xmrig | 5c6c80f3a5477beae31bce203422d19bfaf2a575403f65eb67cf92ce0771bed5

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01-05-2024 23:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
Size

2.1MB
MD5

0cd385aba84b52d8cf1a91ffe304a5e7
SHA1

7956efb35d06c5ad29467f873d07d1893aef72f6
SHA256

5c6c80f3a5477beae31bce203422d19bfaf2a575403f65eb67cf92ce0771bed5
SHA512

4e0c50f463828d329e955f761f466a6a77d9bcee86b20362601715c74dd6004385a973ba0acaf5991cbf8a954722569aa90804d690a4ba3d47ba48cb125c3f46
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrG0:NAB4

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 46 IoCs

miner

resource	yara_rule
behavioral2/memory/1972-206-0x00007FF747A80000-0x00007FF747E72000-memory.dmp	xmrig
behavioral2/memory/392-207-0x00007FF7F1970000-0x00007FF7F1D62000-memory.dmp	xmrig
behavioral2/memory/1176-208-0x00007FF7A7600000-0x00007FF7A79F2000-memory.dmp	xmrig
behavioral2/memory/1728-209-0x00007FF706B00000-0x00007FF706EF2000-memory.dmp	xmrig
behavioral2/memory/2384-211-0x00007FF74FD50000-0x00007FF750142000-memory.dmp	xmrig
behavioral2/memory/4844-212-0x00007FF772E40000-0x00007FF773232000-memory.dmp	xmrig
behavioral2/memory/1004-214-0x00007FF6E0F40000-0x00007FF6E1332000-memory.dmp	xmrig
behavioral2/memory/4820-216-0x00007FF704FA0000-0x00007FF705392000-memory.dmp	xmrig
behavioral2/memory/2748-218-0x00007FF727DC0000-0x00007FF7281B2000-memory.dmp	xmrig
behavioral2/memory/5008-220-0x00007FF756190000-0x00007FF756582000-memory.dmp	xmrig
behavioral2/memory/1408-222-0x00007FF7F7110000-0x00007FF7F7502000-memory.dmp	xmrig
behavioral2/memory/2856-224-0x00007FF6E33E0000-0x00007FF6E37D2000-memory.dmp	xmrig
behavioral2/memory/4628-226-0x00007FF6C6910000-0x00007FF6C6D02000-memory.dmp	xmrig
behavioral2/memory/2148-227-0x00007FF6A2F80000-0x00007FF6A3372000-memory.dmp	xmrig
behavioral2/memory/632-225-0x00007FF672FF0000-0x00007FF6733E2000-memory.dmp	xmrig
behavioral2/memory/4600-223-0x00007FF7DB680000-0x00007FF7DBA72000-memory.dmp	xmrig
behavioral2/memory/1360-221-0x00007FF7EAC80000-0x00007FF7EB072000-memory.dmp	xmrig
behavioral2/memory/4532-219-0x00007FF66AF00000-0x00007FF66B2F2000-memory.dmp	xmrig
behavioral2/memory/872-217-0x00007FF717280000-0x00007FF717672000-memory.dmp	xmrig
behavioral2/memory/2860-215-0x00007FF72AF00000-0x00007FF72B2F2000-memory.dmp	xmrig
behavioral2/memory/3964-213-0x00007FF7C7FB0000-0x00007FF7C83A2000-memory.dmp	xmrig
behavioral2/memory/1584-210-0x00007FF6BE5A0000-0x00007FF6BE992000-memory.dmp	xmrig
behavioral2/memory/2076-172-0x00007FF77FAE0000-0x00007FF77FED2000-memory.dmp	xmrig
behavioral2/memory/3936-3998-0x00007FF7E0FD0000-0x00007FF7E13C2000-memory.dmp	xmrig
behavioral2/memory/1972-4007-0x00007FF747A80000-0x00007FF747E72000-memory.dmp	xmrig
behavioral2/memory/4628-4014-0x00007FF6C6910000-0x00007FF6C6D02000-memory.dmp	xmrig
behavioral2/memory/2076-4013-0x00007FF77FAE0000-0x00007FF77FED2000-memory.dmp	xmrig
behavioral2/memory/2860-4020-0x00007FF72AF00000-0x00007FF72B2F2000-memory.dmp	xmrig
behavioral2/memory/1584-4035-0x00007FF6BE5A0000-0x00007FF6BE992000-memory.dmp	xmrig
behavioral2/memory/1176-4037-0x00007FF7A7600000-0x00007FF7A79F2000-memory.dmp	xmrig
behavioral2/memory/5008-4038-0x00007FF756190000-0x00007FF756582000-memory.dmp	xmrig
behavioral2/memory/4820-4033-0x00007FF704FA0000-0x00007FF705392000-memory.dmp	xmrig
behavioral2/memory/3964-4029-0x00007FF7C7FB0000-0x00007FF7C83A2000-memory.dmp	xmrig
behavioral2/memory/1728-4027-0x00007FF706B00000-0x00007FF706EF2000-memory.dmp	xmrig
behavioral2/memory/4844-4025-0x00007FF772E40000-0x00007FF773232000-memory.dmp	xmrig
behavioral2/memory/2384-4023-0x00007FF74FD50000-0x00007FF750142000-memory.dmp	xmrig
behavioral2/memory/1004-4031-0x00007FF6E0F40000-0x00007FF6E1332000-memory.dmp	xmrig
behavioral2/memory/4600-4059-0x00007FF7DB680000-0x00007FF7DBA72000-memory.dmp	xmrig
behavioral2/memory/2856-4057-0x00007FF6E33E0000-0x00007FF6E37D2000-memory.dmp	xmrig
behavioral2/memory/872-4052-0x00007FF717280000-0x00007FF717672000-memory.dmp	xmrig
behavioral2/memory/1408-4051-0x00007FF7F7110000-0x00007FF7F7502000-memory.dmp	xmrig
behavioral2/memory/1360-4047-0x00007FF7EAC80000-0x00007FF7EB072000-memory.dmp	xmrig
behavioral2/memory/4532-4041-0x00007FF66AF00000-0x00007FF66B2F2000-memory.dmp	xmrig
behavioral2/memory/2148-4049-0x00007FF6A2F80000-0x00007FF6A3372000-memory.dmp	xmrig
behavioral2/memory/2748-4045-0x00007FF727DC0000-0x00007FF7281B2000-memory.dmp	xmrig
behavioral2/memory/1352-4998-0x00007FF74BDC0000-0x00007FF74C1B2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3936	vnBMlIo.exe
632	DOHtGyQ.exe
2076	RJPPnLS.exe
1972	lZepYNd.exe
392	TyEQKTr.exe
4628	SFKZhfR.exe
1176	hdaqnsE.exe
1728	nxtzqUa.exe
1584	mvMompQ.exe
2384	NNCMMWP.exe
4844	bsJbaHi.exe
3964	sUMYsTJ.exe
1004	GyNfexH.exe
2860	FLpHCPa.exe
4820	ZrEdxJQ.exe
2148	hXAczQZ.exe
872	OOjQgwi.exe
2748	kkmwcom.exe
4532	DkSHmBp.exe
5008	UzOvrcL.exe
1360	twvpRim.exe
1408	AKOlsYE.exe
4600	LoSqcJB.exe
2856	TCrIeki.exe
1436	xvHkznF.exe
5052	tyQkvSg.exe
4808	uZpmWjn.exe
916	dywVrrX.exe
5108	qtHqExi.exe
1232	PGotICc.exe
2876	zmnaBYH.exe
2976	VQPzkub.exe
4980	btCmzzO.exe
3580	rikcBCL.exe
2632	nKdCLKx.exe
4380	fvRBvVH.exe
4364	jyMOqty.exe
3272	QRGeDre.exe
1488	FTFYHPw.exe
4644	JIOPDlE.exe
3292	IpvPxPP.exe
1676	yjAnAHw.exe
1684	ILBsiWo.exe
60	GWEYKaC.exe
2604	VkIbPni.exe
2028	MZfNrIn.exe
3948	kmQmVIn.exe
3476	YikxpJz.exe
4648	DGOJSAU.exe
1904	ZVMYUjw.exe
1448	eErdYUL.exe
2088	fTRPlhk.exe
2172	pNALPdn.exe
1788	YjajKKM.exe
428	PYtctIU.exe
888	qtvsYGx.exe
3572	hobUBbu.exe
1920	hTcHhlJ.exe
1280	KZquBuR.exe
4964	LnUZrOJ.exe
1912	pDZBBTs.exe
2144	bWgJTrw.exe
2520	MxhlkMt.exe
4052	ebWfJIK.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1352-0-0x00007FF74BDC0000-0x00007FF74C1B2000-memory.dmp	upx
behavioral2/files/0x000c000000023b7a-5.dat	upx
behavioral2/files/0x000a000000023b90-20.dat	upx
behavioral2/files/0x000a000000023b92-31.dat	upx
behavioral2/files/0x000a000000023b97-47.dat	upx
behavioral2/files/0x000a000000023ba1-88.dat	upx
behavioral2/files/0x000a000000023ba4-104.dat	upx
behavioral2/files/0x000a000000023ba0-157.dat	upx
behavioral2/files/0x000a000000023b9f-154.dat	upx
behavioral2/files/0x000a000000023baa-153.dat	upx
behavioral2/files/0x000c000000023b88-152.dat	upx
behavioral2/files/0x000a000000023b9e-143.dat	upx
behavioral2/files/0x000a000000023ba7-139.dat	upx
behavioral2/files/0x000a000000023ba2-136.dat	upx
behavioral2/files/0x000a000000023b9c-115.dat	upx
behavioral2/files/0x000a000000023ba3-102.dat	upx
behavioral2/files/0x000a000000023ba9-149.dat	upx
behavioral2/files/0x000a000000023b98-97.dat	upx
behavioral2/files/0x000a000000023b9d-94.dat	upx
behavioral2/files/0x000a000000023b96-89.dat	upx
behavioral2/files/0x000a000000023b95-85.dat	upx
behavioral2/files/0x000a000000023b9b-81.dat	upx
behavioral2/files/0x000a000000023b99-73.dat	upx
behavioral2/files/0x000a000000023b9a-78.dat	upx
behavioral2/files/0x000a000000023b94-50.dat	upx
behavioral2/files/0x000a000000023b93-37.dat	upx
behavioral2/memory/3936-16-0x00007FF7E0FD0000-0x00007FF7E13C2000-memory.dmp	upx
behavioral2/files/0x000a000000023b91-14.dat	upx
behavioral2/files/0x000a000000023bbb-198.dat	upx
behavioral2/memory/1972-206-0x00007FF747A80000-0x00007FF747E72000-memory.dmp	upx
behavioral2/memory/392-207-0x00007FF7F1970000-0x00007FF7F1D62000-memory.dmp	upx
behavioral2/memory/1176-208-0x00007FF7A7600000-0x00007FF7A79F2000-memory.dmp	upx
behavioral2/memory/1728-209-0x00007FF706B00000-0x00007FF706EF2000-memory.dmp	upx
behavioral2/memory/2384-211-0x00007FF74FD50000-0x00007FF750142000-memory.dmp	upx
behavioral2/memory/4844-212-0x00007FF772E40000-0x00007FF773232000-memory.dmp	upx
behavioral2/memory/1004-214-0x00007FF6E0F40000-0x00007FF6E1332000-memory.dmp	upx
behavioral2/memory/4820-216-0x00007FF704FA0000-0x00007FF705392000-memory.dmp	upx
behavioral2/memory/2748-218-0x00007FF727DC0000-0x00007FF7281B2000-memory.dmp	upx
behavioral2/memory/5008-220-0x00007FF756190000-0x00007FF756582000-memory.dmp	upx
behavioral2/memory/1408-222-0x00007FF7F7110000-0x00007FF7F7502000-memory.dmp	upx
behavioral2/memory/2856-224-0x00007FF6E33E0000-0x00007FF6E37D2000-memory.dmp	upx
behavioral2/memory/4628-226-0x00007FF6C6910000-0x00007FF6C6D02000-memory.dmp	upx
behavioral2/memory/2148-227-0x00007FF6A2F80000-0x00007FF6A3372000-memory.dmp	upx
behavioral2/memory/632-225-0x00007FF672FF0000-0x00007FF6733E2000-memory.dmp	upx
behavioral2/memory/4600-223-0x00007FF7DB680000-0x00007FF7DBA72000-memory.dmp	upx
behavioral2/memory/1360-221-0x00007FF7EAC80000-0x00007FF7EB072000-memory.dmp	upx
behavioral2/memory/4532-219-0x00007FF66AF00000-0x00007FF66B2F2000-memory.dmp	upx
behavioral2/memory/872-217-0x00007FF717280000-0x00007FF717672000-memory.dmp	upx
behavioral2/memory/2860-215-0x00007FF72AF00000-0x00007FF72B2F2000-memory.dmp	upx
behavioral2/memory/3964-213-0x00007FF7C7FB0000-0x00007FF7C83A2000-memory.dmp	upx
behavioral2/memory/1584-210-0x00007FF6BE5A0000-0x00007FF6BE992000-memory.dmp	upx
behavioral2/files/0x000a000000023bba-197.dat	upx
behavioral2/files/0x000a000000023bb9-196.dat	upx
behavioral2/files/0x000a000000023bb8-195.dat	upx
behavioral2/files/0x000a000000023bb7-194.dat	upx
behavioral2/files/0x000a000000023bb6-193.dat	upx
behavioral2/files/0x000a000000023ba8-192.dat	upx
behavioral2/files/0x000a000000023bb3-178.dat	upx
behavioral2/files/0x000a000000023bb1-177.dat	upx
behavioral2/files/0x000a000000023bae-175.dat	upx
behavioral2/files/0x000a000000023ba6-174.dat	upx
behavioral2/memory/2076-172-0x00007FF77FAE0000-0x00007FF77FED2000-memory.dmp	upx
behavioral2/files/0x000a000000023bad-171.dat	upx
behavioral2/files/0x000a000000023bac-170.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\jwTAyoq.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\YhNdCJq.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\Xdtsish.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\UuzdMDx.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\tAWPRkd.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\ytMYSFh.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\vIdnoGq.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\sNSTqcM.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\zLixHME.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\nLcHzJx.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\yPjfdkA.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\QWESVid.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\YrfxjeM.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\RWjCfZx.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\RDwmrHg.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\XYgVOKt.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\dWnpopR.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\kziEHJK.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\HsoXSwG.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\nDTgqgG.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\dJcJYno.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\jjpqzof.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\FBcqoMg.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\noIJIvP.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\QvsGoND.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\vVzyDKb.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\bfooNvD.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\aRAblcy.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\dUPwwhd.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\GjgmigK.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\rPRfUDR.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\gWrgnOB.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\QIyvpqo.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\ypwPSHo.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\yvondtD.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\kZaKNBV.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\xNNUHrs.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\IJfTuqc.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\iGMRvMJ.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\nnecYYM.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\MUBVILD.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\CbBXTaV.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\gnchYvW.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\aaEJiEQ.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\LujuVQA.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\igaXkrh.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\kDuxaSg.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\LsbwTYp.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\mnbkUoJ.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\WJEceel.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\hDMygxg.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\nwdIKKX.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\TdaaEep.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\MRuhFPS.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\uNzDGHr.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\hNRrRik.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\uYzuqsb.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\CgFYVEf.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\iWcUOBR.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\NVvbxRL.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\nZcgaKn.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\acRWCuj.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\pHwKvyv.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\FdgaDIn.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
116	powershell.exe
116	powershell.exe
116	powershell.exe
116	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	116	powershell.exe
Token: SeLockMemoryPrivilege	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 116	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	86
PID 1352 wrote to memory of 116	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	86
PID 1352 wrote to memory of 3936	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	87
PID 1352 wrote to memory of 3936	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	87
PID 1352 wrote to memory of 1972	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	88
PID 1352 wrote to memory of 1972	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	88
PID 1352 wrote to memory of 632	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	89
PID 1352 wrote to memory of 632	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	89
PID 1352 wrote to memory of 2076	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	90
PID 1352 wrote to memory of 2076	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	90
PID 1352 wrote to memory of 392	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	91
PID 1352 wrote to memory of 392	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	91
PID 1352 wrote to memory of 4628	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	92
PID 1352 wrote to memory of 4628	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	92
PID 1352 wrote to memory of 1176	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	93
PID 1352 wrote to memory of 1176	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	93
PID 1352 wrote to memory of 1004	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	94
PID 1352 wrote to memory of 1004	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	94
PID 1352 wrote to memory of 1728	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	95
PID 1352 wrote to memory of 1728	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	95
PID 1352 wrote to memory of 1584	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	96
PID 1352 wrote to memory of 1584	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	96
PID 1352 wrote to memory of 2384	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	97
PID 1352 wrote to memory of 2384	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	97
PID 1352 wrote to memory of 4844	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	98
PID 1352 wrote to memory of 4844	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	98
PID 1352 wrote to memory of 3964	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	99
PID 1352 wrote to memory of 3964	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	99
PID 1352 wrote to memory of 2860	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	100
PID 1352 wrote to memory of 2860	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	100
PID 1352 wrote to memory of 4820	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	101
PID 1352 wrote to memory of 4820	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	101
PID 1352 wrote to memory of 2148	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	102
PID 1352 wrote to memory of 2148	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	102
PID 1352 wrote to memory of 872	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	103
PID 1352 wrote to memory of 872	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	103
PID 1352 wrote to memory of 2748	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	104
PID 1352 wrote to memory of 2748	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	104
PID 1352 wrote to memory of 4532	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	105
PID 1352 wrote to memory of 4532	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	105
PID 1352 wrote to memory of 5008	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	106
PID 1352 wrote to memory of 5008	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	106
PID 1352 wrote to memory of 1360	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	107
PID 1352 wrote to memory of 1360	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	107
PID 1352 wrote to memory of 1408	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	108
PID 1352 wrote to memory of 1408	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	108
PID 1352 wrote to memory of 916	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	109
PID 1352 wrote to memory of 916	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	109
PID 1352 wrote to memory of 2876	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	110
PID 1352 wrote to memory of 2876	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	110
PID 1352 wrote to memory of 4600	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	111
PID 1352 wrote to memory of 4600	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	111
PID 1352 wrote to memory of 2632	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	112
PID 1352 wrote to memory of 2632	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	112
PID 1352 wrote to memory of 2856	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	113
PID 1352 wrote to memory of 2856	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	113
PID 1352 wrote to memory of 1436	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	114
PID 1352 wrote to memory of 1436	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	114
PID 1352 wrote to memory of 5052	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	115
PID 1352 wrote to memory of 5052	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	115
PID 1352 wrote to memory of 4808	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	116
PID 1352 wrote to memory of 4808	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	116
PID 1352 wrote to memory of 5108	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	117
PID 1352 wrote to memory of 5108	1352	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	117

