xmrig | 0cf96916a10e2b797571d9ef1c1acd76b04f2935225ce5fd97f8ba50e31b36a1

Analysis

max time kernel
88s
max time network
143s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
02-05-2024 23:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
Size

2.2MB
MD5

0f2fc8d4d7f2ade7ff94e2ba62606222
SHA1

cfed352c978be66668c44bd4bce22d927e6f2998
SHA256

0cf96916a10e2b797571d9ef1c1acd76b04f2935225ce5fd97f8ba50e31b36a1
SHA512

c045b66e98830ae75534c937d3fef256a312f6d3225168015d6ea1a86db42616b73dfe7ea235273db3fc35c58fb603f9f1f29f0242eac4a9920d90efb620f98e
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfg:NABt

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 22 IoCs

miner

resource	yara_rule
behavioral1/memory/2280-70-0x000000013F790000-0x000000013FB82000-memory.dmp	xmrig
behavioral1/memory/2896-142-0x000000013F770000-0x000000013FB62000-memory.dmp	xmrig
behavioral1/memory/1728-123-0x000000013F550000-0x000000013F942000-memory.dmp	xmrig
behavioral1/memory/2496-100-0x000000013F820000-0x000000013FC12000-memory.dmp	xmrig
behavioral1/memory/2736-112-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	xmrig
behavioral1/memory/1840-110-0x000000013FA80000-0x000000013FE72000-memory.dmp	xmrig
behavioral1/memory/2452-108-0x000000013F510000-0x000000013F902000-memory.dmp	xmrig
behavioral1/memory/2372-88-0x0000000003250000-0x0000000003642000-memory.dmp	xmrig
behavioral1/memory/1776-81-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	xmrig
behavioral1/memory/2872-72-0x000000013FB40000-0x000000013FF32000-memory.dmp	xmrig
behavioral1/memory/2052-5391-0x000000013F850000-0x000000013FC42000-memory.dmp	xmrig
behavioral1/memory/2596-5388-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	xmrig
behavioral1/memory/2896-5394-0x000000013F770000-0x000000013FB62000-memory.dmp	xmrig
behavioral1/memory/1776-5393-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	xmrig
behavioral1/memory/2736-5397-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	xmrig
behavioral1/memory/2280-5400-0x000000013F790000-0x000000013FB82000-memory.dmp	xmrig
behavioral1/memory/1840-5403-0x000000013FA80000-0x000000013FE72000-memory.dmp	xmrig
behavioral1/memory/2452-5414-0x000000013F510000-0x000000013F902000-memory.dmp	xmrig
behavioral1/memory/2872-5399-0x000000013FB40000-0x000000013FF32000-memory.dmp	xmrig
behavioral1/memory/1728-5531-0x000000013F550000-0x000000013F942000-memory.dmp	xmrig
behavioral1/memory/2496-5570-0x000000013F820000-0x000000013FC12000-memory.dmp	xmrig
behavioral1/memory/2372-12803-0x000000013F450000-0x000000013F842000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1668	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2052	zJzvLdB.exe
2596	OLmcEhf.exe
2896	bbPqrJO.exe
2280	KjNHfMi.exe
2872	QgqoIBh.exe
1776	OupfqNM.exe
2496	swTKHsc.exe
2452	gJtRUPW.exe
1840	hzLpQJW.exe
2736	LwuHdHp.exe
1728	MrWrQzx.exe
2960	VCbflMQ.exe
2772	rUwVGuI.exe
868	WrwewGr.exe
320	pBbPldO.exe
2660	PueJaFq.exe
1968	yULWkxI.exe
344	yhGIbjF.exe
2428	ASukDBT.exe
2864	hvMNbJb.exe
3024	QNDMozK.exe
3012	ylAypGW.exe
1504	IyIseSO.exe
2700	XCwOLou.exe
2672	BSJOkgH.exe
824	KPhVmrS.exe
408	UWPQuAh.exe
2848	TwuMIVd.exe
1736	WLvIzUD.exe
1788	qpmheSP.exe
1368	ykwFTNG.exe
304	gMwOuzP.exe
1352	QdfQBkA.exe
1044	NzhpWdk.exe
1944	FOLpoxm.exe
968	TYCtVfn.exe
1164	BeTzkzt.exe
1664	hADglrS.exe
1108	kvwseWP.exe
2304	wUVOokr.exe
1036	wYUTTCc.exe
2136	kzUyQHP.exe
2212	kzmCjXO.exe
2636	mPDEbuF.exe
2600	FYoszLL.exe
2504	OvVsUtF.exe
2520	wbJrkvv.exe
2828	YEWzAvs.exe
1032	LerCqBJ.exe
2272	SOLpTtB.exe
2268	xrRvWCw.exe
2152	oXHdCtR.exe
1152	CmoXbfo.exe
1976	Kjebtcc.exe
2120	fCEVSYo.exe
2380	BQrYODB.exe
2472	TnQWFuY.exe
816	yBShKnp.exe
1696	AMrYvSf.exe
1748	awGcEHq.exe
2936	XTYZGpR.exe
3104	NoFNvSA.exe
3136	AhoITlT.exe
3168	DMyGlyI.exe

