xmrig | 7f2d9472f33ea2da66a9fc650d03e7cbcfe94f59cc5c4c3af5eb548299f46fcb

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 05:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
Size

1.9MB
MD5

0daac1f9eccd235c4abf4aaa8c175628
SHA1

4d4e9cbfda5eac3bbc363f618c26f68f8e31b658
SHA256

7f2d9472f33ea2da66a9fc650d03e7cbcfe94f59cc5c4c3af5eb548299f46fcb
SHA512

c4dcfa06ebb734f700643a2ab199a299d38bbb87ee47023d0184fad70c611aee66ef095fbc9cf3c1ec6a6e0aea34950abe56c23a59022c9f8316641f93bbbbde
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+UR:NAB+

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 44 IoCs

miner

resource	yara_rule
behavioral2/memory/1556-251-0x00007FF737940000-0x00007FF737D32000-memory.dmp	xmrig
behavioral2/memory/1292-300-0x00007FF74B400000-0x00007FF74B7F2000-memory.dmp	xmrig
behavioral2/memory/4908-309-0x00007FF682A80000-0x00007FF682E72000-memory.dmp	xmrig
behavioral2/memory/3068-335-0x00007FF6B28C0000-0x00007FF6B2CB2000-memory.dmp	xmrig
behavioral2/memory/3608-344-0x00007FF6D7710000-0x00007FF6D7B02000-memory.dmp	xmrig
behavioral2/memory/2384-349-0x00007FF63A390000-0x00007FF63A782000-memory.dmp	xmrig
behavioral2/memory/5012-352-0x00007FF6B75E0000-0x00007FF6B79D2000-memory.dmp	xmrig
behavioral2/memory/2512-351-0x00007FF740C90000-0x00007FF741082000-memory.dmp	xmrig
behavioral2/memory/1972-348-0x00007FF69BFE0000-0x00007FF69C3D2000-memory.dmp	xmrig
behavioral2/memory/1620-347-0x00007FF720B00000-0x00007FF720EF2000-memory.dmp	xmrig
behavioral2/memory/2132-346-0x00007FF79EFB0000-0x00007FF79F3A2000-memory.dmp	xmrig
behavioral2/memory/1340-345-0x00007FF63C0A0000-0x00007FF63C492000-memory.dmp	xmrig
behavioral2/memory/2100-343-0x00007FF6E3FD0000-0x00007FF6E43C2000-memory.dmp	xmrig
behavioral2/memory/1636-337-0x00007FF6A8490000-0x00007FF6A8882000-memory.dmp	xmrig
behavioral2/memory/888-334-0x00007FF626210000-0x00007FF626602000-memory.dmp	xmrig
behavioral2/memory/2884-333-0x00007FF761710000-0x00007FF761B02000-memory.dmp	xmrig
behavioral2/memory/428-331-0x00007FF6A3040000-0x00007FF6A3432000-memory.dmp	xmrig
behavioral2/memory/1064-285-0x00007FF77D000000-0x00007FF77D3F2000-memory.dmp	xmrig
behavioral2/memory/1468-250-0x00007FF69B780000-0x00007FF69BB72000-memory.dmp	xmrig
behavioral2/memory/2448-218-0x00007FF69BE80000-0x00007FF69C272000-memory.dmp	xmrig
behavioral2/memory/2328-184-0x00007FF677F40000-0x00007FF678332000-memory.dmp	xmrig
behavioral2/memory/716-142-0x00007FF77B150000-0x00007FF77B542000-memory.dmp	xmrig
behavioral2/memory/4892-111-0x00007FF7455A0000-0x00007FF745992000-memory.dmp	xmrig
behavioral2/memory/1556-4628-0x00007FF737940000-0x00007FF737D32000-memory.dmp	xmrig
behavioral2/memory/1292-4631-0x00007FF74B400000-0x00007FF74B7F2000-memory.dmp	xmrig
behavioral2/memory/4892-4638-0x00007FF7455A0000-0x00007FF745992000-memory.dmp	xmrig
behavioral2/memory/2448-4624-0x00007FF69BE80000-0x00007FF69C272000-memory.dmp	xmrig
behavioral2/memory/2884-4642-0x00007FF761710000-0x00007FF761B02000-memory.dmp	xmrig
behavioral2/memory/888-4645-0x00007FF626210000-0x00007FF626602000-memory.dmp	xmrig
behavioral2/memory/1468-4654-0x00007FF69B780000-0x00007FF69BB72000-memory.dmp	xmrig
behavioral2/memory/2328-4667-0x00007FF677F40000-0x00007FF678332000-memory.dmp	xmrig
behavioral2/memory/1972-4682-0x00007FF69BFE0000-0x00007FF69C3D2000-memory.dmp	xmrig
behavioral2/memory/5012-4710-0x00007FF6B75E0000-0x00007FF6B79D2000-memory.dmp	xmrig
behavioral2/memory/2132-4701-0x00007FF79EFB0000-0x00007FF79F3A2000-memory.dmp	xmrig
behavioral2/memory/1620-4708-0x00007FF720B00000-0x00007FF720EF2000-memory.dmp	xmrig
behavioral2/memory/1340-4693-0x00007FF63C0A0000-0x00007FF63C492000-memory.dmp	xmrig
behavioral2/memory/1064-4681-0x00007FF77D000000-0x00007FF77D3F2000-memory.dmp	xmrig
behavioral2/memory/3068-4677-0x00007FF6B28C0000-0x00007FF6B2CB2000-memory.dmp	xmrig
behavioral2/memory/4908-4675-0x00007FF682A80000-0x00007FF682E72000-memory.dmp	xmrig
behavioral2/memory/1636-4679-0x00007FF6A8490000-0x00007FF6A8882000-memory.dmp	xmrig
behavioral2/memory/428-4673-0x00007FF6A3040000-0x00007FF6A3432000-memory.dmp	xmrig
behavioral2/memory/2100-4656-0x00007FF6E3FD0000-0x00007FF6E43C2000-memory.dmp	xmrig
behavioral2/memory/2384-4740-0x00007FF63A390000-0x00007FF63A782000-memory.dmp	xmrig
behavioral2/memory/3608-4735-0x00007FF6D7710000-0x00007FF6D7B02000-memory.dmp	xmrig

