xmrig | 2c1f3cdc5aa81a0f86e145d702752f9f7e6229aeeac48380f099670d14cce4b5

Analysis

max time kernel
150s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01/05/2024, 06:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
Size

1.9MB
MD5

0b4633969fb74371b862ea226a204360
SHA1

5fe27f03ad850a9b94ff1e15716d4647f2f14038
SHA256

2c1f3cdc5aa81a0f86e145d702752f9f7e6229aeeac48380f099670d14cce4b5
SHA512

df718ba6a216e880cc9b67013fc837a1cd283d0ce5514925d476177e80183d9fe6ab38971584d801553b6f4c9db033279a6af6b8e8681e4f9fa4d09cb9aad04c
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+UA:NABZ

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 44 IoCs

miner

resource	yara_rule
behavioral2/memory/1772-202-0x00007FF68F6B0000-0x00007FF68FAA2000-memory.dmp	xmrig
behavioral2/memory/1900-243-0x00007FF7231F0000-0x00007FF7235E2000-memory.dmp	xmrig
behavioral2/memory/1044-283-0x00007FF732190000-0x00007FF732582000-memory.dmp	xmrig
behavioral2/memory/2868-369-0x00007FF667650000-0x00007FF667A42000-memory.dmp	xmrig
behavioral2/memory/4956-387-0x00007FF6A25A0000-0x00007FF6A2992000-memory.dmp	xmrig
behavioral2/memory/4660-426-0x00007FF791DE0000-0x00007FF7921D2000-memory.dmp	xmrig
behavioral2/memory/3268-439-0x00007FF6E10B0000-0x00007FF6E14A2000-memory.dmp	xmrig
behavioral2/memory/2720-445-0x00007FF7723E0000-0x00007FF7727D2000-memory.dmp	xmrig
behavioral2/memory/2512-444-0x00007FF730600000-0x00007FF7309F2000-memory.dmp	xmrig
behavioral2/memory/900-438-0x00007FF619F20000-0x00007FF61A312000-memory.dmp	xmrig
behavioral2/memory/2800-349-0x00007FF7728B0000-0x00007FF772CA2000-memory.dmp	xmrig
behavioral2/memory/4796-338-0x00007FF6770E0000-0x00007FF6774D2000-memory.dmp	xmrig
behavioral2/memory/4912-335-0x00007FF705E30000-0x00007FF706222000-memory.dmp	xmrig
behavioral2/memory/3208-304-0x00007FF631DC0000-0x00007FF6321B2000-memory.dmp	xmrig
behavioral2/memory/1016-303-0x00007FF67E490000-0x00007FF67E882000-memory.dmp	xmrig
behavioral2/memory/4908-218-0x00007FF727DC0000-0x00007FF7281B2000-memory.dmp	xmrig
behavioral2/memory/2344-158-0x00007FF76AAB0000-0x00007FF76AEA2000-memory.dmp	xmrig
behavioral2/memory/2036-164-0x00007FF68B9F0000-0x00007FF68BDE2000-memory.dmp	xmrig
behavioral2/memory/3544-4939-0x00007FF70B550000-0x00007FF70B942000-memory.dmp	xmrig
behavioral2/memory/1928-4954-0x00007FF75A230000-0x00007FF75A622000-memory.dmp	xmrig
behavioral2/memory/2716-4957-0x00007FF6E57C0000-0x00007FF6E5BB2000-memory.dmp	xmrig
behavioral2/memory/1504-4967-0x00007FF642B70000-0x00007FF642F62000-memory.dmp	xmrig
behavioral2/memory/2716-4983-0x00007FF6E57C0000-0x00007FF6E5BB2000-memory.dmp	xmrig
behavioral2/memory/1016-4985-0x00007FF67E490000-0x00007FF67E882000-memory.dmp	xmrig
behavioral2/memory/3268-4988-0x00007FF6E10B0000-0x00007FF6E14A2000-memory.dmp	xmrig
behavioral2/memory/2512-4979-0x00007FF730600000-0x00007FF7309F2000-memory.dmp	xmrig
behavioral2/memory/1928-4974-0x00007FF75A230000-0x00007FF75A622000-memory.dmp	xmrig
behavioral2/memory/900-4971-0x00007FF619F20000-0x00007FF61A312000-memory.dmp	xmrig
behavioral2/memory/752-4962-0x00007FF662B20000-0x00007FF662F12000-memory.dmp	xmrig
behavioral2/memory/3544-4961-0x00007FF70B550000-0x00007FF70B942000-memory.dmp	xmrig
behavioral2/memory/4908-5037-0x00007FF727DC0000-0x00007FF7281B2000-memory.dmp	xmrig
behavioral2/memory/3208-5032-0x00007FF631DC0000-0x00007FF6321B2000-memory.dmp	xmrig
behavioral2/memory/4796-5026-0x00007FF6770E0000-0x00007FF6774D2000-memory.dmp	xmrig
behavioral2/memory/2720-5020-0x00007FF7723E0000-0x00007FF7727D2000-memory.dmp	xmrig
behavioral2/memory/1044-5014-0x00007FF732190000-0x00007FF732582000-memory.dmp	xmrig
behavioral2/memory/2868-5008-0x00007FF667650000-0x00007FF667A42000-memory.dmp	xmrig
behavioral2/memory/1900-5047-0x00007FF7231F0000-0x00007FF7235E2000-memory.dmp	xmrig
behavioral2/memory/4660-5044-0x00007FF791DE0000-0x00007FF7921D2000-memory.dmp	xmrig
behavioral2/memory/752-5038-0x00007FF662B20000-0x00007FF662F12000-memory.dmp	xmrig
behavioral2/memory/2800-5028-0x00007FF7728B0000-0x00007FF772CA2000-memory.dmp	xmrig
behavioral2/memory/4956-5022-0x00007FF6A25A0000-0x00007FF6A2992000-memory.dmp	xmrig
behavioral2/memory/1772-5016-0x00007FF68F6B0000-0x00007FF68FAA2000-memory.dmp	xmrig
behavioral2/memory/2344-5011-0x00007FF76AAB0000-0x00007FF76AEA2000-memory.dmp	xmrig
behavioral2/memory/2036-4997-0x00007FF68B9F0000-0x00007FF68BDE2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
836	DwPDkVM.exe
3544	dGWeFZz.exe
1504	tTIBnEA.exe
900	OtcKqWa.exe
1928	zEYQwbx.exe
2716	ywcVYSh.exe
3268	UpvqFUO.exe
752	oGFZPsD.exe
2344	bfcKgpu.exe
2036	rcrLKdB.exe
1772	rEnEngo.exe
4908	aBfbsha.exe
2512	TRTUkOr.exe
1900	fjztFQt.exe
1044	XBeNdoB.exe
1016	eINmQDI.exe
3208	UpTfFuT.exe
2720	LLJyowi.exe
4912	oVmXCXf.exe
4796	AVepzYo.exe
2800	KbhdITg.exe
2868	yjKAkpk.exe
4956	uJHFYrm.exe
4660	reyiWLE.exe
2156	sybApgO.exe
2472	hYSwtgq.exe
3032	ePkvdzW.exe
5004	xXlHesK.exe
1544	EGBuWjN.exe
4572	wFctiPX.exe
400	YHgdDgz.exe
5040	IkKNWeN.exe
424	TlgHOhY.exe
1960	KZybqfl.exe
5112	GlqzEtB.exe
3852	XnmESev.exe
4864	NmrOLnG.exe
3812	XcTtyIa.exe
5096	kIxQBCC.exe
3660	toIRBEg.exe
4340	LMwtNOe.exe
3720	TbBBINA.exe
2444	HoNmRww.exe
2792	EdgcKGr.exe
3488	syDggLT.exe
872	osRBvqS.exe
664	MSzqVxO.exe
4132	BUijATJ.exe
5080	IzDRisM.exe
3108	rrccrHZ.exe
4012	YJdKHSf.exe
4736	ozDQmTB.exe
4812	Mxtsryl.exe
3484	glLgDwm.exe
4372	aiNAcQF.exe
2212	NxBbzsK.exe
1592	eclFpNF.exe
4336	vnYZqXr.exe
2328	RsqcDUH.exe
1112	DrsWqsn.exe
1036	sKYYQNx.exe
3584	JmfdUfl.exe
2520	WgrKlGM.exe
2280	ksGaSkf.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3264-0-0x00007FF7C5620000-0x00007FF7C5A12000-memory.dmp	upx
behavioral2/files/0x000b000000023bd2-8.dat	upx
behavioral2/files/0x000a000000023bd7-11.dat	upx
behavioral2/files/0x000a000000023bdf-47.dat	upx
behavioral2/files/0x000b000000023be8-110.dat	upx
behavioral2/files/0x0008000000023c11-136.dat	upx
behavioral2/memory/1772-202-0x00007FF68F6B0000-0x00007FF68FAA2000-memory.dmp	upx
behavioral2/memory/1900-243-0x00007FF7231F0000-0x00007FF7235E2000-memory.dmp	upx
behavioral2/memory/1044-283-0x00007FF732190000-0x00007FF732582000-memory.dmp	upx
behavioral2/memory/2868-369-0x00007FF667650000-0x00007FF667A42000-memory.dmp	upx
behavioral2/memory/4956-387-0x00007FF6A25A0000-0x00007FF6A2992000-memory.dmp	upx
behavioral2/memory/4660-426-0x00007FF791DE0000-0x00007FF7921D2000-memory.dmp	upx
behavioral2/memory/3268-439-0x00007FF6E10B0000-0x00007FF6E14A2000-memory.dmp	upx
behavioral2/memory/2720-445-0x00007FF7723E0000-0x00007FF7727D2000-memory.dmp	upx
behavioral2/memory/2512-444-0x00007FF730600000-0x00007FF7309F2000-memory.dmp	upx
behavioral2/memory/900-438-0x00007FF619F20000-0x00007FF61A312000-memory.dmp	upx
behavioral2/memory/2800-349-0x00007FF7728B0000-0x00007FF772CA2000-memory.dmp	upx
behavioral2/memory/4796-338-0x00007FF6770E0000-0x00007FF6774D2000-memory.dmp	upx
behavioral2/memory/4912-335-0x00007FF705E30000-0x00007FF706222000-memory.dmp	upx
behavioral2/memory/3208-304-0x00007FF631DC0000-0x00007FF6321B2000-memory.dmp	upx
behavioral2/memory/1016-303-0x00007FF67E490000-0x00007FF67E882000-memory.dmp	upx
behavioral2/memory/4908-218-0x00007FF727DC0000-0x00007FF7281B2000-memory.dmp	upx
behavioral2/files/0x0008000000023c48-188.dat	upx
behavioral2/files/0x0008000000023c47-187.dat	upx
behavioral2/files/0x0008000000023c46-186.dat	upx
behavioral2/files/0x0008000000023c45-185.dat	upx
behavioral2/files/0x0008000000023c44-184.dat	upx
behavioral2/files/0x000b000000023be9-176.dat	upx
behavioral2/files/0x0008000000023c0e-172.dat	upx
behavioral2/files/0x0009000000023c08-165.dat	upx
behavioral2/files/0x000a000000023be6-159.dat	upx
behavioral2/memory/2344-158-0x00007FF76AAB0000-0x00007FF76AEA2000-memory.dmp	upx
behavioral2/files/0x0008000000023c14-157.dat	upx
behavioral2/files/0x000e000000023bf8-151.dat	upx
behavioral2/files/0x000a000000023bf1-148.dat	upx
behavioral2/files/0x000a000000023be3-146.dat	upx
behavioral2/files/0x0008000000023c13-145.dat	upx
behavioral2/files/0x0008000000023c12-138.dat	upx
behavioral2/files/0x0008000000023c43-166.dat	upx
behavioral2/files/0x000e000000023c0c-130.dat	upx
behavioral2/memory/2036-164-0x00007FF68B9F0000-0x00007FF68BDE2000-memory.dmp	upx
behavioral2/files/0x0009000000023c07-129.dat	upx
behavioral2/memory/752-125-0x00007FF662B20000-0x00007FF662F12000-memory.dmp	upx
behavioral2/files/0x0009000000023c06-124.dat	upx
behavioral2/files/0x000a000000023be2-139.dat	upx
behavioral2/files/0x000a000000023bde-107.dat	upx
behavioral2/files/0x000b000000023be7-104.dat	upx
behavioral2/files/0x000a000000023bdd-103.dat	upx
behavioral2/files/0x000a000000023be5-94.dat	upx
behavioral2/files/0x000a000000023bdc-93.dat	upx
behavioral2/files/0x000a000000023bdb-85.dat	upx
behavioral2/memory/2716-83-0x00007FF6E57C0000-0x00007FF6E5BB2000-memory.dmp	upx
behavioral2/files/0x0008000000023c01-123.dat	upx
behavioral2/files/0x000a000000023be4-79.dat	upx
behavioral2/files/0x000a000000023be0-118.dat	upx
behavioral2/files/0x000a000000023be1-61.dat	upx
behavioral2/files/0x000a000000023bd9-59.dat	upx
behavioral2/memory/1928-56-0x00007FF75A230000-0x00007FF75A622000-memory.dmp	upx
behavioral2/files/0x000a000000023bd8-48.dat	upx
behavioral2/files/0x000a000000023bda-65.dat	upx
behavioral2/memory/1504-38-0x00007FF642B70000-0x00007FF642F62000-memory.dmp	upx
behavioral2/files/0x000a000000023bd6-33.dat	upx
behavioral2/memory/3544-30-0x00007FF70B550000-0x00007FF70B942000-memory.dmp	upx
behavioral2/memory/836-16-0x00007FF727420000-0x00007FF727812000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\rDXyhSz.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\ZTklIHv.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\GHgJYVx.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\gvdtnlZ.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\MsjdfLc.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\bSTIZHC.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\xYrSCDd.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\XWxLHBH.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\sZszpjA.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\CBJBnGF.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\XttzWQz.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\BPElCFB.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\ySLneKi.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\hXZCHhl.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\ZXasOnP.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\VTIcnax.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\oHJFfHP.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\BUxcCim.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\SMmWWhA.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\VahUsSB.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\LZpoceE.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\XnCorLi.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\XXyIQaa.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\qhfjCeH.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\ELesXAS.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\TfNHqab.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\URMUGhJ.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\zXbhkUy.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\wUtsrgr.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\dlhiLwi.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\ZznAkNB.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\BhihqXc.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\RCreFJD.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\hGXjxwX.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\BgIsrfZ.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\uQQBXJx.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\aTliooy.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\rtAIUmH.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\dcHLzsd.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\HkbDZSw.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\zIgACQG.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\qyLRFvE.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\WjIhygG.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\ehUelJA.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\QKkIaEq.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\PWfRgwB.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\hntzxlR.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\ICxBJRj.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\IJYDfwW.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\vIwwiSD.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\vivkcxW.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\jwHERlO.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\tRannbv.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\zgzTitg.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\JrTiHlo.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\wzCOSxj.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\byHnjPi.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\knzHaLA.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\HXlRLUe.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\aTdoHFN.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\TnCAYNO.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\RUDwVzt.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\kXYVCHT.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\oAfYCrt.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3508	powershell.exe
3508	powershell.exe
3508	powershell.exe
3508	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
Token: SeDebugPrivilege	3508	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 3508	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	84
PID 3264 wrote to memory of 3508	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	84
PID 3264 wrote to memory of 836	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	85
PID 3264 wrote to memory of 836	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	85
PID 3264 wrote to memory of 3544	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	86
PID 3264 wrote to memory of 3544	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	86
PID 3264 wrote to memory of 1504	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	87
PID 3264 wrote to memory of 1504	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	87
PID 3264 wrote to memory of 900	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	88
PID 3264 wrote to memory of 900	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	88
PID 3264 wrote to memory of 1928	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	89
PID 3264 wrote to memory of 1928	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	89
PID 3264 wrote to memory of 2716	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	90
PID 3264 wrote to memory of 2716	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	90
PID 3264 wrote to memory of 3268	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	91
PID 3264 wrote to memory of 3268	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	91
PID 3264 wrote to memory of 752	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	92
PID 3264 wrote to memory of 752	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	92
PID 3264 wrote to memory of 2344	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	93
PID 3264 wrote to memory of 2344	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	93
PID 3264 wrote to memory of 2036	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	94
PID 3264 wrote to memory of 2036	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	94
PID 3264 wrote to memory of 1772	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	95
PID 3264 wrote to memory of 1772	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	95
PID 3264 wrote to memory of 4908	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	96
PID 3264 wrote to memory of 4908	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	96
PID 3264 wrote to memory of 2512	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	97
PID 3264 wrote to memory of 2512	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	97
PID 3264 wrote to memory of 1900	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	98
PID 3264 wrote to memory of 1900	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	98
PID 3264 wrote to memory of 1044	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	99
PID 3264 wrote to memory of 1044	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	99
PID 3264 wrote to memory of 1016	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	100
PID 3264 wrote to memory of 1016	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	100
PID 3264 wrote to memory of 3208	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	101
PID 3264 wrote to memory of 3208	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	101
PID 3264 wrote to memory of 2720	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	102
PID 3264 wrote to memory of 2720	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	102