Loads dropped DLL 64 IoCs

pid	Process
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe

UPX packed file 58 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2372-0-0x000000013F450000-0x000000013F842000-memory.dmp	upx
behavioral1/files/0x000b0000000144e0-3.dat	upx
behavioral1/files/0x003600000001480e-12.dat	upx
behavioral1/files/0x0007000000014ba7-11.dat	upx
behavioral1/memory/2596-15-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	upx
behavioral1/files/0x000800000001502c-37.dat	upx
behavioral1/files/0x00080000000153d9-42.dat	upx
behavioral1/files/0x0006000000015cce-54.dat	upx
behavioral1/files/0x0006000000015ce3-61.dat	upx
behavioral1/files/0x0006000000015cd9-59.dat	upx
behavioral1/memory/2280-70-0x000000013F790000-0x000000013FB82000-memory.dmp	upx
behavioral1/files/0x0006000000015d0c-89.dat	upx
behavioral1/files/0x0006000000015f3c-106.dat	upx
behavioral1/files/0x00060000000162c9-125.dat	upx
behavioral1/files/0x000600000001654a-131.dat	upx
behavioral1/files/0x0006000000016813-147.dat	upx
behavioral1/files/0x0006000000015d24-154.dat	upx
behavioral1/files/0x0006000000015e6d-167.dat	upx
behavioral1/files/0x0006000000016c8c-180.dat	upx
behavioral1/files/0x0006000000015cf5-73.dat	upx
behavioral1/files/0x0006000000015d4c-160.dat	upx
behavioral1/files/0x00360000000149e1-156.dat	upx
behavioral1/memory/2896-142-0x000000013F770000-0x000000013FB62000-memory.dmp	upx
behavioral1/files/0x00060000000165f0-135.dat	upx
behavioral1/files/0x0006000000016476-128.dat	upx
behavioral1/files/0x00060000000160cc-124.dat	upx
behavioral1/memory/1728-123-0x000000013F550000-0x000000013F942000-memory.dmp	upx
behavioral1/files/0x00060000000161b3-120.dat	upx
behavioral1/files/0x0006000000015fa7-113.dat	upx
behavioral1/memory/2496-100-0x000000013F820000-0x000000013FC12000-memory.dmp	upx
behavioral1/files/0x0006000000016cb2-183.dat	upx
behavioral1/files/0x0006000000015d44-92.dat	upx
behavioral1/files/0x0006000000016c42-177.dat	upx
behavioral1/files/0x0006000000016c1d-170.dat	upx
behavioral1/files/0x0006000000016c3a-176.dat	upx
behavioral1/files/0x0006000000016a6f-163.dat	upx
behavioral1/memory/2736-112-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	upx
behavioral1/memory/1840-110-0x000000013FA80000-0x000000013FE72000-memory.dmp	upx
behavioral1/memory/2452-108-0x000000013F510000-0x000000013F902000-memory.dmp	upx
behavioral1/files/0x0006000000015e09-105.dat	upx
behavioral1/memory/1776-81-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	upx
behavioral1/memory/2872-72-0x000000013FB40000-0x000000013FF32000-memory.dmp	upx
behavioral1/files/0x0007000000015cbd-50.dat	upx
behavioral1/files/0x001800000000558a-36.dat	upx
behavioral1/files/0x0007000000014dae-30.dat	upx
behavioral1/memory/2052-8-0x000000013F850000-0x000000013FC42000-memory.dmp	upx
behavioral1/memory/2052-5391-0x000000013F850000-0x000000013FC42000-memory.dmp	upx
behavioral1/memory/2596-5388-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	upx
behavioral1/memory/2896-5394-0x000000013F770000-0x000000013FB62000-memory.dmp	upx
behavioral1/memory/1776-5393-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	upx
behavioral1/memory/2736-5397-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	upx
behavioral1/memory/2280-5400-0x000000013F790000-0x000000013FB82000-memory.dmp	upx
behavioral1/memory/1840-5403-0x000000013FA80000-0x000000013FE72000-memory.dmp	upx
behavioral1/memory/2452-5414-0x000000013F510000-0x000000013F902000-memory.dmp	upx
behavioral1/memory/2872-5399-0x000000013FB40000-0x000000013FF32000-memory.dmp	upx
behavioral1/memory/1728-5531-0x000000013F550000-0x000000013F942000-memory.dmp	upx
behavioral1/memory/2496-5570-0x000000013F820000-0x000000013FC12000-memory.dmp	upx
behavioral1/memory/2372-12803-0x000000013F450000-0x000000013F842000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\RJOAVFi.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\GwRTOdS.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\nRMToDN.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\ICRIncf.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\hUWvbMI.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\TFBGMSU.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\NVbrxfG.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\qDxIIJJ.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\rtFTSkl.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\hkHIwZz.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\ZVdDcBL.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\lPeqyCk.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\eTjvRIy.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\bvdoWbj.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\saTBDBI.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\BVLnMGg.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\PppMDXT.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\BeTzkzt.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\DsDpGTw.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\LRBGxKO.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\WKkfatq.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\BIctQCe.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\CfYnkvs.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\FByCUZg.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\rutGfcW.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\HSmGpqI.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\BIrozdO.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\teXWoXF.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\tldcjQi.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\lyLMLXL.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\NRXKRWk.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\SBOMjZO.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\NClURGZ.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\vFFmKST.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\VeoElSU.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\LoSNrjx.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\IwZxETa.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\YjWClAH.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\SLhXtfW.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\BJMpYju.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\ZjYittD.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\ogWGvaT.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\CNlqYog.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\yMnVOCx.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\kdGjGCK.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\WwraDpZ.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\yJykIeT.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\xcwBTVp.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\tSyVVEF.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\rvaVysH.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\JcZwSIO.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\cwtKdAz.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\HZUKxJl.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\zVudHOJ.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\Eqcgjwj.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\YuPklbO.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\IOXMGPp.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\JBYJaXY.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\WynOFWY.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\XJtAZIg.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\GpqRAVB.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\VRAlbHN.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\YzvrLwz.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\xbbcRwO.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1668	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
Token: SeDebugPrivilege	1668	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 1668	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	29
PID 2372 wrote to memory of 1668	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	29
PID 2372 wrote to memory of 1668	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	29
PID 2372 wrote to memory of 2052	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	30
PID 2372 wrote to memory of 2052	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	30
PID 2372 wrote to memory of 2052	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	30
PID 2372 wrote to memory of 2596	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	31
PID 2372 wrote to memory of 2596	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	31
PID 2372 wrote to memory of 2596	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	31
PID 2372 wrote to memory of 2896	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	32
PID 2372 wrote to memory of 2896	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	32
PID 2372 wrote to memory of 2896	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	32
PID 2372 wrote to memory of 2280	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	33
PID 2372 wrote to memory of 2280	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	33
PID 2372 wrote to memory of 2280	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	33
PID 2372 wrote to memory of 2872	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	34
PID 2372 wrote to memory of 2872	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	34
PID 2372 wrote to memory of 2872	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	34
PID 2372 wrote to memory of 1776	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	35
PID 2372 wrote to memory of 1776	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	35
PID 2372 wrote to memory of 1776	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	35
PID 2372 wrote to memory of 2496	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	36
PID 2372 wrote to memory of 2496	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	36
PID 2372 wrote to memory of 2496	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	36
PID 2372 wrote to memory of 2452	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	37
PID 2372 wrote to memory of 2452	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	37
PID 2372 wrote to memory of 2452	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	37
PID 2372 wrote to memory of 1840	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	38
PID 2372 wrote to memory of 1840	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	38
PID 2372 wrote to memory of 1840	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	38
PID 2372 wrote to memory of 2736	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	39
PID 2372 wrote to memory of 2736	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	39
PID 2372 wrote to memory of 2736	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	39
PID 2372 wrote to memory of 1728	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	40
PID 2372 wrote to memory of 1728	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	40
PID 2372 wrote to memory of 1728	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	40
PID 2372 wrote to memory of 2864	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	41
PID 2372 wrote to memory of 2864	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	41
PID 2372 wrote to memory of 2864	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	41
PID 2372 wrote to memory of 2960	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	42
PID 2372 wrote to memory of 2960	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	42
PID 2372 wrote to memory of 2960	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	42
PID 2372 wrote to memory of 3024	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	43
PID 2372 wrote to memory of 3024	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	43
PID 2372 wrote to memory of 3024	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	43
PID 2372 wrote to memory of 2772	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	44
PID 2372 wrote to memory of 2772	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	44
PID 2372 wrote to memory of 2772	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	44
PID 2372 wrote to memory of 3012	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	45
PID 2372 wrote to memory of 3012	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	45
PID 2372 wrote to memory of 3012	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	45
PID 2372 wrote to memory of 868	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	46
PID 2372 wrote to memory of 868	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	46
PID 2372 wrote to memory of 868	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	46
PID 2372 wrote to memory of 2700	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	47
PID 2372 wrote to memory of 2700	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	47
PID 2372 wrote to memory of 2700	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	47
PID 2372 wrote to memory of 320	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	48
PID 2372 wrote to memory of 320	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	48
PID 2372 wrote to memory of 320	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	48
PID 2372 wrote to memory of 2672	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	49
PID 2372 wrote to memory of 2672	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	49
PID 2372 wrote to memory of 2672	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	49
PID 2372 wrote to memory of 2660	2372	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1668
- C:\Windows\System\zJzvLdB.exe
  C:\Windows\System\zJzvLdB.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\OLmcEhf.exe
  C:\Windows\System\OLmcEhf.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\bbPqrJO.exe
  C:\Windows\System\bbPqrJO.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\KjNHfMi.exe
  C:\Windows\System\KjNHfMi.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\QgqoIBh.exe
  C:\Windows\System\QgqoIBh.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\OupfqNM.exe
  C:\Windows\System\OupfqNM.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\swTKHsc.exe
  C:\Windows\System\swTKHsc.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\gJtRUPW.exe
  C:\Windows\System\gJtRUPW.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\hzLpQJW.exe
  C:\Windows\System\hzLpQJW.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\LwuHdHp.exe
  C:\Windows\System\LwuHdHp.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\MrWrQzx.exe
  C:\Windows\System\MrWrQzx.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\hvMNbJb.exe
  C:\Windows\System\hvMNbJb.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\VCbflMQ.exe
  C:\Windows\System\VCbflMQ.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\QNDMozK.exe
  C:\Windows\System\QNDMozK.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\rUwVGuI.exe
  C:\Windows\System\rUwVGuI.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\ylAypGW.exe
  C:\Windows\System\ylAypGW.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\WrwewGr.exe
  C:\Windows\System\WrwewGr.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\XCwOLou.exe
  C:\Windows\System\XCwOLou.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\pBbPldO.exe
  C:\Windows\System\pBbPldO.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\BSJOkgH.exe
  C:\Windows\System\BSJOkgH.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\PueJaFq.exe
  C:\Windows\System\PueJaFq.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\TwuMIVd.exe
  C:\Windows\System\TwuMIVd.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\yULWkxI.exe
  C:\Windows\System\yULWkxI.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\WLvIzUD.exe
  C:\Windows\System\WLvIzUD.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\yhGIbjF.exe
  C:\Windows\System\yhGIbjF.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System\qpmheSP.exe
  C:\Windows\System\qpmheSP.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\ASukDBT.exe
  C:\Windows\System\ASukDBT.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\gMwOuzP.exe
  C:\Windows\System\gMwOuzP.exe
  2⤵
  - Executes dropped EXE
  PID:304
- C:\Windows\System\IyIseSO.exe
  C:\Windows\System\IyIseSO.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\cDcpUpv.exe
  C:\Windows\System\cDcpUpv.exe
  2⤵
  PID:848
- C:\Windows\System\KPhVmrS.exe
  C:\Windows\System\KPhVmrS.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\DgJMZIS.exe
  C:\Windows\System\DgJMZIS.exe
  2⤵
  PID:1832
- C:\Windows\System\UWPQuAh.exe
  C:\Windows\System\UWPQuAh.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\gbDOmoy.exe
  C:\Windows\System\gbDOmoy.exe
  2⤵
  PID:1144
- C:\Windows\System\ykwFTNG.exe
  C:\Windows\System\ykwFTNG.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\ClGohlA.exe
  C:\Windows\System\ClGohlA.exe
  2⤵
  PID:1100
- C:\Windows\System\QdfQBkA.exe
  C:\Windows\System\QdfQBkA.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\yJlHxfB.exe
  C:\Windows\System\yJlHxfB.exe
  2⤵
  PID:608
- C:\Windows\System\NzhpWdk.exe
  C:\Windows\System\NzhpWdk.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\pMpKqfF.exe
  C:\Windows\System\pMpKqfF.exe
  2⤵
  PID:1960
- C:\Windows\System\FOLpoxm.exe
  C:\Windows\System\FOLpoxm.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\AJXfyAu.exe
  C:\Windows\System\AJXfyAu.exe
  2⤵
  PID:1892
- C:\Windows\System\TYCtVfn.exe
  C:\Windows\System\TYCtVfn.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\SaEJBrI.exe
  C:\Windows\System\SaEJBrI.exe
  2⤵
  PID:692
- C:\Windows\System\BeTzkzt.exe
  C:\Windows\System\BeTzkzt.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\BDbtDbc.exe
  C:\Windows\System\BDbtDbc.exe
  2⤵
  PID:2288
- C:\Windows\System\hADglrS.exe
  C:\Windows\System\hADglrS.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\Ncgutjs.exe
  C:\Windows\System\Ncgutjs.exe
  2⤵
  PID:2316
- C:\Windows\System\kvwseWP.exe
  C:\Windows\System\kvwseWP.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\RnaDKxu.exe
  C:\Windows\System\RnaDKxu.exe
  2⤵
  PID:1432
- C:\Windows\System\wUVOokr.exe
  C:\Windows\System\wUVOokr.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\AZDQLQq.exe
  C:\Windows\System\AZDQLQq.exe
  2⤵
  PID:1524
- C:\Windows\System\wYUTTCc.exe
  C:\Windows\System\wYUTTCc.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\YHJwehG.exe
  C:\Windows\System\YHJwehG.exe
  2⤵
  PID:2128
- C:\Windows\System\kzUyQHP.exe
  C:\Windows\System\kzUyQHP.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\rmfsDKz.exe
  C:\Windows\System\rmfsDKz.exe
  2⤵
  PID:1596
- C:\Windows\System\kzmCjXO.exe
  C:\Windows\System\kzmCjXO.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\rukmBBx.exe
  C:\Windows\System\rukmBBx.exe
  2⤵
  PID:1300
- C:\Windows\System\mPDEbuF.exe
  C:\Windows\System\mPDEbuF.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\DaFAlEo.exe
  C:\Windows\System\DaFAlEo.exe
  2⤵
  PID:2892
- C:\Windows\System\FYoszLL.exe
  C:\Windows\System\FYoszLL.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\llaXxqg.exe
  C:\Windows\System\llaXxqg.exe
  2⤵
  PID:2888
- C:\Windows\System\OvVsUtF.exe