Blocklisted process makes network request 6 IoCs

flow	pid	Process
10	464	powershell.exe
12	464	powershell.exe
14	464	powershell.exe
15	464	powershell.exe
17	464	powershell.exe
18	464	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2068	IDFubHU.exe
4892	weBjqvS.exe
2512	KTEmaJs.exe
716	TidrlpV.exe
2328	FSvqdKH.exe
2448	IIHMtrC.exe
1468	AxgsBbA.exe
1556	CMOUwZI.exe
1064	xmUVLmB.exe
1292	FpZteog.exe
4908	UKKRMmn.exe
428	ZPGrKYM.exe
2884	fUtREWk.exe
888	hpcXTSb.exe
3068	xMpGrzI.exe
1636	mfEAfsp.exe
2100	imyPebO.exe
3608	JeAmyza.exe
1340	WXEIMwq.exe
2132	jVzOVWq.exe
1620	nYyUvXp.exe
1972	gLpUxuV.exe
2384	RVuiEAO.exe
5012	mjKifUn.exe
4900	JQpdZPL.exe
2088	hGdrTVh.exe
2396	lifQZJm.exe
1416	RgYJxzN.exe
3600	YINVLiX.exe
3752	oaKQJsU.exe
3644	fnmliMD.exe
2196	NMhNUFU.exe
4964	ilDkYic.exe
4856	OWDLris.exe
3052	ixgfsGy.exe
4776	GpLCnmU.exe
4688	dIwLhkX.exe
3796	RKtqMSJ.exe
2036	piEfQZj.exe
804	AwSzgLM.exe
3732	Aglplfy.exe
4960	VsWjuhf.exe
452	hupwpof.exe
4024	ONSRktC.exe
2660	ckrnzMT.exe
3708	pLpHYsn.exe
436	eMqXCVq.exe
2916	RzUlGUi.exe
448	lrBJuYf.exe
4896	jvUeDeD.exe
4980	IRSHohi.exe
1952	xPRJNUb.exe
4612	EWwHWpV.exe
3968	WOmFxai.exe
1440	verfpOE.exe
4400	qRsblUw.exe
4384	IhAEUXI.exe
3504	vWWvTnJ.exe
3536	ddkdFod.exe
4608	ZakHrKe.exe
2444	oLczosr.exe
1436	zmuTTXj.exe
2792	YDTHPwk.exe
592	jqRgKJM.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2912-0-0x00007FF6D1400000-0x00007FF6D17F2000-memory.dmp	upx
behavioral2/files/0x000a000000023bb1-7.dat	upx
behavioral2/files/0x000a000000023bb3-25.dat	upx
behavioral2/files/0x000a000000023bb4-26.dat	upx
behavioral2/files/0x0031000000023bb7-36.dat	upx
behavioral2/files/0x000a000000023bbe-86.dat	upx
behavioral2/memory/1556-251-0x00007FF737940000-0x00007FF737D32000-memory.dmp	upx
behavioral2/memory/1292-300-0x00007FF74B400000-0x00007FF74B7F2000-memory.dmp	upx
behavioral2/memory/4908-309-0x00007FF682A80000-0x00007FF682E72000-memory.dmp	upx
behavioral2/memory/3068-335-0x00007FF6B28C0000-0x00007FF6B2CB2000-memory.dmp	upx
behavioral2/memory/3608-344-0x00007FF6D7710000-0x00007FF6D7B02000-memory.dmp	upx
behavioral2/memory/2384-349-0x00007FF63A390000-0x00007FF63A782000-memory.dmp	upx
behavioral2/memory/5012-352-0x00007FF6B75E0000-0x00007FF6B79D2000-memory.dmp	upx
behavioral2/memory/2512-351-0x00007FF740C90000-0x00007FF741082000-memory.dmp	upx
behavioral2/memory/1972-348-0x00007FF69BFE0000-0x00007FF69C3D2000-memory.dmp	upx
behavioral2/memory/1620-347-0x00007FF720B00000-0x00007FF720EF2000-memory.dmp	upx
behavioral2/memory/2132-346-0x00007FF79EFB0000-0x00007FF79F3A2000-memory.dmp	upx
behavioral2/memory/1340-345-0x00007FF63C0A0000-0x00007FF63C492000-memory.dmp	upx
behavioral2/memory/2100-343-0x00007FF6E3FD0000-0x00007FF6E43C2000-memory.dmp	upx
behavioral2/memory/1636-337-0x00007FF6A8490000-0x00007FF6A8882000-memory.dmp	upx
behavioral2/memory/888-334-0x00007FF626210000-0x00007FF626602000-memory.dmp	upx
behavioral2/memory/2884-333-0x00007FF761710000-0x00007FF761B02000-memory.dmp	upx
behavioral2/memory/428-331-0x00007FF6A3040000-0x00007FF6A3432000-memory.dmp	upx
behavioral2/memory/1064-285-0x00007FF77D000000-0x00007FF77D3F2000-memory.dmp	upx
behavioral2/memory/1468-250-0x00007FF69B780000-0x00007FF69BB72000-memory.dmp	upx
behavioral2/memory/2448-218-0x00007FF69BE80000-0x00007FF69C272000-memory.dmp	upx
behavioral2/files/0x000a000000023bd4-185.dat	upx
behavioral2/memory/2328-184-0x00007FF677F40000-0x00007FF678332000-memory.dmp	upx
behavioral2/files/0x000a000000023bd3-183.dat	upx
behavioral2/files/0x000a000000023bc8-176.dat	upx
behavioral2/files/0x000a000000023bd2-175.dat	upx
behavioral2/files/0x000a000000023bc7-172.dat	upx
behavioral2/files/0x000c000000023b9e-166.dat	upx
behavioral2/files/0x000a000000023bc3-160.dat	upx
behavioral2/files/0x000a000000023bd0-159.dat	upx
behavioral2/files/0x000a000000023bc2-155.dat	upx
behavioral2/files/0x000a000000023bcf-154.dat	upx
behavioral2/files/0x000a000000023bd5-186.dat	upx
behavioral2/files/0x000a000000023bce-147.dat	upx
behavioral2/files/0x000a000000023bcd-146.dat	upx
behavioral2/files/0x000a000000023bc6-168.dat	upx
behavioral2/memory/716-142-0x00007FF77B150000-0x00007FF77B542000-memory.dmp	upx
behavioral2/files/0x000a000000023bcb-139.dat	upx
behavioral2/files/0x000a000000023bca-138.dat	upx
behavioral2/files/0x000a000000023bd1-163.dat	upx
behavioral2/files/0x000a000000023bc4-134.dat	upx
behavioral2/files/0x000a000000023bc9-133.dat	upx
behavioral2/files/0x000a000000023bbb-129.dat	upx
behavioral2/files/0x0031000000023bb8-126.dat	upx
behavioral2/files/0x000a000000023bbf-115.dat	upx
behavioral2/files/0x000a000000023bc1-149.dat	upx
behavioral2/files/0x000a000000023bcc-145.dat	upx
behavioral2/memory/4892-111-0x00007FF7455A0000-0x00007FF745992000-memory.dmp	upx
behavioral2/files/0x000a000000023bba-98.dat	upx
behavioral2/files/0x000a000000023bc0-92.dat	upx
behavioral2/files/0x000a000000023bc5-105.dat	upx
behavioral2/files/0x000a000000023bbd-79.dat	upx
behavioral2/files/0x000a000000023bbc-72.dat	upx
behavioral2/files/0x000a000000023bb5-62.dat	upx
behavioral2/files/0x000a000000023bb9-60.dat	upx
behavioral2/files/0x0031000000023bb6-55.dat	upx
behavioral2/files/0x000a000000023bb0-40.dat	upx
behavioral2/files/0x000a000000023bb2-37.dat	upx
behavioral2/memory/2068-18-0x00007FF78AA90000-0x00007FF78AE82000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
10	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\YQAwozA.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\aynvlWh.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\WYrqIlD.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\KOnnano.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\EWjkKVD.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\gHkJKqR.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\IrmoVFS.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\CCTgncY.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\nELfmRZ.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\wyWYYAk.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\lIDQTyu.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\ljoThag.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\uAdgNsL.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\CCpPqwH.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\zpfhkuJ.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\VpYofAw.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\myGauyZ.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\XUcvdBs.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\jRXjXvh.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\yCegfjc.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\xoyZazN.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\HYptHon.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\oePYXUT.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\GsuiSST.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\cjXRTTM.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\qHMmmhn.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\ofoexuS.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\UjmfXVz.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\yCeWMLI.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\MJjLTdE.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\SQEIHog.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\fqVInHM.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\XaOjHks.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\SmePcCb.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\GLHavGa.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\JasvAeD.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\QNMiqUn.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\ZWAeRWr.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\vdDhjQD.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\KVsKaoK.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\qomWFNY.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\KkueClq.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\diDMKoM.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\AwZEEVP.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\iCkSVFG.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\FhPHHwE.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\lVcTkVg.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\aYSEVrp.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\bFKrgir.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\rgyPwdK.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\ApBosKZ.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\QdsXtwC.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\SaObuAs.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\wpavxxd.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\NdfoBsm.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\SaYMPhM.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\Ssnmdtz.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\NiHxQwf.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\XDLkmqI.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\IhBgyrI.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\RYhutxP.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\fZESPiG.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\NwqscOQ.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\swcZmEN.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
464	powershell.exe
464	powershell.exe
464	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
Token: SeDebugPrivilege	464	powershell.exe
Token: SeLockMemoryPrivilege	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 464	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	84
PID 2912 wrote to memory of 464	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	84
PID 2912 wrote to memory of 2068	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	85
PID 2912 wrote to memory of 2068	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	85
PID 2912 wrote to memory of 2512	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	86
PID 2912 wrote to memory of 2512	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	86
PID 2912 wrote to memory of 716	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	87
PID 2912 wrote to memory of 716	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	87
PID 2912 wrote to memory of 4892	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	88
PID 2912 wrote to memory of 4892	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	88
PID 2912 wrote to memory of 2328	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	89
PID 2912 wrote to memory of 2328	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	89
PID 2912 wrote to memory of 2448	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	90
PID 2912 wrote to memory of 2448	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	90
PID 2912 wrote to memory of 1468	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	91
PID 2912 wrote to memory of 1468	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	91
PID 2912 wrote to memory of 1556	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	92
PID 2912 wrote to memory of 1556	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	92
PID 2912 wrote to memory of 1064	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	93
PID 2912 wrote to memory of 1064	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	93
PID 2912 wrote to memory of 4908	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	94
PID 2912 wrote to memory of 4908	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	94
PID 2912 wrote to memory of 1292	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	95
PID 2912 wrote to memory of 1292	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	95
PID 2912 wrote to memory of 3608	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	96
PID 2912 wrote to memory of 3608	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	96
PID 2912 wrote to memory of 428	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	97
PID 2912 wrote to memory of 428	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	97
PID 2912 wrote to memory of 2884	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	98
PID 2912 wrote to memory of 2884	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	98
PID 2912 wrote to memory of 888	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	99
PID 2912 wrote to memory of 888	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	99
PID 2912 wrote to memory of 3068	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	100
PID 2912 wrote to memory of 3068	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	100
PID 2912 wrote to memory of 1636	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	101
PID 2912 wrote to memory of 1636	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	101
PID 2912 wrote to memory of 2100	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	102
PID 2912 wrote to memory of 2100	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	102
PID 2912 wrote to memory of 1340	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	103
PID 2912 wrote to memory of 1340	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	103
PID 2912 wrote to memory of 2132	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	104
PID 2912 wrote to memory of 2132	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	104
PID 2912 wrote to memory of 1620	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	105
PID 2912 wrote to memory of 1620	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	105
PID 2912 wrote to memory of 1972	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	106
PID 2912 wrote to memory of 1972	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	106
PID 2912 wrote to memory of 2384	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	107
PID 2912 wrote to memory of 2384	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	107
PID 2912 wrote to memory of 5012	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	108
PID 2912 wrote to memory of 5012	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	108
PID 2912 wrote to memory of 4900	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	109
PID 2912 wrote to memory of 4900	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	109
PID 2912 wrote to memory of 2088	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	110
PID 2912 wrote to memory of 2088	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	110
PID 2912 wrote to memory of 2396	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	111
PID 2912 wrote to memory of 2396	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	111
PID 2912 wrote to memory of 1416	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	112
PID 2912 wrote to memory of 1416	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	112
PID 2912 wrote to memory of 3600	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	113
PID 2912 wrote to memory of 3600	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	113
PID 2912 wrote to memory of 3752	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	114
PID 2912 wrote to memory of 3752	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	114
PID 2912 wrote to memory of 3644	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	115
PID 2912 wrote to memory of 3644	2912	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:464
- C:\Windows\System\IDFubHU.exe
  C:\Windows\System\IDFubHU.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\KTEmaJs.exe
  C:\Windows\System\KTEmaJs.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\TidrlpV.exe
  C:\Windows\System\TidrlpV.exe
  2⤵
  - Executes dropped EXE
  PID:716
- C:\Windows\System\weBjqvS.exe
  C:\Windows\System\weBjqvS.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\FSvqdKH.exe
  C:\Windows\System\FSvqdKH.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\IIHMtrC.exe
  C:\Windows\System\IIHMtrC.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\AxgsBbA.exe
  C:\Windows\System\AxgsBbA.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\CMOUwZI.exe
  C:\Windows\System\CMOUwZI.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\xmUVLmB.exe
  C:\Windows\System\xmUVLmB.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\UKKRMmn.exe
  C:\Windows\System\UKKRMmn.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\FpZteog.exe
  C:\Windows\System\FpZteog.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\JeAmyza.exe
  C:\Windows\System\JeAmyza.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\ZPGrKYM.exe
  C:\Windows\System\ZPGrKYM.exe
  2⤵
  - Executes dropped EXE
  PID:428
- C:\Windows\System\fUtREWk.exe
  C:\Windows\System\fUtREWk.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\hpcXTSb.exe
  C:\Windows\System\hpcXTSb.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\xMpGrzI.exe
  C:\Windows\System\xMpGrzI.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\mfEAfsp.exe
  C:\Windows\System\mfEAfsp.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\imyPebO.exe
  C:\Windows\System\imyPebO.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\WXEIMwq.exe
  C:\Windows\System\WXEIMwq.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\jVzOVWq.exe
  C:\Windows\System\jVzOVWq.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\nYyUvXp.exe
  C:\Windows\System\nYyUvXp.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\gLpUxuV.exe
  C:\Windows\System\gLpUxuV.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\RVuiEAO.exe
  C:\Windows\System\RVuiEAO.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\mjKifUn.exe
  C:\Windows\System\mjKifUn.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\JQpdZPL.exe
  C:\Windows\System\JQpdZPL.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\hGdrTVh.exe
  C:\Windows\System\hGdrTVh.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\lifQZJm.exe
  C:\Windows\System\lifQZJm.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\RgYJxzN.exe
  C:\Windows\System\RgYJxzN.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\YINVLiX.exe
  C:\Windows\System\YINVLiX.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\oaKQJsU.exe
  C:\Windows\System\oaKQJsU.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\fnmliMD.exe
  C:\Windows\System\fnmliMD.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\NMhNUFU.exe
  C:\Windows\System\NMhNUFU.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\ilDkYic.exe
  C:\Windows\System\ilDkYic.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\OWDLris.exe
  C:\Windows\System\OWDLris.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\ixgfsGy.exe
  C:\Windows\System\ixgfsGy.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\GpLCnmU.exe
  C:\Windows\System\GpLCnmU.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\dIwLhkX.exe
  C:\Windows\System\dIwLhkX.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\RKtqMSJ.exe
  C:\Windows\System\RKtqMSJ.exe
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Windows\System\piEfQZj.exe
  C:\Windows\System\piEfQZj.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\AwSzgLM.exe
  C:\Windows\System\AwSzgLM.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\Aglplfy.exe
  C:\Windows\System\Aglplfy.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\VsWjuhf.exe
  C:\Windows\System\VsWjuhf.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\hupwpof.exe
  C:\Windows\System\hupwpof.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\ONSRktC.exe
  C:\Windows\System\ONSRktC.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\ckrnzMT.exe
  C:\Windows\System\ckrnzMT.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\pLpHYsn.exe
  C:\Windows\System\pLpHYsn.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\eMqXCVq.exe