PID 3264 wrote to memory of 4912	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	103
PID 3264 wrote to memory of 4912	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	103
PID 3264 wrote to memory of 4796	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	104
PID 3264 wrote to memory of 4796	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	104
PID 3264 wrote to memory of 2800	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	105
PID 3264 wrote to memory of 2800	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	105
PID 3264 wrote to memory of 2868	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	106
PID 3264 wrote to memory of 2868	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	106
PID 3264 wrote to memory of 4956	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	107
PID 3264 wrote to memory of 4956	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	107
PID 3264 wrote to memory of 4660	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	108
PID 3264 wrote to memory of 4660	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	108
PID 3264 wrote to memory of 2156	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	109
PID 3264 wrote to memory of 2156	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	109
PID 3264 wrote to memory of 2472	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	110
PID 3264 wrote to memory of 2472	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	110
PID 3264 wrote to memory of 424	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	111
PID 3264 wrote to memory of 424	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	111
PID 3264 wrote to memory of 3032	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	112
PID 3264 wrote to memory of 3032	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	112
PID 3264 wrote to memory of 5004	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	113
PID 3264 wrote to memory of 5004	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	113
PID 3264 wrote to memory of 1544	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	114
PID 3264 wrote to memory of 1544	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	114
PID 3264 wrote to memory of 4572	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	115
PID 3264 wrote to memory of 4572	3264	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0b4633969fb74371b862ea226a204360_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3508
- C:\Windows\System\DwPDkVM.exe
  C:\Windows\System\DwPDkVM.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\dGWeFZz.exe
  C:\Windows\System\dGWeFZz.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\tTIBnEA.exe
  C:\Windows\System\tTIBnEA.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\OtcKqWa.exe
  C:\Windows\System\OtcKqWa.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\zEYQwbx.exe
  C:\Windows\System\zEYQwbx.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\ywcVYSh.exe
  C:\Windows\System\ywcVYSh.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\UpvqFUO.exe
  C:\Windows\System\UpvqFUO.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\oGFZPsD.exe
  C:\Windows\System\oGFZPsD.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\bfcKgpu.exe
  C:\Windows\System\bfcKgpu.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\rcrLKdB.exe
  C:\Windows\System\rcrLKdB.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\rEnEngo.exe
  C:\Windows\System\rEnEngo.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\aBfbsha.exe
  C:\Windows\System\aBfbsha.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\TRTUkOr.exe
  C:\Windows\System\TRTUkOr.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\fjztFQt.exe
  C:\Windows\System\fjztFQt.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\XBeNdoB.exe
  C:\Windows\System\XBeNdoB.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\eINmQDI.exe
  C:\Windows\System\eINmQDI.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\UpTfFuT.exe
  C:\Windows\System\UpTfFuT.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\LLJyowi.exe
  C:\Windows\System\LLJyowi.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\oVmXCXf.exe
  C:\Windows\System\oVmXCXf.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\AVepzYo.exe
  C:\Windows\System\AVepzYo.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\KbhdITg.exe
  C:\Windows\System\KbhdITg.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\yjKAkpk.exe
  C:\Windows\System\yjKAkpk.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\uJHFYrm.exe
  C:\Windows\System\uJHFYrm.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\reyiWLE.exe
  C:\Windows\System\reyiWLE.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\sybApgO.exe
  C:\Windows\System\sybApgO.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\hYSwtgq.exe
  C:\Windows\System\hYSwtgq.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\TlgHOhY.exe
  C:\Windows\System\TlgHOhY.exe
  2⤵
  - Executes dropped EXE
  PID:424
- C:\Windows\System\ePkvdzW.exe
  C:\Windows\System\ePkvdzW.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\xXlHesK.exe
  C:\Windows\System\xXlHesK.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\EGBuWjN.exe
  C:\Windows\System\EGBuWjN.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\wFctiPX.exe
  C:\Windows\System\wFctiPX.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\YHgdDgz.exe
  C:\Windows\System\YHgdDgz.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\IkKNWeN.exe
  C:\Windows\System\IkKNWeN.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\KZybqfl.exe
  C:\Windows\System\KZybqfl.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\GlqzEtB.exe
  C:\Windows\System\GlqzEtB.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\XnmESev.exe
  C:\Windows\System\XnmESev.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\NmrOLnG.exe
  C:\Windows\System\NmrOLnG.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\XcTtyIa.exe
  C:\Windows\System\XcTtyIa.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\kIxQBCC.exe
  C:\Windows\System\kIxQBCC.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\toIRBEg.exe
  C:\Windows\System\toIRBEg.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\LMwtNOe.exe
  C:\Windows\System\LMwtNOe.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\TbBBINA.exe
  C:\Windows\System\TbBBINA.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\HoNmRww.exe
  C:\Windows\System\HoNmRww.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\EdgcKGr.exe
  C:\Windows\System\EdgcKGr.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\syDggLT.exe
  C:\Windows\System\syDggLT.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\osRBvqS.exe
  C:\Windows\System\osRBvqS.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\MSzqVxO.exe
  C:\Windows\System\MSzqVxO.exe
  2⤵
  - Executes dropped EXE
  PID:664
- C:\Windows\System\BUijATJ.exe
  C:\Windows\System\BUijATJ.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System\IzDRisM.exe
  C:\Windows\System\IzDRisM.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\rrccrHZ.exe
  C:\Windows\System\rrccrHZ.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\YJdKHSf.exe
  C:\Windows\System\YJdKHSf.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\ozDQmTB.exe
  C:\Windows\System\ozDQmTB.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\Mxtsryl.exe
  C:\Windows\System\Mxtsryl.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\glLgDwm.exe
  C:\Windows\System\glLgDwm.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\aiNAcQF.exe
  C:\Windows\System\aiNAcQF.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\NxBbzsK.exe
  C:\Windows\System\NxBbzsK.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\eclFpNF.exe
  C:\Windows\System\eclFpNF.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\vnYZqXr.exe
  C:\Windows\System\vnYZqXr.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\RsqcDUH.exe
  C:\Windows\System\RsqcDUH.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\DrsWqsn.exe
  C:\Windows\System\DrsWqsn.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\sKYYQNx.exe
  C:\Windows\System\sKYYQNx.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\JmfdUfl.exe
  C:\Windows\System\JmfdUfl.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\WgrKlGM.exe
  C:\Windows\System\WgrKlGM.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\ksGaSkf.exe
  C:\Windows\System\ksGaSkf.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\mOxbSLH.exe
  C:\Windows\System\mOxbSLH.exe
  2⤵
  PID:4264
- C:\Windows\System\onWupHv.exe
  C:\Windows\System\onWupHv.exe
  2⤵
  PID:1924
- C:\Windows\System\FoJfEdT.exe
  C:\Windows\System\FoJfEdT.exe
  2⤵
  PID:3252
- C:\Windows\System\kbFaIms.exe
  C:\Windows\System\kbFaIms.exe
  2⤵
  PID:3200
- C:\Windows\System\kqRFrfH.exe
  C:\Windows\System\kqRFrfH.exe
  2⤵
  PID:3628
- C:\Windows\System\YVeYANY.exe
  C:\Windows\System\YVeYANY.exe
  2⤵
  PID:4556
- C:\Windows\System\QCalhET.exe
  C:\Windows\System\QCalhET.exe
  2⤵
  PID:2232
- C:\Windows\System\pfCFUAD.exe
  C:\Windows\System\pfCFUAD.exe
  2⤵
  PID:4636
- C:\Windows\System\oPZIVgf.exe
  C:\Windows\System\oPZIVgf.exe
  2⤵
  PID:3420
- C:\Windows\System\ljxPNhR.exe
  C:\Windows\System\ljxPNhR.exe
  2⤵
  PID:1736
- C:\Windows\System\fqvxIGk.exe
  C:\Windows\System\fqvxIGk.exe
  2⤵
  PID:4944
- C:\Windows\System\vdsYRPb.exe
  C:\Windows\System\vdsYRPb.exe
  2⤵
  PID:3592
- C:\Windows\System\iDaPqOx.exe
  C:\Windows\System\iDaPqOx.exe
  2⤵
  PID:3928
- C:\Windows\System\qfrxylB.exe
  C:\Windows\System\qfrxylB.exe
  2⤵
  PID:4208
- C:\Windows\System\TTShVJp.exe
  C:\Windows\System\TTShVJp.exe
  2⤵
  PID:3888
- C:\Windows\System\YFwvWuA.exe
  C:\Windows\System\YFwvWuA.exe
  2⤵
  PID:2540
- C:\Windows\System\mdeUusg.exe
  C:\Windows\System\mdeUusg.exe
  2⤵
  PID:2500
- C:\Windows\System\yZqijhY.exe
  C:\Windows\System\yZqijhY.exe
  2⤵
  PID:3528
- C:\Windows\System\coSBUde.exe
  C:\Windows\System\coSBUde.exe
  2⤵
  PID:5128
- C:\Windows\System\mzSYcLV.exe
  C:\Windows\System\mzSYcLV.exe
  2⤵
  PID:5152
- C:\Windows\System\UUvNJRw.exe
  C:\Windows\System\UUvNJRw.exe
  2⤵
  PID:5256
- C:\Windows\System\OjNkyFu.exe
  C:\Windows\System\OjNkyFu.exe
  2⤵
  PID:5284
- C:\Windows\System\tJhGHJe.exe
  C:\Windows\System\tJhGHJe.exe
  2⤵
  PID:5304
- C:\Windows\System\mMceGTG.exe
  C:\Windows\System\mMceGTG.exe
  2⤵
  PID:5324
- C:\Windows\System\AeugFVE.exe
  C:\Windows\System\AeugFVE.exe
  2⤵
  PID:5348
- C:\Windows\System\OBCjAzp.exe
  C:\Windows\System\OBCjAzp.exe
  2⤵
  PID:5372
- C:\Windows\System\BBeoLjc.exe
  C:\Windows\System\BBeoLjc.exe
  2⤵
  PID:5396
- C:\Windows\System\qOYmtGi.exe
  C:\Windows\System\qOYmtGi.exe
  2⤵
  PID:5412
- C:\Windows\System\jWmxSDX.exe
  C:\Windows\System\jWmxSDX.exe
  2⤵
  PID:5432
- C:\Windows\System\WFDDOqY.exe
  C:\Windows\System\WFDDOqY.exe
  2⤵
  PID:5464
- C:\Windows\System\txqRpIx.exe
  C:\Windows\System\txqRpIx.exe
  2⤵
  PID:5632
- C:\Windows\System\wIjgDmL.exe
  C:\Windows\System\wIjgDmL.exe
  2⤵
  PID:5652
- C:\Windows\System\BUgYUrt.exe
  C:\Windows\System\BUgYUrt.exe
  2⤵
  PID:5760
- C:\Windows\System\kdjvHSz.exe
  C:\Windows\System\kdjvHSz.exe
  2⤵
  PID:5784
- C:\Windows\System\NeUZlny.exe
  C:\Windows\System\NeUZlny.exe
  2⤵
  PID:5804
- C:\Windows\System\jzEQuNm.exe
  C:\Windows\System\jzEQuNm.exe
  2⤵
  PID:5828
- C:\Windows\System\vtrNYZM.exe
  C:\Windows\System\vtrNYZM.exe
  2⤵
  PID:5852
- C:\Windows\System\iopndiD.exe
  C:\Windows\System\iopndiD.exe
  2⤵
  PID:5916
- C:\Windows\System\oBCJeAX.exe
  C:\Windows\System\oBCJeAX.exe
  2⤵
  PID:5940
- C:\Windows\System\cBndilq.exe
  C:\Windows\System\cBndilq.exe
  2⤵
  PID:5960
- C:\Windows\System\gZbcXDh.exe
  C:\Windows\System\gZbcXDh.exe
  2⤵
  PID:5992
- C:\Windows\System\VQmbtHE.exe
  C:\Windows\System\VQmbtHE.exe
  2⤵
  PID:6052
- C:\Windows\System\zvlAApg.exe
  C:\Windows\System\zvlAApg.exe
  2⤵
  PID:6068
- C:\Windows\System\hRgjwVf.exe
  C:\Windows\System\hRgjwVf.exe
  2⤵
  PID:6084
- C:\Windows\System\OAnPJXU.exe
  C:\Windows\System\OAnPJXU.exe
  2⤵
  PID:6100
- C:\Windows\System\eoryZwW.exe
  C:\Windows\System\eoryZwW.exe
  2⤵
  PID:6116
- C:\Windows\System\RjQpIak.exe
  C:\Windows\System\RjQpIak.exe
  2⤵
  PID:6132
- C:\Windows\System\EbHuYZx.exe
  C:\Windows\System\EbHuYZx.exe
  2⤵
  PID:1200
- C:\Windows\System\nWCJOZe.exe
  C:\Windows\System\nWCJOZe.exe
  2⤵
  PID:3228
- C:\Windows\System\EIHzngy.exe
  C:\Windows\System\EIHzngy.exe
  2⤵
  PID:228
- C:\Windows\System\zgPxpZc.exe
  C:\Windows\System\zgPxpZc.exe
  2⤵
  PID:5164
- C:\Windows\System\bXfBWlM.exe
  C:\Windows\System\bXfBWlM.exe
  2⤵
  PID:5032
- C:\Windows\System\TIKVpTJ.exe
  C:\Windows\System\TIKVpTJ.exe
  2⤵
  PID:4288
- C:\Windows\System\CMtaoQU.exe
  C:\Windows\System\CMtaoQU.exe
  2⤵
  PID:4256
- C:\Windows\System\dPVuFfs.exe
  C:\Windows\System\dPVuFfs.exe
  2⤵
  PID:5044
- C:\Windows\System\PDlmrAj.exe
  C:\Windows\System\PDlmrAj.exe
  2⤵
  PID:4276
- C:\Windows\System\WwqhJIX.exe
  C:\Windows\System\WwqhJIX.exe
  2⤵
  PID:3416
- C:\Windows\System\lpjnPdW.exe
  C:\Windows\System\lpjnPdW.exe
  2⤵
  PID:1964
- C:\Windows\System\UKgmldy.exe
  C:\Windows\System\UKgmldy.exe
  2⤵
  PID:5000
- C:\Windows\System\HXeyHhq.exe
  C:\Windows\System\HXeyHhq.exe
  2⤵
  PID:4756
- C:\Windows\System\BAGeUxw.exe
  C:\Windows\System\BAGeUxw.exe
  2⤵
  PID:2004
- C:\Windows\System\rlfQVzD.exe
  C:\Windows\System\rlfQVzD.exe
  2⤵
  PID:1020
- C:\Windows\System\ZvdtunQ.exe
  C:\Windows\System\ZvdtunQ.exe
  2⤵
  PID:5332
- C:\Windows\System\cHwfBtM.exe
  C:\Windows\System\cHwfBtM.exe
  2⤵
  PID:5444
- C:\Windows\System\FZThSPc.exe
  C:\Windows\System\FZThSPc.exe
  2⤵
  PID:5496
- C:\Windows\System\mbIrmiX.exe
  C:\Windows\System\mbIrmiX.exe
  2⤵
  PID:5956
- C:\Windows\System\mLQJBPK.exe
  C:\Windows\System\mLQJBPK.exe
  2⤵
  PID:5596
- C:\Windows\System\WdiMSlt.exe
  C:\Windows\System\WdiMSlt.exe
  2⤵
  PID:5644
- C:\Windows\System\CfRaaRq.exe
  C:\Windows\System\CfRaaRq.exe
  2⤵
  PID:2728
- C:\Windows\System\eoEpqQC.exe
  C:\Windows\System\eoEpqQC.exe
  2⤵
  PID:5980
- C:\Windows\System\btxvbAy.exe
  C:\Windows\System\btxvbAy.exe
  2⤵
  PID:5728
- C:\Windows\System\zcaykeE.exe
  C:\Windows\System\zcaykeE.exe
  2⤵
  PID:5752
- C:\Windows\System\VNiwzHN.exe
  C:\Windows\System\VNiwzHN.exe
  2⤵
  PID:5792
- C:\Windows\System\QJpyTFF.exe
  C:\Windows\System\QJpyTFF.exe
  2⤵
  PID:5836
- C:\Windows\System\sYKNVlQ.exe
  C:\Windows\System\sYKNVlQ.exe
  2⤵
  PID:5900
- C:\Windows\System\wqjgbHX.exe
  C:\Windows\System\wqjgbHX.exe
  2⤵
  PID:6004
- C:\Windows\System\rFUOLzM.exe
  C:\Windows\System\rFUOLzM.exe
  2⤵
  PID:6092
- C:\Windows\System\gDUgpQM.exe
  C:\Windows\System\gDUgpQM.exe
  2⤵
  PID:6128
- C:\Windows\System\CeDaWkx.exe
  C:\Windows\System\CeDaWkx.exe
  2⤵
  PID:4312
- C:\Windows\System\XVUspnE.exe
  C:\Windows\System\XVUspnE.exe
  2⤵
  PID:3396
- C:\Windows\System\LKNvARi.exe
  C:\Windows\System\LKNvARi.exe
  2⤵
  PID:1096
- C:\Windows\System\hdCByAP.exe
  C:\Windows\System\hdCByAP.exe
  2⤵
  PID:4272
- C:\Windows\System\SqeMeZl.exe
  C:\Windows\System\SqeMeZl.exe
  2⤵
  PID:904
- C:\Windows\System\sSfMEVC.exe
  C:\Windows\System\sSfMEVC.exe
  2⤵
  PID:5036
- C:\Windows\System\oFLYdIs.exe
  C:\Windows\System\oFLYdIs.exe
  2⤵
  PID:6164
- C:\Windows\System\xwIKysu.exe
  C:\Windows\System\xwIKysu.exe
  2⤵
  PID:6204
- C:\Windows\System\nnCGAHU.exe
  C:\Windows\System\nnCGAHU.exe
  2⤵
  PID:6228
- C:\Windows\System\mtmpyYt.exe
  C:\Windows\System\mtmpyYt.exe
  2⤵
  PID:6344
- C:\Windows\System\gnFuqFi.exe
  C:\Windows\System\gnFuqFi.exe
  2⤵
  PID:6360
- C:\Windows\System\ZIAPCwQ.exe
  C:\Windows\System\ZIAPCwQ.exe
  2⤵
  PID:6384
- C:\Windows\System\yUbwDjo.exe
  C:\Windows\System\yUbwDjo.exe
  2⤵
  PID:6400
- C:\Windows\System\iCBrrII.exe
  C:\Windows\System\iCBrrII.exe
  2⤵
  PID:6424
- C:\Windows\System\mQRcSXB.exe
  C:\Windows\System\mQRcSXB.exe
  2⤵
  PID:6448
- C:\Windows\System\zpSrYDt.exe
  C:\Windows\System\zpSrYDt.exe
  2⤵
  PID:6480
- C:\Windows\System\GqYrZZO.exe
  C:\Windows\System\GqYrZZO.exe
  2⤵
  PID:6496
- C:\Windows\System\VMofnFx.exe
  C:\Windows\System\VMofnFx.exe
  2⤵
  PID:6516
- C:\Windows\System\aqqKCfM.exe
  C:\Windows\System\aqqKCfM.exe
  2⤵
  PID:6532
- C:\Windows\System\csiInxV.exe
  C:\Windows\System\csiInxV.exe
  2⤵
  PID:6632
- C:\Windows\System\dZVjyqU.exe
  C:\Windows\System\dZVjyqU.exe
  2⤵
  PID:6656
- C:\Windows\System\qtOhIkw.exe
  C:\Windows\System\qtOhIkw.exe
  2⤵
  PID:6680
- C:\Windows\System\iISZMJY.exe
  C:\Windows\System\iISZMJY.exe
  2⤵
  PID:6696
- C:\Windows\System\OxTnxov.exe
  C:\Windows\System\OxTnxov.exe
  2⤵
  PID:6720
- C:\Windows\System\Lcgjwuu.exe
  C:\Windows\System\Lcgjwuu.exe
  2⤵
  PID:6748
- C:\Windows\System\VhMCbrV.exe
  C:\Windows\System\VhMCbrV.exe
  2⤵
  PID:6764
- C:\Windows\System\dXOhVrD.exe
  C:\Windows\System\dXOhVrD.exe
  2⤵
  PID:6788
- C:\Windows\System\VvhtliN.exe
  C:\Windows\System\VvhtliN.exe
  2⤵
  PID:6808
- C:\Windows\System\RuKHGrx.exe
  C:\Windows\System\RuKHGrx.exe
  2⤵
  PID:6828
- C:\Windows\System\GzxEvca.exe
  C:\Windows\System\GzxEvca.exe