C:\Users\Admin\AppData\Local\Temp\0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:116
- C:\Windows\System\vnBMlIo.exe
  C:\Windows\System\vnBMlIo.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System\lZepYNd.exe
  C:\Windows\System\lZepYNd.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\DOHtGyQ.exe
  C:\Windows\System\DOHtGyQ.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\RJPPnLS.exe
  C:\Windows\System\RJPPnLS.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\TyEQKTr.exe
  C:\Windows\System\TyEQKTr.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\SFKZhfR.exe
  C:\Windows\System\SFKZhfR.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\hdaqnsE.exe
  C:\Windows\System\hdaqnsE.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\GyNfexH.exe
  C:\Windows\System\GyNfexH.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\nxtzqUa.exe
  C:\Windows\System\nxtzqUa.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\mvMompQ.exe
  C:\Windows\System\mvMompQ.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\NNCMMWP.exe
  C:\Windows\System\NNCMMWP.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\bsJbaHi.exe
  C:\Windows\System\bsJbaHi.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\sUMYsTJ.exe
  C:\Windows\System\sUMYsTJ.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\FLpHCPa.exe
  C:\Windows\System\FLpHCPa.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\ZrEdxJQ.exe
  C:\Windows\System\ZrEdxJQ.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\hXAczQZ.exe
  C:\Windows\System\hXAczQZ.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\OOjQgwi.exe
  C:\Windows\System\OOjQgwi.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\kkmwcom.exe
  C:\Windows\System\kkmwcom.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\DkSHmBp.exe
  C:\Windows\System\DkSHmBp.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\UzOvrcL.exe
  C:\Windows\System\UzOvrcL.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\twvpRim.exe
  C:\Windows\System\twvpRim.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\AKOlsYE.exe
  C:\Windows\System\AKOlsYE.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\dywVrrX.exe
  C:\Windows\System\dywVrrX.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\zmnaBYH.exe
  C:\Windows\System\zmnaBYH.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\LoSqcJB.exe
  C:\Windows\System\LoSqcJB.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\nKdCLKx.exe
  C:\Windows\System\nKdCLKx.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\TCrIeki.exe
  C:\Windows\System\TCrIeki.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\xvHkznF.exe
  C:\Windows\System\xvHkznF.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\tyQkvSg.exe
  C:\Windows\System\tyQkvSg.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\uZpmWjn.exe
  C:\Windows\System\uZpmWjn.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\qtHqExi.exe
  C:\Windows\System\qtHqExi.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\PGotICc.exe
  C:\Windows\System\PGotICc.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\VQPzkub.exe
  C:\Windows\System\VQPzkub.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\btCmzzO.exe
  C:\Windows\System\btCmzzO.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\yjAnAHw.exe
  C:\Windows\System\yjAnAHw.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\rikcBCL.exe
  C:\Windows\System\rikcBCL.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\GWEYKaC.exe
  C:\Windows\System\GWEYKaC.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\VkIbPni.exe
  C:\Windows\System\VkIbPni.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\fvRBvVH.exe
  C:\Windows\System\fvRBvVH.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\jyMOqty.exe
  C:\Windows\System\jyMOqty.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\QRGeDre.exe
  C:\Windows\System\QRGeDre.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\FTFYHPw.exe
  C:\Windows\System\FTFYHPw.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\JIOPDlE.exe
  C:\Windows\System\JIOPDlE.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\IpvPxPP.exe
  C:\Windows\System\IpvPxPP.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\ILBsiWo.exe
  C:\Windows\System\ILBsiWo.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\MZfNrIn.exe
  C:\Windows\System\MZfNrIn.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\kmQmVIn.exe
  C:\Windows\System\kmQmVIn.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\YikxpJz.exe
  C:\Windows\System\YikxpJz.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\DGOJSAU.exe
  C:\Windows\System\DGOJSAU.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\ZVMYUjw.exe
  C:\Windows\System\ZVMYUjw.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\eErdYUL.exe
  C:\Windows\System\eErdYUL.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\fTRPlhk.exe
  C:\Windows\System\fTRPlhk.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\pNALPdn.exe
  C:\Windows\System\pNALPdn.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\pDZBBTs.exe
  C:\Windows\System\pDZBBTs.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\YjajKKM.exe
  C:\Windows\System\YjajKKM.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\PYtctIU.exe
  C:\Windows\System\PYtctIU.exe
  2⤵
  - Executes dropped EXE
  PID:428
- C:\Windows\System\MxhlkMt.exe
  C:\Windows\System\MxhlkMt.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\ebWfJIK.exe
  C:\Windows\System\ebWfJIK.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\qtvsYGx.exe
  C:\Windows\System\qtvsYGx.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\hobUBbu.exe
  C:\Windows\System\hobUBbu.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\hTcHhlJ.exe
  C:\Windows\System\hTcHhlJ.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\KZquBuR.exe
  C:\Windows\System\KZquBuR.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\LnUZrOJ.exe
  C:\Windows\System\LnUZrOJ.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\bWgJTrw.exe
  C:\Windows\System\bWgJTrw.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\LIwiDOZ.exe
  C:\Windows\System\LIwiDOZ.exe
  2⤵
  PID:4144
- C:\Windows\System\tpcuwEK.exe
  C:\Windows\System\tpcuwEK.exe
  2⤵
  PID:2660
- C:\Windows\System\JhUbaQw.exe
  C:\Windows\System\JhUbaQw.exe
  2⤵
  PID:4116
- C:\Windows\System\dNUefIb.exe
  C:\Windows\System\dNUefIb.exe
  2⤵
  PID:4060
- C:\Windows\System\oELCqrv.exe
  C:\Windows\System\oELCqrv.exe
  2⤵
  PID:4196
- C:\Windows\System\CVtBQci.exe
  C:\Windows\System\CVtBQci.exe
  2⤵
  PID:1612
- C:\Windows\System\nWmgzFZ.exe
  C:\Windows\System\nWmgzFZ.exe
  2⤵
  PID:3184
- C:\Windows\System\GRVytJb.exe
  C:\Windows\System\GRVytJb.exe
  2⤵
  PID:3148
- C:\Windows\System\tFyuUYH.exe
  C:\Windows\System\tFyuUYH.exe
  2⤵
  PID:4100
- C:\Windows\System\hpbjmRI.exe
  C:\Windows\System\hpbjmRI.exe
  2⤵
  PID:4360
- C:\Windows\System\IuVvNJM.exe
  C:\Windows\System\IuVvNJM.exe
  2⤵
  PID:4676
- C:\Windows\System\LHDOqiW.exe
  C:\Windows\System\LHDOqiW.exe
  2⤵
  PID:3752
- C:\Windows\System\EDtmETI.exe
  C:\Windows\System\EDtmETI.exe
  2⤵
  PID:2460
- C:\Windows\System\nFgnIWL.exe
  C:\Windows\System\nFgnIWL.exe
  2⤵
  PID:2192
- C:\Windows\System\cREZWiM.exe
  C:\Windows\System\cREZWiM.exe
  2⤵
  PID:4712
- C:\Windows\System\ImAahGI.exe
  C:\Windows\System\ImAahGI.exe
  2⤵
  PID:4904
- C:\Windows\System\iGRYnPj.exe
  C:\Windows\System\iGRYnPj.exe
  2⤵
  PID:4236
- C:\Windows\System\clUperj.exe
  C:\Windows\System\clUperj.exe
  2⤵
  PID:3204
- C:\Windows\System\faVPVJA.exe
  C:\Windows\System\faVPVJA.exe
  2⤵
  PID:3308
- C:\Windows\System\aTFRVgj.exe
  C:\Windows\System\aTFRVgj.exe
  2⤵
  PID:1956
- C:\Windows\System\JrNVGYR.exe
  C:\Windows\System\JrNVGYR.exe
  2⤵
  PID:4696
- C:\Windows\System\gYgfAfJ.exe
  C:\Windows\System\gYgfAfJ.exe
  2⤵
  PID:4468
- C:\Windows\System\PPMeBSd.exe
  C:\Windows\System\PPMeBSd.exe
  2⤵
  PID:5128
- C:\Windows\System\kKLlNHQ.exe
  C:\Windows\System\kKLlNHQ.exe
  2⤵
  PID:5152
- C:\Windows\System\fItTkDw.exe
  C:\Windows\System\fItTkDw.exe
  2⤵
  PID:5180
- C:\Windows\System\ErJlRcW.exe
  C:\Windows\System\ErJlRcW.exe
  2⤵
  PID:5200
- C:\Windows\System\DuzYtUp.exe
  C:\Windows\System\DuzYtUp.exe
  2⤵
  PID:5252
- C:\Windows\System\yxuZtoK.exe
  C:\Windows\System\yxuZtoK.exe
  2⤵
  PID:5276
- C:\Windows\System\KmZOZas.exe
  C:\Windows\System\KmZOZas.exe
  2⤵
  PID:5304
- C:\Windows\System\FHRcaUZ.exe
  C:\Windows\System\FHRcaUZ.exe
  2⤵
  PID:5348
- C:\Windows\System\kujEiPK.exe
  C:\Windows\System\kujEiPK.exe
  2⤵
  PID:5368
- C:\Windows\System\eCDqSXD.exe
  C:\Windows\System\eCDqSXD.exe
  2⤵
  PID:5392
- C:\Windows\System\wJoOCdS.exe
  C:\Windows\System\wJoOCdS.exe
  2⤵
  PID:5412
- C:\Windows\System\KFiNscG.exe
  C:\Windows\System\KFiNscG.exe
  2⤵
  PID:5432
- C:\Windows\System\IvTqgrQ.exe
  C:\Windows\System\IvTqgrQ.exe
  2⤵
  PID:5456
- C:\Windows\System\OeLkwsH.exe
  C:\Windows\System\OeLkwsH.exe
  2⤵
  PID:5480
- C:\Windows\System\FOgpCpu.exe
  C:\Windows\System\FOgpCpu.exe
  2⤵
  PID:5520
- C:\Windows\System\fAMsaFl.exe
  C:\Windows\System\fAMsaFl.exe
  2⤵
  PID:5548
- C:\Windows\System\lZsSxMN.exe
  C:\Windows\System\lZsSxMN.exe
  2⤵
  PID:5564
- C:\Windows\System\zePPyhu.exe
  C:\Windows\System\zePPyhu.exe
  2⤵
  PID:5588
- C:\Windows\System\XLHPeaw.exe
  C:\Windows\System\XLHPeaw.exe
  2⤵
  PID:5616
- C:\Windows\System\SgMOyHM.exe
  C:\Windows\System\SgMOyHM.exe
  2⤵
  PID:5632
- C:\Windows\System\NAOFOHy.exe
  C:\Windows\System\NAOFOHy.exe
  2⤵
  PID:5648
- C:\Windows\System\diQAHdj.exe
  C:\Windows\System\diQAHdj.exe
  2⤵
  PID:5668
- C:\Windows\System\YLYbHXv.exe
  C:\Windows\System\YLYbHXv.exe
  2⤵
  PID:5688
- C:\Windows\System\uYePOps.exe
  C:\Windows\System\uYePOps.exe
  2⤵
  PID:5716
- C:\Windows\System\RMlueZt.exe
  C:\Windows\System\RMlueZt.exe
  2⤵
  PID:5740
- C:\Windows\System\pXYnifT.exe
  C:\Windows\System\pXYnifT.exe
  2⤵
  PID:5764
- C:\Windows\System\eSilhgL.exe
  C:\Windows\System\eSilhgL.exe
  2⤵
  PID:5780
- C:\Windows\System\abRHWXA.exe
  C:\Windows\System\abRHWXA.exe
  2⤵
  PID:5804
- C:\Windows\System\DLYagSC.exe
  C:\Windows\System\DLYagSC.exe
  2⤵
  PID:5832
- C:\Windows\System\wTCJLSS.exe
  C:\Windows\System\wTCJLSS.exe
  2⤵
  PID:5860
- C:\Windows\System\XaDfCDL.exe
  C:\Windows\System\XaDfCDL.exe
  2⤵
  PID:5876
- C:\Windows\System\YRELpOz.exe
  C:\Windows\System\YRELpOz.exe
  2⤵
  PID:5908
- C:\Windows\System\jKKlJLX.exe
  C:\Windows\System\jKKlJLX.exe
  2⤵
  PID:5940
- C:\Windows\System\wlgBaVw.exe
  C:\Windows\System\wlgBaVw.exe
  2⤵
  PID:5960
- C:\Windows\System\hHzguVA.exe
  C:\Windows\System\hHzguVA.exe
  2⤵
  PID:5976
- C:\Windows\System\Rqmaxhl.exe
  C:\Windows\System\Rqmaxhl.exe
  2⤵
  PID:6004
- C:\Windows\System\gnbvSSt.exe
  C:\Windows\System\gnbvSSt.exe
  2⤵
  PID:6024
- C:\Windows\System\sYUvBHj.exe
  C:\Windows\System\sYUvBHj.exe
  2⤵
  PID:6052
- C:\Windows\System\ukDxnLI.exe
  C:\Windows\System\ukDxnLI.exe
  2⤵
  PID:6076
- C:\Windows\System\WJGeyxf.exe
  C:\Windows\System\WJGeyxf.exe
  2⤵
  PID:6112
- C:\Windows\System\lkJGNtb.exe
  C:\Windows\System\lkJGNtb.exe
  2⤵
  PID:6136
- C:\Windows\System\owwtAgA.exe
  C:\Windows\System\owwtAgA.exe
  2⤵
  PID:2064
- C:\Windows\System\QIONNQz.exe
  C:\Windows\System\QIONNQz.exe
  2⤵
  PID:3552
- C:\Windows\System\IOnSdKt.exe
  C:\Windows\System\IOnSdKt.exe
  2⤵
  PID:3412
- C:\Windows\System\SupQvJv.exe
  C:\Windows\System\SupQvJv.exe
  2⤵
  PID:1412
- C:\Windows\System\KYgyCLS.exe
  C:\Windows\System\KYgyCLS.exe
  2⤵
  PID:3744
- C:\Windows\System\VIvGEZl.exe
  C:\Windows\System\VIvGEZl.exe
  2⤵
  PID:5248
- C:\Windows\System\kAGCHvf.exe
  C:\Windows\System\kAGCHvf.exe
  2⤵
  PID:836
- C:\Windows\System\BSQyCOX.exe
  C:\Windows\System\BSQyCOX.exe
  2⤵
  PID:2448
- C:\Windows\System\eNywpDq.exe
  C:\Windows\System\eNywpDq.exe
  2⤵
  PID:5388
- C:\Windows\System\aULZFBO.exe
  C:\Windows\System\aULZFBO.exe
  2⤵
  PID:5444
- C:\Windows\System\rgKUDFG.exe
  C:\Windows\System\rgKUDFG.exe
  2⤵
  PID:5136
- C:\Windows\System\WkxkHjX.exe
  C:\Windows\System\WkxkHjX.exe
  2⤵
  PID:5324
- C:\Windows\System\xNjBOvX.exe
  C:\Windows\System\xNjBOvX.exe
  2⤵
  PID:5196
- C:\Windows\System\ULmneyp.exe
  C:\Windows\System\ULmneyp.exe
  2⤵
  PID:5680
- C:\Windows\System\yubHNeg.exe
  C:\Windows\System\yubHNeg.exe
  2⤵
  PID:5468
- C:\Windows\System\nyfOnwE.exe
  C:\Windows\System\nyfOnwE.exe
  2⤵
  PID:5404
- C:\Windows\System\SupLEjy.exe
  C:\Windows\System\SupLEjy.exe
  2⤵
  PID:5476
- C:\Windows\System\IlzIWjM.exe
  C:\Windows\System\IlzIWjM.exe
  2⤵
  PID:5760
- C:\Windows\System\lPzlVBL.exe
  C:\Windows\System\lPzlVBL.exe
  2⤵
  PID:5812
- C:\Windows\System\kqVthUx.exe
  C:\Windows\System\kqVthUx.exe
  2⤵
  PID:5556
- C:\Windows\System\aHjQzOD.exe
  C:\Windows\System\aHjQzOD.exe
  2⤵
  PID:5600
- C:\Windows\System\KjdIsuH.exe
  C:\Windows\System\KjdIsuH.exe
  2⤵
  PID:5644
- C:\Windows\System\aGRNwbm.exe
  C:\Windows\System\aGRNwbm.exe
  2⤵
  PID:6016
- C:\Windows\System\bjjaHmw.exe
  C:\Windows\System\bjjaHmw.exe
  2⤵
  PID:2956
- C:\Windows\System\QIgKfpY.exe
  C:\Windows\System\QIgKfpY.exe
  2⤵
  PID:3724
- C:\Windows\System\NnSFDrT.exe
  C:\Windows\System\NnSFDrT.exe
  2⤵
  PID:2888
- C:\Windows\System\IsSXFUy.exe
  C:\Windows\System\IsSXFUy.exe
  2⤵
  PID:6164
- C:\Windows\System\bqAOpby.exe
  C:\Windows\System\bqAOpby.exe
  2⤵
  PID:6184
- C:\Windows\System\lnKaazQ.exe
  C:\Windows\System\lnKaazQ.exe
  2⤵
  PID:6204
- C:\Windows\System\LIOxUUu.exe
  C:\Windows\System\LIOxUUu.exe
  2⤵
  PID:6236
- C:\Windows\System\eTdORaX.exe
  C:\Windows\System\eTdORaX.exe
  2⤵
  PID:6260
- C:\Windows\System\UStFETr.exe
  C:\Windows\System\UStFETr.exe
  2⤵
  PID:6284
- C:\Windows\System\MSXGiHs.exe
  C:\Windows\System\MSXGiHs.exe
  2⤵
  PID:6304
- C:\Windows\System\gNfljIK.exe
  C:\Windows\System\gNfljIK.exe
  2⤵
  PID:6320
- C:\Windows\System\arHyfPo.exe
  C:\Windows\System\arHyfPo.exe
  2⤵
  PID:6348
- C:\Windows\System\JofYKma.exe
  C:\Windows\System\JofYKma.exe
  2⤵
  PID:6368
- C:\Windows\System\yAAzveE.exe
  C:\Windows\System\yAAzveE.exe
  2⤵
  PID:6388
- C:\Windows\System\HREASEi.exe
  C:\Windows\System\HREASEi.exe
  2⤵
  PID:6416
- C:\Windows\System\UOutFtp.exe
  C:\Windows\System\UOutFtp.exe
  2⤵
  PID:6432
- C:\Windows\System\EPByyQD.exe
  C:\Windows\System\EPByyQD.exe
  2⤵
  PID:6452
- C:\Windows\System\LrSSLdg.exe
  C:\Windows\System\LrSSLdg.exe
  2⤵
  PID:6472
- C:\Windows\System\pYucJuX.exe
  C:\Windows\System\pYucJuX.exe
  2⤵
  PID:6492
- C:\Windows\System\eCUKevk.exe
  C:\Windows\System\eCUKevk.exe
  2⤵
  PID:6512
- C:\Windows\System\hYiqzlD.exe
  C:\Windows\System\hYiqzlD.exe
  2⤵
  PID:6540
- C:\Windows\System\vFsFcgc.exe
  C:\Windows\System\vFsFcgc.exe
  2⤵
  PID:6556
- C:\Windows\System\cUcwisz.exe
  C:\Windows\System\cUcwisz.exe
  2⤵
  PID:6580
- C:\Windows\System\TDoBlEV.exe
  C:\Windows\System\TDoBlEV.exe
  2⤵
  PID:6604
- C:\Windows\System\vtpzKIk.exe
  C:\Windows\System\vtpzKIk.exe
  2⤵
  PID:6632
- C:\Windows\System\tGCTYDK.exe
  C:\Windows\System\tGCTYDK.exe
  2⤵
  PID:6652
- C:\Windows\System\ToxpMtb.exe
  C:\Windows\System\ToxpMtb.exe
  2⤵
  PID:6676
- C:\Windows\System\eOKzuvX.exe
  C:\Windows\System\eOKzuvX.exe
  2⤵
  PID:6696
- C:\Windows\System\vrOFFOi.exe
  C:\Windows\System\vrOFFOi.exe
  2⤵
  PID:6724
- C:\Windows\System\yrJoBwl.exe
  C:\Windows\System\yrJoBwl.exe
  2⤵
  PID:6744
- C:\Windows\System\JQPNHdm.exe
  C:\Windows\System\JQPNHdm.exe
  2⤵
  PID:6772
- C:\Windows\System\ZHKRxqL.exe
  C:\Windows\System\ZHKRxqL.exe
  2⤵
  PID:6788
- C:\Windows\System\EfUYxyW.exe
  C:\Windows\System\EfUYxyW.exe
  2⤵
  PID:6820
- C:\Windows\System\JrnfNIv.exe
  C:\Windows\System\JrnfNIv.exe
  2⤵
  PID:6836
- C:\Windows\System\fsXsmEM.exe
  C:\Windows\System\fsXsmEM.exe
  2⤵
  PID:6864
- C:\Windows\System\PuvHUBe.exe
  C:\Windows\System\PuvHUBe.exe
  2⤵
  PID:6888
- C:\Windows\System\WSooBdo.exe
  C:\Windows\System\WSooBdo.exe
  2⤵
  PID:6904
- C:\Windows\System\IIoaRkN.exe
  C:\Windows\System\IIoaRkN.exe
  2⤵
  PID:6928
- C:\Windows\System\niPywHq.exe
  C:\Windows\System\niPywHq.exe
  2⤵
  PID:6952
- C:\Windows\System\oHteDeO.exe
  C:\Windows\System\oHteDeO.exe
  2⤵
  PID:6976
- C:\Windows\System\UbwMCly.exe
  C:\Windows\System\UbwMCly.exe
  2⤵
  PID:7004
- C:\Windows\System\IvgPXzb.exe
  C:\Windows\System\IvgPXzb.exe
  2⤵
  PID:7032
- C:\Windows\System\fbfciVx.exe
  C:\Windows\System\fbfciVx.exe
  2⤵
  PID:7052
- C:\Windows\System\fsCoVrm.exe
  C:\Windows\System\fsCoVrm.exe
  2⤵
  PID:7076
- C:\Windows\System\TTTSNZY.exe
  C:\Windows\System\TTTSNZY.exe
  2⤵
  PID:7096
- C:\Windows\System\tejpIGh.exe
