xmrig | 4491672b69fee2de24a1054e804617975365e22d44deac5545f5057803f273a6

Analysis

max time kernel
140s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
02-05-2024 13:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
Size

2.2MB
MD5

0eaf16e2c5b8f412d5859696948ec27a
SHA1

c70343dcf06bde93dc805999e194d23deeeedc0c
SHA256

4491672b69fee2de24a1054e804617975365e22d44deac5545f5057803f273a6
SHA512

08bd702df560726eee1500f127dcf362ae26c833ca5b215bd8e13cbe035536538f1edf913f1dcc2f593611ff3b4a4028c03ef3ffeef99244c1cb6f048d018c7b
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qr8+P7:NABa

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 43 IoCs

miner

resource	yara_rule
behavioral2/memory/868-75-0x00007FF71B390000-0x00007FF71B782000-memory.dmp	xmrig
behavioral2/memory/4632-110-0x00007FF6C4B90000-0x00007FF6C4F82000-memory.dmp	xmrig
behavioral2/memory/440-137-0x00007FF639B90000-0x00007FF639F82000-memory.dmp	xmrig
behavioral2/memory/4064-203-0x00007FF6E30E0000-0x00007FF6E34D2000-memory.dmp	xmrig
behavioral2/memory/4184-296-0x00007FF797280000-0x00007FF797672000-memory.dmp	xmrig
behavioral2/memory/2460-356-0x00007FF783B80000-0x00007FF783F72000-memory.dmp	xmrig
behavioral2/memory/4376-362-0x00007FF6818B0000-0x00007FF681CA2000-memory.dmp	xmrig
behavioral2/memory/3584-422-0x00007FF7E2BF0000-0x00007FF7E2FE2000-memory.dmp	xmrig
behavioral2/memory/372-423-0x00007FF744500000-0x00007FF7448F2000-memory.dmp	xmrig
behavioral2/memory/1632-421-0x00007FF61C2F0000-0x00007FF61C6E2000-memory.dmp	xmrig
behavioral2/memory/3880-418-0x00007FF7D72A0000-0x00007FF7D7692000-memory.dmp	xmrig
behavioral2/memory/1208-398-0x00007FF6F1400000-0x00007FF6F17F2000-memory.dmp	xmrig
behavioral2/memory/1528-350-0x00007FF75EA50000-0x00007FF75EE42000-memory.dmp	xmrig
behavioral2/memory/2684-347-0x00007FF7D4600000-0x00007FF7D49F2000-memory.dmp	xmrig
behavioral2/memory/3384-281-0x00007FF65F0C0000-0x00007FF65F4B2000-memory.dmp	xmrig
behavioral2/memory/4588-268-0x00007FF6158A0000-0x00007FF615C92000-memory.dmp	xmrig
behavioral2/memory/4728-263-0x00007FF72DF90000-0x00007FF72E382000-memory.dmp	xmrig
behavioral2/memory/804-240-0x00007FF649EB0000-0x00007FF64A2A2000-memory.dmp	xmrig
behavioral2/memory/4016-226-0x00007FF640DC0000-0x00007FF6411B2000-memory.dmp	xmrig
behavioral2/memory/2912-211-0x00007FF6E0D30000-0x00007FF6E1122000-memory.dmp	xmrig
behavioral2/memory/5044-210-0x00007FF67F3B0000-0x00007FF67F7A2000-memory.dmp	xmrig
behavioral2/memory/4348-176-0x00007FF795710000-0x00007FF795B02000-memory.dmp	xmrig
behavioral2/memory/4952-106-0x00007FF700C60000-0x00007FF701052000-memory.dmp	xmrig
behavioral2/memory/4272-60-0x00007FF71D390000-0x00007FF71D782000-memory.dmp	xmrig
behavioral2/memory/4348-4757-0x00007FF795710000-0x00007FF795B02000-memory.dmp	xmrig
behavioral2/memory/4632-4754-0x00007FF6C4B90000-0x00007FF6C4F82000-memory.dmp	xmrig
behavioral2/memory/4588-4760-0x00007FF6158A0000-0x00007FF615C92000-memory.dmp	xmrig
behavioral2/memory/5044-4767-0x00007FF67F3B0000-0x00007FF67F7A2000-memory.dmp	xmrig
behavioral2/memory/4064-4772-0x00007FF6E30E0000-0x00007FF6E34D2000-memory.dmp	xmrig
behavioral2/memory/2912-4778-0x00007FF6E0D30000-0x00007FF6E1122000-memory.dmp	xmrig
behavioral2/memory/1632-4787-0x00007FF61C2F0000-0x00007FF61C6E2000-memory.dmp	xmrig
behavioral2/memory/4184-4790-0x00007FF797280000-0x00007FF797672000-memory.dmp	xmrig
behavioral2/memory/4016-4804-0x00007FF640DC0000-0x00007FF6411B2000-memory.dmp	xmrig
behavioral2/memory/3384-4815-0x00007FF65F0C0000-0x00007FF65F4B2000-memory.dmp	xmrig
behavioral2/memory/2460-4864-0x00007FF783B80000-0x00007FF783F72000-memory.dmp	xmrig
behavioral2/memory/1208-4861-0x00007FF6F1400000-0x00007FF6F17F2000-memory.dmp	xmrig
behavioral2/memory/2684-4853-0x00007FF7D4600000-0x00007FF7D49F2000-memory.dmp	xmrig
behavioral2/memory/372-4848-0x00007FF744500000-0x00007FF7448F2000-memory.dmp	xmrig
behavioral2/memory/4728-4846-0x00007FF72DF90000-0x00007FF72E382000-memory.dmp	xmrig
behavioral2/memory/3584-4843-0x00007FF7E2BF0000-0x00007FF7E2FE2000-memory.dmp	xmrig
behavioral2/memory/4376-4832-0x00007FF6818B0000-0x00007FF681CA2000-memory.dmp	xmrig
behavioral2/memory/804-4810-0x00007FF649EB0000-0x00007FF64A2A2000-memory.dmp	xmrig
behavioral2/memory/3880-4792-0x00007FF7D72A0000-0x00007FF7D7692000-memory.dmp	xmrig