  C:\Windows\System\OvVsUtF.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\agqkJAh.exe
  C:\Windows\System\agqkJAh.exe
  2⤵
  PID:2564
- C:\Windows\System\wbJrkvv.exe
  C:\Windows\System\wbJrkvv.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\vumTQRj.exe
  C:\Windows\System\vumTQRj.exe
  2⤵
  PID:2140
- C:\Windows\System\YEWzAvs.exe
  C:\Windows\System\YEWzAvs.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\KUQyQWI.exe
  C:\Windows\System\KUQyQWI.exe
  2⤵
  PID:2992
- C:\Windows\System\LerCqBJ.exe
  C:\Windows\System\LerCqBJ.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\mClggZk.exe
  C:\Windows\System\mClggZk.exe
  2⤵
  PID:896
- C:\Windows\System\SOLpTtB.exe
  C:\Windows\System\SOLpTtB.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\QoQpnrs.exe
  C:\Windows\System\QoQpnrs.exe
  2⤵
  PID:1648
- C:\Windows\System\xrRvWCw.exe
  C:\Windows\System\xrRvWCw.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\evuXgBZ.exe
  C:\Windows\System\evuXgBZ.exe
  2⤵
  PID:820
- C:\Windows\System\oXHdCtR.exe
  C:\Windows\System\oXHdCtR.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\dSAgPnC.exe
  C:\Windows\System\dSAgPnC.exe
  2⤵
  PID:1252
- C:\Windows\System\CmoXbfo.exe
  C:\Windows\System\CmoXbfo.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\LvllfDN.exe
  C:\Windows\System\LvllfDN.exe
  2⤵
  PID:1716
- C:\Windows\System\Kjebtcc.exe
  C:\Windows\System\Kjebtcc.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\kRHTbYI.exe
  C:\Windows\System\kRHTbYI.exe
  2⤵
  PID:3064
- C:\Windows\System\fCEVSYo.exe
  C:\Windows\System\fCEVSYo.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\teXWoXF.exe
  C:\Windows\System\teXWoXF.exe
  2⤵
  PID:1272
- C:\Windows\System\BQrYODB.exe
  C:\Windows\System\BQrYODB.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\XbsFRpF.exe
  C:\Windows\System\XbsFRpF.exe
  2⤵
  PID:2160
- C:\Windows\System\TnQWFuY.exe
  C:\Windows\System\TnQWFuY.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\PlPjzGz.exe
  C:\Windows\System\PlPjzGz.exe
  2⤵
  PID:2748
- C:\Windows\System\yBShKnp.exe
  C:\Windows\System\yBShKnp.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\wRoMoug.exe
  C:\Windows\System\wRoMoug.exe
  2⤵
  PID:2260
- C:\Windows\System\AMrYvSf.exe
  C:\Windows\System\AMrYvSf.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\XFOCwsn.exe
  C:\Windows\System\XFOCwsn.exe
  2⤵
  PID:1812
- C:\Windows\System\awGcEHq.exe
  C:\Windows\System\awGcEHq.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\amvoZiB.exe
  C:\Windows\System\amvoZiB.exe
  2⤵
  PID:1600
- C:\Windows\System\XTYZGpR.exe
  C:\Windows\System\XTYZGpR.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\wnlJxeV.exe
  C:\Windows\System\wnlJxeV.exe
  2⤵
  PID:3088
- C:\Windows\System\NoFNvSA.exe
  C:\Windows\System\NoFNvSA.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\QjYtEVl.exe
  C:\Windows\System\QjYtEVl.exe
  2⤵
  PID:3120
- C:\Windows\System\AhoITlT.exe
  C:\Windows\System\AhoITlT.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\mJKsfsW.exe
  C:\Windows\System\mJKsfsW.exe
  2⤵
  PID:3152
- C:\Windows\System\DMyGlyI.exe
  C:\Windows\System\DMyGlyI.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\ZcXJjXU.exe
  C:\Windows\System\ZcXJjXU.exe
  2⤵
  PID:3184
- C:\Windows\System\uAAjOmm.exe
  C:\Windows\System\uAAjOmm.exe
  2⤵
  PID:3200
- C:\Windows\System\ZHCjsyR.exe
  C:\Windows\System\ZHCjsyR.exe
  2⤵
  PID:3216
- C:\Windows\System\tZJpcLX.exe
  C:\Windows\System\tZJpcLX.exe
  2⤵
  PID:3444
- C:\Windows\System\edOheTH.exe
  C:\Windows\System\edOheTH.exe
  2⤵
  PID:3468
- C:\Windows\System\qqpPFfx.exe
  C:\Windows\System\qqpPFfx.exe
  2⤵
  PID:3504
- C:\Windows\System\dhcAQwE.exe
  C:\Windows\System\dhcAQwE.exe
  2⤵
  PID:3540
- C:\Windows\System\hGswKYA.exe
  C:\Windows\System\hGswKYA.exe
  2⤵
  PID:3576
- C:\Windows\System\DJEocOT.exe
  C:\Windows\System\DJEocOT.exe
  2⤵
  PID:3604
- C:\Windows\System\jBbTfKe.exe
  C:\Windows\System\jBbTfKe.exe
  2⤵
  PID:3632
- C:\Windows\System\VIhvgvJ.exe
  C:\Windows\System\VIhvgvJ.exe
  2⤵
  PID:3696
- C:\Windows\System\oRXpIch.exe
  C:\Windows\System\oRXpIch.exe
  2⤵
  PID:3716
- C:\Windows\System\gdbhaMP.exe
  C:\Windows\System\gdbhaMP.exe
  2⤵
  PID:3736
- C:\Windows\System\NoPpNHr.exe
  C:\Windows\System\NoPpNHr.exe
  2⤵
  PID:3756
- C:\Windows\System\UuXflhp.exe
  C:\Windows\System\UuXflhp.exe
  2⤵
  PID:3776
- C:\Windows\System\kqsDmrm.exe
  C:\Windows\System\kqsDmrm.exe
  2⤵
  PID:3796
- C:\Windows\System\psztUor.exe
  C:\Windows\System\psztUor.exe
  2⤵
  PID:3816
- C:\Windows\System\ivPiAeH.exe
  C:\Windows\System\ivPiAeH.exe
  2⤵
  PID:3836
- C:\Windows\System\gGsqGtE.exe
  C:\Windows\System\gGsqGtE.exe
  2⤵
  PID:3856
- C:\Windows\System\JszhpeJ.exe
  C:\Windows\System\JszhpeJ.exe
  2⤵
  PID:3876
- C:\Windows\System\VweEdNk.exe
  C:\Windows\System\VweEdNk.exe
  2⤵
  PID:3896
- C:\Windows\System\byDnSTR.exe
  C:\Windows\System\byDnSTR.exe
  2⤵
  PID:3916
- C:\Windows\System\vXERLRv.exe
  C:\Windows\System\vXERLRv.exe
  2⤵
  PID:3936
- C:\Windows\System\jGwpTXO.exe
  C:\Windows\System\jGwpTXO.exe
  2⤵
  PID:3956
- C:\Windows\System\ygkTqpP.exe
  C:\Windows\System\ygkTqpP.exe
  2⤵
  PID:3976
- C:\Windows\System\LArsrWz.exe
  C:\Windows\System\LArsrWz.exe
  2⤵
  PID:3996
- C:\Windows\System\GlPQgcz.exe
  C:\Windows\System\GlPQgcz.exe
  2⤵
  PID:4016
- C:\Windows\System\FivExDx.exe
  C:\Windows\System\FivExDx.exe
  2⤵
  PID:4036
- C:\Windows\System\CJjOSXu.exe
  C:\Windows\System\CJjOSXu.exe
  2⤵
  PID:4056
- C:\Windows\System\kgXpemD.exe
  C:\Windows\System\kgXpemD.exe
  2⤵
  PID:4076
- C:\Windows\System\ZgspiqX.exe
  C:\Windows\System\ZgspiqX.exe
  2⤵
  PID:2220
- C:\Windows\System\GTzAPEN.exe
  C:\Windows\System\GTzAPEN.exe
  2⤵
  PID:3084
- C:\Windows\System\MJrOyjC.exe
  C:\Windows\System\MJrOyjC.exe
  2⤵
  PID:2980
- C:\Windows\System\YiKfyss.exe
  C:\Windows\System\YiKfyss.exe
  2⤵
  PID:2704
- C:\Windows\System\lFMefzi.exe
  C:\Windows\System\lFMefzi.exe
  2⤵
  PID:1940
- C:\Windows\System\SALKYTs.exe
  C:\Windows\System\SALKYTs.exe
  2⤵
  PID:852
- C:\Windows\System\BsQzsPK.exe
  C:\Windows\System\BsQzsPK.exe
  2⤵
  PID:1308
- C:\Windows\System\czLllBd.exe
  C:\Windows\System\czLllBd.exe
  2⤵
  PID:964
- C:\Windows\System\GcsterN.exe
  C:\Windows\System\GcsterN.exe
  2⤵
  PID:928
- C:\Windows\System\lOCVWQM.exe
  C:\Windows\System\lOCVWQM.exe
  2⤵
  PID:2064
- C:\Windows\System\oFYscju.exe
  C:\Windows\System\oFYscju.exe
  2⤵
  PID:1316
- C:\Windows\System\oMgfjzR.exe
  C:\Windows\System\oMgfjzR.exe
  2⤵
  PID:3176
- C:\Windows\System\TAzTikK.exe
  C:\Windows\System\TAzTikK.exe
  2⤵
  PID:3212
- C:\Windows\System\geLeFJh.exe
  C:\Windows\System\geLeFJh.exe
  2⤵
  PID:2464
- C:\Windows\System\WWuTzXx.exe
  C:\Windows\System\WWuTzXx.exe
  2⤵
  PID:764
- C:\Windows\System\MZUIdsa.exe
  C:\Windows\System\MZUIdsa.exe
  2⤵
  PID:2344
- C:\Windows\System\EHzdcvE.exe
  C:\Windows\System\EHzdcvE.exe
  2⤵
  PID:3520
- C:\Windows\System\iutPliH.exe
  C:\Windows\System\iutPliH.exe
  2⤵
  PID:3532
- C:\Windows\System\IMaxOJE.exe
  C:\Windows\System\IMaxOJE.exe
  2⤵
  PID:2840
- C:\Windows\System\TrUzhcV.exe
  C:\Windows\System\TrUzhcV.exe
  2⤵
  PID:3600
- C:\Windows\System\LyMrDdg.exe
  C:\Windows\System\LyMrDdg.exe
  2⤵
  PID:2016
- C:\Windows\System\ZStUVHs.exe
  C:\Windows\System\ZStUVHs.exe
  2⤵
  PID:1672
- C:\Windows\System\KaWIyFF.exe
  C:\Windows\System\KaWIyFF.exe
  2⤵
  PID:3248
- C:\Windows\System\obUGYbv.exe
  C:\Windows\System\obUGYbv.exe
  2⤵
  PID:1512
- C:\Windows\System\pgbCBOH.exe
  C:\Windows\System\pgbCBOH.exe
  2⤵
  PID:3640
- C:\Windows\System\NtkWHOd.exe
  C:\Windows\System\NtkWHOd.exe
  2⤵
  PID:2612
- C:\Windows\System\GEewUEU.exe
  C:\Windows\System\GEewUEU.exe
  2⤵
  PID:2148
- C:\Windows\System\KiZFUvA.exe
  C:\Windows\System\KiZFUvA.exe
  2⤵
  PID:1096
- C:\Windows\System\SDqbjdy.exe
  C:\Windows\System\SDqbjdy.exe
  2⤵
  PID:2252
- C:\Windows\System\gpxrIXs.exe
  C:\Windows\System\gpxrIXs.exe
  2⤵
  PID:2556
- C:\Windows\System\TFBGMSU.exe
  C:\Windows\System\TFBGMSU.exe
  2⤵
  PID:496
- C:\Windows\System\DcUIlHW.exe
  C:\Windows\System\DcUIlHW.exe
  2⤵
  PID:3564
- C:\Windows\System\UavGaJi.exe
  C:\Windows\System\UavGaJi.exe
  2⤵
  PID:3100
- C:\Windows\System\BWSzmgJ.exe
  C:\Windows\System\BWSzmgJ.exe
  2⤵
  PID:3164
- C:\Windows\System\DzHjmTK.exe
  C:\Windows\System\DzHjmTK.exe
  2⤵
  PID:3616
- C:\Windows\System\QZoNuID.exe
  C:\Windows\System\QZoNuID.exe
  2⤵
  PID:3228
- C:\Windows\System\XcHvLMJ.exe
  C:\Windows\System\XcHvLMJ.exe
  2⤵
  PID:1876
- C:\Windows\System\DfpfneT.exe
  C:\Windows\System\DfpfneT.exe
  2⤵
  PID:1496
- C:\Windows\System\XRlXMjY.exe
  C:\Windows\System\XRlXMjY.exe
  2⤵
  PID:3672
- C:\Windows\System\yeTqKQS.exe
  C:\Windows\System\yeTqKQS.exe
  2⤵
  PID:2688
- C:\Windows\System\XkvkBIK.exe
  C:\Windows\System\XkvkBIK.exe
  2⤵
  PID:3500
- C:\Windows\System\EdMiOwR.exe
  C:\Windows\System\EdMiOwR.exe
  2⤵
  PID:1712
- C:\Windows\System\bhPtXjs.exe
  C:\Windows\System\bhPtXjs.exe
  2⤵
  PID:3260
- C:\Windows\System\xXlulRu.exe
  C:\Windows\System\xXlulRu.exe
  2⤵
  PID:3280
- C:\Windows\System\Lpbpmuv.exe
  C:\Windows\System\Lpbpmuv.exe
  2⤵
  PID:3296
- C:\Windows\System\RCzjlPJ.exe
  C:\Windows\System\RCzjlPJ.exe
  2⤵
  PID:3312
- C:\Windows\System\YwkXyxS.exe
  C:\Windows\System\YwkXyxS.exe
  2⤵
  PID:3332
- C:\Windows\System\UmlrcGw.exe
  C:\Windows\System\UmlrcGw.exe
  2⤵
  PID:3348
- C:\Windows\System\nzSpmdf.exe
  C:\Windows\System\nzSpmdf.exe
  2⤵
  PID:3364
- C:\Windows\System\NftyPSA.exe
  C:\Windows\System\NftyPSA.exe
  2⤵
  PID:3436
- C:\Windows\System\RDUoefN.exe
  C:\Windows\System\RDUoefN.exe
  2⤵
  PID:1720
- C:\Windows\System\NHAIcyy.exe
  C:\Windows\System\NHAIcyy.exe
  2⤵
  PID:3032
- C:\Windows\System\zWrBbfj.exe
  C:\Windows\System\zWrBbfj.exe
  2⤵
  PID:3712
- C:\Windows\System\VaiyybB.exe
  C:\Windows\System\VaiyybB.exe
  2⤵
  PID:3744
- C:\Windows\System\LkcflkQ.exe
  C:\Windows\System\LkcflkQ.exe
  2⤵
  PID:3748
- C:\Windows\System\hdAlKRZ.exe
  C:\Windows\System\hdAlKRZ.exe
  2⤵
  PID:3788
- C:\Windows\System\eDWDXtQ.exe
  C:\Windows\System\eDWDXtQ.exe
  2⤵
  PID:3824
- C:\Windows\System\kzPYVzz.exe
  C:\Windows\System\kzPYVzz.exe
  2⤵
  PID:3828
- C:\Windows\System\AKCTvgY.exe
  C:\Windows\System\AKCTvgY.exe
  2⤵
  PID:3884
- C:\Windows\System\XCTcDoa.exe
  C:\Windows\System\XCTcDoa.exe
  2⤵
  PID:3904
- C:\Windows\System\tNoekkR.exe
  C:\Windows\System\tNoekkR.exe
  2⤵
  PID:3912
- C:\Windows\System\XRkYjLo.exe
  C:\Windows\System\XRkYjLo.exe
  2⤵
  PID:3964
- C:\Windows\System\KnJwWuX.exe
  C:\Windows\System\KnJwWuX.exe
  2⤵
  PID:2740
- C:\Windows\System\OaJUwUd.exe
  C:\Windows\System\OaJUwUd.exe
  2⤵
  PID:2512
- C:\Windows\System\UvHLLqO.exe
  C:\Windows\System\UvHLLqO.exe
  2⤵
  PID:4012
- C:\Windows\System\YwqZJKK.exe
  C:\Windows\System\YwqZJKK.exe
  2⤵
  PID:2568
- C:\Windows\System\NWlyVyH.exe
  C:\Windows\System\NWlyVyH.exe
  2⤵
  PID:4024
- C:\Windows\System\EYyDBUD.exe
  C:\Windows\System\EYyDBUD.exe
  2⤵
  PID:4048
- C:\Windows\System\qdbanoi.exe
  C:\Windows\System\qdbanoi.exe
  2⤵
  PID:4092
- C:\Windows\System\ujvoxgF.exe
  C:\Windows\System\ujvoxgF.exe
  2⤵
  PID:3052
- C:\Windows\System\PrixITf.exe
  C:\Windows\System\PrixITf.exe
  2⤵
  PID:3144
- C:\Windows\System\dcpFFnu.exe
  C:\Windows\System\dcpFFnu.exe
  2⤵
  PID:2040
- C:\Windows\System\WIbHbpx.exe
  C:\Windows\System\WIbHbpx.exe
  2⤵
  PID:1868
- C:\Windows\System\qLGhiaa.exe
  C:\Windows\System\qLGhiaa.exe
  2⤵
  PID:2516
- C:\Windows\System\pkTyeaA.exe
  C:\Windows\System\pkTyeaA.exe
  2⤵
  PID:3440
- C:\Windows\System\bRUleSQ.exe
  C:\Windows\System\bRUleSQ.exe
  2⤵
  PID:2852
- C:\Windows\System\XNRmmIR.exe
  C:\Windows\System\XNRmmIR.exe
  2⤵
  PID:688
- C:\Windows\System\MNFTaoA.exe
  C:\Windows\System\MNFTaoA.exe
  2⤵
  PID:1392
- C:\Windows\System\ADkvOye.exe
  C:\Windows\System\ADkvOye.exe
  2⤵
  PID:2856
- C:\Windows\System\HNsNRae.exe
  C:\Windows\System\HNsNRae.exe
  2⤵
  PID:1516
- C:\Windows\System\gTIgXbO.exe
  C:\Windows\System\gTIgXbO.exe
  2⤵
  PID:916
- C:\Windows\System\DqcmfVx.exe
  C:\Windows\System\DqcmfVx.exe
  2⤵
  PID:1544
- C:\Windows\System\YJEiAid.exe
  C:\Windows\System\YJEiAid.exe
  2⤵
  PID:3624
- C:\Windows\System\cYKLFWu.exe
  C:\Windows\System\cYKLFWu.exe
  2⤵
  PID:3236
- C:\Windows\System\ZABRcOy.exe
  C:\Windows\System\ZABRcOy.exe
  2⤵
  PID:3240
- C:\Windows\System\uTERQZk.exe
  C:\Windows\System\uTERQZk.exe
  2⤵
  PID:3476
- C:\Windows\System\BdrHINh.exe
  C:\Windows\System\BdrHINh.exe
  2⤵
  PID:3264
- C:\Windows\System\fHAdaeA.exe
  C:\Windows\System\fHAdaeA.exe
  2⤵
  PID:3320
- C:\Windows\System\LlJSUQG.exe
  C:\Windows\System\LlJSUQG.exe
  2⤵
  PID:3360
- C:\Windows\System\cPgglUw.exe
  C:\Windows\System\cPgglUw.exe
  2⤵
  PID:2200
- C:\Windows\System\dKsokcu.exe
  C:\Windows\System\dKsokcu.exe
  2⤵
  PID:3724
- C:\Windows\System\mngoEeb.exe
  C:\Windows\System\mngoEeb.exe
  2⤵
  PID:3708
- C:\Windows\System\zXCdViQ.exe
  C:\Windows\System\zXCdViQ.exe
  2⤵
  PID:3792
- C:\Windows\System\tikSiix.exe
  C:\Windows\System\tikSiix.exe
  2⤵
  PID:3344
- C:\Windows\System\JQAZYnX.exe
  C:\Windows\System\JQAZYnX.exe
  2⤵
  PID:3392
- C:\Windows\System\FAIpQIe.exe
  C:\Windows\System\FAIpQIe.exe
  2⤵
  PID:3408
- C:\Windows\System\HghvIuR.exe
  C:\Windows\System\HghvIuR.exe
  2⤵
  PID:3868
- C:\Windows\System\kiYiFeJ.exe
  C:\Windows\System\kiYiFeJ.exe
  2⤵
  PID:3992
- C:\Windows\System\DefTZJB.exe
  C:\Windows\System\DefTZJB.exe
  2⤵
  PID:4032
- C:\Windows\System\AoNTomY.exe
  C:\Windows\System\AoNTomY.exe
  2⤵
  PID:3872
- C:\Windows\System\wqjJHLg.exe
  C:\Windows\System\wqjJHLg.exe
  2⤵
  PID:3932
- C:\Windows\System\UmwhnQk.exe
  C:\Windows\System\UmwhnQk.exe
  2⤵
  PID:4052
- C:\Windows\System\pOWZBvl.exe
  C:\Windows\System\pOWZBvl.exe
  2⤵
  PID:2336
- C:\Windows\System\BnVikjJ.exe
  C:\Windows\System\BnVikjJ.exe
  2⤵
  PID:2744
- C:\Windows\System\BsfzBcn.exe
  C:\Windows\System\BsfzBcn.exe
  2⤵
  PID:2296
- C:\Windows\System\czJnplF.exe
  C:\Windows\System\czJnplF.exe
  2⤵
  PID:3548
- C:\Windows\System\GwDjzbr.exe
  C:\Windows\System\GwDjzbr.exe
  2⤵
  PID:3276
- C:\Windows\System\QjVcJlh.exe
  C:\Windows\System\QjVcJlh.exe
  2⤵
  PID:3388
- C:\Windows\System\HbwBoWm.exe
  C:\Windows\System\HbwBoWm.exe
  2⤵
  PID:4088
- C:\Windows\System\hLmSmxW.exe
  C:\Windows\System\hLmSmxW.exe
  2⤵
  PID:3132
- C:\Windows\System\FxywsGJ.exe
  C:\Windows\System\FxywsGJ.exe
  2⤵
  PID:3256
- C:\Windows\System\jfyrUXr.exe
  C:\Windows\System\jfyrUXr.exe
  2⤵
  PID:3560
- C:\Windows\System\AKqHGtd.exe
  C:\Windows\System\AKqHGtd.exe
  2⤵
  PID:2620
- C:\Windows\System\zqToedV.exe
  C:\Windows\System\zqToedV.exe
  2⤵
  PID:2532
- C:\Windows\System\sOQsMnE.exe
  C:\Windows\System\sOQsMnE.exe
  2⤵
  PID:1604
- C:\Windows\System\EubKnZR.exe
  C:\Windows\System\EubKnZR.exe
  2⤵
  PID:2388
- C:\Windows\System\wVWhYTE.exe
  C:\Windows\System\wVWhYTE.exe
  2⤵
  PID:1780
- C:\Windows\System\zXMfQHa.exe
  C:\Windows\System\zXMfQHa.exe
  2⤵
  PID:1964
- C:\Windows\System\DyPWknI.exe
  C:\Windows\System\DyPWknI.exe
  2⤵
  PID:2944
- C:\Windows\System\RYRhOBr.exe
  C:\Windows\System\RYRhOBr.exe
  2⤵
  PID:1752
- C:\Windows\System\TRtUxxd.exe
  C:\Windows\System\TRtUxxd.exe
  2⤵
  PID:2684
- C:\Windows\System\mHXAXcv.exe
  C:\Windows\System\mHXAXcv.exe
  2⤵
  PID:3208
- C:\Windows\System\UdgkaxS.exe
  C:\Windows\System\UdgkaxS.exe
  2⤵
  PID:4072
- C:\Windows\System\DeRDdzA.exe
  C:\Windows\System\DeRDdzA.exe
  2⤵
  PID:3048
- C:\Windows\System\UKMNZGE.exe
  C:\Windows\System\UKMNZGE.exe
  2⤵
  PID:3196
- C:\Windows\System\LkJdNdA.exe
  C:\Windows\System\LkJdNdA.exe
  2⤵
  PID:3372
- C:\Windows\System\fIwNNBw.exe
  C:\Windows\System\fIwNNBw.exe
  2⤵
  PID:3004
- C:\Windows\System\XHzQfMk.exe
  C:\Windows\System\XHzQfMk.exe
  2⤵
  PID:1568
- C:\Windows\System\zwAAmnJ.exe
  C:\Windows\System\zwAAmnJ.exe
  2⤵
  PID:3596
- C:\Windows\System\rYjwWkr.exe
  C:\Windows\System\rYjwWkr.exe
  2⤵
  PID:960
- C:\Windows\System\gjHoFkJ.exe
  C:\Windows\System\gjHoFkJ.exe
  2⤵
  PID:2488
- C:\Windows\System\WEkOnsa.exe
  C:\Windows\System\WEkOnsa.exe
  2⤵
  PID:560
- C:\Windows\System\ycFirjX.exe
  C:\Windows\System\ycFirjX.exe
  2⤵
  PID:4104
- C:\Windows\System\ABSSzyc.exe
  C:\Windows\System\ABSSzyc.exe
  2⤵
  PID:4120
- C:\Windows\System\dTVGiDk.exe
  C:\Windows\System\dTVGiDk.exe
  2⤵
  PID:4136
- C:\Windows\System\xYKWNfR.exe
  C:\Windows\System\xYKWNfR.exe
  2⤵
  PID:4152
- C:\Windows\System\yZYQCnI.exe
  C:\Windows\System\yZYQCnI.exe
  2⤵
  PID:4168
- C:\Windows\System\QScskRN.exe
  C:\Windows\System\QScskRN.exe
  2⤵
  PID:4184
- C:\Windows\System\hEeokHT.exe
  C:\Windows\System\hEeokHT.exe
  2⤵
  PID:4204
- C:\Windows\System\eoGPkug.exe
  C:\Windows\System\eoGPkug.exe
  2⤵
  PID:4220
- C:\Windows\System\xLWyzRZ.exe
  C:\Windows\System\xLWyzRZ.exe
  2⤵
  PID:4236
- C:\Windows\System\bUGpPAs.exe
  C:\Windows\System\bUGpPAs.exe
  2⤵
  PID:4252
- C:\Windows\System\zJjyjpX.exe
  C:\Windows\System\zJjyjpX.exe
  2⤵
  PID:4300
- C:\Windows\System\MpIktCo.exe
  C:\Windows\System\MpIktCo.exe
  2⤵
  PID:4336
- C:\Windows\System\hlQBUTk.exe
  C:\Windows\System\hlQBUTk.exe
  2⤵
  PID:4352
- C:\Windows\System\OPlwQAi.exe
  C:\Windows\System\OPlwQAi.exe
  2⤵
  PID:4368
- C:\Windows\System\qyWpPaT.exe
  C:\Windows\System\qyWpPaT.exe
  2⤵
  PID:4384
- C:\Windows\System\lMlpfMn.exe
  C:\Windows\System\lMlpfMn.exe
  2⤵
  PID:4400
- C:\Windows\System\FqNEKRi.exe
  C:\Windows\System\FqNEKRi.exe
  2⤵
  PID:4416
- C:\Windows\System\JZOkIlu.exe
  C:\Windows\System\JZOkIlu.exe
  2⤵
  PID:4432
- C:\Windows\System\svBoUkV.exe
  C:\Windows\System\svBoUkV.exe
  2⤵
  PID:4448
- C:\Windows\System\RqJdZTv.exe
  C:\Windows\System\RqJdZTv.exe
  2⤵
  PID:4464
- C:\Windows\System\GUmsGex.exe
  C:\Windows\System\GUmsGex.exe
  2⤵
  PID:4480
- C:\Windows\System\wLNcWrq.exe
  C:\Windows\System\wLNcWrq.exe
  2⤵
  PID:4496
- C:\Windows\System\LxKOonB.exe
  C:\Windows\System\LxKOonB.exe
  2⤵
  PID:4512
- C:\Windows\System\uOtrEYF.exe
  C:\Windows\System\uOtrEYF.exe
  2⤵
  PID:4528
- C:\Windows\System\fgSVfRw.exe
  C:\Windows\System\fgSVfRw.exe
  2⤵
  PID:4544
- C:\Windows\System\VfvKQEA.exe
  C:\Windows\System\VfvKQEA.exe
  2⤵
  PID:4560
- C:\Windows\System\kyBrGsG.exe
  C:\Windows\System\kyBrGsG.exe
  2⤵
  PID:4576
- C:\Windows\System\pEPvHTA.exe
  C:\Windows\System\pEPvHTA.exe
  2⤵
  PID:4592
- C:\Windows\System\DdYcdnn.exe
  C:\Windows\System\DdYcdnn.exe
  2⤵
  PID:4608
- C:\Windows\System\TpfdEUy.exe
  C:\Windows\System\TpfdEUy.exe
  2⤵
  PID:4624
- C:\Windows\System\GinflZK.exe
  C:\Windows\System\GinflZK.exe
  2⤵
  PID:4640
- C:\Windows\System\HirDlgd.exe
  C:\Windows\System\HirDlgd.exe
  2⤵
  PID:4656
- C:\Windows\System\ncjEwRw.exe
  C:\Windows\System\ncjEwRw.exe
  2⤵
  PID:4672
- C:\Windows\System\XQvIXEM.exe
  C:\Windows\System\XQvIXEM.exe
  2⤵
  PID:4688
- C:\Windows\System\wuUxdLq.exe
  C:\Windows\System\wuUxdLq.exe
  2⤵
  PID:4704
- C:\Windows\System\mjWPvrd.exe
  C:\Windows\System\mjWPvrd.exe
  2⤵
  PID:4720
- C:\Windows\System\szotwwo.exe
  C:\Windows\System\szotwwo.exe
  2⤵
  PID:4736
- C:\Windows\System\sbnomSx.exe
  C:\Windows\System\sbnomSx.exe
  2⤵
  PID:4752
- C:\Windows\System\rUBacdD.exe
  C:\Windows\System\rUBacdD.exe
  2⤵
  PID:4768