  C:\Windows\System\tejpIGh.exe
  2⤵
  PID:7116
- C:\Windows\System\VwkosvJ.exe
  C:\Windows\System\VwkosvJ.exe
  2⤵
  PID:7144
- C:\Windows\System\DiJPKXl.exe
  C:\Windows\System\DiJPKXl.exe
  2⤵
  PID:7164
- C:\Windows\System\WdpltZd.exe
  C:\Windows\System\WdpltZd.exe
  2⤵
  PID:5888
- C:\Windows\System\ZHzIMsU.exe
  C:\Windows\System\ZHzIMsU.exe
  2⤵
  PID:5928
- C:\Windows\System\gTmoakd.exe
  C:\Windows\System\gTmoakd.exe
  2⤵
  PID:5968
- C:\Windows\System\mpSEuoy.exe
  C:\Windows\System\mpSEuoy.exe
  2⤵
  PID:6120
- C:\Windows\System\UQdEOpR.exe
  C:\Windows\System\UQdEOpR.exe
  2⤵
  PID:5192
- C:\Windows\System\gOyEVss.exe
  C:\Windows\System\gOyEVss.exe
  2⤵
  PID:2980
- C:\Windows\System\YdkBWoJ.exe
  C:\Windows\System\YdkBWoJ.exe
  2⤵
  PID:2688
- C:\Windows\System\nygEura.exe
  C:\Windows\System\nygEura.exe
  2⤵
  PID:2932
- C:\Windows\System\RjMyHvN.exe
  C:\Windows\System\RjMyHvN.exe
  2⤵
  PID:5020
- C:\Windows\System\prbeBUK.exe
  C:\Windows\System\prbeBUK.exe
  2⤵
  PID:5004
- C:\Windows\System\vfDccZL.exe
  C:\Windows\System\vfDccZL.exe
  2⤵
  PID:6176
- C:\Windows\System\lyCqyKV.exe
  C:\Windows\System\lyCqyKV.exe
  2⤵
  PID:6228
- C:\Windows\System\ArxhkGB.exe
  C:\Windows\System\ArxhkGB.exe
  2⤵
  PID:5284
- C:\Windows\System\UurmUNw.exe
  C:\Windows\System\UurmUNw.exe
  2⤵
  PID:6412
- C:\Windows\System\KvdFcHT.exe
  C:\Windows\System\KvdFcHT.exe
  2⤵
  PID:6468
- C:\Windows\System\GvkLcUt.exe
  C:\Windows\System\GvkLcUt.exe
  2⤵
  PID:5820
- C:\Windows\System\hicyELk.exe
  C:\Windows\System\hicyELk.exe
  2⤵
  PID:5788
- C:\Windows\System\dLZCXey.exe
  C:\Windows\System\dLZCXey.exe
  2⤵
  PID:5628
- C:\Windows\System\stOqxEj.exe
  C:\Windows\System\stOqxEj.exe
  2⤵
  PID:6660
- C:\Windows\System\VvPDaEk.exe
  C:\Windows\System\VvPDaEk.exe
  2⤵
  PID:6704
- C:\Windows\System\DspmnSy.exe
  C:\Windows\System\DspmnSy.exe
  2⤵
  PID:6180
- C:\Windows\System\OzabkTe.exe
  C:\Windows\System\OzabkTe.exe
  2⤵
  PID:1632
- C:\Windows\System\sjtbxmz.exe
  C:\Windows\System\sjtbxmz.exe
  2⤵
  PID:6848
- C:\Windows\System\NLOFPyX.exe
  C:\Windows\System\NLOFPyX.exe
  2⤵
  PID:6900
- C:\Windows\System\CKevhXJ.exe
  C:\Windows\System\CKevhXJ.exe
  2⤵
  PID:6944
- C:\Windows\System\GMQLPWs.exe
  C:\Windows\System\GMQLPWs.exe
  2⤵
  PID:1824
- C:\Windows\System\mUdoZZn.exe
  C:\Windows\System\mUdoZZn.exe
  2⤵
  PID:5776
- C:\Windows\System\VVkpHuh.exe
  C:\Windows\System\VVkpHuh.exe
  2⤵
  PID:7184
- C:\Windows\System\WyTYZPb.exe
  C:\Windows\System\WyTYZPb.exe
  2⤵
  PID:7200
- C:\Windows\System\MycriDt.exe
  C:\Windows\System\MycriDt.exe
  2⤵
  PID:7224
- C:\Windows\System\pwRiZdo.exe
  C:\Windows\System\pwRiZdo.exe
  2⤵
  PID:7240
- C:\Windows\System\ycbOjxp.exe
  C:\Windows\System\ycbOjxp.exe
  2⤵
  PID:7264
- C:\Windows\System\asdmrpa.exe
  C:\Windows\System\asdmrpa.exe
  2⤵
  PID:7292
- C:\Windows\System\iFZTGgZ.exe
  C:\Windows\System\iFZTGgZ.exe
  2⤵
  PID:7316
- C:\Windows\System\LEdFnTD.exe
  C:\Windows\System\LEdFnTD.exe
  2⤵
  PID:7340
- C:\Windows\System\CtIRXBm.exe
  C:\Windows\System\CtIRXBm.exe
  2⤵
  PID:7368
- C:\Windows\System\tKeEtKW.exe
  C:\Windows\System\tKeEtKW.exe
  2⤵
  PID:7384
- C:\Windows\System\ovOPdcO.exe
  C:\Windows\System\ovOPdcO.exe
  2⤵
  PID:7408
- C:\Windows\System\LyEkSAL.exe
  C:\Windows\System\LyEkSAL.exe
  2⤵
  PID:7432
- C:\Windows\System\ZwUvgQr.exe
  C:\Windows\System\ZwUvgQr.exe
  2⤵
  PID:7452
- C:\Windows\System\bVXUKEA.exe
  C:\Windows\System\bVXUKEA.exe
  2⤵
  PID:7472
- C:\Windows\System\ZOQMELX.exe
  C:\Windows\System\ZOQMELX.exe
  2⤵
  PID:7496
- C:\Windows\System\NSqJiHg.exe
  C:\Windows\System\NSqJiHg.exe
  2⤵
  PID:7524
- C:\Windows\System\WqDSEFd.exe
  C:\Windows\System\WqDSEFd.exe
  2⤵
  PID:7548
- C:\Windows\System\GhkmUuO.exe
  C:\Windows\System\GhkmUuO.exe
  2⤵
  PID:7580
- C:\Windows\System\XOiXesA.exe
  C:\Windows\System\XOiXesA.exe
  2⤵
  PID:7600
- C:\Windows\System\bgnxeJU.exe
  C:\Windows\System\bgnxeJU.exe
  2⤵
  PID:7624
- C:\Windows\System\wfmrgwb.exe
  C:\Windows\System\wfmrgwb.exe
  2⤵
  PID:7648
- C:\Windows\System\vogiIta.exe
  C:\Windows\System\vogiIta.exe
  2⤵
  PID:7668
- C:\Windows\System\JyazNDh.exe
  C:\Windows\System\JyazNDh.exe
  2⤵
  PID:7688
- C:\Windows\System\gMyXnvZ.exe
  C:\Windows\System\gMyXnvZ.exe
  2⤵
  PID:7712
- C:\Windows\System\VTFmgkZ.exe
  C:\Windows\System\VTFmgkZ.exe
  2⤵
  PID:7740
- C:\Windows\System\UjqruOV.exe
  C:\Windows\System\UjqruOV.exe
  2⤵
  PID:7764
- C:\Windows\System\FaTaEGQ.exe
  C:\Windows\System\FaTaEGQ.exe
  2⤵
  PID:7780
- C:\Windows\System\XxclZqG.exe
  C:\Windows\System\XxclZqG.exe
  2⤵
  PID:7804
- C:\Windows\System\zMGWDEV.exe
  C:\Windows\System\zMGWDEV.exe
  2⤵
  PID:7824
- C:\Windows\System\YCHereS.exe
  C:\Windows\System\YCHereS.exe
  2⤵
  PID:7844
- C:\Windows\System\YrNQvyo.exe
  C:\Windows\System\YrNQvyo.exe
  2⤵
  PID:7872
- C:\Windows\System\gCmHXGw.exe
  C:\Windows\System\gCmHXGw.exe
  2⤵
  PID:7892
- C:\Windows\System\ibicWgH.exe
  C:\Windows\System\ibicWgH.exe
  2⤵
  PID:7924
- C:\Windows\System\ECyfeVt.exe
  C:\Windows\System\ECyfeVt.exe
  2⤵
  PID:7948
- C:\Windows\System\GwcZXjE.exe
  C:\Windows\System\GwcZXjE.exe
  2⤵
  PID:7964
- C:\Windows\System\kGpNlto.exe
  C:\Windows\System\kGpNlto.exe
  2⤵
  PID:7988
- C:\Windows\System\AnvUckQ.exe
  C:\Windows\System\AnvUckQ.exe
  2⤵
  PID:8016
- C:\Windows\System\sEcnENw.exe
  C:\Windows\System\sEcnENw.exe
  2⤵
  PID:8036
- C:\Windows\System\YNdinAQ.exe
  C:\Windows\System\YNdinAQ.exe
  2⤵
  PID:8056
- C:\Windows\System\fIAwuEY.exe
  C:\Windows\System\fIAwuEY.exe
  2⤵
  PID:8080
- C:\Windows\System\wSTuyeC.exe
  C:\Windows\System\wSTuyeC.exe
  2⤵
  PID:8100
- C:\Windows\System\VQiSsSO.exe
  C:\Windows\System\VQiSsSO.exe
  2⤵
  PID:8128
- C:\Windows\System\dOjkkLG.exe
  C:\Windows\System\dOjkkLG.exe
  2⤵
  PID:8152
- C:\Windows\System\HvXFzqE.exe
  C:\Windows\System\HvXFzqE.exe
  2⤵
  PID:8168
- C:\Windows\System\WJEceel.exe
  C:\Windows\System\WJEceel.exe
  2⤵
  PID:7072
- C:\Windows\System\MOwLLrD.exe
  C:\Windows\System\MOwLLrD.exe
  2⤵
  PID:7092
- C:\Windows\System\uiJDILl.exe
  C:\Windows\System\uiJDILl.exe
  2⤵
  PID:7156
- C:\Windows\System\QgaAOfK.exe
  C:\Windows\System\QgaAOfK.exe
  2⤵
  PID:5904
- C:\Windows\System\sjiCoyi.exe
  C:\Windows\System\sjiCoyi.exe
  2⤵
  PID:6292
- C:\Windows\System\HJtHbvQ.exe
  C:\Windows\System\HJtHbvQ.exe
  2⤵
  PID:1944
- C:\Windows\System\vNeBuNa.exe
  C:\Windows\System\vNeBuNa.exe
  2⤵
  PID:6992
- C:\Windows\System\NxpkCnG.exe
  C:\Windows\System\NxpkCnG.exe
  2⤵
  PID:7068
- C:\Windows\System\fTetrOf.exe
  C:\Windows\System\fTetrOf.exe
  2⤵
  PID:7136
- C:\Windows\System\tsMnphw.exe
  C:\Windows\System\tsMnphw.exe
  2⤵
  PID:6784
- C:\Windows\System\VCvrQeD.exe
  C:\Windows\System\VCvrQeD.exe
  2⤵
  PID:8216
- C:\Windows\System\xrAHLOI.exe
  C:\Windows\System\xrAHLOI.exe
  2⤵
  PID:8240
- C:\Windows\System\lfFCBnp.exe
  C:\Windows\System\lfFCBnp.exe
  2⤵
  PID:8264
- C:\Windows\System\KrnoPHk.exe
  C:\Windows\System\KrnoPHk.exe
  2⤵
  PID:8288
- C:\Windows\System\ZDAhVgx.exe
  C:\Windows\System\ZDAhVgx.exe
  2⤵
  PID:8312
- C:\Windows\System\wrEHQzm.exe
  C:\Windows\System\wrEHQzm.exe
  2⤵
  PID:8332
- C:\Windows\System\VGXbGWi.exe
  C:\Windows\System\VGXbGWi.exe
  2⤵
  PID:8360
- C:\Windows\System\yMCdyhe.exe
  C:\Windows\System\yMCdyhe.exe
  2⤵
  PID:8392
- C:\Windows\System\cuVGqkK.exe
  C:\Windows\System\cuVGqkK.exe
  2⤵
  PID:8408
- C:\Windows\System\JOdDaPI.exe
  C:\Windows\System\JOdDaPI.exe
  2⤵
  PID:8432
- C:\Windows\System\HpCGZgw.exe
  C:\Windows\System\HpCGZgw.exe
  2⤵
  PID:8456
- C:\Windows\System\CJcVmVq.exe
  C:\Windows\System\CJcVmVq.exe
  2⤵
  PID:8476
- C:\Windows\System\PrbbMAT.exe
  C:\Windows\System\PrbbMAT.exe
  2⤵
  PID:8504
- C:\Windows\System\uETZJOc.exe
  C:\Windows\System\uETZJOc.exe
  2⤵
  PID:8520
- C:\Windows\System\dMmHZve.exe
  C:\Windows\System\dMmHZve.exe
  2⤵
  PID:8544
- C:\Windows\System\ksozUoN.exe
  C:\Windows\System\ksozUoN.exe
  2⤵
  PID:8564
- C:\Windows\System\FoJObeR.exe
  C:\Windows\System\FoJObeR.exe
  2⤵
  PID:8588
- C:\Windows\System\onuHJZP.exe
  C:\Windows\System\onuHJZP.exe
  2⤵
  PID:8616
- C:\Windows\System\WtdKrTy.exe
  C:\Windows\System\WtdKrTy.exe
  2⤵
  PID:8640
- C:\Windows\System\sJMRlvQ.exe
  C:\Windows\System\sJMRlvQ.exe
  2⤵
  PID:8660
- C:\Windows\System\CBqAaxk.exe
  C:\Windows\System\CBqAaxk.exe
  2⤵
  PID:8680
- C:\Windows\System\jJZFAmp.exe
  C:\Windows\System\jJZFAmp.exe
  2⤵
  PID:8704
- C:\Windows\System\MxXqmFO.exe
  C:\Windows\System\MxXqmFO.exe
  2⤵
  PID:8724
- C:\Windows\System\dQNRaoo.exe
  C:\Windows\System\dQNRaoo.exe
  2⤵
  PID:8748
- C:\Windows\System\QDmIZfr.exe
  C:\Windows\System\QDmIZfr.exe
  2⤵
  PID:8768
- C:\Windows\System\JTOVsSx.exe
  C:\Windows\System\JTOVsSx.exe
  2⤵
  PID:8788
- C:\Windows\System\xrmWDzZ.exe
  C:\Windows\System\xrmWDzZ.exe
  2⤵
  PID:8812
- C:\Windows\System\qPghZls.exe
  C:\Windows\System\qPghZls.exe
  2⤵
  PID:8836
- C:\Windows\System\FbnJnwE.exe
  C:\Windows\System\FbnJnwE.exe
  2⤵
  PID:8864
- C:\Windows\System\oEwriIY.exe
  C:\Windows\System\oEwriIY.exe
  2⤵
  PID:8884
- C:\Windows\System\ASudXbJ.exe
  C:\Windows\System\ASudXbJ.exe
  2⤵
  PID:8904
- C:\Windows\System\bQAhiua.exe
  C:\Windows\System\bQAhiua.exe
  2⤵
  PID:8928
- C:\Windows\System\wTbKnZh.exe
  C:\Windows\System\wTbKnZh.exe
  2⤵
  PID:8948
- C:\Windows\System\hnwnXze.exe
  C:\Windows\System\hnwnXze.exe
  2⤵
  PID:8980
- C:\Windows\System\rOXjmXo.exe
  C:\Windows\System\rOXjmXo.exe
  2⤵
  PID:8996
- C:\Windows\System\FwoENnc.exe
  C:\Windows\System\FwoENnc.exe
  2⤵
  PID:9032
- C:\Windows\System\ZnkJWCb.exe
  C:\Windows\System\ZnkJWCb.exe
  2⤵
  PID:9048
- C:\Windows\System\zqBmItZ.exe
  C:\Windows\System\zqBmItZ.exe
  2⤵
  PID:9076
- C:\Windows\System\cNRTHLR.exe
  C:\Windows\System\cNRTHLR.exe
  2⤵
  PID:9096
- C:\Windows\System\uAQAEUe.exe
  C:\Windows\System\uAQAEUe.exe
  2⤵
  PID:9116
- C:\Windows\System\LNTSNAo.exe
  C:\Windows\System\LNTSNAo.exe
  2⤵
  PID:9136
- C:\Windows\System\SQkXYoj.exe
  C:\Windows\System\SQkXYoj.exe
  2⤵
  PID:9164
- C:\Windows\System\ksWLRbK.exe
  C:\Windows\System\ksWLRbK.exe
  2⤵
  PID:9188
- C:\Windows\System\EmNyYnH.exe
  C:\Windows\System\EmNyYnH.exe
  2⤵
  PID:9208
- C:\Windows\System\YUkFlRI.exe
  C:\Windows\System\YUkFlRI.exe
  2⤵
  PID:7556
- C:\Windows\System\bJLXYVS.exe
  C:\Windows\System\bJLXYVS.exe
  2⤵
  PID:6876
- C:\Windows\System\iPwuquf.exe
  C:\Windows\System\iPwuquf.exe
  2⤵
  PID:7752
- C:\Windows\System\ndWefmk.exe
  C:\Windows\System\ndWefmk.exe
  2⤵
  PID:6984
- C:\Windows\System\PBjyhoD.exe
  C:\Windows\System\PBjyhoD.exe
  2⤵
  PID:7996
- C:\Windows\System\VZwfGgp.exe
  C:\Windows\System\VZwfGgp.exe
  2⤵
  PID:8032
- C:\Windows\System\RRQdIzE.exe
  C:\Windows\System\RRQdIzE.exe
  2⤵
  PID:8136
- C:\Windows\System\aOHeuNR.exe
  C:\Windows\System\aOHeuNR.exe
  2⤵
  PID:8188
- C:\Windows\System\YJLkPiY.exe
  C:\Windows\System\YJLkPiY.exe
  2⤵
  PID:6616
- C:\Windows\System\mTmUGaq.exe
  C:\Windows\System\mTmUGaq.exe
  2⤵
  PID:5868
- C:\Windows\System\iseMuZI.exe
  C:\Windows\System\iseMuZI.exe
  2⤵
  PID:5956
- C:\Windows\System\ghGUDUm.exe
  C:\Windows\System\ghGUDUm.exe
  2⤵
  PID:6132
- C:\Windows\System\IhsOwGe.exe
  C:\Windows\System\IhsOwGe.exe
  2⤵
  PID:8424
- C:\Windows\System\HRbcQXG.exe
  C:\Windows\System\HRbcQXG.exe
  2⤵
  PID:4868
- C:\Windows\System\UlegYFt.exe
  C:\Windows\System\UlegYFt.exe
  2⤵
  PID:9224
- C:\Windows\System\SsjodjC.exe
  C:\Windows\System\SsjodjC.exe
  2⤵
  PID:9244
- C:\Windows\System\sqkgCeo.exe
  C:\Windows\System\sqkgCeo.exe
  2⤵
  PID:9268
- C:\Windows\System\YxiVxSL.exe
  C:\Windows\System\YxiVxSL.exe
  2⤵
  PID:9288
- C:\Windows\System\qaWrOGv.exe
  C:\Windows\System\qaWrOGv.exe
  2⤵
  PID:9320
- C:\Windows\System\OmnUlkR.exe
  C:\Windows\System\OmnUlkR.exe
  2⤵
  PID:9336
- C:\Windows\System\gPaTLie.exe
  C:\Windows\System\gPaTLie.exe
  2⤵
  PID:9352
- C:\Windows\System\AvxxFBm.exe
  C:\Windows\System\AvxxFBm.exe
  2⤵
  PID:9372
- C:\Windows\System\YQrOSpx.exe
  C:\Windows\System\YQrOSpx.exe
  2⤵
  PID:9412
- C:\Windows\System\NrqIQgp.exe
  C:\Windows\System\NrqIQgp.exe
  2⤵
  PID:9444
- C:\Windows\System\JSsHJVZ.exe
  C:\Windows\System\JSsHJVZ.exe
  2⤵
  PID:9464
- C:\Windows\System\IwXdkkA.exe
  C:\Windows\System\IwXdkkA.exe
  2⤵
  PID:9484
- C:\Windows\System\rkmZAgD.exe
  C:\Windows\System\rkmZAgD.exe
  2⤵
  PID:9508
- C:\Windows\System\zZojTrd.exe
  C:\Windows\System\zZojTrd.exe
  2⤵
  PID:9532
- C:\Windows\System\FKfADGH.exe
  C:\Windows\System\FKfADGH.exe
  2⤵
  PID:9548
- C:\Windows\System\GPAeKCC.exe
  C:\Windows\System\GPAeKCC.exe
  2⤵
  PID:9576
- C:\Windows\System\VGlqNRW.exe
  C:\Windows\System\VGlqNRW.exe
  2⤵
  PID:9596
- C:\Windows\System\yCStFVE.exe
  C:\Windows\System\yCStFVE.exe
  2⤵
  PID:9616
- C:\Windows\System\wHQHFmR.exe
  C:\Windows\System\wHQHFmR.exe
  2⤵
  PID:9636
- C:\Windows\System\vlxnKyT.exe
  C:\Windows\System\vlxnKyT.exe
  2⤵
  PID:9664
- C:\Windows\System\GgQoHNg.exe
  C:\Windows\System\GgQoHNg.exe
  2⤵
  PID:9684
- C:\Windows\System\RnBAIHh.exe
  C:\Windows\System\RnBAIHh.exe
  2⤵
  PID:9708
- C:\Windows\System\XEOjNrD.exe
  C:\Windows\System\XEOjNrD.exe
  2⤵
  PID:9728
- C:\Windows\System\yKqMPpH.exe
  C:\Windows\System\yKqMPpH.exe
  2⤵
  PID:9752
- C:\Windows\System\RnXpQIe.exe
  C:\Windows\System\RnXpQIe.exe
  2⤵
  PID:9772
- C:\Windows\System\HidIfSx.exe
  C:\Windows\System\HidIfSx.exe
  2⤵
  PID:9796
- C:\Windows\System\RiBiCfz.exe
  C:\Windows\System\RiBiCfz.exe
  2⤵
  PID:9816
- C:\Windows\System\ZhDpcYi.exe
  C:\Windows\System\ZhDpcYi.exe
  2⤵
  PID:9836
- C:\Windows\System\pVtoMTG.exe
  C:\Windows\System\pVtoMTG.exe
  2⤵
  PID:9856
- C:\Windows\System\hqoOmyY.exe
  C:\Windows\System\hqoOmyY.exe
  2⤵
  PID:9876
- C:\Windows\System\ExRXghy.exe
  C:\Windows\System\ExRXghy.exe
  2⤵
  PID:9900
- C:\Windows\System\mnxVNeD.exe
  C:\Windows\System\mnxVNeD.exe
  2⤵
  PID:9920
- C:\Windows\System\kdMhkUE.exe
  C:\Windows\System\kdMhkUE.exe
  2⤵
  PID:9944
- C:\Windows\System\RzXrbTd.exe
  C:\Windows\System\RzXrbTd.exe
  2⤵
  PID:9960
- C:\Windows\System\EkNwMSx.exe
  C:\Windows\System\EkNwMSx.exe
  2⤵
  PID:9980
- C:\Windows\System\Nqhrsjr.exe
  C:\Windows\System\Nqhrsjr.exe
  2⤵
  PID:10000
- C:\Windows\System\hZbvWry.exe
  C:\Windows\System\hZbvWry.exe
  2⤵
  PID:10024
- C:\Windows\System\tzlgBEP.exe
  C:\Windows\System\tzlgBEP.exe
  2⤵
  PID:10040
- C:\Windows\System\UsMebls.exe
  C:\Windows\System\UsMebls.exe
  2⤵
  PID:10056
- C:\Windows\System\xNsqeBc.exe
  C:\Windows\System\xNsqeBc.exe
  2⤵
  PID:10076
- C:\Windows\System\gpFOlMF.exe
  C:\Windows\System\gpFOlMF.exe
  2⤵
  PID:10096
- C:\Windows\System\dnTsJPr.exe
  C:\Windows\System\dnTsJPr.exe
  2⤵
  PID:10116
- C:\Windows\System\eYEVRuT.exe
  C:\Windows\System\eYEVRuT.exe
  2⤵
  PID:10136
- C:\Windows\System\TfqNFPK.exe
  C:\Windows\System\TfqNFPK.exe
  2⤵
  PID:10160
- C:\Windows\System\vxYHvwi.exe
  C:\Windows\System\vxYHvwi.exe
  2⤵
  PID:10184
- C:\Windows\System\mhfehrj.exe
  C:\Windows\System\mhfehrj.exe
  2⤵
  PID:10200
- C:\Windows\System\evdHYpW.exe
  C:\Windows\System\evdHYpW.exe
  2⤵
  PID:10228
- C:\Windows\System\GwMmwQc.exe
  C:\Windows\System\GwMmwQc.exe
  2⤵
  PID:9144
- C:\Windows\System\SlfXNyf.exe
  C:\Windows\System\SlfXNyf.exe
  2⤵
  PID:9196
- C:\Windows\System\oyZznZN.exe
  C:\Windows\System\oyZznZN.exe
  2⤵
  PID:6832
- C:\Windows\System\EIuBCcZ.exe
  C:\Windows\System\EIuBCcZ.exe
  2⤵
  PID:5828
- C:\Windows\System\OZqgYAr.exe
  C:\Windows\System\OZqgYAr.exe
  2⤵
  PID:8308
- C:\Windows\System\KHDzfRn.exe
  C:\Windows\System\KHDzfRn.exe
  2⤵
  PID:7088
- C:\Windows\System\pivBtME.exe
  C:\Windows\System\pivBtME.exe
  2⤵
  PID:7708
- C:\Windows\System\RmugnHQ.exe
  C:\Windows\System\RmugnHQ.exe
  2⤵
  PID:7728
- C:\Windows\System\rlnrdie.exe
  C:\Windows\System\rlnrdie.exe
  2⤵
  PID:7776
- C:\Windows\System\XlGTMsM.exe
  C:\Windows\System\XlGTMsM.exe
  2⤵
  PID:7852
- C:\Windows\System\eNqIHsX.exe
  C:\Windows\System\eNqIHsX.exe
  2⤵
  PID:8048
- C:\Windows\System\dnGrtnH.exe
  C:\Windows\System\dnGrtnH.exe
  2⤵
  PID:8092
- C:\Windows\System\BwuFyde.exe
  C:\Windows\System\BwuFyde.exe
  2⤵
  PID:4776
- C:\Windows\System\YFfFumE.exe
  C:\Windows\System\YFfFumE.exe
  2⤵
  PID:9240
- C:\Windows\System\LDflHfx.exe
  C:\Windows\System\LDflHfx.exe
  2⤵
  PID:7812
- C:\Windows\System\YKrbGom.exe
  C:\Windows\System\YKrbGom.exe
  2⤵
  PID:9380
- C:\Windows\System\rErVlfK.exe
  C:\Windows\System\rErVlfK.exe
  2⤵
  PID:8236
- C:\Windows\System\XngweAz.exe
  C:\Windows\System\XngweAz.exe
  2⤵
  PID:8280
- C:\Windows\System\pEJqQvq.exe
  C:\Windows\System\pEJqQvq.exe
  2⤵
  PID:10256
- C:\Windows\System\CuwvvMD.exe