  C:\Windows\System\eMqXCVq.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\RzUlGUi.exe
  C:\Windows\System\RzUlGUi.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\lrBJuYf.exe
  C:\Windows\System\lrBJuYf.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\jvUeDeD.exe
  C:\Windows\System\jvUeDeD.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\IRSHohi.exe
  C:\Windows\System\IRSHohi.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\xPRJNUb.exe
  C:\Windows\System\xPRJNUb.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\EWwHWpV.exe
  C:\Windows\System\EWwHWpV.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\WOmFxai.exe
  C:\Windows\System\WOmFxai.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\verfpOE.exe
  C:\Windows\System\verfpOE.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\qRsblUw.exe
  C:\Windows\System\qRsblUw.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\IhAEUXI.exe
  C:\Windows\System\IhAEUXI.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\vWWvTnJ.exe
  C:\Windows\System\vWWvTnJ.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\ddkdFod.exe
  C:\Windows\System\ddkdFod.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\ZakHrKe.exe
  C:\Windows\System\ZakHrKe.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\oLczosr.exe
  C:\Windows\System\oLczosr.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\zmuTTXj.exe
  C:\Windows\System\zmuTTXj.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\YDTHPwk.exe
  C:\Windows\System\YDTHPwk.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\jqRgKJM.exe
  C:\Windows\System\jqRgKJM.exe
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Windows\System\PIQWaKG.exe
  C:\Windows\System\PIQWaKG.exe
  2⤵
  PID:2424
- C:\Windows\System\qnEkUQT.exe
  C:\Windows\System\qnEkUQT.exe
  2⤵
  PID:524
- C:\Windows\System\WIMcvlT.exe
  C:\Windows\System\WIMcvlT.exe
  2⤵
  PID:1704
- C:\Windows\System\pFQMJyf.exe
  C:\Windows\System\pFQMJyf.exe
  2⤵
  PID:2892
- C:\Windows\System\sbhXciR.exe
  C:\Windows\System\sbhXciR.exe
  2⤵
  PID:4404
- C:\Windows\System\tkFDvRW.exe
  C:\Windows\System\tkFDvRW.exe
  2⤵
  PID:1600
- C:\Windows\System\fmPkrvD.exe
  C:\Windows\System\fmPkrvD.exe
  2⤵
  PID:1708
- C:\Windows\System\aXSJsne.exe
  C:\Windows\System\aXSJsne.exe
  2⤵
  PID:2248
- C:\Windows\System\fUGlWmm.exe
  C:\Windows\System\fUGlWmm.exe
  2⤵
  PID:1840
- C:\Windows\System\IPxuQPc.exe
  C:\Windows\System\IPxuQPc.exe
  2⤵
  PID:3352
- C:\Windows\System\FGeXeIg.exe
  C:\Windows\System\FGeXeIg.exe
  2⤵
  PID:3564
- C:\Windows\System\JsdKOWy.exe
  C:\Windows\System\JsdKOWy.exe
  2⤵
  PID:384
- C:\Windows\System\MSWQpGu.exe
  C:\Windows\System\MSWQpGu.exe
  2⤵
  PID:4572
- C:\Windows\System\ubFdFMN.exe
  C:\Windows\System\ubFdFMN.exe
  2⤵
  PID:1760
- C:\Windows\System\qtNrEmb.exe
  C:\Windows\System\qtNrEmb.exe
  2⤵
  PID:4112
- C:\Windows\System\bcmCynm.exe
  C:\Windows\System\bcmCynm.exe
  2⤵
  PID:5136
- C:\Windows\System\VlrgYIB.exe
  C:\Windows\System\VlrgYIB.exe
  2⤵
  PID:5404
- C:\Windows\System\LcoGZlt.exe
  C:\Windows\System\LcoGZlt.exe
  2⤵
  PID:5428
- C:\Windows\System\BtjEpVz.exe
  C:\Windows\System\BtjEpVz.exe
  2⤵
  PID:5452
- C:\Windows\System\FnTiAxo.exe
  C:\Windows\System\FnTiAxo.exe
  2⤵
  PID:5480
- C:\Windows\System\bqxgJgq.exe
  C:\Windows\System\bqxgJgq.exe
  2⤵
  PID:3668
- C:\Windows\System\MjPkwFf.exe
  C:\Windows\System\MjPkwFf.exe
  2⤵
  PID:4508
- C:\Windows\System\JIqQZvI.exe
  C:\Windows\System\JIqQZvI.exe
  2⤵
  PID:456
- C:\Windows\System\YEAdDtt.exe
  C:\Windows\System\YEAdDtt.exe
  2⤵
  PID:2520
- C:\Windows\System\ghsXQiu.exe
  C:\Windows\System\ghsXQiu.exe
  2⤵
  PID:3172
- C:\Windows\System\kazftBw.exe
  C:\Windows\System\kazftBw.exe
  2⤵
  PID:4124
- C:\Windows\System\LuIXqFM.exe
  C:\Windows\System\LuIXqFM.exe
  2⤵
  PID:4420
- C:\Windows\System\lETvLAp.exe
  C:\Windows\System\lETvLAp.exe
  2⤵
  PID:3652
- C:\Windows\System\YpnjfeC.exe
  C:\Windows\System\YpnjfeC.exe
  2⤵
  PID:3724
- C:\Windows\System\IgfplpF.exe
  C:\Windows\System\IgfplpF.exe
  2⤵
  PID:5864
- C:\Windows\System\nIbSROF.exe
  C:\Windows\System\nIbSROF.exe
  2⤵
  PID:5900
- C:\Windows\System\UcWWzJi.exe
  C:\Windows\System\UcWWzJi.exe
  2⤵
  PID:5920
- C:\Windows\System\fHHftWs.exe
  C:\Windows\System\fHHftWs.exe
  2⤵
  PID:5940
- C:\Windows\System\zsyZZbu.exe
  C:\Windows\System\zsyZZbu.exe
  2⤵
  PID:5968
- C:\Windows\System\ncqsJWc.exe
  C:\Windows\System\ncqsJWc.exe
  2⤵
  PID:5996
- C:\Windows\System\ExPKFXs.exe
  C:\Windows\System\ExPKFXs.exe
  2⤵
  PID:6020
- C:\Windows\System\ktOOVxi.exe
  C:\Windows\System\ktOOVxi.exe
  2⤵
  PID:6032
- C:\Windows\System\rCJEfpX.exe
  C:\Windows\System\rCJEfpX.exe
  2⤵
  PID:6048
- C:\Windows\System\LpjxiBf.exe
  C:\Windows\System\LpjxiBf.exe
  2⤵
  PID:6064
- C:\Windows\System\CAdprrt.exe
  C:\Windows\System\CAdprrt.exe
  2⤵
  PID:6080
- C:\Windows\System\uxjXZvf.exe
  C:\Windows\System\uxjXZvf.exe
  2⤵
  PID:1008
- C:\Windows\System\RxBrbHy.exe
  C:\Windows\System\RxBrbHy.exe
  2⤵
  PID:6116
- C:\Windows\System\guckRlQ.exe
  C:\Windows\System\guckRlQ.exe
  2⤵
  PID:6140
- C:\Windows\System\dmTarHa.exe
  C:\Windows\System\dmTarHa.exe
  2⤵
  PID:5240
- C:\Windows\System\gFVwddd.exe
  C:\Windows\System\gFVwddd.exe
  2⤵
  PID:4564
- C:\Windows\System\rdpTNOB.exe
  C:\Windows\System\rdpTNOB.exe
  2⤵
  PID:3868
- C:\Windows\System\UEpSNfU.exe
  C:\Windows\System\UEpSNfU.exe
  2⤵
  PID:5616
- C:\Windows\System\zrtHDUZ.exe
  C:\Windows\System\zrtHDUZ.exe
  2⤵
  PID:1244
- C:\Windows\System\VWdYxGx.exe
  C:\Windows\System\VWdYxGx.exe
  2⤵
  PID:5664
- C:\Windows\System\qPoFoGm.exe
  C:\Windows\System\qPoFoGm.exe
  2⤵
  PID:5728
- C:\Windows\System\xYkXTpq.exe
  C:\Windows\System\xYkXTpq.exe
  2⤵
  PID:2304
- C:\Windows\System\lKfIOFE.exe
  C:\Windows\System\lKfIOFE.exe
  2⤵
  PID:3520
- C:\Windows\System\hcwDlfw.exe
  C:\Windows\System\hcwDlfw.exe
  2⤵
  PID:2508
- C:\Windows\System\HHllqLK.exe
  C:\Windows\System\HHllqLK.exe
  2⤵
  PID:2880
- C:\Windows\System\GsuiSST.exe
  C:\Windows\System\GsuiSST.exe
  2⤵
  PID:3904
- C:\Windows\System\CnBKEXq.exe
  C:\Windows\System\CnBKEXq.exe
  2⤵
  PID:4456
- C:\Windows\System\iAWYbNQ.exe
  C:\Windows\System\iAWYbNQ.exe
  2⤵
  PID:2452
- C:\Windows\System\yKUhiES.exe
  C:\Windows\System\yKUhiES.exe
  2⤵
  PID:432
- C:\Windows\System\TBOzPMM.exe
  C:\Windows\System\TBOzPMM.exe
  2⤵
  PID:3276
- C:\Windows\System\thGWyIi.exe
  C:\Windows\System\thGWyIi.exe
  2⤵
  PID:4428
- C:\Windows\System\jWERvIO.exe
  C:\Windows\System\jWERvIO.exe
  2⤵
  PID:1804
- C:\Windows\System\OGHBjEc.exe
  C:\Windows\System\OGHBjEc.exe
  2⤵
  PID:5160
- C:\Windows\System\tNNvkUE.exe
  C:\Windows\System\tNNvkUE.exe
  2⤵
  PID:5204
- C:\Windows\System\GOoqaeO.exe
  C:\Windows\System\GOoqaeO.exe
  2⤵
  PID:5288
- C:\Windows\System\xalAxMg.exe
  C:\Windows\System\xalAxMg.exe
  2⤵
  PID:5344
- C:\Windows\System\lyJTNAJ.exe
  C:\Windows\System\lyJTNAJ.exe
  2⤵
  PID:5436
- C:\Windows\System\VeNxPwV.exe
  C:\Windows\System\VeNxPwV.exe
  2⤵
  PID:5500
- C:\Windows\System\shCYdhK.exe
  C:\Windows\System\shCYdhK.exe
  2⤵
  PID:5440
- C:\Windows\System\srwsAfu.exe
  C:\Windows\System\srwsAfu.exe
  2⤵
  PID:5524
- C:\Windows\System\XgPlkSu.exe
  C:\Windows\System\XgPlkSu.exe
  2⤵
  PID:5636
- C:\Windows\System\hUZkRfD.exe
  C:\Windows\System\hUZkRfD.exe
  2⤵
  PID:220
- C:\Windows\System\hdHbmPW.exe
  C:\Windows\System\hdHbmPW.exe
  2⤵
  PID:5716
- C:\Windows\System\MgfYWhv.exe
  C:\Windows\System\MgfYWhv.exe
  2⤵
  PID:2748
- C:\Windows\System\oYtYuRI.exe
  C:\Windows\System\oYtYuRI.exe
  2⤵
  PID:4484
- C:\Windows\System\UTxlfur.exe
  C:\Windows\System\UTxlfur.exe
  2⤵
  PID:4924
- C:\Windows\System\LHqNxob.exe
  C:\Windows\System\LHqNxob.exe
  2⤵
  PID:5092
- C:\Windows\System\uZSxBKT.exe
  C:\Windows\System\uZSxBKT.exe
  2⤵
  PID:684
- C:\Windows\System\XBFbzyA.exe
  C:\Windows\System\XBFbzyA.exe
  2⤵
  PID:5852
- C:\Windows\System\tyJihiM.exe
  C:\Windows\System\tyJihiM.exe
  2⤵
  PID:5876
- C:\Windows\System\pfXSUQm.exe
  C:\Windows\System\pfXSUQm.exe
  2⤵
  PID:5892
- C:\Windows\System\uhYDBQJ.exe
  C:\Windows\System\uhYDBQJ.exe
  2⤵
  PID:3208
- C:\Windows\System\klweiEg.exe
  C:\Windows\System\klweiEg.exe
  2⤵
  PID:5960
- C:\Windows\System\YWkMjcT.exe
  C:\Windows\System\YWkMjcT.exe
  2⤵
  PID:3960
- C:\Windows\System\FrnsEwP.exe
  C:\Windows\System\FrnsEwP.exe
  2⤵
  PID:6104
- C:\Windows\System\MXBGdzK.exe
  C:\Windows\System\MXBGdzK.exe
  2⤵
  PID:6124
- C:\Windows\System\PJsHgoi.exe
  C:\Windows\System\PJsHgoi.exe
  2⤵
  PID:772
- C:\Windows\System\bZWFKmY.exe
  C:\Windows\System\bZWFKmY.exe
  2⤵
  PID:4524
- C:\Windows\System\JkMwBLL.exe
  C:\Windows\System\JkMwBLL.exe
  2⤵
  PID:5668
- C:\Windows\System\ZDWHqVb.exe
  C:\Windows\System\ZDWHqVb.exe
  2⤵
  PID:6088
- C:\Windows\System\cWmelrC.exe
  C:\Windows\System\cWmelrC.exe
  2⤵
  PID:2516
- C:\Windows\System\lhmYtux.exe
  C:\Windows\System\lhmYtux.exe
  2⤵
  PID:1728
- C:\Windows\System\wCsfClR.exe
  C:\Windows\System\wCsfClR.exe
  2⤵
  PID:1388
- C:\Windows\System\hqZZUUQ.exe
  C:\Windows\System\hqZZUUQ.exe
  2⤵
  PID:4928
- C:\Windows\System\CEcxNmv.exe
  C:\Windows\System\CEcxNmv.exe
  2⤵
  PID:5552
- C:\Windows\System\ynWxkwh.exe
  C:\Windows\System\ynWxkwh.exe
  2⤵
  PID:2888
- C:\Windows\System\vRFSYky.exe
  C:\Windows\System\vRFSYky.exe
  2⤵
  PID:4432
- C:\Windows\System\luGAOeN.exe
  C:\Windows\System\luGAOeN.exe
  2⤵
  PID:2316
- C:\Windows\System\EtZwoDg.exe
  C:\Windows\System\EtZwoDg.exe
  2⤵
  PID:5612
- C:\Windows\System\sghWUXl.exe
  C:\Windows\System\sghWUXl.exe
  2⤵
  PID:5848
- C:\Windows\System\sKbmeEN.exe
  C:\Windows\System\sKbmeEN.exe
  2⤵
  PID:6152
- C:\Windows\System\XNahWXw.exe
  C:\Windows\System\XNahWXw.exe
  2⤵
  PID:6168
- C:\Windows\System\TTjWHHL.exe
  C:\Windows\System\TTjWHHL.exe
  2⤵
  PID:6200
- C:\Windows\System\kChuIxv.exe
  C:\Windows\System\kChuIxv.exe
  2⤵
  PID:6224
- C:\Windows\System\YgVPAGu.exe
  C:\Windows\System\YgVPAGu.exe
  2⤵
  PID:6244
- C:\Windows\System\GIbXhmF.exe
  C:\Windows\System\GIbXhmF.exe
  2⤵
  PID:6264
- C:\Windows\System\RGSXWOb.exe
  C:\Windows\System\RGSXWOb.exe
  2⤵
  PID:6280
- C:\Windows\System\ATPJMbl.exe
  C:\Windows\System\ATPJMbl.exe
  2⤵
  PID:6304
- C:\Windows\System\OAcarJg.exe
  C:\Windows\System\OAcarJg.exe
  2⤵
  PID:6324
- C:\Windows\System\JeMCdwy.exe
  C:\Windows\System\JeMCdwy.exe
  2⤵
  PID:6352
- C:\Windows\System\XpBXWwc.exe
  C:\Windows\System\XpBXWwc.exe
  2⤵
  PID:6372
- C:\Windows\System\QDmocMA.exe
  C:\Windows\System\QDmocMA.exe
  2⤵
  PID:6392
- C:\Windows\System\VOEGdmv.exe
  C:\Windows\System\VOEGdmv.exe
  2⤵
  PID:6416
- C:\Windows\System\jTwegIt.exe
  C:\Windows\System\jTwegIt.exe
  2⤵
  PID:6432
- C:\Windows\System\xSiZgcU.exe
  C:\Windows\System\xSiZgcU.exe
  2⤵
  PID:6456
- C:\Windows\System\WXbkJGa.exe
  C:\Windows\System\WXbkJGa.exe
  2⤵
  PID:6476
- C:\Windows\System\ynYesyR.exe
  C:\Windows\System\ynYesyR.exe
  2⤵
  PID:6500
- C:\Windows\System\tNdymeK.exe
  C:\Windows\System\tNdymeK.exe
  2⤵
  PID:6516
- C:\Windows\System\DygbwMs.exe
  C:\Windows\System\DygbwMs.exe
  2⤵
  PID:6540
- C:\Windows\System\PndRbQX.exe
  C:\Windows\System\PndRbQX.exe
  2⤵
  PID:6560
- C:\Windows\System\SpDdKcj.exe
  C:\Windows\System\SpDdKcj.exe
  2⤵
  PID:6580
- C:\Windows\System\aZcyOoe.exe
  C:\Windows\System\aZcyOoe.exe
  2⤵
  PID:6608
- C:\Windows\System\NawPPDx.exe
  C:\Windows\System\NawPPDx.exe
  2⤵
  PID:6624
- C:\Windows\System\ykQanuH.exe
  C:\Windows\System\ykQanuH.exe
  2⤵
  PID:6648
- C:\Windows\System\iBnYNID.exe
  C:\Windows\System\iBnYNID.exe
  2⤵
  PID:6672
- C:\Windows\System\yxSEjVw.exe
  C:\Windows\System\yxSEjVw.exe
  2⤵
  PID:6692
- C:\Windows\System\TlnmcQi.exe
  C:\Windows\System\TlnmcQi.exe
  2⤵
  PID:6712
- C:\Windows\System\ZNvmRQO.exe
  C:\Windows\System\ZNvmRQO.exe
  2⤵
  PID:6732
- C:\Windows\System\pWfCtuE.exe
  C:\Windows\System\pWfCtuE.exe
  2⤵
  PID:6756
- C:\Windows\System\cqCAUlM.exe
  C:\Windows\System\cqCAUlM.exe
  2⤵
  PID:6772
- C:\Windows\System\UNrKnWy.exe
  C:\Windows\System\UNrKnWy.exe
  2⤵
  PID:6796
- C:\Windows\System\wHGHFAh.exe
  C:\Windows\System\wHGHFAh.exe
  2⤵
  PID:6820
- C:\Windows\System\xDSLsvS.exe
  C:\Windows\System\xDSLsvS.exe
  2⤵
  PID:6840
- C:\Windows\System\zDoOXyF.exe
  C:\Windows\System\zDoOXyF.exe
  2⤵
  PID:6860
- C:\Windows\System\oXPqOKk.exe
  C:\Windows\System\oXPqOKk.exe
  2⤵
  PID:6880
- C:\Windows\System\tTnyszI.exe
  C:\Windows\System\tTnyszI.exe
  2⤵
  PID:6904
- C:\Windows\System\lqBhecS.exe
  C:\Windows\System\lqBhecS.exe
  2⤵
  PID:6920
- C:\Windows\System\vFzKOZe.exe
  C:\Windows\System\vFzKOZe.exe
  2⤵
  PID:6944
- C:\Windows\System\gJmmfJn.exe
  C:\Windows\System\gJmmfJn.exe
  2⤵
  PID:6964
- C:\Windows\System\PzBUHNZ.exe
  C:\Windows\System\PzBUHNZ.exe
  2⤵
  PID:6984
- C:\Windows\System\XYeelel.exe
  C:\Windows\System\XYeelel.exe
  2⤵
  PID:7008
- C:\Windows\System\pvwzpLg.exe
  C:\Windows\System\pvwzpLg.exe
  2⤵
  PID:7028
- C:\Windows\System\jbAIETj.exe
  C:\Windows\System\jbAIETj.exe
  2⤵
  PID:7052
- C:\Windows\System\SaMfyuS.exe
  C:\Windows\System\SaMfyuS.exe
  2⤵
  PID:7072
- C:\Windows\System\UmyozKC.exe
  C:\Windows\System\UmyozKC.exe
  2⤵
  PID:7096
- C:\Windows\System\FKckqbX.exe
  C:\Windows\System\FKckqbX.exe
  2⤵
  PID:7112
- C:\Windows\System\qyAuVoC.exe
  C:\Windows\System\qyAuVoC.exe
  2⤵
  PID:7136
- C:\Windows\System\rDVyAQn.exe
  C:\Windows\System\rDVyAQn.exe
  2⤵
  PID:7160
- C:\Windows\System\wxupruv.exe
  C:\Windows\System\wxupruv.exe
  2⤵
  PID:5236
- C:\Windows\System\soHgrLe.exe
  C:\Windows\System\soHgrLe.exe
  2⤵
  PID:5496
- C:\Windows\System\LFIErbG.exe
  C:\Windows\System\LFIErbG.exe
  2⤵
  PID:5088
- C:\Windows\System\vnoNjxk.exe
  C:\Windows\System\vnoNjxk.exe
  2⤵
  PID:5196
- C:\Windows\System\HTsDOKo.exe
  C:\Windows\System\HTsDOKo.exe
  2⤵
  PID:1672
- C:\Windows\System\BTvuZrR.exe
  C:\Windows\System\BTvuZrR.exe
  2⤵
  PID:5928
- C:\Windows\System\LevXnHT.exe
  C:\Windows\System\LevXnHT.exe
  2⤵
  PID:4168
- C:\Windows\System\UhNFKZF.exe
  C:\Windows\System\UhNFKZF.exe
  2⤵
  PID:6076
- C:\Windows\System\oWRqBib.exe
  C:\Windows\System\oWRqBib.exe
  2⤵
  PID:3212
- C:\Windows\System\duxYwEt.exe
  C:\Windows\System\duxYwEt.exe
  2⤵
  PID:440
- C:\Windows\System\ONkLauy.exe
  C:\Windows\System\ONkLauy.exe
  2⤵
  PID:5036
- C:\Windows\System\KMZrLdF.exe
  C:\Windows\System\KMZrLdF.exe
  2⤵
  PID:4312
- C:\Windows\System\DENYLoJ.exe
  C:\Windows\System\DENYLoJ.exe
  2⤵
  PID:5964
- C:\Windows\System\SaYMPhM.exe
  C:\Windows\System\SaYMPhM.exe
  2⤵
  PID:6192
- C:\Windows\System\qmmruoc.exe
  C:\Windows\System\qmmruoc.exe
  2⤵
  PID:5600
- C:\Windows\System\pzNNVSh.exe
  C:\Windows\System\pzNNVSh.exe
  2⤵
  PID:6524
- C:\Windows\System\iFFcook.exe
  C:\Windows\System\iFFcook.exe
  2⤵
  PID:6096
- C:\Windows\System\PJbCuuq.exe
  C:\Windows\System\PJbCuuq.exe
  2⤵
  PID:6252
- C:\Windows\System\ReFCOOP.exe
  C:\Windows\System\ReFCOOP.exe
  2⤵
  PID:6272
- C:\Windows\System\ncSZHNt.exe
  C:\Windows\System\ncSZHNt.exe
  2⤵
  PID:6344
- C:\Windows\System\CYpOzCB.exe
  C:\Windows\System\CYpOzCB.exe
  2⤵
  PID:7188
- C:\Windows\System\ckHSwpE.exe
  C:\Windows\System\ckHSwpE.exe
  2⤵
  PID:7204
- C:\Windows\System\ZvcfgLE.exe
  C:\Windows\System\ZvcfgLE.exe
  2⤵
  PID:7228
- C:\Windows\System\TrbORzZ.exe
  C:\Windows\System\TrbORzZ.exe
  2⤵
  PID:7244
- C:\Windows\System\BAbpfCH.exe
  C:\Windows\System\BAbpfCH.exe
  2⤵
  PID:7280
- C:\Windows\System\qiIsvMq.exe
  C:\Windows\System\qiIsvMq.exe
  2⤵
  PID:7300
- C:\Windows\System\GPDhMlZ.exe
  C:\Windows\System\GPDhMlZ.exe
  2⤵
  PID:7320
- C:\Windows\System\uHbsfyQ.exe
  C:\Windows\System\uHbsfyQ.exe
  2⤵
  PID:7344
- C:\Windows\System\sQXymFB.exe
  C:\Windows\System\sQXymFB.exe
  2⤵
  PID:7364
- C:\Windows\System\jtmzLWB.exe
  C:\Windows\System\jtmzLWB.exe
  2⤵
  PID:7392
- C:\Windows\System\dNFpubq.exe
  C:\Windows\System\dNFpubq.exe
  2⤵
  PID:7412
- C:\Windows\System\gyDKVKR.exe
  C:\Windows\System\gyDKVKR.exe
  2⤵
  PID:7436
- C:\Windows\System\SZwfqGA.exe
  C:\Windows\System\SZwfqGA.exe
  2⤵
  PID:7468
- C:\Windows\System\maDfpfD.exe
  C:\Windows\System\maDfpfD.exe
  2⤵
  PID:7484
- C:\Windows\System\ADZTCQf.exe
  C:\Windows\System\ADZTCQf.exe
  2⤵
  PID:7500
- C:\Windows\System\mILupXw.exe
  C:\Windows\System\mILupXw.exe
  2⤵
  PID:7524
- C:\Windows\System\GfipOSg.exe
  C:\Windows\System\GfipOSg.exe
  2⤵
  PID:7544
- C:\Windows\System\NoAqgqE.exe
  C:\Windows\System\NoAqgqE.exe
  2⤵
  PID:7560
- C:\Windows\System\sOhOavI.exe
  C:\Windows\System\sOhOavI.exe
  2⤵
  PID:7584
- C:\Windows\System\QTgxGOg.exe
  C:\Windows\System\QTgxGOg.exe
  2⤵
  PID:7604
- C:\Windows\System\SMHMcZh.exe
  C:\Windows\System\SMHMcZh.exe
  2⤵
  PID:7624
- C:\Windows\System\UfAjajA.exe
  C:\Windows\System\UfAjajA.exe
  2⤵
  PID:7648
- C:\Windows\System\CduCIoe.exe
  C:\Windows\System\CduCIoe.exe
  2⤵
  PID:7664
- C:\Windows\System\yyrLmnN.exe
  C:\Windows\System\yyrLmnN.exe
  2⤵
  PID:7692
- C:\Windows\System\AmUBZbl.exe
  C:\Windows\System\AmUBZbl.exe
  2⤵
  PID:7716
- C:\Windows\System\ivhznid.exe
  C:\Windows\System\ivhznid.exe
  2⤵
  PID:7736
- C:\Windows\System\QgmxcaG.exe
  C:\Windows\System\QgmxcaG.exe
  2⤵
  PID:7756
- C:\Windows\System\LPFulhh.exe
  C:\Windows\System\LPFulhh.exe
  2⤵
  PID:7776
- C:\Windows\System\tvzgoez.exe
  C:\Windows\System\tvzgoez.exe
  2⤵
  PID:7796
- C:\Windows\System\LzVQrng.exe
  C:\Windows\System\LzVQrng.exe
  2⤵
  PID:7820
- C:\Windows\System\MXCBAuj.exe
  C:\Windows\System\MXCBAuj.exe
  2⤵
  PID:7840
- C:\Windows\System\ylfPmzG.exe
  C:\Windows\System\ylfPmzG.exe
  2⤵
  PID:7856
- C:\Windows\System\JUhtJft.exe
  C:\Windows\System\JUhtJft.exe
  2⤵
  PID:7884
- C:\Windows\System\wcPCNwN.exe
  C:\Windows\System\wcPCNwN.exe
  2⤵
  PID:7904
- C:\Windows\System\xqkVJXe.exe
  C:\Windows\System\xqkVJXe.exe
  2⤵
  PID:7928
- C:\Windows\System\nTGQFaD.exe
  C:\Windows\System\nTGQFaD.exe
  2⤵
  PID:7944
- C:\Windows\System\pDmGlfN.exe
  C:\Windows\System\pDmGlfN.exe
  2⤵
  PID:7968
- C:\Windows\System\ERatKiX.exe
  C:\Windows\System\ERatKiX.exe
  2⤵
  PID:7988
- C:\Windows\System\JomHuYk.exe
  C:\Windows\System\JomHuYk.exe
  2⤵
  PID:8012
- C:\Windows\System\SKjzTJd.exe
  C:\Windows\System\SKjzTJd.exe
  2⤵
  PID:8032
- C:\Windows\System\WJKSdzE.exe
  C:\Windows\System\WJKSdzE.exe
  2⤵
  PID:8048
- C:\Windows\System\uBQUHXa.exe
  C:\Windows\System\uBQUHXa.exe
  2⤵
  PID:8064
- C:\Windows\System\DDezquP.exe
  C:\Windows\System\DDezquP.exe
  2⤵
  PID:8084
- C:\Windows\System\LoAcjSF.exe
  C:\Windows\System\LoAcjSF.exe
  2⤵
  PID:8104
- C:\Windows\System\tgAdvoI.exe
  C:\Windows\System\tgAdvoI.exe
  2⤵
  PID:8128
- C:\Windows\System\dxVvnpB.exe
  C:\Windows\System\dxVvnpB.exe
  2⤵
  PID:8148
- C:\Windows\System\WrvkbNX.exe
  C:\Windows\System\WrvkbNX.exe
  2⤵
  PID:8172
- C:\Windows\System\xqNvETe.exe
  C:\Windows\System\xqNvETe.exe
  2⤵
  PID:8188
- C:\Windows\System\lnazpfw.exe
  C:\Windows\System\lnazpfw.exe
  2⤵
  PID:6848
- C:\Windows\System\vkrUspg.exe
  C:\Windows\System\vkrUspg.exe
  2⤵
  PID:6176
- C:\Windows\System\qVwozgP.exe
  C:\Windows\System\qVwozgP.exe
  2⤵
  PID:3532
- C:\Windows\System\qPBPqBc.exe
  C:\Windows\System\qPBPqBc.exe
  2⤵
  PID:6572
- C:\Windows\System\fbJrkCq.exe
  C:\Windows\System\fbJrkCq.exe
  2⤵
  PID:6600
- C:\Windows\System\uaSothF.exe
  C:\Windows\System\uaSothF.exe
  2⤵
  PID:6364
- C:\Windows\System\sUiUSSm.exe
  C:\Windows\System\sUiUSSm.exe
  2⤵
  PID:6768
- C:\Windows\System\tmHLaWa.exe
  C:\Windows\System\tmHLaWa.exe
  2⤵
  PID:6816
- C:\Windows\System\SIvqZeE.exe
  C:\Windows\System\SIvqZeE.exe
  2⤵
  PID:6260
- C:\Windows\System\VdSSsEn.exe
  C:\Windows\System\VdSSsEn.exe
  2⤵
  PID:7220
- C:\Windows\System\zLQrdOw.exe