- C:\Windows\System\UUyNMRs.exe
  C:\Windows\System\UUyNMRs.exe
  2⤵
  PID:4784
- C:\Windows\System\XMxGvpb.exe
  C:\Windows\System\XMxGvpb.exe
  2⤵
  PID:4800
- C:\Windows\System\DQZnTlW.exe
  C:\Windows\System\DQZnTlW.exe
  2⤵
  PID:4816
- C:\Windows\System\qZaQZPL.exe
  C:\Windows\System\qZaQZPL.exe
  2⤵
  PID:4832
- C:\Windows\System\YJEQQqA.exe
  C:\Windows\System\YJEQQqA.exe
  2⤵
  PID:4908
- C:\Windows\System\onxwdBq.exe
  C:\Windows\System\onxwdBq.exe
  2⤵
  PID:4924
- C:\Windows\System\WrWCUMb.exe
  C:\Windows\System\WrWCUMb.exe
  2⤵
  PID:4944
- C:\Windows\System\tVjpfKu.exe
  C:\Windows\System\tVjpfKu.exe
  2⤵
  PID:4960
- C:\Windows\System\MLzOJpY.exe
  C:\Windows\System\MLzOJpY.exe
  2⤵
  PID:4976
- C:\Windows\System\EdwmFhH.exe
  C:\Windows\System\EdwmFhH.exe
  2⤵
  PID:4992
- C:\Windows\System\EpiCSEs.exe
  C:\Windows\System\EpiCSEs.exe
  2⤵
  PID:5008
- C:\Windows\System\ODgPBbL.exe
  C:\Windows\System\ODgPBbL.exe
  2⤵
  PID:5024
- C:\Windows\System\oQIlfEa.exe
  C:\Windows\System\oQIlfEa.exe
  2⤵
  PID:5040
- C:\Windows\System\cZvsylG.exe
  C:\Windows\System\cZvsylG.exe
  2⤵
  PID:5056
- C:\Windows\System\kwVWmtj.exe
  C:\Windows\System\kwVWmtj.exe
  2⤵
  PID:5072
- C:\Windows\System\rDmKIZW.exe
  C:\Windows\System\rDmKIZW.exe
  2⤵
  PID:5092
- C:\Windows\System\QAhlZWC.exe
  C:\Windows\System\QAhlZWC.exe
  2⤵
  PID:5108
- C:\Windows\System\pCUpevc.exe
  C:\Windows\System\pCUpevc.exe
  2⤵
  PID:3612
- C:\Windows\System\WMmEImh.exe
  C:\Windows\System\WMmEImh.exe
  2⤵
  PID:1660
- C:\Windows\System\pblpTkg.exe
  C:\Windows\System\pblpTkg.exe
  2⤵
  PID:1552
- C:\Windows\System\rNstXFh.exe
  C:\Windows\System\rNstXFh.exe
  2⤵
  PID:3784
- C:\Windows\System\LQuPJYn.exe
  C:\Windows\System\LQuPJYn.exe
  2⤵
  PID:1804
- C:\Windows\System\vFFmKST.exe
  C:\Windows\System\vFFmKST.exe
  2⤵
  PID:1332
- C:\Windows\System\KtwYRrk.exe
  C:\Windows\System\KtwYRrk.exe
  2⤵
  PID:3352
- C:\Windows\System\IODsfYA.exe
  C:\Windows\System\IODsfYA.exe
  2⤵
  PID:1008
- C:\Windows\System\gYzscXO.exe
  C:\Windows\System\gYzscXO.exe
  2⤵
  PID:2000
- C:\Windows\System\lcFWqnE.exe
  C:\Windows\System\lcFWqnE.exe
  2⤵
  PID:3460
- C:\Windows\System\IKGCDDc.exe
  C:\Windows\System\IKGCDDc.exe
  2⤵
  PID:2680
- C:\Windows\System\oVHvKtW.exe
  C:\Windows\System\oVHvKtW.exe
  2⤵
  PID:2724
- C:\Windows\System\wpPsnte.exe
  C:\Windows\System\wpPsnte.exe
  2⤵
  PID:2760
- C:\Windows\System\jLrCcwG.exe
  C:\Windows\System\jLrCcwG.exe
  2⤵
  PID:4380
- C:\Windows\System\IXpsjxE.exe
  C:\Windows\System\IXpsjxE.exe
  2⤵
  PID:4360
- C:\Windows\System\yJykIeT.exe
  C:\Windows\System\yJykIeT.exe
  2⤵
  PID:2764
- C:\Windows\System\RgOckxb.exe
  C:\Windows\System\RgOckxb.exe
  2⤵
  PID:4428
- C:\Windows\System\JDSctrO.exe
  C:\Windows\System\JDSctrO.exe
  2⤵
  PID:864
- C:\Windows\System\zhHHwAL.exe
  C:\Windows\System\zhHHwAL.exe
  2⤵
  PID:4552
- C:\Windows\System\JsvjukL.exe
  C:\Windows\System\JsvjukL.exe
  2⤵
  PID:2860
- C:\Windows\System\aWtiIfp.exe
  C:\Windows\System\aWtiIfp.exe
  2⤵
  PID:4584
- C:\Windows\System\ILXVTXz.exe
  C:\Windows\System\ILXVTXz.exe
  2⤵
  PID:4668
- C:\Windows\System\rQLISAf.exe
  C:\Windows\System\rQLISAf.exe
  2⤵
  PID:4600
- C:\Windows\System\gCWjcuz.exe
  C:\Windows\System\gCWjcuz.exe
  2⤵
  PID:4764
- C:\Windows\System\AgpfADn.exe
  C:\Windows\System\AgpfADn.exe
  2⤵
  PID:4616
- C:\Windows\System\oywbprR.exe
  C:\Windows\System\oywbprR.exe
  2⤵
  PID:4744
- C:\Windows\System\oCkJrTA.exe
  C:\Windows\System\oCkJrTA.exe
  2⤵
  PID:4780
- C:\Windows\System\BusyYzL.exe
  C:\Windows\System\BusyYzL.exe
  2⤵
  PID:4684
- C:\Windows\System\lhEmOdY.exe
  C:\Windows\System\lhEmOdY.exe
  2⤵
  PID:4840
- C:\Windows\System\VeoElSU.exe
  C:\Windows\System\VeoElSU.exe
  2⤵
  PID:4856
- C:\Windows\System\nwIBxzR.exe
  C:\Windows\System\nwIBxzR.exe
  2⤵
  PID:4872
- C:\Windows\System\nscIFjn.exe
  C:\Windows\System\nscIFjn.exe
  2⤵
  PID:4884
- C:\Windows\System\tZZlbnp.exe
  C:\Windows\System\tZZlbnp.exe
  2⤵
  PID:4916
- C:\Windows\System\jlpjzro.exe
  C:\Windows\System\jlpjzro.exe
  2⤵
  PID:4920
- C:\Windows\System\kSGVfxM.exe
  C:\Windows\System\kSGVfxM.exe
  2⤵
  PID:2436
- C:\Windows\System\AYWbTQU.exe
  C:\Windows\System\AYWbTQU.exe
  2⤵
  PID:4116
- C:\Windows\System\LLOPNcS.exe
  C:\Windows\System\LLOPNcS.exe
  2⤵
  PID:1580
- C:\Windows\System\nVkfAaK.exe
  C:\Windows\System\nVkfAaK.exe
  2⤵
  PID:2768
- C:\Windows\System\zNCRJAM.exe
  C:\Windows\System\zNCRJAM.exe
  2⤵
  PID:2644
- C:\Windows\System\MtsbcOt.exe
  C:\Windows\System\MtsbcOt.exe
  2⤵
  PID:2920
- C:\Windows\System\VKjcpRi.exe
  C:\Windows\System\VKjcpRi.exe
  2⤵
  PID:2308
- C:\Windows\System\hTClMxc.exe
  C:\Windows\System\hTClMxc.exe
  2⤵
  PID:3292
- C:\Windows\System\jYclPsi.exe
  C:\Windows\System\jYclPsi.exe
  2⤵
  PID:3652
- C:\Windows\System\asyKKOS.exe
  C:\Windows\System\asyKKOS.exe
  2⤵
  PID:4128
- C:\Windows\System\AjMXRhY.exe
  C:\Windows\System\AjMXRhY.exe
  2⤵
  PID:4196
- C:\Windows\System\lFcPyXp.exe
  C:\Windows\System\lFcPyXp.exe
  2⤵
  PID:4268
- C:\Windows\System\znYWVxN.exe
  C:\Windows\System\znYWVxN.exe
  2⤵
  PID:4212
- C:\Windows\System\EAYmhtj.exe
  C:\Windows\System\EAYmhtj.exe
  2⤵
  PID:4408
- C:\Windows\System\FWSgSuy.exe
  C:\Windows\System\FWSgSuy.exe
  2⤵
  PID:4344
- C:\Windows\System\YuPklbO.exe
  C:\Windows\System\YuPklbO.exe
  2⤵
  PID:4376
- C:\Windows\System\sKvvwQd.exe
  C:\Windows\System\sKvvwQd.exe
  2⤵
  PID:4444
- C:\Windows\System\TjlZBAO.exe
  C:\Windows\System\TjlZBAO.exe
  2⤵
  PID:592
- C:\Windows\System\ymAUuVQ.exe
  C:\Windows\System\ymAUuVQ.exe
  2⤵
  PID:4572
- C:\Windows\System\FqUPkvg.exe
  C:\Windows\System\FqUPkvg.exe
  2⤵
  PID:4852
- C:\Windows\System\VhqHLXd.exe
  C:\Windows\System\VhqHLXd.exe
  2⤵
  PID:4632
- C:\Windows\System\ACAlRCO.exe
  C:\Windows\System\ACAlRCO.exe
  2⤵
  PID:4940
- C:\Windows\System\zBisAer.exe
  C:\Windows\System\zBisAer.exe
  2⤵
  PID:2420
- C:\Windows\System\sqHedPJ.exe
  C:\Windows\System\sqHedPJ.exe
  2⤵
  PID:4868
- C:\Windows\System\XVyDhCn.exe
  C:\Windows\System\XVyDhCn.exe
  2⤵
  PID:4652
- C:\Windows\System\ugEbQkU.exe
  C:\Windows\System\ugEbQkU.exe
  2⤵
  PID:4824
- C:\Windows\System\GwRTOdS.exe
  C:\Windows\System\GwRTOdS.exe
  2⤵
  PID:4896
- C:\Windows\System\TUZbxeb.exe
  C:\Windows\System\TUZbxeb.exe
  2⤵
  PID:4932
- C:\Windows\System\IufWsqj.exe
  C:\Windows\System\IufWsqj.exe
  2⤵
  PID:4968
- C:\Windows\System\FByCUZg.exe
  C:\Windows\System\FByCUZg.exe
  2⤵
  PID:5032
- C:\Windows\System\IfvGzpK.exe
  C:\Windows\System\IfvGzpK.exe
  2⤵
  PID:5100
- C:\Windows\System\sPeYnkA.exe
  C:\Windows\System\sPeYnkA.exe
  2⤵
  PID:5020
- C:\Windows\System\PHoATnY.exe
  C:\Windows\System\PHoATnY.exe
  2⤵
  PID:5016
- C:\Windows\System\pzJnvxY.exe
  C:\Windows\System\pzJnvxY.exe
  2⤵
  PID:5116
- C:\Windows\System\YqbGxpC.exe
  C:\Windows\System\YqbGxpC.exe
  2⤵
  PID:1816
- C:\Windows\System\jZccwkG.exe
  C:\Windows\System\jZccwkG.exe
  2⤵
  PID:4160
- C:\Windows\System\rqtEZQy.exe
  C:\Windows\System\rqtEZQy.exe
  2⤵
  PID:988
- C:\Windows\System\jbUByoK.exe
  C:\Windows\System\jbUByoK.exe
  2⤵
  PID:332
- C:\Windows\System\tElOKen.exe
  C:\Windows\System\tElOKen.exe
  2⤵
  PID:4100
- C:\Windows\System\gmLfdiJ.exe
  C:\Windows\System\gmLfdiJ.exe
  2⤵
  PID:4148
- C:\Windows\System\gjhKHgc.exe
  C:\Windows\System\gjhKHgc.exe
  2⤵
  PID:4180
- C:\Windows\System\FRMyDpR.exe
  C:\Windows\System\FRMyDpR.exe
  2⤵
  PID:4248
- C:\Windows\System\dnTfIfl.exe
  C:\Windows\System\dnTfIfl.exe
  2⤵
  PID:4524
- C:\Windows\System\qyBnLXo.exe
  C:\Windows\System\qyBnLXo.exe
  2⤵
  PID:4440
- C:\Windows\System\Fffsmev.exe
  C:\Windows\System\Fffsmev.exe
  2⤵
  PID:4936
- C:\Windows\System\mIcDTOS.exe
  C:\Windows\System\mIcDTOS.exe
  2⤵
  PID:3404
- C:\Windows\System\BafKmjH.exe
  C:\Windows\System\BafKmjH.exe
  2⤵
  PID:5084
- C:\Windows\System\pfGAskK.exe
  C:\Windows\System\pfGAskK.exe
  2⤵
  PID:2984
- C:\Windows\System\zPBAKvD.exe
  C:\Windows\System\zPBAKvD.exe
  2⤵
  PID:2240
- C:\Windows\System\ogVnLZY.exe
  C:\Windows\System\ogVnLZY.exe
  2⤵
  PID:3752
- C:\Windows\System\wAbVSDG.exe
  C:\Windows\System\wAbVSDG.exe
  2⤵
  PID:2972
- C:\Windows\System\YWPOsLs.exe
  C:\Windows\System\YWPOsLs.exe
  2⤵
  PID:2412
- C:\Windows\System\uREIuTt.exe
  C:\Windows\System\uREIuTt.exe
  2⤵
  PID:4192
- C:\Windows\System\OGNcHwL.exe
  C:\Windows\System\OGNcHwL.exe
  2⤵
  PID:2112
- C:\Windows\System\uKFYmOK.exe
  C:\Windows\System\uKFYmOK.exe
  2⤵
  PID:4272
- C:\Windows\System\ZstjGsW.exe
  C:\Windows\System\ZstjGsW.exe
  2⤵
  PID:4456
- C:\Windows\System\tTlZQTb.exe
  C:\Windows\System\tTlZQTb.exe
  2⤵
  PID:4860
- C:\Windows\System\QFIUzUV.exe
  C:\Windows\System\QFIUzUV.exe
  2⤵
  PID:4472
- C:\Windows\System\NVbrxfG.exe
  C:\Windows\System\NVbrxfG.exe
  2⤵
  PID:4332
- C:\Windows\System\aOwXDlV.exe
  C:\Windows\System\aOwXDlV.exe
  2⤵
  PID:4880
- C:\Windows\System\KyFZDBH.exe
  C:\Windows\System\KyFZDBH.exe
  2⤵
  PID:5052
- C:\Windows\System\xnLxaeh.exe
  C:\Windows\System\xnLxaeh.exe
  2⤵
  PID:5000
- C:\Windows\System\GpNLXyM.exe
  C:\Windows\System\GpNLXyM.exe
  2⤵
  PID:5088
- C:\Windows\System\EGgNfgK.exe
  C:\Windows\System\EGgNfgK.exe
  2⤵
  PID:3888
- C:\Windows\System\BgmmCyF.exe
  C:\Windows\System\BgmmCyF.exe
  2⤵
  PID:2340
- C:\Windows\System\SwtYXXZ.exe
  C:\Windows\System\SwtYXXZ.exe
  2⤵
  PID:4292
- C:\Windows\System\skxdvZL.exe
  C:\Windows\System\skxdvZL.exe
  2⤵
  PID:3628
- C:\Windows\System\kAeUINZ.exe
  C:\Windows\System\kAeUINZ.exe
  2⤵
  PID:3420
- C:\Windows\System\vlBYysg.exe
  C:\Windows\System\vlBYysg.exe
  2⤵
  PID:4828
- C:\Windows\System\xDOabkx.exe
  C:\Windows\System\xDOabkx.exe
  2⤵
  PID:4520
- C:\Windows\System\WsLFXDq.exe
  C:\Windows\System\WsLFXDq.exe
  2⤵
  PID:4792
- C:\Windows\System\xGIyBVX.exe
  C:\Windows\System\xGIyBVX.exe
  2⤵
  PID:4988
- C:\Windows\System\PgqkYYG.exe
  C:\Windows\System\PgqkYYG.exe
  2⤵
  PID:4732
- C:\Windows\System\tRjZyjG.exe
  C:\Windows\System\tRjZyjG.exe
  2⤵
  PID:4232
- C:\Windows\System\UWFIkNk.exe
  C:\Windows\System\UWFIkNk.exe
  2⤵
  PID:1992
- C:\Windows\System\ypOaIgg.exe
  C:\Windows\System\ypOaIgg.exe
  2⤵
  PID:1824
- C:\Windows\System\avavnfx.exe
  C:\Windows\System\avavnfx.exe
  2⤵
  PID:5124
- C:\Windows\System\puxdeJC.exe
  C:\Windows\System\puxdeJC.exe
  2⤵
  PID:5140
- C:\Windows\System\dwubHlm.exe
  C:\Windows\System\dwubHlm.exe
  2⤵
  PID:5160
- C:\Windows\System\wHhLwDt.exe
  C:\Windows\System\wHhLwDt.exe
  2⤵
  PID:5176
- C:\Windows\System\zxGiOdP.exe
  C:\Windows\System\zxGiOdP.exe
  2⤵
  PID:5192
- C:\Windows\System\ddpojTC.exe
  C:\Windows\System\ddpojTC.exe
  2⤵
  PID:5208
- C:\Windows\System\gzOYixI.exe
  C:\Windows\System\gzOYixI.exe
  2⤵
  PID:5224
- C:\Windows\System\xnWyrqw.exe
  C:\Windows\System\xnWyrqw.exe
  2⤵
  PID:5240
- C:\Windows\System\EcxOfGx.exe
  C:\Windows\System\EcxOfGx.exe
  2⤵
  PID:5260
- C:\Windows\System\yncQkKo.exe
  C:\Windows\System\yncQkKo.exe
  2⤵
  PID:5276
- C:\Windows\System\YtPAPct.exe
  C:\Windows\System\YtPAPct.exe
  2⤵
  PID:5292
- C:\Windows\System\ywpHBxb.exe
  C:\Windows\System\ywpHBxb.exe
  2⤵
  PID:5308
- C:\Windows\System\sRWvIWp.exe
  C:\Windows\System\sRWvIWp.exe
  2⤵
  PID:5324
- C:\Windows\System\CbHqCTK.exe
  C:\Windows\System\CbHqCTK.exe
  2⤵
  PID:5340
- C:\Windows\System\UYqdMWG.exe
  C:\Windows\System\UYqdMWG.exe
  2⤵
  PID:5356
- C:\Windows\System\LauICvu.exe
  C:\Windows\System\LauICvu.exe
  2⤵
  PID:5376
- C:\Windows\System\txQCUZK.exe
  C:\Windows\System\txQCUZK.exe
  2⤵
  PID:5392
- C:\Windows\System\nrJaKUB.exe
  C:\Windows\System\nrJaKUB.exe
  2⤵
  PID:5408
- C:\Windows\System\akisaqu.exe
  C:\Windows\System\akisaqu.exe
  2⤵
  PID:5424
- C:\Windows\System\IryBDsh.exe
  C:\Windows\System\IryBDsh.exe
  2⤵
  PID:5440
- C:\Windows\System\eSoyleH.exe
  C:\Windows\System\eSoyleH.exe
  2⤵
  PID:5456
- C:\Windows\System\CNlqYog.exe
  C:\Windows\System\CNlqYog.exe
  2⤵
  PID:5472
- C:\Windows\System\ZisUdTf.exe
  C:\Windows\System\ZisUdTf.exe
  2⤵
  PID:5552
- C:\Windows\System\ASWIYHC.exe
  C:\Windows\System\ASWIYHC.exe
  2⤵
  PID:5568
- C:\Windows\System\WsWljIV.exe
  C:\Windows\System\WsWljIV.exe
  2⤵
  PID:5584
- C:\Windows\System\GVzVvdk.exe
  C:\Windows\System\GVzVvdk.exe
  2⤵
  PID:5608
- C:\Windows\System\dkqaQDh.exe
  C:\Windows\System\dkqaQDh.exe
  2⤵
  PID:5624
- C:\Windows\System\edhqRvZ.exe
  C:\Windows\System\edhqRvZ.exe
  2⤵
  PID:5640
- C:\Windows\System\AuOoBMk.exe
  C:\Windows\System\AuOoBMk.exe
  2⤵
  PID:5656
- C:\Windows\System\FeEjaLB.exe
  C:\Windows\System\FeEjaLB.exe
  2⤵
  PID:5672
- C:\Windows\System\wCtxruD.exe
  C:\Windows\System\wCtxruD.exe
  2⤵
  PID:5692
- C:\Windows\System\JnXXVGV.exe
  C:\Windows\System\JnXXVGV.exe
  2⤵
  PID:5708
- C:\Windows\System\FXRaXxz.exe
  C:\Windows\System\FXRaXxz.exe
  2⤵
  PID:5728
- C:\Windows\System\UlnaFaI.exe
  C:\Windows\System\UlnaFaI.exe
  2⤵
  PID:5748
- C:\Windows\System\yMDKEPs.exe
  C:\Windows\System\yMDKEPs.exe
  2⤵
  PID:5820
- C:\Windows\System\wySpfHr.exe
  C:\Windows\System\wySpfHr.exe
  2⤵
  PID:5836
- C:\Windows\System\kkVQsPW.exe
  C:\Windows\System\kkVQsPW.exe
  2⤵
  PID:5852
- C:\Windows\System\NkMtBXX.exe
  C:\Windows\System\NkMtBXX.exe
  2⤵
  PID:5872
- C:\Windows\System\OAwEPbz.exe
  C:\Windows\System\OAwEPbz.exe
  2⤵
  PID:5888
- C:\Windows\System\EitZlCE.exe
  C:\Windows\System\EitZlCE.exe
  2⤵
  PID:5904
- C:\Windows\System\cXZCuik.exe
  C:\Windows\System\cXZCuik.exe
  2⤵
  PID:5940
- C:\Windows\System\KUFsdHL.exe
  C:\Windows\System\KUFsdHL.exe
  2⤵
  PID:5956
- C:\Windows\System\bMAyGwX.exe
  C:\Windows\System\bMAyGwX.exe
  2⤵
  PID:5972
- C:\Windows\System\MiORcaF.exe
  C:\Windows\System\MiORcaF.exe
  2⤵
  PID:5988
- C:\Windows\System\WHchgeK.exe
  C:\Windows\System\WHchgeK.exe
  2⤵
  PID:6004
- C:\Windows\System\uRrsYUQ.exe
  C:\Windows\System\uRrsYUQ.exe
  2⤵
  PID:6024
- C:\Windows\System\aeADvGg.exe
  C:\Windows\System\aeADvGg.exe
  2⤵
  PID:6040
- C:\Windows\System\wleNPoe.exe
  C:\Windows\System\wleNPoe.exe
  2⤵
  PID:6056
- C:\Windows\System\QdSGBSX.exe
  C:\Windows\System\QdSGBSX.exe
  2⤵
  PID:6072
- C:\Windows\System\HZJhhVC.exe
  C:\Windows\System\HZJhhVC.exe
  2⤵
  PID:6088
- C:\Windows\System\uGDaXgV.exe
  C:\Windows\System\uGDaXgV.exe
  2⤵
  PID:6104
- C:\Windows\System\YkdVjcS.exe
  C:\Windows\System\YkdVjcS.exe
  2⤵
  PID:4112
- C:\Windows\System\CwjugMD.exe
  C:\Windows\System\CwjugMD.exe
  2⤵
  PID:4144
- C:\Windows\System\msrVIkg.exe
  C:\Windows\System\msrVIkg.exe
  2⤵
  PID:5304
- C:\Windows\System\eLJPEGZ.exe
  C:\Windows\System\eLJPEGZ.exe
  2⤵
  PID:5236
- C:\Windows\System\lhKIWLU.exe
  C:\Windows\System\lhKIWLU.exe
  2⤵
  PID:5320
- C:\Windows\System\uwwwoXy.exe
  C:\Windows\System\uwwwoXy.exe
  2⤵
  PID:5468
- C:\Windows\System\aaJsTuY.exe
  C:\Windows\System\aaJsTuY.exe
  2⤵
  PID:5560
- C:\Windows\System\FWqIxDv.exe
  C:\Windows\System\FWqIxDv.exe
  2⤵
  PID:5604
- C:\Windows\System\pQOFnQL.exe
  C:\Windows\System\pQOFnQL.exe
  2⤵
  PID:5316
- C:\Windows\System\bSlmIRC.exe
  C:\Windows\System\bSlmIRC.exe
  2⤵
  PID:5484
- C:\Windows\System\qxLKCjH.exe
  C:\Windows\System\qxLKCjH.exe
  2⤵
  PID:5532
- C:\Windows\System\VXrrTKM.exe
  C:\Windows\System\VXrrTKM.exe
  2⤵
  PID:5168
- C:\Windows\System\AARgRpb.exe
  C:\Windows\System\AARgRpb.exe
  2⤵
  PID:5668
- C:\Windows\System\XnYFZTC.exe
  C:\Windows\System\XnYFZTC.exe
  2⤵
  PID:5504
- C:\Windows\System\SXbQMxA.exe
  C:\Windows\System\SXbQMxA.exe
  2⤵
  PID:5152
- C:\Windows\System\cylPryc.exe
  C:\Windows\System\cylPryc.exe
  2⤵
  PID:5528
- C:\Windows\System\OdGWoBJ.exe
  C:\Windows\System\OdGWoBJ.exe
  2⤵
  PID:5488
- C:\Windows\System\aHjbbnE.exe
  C:\Windows\System\aHjbbnE.exe
  2⤵
  PID:5580
- C:\Windows\System\ODZUtlf.exe
  C:\Windows\System\ODZUtlf.exe
  2⤵
  PID:5652
- C:\Windows\System\WLNOMpB.exe
  C:\Windows\System\WLNOMpB.exe
  2⤵
  PID:5716
- C:\Windows\System\Refxhyo.exe
  C:\Windows\System\Refxhyo.exe
  2⤵
  PID:5756
- C:\Windows\System\ZAQewvv.exe
  C:\Windows\System\ZAQewvv.exe
  2⤵
  PID:5764
- C:\Windows\System\PGwaNWp.exe
  C:\Windows\System\PGwaNWp.exe
  2⤵
  PID:5780
- C:\Windows\System\ntAQCRx.exe
  C:\Windows\System\ntAQCRx.exe
  2⤵
  PID:5796
- C:\Windows\System\fSZFtAy.exe
  C:\Windows\System\fSZFtAy.exe
  2⤵
  PID:5812
- C:\Windows\System\hsriNVo.exe
  C:\Windows\System\hsriNVo.exe
  2⤵
  PID:5880
- C:\Windows\System\pXiykPn.exe
  C:\Windows\System\pXiykPn.exe
  2⤵
  PID:5860
- C:\Windows\System\LPkrJHq.exe
  C:\Windows\System\LPkrJHq.exe
  2⤵
  PID:5900
- C:\Windows\System\rtFTSkl.exe
  C:\Windows\System\rtFTSkl.exe
  2⤵
  PID:5996
- C:\Windows\System\McBQQPm.exe
  C:\Windows\System\McBQQPm.exe
  2⤵
  PID:5912
- C:\Windows\System\isdRTDD.exe
  C:\Windows\System\isdRTDD.exe
  2⤵
  PID:6080
- C:\Windows\System\XJtAZIg.exe
  C:\Windows\System\XJtAZIg.exe
  2⤵
  PID:6116
- C:\Windows\System\HOhyQzk.exe
  C:\Windows\System\HOhyQzk.exe
  2⤵
  PID:5984
- C:\Windows\System\hAXIjeD.exe
  C:\Windows\System\hAXIjeD.exe
  2⤵
  PID:6052
- C:\Windows\System\VDZmZAO.exe
  C:\Windows\System\VDZmZAO.exe
  2⤵
  PID:6132
- C:\Windows\System\vcQunEl.exe
  C:\Windows\System\vcQunEl.exe
  2⤵
  PID:6140
- C:\Windows\System\GyAIAxF.exe
  C:\Windows\System\GyAIAxF.exe
  2⤵
  PID:6096
- C:\Windows\System\YSWAtxJ.exe
  C:\Windows\System\YSWAtxJ.exe
  2⤵
  PID:5136
- C:\Windows\System\iODFntl.exe
  C:\Windows\System\iODFntl.exe
  2⤵
  PID:5336
- C:\Windows\System\YtjLSrl.exe
  C:\Windows\System\YtjLSrl.exe
  2⤵
  PID:5368
- C:\Windows\System\uYHVhye.exe
  C:\Windows\System\uYHVhye.exe
  2⤵
  PID:5148
- C:\Windows\System\RvYyOZj.exe
  C:\Windows\System\RvYyOZj.exe
  2⤵
  PID:5600
- C:\Windows\System\ojMEcLv.exe
  C:\Windows\System\ojMEcLv.exe
  2⤵
  PID:5284
- C:\Windows\System\rAAKgpY.exe
  C:\Windows\System\rAAKgpY.exe
  2⤵
  PID:5352
- C:\Windows\System\WKkfatq.exe
  C:\Windows\System\WKkfatq.exe
  2⤵
  PID:5188
- C:\Windows\System\rHatfjl.exe
  C:\Windows\System\rHatfjl.exe
  2⤵
  PID:5592
- C:\Windows\System\JQABRyS.exe
  C:\Windows\System\JQABRyS.exe
  2⤵
  PID:5500
- C:\Windows\System\PmuLPxL.exe
  C:\Windows\System\PmuLPxL.exe
  2⤵
  PID:5664
- C:\Windows\System\eGaDfUa.exe
  C:\Windows\System\eGaDfUa.exe
  2⤵
  PID:5184
- C:\Windows\System\mLrPAWx.exe
  C:\Windows\System\mLrPAWx.exe
  2⤵
  PID:5684
- C:\Windows\System\FxWTTgX.exe
  C:\Windows\System\FxWTTgX.exe
  2⤵
  PID:5804
- C:\Windows\System\ZvNSfvX.exe
  C:\Windows\System\ZvNSfvX.exe
  2⤵
  PID:5964
- C:\Windows\System\NkcDItA.exe
  C:\Windows\System\NkcDItA.exe
  2⤵
  PID:6020
- C:\Windows\System\ogxJjmp.exe
  C:\Windows\System\ogxJjmp.exe
  2⤵
  PID:6128
- C:\Windows\System\mojIaVK.exe
  C:\Windows\System\mojIaVK.exe
  2⤵
  PID:5332
- C:\Windows\System\WeLeVfN.exe
  C:\Windows\System\WeLeVfN.exe
  2⤵
  PID:5736
- C:\Windows\System\uIrnrPN.exe
  C:\Windows\System\uIrnrPN.exe
  2⤵
  PID:6136
- C:\Windows\System\AVofLqk.exe
  C:\Windows\System\AVofLqk.exe
  2⤵
  PID:5896
- C:\Windows\System\WRtAQaC.exe
  C:\Windows\System\WRtAQaC.exe
  2⤵
  PID:5920
- C:\Windows\System\bWbCvoV.exe
  C:\Windows\System\bWbCvoV.exe
  2⤵
  PID:5400
- C:\Windows\System\DmSSuEb.exe
  C:\Windows\System\DmSSuEb.exe
  2⤵
  PID:5268
- C:\Windows\System\kwCcodY.exe
  C:\Windows\System\kwCcodY.exe
  2⤵
  PID:5288
- C:\Windows\System\mRoMnEL.exe
  C:\Windows\System\mRoMnEL.exe
  2⤵
  PID:5524