  C:\Windows\System\CuwvvMD.exe
  2⤵
  PID:10280
- C:\Windows\System\jVYsBgT.exe
  C:\Windows\System\jVYsBgT.exe
  2⤵
  PID:10504
- C:\Windows\System\mQhxIej.exe
  C:\Windows\System\mQhxIej.exe
  2⤵
  PID:10548
- C:\Windows\System\wKAMhJq.exe
  C:\Windows\System\wKAMhJq.exe
  2⤵
  PID:10564
- C:\Windows\System\rJxNnkN.exe
  C:\Windows\System\rJxNnkN.exe
  2⤵
  PID:10584
- C:\Windows\System\sHpTLRY.exe
  C:\Windows\System\sHpTLRY.exe
  2⤵
  PID:10600
- C:\Windows\System\rGeAwqz.exe
  C:\Windows\System\rGeAwqz.exe
  2⤵
  PID:10624
- C:\Windows\System\XAlXbHd.exe
  C:\Windows\System\XAlXbHd.exe
  2⤵
  PID:10648
- C:\Windows\System\PwUExRd.exe
  C:\Windows\System\PwUExRd.exe
  2⤵
  PID:10668
- C:\Windows\System\zCHiBjB.exe
  C:\Windows\System\zCHiBjB.exe
  2⤵
  PID:10688
- C:\Windows\System\SKfIRzc.exe
  C:\Windows\System\SKfIRzc.exe
  2⤵
  PID:10716
- C:\Windows\System\xeVFjvA.exe
  C:\Windows\System\xeVFjvA.exe
  2⤵
  PID:10736
- C:\Windows\System\uDGchmv.exe
  C:\Windows\System\uDGchmv.exe
  2⤵
  PID:10752
- C:\Windows\System\FzmGWuA.exe
  C:\Windows\System\FzmGWuA.exe
  2⤵
  PID:10768
- C:\Windows\System\PwwjGqD.exe
  C:\Windows\System\PwwjGqD.exe
  2⤵
  PID:10784
- C:\Windows\System\SrgLiER.exe
  C:\Windows\System\SrgLiER.exe
  2⤵
  PID:10804
- C:\Windows\System\nHwrPmk.exe
  C:\Windows\System\nHwrPmk.exe
  2⤵
  PID:10824
- C:\Windows\System\gkcDNYB.exe
  C:\Windows\System\gkcDNYB.exe
  2⤵
  PID:10848
- C:\Windows\System\lvlKERe.exe
  C:\Windows\System\lvlKERe.exe
  2⤵
  PID:10868
- C:\Windows\System\jBRZkYZ.exe
  C:\Windows\System\jBRZkYZ.exe
  2⤵
  PID:10900
- C:\Windows\System\VNruxPQ.exe
  C:\Windows\System\VNruxPQ.exe
  2⤵
  PID:10924
- C:\Windows\System\WnAGtRw.exe
  C:\Windows\System\WnAGtRw.exe
  2⤵
  PID:10944
- C:\Windows\System\RJFWqrz.exe
  C:\Windows\System\RJFWqrz.exe
  2⤵
  PID:10968
- C:\Windows\System\BbItOoM.exe
  C:\Windows\System\BbItOoM.exe
  2⤵
  PID:10988
- C:\Windows\System\CGfkfqm.exe
  C:\Windows\System\CGfkfqm.exe
  2⤵
  PID:11020
- C:\Windows\System\QnpnJBp.exe
  C:\Windows\System\QnpnJBp.exe
  2⤵
  PID:11048
- C:\Windows\System\cEZnNaK.exe
  C:\Windows\System\cEZnNaK.exe
  2⤵
  PID:11080
- C:\Windows\System\ifPvZxS.exe
  C:\Windows\System\ifPvZxS.exe
  2⤵
  PID:11100
- C:\Windows\System\eoJjFeI.exe
  C:\Windows\System\eoJjFeI.exe
  2⤵
  PID:11124
- C:\Windows\System\yimOWnu.exe
  C:\Windows\System\yimOWnu.exe
  2⤵
  PID:11148
- C:\Windows\System\XIUSCsJ.exe
  C:\Windows\System\XIUSCsJ.exe
  2⤵
  PID:11176
- C:\Windows\System\nIoWvsE.exe
  C:\Windows\System\nIoWvsE.exe
  2⤵
  PID:11200
- C:\Windows\System\xQTMQgK.exe
  C:\Windows\System\xQTMQgK.exe
  2⤵
  PID:11220
- C:\Windows\System\mJHxUZk.exe
  C:\Windows\System\mJHxUZk.exe
  2⤵
  PID:11248
- C:\Windows\System\obUSksl.exe
  C:\Windows\System\obUSksl.exe
  2⤵
  PID:8164
- C:\Windows\System\sBGamHV.exe
  C:\Windows\System\sBGamHV.exe
  2⤵
  PID:8368
- C:\Windows\System\fbBdcBd.exe
  C:\Windows\System\fbBdcBd.exe
  2⤵
  PID:6336
- C:\Windows\System\yuvSSEi.exe
  C:\Windows\System\yuvSSEi.exe
  2⤵
  PID:8492
- C:\Windows\System\JmxkSZI.exe
  C:\Windows\System\JmxkSZI.exe
  2⤵
  PID:6440
- C:\Windows\System\OWfdrDc.exe
  C:\Windows\System\OWfdrDc.exe
  2⤵
  PID:8512
- C:\Windows\System\ojrhLYY.exe
  C:\Windows\System\ojrhLYY.exe
  2⤵
  PID:8532
- C:\Windows\System\uGVToke.exe
  C:\Windows\System\uGVToke.exe
  2⤵
  PID:8560
- C:\Windows\System\DspQSdD.exe
  C:\Windows\System\DspQSdD.exe
  2⤵
  PID:8580
- C:\Windows\System\YZxExPx.exe
  C:\Windows\System\YZxExPx.exe
  2⤵
  PID:6804
- C:\Windows\System\VvAiJpb.exe
  C:\Windows\System\VvAiJpb.exe
  2⤵
  PID:8624
- C:\Windows\System\kwPGYcc.exe
  C:\Windows\System\kwPGYcc.exe
  2⤵
  PID:8656
- C:\Windows\System\kYVuHcT.exe
  C:\Windows\System\kYVuHcT.exe
  2⤵
  PID:8712
- C:\Windows\System\nsKawup.exe
  C:\Windows\System\nsKawup.exe
  2⤵
  PID:8744
- C:\Windows\System\ybTBLoP.exe
  C:\Windows\System\ybTBLoP.exe
  2⤵
  PID:8796
- C:\Windows\System\xiZLWny.exe
  C:\Windows\System\xiZLWny.exe
  2⤵
  PID:8848
- C:\Windows\System\QlhAkBc.exe
  C:\Windows\System\QlhAkBc.exe
  2⤵
  PID:7196
- C:\Windows\System\UGiQTLh.exe
  C:\Windows\System\UGiQTLh.exe
  2⤵
  PID:7208
- C:\Windows\System\PPqIAIJ.exe
  C:\Windows\System\PPqIAIJ.exe
  2⤵
  PID:8936
- C:\Windows\System\gUAzdRL.exe
  C:\Windows\System\gUAzdRL.exe
  2⤵
  PID:8944
- C:\Windows\System\rekjubj.exe
  C:\Windows\System\rekjubj.exe
  2⤵
  PID:7308
- C:\Windows\System\rlcEhqs.exe
  C:\Windows\System\rlcEhqs.exe
  2⤵
  PID:7380
- C:\Windows\System\HZrzLtr.exe
  C:\Windows\System\HZrzLtr.exe
  2⤵
  PID:7424
- C:\Windows\System\DSXgIIY.exe
  C:\Windows\System\DSXgIIY.exe
  2⤵
  PID:8988
- C:\Windows\System\cKLWxvM.exe
  C:\Windows\System\cKLWxvM.exe
  2⤵
  PID:9044
- C:\Windows\System\GQLiBmo.exe
  C:\Windows\System\GQLiBmo.exe
  2⤵
  PID:9092
- C:\Windows\System\NIPWyFl.exe
  C:\Windows\System\NIPWyFl.exe
  2⤵
  PID:9788
- C:\Windows\System\hPeNqBP.exe
  C:\Windows\System\hPeNqBP.exe
  2⤵
  PID:9604
- C:\Windows\System\pLhyVlw.exe
  C:\Windows\System\pLhyVlw.exe
  2⤵
  PID:10104
- C:\Windows\System\khLXcNk.exe
  C:\Windows\System\khLXcNk.exe
  2⤵
  PID:9912
- C:\Windows\System\eibKHfH.exe
  C:\Windows\System\eibKHfH.exe
  2⤵
  PID:9828
- C:\Windows\System\dCKCcla.exe
  C:\Windows\System\dCKCcla.exe
  2⤵
  PID:9540
- C:\Windows\System\UdTYKkU.exe
  C:\Windows\System\UdTYKkU.exe
  2⤵
  PID:10196
- C:\Windows\System\pysZdio.exe
  C:\Windows\System\pysZdio.exe
  2⤵
  PID:7460
- C:\Windows\System\eBhgVOF.exe
  C:\Windows\System\eBhgVOF.exe
  2⤵
  PID:8324
- C:\Windows\System\CarEUiu.exe
  C:\Windows\System\CarEUiu.exe
  2⤵
  PID:7732
- C:\Windows\System\CRGpzGo.exe
  C:\Windows\System\CRGpzGo.exe
  2⤵
  PID:7912
- C:\Windows\System\xKVgECf.exe
  C:\Windows\System\xKVgECf.exe
  2⤵
  PID:6924
- C:\Windows\System\qJRStlC.exe
  C:\Windows\System\qJRStlC.exe
  2⤵
  PID:6212
- C:\Windows\System\mJYsJZk.exe
  C:\Windows\System\mJYsJZk.exe
  2⤵
  PID:9332
- C:\Windows\System\XGnDKrN.exe
  C:\Windows\System\XGnDKrN.exe
  2⤵
  PID:10248
- C:\Windows\System\dGobDkU.exe
  C:\Windows\System\dGobDkU.exe
  2⤵
  PID:3864
- C:\Windows\System\ORBmBOq.exe
  C:\Windows\System\ORBmBOq.exe
  2⤵
  PID:6592
- C:\Windows\System\tnmBWXP.exe
  C:\Windows\System\tnmBWXP.exe
  2⤵
  PID:7664
- C:\Windows\System\ZHobkhn.exe
  C:\Windows\System\ZHobkhn.exe
  2⤵
  PID:7348
- C:\Windows\System\xyXfUeM.exe
  C:\Windows\System\xyXfUeM.exe
  2⤵
  PID:9916
- C:\Windows\System\AJqTAOc.exe
  C:\Windows\System\AJqTAOc.exe
  2⤵
  PID:10052
- C:\Windows\System\wwsQKWp.exe
  C:\Windows\System\wwsQKWp.exe
  2⤵
  PID:10464
- C:\Windows\System\yZcPFmx.exe
  C:\Windows\System\yZcPFmx.exe
  2⤵
  PID:10144
- C:\Windows\System\TfwuUmq.exe
  C:\Windows\System\TfwuUmq.exe
  2⤵
  PID:10544
- C:\Windows\System\jwaTaun.exe
  C:\Windows\System\jwaTaun.exe
  2⤵
  PID:10580
- C:\Windows\System\XHJcKLG.exe
  C:\Windows\System\XHJcKLG.exe
  2⤵
  PID:10644
- C:\Windows\System\rhEdKOM.exe
  C:\Windows\System\rhEdKOM.exe
  2⤵
  PID:9252
- C:\Windows\System\nhzcjSy.exe
  C:\Windows\System\nhzcjSy.exe
  2⤵
  PID:3760
- C:\Windows\System\lBIuWvm.exe
  C:\Windows\System\lBIuWvm.exe
  2⤵
  PID:9296
- C:\Windows\System\ahEPfSv.exe
  C:\Windows\System\ahEPfSv.exe
  2⤵
  PID:10760
- C:\Windows\System\YLoWGKf.exe
  C:\Windows\System\YLoWGKf.exe
  2⤵
  PID:10820
- C:\Windows\System\UcUgUSs.exe
  C:\Windows\System\UcUgUSs.exe
  2⤵
  PID:3560
- C:\Windows\System\httBQXE.exe
  C:\Windows\System\httBQXE.exe
  2⤵
  PID:7840
- C:\Windows\System\uMmXnSl.exe
  C:\Windows\System\uMmXnSl.exe
  2⤵
  PID:10956
- C:\Windows\System\NhoBqrp.exe
  C:\Windows\System\NhoBqrp.exe
  2⤵
  PID:9392
- C:\Windows\System\StkMocy.exe
  C:\Windows\System\StkMocy.exe
  2⤵
  PID:9424
- C:\Windows\System\gfLrYwg.exe
  C:\Windows\System\gfLrYwg.exe
  2⤵
  PID:9584
- C:\Windows\System\WhKaZVk.exe
  C:\Windows\System\WhKaZVk.exe
  2⤵
  PID:9632
- C:\Windows\System\BzTAWOo.exe
  C:\Windows\System\BzTAWOo.exe
  2⤵
  PID:9680
- C:\Windows\System\NylhwDj.exe
  C:\Windows\System\NylhwDj.exe
  2⤵
  PID:9724
- C:\Windows\System\pfsiblZ.exe
  C:\Windows\System\pfsiblZ.exe
  2⤵
  PID:9780
- C:\Windows\System\JaUWdLl.exe
  C:\Windows\System\JaUWdLl.exe
  2⤵
  PID:9844
- C:\Windows\System\WEZsYxi.exe
  C:\Windows\System\WEZsYxi.exe
  2⤵
  PID:8536
- C:\Windows\System\uTzZyFH.exe
  C:\Windows\System\uTzZyFH.exe
  2⤵
  PID:6736
- C:\Windows\System\ZSsNEnl.exe
  C:\Windows\System\ZSsNEnl.exe
  2⤵
  PID:8612
- C:\Windows\System\hmAOoYl.exe
  C:\Windows\System\hmAOoYl.exe
  2⤵
  PID:8688
- C:\Windows\System\RawdhIR.exe
  C:\Windows\System\RawdhIR.exe
  2⤵
  PID:9976
- C:\Windows\System\HkiikNL.exe
  C:\Windows\System\HkiikNL.exe
  2⤵
  PID:10156
- C:\Windows\System\fTEfIUD.exe
  C:\Windows\System\fTEfIUD.exe
  2⤵
  PID:8760
- C:\Windows\System\znMdwyW.exe
  C:\Windows\System\znMdwyW.exe
  2⤵
  PID:10680
- C:\Windows\System\tfnyyVS.exe
  C:\Windows\System\tfnyyVS.exe
  2⤵
  PID:5752
- C:\Windows\System\zcnbTyj.exe
  C:\Windows\System\zcnbTyj.exe
  2⤵
  PID:10776
- C:\Windows\System\hpbBwtp.exe
  C:\Windows\System\hpbBwtp.exe
  2⤵
  PID:7680
- C:\Windows\System\bgBACog.exe
  C:\Windows\System\bgBACog.exe
  2⤵
  PID:5144
- C:\Windows\System\jPCGNvx.exe
  C:\Windows\System\jPCGNvx.exe
  2⤵
  PID:8072
- C:\Windows\System\kIQvMDW.exe
  C:\Windows\System\kIQvMDW.exe
  2⤵
  PID:9184
- C:\Windows\System\JnmzSVL.exe
  C:\Windows\System\JnmzSVL.exe
  2⤵
  PID:8272
- C:\Windows\System\auluTZd.exe
  C:\Windows\System\auluTZd.exe
  2⤵
  PID:9764
- C:\Windows\System\cEjSMiV.exe
  C:\Windows\System\cEjSMiV.exe
  2⤵
  PID:9148
- C:\Windows\System\aKACpLz.exe
  C:\Windows\System\aKACpLz.exe
  2⤵
  PID:7696
- C:\Windows\System\KFbnYUs.exe
  C:\Windows\System\KFbnYUs.exe
  2⤵
  PID:11260
- C:\Windows\System\ERQlPiR.exe
  C:\Windows\System\ERQlPiR.exe
  2⤵
  PID:10396
- C:\Windows\System\NSdfsqt.exe
  C:\Windows\System\NSdfsqt.exe
  2⤵
  PID:10536
- C:\Windows\System\ggeMMnx.exe
  C:\Windows\System\ggeMMnx.exe
  2⤵
  PID:10212
- C:\Windows\System\BfYAjZD.exe
  C:\Windows\System\BfYAjZD.exe
  2⤵
  PID:10664
- C:\Windows\System\hJvuWQE.exe
  C:\Windows\System\hJvuWQE.exe
  2⤵
  PID:10792
- C:\Windows\System\fMICCuI.exe
  C:\Windows\System\fMICCuI.exe
  2⤵
  PID:10936
- C:\Windows\System\ucblzrC.exe
  C:\Windows\System\ucblzrC.exe
  2⤵
  PID:10128
- C:\Windows\System\LNINLkv.exe
  C:\Windows\System\LNINLkv.exe
  2⤵
  PID:4028
- C:\Windows\System\fpFNABf.exe
  C:\Windows\System\fpFNABf.exe
  2⤵
  PID:11096
- C:\Windows\System\IKbPcex.exe
  C:\Windows\System\IKbPcex.exe
  2⤵
  PID:11144
- C:\Windows\System\PcuWEVj.exe
  C:\Windows\System\PcuWEVj.exe
  2⤵
  PID:11192
- C:\Windows\System\EBlydyh.exe
  C:\Windows\System\EBlydyh.exe
  2⤵
  PID:1512
- C:\Windows\System\KjkGIkC.exe
  C:\Windows\System\KjkGIkC.exe
  2⤵
  PID:6448
- C:\Windows\System\UyuQdFb.exe
  C:\Windows\System\UyuQdFb.exe
  2⤵
  PID:8820
- C:\Windows\System\bhKqiYw.exe
  C:\Windows\System\bhKqiYw.exe
  2⤵
  PID:8880
- C:\Windows\System\nuakQqM.exe
  C:\Windows\System\nuakQqM.exe
  2⤵
  PID:7336
- C:\Windows\System\xFZBGru.exe
  C:\Windows\System\xFZBGru.exe
  2⤵
  PID:11272
- C:\Windows\System\GSSWbUf.exe
  C:\Windows\System\GSSWbUf.exe
  2⤵
  PID:11296
- C:\Windows\System\bQKNaiZ.exe
  C:\Windows\System\bQKNaiZ.exe
  2⤵
  PID:11316
- C:\Windows\System\HhJyPpD.exe
  C:\Windows\System\HhJyPpD.exe
  2⤵
  PID:11340
- C:\Windows\System\vZhxxdn.exe
  C:\Windows\System\vZhxxdn.exe
  2⤵
  PID:11364
- C:\Windows\System\OMZwdjx.exe
  C:\Windows\System\OMZwdjx.exe
  2⤵
  PID:11388
- C:\Windows\System\QiKSLIa.exe
  C:\Windows\System\QiKSLIa.exe
  2⤵
  PID:11412
- C:\Windows\System\uSfnsUc.exe
  C:\Windows\System\uSfnsUc.exe
  2⤵
  PID:11440
- C:\Windows\System\UwEItEM.exe
  C:\Windows\System\UwEItEM.exe
  2⤵
  PID:11460
- C:\Windows\System\gqqlRMw.exe
  C:\Windows\System\gqqlRMw.exe
  2⤵
  PID:11484
- C:\Windows\System\MHprXMI.exe
  C:\Windows\System\MHprXMI.exe
  2⤵
  PID:11504
- C:\Windows\System\cXEfBVh.exe
  C:\Windows\System\cXEfBVh.exe
  2⤵
  PID:11528
- C:\Windows\System\ePYuyhx.exe
  C:\Windows\System\ePYuyhx.exe
  2⤵
  PID:11552
- C:\Windows\System\NVvWkJP.exe
  C:\Windows\System\NVvWkJP.exe
  2⤵
  PID:11576
- C:\Windows\System\plPNyuv.exe
  C:\Windows\System\plPNyuv.exe
  2⤵
  PID:11600
- C:\Windows\System\azzkmQj.exe
  C:\Windows\System\azzkmQj.exe
  2⤵
  PID:11624
- C:\Windows\System\ndbFIxw.exe
  C:\Windows\System\ndbFIxw.exe
  2⤵
  PID:11652
- C:\Windows\System\rIdRjXs.exe
  C:\Windows\System\rIdRjXs.exe
  2⤵
  PID:11672
- C:\Windows\System\RosdmnK.exe
  C:\Windows\System\RosdmnK.exe
  2⤵
  PID:11692
- C:\Windows\System\HmWanOi.exe
  C:\Windows\System\HmWanOi.exe
  2⤵
  PID:11716
- C:\Windows\System\JpZHTNV.exe
  C:\Windows\System\JpZHTNV.exe
  2⤵
  PID:11740
- C:\Windows\System\nutrgqI.exe
  C:\Windows\System\nutrgqI.exe
  2⤵
  PID:11764
- C:\Windows\System\jEisLTL.exe
  C:\Windows\System\jEisLTL.exe
  2⤵
  PID:11788
- C:\Windows\System\cauOvRX.exe
  C:\Windows\System\cauOvRX.exe
  2⤵
  PID:11812
- C:\Windows\System\uWZgIVj.exe
  C:\Windows\System\uWZgIVj.exe
  2⤵
  PID:11836
- C:\Windows\System\ALkPzBE.exe
  C:\Windows\System\ALkPzBE.exe
  2⤵
  PID:11856
- C:\Windows\System\syTVxQC.exe
  C:\Windows\System\syTVxQC.exe
  2⤵
  PID:11876
- C:\Windows\System\AIqFvjc.exe
  C:\Windows\System\AIqFvjc.exe
  2⤵
  PID:11900
- C:\Windows\System\hyNeHUx.exe
  C:\Windows\System\hyNeHUx.exe
  2⤵
  PID:11924
- C:\Windows\System\mTVplwr.exe
  C:\Windows\System\mTVplwr.exe
  2⤵
  PID:11948
- C:\Windows\System\lJErfuh.exe
  C:\Windows\System\lJErfuh.exe
  2⤵
  PID:11972
- C:\Windows\System\jUUdJDj.exe
  C:\Windows\System\jUUdJDj.exe
  2⤵
  PID:12000
- C:\Windows\System\jvzwSLa.exe
  C:\Windows\System\jvzwSLa.exe
  2⤵
  PID:12020
- C:\Windows\System\dDuSgjs.exe
  C:\Windows\System\dDuSgjs.exe
  2⤵
  PID:12048
- C:\Windows\System\DfRVwHq.exe
  C:\Windows\System\DfRVwHq.exe
  2⤵
  PID:12068
- C:\Windows\System\xVUapvV.exe
  C:\Windows\System\xVUapvV.exe
  2⤵
  PID:12092
- C:\Windows\System\sVZBjdk.exe
  C:\Windows\System\sVZBjdk.exe
  2⤵
  PID:12112
- C:\Windows\System\qECxrxn.exe
  C:\Windows\System\qECxrxn.exe
  2⤵
  PID:12136
- C:\Windows\System\tUMrMhV.exe
  C:\Windows\System\tUMrMhV.exe
  2⤵
  PID:12160
- C:\Windows\System\WqShdHH.exe
  C:\Windows\System\WqShdHH.exe
  2⤵
  PID:12188
- C:\Windows\System\EcxfntA.exe
  C:\Windows\System\EcxfntA.exe
  2⤵
  PID:12212
- C:\Windows\System\sodMtJn.exe
  C:\Windows\System\sodMtJn.exe
  2⤵
  PID:12232
- C:\Windows\System\CKEqxBs.exe
  C:\Windows\System\CKEqxBs.exe
  2⤵
  PID:12256
- C:\Windows\System\WrbHOxR.exe
  C:\Windows\System\WrbHOxR.exe
  2⤵
  PID:12284
- C:\Windows\System\yPXSGWw.exe
  C:\Windows\System\yPXSGWw.exe
  2⤵
  PID:12308
- C:\Windows\System\QMjatLe.exe
  C:\Windows\System\QMjatLe.exe
  2⤵
  PID:12336
- C:\Windows\System\HslxHHZ.exe
  C:\Windows\System\HslxHHZ.exe
  2⤵
  PID:9868
- C:\Windows\System\OyQBVIq.exe
  C:\Windows\System\OyQBVIq.exe
  2⤵
  PID:12440
- C:\Windows\System\thKQidn.exe
  C:\Windows\System\thKQidn.exe
  2⤵
  PID:9328
- C:\Windows\System\KiLmKUR.exe
  C:\Windows\System\KiLmKUR.exe
  2⤵
  PID:11004
- C:\Windows\System\wIKATDp.exe
  C:\Windows\System\wIKATDp.exe
  2⤵
  PID:4284
- C:\Windows\System\zMIiUjN.exe
  C:\Windows\System\zMIiUjN.exe
  2⤵
  PID:12500
- C:\Windows\System\KqTmBxG.exe
  C:\Windows\System\KqTmBxG.exe
  2⤵
  PID:9660
- C:\Windows\System\ZhrYiQK.exe
  C:\Windows\System\ZhrYiQK.exe
  2⤵
  PID:9832
- C:\Windows\System\tIoLRzz.exe
  C:\Windows\System\tIoLRzz.exe
  2⤵
  PID:12416
- C:\Windows\System\WYziFjB.exe
  C:\Windows\System\WYziFjB.exe
  2⤵
  PID:12448
- C:\Windows\System\yIVMXGY.exe
  C:\Windows\System\yIVMXGY.exe
  2⤵
  PID:12684
- C:\Windows\System\FJhXvGe.exe
  C:\Windows\System\FJhXvGe.exe
  2⤵
  PID:12712
- C:\Windows\System\rzREhwA.exe
  C:\Windows\System\rzREhwA.exe
  2⤵
  PID:12792
- C:\Windows\System\dwYmYXD.exe
  C:\Windows\System\dwYmYXD.exe
  2⤵
  PID:13048
- C:\Windows\System\QQIuSck.exe
  C:\Windows\System\QQIuSck.exe
  2⤵
  PID:4372
- C:\Windows\System\jJJubYJ.exe
  C:\Windows\System\jJJubYJ.exe
  2⤵
  PID:7596
- C:\Windows\System\UGZYzoX.exe
  C:\Windows\System\UGZYzoX.exe
  2⤵
  PID:7656
- C:\Windows\System\KbfxdoF.exe
  C:\Windows\System\KbfxdoF.exe
  2⤵
  PID:4656
- C:\Windows\System\zalBWpV.exe
  C:\Windows\System\zalBWpV.exe
  2⤵
  PID:7512
- C:\Windows\System\aiPdttY.exe
  C:\Windows\System\aiPdttY.exe
  2⤵
  PID:9908
- C:\Windows\System\IlmfJke.exe
  C:\Windows\System\IlmfJke.exe
  2⤵
  PID:12420
- C:\Windows\System\ZvrwpwF.exe
  C:\Windows\System\ZvrwpwF.exe
  2⤵
  PID:12372
- C:\Windows\System\UdatiCt.exe
  C:\Windows\System\UdatiCt.exe
  2⤵
  PID:10596
- C:\Windows\System\jztPJVZ.exe
  C:\Windows\System\jztPJVZ.exe
  2⤵
  PID:5104