  2⤵
  PID:6848
- C:\Windows\System\mFieWZO.exe
  C:\Windows\System\mFieWZO.exe
  2⤵
  PID:6872
- C:\Windows\System\UIyiYJk.exe
  C:\Windows\System\UIyiYJk.exe
  2⤵
  PID:6892
- C:\Windows\System\uZRVkhI.exe
  C:\Windows\System\uZRVkhI.exe
  2⤵
  PID:6912
- C:\Windows\System\dRjZMgR.exe
  C:\Windows\System\dRjZMgR.exe
  2⤵
  PID:6936
- C:\Windows\System\WlWuHqu.exe
  C:\Windows\System\WlWuHqu.exe
  2⤵
  PID:6952
- C:\Windows\System\SUkvZXP.exe
  C:\Windows\System\SUkvZXP.exe
  2⤵
  PID:6976
- C:\Windows\System\cKDsyhe.exe
  C:\Windows\System\cKDsyhe.exe
  2⤵
  PID:7000
- C:\Windows\System\roExIKu.exe
  C:\Windows\System\roExIKu.exe
  2⤵
  PID:7024
- C:\Windows\System\wqKmkVh.exe
  C:\Windows\System\wqKmkVh.exe
  2⤵
  PID:7044
- C:\Windows\System\MvdTPzi.exe
  C:\Windows\System\MvdTPzi.exe
  2⤵
  PID:7068
- C:\Windows\System\zZtazGq.exe
  C:\Windows\System\zZtazGq.exe
  2⤵
  PID:7092
- C:\Windows\System\nkPyGOI.exe
  C:\Windows\System\nkPyGOI.exe
  2⤵
  PID:7108
- C:\Windows\System\eeYwjOk.exe
  C:\Windows\System\eeYwjOk.exe
  2⤵
  PID:3716
- C:\Windows\System\NeZkHsi.exe
  C:\Windows\System\NeZkHsi.exe
  2⤵
  PID:5408
- C:\Windows\System\qvlxQgv.exe
  C:\Windows\System\qvlxQgv.exe
  2⤵
  PID:5472
- C:\Windows\System\iMZxBhY.exe
  C:\Windows\System\iMZxBhY.exe
  2⤵
  PID:5616
- C:\Windows\System\HyvpMGc.exe
  C:\Windows\System\HyvpMGc.exe
  2⤵
  PID:5972
- C:\Windows\System\IxsREKY.exe
  C:\Windows\System\IxsREKY.exe
  2⤵
  PID:5812
- C:\Windows\System\IjvuFrq.exe
  C:\Windows\System\IjvuFrq.exe
  2⤵
  PID:5924
- C:\Windows\System\iQdsnWh.exe
  C:\Windows\System\iQdsnWh.exe
  2⤵
  PID:6108
- C:\Windows\System\cMWxErQ.exe
  C:\Windows\System\cMWxErQ.exe
  2⤵
  PID:2580
- C:\Windows\System\ZJVTFKp.exe
  C:\Windows\System\ZJVTFKp.exe
  2⤵
  PID:1916
- C:\Windows\System\Rimjxnm.exe
  C:\Windows\System\Rimjxnm.exe
  2⤵
  PID:6148
- C:\Windows\System\LRFZDDg.exe
  C:\Windows\System\LRFZDDg.exe
  2⤵
  PID:6240
- C:\Windows\System\CLTkMXl.exe
  C:\Windows\System\CLTkMXl.exe
  2⤵
  PID:6996
- C:\Windows\System\jIOtRVT.exe
  C:\Windows\System\jIOtRVT.exe
  2⤵
  PID:7052
- C:\Windows\System\CoVnWeF.exe
  C:\Windows\System\CoVnWeF.exe
  2⤵
  PID:7180
- C:\Windows\System\vIsWJhB.exe
  C:\Windows\System\vIsWJhB.exe
  2⤵
  PID:7208
- C:\Windows\System\iEQbGBf.exe
  C:\Windows\System\iEQbGBf.exe
  2⤵
  PID:7224
- C:\Windows\System\VqXudTW.exe
  C:\Windows\System\VqXudTW.exe
  2⤵
  PID:7244
- C:\Windows\System\yAvCRta.exe
  C:\Windows\System\yAvCRta.exe
  2⤵
  PID:7260
- C:\Windows\System\IcuWfXB.exe
  C:\Windows\System\IcuWfXB.exe
  2⤵
  PID:7440
- C:\Windows\System\iORxkds.exe
  C:\Windows\System\iORxkds.exe
  2⤵
  PID:7464
- C:\Windows\System\WMhcpHZ.exe
  C:\Windows\System\WMhcpHZ.exe
  2⤵
  PID:7480
- C:\Windows\System\ZzRuhDr.exe
  C:\Windows\System\ZzRuhDr.exe
  2⤵
  PID:7504
- C:\Windows\System\JlMavch.exe
  C:\Windows\System\JlMavch.exe
  2⤵
  PID:7528
- C:\Windows\System\IoZvIVg.exe
  C:\Windows\System\IoZvIVg.exe
  2⤵
  PID:7544
- C:\Windows\System\ihNNlvi.exe
  C:\Windows\System\ihNNlvi.exe
  2⤵
  PID:7568
- C:\Windows\System\GonwPim.exe
  C:\Windows\System\GonwPim.exe
  2⤵
  PID:7600
- C:\Windows\System\pWITtVt.exe
  C:\Windows\System\pWITtVt.exe
  2⤵
  PID:7616
- C:\Windows\System\GteUFBh.exe
  C:\Windows\System\GteUFBh.exe
  2⤵
  PID:7636
- C:\Windows\System\lBIaArM.exe
  C:\Windows\System\lBIaArM.exe
  2⤵
  PID:7760
- C:\Windows\System\xKJHDnJ.exe
  C:\Windows\System\xKJHDnJ.exe
  2⤵
  PID:7784
- C:\Windows\System\NmyUlic.exe
  C:\Windows\System\NmyUlic.exe
  2⤵
  PID:7804
- C:\Windows\System\MJaFdZW.exe
  C:\Windows\System\MJaFdZW.exe
  2⤵
  PID:7820
- C:\Windows\System\FrirIas.exe
  C:\Windows\System\FrirIas.exe
  2⤵
  PID:7840
- C:\Windows\System\IqDdbvU.exe
  C:\Windows\System\IqDdbvU.exe
  2⤵
  PID:7860
- C:\Windows\System\lfOneqh.exe
  C:\Windows\System\lfOneqh.exe
  2⤵
  PID:7876
- C:\Windows\System\navmCVb.exe
  C:\Windows\System\navmCVb.exe
  2⤵
  PID:7900
- C:\Windows\System\ExFdsLq.exe
  C:\Windows\System\ExFdsLq.exe
  2⤵
  PID:7928
- C:\Windows\System\zZGoCgK.exe
  C:\Windows\System\zZGoCgK.exe
  2⤵
  PID:7948
- C:\Windows\System\AzRHjIy.exe
  C:\Windows\System\AzRHjIy.exe
  2⤵
  PID:7972
- C:\Windows\System\nQZRDGV.exe
  C:\Windows\System\nQZRDGV.exe
  2⤵
  PID:7992
- C:\Windows\System\KrVgSuZ.exe
  C:\Windows\System\KrVgSuZ.exe
  2⤵
  PID:8016
- C:\Windows\System\PTEliOa.exe
  C:\Windows\System\PTEliOa.exe
  2⤵
  PID:8040
- C:\Windows\System\VTIcnax.exe
  C:\Windows\System\VTIcnax.exe
  2⤵
  PID:8056
- C:\Windows\System\rtAIUmH.exe
  C:\Windows\System\rtAIUmH.exe
  2⤵
  PID:8080
- C:\Windows\System\RbuCTqR.exe
  C:\Windows\System\RbuCTqR.exe
  2⤵
  PID:8100
- C:\Windows\System\WAGIoWv.exe
  C:\Windows\System\WAGIoWv.exe
  2⤵
  PID:8120
- C:\Windows\System\EYvermh.exe
  C:\Windows\System\EYvermh.exe
  2⤵
  PID:8140
- C:\Windows\System\xGjJmnc.exe
  C:\Windows\System\xGjJmnc.exe
  2⤵
  PID:6464
- C:\Windows\System\nSHjNSa.exe
  C:\Windows\System\nSHjNSa.exe
  2⤵
  PID:1624
- C:\Windows\System\sIPWoxL.exe
  C:\Windows\System\sIPWoxL.exe
  2⤵
  PID:6548
- C:\Windows\System\qRTzwdw.exe
  C:\Windows\System\qRTzwdw.exe
  2⤵
  PID:6624
- C:\Windows\System\vmsazss.exe
  C:\Windows\System\vmsazss.exe
  2⤵
  PID:6676
- C:\Windows\System\irRLVmN.exe
  C:\Windows\System\irRLVmN.exe
  2⤵
  PID:6728
- C:\Windows\System\OUbwOXD.exe
  C:\Windows\System\OUbwOXD.exe
  2⤵
  PID:6772
- C:\Windows\System\vGqRwsa.exe
  C:\Windows\System\vGqRwsa.exe
  2⤵
  PID:6804
- C:\Windows\System\NymSiqZ.exe
  C:\Windows\System\NymSiqZ.exe
  2⤵
  PID:6856
- C:\Windows\System\ejUzgHI.exe
  C:\Windows\System\ejUzgHI.exe
  2⤵
  PID:6904
- C:\Windows\System\ffSHPDV.exe
  C:\Windows\System\ffSHPDV.exe
  2⤵
  PID:6944
- C:\Windows\System\uPqHEHG.exe
  C:\Windows\System\uPqHEHG.exe
  2⤵
  PID:7060
- C:\Windows\System\yAkoRMW.exe
  C:\Windows\System\yAkoRMW.exe
  2⤵
  PID:7104
- C:\Windows\System\ljJmsMi.exe
  C:\Windows\System\ljJmsMi.exe
  2⤵
  PID:6220
- C:\Windows\System\xhuAKNa.exe
  C:\Windows\System\xhuAKNa.exe
  2⤵
  PID:7120
- C:\Windows\System\kcBxhYm.exe
  C:\Windows\System\kcBxhYm.exe
  2⤵
  PID:7652
- C:\Windows\System\xwitLLY.exe
  C:\Windows\System\xwitLLY.exe
  2⤵
  PID:7200
- C:\Windows\System\ijOCapK.exe
  C:\Windows\System\ijOCapK.exe
  2⤵
  PID:7240
- C:\Windows\System\teUwBLU.exe
  C:\Windows\System\teUwBLU.exe
  2⤵
  PID:1936
- C:\Windows\System\FitBNUc.exe
  C:\Windows\System\FitBNUc.exe
  2⤵
  PID:2752
- C:\Windows\System\LvqDXUF.exe
  C:\Windows\System\LvqDXUF.exe
  2⤵
  PID:8088
- C:\Windows\System\NelYNQX.exe
  C:\Windows\System\NelYNQX.exe
  2⤵
  PID:8132
- C:\Windows\System\XsaJFyP.exe
  C:\Windows\System\XsaJFyP.exe
  2⤵
  PID:7396
- C:\Windows\System\yBgihQY.exe
  C:\Windows\System\yBgihQY.exe
  2⤵
  PID:7428
- C:\Windows\System\zhxorhu.exe
  C:\Windows\System\zhxorhu.exe
  2⤵
  PID:7500
- C:\Windows\System\lDlYVkS.exe
  C:\Windows\System\lDlYVkS.exe
  2⤵
  PID:7540
- C:\Windows\System\SknZtXD.exe
  C:\Windows\System\SknZtXD.exe
  2⤵
  PID:8092
- C:\Windows\System\EqMDlIq.exe
  C:\Windows\System\EqMDlIq.exe
  2⤵
  PID:8212
- C:\Windows\System\YqQJxum.exe
  C:\Windows\System\YqQJxum.exe
  2⤵
  PID:8228
- C:\Windows\System\kICauab.exe
  C:\Windows\System\kICauab.exe
  2⤵
  PID:8244
- C:\Windows\System\BJGATMS.exe
  C:\Windows\System\BJGATMS.exe
  2⤵
  PID:8268
- C:\Windows\System\MmBLRkb.exe
  C:\Windows\System\MmBLRkb.exe
  2⤵
  PID:8292
- C:\Windows\System\qkPTcdf.exe
  C:\Windows\System\qkPTcdf.exe
  2⤵
  PID:8316
- C:\Windows\System\zuAqnhE.exe
  C:\Windows\System\zuAqnhE.exe
  2⤵
  PID:8888
- C:\Windows\System\HsfvcDg.exe
  C:\Windows\System\HsfvcDg.exe
  2⤵
  PID:8908
- C:\Windows\System\QbieVGq.exe
  C:\Windows\System\QbieVGq.exe
  2⤵
  PID:8928
- C:\Windows\System\KJQgAYZ.exe
  C:\Windows\System\KJQgAYZ.exe
  2⤵
  PID:8948
- C:\Windows\System\QPabLRV.exe
  C:\Windows\System\QPabLRV.exe
  2⤵
  PID:8968
- C:\Windows\System\LQrsKNH.exe
  C:\Windows\System\LQrsKNH.exe
  2⤵
  PID:8988
- C:\Windows\System\MbiPoHW.exe
  C:\Windows\System\MbiPoHW.exe
  2⤵
  PID:9008
- C:\Windows\System\MDpGeds.exe
  C:\Windows\System\MDpGeds.exe
  2⤵
  PID:9028
- C:\Windows\System\tbSFDMe.exe
  C:\Windows\System\tbSFDMe.exe
  2⤵
  PID:9048
- C:\Windows\System\TlQjgIX.exe
  C:\Windows\System\TlQjgIX.exe
  2⤵
  PID:9072
- C:\Windows\System\eTGIPFW.exe
  C:\Windows\System\eTGIPFW.exe
  2⤵
  PID:9092
- C:\Windows\System\ZscTlza.exe
  C:\Windows\System\ZscTlza.exe
  2⤵
  PID:9108
- C:\Windows\System\EccsbMl.exe
  C:\Windows\System\EccsbMl.exe
  2⤵
  PID:9124
- C:\Windows\System\SOsynDB.exe
  C:\Windows\System\SOsynDB.exe
  2⤵
  PID:9148
- C:\Windows\System\dxgQItd.exe
  C:\Windows\System\dxgQItd.exe
  2⤵
  PID:9164
- C:\Windows\System\XUGzCzJ.exe
  C:\Windows\System\XUGzCzJ.exe
  2⤵
  PID:9184
- C:\Windows\System\fthzWlh.exe
  C:\Windows\System\fthzWlh.exe
  2⤵
  PID:9204
- C:\Windows\System\cTSWTpF.exe
  C:\Windows\System\cTSWTpF.exe
  2⤵
  PID:7724
- C:\Windows\System\QSQYjGx.exe
  C:\Windows\System\QSQYjGx.exe
  2⤵
  PID:7768
- C:\Windows\System\yeUMlfh.exe
  C:\Windows\System\yeUMlfh.exe
  2⤵
  PID:7812
- C:\Windows\System\lHlJFTI.exe
  C:\Windows\System\lHlJFTI.exe
  2⤵
  PID:7856
- C:\Windows\System\fRamJvk.exe
  C:\Windows\System\fRamJvk.exe
  2⤵
  PID:7908
- C:\Windows\System\MmXqzht.exe
  C:\Windows\System\MmXqzht.exe
  2⤵
  PID:7960
- C:\Windows\System\fQZmBsE.exe
  C:\Windows\System\fQZmBsE.exe
  2⤵
  PID:8008
- C:\Windows\System\BQmJdAR.exe
  C:\Windows\System\BQmJdAR.exe
  2⤵
  PID:8052
- C:\Windows\System\PdiDWHV.exe
  C:\Windows\System\PdiDWHV.exe
  2⤵
  PID:8136
- C:\Windows\System\EawOUyM.exe
  C:\Windows\System\EawOUyM.exe
  2⤵
  PID:1224
- C:\Windows\System\iuYgEkE.exe
  C:\Windows\System\iuYgEkE.exe
  2⤵
  PID:6512
- C:\Windows\System\wHeOTWu.exe
  C:\Windows\System\wHeOTWu.exe
  2⤵
  PID:6664
- C:\Windows\System\QJOHqBk.exe
  C:\Windows\System\QJOHqBk.exe
  2⤵
  PID:6740
- C:\Windows\System\YeSfyrZ.exe
  C:\Windows\System\YeSfyrZ.exe
  2⤵
  PID:6840
- C:\Windows\System\hDgKAZb.exe
  C:\Windows\System\hDgKAZb.exe
  2⤵
  PID:6900
- C:\Windows\System\uTrZwks.exe
  C:\Windows\System\uTrZwks.exe
  2⤵
  PID:6968
- C:\Windows\System\ZtqhFtl.exe
  C:\Windows\System\ZtqhFtl.exe
  2⤵
  PID:2852
- C:\Windows\System\ypVEWNE.exe
  C:\Windows\System\ypVEWNE.exe
  2⤵
  PID:2980
- C:\Windows\System\WpEhLkb.exe
  C:\Windows\System\WpEhLkb.exe
  2⤵
  PID:3188
- C:\Windows\System\UeJTUJk.exe
  C:\Windows\System\UeJTUJk.exe
  2⤵
  PID:6984
- C:\Windows\System\bYilyBB.exe
  C:\Windows\System\bYilyBB.exe
  2⤵
  PID:7176
- C:\Windows\System\LyPwwhc.exe
  C:\Windows\System\LyPwwhc.exe
  2⤵
  PID:7236
- C:\Windows\System\joLweJG.exe
  C:\Windows\System\joLweJG.exe
  2⤵
  PID:8072
- C:\Windows\System\QGSmeQO.exe
  C:\Windows\System\QGSmeQO.exe
  2⤵
  PID:7412
- C:\Windows\System\DAAaklc.exe
  C:\Windows\System\DAAaklc.exe
  2⤵
  PID:7460
- C:\Windows\System\AftHOyl.exe
  C:\Windows\System\AftHOyl.exe
  2⤵
  PID:7576
- C:\Windows\System\uwZyvcE.exe
  C:\Windows\System\uwZyvcE.exe
  2⤵
  PID:8224
- C:\Windows\System\JFWbiNY.exe
  C:\Windows\System\JFWbiNY.exe
  2⤵
  PID:8260
- C:\Windows\System\OlnZvqN.exe
  C:\Windows\System\OlnZvqN.exe
  2⤵
  PID:8300
- C:\Windows\System\DLJhgoQ.exe
  C:\Windows\System\DLJhgoQ.exe
  2⤵
  PID:8408
- C:\Windows\System\QoOQlPa.exe
  C:\Windows\System\QoOQlPa.exe
  2⤵
  PID:8484
- C:\Windows\System\QyVQmiv.exe
  C:\Windows\System\QyVQmiv.exe
  2⤵
  PID:8524
- C:\Windows\System\pxGvTft.exe
  C:\Windows\System\pxGvTft.exe
  2⤵
  PID:432
- C:\Windows\System\QRJsHyD.exe
  C:\Windows\System\QRJsHyD.exe
  2⤵
  PID:2908
- C:\Windows\System\UfUFrHG.exe
  C:\Windows\System\UfUFrHG.exe
  2⤵
  PID:3232
- C:\Windows\System\RVLNfVJ.exe
  C:\Windows\System\RVLNfVJ.exe
  2⤵
  PID:1392
- C:\Windows\System\pOWLHkC.exe
  C:\Windows\System\pOWLHkC.exe
  2⤵
  PID:2588
- C:\Windows\System\PZWbucq.exe
  C:\Windows\System\PZWbucq.exe
  2⤵
  PID:4284
- C:\Windows\System\dExQEXT.exe
  C:\Windows\System\dExQEXT.exe
  2⤵
  PID:3684
- C:\Windows\System\TsrlcCJ.exe
  C:\Windows\System\TsrlcCJ.exe
  2⤵
  PID:3516
- C:\Windows\System\RZaPsRE.exe
  C:\Windows\System\RZaPsRE.exe
  2⤵
  PID:3104
- C:\Windows\System\NsbwdUr.exe
  C:\Windows\System\NsbwdUr.exe
  2⤵
  PID:2576
- C:\Windows\System\cRkbLHa.exe
  C:\Windows\System\cRkbLHa.exe
  2⤵
  PID:5864
- C:\Windows\System\tCeGpqZ.exe
  C:\Windows\System\tCeGpqZ.exe
  2⤵
  PID:4152
- C:\Windows\System\XSwAeJl.exe
  C:\Windows\System\XSwAeJl.exe
  2⤵
  PID:8812
- C:\Windows\System\YsJbsdu.exe
  C:\Windows\System\YsJbsdu.exe
  2⤵
  PID:8856
- C:\Windows\System\mluSuRC.exe
  C:\Windows\System\mluSuRC.exe
  2⤵
  PID:8956
- C:\Windows\System\jNUWEVi.exe
  C:\Windows\System\jNUWEVi.exe
  2⤵
  PID:9004
- C:\Windows\System\NeFQgpD.exe
  C:\Windows\System\NeFQgpD.exe
  2⤵
  PID:8836
- C:\Windows\System\gEfEAoS.exe
  C:\Windows\System\gEfEAoS.exe
  2⤵
  PID:9084
- C:\Windows\System\AkdQslK.exe
  C:\Windows\System\AkdQslK.exe
  2⤵
  PID:8980
- C:\Windows\System\hzJrHyk.exe
  C:\Windows\System\hzJrHyk.exe
  2⤵
  PID:8940
- C:\Windows\System\FzuQpmO.exe
  C:\Windows\System\FzuQpmO.exe
  2⤵
  PID:9180
- C:\Windows\System\AhzsCzQ.exe
  C:\Windows\System\AhzsCzQ.exe
  2⤵
  PID:9040
- C:\Windows\System\ksurVjT.exe
  C:\Windows\System\ksurVjT.exe
  2⤵
  PID:9136
- C:\Windows\System\SJWghhe.exe
  C:\Windows\System\SJWghhe.exe
  2⤵
  PID:9060
- C:\Windows\System\mwzyEvE.exe
  C:\Windows\System\mwzyEvE.exe
  2⤵
  PID:9116
- C:\Windows\System\WpNjXde.exe
  C:\Windows\System\WpNjXde.exe
  2⤵
  PID:9196
- C:\Windows\System\uOsHgCg.exe
  C:\Windows\System\uOsHgCg.exe
  2⤵
  PID:8000
- C:\Windows\System\eBWskRJ.exe
  C:\Windows\System\eBWskRJ.exe
  2⤵
  PID:6868
- C:\Windows\System\EDrgxdn.exe
  C:\Windows\System\EDrgxdn.exe
  2⤵
  PID:7152
- C:\Windows\System\iYqYqNt.exe
  C:\Windows\System\iYqYqNt.exe
  2⤵
  PID:7196
- C:\Windows\System\VVETghq.exe
  C:\Windows\System\VVETghq.exe
  2⤵
  PID:8128
- C:\Windows\System\iGEnHtG.exe
  C:\Windows\System\iGEnHtG.exe
  2⤵
  PID:8280
- C:\Windows\System\xsjLecH.exe
  C:\Windows\System\xsjLecH.exe
  2⤵
  PID:4136
- C:\Windows\System\rqrwCiT.exe
  C:\Windows\System\rqrwCiT.exe
  2⤵
  PID:7020
- C:\Windows\System\KiXnoHF.exe
  C:\Windows\System\KiXnoHF.exe
  2⤵
  PID:7348
- C:\Windows\System\JCFjoea.exe
  C:\Windows\System\JCFjoea.exe
  2⤵
  PID:8200
- C:\Windows\System\HaivupN.exe
  C:\Windows\System\HaivupN.exe
  2⤵
  PID:3412
- C:\Windows\System\qnJNWsc.exe
  C:\Windows\System\qnJNWsc.exe
  2⤵
  PID:8284
- C:\Windows\System\jtVShmP.exe
  C:\Windows\System\jtVShmP.exe
  2⤵
  PID:7100
- C:\Windows\System\SthqMjx.exe
  C:\Windows\System\SthqMjx.exe
  2⤵
  PID:1984
- C:\Windows\System\YVTahVJ.exe
  C:\Windows\System\YVTahVJ.exe
  2⤵
  PID:6196
- C:\Windows\System\qzINXmC.exe
  C:\Windows\System\qzINXmC.exe
  2⤵
  PID:9236
- C:\Windows\System\CCrYXjd.exe
  C:\Windows\System\CCrYXjd.exe
  2⤵
  PID:9256
- C:\Windows\System\yHuFsdB.exe
  C:\Windows\System\yHuFsdB.exe
  2⤵
  PID:9284
- C:\Windows\System\yfJMNUW.exe
  C:\Windows\System\yfJMNUW.exe
  2⤵
  PID:9300
- C:\Windows\System\GcPYGEq.exe
  C:\Windows\System\GcPYGEq.exe
  2⤵
  PID:9324
- C:\Windows\System\JpZuTCp.exe
  C:\Windows\System\JpZuTCp.exe
  2⤵
  PID:9352
- C:\Windows\System\DgjbHyq.exe
  C:\Windows\System\DgjbHyq.exe
  2⤵
  PID:9376
- C:\Windows\System\gWgcDrM.exe
  C:\Windows\System\gWgcDrM.exe
  2⤵
  PID:9400
- C:\Windows\System\quwzWNH.exe
  C:\Windows\System\quwzWNH.exe
  2⤵
  PID:9420
- C:\Windows\System\ngTtrFu.exe
  C:\Windows\System\ngTtrFu.exe
  2⤵
  PID:9448
- C:\Windows\System\lOFIQXq.exe
  C:\Windows\System\lOFIQXq.exe
  2⤵
  PID:9468
- C:\Windows\System\yxlETmW.exe
  C:\Windows\System\yxlETmW.exe
  2⤵
  PID:9488
- C:\Windows\System\stPsnwS.exe
  C:\Windows\System\stPsnwS.exe
  2⤵
  PID:9508
- C:\Windows\System\NvIYEfu.exe
  C:\Windows\System\NvIYEfu.exe
  2⤵
  PID:9532
- C:\Windows\System\rnYiYPJ.exe
  C:\Windows\System\rnYiYPJ.exe
  2⤵
  PID:9556
- C:\Windows\System\xjQygJT.exe
  C:\Windows\System\xjQygJT.exe
  2⤵
  PID:9576
- C:\Windows\System\LrINABn.exe
  C:\Windows\System\LrINABn.exe
  2⤵
  PID:9596
- C:\Windows\System\scZvsii.exe
  C:\Windows\System\scZvsii.exe
  2⤵
  PID:9624
- C:\Windows\System\msvuyiN.exe
  C:\Windows\System\msvuyiN.exe
  2⤵
  PID:9644
- C:\Windows\System\HuVjGqf.exe
  C:\Windows\System\HuVjGqf.exe
  2⤵
  PID:9664
- C:\Windows\System\TxXFedg.exe
  C:\Windows\System\TxXFedg.exe
  2⤵
  PID:9688
- C:\Windows\System\LtttkqS.exe
  C:\Windows\System\LtttkqS.exe
  2⤵
  PID:9708
- C:\Windows\System\xhPrRtZ.exe
  C:\Windows\System\xhPrRtZ.exe
  2⤵
  PID:9728
- C:\Windows\System\DbueMNj.exe
  C:\Windows\System\DbueMNj.exe
  2⤵
  PID:9752
- C:\Windows\System\bdSgTnY.exe
  C:\Windows\System\bdSgTnY.exe
  2⤵
  PID:9780
- C:\Windows\System\nvVQdkj.exe
  C:\Windows\System\nvVQdkj.exe
  2⤵
  PID:9800
- C:\Windows\System\RQegiBK.exe
  C:\Windows\System\RQegiBK.exe
  2⤵
  PID:9824
- C:\Windows\System\mqiijeA.exe
  C:\Windows\System\mqiijeA.exe
  2⤵
  PID:9848
- C:\Windows\System\SsbJTBe.exe
  C:\Windows\System\SsbJTBe.exe
  2⤵
  PID:9864
- C:\Windows\System\HvKDLoj.exe
  C:\Windows\System\HvKDLoj.exe
  2⤵