  C:\Windows\System\zLQrdOw.exe
  2⤵
  PID:6872
- C:\Windows\System\KVaENCU.exe
  C:\Windows\System\KVaENCU.exe
  2⤵
  PID:7420
- C:\Windows\System\Gmjkqcw.exe
  C:\Windows\System\Gmjkqcw.exe
  2⤵
  PID:5144
- C:\Windows\System\DhdzvIm.exe
  C:\Windows\System\DhdzvIm.exe
  2⤵
  PID:5948
- C:\Windows\System\ZneoSQN.exe
  C:\Windows\System\ZneoSQN.exe
  2⤵
  PID:7252
- C:\Windows\System\jQqDhwQ.exe
  C:\Windows\System\jQqDhwQ.exe
  2⤵
  PID:8200
- C:\Windows\System\UbntAPI.exe
  C:\Windows\System\UbntAPI.exe
  2⤵
  PID:8224
- C:\Windows\System\wmqPEYQ.exe
  C:\Windows\System\wmqPEYQ.exe
  2⤵
  PID:8240
- C:\Windows\System\yTmhUZg.exe
  C:\Windows\System\yTmhUZg.exe
  2⤵
  PID:8264
- C:\Windows\System\zKFggpj.exe
  C:\Windows\System\zKFggpj.exe
  2⤵
  PID:8296
- C:\Windows\System\DWSyzUb.exe
  C:\Windows\System\DWSyzUb.exe
  2⤵
  PID:8340
- C:\Windows\System\DCirUeV.exe
  C:\Windows\System\DCirUeV.exe
  2⤵
  PID:8388
- C:\Windows\System\vutRhJO.exe
  C:\Windows\System\vutRhJO.exe
  2⤵
  PID:8408
- C:\Windows\System\msfjijS.exe
  C:\Windows\System\msfjijS.exe
  2⤵
  PID:8464
- C:\Windows\System\qrTiBix.exe
  C:\Windows\System\qrTiBix.exe
  2⤵
  PID:8520
- C:\Windows\System\aUHmSWf.exe
  C:\Windows\System\aUHmSWf.exe
  2⤵
  PID:8552
- C:\Windows\System\tTNqzkW.exe
  C:\Windows\System\tTNqzkW.exe
  2⤵
  PID:8584
- C:\Windows\System\xYpMOqj.exe
  C:\Windows\System\xYpMOqj.exe
  2⤵
  PID:8604
- C:\Windows\System\UFAKEGQ.exe
  C:\Windows\System\UFAKEGQ.exe
  2⤵
  PID:8628
- C:\Windows\System\WamIiGP.exe
  C:\Windows\System\WamIiGP.exe
  2⤵
  PID:8644
- C:\Windows\System\UlGmswD.exe
  C:\Windows\System\UlGmswD.exe
  2⤵
  PID:8672
- C:\Windows\System\rWMCaZu.exe
  C:\Windows\System\rWMCaZu.exe
  2⤵
  PID:8688
- C:\Windows\System\WobWkKj.exe
  C:\Windows\System\WobWkKj.exe
  2⤵
  PID:8708
- C:\Windows\System\SoMdLEM.exe
  C:\Windows\System\SoMdLEM.exe
  2⤵
  PID:8736
- C:\Windows\System\ApbVThF.exe
  C:\Windows\System\ApbVThF.exe
  2⤵
  PID:8764
- C:\Windows\System\TKJlmjp.exe
  C:\Windows\System\TKJlmjp.exe
  2⤵
  PID:8784
- C:\Windows\System\kITvDRx.exe
  C:\Windows\System\kITvDRx.exe
  2⤵
  PID:8804
- C:\Windows\System\XsAjrbM.exe
  C:\Windows\System\XsAjrbM.exe
  2⤵
  PID:8828
- C:\Windows\System\nDBUJYj.exe
  C:\Windows\System\nDBUJYj.exe
  2⤵
  PID:8852
- C:\Windows\System\OZHTrGh.exe
  C:\Windows\System\OZHTrGh.exe
  2⤵
  PID:8872
- C:\Windows\System\MtGCfhZ.exe
  C:\Windows\System\MtGCfhZ.exe
  2⤵
  PID:8896
- C:\Windows\System\mfoVmPn.exe
  C:\Windows\System\mfoVmPn.exe
  2⤵
  PID:8920
- C:\Windows\System\cGzGCwW.exe
  C:\Windows\System\cGzGCwW.exe
  2⤵
  PID:8940
- C:\Windows\System\yIgFIJY.exe
  C:\Windows\System\yIgFIJY.exe
  2⤵
  PID:8960
- C:\Windows\System\mpCAovB.exe
  C:\Windows\System\mpCAovB.exe
  2⤵
  PID:8984
- C:\Windows\System\eqkACpe.exe
  C:\Windows\System\eqkACpe.exe
  2⤵
  PID:9008
- C:\Windows\System\NwZrSeb.exe
  C:\Windows\System\NwZrSeb.exe
  2⤵
  PID:9028
- C:\Windows\System\iMbKMqC.exe
  C:\Windows\System\iMbKMqC.exe
  2⤵
  PID:9052
- C:\Windows\System\iVRIhjI.exe
  C:\Windows\System\iVRIhjI.exe
  2⤵
  PID:9076
- C:\Windows\System\kNRBRWy.exe
  C:\Windows\System\kNRBRWy.exe
  2⤵
  PID:9104
- C:\Windows\System\BSHJSGT.exe
  C:\Windows\System\BSHJSGT.exe
  2⤵
  PID:4052
- C:\Windows\System\yagAlhv.exe
  C:\Windows\System\yagAlhv.exe
  2⤵
  PID:7312
- C:\Windows\System\qzogaAi.exe
  C:\Windows\System\qzogaAi.exe
  2⤵
  PID:3544
- C:\Windows\System\nfyExjS.exe
  C:\Windows\System\nfyExjS.exe
  2⤵
  PID:8272
- C:\Windows\System\MWLNLNm.exe
  C:\Windows\System\MWLNLNm.exe
  2⤵
  PID:6728
- C:\Windows\System\PtsJsHK.exe
  C:\Windows\System\PtsJsHK.exe
  2⤵
  PID:6656
- C:\Windows\System\MPHcdxm.exe
  C:\Windows\System\MPHcdxm.exe
  2⤵
  PID:7576
- C:\Windows\System\dWPWURD.exe
  C:\Windows\System\dWPWURD.exe
  2⤵
  PID:8756
- C:\Windows\System\hrkwNer.exe
  C:\Windows\System\hrkwNer.exe
  2⤵
  PID:8860
- C:\Windows\System\WgkOMKb.exe
  C:\Windows\System\WgkOMKb.exe
  2⤵
  PID:8280
- C:\Windows\System\sFlkbuX.exe
  C:\Windows\System\sFlkbuX.exe
  2⤵
  PID:8700
- C:\Windows\System\KVJiaRa.exe
  C:\Windows\System\KVJiaRa.exe
  2⤵
  PID:9068
- C:\Windows\System\rWdLPGV.exe
  C:\Windows\System\rWdLPGV.exe
  2⤵
  PID:8888
- C:\Windows\System\xwWsiBE.exe
  C:\Windows\System\xwWsiBE.exe
  2⤵
  PID:8992
- C:\Windows\System\sWlwKGb.exe
  C:\Windows\System\sWlwKGb.exe
  2⤵
  PID:8596
- C:\Windows\System\DfnRLKI.exe
  C:\Windows\System\DfnRLKI.exe
  2⤵
  PID:9164
- C:\Windows\System\mQbKJDO.exe
  C:\Windows\System\mQbKJDO.exe
  2⤵
  PID:7772
- C:\Windows\System\xCCJzAG.exe
  C:\Windows\System\xCCJzAG.exe
  2⤵
  PID:7408
- C:\Windows\System\EeYHrSi.exe
  C:\Windows\System\EeYHrSi.exe
  2⤵
  PID:6616
- C:\Windows\System\DyAgxsZ.exe
  C:\Windows\System\DyAgxsZ.exe
  2⤵
  PID:8196
- C:\Windows\System\cdEXHZz.exe
  C:\Windows\System\cdEXHZz.exe
  2⤵
  PID:920
- C:\Windows\System\eGlWyfx.exe
  C:\Windows\System\eGlWyfx.exe
  2⤵
  PID:9092
- C:\Windows\System\tzJdIJR.exe
  C:\Windows\System\tzJdIJR.exe
  2⤵
  PID:4260
- C:\Windows\System\VRKnxfQ.exe
  C:\Windows\System\VRKnxfQ.exe
  2⤵
  PID:8040
- C:\Windows\System\xbvMfav.exe
  C:\Windows\System\xbvMfav.exe
  2⤵
  PID:4784
- C:\Windows\System\kfYTCMf.exe
  C:\Windows\System\kfYTCMf.exe
  2⤵
  PID:8704
- C:\Windows\System\JcILYQA.exe
  C:\Windows\System\JcILYQA.exe
  2⤵
  PID:8824
- C:\Windows\System\eMLELbG.exe
  C:\Windows\System\eMLELbG.exe
  2⤵
  PID:9228
- C:\Windows\System\XWGdONT.exe
  C:\Windows\System\XWGdONT.exe
  2⤵
  PID:9244
- C:\Windows\System\qSRsYHc.exe
  C:\Windows\System\qSRsYHc.exe
  2⤵
  PID:9268
- C:\Windows\System\yODxHiJ.exe
  C:\Windows\System\yODxHiJ.exe
  2⤵
  PID:9292
- C:\Windows\System\bhEvcuW.exe
  C:\Windows\System\bhEvcuW.exe
  2⤵
  PID:9312
- C:\Windows\System\WDuGJVb.exe
  C:\Windows\System\WDuGJVb.exe
  2⤵
  PID:9332
- C:\Windows\System\CKvjtVx.exe
  C:\Windows\System\CKvjtVx.exe
  2⤵
  PID:9356
- C:\Windows\System\aFcNoAE.exe
  C:\Windows\System\aFcNoAE.exe
  2⤵
  PID:9376
- C:\Windows\System\UJEiCpj.exe
  C:\Windows\System\UJEiCpj.exe
  2⤵
  PID:9392
- C:\Windows\System\uPidbOt.exe
  C:\Windows\System\uPidbOt.exe
  2⤵
  PID:9424
- C:\Windows\System\BTepBjN.exe
  C:\Windows\System\BTepBjN.exe
  2⤵
  PID:9440
- C:\Windows\System\NdJHKVY.exe
  C:\Windows\System\NdJHKVY.exe
  2⤵
  PID:9464
- C:\Windows\System\OyXUtrq.exe
  C:\Windows\System\OyXUtrq.exe
  2⤵
  PID:9480
- C:\Windows\System\pdHYVXq.exe
  C:\Windows\System\pdHYVXq.exe
  2⤵
  PID:9504
- C:\Windows\System\SKjrSFg.exe
  C:\Windows\System\SKjrSFg.exe
  2⤵
  PID:9524
- C:\Windows\System\UTSgKtp.exe
  C:\Windows\System\UTSgKtp.exe
  2⤵
  PID:9544
- C:\Windows\System\fqqGiCH.exe
  C:\Windows\System\fqqGiCH.exe
  2⤵
  PID:9564
- C:\Windows\System\iVKgWcs.exe
  C:\Windows\System\iVKgWcs.exe
  2⤵
  PID:9588
- C:\Windows\System\byYwobV.exe
  C:\Windows\System\byYwobV.exe
  2⤵
  PID:9612
- C:\Windows\System\SUsTjUi.exe
  C:\Windows\System\SUsTjUi.exe
  2⤵
  PID:9632
- C:\Windows\System\tiPjCJc.exe
  C:\Windows\System\tiPjCJc.exe
  2⤵
  PID:9656
- C:\Windows\System\UcWxmJu.exe
  C:\Windows\System\UcWxmJu.exe
  2⤵
  PID:9680
- C:\Windows\System\uojSJao.exe
  C:\Windows\System\uojSJao.exe
  2⤵
  PID:9708
- C:\Windows\System\cFiMqVJ.exe
  C:\Windows\System\cFiMqVJ.exe
  2⤵
  PID:9736
- C:\Windows\System\eisPdZb.exe
  C:\Windows\System\eisPdZb.exe
  2⤵
  PID:9756
- C:\Windows\System\LyKJWTE.exe
  C:\Windows\System\LyKJWTE.exe
  2⤵
  PID:9784
- C:\Windows\System\sOhZNIa.exe
  C:\Windows\System\sOhZNIa.exe
  2⤵
  PID:9808
- C:\Windows\System\XUkHQZo.exe
  C:\Windows\System\XUkHQZo.exe
  2⤵
  PID:9824
- C:\Windows\System\kHiVhEy.exe
  C:\Windows\System\kHiVhEy.exe
  2⤵
  PID:9860
- C:\Windows\System\gYYibPk.exe
  C:\Windows\System\gYYibPk.exe
  2⤵
  PID:9880
- C:\Windows\System\KrVFcZW.exe
  C:\Windows\System\KrVFcZW.exe
  2⤵
  PID:9904
- C:\Windows\System\ukwWMxF.exe
  C:\Windows\System\ukwWMxF.exe
  2⤵
  PID:9924
- C:\Windows\System\udrsLlY.exe
  C:\Windows\System\udrsLlY.exe
  2⤵
  PID:9948
- C:\Windows\System\kMPXYyt.exe
  C:\Windows\System\kMPXYyt.exe
  2⤵
  PID:9972
- C:\Windows\System\UwaQjEy.exe
  C:\Windows\System\UwaQjEy.exe
  2⤵
  PID:9992
- C:\Windows\System\mRPxzJV.exe
  C:\Windows\System\mRPxzJV.exe
  2⤵
  PID:10008
- C:\Windows\System\lbzChYo.exe
  C:\Windows\System\lbzChYo.exe
  2⤵
  PID:10024
- C:\Windows\System\CtrVhjI.exe
  C:\Windows\System\CtrVhjI.exe
  2⤵
  PID:10040
- C:\Windows\System\qhPlrlf.exe
  C:\Windows\System\qhPlrlf.exe
  2⤵
  PID:10056
- C:\Windows\System\MNeRCRP.exe
  C:\Windows\System\MNeRCRP.exe
  2⤵
  PID:10076
- C:\Windows\System\qQLkuJs.exe
  C:\Windows\System\qQLkuJs.exe
  2⤵
  PID:10096
- C:\Windows\System\WCABhtx.exe
  C:\Windows\System\WCABhtx.exe
  2⤵
  PID:10120
- C:\Windows\System\vNoqaGb.exe
  C:\Windows\System\vNoqaGb.exe
  2⤵
  PID:10144
- C:\Windows\System\rpVTfcz.exe
  C:\Windows\System\rpVTfcz.exe
  2⤵
  PID:10160
- C:\Windows\System\rEMPdgo.exe
  C:\Windows\System\rEMPdgo.exe
  2⤵
  PID:10188
- C:\Windows\System\HfkKWnu.exe
  C:\Windows\System\HfkKWnu.exe
  2⤵
  PID:10204
- C:\Windows\System\iQxJbHn.exe
  C:\Windows\System\iQxJbHn.exe
  2⤵
  PID:10224
- C:\Windows\System\djpRjfj.exe
  C:\Windows\System\djpRjfj.exe
  2⤵
  PID:9048
- C:\Windows\System\OxOGamz.exe
  C:\Windows\System\OxOGamz.exe
  2⤵
  PID:9084
- C:\Windows\System\mOngHgp.exe
  C:\Windows\System\mOngHgp.exe
  2⤵
  PID:7048
- C:\Windows\System\gXdoIvs.exe
  C:\Windows\System\gXdoIvs.exe
  2⤵
  PID:9172
- C:\Windows\System\WgxaRzR.exe
  C:\Windows\System\WgxaRzR.exe
  2⤵
  PID:7532
- C:\Windows\System\QAlIarV.exe
  C:\Windows\System\QAlIarV.exe
  2⤵
  PID:9188
- C:\Windows\System\FnCAGbR.exe
  C:\Windows\System\FnCAGbR.exe
  2⤵
  PID:8220
- C:\Windows\System\sIdcrTg.exe
  C:\Windows\System\sIdcrTg.exe
  2⤵
  PID:8580
- C:\Windows\System\bGPabdT.exe
  C:\Windows\System\bGPabdT.exe
  2⤵
  PID:8748
- C:\Windows\System\UZAxPZo.exe
  C:\Windows\System\UZAxPZo.exe
  2⤵
  PID:9072
- C:\Windows\System\jrBKcwy.exe
  C:\Windows\System\jrBKcwy.exe
  2⤵
  PID:8744
- C:\Windows\System\hndMpzR.exe
  C:\Windows\System\hndMpzR.exe
  2⤵
  PID:6764
- C:\Windows\System\dSwUSau.exe
  C:\Windows\System\dSwUSau.exe
  2⤵
  PID:9140
- C:\Windows\System\QqCHitt.exe
  C:\Windows\System\QqCHitt.exe
  2⤵
  PID:9436
- C:\Windows\System\HrvRLgJ.exe
  C:\Windows\System\HrvRLgJ.exe
  2⤵
  PID:9476
- C:\Windows\System\ZtgwycU.exe
  C:\Windows\System\ZtgwycU.exe
  2⤵
  PID:2764
- C:\Windows\System\xMHxebe.exe
  C:\Windows\System\xMHxebe.exe
  2⤵
  PID:4588
- C:\Windows\System\WvwapPo.exe
  C:\Windows\System\WvwapPo.exe
  2⤵
  PID:5048
- C:\Windows\System\gaqNGrP.exe
  C:\Windows\System\gaqNGrP.exe
  2⤵
  PID:6468
- C:\Windows\System\bRcbmdJ.exe
  C:\Windows\System\bRcbmdJ.exe
  2⤵
  PID:9892
- C:\Windows\System\NYLOZfS.exe
  C:\Windows\System\NYLOZfS.exe
  2⤵
  PID:10260
- C:\Windows\System\DuiqlEk.exe
  C:\Windows\System\DuiqlEk.exe
  2⤵
  PID:10292
- C:\Windows\System\rOfdxnd.exe
  C:\Windows\System\rOfdxnd.exe
  2⤵
  PID:10324
- C:\Windows\System\mFvmkKr.exe
  C:\Windows\System\mFvmkKr.exe
  2⤵
  PID:10340
- C:\Windows\System\YahEgJH.exe
  C:\Windows\System\YahEgJH.exe
  2⤵
  PID:10364
- C:\Windows\System\JUoWamh.exe
  C:\Windows\System\JUoWamh.exe
  2⤵
  PID:10380
- C:\Windows\System\DmGTxmg.exe
  C:\Windows\System\DmGTxmg.exe
  2⤵
  PID:10404
- C:\Windows\System\xEsNlfx.exe
  C:\Windows\System\xEsNlfx.exe
  2⤵
  PID:10424
- C:\Windows\System\LWvJdWf.exe
  C:\Windows\System\LWvJdWf.exe
  2⤵
  PID:10444
- C:\Windows\System\opjgVva.exe
  C:\Windows\System\opjgVva.exe
  2⤵
  PID:10468
- C:\Windows\System\IDZaBDR.exe
  C:\Windows\System\IDZaBDR.exe
  2⤵
  PID:10492
- C:\Windows\System\MoHOhBY.exe
  C:\Windows\System\MoHOhBY.exe
  2⤵
  PID:10508
- C:\Windows\System\mGcowcb.exe
  C:\Windows\System\mGcowcb.exe
  2⤵
  PID:10532
- C:\Windows\System\seQYDgB.exe
  C:\Windows\System\seQYDgB.exe
  2⤵
  PID:10556
- C:\Windows\System\yqVJcPS.exe
  C:\Windows\System\yqVJcPS.exe
  2⤵
  PID:10576
- C:\Windows\System\wALpJQS.exe
  C:\Windows\System\wALpJQS.exe
  2⤵
  PID:10600
- C:\Windows\System\jtbNKrn.exe
  C:\Windows\System\jtbNKrn.exe
  2⤵
  PID:10620
- C:\Windows\System\GxdImWW.exe
  C:\Windows\System\GxdImWW.exe
  2⤵
  PID:10648
- C:\Windows\System\PazWgSO.exe
  C:\Windows\System\PazWgSO.exe
  2⤵
  PID:10664
- C:\Windows\System\kyCDNnP.exe
  C:\Windows\System\kyCDNnP.exe
  2⤵
  PID:10688
- C:\Windows\System\ypwQNkv.exe
  C:\Windows\System\ypwQNkv.exe
  2⤵
  PID:10712
- C:\Windows\System\GDKAStO.exe
  C:\Windows\System\GDKAStO.exe
  2⤵
  PID:10732
- C:\Windows\System\QbbVeaH.exe
  C:\Windows\System\QbbVeaH.exe
  2⤵
  PID:10756
- C:\Windows\System\UwjGSqN.exe
  C:\Windows\System\UwjGSqN.exe
  2⤵
  PID:10784
- C:\Windows\System\jHIoaXX.exe
  C:\Windows\System\jHIoaXX.exe
  2⤵
  PID:10800
- C:\Windows\System\AOMMlAK.exe
  C:\Windows\System\AOMMlAK.exe
  2⤵
  PID:10824
- C:\Windows\System\MevEiHa.exe
  C:\Windows\System\MevEiHa.exe
  2⤵
  PID:10844
- C:\Windows\System\KPjabEL.exe
  C:\Windows\System\KPjabEL.exe
  2⤵
  PID:10868
- C:\Windows\System\rQarYep.exe
  C:\Windows\System\rQarYep.exe
  2⤵
  PID:10888
- C:\Windows\System\eMUYuGw.exe
  C:\Windows\System\eMUYuGw.exe
  2⤵
  PID:10908
- C:\Windows\System\GJPDutX.exe
  C:\Windows\System\GJPDutX.exe
  2⤵
  PID:10928
- C:\Windows\System\QSoJumE.exe
  C:\Windows\System\QSoJumE.exe
  2⤵
  PID:10948
- C:\Windows\System\mOmqMNZ.exe
  C:\Windows\System\mOmqMNZ.exe
  2⤵
  PID:10968
- C:\Windows\System\FnoLyWT.exe
  C:\Windows\System\FnoLyWT.exe
  2⤵
  PID:10984
- C:\Windows\System\eVNKaig.exe
  C:\Windows\System\eVNKaig.exe
  2⤵
  PID:11000
- C:\Windows\System\yYgyXfV.exe
  C:\Windows\System\yYgyXfV.exe
  2⤵
  PID:11016
- C:\Windows\System\ZVaxOZO.exe
  C:\Windows\System\ZVaxOZO.exe
  2⤵
  PID:11032
- C:\Windows\System\hFxgedF.exe
  C:\Windows\System\hFxgedF.exe
  2⤵
  PID:11048
- C:\Windows\System\SzDxvJq.exe
  C:\Windows\System\SzDxvJq.exe
  2⤵
  PID:11064
- C:\Windows\System\Mqoinki.exe
  C:\Windows\System\Mqoinki.exe
  2⤵
  PID:11080
- C:\Windows\System\KicnHtT.exe
  C:\Windows\System\KicnHtT.exe
  2⤵
  PID:11096
- C:\Windows\System\qEVDDCC.exe
  C:\Windows\System\qEVDDCC.exe
  2⤵
  PID:11116
- C:\Windows\System\RCVlSyF.exe
  C:\Windows\System\RCVlSyF.exe
  2⤵
  PID:11136
- C:\Windows\System\JXEFsuz.exe
  C:\Windows\System\JXEFsuz.exe
  2⤵
  PID:11164
- C:\Windows\System\wTkZXAL.exe
  C:\Windows\System\wTkZXAL.exe
  2⤵
  PID:11192
- C:\Windows\System\jpAvxVQ.exe
  C:\Windows\System\jpAvxVQ.exe
  2⤵
  PID:11216
- C:\Windows\System\zJTzPBy.exe
  C:\Windows\System\zJTzPBy.exe
  2⤵
  PID:11232
- C:\Windows\System\cfAWlch.exe
  C:\Windows\System\cfAWlch.exe
  2⤵
  PID:11256
- C:\Windows\System\UuecKhS.exe
  C:\Windows\System\UuecKhS.exe
  2⤵
  PID:9308
- C:\Windows\System\BSratUj.exe
  C:\Windows\System\BSratUj.exe
  2⤵
  PID:10064
- C:\Windows\System\xhzbsRq.exe
  C:\Windows\System\xhzbsRq.exe
  2⤵
  PID:10152
- C:\Windows\System\DltcMZg.exe
  C:\Windows\System\DltcMZg.exe
  2⤵
  PID:6012
- C:\Windows\System\AAUPCxN.exe
  C:\Windows\System\AAUPCxN.exe
  2⤵
  PID:8976
- C:\Windows\System\SXImzvV.exe
  C:\Windows\System\SXImzvV.exe
  2⤵
  PID:9536
- C:\Windows\System\vzuPhnB.exe
  C:\Windows\System\vzuPhnB.exe
  2⤵
  PID:9264
- C:\Windows\System\WaoYRba.exe
  C:\Windows\System\WaoYRba.exe
  2⤵
  PID:5068
- C:\Windows\System\ZYJcpEq.exe
  C:\Windows\System\ZYJcpEq.exe
  2⤵
  PID:6512
- C:\Windows\System\hesZcTY.exe
  C:\Windows\System\hesZcTY.exe
  2⤵
  PID:3756
- C:\Windows\System\pawHNky.exe
  C:\Windows\System\pawHNky.exe
  2⤵
  PID:9780
- C:\Windows\System\HmwBvhJ.exe
  C:\Windows\System\HmwBvhJ.exe
  2⤵
  PID:9252
- C:\Windows\System\UBOSECx.exe
  C:\Windows\System\UBOSECx.exe
  2⤵
  PID:4640
- C:\Windows\System\WthZJty.exe
  C:\Windows\System\WthZJty.exe
  2⤵
  PID:9900
- C:\Windows\System\CEkYujE.exe
  C:\Windows\System\CEkYujE.exe
  2⤵
  PID:9984
- C:\Windows\System\PyRJlvr.exe
  C:\Windows\System\PyRJlvr.exe
  2⤵
  PID:10388
- C:\Windows\System\jKAPxiW.exe
  C:\Windows\System\jKAPxiW.exe
  2⤵
  PID:10488
- C:\Windows\System\iFSclOg.exe
  C:\Windows\System\iFSclOg.exe
  2⤵
  PID:10544
- C:\Windows\System\odlwDjn.exe
  C:\Windows\System\odlwDjn.exe
  2⤵
  PID:10572
- C:\Windows\System\uXoFZZr.exe
  C:\Windows\System\uXoFZZr.exe
  2⤵
  PID:10640
- C:\Windows\System\nMtNlRy.exe
  C:\Windows\System\nMtNlRy.exe
  2⤵
  PID:1860
- C:\Windows\System\WfwnFBt.exe
  C:\Windows\System\WfwnFBt.exe
  2⤵
  PID:10728
- C:\Windows\System\GmVfLZx.exe
  C:\Windows\System\GmVfLZx.exe
  2⤵
  PID:10776
- C:\Windows\System\gbZQwfi.exe
  C:\Windows\System\gbZQwfi.exe
  2⤵
  PID:10820
- C:\Windows\System\isvPOfo.exe
  C:\Windows\System\isvPOfo.exe
  2⤵
  PID:11280
- C:\Windows\System\tipfYDD.exe
  C:\Windows\System\tipfYDD.exe
  2⤵
  PID:11300
- C:\Windows\System\BkEVApH.exe
  C:\Windows\System\BkEVApH.exe
  2⤵
  PID:11324
- C:\Windows\System\ypwylLE.exe
  C:\Windows\System\ypwylLE.exe
  2⤵
  PID:11344
- C:\Windows\System\mLFDazX.exe
  C:\Windows\System\mLFDazX.exe
  2⤵
  PID:11364
- C:\Windows\System\xFGXvML.exe
  C:\Windows\System\xFGXvML.exe
  2⤵
  PID:11384
- C:\Windows\System\cGDwKSx.exe
  C:\Windows\System\cGDwKSx.exe
  2⤵
  PID:11408
- C:\Windows\System\ooNoXRb.exe
  C:\Windows\System\ooNoXRb.exe
  2⤵
  PID:11428
- C:\Windows\System\HtWXGEA.exe
  C:\Windows\System\HtWXGEA.exe
  2⤵
  PID:11460
- C:\Windows\System\BmGLZSV.exe
  C:\Windows\System\BmGLZSV.exe
  2⤵
  PID:11476
- C:\Windows\System\DAYnfpN.exe
  C:\Windows\System\DAYnfpN.exe
  2⤵
  PID:11492
- C:\Windows\System\TLOVgZV.exe
  C:\Windows\System\TLOVgZV.exe
  2⤵
  PID:11508
- C:\Windows\System\aFFTVzt.exe
  C:\Windows\System\aFFTVzt.exe
  2⤵
  PID:11528
- C:\Windows\System\BfNiiGD.exe
  C:\Windows\System\BfNiiGD.exe
  2⤵
  PID:11564
- C:\Windows\System\UKaXHUf.exe
  C:\Windows\System\UKaXHUf.exe
  2⤵
  PID:11580
- C:\Windows\System\PMkeUAU.exe
  C:\Windows\System\PMkeUAU.exe
  2⤵
  PID:11600
- C:\Windows\System\ntNjjuc.exe
  C:\Windows\System\ntNjjuc.exe
  2⤵
  PID:11628
- C:\Windows\System\eCUyUoP.exe
  C:\Windows\System\eCUyUoP.exe
  2⤵
  PID:11648
- C:\Windows\System\UjrKzFe.exe
  C:\Windows\System\UjrKzFe.exe
  2⤵
  PID:11668
- C:\Windows\System\lSCfAcn.exe
  C:\Windows\System\lSCfAcn.exe
  2⤵
  PID:11692
- C:\Windows\System\DPyDlWv.exe
  C:\Windows\System\DPyDlWv.exe
  2⤵
  PID:11712
- C:\Windows\System\WGqtfVf.exe
  C:\Windows\System\WGqtfVf.exe
  2⤵
  PID:11732
- C:\Windows\System\yfzkMrS.exe
  C:\Windows\System\yfzkMrS.exe
  2⤵
  PID:11752
- C:\Windows\System\yKdwpUL.exe
  C:\Windows\System\yKdwpUL.exe
  2⤵
  PID:11772
- C:\Windows\System\jVafbSZ.exe
  C:\Windows\System\jVafbSZ.exe
  2⤵
  PID:11792
- C:\Windows\System\isMlyMj.exe
  C:\Windows\System\isMlyMj.exe
  2⤵
  PID:11808
- C:\Windows\System\vkwvNaL.exe
  C:\Windows\System\vkwvNaL.exe
  2⤵
  PID:11824
- C:\Windows\System\KCFsBvL.exe
  C:\Windows\System\KCFsBvL.exe
  2⤵
  PID:11840
- C:\Windows\System\AKqXTpi.exe
  C:\Windows\System\AKqXTpi.exe
  2⤵
  PID:11856
- C:\Windows\System\MBgBUKR.exe
  C:\Windows\System\MBgBUKR.exe
  2⤵
  PID:11872
- C:\Windows\System\ZaWStsD.exe
  C:\Windows\System\ZaWStsD.exe
  2⤵
  PID:11888
- C:\Windows\System\wKXAhtx.exe
  C:\Windows\System\wKXAhtx.exe
  2⤵
  PID:11904
- C:\Windows\System\IjJXBAm.exe
  C:\Windows\System\IjJXBAm.exe
  2⤵
  PID:11920
- C:\Windows\System\welFdvO.exe
  C:\Windows\System\welFdvO.exe
  2⤵
  PID:11940
- C:\Windows\System\PJvwXrm.exe
  C:\Windows\System\PJvwXrm.exe
  2⤵
  PID:11968
- C:\Windows\System\pmPtjPe.exe
  C:\Windows\System\pmPtjPe.exe
  2⤵
  PID:11988
- C:\Windows\System\ZFCLsVB.exe
  C:\Windows\System\ZFCLsVB.exe
  2⤵
  PID:12012
- C:\Windows\System\pYvsxRL.exe
  C:\Windows\System\pYvsxRL.exe
  2⤵
  PID:12028
- C:\Windows\System\SBzuUJn.exe
  C:\Windows\System\SBzuUJn.exe
  2⤵
  PID:12056