- C:\Windows\System\ENhSFWR.exe
  C:\Windows\System\ENhSFWR.exe
  2⤵
  PID:9520
- C:\Windows\System\okKHWTf.exe
  C:\Windows\System\okKHWTf.exe
  2⤵
  PID:7256
- C:\Windows\System\tNwIADR.exe
  C:\Windows\System\tNwIADR.exe
  2⤵
  PID:11268
- C:\Windows\System\SCsvYav.exe
  C:\Windows\System\SCsvYav.exe
  2⤵
  PID:2500
- C:\Windows\System\FacoeUN.exe
  C:\Windows\System\FacoeUN.exe
  2⤵
  PID:12484
- C:\Windows\System\VOmseMI.exe
  C:\Windows\System\VOmseMI.exe
  2⤵
  PID:12552
- C:\Windows\System\zxyHaPm.exe
  C:\Windows\System\zxyHaPm.exe
  2⤵
  PID:13208
- C:\Windows\System\onJaWle.exe
  C:\Windows\System\onJaWle.exe
  2⤵
  PID:13228
- C:\Windows\System\QrAaXeA.exe
  C:\Windows\System\QrAaXeA.exe
  2⤵
  PID:12828
- C:\Windows\System\cVMIAKl.exe
  C:\Windows\System\cVMIAKl.exe
  2⤵
  PID:11132
- C:\Windows\System\mkYHQJy.exe
  C:\Windows\System\mkYHQJy.exe
  2⤵
  PID:11596
- C:\Windows\System\itzcUdD.exe
  C:\Windows\System\itzcUdD.exe
  2⤵
  PID:11708
- C:\Windows\System\YHfVxFJ.exe
  C:\Windows\System\YHfVxFJ.exe
  2⤵
  PID:13304
- C:\Windows\System\RXTUYYv.exe
  C:\Windows\System\RXTUYYv.exe
  2⤵
  PID:12836
- C:\Windows\System\KoNffIg.exe
  C:\Windows\System\KoNffIg.exe
  2⤵
  PID:12080
- C:\Windows\System\YXTnhMN.exe
  C:\Windows\System\YXTnhMN.exe
  2⤵
  PID:12352
- C:\Windows\System\feQwlbc.exe
  C:\Windows\System\feQwlbc.exe
  2⤵
  PID:12524
- C:\Windows\System\JAhMcHv.exe
  C:\Windows\System\JAhMcHv.exe
  2⤵
  PID:12668
- C:\Windows\System\pgVIlEL.exe
  C:\Windows\System\pgVIlEL.exe
  2⤵
  PID:12392
- C:\Windows\System\IQlorhp.exe
  C:\Windows\System\IQlorhp.exe
  2⤵
  PID:11288
- C:\Windows\System\UUKzbEz.exe
  C:\Windows\System\UUKzbEz.exe
  2⤵
  PID:5492
- C:\Windows\System\kZdIEpR.exe
  C:\Windows\System\kZdIEpR.exe
  2⤵
  PID:1332
- C:\Windows\System\MaJmUaT.exe
  C:\Windows\System\MaJmUaT.exe
  2⤵
  PID:12616
- C:\Windows\System\ZdzclzM.exe
  C:\Windows\System\ZdzclzM.exe
  2⤵
  PID:4300
- C:\Windows\System\ccpvCsT.exe
  C:\Windows\System\ccpvCsT.exe
  2⤵
  PID:5268
- C:\Windows\System\dicZbzj.exe
  C:\Windows\System\dicZbzj.exe
  2⤵
  PID:11472
- C:\Windows\System\tYtQxCu.exe
  C:\Windows\System\tYtQxCu.exe
  2⤵
  PID:11668
- C:\Windows\System\CHwMWPr.exe
  C:\Windows\System\CHwMWPr.exe
  2⤵
  PID:12144
- C:\Windows\System\bNaahnU.exe
  C:\Windows\System\bNaahnU.exe
  2⤵
  PID:4668
- C:\Windows\System\LrWYlqc.exe
  C:\Windows\System\LrWYlqc.exe
  2⤵
  PID:2324
- C:\Windows\System\JqXoLiF.exe
  C:\Windows\System\JqXoLiF.exe
  2⤵
  PID:12328
- C:\Windows\System\KKvyfCO.exe
  C:\Windows\System\KKvyfCO.exe
  2⤵
  PID:12740
- C:\Windows\System\LayIpJg.exe
  C:\Windows\System\LayIpJg.exe
  2⤵
  PID:12804
- C:\Windows\System\sCDVQws.exe
  C:\Windows\System\sCDVQws.exe
  2⤵
  PID:12860
- C:\Windows\System\KNvPnbf.exe
  C:\Windows\System\KNvPnbf.exe
  2⤵
  PID:748
- C:\Windows\System\xnLQUVG.exe
  C:\Windows\System\xnLQUVG.exe
  2⤵
  PID:12404
- C:\Windows\System\UaDTpFt.exe
  C:\Windows\System\UaDTpFt.exe
  2⤵
  PID:12672
- C:\Windows\System\MxnbrKm.exe
  C:\Windows\System\MxnbrKm.exe
  2⤵
  PID:2484
- C:\Windows\System\dbDIfKZ.exe
  C:\Windows\System\dbDIfKZ.exe
  2⤵
  PID:2252
- C:\Windows\System\eRBXxLr.exe
  C:\Windows\System\eRBXxLr.exe
  2⤵
  PID:12304
- C:\Windows\System\duKoOoy.exe
  C:\Windows\System\duKoOoy.exe
  2⤵
  PID:11336
- C:\Windows\System\YekLNUz.exe
  C:\Windows\System\YekLNUz.exe
  2⤵
  PID:11228
- C:\Windows\System\Fixwxsa.exe
  C:\Windows\System\Fixwxsa.exe
  2⤵
  PID:13308
- C:\Windows\System\eARLDec.exe
  C:\Windows\System\eARLDec.exe
  2⤵
  PID:12044
- C:\Windows\System\bvmXnsD.exe
  C:\Windows\System\bvmXnsD.exe
  2⤵
  PID:12508
- C:\Windows\System\SQybSAu.exe
  C:\Windows\System\SQybSAu.exe
  2⤵
  PID:10444
- C:\Windows\System\hsGtgNZ.exe
  C:\Windows\System\hsGtgNZ.exe
  2⤵
  PID:9204
- C:\Windows\System\aCWSXmw.exe
  C:\Windows\System\aCWSXmw.exe
  2⤵
  PID:11188
- C:\Windows\System\qxOuTlU.exe
  C:\Windows\System\qxOuTlU.exe
  2⤵
  PID:8808
- C:\Windows\System\IxAsQLH.exe
  C:\Windows\System\IxAsQLH.exe
  2⤵
  PID:11332
- C:\Windows\System\mQXiZCS.exe
  C:\Windows\System\mQXiZCS.exe
  2⤵
  PID:13216
- C:\Windows\System\AHSBcXk.exe
  C:\Windows\System\AHSBcXk.exe
  2⤵
  PID:6576
- C:\Windows\System\JGOJSsU.exe
  C:\Windows\System\JGOJSsU.exe
  2⤵
  PID:12008
- C:\Windows\System\DPeOwkd.exe
  C:\Windows\System\DPeOwkd.exe
  2⤵
  PID:4148
- C:\Windows\System\RISoSYj.exe
  C:\Windows\System\RISoSYj.exe
  2⤵
  PID:12248
- C:\Windows\System\WQdKJDp.exe
  C:\Windows\System\WQdKJDp.exe
  2⤵
  PID:4172
- C:\Windows\System\RbALrWm.exe
  C:\Windows\System\RbALrWm.exe
  2⤵
  PID:13268
- C:\Windows\System\GAtKzUh.exe
  C:\Windows\System\GAtKzUh.exe
  2⤵
  PID:12012
- C:\Windows\System\Cclmecp.exe
  C:\Windows\System\Cclmecp.exe
  2⤵
  PID:10424
- C:\Windows\System\aTrXvaR.exe
  C:\Windows\System\aTrXvaR.exe
  2⤵
  PID:12588
- C:\Windows\System\xvHORmY.exe
  C:\Windows\System\xvHORmY.exe
  2⤵
  PID:13128
- C:\Windows\System\lOyLCaJ.exe
  C:\Windows\System\lOyLCaJ.exe
  2⤵
  PID:316
- C:\Windows\System\gqpvfln.exe
  C:\Windows\System\gqpvfln.exe
  2⤵
  PID:11420
- C:\Windows\System\HqtryMF.exe
  C:\Windows\System\HqtryMF.exe
  2⤵
  PID:12496
- C:\Windows\System\aTOUXbE.exe
  C:\Windows\System\aTOUXbE.exe
  2⤵
  PID:12964
- C:\Windows\System\TDyGsHh.exe
  C:\Windows\System\TDyGsHh.exe
  2⤵
  PID:12152
- C:\Windows\System\mffByjA.exe
  C:\Windows\System\mffByjA.exe
  2⤵
  PID:6692
- C:\Windows\System\sKhUUUo.exe
  C:\Windows\System\sKhUUUo.exe
  2⤵
  PID:10560
- C:\Windows\System\QYEzrsb.exe
  C:\Windows\System\QYEzrsb.exe
  2⤵
  PID:13284
- C:\Windows\System\bGdLMEz.exe
  C:\Windows\System\bGdLMEz.exe
  2⤵
  PID:4928
- C:\Windows\System\grRAyEH.exe
  C:\Windows\System\grRAyEH.exe
  2⤵
  PID:12596
- C:\Windows\System\QbWtFcD.exe
  C:\Windows\System\QbWtFcD.exe
  2⤵
  PID:8556
- C:\Windows\System\mHAQTUX.exe
  C:\Windows\System\mHAQTUX.exe
  2⤵
  PID:1148
- C:\Windows\System\bqFfMkx.exe
  C:\Windows\System\bqFfMkx.exe
  2⤵
  PID:3956
- C:\Windows\System\ZjbNofp.exe
  C:\Windows\System\ZjbNofp.exe
  2⤵
  PID:1056
- C:\Windows\System\PSgCcId.exe
  C:\Windows\System\PSgCcId.exe
  2⤵
  PID:2128
- C:\Windows\System\nPViKBk.exe
  C:\Windows\System\nPViKBk.exe
  2⤵
  PID:11620
- C:\Windows\System\dOHdlle.exe
  C:\Windows\System\dOHdlle.exe
  2⤵
  PID:7480
- C:\Windows\System\RLebEXD.exe
  C:\Windows\System\RLebEXD.exe
  2⤵
  PID:10456
- C:\Windows\System\SYastVO.exe
  C:\Windows\System\SYastVO.exe
  2⤵
  PID:13224
- C:\Windows\System\BWpgSjl.exe
  C:\Windows\System\BWpgSjl.exe
  2⤵
  PID:13336
- C:\Windows\System\IvWLHJa.exe
  C:\Windows\System\IvWLHJa.exe
  2⤵
  PID:13424
- C:\Windows\System\kXVhITU.exe
  C:\Windows\System\kXVhITU.exe
  2⤵
  PID:13716
- C:\Windows\System\WPbJOrI.exe
  C:\Windows\System\WPbJOrI.exe
  2⤵
  PID:13752
- C:\Windows\System\jPsPHxJ.exe
  C:\Windows\System\jPsPHxJ.exe
  2⤵
  PID:13768
- C:\Windows\System\xvELZuF.exe
  C:\Windows\System\xvELZuF.exe
  2⤵
  PID:13784
- C:\Windows\System\ndTukPW.exe
  C:\Windows\System\ndTukPW.exe
  2⤵
  PID:13804
- C:\Windows\System\VoIpywF.exe
  C:\Windows\System\VoIpywF.exe
  2⤵
  PID:13836
- C:\Windows\System\oyvUnwU.exe
  C:\Windows\System\oyvUnwU.exe
  2⤵
  PID:13876
- C:\Windows\System\nvLINAm.exe
  C:\Windows\System\nvLINAm.exe
  2⤵
  PID:13900
- C:\Windows\System\roNVyQO.exe
  C:\Windows\System\roNVyQO.exe
  2⤵
  PID:13932
- C:\Windows\System\pzEKLwT.exe
  C:\Windows\System\pzEKLwT.exe
  2⤵
  PID:13244
- C:\Windows\System\iNpZMVv.exe
  C:\Windows\System\iNpZMVv.exe
  2⤵
  PID:12692
- C:\Windows\System\rfsyxFQ.exe
  C:\Windows\System\rfsyxFQ.exe
  2⤵
  PID:13476
- C:\Windows\System\CKaKwhl.exe
  C:\Windows\System\CKaKwhl.exe
  2⤵
  PID:12708
- C:\Windows\System\sqVRFag.exe
  C:\Windows\System\sqVRFag.exe
  2⤵
  PID:13400
- C:\Windows\System\DVefziz.exe
  C:\Windows\System\DVefziz.exe
  2⤵
  PID:12996
- C:\Windows\System\BaTYyxs.exe
  C:\Windows\System\BaTYyxs.exe
  2⤵
  PID:13532
- C:\Windows\System\FQZEtUV.exe
  C:\Windows\System\FQZEtUV.exe
  2⤵
  PID:13612
- C:\Windows\System\XkDspmt.exe
  C:\Windows\System\XkDspmt.exe
  2⤵
  PID:13960
- C:\Windows\System\LBdylVg.exe
  C:\Windows\System\LBdylVg.exe
  2⤵
  PID:13368
- C:\Windows\System\ahNRTTC.exe
  C:\Windows\System\ahNRTTC.exe
  2⤵
  PID:14220
- C:\Windows\System\mQFLrJm.exe
  C:\Windows\System\mQFLrJm.exe
  2⤵
  PID:14184
- C:\Windows\System\AwitUKS.exe
  C:\Windows\System\AwitUKS.exe
  2⤵
  PID:14072
- C:\Windows\System\YexEsiV.exe
  C:\Windows\System\YexEsiV.exe
  2⤵
  PID:4452
- C:\Windows\System\NCfakcm.exe
  C:\Windows\System\NCfakcm.exe
  2⤵
  PID:12820
- C:\Windows\System\gAmSoza.exe
  C:\Windows\System\gAmSoza.exe
  2⤵
  PID:11432
- C:\Windows\System\vdNCCGj.exe
  C:\Windows\System\vdNCCGj.exe
  2⤵
  PID:13608
- C:\Windows\System\EsKGNXN.exe
  C:\Windows\System\EsKGNXN.exe
  2⤵
  PID:13632
- C:\Windows\System\GkgNZcz.exe
  C:\Windows\System\GkgNZcz.exe
  2⤵
  PID:13584
- C:\Windows\System\wuHvmKD.exe
  C:\Windows\System\wuHvmKD.exe
  2⤵
  PID:13712
- C:\Windows\System\LJGNSsh.exe
  C:\Windows\System\LJGNSsh.exe
  2⤵
  PID:4464
- C:\Windows\System\MrryGWt.exe
  C:\Windows\System\MrryGWt.exe
  2⤵
  PID:13660
- C:\Windows\System\CVqiTFC.exe
  C:\Windows\System\CVqiTFC.exe
  2⤵
  PID:13676
- C:\Windows\System\LuOQJyT.exe
  C:\Windows\System\LuOQJyT.exe
  2⤵
  PID:12016
- C:\Windows\System\nBcYSYM.exe
  C:\Windows\System\nBcYSYM.exe
  2⤵
  PID:13732
- C:\Windows\System\BeRocUM.exe
  C:\Windows\System\BeRocUM.exe
  2⤵
  PID:13512
- C:\Windows\System\MtaVNGt.exe
  C:\Windows\System\MtaVNGt.exe
  2⤵
  PID:13544
- C:\Windows\System\VpAPkUf.exe
  C:\Windows\System\VpAPkUf.exe
  2⤵
  PID:13564
- C:\Windows\System\bodAAHv.exe
  C:\Windows\System\bodAAHv.exe
  2⤵
  PID:13868
- C:\Windows\System\ceAFBJD.exe
  C:\Windows\System\ceAFBJD.exe
  2⤵
  PID:5036
- C:\Windows\System\aiihJaT.exe
  C:\Windows\System\aiihJaT.exe
  2⤵
  PID:3604
- C:\Windows\System\DFILFDr.exe
  C:\Windows\System\DFILFDr.exe
  2⤵
  PID:13372
- C:\Windows\System\VcktzEh.exe
  C:\Windows\System\VcktzEh.exe
  2⤵
  PID:13384
- C:\Windows\System\dokxPOz.exe
  C:\Windows\System\dokxPOz.exe
  2⤵
  PID:4596
- C:\Windows\System\kuUqCfi.exe
  C:\Windows\System\kuUqCfi.exe
  2⤵
  PID:6096
- C:\Windows\System\QSXJnVG.exe
  C:\Windows\System\QSXJnVG.exe
  2⤵
  PID:13560
- C:\Windows\System\XfeNCGI.exe
  C:\Windows\System\XfeNCGI.exe
  2⤵
  PID:13500
- C:\Windows\System\QManOHW.exe
  C:\Windows\System\QManOHW.exe
  2⤵
  PID:14008
- C:\Windows\System\eIdeRHe.exe
  C:\Windows\System\eIdeRHe.exe
  2⤵
  PID:644
- C:\Windows\System\QwxeoUG.exe
  C:\Windows\System\QwxeoUG.exe
  2⤵
  PID:14328
- C:\Windows\System\CSeVxZP.exe
  C:\Windows\System\CSeVxZP.exe
  2⤵
  PID:13420
- C:\Windows\System\mvoaXKK.exe
  C:\Windows\System\mvoaXKK.exe
  2⤵
  PID:14160
- C:\Windows\System\aGExsVD.exe
  C:\Windows\System\aGExsVD.exe
  2⤵
  PID:4484
- C:\Windows\System\FCMoigB.exe
  C:\Windows\System\FCMoigB.exe
  2⤵
  PID:13700
- C:\Windows\System\wQgiewi.exe
  C:\Windows\System\wQgiewi.exe
  2⤵
  PID:13912
- C:\Windows\System\IgWLgYo.exe
  C:\Windows\System\IgWLgYo.exe
  2⤵
  PID:14272
- C:\Windows\System\hAHOWIi.exe
  C:\Windows\System\hAHOWIi.exe
  2⤵
  PID:3592
- C:\Windows\System\kMxkAHM.exe
  C:\Windows\System\kMxkAHM.exe
  2⤵
  PID:14148
- C:\Windows\System\SkUNZVA.exe
  C:\Windows\System\SkUNZVA.exe
  2⤵
  PID:14084
- C:\Windows\System\uFUQbKb.exe
  C:\Windows\System\uFUQbKb.exe
  2⤵
  PID:14108
- C:\Windows\System\lxeSoNs.exe
  C:\Windows\System\lxeSoNs.exe
  2⤵
  PID:4404
- C:\Windows\System\BpdDYZH.exe
  C:\Windows\System\BpdDYZH.exe
  2⤵
  PID:3584
- C:\Windows\System\KlzIxAO.exe
  C:\Windows\System\KlzIxAO.exe
  2⤵
  PID:3156
- C:\Windows\System\AcVAQMo.exe
  C:\Windows\System\AcVAQMo.exe
  2⤵
  PID:13872
- C:\Windows\System\jqalpCA.exe
  C:\Windows\System\jqalpCA.exe
  2⤵
  PID:14116
- C:\Windows\System\GBtDXUS.exe
  C:\Windows\System\GBtDXUS.exe
  2⤵
  PID:14032
- C:\Windows\System\YTTXtVV.exe
  C:\Windows\System\YTTXtVV.exe
  2⤵
  PID:14268
- C:\Windows\System\ioHGbxg.exe
  C:\Windows\System\ioHGbxg.exe
  2⤵
  PID:1432
- C:\Windows\System\lzwRFHK.exe
  C:\Windows\System\lzwRFHK.exe
  2⤵
  PID:4516
- C:\Windows\System\FIQETeR.exe
  C:\Windows\System\FIQETeR.exe
  2⤵
  PID:4440
- C:\Windows\System\PiIGnvV.exe
  C:\Windows\System\PiIGnvV.exe
  2⤵
  PID:1344
- C:\Windows\System\SZyfxBR.exe
  C:\Windows\System\SZyfxBR.exe
  2⤵
  PID:12788
- C:\Windows\System\lJzGPuj.exe
  C:\Windows\System\lJzGPuj.exe
  2⤵
  PID:2964
- C:\Windows\System\lYmMyuc.exe
  C:\Windows\System\lYmMyuc.exe
  2⤵
  PID:2728
- C:\Windows\System\jSreufU.exe
  C:\Windows\System\jSreufU.exe
  2⤵
  PID:14308
- C:\Windows\System\RmJCIat.exe
  C:\Windows\System\RmJCIat.exe
  2⤵
  PID:13344
- C:\Windows\System\igwvxkX.exe
  C:\Windows\System\igwvxkX.exe
  2⤵
  PID:564
- C:\Windows\System\hJlrXIO.exe
  C:\Windows\System\hJlrXIO.exe
  2⤵
  PID:868
- C:\Windows\System\pONrUwc.exe
  C:\Windows\System\pONrUwc.exe
  2⤵
  PID:4616
- C:\Windows\System\jbCNVRn.exe
  C:\Windows\System\jbCNVRn.exe
  2⤵
  PID:13396
- C:\Windows\System\dzJozrO.exe
  C:\Windows\System\dzJozrO.exe
  2⤵
  PID:7492
- C:\Windows\System\OkODqAv.exe
  C:\Windows\System\OkODqAv.exe
  2⤵
  PID:1256
- C:\Windows\System\UVSyXfK.exe
  C:\Windows\System\UVSyXfK.exe
  2⤵
  PID:13464
- C:\Windows\System\UDuACCA.exe
  C:\Windows\System\UDuACCA.exe
  2⤵
  PID:7504
- C:\Windows\System\SEkmPCF.exe
  C:\Windows\System\SEkmPCF.exe
  2⤵
  PID:1144
- C:\Windows\System\FxExDCm.exe
  C:\Windows\System\FxExDCm.exe
  2⤵
  PID:2136
- C:\Windows\System\exRSVgH.exe
  C:\Windows\System\exRSVgH.exe
  2⤵
  PID:14000
- C:\Windows\System\ouRKLIL.exe
  C:\Windows\System\ouRKLIL.exe
  2⤵
  PID:2780
- C:\Windows\System\HWsEYLO.exe
  C:\Windows\System\HWsEYLO.exe
  2⤵
  PID:4244
- C:\Windows\System\BHKWAuE.exe
  C:\Windows\System\BHKWAuE.exe
  2⤵
  PID:3940
- C:\Windows\System\VgsMMic.exe
  C:\Windows\System\VgsMMic.exe
  2⤵
  PID:14216
- C:\Windows\System\kJoRHvS.exe
  C:\Windows\System\kJoRHvS.exe
  2⤵
  PID:3600
- C:\Windows\System\daQiwbu.exe
  C:\Windows\System\daQiwbu.exe
  2⤵
  PID:1884
- C:\Windows\System\GZfsMSH.exe
  C:\Windows\System\GZfsMSH.exe
  2⤵
  PID:2100
- C:\Windows\System\HBAtzbP.exe
  C:\Windows\System\HBAtzbP.exe
  2⤵
  PID:4008
- C:\Windows\System\KRYxeSK.exe
  C:\Windows\System\KRYxeSK.exe
  2⤵
  PID:13488
- C:\Windows\System\SOFcjut.exe
  C:\Windows\System\SOFcjut.exe
  2⤵
  PID:5292
- C:\Windows\System\ESAAeFS.exe
  C:\Windows\System\ESAAeFS.exe
  2⤵
  PID:840
- C:\Windows\System\xLpodaB.exe
  C:\Windows\System\xLpodaB.exe
  2⤵
  PID:5228
- C:\Windows\System\KgyOUDv.exe
  C:\Windows\System\KgyOUDv.exe
  2⤵
  PID:4956
- C:\Windows\System\tsQKonv.exe
  C:\Windows\System\tsQKonv.exe
  2⤵
  PID:3544
- C:\Windows\System\UBeFrWS.exe
  C:\Windows\System\UBeFrWS.exe
  2⤵
  PID:3124
- C:\Windows\System\TSxWjHo.exe
  C:\Windows\System\TSxWjHo.exe
  2⤵
  PID:5512
- C:\Windows\System\goLnYdX.exe
  C:\Windows\System\goLnYdX.exe
  2⤵
  PID:14016
- C:\Windows\System\mBiIlNb.exe
  C:\Windows\System\mBiIlNb.exe
  2⤵
  PID:4340
- C:\Windows\System\GXYzWzj.exe
  C:\Windows\System\GXYzWzj.exe
  2⤵
  PID:5064
- C:\Windows\System\DxvFabl.exe
  C:\Windows\System\DxvFabl.exe
  2⤵
  PID:5736
- C:\Windows\System\IeGHFaG.exe
  C:\Windows\System\IeGHFaG.exe
  2⤵
  PID:7064
- C:\Windows\System\mKnGjnz.exe
  C:\Windows\System\mKnGjnz.exe
  2⤵
  PID:6048
- C:\Windows\System\PnFvXpX.exe
  C:\Windows\System\PnFvXpX.exe
  2⤵
  PID:6060
- C:\Windows\System\adRTopK.exe
  C:\Windows\System\adRTopK.exe
  2⤵
  PID:6084
- C:\Windows\System\lmsPQVL.exe
  C:\Windows\System\lmsPQVL.exe
  2⤵
  PID:6088
- C:\Windows\System\ApMGNBz.exe
  C:\Windows\System\ApMGNBz.exe
  2⤵
  PID:13456
- C:\Windows\System\ZPnpqvq.exe
  C:\Windows\System\ZPnpqvq.exe
  2⤵
  PID:2628
- C:\Windows\System\FxDeKIh.exe
  C:\Windows\System\FxDeKIh.exe
  2⤵
  PID:1952
- C:\Windows\System\SPlnHUi.exe
  C:\Windows\System\SPlnHUi.exe
  2⤵
  PID:6064
- C:\Windows\System\PkbBqci.exe
  C:\Windows\System\PkbBqci.exe
  2⤵
  PID:3952
- C:\Windows\System\MLySypZ.exe
  C:\Windows\System\MLySypZ.exe
  2⤵
  PID:5220
- C:\Windows\System\wmACKEB.exe
  C:\Windows\System\wmACKEB.exe
  2⤵
  PID:5316
- C:\Windows\System\JhRaQvo.exe
  C:\Windows\System\JhRaQvo.exe
  2⤵
  PID:6128
- C:\Windows\System\ybcBPxe.exe
  C:\Windows\System\ybcBPxe.exe
  2⤵
  PID:5096
- C:\Windows\System\LLZHjoR.exe
  C:\Windows\System\LLZHjoR.exe
  2⤵
  PID:3244
- C:\Windows\System\EswciQj.exe
  C:\Windows\System\EswciQj.exe
  2⤵
  PID:2068
- C:\Windows\System\WoVWWGC.exe
  C:\Windows\System\WoVWWGC.exe
  2⤵
  PID:6768
- C:\Windows\System\FGhQBrB.exe
  C:\Windows\System\FGhQBrB.exe
  2⤵
  PID:6280
- C:\Windows\System\qaWJMXB.exe
  C:\Windows\System\qaWJMXB.exe