  PID:9892
- C:\Windows\System\HhsqbGL.exe
  C:\Windows\System\HhsqbGL.exe
  2⤵
  PID:9912
- C:\Windows\System\NNAywsu.exe
  C:\Windows\System\NNAywsu.exe
  2⤵
  PID:9932
- C:\Windows\System\hHofiQG.exe
  C:\Windows\System\hHofiQG.exe
  2⤵
  PID:9956
- C:\Windows\System\ZOWNUNk.exe
  C:\Windows\System\ZOWNUNk.exe
  2⤵
  PID:9976
- C:\Windows\System\ptOItIu.exe
  C:\Windows\System\ptOItIu.exe
  2⤵
  PID:9996
- C:\Windows\System\BZmzeFj.exe
  C:\Windows\System\BZmzeFj.exe
  2⤵
  PID:10020
- C:\Windows\System\sZrovnJ.exe
  C:\Windows\System\sZrovnJ.exe
  2⤵
  PID:10044
- C:\Windows\System\RXWmrQj.exe
  C:\Windows\System\RXWmrQj.exe
  2⤵
  PID:10064
- C:\Windows\System\RALOtKx.exe
  C:\Windows\System\RALOtKx.exe
  2⤵
  PID:10088
- C:\Windows\System\gcOpilK.exe
  C:\Windows\System\gcOpilK.exe
  2⤵
  PID:10108
- C:\Windows\System\bhoItBo.exe
  C:\Windows\System\bhoItBo.exe
  2⤵
  PID:10124
- C:\Windows\System\vGuPofI.exe
  C:\Windows\System\vGuPofI.exe
  2⤵
  PID:10148
- C:\Windows\System\KMTSYGq.exe
  C:\Windows\System\KMTSYGq.exe
  2⤵
  PID:10168
- C:\Windows\System\TatOVzw.exe
  C:\Windows\System\TatOVzw.exe
  2⤵
  PID:10208
- C:\Windows\System\nGKaOwj.exe
  C:\Windows\System\nGKaOwj.exe
  2⤵
  PID:10224
- C:\Windows\System\klEfiVg.exe
  C:\Windows\System\klEfiVg.exe
  2⤵
  PID:8096
- C:\Windows\System\wCUMXwD.exe
  C:\Windows\System\wCUMXwD.exe
  2⤵
  PID:4380
- C:\Windows\System\fPBKQTK.exe
  C:\Windows\System\fPBKQTK.exe
  2⤵
  PID:7628
- C:\Windows\System\itphRzh.exe
  C:\Windows\System\itphRzh.exe
  2⤵
  PID:8252
- C:\Windows\System\AzjDrpj.exe
  C:\Windows\System\AzjDrpj.exe
  2⤵
  PID:7340
- C:\Windows\System\YWvSbEw.exe
  C:\Windows\System\YWvSbEw.exe
  2⤵
  PID:8468
- C:\Windows\System\sFcPRDY.exe
  C:\Windows\System\sFcPRDY.exe
  2⤵
  PID:2596
- C:\Windows\System\ROGXUWT.exe
  C:\Windows\System\ROGXUWT.exe
  2⤵
  PID:8896
- C:\Windows\System\sOKqomC.exe
  C:\Windows\System\sOKqomC.exe
  2⤵
  PID:1352
- C:\Windows\System\PSRXLew.exe
  C:\Windows\System\PSRXLew.exe
  2⤵
  PID:9264
- C:\Windows\System\IDDYZAl.exe
  C:\Windows\System\IDDYZAl.exe
  2⤵
  PID:7716
- C:\Windows\System\BKGyyRs.exe
  C:\Windows\System\BKGyyRs.exe
  2⤵
  PID:8024
- C:\Windows\System\IJFxWsR.exe
  C:\Windows\System\IJFxWsR.exe
  2⤵
  PID:7516
- C:\Windows\System\RyioFsu.exe
  C:\Windows\System\RyioFsu.exe
  2⤵
  PID:9500
- C:\Windows\System\XjihtuU.exe
  C:\Windows\System\XjihtuU.exe
  2⤵
  PID:3808
- C:\Windows\System\mndhprI.exe
  C:\Windows\System\mndhprI.exe
  2⤵
  PID:9696
- C:\Windows\System\fLCkOKY.exe
  C:\Windows\System\fLCkOKY.exe
  2⤵
  PID:6884
- C:\Windows\System\xMHPjjL.exe
  C:\Windows\System\xMHPjjL.exe
  2⤵
  PID:9816
- C:\Windows\System\LZqUYtV.exe
  C:\Windows\System\LZqUYtV.exe
  2⤵
  PID:10260
- C:\Windows\System\IgofThO.exe
  C:\Windows\System\IgofThO.exe
  2⤵
  PID:10284
- C:\Windows\System\kllIdTr.exe
  C:\Windows\System\kllIdTr.exe
  2⤵
  PID:10304
- C:\Windows\System\MMDODAr.exe
  C:\Windows\System\MMDODAr.exe
  2⤵
  PID:10320
- C:\Windows\System\AbOnqSQ.exe
  C:\Windows\System\AbOnqSQ.exe
  2⤵
  PID:10344
- C:\Windows\System\uxKMdfc.exe
  C:\Windows\System\uxKMdfc.exe
  2⤵
  PID:10364
- C:\Windows\System\YzIsFzO.exe
  C:\Windows\System\YzIsFzO.exe
  2⤵
  PID:10388
- C:\Windows\System\GgUxudp.exe
  C:\Windows\System\GgUxudp.exe
  2⤵
  PID:10664
- C:\Windows\System\ltEjPNY.exe
  C:\Windows\System\ltEjPNY.exe
  2⤵
  PID:10684
- C:\Windows\System\JkfcsHV.exe
  C:\Windows\System\JkfcsHV.exe
  2⤵
  PID:10708
- C:\Windows\System\xhxIiDG.exe
  C:\Windows\System\xhxIiDG.exe
  2⤵
  PID:10732
- C:\Windows\System\RvDwGFX.exe
  C:\Windows\System\RvDwGFX.exe
  2⤵
  PID:10760
- C:\Windows\System\KbQuOdd.exe
  C:\Windows\System\KbQuOdd.exe
  2⤵
  PID:10784
- C:\Windows\System\bXSPdbx.exe
  C:\Windows\System\bXSPdbx.exe
  2⤵
  PID:10804
- C:\Windows\System\arCvcYZ.exe
  C:\Windows\System\arCvcYZ.exe
  2⤵
  PID:10832
- C:\Windows\System\cQjKleE.exe
  C:\Windows\System\cQjKleE.exe
  2⤵
  PID:10856
- C:\Windows\System\IBzhsJQ.exe
  C:\Windows\System\IBzhsJQ.exe
  2⤵
  PID:10872
- C:\Windows\System\sRUCpfn.exe
  C:\Windows\System\sRUCpfn.exe
  2⤵
  PID:10900
- C:\Windows\System\jnTxUoh.exe
  C:\Windows\System\jnTxUoh.exe
  2⤵
  PID:10924
- C:\Windows\System\BDtkbZx.exe
  C:\Windows\System\BDtkbZx.exe
  2⤵
  PID:10952
- C:\Windows\System\MFAoaJr.exe
  C:\Windows\System\MFAoaJr.exe
  2⤵
  PID:10988
- C:\Windows\System\ZLwocGH.exe
  C:\Windows\System\ZLwocGH.exe
  2⤵
  PID:11008
- C:\Windows\System\BLGNkxd.exe
  C:\Windows\System\BLGNkxd.exe
  2⤵
  PID:11036
- C:\Windows\System\PSzJvJX.exe
  C:\Windows\System\PSzJvJX.exe
  2⤵
  PID:11060
- C:\Windows\System\nwdyoPi.exe
  C:\Windows\System\nwdyoPi.exe
  2⤵
  PID:11084
- C:\Windows\System\JiYzksl.exe
  C:\Windows\System\JiYzksl.exe
  2⤵
  PID:11108
- C:\Windows\System\EVsTUNN.exe
  C:\Windows\System\EVsTUNN.exe
  2⤵
  PID:11124
- C:\Windows\System\IdhmcJh.exe
  C:\Windows\System\IdhmcJh.exe
  2⤵
  PID:11144
- C:\Windows\System\gmPggWR.exe
  C:\Windows\System\gmPggWR.exe
  2⤵
  PID:11160
- C:\Windows\System\WKiqLWS.exe
  C:\Windows\System\WKiqLWS.exe
  2⤵
  PID:11180
- C:\Windows\System\YnnoHIh.exe
  C:\Windows\System\YnnoHIh.exe
  2⤵
  PID:11196
- C:\Windows\System\YsTHVOb.exe
  C:\Windows\System\YsTHVOb.exe
  2⤵
  PID:11212
- C:\Windows\System\ToxEjkN.exe
  C:\Windows\System\ToxEjkN.exe
  2⤵
  PID:11232
- C:\Windows\System\MLBrJiQ.exe
  C:\Windows\System\MLBrJiQ.exe
  2⤵
  PID:11256
- C:\Windows\System\PXjngve.exe
  C:\Windows\System\PXjngve.exe
  2⤵
  PID:9228
- C:\Windows\System\VpMnXmN.exe
  C:\Windows\System\VpMnXmN.exe
  2⤵
  PID:10056
- C:\Windows\System\vRxHgRo.exe
  C:\Windows\System\vRxHgRo.exe
  2⤵
  PID:9388
- C:\Windows\System\jmwJGfJ.exe
  C:\Windows\System\jmwJGfJ.exe
  2⤵
  PID:9436
- C:\Windows\System\cSrhZvf.exe
  C:\Windows\System\cSrhZvf.exe
  2⤵
  PID:10144
- C:\Windows\System\VVMbGcU.exe
  C:\Windows\System\VVMbGcU.exe
  2⤵
  PID:10184
- C:\Windows\System\tFKvFWy.exe
  C:\Windows\System\tFKvFWy.exe
  2⤵
  PID:4800
- C:\Windows\System\KUNHjZd.exe
  C:\Windows\System\KUNHjZd.exe
  2⤵
  PID:4064
- C:\Windows\System\FkFXThK.exe
  C:\Windows\System\FkFXThK.exe
  2⤵
  PID:9792
- C:\Windows\System\nmbzHRG.exe
  C:\Windows\System\nmbzHRG.exe
  2⤵
  PID:10312
- C:\Windows\System\UfqGfSk.exe
  C:\Windows\System\UfqGfSk.exe
  2⤵
  PID:9908
- C:\Windows\System\fVckvyW.exe
  C:\Windows\System\fVckvyW.exe
  2⤵
  PID:9340
- C:\Windows\System\TAykVCE.exe
  C:\Windows\System\TAykVCE.exe
  2⤵
  PID:10072
- C:\Windows\System\cilooMN.exe
  C:\Windows\System\cilooMN.exe
  2⤵
  PID:9496
- C:\Windows\System\VdBlswB.exe
  C:\Windows\System\VdBlswB.exe
  2⤵
  PID:9592
- C:\Windows\System\eVlwooL.exe
  C:\Windows\System\eVlwooL.exe
  2⤵
  PID:9636
- C:\Windows\System\YndbJze.exe
  C:\Windows\System\YndbJze.exe
  2⤵
  PID:8900
- C:\Windows\System\GwqvzjJ.exe
  C:\Windows\System\GwqvzjJ.exe
  2⤵
  PID:9684
- C:\Windows\System\RUVxuIr.exe
  C:\Windows\System\RUVxuIr.exe
  2⤵
  PID:6544
- C:\Windows\System\qzMLuxx.exe
  C:\Windows\System\qzMLuxx.exe
  2⤵
  PID:2532
- C:\Windows\System\aVJyZWV.exe
  C:\Windows\System\aVJyZWV.exe
  2⤵
  PID:9808
- C:\Windows\System\CBZkUoT.exe
  C:\Windows\System\CBZkUoT.exe
  2⤵
  PID:10280
- C:\Windows\System\VOZifBF.exe
  C:\Windows\System\VOZifBF.exe
  2⤵
  PID:9248
- C:\Windows\System\bgKiIDH.exe
  C:\Windows\System\bgKiIDH.exe
  2⤵
  PID:10648
- C:\Windows\System\HvqEdCR.exe
  C:\Windows\System\HvqEdCR.exe
  2⤵
  PID:10704
- C:\Windows\System\sUkCfIk.exe
  C:\Windows\System\sUkCfIk.exe
  2⤵
  PID:10792
- C:\Windows\System\arImhWu.exe
  C:\Windows\System\arImhWu.exe
  2⤵
  PID:10840
- C:\Windows\System\fbLVXvU.exe
  C:\Windows\System\fbLVXvU.exe
  2⤵
  PID:10912
- C:\Windows\System\mGYMFeM.exe
  C:\Windows\System\mGYMFeM.exe
  2⤵
  PID:10944
- C:\Windows\System\FPgMFIx.exe
  C:\Windows\System\FPgMFIx.exe
  2⤵
  PID:10972
- C:\Windows\System\QgEHHFC.exe
  C:\Windows\System\QgEHHFC.exe
  2⤵
  PID:11296
- C:\Windows\System\mzRPJzG.exe
  C:\Windows\System\mzRPJzG.exe
  2⤵
  PID:11320
- C:\Windows\System\nvxskFx.exe
  C:\Windows\System\nvxskFx.exe
  2⤵
  PID:11340
- C:\Windows\System\aHMBgFQ.exe
  C:\Windows\System\aHMBgFQ.exe
  2⤵
  PID:11364
- C:\Windows\System\JvrNVKw.exe
  C:\Windows\System\JvrNVKw.exe
  2⤵
  PID:11388
- C:\Windows\System\vIYJvDG.exe
  C:\Windows\System\vIYJvDG.exe
  2⤵
  PID:11412
- C:\Windows\System\jffDMrZ.exe
  C:\Windows\System\jffDMrZ.exe
  2⤵
  PID:11432
- C:\Windows\System\GfZwUWR.exe
  C:\Windows\System\GfZwUWR.exe
  2⤵
  PID:11448
- C:\Windows\System\rMfvgYs.exe
  C:\Windows\System\rMfvgYs.exe
  2⤵
  PID:11472
- C:\Windows\System\wfbMPdR.exe
  C:\Windows\System\wfbMPdR.exe
  2⤵
  PID:11488
- C:\Windows\System\VCVkJaf.exe
  C:\Windows\System\VCVkJaf.exe
  2⤵
  PID:11512
- C:\Windows\System\WWRKWii.exe
  C:\Windows\System\WWRKWii.exe
  2⤵
  PID:11536
- C:\Windows\System\NaRBPAi.exe
  C:\Windows\System\NaRBPAi.exe
  2⤵
  PID:11552
- C:\Windows\System\UUTbkkl.exe
  C:\Windows\System\UUTbkkl.exe
  2⤵
  PID:11576
- C:\Windows\System\fARnBJW.exe
  C:\Windows\System\fARnBJW.exe
  2⤵
  PID:11596
- C:\Windows\System\nXOXOGc.exe
  C:\Windows\System\nXOXOGc.exe
  2⤵
  PID:11616
- C:\Windows\System\djtRcDV.exe
  C:\Windows\System\djtRcDV.exe
  2⤵
  PID:11636
- C:\Windows\System\WwMYTbV.exe
  C:\Windows\System\WwMYTbV.exe
  2⤵
  PID:11660
- C:\Windows\System\AJULZEV.exe
  C:\Windows\System\AJULZEV.exe
  2⤵
  PID:11680
- C:\Windows\System\BcorWPL.exe
  C:\Windows\System\BcorWPL.exe
  2⤵
  PID:11704
- C:\Windows\System\MNPHwcC.exe
  C:\Windows\System\MNPHwcC.exe
  2⤵
  PID:11728
- C:\Windows\System\tDMQies.exe
  C:\Windows\System\tDMQies.exe
  2⤵
  PID:11756
- C:\Windows\System\TOLmLaz.exe
  C:\Windows\System\TOLmLaz.exe
  2⤵
  PID:11776
- C:\Windows\System\KDeHdtu.exe
  C:\Windows\System\KDeHdtu.exe
  2⤵
  PID:11800
- C:\Windows\System\lJPJxzN.exe
  C:\Windows\System\lJPJxzN.exe
  2⤵
  PID:11824
- C:\Windows\System\WhCImrI.exe
  C:\Windows\System\WhCImrI.exe
  2⤵
  PID:11844
- C:\Windows\System\KjeiGzc.exe
  C:\Windows\System\KjeiGzc.exe
  2⤵
  PID:11868
- C:\Windows\System\oHJFfHP.exe
  C:\Windows\System\oHJFfHP.exe
  2⤵
  PID:11892
- C:\Windows\System\FsJcfuw.exe
  C:\Windows\System\FsJcfuw.exe
  2⤵
  PID:11908
- C:\Windows\System\hLQcoNf.exe
  C:\Windows\System\hLQcoNf.exe
  2⤵
  PID:11924
- C:\Windows\System\Bllftry.exe
  C:\Windows\System\Bllftry.exe
  2⤵
  PID:11940
- C:\Windows\System\vDJsnYX.exe
  C:\Windows\System\vDJsnYX.exe
  2⤵
  PID:11964
- C:\Windows\System\ivQPpFg.exe
  C:\Windows\System\ivQPpFg.exe
  2⤵
  PID:11988
- C:\Windows\System\goqCykA.exe
  C:\Windows\System\goqCykA.exe
  2⤵
  PID:12004
- C:\Windows\System\rKyxELl.exe
  C:\Windows\System\rKyxELl.exe
  2⤵
  PID:12024
- C:\Windows\System\IihRCAT.exe
  C:\Windows\System\IihRCAT.exe
  2⤵
  PID:12048
- C:\Windows\System\QOYhnPQ.exe
  C:\Windows\System\QOYhnPQ.exe
  2⤵
  PID:12068
- C:\Windows\System\PVviMfC.exe
  C:\Windows\System\PVviMfC.exe
  2⤵
  PID:12096
- C:\Windows\System\DnYaNgp.exe
  C:\Windows\System\DnYaNgp.exe
  2⤵
  PID:12116
- C:\Windows\System\FSnnGnI.exe
  C:\Windows\System\FSnnGnI.exe
  2⤵
  PID:12136
- C:\Windows\System\kRUYvge.exe
  C:\Windows\System\kRUYvge.exe
  2⤵
  PID:12164
- C:\Windows\System\lXofrYh.exe
  C:\Windows\System\lXofrYh.exe
  2⤵
  PID:12184
- C:\Windows\System\HkmXqJd.exe
  C:\Windows\System\HkmXqJd.exe
  2⤵
  PID:12212
- C:\Windows\System\LJTKnfo.exe
  C:\Windows\System\LJTKnfo.exe
  2⤵
  PID:12236
- C:\Windows\System\dtCxmFH.exe
  C:\Windows\System\dtCxmFH.exe
  2⤵
  PID:12256
- C:\Windows\System\kggVXhm.exe
  C:\Windows\System\kggVXhm.exe
  2⤵
  PID:12276
- C:\Windows\System\qQSLVuz.exe
  C:\Windows\System\qQSLVuz.exe
  2⤵
  PID:11000
- C:\Windows\System\lORVJFb.exe
  C:\Windows\System\lORVJFb.exe
  2⤵
  PID:10236
- C:\Windows\System\MLwdIbY.exe
  C:\Windows\System\MLwdIbY.exe
  2⤵
  PID:11136
- C:\Windows\System\NnBGllT.exe
  C:\Windows\System\NnBGllT.exe
  2⤵
  PID:8804
- C:\Windows\System\uPdXPRq.exe
  C:\Windows\System\uPdXPRq.exe
  2⤵
  PID:9856
- C:\Windows\System\XgpFpdV.exe
  C:\Windows\System\XgpFpdV.exe
  2⤵
  PID:10576
- C:\Windows\System\NwiVJxJ.exe
  C:\Windows\System\NwiVJxJ.exe
  2⤵
  PID:9704
- C:\Windows\System\ZPVEvcM.exe
  C:\Windows\System\ZPVEvcM.exe
  2⤵
  PID:9540
- C:\Windows\System\bIgwIlS.exe
  C:\Windows\System\bIgwIlS.exe
  2⤵
  PID:10632
- C:\Windows\System\ukfsUIC.exe
  C:\Windows\System\ukfsUIC.exe
  2⤵
  PID:9836
- C:\Windows\System\XciDVkA.exe
  C:\Windows\System\XciDVkA.exe
  2⤵
  PID:10440
- C:\Windows\System\cXHcbwp.exe
  C:\Windows\System\cXHcbwp.exe
  2⤵
  PID:4048
- C:\Windows\System\xstTOdy.exe
  C:\Windows\System\xstTOdy.exe
  2⤵
  PID:10796
- C:\Windows\System\fKeHTRe.exe
  C:\Windows\System\fKeHTRe.exe
  2⤵
  PID:9572
- C:\Windows\System\tbSRvFj.exe
  C:\Windows\System\tbSRvFj.exe
  2⤵
  PID:9884
- C:\Windows\System\SyQcxBR.exe
  C:\Windows\System\SyQcxBR.exe
  2⤵
  PID:10012
- C:\Windows\System\ZaKJOJy.exe
  C:\Windows\System\ZaKJOJy.exe
  2⤵
  PID:10888
- C:\Windows\System\XtvKrKz.exe
  C:\Windows\System\XtvKrKz.exe
  2⤵
  PID:11272
- C:\Windows\System\Gyhuxzb.exe
  C:\Windows\System\Gyhuxzb.exe
  2⤵
  PID:10508
- C:\Windows\System\zXLNMpT.exe
  C:\Windows\System\zXLNMpT.exe
  2⤵
  PID:11076
- C:\Windows\System\UUvsKDE.exe
  C:\Windows\System\UUvsKDE.exe
  2⤵
  PID:11140
- C:\Windows\System\LPTuWWb.exe
  C:\Windows\System\LPTuWWb.exe
  2⤵
  PID:11156
- C:\Windows\System\GVZoNuX.exe
  C:\Windows\System\GVZoNuX.exe
  2⤵
  PID:11192
- C:\Windows\System\ibRLVUV.exe
  C:\Windows\System\ibRLVUV.exe
  2⤵
  PID:11504
- C:\Windows\System\hAGBwyP.exe
  C:\Windows\System\hAGBwyP.exe
  2⤵
  PID:9820
- C:\Windows\System\wJcSSsh.exe
  C:\Windows\System\wJcSSsh.exe
  2⤵
  PID:9392
- C:\Windows\System\GBVKcVF.exe
  C:\Windows\System\GBVKcVF.exe
  2⤵
  PID:11652
- C:\Windows\System\GcAVgaA.exe
  C:\Windows\System\GcAVgaA.exe
  2⤵
  PID:11716
- C:\Windows\System\HOEsIGE.exe
  C:\Windows\System\HOEsIGE.exe
  2⤵
  PID:11772
- C:\Windows\System\KmraHWA.exe
  C:\Windows\System\KmraHWA.exe
  2⤵
  PID:9748
- C:\Windows\System\cbuGlSf.exe
  C:\Windows\System\cbuGlSf.exe
  2⤵
  PID:11904
- C:\Windows\System\uZrXtqd.exe
  C:\Windows\System\uZrXtqd.exe
  2⤵
  PID:12296
- C:\Windows\System\knUpkwK.exe
  C:\Windows\System\knUpkwK.exe
  2⤵
  PID:12316
- C:\Windows\System\LyLnzEh.exe
  C:\Windows\System\LyLnzEh.exe
  2⤵
  PID:12340
- C:\Windows\System\fgZxXiv.exe
  C:\Windows\System\fgZxXiv.exe
  2⤵
  PID:12356
- C:\Windows\System\LhRxrAD.exe
  C:\Windows\System\LhRxrAD.exe
  2⤵
  PID:12380
- C:\Windows\System\CmPuFRR.exe
  C:\Windows\System\CmPuFRR.exe
  2⤵
  PID:12404
- C:\Windows\System\gurpXZs.exe
  C:\Windows\System\gurpXZs.exe
  2⤵
  PID:12428
- C:\Windows\System\cezcgWL.exe
  C:\Windows\System\cezcgWL.exe
  2⤵
  PID:12448
- C:\Windows\System\yjDRjud.exe
  C:\Windows\System\yjDRjud.exe
  2⤵
  PID:12468
- C:\Windows\System\wLstbbU.exe
  C:\Windows\System\wLstbbU.exe
  2⤵
  PID:12488
- C:\Windows\System\zDAyXja.exe
  C:\Windows\System\zDAyXja.exe
  2⤵
  PID:12508
- C:\Windows\System\sYnRMwJ.exe
  C:\Windows\System\sYnRMwJ.exe
  2⤵
  PID:12536
- C:\Windows\System\coNzDqR.exe
  C:\Windows\System\coNzDqR.exe
  2⤵
  PID:12560
- C:\Windows\System\qrTFDjo.exe
  C:\Windows\System\qrTFDjo.exe
  2⤵
  PID:12584
- C:\Windows\System\XuCrvlI.exe
  C:\Windows\System\XuCrvlI.exe
  2⤵
  PID:12604
- C:\Windows\System\dTDWgdS.exe
  C:\Windows\System\dTDWgdS.exe
  2⤵
  PID:12620
- C:\Windows\System\czAOvtA.exe
  C:\Windows\System\czAOvtA.exe
  2⤵
  PID:12636
- C:\Windows\System\acDQwKG.exe
  C:\Windows\System\acDQwKG.exe
  2⤵
  PID:12652
- C:\Windows\System\YgeVQbA.exe
  C:\Windows\System\YgeVQbA.exe
  2⤵
  PID:12668
- C:\Windows\System\nYaqnTg.exe
  C:\Windows\System\nYaqnTg.exe
  2⤵
  PID:12688
- C:\Windows\System\jLIToRn.exe
  C:\Windows\System\jLIToRn.exe
  2⤵
  PID:12704
- C:\Windows\System\BlcTscA.exe
  C:\Windows\System\BlcTscA.exe
  2⤵
  PID:12720
- C:\Windows\System\jFAickY.exe
  C:\Windows\System\jFAickY.exe
  2⤵
  PID:12736
- C:\Windows\System\xkkCMEa.exe
  C:\Windows\System\xkkCMEa.exe
  2⤵
  PID:12752
- C:\Windows\System\NHaHiwP.exe
  C:\Windows\System\NHaHiwP.exe
  2⤵
  PID:12772
- C:\Windows\System\NoCFSkq.exe
  C:\Windows\System\NoCFSkq.exe
  2⤵
  PID:12804
- C:\Windows\System\wKWoGAd.exe
  C:\Windows\System\wKWoGAd.exe
  2⤵
  PID:12832
- C:\Windows\System\lMxyRDj.exe
  C:\Windows\System\lMxyRDj.exe
  2⤵
  PID:12852
- C:\Windows\System\jsXexXD.exe
  C:\Windows\System\jsXexXD.exe
  2⤵
  PID:12876
- C:\Windows\System\ALWzQOd.exe
  C:\Windows\System\ALWzQOd.exe
  2⤵
  PID:12892
- C:\Windows\System\KtIjpFJ.exe
  C:\Windows\System\KtIjpFJ.exe
  2⤵
  PID:12912
- C:\Windows\System\xwIlTCB.exe
  C:\Windows\System\xwIlTCB.exe
  2⤵
  PID:12936
- C:\Windows\System\rmgjnNy.exe
  C:\Windows\System\rmgjnNy.exe
  2⤵
  PID:12960
- C:\Windows\System\ZpdRTNc.exe
  C:\Windows\System\ZpdRTNc.exe
  2⤵
  PID:12984
- C:\Windows\System\wQklxnq.exe
  C:\Windows\System\wQklxnq.exe
  2⤵
  PID:13004
- C:\Windows\System\GLBtPWo.exe
  C:\Windows\System\GLBtPWo.exe
  2⤵
  PID:13028
- C:\Windows\System\YWLxYkS.exe
  C:\Windows\System\YWLxYkS.exe
  2⤵
  PID:13048