- C:\Windows\System\YjWClAH.exe
  C:\Windows\System\YjWClAH.exe
  2⤵
  PID:5700
- C:\Windows\System\uKPhACz.exe
  C:\Windows\System\uKPhACz.exe
  2⤵
  PID:5704
- C:\Windows\System\UGyEdJI.exe
  C:\Windows\System\UGyEdJI.exe
  2⤵
  PID:6012
- C:\Windows\System\EcFoCbR.exe
  C:\Windows\System\EcFoCbR.exe
  2⤵
  PID:6068
- C:\Windows\System\Qgggroy.exe
  C:\Windows\System\Qgggroy.exe
  2⤵
  PID:5844
- C:\Windows\System\jsMHuGv.exe
  C:\Windows\System\jsMHuGv.exe
  2⤵
  PID:5248
- C:\Windows\System\fgCRevi.exe
  C:\Windows\System\fgCRevi.exe
  2⤵
  PID:5364
- C:\Windows\System\ccaJzlD.exe
  C:\Windows\System\ccaJzlD.exe
  2⤵
  PID:5480
- C:\Windows\System\yUsHAWh.exe
  C:\Windows\System\yUsHAWh.exe
  2⤵
  PID:1444
- C:\Windows\System\rzMtCsJ.exe
  C:\Windows\System\rzMtCsJ.exe
  2⤵
  PID:6156
- C:\Windows\System\MqqHSql.exe
  C:\Windows\System\MqqHSql.exe
  2⤵
  PID:6176
- C:\Windows\System\iqOInYN.exe
  C:\Windows\System\iqOInYN.exe
  2⤵
  PID:6192
- C:\Windows\System\aOzuQan.exe
  C:\Windows\System\aOzuQan.exe
  2⤵
  PID:6208
- C:\Windows\System\LkSllSS.exe
  C:\Windows\System\LkSllSS.exe
  2⤵
  PID:6224
- C:\Windows\System\DjNhldd.exe
  C:\Windows\System\DjNhldd.exe
  2⤵
  PID:6240
- C:\Windows\System\gtiVmdG.exe
  C:\Windows\System\gtiVmdG.exe
  2⤵
  PID:6256
- C:\Windows\System\aspdRNY.exe
  C:\Windows\System\aspdRNY.exe
  2⤵
  PID:6272
- C:\Windows\System\PyEXwtv.exe
  C:\Windows\System\PyEXwtv.exe
  2⤵
  PID:6288
- C:\Windows\System\yHNQaMF.exe
  C:\Windows\System\yHNQaMF.exe
  2⤵
  PID:6304
- C:\Windows\System\eZZOUNO.exe
  C:\Windows\System\eZZOUNO.exe
  2⤵
  PID:6320
- C:\Windows\System\SIJUBqV.exe
  C:\Windows\System\SIJUBqV.exe
  2⤵
  PID:6340
- C:\Windows\System\KUhvFhM.exe
  C:\Windows\System\KUhvFhM.exe
  2⤵
  PID:6360
- C:\Windows\System\tguzxyT.exe
  C:\Windows\System\tguzxyT.exe
  2⤵
  PID:6376
- C:\Windows\System\Kvnvdfy.exe
  C:\Windows\System\Kvnvdfy.exe
  2⤵
  PID:6392
- C:\Windows\System\CKQeHEO.exe
  C:\Windows\System\CKQeHEO.exe
  2⤵
  PID:6408
- C:\Windows\System\GUCICOH.exe
  C:\Windows\System\GUCICOH.exe
  2⤵
  PID:6424
- C:\Windows\System\ENDQlpi.exe
  C:\Windows\System\ENDQlpi.exe
  2⤵
  PID:6440
- C:\Windows\System\qbRfcad.exe
  C:\Windows\System\qbRfcad.exe
  2⤵
  PID:6456
- C:\Windows\System\XzHcBbx.exe
  C:\Windows\System\XzHcBbx.exe
  2⤵
  PID:6472
- C:\Windows\System\UnCGsqP.exe
  C:\Windows\System\UnCGsqP.exe
  2⤵
  PID:6488
- C:\Windows\System\pzNXyHJ.exe
  C:\Windows\System\pzNXyHJ.exe
  2⤵
  PID:6504
- C:\Windows\System\tzfcOmn.exe
  C:\Windows\System\tzfcOmn.exe
  2⤵
  PID:6520
- C:\Windows\System\zqLxMZT.exe
  C:\Windows\System\zqLxMZT.exe
  2⤵
  PID:6536
- C:\Windows\System\tStWZwk.exe
  C:\Windows\System\tStWZwk.exe
  2⤵
  PID:6552
- C:\Windows\System\BDKQHNR.exe
  C:\Windows\System\BDKQHNR.exe
  2⤵
  PID:6568
- C:\Windows\System\bRJwbSi.exe
  C:\Windows\System\bRJwbSi.exe
  2⤵
  PID:6584
- C:\Windows\System\hQtOUuy.exe
  C:\Windows\System\hQtOUuy.exe
  2⤵
  PID:6600
- C:\Windows\System\kANzSYo.exe
  C:\Windows\System\kANzSYo.exe
  2⤵
  PID:6616
- C:\Windows\System\RnyTDFL.exe
  C:\Windows\System\RnyTDFL.exe
  2⤵
  PID:6632
- C:\Windows\System\aNlLSiq.exe
  C:\Windows\System\aNlLSiq.exe
  2⤵
  PID:6652
- C:\Windows\System\VRLBOQH.exe
  C:\Windows\System\VRLBOQH.exe
  2⤵
  PID:6668
- C:\Windows\System\NHgGWsQ.exe
  C:\Windows\System\NHgGWsQ.exe
  2⤵
  PID:6684
- C:\Windows\System\WyXqpGe.exe
  C:\Windows\System\WyXqpGe.exe
  2⤵
  PID:6700
- C:\Windows\System\twfqgZe.exe
  C:\Windows\System\twfqgZe.exe
  2⤵
  PID:6720
- C:\Windows\System\HNhTBHZ.exe
  C:\Windows\System\HNhTBHZ.exe
  2⤵
  PID:6736
- C:\Windows\System\jcyVJVu.exe
  C:\Windows\System\jcyVJVu.exe
  2⤵
  PID:6752
- C:\Windows\System\lDwJtiB.exe
  C:\Windows\System\lDwJtiB.exe
  2⤵
  PID:6768
- C:\Windows\System\wxyKnug.exe
  C:\Windows\System\wxyKnug.exe
  2⤵
  PID:6784
- C:\Windows\System\GQhxbKQ.exe
  C:\Windows\System\GQhxbKQ.exe
  2⤵
  PID:6800
- C:\Windows\System\yqlKvoP.exe
  C:\Windows\System\yqlKvoP.exe
  2⤵
  PID:6816
- C:\Windows\System\UUGGeaI.exe
  C:\Windows\System\UUGGeaI.exe
  2⤵
  PID:6832
- C:\Windows\System\gxHLDnJ.exe
  C:\Windows\System\gxHLDnJ.exe
  2⤵
  PID:6848
- C:\Windows\System\NPlXNQr.exe
  C:\Windows\System\NPlXNQr.exe
  2⤵
  PID:6864
- C:\Windows\System\mhhxxdY.exe
  C:\Windows\System\mhhxxdY.exe
  2⤵
  PID:6880
- C:\Windows\System\oGVZBYY.exe
  C:\Windows\System\oGVZBYY.exe
  2⤵
  PID:6896
- C:\Windows\System\HnimJsB.exe
  C:\Windows\System\HnimJsB.exe
  2⤵
  PID:6912
- C:\Windows\System\EcdKKJx.exe
  C:\Windows\System\EcdKKJx.exe
  2⤵
  PID:6928
- C:\Windows\System\vCLDKub.exe
  C:\Windows\System\vCLDKub.exe
  2⤵
  PID:6944
- C:\Windows\System\rFaIEiS.exe
  C:\Windows\System\rFaIEiS.exe
  2⤵
  PID:6960
- C:\Windows\System\xRkCuRA.exe
  C:\Windows\System\xRkCuRA.exe
  2⤵
  PID:6976
- C:\Windows\System\FvcQWvu.exe
  C:\Windows\System\FvcQWvu.exe
  2⤵
  PID:6992
- C:\Windows\System\yRoOcnX.exe
  C:\Windows\System\yRoOcnX.exe
  2⤵
  PID:7008
- C:\Windows\System\vTGfsZr.exe
  C:\Windows\System\vTGfsZr.exe
  2⤵
  PID:7024
- C:\Windows\System\azlCzkD.exe
  C:\Windows\System\azlCzkD.exe
  2⤵
  PID:7144
- C:\Windows\System\pEgvrJH.exe
  C:\Windows\System\pEgvrJH.exe
  2⤵
  PID:7160
- C:\Windows\System\TLrLaqW.exe
  C:\Windows\System\TLrLaqW.exe
  2⤵
  PID:6172
- C:\Windows\System\CKDzIzo.exe
  C:\Windows\System\CKDzIzo.exe
  2⤵
  PID:6216
- C:\Windows\System\OcyUplr.exe
  C:\Windows\System\OcyUplr.exe
  2⤵
  PID:4264
- C:\Windows\System\bDgMldf.exe
  C:\Windows\System\bDgMldf.exe
  2⤵
  PID:5544
- C:\Windows\System\ZZziSIW.exe
  C:\Windows\System\ZZziSIW.exe
  2⤵
  PID:5868
- C:\Windows\System\jsMHdSf.exe
  C:\Windows\System\jsMHdSf.exe
  2⤵
  PID:5436
- C:\Windows\System\vQhBtHS.exe
  C:\Windows\System\vQhBtHS.exe
  2⤵
  PID:6168
- C:\Windows\System\vHPMEyO.exe
  C:\Windows\System\vHPMEyO.exe
  2⤵
  PID:6236
- C:\Windows\System\HjdCyio.exe
  C:\Windows\System\HjdCyio.exe
  2⤵
  PID:6280
- C:\Windows\System\qAcXDqw.exe
  C:\Windows\System\qAcXDqw.exe
  2⤵
  PID:6352
- C:\Windows\System\RgZLdLC.exe
  C:\Windows\System\RgZLdLC.exe
  2⤵
  PID:6416
- C:\Windows\System\hfJorLu.exe
  C:\Windows\System\hfJorLu.exe
  2⤵
  PID:6300
- C:\Windows\System\qLVpkAc.exe
  C:\Windows\System\qLVpkAc.exe
  2⤵
  PID:6368
- C:\Windows\System\RHaZotB.exe
  C:\Windows\System\RHaZotB.exe
  2⤵
  PID:6432
- C:\Windows\System\bxYyCdL.exe
  C:\Windows\System\bxYyCdL.exe
  2⤵
  PID:6468
- C:\Windows\System\zewjDvt.exe
  C:\Windows\System\zewjDvt.exe
  2⤵
  PID:6512
- C:\Windows\System\boxJIEW.exe
  C:\Windows\System\boxJIEW.exe
  2⤵
  PID:6576
- C:\Windows\System\HZtksya.exe
  C:\Windows\System\HZtksya.exe
  2⤵
  PID:6640
- C:\Windows\System\QYsYPzP.exe
  C:\Windows\System\QYsYPzP.exe
  2⤵
  PID:6972
- C:\Windows\System\mYYsxWF.exe
  C:\Windows\System\mYYsxWF.exe
  2⤵
  PID:6924
- C:\Windows\System\YLVZwpz.exe
  C:\Windows\System\YLVZwpz.exe
  2⤵
  PID:6988
- C:\Windows\System\goTmfjg.exe
  C:\Windows\System\goTmfjg.exe
  2⤵
  PID:7044
- C:\Windows\System\hfPKMLu.exe
  C:\Windows\System\hfPKMLu.exe
  2⤵
  PID:7068
- C:\Windows\System\DSNBYRc.exe
  C:\Windows\System\DSNBYRc.exe
  2⤵
  PID:7052
- C:\Windows\System\UuCIcKy.exe
  C:\Windows\System\UuCIcKy.exe
  2⤵
  PID:7100
- C:\Windows\System\uUENXtw.exe
  C:\Windows\System\uUENXtw.exe
  2⤵
  PID:7124
- C:\Windows\System\ubLhUvs.exe
  C:\Windows\System\ubLhUvs.exe
  2⤵
  PID:5420
- C:\Windows\System\naVHLMY.exe
  C:\Windows\System\naVHLMY.exe
  2⤵
  PID:5828
- C:\Windows\System\JEsMVbO.exe
  C:\Windows\System\JEsMVbO.exe
  2⤵
  PID:7156
- C:\Windows\System\hWpiDhA.exe
  C:\Windows\System\hWpiDhA.exe
  2⤵
  PID:5832
- C:\Windows\System\tYTBHJj.exe
  C:\Windows\System\tYTBHJj.exe
  2⤵
  PID:6384
- C:\Windows\System\lnpOYEr.exe
  C:\Windows\System\lnpOYEr.exe
  2⤵
  PID:6164
- C:\Windows\System\xyLSTbC.exe
  C:\Windows\System\xyLSTbC.exe
  2⤵
  PID:6232
- C:\Windows\System\KEjgddo.exe
  C:\Windows\System\KEjgddo.exe
  2⤵
  PID:6448
- C:\Windows\System\AocmGHb.exe
  C:\Windows\System\AocmGHb.exe
  2⤵
  PID:6464
- C:\Windows\System\IWIxnfe.exe
  C:\Windows\System\IWIxnfe.exe
  2⤵
  PID:6648
- C:\Windows\System\HYHxKXC.exe
  C:\Windows\System\HYHxKXC.exe
  2⤵
  PID:6708
- C:\Windows\System\cRSgmTX.exe
  C:\Windows\System\cRSgmTX.exe
  2⤵
  PID:6744
- C:\Windows\System\IaplfSr.exe
  C:\Windows\System\IaplfSr.exe
  2⤵
  PID:6528
- C:\Windows\System\sVzUKba.exe
  C:\Windows\System\sVzUKba.exe
  2⤵
  PID:6560
- C:\Windows\System\jqlTEnQ.exe
  C:\Windows\System\jqlTEnQ.exe
  2⤵
  PID:6660
- C:\Windows\System\UsYCwbl.exe
  C:\Windows\System\UsYCwbl.exe
  2⤵
  PID:6728
- C:\Windows\System\BdqycqD.exe
  C:\Windows\System\BdqycqD.exe
  2⤵
  PID:6780
- C:\Windows\System\Tzsyryq.exe
  C:\Windows\System\Tzsyryq.exe
  2⤵
  PID:6796
- C:\Windows\System\EAhzqcq.exe
  C:\Windows\System\EAhzqcq.exe
  2⤵
  PID:6824
- C:\Windows\System\knsqbnK.exe
  C:\Windows\System\knsqbnK.exe
  2⤵
  PID:6876
- C:\Windows\System\jhyCJrx.exe
  C:\Windows\System\jhyCJrx.exe
  2⤵
  PID:6968
- C:\Windows\System\wScscEi.exe
  C:\Windows\System\wScscEi.exe
  2⤵
  PID:6956
- C:\Windows\System\NuXHcNR.exe
  C:\Windows\System\NuXHcNR.exe
  2⤵
  PID:7092
- C:\Windows\System\LWuHcxO.exe
  C:\Windows\System\LWuHcxO.exe
  2⤵
  PID:7136
- C:\Windows\System\lpVIeUt.exe
  C:\Windows\System\lpVIeUt.exe
  2⤵
  PID:6016
- C:\Windows\System\Byizelu.exe
  C:\Windows\System\Byizelu.exe
  2⤵
  PID:6404
- C:\Windows\System\YPUWehf.exe
  C:\Windows\System\YPUWehf.exe
  2⤵
  PID:6500
- C:\Windows\System\VoICAQs.exe
  C:\Windows\System\VoICAQs.exe
  2⤵
  PID:6764
- C:\Windows\System\ALbsnuL.exe
  C:\Windows\System\ALbsnuL.exe
  2⤵
  PID:6872
- C:\Windows\System\cfXvnlz.exe
  C:\Windows\System\cfXvnlz.exe
  2⤵
  PID:7084
- C:\Windows\System\zIHQGbj.exe
  C:\Windows\System\zIHQGbj.exe
  2⤵
  PID:7036
- C:\Windows\System\uGOlQWf.exe
  C:\Windows\System\uGOlQWf.exe
  2⤵
  PID:6808
- C:\Windows\System\SFChEHF.exe
  C:\Windows\System\SFChEHF.exe
  2⤵
  PID:6892
- C:\Windows\System\kvuVDGL.exe
  C:\Windows\System\kvuVDGL.exe
  2⤵
  PID:7172
- C:\Windows\System\COPqEeH.exe
  C:\Windows\System\COPqEeH.exe
  2⤵
  PID:7188
- C:\Windows\System\QziYows.exe
  C:\Windows\System\QziYows.exe
  2⤵
  PID:7204
- C:\Windows\System\OfXfKrf.exe
  C:\Windows\System\OfXfKrf.exe
  2⤵
  PID:7220
- C:\Windows\System\QKyihNE.exe
  C:\Windows\System\QKyihNE.exe
  2⤵
  PID:7236
- C:\Windows\System\SZsGwEX.exe
  C:\Windows\System\SZsGwEX.exe
  2⤵
  PID:7252
- C:\Windows\System\ddBEWpQ.exe
  C:\Windows\System\ddBEWpQ.exe
  2⤵
  PID:7268
- C:\Windows\System\GtHKMMP.exe
  C:\Windows\System\GtHKMMP.exe
  2⤵
  PID:7284
- C:\Windows\System\qRZvZXD.exe
  C:\Windows\System\qRZvZXD.exe
  2⤵
  PID:7300
- C:\Windows\System\scAbMbE.exe
  C:\Windows\System\scAbMbE.exe
  2⤵
  PID:7316
- C:\Windows\System\BslygXV.exe
  C:\Windows\System\BslygXV.exe
  2⤵
  PID:7344
- C:\Windows\System\zqlsxeU.exe
  C:\Windows\System\zqlsxeU.exe
  2⤵
  PID:7360
- C:\Windows\System\ytRSsUA.exe
  C:\Windows\System\ytRSsUA.exe
  2⤵
  PID:7376
- C:\Windows\System\WGGASnl.exe
  C:\Windows\System\WGGASnl.exe
  2⤵
  PID:7396
- C:\Windows\System\AZcHvQu.exe
  C:\Windows\System\AZcHvQu.exe
  2⤵
  PID:7412
- C:\Windows\System\mpsLTJL.exe
  C:\Windows\System\mpsLTJL.exe
  2⤵
  PID:7432
- C:\Windows\System\LvhphYt.exe
  C:\Windows\System\LvhphYt.exe
  2⤵
  PID:7448
- C:\Windows\System\uzqcpJp.exe
  C:\Windows\System\uzqcpJp.exe
  2⤵
  PID:7464
- C:\Windows\System\WcTjlgL.exe
  C:\Windows\System\WcTjlgL.exe
  2⤵
  PID:7484
- C:\Windows\System\SwqOACg.exe
  C:\Windows\System\SwqOACg.exe
  2⤵
  PID:7500
- C:\Windows\System\GcWvleA.exe
  C:\Windows\System\GcWvleA.exe
  2⤵
  PID:7516
- C:\Windows\System\NOtImsP.exe
  C:\Windows\System\NOtImsP.exe
  2⤵
  PID:7532
- C:\Windows\System\IFGXtIC.exe
  C:\Windows\System\IFGXtIC.exe
  2⤵
  PID:7548
- C:\Windows\System\YGvfgPN.exe
  C:\Windows\System\YGvfgPN.exe
  2⤵
  PID:7564
- C:\Windows\System\KKkALnY.exe
  C:\Windows\System\KKkALnY.exe
  2⤵
  PID:7580
- C:\Windows\System\eNSpyRy.exe
  C:\Windows\System\eNSpyRy.exe
  2⤵
  PID:7596
- C:\Windows\System\doBdyvL.exe
  C:\Windows\System\doBdyvL.exe
  2⤵
  PID:7612
- C:\Windows\System\cwtKdAz.exe
  C:\Windows\System\cwtKdAz.exe
  2⤵
  PID:7628
- C:\Windows\System\TzAllIt.exe
  C:\Windows\System\TzAllIt.exe
  2⤵
  PID:7644
- C:\Windows\System\hEGuyom.exe
  C:\Windows\System\hEGuyom.exe
  2⤵
  PID:7660
- C:\Windows\System\GpqRAVB.exe
  C:\Windows\System\GpqRAVB.exe
  2⤵
  PID:7680
- C:\Windows\System\ZYolESG.exe
  C:\Windows\System\ZYolESG.exe
  2⤵
  PID:7696
- C:\Windows\System\cDfSMBD.exe
  C:\Windows\System\cDfSMBD.exe
  2⤵
  PID:7712
- C:\Windows\System\TqQNlpX.exe
  C:\Windows\System\TqQNlpX.exe
  2⤵
  PID:7728
- C:\Windows\System\oBNvOdm.exe
  C:\Windows\System\oBNvOdm.exe
  2⤵
  PID:7748
- C:\Windows\System\BDMyQBb.exe
  C:\Windows\System\BDMyQBb.exe
  2⤵
  PID:7764
- C:\Windows\System\mkjZBRW.exe
  C:\Windows\System\mkjZBRW.exe
  2⤵
  PID:7780
- C:\Windows\System\QmSfpUV.exe
  C:\Windows\System\QmSfpUV.exe
  2⤵
  PID:7796
- C:\Windows\System\XEyjblq.exe
  C:\Windows\System\XEyjblq.exe
  2⤵
  PID:7812
- C:\Windows\System\DynellB.exe
  C:\Windows\System\DynellB.exe
  2⤵
  PID:7928
- C:\Windows\System\wjQktNm.exe
  C:\Windows\System\wjQktNm.exe
  2⤵
  PID:7948
- C:\Windows\System\SjfWGyE.exe
  C:\Windows\System\SjfWGyE.exe
  2⤵
  PID:7964
- C:\Windows\System\OnluGrt.exe
  C:\Windows\System\OnluGrt.exe
  2⤵
  PID:7984
- C:\Windows\System\dBGWHnv.exe
  C:\Windows\System\dBGWHnv.exe
  2⤵
  PID:8000
- C:\Windows\System\LqnUCtr.exe
  C:\Windows\System\LqnUCtr.exe
  2⤵
  PID:8020
- C:\Windows\System\cqmSKZG.exe
  C:\Windows\System\cqmSKZG.exe
  2⤵
  PID:8036
- C:\Windows\System\bPLdYQv.exe
  C:\Windows\System\bPLdYQv.exe
  2⤵
  PID:8052
- C:\Windows\System\veVqYke.exe
  C:\Windows\System\veVqYke.exe
  2⤵
  PID:8068
- C:\Windows\System\MXYZFdT.exe
  C:\Windows\System\MXYZFdT.exe
  2⤵
  PID:8088
- C:\Windows\System\rVjQTwq.exe
  C:\Windows\System\rVjQTwq.exe
  2⤵
  PID:8104
- C:\Windows\System\XIJUxnZ.exe
  C:\Windows\System\XIJUxnZ.exe
  2⤵
  PID:8120
- C:\Windows\System\WCIuBrq.exe
  C:\Windows\System\WCIuBrq.exe
  2⤵
  PID:8136
- C:\Windows\System\kwjkhhB.exe
  C:\Windows\System\kwjkhhB.exe
  2⤵
  PID:8152
- C:\Windows\System\CmmtexE.exe
  C:\Windows\System\CmmtexE.exe
  2⤵
  PID:8168
- C:\Windows\System\OQZEbZQ.exe
  C:\Windows\System\OQZEbZQ.exe
  2⤵
  PID:8184
- C:\Windows\System\pGFyzHi.exe
  C:\Windows\System\pGFyzHi.exe
  2⤵
  PID:7216
- C:\Windows\System\CXxOOxh.exe
  C:\Windows\System\CXxOOxh.exe
  2⤵
  PID:7004
- C:\Windows\System\Ccoaxdi.exe
  C:\Windows\System\Ccoaxdi.exe
  2⤵
  PID:6400
- C:\Windows\System\iKEgzzK.exe
  C:\Windows\System\iKEgzzK.exe
  2⤵
  PID:7060
- C:\Windows\System\CKmQMJd.exe
  C:\Windows\System\CKmQMJd.exe
  2⤵
  PID:5492
- C:\Windows\System\HFdWBzK.exe
  C:\Windows\System\HFdWBzK.exe
  2⤵
  PID:6548
- C:\Windows\System\VPyKjaA.exe
  C:\Windows\System\VPyKjaA.exe
  2⤵
  PID:6592
- C:\Windows\System\KPvtKuM.exe
  C:\Windows\System\KPvtKuM.exe
  2⤵
  PID:6812
- C:\Windows\System\GmvJHMT.exe
  C:\Windows\System\GmvJHMT.exe
  2⤵
  PID:6984
- C:\Windows\System\vJBaIZX.exe
  C:\Windows\System\vJBaIZX.exe
  2⤵
  PID:6564
- C:\Windows\System\KKPoTKS.exe
  C:\Windows\System\KKPoTKS.exe
  2⤵
  PID:6888
- C:\Windows\System\wuRFBOm.exe
  C:\Windows\System\wuRFBOm.exe
  2⤵
  PID:7108
- C:\Windows\System\XBQLgPj.exe
  C:\Windows\System\XBQLgPj.exe
  2⤵
  PID:7292
- C:\Windows\System\aTXpwMb.exe
  C:\Windows\System\aTXpwMb.exe
  2⤵
  PID:7308
- C:\Windows\System\tEwiLYJ.exe
  C:\Windows\System\tEwiLYJ.exe
  2⤵
  PID:7340
- C:\Windows\System\lJwMveE.exe
  C:\Windows\System\lJwMveE.exe
  2⤵
  PID:7336
- C:\Windows\System\wVMUrmt.exe
  C:\Windows\System\wVMUrmt.exe
  2⤵
  PID:7388
- C:\Windows\System\SIoVNZr.exe
  C:\Windows\System\SIoVNZr.exe
  2⤵
  PID:7428
- C:\Windows\System\kxfAQai.exe
  C:\Windows\System\kxfAQai.exe
  2⤵
  PID:7496
- C:\Windows\System\WUyHkGZ.exe
  C:\Windows\System\WUyHkGZ.exe
  2⤵
  PID:7444
- C:\Windows\System\bKnvMle.exe
  C:\Windows\System\bKnvMle.exe
  2⤵
  PID:7476
- C:\Windows\System\zgmsZpL.exe
  C:\Windows\System\zgmsZpL.exe
  2⤵
  PID:7588
- C:\Windows\System\IZGgOJQ.exe
  C:\Windows\System\IZGgOJQ.exe
  2⤵
  PID:7652
- C:\Windows\System\rMWNhRs.exe
  C:\Windows\System\rMWNhRs.exe
  2⤵
  PID:7704
- C:\Windows\System\dKvcmQj.exe
  C:\Windows\System\dKvcmQj.exe
  2⤵
  PID:7736
- C:\Windows\System\nYiJulH.exe
  C:\Windows\System\nYiJulH.exe
  2⤵
  PID:7668
- C:\Windows\System\byQuwDf.exe
  C:\Windows\System\byQuwDf.exe
  2⤵
  PID:7640
- C:\Windows\System\GILKqIf.exe
  C:\Windows\System\GILKqIf.exe
  2⤵
  PID:7720
- C:\Windows\System\yMnVOCx.exe
  C:\Windows\System\yMnVOCx.exe
  2⤵
  PID:7760
- C:\Windows\System\rLhTZUh.exe
  C:\Windows\System\rLhTZUh.exe
  2⤵
  PID:7804
- C:\Windows\System\CglMMPt.exe
  C:\Windows\System\CglMMPt.exe
  2⤵
  PID:7832
- C:\Windows\System\CLhpcmF.exe
  C:\Windows\System\CLhpcmF.exe
  2⤵
  PID:7844
- C:\Windows\System\UNaYQBh.exe
  C:\Windows\System\UNaYQBh.exe
  2⤵
  PID:7864
- C:\Windows\System\juVTosb.exe
  C:\Windows\System\juVTosb.exe
  2⤵
  PID:7876
- C:\Windows\System\ZZJEWht.exe
  C:\Windows\System\ZZJEWht.exe
  2⤵
  PID:7896
- C:\Windows\System\RkFWBtU.exe
  C:\Windows\System\RkFWBtU.exe
  2⤵
  PID:7916
- C:\Windows\System\lMUMpZe.exe
  C:\Windows\System\lMUMpZe.exe
  2⤵
  PID:7956
- C:\Windows\System\lTIqTlX.exe
  C:\Windows\System\lTIqTlX.exe
  2⤵
  PID:8032
- C:\Windows\System\VXVoBEE.exe
  C:\Windows\System\VXVoBEE.exe
  2⤵
  PID:8096
- C:\Windows\System\GYCggVK.exe
  C:\Windows\System\GYCggVK.exe
  2⤵
  PID:8160
- C:\Windows\System\iEmVFfZ.exe
  C:\Windows\System\iEmVFfZ.exe
  2⤵
  PID:7184
- C:\Windows\System\ZSkcLyJ.exe
  C:\Windows\System\ZSkcLyJ.exe
  2⤵
  PID:7940
- C:\Windows\System\yyNxXbZ.exe
  C:\Windows\System\yyNxXbZ.exe
  2⤵
  PID:7980
- C:\Windows\System\RhQONDh.exe
  C:\Windows\System\RhQONDh.exe
  2⤵
  PID:8044
- C:\Windows\System\mUvqntn.exe
  C:\Windows\System\mUvqntn.exe
  2⤵
  PID:8084
- C:\Windows\System\pewZzIq.exe
  C:\Windows\System\pewZzIq.exe
  2⤵
  PID:7248
- C:\Windows\System\FakqEzu.exe
  C:\Windows\System\FakqEzu.exe
  2⤵
  PID:7112
- C:\Windows\System\RNnIuZz.exe
  C:\Windows\System\RNnIuZz.exe
  2⤵
  PID:7132
- C:\Windows\System\FRiTxOW.exe
  C:\Windows\System\FRiTxOW.exe
  2⤵
  PID:5924
- C:\Windows\System\MFqRlrS.exe
  C:\Windows\System\MFqRlrS.exe
  2⤵
  PID:6696
- C:\Windows\System\mbQCnlV.exe
  C:\Windows\System\mbQCnlV.exe
  2⤵
  PID:7072
- C:\Windows\System\iWIZzps.exe
  C:\Windows\System\iWIZzps.exe
  2⤵
  PID:7312
- C:\Windows\System\YqRGpIz.exe
  C:\Windows\System\YqRGpIz.exe
  2⤵
  PID:7196
- C:\Windows\System\EnWechN.exe
  C:\Windows\System\EnWechN.exe
  2⤵
  PID:6312
- C:\Windows\System\rFOOBsC.exe
  C:\Windows\System\rFOOBsC.exe
  2⤵
  PID:7296
- C:\Windows\System\ipsDcVV.exe
  C:\Windows\System\ipsDcVV.exe
  2⤵
  PID:7560
- C:\Windows\System\wwvIuZC.exe
  C:\Windows\System\wwvIuZC.exe
  2⤵
  PID:7744
- C:\Windows\System\GiyLRkr.exe
  C:\Windows\System\GiyLRkr.exe
  2⤵
  PID:7856
- C:\Windows\System\uNFTJAV.exe
  C:\Windows\System\uNFTJAV.exe
  2⤵
  PID:7608
- C:\Windows\System\cwpAdYG.exe
  C:\Windows\System\cwpAdYG.exe
  2⤵
  PID:8064
- C:\Windows\System\XKfUjAy.exe
  C:\Windows\System\XKfUjAy.exe
  2⤵
  PID:8116
- C:\Windows\System\vbxdGsb.exe
  C:\Windows\System\vbxdGsb.exe
  2⤵
  PID:7996