- C:\Windows\System\TZiLfZr.exe
  C:\Windows\System\TZiLfZr.exe
  2⤵
  PID:12080
- C:\Windows\System\TUonhcC.exe
  C:\Windows\System\TUonhcC.exe
  2⤵
  PID:12104
- C:\Windows\System\rCPOVMH.exe
  C:\Windows\System\rCPOVMH.exe
  2⤵
  PID:12124
- C:\Windows\System\BzRnNdL.exe
  C:\Windows\System\BzRnNdL.exe
  2⤵
  PID:12148
- C:\Windows\System\uvNIoAk.exe
  C:\Windows\System\uvNIoAk.exe
  2⤵
  PID:12168
- C:\Windows\System\rMtDivY.exe
  C:\Windows\System\rMtDivY.exe
  2⤵
  PID:12200
- C:\Windows\System\fWVkmrC.exe
  C:\Windows\System\fWVkmrC.exe
  2⤵
  PID:12228
- C:\Windows\System\aoZCCdS.exe
  C:\Windows\System\aoZCCdS.exe
  2⤵
  PID:12252
- C:\Windows\System\tXDLMiA.exe
  C:\Windows\System\tXDLMiA.exe
  2⤵
  PID:12268
- C:\Windows\System\NCOJPod.exe
  C:\Windows\System\NCOJPod.exe
  2⤵
  PID:10884
- C:\Windows\System\dLSOaFo.exe
  C:\Windows\System\dLSOaFo.exe
  2⤵
  PID:9596
- C:\Windows\System\zVyplde.exe
  C:\Windows\System\zVyplde.exe
  2⤵
  PID:8716
- C:\Windows\System\ZTayHAd.exe
  C:\Windows\System\ZTayHAd.exe
  2⤵
  PID:9652
- C:\Windows\System\ZctRSwt.exe
  C:\Windows\System\ZctRSwt.exe
  2⤵
  PID:11044
- C:\Windows\System\qjfEEZj.exe
  C:\Windows\System\qjfEEZj.exe
  2⤵
  PID:11108
- C:\Windows\System\DnBdHUy.exe
  C:\Windows\System\DnBdHUy.exe
  2⤵
  PID:9448
- C:\Windows\System\khWZQlK.exe
  C:\Windows\System\khWZQlK.exe
  2⤵
  PID:11224
- C:\Windows\System\GAjlWKa.exe
  C:\Windows\System\GAjlWKa.exe
  2⤵
  PID:9288
- C:\Windows\System\WRVgxDB.exe
  C:\Windows\System\WRVgxDB.exe
  2⤵
  PID:10248
- C:\Windows\System\ZwoUTEn.exe
  C:\Windows\System\ZwoUTEn.exe
  2⤵
  PID:9916
- C:\Windows\System\WVmGoZG.exe
  C:\Windows\System\WVmGoZG.exe
  2⤵
  PID:9980
- C:\Windows\System\ZcoEdYe.exe
  C:\Windows\System\ZcoEdYe.exe
  2⤵
  PID:10436
- C:\Windows\System\cRWYOVx.exe
  C:\Windows\System\cRWYOVx.exe
  2⤵
  PID:10128
- C:\Windows\System\zUzuBIz.exe
  C:\Windows\System\zUzuBIz.exe
  2⤵
  PID:10552
- C:\Windows\System\JLZmIqo.exe
  C:\Windows\System\JLZmIqo.exe
  2⤵
  PID:10628
- C:\Windows\System\RZoJpbB.exe
  C:\Windows\System\RZoJpbB.exe
  2⤵
  PID:10112
- C:\Windows\System\IcjpULl.exe
  C:\Windows\System\IcjpULl.exe
  2⤵
  PID:10748
- C:\Windows\System\xxZhMhE.exe
  C:\Windows\System\xxZhMhE.exe
  2⤵
  PID:10672
- C:\Windows\System\kWCDTSa.exe
  C:\Windows\System\kWCDTSa.exe
  2⤵
  PID:8772
- C:\Windows\System\JOVhcGX.exe
  C:\Windows\System\JOVhcGX.exe
  2⤵
  PID:10840
- C:\Windows\System\CAyjRJs.exe
  C:\Windows\System\CAyjRJs.exe
  2⤵
  PID:10876
- C:\Windows\System\IGoCQsp.exe
  C:\Windows\System\IGoCQsp.exe
  2⤵
  PID:11308
- C:\Windows\System\GJbqhSe.exe
  C:\Windows\System\GJbqhSe.exe
  2⤵
  PID:11360
- C:\Windows\System\UczCMSo.exe
  C:\Windows\System\UczCMSo.exe
  2⤵
  PID:12304
- C:\Windows\System\WRuwwuN.exe
  C:\Windows\System\WRuwwuN.exe
  2⤵
  PID:12328
- C:\Windows\System\fmmJJBv.exe
  C:\Windows\System\fmmJJBv.exe
  2⤵
  PID:12352
- C:\Windows\System\DMLQdVX.exe
  C:\Windows\System\DMLQdVX.exe
  2⤵
  PID:12376
- C:\Windows\System\YspctlR.exe
  C:\Windows\System\YspctlR.exe
  2⤵
  PID:12392
- C:\Windows\System\YPRRvAP.exe
  C:\Windows\System\YPRRvAP.exe
  2⤵
  PID:12412
- C:\Windows\System\OuZINuV.exe
  C:\Windows\System\OuZINuV.exe
  2⤵
  PID:12432
- C:\Windows\System\FRqkToz.exe
  C:\Windows\System\FRqkToz.exe
  2⤵
  PID:13268
- C:\Windows\System\hmeJIiV.exe
  C:\Windows\System\hmeJIiV.exe
  2⤵
  PID:13300
- C:\Windows\System\kVuYtqE.exe
  C:\Windows\System\kVuYtqE.exe
  2⤵
  PID:10976
- C:\Windows\System\xCNoMKD.exe
  C:\Windows\System\xCNoMKD.exe
  2⤵
  PID:2260
- C:\Windows\System\MpknPWm.exe
  C:\Windows\System\MpknPWm.exe
  2⤵
  PID:11088
- C:\Windows\System\bBaYXiZ.exe
  C:\Windows\System\bBaYXiZ.exe
  2⤵
  PID:11592
- C:\Windows\System\WsDKYLs.exe
  C:\Windows\System\WsDKYLs.exe
  2⤵
  PID:11768
- C:\Windows\System\gQKKCxf.exe
  C:\Windows\System\gQKKCxf.exe
  2⤵
  PID:11916
- C:\Windows\System\uMwjhLD.exe
  C:\Windows\System\uMwjhLD.exe
  2⤵
  PID:9776
- C:\Windows\System\lwdALqF.exe
  C:\Windows\System\lwdALqF.exe
  2⤵
  PID:11472
- C:\Windows\System\FmRKQmG.exe
  C:\Windows\System\FmRKQmG.exe
  2⤵
  PID:7196
- C:\Windows\System\ctnMBMp.exe
  C:\Windows\System\ctnMBMp.exe
  2⤵
  PID:10252
- C:\Windows\System\WEapMxu.exe
  C:\Windows\System\WEapMxu.exe
  2⤵
  PID:13040
- C:\Windows\System\xKIbUXe.exe
  C:\Windows\System\xKIbUXe.exe
  2⤵
  PID:13088
- C:\Windows\System\XebRGWD.exe
  C:\Windows\System\XebRGWD.exe
  2⤵
  PID:12908
- C:\Windows\System\OZORTyH.exe
  C:\Windows\System\OZORTyH.exe
  2⤵
  PID:12924
- C:\Windows\System\eVqOTRA.exe
  C:\Windows\System\eVqOTRA.exe
  2⤵
  PID:13200
- C:\Windows\System\IoycdsQ.exe
  C:\Windows\System\IoycdsQ.exe
  2⤵
  PID:13256
- C:\Windows\System\PKksDCc.exe
  C:\Windows\System\PKksDCc.exe
  2⤵
  PID:13280
- C:\Windows\System\YAnLJdi.exe
  C:\Windows\System\YAnLJdi.exe
  2⤵
  PID:11380
- C:\Windows\System\kmslozO.exe
  C:\Windows\System\kmslozO.exe
  2⤵
  PID:11012
- C:\Windows\System\rfulqYu.exe
  C:\Windows\System\rfulqYu.exe
  2⤵
  PID:11616
- C:\Windows\System\lskCiUB.exe
  C:\Windows\System\lskCiUB.exe
  2⤵
  PID:9492
- C:\Windows\System\mdcwCSD.exe
  C:\Windows\System\mdcwCSD.exe
  2⤵
  PID:11956
- C:\Windows\System\drXerVv.exe
  C:\Windows\System\drXerVv.exe
  2⤵
  PID:10356
- C:\Windows\System\TTRYTpI.exe
  C:\Windows\System\TTRYTpI.exe
  2⤵
  PID:13120
- C:\Windows\System\aoXpyPe.exe
  C:\Windows\System\aoXpyPe.exe
  2⤵
  PID:10464
- C:\Windows\System\MLBjRif.exe
  C:\Windows\System\MLBjRif.exe
  2⤵
  PID:10796
- C:\Windows\System\HfLZPGc.exe
  C:\Windows\System\HfLZPGc.exe
  2⤵
  PID:9608
- C:\Windows\System\mcxWdAP.exe
  C:\Windows\System\mcxWdAP.exe
  2⤵
  PID:12008
- C:\Windows\System\IiUOqTJ.exe
  C:\Windows\System\IiUOqTJ.exe
  2⤵
  PID:10016
- C:\Windows\System\UowldGk.exe
  C:\Windows\System\UowldGk.exe
  2⤵
  PID:13232
- C:\Windows\System\pDwOVGl.exe
  C:\Windows\System\pDwOVGl.exe
  2⤵
  PID:11744
- C:\Windows\System\MlZxqsy.exe
  C:\Windows\System\MlZxqsy.exe
  2⤵
  PID:13100
- C:\Windows\System\ZCpVjrG.exe
  C:\Windows\System\ZCpVjrG.exe
  2⤵
  PID:11536
- C:\Windows\System\NrFHDNY.exe
  C:\Windows\System\NrFHDNY.exe
  2⤵
  PID:9848
- C:\Windows\System\EtQJUiT.exe
  C:\Windows\System\EtQJUiT.exe
  2⤵
  PID:12312
- C:\Windows\System\LcJOkgU.exe
  C:\Windows\System\LcJOkgU.exe
  2⤵
  PID:11708
- C:\Windows\System\ODfeJCi.exe
  C:\Windows\System\ODfeJCi.exe
  2⤵
  PID:11764
- C:\Windows\System\BwyJbVI.exe
  C:\Windows\System\BwyJbVI.exe
  2⤵
  PID:13152
- C:\Windows\System\DKdYJvc.exe
  C:\Windows\System\DKdYJvc.exe
  2⤵
  PID:13160
- C:\Windows\System\xKHLDWk.exe
  C:\Windows\System\xKHLDWk.exe
  2⤵
  PID:13252
- C:\Windows\System\AQMxtFB.exe
  C:\Windows\System\AQMxtFB.exe
  2⤵
  PID:9000
- C:\Windows\System\nsLyNsG.exe
  C:\Windows\System\nsLyNsG.exe
  2⤵
  PID:10420
- C:\Windows\System\rxWQgzQ.exe
  C:\Windows\System\rxWQgzQ.exe
  2⤵
  PID:12248
- C:\Windows\System\zMpabGL.exe
  C:\Windows\System\zMpabGL.exe
  2⤵
  PID:3300
- C:\Windows\System\ivfmZil.exe
  C:\Windows\System\ivfmZil.exe
  2⤵
  PID:2664
- C:\Windows\System\WaqJoxy.exe
  C:\Windows\System\WaqJoxy.exe
  2⤵
  PID:1604
- C:\Windows\System\vlXESdL.exe
  C:\Windows\System\vlXESdL.exe
  2⤵
  PID:13032
- C:\Windows\System\eyipjuJ.exe
  C:\Windows\System\eyipjuJ.exe
  2⤵
  PID:13292
- C:\Windows\System\GluzjCu.exe
  C:\Windows\System\GluzjCu.exe
  2⤵
  PID:11552
- C:\Windows\System\FhEoXiv.exe
  C:\Windows\System\FhEoXiv.exe
  2⤵
  PID:10476
- C:\Windows\System\VwTNxVp.exe
  C:\Windows\System\VwTNxVp.exe
  2⤵
  PID:12440
- C:\Windows\System\PQlbMHt.exe
  C:\Windows\System\PQlbMHt.exe
  2⤵
  PID:11484
- C:\Windows\System\MHRGxZi.exe
  C:\Windows\System\MHRGxZi.exe
  2⤵
  PID:12428
- C:\Windows\System\vJgcMBX.exe
  C:\Windows\System\vJgcMBX.exe
  2⤵
  PID:10168
- C:\Windows\System\CRFNUYR.exe
  C:\Windows\System\CRFNUYR.exe
  2⤵
  PID:12492
- C:\Windows\System\RLhrTwS.exe
  C:\Windows\System\RLhrTwS.exe
  2⤵
  PID:11816
- C:\Windows\System\CkIOFby.exe
  C:\Windows\System\CkIOFby.exe
  2⤵
  PID:11724
- C:\Windows\System\lVcTkVg.exe
  C:\Windows\System\lVcTkVg.exe
  2⤵
  PID:12564
- C:\Windows\System\fpXJpMT.exe
  C:\Windows\System\fpXJpMT.exe
  2⤵
  PID:13008
- C:\Windows\System\CbKddYw.exe
  C:\Windows\System\CbKddYw.exe
  2⤵
  PID:2460
- C:\Windows\System\dkUMHbG.exe
  C:\Windows\System\dkUMHbG.exe
  2⤵
  PID:12904
- C:\Windows\System\LcQbUZA.exe
  C:\Windows\System\LcQbUZA.exe
  2⤵
  PID:4568
- C:\Windows\System\rggMYOV.exe
  C:\Windows\System\rggMYOV.exe
  2⤵
  PID:1348
- C:\Windows\System\YjQEtCD.exe
  C:\Windows\System\YjQEtCD.exe
  2⤵
  PID:12592
- C:\Windows\System\RHOclHu.exe
  C:\Windows\System\RHOclHu.exe
  2⤵
  PID:11208
- C:\Windows\System\EIPkOnl.exe
  C:\Windows\System\EIPkOnl.exe
  2⤵
  PID:12968
- C:\Windows\System\KplkKVx.exe
  C:\Windows\System\KplkKVx.exe
  2⤵
  PID:1068
- C:\Windows\System\ySGhCUL.exe
  C:\Windows\System\ySGhCUL.exe
  2⤵
  PID:1020
- C:\Windows\System\TUTbsmb.exe
  C:\Windows\System\TUTbsmb.exe
  2⤵
  PID:10440
- C:\Windows\System\BhqAjro.exe
  C:\Windows\System\BhqAjro.exe
  2⤵
  PID:748
- C:\Windows\System\NTjcXwQ.exe
  C:\Windows\System\NTjcXwQ.exe
  2⤵
  PID:12872
- C:\Windows\System\LUtoIYk.exe
  C:\Windows\System\LUtoIYk.exe
  2⤵
  PID:11596
- C:\Windows\System\XfimKqX.exe
  C:\Windows\System\XfimKqX.exe
  2⤵
  PID:2432
- C:\Windows\System\dBIfZaV.exe
  C:\Windows\System\dBIfZaV.exe
  2⤵
  PID:2624
- C:\Windows\System\yAFFQLe.exe
  C:\Windows\System\yAFFQLe.exe
  2⤵
  PID:11852
- C:\Windows\System\WFlhGaU.exe
  C:\Windows\System\WFlhGaU.exe
  2⤵
  PID:11456
- C:\Windows\System\pPjZbnu.exe
  C:\Windows\System\pPjZbnu.exe
  2⤵
  PID:944
- C:\Windows\System\NraFArB.exe
  C:\Windows\System\NraFArB.exe
  2⤵
  PID:1872
- C:\Windows\System\zssrWTb.exe
  C:\Windows\System\zssrWTb.exe
  2⤵
  PID:1864
- C:\Windows\System\dhOgofo.exe
  C:\Windows\System\dhOgofo.exe
  2⤵
  PID:5956
- C:\Windows\System\iVRqaIV.exe
  C:\Windows\System\iVRqaIV.exe
  2⤵
  PID:4152
- C:\Windows\System\BZxTHzF.exe
  C:\Windows\System\BZxTHzF.exe
  2⤵
  PID:11504
- C:\Windows\System\FELeBFu.exe
  C:\Windows\System\FELeBFu.exe
  2⤵
  PID:11676
- C:\Windows\System\YexgimJ.exe
  C:\Windows\System\YexgimJ.exe
  2⤵
  PID:9932
- C:\Windows\System\sfqmWxg.exe
  C:\Windows\System\sfqmWxg.exe
  2⤵
  PID:1004
- C:\Windows\System\VmFcKLS.exe
  C:\Windows\System\VmFcKLS.exe
  2⤵
  PID:3408
- C:\Windows\System\fFwQaxE.exe
  C:\Windows\System\fFwQaxE.exe
  2⤵
  PID:7340
- C:\Windows\System\sWOKdWc.exe
  C:\Windows\System\sWOKdWc.exe
  2⤵
  PID:11640
- C:\Windows\System\yAbfXxd.exe
  C:\Windows\System\yAbfXxd.exe
  2⤵
  PID:12096
- C:\Windows\System\doESJUI.exe
  C:\Windows\System\doESJUI.exe
  2⤵
  PID:5292
- C:\Windows\System\uBLAhfD.exe
  C:\Windows\System\uBLAhfD.exe
  2⤵
  PID:1472
- C:\Windows\System\eiYRsoo.exe
  C:\Windows\System\eiYRsoo.exe
  2⤵
  PID:6360
- C:\Windows\System\vYGhFFW.exe
  C:\Windows\System\vYGhFFW.exe
  2⤵
  PID:6604
- C:\Windows\System\eYplvVR.exe
  C:\Windows\System\eYplvVR.exe
  2⤵
  PID:7004
- C:\Windows\System\bZifuWH.exe
  C:\Windows\System\bZifuWH.exe
  2⤵
  PID:6720
- C:\Windows\System\VZWewpt.exe
  C:\Windows\System\VZWewpt.exe
  2⤵
  PID:6812
- C:\Windows\System\qHRqhPI.exe
  C:\Windows\System\qHRqhPI.exe
  2⤵
  PID:7060
- C:\Windows\System\xrSdamo.exe
  C:\Windows\System\xrSdamo.exe
  2⤵
  PID:5272
- C:\Windows\System\kkaexKl.exe
  C:\Windows\System\kkaexKl.exe
  2⤵
  PID:5280
- C:\Windows\System\voNnDja.exe
  C:\Windows\System\voNnDja.exe
  2⤵
  PID:1652
- C:\Windows\System\iCbuivQ.exe
  C:\Windows\System\iCbuivQ.exe
  2⤵
  PID:4468
- C:\Windows\System\LBoIhAH.exe
  C:\Windows\System\LBoIhAH.exe
  2⤵
  PID:6748
- C:\Windows\System\iREONTM.exe
  C:\Windows\System\iREONTM.exe
  2⤵
  PID:2288
- C:\Windows\System\QtmYbYx.exe
  C:\Windows\System\QtmYbYx.exe
  2⤵
  PID:4812
- C:\Windows\System\avorKCw.exe
  C:\Windows\System\avorKCw.exe
  2⤵
  PID:5492
- C:\Windows\System\xsQkxsQ.exe
  C:\Windows\System\xsQkxsQ.exe
  2⤵
  PID:5540
- C:\Windows\System\PBqjCRD.exe
  C:\Windows\System\PBqjCRD.exe
  2⤵
  PID:760
- C:\Windows\System\HuVqaDF.exe
  C:\Windows\System\HuVqaDF.exe
  2⤵
  PID:4596
- C:\Windows\System\PFXhNeS.exe
  C:\Windows\System\PFXhNeS.exe
  2⤵
  PID:5564
- C:\Windows\System\JYbroqf.exe
  C:\Windows\System\JYbroqf.exe
  2⤵
  PID:5656
- C:\Windows\System\ipvzuNy.exe
  C:\Windows\System\ipvzuNy.exe
  2⤵
  PID:5672
- C:\Windows\System\YUKsTis.exe
  C:\Windows\System\YUKsTis.exe
  2⤵
  PID:5608
- C:\Windows\System\JcrEiwu.exe
  C:\Windows\System\JcrEiwu.exe
  2⤵
  PID:4876
- C:\Windows\System\cJHMrXA.exe
  C:\Windows\System\cJHMrXA.exe
  2⤵
  PID:5684
- C:\Windows\System\hujhHFx.exe
  C:\Windows\System\hujhHFx.exe
  2⤵
  PID:10052
- C:\Windows\System\QLiVqMH.exe
  C:\Windows\System\QLiVqMH.exe
  2⤵
  PID:12900
- C:\Windows\System\beRcAaQ.exe
  C:\Windows\System\beRcAaQ.exe
  2⤵
  PID:1044
- C:\Windows\System\BwLlGhp.exe
  C:\Windows\System\BwLlGhp.exe
  2⤵
  PID:11864
- C:\Windows\System\djuzEgK.exe
  C:\Windows\System\djuzEgK.exe
  2⤵
  PID:5124
- C:\Windows\System\HgvPuqt.exe
  C:\Windows\System\HgvPuqt.exe
  2⤵
  PID:6404
- C:\Windows\System\cXGWDct.exe
  C:\Windows\System\cXGWDct.exe
  2⤵
  PID:6784
- C:\Windows\System\OawTEsc.exe
  C:\Windows\System\OawTEsc.exe
  2⤵
  PID:5780
- C:\Windows\System\alHourJ.exe
  C:\Windows\System\alHourJ.exe
  2⤵
  PID:11028
- C:\Windows\System\jBJGiVk.exe
  C:\Windows\System\jBJGiVk.exe
  2⤵
  PID:6868
- C:\Windows\System\MlDMJmc.exe
  C:\Windows\System\MlDMJmc.exe
  2⤵
  PID:5180
- C:\Windows\System\dPMcpfZ.exe
  C:\Windows\System\dPMcpfZ.exe
  2⤵
  PID:5216
- C:\Windows\System\XxziInn.exe
  C:\Windows\System\XxziInn.exe
  2⤵
  PID:5348
- C:\Windows\System\ZHvAxsV.exe
  C:\Windows\System\ZHvAxsV.exe
  2⤵
  PID:5400
- C:\Windows\System\XkMqmNV.exe
  C:\Windows\System\XkMqmNV.exe
  2⤵
  PID:4592
- C:\Windows\System\lzxuSIM.exe
  C:\Windows\System\lzxuSIM.exe
  2⤵
  PID:3320
- C:\Windows\System\FIVomBT.exe
  C:\Windows\System\FIVomBT.exe
  2⤵
  PID:5504
- C:\Windows\System\uAmNBaQ.exe
  C:\Windows\System\uAmNBaQ.exe
  2⤵
  PID:6332
- C:\Windows\System\zCWoABo.exe
  C:\Windows\System\zCWoABo.exe
  2⤵
  PID:7152
- C:\Windows\System\cPKMEmO.exe
  C:\Windows\System\cPKMEmO.exe
  2⤵
  PID:5324
- C:\Windows\System\HbFZJlu.exe
  C:\Windows\System\HbFZJlu.exe
  2⤵
  PID:2324
- C:\Windows\System\cgDXeTh.exe
  C:\Windows\System\cgDXeTh.exe
  2⤵
  PID:5260
- C:\Windows\System\EuheqHG.exe
  C:\Windows\System\EuheqHG.exe
  2⤵
  PID:6232
- C:\Windows\System\HSDmLsz.exe
  C:\Windows\System\HSDmLsz.exe
  2⤵
  PID:3684
- C:\Windows\System\kxsJnRw.exe
  C:\Windows\System\kxsJnRw.exe
  2⤵
  PID:13984
- C:\Windows\System\WFJoVHb.exe
  C:\Windows\System\WFJoVHb.exe
  2⤵
  PID:14004
- C:\Windows\System\wVygABM.exe
  C:\Windows\System\wVygABM.exe
  2⤵
  PID:14028
- C:\Windows\System\YOQIXgf.exe
  C:\Windows\System\YOQIXgf.exe
  2⤵
  PID:14056
- C:\Windows\System\aiyUeAd.exe
  C:\Windows\System\aiyUeAd.exe
  2⤵
  PID:13580
- C:\Windows\System\wAQrbbC.exe
  C:\Windows\System\wAQrbbC.exe
  2⤵
  PID:13628
- C:\Windows\System\oagQSRu.exe
  C:\Windows\System\oagQSRu.exe
  2⤵
  PID:13768
- C:\Windows\System\xRdpsym.exe
  C:\Windows\System\xRdpsym.exe
  2⤵
  PID:13736
- C:\Windows\System\dsXnLuH.exe
  C:\Windows\System\dsXnLuH.exe
  2⤵
  PID:13804
- C:\Windows\System\YoyvmsE.exe
  C:\Windows\System\YoyvmsE.exe
  2⤵
  PID:14044
- C:\Windows\System\baMUonq.exe
  C:\Windows\System\baMUonq.exe
  2⤵
  PID:14084
- C:\Windows\System\WcOPRwS.exe
  C:\Windows\System\WcOPRwS.exe
  2⤵
  PID:14104
- C:\Windows\System\QnvrzXv.exe
  C:\Windows\System\QnvrzXv.exe
  2⤵
  PID:14136
- C:\Windows\System\CBIMlrz.exe
  C:\Windows\System\CBIMlrz.exe
  2⤵
  PID:14164
- C:\Windows\System\JorQaxy.exe
  C:\Windows\System\JorQaxy.exe
  2⤵
  PID:14192
- C:\Windows\System\jFTfGHq.exe
  C:\Windows\System\jFTfGHq.exe
  2⤵
  PID:14220
- C:\Windows\System\eAXEmpn.exe
  C:\Windows\System\eAXEmpn.exe
  2⤵
  PID:14240
- C:\Windows\System\mmNSBmF.exe
  C:\Windows\System\mmNSBmF.exe
  2⤵
  PID:14276
- C:\Windows\System\aObdEHY.exe
  C:\Windows\System\aObdEHY.exe
  2⤵
  PID:14300
- C:\Windows\System\efBqVwK.exe
  C:\Windows\System\efBqVwK.exe
  2⤵
  PID:13508
- C:\Windows\System\rqwtpIh.exe
  C:\Windows\System\rqwtpIh.exe
  2⤵
  PID:13532
- C:\Windows\System\NFEHjSh.exe
  C:\Windows\System\NFEHjSh.exe
  2⤵
  PID:13844
- C:\Windows\System\eVIysCu.exe
  C:\Windows\System\eVIysCu.exe
  2⤵
  PID:13576
- C:\Windows\System\DXRvrBJ.exe
  C:\Windows\System\DXRvrBJ.exe
  2⤵
  PID:13612
- C:\Windows\System\fHlZwlJ.exe
  C:\Windows\System\fHlZwlJ.exe
  2⤵
  PID:13608
- C:\Windows\System\iJMJoMs.exe
  C:\Windows\System\iJMJoMs.exe
  2⤵
  PID:13696
- C:\Windows\System\JLhQcGu.exe
  C:\Windows\System\JLhQcGu.exe
  2⤵
  PID:13636
- C:\Windows\System\ydOegLI.exe
  C:\Windows\System\ydOegLI.exe
  2⤵
  PID:13672
- C:\Windows\System\jFIMtBv.exe
  C:\Windows\System\jFIMtBv.exe
  2⤵
  PID:13728
- C:\Windows\System\PBCcIyC.exe
  C:\Windows\System\PBCcIyC.exe
  2⤵
  PID:13772
- C:\Windows\System\eGkUuPx.exe
  C:\Windows\System\eGkUuPx.exe
  2⤵
  PID:13828
- C:\Windows\System\oUJuRMA.exe
  C:\Windows\System\oUJuRMA.exe
  2⤵
  PID:13900
- C:\Windows\System\eBPYUFt.exe
  C:\Windows\System\eBPYUFt.exe
  2⤵
  PID:6008
- C:\Windows\System\tkKPrZV.exe
  C:\Windows\System\tkKPrZV.exe
  2⤵
  PID:13840
- C:\Windows\System\RuPszFy.exe
  C:\Windows\System\RuPszFy.exe
  2⤵
  PID:5856
- C:\Windows\System\jVyYbbf.exe
  C:\Windows\System\jVyYbbf.exe
  2⤵
  PID:13956
- C:\Windows\System\feLVOht.exe
  C:\Windows\System\feLVOht.exe
  2⤵
  PID:13992
- C:\Windows\System\QLzzIra.exe
  C:\Windows\System\QLzzIra.exe
  2⤵
  PID:14124
- C:\Windows\System\ZxITbBN.exe
  C:\Windows\System\ZxITbBN.exe
  2⤵
  PID:3824
- C:\Windows\System\SBAKQMp.exe
  C:\Windows\System\SBAKQMp.exe
  2⤵
  PID:14180
- C:\Windows\System\MKbQwyh.exe
  C:\Windows\System\MKbQwyh.exe
  2⤵
  PID:3256
- C:\Windows\System\OZrVeNK.exe
  C:\Windows\System\OZrVeNK.exe
  2⤵
  PID:5200
- C:\Windows\System\jcgtmbb.exe
  C:\Windows\System\jcgtmbb.exe
  2⤵
  PID:5208
- C:\Windows\System\xmVODmw.exe
  C:\Windows\System\xmVODmw.exe
  2⤵
  PID:13320
- C:\Windows\System\spfRGEf.exe
  C:\Windows\System\spfRGEf.exe
  2⤵
  PID:13324
- C:\Windows\System\fVqiltC.exe
  C:\Windows\System\fVqiltC.exe
  2⤵
  PID:13436
- C:\Windows\System\UQRWYXS.exe
  C:\Windows\System\UQRWYXS.exe
  2⤵
  PID:13516
- C:\Windows\System\DlIdAXT.exe
  C:\Windows\System\DlIdAXT.exe
  2⤵
  PID:5836
- C:\Windows\System\wNWYcXK.exe
  C:\Windows\System\wNWYcXK.exe
  2⤵
  PID:6136
- C:\Windows\System\wUCYXaG.exe
  C:\Windows\System\wUCYXaG.exe
  2⤵
  PID:13872
- C:\Windows\System\dFufzAy.exe
  C:\Windows\System\dFufzAy.exe
  2⤵
  PID:14228
- C:\Windows\System\hRLXsRe.exe
  C:\Windows\System\hRLXsRe.exe
  2⤵
  PID:14096
- C:\Windows\System\HAMDxEm.exe
  C:\Windows\System\HAMDxEm.exe
  2⤵
  PID:3580
- C:\Windows\System\mmMxIUv.exe
  C:\Windows\System\mmMxIUv.exe
  2⤵
  PID:12916
- C:\Windows\System\bZYWyzF.exe
  C:\Windows\System\bZYWyzF.exe
  2⤵
  PID:556
- C:\Windows\System\MeoAsSa.exe
  C:\Windows\System\MeoAsSa.exe
  2⤵
  PID:13380
- C:\Windows\System\DWlZExU.exe
  C:\Windows\System\DWlZExU.exe
  2⤵
  PID:3488
- C:\Windows\System\gOBVTPE.exe
  C:\Windows\System\gOBVTPE.exe
  2⤵
  PID:13404
- C:\Windows\System\bYGibVS.exe
  C:\Windows\System\bYGibVS.exe
  2⤵
  PID:2724
- C:\Windows\System\MrmwzaP.exe
  C:\Windows\System\MrmwzaP.exe
  2⤵
  PID:13464
- C:\Windows\System\zGuhdQs.exe
  C:\Windows\System\zGuhdQs.exe
  2⤵
  PID:4704
- C:\Windows\System\xycWTyE.exe
  C:\Windows\System\xycWTyE.exe
  2⤵
  PID:5696
- C:\Windows\System\PyeCuIv.exe
  C:\Windows\System\PyeCuIv.exe
  2⤵
  PID:13620
- C:\Windows\System\iOZXKrA.exe
  C:\Windows\System\iOZXKrA.exe
  2⤵
  PID:6188
- C:\Windows\System\zFnWwbD.exe