- C:\Windows\System\ZJzDFwK.exe
  C:\Windows\System\ZJzDFwK.exe
  2⤵
  PID:13072
- C:\Windows\System\rStSbHC.exe
  C:\Windows\System\rStSbHC.exe
  2⤵
  PID:13304
- C:\Windows\System\oixpdCw.exe
  C:\Windows\System\oixpdCw.exe
  2⤵
  PID:11396
- C:\Windows\System\lWKhSaD.exe
  C:\Windows\System\lWKhSaD.exe
  2⤵
  PID:9940
- C:\Windows\System\lqJtuMQ.exe
  C:\Windows\System\lqJtuMQ.exe
  2⤵
  PID:10360
- C:\Windows\System\ZaoRDRZ.exe
  C:\Windows\System\ZaoRDRZ.exe
  2⤵
  PID:13196
- C:\Windows\System\ZaLKAgC.exe
  C:\Windows\System\ZaLKAgC.exe
  2⤵
  PID:12088
- C:\Windows\System\AHVRjad.exe
  C:\Windows\System\AHVRjad.exe
  2⤵
  PID:12200
- C:\Windows\System\UUEyuHD.exe
  C:\Windows\System\UUEyuHD.exe
  2⤵
  PID:9616
- C:\Windows\System\ufDUstC.exe
  C:\Windows\System\ufDUstC.exe
  2⤵
  PID:5340
- C:\Windows\System\aeWDGSn.exe
  C:\Windows\System\aeWDGSn.exe
  2⤵
  PID:10968
- C:\Windows\System\xfszaVm.exe
  C:\Windows\System\xfszaVm.exe
  2⤵
  PID:11096
- C:\Windows\System\WqkyvRU.exe
  C:\Windows\System\WqkyvRU.exe
  2⤵
  PID:3980
- C:\Windows\System\jRZEIyq.exe
  C:\Windows\System\jRZEIyq.exe
  2⤵
  PID:12436
- C:\Windows\System\gkYKBgz.exe
  C:\Windows\System\gkYKBgz.exe
  2⤵
  PID:12764
- C:\Windows\System\JNkatEc.exe
  C:\Windows\System\JNkatEc.exe
  2⤵
  PID:12976
- C:\Windows\System\QiEkHPb.exe
  C:\Windows\System\QiEkHPb.exe
  2⤵
  PID:13024
- C:\Windows\System\QLxpBPZ.exe
  C:\Windows\System\QLxpBPZ.exe
  2⤵
  PID:13056
- C:\Windows\System\IHtjYwa.exe
  C:\Windows\System\IHtjYwa.exe
  2⤵
  PID:13120
- C:\Windows\System\lEFfPcq.exe
  C:\Windows\System\lEFfPcq.exe
  2⤵
  PID:13164
- C:\Windows\System\HcmFWcg.exe
  C:\Windows\System\HcmFWcg.exe
  2⤵
  PID:13188
- C:\Windows\System\oUngtnM.exe
  C:\Windows\System\oUngtnM.exe
  2⤵
  PID:628
- C:\Windows\System\nVtworM.exe
  C:\Windows\System\nVtworM.exe
  2⤵
  PID:10700
- C:\Windows\System\ZXoFWwi.exe
  C:\Windows\System\ZXoFWwi.exe
  2⤵
  PID:12112
- C:\Windows\System\vPGykTh.exe
  C:\Windows\System\vPGykTh.exe
  2⤵
  PID:9296
- C:\Windows\System\LromEtN.exe
  C:\Windows\System\LromEtN.exe
  2⤵
  PID:10256
- C:\Windows\System\QyNPLvT.exe
  C:\Windows\System\QyNPLvT.exe
  2⤵
  PID:10040
- C:\Windows\System\IqGrXML.exe
  C:\Windows\System\IqGrXML.exe
  2⤵
  PID:2676
- C:\Windows\System\LAmbtMl.exe
  C:\Windows\System\LAmbtMl.exe
  2⤵
  PID:11404
- C:\Windows\System\ZUsQKlM.exe
  C:\Windows\System\ZUsQKlM.exe
  2⤵
  PID:8032
- C:\Windows\System\vJhlSFj.exe
  C:\Windows\System\vJhlSFj.exe
  2⤵
  PID:11496
- C:\Windows\System\QrFUhJK.exe
  C:\Windows\System\QrFUhJK.exe
  2⤵
  PID:9172
- C:\Windows\System\IXyZxFW.exe
  C:\Windows\System\IXyZxFW.exe
  2⤵
  PID:9904
- C:\Windows\System\sfqmWxg.exe
  C:\Windows\System\sfqmWxg.exe
  2⤵
  PID:11836
- C:\Windows\System\csDJUtD.exe
  C:\Windows\System\csDJUtD.exe
  2⤵
  PID:11544
- C:\Windows\System\EXTWjBy.exe
  C:\Windows\System\EXTWjBy.exe
  2⤵
  PID:11956
- C:\Windows\System\GKhzXEc.exe
  C:\Windows\System\GKhzXEc.exe
  2⤵
  PID:12040
- C:\Windows\System\iTNTrik.exe
  C:\Windows\System\iTNTrik.exe
  2⤵
  PID:12224
- C:\Windows\System\jrnUMrB.exe
  C:\Windows\System\jrnUMrB.exe
  2⤵
  PID:12412
- C:\Windows\System\GNWcEwq.exe
  C:\Windows\System\GNWcEwq.exe
  2⤵
  PID:11288
- C:\Windows\System\jeXDgSH.exe
  C:\Windows\System\jeXDgSH.exe
  2⤵
  PID:12192
- C:\Windows\System\btynhSk.exe
  C:\Windows\System\btynhSk.exe
  2⤵
  PID:12364
- C:\Windows\System\ZywqKss.exe
  C:\Windows\System\ZywqKss.exe
  2⤵
  PID:7828
- C:\Windows\System\HZHslzp.exe
  C:\Windows\System\HZHslzp.exe
  2⤵
  PID:12460
- C:\Windows\System\cQzapAb.exe
  C:\Windows\System\cQzapAb.exe
  2⤵
  PID:13220
- C:\Windows\System\NcQCWfp.exe
  C:\Windows\System\NcQCWfp.exe
  2⤵
  PID:11204
- C:\Windows\System\NwSwwHd.exe
  C:\Windows\System\NwSwwHd.exe
  2⤵
  PID:9924
- C:\Windows\System\jUMXedn.exe
  C:\Windows\System\jUMXedn.exe
  2⤵
  PID:9252
- C:\Windows\System\VOUowbt.exe
  C:\Windows\System\VOUowbt.exe
  2⤵
  PID:12480
- C:\Windows\System\XukhEDS.exe
  C:\Windows\System\XukhEDS.exe
  2⤵
  PID:12172
- C:\Windows\System\VgaUVvp.exe
  C:\Windows\System\VgaUVvp.exe
  2⤵
  PID:13136
- C:\Windows\System\VZsFSXP.exe
  C:\Windows\System\VZsFSXP.exe
  2⤵
  PID:10680
- C:\Windows\System\jSPnCdt.exe
  C:\Windows\System\jSPnCdt.exe
  2⤵
  PID:9480
- C:\Windows\System\khKNMhC.exe
  C:\Windows\System\khKNMhC.exe
  2⤵
  PID:13320
- C:\Windows\System\qtepgDZ.exe
  C:\Windows\System\qtepgDZ.exe
  2⤵
  PID:13344
- C:\Windows\System\LkDYKue.exe
  C:\Windows\System\LkDYKue.exe
  2⤵
  PID:13396
- C:\Windows\System\DUVhjgi.exe
  C:\Windows\System\DUVhjgi.exe
  2⤵
  PID:13416
- C:\Windows\System\afPwzyy.exe
  C:\Windows\System\afPwzyy.exe
  2⤵
  PID:13436
- C:\Windows\System\Zoraqct.exe
  C:\Windows\System\Zoraqct.exe
  2⤵
  PID:13460
- C:\Windows\System\tJUagIr.exe
  C:\Windows\System\tJUagIr.exe
  2⤵
  PID:13892
- C:\Windows\System\NAGWLxP.exe
  C:\Windows\System\NAGWLxP.exe
  2⤵
  PID:11972
- C:\Windows\System\qvomOOZ.exe
  C:\Windows\System\qvomOOZ.exe
  2⤵
  PID:11632
- C:\Windows\System\bvuUxUM.exe
  C:\Windows\System\bvuUxUM.exe
  2⤵
  PID:11464
- C:\Windows\System\fNZyhXk.exe
  C:\Windows\System\fNZyhXk.exe
  2⤵
  PID:12932
- C:\Windows\System\cEyrcWE.exe
  C:\Windows\System\cEyrcWE.exe
  2⤵
  PID:8508
- C:\Windows\System\bCsubmd.exe
  C:\Windows\System\bCsubmd.exe
  2⤵
  PID:11796
- C:\Windows\System\PQcIJDq.exe
  C:\Windows\System\PQcIJDq.exe
  2⤵
  PID:12228
- C:\Windows\System\zXqBfFi.exe
  C:\Windows\System\zXqBfFi.exe
  2⤵
  PID:4640
- C:\Windows\System\tWjTFkt.exe
  C:\Windows\System\tWjTFkt.exe
  2⤵
  PID:11304
- C:\Windows\System\bfAlYTF.exe
  C:\Windows\System\bfAlYTF.exe
  2⤵
  PID:13968
- C:\Windows\System\bTrMKkv.exe
  C:\Windows\System\bTrMKkv.exe
  2⤵
  PID:13680
- C:\Windows\System\xhKkiwH.exe
  C:\Windows\System\xhKkiwH.exe
  2⤵
  PID:13696
- C:\Windows\System\hCyoEDn.exe
  C:\Windows\System\hCyoEDn.exe
  2⤵
  PID:13620
- C:\Windows\System\WkIbUZf.exe
  C:\Windows\System\WkIbUZf.exe
  2⤵
  PID:13600
- C:\Windows\System\RuCmgid.exe
  C:\Windows\System\RuCmgid.exe
  2⤵
  PID:13584
- C:\Windows\System\NJfjnnd.exe
  C:\Windows\System\NJfjnnd.exe
  2⤵
  PID:13180
- C:\Windows\System\bbmBWze.exe
  C:\Windows\System\bbmBWze.exe
  2⤵
  PID:10740
- C:\Windows\System\oTkmDAE.exe
  C:\Windows\System\oTkmDAE.exe
  2⤵
  PID:11816
- C:\Windows\System\BOHiLlM.exe
  C:\Windows\System\BOHiLlM.exe
  2⤵
  PID:13408
- C:\Windows\System\ZnDkCDC.exe
  C:\Windows\System\ZnDkCDC.exe
  2⤵
  PID:13504
- C:\Windows\System\sCZnfSZ.exe
  C:\Windows\System\sCZnfSZ.exe
  2⤵
  PID:12596
- C:\Windows\System\iRHeIvA.exe
  C:\Windows\System\iRHeIvA.exe
  2⤵
  PID:13912
- C:\Windows\System\PSOvxwK.exe
  C:\Windows\System\PSOvxwK.exe
  2⤵
  PID:1272
- C:\Windows\System\UKnXDfm.exe
  C:\Windows\System\UKnXDfm.exe
  2⤵
  PID:1312
- C:\Windows\System\AyCPFXJ.exe
  C:\Windows\System\AyCPFXJ.exe
  2⤵
  PID:1688
- C:\Windows\System\zGsPOoX.exe
  C:\Windows\System\zGsPOoX.exe
  2⤵
  PID:1484
- C:\Windows\System\INaKuXJ.exe
  C:\Windows\System\INaKuXJ.exe
  2⤵
  PID:13944
- C:\Windows\System\UIrGjiE.exe
  C:\Windows\System\UIrGjiE.exe
  2⤵
  PID:13604
- C:\Windows\System\rYVdvVb.exe
  C:\Windows\System\rYVdvVb.exe
  2⤵
  PID:13692
- C:\Windows\System\yoPzNOr.exe
  C:\Windows\System\yoPzNOr.exe
  2⤵
  PID:13532
- C:\Windows\System\YbcHPvY.exe
  C:\Windows\System\YbcHPvY.exe
  2⤵
  PID:14092
- C:\Windows\System\hNhsiHM.exe
  C:\Windows\System\hNhsiHM.exe
  2⤵
  PID:13872
- C:\Windows\System\yZXGAGw.exe
  C:\Windows\System\yZXGAGw.exe
  2⤵
  PID:13512
- C:\Windows\System\jKIYGFt.exe
  C:\Windows\System\jKIYGFt.exe
  2⤵
  PID:14128
- C:\Windows\System\uqQRIZT.exe
  C:\Windows\System\uqQRIZT.exe
  2⤵
  PID:13784
- C:\Windows\System\TyRRxqt.exe
  C:\Windows\System\TyRRxqt.exe
  2⤵
  PID:14060
- C:\Windows\System\lfMYSPL.exe
  C:\Windows\System\lfMYSPL.exe
  2⤵
  PID:13572
- C:\Windows\System\mFZZEsV.exe
  C:\Windows\System\mFZZEsV.exe
  2⤵
  PID:14240
- C:\Windows\System\CrOiUPt.exe
  C:\Windows\System\CrOiUPt.exe
  2⤵
  PID:14200
- C:\Windows\System\tSvghuv.exe
  C:\Windows\System\tSvghuv.exe
  2⤵
  PID:3332
- C:\Windows\System\zxfBKKm.exe
  C:\Windows\System\zxfBKKm.exe
  2⤵
  PID:14184
- C:\Windows\System\ZjHEiOm.exe
  C:\Windows\System\ZjHEiOm.exe
  2⤵
  PID:10772
- C:\Windows\System\qYoeyjF.exe
  C:\Windows\System\qYoeyjF.exe
  2⤵
  PID:12348
- C:\Windows\System\xvLOvPa.exe
  C:\Windows\System\xvLOvPa.exe
  2⤵
  PID:11612
- C:\Windows\System\RBooKax.exe
  C:\Windows\System\RBooKax.exe
  2⤵
  PID:14244
- C:\Windows\System\NVbszQk.exe
  C:\Windows\System\NVbszQk.exe
  2⤵
  PID:11932
- C:\Windows\System\ibZBEWz.exe
  C:\Windows\System\ibZBEWz.exe
  2⤵
  PID:10028
- C:\Windows\System\jXhNtHj.exe
  C:\Windows\System\jXhNtHj.exe
  2⤵
  PID:7136
- C:\Windows\System\sHceawz.exe
  C:\Windows\System\sHceawz.exe
  2⤵
  PID:4972
- C:\Windows\System\pQpZmeO.exe
  C:\Windows\System\pQpZmeO.exe
  2⤵
  PID:2204
- C:\Windows\System\IEIBajH.exe
  C:\Windows\System\IEIBajH.exe
  2⤵
  PID:13744
- C:\Windows\System\IpPfccy.exe
  C:\Windows\System\IpPfccy.exe
  2⤵
  PID:8852
- C:\Windows\System\fbCiNvH.exe
  C:\Windows\System\fbCiNvH.exe
  2⤵
  PID:12996
- C:\Windows\System\IJJNtop.exe
  C:\Windows\System\IJJNtop.exe
  2⤵
  PID:12904
- C:\Windows\System\jKKrAbM.exe
  C:\Windows\System\jKKrAbM.exe
  2⤵
  PID:3320
- C:\Windows\System\ohPYtBc.exe
  C:\Windows\System\ohPYtBc.exe
  2⤵
  PID:4088
- C:\Windows\System\mZFmeIO.exe
  C:\Windows\System\mZFmeIO.exe
  2⤵
  PID:13108
- C:\Windows\System\BaBCXJA.exe
  C:\Windows\System\BaBCXJA.exe
  2⤵
  PID:11740
- C:\Windows\System\VnjeujB.exe
  C:\Windows\System\VnjeujB.exe
  2⤵
  PID:13404
- C:\Windows\System\ggODaJW.exe
  C:\Windows\System\ggODaJW.exe
  2⤵
  PID:4252
- C:\Windows\System\EQRwvWK.exe
  C:\Windows\System\EQRwvWK.exe
  2⤵
  PID:12044
- C:\Windows\System\JasdrIH.exe
  C:\Windows\System\JasdrIH.exe
  2⤵
  PID:13508
- C:\Windows\System\DHNAyuy.exe
  C:\Windows\System\DHNAyuy.exe
  2⤵
  PID:13484
- C:\Windows\System\UogKEJW.exe
  C:\Windows\System\UogKEJW.exe
  2⤵
  PID:12464
- C:\Windows\System\FeqvZQl.exe
  C:\Windows\System\FeqvZQl.exe
  2⤵
  PID:12944
- C:\Windows\System\XNIfGVO.exe
  C:\Windows\System\XNIfGVO.exe
  2⤵
  PID:3372
- C:\Windows\System\eHyNhMN.exe
  C:\Windows\System\eHyNhMN.exe
  2⤵
  PID:13292
- C:\Windows\System\BNmkxId.exe
  C:\Windows\System\BNmkxId.exe
  2⤵
  PID:3756
- C:\Windows\System\TxsMoAY.exe
  C:\Windows\System\TxsMoAY.exe
  2⤵
  PID:13388
- C:\Windows\System\YNhFAkR.exe
  C:\Windows\System\YNhFAkR.exe
  2⤵
  PID:13468
- C:\Windows\System\WLCXBrI.exe
  C:\Windows\System\WLCXBrI.exe
  2⤵
  PID:13480
- C:\Windows\System\jteXbov.exe
  C:\Windows\System\jteXbov.exe
  2⤵
  PID:13336
- C:\Windows\System\epSXXVc.exe
  C:\Windows\System\epSXXVc.exe
  2⤵
  PID:13756
- C:\Windows\System\VYcyTES.exe
  C:\Windows\System\VYcyTES.exe
  2⤵
  PID:13752
- C:\Windows\System\DKkrZGl.exe
  C:\Windows\System\DKkrZGl.exe
  2⤵
  PID:728
- C:\Windows\System\VQtUcED.exe
  C:\Windows\System\VQtUcED.exe
  2⤵
  PID:13376
- C:\Windows\System\fIGkKXj.exe
  C:\Windows\System\fIGkKXj.exe
  2⤵
  PID:8880
- C:\Windows\System\HLFntkF.exe
  C:\Windows\System\HLFntkF.exe
  2⤵
  PID:3196
- C:\Windows\System\LHRFXjx.exe
  C:\Windows\System\LHRFXjx.exe
  2⤵
  PID:13760
- C:\Windows\System\JVbkcps.exe
  C:\Windows\System\JVbkcps.exe
  2⤵
  PID:4192
- C:\Windows\System\RgEDYzS.exe
  C:\Windows\System\RgEDYzS.exe
  2⤵
  PID:2136
- C:\Windows\System\sZhdLCU.exe
  C:\Windows\System\sZhdLCU.exe
  2⤵
  PID:13916
- C:\Windows\System\NxayMbN.exe
  C:\Windows\System\NxayMbN.exe
  2⤵
  PID:1320
- C:\Windows\System\BiGhNgU.exe
  C:\Windows\System\BiGhNgU.exe
  2⤵
  PID:1076
- C:\Windows\System\JisRqij.exe
  C:\Windows\System\JisRqij.exe
  2⤵
  PID:13608
- C:\Windows\System\HXsjAaN.exe
  C:\Windows\System\HXsjAaN.exe
  2⤵
  PID:13560
- C:\Windows\System\gTbogmN.exe
  C:\Windows\System\gTbogmN.exe
  2⤵
  PID:13852
- C:\Windows\System\nfjqKHp.exe
  C:\Windows\System\nfjqKHp.exe
  2⤵
  PID:14112
- C:\Windows\System\qQfjSkH.exe
  C:\Windows\System\qQfjSkH.exe
  2⤵
  PID:14188
- C:\Windows\System\BguXeVU.exe
  C:\Windows\System\BguXeVU.exe
  2⤵
  PID:14172
- C:\Windows\System\MUgixSK.exe
  C:\Windows\System\MUgixSK.exe
  2⤵
  PID:14208
- C:\Windows\System\iEOvyAx.exe
  C:\Windows\System\iEOvyAx.exe
  2⤵
  PID:12144
- C:\Windows\System\xQVrhGQ.exe
  C:\Windows\System\xQVrhGQ.exe
  2⤵
  PID:8672
- C:\Windows\System\ZKgssnk.exe
  C:\Windows\System\ZKgssnk.exe
  2⤵
  PID:1368
- C:\Windows\System\AtnQhpF.exe
  C:\Windows\System\AtnQhpF.exe
  2⤵
  PID:6192
- C:\Windows\System\dLdmoOX.exe
  C:\Windows\System\dLdmoOX.exe
  2⤵
  PID:13564
- C:\Windows\System\KOKRbCQ.exe
  C:\Windows\System\KOKRbCQ.exe
  2⤵
  PID:4360
- C:\Windows\System\yaGQEks.exe
  C:\Windows\System\yaGQEks.exe
  2⤵
  PID:1828
- C:\Windows\System\hIlZGAt.exe
  C:\Windows\System\hIlZGAt.exe
  2⤵
  PID:13904
- C:\Windows\System\cYmKenU.exe
  C:\Windows\System\cYmKenU.exe
  2⤵
  PID:2260
- C:\Windows\System\hBoYaFg.exe
  C:\Windows\System\hBoYaFg.exe
  2⤵
  PID:3864
- C:\Windows\System\ZvtmRvD.exe
  C:\Windows\System\ZvtmRvD.exe
  2⤵
  PID:3916
- C:\Windows\System\slGOFZY.exe
  C:\Windows\System\slGOFZY.exe
  2⤵
  PID:13412
- C:\Windows\System\yOiTYgn.exe
  C:\Windows\System\yOiTYgn.exe
  2⤵
  PID:6324
- C:\Windows\System\gTEDMgs.exe
  C:\Windows\System\gTEDMgs.exe
  2⤵
  PID:3996
- C:\Windows\System\tlYQoHa.exe
  C:\Windows\System\tlYQoHa.exe
  2⤵
  PID:13536
- C:\Windows\System\VXvPtxn.exe
  C:\Windows\System\VXvPtxn.exe
  2⤵
  PID:2032
- C:\Windows\System\SMmWWhA.exe
  C:\Windows\System\SMmWWhA.exe
  2⤵
  PID:3216
- C:\Windows\System\xYbqjVY.exe
  C:\Windows\System\xYbqjVY.exe
  2⤵
  PID:1424
- C:\Windows\System\LKfSeuD.exe
  C:\Windows\System\LKfSeuD.exe
  2⤵
  PID:2796
- C:\Windows\System\VqZHVfW.exe
  C:\Windows\System\VqZHVfW.exe
  2⤵
  PID:13544
- C:\Windows\System\jvzACtN.exe
  C:\Windows\System\jvzACtN.exe
  2⤵
  PID:8760
- C:\Windows\System\VAfxbhE.exe
  C:\Windows\System\VAfxbhE.exe
  2⤵
  PID:824
- C:\Windows\System\RvGwbuj.exe
  C:\Windows\System\RvGwbuj.exe
  2⤵
  PID:3680
- C:\Windows\System\ARjGESM.exe
  C:\Windows\System\ARjGESM.exe
  2⤵
  PID:14176
- C:\Windows\System\KxkLeXU.exe
  C:\Windows\System\KxkLeXU.exe
  2⤵
  PID:3356
- C:\Windows\System\ogjoXvA.exe
  C:\Windows\System\ogjoXvA.exe
  2⤵
  PID:5188
- C:\Windows\System\qkfJfCm.exe
  C:\Windows\System\qkfJfCm.exe
  2⤵
  PID:3176
- C:\Windows\System\kfQVyWa.exe
  C:\Windows\System\kfQVyWa.exe
  2⤵
  PID:1356
- C:\Windows\System\FqHHcvV.exe
  C:\Windows\System\FqHHcvV.exe
  2⤵
  PID:5060
- C:\Windows\System\qhdlBtI.exe
  C:\Windows\System\qhdlBtI.exe
  2⤵
  PID:3068
- C:\Windows\System\HgujjwW.exe
  C:\Windows\System\HgujjwW.exe
  2⤵
  PID:1012
- C:\Windows\System\yuVCCej.exe
  C:\Windows\System\yuVCCej.exe
  2⤵
  PID:2116
- C:\Windows\System\PbQGZtk.exe
  C:\Windows\System\PbQGZtk.exe
  2⤵
  PID:4936
- C:\Windows\System\ZGmAWQx.exe
  C:\Windows\System\ZGmAWQx.exe
  2⤵
  PID:4520
- C:\Windows\System\aCMhMOE.exe
  C:\Windows\System\aCMhMOE.exe
  2⤵
  PID:13428
- C:\Windows\System\wXDFmia.exe
  C:\Windows\System\wXDFmia.exe
  2⤵
  PID:2092
- C:\Windows\System\TqUahFs.exe
  C:\Windows\System\TqUahFs.exe
  2⤵
  PID:2644
- C:\Windows\System\DlJqeyU.exe
  C:\Windows\System\DlJqeyU.exe
  2⤵
  PID:1652
- C:\Windows\System\yZsOxJn.exe
  C:\Windows\System\yZsOxJn.exe
  2⤵
  PID:832
- C:\Windows\System\FstrvnA.exe
  C:\Windows\System\FstrvnA.exe
  2⤵
  PID:828
- C:\Windows\System\uAQutIR.exe
  C:\Windows\System\uAQutIR.exe
  2⤵
  PID:3376
- C:\Windows\System\pHpDuPj.exe
  C:\Windows\System\pHpDuPj.exe
  2⤵
  PID:2332
- C:\Windows\System\qxwYtcw.exe
  C:\Windows\System\qxwYtcw.exe
  2⤵
  PID:4456
- C:\Windows\System\PILlKUj.exe
  C:\Windows\System\PILlKUj.exe
  2⤵
  PID:5172
- C:\Windows\System\CaYNcAD.exe
  C:\Windows\System\CaYNcAD.exe
  2⤵
  PID:4216
- C:\Windows\System\lgWtDPU.exe
  C:\Windows\System\lgWtDPU.exe
  2⤵
  PID:3844
- C:\Windows\System\DfeFpba.exe
  C:\Windows\System\DfeFpba.exe
  2⤵
  PID:6476
- C:\Windows\System\ihZlBmK.exe
  C:\Windows\System\ihZlBmK.exe
  2⤵
  PID:14324
- C:\Windows\System\KCfDziD.exe
  C:\Windows\System\KCfDziD.exe
  2⤵
  PID:1596
- C:\Windows\System\rGgxHEu.exe
  C:\Windows\System\rGgxHEu.exe
  2⤵
  PID:5196
- C:\Windows\System\DESZpRZ.exe
  C:\Windows\System\DESZpRZ.exe
  2⤵
  PID:5224
- C:\Windows\System\JlkJjLL.exe
  C:\Windows\System\JlkJjLL.exe
  2⤵
  PID:2312
- C:\Windows\System\ueLVUqG.exe
  C:\Windows\System\ueLVUqG.exe
  2⤵
  PID:2768
- C:\Windows\System\ElYuzzr.exe
  C:\Windows\System\ElYuzzr.exe
  2⤵
  PID:2144
- C:\Windows\System\NADQzSk.exe
  C:\Windows\System\NADQzSk.exe
  2⤵
  PID:1000
- C:\Windows\System\bppcWSa.exe
  C:\Windows\System\bppcWSa.exe
  2⤵
  PID:8768
- C:\Windows\System\lemlUDY.exe
  C:\Windows\System\lemlUDY.exe
  2⤵
  PID:3784
- C:\Windows\System\pReELdC.exe
  C:\Windows\System\pReELdC.exe
  2⤵
  PID:4748
- C:\Windows\System\YNCJwSw.exe
  C:\Windows\System\YNCJwSw.exe
  2⤵
  PID:5528
- C:\Windows\System\yfvkJjO.exe
  C:\Windows\System\yfvkJjO.exe
  2⤵
  PID:5236
- C:\Windows\System\DswhJKx.exe
  C:\Windows\System\DswhJKx.exe
  2⤵
  PID:232