  2⤵
  PID:5676
- C:\Windows\System\cBCjYTC.exe
  C:\Windows\System\cBCjYTC.exe
  2⤵
  PID:5900
- C:\Windows\System\vvJLThd.exe
  C:\Windows\System\vvJLThd.exe
  2⤵
  PID:6528
- C:\Windows\System\SRAUuDF.exe
  C:\Windows\System\SRAUuDF.exe
  2⤵
  PID:5952
- C:\Windows\System\dqbVNOr.exe
  C:\Windows\System\dqbVNOr.exe
  2⤵
  PID:6572
- C:\Windows\System\ntrpfpP.exe
  C:\Windows\System\ntrpfpP.exe
  2⤵
  PID:7220
- C:\Windows\System\HIiksxd.exe
  C:\Windows\System\HIiksxd.exe
  2⤵
  PID:5596
- C:\Windows\System\NJYCraM.exe
  C:\Windows\System\NJYCraM.exe
  2⤵
  PID:64
- C:\Windows\System\FoIJzhw.exe
  C:\Windows\System\FoIJzhw.exe
  2⤵
  PID:6276
- C:\Windows\System\UGlIgJx.exe
  C:\Windows\System\UGlIgJx.exe
  2⤵
  PID:7856
- C:\Windows\System\FcalJaJ.exe
  C:\Windows\System\FcalJaJ.exe
  2⤵
  PID:6996
- C:\Windows\System\DxnGNmq.exe
  C:\Windows\System\DxnGNmq.exe
  2⤵
  PID:6672
- C:\Windows\System\KmOYidB.exe
  C:\Windows\System\KmOYidB.exe
  2⤵
  PID:6988
- C:\Windows\System\NoVZIfR.exe
  C:\Windows\System\NoVZIfR.exe
  2⤵
  PID:8124
- C:\Windows\System\XaWraZX.exe
  C:\Windows\System\XaWraZX.exe
  2⤵
  PID:2952
- C:\Windows\System\LoOdxgy.exe
  C:\Windows\System\LoOdxgy.exe
  2⤵
  PID:14036
- C:\Windows\System\FEKOFWp.exe
  C:\Windows\System\FEKOFWp.exe
  2⤵
  PID:7300
- C:\Windows\System\mRcyKaR.exe
  C:\Windows\System\mRcyKaR.exe
  2⤵
  PID:7544
- C:\Windows\System\iEdpibA.exe
  C:\Windows\System\iEdpibA.exe
  2⤵
  PID:6640
- C:\Windows\System\xarYuuq.exe
  C:\Windows\System\xarYuuq.exe
  2⤵
  PID:6732
- C:\Windows\System\PSRbmOz.exe
  C:\Windows\System\PSRbmOz.exe
  2⤵
  PID:5164
- C:\Windows\System\wXRLdyb.exe
  C:\Windows\System\wXRLdyb.exe
  2⤵
  PID:8416
- C:\Windows\System\aHqonqH.exe
  C:\Windows\System\aHqonqH.exe
  2⤵
  PID:8448
- C:\Windows\System\CbnCPjp.exe
  C:\Windows\System\CbnCPjp.exe
  2⤵
  PID:7880
- C:\Windows\System\IbfLugM.exe
  C:\Windows\System\IbfLugM.exe
  2⤵
  PID:8732
- C:\Windows\System\SJaunZq.exe
  C:\Windows\System\SJaunZq.exe
  2⤵
  PID:3468
- C:\Windows\System\qbcBRdM.exe
  C:\Windows\System\qbcBRdM.exe
  2⤵
  PID:8956
- C:\Windows\System\zClrQvw.exe
  C:\Windows\System\zClrQvw.exe
  2⤵
  PID:5884
- C:\Windows\System\sqEHAlc.exe
  C:\Windows\System\sqEHAlc.exe
  2⤵
  PID:7060
- C:\Windows\System\urdlwbZ.exe
  C:\Windows\System\urdlwbZ.exe
  2⤵
  PID:7932
- C:\Windows\System\UplOJih.exe
  C:\Windows\System\UplOJih.exe
  2⤵
  PID:8012
- C:\Windows\System\CpRrPET.exe
  C:\Windows\System\CpRrPET.exe
  2⤵
  PID:7508
- C:\Windows\System\yrcxkbS.exe
  C:\Windows\System\yrcxkbS.exe
  2⤵
  PID:8500
- C:\Windows\System\EXqLbRt.exe
  C:\Windows\System\EXqLbRt.exe
  2⤵
  PID:7908
- C:\Windows\System\lWmTuLI.exe
  C:\Windows\System\lWmTuLI.exe
  2⤵
  PID:956
- C:\Windows\System\OGDjXDT.exe
  C:\Windows\System\OGDjXDT.exe
  2⤵
  PID:7140
- C:\Windows\System\rCSPeJM.exe
  C:\Windows\System\rCSPeJM.exe
  2⤵
  PID:8352
- C:\Windows\System\ZHwEJih.exe
  C:\Windows\System\ZHwEJih.exe
  2⤵
  PID:6712
- C:\Windows\System\IrRntwy.exe
  C:\Windows\System\IrRntwy.exe
  2⤵
  PID:9572
- C:\Windows\System\VZjiZNE.exe
  C:\Windows\System\VZjiZNE.exe
  2⤵
  PID:4164
- C:\Windows\System\sTMSTrB.exe
  C:\Windows\System\sTMSTrB.exe
  2⤵
  PID:7128
- C:\Windows\System\TFakaJj.exe
  C:\Windows\System\TFakaJj.exe
  2⤵
  PID:5428
- C:\Windows\System\XaShsvd.exe
  C:\Windows\System\XaShsvd.exe
  2⤵
  PID:1052
- C:\Windows\System\EZTLWBF.exe
  C:\Windows\System\EZTLWBF.exe
  2⤵
  PID:7736
- C:\Windows\System\uMmsLLb.exe
  C:\Windows\System\uMmsLLb.exe
  2⤵
  PID:9656
- C:\Windows\System\XgcNvKe.exe
  C:\Windows\System\XgcNvKe.exe
  2⤵
  PID:9736
- C:\Windows\System\MRuhFPS.exe
  C:\Windows\System\MRuhFPS.exe
  2⤵
  PID:7920
- C:\Windows\System\ffbMacv.exe
  C:\Windows\System\ffbMacv.exe
  2⤵
  PID:8252
- C:\Windows\System\hjYayIs.exe
  C:\Windows\System\hjYayIs.exe
  2⤵
  PID:9928
- C:\Windows\System\VqwMGJV.exe
  C:\Windows\System\VqwMGJV.exe
  2⤵
  PID:7016
- C:\Windows\System\qSbFWXP.exe
  C:\Windows\System\qSbFWXP.exe
  2⤵
  PID:10476
- C:\Windows\System\cSxUiUg.exe
  C:\Windows\System\cSxUiUg.exe
  2⤵
  PID:10176
- C:\Windows\System\PxUYVXb.exe
  C:\Windows\System\PxUYVXb.exe
  2⤵
  PID:9264
- C:\Windows\System\arpGHEv.exe
  C:\Windows\System\arpGHEv.exe
  2⤵
  PID:5584
- C:\Windows\System\tFoJive.exe
  C:\Windows\System\tFoJive.exe
  2⤵
  PID:8452
- C:\Windows\System\GynBJlN.exe
  C:\Windows\System\GynBJlN.exe
  2⤵
  PID:11016
- C:\Windows\System\JIFAgXN.exe
  C:\Windows\System\JIFAgXN.exe
  2⤵
  PID:7972
- C:\Windows\System\faTyoqf.exe
  C:\Windows\System\faTyoqf.exe
  2⤵
  PID:14088
- C:\Windows\System\rGCiLiY.exe
  C:\Windows\System\rGCiLiY.exe
  2⤵
  PID:4544
- C:\Windows\System\ejnOkXM.exe
  C:\Windows\System\ejnOkXM.exe
  2⤵
  PID:13440
- C:\Windows\System\lFUQfIQ.exe
  C:\Windows\System\lFUQfIQ.exe
  2⤵
  PID:9124
- C:\Windows\System\aFtrBgl.exe
  C:\Windows\System\aFtrBgl.exe
  2⤵
  PID:9152
- C:\Windows\System\pULfYKT.exe
  C:\Windows\System\pULfYKT.exe
  2⤵
  PID:6092
- C:\Windows\System\EPFIWue.exe
  C:\Windows\System\EPFIWue.exe
  2⤵
  PID:5604
- C:\Windows\System\xItrQqf.exe
  C:\Windows\System\xItrQqf.exe
  2⤵
  PID:8088
- C:\Windows\System\GwnMGHE.exe
  C:\Windows\System\GwnMGHE.exe
  2⤵
  PID:10432
- C:\Windows\System\UHfMOWE.exe
  C:\Windows\System\UHfMOWE.exe
  2⤵
  PID:7644
- C:\Windows\System\sMiOJqs.exe
  C:\Windows\System\sMiOJqs.exe
  2⤵
  PID:7172
- C:\Windows\System\tAkuLxx.exe
  C:\Windows\System\tAkuLxx.exe
  2⤵
  PID:7944
- C:\Windows\System\jdsffrj.exe
  C:\Windows\System\jdsffrj.exe
  2⤵
  PID:8856
- C:\Windows\System\RYPOjEw.exe
  C:\Windows\System\RYPOjEw.exe
  2⤵
  PID:13360
- C:\Windows\System\AysbPwL.exe
  C:\Windows\System\AysbPwL.exe
  2⤵
  PID:11112
- C:\Windows\System\dViBaKo.exe
  C:\Windows\System\dViBaKo.exe
  2⤵
  PID:10364
- C:\Windows\System\gskxPMD.exe
  C:\Windows\System\gskxPMD.exe
  2⤵
  PID:8784
- C:\Windows\System\UnfcxdC.exe
  C:\Windows\System\UnfcxdC.exe
  2⤵
  PID:9888
- C:\Windows\System\ceSjgPY.exe
  C:\Windows\System\ceSjgPY.exe
  2⤵
  PID:10484
- C:\Windows\System\wnxpLqo.exe
  C:\Windows\System\wnxpLqo.exe
  2⤵
  PID:3736
- C:\Windows\System\zyGsbez.exe
  C:\Windows\System\zyGsbez.exe
  2⤵
  PID:6376
- C:\Windows\System\mtUtJvJ.exe
  C:\Windows\System\mtUtJvJ.exe
  2⤵
  PID:10152
- C:\Windows\System\tvNVCTm.exe
  C:\Windows\System\tvNVCTm.exe
  2⤵
  PID:9364
- C:\Windows\System\TdTutme.exe
  C:\Windows\System\TdTutme.exe
  2⤵
  PID:5708
- C:\Windows\System\igisFII.exe
  C:\Windows\System\igisFII.exe
  2⤵
  PID:9040
- C:\Windows\System\WOgDicZ.exe
  C:\Windows\System\WOgDicZ.exe
  2⤵
  PID:9172
- C:\Windows\System\ONQlNpJ.exe
  C:\Windows\System\ONQlNpJ.exe
  2⤵
  PID:9060
- C:\Windows\System\ptsBsEU.exe
  C:\Windows\System\ptsBsEU.exe
  2⤵
  PID:14052
- C:\Windows\System\xRCVfks.exe
  C:\Windows\System\xRCVfks.exe
  2⤵
  PID:10860
- C:\Windows\System\arwRYkr.exe
  C:\Windows\System\arwRYkr.exe
  2⤵
  PID:10356
- C:\Windows\System\rIQhCBi.exe
  C:\Windows\System\rIQhCBi.exe
  2⤵
  PID:10376
- C:\Windows\System\rufrHpS.exe
  C:\Windows\System\rufrHpS.exe
  2⤵
  PID:8852
- C:\Windows\System\oRDKNHu.exe
  C:\Windows\System\oRDKNHu.exe
  2⤵
  PID:8716
- C:\Windows\System\UhItlqj.exe
  C:\Windows\System\UhItlqj.exe
  2⤵
  PID:11400
- C:\Windows\System\bCipinx.exe
  C:\Windows\System\bCipinx.exe
  2⤵
  PID:9132
- C:\Windows\System\kfBPQFZ.exe
  C:\Windows\System\kfBPQFZ.exe
  2⤵
  PID:9588
- C:\Windows\System\ObzIlbI.exe
  C:\Windows\System\ObzIlbI.exe
  2⤵
  PID:12680
- C:\Windows\System\NVwLDrE.exe
  C:\Windows\System\NVwLDrE.exe
  2⤵
  PID:11728
- C:\Windows\System\mENxZVI.exe
  C:\Windows\System\mENxZVI.exe
  2⤵
  PID:8600
- C:\Windows\System\RJaThrE.exe
  C:\Windows\System\RJaThrE.exe
  2⤵
  PID:12752
- C:\Windows\System\DvTdaHk.exe
  C:\Windows\System\DvTdaHk.exe
  2⤵
  PID:10244
- C:\Windows\System\MVgnjsR.exe
  C:\Windows\System\MVgnjsR.exe
  2⤵
  PID:8112
- C:\Windows\System\CIphUmL.exe
  C:\Windows\System\CIphUmL.exe
  2⤵
  PID:12088
- C:\Windows\System\fpyPZCi.exe
  C:\Windows\System\fpyPZCi.exe
  2⤵
  PID:7416
- C:\Windows\System\ZEnnSCB.exe
  C:\Windows\System\ZEnnSCB.exe
  2⤵
  PID:8468
- C:\Windows\System\rUuTFqi.exe
  C:\Windows\System\rUuTFqi.exe
  2⤵
  PID:10360
- C:\Windows\System\ChArNYh.exe
  C:\Windows\System\ChArNYh.exe
  2⤵
  PID:12320
- C:\Windows\System\eLXtsHy.exe
  C:\Windows\System\eLXtsHy.exe
  2⤵
  PID:6152
- C:\Windows\System\pjepRtH.exe
  C:\Windows\System\pjepRtH.exe
  2⤵
  PID:13044
- C:\Windows\System\OuKJVTB.exe
  C:\Windows\System\OuKJVTB.exe
  2⤵
  PID:8596
- C:\Windows\System\lfcglcT.exe
  C:\Windows\System\lfcglcT.exe
  2⤵
  PID:8028
- C:\Windows\System\vMPCrtU.exe
  C:\Windows\System\vMPCrtU.exe
  2⤵
  PID:12504
- C:\Windows\System\zpFCZpZ.exe
  C:\Windows\System\zpFCZpZ.exe
  2⤵
  PID:11308
- C:\Windows\System\iolXYdx.exe
  C:\Windows\System\iolXYdx.exe
  2⤵
  PID:8496
- C:\Windows\System\SvRpgGw.exe
  C:\Windows\System\SvRpgGw.exe
  2⤵
  PID:9436
- C:\Windows\System\XhIGDuU.exe
  C:\Windows\System\XhIGDuU.exe
  2⤵
  PID:11140
- C:\Windows\System\FbFUnCh.exe
  C:\Windows\System\FbFUnCh.exe
  2⤵
  PID:10368
- C:\Windows\System\fGjOGkJ.exe
  C:\Windows\System\fGjOGkJ.exe
  2⤵
  PID:11448
- C:\Windows\System\YfuUUzc.exe
  C:\Windows\System\YfuUUzc.exe
  2⤵
  PID:13080
- C:\Windows\System\iKWcBJE.exe
  C:\Windows\System\iKWcBJE.exe
  2⤵
  PID:10572
- C:\Windows\System\HFdwaoD.exe
  C:\Windows\System\HFdwaoD.exe
  2⤵
  PID:10676
- C:\Windows\System\uSuzQsr.exe
  C:\Windows\System\uSuzQsr.exe
  2⤵
  PID:4044
- C:\Windows\System\NjSYVTc.exe
  C:\Windows\System\NjSYVTc.exe
  2⤵
  PID:9720
- C:\Windows\System\SplnAIQ.exe
  C:\Windows\System\SplnAIQ.exe
  2⤵
  PID:11684
- C:\Windows\System\QpJWyBt.exe
  C:\Windows\System\QpJWyBt.exe
  2⤵
  PID:11804
- C:\Windows\System\xNIfzJD.exe
  C:\Windows\System\xNIfzJD.exe
  2⤵
  PID:11832
- C:\Windows\System\uYOczPj.exe
  C:\Windows\System\uYOczPj.exe
  2⤵
  PID:12864
- C:\Windows\System\hCPFvgL.exe
  C:\Windows\System\hCPFvgL.exe
  2⤵
  PID:8200
- C:\Windows\System\YEnxRna.exe
  C:\Windows\System\YEnxRna.exe
  2⤵
  PID:10316
- C:\Windows\System\ZXsYyTF.exe
  C:\Windows\System\ZXsYyTF.exe
  2⤵
  PID:12224
- C:\Windows\System\EHsTSCD.exe
  C:\Windows\System\EHsTSCD.exe
  2⤵
  PID:5948
- C:\Windows\System\ADlvWXg.exe
  C:\Windows\System\ADlvWXg.exe
  2⤵
  PID:12172
- C:\Windows\System\xWzcTkP.exe
  C:\Windows\System\xWzcTkP.exe
  2⤵
  PID:12844
- C:\Windows\System\hIanZhG.exe
  C:\Windows\System\hIanZhG.exe
  2⤵
  PID:12516
- C:\Windows\System\VkRDNRK.exe
  C:\Windows\System\VkRDNRK.exe
  2⤵
  PID:9452
- C:\Windows\System\hYLAUsz.exe
  C:\Windows\System\hYLAUsz.exe
  2⤵
  PID:8900
- C:\Windows\System\fHtzmIW.exe
  C:\Windows\System\fHtzmIW.exe
  2⤵
  PID:11756
- C:\Windows\System\JPQtxdg.exe
  C:\Windows\System\JPQtxdg.exe
  2⤵
  PID:8756
- C:\Windows\System\oGfvMAH.exe
  C:\Windows\System\oGfvMAH.exe
  2⤵
  PID:7748
- C:\Windows\System\SfeHCCG.exe
  C:\Windows\System\SfeHCCG.exe
  2⤵
  PID:9784
- C:\Windows\System\BuBCSMR.exe
  C:\Windows\System\BuBCSMR.exe
  2⤵
  PID:8212
- C:\Windows\System\uLiaDbW.exe
  C:\Windows\System\uLiaDbW.exe
  2⤵
  PID:4004
- C:\Windows\System\dIxtrwp.exe
  C:\Windows\System\dIxtrwp.exe
  2⤵
  PID:13156
- C:\Windows\System\YTznscb.exe
  C:\Windows\System\YTznscb.exe
  2⤵
  PID:10312
- C:\Windows\System\ZVfUwAY.exe
  C:\Windows\System\ZVfUwAY.exe
  2⤵
  PID:13016
- C:\Windows\System\HCMnwRD.exe
  C:\Windows\System\HCMnwRD.exe
  2⤵
  PID:12948
- C:\Windows\System\xIDIGgD.exe
  C:\Windows\System\xIDIGgD.exe
  2⤵
  PID:12384
- C:\Windows\System\AkFDPex.exe
  C:\Windows\System\AkFDPex.exe
  2⤵
  PID:8668
- C:\Windows\System\qKffUzU.exe
  C:\Windows\System\qKffUzU.exe
  2⤵
  PID:13068
- C:\Windows\System\cNkPhdV.exe
  C:\Windows\System\cNkPhdV.exe
  2⤵
  PID:12592
- C:\Windows\System\oxWcmqO.exe
  C:\Windows\System\oxWcmqO.exe
  2⤵
  PID:12936
- C:\Windows\System\OESqdIu.exe
  C:\Windows\System\OESqdIu.exe
  2⤵
  PID:1544
- C:\Windows\System\ukMVnBP.exe
  C:\Windows\System\ukMVnBP.exe
  2⤵
  PID:6968
- C:\Windows\System\zSRRsLM.exe
  C:\Windows\System\zSRRsLM.exe
  2⤵
  PID:7132
- C:\Windows\System\xdVdBwo.exe
  C:\Windows\System\xdVdBwo.exe
  2⤵
  PID:12776
- C:\Windows\System\eivquaG.exe
  C:\Windows\System\eivquaG.exe
  2⤵
  PID:9716
- C:\Windows\System\vjtebOf.exe
  C:\Windows\System\vjtebOf.exe
  2⤵
  PID:12436
- C:\Windows\System\BQkkyuO.exe
  C:\Windows\System\BQkkyuO.exe
  2⤵
  PID:11780
- C:\Windows\System\LwPxBlc.exe
  C:\Windows\System\LwPxBlc.exe
  2⤵
  PID:12272
- C:\Windows\System\nElgHqa.exe
  C:\Windows\System\nElgHqa.exe
  2⤵
  PID:4520
- C:\Windows\System\qJKhtFT.exe
  C:\Windows\System\qJKhtFT.exe
  2⤵
  PID:12456
- C:\Windows\System\gDmQxgU.exe
  C:\Windows\System\gDmQxgU.exe
  2⤵
  PID:11800
- C:\Windows\System\XpzWnIC.exe
  C:\Windows\System\XpzWnIC.exe
  2⤵
  PID:12904
- C:\Windows\System\bVUEMCs.exe
  C:\Windows\System\bVUEMCs.exe
  2⤵
  PID:10812
- C:\Windows\System\Tjrohjf.exe
  C:\Windows\System\Tjrohjf.exe
  2⤵
  PID:12608
- C:\Windows\System\PQkiKLk.exe
  C:\Windows\System\PQkiKLk.exe
  2⤵
  PID:11572
- C:\Windows\System\VSoUYBl.exe
  C:\Windows\System\VSoUYBl.exe
  2⤵
  PID:11568
- C:\Windows\System\ZrEyIgd.exe
  C:\Windows\System\ZrEyIgd.exe
  2⤵
  PID:4492
- C:\Windows\System\sinQmBb.exe
  C:\Windows\System\sinQmBb.exe
  2⤵
  PID:11164
- C:\Windows\System\UNeDZZa.exe
  C:\Windows\System\UNeDZZa.exe
  2⤵
  PID:13416
- C:\Windows\System\pBgEOEv.exe
  C:\Windows\System\pBgEOEv.exe
  2⤵
  PID:12768
- C:\Windows\System\gTimPKq.exe
  C:\Windows\System\gTimPKq.exe
  2⤵
  PID:13748
- C:\Windows\System\dRciAlE.exe
  C:\Windows\System\dRciAlE.exe
  2⤵
  PID:13724
- C:\Windows\System\piyvfDY.exe
  C:\Windows\System\piyvfDY.exe
  2⤵
  PID:12124
- C:\Windows\System\FuqsGuK.exe
  C:\Windows\System\FuqsGuK.exe
  2⤵
  PID:13680
- C:\Windows\System\JIKEwTd.exe
  C:\Windows\System\JIKEwTd.exe
  2⤵
  PID:11908
- C:\Windows\System\HOyaMqD.exe
  C:\Windows\System\HOyaMqD.exe
  2⤵
  PID:12060
- C:\Windows\System\tlfhLIi.exe
  C:\Windows\System\tlfhLIi.exe
  2⤵
  PID:14112
- C:\Windows\System\yOOvahl.exe
  C:\Windows\System\yOOvahl.exe
  2⤵
  PID:13140
- C:\Windows\System\AQccVHn.exe
  C:\Windows\System\AQccVHn.exe
  2⤵
  PID:9672
- C:\Windows\System\GultAAW.exe
  C:\Windows\System\GultAAW.exe
  2⤵
  PID:10696
- C:\Windows\System\UYXpvUm.exe
  C:\Windows\System\UYXpvUm.exe
  2⤵
  PID:13064
- C:\Windows\System\TKESogq.exe
  C:\Windows\System\TKESogq.exe
  2⤵
  PID:11848
- C:\Windows\System\HCUvIXK.exe
  C:\Windows\System\HCUvIXK.exe
  2⤵
  PID:13324
- C:\Windows\System\HdZNivJ.exe
  C:\Windows\System\HdZNivJ.exe
  2⤵
  PID:12784
- C:\Windows\System\gCuyqdw.exe
  C:\Windows\System\gCuyqdw.exe
  2⤵
  PID:13276
- C:\Windows\System\zbcwMPg.exe
  C:\Windows\System\zbcwMPg.exe
  2⤵
  PID:13548
- C:\Windows\System\iQSANQR.exe
  C:\Windows\System\iQSANQR.exe
  2⤵
  PID:12876
- C:\Windows\System\mDBWERs.exe
  C:\Windows\System\mDBWERs.exe
  2⤵
  PID:10192
- C:\Windows\System\ewHblKo.exe
  C:\Windows\System\ewHblKo.exe
  2⤵
  PID:3616
- C:\Windows\System\lSaxvfS.exe
  C:\Windows\System\lSaxvfS.exe
  2⤵
  PID:10488
- C:\Windows\System\uyYVauf.exe
  C:\Windows\System\uyYVauf.exe
  2⤵
  PID:14296
- C:\Windows\System\KoCmDRu.exe
  C:\Windows\System\KoCmDRu.exe
  2⤵
  PID:1568
- C:\Windows\System\jZTlkeb.exe
  C:\Windows\System\jZTlkeb.exe
  2⤵
  PID:6588
- C:\Windows\System\eaWLJgS.exe
  C:\Windows\System\eaWLJgS.exe
  2⤵
  PID:12652
- C:\Windows\System\KTSZKcH.exe
  C:\Windows\System\KTSZKcH.exe
  2⤵
  PID:11968
- C:\Windows\System\ujyNUfz.exe
  C:\Windows\System\ujyNUfz.exe
  2⤵
  PID:13052
- C:\Windows\System\SGNYjse.exe
  C:\Windows\System\SGNYjse.exe
  2⤵
  PID:3880
- C:\Windows\System\GJgWYUS.exe
  C:\Windows\System\GJgWYUS.exe
  2⤵
  PID:12644
- C:\Windows\System\sUBRFxS.exe
  C:\Windows\System\sUBRFxS.exe
  2⤵
  PID:2452
- C:\Windows\System\GSbBStT.exe
  C:\Windows\System\GSbBStT.exe
  2⤵
  PID:12988
- C:\Windows\System\vpLrnes.exe
  C:\Windows\System\vpLrnes.exe
  2⤵
  PID:9008
- C:\Windows\System\ehEYbpv.exe
  C:\Windows\System\ehEYbpv.exe
  2⤵
  PID:10892
- C:\Windows\System\evlbHIL.exe
  C:\Windows\System\evlbHIL.exe
  2⤵
  PID:13328
- C:\Windows\System\XXpgwZw.exe
  C:\Windows\System\XXpgwZw.exe
  2⤵
  PID:3708
- C:\Windows\System\JMUBOEU.exe
  C:\Windows\System\JMUBOEU.exe
  2⤵
  PID:11640
- C:\Windows\System\VMNVxQc.exe
  C:\Windows\System\VMNVxQc.exe
  2⤵
  PID:3020
- C:\Windows\System\uWItsHj.exe
  C:\Windows\System\uWItsHj.exe
  2⤵
  PID:11864
- C:\Windows\System\GlxTWlH.exe
  C:\Windows\System\GlxTWlH.exe
  2⤵
  PID:13792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_is1lihyu.xya.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AKOlsYE.exe