  C:\Windows\System\zFnWwbD.exe
  2⤵
  PID:13700
- C:\Windows\System\YtcpVlF.exe
  C:\Windows\System\YtcpVlF.exe
  2⤵
  PID:4560
- C:\Windows\System\lHIMmwT.exe
  C:\Windows\System\lHIMmwT.exe
  2⤵
  PID:13368
- C:\Windows\System\MRtqEsF.exe
  C:\Windows\System\MRtqEsF.exe
  2⤵
  PID:5620
- C:\Windows\System\Jqqyxeg.exe
  C:\Windows\System\Jqqyxeg.exe
  2⤵
  PID:14324
- C:\Windows\System\oGYtrkG.exe
  C:\Windows\System\oGYtrkG.exe
  2⤵
  PID:7804
- C:\Windows\System\pYsUMuB.exe
  C:\Windows\System\pYsUMuB.exe
  2⤵
  PID:14116
- C:\Windows\System\bXucwYx.exe
  C:\Windows\System\bXucwYx.exe
  2⤵
  PID:14216
- C:\Windows\System\eQtwHTf.exe
  C:\Windows\System\eQtwHTf.exe
  2⤵
  PID:4380
- C:\Windows\System\hhlIpqT.exe
  C:\Windows\System\hhlIpqT.exe
  2⤵
  PID:8008
- C:\Windows\System\yOAdMat.exe
  C:\Windows\System\yOAdMat.exe
  2⤵
  PID:13372
- C:\Windows\System\Ynfuqsi.exe
  C:\Windows\System\Ynfuqsi.exe
  2⤵
  PID:14020
- C:\Windows\System\TwQFyfk.exe
  C:\Windows\System\TwQFyfk.exe
  2⤵
  PID:13912
- C:\Windows\System\CMssnhS.exe
  C:\Windows\System\CMssnhS.exe
  2⤵
  PID:13340
- C:\Windows\System\CVGVTUv.exe
  C:\Windows\System\CVGVTUv.exe
  2⤵
  PID:7764
- C:\Windows\System\WSzzTLx.exe
  C:\Windows\System\WSzzTLx.exe
  2⤵
  PID:13444
- C:\Windows\System\oPhYmXV.exe
  C:\Windows\System\oPhYmXV.exe
  2⤵
  PID:7092
- C:\Windows\System\vxQwwAu.exe
  C:\Windows\System\vxQwwAu.exe
  2⤵
  PID:13884
- C:\Windows\System\jKHtMlG.exe
  C:\Windows\System\jKHtMlG.exe
  2⤵
  PID:876
- C:\Windows\System\JyJMNeO.exe
  C:\Windows\System\JyJMNeO.exe
  2⤵
  PID:13944
- C:\Windows\System\zyDsMcK.exe
  C:\Windows\System\zyDsMcK.exe
  2⤵
  PID:13588
- C:\Windows\System\RSnZFPv.exe
  C:\Windows\System\RSnZFPv.exe
  2⤵
  PID:5104
- C:\Windows\System\zVBNIFf.exe
  C:\Windows\System\zVBNIFf.exe
  2⤵
  PID:6808
- C:\Windows\System\VYlSwrx.exe
  C:\Windows\System\VYlSwrx.exe
  2⤵
  PID:5860
- C:\Windows\System\PCLOxza.exe
  C:\Windows\System\PCLOxza.exe
  2⤵
  PID:7356
- C:\Windows\System\RGGeCiP.exe
  C:\Windows\System\RGGeCiP.exe
  2⤵
  PID:7352
- C:\Windows\System\LDSaCAD.exe
  C:\Windows\System\LDSaCAD.exe
  2⤵
  PID:7020
- C:\Windows\System\zyNiNPz.exe
  C:\Windows\System\zyNiNPz.exe
  2⤵
  PID:5704
- C:\Windows\System\GiBTVRD.exe
  C:\Windows\System\GiBTVRD.exe
  2⤵
  PID:5712
- C:\Windows\System\TshoeYC.exe
  C:\Windows\System\TshoeYC.exe
  2⤵
  PID:6340
- C:\Windows\System\JzFjeZn.exe
  C:\Windows\System\JzFjeZn.exe
  2⤵
  PID:8144
- C:\Windows\System\GlTftFI.exe
  C:\Windows\System\GlTftFI.exe
  2⤵
  PID:7880
- C:\Windows\System\zqgJNna.exe
  C:\Windows\System\zqgJNna.exe
  2⤵
  PID:13668
- C:\Windows\System\QrDlDaF.exe
  C:\Windows\System\QrDlDaF.exe
  2⤵
  PID:8020
- C:\Windows\System\bSmHfoh.exe
  C:\Windows\System\bSmHfoh.exe
  2⤵
  PID:6620
- C:\Windows\System\TyIPzgL.exe
  C:\Windows\System\TyIPzgL.exe
  2⤵
  PID:8456
- C:\Windows\System\XcQBLZg.exe
  C:\Windows\System\XcQBLZg.exe
  2⤵
  PID:13164
- C:\Windows\System\WPyzvwW.exe
  C:\Windows\System\WPyzvwW.exe
  2⤵
  PID:8476
- C:\Windows\System\JIAwVjU.exe
  C:\Windows\System\JIAwVjU.exe
  2⤵
  PID:1676
- C:\Windows\System\BivVYMf.exe
  C:\Windows\System\BivVYMf.exe
  2⤵
  PID:8216
- C:\Windows\System\xgcHAPN.exe
  C:\Windows\System\xgcHAPN.exe
  2⤵
  PID:6004
- C:\Windows\System\lkTtfyE.exe
  C:\Windows\System\lkTtfyE.exe
  2⤵
  PID:8536
- C:\Windows\System\wjStkMR.exe
  C:\Windows\System\wjStkMR.exe
  2⤵
  PID:8556
- C:\Windows\System\tHjSjkF.exe
  C:\Windows\System\tHjSjkF.exe
  2⤵
  PID:8664
- C:\Windows\System\NEXCGuN.exe
  C:\Windows\System\NEXCGuN.exe
  2⤵
  PID:7120
- C:\Windows\System\mrXzrln.exe
  C:\Windows\System\mrXzrln.exe
  2⤵
  PID:8508
- C:\Windows\System\eJDzrYJ.exe
  C:\Windows\System\eJDzrYJ.exe
  2⤵
  PID:8656
- C:\Windows\System\FEWpVUg.exe
  C:\Windows\System\FEWpVUg.exe
  2⤵
  PID:13716
- C:\Windows\System\SLDxBeI.exe
  C:\Windows\System\SLDxBeI.exe
  2⤵
  PID:7868
- C:\Windows\System\sTrejdN.exe
  C:\Windows\System\sTrejdN.exe
  2⤵
  PID:5520
- C:\Windows\System\BoDBRIB.exe
  C:\Windows\System\BoDBRIB.exe
  2⤵
  PID:13644
- C:\Windows\System\OrlwLjr.exe
  C:\Windows\System\OrlwLjr.exe
  2⤵
  PID:7600
- C:\Windows\System\XZjdPQY.exe
  C:\Windows\System\XZjdPQY.exe
  2⤵
  PID:6836
- C:\Windows\System\OAKRMlD.exe
  C:\Windows\System\OAKRMlD.exe
  2⤵
  PID:4104
- C:\Windows\System\ScvQYHN.exe
  C:\Windows\System\ScvQYHN.exe
  2⤵
  PID:7024
- C:\Windows\System\BWSLBpz.exe
  C:\Windows\System\BWSLBpz.exe
  2⤵
  PID:9180
- C:\Windows\System\tKBJNCw.exe
  C:\Windows\System\tKBJNCw.exe
  2⤵
  PID:9160
- C:\Windows\System\QkxWzvN.exe
  C:\Windows\System\QkxWzvN.exe
  2⤵
  PID:6956
- C:\Windows\System\jejrzuo.exe
  C:\Windows\System\jejrzuo.exe
  2⤵
  PID:7920
- C:\Windows\System\XdmTnpE.exe
  C:\Windows\System\XdmTnpE.exe
  2⤵
  PID:8512
- C:\Windows\System\GBFVfOV.exe
  C:\Windows\System\GBFVfOV.exe
  2⤵
  PID:6940
- C:\Windows\System\TvQSdjz.exe
  C:\Windows\System\TvQSdjz.exe
  2⤵
  PID:6180
- C:\Windows\System\IwvBjHE.exe
  C:\Windows\System\IwvBjHE.exe
  2⤵
  PID:5884
- C:\Windows\System\SwUnLtT.exe
  C:\Windows\System\SwUnLtT.exe
  2⤵
  PID:6424
- C:\Windows\System\DXLdxWr.exe
  C:\Windows\System\DXLdxWr.exe
  2⤵
  PID:6488
- C:\Windows\System\jpdbDEg.exe
  C:\Windows\System\jpdbDEg.exe
  2⤵
  PID:7376
- C:\Windows\System\BJuAOfy.exe
  C:\Windows\System\BJuAOfy.exe
  2⤵
  PID:4080
- C:\Windows\System\keMIgNl.exe
  C:\Windows\System\keMIgNl.exe
  2⤵
  PID:6448
- C:\Windows\System\imoZraI.exe
  C:\Windows\System\imoZraI.exe
  2⤵
  PID:8400
- C:\Windows\System\UNoEeEi.exe
  C:\Windows\System\UNoEeEi.exe
  2⤵
  PID:6888
- C:\Windows\System\CmDjqlc.exe
  C:\Windows\System\CmDjqlc.exe
  2⤵
  PID:5776
- C:\Windows\System\ayushmH.exe
  C:\Windows\System\ayushmH.exe
  2⤵
  PID:8500
- C:\Windows\System\kVzOFdc.exe
  C:\Windows\System\kVzOFdc.exe
  2⤵
  PID:9404
- C:\Windows\System\pFXFTMF.exe
  C:\Windows\System\pFXFTMF.exe
  2⤵
  PID:12088
- C:\Windows\System\QapnWsu.exe
  C:\Windows\System\QapnWsu.exe
  2⤵
  PID:7744
- C:\Windows\System\YkSYuOs.exe
  C:\Windows\System\YkSYuOs.exe
  2⤵
  PID:9280
- C:\Windows\System\UggmvfO.exe
  C:\Windows\System\UggmvfO.exe
  2⤵
  PID:8996
- C:\Windows\System\TMNqCim.exe
  C:\Windows\System\TMNqCim.exe
  2⤵
  PID:9620
- C:\Windows\System\GqFsgow.exe
  C:\Windows\System\GqFsgow.exe
  2⤵
  PID:4264
- C:\Windows\System\KvIcaZt.exe
  C:\Windows\System\KvIcaZt.exe
  2⤵
  PID:9220
- C:\Windows\System\OKRxLBN.exe
  C:\Windows\System\OKRxLBN.exe
  2⤵
  PID:9256
- C:\Windows\System\GJZxCBk.exe
  C:\Windows\System\GJZxCBk.exe
  2⤵
  PID:9320
- C:\Windows\System\qqUWDhs.exe
  C:\Windows\System\qqUWDhs.exe
  2⤵
  PID:13560
- C:\Windows\System\QoXxOAg.exe
  C:\Windows\System\QoXxOAg.exe
  2⤵
  PID:8792
- C:\Windows\System\anphzfy.exe
  C:\Windows\System\anphzfy.exe
  2⤵
  PID:13552
- C:\Windows\System\qelBLHh.exe
  C:\Windows\System\qelBLHh.exe
  2⤵
  PID:9868
- C:\Windows\System\MbmXttm.exe
  C:\Windows\System\MbmXttm.exe
  2⤵
  PID:8884
- C:\Windows\System\JyNQhKx.exe
  C:\Windows\System\JyNQhKx.exe
  2⤵
  PID:9364
- C:\Windows\System\eexNvVi.exe
  C:\Windows\System\eexNvVi.exe
  2⤵
  PID:8352
- C:\Windows\System\oqHcMYl.exe
  C:\Windows\System\oqHcMYl.exe
  2⤵
  PID:10780
- C:\Windows\System\IYfOQgC.exe
  C:\Windows\System\IYfOQgC.exe
  2⤵
  PID:10520
- C:\Windows\System\jEhmfuh.exe
  C:\Windows\System\jEhmfuh.exe
  2⤵
  PID:10108
- C:\Windows\System\yQDLYzB.exe
  C:\Windows\System\yQDLYzB.exe
  2⤵
  PID:7808
- C:\Windows\System\BeTmxFM.exe
  C:\Windows\System\BeTmxFM.exe
  2⤵
  PID:8936
- C:\Windows\System\YLlnMJH.exe
  C:\Windows\System\YLlnMJH.exe
  2⤵
  PID:6208
- C:\Windows\System\iVrWanx.exe
  C:\Windows\System\iVrWanx.exe
  2⤵
  PID:8796
- C:\Windows\System\QVgjcGV.exe
  C:\Windows\System\QVgjcGV.exe
  2⤵
  PID:10432
- C:\Windows\System\QQEDcjh.exe
  C:\Windows\System\QQEDcjh.exe
  2⤵
  PID:8320
- C:\Windows\System\YyuBFUN.exe
  C:\Windows\System\YyuBFUN.exe
  2⤵
  PID:8908
- C:\Windows\System\osTxVuR.exe
  C:\Windows\System\osTxVuR.exe
  2⤵
  PID:10272
- C:\Windows\System\ysEaocp.exe
  C:\Windows\System\ysEaocp.exe
  2⤵
  PID:6960
- C:\Windows\System\dYNfetH.exe
  C:\Windows\System\dYNfetH.exe
  2⤵
  PID:9036
- C:\Windows\System\wRJlGSi.exe
  C:\Windows\System\wRJlGSi.exe
  2⤵
  PID:10676
- C:\Windows\System\QXZGXdf.exe
  C:\Windows\System\QXZGXdf.exe
  2⤵
  PID:10456
- C:\Windows\System\AIokwuZ.exe
  C:\Windows\System\AIokwuZ.exe
  2⤵
  PID:6892
- C:\Windows\System\HRpdJZS.exe
  C:\Windows\System\HRpdJZS.exe
  2⤵
  PID:7464
- C:\Windows\System\MbNOSyq.exe
  C:\Windows\System\MbNOSyq.exe
  2⤵
  PID:9956
- C:\Windows\System\HGTeRbV.exe
  C:\Windows\System\HGTeRbV.exe
  2⤵
  PID:11124
- C:\Windows\System\ailoVBN.exe
  C:\Windows\System\ailoVBN.exe
  2⤵
  PID:11780
- C:\Windows\System\NyzDsua.exe
  C:\Windows\System\NyzDsua.exe
  2⤵
  PID:7432
- C:\Windows\System\KbxKkmn.exe
  C:\Windows\System\KbxKkmn.exe
  2⤵
  PID:10916
- C:\Windows\System\wFapzzg.exe
  C:\Windows\System\wFapzzg.exe
  2⤵
  PID:10376
- C:\Windows\System\IDKCGkx.exe
  C:\Windows\System\IDKCGkx.exe
  2⤵
  PID:9516
- C:\Windows\System\YmeoThk.exe
  C:\Windows\System\YmeoThk.exe
  2⤵
  PID:12536
- C:\Windows\System\hKFeBXx.exe
  C:\Windows\System\hKFeBXx.exe
  2⤵
  PID:7812
- C:\Windows\System\wWjotHq.exe
  C:\Windows\System\wWjotHq.exe
  2⤵
  PID:12360
- C:\Windows\System\pywZpYg.exe
  C:\Windows\System\pywZpYg.exe
  2⤵
  PID:9120
- C:\Windows\System\WykwqEO.exe
  C:\Windows\System\WykwqEO.exe
  2⤵
  PID:6412
- C:\Windows\System\ZeprXEH.exe
  C:\Windows\System\ZeprXEH.exe
  2⤵
  PID:1128
- C:\Windows\System\BeDmwvV.exe
  C:\Windows\System\BeDmwvV.exe
  2⤵
  PID:11624
- C:\Windows\System\imZpawr.exe
  C:\Windows\System\imZpawr.exe
  2⤵
  PID:7276
- C:\Windows\System\eMxrYKX.exe
  C:\Windows\System\eMxrYKX.exe
  2⤵
  PID:13796
- C:\Windows\System\aLGXtqX.exe
  C:\Windows\System\aLGXtqX.exe
  2⤵
  PID:7384
- C:\Windows\System\NOhmAMZ.exe
  C:\Windows\System\NOhmAMZ.exe
  2⤵
  PID:10644
- C:\Windows\System\bawKvIF.exe
  C:\Windows\System\bawKvIF.exe
  2⤵
  PID:12568
- C:\Windows\System\rAvWWzd.exe
  C:\Windows\System\rAvWWzd.exe
  2⤵
  PID:8308
- C:\Windows\System\nJzkyql.exe
  C:\Windows\System\nJzkyql.exe
  2⤵
  PID:7644
- C:\Windows\System\JAvMQQE.exe
  C:\Windows\System\JAvMQQE.exe
  2⤵
  PID:8028
- C:\Windows\System\wDXPcAI.exe
  C:\Windows\System\wDXPcAI.exe
  2⤵
  PID:10832
- C:\Windows\System\nITyOYC.exe
  C:\Windows\System\nITyOYC.exe
  2⤵
  PID:9668
- C:\Windows\System\GXIneCM.exe
  C:\Windows\System\GXIneCM.exe
  2⤵
  PID:10032
- C:\Windows\System\VYmxrhs.exe
  C:\Windows\System\VYmxrhs.exe
  2⤵
  PID:12476
- C:\Windows\System\oWURwKR.exe
  C:\Windows\System\oWURwKR.exe
  2⤵
  PID:10724
- C:\Windows\System\XzrgpPJ.exe
  C:\Windows\System\XzrgpPJ.exe
  2⤵
  PID:12448
- C:\Windows\System\LyhuaZJ.exe
  C:\Windows\System\LyhuaZJ.exe
  2⤵
  PID:11960
- C:\Windows\System\pdUPlat.exe
  C:\Windows\System\pdUPlat.exe
  2⤵
  PID:9200
- C:\Windows\System\JFgwnJf.exe
  C:\Windows\System\JFgwnJf.exe
  2⤵
  PID:9580
- C:\Windows\System\FeABZhH.exe
  C:\Windows\System\FeABZhH.exe
  2⤵
  PID:2560
- C:\Windows\System\crDnPYm.exe
  C:\Windows\System\crDnPYm.exe
  2⤵
  PID:10680
- C:\Windows\System\LbAyXNo.exe
  C:\Windows\System\LbAyXNo.exe
  2⤵
  PID:3568
- C:\Windows\System\KZbRDZc.exe
  C:\Windows\System\KZbRDZc.exe
  2⤵
  PID:12928
- C:\Windows\System\faHfagM.exe
  C:\Windows\System\faHfagM.exe
  2⤵
  PID:11112
- C:\Windows\System\elkGKZm.exe
  C:\Windows\System\elkGKZm.exe
  2⤵
  PID:10088
- C:\Windows\System\vYEMzCe.exe
  C:\Windows\System\vYEMzCe.exe
  2⤵
  PID:8836
- C:\Windows\System\IDkCatb.exe
  C:\Windows\System\IDkCatb.exe
  2⤵
  PID:12732
- C:\Windows\System\SWtDuQu.exe
  C:\Windows\System\SWtDuQu.exe
  2⤵
  PID:11056
- C:\Windows\System\Dnmskji.exe
  C:\Windows\System\Dnmskji.exe
  2⤵
  PID:12220
- C:\Windows\System\BlRRljV.exe
  C:\Windows\System\BlRRljV.exe
  2⤵
  PID:10608
- C:\Windows\System\uEVjlIn.exe
  C:\Windows\System\uEVjlIn.exe
  2⤵
  PID:13220
- C:\Windows\System\pRooeQx.exe
  C:\Windows\System\pRooeQx.exe
  2⤵
  PID:12280
- C:\Windows\System\dpGoviI.exe
  C:\Windows\System\dpGoviI.exe
  2⤵
  PID:8076
- C:\Windows\System\KGPsFTl.exe
  C:\Windows\System\KGPsFTl.exe
  2⤵
  PID:10528
- C:\Windows\System\VgKPiDn.exe
  C:\Windows\System\VgKPiDn.exe
  2⤵
  PID:12716
- C:\Windows\System\laSUsck.exe
  C:\Windows\System\laSUsck.exe
  2⤵
  PID:10392
- C:\Windows\System\RmNlude.exe
  C:\Windows\System\RmNlude.exe
  2⤵
  PID:9328
- C:\Windows\System\WvZeuWB.exe
  C:\Windows\System\WvZeuWB.exe
  2⤵
  PID:12660
- C:\Windows\System\fjPFWAP.exe
  C:\Windows\System\fjPFWAP.exe
  2⤵
  PID:11240
- C:\Windows\System\LXIjpGt.exe
  C:\Windows\System\LXIjpGt.exe
  2⤵
  PID:11248
- C:\Windows\System\fWlyTqh.exe
  C:\Windows\System\fWlyTqh.exe
  2⤵
  PID:11720
- C:\Windows\System\UZtFnMz.exe
  C:\Windows\System\UZtFnMz.exe
  2⤵
  PID:8292
- C:\Windows\System\kmsBXmP.exe
  C:\Windows\System\kmsBXmP.exe
  2⤵
  PID:11292
- C:\Windows\System\txDHcPh.exe
  C:\Windows\System\txDHcPh.exe
  2⤵
  PID:9876
- C:\Windows\System\qzYtqHd.exe
  C:\Windows\System\qzYtqHd.exe
  2⤵
  PID:1720
- C:\Windows\System\QIKCxoB.exe
  C:\Windows\System\QIKCxoB.exe
  2⤵
  PID:12004
- C:\Windows\System\nNLFtVf.exe
  C:\Windows\System\nNLFtVf.exe
  2⤵
  PID:12192
- C:\Windows\System\UmArKCf.exe
  C:\Windows\System\UmArKCf.exe
  2⤵
  PID:6552
- C:\Windows\System\jhJSkCq.exe
  C:\Windows\System\jhJSkCq.exe
  2⤵
  PID:13260
- C:\Windows\System\cgwKppv.exe
  C:\Windows\System\cgwKppv.exe
  2⤵
  PID:4716
- C:\Windows\System\rvzvRJj.exe
  C:\Windows\System\rvzvRJj.exe
  2⤵
  PID:7128
- C:\Windows\System\aelTmDz.exe
  C:\Windows\System\aelTmDz.exe
  2⤵
  PID:12736
- C:\Windows\System\GMCsWgm.exe
  C:\Windows\System\GMCsWgm.exe
  2⤵
  PID:12888
- C:\Windows\System\wxAahRI.exe
  C:\Windows\System\wxAahRI.exe
  2⤵
  PID:12444
- C:\Windows\System\VVVQWKt.exe
  C:\Windows\System\VVVQWKt.exe
  2⤵
  PID:10920
- C:\Windows\System\WrqySQj.exe
  C:\Windows\System\WrqySQj.exe
  2⤵
  PID:9872
- C:\Windows\System\WYQEvty.exe
  C:\Windows\System\WYQEvty.exe
  2⤵
  PID:12988
- C:\Windows\System\IjBYkSV.exe
  C:\Windows\System\IjBYkSV.exe
  2⤵
  PID:10684
- C:\Windows\System\FqiChdE.exe
  C:\Windows\System\FqiChdE.exe
  2⤵
  PID:9196
- C:\Windows\System\xCTzRPA.exe
  C:\Windows\System\xCTzRPA.exe
  2⤵
  PID:9540
- C:\Windows\System\OxAJcZB.exe
  C:\Windows\System\OxAJcZB.exe
  2⤵
  PID:9724
- C:\Windows\System\iMpETbk.exe
  C:\Windows\System\iMpETbk.exe
  2⤵
  PID:12524
- C:\Windows\System\nojWGLF.exe
  C:\Windows\System\nojWGLF.exe
  2⤵
  PID:11276
- C:\Windows\System\tvbHmQn.exe
  C:\Windows\System\tvbHmQn.exe
  2⤵
  PID:3000
- C:\Windows\System\nfgBwBM.exe
  C:\Windows\System\nfgBwBM.exe
  2⤵
  PID:11316
- C:\Windows\System\qUSjyPz.exe
  C:\Windows\System\qUSjyPz.exe
  2⤵
  PID:5340
- C:\Windows\System\XnINHGD.exe
  C:\Windows\System\XnINHGD.exe
  2⤵
  PID:13296
- C:\Windows\System\JgPSoIe.exe
  C:\Windows\System\JgPSoIe.exe
  2⤵
  PID:12580
- C:\Windows\System\eywsqVq.exe
  C:\Windows\System\eywsqVq.exe
  2⤵
  PID:12772
- C:\Windows\System\WRToaYR.exe
  C:\Windows\System\WRToaYR.exe
  2⤵
  PID:12912
- C:\Windows\System\sfJRnst.exe
  C:\Windows\System\sfJRnst.exe
  2⤵
  PID:10500
- C:\Windows\System\SIvtNFo.exe
  C:\Windows\System\SIvtNFo.exe
  2⤵
  PID:12092
- C:\Windows\System\RSTrtdU.exe
  C:\Windows\System\RSTrtdU.exe
  2⤵
  PID:10308
- C:\Windows\System\aBwubWm.exe
  C:\Windows\System\aBwubWm.exe
  2⤵
  PID:12132
- C:\Windows\System\IywUsyq.exe
  C:\Windows\System\IywUsyq.exe
  2⤵
  PID:12656
- C:\Windows\System\lHkmcfw.exe
  C:\Windows\System\lHkmcfw.exe
  2⤵
  PID:12760
- C:\Windows\System\xmTvBYu.exe
  C:\Windows\System\xmTvBYu.exe
  2⤵
  PID:6132
- C:\Windows\System\RetWzmM.exe
  C:\Windows\System\RetWzmM.exe
  2⤵
  PID:13108
- C:\Windows\System\zfpKUwL.exe
  C:\Windows\System\zfpKUwL.exe
  2⤵
  PID:10400
- C:\Windows\System\xDfkWqF.exe
  C:\Windows\System\xDfkWqF.exe
  2⤵
  PID:6320
- C:\Windows\System\reIpeOg.exe
  C:\Windows\System\reIpeOg.exe
  2⤵
  PID:12064
- C:\Windows\System\yVBHlBU.exe
  C:\Windows\System\yVBHlBU.exe
  2⤵
  PID:9664
- C:\Windows\System\RXyqvsM.exe
  C:\Windows\System\RXyqvsM.exe
  2⤵
  PID:12644
- C:\Windows\System\WMjGugM.exe
  C:\Windows\System\WMjGugM.exe
  2⤵
  PID:9852
- C:\Windows\System\IcTxLTG.exe
  C:\Windows\System\IcTxLTG.exe
  2⤵
  PID:11468
- C:\Windows\System\iwrcBoW.exe
  C:\Windows\System\iwrcBoW.exe
  2⤵
  PID:12744
- C:\Windows\System\RebVSKt.exe
  C:\Windows\System\RebVSKt.exe
  2⤵
  PID:12456
- C:\Windows\System\GaIYjnY.exe
  C:\Windows\System\GaIYjnY.exe
  2⤵
  PID:9960
- C:\Windows\System\NvHcVuX.exe
  C:\Windows\System\NvHcVuX.exe
  2⤵
  PID:11928
- C:\Windows\System\GOldsCK.exe
  C:\Windows\System\GOldsCK.exe
  2⤵
  PID:12424
- C:\Windows\System\tsXCFhb.exe
  C:\Windows\System\tsXCFhb.exe
  2⤵
  PID:9512
- C:\Windows\System\TMjbeOg.exe
  C:\Windows\System\TMjbeOg.exe
  2⤵
  PID:12164
- C:\Windows\System\MITodMI.exe
  C:\Windows\System\MITodMI.exe
  2⤵
  PID:13236
- C:\Windows\System\WUXBAKf.exe
  C:\Windows\System\WUXBAKf.exe
  2⤵
  PID:11420
- C:\Windows\System\UGbjaUT.exe
  C:\Windows\System\UGbjaUT.exe
  2⤵
  PID:11984
- C:\Windows\System\sTOuCGr.exe
  C:\Windows\System\sTOuCGr.exe
  2⤵
  PID:14340
- C:\Windows\System\UtnYuYw.exe
  C:\Windows\System\UtnYuYw.exe
  2⤵
  PID:14364
- C:\Windows\System\wBvltXi.exe
  C:\Windows\System\wBvltXi.exe
  2⤵
  PID:14396
- C:\Windows\System\rhUIVOX.exe
  C:\Windows\System\rhUIVOX.exe
  2⤵
  PID:14448
- C:\Windows\System\CfEVILa.exe
  C:\Windows\System\CfEVILa.exe
  2⤵
  PID:14472
- C:\Windows\System\AZahDmR.exe
  C:\Windows\System\AZahDmR.exe
  2⤵
  PID:14488
- C:\Windows\System\ACeeDWU.exe
  C:\Windows\System\ACeeDWU.exe
  2⤵
  PID:14504
- C:\Windows\System\OmpdfYZ.exe
  C:\Windows\System\OmpdfYZ.exe
  2⤵
  PID:14544
- C:\Windows\System\YOKjSrr.exe
  C:\Windows\System\YOKjSrr.exe
  2⤵
  PID:14576
- C:\Windows\System\IktZIvF.exe
  C:\Windows\System\IktZIvF.exe
  2⤵
  PID:14620
- C:\Windows\System\fqlrCLc.exe
  C:\Windows\System\fqlrCLc.exe
  2⤵
  PID:14636
- C:\Windows\System\wCBucOG.exe
  C:\Windows\System\wCBucOG.exe
  2⤵
  PID:14672
- C:\Windows\System\gPlAcFx.exe
  C:\Windows\System\gPlAcFx.exe
  2⤵
  PID:14700
- C:\Windows\System\xAwqKpl.exe
  C:\Windows\System\xAwqKpl.exe
  2⤵
  PID:14736
- C:\Windows\System\UzNnCTH.exe
  C:\Windows\System\UzNnCTH.exe
  2⤵
  PID:14764
- C:\Windows\System\FiUdgwR.exe
  C:\Windows\System\FiUdgwR.exe
  2⤵
  PID:14800
- C:\Windows\System\RUraQwk.exe
  C:\Windows\System\RUraQwk.exe
  2⤵
  PID:14824
- C:\Windows\System\sgiPIjc.exe
  C:\Windows\System\sgiPIjc.exe
  2⤵
  PID:14856
- C:\Windows\System\JemmOrP.exe
  C:\Windows\System\JemmOrP.exe
  2⤵
  PID:14888
- C:\Windows\System\YZHTrJr.exe
  C:\Windows\System\YZHTrJr.exe
  2⤵
  PID:14904
- C:\Windows\System\WIWvvcR.exe
  C:\Windows\System\WIWvvcR.exe
  2⤵
  PID:14932
- C:\Windows\System\NiOdCcv.exe
  C:\Windows\System\NiOdCcv.exe
  2⤵
  PID:14960
- C:\Windows\System\xiVSxRd.exe
  C:\Windows\System\xiVSxRd.exe
  2⤵
  PID:14988
- C:\Windows\System\okmJrvd.exe
  C:\Windows\System\okmJrvd.exe
  2⤵
  PID:15016
- C:\Windows\System\CLGUuXm.exe
  C:\Windows\System\CLGUuXm.exe
  2⤵
  PID:15052
- C:\Windows\System\EHvdaIU.exe
  C:\Windows\System\EHvdaIU.exe
  2⤵
  PID:15080
- C:\Windows\System\lBBDQDy.exe
  C:\Windows\System\lBBDQDy.exe
  2⤵
  PID:15108
- C:\Windows\System\SctiBkR.exe
  C:\Windows\System\SctiBkR.exe
  2⤵
  PID:15136
- C:\Windows\System\umyEWgQ.exe
  C:\Windows\System\umyEWgQ.exe
  2⤵
  PID:15200
- C:\Windows\System\ZMaCKZK.exe
  C:\Windows\System\ZMaCKZK.exe
  2⤵
  PID:15232
- C:\Windows\System\iADQIVv.exe
  C:\Windows\System\iADQIVv.exe
  2⤵
  PID:15248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Y2LQBQ0P\home-993d2c38b2c1[1].css