- C:\Windows\System\JzgYAWR.exe
  C:\Windows\System\JzgYAWR.exe
  2⤵
  PID:14252
- C:\Windows\System\ekpkrHj.exe
  C:\Windows\System\ekpkrHj.exe
  2⤵
  PID:5544
- C:\Windows\System\xAJvrIa.exe
  C:\Windows\System\xAJvrIa.exe
  2⤵
  PID:14260
- C:\Windows\System\vAYqsLC.exe
  C:\Windows\System\vAYqsLC.exe
  2⤵
  PID:220
- C:\Windows\System\wTzcBPk.exe
  C:\Windows\System\wTzcBPk.exe
  2⤵
  PID:5448
- C:\Windows\System\uCjHCuW.exe
  C:\Windows\System\uCjHCuW.exe
  2⤵
  PID:3448
- C:\Windows\System\LeRZCgK.exe
  C:\Windows\System\LeRZCgK.exe
  2⤵
  PID:5488
- C:\Windows\System\unEHwct.exe
  C:\Windows\System\unEHwct.exe
  2⤵
  PID:1692
- C:\Windows\System\UtnSslQ.exe
  C:\Windows\System\UtnSslQ.exe
  2⤵
  PID:5504
- C:\Windows\System\HPPUtnq.exe
  C:\Windows\System\HPPUtnq.exe
  2⤵
  PID:4076
- C:\Windows\System\KZmdqyZ.exe
  C:\Windows\System\KZmdqyZ.exe
  2⤵
  PID:13568
- C:\Windows\System\cqlxdhs.exe
  C:\Windows\System\cqlxdhs.exe
  2⤵
  PID:3904
- C:\Windows\System\hwTlDjx.exe
  C:\Windows\System\hwTlDjx.exe
  2⤵
  PID:2316
- C:\Windows\System\zZMQbOX.exe
  C:\Windows\System\zZMQbOX.exe
  2⤵
  PID:3856
- C:\Windows\System\VpqtwWv.exe
  C:\Windows\System\VpqtwWv.exe
  2⤵
  PID:10396
- C:\Windows\System\kdytYOl.exe
  C:\Windows\System\kdytYOl.exe
  2⤵
  PID:5176
- C:\Windows\System\fQXKjvo.exe
  C:\Windows\System\fQXKjvo.exe
  2⤵
  PID:11044
- C:\Windows\System\bbHbZga.exe
  C:\Windows\System\bbHbZga.exe
  2⤵
  PID:5708
- C:\Windows\System\mzYjxFc.exe
  C:\Windows\System\mzYjxFc.exe
  2⤵
  PID:4396
- C:\Windows\System\tdIWrjj.exe
  C:\Windows\System\tdIWrjj.exe
  2⤵
  PID:3204
- C:\Windows\System\DwXoMFL.exe
  C:\Windows\System\DwXoMFL.exe
  2⤵
  PID:6028
- C:\Windows\System\sYhLCCb.exe
  C:\Windows\System\sYhLCCb.exe
  2⤵
  PID:13012
- C:\Windows\System\HfYoXrZ.exe
  C:\Windows\System\HfYoXrZ.exe
  2⤵
  PID:6040
- C:\Windows\System\gcSUEPa.exe
  C:\Windows\System\gcSUEPa.exe
  2⤵
  PID:8764
- C:\Windows\System\eOprKnn.exe
  C:\Windows\System\eOprKnn.exe
  2⤵
  PID:2120
- C:\Windows\System\XQwCrLq.exe
  C:\Windows\System\XQwCrLq.exe
  2⤵
  PID:13728
- C:\Windows\System\dYZtJLS.exe
  C:\Windows\System\dYZtJLS.exe
  2⤵
  PID:376
- C:\Windows\System\CALftxV.exe
  C:\Windows\System\CALftxV.exe
  2⤵
  PID:5624
- C:\Windows\System\JzIFmvp.exe
  C:\Windows\System\JzIFmvp.exe
  2⤵
  PID:3940
- C:\Windows\System\KxpGQau.exe
  C:\Windows\System\KxpGQau.exe
  2⤵
  PID:5524
- C:\Windows\System\RKwfxuK.exe
  C:\Windows\System\RKwfxuK.exe
  2⤵
  PID:13772
- C:\Windows\System\RajbrZs.exe
  C:\Windows\System\RajbrZs.exe
  2⤵
  PID:616
- C:\Windows\System\AmsoPrc.exe
  C:\Windows\System\AmsoPrc.exe
  2⤵
  PID:5476
- C:\Windows\System\IxSwzpq.exe
  C:\Windows\System\IxSwzpq.exe
  2⤵
  PID:5532
- C:\Windows\System\TcupSrh.exe
  C:\Windows\System\TcupSrh.exe
  2⤵
  PID:4728
- C:\Windows\System\RseuheI.exe
  C:\Windows\System\RseuheI.exe
  2⤵
  PID:5168
- C:\Windows\System\KzpXbQM.exe
  C:\Windows\System\KzpXbQM.exe
  2⤵
  PID:5456
- C:\Windows\System\FwiyjhJ.exe
  C:\Windows\System\FwiyjhJ.exe
  2⤵
  PID:804
- C:\Windows\System\rHtOGPl.exe
  C:\Windows\System\rHtOGPl.exe
  2⤵
  PID:11712
- C:\Windows\System\ljpzAeI.exe
  C:\Windows\System\ljpzAeI.exe
  2⤵
  PID:4320
- C:\Windows\System\XMMZisc.exe
  C:\Windows\System\XMMZisc.exe
  2⤵
  PID:5316
- C:\Windows\System\kSIXlMY.exe
  C:\Windows\System\kSIXlMY.exe
  2⤵
  PID:372
- C:\Windows\System\YcGMXIa.exe
  C:\Windows\System\YcGMXIa.exe
  2⤵
  PID:2272
- C:\Windows\System\gLzuWnd.exe
  C:\Windows\System\gLzuWnd.exe
  2⤵
  PID:5592
- C:\Windows\System\ORSfwRZ.exe
  C:\Windows\System\ORSfwRZ.exe
  2⤵
  PID:5676
- C:\Windows\System\pAfDPUh.exe
  C:\Windows\System\pAfDPUh.exe
  2⤵
  PID:5600
- C:\Windows\System\LWVqvAZ.exe
  C:\Windows\System\LWVqvAZ.exe
  2⤵
  PID:14332
- C:\Windows\System\dShIINI.exe
  C:\Windows\System\dShIINI.exe
  2⤵
  PID:10580
- C:\Windows\System\mvHmyCn.exe
  C:\Windows\System\mvHmyCn.exe
  2⤵
  PID:10560
- C:\Windows\System\BhEHgEa.exe
  C:\Windows\System\BhEHgEa.exe
  2⤵
  PID:13380
- C:\Windows\System\kkokGiP.exe
  C:\Windows\System\kkokGiP.exe
  2⤵
  PID:6248
- C:\Windows\System\MtnunfZ.exe
  C:\Windows\System\MtnunfZ.exe
  2⤵
  PID:13044
- C:\Windows\System\dzYoIaT.exe
  C:\Windows\System\dzYoIaT.exe
  2⤵
  PID:5936
- C:\Windows\System\eEachpY.exe
  C:\Windows\System\eEachpY.exe
  2⤵
  PID:5628
- C:\Windows\System\jCcUCAg.exe
  C:\Windows\System\jCcUCAg.exe
  2⤵
  PID:13920
- C:\Windows\System\TCkZXrS.exe
  C:\Windows\System\TCkZXrS.exe
  2⤵
  PID:13064
- C:\Windows\System\yIqlRCq.exe
  C:\Windows\System\yIqlRCq.exe
  2⤵
  PID:5740
- C:\Windows\System\ZOBIaZh.exe
  C:\Windows\System\ZOBIaZh.exe
  2⤵
  PID:6296
- C:\Windows\System\WJUVrpD.exe
  C:\Windows\System\WJUVrpD.exe
  2⤵
  PID:6032
- C:\Windows\System\iOBmyZS.exe
  C:\Windows\System\iOBmyZS.exe
  2⤵
  PID:6036
- C:\Windows\System\PviQreb.exe
  C:\Windows\System\PviQreb.exe
  2⤵
  PID:8756
- C:\Windows\System\VCjPvsp.exe
  C:\Windows\System\VCjPvsp.exe
  2⤵
  PID:2896
- C:\Windows\System\BJIKQOg.exe
  C:\Windows\System\BJIKQOg.exe
  2⤵
  PID:5688
- C:\Windows\System\BdpGXPd.exe
  C:\Windows\System\BdpGXPd.exe
  2⤵
  PID:1644
- C:\Windows\System\mjBxPns.exe
  C:\Windows\System\mjBxPns.exe
  2⤵
  PID:6556
- C:\Windows\System\DkzBBBo.exe
  C:\Windows\System\DkzBBBo.exe
  2⤵
  PID:2448
- C:\Windows\System\mlRwTyQ.exe
  C:\Windows\System\mlRwTyQ.exe
  2⤵
  PID:5988
- C:\Windows\System\tHwZwaF.exe
  C:\Windows\System\tHwZwaF.exe
  2⤵
  PID:6328
- C:\Windows\System\cRnJIFl.exe
  C:\Windows\System\cRnJIFl.exe
  2⤵
  PID:1064
- C:\Windows\System\IzHHhoS.exe
  C:\Windows\System\IzHHhoS.exe
  2⤵
  PID:6372
- C:\Windows\System\DuTGQTS.exe
  C:\Windows\System\DuTGQTS.exe
  2⤵
  PID:6412
- C:\Windows\System\pjjXlNR.exe
  C:\Windows\System\pjjXlNR.exe
  2⤵
  PID:6504
- C:\Windows\System\ehivlEx.exe
  C:\Windows\System\ehivlEx.exe
  2⤵
  PID:6576
- C:\Windows\System\HNbrcEd.exe
  C:\Windows\System\HNbrcEd.exe
  2⤵
  PID:7088
- C:\Windows\System\nvEvhie.exe
  C:\Windows\System\nvEvhie.exe
  2⤵
  PID:2920
- C:\Windows\System\zpbKZxl.exe
  C:\Windows\System\zpbKZxl.exe
  2⤵
  PID:5564
- C:\Windows\System\fxDdepb.exe
  C:\Windows\System\fxDdepb.exe
  2⤵
  PID:3760
- C:\Windows\System\bIfPLvm.exe
  C:\Windows\System\bIfPLvm.exe
  2⤵
  PID:3084
- C:\Windows\System\dwpoBNY.exe
  C:\Windows\System\dwpoBNY.exe
  2⤵
  PID:4780
- C:\Windows\System\uuJqDcs.exe
  C:\Windows\System\uuJqDcs.exe
  2⤵
  PID:5360
- C:\Windows\System\UlOJXhh.exe
  C:\Windows\System\UlOJXhh.exe
  2⤵
  PID:448
- C:\Windows\System\xUItVge.exe
  C:\Windows\System\xUItVge.exe
  2⤵
  PID:5716
- C:\Windows\System\ZYalwCQ.exe
  C:\Windows\System\ZYalwCQ.exe
  2⤵
  PID:4768
- C:\Windows\System\HGyoMvZ.exe
  C:\Windows\System\HGyoMvZ.exe
  2⤵
  PID:6776
- C:\Windows\System\HyoFddW.exe
  C:\Windows\System\HyoFddW.exe
  2⤵
  PID:3348
- C:\Windows\System\nLHgapF.exe
  C:\Windows\System\nLHgapF.exe
  2⤵
  PID:10568
- C:\Windows\System\WoAzFgu.exe
  C:\Windows\System\WoAzFgu.exe
  2⤵
  PID:6252
- C:\Windows\System\NHGXNsy.exe
  C:\Windows\System\NHGXNsy.exe
  2⤵
  PID:5380
- C:\Windows\System\BxnPCEH.exe
  C:\Windows\System\BxnPCEH.exe
  2⤵
  PID:5696
- C:\Windows\System\mLzEVIo.exe
  C:\Windows\System\mLzEVIo.exe
  2⤵
  PID:12064
- C:\Windows\System\ixgbMxQ.exe
  C:\Windows\System\ixgbMxQ.exe
  2⤵
  PID:5732
- C:\Windows\System\FHvdhBc.exe
  C:\Windows\System\FHvdhBc.exe
  2⤵
  PID:7040
- C:\Windows\System\MMPqncN.exe
  C:\Windows\System\MMPqncN.exe
  2⤵
  PID:6268
- C:\Windows\System\gTSdaAI.exe
  C:\Windows\System\gTSdaAI.exe
  2⤵
  PID:14256
- C:\Windows\System\LuPvxcf.exe
  C:\Windows\System\LuPvxcf.exe
  2⤵
  PID:5896
- C:\Windows\System\NBBVZve.exe
  C:\Windows\System\NBBVZve.exe
  2⤵
  PID:6552
- C:\Windows\System\jonESDp.exe
  C:\Windows\System\jonESDp.exe
  2⤵
  PID:5092
- C:\Windows\System\qjLNjTv.exe
  C:\Windows\System\qjLNjTv.exe
  2⤵
  PID:5204
- C:\Windows\System\oUweoNK.exe
  C:\Windows\System\oUweoNK.exe
  2⤵
  PID:6320
- C:\Windows\System\GlggpIy.exe
  C:\Windows\System\GlggpIy.exe
  2⤵
  PID:5268
- C:\Windows\System\IapCdwj.exe
  C:\Windows\System\IapCdwj.exe
  2⤵
  PID:5536
- C:\Windows\System\bbUIjer.exe
  C:\Windows\System\bbUIjer.exe
  2⤵
  PID:7296
- C:\Windows\System\YHUguzh.exe
  C:\Windows\System\YHUguzh.exe
  2⤵
  PID:3464
- C:\Windows\System\UXnGqWP.exe
  C:\Windows\System\UXnGqWP.exe
  2⤵
  PID:4292
- C:\Windows\System\GUuKSUF.exe
  C:\Windows\System\GUuKSUF.exe
  2⤵
  PID:6600
- C:\Windows\System\PJVAwjx.exe
  C:\Windows\System\PJVAwjx.exe
  2⤵
  PID:5516
- C:\Windows\System\HORolOY.exe
  C:\Windows\System\HORolOY.exe
  2⤵
  PID:7324
- C:\Windows\System\cFBsFUr.exe
  C:\Windows\System\cFBsFUr.exe
  2⤵
  PID:5248
- C:\Windows\System\XAyepeq.exe
  C:\Windows\System\XAyepeq.exe
  2⤵
  PID:5664
- C:\Windows\System\jSZWgmF.exe
  C:\Windows\System\jSZWgmF.exe
  2⤵
  PID:5264
- C:\Windows\System\jkKULGM.exe
  C:\Windows\System\jkKULGM.exe
  2⤵
  PID:7312
- C:\Windows\System\aAsamBc.exe
  C:\Windows\System\aAsamBc.exe
  2⤵
  PID:7328
- C:\Windows\System\PioQGCH.exe
  C:\Windows\System\PioQGCH.exe
  2⤵
  PID:7336
- C:\Windows\System\AovNBRN.exe
  C:\Windows\System\AovNBRN.exe
  2⤵
  PID:6928
- C:\Windows\System\Wwlqunn.exe
  C:\Windows\System\Wwlqunn.exe
  2⤵
  PID:5820
- C:\Windows\System\iIbWRKR.exe
  C:\Windows\System\iIbWRKR.exe
  2⤵
  PID:6224
- C:\Windows\System\jWriXIc.exe
  C:\Windows\System\jWriXIc.exe
  2⤵
  PID:1740
- C:\Windows\System\RBKQeOV.exe
  C:\Windows\System\RBKQeOV.exe
  2⤵
  PID:5860
- C:\Windows\System\IzvTffR.exe
  C:\Windows\System\IzvTffR.exe
  2⤵
  PID:7204
- C:\Windows\System\JVDPtNn.exe
  C:\Windows\System\JVDPtNn.exe
  2⤵
  PID:5932
- C:\Windows\System\iLfpjgH.exe
  C:\Windows\System\iLfpjgH.exe
  2⤵
  PID:6080
- C:\Windows\System\ijCSkAN.exe
  C:\Windows\System\ijCSkAN.exe
  2⤵
  PID:5012
- C:\Windows\System\xnIACtD.exe
  C:\Windows\System\xnIACtD.exe
  2⤵
  PID:6060
- C:\Windows\System\StcQoyK.exe
  C:\Windows\System\StcQoyK.exe
  2⤵
  PID:1292
- C:\Windows\System\ibHcCOT.exe
  C:\Windows\System\ibHcCOT.exe
  2⤵
  PID:6124
- C:\Windows\System\VjtHfoA.exe
  C:\Windows\System\VjtHfoA.exe
  2⤵
  PID:6616
- C:\Windows\System\DLhocXg.exe
  C:\Windows\System\DLhocXg.exe
  2⤵
  PID:7668
- C:\Windows\System\jhTOUjx.exe
  C:\Windows\System\jhTOUjx.exe
  2⤵
  PID:5492
- C:\Windows\System\ZiybWTg.exe
  C:\Windows\System\ZiybWTg.exe
  2⤵
  PID:7416
- C:\Windows\System\hWTBpzY.exe
  C:\Windows\System\hWTBpzY.exe
  2⤵
  PID:7700
- C:\Windows\System\clCRfst.exe
  C:\Windows\System\clCRfst.exe
  2⤵
  PID:7492
- C:\Windows\System\NKEetES.exe
  C:\Windows\System\NKEetES.exe
  2⤵
  PID:7300
- C:\Windows\System\saEJaXJ.exe
  C:\Windows\System\saEJaXJ.exe
  2⤵
  PID:2664
- C:\Windows\System\RnmDRwj.exe
  C:\Windows\System\RnmDRwj.exe
  2⤵
  PID:7316
- C:\Windows\System\iyxFuHb.exe
  C:\Windows\System\iyxFuHb.exe
  2⤵
  PID:7836
- C:\Windows\System\zyFKdCQ.exe
  C:\Windows\System\zyFKdCQ.exe
  2⤵
  PID:6708
- C:\Windows\System\WFQwgtg.exe
  C:\Windows\System\WFQwgtg.exe
  2⤵
  PID:8164
- C:\Windows\System\AFVuuln.exe
  C:\Windows\System\AFVuuln.exe
  2⤵
  PID:6744
- C:\Windows\System\trYJjdu.exe
  C:\Windows\System\trYJjdu.exe
  2⤵
  PID:7736
- C:\Windows\System\tbRkhDI.exe
  C:\Windows\System\tbRkhDI.exe
  2⤵
  PID:7748
- C:\Windows\System\QwVHJGU.exe
  C:\Windows\System\QwVHJGU.exe
  2⤵
  PID:7756
- C:\Windows\System\GWVgPuy.exe
  C:\Windows\System\GWVgPuy.exe
  2⤵
  PID:5724
- C:\Windows\System\kgvlSrK.exe
  C:\Windows\System\kgvlSrK.exe
  2⤵
  PID:6332
- C:\Windows\System\JJFGJTi.exe
  C:\Windows\System\JJFGJTi.exe
  2⤵
  PID:13476
- C:\Windows\System\MnMGLdE.exe
  C:\Windows\System\MnMGLdE.exe
  2⤵
  PID:6256
- C:\Windows\System\MuyuPxp.exe
  C:\Windows\System\MuyuPxp.exe
  2⤵
  PID:5824
- C:\Windows\System\QolLNXo.exe
  C:\Windows\System\QolLNXo.exe
  2⤵
  PID:5776
- C:\Windows\System\YHgiqNE.exe
  C:\Windows\System\YHgiqNE.exe
  2⤵
  PID:8004
- C:\Windows\System\vmXRftM.exe
  C:\Windows\System\vmXRftM.exe
  2⤵
  PID:8036
- C:\Windows\System\cZcbHVh.exe
  C:\Windows\System\cZcbHVh.exe
  2⤵
  PID:6492
- C:\Windows\System\ZyOfEAN.exe
  C:\Windows\System\ZyOfEAN.exe
  2⤵
  PID:6584
- C:\Windows\System\TUMZoWj.exe
  C:\Windows\System\TUMZoWj.exe
  2⤵
  PID:6588
- C:\Windows\System\vcYEbjJ.exe
  C:\Windows\System\vcYEbjJ.exe
  2⤵
  PID:7660
- C:\Windows\System\hFgwaJP.exe
  C:\Windows\System\hFgwaJP.exe
  2⤵
  PID:7384
- C:\Windows\System\MklRniS.exe
  C:\Windows\System\MklRniS.exe
  2⤵
  PID:5440
- C:\Windows\System\OXJIiSA.exe
  C:\Windows\System\OXJIiSA.exe
  2⤵
  PID:7964
- C:\Windows\System\XUDZHRJ.exe
  C:\Windows\System\XUDZHRJ.exe
  2⤵
  PID:5460
- C:\Windows\System\AoTBktY.exe
  C:\Windows\System\AoTBktY.exe
  2⤵
  PID:6440
- C:\Windows\System\tWholcV.exe
  C:\Windows\System\tWholcV.exe
  2⤵
  PID:5048
- C:\Windows\System\emYfpyk.exe
  C:\Windows\System\emYfpyk.exe
  2⤵
  PID:6528
- C:\Windows\System\qxyFxmV.exe
  C:\Windows\System\qxyFxmV.exe
  2⤵
  PID:5744
- C:\Windows\System\MkNJMRf.exe
  C:\Windows\System\MkNJMRf.exe
  2⤵
  PID:6648
- C:\Windows\System\iKAvxHL.exe
  C:\Windows\System\iKAvxHL.exe
  2⤵
  PID:7712
- C:\Windows\System\ZmCfiRp.exe
  C:\Windows\System\ZmCfiRp.exe
  2⤵
  PID:7076
- C:\Windows\System\CQkHbEF.exe
  C:\Windows\System\CQkHbEF.exe
  2⤵
  PID:7728
- C:\Windows\System\PJpnjpb.exe
  C:\Windows\System\PJpnjpb.exe
  2⤵
  PID:10544
- C:\Windows\System\Anxfvov.exe
  C:\Windows\System\Anxfvov.exe
  2⤵
  PID:8172
- C:\Windows\System\rxAVrjG.exe
  C:\Windows\System\rxAVrjG.exe
  2⤵
  PID:8176
- C:\Windows\System\fhkAfHE.exe
  C:\Windows\System\fhkAfHE.exe
  2⤵
  PID:7344
- C:\Windows\System\fGHAeKh.exe
  C:\Windows\System\fGHAeKh.exe
  2⤵
  PID:6292
- C:\Windows\System\zzpLCTi.exe
  C:\Windows\System\zzpLCTi.exe
  2⤵
  PID:6188
- C:\Windows\System\fQbCHHz.exe
  C:\Windows\System\fQbCHHz.exe
  2⤵
  PID:7888
- C:\Windows\System\amWUVcr.exe
  C:\Windows\System\amWUVcr.exe
  2⤵
  PID:4156
- C:\Windows\System\DQvrbDG.exe
  C:\Windows\System\DQvrbDG.exe
  2⤵
  PID:7368
- C:\Windows\System\NyanZrZ.exe
  C:\Windows\System\NyanZrZ.exe
  2⤵
  PID:7032
- C:\Windows\System\jhhkrOw.exe
  C:\Windows\System\jhhkrOw.exe
  2⤵
  PID:7980
- C:\Windows\System\emUvflp.exe
  C:\Windows\System\emUvflp.exe
  2⤵
  PID:5244
- C:\Windows\System\zeABwyw.exe
  C:\Windows\System\zeABwyw.exe
  2⤵
  PID:8364
- C:\Windows\System\BrfIYkH.exe
  C:\Windows\System\BrfIYkH.exe
  2⤵
  PID:5320
- C:\Windows\System\mjCjLcn.exe
  C:\Windows\System\mjCjLcn.exe
  2⤵
  PID:8112
- C:\Windows\System\JSqwpOc.exe
  C:\Windows\System\JSqwpOc.exe
  2⤵
  PID:7372
- C:\Windows\System\GxiivmI.exe
  C:\Windows\System\GxiivmI.exe
  2⤵
  PID:6312
- C:\Windows\System\wgmHMEF.exe
  C:\Windows\System\wgmHMEF.exe
  2⤵
  PID:5368
- C:\Windows\System\zJsterz.exe
  C:\Windows\System\zJsterz.exe
  2⤵
  PID:7400
- C:\Windows\System\WmYuKAy.exe
  C:\Windows\System\WmYuKAy.exe
  2⤵
  PID:7680
- C:\Windows\System\MpnkcDl.exe
  C:\Windows\System\MpnkcDl.exe
  2⤵
  PID:5588
- C:\Windows\System\JfyzfEf.exe
  C:\Windows\System\JfyzfEf.exe
  2⤵
  PID:5184
- C:\Windows\System\xNDUvdv.exe
  C:\Windows\System\xNDUvdv.exe
  2⤵
  PID:6644
- C:\Windows\System\eCbQPXf.exe
  C:\Windows\System\eCbQPXf.exe
  2⤵
  PID:5736
- C:\Windows\System\TpKbwpU.exe
  C:\Windows\System\TpKbwpU.exe
  2⤵
  PID:7704
- C:\Windows\System\EZJzMyG.exe
  C:\Windows\System\EZJzMyG.exe
  2⤵
  PID:6064
- C:\Windows\System\ODLhwcJ.exe
  C:\Windows\System\ODLhwcJ.exe
  2⤵
  PID:6736
- C:\Windows\System\qdyvVUC.exe
  C:\Windows\System\qdyvVUC.exe
  2⤵
  PID:8480
- C:\Windows\System\DiQsklL.exe
  C:\Windows\System\DiQsklL.exe
  2⤵
  PID:8544
- C:\Windows\System\fidihWW.exe
  C:\Windows\System\fidihWW.exe
  2⤵
  PID:8548
- C:\Windows\System\TKvHego.exe
  C:\Windows\System\TKvHego.exe
  2⤵
  PID:8552
- C:\Windows\System\MEHUvGF.exe
  C:\Windows\System\MEHUvGF.exe
  2⤵
  PID:6964
- C:\Windows\System\JgFlRie.exe
  C:\Windows\System\JgFlRie.exe
  2⤵
  PID:8332
- C:\Windows\System\vuzsCue.exe
  C:\Windows\System\vuzsCue.exe
  2⤵
  PID:6352
- C:\Windows\System\DXYcnrD.exe
  C:\Windows\System\DXYcnrD.exe
  2⤵
  PID:1340
- C:\Windows\System\luuTfJA.exe
  C:\Windows\System\luuTfJA.exe
  2⤵
  PID:6988
- C:\Windows\System\eXIYPuJ.exe
  C:\Windows\System\eXIYPuJ.exe
  2⤵
  PID:988
- C:\Windows\System\fgJqPFZ.exe
  C:\Windows\System\fgJqPFZ.exe
  2⤵
  PID:7320
- C:\Windows\System\JWHeizk.exe
  C:\Windows\System\JWHeizk.exe
  2⤵
  PID:7376
- C:\Windows\System\XFhdBEx.exe
  C:\Windows\System\XFhdBEx.exe
  2⤵
  PID:7496
- C:\Windows\System\stjhgTM.exe
  C:\Windows\System\stjhgTM.exe
  2⤵
  PID:8396
- C:\Windows\System\qsaKryK.exe
  C:\Windows\System\qsaKryK.exe
  2⤵
  PID:6284
- C:\Windows\System\wrqpVRr.exe
  C:\Windows\System\wrqpVRr.exe
  2⤵
  PID:10552
- C:\Windows\System\qIzksrF.exe
  C:\Windows\System\qIzksrF.exe
  2⤵
  PID:8464
- C:\Windows\System\YzJaEOT.exe
  C:\Windows\System\YzJaEOT.exe
  2⤵
  PID:8256
- C:\Windows\System\fOnQpzc.exe
  C:\Windows\System\fOnQpzc.exe
  2⤵
  PID:8420
- C:\Windows\System\PhZKQVk.exe
  C:\Windows\System\PhZKQVk.exe
  2⤵
  PID:8412
- C:\Windows\System\EcUkVVW.exe
  C:\Windows\System\EcUkVVW.exe
  2⤵
  PID:8428