- C:\Windows\System\bqULkWC.exe
  C:\Windows\System\bqULkWC.exe
  2⤵
  PID:7756
- C:\Windows\System\uDFzGFu.exe
  C:\Windows\System\uDFzGFu.exe
  2⤵
  PID:7840
- C:\Windows\System\EHeNEMk.exe
  C:\Windows\System\EHeNEMk.exe
  2⤵
  PID:7992
- C:\Windows\System\DOZNgak.exe
  C:\Windows\System\DOZNgak.exe
  2⤵
  PID:6332
- C:\Windows\System\GjuNKxg.exe
  C:\Windows\System\GjuNKxg.exe
  2⤵
  PID:7032
- C:\Windows\System\JFCzGwV.exe
  C:\Windows\System\JFCzGwV.exe
  2⤵
  PID:7020
- C:\Windows\System\hXaMrAj.exe
  C:\Windows\System\hXaMrAj.exe
  2⤵
  PID:6596
- C:\Windows\System\wAOuPAv.exe
  C:\Windows\System\wAOuPAv.exe
  2⤵
  PID:7492
- C:\Windows\System\ddNlArH.exe
  C:\Windows\System\ddNlArH.exe
  2⤵
  PID:7888
- C:\Windows\System\yBezDuZ.exe
  C:\Windows\System\yBezDuZ.exe
  2⤵
  PID:7180
- C:\Windows\System\pSAKeqn.exe
  C:\Windows\System\pSAKeqn.exe
  2⤵
  PID:7820
- C:\Windows\System\DZDlqEX.exe
  C:\Windows\System\DZDlqEX.exe
  2⤵
  PID:7356
- C:\Windows\System\TXyuhOW.exe
  C:\Windows\System\TXyuhOW.exe
  2⤵
  PID:8128
- C:\Windows\System\TmcUuxO.exe
  C:\Windows\System\TmcUuxO.exe
  2⤵
  PID:7836
- C:\Windows\System\ExJzkbn.exe
  C:\Windows\System\ExJzkbn.exe
  2⤵
  PID:7372
- C:\Windows\System\LVEqEYA.exe
  C:\Windows\System\LVEqEYA.exe
  2⤵
  PID:8012
- C:\Windows\System\BWcXKqx.exe
  C:\Windows\System\BWcXKqx.exe
  2⤵
  PID:7572
- C:\Windows\System\hIiAKMM.exe
  C:\Windows\System\hIiAKMM.exe
  2⤵
  PID:7636
- C:\Windows\System\SSkTbuQ.exe
  C:\Windows\System\SSkTbuQ.exe
  2⤵
  PID:7472
- C:\Windows\System\XqJynLP.exe
  C:\Windows\System\XqJynLP.exe
  2⤵
  PID:7892
- C:\Windows\System\FQrUDlH.exe
  C:\Windows\System\FQrUDlH.exe
  2⤵
  PID:7604
- C:\Windows\System\ukzhJoL.exe
  C:\Windows\System\ukzhJoL.exe
  2⤵
  PID:8008
- C:\Windows\System\cBbQGww.exe
  C:\Windows\System\cBbQGww.exe
  2⤵
  PID:7260
- C:\Windows\System\wbfILQk.exe
  C:\Windows\System\wbfILQk.exe
  2⤵
  PID:7332
- C:\Windows\System\AZykPCM.exe
  C:\Windows\System\AZykPCM.exe
  2⤵
  PID:7440
- C:\Windows\System\rglrqai.exe
  C:\Windows\System\rglrqai.exe
  2⤵
  PID:7904
- C:\Windows\System\csdeKOw.exe
  C:\Windows\System\csdeKOw.exe
  2⤵
  PID:7944
- C:\Windows\System\rUJtyLp.exe
  C:\Windows\System\rUJtyLp.exe
  2⤵
  PID:7924
- C:\Windows\System\gjEIStI.exe
  C:\Windows\System\gjEIStI.exe
  2⤵
  PID:7976
- C:\Windows\System\IxbubTs.exe
  C:\Windows\System\IxbubTs.exe
  2⤵
  PID:7624
- C:\Windows\System\XrNDWrF.exe
  C:\Windows\System\XrNDWrF.exe
  2⤵
  PID:8208
- C:\Windows\System\YlDNdgz.exe
  C:\Windows\System\YlDNdgz.exe
  2⤵
  PID:8224
- C:\Windows\System\BTZuubW.exe
  C:\Windows\System\BTZuubW.exe
  2⤵
  PID:8240
- C:\Windows\System\cnqCiYx.exe
  C:\Windows\System\cnqCiYx.exe
  2⤵
  PID:8256
- C:\Windows\System\yLkaWxj.exe
  C:\Windows\System\yLkaWxj.exe
  2⤵
  PID:8272
- C:\Windows\System\xcwBTVp.exe
  C:\Windows\System\xcwBTVp.exe
  2⤵
  PID:8288
- C:\Windows\System\ZbSftdz.exe
  C:\Windows\System\ZbSftdz.exe
  2⤵
  PID:8304
- C:\Windows\System\DsSoZUW.exe
  C:\Windows\System\DsSoZUW.exe
  2⤵
  PID:8320
- C:\Windows\System\GixpzCm.exe
  C:\Windows\System\GixpzCm.exe
  2⤵
  PID:8336
- C:\Windows\System\iEnQykC.exe
  C:\Windows\System\iEnQykC.exe
  2⤵
  PID:8352
- C:\Windows\System\fpcMAfI.exe
  C:\Windows\System\fpcMAfI.exe
  2⤵
  PID:8368
- C:\Windows\System\rhYyLSq.exe
  C:\Windows\System\rhYyLSq.exe
  2⤵
  PID:8384
- C:\Windows\System\yoXvTLB.exe
  C:\Windows\System\yoXvTLB.exe
  2⤵
  PID:8400
- C:\Windows\System\kbSRRgL.exe
  C:\Windows\System\kbSRRgL.exe
  2⤵
  PID:8416
- C:\Windows\System\hBAYAUC.exe
  C:\Windows\System\hBAYAUC.exe
  2⤵
  PID:8432
- C:\Windows\System\xEmJdvO.exe
  C:\Windows\System\xEmJdvO.exe
  2⤵
  PID:8448
- C:\Windows\System\YTjNcQi.exe
  C:\Windows\System\YTjNcQi.exe
  2⤵
  PID:8464
- C:\Windows\System\rrYqZeT.exe
  C:\Windows\System\rrYqZeT.exe
  2⤵
  PID:8484
- C:\Windows\System\VSltwkl.exe
  C:\Windows\System\VSltwkl.exe
  2⤵
  PID:8500
- C:\Windows\System\YJdlRht.exe
  C:\Windows\System\YJdlRht.exe
  2⤵
  PID:8516
- C:\Windows\System\yIARetw.exe
  C:\Windows\System\yIARetw.exe
  2⤵
  PID:8532
- C:\Windows\System\FOKWANG.exe
  C:\Windows\System\FOKWANG.exe
  2⤵
  PID:8548
- C:\Windows\System\DxvVUcK.exe
  C:\Windows\System\DxvVUcK.exe
  2⤵
  PID:8564
- C:\Windows\System\hkWdYKI.exe
  C:\Windows\System\hkWdYKI.exe
  2⤵
  PID:8580
- C:\Windows\System\PVKRjBq.exe
  C:\Windows\System\PVKRjBq.exe
  2⤵
  PID:8596
- C:\Windows\System\LTpQWHp.exe
  C:\Windows\System\LTpQWHp.exe
  2⤵
  PID:8612
- C:\Windows\System\YESDtWn.exe
  C:\Windows\System\YESDtWn.exe
  2⤵
  PID:8628
- C:\Windows\System\CFysOXS.exe
  C:\Windows\System\CFysOXS.exe
  2⤵
  PID:8644
- C:\Windows\System\MdhzjUY.exe
  C:\Windows\System\MdhzjUY.exe
  2⤵
  PID:8664
- C:\Windows\System\EWuUUYy.exe
  C:\Windows\System\EWuUUYy.exe
  2⤵
  PID:8680
- C:\Windows\System\xjeyDzc.exe
  C:\Windows\System\xjeyDzc.exe
  2⤵
  PID:8696
- C:\Windows\System\DdJUBUM.exe
  C:\Windows\System\DdJUBUM.exe
  2⤵
  PID:8712
- C:\Windows\System\fgUmdNi.exe
  C:\Windows\System\fgUmdNi.exe
  2⤵
  PID:8728
- C:\Windows\System\piGsAgu.exe
  C:\Windows\System\piGsAgu.exe
  2⤵
  PID:8744
- C:\Windows\System\FOdrjeJ.exe
  C:\Windows\System\FOdrjeJ.exe
  2⤵
  PID:8760
- C:\Windows\System\foymLZP.exe
  C:\Windows\System\foymLZP.exe
  2⤵
  PID:8776
- C:\Windows\System\tbyRqIp.exe
  C:\Windows\System\tbyRqIp.exe
  2⤵
  PID:8792
- C:\Windows\System\dfzGtPn.exe
  C:\Windows\System\dfzGtPn.exe
  2⤵
  PID:8808
- C:\Windows\System\yYVPylm.exe
  C:\Windows\System\yYVPylm.exe
  2⤵
  PID:8824
- C:\Windows\System\bvdoWbj.exe
  C:\Windows\System\bvdoWbj.exe
  2⤵
  PID:8848
- C:\Windows\System\MyMfBjg.exe
  C:\Windows\System\MyMfBjg.exe
  2⤵
  PID:8864
- C:\Windows\System\hfbWKGx.exe
  C:\Windows\System\hfbWKGx.exe
  2⤵
  PID:8880
- C:\Windows\System\RcwJtvE.exe
  C:\Windows\System\RcwJtvE.exe
  2⤵
  PID:8896
- C:\Windows\System\bpvNznJ.exe
  C:\Windows\System\bpvNznJ.exe
  2⤵
  PID:8912
- C:\Windows\System\uLNEmmw.exe
  C:\Windows\System\uLNEmmw.exe
  2⤵
  PID:8928
- C:\Windows\System\XveQUwP.exe
  C:\Windows\System\XveQUwP.exe
  2⤵
  PID:8948
- C:\Windows\System\RnKDlKM.exe
  C:\Windows\System\RnKDlKM.exe
  2⤵
  PID:8964
- C:\Windows\System\EZLAQKo.exe
  C:\Windows\System\EZLAQKo.exe
  2⤵
  PID:8980
- C:\Windows\System\unhtHqe.exe
  C:\Windows\System\unhtHqe.exe
  2⤵
  PID:8996
- C:\Windows\System\SGdzMKf.exe
  C:\Windows\System\SGdzMKf.exe
  2⤵
  PID:9012
- C:\Windows\System\dkslOSm.exe
  C:\Windows\System\dkslOSm.exe
  2⤵
  PID:9028
- C:\Windows\System\CBtuYfr.exe
  C:\Windows\System\CBtuYfr.exe
  2⤵
  PID:9048
- C:\Windows\System\eHUoUHV.exe
  C:\Windows\System\eHUoUHV.exe
  2⤵
  PID:9068
- C:\Windows\System\UFvynZu.exe
  C:\Windows\System\UFvynZu.exe
  2⤵
  PID:9084
- C:\Windows\System\qCljhcA.exe
  C:\Windows\System\qCljhcA.exe
  2⤵
  PID:9100
- C:\Windows\System\wxPfLPv.exe
  C:\Windows\System\wxPfLPv.exe
  2⤵
  PID:9116
- C:\Windows\System\VxwJrPV.exe
  C:\Windows\System\VxwJrPV.exe
  2⤵
  PID:9132
- C:\Windows\System\PJUORpb.exe
  C:\Windows\System\PJUORpb.exe
  2⤵
  PID:9148
- C:\Windows\System\HsmuRRK.exe
  C:\Windows\System\HsmuRRK.exe
  2⤵
  PID:9164
- C:\Windows\System\nDyDZPn.exe
  C:\Windows\System\nDyDZPn.exe
  2⤵
  PID:9184
- C:\Windows\System\xNGmuCn.exe
  C:\Windows\System\xNGmuCn.exe
  2⤵
  PID:9200
- C:\Windows\System\PCRjUAz.exe
  C:\Windows\System\PCRjUAz.exe
  2⤵
  PID:8060
- C:\Windows\System\qylArjZ.exe
  C:\Windows\System\qylArjZ.exe
  2⤵
  PID:8236
- C:\Windows\System\FtmPxgn.exe
  C:\Windows\System\FtmPxgn.exe
  2⤵
  PID:8080
- C:\Windows\System\MAhJIIZ.exe
  C:\Windows\System\MAhJIIZ.exe
  2⤵
  PID:8360
- C:\Windows\System\fYcAFqT.exe
  C:\Windows\System\fYcAFqT.exe
  2⤵
  PID:8428
- C:\Windows\System\PpAUuOs.exe
  C:\Windows\System\PpAUuOs.exe
  2⤵
  PID:8280
- C:\Windows\System\zRRXiOc.exe
  C:\Windows\System\zRRXiOc.exe
  2⤵
  PID:8460
- C:\Windows\System\OiOJAwW.exe
  C:\Windows\System\OiOJAwW.exe
  2⤵
  PID:8524
- C:\Windows\System\gYRepOA.exe
  C:\Windows\System\gYRepOA.exe
  2⤵
  PID:8528
- C:\Windows\System\BHoZiNJ.exe
  C:\Windows\System\BHoZiNJ.exe
  2⤵
  PID:8588
- C:\Windows\System\QBGLyGS.exe
  C:\Windows\System\QBGLyGS.exe
  2⤵
  PID:8608
- C:\Windows\System\jSUGYnd.exe
  C:\Windows\System\jSUGYnd.exe
  2⤵
  PID:8636
- C:\Windows\System\RBKspJo.exe
  C:\Windows\System\RBKspJo.exe
  2⤵
  PID:8676
- C:\Windows\System\fUShYXN.exe
  C:\Windows\System\fUShYXN.exe
  2⤵
  PID:8736
- C:\Windows\System\cBnsQCm.exe
  C:\Windows\System\cBnsQCm.exe
  2⤵
  PID:8688
- C:\Windows\System\FRTpFYb.exe
  C:\Windows\System\FRTpFYb.exe
  2⤵
  PID:8756
- C:\Windows\System\aKKmmxQ.exe
  C:\Windows\System\aKKmmxQ.exe
  2⤵
  PID:8820
- C:\Windows\System\NtVKDGW.exe
  C:\Windows\System\NtVKDGW.exe
  2⤵
  PID:8844
- C:\Windows\System\UwRdRxU.exe
  C:\Windows\System\UwRdRxU.exe
  2⤵
  PID:8856
- C:\Windows\System\mJBnIUZ.exe
  C:\Windows\System\mJBnIUZ.exe
  2⤵
  PID:8924
- C:\Windows\System\AJFBHNK.exe
  C:\Windows\System\AJFBHNK.exe
  2⤵
  PID:8936
- C:\Windows\System\ovnmggx.exe
  C:\Windows\System\ovnmggx.exe
  2⤵
  PID:8988
- C:\Windows\System\XLleaFN.exe
  C:\Windows\System\XLleaFN.exe
  2⤵
  PID:9064
- C:\Windows\System\FjOMPaT.exe
  C:\Windows\System\FjOMPaT.exe
  2⤵
  PID:9128
- C:\Windows\System\jtvmOnF.exe
  C:\Windows\System\jtvmOnF.exe
  2⤵
  PID:9196
- C:\Windows\System\MqowLvr.exe
  C:\Windows\System\MqowLvr.exe
  2⤵
  PID:8332
- C:\Windows\System\PTUHFIz.exe
  C:\Windows\System\PTUHFIz.exe
  2⤵
  PID:8316
- C:\Windows\System\KTobaax.exe
  C:\Windows\System\KTobaax.exe
  2⤵
  PID:8380
- C:\Windows\System\FkYEMfP.exe
  C:\Windows\System\FkYEMfP.exe
  2⤵
  PID:8444
- C:\Windows\System\RMNdZyq.exe
  C:\Windows\System\RMNdZyq.exe
  2⤵
  PID:8972
- C:\Windows\System\ybKgrAT.exe
  C:\Windows\System\ybKgrAT.exe
  2⤵
  PID:9004
- C:\Windows\System\GHWvGtc.exe
  C:\Windows\System\GHWvGtc.exe
  2⤵
  PID:9080
- C:\Windows\System\TlbEZTK.exe
  C:\Windows\System\TlbEZTK.exe
  2⤵
  PID:9140
- C:\Windows\System\lnIlDPu.exe
  C:\Windows\System\lnIlDPu.exe
  2⤵
  PID:9180
- C:\Windows\System\uWICZur.exe
  C:\Windows\System\uWICZur.exe
  2⤵
  PID:8976
- C:\Windows\System\FcLPgae.exe
  C:\Windows\System\FcLPgae.exe
  2⤵
  PID:8708
- C:\Windows\System\xUQTnXu.exe
  C:\Windows\System\xUQTnXu.exe
  2⤵
  PID:8392
- C:\Windows\System\TjiQuwS.exe
  C:\Windows\System\TjiQuwS.exe
  2⤵
  PID:8220
- C:\Windows\System\pnNgbaw.exe
  C:\Windows\System\pnNgbaw.exe
  2⤵
  PID:8672
- C:\Windows\System\RcSrwxr.exe
  C:\Windows\System\RcSrwxr.exe
  2⤵
  PID:8752
- C:\Windows\System\InDfANN.exe
  C:\Windows\System\InDfANN.exe
  2⤵
  PID:8888
- C:\Windows\System\uzGYNVc.exe
  C:\Windows\System\uzGYNVc.exe
  2⤵
  PID:9172
- C:\Windows\System\zKnNbfJ.exe
  C:\Windows\System\zKnNbfJ.exe
  2⤵
  PID:8624
- C:\Windows\System\snXlpax.exe
  C:\Windows\System\snXlpax.exe
  2⤵
  PID:8876
- C:\Windows\System\QOjsWqR.exe
  C:\Windows\System\QOjsWqR.exe
  2⤵
  PID:9192
- C:\Windows\System\vOLbIIG.exe
  C:\Windows\System\vOLbIIG.exe
  2⤵
  PID:8768
- C:\Windows\System\tEpudfB.exe
  C:\Windows\System\tEpudfB.exe
  2⤵
  PID:8604
- C:\Windows\System\eziDnxX.exe
  C:\Windows\System\eziDnxX.exe
  2⤵
  PID:9040
- C:\Windows\System\EYauUzS.exe
  C:\Windows\System\EYauUzS.exe
  2⤵
  PID:8544
- C:\Windows\System\jEHHcGj.exe
  C:\Windows\System\jEHHcGj.exe
  2⤵
  PID:8724
- C:\Windows\System\QhZZjJn.exe
  C:\Windows\System\QhZZjJn.exe
  2⤵
  PID:7228
- C:\Windows\System\lAKHJiU.exe
  C:\Windows\System\lAKHJiU.exe
  2⤵
  PID:9096
- C:\Windows\System\IMdWxXj.exe
  C:\Windows\System\IMdWxXj.exe
  2⤵
  PID:8300
- C:\Windows\System\XrHcjtt.exe
  C:\Windows\System\XrHcjtt.exe
  2⤵
  PID:8480
- C:\Windows\System\bAJAwBx.exe
  C:\Windows\System\bAJAwBx.exe
  2⤵
  PID:9176
- C:\Windows\System\IoEiGvz.exe
  C:\Windows\System\IoEiGvz.exe
  2⤵
  PID:9020
- C:\Windows\System\uvjuuft.exe
  C:\Windows\System\uvjuuft.exe
  2⤵
  PID:9108
- C:\Windows\System\vyZNJMw.exe
  C:\Windows\System\vyZNJMw.exe
  2⤵
  PID:8216
- C:\Windows\System\JJLvhoU.exe
  C:\Windows\System\JJLvhoU.exe
  2⤵
  PID:8840
- C:\Windows\System\DjTRaCq.exe
  C:\Windows\System\DjTRaCq.exe
  2⤵
  PID:9092
- C:\Windows\System\cclggQQ.exe
  C:\Windows\System\cclggQQ.exe
  2⤵
  PID:8572
- C:\Windows\System\xwZEgWt.exe
  C:\Windows\System\xwZEgWt.exe
  2⤵
  PID:9212
- C:\Windows\System\EERjPZY.exe
  C:\Windows\System\EERjPZY.exe
  2⤵
  PID:8492
- C:\Windows\System\cfAKPEX.exe
  C:\Windows\System\cfAKPEX.exe
  2⤵
  PID:8944
- C:\Windows\System\gNnRspY.exe
  C:\Windows\System\gNnRspY.exe
  2⤵
  PID:8836
- C:\Windows\System\sjEcHJx.exe
  C:\Windows\System\sjEcHJx.exe
  2⤵
  PID:9228
- C:\Windows\System\RCFFYPo.exe
  C:\Windows\System\RCFFYPo.exe
  2⤵
  PID:9244
- C:\Windows\System\KTiNVhF.exe
  C:\Windows\System\KTiNVhF.exe
  2⤵
  PID:9260
- C:\Windows\System\ELxACSs.exe
  C:\Windows\System\ELxACSs.exe
  2⤵
  PID:9276
- C:\Windows\System\sczsxfL.exe
  C:\Windows\System\sczsxfL.exe
  2⤵
  PID:9292
- C:\Windows\System\bmBGdgK.exe
  C:\Windows\System\bmBGdgK.exe
  2⤵
  PID:9308
- C:\Windows\System\txogOMv.exe
  C:\Windows\System\txogOMv.exe
  2⤵
  PID:9324
- C:\Windows\System\HHouSDJ.exe
  C:\Windows\System\HHouSDJ.exe
  2⤵
  PID:9340
- C:\Windows\System\FloFmZP.exe
  C:\Windows\System\FloFmZP.exe
  2⤵
  PID:9356
- C:\Windows\System\AJmDLmE.exe
  C:\Windows\System\AJmDLmE.exe
  2⤵
  PID:9372
- C:\Windows\System\RYURgsA.exe
  C:\Windows\System\RYURgsA.exe
  2⤵
  PID:9392
- C:\Windows\System\ziUQFZK.exe
  C:\Windows\System\ziUQFZK.exe
  2⤵
  PID:9408
- C:\Windows\System\uHBHduU.exe
  C:\Windows\System\uHBHduU.exe
  2⤵
  PID:9424
- C:\Windows\System\aawxfby.exe
  C:\Windows\System\aawxfby.exe
  2⤵
  PID:9440
- C:\Windows\System\aqcpkwz.exe
  C:\Windows\System\aqcpkwz.exe
  2⤵
  PID:9460
- C:\Windows\System\usvxNGt.exe
  C:\Windows\System\usvxNGt.exe
  2⤵
  PID:9476
- C:\Windows\System\SggUWIm.exe
  C:\Windows\System\SggUWIm.exe
  2⤵
  PID:9492
- C:\Windows\System\JAvnCaI.exe
  C:\Windows\System\JAvnCaI.exe
  2⤵
  PID:9508
- C:\Windows\System\xclknkP.exe
  C:\Windows\System\xclknkP.exe
  2⤵
  PID:9528
- C:\Windows\System\TrVMjPT.exe
  C:\Windows\System\TrVMjPT.exe
  2⤵
  PID:9544
- C:\Windows\System\FPnUVBb.exe
  C:\Windows\System\FPnUVBb.exe
  2⤵
  PID:9564
- C:\Windows\System\bHiJaKa.exe
  C:\Windows\System\bHiJaKa.exe
  2⤵
  PID:9580
- C:\Windows\System\HCPshpY.exe
  C:\Windows\System\HCPshpY.exe
  2⤵
  PID:9596
- C:\Windows\System\xRKVDVs.exe
  C:\Windows\System\xRKVDVs.exe
  2⤵
  PID:9616
- C:\Windows\System\ChSZRGA.exe
  C:\Windows\System\ChSZRGA.exe
  2⤵
  PID:9632
- C:\Windows\System\zFeBkYi.exe
  C:\Windows\System\zFeBkYi.exe
  2⤵
  PID:9648
- C:\Windows\System\vTfFJfM.exe
  C:\Windows\System\vTfFJfM.exe
  2⤵
  PID:9668
- C:\Windows\System\SqmZPpO.exe
  C:\Windows\System\SqmZPpO.exe
  2⤵
  PID:9684
- C:\Windows\System\rcBoKgm.exe
  C:\Windows\System\rcBoKgm.exe
  2⤵
  PID:9704
- C:\Windows\System\fLDUOWo.exe
  C:\Windows\System\fLDUOWo.exe
  2⤵
  PID:9720
- C:\Windows\System\jBrwtcJ.exe
  C:\Windows\System\jBrwtcJ.exe
  2⤵
  PID:9736
- C:\Windows\System\LGNPRXp.exe
  C:\Windows\System\LGNPRXp.exe
  2⤵
  PID:9756
- C:\Windows\System\uCsyiog.exe
  C:\Windows\System\uCsyiog.exe
  2⤵
  PID:9772
- C:\Windows\System\iqrdeWl.exe
  C:\Windows\System\iqrdeWl.exe
  2⤵
  PID:9788
- C:\Windows\System\faDvvLd.exe
  C:\Windows\System\faDvvLd.exe
  2⤵
  PID:9808
- C:\Windows\System\QThIfJI.exe
  C:\Windows\System\QThIfJI.exe
  2⤵
  PID:9844
- C:\Windows\System\fnbCGEk.exe
  C:\Windows\System\fnbCGEk.exe
  2⤵
  PID:9860
- C:\Windows\System\fxiZtaA.exe
  C:\Windows\System\fxiZtaA.exe
  2⤵
  PID:9876
- C:\Windows\System\TtJlrha.exe
  C:\Windows\System\TtJlrha.exe
  2⤵
  PID:9892
- C:\Windows\System\PwMbWKW.exe
  C:\Windows\System\PwMbWKW.exe
  2⤵
  PID:9908
- C:\Windows\System\DwdIKmF.exe
  C:\Windows\System\DwdIKmF.exe
  2⤵
  PID:9924
- C:\Windows\System\KEcwZXK.exe
  C:\Windows\System\KEcwZXK.exe
  2⤵
  PID:9940
- C:\Windows\System\sqYWUaZ.exe
  C:\Windows\System\sqYWUaZ.exe
  2⤵
  PID:9956
- C:\Windows\System\ZVUUuVP.exe
  C:\Windows\System\ZVUUuVP.exe
  2⤵
  PID:9972
- C:\Windows\System\HNBZXgF.exe
  C:\Windows\System\HNBZXgF.exe
  2⤵
  PID:9988
- C:\Windows\System\DIpvyAh.exe
  C:\Windows\System\DIpvyAh.exe
  2⤵
  PID:10008
- C:\Windows\System\JYCEMND.exe
  C:\Windows\System\JYCEMND.exe
  2⤵
  PID:10024
- C:\Windows\System\GqsnGvd.exe
  C:\Windows\System\GqsnGvd.exe
  2⤵
  PID:10040
- C:\Windows\System\CwOGhaR.exe
  C:\Windows\System\CwOGhaR.exe
  2⤵
  PID:10056
- C:\Windows\System\nlnLizA.exe
  C:\Windows\System\nlnLizA.exe
  2⤵
  PID:10072
- C:\Windows\System\QDAIlKe.exe
  C:\Windows\System\QDAIlKe.exe
  2⤵
  PID:10088
- C:\Windows\System\EKxSLBA.exe
  C:\Windows\System\EKxSLBA.exe
  2⤵
  PID:10104
- C:\Windows\System\nldxYZm.exe
  C:\Windows\System\nldxYZm.exe
  2⤵
  PID:10128
- C:\Windows\System\mJUBjLA.exe
  C:\Windows\System\mJUBjLA.exe
  2⤵
  PID:10144
- C:\Windows\System\hVTYMaH.exe
  C:\Windows\System\hVTYMaH.exe
  2⤵
  PID:10160
- C:\Windows\System\ErNcgJM.exe
  C:\Windows\System\ErNcgJM.exe
  2⤵
  PID:10176
- C:\Windows\System\lDamtfV.exe
  C:\Windows\System\lDamtfV.exe
  2⤵
  PID:10192
- C:\Windows\System\FmucLcu.exe
  C:\Windows\System\FmucLcu.exe
  2⤵
  PID:10208
- C:\Windows\System\iYccsWC.exe
  C:\Windows\System\iYccsWC.exe
  2⤵
  PID:10224
- C:\Windows\System\EQtrDJq.exe
  C:\Windows\System\EQtrDJq.exe
  2⤵
  PID:9160
- C:\Windows\System\VcQMfNj.exe
  C:\Windows\System\VcQMfNj.exe
  2⤵
  PID:9284
- C:\Windows\System\BnNOLDs.exe
  C:\Windows\System\BnNOLDs.exe
  2⤵
  PID:9288
- C:\Windows\System\GhNwIwl.exe
  C:\Windows\System\GhNwIwl.exe
  2⤵
  PID:9388
- C:\Windows\System\SvGmgnM.exe
  C:\Windows\System\SvGmgnM.exe
  2⤵
  PID:9448
- C:\Windows\System\LXQLBTN.exe
  C:\Windows\System\LXQLBTN.exe
  2⤵
  PID:9240
- C:\Windows\System\Prcdogu.exe
  C:\Windows\System\Prcdogu.exe
  2⤵
  PID:9300
- C:\Windows\System\cwdxpCo.exe
  C:\Windows\System\cwdxpCo.exe
  2⤵
  PID:9436
- C:\Windows\System\kGiSMkf.exe
  C:\Windows\System\kGiSMkf.exe
  2⤵
  PID:9520
- C:\Windows\System\XiyoGrI.exe
  C:\Windows\System\XiyoGrI.exe
  2⤵
  PID:9556
- C:\Windows\System\vlKtPrc.exe
  C:\Windows\System\vlKtPrc.exe
  2⤵
  PID:9400
- C:\Windows\System\nUlSanp.exe
  C:\Windows\System\nUlSanp.exe
  2⤵
  PID:9656
- C:\Windows\System\ifIuZNL.exe
  C:\Windows\System\ifIuZNL.exe
  2⤵
  PID:9696
- C:\Windows\System\LxWlRCc.exe
  C:\Windows\System\LxWlRCc.exe
  2⤵
  PID:9472
- C:\Windows\System\GqBoRcT.exe
  C:\Windows\System\GqBoRcT.exe
  2⤵
  PID:9744
- C:\Windows\System\EsWUiWy.exe
  C:\Windows\System\EsWUiWy.exe
  2⤵
  PID:9612
- C:\Windows\System\wbOGufH.exe
  C:\Windows\System\wbOGufH.exe
  2⤵
  PID:9680
- C:\Windows\System\AuauKad.exe
  C:\Windows\System\AuauKad.exe
  2⤵
  PID:9728
- C:\Windows\System\xifkmnO.exe
  C:\Windows\System\xifkmnO.exe
  2⤵
  PID:9780
- C:\Windows\System\qjHSQew.exe
  C:\Windows\System\qjHSQew.exe
  2⤵
  PID:9796
- C:\Windows\System\mrqwnwe.exe
  C:\Windows\System\mrqwnwe.exe
  2⤵
  PID:9828
- C:\Windows\System\XxzIerW.exe
  C:\Windows\System\XxzIerW.exe
  2⤵
  PID:9868
- C:\Windows\System\tcUJYNO.exe
  C:\Windows\System\tcUJYNO.exe
  2⤵
  PID:9920
- C:\Windows\System\tSyVVEF.exe
  C:\Windows\System\tSyVVEF.exe
  2⤵
  PID:9984
- C:\Windows\System\hFlxjqG.exe
  C:\Windows\System\hFlxjqG.exe
  2⤵
  PID:10020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ASukDBT.exe