Filesize
2.1MB

MD5
ccb822aae0d0682a0fc5a68496c56a1d

SHA1
44cd680e1186f06c2cd20f6c58e9245aca720e7d

SHA256
fa564a89e9734c82053f793d323185783eb6ad93bb9ccd8ce94fe8d7b5c4c26f

SHA512
c4903e730d532d430d31a2da9d5a2c4e2b2a205716fe6f676b7c96ba508d62723b345aa14602f1e51f94f00c285f5334fa68f9a44ba3252508b66e4f850f96f8

Download Submit
C:\Windows\System\DOHtGyQ.exe

Filesize
2.1MB

MD5
6bd64801ce8c293cfa25bc2c838cef38

SHA1
42739abfb72ca9fe6783464f618705a350f213e9

SHA256
7f418402c90bf5859bdb7dc14cadfd76a8d2e417b68ef957a264295e06de7d02

SHA512
8ae7a74b3dbb080eea30807db6d0060a4f498604f7b23c79acd37481072cd47447c0cea246cbbe06f8a4c7bfbccba666622dae40b6ef83f55a0d41f2694955c5

Download Submit
C:\Windows\System\DkSHmBp.exe

Filesize
2.1MB

MD5
e1fb3a9c0975af1909b5146f892f8ad0

SHA1
b97c69b3efb34a320815850f3d9455cb944a0802

SHA256
920541fc69f113e7bd2c4d9f4edcedd1df016639b43392970509900898092c51

SHA512
95268c32e0f46c8324c6a4c24d487246eabf44b5916a29c0500498574fdc8acb4f4cceb2044444de476685e3f766a060bbb716d30781cd61ee6ace40bd84c6d2

Download Submit
C:\Windows\System\FLpHCPa.exe

Filesize
2.1MB

MD5
693ea8e8ff371f7d3edf87e0fc302f4d

SHA1
4f08446f744b40d795cec4a5d904efbeae1acc9d

SHA256
a29e1e504035dba4b9491ffb817439f1c2a5956f5b862569b7218993908bbe1d

SHA512
0f16a4e5f2179e76ae7f2b8d0727f1c8264f7a7f12821a8f45e7a1f1a159bb537ed9c349e47bc29f37eec802794b4ab7dd47a39514b584b648bee377a7bd0bdd

Download Submit
C:\Windows\System\FTFYHPw.exe

Filesize
2.1MB

MD5
776343b6b0339f47a4df918f7a6021b4

SHA1
0649ef75241b104bad86ddfe3fb46a78f3da6cbe

SHA256
f849fc20ee76b5eb2092ad74d9db0840efe1fdbb059075ff7ea79ef18c27d927

SHA512
2ea62444d605148073ecbeae692359593e87e28388c82a2b094dd5a7f86bff65722a349ca2a0dbdd8fd88ad4ed898d916453b13f1f0c7870c3903c0ee9dc4c82

Download Submit
C:\Windows\System\GyNfexH.exe

Filesize
2.1MB

MD5
1eb74f71c0091f5be66f23c7fe2e5f43

SHA1
77146d1df7e751b5a1f8ae671ab9c3ac95616fbe

SHA256
3b90df99373365956a943b673dcb54ffc748bc740618bac8fdf52d0ffe8e29ea

SHA512
9816867d201c1ce751e79d527614c03e2f0abcf1a5b304f1a7ecae674c3f1f96a9bec0815a9123e1f08975e31b1d8612a34294cc7125b4a9593f4bfaaba5c533

Download Submit
C:\Windows\System\IpvPxPP.exe

Filesize
2.1MB

MD5
3ccb1d92b1bf85caeeb212b03ffb777e

SHA1
66b7cf1b147a4e42b7c5e63cbd694a335625bc4f

SHA256
11b1fdaef1f00adcd37ca427d849dab83c25a5a81b624663a64ea539bcee4ad6

SHA512
8b419a7459328a03852bd4aa42729dc3dc16ee71ebd7fd996d3c4fa0dc73d851bb830a4369dd761382c727bef6ebcc5ea1fc72bb657c21a0bbca5351d1da6217

Download Submit
C:\Windows\System\JIOPDlE.exe

Filesize
2.1MB

MD5
3ce0466f5dd29fca499b275263aca3e7

SHA1
ffcaa65df970fd1a8c9010dca9b09b9236109c67

SHA256
93a3f1f87be917377d733247a78d6cf82a8a6f955601779dbf59303c2457556a

SHA512
301e671005a2cf926105771977eed42bd480330e87599f32efc88e8d23043ab0fcc0c66af2f93ac38271828aefa7bd1281c09a0420ed27ab3069935823479293

Download Submit
C:\Windows\System\LoSqcJB.exe

Filesize
2.1MB

MD5
5e0bd6ae51ab6f3f2902dc5584d18d7d

SHA1
237954dd82d2c8fb6514f652c0ce9fb27ae0bc52

SHA256
a2850d46907f24b0477f93a15121d248b9571990cc34777eb2f32e94bd15a97c

SHA512
1f0cdbfa5da33f974bf0a140d4953a2a5306df1e77200464fdd8a70bd603aa5e943d83d5a1393c97d26bc6168eacb56d733b578e2332b3f9ad000a0520abcade

Download Submit
C:\Windows\System\NNCMMWP.exe

Filesize
2.1MB

MD5
44036154c393957d0f16233abbcafa34

SHA1
7d1378e3fdb19921e0691a89c88ff2bb62f9bafa

SHA256
be3cb28133dcd69050359f6e67258c12facb469bb28187d50e2cd6c4d876f8ff

SHA512
2a6e09e6ecfce3ab3f7a009a92c7455bc317e7687704ced40f4bb6f35d2560cc70da4807d8881d2688664223e1242bb2ee6035cd6cb05fb5d2efaafbdf5686a9

Download Submit
C:\Windows\System\OOjQgwi.exe

Filesize
2.1MB

MD5
26bc785f6327a003f2e016d48f33e8a3

SHA1
68d3f706650bdc335c6f62e0f4a441d4cecf3111

SHA256
64447076142505064dc652b54172508188fdcd18b4ec6cb4be5e8d7a9b829a08

SHA512
bb9e435cb3b646ac4866c239f0ca95351ee5451569b78d131e2a20d922bac482f9da19fa1b7a1bd233f1dbbbf8dc9f614205e7a0b984a1ffa5423a881ee53339

Download Submit
C:\Windows\System\PGotICc.exe

Filesize
2.1MB

MD5
154732ae882554a23240f329d397cb6a

SHA1
c04de6f2767b31485783d2eaa556d51f93017e88

SHA256
4632232a9a0a4d23daa38374d57df617ab940e3ed77591c33fbb33f2acfe08ee

SHA512
0e157d28cd25587f21054383b55e21898c53800849d2e0aa0d093d59f089a7725cd8f1ba2325303f9be4a125bfe820f2efd5c6eabecf6ec67871fe69142e9bf7

Download Submit
C:\Windows\System\QRGeDre.exe

Filesize
2.1MB

MD5
38167c698da9f3cee9fe06a74f09902a

SHA1
7e91a2f094c159ba3fca2d6b8543929741745115

SHA256
e0fc8f6a6b338624583bfb411f4d87868d27f307362cd87931ea44b02606daa6

SHA512
b74f99caa7186fdf42a784dbebd3134408b377e399f5725d51092999bd2cf03292238774ad9ab138113a49d86439fb5414d19071a2dd17ee51a18a7e6ad8b53a

Download Submit
C:\Windows\System\RJPPnLS.exe

Filesize
2.1MB

MD5
efe14fe4569086ba176e0af48a97a56a

SHA1
fb3e8660e6150f839dfece8a7e0203bd333c9ff0

SHA256
f8ac84d4b2e312fd75d02e0638c3e9f9f52986505841c1c1c99a96f24f27f0ed

SHA512
36122e075fc6db52bd5bf29d7aaf61f565f124d400d2926262dfd306f087d90f023a9b0a090ccf02924cf6c0db380003007a935911d575a8af67e476427cc93d

Download Submit
C:\Windows\System\SFKZhfR.exe

Filesize
2.1MB

MD5
025f92786e262fbc9dc5c209d210b3fc

SHA1
d0a5ded912456b3e2bcd393247ce749b5558dd77

SHA256
b3a9438df066f61b02048d04db374fe892b01287cc304d1bcb7b496dbc72073f

SHA512
3d72f9a5120b753fc5d24ace5e88a844c0137c8c90d4b6d9699720a7ebe0cd8776654d1557404a650c9fb68fa8c3afab3c4207b5edd9b79d7a4ca254d6f53950

Download Submit
C:\Windows\System\TCrIeki.exe

Filesize
2.1MB

MD5
202a4e74d5c24ed6c7e7ddd85fac9c3e

SHA1
b2bfafa832009375eb9440f9dd2f9450bbfc1b29

SHA256
069308c7505e303bc0c125d8593e6c08e7419803b7bc3bf2cd33966d79d8a968

SHA512
6fc21c0b3ca51020645dfb204e68435e473c7d2de576bec82d61904809ee3b67661663f8e6f9e48e16600f93fa63bc10c0b4efcdcc3a146a546bc97adf69c7e5