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:13936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_k33j5pb4.1zl.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AVepzYo.exe

Filesize
1.9MB

MD5
34373c5a03a00425f7f25f745a801ecd

SHA1
81bc7673abe14a74ae0f10f5b3adf773d112a193

SHA256
d6f42542ed198ee6c2f85e76e128a2a5c98e3fad29b79438a83efe53fbc293d7

SHA512
95f37ff35a01b34d48a27ee07e07688b2188f221cf1298d3b5913caee2447d537bf124a794e6474b732e28d0eef966348239b3f00f37d0b6b62cff68e820fbc9

Download Submit
C:\Windows\System\DwPDkVM.exe

Filesize
1.9MB

MD5
d902b89b4e8af3921b54a9c36d7a8e47

SHA1
30f77647263616c114cac925ee11633d19957822

SHA256
b5ac71b340267efee131f4c9f196bc2b445e1b00e04aa060c81cd87546e8bdcd

SHA512
74fcff15fc1fa7565490d5439b3bb1fa3404204db45cb292f42256366fa23d9e045fac1ea48ad5f14e3c19b0742d74cc2de4a8d9368c295e7393765993edf7aa

Download Submit
C:\Windows\System\EGBuWjN.exe

Filesize
1.9MB

MD5
f6e4084a45d5c056561af726cb4159d7

SHA1
f05d251536f2b186edf4ab350c0ceb434e276caf

SHA256
351b427e5ecbe9aa2c7190a2e377e167a5c24192d33cc5642b1644383eba7946

SHA512
881caa09dd43d03c1c149c1de9ef44b8ac74cc321f19acff3682799791c23329b9bf9ab54495ac91a4435d09d53a683580ce774816fef9c34c68bf07a30f73dd

Download Submit
C:\Windows\System\GlqzEtB.exe

Filesize
1.9MB

MD5
99d0b8b7b60403987147ec2e4f781a40

SHA1
67255884c15353c88f2593b13f522053b39ea946

SHA256
d9b24684fdfcaee00164b3c6314da304611792c54e6053947fae5645b1b38b74

SHA512
61c83cecb8b5f6e2ffb490a8a76e2f2187c03d9ae45e704102ca154010cd743c9b975a31e9069cdc56a0ff91e927af8882ecb75584e135596755b3e2b188aed8

Download Submit
C:\Windows\System\IkKNWeN.exe

Filesize
1.9MB

MD5
834275d4bedb21e0bb94ecf88f64b580

SHA1
1eb14fbf46f69ec453faebb68f2ab04cbef31ff5

SHA256
6b31e06382d5b82f7f3536a2d1d4ba048bb9f8bcb652626da876aa4de5f4407b

SHA512
8905266693d4974d1177bffb2623fcbea1f9281a5a06b07496377ae2045413c4bf7fcffafe4fdae31155e1f91f6916cdff7a1d2bd5cbc973c66fff0033dc4b2a

Download Submit
C:\Windows\System\KZybqfl.exe

Filesize
1.9MB

MD5
4b0c3b7ed094fe61d48196b343a6bcd7

SHA1
38cdca638ecea8b1d9bc6862a2146d82d4b2b9c5

SHA256
adb847ef302fca9989ced3aed5981e40342a5f7455971cf1bd951ce1212da338

SHA512
d6bc56f7f3ccf4ae9f640248e536db585d07dfa70bc01bbf4679db0b988b6cfd9ec39fd0e459d6ea1b3e8d1309123d277a36e26b9408e383728f9852feba65cb

Download Submit
C:\Windows\System\KbhdITg.exe

Filesize
1.9MB

MD5
76f957b53273d00ad01db1850f1f50e4

SHA1
72d5df4e92be80af01caeb0d87dc1b0272a8deac

SHA256
deafccad4e37b76b7dfee35ed6398cfb3e54913f613a2a182b440ca4f07f7578

SHA512
47685870475d1d2be63fec8ab70496ec997d3b7061169d4c87dca01904d979c6f4cde410c0a2620a7f83385a04aaa363a4f714711cfe609f786ce2a5dc71aacb

Download Submit
C:\Windows\System\LLJyowi.exe

Filesize
1.9MB

MD5
c5c69befef06c446343874e983754cb5

SHA1
b47dcd6da107c866828fea7879a18cbfe04e4936

SHA256
67ade9de3d28692bac1aec334645346a772a30163c6b94f7d31cfa609f624645

SHA512
1a2c68c4a1132cb0bda078f6eea78f6ece50d168b559c9494301be5890a09097a1d569ad7a44858513bed9b1993979b406d58e19238b93146b1523dc51c971ac

Download Submit
C:\Windows\System\NmrOLnG.exe

Filesize
1.9MB

MD5
033070d483f9cb3c01c42607980aeb00

SHA1
a3e2ea0de742a8bde88daf95e28abb230052a6c2

SHA256
9c09c8586a138fbad15dfc4711fbd90f7e6af3bf7c0ae1e9770fc618656f664d

SHA512
5b5295513750390f169c1c2a716d6dfbc273578543489db38f1e45a5c836576d06077c210dfe095b3db5ecbf6ebf0f6d2fd2154668a7423db96fab1fcb4ed501

Download Submit
C:\Windows\System\OtcKqWa.exe

Filesize
1.9MB

MD5
960bbb60865a3ec0a3d255f7987b5987

SHA1
ce09f8c2f6dc3a00746e2cfcafc5516241a3ba37

SHA256
c7a1cafeb65d2442f82f38f470d620524e7943d50eca60c8c2df88abe61be341

SHA512
58f65d4cacdca2a276060a1c54ca1c50ae3fa72343dafcf9ebc21f91b7f50aaa8fe9a99bec15cadc50b669d377bb3574c5cad5eaea6a54cd2bce29f12b76c25b

Download Submit
C:\Windows\System\TRTUkOr.exe

Filesize
1.9MB

MD5
b7a25c552e14fb84ad2136a3c797c603

SHA1
0dd95f97f61d3998685b73f27b48dee32cacf297

SHA256
9d44944514d8c2fb2ea4f1ce94d16217e38e4bfd9a1a9d9c2d9ef4d987b506e2

SHA512
411823e421efe52db8b84240f3e5257009bb009de8600d84ef922d2c32173470dd91e454035a372bd76c0ed5478423867114c0ba1f699d69735707136f25ed71

Download Submit
C:\Windows\System\TlgHOhY.exe

Filesize
1.9MB

MD5
7f979049d13e75c49444c7ed478bc1a1

SHA1
ad39c13e1374a76670b8cff72f86af62cb9507ec

SHA256
88d93d0a4ec31ddb455d610d0e3408920d833c0eeca256041df3039857a4a7a1

SHA512
8f13ebc4dd020b7dbe662439d8faf21fcff413c700efd8a78a5468f46f76c36aa906cb231381a538bea31b7c65d0a765d94ab833a5af5853ac8b5c6968678037

Download Submit
C:\Windows\System\UpTfFuT.exe

Filesize
1.9MB

MD5
3bb0bec4d3f3a14418dc7bb3854147b5

SHA1
722d9048f4d283f36a251fec00b81e25d4f6ab41

SHA256
d990b27142e1082f61d0fbda08cbf2420a5984c6cd5b5f27c7750c7534219af8

SHA512
832297880e3abb15137d1dbab1a01dea65e096fe4ef8c2b46c028f0fb95ecc5929b123320e57499708def1fce5f3198597828fbdb69512bafe373e3254f4dc71