Filesize
2.2MB

MD5
92c8f34d2b53ded4ac90c7d3eaed6268

SHA1
e1200468e3571827af5f9812c9eba4898ce93e1e

SHA256
d0de37431770e4cad0bafaf36bb52c6adec97ee024d771ec5d8f5fef5586e229

SHA512
c0f2e7ddab405be57537e5318fd7d022f3b4e5dc68a03b3a12e25b20e47d8d042c11de5f8dcef3fb0eeea5911c82d1ec8ac29a699528cb84c98ebc9180f2eabb

Download Submit
C:\Windows\system\FklBvBB.exe

Filesize
8B

MD5
0b02220145771e90ebe4310a5742c9eb

SHA1
9bd568d96b03bd5446f96a7b59c08196eb5a57c3

SHA256
6135f164d0697be47c97ab606a7a1adcbc1eb3846ae4debecafb1a6ccfd23e4e

SHA512
cb08dee7f4e4dd1bb8de836a2364c078d9de5aef5dcb329e7e0b8e1cc2bfaa06c42f8b8ddf04bdb30392074759beef091a761854b0812b9a726b3c820c99a5a8

Download Submit
C:\Windows\system\IyIseSO.exe

Filesize
2.2MB

MD5
42ee6eb3332b40c6e93ac6c9ad0b6eca

SHA1
226bced76f95bde45f7287ff6249072caccb33c8

SHA256
25afc7f19f99fc19e586a22fce02543fc69ab4f6b3115a4efad89cdae3538f4a

SHA512
3bb59578619357e741c325ea5395b8fe7a0676d5af3b73ffc438852fee2d25627249a33b3dd1f9f4168c9cbfe251032edf1de55a4a3fb801020a889ceb8b92ec

Download Submit
C:\Windows\system\KPhVmrS.exe

Filesize
2.2MB

MD5
4ea0bc03487c4e1df5d507d5c079ab30

SHA1
6b3346e89e2eb10adc025772ab1fcefe3625602b

SHA256
fe4fbabbf51f181db9ef4aecf026bf1cafc7265efafac0ec7203159981eed94c

SHA512
f0e0fcd1ccd9ecf71ed20aebc9932025a933f82af75a48ba4e4b7c8bf407ca332550586084865a650af6a16f0ddd5460f387c68b95868bb1e47d6058f72e318c

Download Submit
C:\Windows\system\KjNHfMi.exe

Filesize
2.2MB

MD5
f0c23ce0ee014b3ab12d24c6d5405c1e

SHA1
382dd92fda5b9da4fd602f09f1709bb9b8c6b302

SHA256
45fa9bf13b593e348556c39b87a628d4573156ab86f7458db0e80213cc1eaf97

SHA512
ca1dc83579209fe61866597dd0a51f699a285a2ec0db1bd7aad6707fa5e0af77b2e08564e24cea2435724a93ef6fd0027fa8d8c13ec2a9a66b8e4913e6a3562b

Download Submit
C:\Windows\system\LwuHdHp.exe

Filesize
2.2MB

MD5
bb833f89bf61adfade46470de22caf54

SHA1
8056bed5881077cff0772acbff156b5b1b86c21c

SHA256
9b0b9db0e9897c9fd153fec0eadc3f2ef1100f0070ad5b7b4d2bf63846c2f287

SHA512
fade535d89f98502f2a520f29acfa6998b7919d86d3662d487577a75ab0bcc257ef025a150968c7dc0813f8f16fe583705462e4084c812cf8dd4bec5a145a86c