Filesize
11KB

MD5
6328d6d9a6b00ce7f992230b97b17c1f

SHA1
88837b802bdde407e37e92641072ea2eeec95556

SHA256
c9d9b80794cebd7d97daf52f7f0ce0e31bcf7a6f65a6e07851c688d67f10dba8

SHA512
993d2c38b2c15499aebdb39c1f9c21d0501d4c2a5973caec65be9ddc3ddfd6e46d06449e7483daa4fa9afa17cb81ff27a391519a64629169eb15c52911aab2c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_khjdkqlh.c44.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AwSzgLM.exe

Filesize
1.9MB

MD5
64e3de1a7bf397642d53e0e8d1a89c34

SHA1
ef4f48f8a77e69b2c50c3ce5017f5741b90679d0

SHA256
8fb92a8aa66beac036825471d0397a2a4bb235c87cbb3d3ff97145b18cf1c030

SHA512
74985c3feba9e82ef15f88be324bd7d06a9e145c918d2573fc214d3939bdafdde543387096d178fb45ed4c58db9576bd8148628bf3d1eb9eea495b4664268eeb

Download Submit
C:\Windows\System\AxgsBbA.exe

Filesize
1.9MB

MD5
c1892bbd36ec4cdfe5f4242f2c4ecd22

SHA1
e88313efbaa3f9fe6082b93053dcd44f74eb857b

SHA256
12437570bf14b62b0f4c511381b1080e38844c018d79a93f9599e38083914342

SHA512
18866b5a86d461be11c671ed45e8e85258d7679a7a4aa57177779618a989e51eeb56cd1e11a4c14f85c2fc0835bd50731a2db2affc88034eca090786117b5608

Download Submit
C:\Windows\System\CMOUwZI.exe

Filesize
1.9MB

MD5
347743a47a88f7ed9c5b29742e9dacba

SHA1
74d2b50011392762187c0068770ffc8f8cd6d951

SHA256
cf362f5540c35fc886512be65000d1466fa34d4859eb0438095d854826d9c5f7

SHA512
0e296361744d13c0a81b1137eb19d4a50854aa9d8e5101281aa0f65dee4cf5bed0c89405e34e5ccdb4576c16a4e15daf39fc488a2d80591a67e08db8db0577a7

Download Submit
C:\Windows\System\FSvqdKH.exe

Filesize
1.9MB

MD5
a8c116109c3560497ed0e03232dabc08

SHA1
dea8155b037b9bf50a21a0c9b0e7519f7f688f2f

SHA256
a3a2db20e88a3eed745097a069872f9abcfbbef7b9f69793fdf9b523f0756e57

SHA512
efb45ec42f2eb41fb7e13f11ec875af40256fc837279b72959cc09a8be35ad644b36a5a18a7056f038f2548457598c3e6527cf6459766f0660b94a8e428e9d15

Download Submit
C:\Windows\System\FpZteog.exe

Filesize
1.9MB

MD5
7f8a9ae5e337593cc565999b46161f25

SHA1
abcd8fe4c73d246005838baaf3c5c63e8e71bd21

SHA256
afb2501ac905a72fc4f9fb476c26723f16665aa676cdedbbef0ce0057ee04c98

SHA512
dc2e4079ff0a391c7cdd3c7057de5f3d89dc881fc7b74e6e3aa81fd51a5a5c64687a26669b9314555bcc35caff78e78f75730785acca016613ba2a1253a1b71a

Download Submit
C:\Windows\System\GpLCnmU.exe

Filesize
1.9MB

MD5
ebce2e4411605796e35f4d7c02122cf6

SHA1
d4509052aaf531021f0d091808a0ed303896e51e

SHA256
60876faa7bd18ca146482946863fc3bb1671ca19159bdc716287b8e2077a7f79

SHA512
6a49dc1b4af36db24e47ecc727cfe25d548597bd8379604a828808a27b37ec406768ecacf9dca2e6fe37a22198686ab92a651d5b619f6bf8cc624a196c7aa33e

Download Submit
C:\Windows\System\IDFubHU.exe

Filesize
1.9MB

MD5
52b143f6e806b12281a2ce0c418b6085

SHA1
8735b8bfc7ba560adb295594a0d5cc9674b9f897

SHA256
17d71b190e0a8a5ddd74d38d32b09de4b286ffccf3b0d9cf09672359e06e2bbc

SHA512
691c3d276afcc1432c9570b13406402b4a9352fe1fbf9ff3763d125a68234b2a128c0673798a341974f6f866271b7dc5532e23f3dff1171f205462d969949e9b

Download Submit
C:\Windows\System\IIHMtrC.exe

Filesize
1.9MB

MD5
2a3cd2b33e4b4b14ef2f559420fa8fe0

SHA1
3873139710a0ec280148f9d1a1d1a15c2645356b

SHA256
7eb4532ff2432e75937cd333f5017a20b860411dbb2cdc720187e5ce429bb03b

SHA512
37d701b66051c50fb78d1d732824ab891dbca6484aed4c0ccfb39febf2ab30dab1e6d5249a28dfa11d935c0c1029dc100eec4eec9199d39da67bcee9ddc5693a

Download Submit
C:\Windows\System\JQpdZPL.exe

Filesize
1.9MB

MD5
5e0e6c117f4886198da0c35a709699f2

SHA1
354313ad916980c7073da3080ca761c5299adb4a

SHA256
bc9d5fd93f732160fb907948a8090bbbc82fd7fb1840d9e54a381a899e099089

SHA512
580302acc876ebf4b2cbc842fcc57a0f7dc823e1cd5f9d8ac5dfad3be65fd59f9a3d2ce1dfa31b21c1265a746b604b09739b801bb8469802048d13c2337c0671

Download Submit
C:\Windows\System\JeAmyza.exe

Filesize
1.9MB

MD5
70678795a2a85a91d5c9536a0477e599

SHA1
6a9672ae41855731b21f2ef7df206196b6c1a7e6

SHA256
b2afced7dc76b608f9544526ceceaa97d2b1ce739151b16416acdbdd27533219

SHA512
6cfcf44576c4237774cc7e4f7f22bd3e4a33616d10484d3d67fa58b8da5f04fedb881031a8d7c65c5089d8ca038a21fdf66f8ecbb1fe15b2b722de4bc15f49d6

Download Submit
C:\Windows\System\KTEmaJs.exe

Filesize
1.9MB

MD5
08c7e10484e233ed1f0d31281964accf

SHA1
3f722045919631029222e3781dbe1007e532434a

SHA256
08b3e37fc987ab38b677c0ed01c9143f15995c97e01100f79562ea401a5bc429

SHA512
99dd480bd40a6097e52621ed12de55767318428d38d88231e8dea69a2bda6a7e4f7c6e5586d28de41fce7419b24b5b9277ef19e2791210d31a7676efaa1ed7e4

Download Submit
C:\Windows\System\NMhNUFU.exe

Filesize
1.9MB

MD5
7c2fbb30f22e0d3b3426839d59fb6a09

SHA1
b4a9f9d9c2b6f2a4780ba514b217a565f9896f15

SHA256
ea0434d509c9cd799fabcffa77e488cffeb78a15f7860d246866ff2b131babc1

SHA512
8365e6c1b38f06e3f97cc8d14bd27875665332cb2000943f3a4164ddeb6d046eaa1d72e72b895c7e9d63f251c76f2471ce7af6f69a5642c8726b8978121e5fd4

Download Submit
C:\Windows\System\OWDLris.exe

Filesize
1.9MB

MD5
99e62e83ac018ae8e84d07ed2ae905b9

SHA1
2255fc9e6df28deea9d25e17157933a30a47d73d

SHA256
0625a942244f1d0449d7aee9ad859d475caa39e70a9c71478a9e4ef9d0d61a97

SHA512
043a9966329e58695bd34c0a1c0305621a1e81ca99188c4db434e90f64c8f77f54177b96c5a6dd746d6d0d8c43f572824978881f8341829647a23417fdbf0377

Download Submit
C:\Windows\System\RKtqMSJ.exe

Filesize
1.9MB

MD5
c1ac208e9e7c391682f86dcd8e2dfe42

SHA1
b94d4c8bba6b79abd8cc4feb3b6f660b8eb83592

SHA256
182f3ad7a8df48f46c1f079955d5056666481bd49cea112a6d5bbb611c3a44a2

SHA512
69e822be8fd736e0f025c06a551839374ab8967bab1628934076e07c8630b5e6c71d8638a0cefba128576b9dbcc63533a2b3be4049bd22d3e0fe12a9ffabda64