Download Submit
C:\Windows\System\UpvqFUO.exe

Filesize
1.9MB

MD5
60b8a48b959629082bad730007c76042

SHA1
4025bfbc9e41fde862734494facbd0c288ae28af

SHA256
e011acbb3d790ee0794f915a14ae51481d5eb7dfc718830405dfe80bd6f5daa2

SHA512
c93718ee0097471e540a1d786e8a23389b19998de0e5b1043da0673f480119e24cb1db56964c145388466c045a8a728cb2df84ee27dbcd19f48257586c19a5d4

Download Submit
C:\Windows\System\XBeNdoB.exe

Filesize
1.9MB

MD5
d45d9d6ea8cc31d741e6ed8984f5dc5d

SHA1
3001d87af105c32132c3dbebdd6abe9ce2298937

SHA256
425820b8680fdd91d73a54fd286c817a9f335d30ce650df83bd787f5fcd445fa

SHA512
922ef2274e3a626b433bfe9f20c24646b94d8942adc342e27d0daf3b731bd736836218c043ea7b1d7a39e97f55416af708b00395364f418e6c7ff582e3c25b6e

Download Submit
C:\Windows\System\XcTtyIa.exe

Filesize
1.9MB

MD5
47ee7aef1139e2e507881f93369d4999

SHA1
8da9bd40fb840d04d3753c78963d2efcfa3cd889

SHA256
f700dbd433941204b4557b9de1286266201a9720bb8e438bfec7151714767444

SHA512
9bacc4a075383e63ec06ef1580360139cf7768c8bb3478494fa657868968259f03cca6d32bb01bf51125bc778ab3a386afd0d14a561073ca28bd03e1e215d0a4

Download Submit
C:\Windows\System\XnmESev.exe

Filesize
1.9MB

MD5
37363dd53d780199ba0ae2298441a66a

SHA1
66a8db0e687fdcfb0e9a5f035cd7bbb1209a33d3

SHA256
8cc0b4e8d7fb366999371274d829f6164b31a5a395b2d6b3abdb9cd32aafc303

SHA512
2048e19d3d5eb5b668ce2b2bafb4458b7b8297ecbb2ca0c190e0e3da912fe79b83dbc28bd0f16e6b584e9bb78c047c1bae21b598736a80da222904d2d1f720ec

Download Submit
C:\Windows\System\YHgdDgz.exe

Filesize
1.9MB

MD5
bd010e28388a500cd3ffa5e59151b717

SHA1
78a605f718648f738c00043ef097997ca84b1640

SHA256
aea8c8152f82145cefe0cab2378ead76918e9a9574948344eda6dcc5fa6db018

SHA512
b1998a8900ecd8237635d98e660a06c3fbaf65ac0dc187c0fd6b06380fd57dfcc895debb27a8b5bf4688dace6f47e0b6a4aa5ec5b7314f975c9651a006764f3c

Download Submit
C:\Windows\System\aBfbsha.exe

Filesize
1.9MB

MD5
24957bcf06eb49a1e2331b440c376593

SHA1
41a2c793e15a0048417557247c6600bc07a15134

SHA256
f1aeebb748464972473c6daada084d6d278563dac6649ff8fd2ec7b0c6d9d005

SHA512
fc1c9d8b983fb020f7e31aab7d21e637d4fa8c3f96ec875fece55d546f166b694a12c2a72de1522829a6f46155ac503a98d39440dd3107aaef4975596b24dd78

Download Submit
C:\Windows\System\bfcKgpu.exe

Filesize
1.9MB

MD5
79eba0ea4b6ace55d7976b8c55fbff54

SHA1
8251d322f8d81d3450b85509fd3b571f7e863116

SHA256
bf3a1db1835e0cc1028a41939b6d9611574c165db5e9d75bcf87a0e47203448a

SHA512
64621ff495195cf1e5ca9217fcfbfb955e58d79bba11e227306f63d1761d226735e1e8ba7113b032e51acb54bfd2b262bd08dee0d9264251fc2769efe2981702

Download Submit
C:\Windows\System\dGWeFZz.exe

Filesize
1.9MB

MD5
a29b3185e6799ebd791c1e2016022c78

SHA1
17e430e450193e39eb6214cb2eda4f32246f376e

SHA256
8071484e5c46b17d48a581fe2afcbb4283e367c5227f6f9ed87d89f16ab6c5dd

SHA512
cb5432791592670945446e9d0207d206b454bacf25a0adadfcf9c4878dff6262faa64ba1c9a1ca1bcfcf26fca704b94abfb0a0544805a282421a19dbbf646fab

Download Submit
C:\Windows\System\eINmQDI.exe

Filesize
1.9MB

MD5
7df63ca4c2b7ae3203099eeb413adbb7

SHA1
7cf22c094a22feb8a4483bf2812b6ebc0fe79379

SHA256
2e69de583cf600b279d7dcc3c1da9f578de7b95dc648789d6bd1a626086b6606

SHA512
3e82ee02baf228d10e4d405d68a7bea5ef68535369f6e2b3e809e12c8dfe66475e5227266907a4e7b1a3d48d33d5a5d60afcf3ea8ce0ab0aaafb595e5d5ff3e9

Download Submit
C:\Windows\System\ePkvdzW.exe

Filesize
1.9MB

MD5
e01a90370d025e84d75daf1ef7981db0

SHA1
0c696470cf4ca1e5998aa64ecec028d8d9f78938

SHA256
f4105734a155a715d5c049a7627f8be7661d1a2c2fed8c3586ff4f3297ba5890

SHA512
2a4812228bb44a1dd879f6590e7943f8c0f92d5915f58e959bf5bcc9bd016a60ea1e540e18a872c795b979f418a2c88b25f9036cce3effd6c636f5d1310b3c5a

Download Submit
C:\Windows\System\fjztFQt.exe

Filesize
1.9MB

MD5
172bf67a98ad826c158b7f13281c84fd

SHA1
70feb54c6c569be6f2c52550323fd8b9a6ffb5be

SHA256
91200e705fcae73988f70c357dba86acc3da4cfa7ee41c6c55026d9f8a82f92b

SHA512
6ede1beb24fee823f68a462f1186c32d0ba9c19de66c092589b3ce18fb2b0e95b22b3f55496b323a2c822ccc1b9d9b1cc86952e18363bff72d40c2ec001ee787

Download Submit
C:\Windows\System\gGJGxjg.exe

Filesize
18B

MD5
b5af15b91ef901dbbad280bf2ec97d3f

SHA1
b8fc44effcf94c604b3a330099fdd05d70ca2290

SHA256
4b241b0358bbe69bc40fb7c8558ef0dacf7a7dd595b9974e7ee1287f6f6a57a6

SHA512
77e9e1cd7604d29efe33ea37dfc85035465c8eb4a6b1edf396f009c9427a6171460e7b24fac454a276653572360ea48634eb43a059b68dd9d91460bd58c1ddf1

Download Submit
C:\Windows\System\hYSwtgq.exe

Filesize
1.9MB

MD5
f173fd33d79a3709882c34cd64b5919a

SHA1
5f6856901bac5536c7bfa1e194fd4374cc218e92

SHA256
1d8d9ccf541154cae5083f8d7f56362f56b17d946a38a1581ecbf3e045956c53

SHA512
6f74a33f2a43a6c874e4f21dd48bd39725defdaddd03ea0af142b9065391aa1748f6bf30b4d25ec807c157e11dce0486215c61e34ceeb9df10e2c243896bae14

Download Submit
C:\Windows\System\kIxQBCC.exe

Filesize
1.9MB

MD5
68f05f667bffdac446cc8b5f2149cfd0

SHA1
43480ed95df78d351da851d2cc55cfe7f3686149

SHA256
c477cee0623d88dae0b6713eee86d89fd43e8b5608fcf383852f0c9ad69b2557

SHA512
249fe9a4514fe05756a2a36ceab0f139c63147b7b77f10c6a0314be3f04fdfdea7f9b82549c185afe341f163b2a097f04fbf4185ffb9cedba67aaf223da1c55b

Download Submit
C:\Windows\System\ndTACyQ.exe

Filesize
8B

MD5
9e16362b7eef9ff59cf4576b688fec20

SHA1
58714a79316bdda8b345ca47c2a7e8087e024871

SHA256
cb157cd47cb9ddacb8fa194262e9cc1364ca68490d93ad041938e77ef90ead7c

SHA512
53056e2e9a952538e1c61538c2bad2166adaf2d4a03d0e97e211329cd7f80967988343aa21690b08c2f1ad6d3fabfdc6095392f57b127d575de79d724d1a09de

Download Submit
C:\Windows\System\oGFZPsD.exe

Filesize
1.9MB

MD5
b362778e210868c1eee3f4ac83c8a26a

SHA1
21e07932c9fea1c4b87a398afde23f8c34ae21f7

SHA256
93a45980467f84da63ccaddf07a4c8c841c4c6e37ae474f14818da3402fac2bd

SHA512
c3af463895796a84a931843b9457657fa7d6f52196d4f9c8523a48801869f1fce6fd5edcc5da941f1c12caee7b0c5c46830064a59dbcb7520923e068e19f5f17

Download Submit
C:\Windows\System\oVmXCXf.exe

Filesize
1.9MB

MD5
5f074f49fa0e9bca719cad9e41ab1a50

SHA1
c0064da11d281613420f6211e20577836b35c66c

SHA256
1b764de87163b059faead693b3a11c79a1172878109bc137c5e2793d336f5ac7

SHA512
26459cb509a0a6897be368dcc615c86e13cef446270d727ee59c32dab3c67495978cf7fdfb08e456f339cc3b47a5032e275afed68384d7c5142c5ff951b7d5ed

Download Submit
C:\Windows\System\rEnEngo.exe

Filesize
1.9MB

MD5
c1307829631687d887f3e813389bfe1e

SHA1
12640ff4f6e7ad894beccd2215af6bcf675a6b95

SHA256
adc6a0c14e5cac9dcb3a03aad679ae7ee8a3f30fdd7e63d652cdbb1291a133ad

SHA512
33624aaca45f57987a3ee5430741d4bd362b7c5321c890461b435a922d300f2f4a693cd3e3595b24ad1a5caf91ac0ff1c7bf29e5ad1f671f9ba3fd0311b1aff8

Download Submit
C:\Windows\System\rcrLKdB.exe

Filesize
1.9MB

MD5
28d6959758f4e263c07da4ed53bfcd47

SHA1
f336bb9b1868235a4e6607cf2abf464b85744bce

SHA256
9ac2edb301f3a4b382821a01d49c57cdd12a473a6809554f45c6c77de259260f

SHA512
d0cd4e85535884e59ac1bedd93f5abcc62c0eccb8c28681e8f0ded99f744acf69f4dcc5964b63aad63f0ed4e3cdc473b5bd37211b548833f3d8bf5fc89c82d52

Download Submit
C:\Windows\System\reyiWLE.exe

Filesize
1.9MB

MD5
904f99d1733d241442da1f70bd3daa74

SHA1
f328be954bec1ce15c1642794118e4abac33d0f0

SHA256
d6ef8c64a9ac0585a424e8c6a7641d7d6ca1c86e04853451027fa2beaf43ebf2

SHA512
6363ecbddd93fbb75d30810412fcde427823240b5377006075006e12044b9906ae90cf4b9f73bf054cd450455f464d0f148423f76749e0fc3a03781ce2fd29e9

Download Submit
C:\Windows\System\sybApgO.exe

Filesize
1.9MB

MD5
15fdd945eea5d5418e1206105cfe022d

SHA1
09b5542a3ed2f08e7bf58278c772218b69286786

SHA256
5ba33bcdca260dc68537ef726b63f0843f62bb8f8f619fdcfc86b3ca7cb43691

SHA512
a9ab123ec393ee4587694a84c4cd178edd57177cc33e2f8abf32c02928e461adac9760b26710c1081873472b1a73186b7ccc25d68db2985d3d3e30fd587562f0

Download Submit
C:\Windows\System\tTIBnEA.exe

Filesize
1.9MB

MD5
a9a78efbded12c6daf12566696a2e182

SHA1
24f30d5bcbe9813efb3e6cea424d29e6d1ecb785

SHA256
4a40ab3a61d2fb9908d944eaed32f73e37c8bfde07f53cdd676399aca59e8169

SHA512
1f62dfbb1051d422aa757b58e411b916413c7e3378190b6eba790cd6cb4ed6be4b02d64017fed1cdb5333ee1225be453c5756d3dd43d28af8bb57b33434deebd

Download Submit
C:\Windows\System\uJHFYrm.exe

Filesize
1.9MB

MD5
203488841e0f89bab8684a5422ff3b3d

SHA1
16168ce0b45b49620c496aac8f6e7c6103609709

SHA256
6260f27f77d1e58d36bc763e29cbbbf657a2bd886a6ad085ef1776dfff36e4d0

SHA512
03fd5fe91f970d4a55523961abd2925d1d716d90cb139de7dbffdbfbb9b8ec7c0047832310b1790999614e6b99b4611d12f6147e97bf51539282e919d388bb8b

Download Submit
C:\Windows\System\wFctiPX.exe

Filesize
1.9MB

MD5
05937047c955120e4c816987ccce8483

SHA1
9f3160a40bd15a5df1745e74d8bd5d9052398886

SHA256
6d791cb105ccb85002355fc5764a26cfd2f0fb18996cc1d86cabc0d2a0873089

SHA512
9cfa077fc7b3a1fd9d8aa997b6df0e32ce572bb5dce5f9ac9ea7fe15201a37ced134a05562c690988cc562265488d3bfef138310a4c581bc0f0bd62fba2821dc

Download Submit
C:\Windows\System\xXlHesK.exe

Filesize
1.9MB

MD5
aa65191eb160d0987d96ac823696c209

SHA1
046749fdd8c23ee0bb249c31bfab0ade1c7b3329

SHA256
15845566d9536c310ded3b651eced3ac4d73264fd6c31b8085b5e72039fee725

SHA512
9871c26cbd9b1ecba63f4713c5e376b5a516d915e370b19dc9955f2f9bbe3f7f627093090d3fd56243023099d314928ffa1336e1a0ff030a7163e5f7a613acc9

Download Submit
C:\Windows\System\yjKAkpk.exe

Filesize
1.9MB

MD5
770a4dfaaa925e7ee8cf69ef5bbf1ed2

SHA1
711185962eef3d5e5ee2f8c00f8937e418a69fe4

SHA256
e2129608906ff2863f8a17214c3cb4b5ddec7df6b3cf0c1292202609da5cb147

SHA512
d36c53f6a294c631a19d5059e6e2d518b14e615467f04bfb997d377af5c59a9b974aa7d87f4bc5ef29c21a659b2b4a91092b543d28f754995684f39ebd56014a

Download Submit
C:\Windows\System\ywcVYSh.exe

Filesize
1.9MB

MD5
7f78b115d17ce98c8849706e68261d7c

SHA1
f8b537a17113868eba7203ced3eca6748ab47fc3

SHA256
ebd29e37aeec43d9bac370c1c3ac49619292f9a2f2fd2d9348768648c228e26a

SHA512
19ce21949a0d8fd0e986e7c23caf6be3b9acca93732270c3d31daaac3b64b9106cbd26c1055ecb598f16d5f14206b12969065004117860abf8ec9ac32f2ac70b

Download Submit
C:\Windows\System\zEYQwbx.exe

Filesize
1.9MB

MD5
106133acb4ceeec4cbc1911555723ff2

SHA1
cf53b71554661d94ca6969db98da93e20750055b

SHA256
cdf045bca183a2858cd1f21a29d41b2095e9f4a5088358d5d95fa41d8d53f8db

SHA512
e7ec0e6d25a55a512a75877240395b830985c26e6aeaed6c536ccc880a86b6828c7cc6bdfa79863c1d2aad1cdea4aec1ea89d69f2926999ea3247a1bb6e6b695

Download Submit
memory/752-4962-0x00007FF662B20000-0x00007FF662F12000-memory.dmp

Filesize
3.9MB

Download
memory/752-125-0x00007FF662B20000-0x00007FF662F12000-memory.dmp

Filesize
3.9MB

Download
memory/752-5038-0x00007FF662B20000-0x00007FF662F12000-memory.dmp

Filesize
3.9MB

Download
memory/836-16-0x00007FF727420000-0x00007FF727812000-memory.dmp

Filesize
3.9MB

Download
memory/900-438-0x00007FF619F20000-0x00007FF61A312000-memory.dmp

Filesize
3.9MB

Download
memory/900-4971-0x00007FF619F20000-0x00007FF61A312000-memory.dmp

Filesize
3.9MB

Download
memory/1016-303-0x00007FF67E490000-0x00007FF67E882000-memory.dmp

Filesize
3.9MB

Download
memory/1016-4985-0x00007FF67E490000-0x00007FF67E882000-memory.dmp

Filesize
3.9MB

Download
memory/1044-5014-0x00007FF732190000-0x00007FF732582000-memory.dmp

Filesize
3.9MB

Download
memory/1044-283-0x00007FF732190000-0x00007FF732582000-memory.dmp

Filesize
3.9MB

Download
memory/1504-4967-0x00007FF642B70000-0x00007FF642F62000-memory.dmp

Filesize
3.9MB

Download
memory/1504-38-0x00007FF642B70000-0x00007FF642F62000-memory.dmp

Filesize
3.9MB

Download
memory/1772-202-0x00007FF68F6B0000-0x00007FF68FAA2000-memory.dmp

Filesize
3.9MB

Download
memory/1772-5016-0x00007FF68F6B0000-0x00007FF68FAA2000-memory.dmp

Filesize
3.9MB

Download
memory/1900-243-0x00007FF7231F0000-0x00007FF7235E2000-memory.dmp

Filesize
3.9MB

Download
memory/1900-5047-0x00007FF7231F0000-0x00007FF7235E2000-memory.dmp

Filesize
3.9MB

Download
memory/1928-56-0x00007FF75A230000-0x00007FF75A622000-memory.dmp

Filesize
3.9MB

Download
memory/1928-4974-0x00007FF75A230000-0x00007FF75A622000-memory.dmp

Filesize
3.9MB

Download
memory/1928-4954-0x00007FF75A230000-0x00007FF75A622000-memory.dmp

Filesize
3.9MB

Download
memory/2036-4997-0x00007FF68B9F0000-0x00007FF68BDE2000-memory.dmp

Filesize
3.9MB

Download
memory/2036-164-0x00007FF68B9F0000-0x00007FF68BDE2000-memory.dmp

Filesize
3.9MB

Download
memory/2344-5011-0x00007FF76AAB0000-0x00007FF76AEA2000-memory.dmp

Filesize
3.9MB

Download
memory/2344-158-0x00007FF76AAB0000-0x00007FF76AEA2000-memory.dmp

Filesize
3.9MB

Download
memory/2512-444-0x00007FF730600000-0x00007FF7309F2000-memory.dmp

Filesize
3.9MB

Download
memory/2512-4979-0x00007FF730600000-0x00007FF7309F2000-memory.dmp

Filesize
3.9MB

Download
memory/2716-4957-0x00007FF6E57C0000-0x00007FF6E5BB2000-memory.dmp

Filesize
3.9MB

Download
memory/2716-83-0x00007FF6E57C0000-0x00007FF6E5BB2000-memory.dmp

Filesize
3.9MB

Download
memory/2716-4983-0x00007FF6E57C0000-0x00007FF6E5BB2000-memory.dmp

Filesize
3.9MB

Download
memory/2720-445-0x00007FF7723E0000-0x00007FF7727D2000-memory.dmp

Filesize
3.9MB

Download
memory/2720-5020-0x00007FF7723E0000-0x00007FF7727D2000-memory.dmp

Filesize
3.9MB

Download
memory/2800-5028-0x00007FF7728B0000-0x00007FF772CA2000-memory.dmp

Filesize
3.9MB

Download
memory/2800-349-0x00007FF7728B0000-0x00007FF772CA2000-memory.dmp

Filesize
3.9MB

Download
memory/2868-369-0x00007FF667650000-0x00007FF667A42000-memory.dmp

Filesize
3.9MB

Download
memory/2868-5008-0x00007FF667650000-0x00007FF667A42000-memory.dmp

Filesize
3.9MB

Download
memory/3208-5032-0x00007FF631DC0000-0x00007FF6321B2000-memory.dmp

Filesize
3.9MB

Download
memory/3208-304-0x00007FF631DC0000-0x00007FF6321B2000-memory.dmp

Filesize
3.9MB

Download
memory/3264-1-0x000002A5C6EF0000-0x000002A5C6F00000-memory.dmp

Filesize
64KB

Download
memory/3264-0-0x00007FF7C5620000-0x00007FF7C5A12000-memory.dmp

Filesize
3.9MB

Download
memory/3268-4988-0x00007FF6E10B0000-0x00007FF6E14A2000-memory.dmp

Filesize
3.9MB

Download
memory/3268-439-0x00007FF6E10B0000-0x00007FF6E14A2000-memory.dmp

Filesize
3.9MB

Download
memory/3508-522-0x000002C79E640000-0x000002C79E662000-memory.dmp

Filesize
136KB

Download
memory/3544-30-0x00007FF70B550000-0x00007FF70B942000-memory.dmp

Filesize
3.9MB

Download
memory/3544-4961-0x00007FF70B550000-0x00007FF70B942000-memory.dmp

Filesize
3.9MB

Download
memory/3544-4939-0x00007FF70B550000-0x00007FF70B942000-memory.dmp

Filesize
3.9MB

Download
memory/4660-5044-0x00007FF791DE0000-0x00007FF7921D2000-memory.dmp

Filesize
3.9MB

Download
memory/4660-426-0x00007FF791DE0000-0x00007FF7921D2000-memory.dmp

Filesize
3.9MB

Download
memory/4796-338-0x00007FF6770E0000-0x00007FF6774D2000-memory.dmp

Filesize
3.9MB

Download
memory/4796-5026-0x00007FF6770E0000-0x00007FF6774D2000-memory.dmp

Filesize
3.9MB

Download
memory/4908-5037-0x00007FF727DC0000-0x00007FF7281B2000-memory.dmp

Filesize
3.9MB

Download
memory/4908-218-0x00007FF727DC0000-0x00007FF7281B2000-memory.dmp

Filesize
3.9MB

Download
memory/4912-335-0x00007FF705E30000-0x00007FF706222000-memory.dmp

Filesize
3.9MB

Download
memory/4956-5022-0x00007FF6A25A0000-0x00007FF6A2992000-memory.dmp

Filesize
3.9MB

Download
memory/4956-387-0x00007FF6A25A0000-0x00007FF6A2992000-memory.dmp

Filesize
3.9MB

Download