Download Submit
C:\Windows\system\OLmcEhf.exe

Filesize
2.2MB

MD5
d429109d57f6c0607f4c48262ff09e30

SHA1
3d4c002ea4dc71f9f4b71dd0169562dcca67e579

SHA256
ef30420eb96f0b69fb57e2100db96a13fdf7b5122b390e92c2e30077287577a8

SHA512
140b66eaeb9c5a998a106c5a95e33a2e23e602537c8508c8c8783209cc7778cf171ee72bca23a3521938f295bb8bdb89ea635df254d6e5b796654d12434786aa

Download Submit
C:\Windows\system\PueJaFq.exe

Filesize
2.2MB

MD5
e1b78b57830cfad2fbab98d5d3fd33e6

SHA1
81703ae8129ef44cb7e896aef786dbc3eccb5681

SHA256
9c44b9161508041d1c101c6728954849c138c5ce97f27fa0f7e9d118b5fb4d01

SHA512
5ad86ac1b05066369dc3aabd91734c69dda6149847daae4666428da4549877a298e1e98d8ca2ce4bb27c3b60b49691cd31a926c6e712d0ae1ee763921b4a2314

Download Submit
C:\Windows\system\QNDMozK.exe

Filesize
2.2MB

MD5
aa11ae34ac2e9a646f68f47908ea1908

SHA1
588b24789790ab250f0877565567313d8fce58d5

SHA256
b17f47c2099b6e641a1cdf426c6fb8ba9db7821ba8fbc11740249c05514dff41

SHA512
8dbf1d2165354664236871ad822c89956bdcf71199371cff0cd130a796dfd579c1a1f1da73b94898466bffcd5ff93eba797c5f89d032586ab91b850c998ec1b1

Download Submit
C:\Windows\system\QgqoIBh.exe

Filesize
2.2MB

MD5
3780d8c54c7ff536e71e1708a664206d

SHA1
f62cb9da15b0423e7131748b95058641369eb6ed

SHA256
cfc26eac7acd74d304de56233021c1e9248c32728a70a64068eb214aefc59800

SHA512
9f0a2ea8c3ccf85c82a4c18d8f2b9d715dc27221ee04c1fdf797112e5d3e9af18333943a7de09838692b2af218b66d4cb9710f06f640e07d9e838aad10c717e6

Download Submit
C:\Windows\system\VCbflMQ.exe

Filesize
2.2MB

MD5
fe29e1118d8f73998616eaeb6eab7cd0

SHA1
ffc32afbe881f0fae31a135abfd39c4282778080

SHA256
f67a8ba1ed253dda82d46e080c1869c8a267422f969157935cfedbd8fd51da9a

SHA512
93ca6803a9dbc11e38f9f88fa0ee5fc052143e5b94be190f5f654264378188b5779296993086ab7c8bd6d5edd824c3dd84ce7318d077b78ac8f80ddb44a27d02

Download Submit
C:\Windows\system\WrwewGr.exe

Filesize
2.2MB

MD5
aea8acb63661c8f09b3370c957ea8dba

SHA1
0dfee71688f2e2e6d42e97924b9468965fc07ec5

SHA256
5f62357471a0f06f308de6dd8e957f01d2420883576400cdd24587d44900ac91

SHA512
29bddfdc37bba7c73dc259fd4ad449f935428731c21979a16f40119ac9e936e23e9addbcb2924713b457fff3ddf6d1cd1c860a2c7813bd1c649eb08df835392e

Download Submit
C:\Windows\system\XCwOLou.exe

Filesize
2.2MB

MD5
f8abaa5e21f68edf21bdba8ad267005c

SHA1
5ee5feaff6ca43aa7599c161898fee3f6911ea87

SHA256
d7752c578fc3ff937694acfd6f8e51bf416b70d5ed12ba4ae54f2c9702fbd18f

SHA512
0e7dbd3d115c83fdd79821e8e8000b4de951ebcca5abb76d1a692e6d1f298c6307d6020ff4476d0a1cf5ca5b81049b8a518617b0c7f7e526b9b60e7ec3d613f7

Download Submit
C:\Windows\system\bbPqrJO.exe

Filesize
2.2MB

MD5
75682c76e1bdb99ef9b2c23d4bd19741

SHA1
24ba77a5b7d76282172f289e498ad7eeea0f89f1

SHA256
e5a39b44b67b3b1ea4ba01e0fe214896d1a84f3f0e08aab56fdf9f2d8dcebc7b

SHA512
acbd5396a5805a45208727c7b7e48ae401a83d1582aa1f5299573cdf2ede1015fb86b07531cef5cdf3204469fe291a0a3001322771982a5b20f7b526615fa004

Download Submit
C:\Windows\system\gJtRUPW.exe

Filesize
2.2MB

MD5
490e6a2a069c60ba6e2df2f8254c4c0c

SHA1
91bfb3d8cbd39a2e19d4a5ffa78694c1e94a2888

SHA256
9d3a1b826dd7b7e507dd75c2f820596f82f4c8b5be1ab24318dc8d6f5bacd000

SHA512
c4ffe62e607907e39f5d8757811977da4f2fa5fda0250d4e556870100c16b230cfd5a6968676ee30b59f720ba21a5d1935be22cb3846d64fb94ddbf837c1542e

Download Submit
C:\Windows\system\hzLpQJW.exe

Filesize
2.2MB

MD5
fd9065eaafcd046f16d91e9e80700b1b

SHA1
b15c97b84e654e595b74f8c6e2bf54f2d0c71fbe

SHA256
0af031953b836869115d468cfe3c7cfd5531aef3fa252c69482051393a7e6f03

SHA512
5ffc805f35c0a8adb424b7a3e426e7d93f99ac773840a4782999499a9d905452e58e221b9de645eec2eb2e29aae19fb80127b619e35c73120525afee11775638

Download Submit
C:\Windows\system\pBbPldO.exe

Filesize
2.2MB

MD5
6b08ddb8e7d986424de741bf49072f35

SHA1
b9f970addd752b2ec24adf98695b301551dc5eee

SHA256
65efa6c1ec0953fe946cdc9963335739a4233c054b76bc533dc0f625088c799a

SHA512
3fd98cb292e6679e18fe1ce62a6d7df8d0f415034da0ade6f454979a3b666899a80f693c5fb047a8a9a09337a4399b1ec10030daf4183e7e5274114e6ff068e7

Download Submit
C:\Windows\system\rUwVGuI.exe

Filesize
2.2MB

MD5
fbd9f6b46078150435f5af811381a497

SHA1
0e92d39f5709af2930ebdf10edf9f3a3a34bdcf0

SHA256
89202c9f741800dcef84d9905dc79ee2843ddb7263715b40fc549cee99800a5a

SHA512
af9d3d3aa350d53ae7a6454d89a7313a008df89640fed909ff214f5fa3218160cfbecd00464a255fe03cffff8a7527440ca9e61d8d9f60014ff8ba0e0ca06936

Download Submit
C:\Windows\system\ylAypGW.exe

Filesize
2.2MB

MD5
a77e1574fdf94726eb521b417abf92a6

SHA1
b58330199af63b4e0144f43445bd635e787dec3f

SHA256
65176e68db1f4c602246885b7d180af5539b477787cf847114b510e6c1ecf276

SHA512
fdcb9553bcf307b3c65e48c96fd6ece478b20d40797130e874fe2b67790bacd1a33bbfaf2f2520fac6aa6ad7a47bd836de2073c94bb9c727b9d66820095ed30e

Download Submit
\Windows\system\BSJOkgH.exe

Filesize
2.2MB

MD5
2ebcae5857c6b112b5538b07272c2fc6

SHA1
c1b0a4c0ba68b55accfb3d926b54f3d11a7eee6c

SHA256
4e0a7c89dc0086243ffc4514fd3d96ee71b02d6cf8ebaa1d1b7139e73bcb856c

SHA512
3d783777d72c130fe0ed12cb33b34a17331bef370da3f94f992d8c2c2213277a2e2abe360278b7f00fc62374762db95f8ffadb74e67c13c6c396ca9da33095e3

Download Submit
\Windows\system\DgJMZIS.exe

Filesize
2.2MB

MD5
9706b8c1712809f8d5a2d950aea2824c

SHA1
489c89d6876464cf074b796f9301fbd2c9eeca21

SHA256
c2c99bef1b01ccab671a40e226cc15f86b2ebcc8eff20808f245c892621c2621

SHA512
efff11f3167a150fa2d256cf5df92600cfc4e6ec2912a0c4038e96a2bb70472dbfe9001623f6ba90be8bd5d1e0ed7eaabe1024f80b5add2c52e3860209d5e748

Download Submit
\Windows\system\MrWrQzx.exe

Filesize
2.2MB

MD5
13a59eabf73a2eb3f99ba2f6668e3b0b

SHA1
ab9e1c844ea5ad5e3cace6743ee8043f6f6296ab

SHA256
6f51293ae1be365cd031b31138f8c8fe440f72b27222b024d066236281f0b22a

SHA512
e70c6dbbaaffabc4e385f3bc3cb17a682d0eb43b8c9b2483e7c35f25c7b5809e8e216f7b49c003cfa0b3c36e43afa3297eef13cce9621bb00440b564228f19e1

Download Submit
\Windows\system\OupfqNM.exe

Filesize
2.2MB

MD5
4232a956c09977cc9666f77a932229f7

SHA1
975ae4ebbc3429d93a22a46f6fbc8058c7f0b6c1

SHA256
d800047676fe4d9c9afba3300b749c0e449f335d7222bc889987cdec73508e2a

SHA512
0f752abe79ebeeec92d2f6addbc8df824b2bc0ce93028c3f04d11f27b4b80df46621fbe910cfdfcaf5473630b3d8cb994f6d218985bc8ec0035dcf43d6273d91

Download Submit
\Windows\system\TwuMIVd.exe

Filesize
2.2MB

MD5
5f358af3c481fc154212b6b171cbb78e

SHA1
141f765317c55751715dcc4d0f1bd8f16e072eed

SHA256
49a17ffa40ba462be37c521128129106120fa87c28c26273b236a8a34065f6fe

SHA512
2a2f246f500407d99ebfa1ff18d74cf124e276685b0349c1191a319ab491dedaee3dcf3f345a5438f5d57b181e2bfc233db63a1ae7e9e4e50eac8ee108a3d2ff

Download Submit
\Windows\system\UWPQuAh.exe

Filesize
2.2MB

MD5
5fbedb035086f44ba4d1a093e4bc5c9a

SHA1
c3fd5f912f0d7437cf312a7823141fd5f388342c

SHA256
a20fb8d3ebdea1e7cf1cb0cbbbd88f64fc56fcac6278d9092dd97c928f94edba

SHA512
f891e82cdc7d2752ca37dc24a7ff9d2477c23ba0073cad81f9cedf588981c7f0e4a15a3bf7825b9890fe28e086b16b70d527a5362b0aa26b79cc623b5ea1e7c9

Download Submit
\Windows\system\WLvIzUD.exe

Filesize
2.2MB

MD5
789fd58a6d74d3a83aa1e98b4f0cbdca

SHA1
db52ebef8508784b7a5b7d9163bef32c3c440233

SHA256
645e09daf2b2019ce68ab04198eaf0e5273d875e336f53ecab7cf4360249f7b7

SHA512
4c7d79d50b72695d0659903ef10abdddbe5c4d24ec1fdb7d9dfdc585445425bc149f61a6912d4dd79ef736ff34593b81e2b4fdf13ad27cb7e14104cde31c3f2a

Download Submit
\Windows\system\cDcpUpv.exe

Filesize
2.2MB

MD5
bc494fd34007531720992898ebe98730

SHA1
1ed14ed70894e22659556a7e3c8c4d21a2801d85

SHA256
25b663dd11ff012d933715ef222d87f02479bbdaaa17aeadd5980b490995f8c8

SHA512
7d3615ac7bcfa29e2ca9113ae0bcac41ebdf063b847ebc111365664df1d0d3de689b16ca1b0b4d3d403204b8a8b6d81095a4262d885516ac08861ce08e3dc7d5

Download Submit
\Windows\system\gMwOuzP.exe

Filesize
2.2MB

MD5
f16d29179900a016553f08ed0ee16a47

SHA1
a20ed035c29c2f182fa3fe29735168bb5aaf3168

SHA256
ffc53ea5880a37121233f6e6f0b49d0ff65ad12210bc1bd6541bc96cce203f44

SHA512
26c3daaaa7824b91474474de3c212899f4831429fe32bc9f5f0dbac7ba68f627b59a34293faf9a6dc3a174ecf8324a435e3321f592c380ccc886599ffa80d778

Download Submit
\Windows\system\gbDOmoy.exe

Filesize
2.2MB

MD5
3fe40d01269398a221f64320110c7e84

SHA1
647a179184171ac2c23bfc266eda30de4c50492f

SHA256
59849a4f5661f964d08d05b9fa2b5cf7795f656ac157dd5220f34227a6522468

SHA512
e1397ce0ef9e02387ee6ce17118b227548e789896af4af140ea396a96ebf3a982f7e18b678651b98d2c6eb77fc83b4c9d9a6267ce2bfaf9588463177d823b54c

Download Submit
\Windows\system\hvMNbJb.exe

Filesize
2.2MB

MD5
b58a238622e7345f0fb1c2f8368e96c8

SHA1
6d65b6b9fb1b4f11a17515c1cb05cea82ad87141

SHA256
ed3e85cdb325a49d1f3716de7b409d575c9f6b16ee752f1a035305ecfa52de50

SHA512
76b2346d23240b0f30f457322be4ddd9cf787c6391ea4757238fd5b4ea21d0777d54783c4f07d563960cf9864e8944143e346f5bd63f92266adf485577f0c9e8

Download Submit
\Windows\system\qpmheSP.exe

Filesize
2.2MB

MD5
5946b01b2dc977636c353453fefa6d14

SHA1
ee6ddea7dabb00aeb3afdb81204f74c7344a4a09

SHA256
b6ba4681d21e282437f8451ee2a5c094ff77b5fda5776fca76b36c5bbd0a24d1

SHA512
0f5a1c7dcf2ea2623dbe7876f7459b96474452dcab18931a841b1eba22b49fb6046d6e401711ebf1399fade15950240ef61076eea4f8fbb781aebadc77bf95e4

Download Submit
\Windows\system\swTKHsc.exe

Filesize
2.2MB

MD5
441d95c19f94a4d8b4d748874411ff81

SHA1
79d23baa6c851a8e9779e0b87d213a909bb74ae3

SHA256
ac14f9845c896ede05a3e8fe24815b5a72ba933d554871df9767acb9a9316896

SHA512
0e83e8c55d3a3c9ba17bc5a158046ee71a616bf6b740130c9fb164a451dac0015f8d3f18908adecd96837bcbd3283d5059f8150866c27863b21c6dbb1c93f47e

Download Submit
\Windows\system\yULWkxI.exe

Filesize
2.2MB

MD5
f9cc097044202831e035ad2084136371

SHA1
d8a736ae6f1d7e1e57a433af764745a5d66f6b42

SHA256
aca8630ff96409dc28f26a9361fcd4f7b76138b29bc75dfc5cb129a9e048cd9e

SHA512
3a88b88acb180eb946ade54331c0d0c07de16efdc97eef5b7eecf0ac6b1c801586f6c7d0192a1cf60dced42e00ffdbb5bcf99063ae2e5727ccb5177f2a86b8b2

Download Submit
\Windows\system\yhGIbjF.exe

Filesize
2.2MB

MD5
6513a52d63a78c67949d4f6daa97fe6c

SHA1
94c025d54dd21381dc238d74bf67340595d9d08a

SHA256
07925faa09532c43633f79c8d9e4c48125006646469749535b2265ff05bab888

SHA512
c3b65de117a1850765beb3358a266ad50f395d545a58fc6810778271af44def3e95674fe956404fab43c4e440f6ddfc2760daebc3b143c5873854761915c22a0

Download Submit
\Windows\system\zJzvLdB.exe

Filesize
2.2MB

MD5
7f47e7d06f8affed6f6b286911e6c6c6

SHA1
45e5f88fa13353688d1558cd2ab926e49aab3a0b

SHA256
210c08ee2efbe57680328b964c07f7f49b089b207ad76a69a36cbe7e3ca92f2c

SHA512
d75851dcf6001b435f0ca56e446c06eceb4e2ec169fb941800852bab038dfb75750b9ef24228e1ac4aae28177f1de9c0160a9fa8f35afff29021b576525c11e6

Download Submit
memory/1668-24-0x0000000002960000-0x00000000029E0000-memory.dmp

Filesize
512KB

Download
memory/1668-158-0x0000000002720000-0x0000000002728000-memory.dmp

Filesize
32KB

Download
memory/1668-67-0x000007FEF5700000-0x000007FEF609D000-memory.dmp

Filesize
9.6MB

Download
memory/1668-80-0x000000001B6C0000-0x000000001B9A2000-memory.dmp

Filesize
2.9MB

Download
memory/1668-134-0x000007FEF5700000-0x000007FEF609D000-memory.dmp

Filesize
9.6MB

Download
memory/1668-25-0x000007FEF59BE000-0x000007FEF59BF000-memory.dmp

Filesize
4KB

Download
memory/1668-422-0x000007FEF5700000-0x000007FEF609D000-memory.dmp

Filesize
9.6MB

Download
memory/1728-123-0x000000013F550000-0x000000013F942000-memory.dmp

Filesize
3.9MB

Download
memory/1728-5531-0x000000013F550000-0x000000013F942000-memory.dmp

Filesize
3.9MB

Download
memory/1776-81-0x000000013F9C0000-0x000000013FDB2000-memory.dmp

Filesize
3.9MB

Download
memory/1776-5393-0x000000013F9C0000-0x000000013FDB2000-memory.dmp

Filesize
3.9MB

Download
memory/1840-5403-0x000000013FA80000-0x000000013FE72000-memory.dmp

Filesize
3.9MB

Download
memory/1840-110-0x000000013FA80000-0x000000013FE72000-memory.dmp

Filesize
3.9MB

Download
memory/2052-5391-0x000000013F850000-0x000000013FC42000-memory.dmp

Filesize
3.9MB

Download
memory/2052-8-0x000000013F850000-0x000000013FC42000-memory.dmp

Filesize
3.9MB

Download
memory/2280-70-0x000000013F790000-0x000000013FB82000-memory.dmp

Filesize
3.9MB

Download
memory/2280-5400-0x000000013F790000-0x000000013FB82000-memory.dmp

Filesize
3.9MB

Download
memory/2372-7-0x000000013F850000-0x000000013FC42000-memory.dmp

Filesize
3.9MB

Download
memory/2372-109-0x000000013FA80000-0x000000013FE72000-memory.dmp

Filesize
3.9MB

Download
memory/2372-12803-0x000000013F450000-0x000000013F842000-memory.dmp

Filesize
3.9MB

Download
memory/2372-0-0x000000013F450000-0x000000013F842000-memory.dmp

Filesize
3.9MB

Download
memory/2372-143-0x0000000003670000-0x0000000003A62000-memory.dmp

Filesize
3.9MB

Download
memory/2372-71-0x000000013FB40000-0x000000013FF32000-memory.dmp

Filesize
3.9MB

Download
memory/2372-69-0x0000000002EE0000-0x00000000032D2000-memory.dmp

Filesize
3.9MB

Download
memory/2372-76-0x000000013F9C0000-0x000000013FDB2000-memory.dmp

Filesize
3.9MB

Download
memory/2372-13-0x0000000002EE0000-0x00000000032D2000-memory.dmp

Filesize
3.9MB

Download
memory/2372-119-0x0000000003670000-0x0000000003A62000-memory.dmp

Filesize
3.9MB

Download
memory/2372-111-0x000000013FBC0000-0x000000013FFB2000-memory.dmp

Filesize
3.9MB

Download
memory/2372-88-0x0000000003250000-0x0000000003642000-memory.dmp

Filesize
3.9MB

Download
memory/2372-1-0x0000000000180000-0x0000000000190000-memory.dmp

Filesize
64KB

Download
memory/2452-108-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/2452-5414-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/2496-100-0x000000013F820000-0x000000013FC12000-memory.dmp

Filesize
3.9MB

Download
memory/2496-5570-0x000000013F820000-0x000000013FC12000-memory.dmp

Filesize
3.9MB

Download
memory/2596-5388-0x000000013F0E0000-0x000000013F4D2000-memory.dmp

Filesize
3.9MB

Download
memory/2596-15-0x000000013F0E0000-0x000000013F4D2000-memory.dmp

Filesize
3.9MB

Download
memory/2736-5397-0x000000013FBC0000-0x000000013FFB2000-memory.dmp

Filesize
3.9MB

Download
memory/2736-112-0x000000013FBC0000-0x000000013FFB2000-memory.dmp

Filesize
3.9MB

Download
memory/2872-5399-0x000000013FB40000-0x000000013FF32000-memory.dmp

Filesize
3.9MB

Download
memory/2872-72-0x000000013FB40000-0x000000013FF32000-memory.dmp

Filesize
3.9MB

Download
memory/2896-5394-0x000000013F770000-0x000000013FB62000-memory.dmp

Filesize
3.9MB

Download
memory/2896-142-0x000000013F770000-0x000000013FB62000-memory.dmp

Filesize
3.9MB

Download