Download Submit
C:\Windows\System\RVuiEAO.exe

Filesize
1.9MB

MD5
b74b9e6f7f635eb0b63645b19ce0284d

SHA1
4aadda64c0696311bdfc5846dbd6882b32f85173

SHA256
b5ac8c11d2a004c4fc0e8b462c91a85b65cbcc23f84875922248433fe4760f5d

SHA512
9e789599bd6fb259a983ecdba195924d061e3d67b6167592dac1d64f1bba189f51bf1b205f23007e929834991d82a593d768adc770045895cd193ce92ebcac39

Download Submit
C:\Windows\System\RgYJxzN.exe

Filesize
1.9MB

MD5
e514fbba059b45679396316f97671ade

SHA1
9ff621ebcb0f89f6b8d2f27a042adc90c3bc10b1

SHA256
775200f37a48cb9b27323c1cb6f1bec60be076a7d8d6267f0f1f90dd1bbe6a32

SHA512
180d5776818a91c614d4793d1aa66caf113affe953a596c1e3483836dc90097bce351a1808c355b1b5d5772b46eb43151ec657fd793a174f70bb068e1b84008f

Download Submit
C:\Windows\System\TidrlpV.exe

Filesize
1.9MB

MD5
26acc69178eb63701757ee93a5658b15

SHA1
76987d1ac516e07d334c93631d18e32f54793d80

SHA256
b7c6841b7030bda15771abe764fcecf6415df7bac9d6cd3c402548b5222c99dc

SHA512
9ed16f4f10f703a4c6c28952fc70739cce345cce8e943773936ca7f2a0a5e477e43f60b2da767506c64cf1b8cdc43b06c41880d13438af61b313fa30e0906507

Download Submit
C:\Windows\System\UKKRMmn.exe

Filesize
1.9MB

MD5
f7be416d8e4d3570834da728042869a4

SHA1
76d264a2da953b1c7a9f59dd080a7d8c4c243b41

SHA256
9377ee0fb1171118bb8a15596812cd06fd3f3174190582ac5fe4678c513fae62

SHA512
af0b4d527d0de05119df712dbc5be2859c747c0680b5afd0c3261a9ded0fbadf68f04f3fab33a12b7441df3edabb5fcde2e01d4f08e34740c0d2f733a9e9f869

Download Submit
C:\Windows\System\WXEIMwq.exe

Filesize
1.9MB

MD5
fa7cf4c3eebf74354982bbe41e193f69

SHA1
8ba629071e5ae0ef937829623e1ffbbf4d6df95a

SHA256
733ff01ec2384ec39d8afef4559e95dc5a3e7c9e61c044d39cba270ae6fe537d

SHA512
c0d335cbb412bf72bcf4a21b8cdee86b940166318dd02944ac8a664f51c16fd93db791dd80ac8f355ae490243597120cf843e1807f6b4b048d6789505391fc0d

Download Submit
C:\Windows\System\YINVLiX.exe

Filesize
1.9MB

MD5
ea8eb19033d84d093027a64af1d666da

SHA1
e8cf4ed56cf847813d379ae0439311ff4f3060a5

SHA256
2c60338345d3dae522a0d1aab9e3f49b20e8d07d38a8c4592969eba329a89b9a

SHA512
87a164827a96bfc40db08fee581ad8d82619b164d1a4d63836283f5798e40c5c22cdfc17c0f58171c83ac8bb67b1c56157cef1918fcccf58a739d5fad5406332

Download Submit
C:\Windows\System\ZPGrKYM.exe

Filesize
1.9MB

MD5
022f5ff5aaba0e8c2b479c7301b034dc

SHA1
635a8af1cad00173c1980a995288e4a154fb1de3

SHA256
0a44a5b3513370383f2105aaacff8fbd0e2188234611bc5d18856ab3d0926598

SHA512
a31d8a7bc8e791e45fa3a7702a8e79336126dccdfe29bbca9480d4e7192ff6bdc37143f95f8d0b0af6502e0c59c2e1dab6bcabb905a4da5c5e70b9164bef8a51

Download Submit
C:\Windows\System\dIwLhkX.exe

Filesize
1.9MB

MD5
7612d201c897d19cbe9ac3d09b9200a9

SHA1
80d6d21fe4b1d5f7841bdae8948f542a9b04415b

SHA256
a0ee5e07b2c73996a567d85c52912ea4ee1d6a28b6fbc5ccce35f60886a64eb6

SHA512
22faebc0ce120bd55e3aaa045eaaf6ea90a500d415fa070f0ae7bcdef9a693bfde69136b30efe4f567ce9e3efe93e7a7637f2a8165030a0d134d3fe215abbe1f

Download Submit
C:\Windows\System\dOyECIE.exe

Filesize
8B

MD5
9e16362b7eef9ff59cf4576b688fec20

SHA1
58714a79316bdda8b345ca47c2a7e8087e024871

SHA256
cb157cd47cb9ddacb8fa194262e9cc1364ca68490d93ad041938e77ef90ead7c

SHA512
53056e2e9a952538e1c61538c2bad2166adaf2d4a03d0e97e211329cd7f80967988343aa21690b08c2f1ad6d3fabfdc6095392f57b127d575de79d724d1a09de

Download Submit
C:\Windows\System\fUtREWk.exe

Filesize
1.9MB

MD5
a117b69775d79ab287c8530c5068a4eb

SHA1
490a4a0e0fd0566a879121616f0ad38ae1186df5

SHA256
2c81988fbb3a7cb5ec3b7c1c3d15545e1fc9fefd7c399b7d94ff791ec056fd05

SHA512
d0a056b01fdc0293f7e30627556a8affb8fba328988dd28fbb47b8397df88f74b46ef69115a103b863fa24db13594ad83210b83d3e83bf3334581804fe9a5539

Download Submit
C:\Windows\System\fnmliMD.exe

Filesize
1.9MB

MD5
ee5fb4c9578177b4ceb83a178d9c3e09

SHA1
6b825ef4760ff443944cde83b246080af2ad8204

SHA256
041ced93bcbf1e3cbfebfefdfd11a510093521352e8044da5397a6d92d66d7ff

SHA512
807549b5754865ffb403ecc7d860c8585af8b30e5bd393bb22cec81aabc0b951ed03313e3e5d0c7f872bf5b2ca006eb6aa8f3d5f5503211d2f043e74692a2e11

Download Submit
C:\Windows\System\gLpUxuV.exe

Filesize
1.9MB

MD5
2efff9b629def273ec2b9b8fd57f024d

SHA1
a5103c2402dc98de8f08ae6abff86b3e68ee05e8

SHA256
8e7f27bf5b059ee0e3577f9fac8be2966bf4f58501e5c9cc4f866625072faeda

SHA512
aba494d246c06e12d2ec4179deac66b6432d9468bf5f32bdf739a5b683f75e44cfce6bf234429300184b1e9b29fb4a248b8f0a57581e9b833ceaea1c15928502

Download Submit
C:\Windows\System\hGdrTVh.exe

Filesize
1.9MB

MD5
eb32295467b8ecca1c4c58234a35c267

SHA1
40ef4dbc09b863ab8f69bfe919646908aac1283f

SHA256
d33d6ab00486639ac5c4fbc32c0eea7af9b50b9734185cb00f8b5308f58f69aa

SHA512
9a1f07b665513b64de620ab81ef34304145ecddcc7e1f86602752ada299961272189a625f4d9ee6702a51c30c272556a616bcb3a7d3f03303a85800c81b096b4

Download Submit
C:\Windows\System\hpcXTSb.exe

Filesize
1.9MB

MD5
1b8247e54ee3b3f89eea2b6c78b1a9b7

SHA1
42af2c46ba0cb0d8659ee39038ec26e73939f4ff

SHA256
5b49e9cf7df7d8cf39b3be1fa0c930c6b229c62f3c033f7e01dac04fdf7b3272

SHA512
eadde6985261052cf96985320a05e6286706e8c8fc785277b4e27521d42948c00d6fe5d35c367d385276fa8ce8795f34afccbb2f5dba6a59e5632d478161b634

Download Submit
C:\Windows\System\ilDkYic.exe

Filesize
1.9MB

MD5
bf4aa03bda3d8d1d5b3bfa3ec6e2db4e

SHA1
fa681549f1f7f893bc5ed810f76b00074e0e945c

SHA256
f2b1977322cc2279f3621da1e534449464de4078717b32535a2443d97d0fd60d

SHA512
746a0311b6bee66f547ff71540c0c0246434a60491d1eea11993cccc163d9a196d90268a4e4227b3cc57cd90c6baa55bbbe8703cd1bf8e462fe55b9d5aca95de

Download Submit
C:\Windows\System\imyPebO.exe

Filesize
1.9MB

MD5
e20ddd0847fa4e036468fe7092d55dac

SHA1
be47eb0eb1621051e4ebfe49d5f82a069e4dff8f

SHA256
8dd26fb0a3e68c47d8bcc2696fea15563da72b65769d44dc4b0d6d3a62ccb591

SHA512
be010693e5e3db0bd9bdc7d9fa7d6db2586c2314a67477173f3fa09b6b6f43d7d298b69eb76bec425880414f79cda25862903bc6f72955ddc86bd57a76e95c98

Download Submit
C:\Windows\System\ixgfsGy.exe

Filesize
1.9MB

MD5
d15a62a9389549e61962d782594eb4d3

SHA1
3e9c0ab77b7b540d6c3efef1a778959e37eb6d19

SHA256
267dcc99bdaf5e1dee8a999f09476dd3c9eca964033cc6bab769bd9e8ffc5180

SHA512
03b36d9b190d8c952bb6fd0d6e48275c609d4afd50c31a3965ceb18adb9bc3f4a2ba8a37cadd77ad45d7ff866bcc3102d585b7335e1fb8e25e820f5b7512d6af

Download Submit
C:\Windows\System\jVzOVWq.exe

Filesize
1.9MB

MD5
910fb4500e7d57a7f6310d67c08d8437

SHA1
529321c513c328a076b305739d4734626b22d144

SHA256
5ff5b3f5af740bb840c1ad565c98dfad07cde5f90eca96afbb8129cf0c2a28e7

SHA512
1f6d32f28be7a4b156194622385ebcb79507f4019195a11f0e954b5d82ef7d3486ed815ff9ddf62c96b3cfcecd15cd3705dcfdd4187e43a7c0939707a7c37eaf

Download Submit
C:\Windows\System\lifQZJm.exe

Filesize
1.9MB

MD5
d2ed131e1b7bbf4a64c3569bec146ad0

SHA1
8a73f36e0ec5bba5c32830a298953e057da28c32

SHA256
873879c6a8d0487a3ca0417c35e8b9217e3042eaaf4dab3e1d9abc1a747c4adc

SHA512
731b1984f981ce1f3eac02fcbe467096c63dab0eb829b12e49a3cc85bd96450c7bd29edea15fed3edad5ec34a10bfe820466602835356d06523566b8a64469b9

Download Submit
C:\Windows\System\mfEAfsp.exe

Filesize
1.9MB

MD5
77f129a3afbb36b09808b765d4520408

SHA1
60c7a438494c85adf202aea0cad0d215976e1eec

SHA256
4131029dc9fb20b71314b5c9e76c125e4362145d50ad4681ecfd0091bd4a834c

SHA512
a8ff91fbfb5dd7f4f199b3a027e4e2b78a6db437ca9fa4986af24cda1dec412295e61aa3d470b0dedbc718e3c6fc2c7230d1bd568e7035f34785f4d0f7960da9

Download Submit
C:\Windows\System\mjKifUn.exe

Filesize
1.9MB

MD5
cf4ff5d004d30729161fb3a148d42ff2

SHA1
ab8e09102ce7cc01dec7e103aa09fa62306a984b

SHA256
6871d043110c5d80e24e1778c1f1be2e0e5581195d332c3dc952cfda36c550fa

SHA512
53a040cc98ab9dc132993727d3809a1ff2441ceb8c9be4addc9fd19bd6d37b095f150d72b7697a6531720660c7b968ca186582fbabd1d0a82d1ccae90de02350

Download Submit
C:\Windows\System\nYyUvXp.exe

Filesize
1.9MB

MD5
07df772a1563cbd8d7e2bc5c73b6eaf6

SHA1
b424cff45358670f708013b00252b3c70ae7bbbc

SHA256
449f042ce62ce9a62fc1e7197520873d129624f9e9b95b4073a97d76905d56ee

SHA512
26555a6d28329c345dbe93c5aab145a1254b4c6489e94ffd475c99777867b37d289579f02482ba4770553fde1882e24fb7878720e0fd9d26e05caed109aafa4b

Download Submit
C:\Windows\System\nizECdt.exe

Filesize
18B

MD5
b5af15b91ef901dbbad280bf2ec97d3f

SHA1
b8fc44effcf94c604b3a330099fdd05d70ca2290

SHA256
4b241b0358bbe69bc40fb7c8558ef0dacf7a7dd595b9974e7ee1287f6f6a57a6

SHA512
77e9e1cd7604d29efe33ea37dfc85035465c8eb4a6b1edf396f009c9427a6171460e7b24fac454a276653572360ea48634eb43a059b68dd9d91460bd58c1ddf1

Download Submit
C:\Windows\System\oaKQJsU.exe

Filesize
1.9MB

MD5
6e3bf13d0e141f4e1d626ea9be4b7bc1

SHA1
51754b476343946012db2af1e4aa667900cbe7f2

SHA256
cb19bec9272ea116c0ec6fb216debe537fab632fb27f3e50aa31a5c5ca9246ba

SHA512
84bb75e8ca716f6a87541d6673922547a90af4d48f4217e4f4ec87f22d793981784300de54d0096ab78bae101120edffd947fc2a8b3d277677e1a7e7eb9a1342

Download Submit
C:\Windows\System\piEfQZj.exe

Filesize
1.9MB

MD5
51cedbeb5bccb006779493f24ef9b273

SHA1
37ac2c44c88fa7fe9e9831c7c2d1517b8c9bbe6c

SHA256
caac7ce6c14ddde3f012e08ce99b0b989318b14a3e07b795e255fcb6c80e52ae

SHA512
04d7a06ff71ff202f8b9aaae573d10253fd4353dd3cd7081cc1ee1ee8170617f8f0df45cce3707795ac2787e196042990476fc8a7928b99904ad4fd8feb19b01

Download Submit
C:\Windows\System\weBjqvS.exe

Filesize
1.9MB

MD5
5853aa143c03839c8311546623d4cacd

SHA1
532904896e7b5478481f376a9205fcbca85ea793

SHA256
4089ab9517be9f87d679c589963339fe64465fc5619cb37faba20099fec3db48

SHA512
93231740423f0b917ff6aec516b605dbf5ce849d4d0523ff8272fa05f3aaf626c90e2121e32b442c21c18bffc8b931b2463fc600016768d777a1188960c6434f

Download Submit
C:\Windows\System\xMpGrzI.exe

Filesize
1.9MB

MD5
f70c0fd99554419ad29aaeac3ba91477

SHA1
c1f572dd7d734df86dd3e9a30db8079930cf5a58

SHA256
ec17012a3104f46a6a4dc62e2f447545cb7a3d37571ee7da0feaf551c4407c01

SHA512
0d4cc14ffb8755128ffc3b2914dd765638f380335476fc49a8bd20f322a00c9d22dbbda513af5d8337050e53bfd70f0bd542379e8eee07787b40c7a988720505

Download Submit
C:\Windows\System\xmUVLmB.exe

Filesize
1.9MB

MD5
edb6dd95d38db8849e1c9e4483ab93f3

SHA1
845068bc3ec7c70e53597e49e9bfaa28885a7897

SHA256
568d811ecdd15277278f9685b3d156347f41d64d27cc863c7abc3f35476182b9

SHA512
8fc21fecd6fa46de7c642076ceff5868e04945505c7a6655595c0e194e6b5fb4b7878716c7d0489d5dcd87173409b398890c52252620690b5171299981fcf639

Download Submit
memory/428-4673-0x00007FF6A3040000-0x00007FF6A3432000-memory.dmp

Filesize
3.9MB

Download
memory/428-331-0x00007FF6A3040000-0x00007FF6A3432000-memory.dmp

Filesize
3.9MB

Download
memory/464-83-0x00007FF8960B0000-0x00007FF896B71000-memory.dmp

Filesize
10.8MB

Download
memory/464-19-0x00007FF8960B3000-0x00007FF8960B5000-memory.dmp

Filesize
8KB

Download
memory/464-6139-0x00007FF8960B3000-0x00007FF8960B5000-memory.dmp

Filesize
8KB

Download
memory/464-350-0x00007FF8960B0000-0x00007FF896B71000-memory.dmp

Filesize
10.8MB

Download
memory/464-353-0x0000029ACC440000-0x0000029ACCBE6000-memory.dmp

Filesize
7.6MB

Download
memory/464-217-0x0000029ACB710000-0x0000029ACB732000-memory.dmp

Filesize
136KB

Download
memory/716-142-0x00007FF77B150000-0x00007FF77B542000-memory.dmp

Filesize
3.9MB

Download
memory/888-334-0x00007FF626210000-0x00007FF626602000-memory.dmp

Filesize
3.9MB

Download
memory/888-4645-0x00007FF626210000-0x00007FF626602000-memory.dmp

Filesize
3.9MB

Download
memory/1064-4681-0x00007FF77D000000-0x00007FF77D3F2000-memory.dmp

Filesize
3.9MB

Download
memory/1064-285-0x00007FF77D000000-0x00007FF77D3F2000-memory.dmp

Filesize
3.9MB

Download
memory/1292-4631-0x00007FF74B400000-0x00007FF74B7F2000-memory.dmp

Filesize
3.9MB

Download
memory/1292-300-0x00007FF74B400000-0x00007FF74B7F2000-memory.dmp

Filesize
3.9MB

Download
memory/1340-345-0x00007FF63C0A0000-0x00007FF63C492000-memory.dmp

Filesize
3.9MB

Download
memory/1340-4693-0x00007FF63C0A0000-0x00007FF63C492000-memory.dmp

Filesize
3.9MB

Download
memory/1468-4654-0x00007FF69B780000-0x00007FF69BB72000-memory.dmp

Filesize
3.9MB

Download
memory/1468-250-0x00007FF69B780000-0x00007FF69BB72000-memory.dmp

Filesize
3.9MB

Download
memory/1556-4628-0x00007FF737940000-0x00007FF737D32000-memory.dmp

Filesize
3.9MB

Download
memory/1556-251-0x00007FF737940000-0x00007FF737D32000-memory.dmp

Filesize
3.9MB

Download
memory/1620-4708-0x00007FF720B00000-0x00007FF720EF2000-memory.dmp

Filesize
3.9MB

Download
memory/1620-347-0x00007FF720B00000-0x00007FF720EF2000-memory.dmp

Filesize
3.9MB

Download
memory/1636-4679-0x00007FF6A8490000-0x00007FF6A8882000-memory.dmp

Filesize
3.9MB

Download
memory/1636-337-0x00007FF6A8490000-0x00007FF6A8882000-memory.dmp

Filesize
3.9MB

Download
memory/1972-348-0x00007FF69BFE0000-0x00007FF69C3D2000-memory.dmp

Filesize
3.9MB

Download
memory/1972-4682-0x00007FF69BFE0000-0x00007FF69C3D2000-memory.dmp

Filesize
3.9MB

Download
memory/2068-18-0x00007FF78AA90000-0x00007FF78AE82000-memory.dmp

Filesize
3.9MB

Download
memory/2100-4656-0x00007FF6E3FD0000-0x00007FF6E43C2000-memory.dmp

Filesize
3.9MB

Download
memory/2100-343-0x00007FF6E3FD0000-0x00007FF6E43C2000-memory.dmp

Filesize
3.9MB

Download
memory/2132-4701-0x00007FF79EFB0000-0x00007FF79F3A2000-memory.dmp

Filesize
3.9MB

Download
memory/2132-346-0x00007FF79EFB0000-0x00007FF79F3A2000-memory.dmp

Filesize
3.9MB

Download
memory/2328-184-0x00007FF677F40000-0x00007FF678332000-memory.dmp

Filesize
3.9MB

Download
memory/2328-4667-0x00007FF677F40000-0x00007FF678332000-memory.dmp

Filesize
3.9MB

Download
memory/2384-349-0x00007FF63A390000-0x00007FF63A782000-memory.dmp

Filesize
3.9MB

Download
memory/2384-4740-0x00007FF63A390000-0x00007FF63A782000-memory.dmp

Filesize
3.9MB

Download
memory/2448-218-0x00007FF69BE80000-0x00007FF69C272000-memory.dmp

Filesize
3.9MB

Download
memory/2448-4624-0x00007FF69BE80000-0x00007FF69C272000-memory.dmp

Filesize
3.9MB

Download
memory/2512-351-0x00007FF740C90000-0x00007FF741082000-memory.dmp

Filesize
3.9MB

Download
memory/2884-4642-0x00007FF761710000-0x00007FF761B02000-memory.dmp

Filesize
3.9MB

Download
memory/2884-333-0x00007FF761710000-0x00007FF761B02000-memory.dmp

Filesize
3.9MB

Download
memory/2912-0-0x00007FF6D1400000-0x00007FF6D17F2000-memory.dmp

Filesize
3.9MB

Download
memory/2912-1-0x0000026C5E160000-0x0000026C5E170000-memory.dmp

Filesize
64KB

Download
memory/3068-4677-0x00007FF6B28C0000-0x00007FF6B2CB2000-memory.dmp

Filesize
3.9MB

Download
memory/3068-335-0x00007FF6B28C0000-0x00007FF6B2CB2000-memory.dmp

Filesize
3.9MB

Download
memory/3608-344-0x00007FF6D7710000-0x00007FF6D7B02000-memory.dmp

Filesize
3.9MB

Download
memory/3608-4735-0x00007FF6D7710000-0x00007FF6D7B02000-memory.dmp

Filesize
3.9MB

Download
memory/4892-111-0x00007FF7455A0000-0x00007FF745992000-memory.dmp

Filesize
3.9MB

Download
memory/4892-4638-0x00007FF7455A0000-0x00007FF745992000-memory.dmp

Filesize
3.9MB

Download
memory/4908-309-0x00007FF682A80000-0x00007FF682E72000-memory.dmp

Filesize
3.9MB

Download
memory/4908-4675-0x00007FF682A80000-0x00007FF682E72000-memory.dmp

Filesize
3.9MB

Download
memory/5012-4710-0x00007FF6B75E0000-0x00007FF6B79D2000-memory.dmp

Filesize
3.9MB

Download
memory/5012-352-0x00007FF6B75E0000-0x00007FF6B79D2000-memory.dmp

Filesize
3.9MB

Download