Download Submit
C:\Windows\System\TyEQKTr.exe

Filesize
2.1MB

MD5
f827f7d6455145ac1e8a4e2ec9d0266d

SHA1
6951cd4e61b7ac60fc144b88c1e95af99a37e9db

SHA256
5501eb95059e3190a691eba35e745d2473378a9c551e5b80b21ea8be15c78a24

SHA512
f82a63c3c94384535ac562ece7c8215c9da9b0fe62914d1fcb14141ffa5c5b24a0da7c57fd6ab4b45afcbf65d615201901c0e017ed798583dd92d5d618f339f3

Download Submit
C:\Windows\System\UzOvrcL.exe

Filesize
2.1MB

MD5
483ba485832c6adbd532022c94453f57

SHA1
a6fade0d8f5da890d9583d066885b3a2bb994284

SHA256
c54759ba6e8bdb095bb5b71852dc2689db5c5c92da5a07cad2cbdcc58924412a

SHA512
a4ada7307f99727fb4fd37f373f1e6efd239430d6750261b54ce5791a42803211277d20b8d0ae42581d7d89fdd56b5a4dd2bc98a34aece5b4960cec67332fb0b

Download Submit
C:\Windows\System\VQPzkub.exe

Filesize
2.1MB

MD5
390121811b7bfa7ba8ff6b2f27a7c5ed

SHA1
1e07fc8beb9edb755e719543c3d556e70f3ef61f

SHA256
2a6fc49d6d9b5a9776cf0b1ade26b1d33eb36826e1fea68689d64c438949d789

SHA512
ef47b543abb3cc319eb7208a72d1669693367e7b5751548c3184b9dfa03eb2dc6cbef844d2fde07bb904bf71a6de10b5c50c16cc8c0fc192334447c7113fe613

Download Submit
C:\Windows\System\YRGGnAs.exe

Filesize
8B

MD5
408407fe49e2a1bd1de2fb4f4e1c1e4e

SHA1
6781f0ed16b9f9a0e8a861848782ae1a9b183885

SHA256
413c20c52ba69478c63daee39bcd70926f09cbc71ce3aa1577802440938b324a

SHA512
51204da6f17b6725f4e9b8b9381f34a7ed365926b3780a3bfe9e8d70ab81ec8caad96b3f0838e87a0f0c0c6baeed1ea2ea2f5c7ee1fa6a13b720a1ec69c3f3fd

Download Submit
C:\Windows\System\ZrEdxJQ.exe

Filesize
2.1MB

MD5
4321500b84353ec86435c1c13eeeb358

SHA1
92d7a733d4067f1c2c17ecbbf9e947d7c9e241a2

SHA256
2391147f2650ee0c53374ebee6225a93f944d10efe4d008d22b9bce4590a45ce

SHA512
2735c8bfd26f77477d70bf2d4733a870e3d46a5d97ace998d178fb44e1269a91ad5cd0e300d4b74fcda49651f3e5327d8944c6f987879397741caf72a8a2bb26

Download Submit
C:\Windows\System\bsJbaHi.exe

Filesize
2.1MB

MD5
5816a8f8e8afb4933b3b49b7115c7ac1

SHA1
fcdb62fa141d21f4fc5a535d8769ebce31af5cb7

SHA256
69fd490293826a75c4702d49363d4acb20c96f611b7602b87aba58c1db14b833

SHA512
72b38aae980577a1e348a81e4ff433d4bff33229f19e40cf5af480568da97cde827530f1e7c47a3678420d7a37c25605969fc770c0daf79a048e903ca33f8769

Download Submit
C:\Windows\System\btCmzzO.exe

Filesize
2.1MB

MD5
e34651e8e075c13e63d00d468a0061ce

SHA1
6b935e0fdaabc7d6d9dd81b9dee81dc8cb3c4e72

SHA256
eb3da5d210aaf113835e803c50a9a18d2f51048de7eca993b7251a34c9574c17

SHA512
7d3bcdb3aaa310844311f5754c6a6c31ce65a33662efe7b5828e14e67e32092dfbdcbb022f068d3568e4ead4c11b6412330cc3f41fd5fb5f534e1083bab0b42c

Download Submit
C:\Windows\System\dywVrrX.exe

Filesize
2.1MB

MD5
f03ee9447eb6cc4e70362c35d50550c7

SHA1
2ea8755645f41a1b6baf4408faacfacd58602988

SHA256
aabbbcbc560c0cd3e55c852f0cf2023475bf37f8ea782e359293434462ff79a1

SHA512
7b4e94e45740b26647f6ecb4948a5bcd37672341971ed23f8681eb9343c63379c7542ec70b9b225b9a86f459b13d1fbd8f2482f44d7856592003afe865958c48

Download Submit
C:\Windows\System\fvRBvVH.exe

Filesize
2.1MB

MD5
09c50112b2197ba42e2c53c6be73e309

SHA1
7a53c21aaefa40f3117c662b004729883fcfcc52

SHA256
689e2fbb1562f7770072d2a9b056e7489721eab411b739798ad520df744a02a7

SHA512
05f6c099ffc156bdf5573d2e023edd16ef5e59e974f1aa952da05e4ff8f5a126a86cb4885090094ba020aa5d3375f2d220e45daa550edf7cfbfb932283553233

Download Submit
C:\Windows\System\hXAczQZ.exe

Filesize
2.1MB

MD5
4f3fbd305292d6d045d171992cfaad78

SHA1
8bbfeb57f82e20c458e92546a4b7074d3edc9259

SHA256
e5f0644bad5c3bcd3efd6cc59ee014fc63344c43fd2adccf222ba3c76ea60be8

SHA512
7d80d4890babc8b21ab3ad8435a6de91eb4e24b63e506dbb9d02e7c04d897c9c16cb9755514dc995bb39da6f49139ae29cbe34274ddf2e32ad1a33767b4a15ba

Download Submit
C:\Windows\System\hdaqnsE.exe

Filesize
2.1MB

MD5
3e40b5ba12a4f9e8ed9896f6f2f24801

SHA1
ca1bac67fc5fec5c9d3a048bd65c22ea6235bda4

SHA256
63b0b69f5d951dceae2a88be232f00e95afcc190519c9575abb10c977168366b

SHA512
d05d5f982fa8a6b700e8ed55255986f4b09d791fb134347c85b53103dfa2507053c178d6eba30e3bd128f937bf09b70987a243adacabcd6ee829bbe78482365a

Download Submit
C:\Windows\System\jyMOqty.exe

Filesize
2.1MB

MD5
0bdca863074ef18979fd24e22d8a7077

SHA1
c13405285d5951c1d959561ef9722930aca6425b

SHA256
bb1eff88529a86d091e54618170341e52fd2fca4e7ab599465a48d02e4248862

SHA512
8f5c51b875ae98a52be80b0f07968f33d6fe32dd392e922e3c140b70dc36462803c165a869acefa9bff72d16a306f07b7568c27503a81362d9a0705ecacb2c98

Download Submit
C:\Windows\System\kkmwcom.exe

Filesize
2.1MB

MD5
362879a2835b4016ee0891654af288e6

SHA1
5a5838847282d16627365f65c6a2d29c7197dfd8

SHA256
113aa7939e7f6fb27771420fd8e810f01e860253467009d8982167d09ef35650

SHA512
09d93de8308065843d2c38a52bccaaa076fdc1f4cace7925efeaa8710c3c340edaf3645081b22cab1f0ac8c899188f4170663449320da0601dc725e1e7ded4a4

Download Submit
C:\Windows\System\lZepYNd.exe

Filesize
2.1MB

MD5
382c48d29e50587d815bf01f1b0d22bb

SHA1
86ac1e7824cbfb4e63c261cbd46a7913c3b4c13b

SHA256
b631645d7e8b5553b3b4cac023774905ff0645da7e75c124afb16270cb84f1d5

SHA512
1b9cdad90119f09d576fbb306aab0d362a31c9bd337858380e6bae024ca2c988d30dba5b3cd39a250f2721cffa3216d9c2da67b3a5d46af5b1cc187a5ef1d983

Download Submit
C:\Windows\System\mvMompQ.exe

Filesize
2.1MB

MD5
1b0c3006b19dfa163b455a5a3fa7b92b

SHA1
08ff9a7eb3afbcaf67795cf4ce9a8ee1a6a26225

SHA256
687c945ec3447e2231b7e3fc5426a72911b1f3586e3d39e11084efd55d28ffed

SHA512
db1828524e843d77349c033fc81bdda74d4d3dde752c22e52e1e3ff3cc1afd07c5e0bfe5878308d1139bac83668cf2a8d5a5b7a91599ddd6e877e0c47eb97276

Download Submit
C:\Windows\System\nKdCLKx.exe

Filesize
2.1MB

MD5
30a11e684344989d92fee3fd68d50b78

SHA1
22def091dfd4f61cca44fbfbcc880c4aa662b143

SHA256
a23affdf1b6d94793e81a7650b5799a1870c2d237c761e010c8fddef472b4e96

SHA512
495c8529faa662357c161783a75c96fff8997d2f37ca3d9ec4ebc5c9ffe869c48ca772bf542f65db4a7716b5c9db4ada508369c0aea0dbc41106cf6ab03fa941

Download Submit
C:\Windows\System\nxtzqUa.exe

Filesize
2.1MB

MD5
77d9d6b3152a57bc078440a80352c672

SHA1
f8449c22ae4a93ec9b2049f1a5d01e8001a6b182

SHA256
d1586ee4f48b0b4e415f4256661cbf64e24af48e730739c79dcc557438a9ecaf

SHA512
5b449f6bbbc83493d420acd4a1684d88138d2b9fed3f8a95e8113f23857eec8f266403bc1b0bd33ed4693822165f6a3e65ea0515b19afe4cb9d622f713f978d4

Download Submit
C:\Windows\System\pcHUlYP.exe

Filesize
18B

MD5
6fe0013890c63ded4f8ff8d16df87289

SHA1
289a7f6e7968aae7b8549ffdd9b978b9db978f87

SHA256
f199c68e43f0f5c8e50bcae2d18e89d3e5e39dfc93aaed12249762ab112691d0

SHA512
d134172fdc11063e45454e6619b8bda3721fc09f325a67b3b4cca8ebbee69cce74d83053e73b70efdb9a6a1fc832c4bc1df3f3d00e9ae3195b7ef87287e98e09

Download Submit
C:\Windows\System\qtHqExi.exe

Filesize
2.1MB

MD5
157c7ba276eeba790b92d5da7df2acab

SHA1
a7748b2715fba7a867f3024eade6f863782f5a6f

SHA256
082cfeb1796bbc85be62250c93235495651a7d96c5ae759574c57445afaded32

SHA512
669b90452f2266b844de6ee588a3d34ab9e39768852c0a3c566ed7980b7313718ec6601e56427544a959d85b4a20e8540f97e7c2f979b9a1ea1b7e09fecd459f

Download Submit
C:\Windows\System\rikcBCL.exe

Filesize
2.1MB

MD5
cea2e578d14db33b78ac4df9285e75cf

SHA1
b569d62c1209bb2b0e92415b1dc097f9cf1c15ba

SHA256
b7f3efd9019a6317a11c71c10ec883689f0fa32c75488865812ddd8ad2fd7ec2

SHA512
86ea8cbe9874d0bc4e94be02c9a06a54f35ec0629299e8ac9542621846ffd2db4d37cbdcdda7134dc5b061d504409d71237881e5d8b4a38adf214efece0cab12

Download Submit
C:\Windows\System\sUMYsTJ.exe

Filesize
2.1MB

MD5
7a868eb3113fb7ed4c99d395aa2f1261

SHA1
621d9dcbd44a24d129455081f6868e73e9e3be9a

SHA256
69cfb671ce3b5bb7eb2583075688050dc0c7fe8d07097c9651dfd56f55c22c9f

SHA512
eecad263a37729de6eb297af397776dd7e3fc33a86572753a46febb473b00fa640836deb45d695a49b6ae3fe825147ad47c991804d06d72f20719b5f3cd1a3d5

Download Submit
C:\Windows\System\twvpRim.exe

Filesize
2.1MB

MD5
6f6cdd9f75be6218fb55d8cd0fc16524

SHA1
adf3eaddd470b8651868c19f13d5183d4e94738d

SHA256
2cc70c1ac8020d98ddaa03d64552d4e5a6e9dc745dbab68b2fe5b8170a989e49

SHA512
3f4e3bec621b86862ae57e0a9ed75fc34031dc492a12c536567374c5dad0e991e1eaaaad6fde2853f7e3c4513bb63a23538468fcc0745f60c76f51992720c5b1

Download Submit
C:\Windows\System\tyQkvSg.exe

Filesize
2.1MB

MD5
c5c28443b4eb4694d5e0286132ef7e4e

SHA1
b871f312774457e3757b656beae78bd02171dde8

SHA256
3d59a1c7aeae486518ac18bcbfef4b381a47dd1c63e9889dfe3d0fa75a08054d

SHA512
fc9332cc74a143017837a05c32bca26098e7fed4c5d79fd860a1c59d508f9e4f33c0fd2cf597223ce10f90066834c9bfb97e93c5f92df6e669fb7d9f58eab6ab

Download Submit
C:\Windows\System\uZpmWjn.exe

Filesize
2.1MB

MD5
a9ce90baf44fe694e93a58abf08994a6

SHA1
7b42e35d041bac5a9dbdb1465a72ee89fc86d0a6

SHA256
b8f2fbb2a00bbcc29aa273d9bcc162966ef479d9d5009674d2a4b380a3c4daff

SHA512
271cd97a9b750bcb74487017dedf1c8144d2736f956a9bf758ffa68e9104e7cb25db1d85c13bfd8c37262e5da8444b94f8a497ddd92155ef43ee3c09e136403e

Download Submit
C:\Windows\System\vnBMlIo.exe

Filesize
2.1MB

MD5
c3cc9e98d87a8df76ab495a912d538ec

SHA1
92fec1876deedc1e0d56d3786799e2ee3b97c35c

SHA256
62b59d59ed02cf6cf2e1351d22ce4335cade1a24ae3d1af6669b0c032f31b1eb

SHA512
5ddedfcff9cb94c21caf2bc16b39505ec371c6890d283830775e65fa72786d10c5496b3bc5d93448606d2d2c2f8d1b0721bf5890b7c5a4b0fe8349d9c082a29d

Download Submit
C:\Windows\System\xvHkznF.exe

Filesize
2.1MB

MD5
4c03696701fc43ab52cb1c50ff5780e5

SHA1
77774a274c41ee8803c45608753ffe5f5c62d144

SHA256
5b55940209b04b93eba9f55326922d54a3f9346de1543d4499dcde5739f5f51c

SHA512
d491da9424c7aea4d35cfcd16d4ee5ddc3fe56286f2a1fd6f9148f701425851de710a432858d4d5e5b36ca05f7c4d8bdb4f9d46a4b2c942e3d0a1bb19c597fec

Download Submit
C:\Windows\System\yjAnAHw.exe

Filesize
2.1MB

MD5
f140718226e1133478525eabb5ebd11d

SHA1
6585011f67bee7afe2f128ca418a87f4332af08f

SHA256
fc5655815e443bce5e3ea7a919bce8609799b769b708bd3fa684dff6bc49daae

SHA512
f149e1430269452ebd0d87c04749a2b1c3792f36db95ef37f9256f3caf1f2d64bd1e25de0e1893c278bbe8ae5b1310c8f9a40dbed89e9a5de29548988284ea3a

Download Submit
C:\Windows\System\zmnaBYH.exe

Filesize
2.1MB

MD5
d1a69bafa3fccc51efe06b4653cda6c3

SHA1
2e87c921f3f0782948849ac475eeb551fbfe6103

SHA256
2ff853e46d4485565014dff3d9475259edc3c2b30d20e5175fc1975655002956

SHA512
274b0db8c555bcea5c2bd46caa1823feceb2f07899546d0c264afd3a3ba5134e0139afc88f61c8ef81caa8f217a75d5babd5c50e356b5de0bbf94a55f12a777e

Download Submit
memory/116-68-0x00007FFA968B0000-0x00007FFA97371000-memory.dmp

Filesize
10.8MB

Download
memory/116-2058-0x00007FFA968B0000-0x00007FFA97371000-memory.dmp

Filesize
10.8MB

Download
memory/116-135-0x000001E0474A0000-0x000001E0474C2000-memory.dmp

Filesize
136KB

Download
memory/116-119-0x00007FFA968B0000-0x00007FFA97371000-memory.dmp

Filesize
10.8MB

Download
memory/116-26-0x00007FFA968B3000-0x00007FFA968B5000-memory.dmp

Filesize
8KB

Download
memory/392-207-0x00007FF7F1970000-0x00007FF7F1D62000-memory.dmp

Filesize
3.9MB

Download
memory/632-225-0x00007FF672FF0000-0x00007FF6733E2000-memory.dmp

Filesize
3.9MB

Download
memory/872-4052-0x00007FF717280000-0x00007FF717672000-memory.dmp

Filesize
3.9MB

Download
memory/872-217-0x00007FF717280000-0x00007FF717672000-memory.dmp

Filesize
3.9MB

Download
memory/1004-4031-0x00007FF6E0F40000-0x00007FF6E1332000-memory.dmp

Filesize
3.9MB

Download
memory/1004-214-0x00007FF6E0F40000-0x00007FF6E1332000-memory.dmp

Filesize
3.9MB

Download
memory/1176-208-0x00007FF7A7600000-0x00007FF7A79F2000-memory.dmp

Filesize
3.9MB

Download
memory/1176-4037-0x00007FF7A7600000-0x00007FF7A79F2000-memory.dmp

Filesize
3.9MB

Download
memory/1352-0-0x00007FF74BDC0000-0x00007FF74C1B2000-memory.dmp

Filesize
3.9MB

Download
memory/1352-1-0x000002E19D890000-0x000002E19D8A0000-memory.dmp

Filesize
64KB

Download
memory/1352-4998-0x00007FF74BDC0000-0x00007FF74C1B2000-memory.dmp

Filesize
3.9MB

Download
memory/1360-4047-0x00007FF7EAC80000-0x00007FF7EB072000-memory.dmp

Filesize
3.9MB

Download
memory/1360-221-0x00007FF7EAC80000-0x00007FF7EB072000-memory.dmp

Filesize
3.9MB

Download
memory/1408-4051-0x00007FF7F7110000-0x00007FF7F7502000-memory.dmp

Filesize
3.9MB

Download
memory/1408-222-0x00007FF7F7110000-0x00007FF7F7502000-memory.dmp

Filesize
3.9MB

Download
memory/1584-210-0x00007FF6BE5A0000-0x00007FF6BE992000-memory.dmp

Filesize
3.9MB

Download
memory/1584-4035-0x00007FF6BE5A0000-0x00007FF6BE992000-memory.dmp

Filesize
3.9MB

Download
memory/1728-209-0x00007FF706B00000-0x00007FF706EF2000-memory.dmp

Filesize
3.9MB

Download
memory/1728-4027-0x00007FF706B00000-0x00007FF706EF2000-memory.dmp

Filesize
3.9MB

Download
memory/1972-206-0x00007FF747A80000-0x00007FF747E72000-memory.dmp

Filesize
3.9MB

Download
memory/1972-4007-0x00007FF747A80000-0x00007FF747E72000-memory.dmp

Filesize
3.9MB

Download
memory/2076-172-0x00007FF77FAE0000-0x00007FF77FED2000-memory.dmp

Filesize
3.9MB

Download
memory/2076-4013-0x00007FF77FAE0000-0x00007FF77FED2000-memory.dmp

Filesize
3.9MB

Download
memory/2148-4049-0x00007FF6A2F80000-0x00007FF6A3372000-memory.dmp

Filesize
3.9MB

Download
memory/2148-227-0x00007FF6A2F80000-0x00007FF6A3372000-memory.dmp

Filesize
3.9MB

Download
memory/2384-4023-0x00007FF74FD50000-0x00007FF750142000-memory.dmp

Filesize
3.9MB

Download
memory/2384-211-0x00007FF74FD50000-0x00007FF750142000-memory.dmp

Filesize
3.9MB

Download
memory/2748-218-0x00007FF727DC0000-0x00007FF7281B2000-memory.dmp

Filesize
3.9MB

Download
memory/2748-4045-0x00007FF727DC0000-0x00007FF7281B2000-memory.dmp

Filesize
3.9MB

Download
memory/2856-224-0x00007FF6E33E0000-0x00007FF6E37D2000-memory.dmp

Filesize
3.9MB

Download
memory/2856-4057-0x00007FF6E33E0000-0x00007FF6E37D2000-memory.dmp

Filesize
3.9MB

Download
memory/2860-4020-0x00007FF72AF00000-0x00007FF72B2F2000-memory.dmp

Filesize
3.9MB

Download
memory/2860-215-0x00007FF72AF00000-0x00007FF72B2F2000-memory.dmp

Filesize
3.9MB

Download
memory/3936-3998-0x00007FF7E0FD0000-0x00007FF7E13C2000-memory.dmp

Filesize
3.9MB

Download
memory/3936-16-0x00007FF7E0FD0000-0x00007FF7E13C2000-memory.dmp

Filesize
3.9MB

Download
memory/3964-4029-0x00007FF7C7FB0000-0x00007FF7C83A2000-memory.dmp

Filesize
3.9MB

Download
memory/3964-213-0x00007FF7C7FB0000-0x00007FF7C83A2000-memory.dmp

Filesize
3.9MB

Download
memory/4532-4041-0x00007FF66AF00000-0x00007FF66B2F2000-memory.dmp

Filesize
3.9MB

Download
memory/4532-219-0x00007FF66AF00000-0x00007FF66B2F2000-memory.dmp

Filesize
3.9MB

Download
memory/4600-223-0x00007FF7DB680000-0x00007FF7DBA72000-memory.dmp

Filesize
3.9MB

Download
memory/4600-4059-0x00007FF7DB680000-0x00007FF7DBA72000-memory.dmp

Filesize
3.9MB

Download
memory/4628-226-0x00007FF6C6910000-0x00007FF6C6D02000-memory.dmp

Filesize
3.9MB

Download
memory/4628-4014-0x00007FF6C6910000-0x00007FF6C6D02000-memory.dmp

Filesize
3.9MB

Download
memory/4820-4033-0x00007FF704FA0000-0x00007FF705392000-memory.dmp

Filesize
3.9MB

Download
memory/4820-216-0x00007FF704FA0000-0x00007FF705392000-memory.dmp

Filesize
3.9MB

Download
memory/4844-4025-0x00007FF772E40000-0x00007FF773232000-memory.dmp

Filesize
3.9MB

Download
memory/4844-212-0x00007FF772E40000-0x00007FF773232000-memory.dmp

Filesize
3.9MB

Download
memory/5008-220-0x00007FF756190000-0x00007FF756582000-memory.dmp

Filesize
3.9MB

Download
memory/5008-4038-0x00007FF756190000-0x00007FF756582000-memory.dmp

Filesize
3.9MB

Download