Blocklisted process makes network request 8 IoCs

flow	pid	Process
9	3344	powershell.exe
11	3344	powershell.exe
13	3344	powershell.exe
14	3344	powershell.exe
16	3344	powershell.exe
20	3344	powershell.exe
21	3344	powershell.exe
22	3344	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3344	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4272	tSGtdSv.exe
868	RBedfnQ.exe
4952	NaMGkup.exe
4632	wEUxynW.exe
440	HIHlMJU.exe
4348	zXCljSJ.exe
4064	cxxbDPG.exe
5044	LWbjznr.exe
3880	rDtKcvv.exe
2912	FtzJKnc.exe
4016	tNNblWb.exe
804	AYtCfhT.exe
4728	ARKyZHC.exe
4588	xeUEuQW.exe
1632	uBFBqCE.exe
3584	GbqhRDS.exe
3384	FgNLXXE.exe
4184	GHtsZhn.exe
372	VChyPsG.exe
2684	AATKjiD.exe
1528	JZjEKRm.exe
2460	WQFrNLy.exe
4376	KdZpIpv.exe
1208	UHVvFsG.exe
4212	JDvuoHQ.exe
2496	rqlhScX.exe
4532	qZNzDQj.exe
3124	NazNCSQ.exe
4928	xNmDtdE.exe
3192	ZTDdkmK.exe
4196	KDdRoFj.exe
8	eUTkngG.exe
4540	GvoPYmM.exe
1568	HSVAvhE.exe
2980	LnkCzia.exe
3260	xHwZlsX.exe
4508	ndgfEOs.exe
4620	sDmsSDO.exe
2412	AlXlFuh.exe
2732	iyomvpb.exe
2132	MEbNGDt.exe
4072	TvncTiz.exe
1788	QdoySci.exe
3460	aamIeLH.exe
4472	mJzfYgg.exe
184	uquaOpP.exe
208	ZwtBOce.exe
4340	gIhJVfK.exe
2440	vMktHot.exe
756	QxHVgti.exe
2696	oVUkBoK.exe
2892	InamDeB.exe
3404	kfXOsAX.exe
2428	GrwbjNW.exe
4732	CIthGRm.exe
4580	DJdaHOW.exe
1968	wotuEKK.exe
4868	qCxRwLk.exe
4412	mbVTWro.exe
4944	KkDwKSd.exe
2748	IenbhBs.exe
4396	uITItSI.exe
1544	TpsmjCV.exe
624	FCsuJfR.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1620-0-0x00007FF7B28E0000-0x00007FF7B2CD2000-memory.dmp	upx
behavioral2/files/0x000a000000023bb0-27.dat	upx
behavioral2/files/0x000a000000023bb2-49.dat	upx
behavioral2/files/0x000a000000023bb8-73.dat	upx
behavioral2/files/0x000a000000023bb5-89.dat	upx
behavioral2/files/0x000a000000023bb1-65.dat	upx
behavioral2/memory/868-75-0x00007FF71B390000-0x00007FF71B782000-memory.dmp	upx
behavioral2/memory/4632-110-0x00007FF6C4B90000-0x00007FF6C4F82000-memory.dmp	upx
behavioral2/memory/440-137-0x00007FF639B90000-0x00007FF639F82000-memory.dmp	upx
behavioral2/memory/4064-203-0x00007FF6E30E0000-0x00007FF6E34D2000-memory.dmp	upx
behavioral2/memory/4184-296-0x00007FF797280000-0x00007FF797672000-memory.dmp	upx
behavioral2/memory/2460-356-0x00007FF783B80000-0x00007FF783F72000-memory.dmp	upx
behavioral2/memory/4376-362-0x00007FF6818B0000-0x00007FF681CA2000-memory.dmp	upx
behavioral2/memory/3584-422-0x00007FF7E2BF0000-0x00007FF7E2FE2000-memory.dmp	upx
behavioral2/memory/372-423-0x00007FF744500000-0x00007FF7448F2000-memory.dmp	upx
behavioral2/memory/1632-421-0x00007FF61C2F0000-0x00007FF61C6E2000-memory.dmp	upx
behavioral2/memory/3880-418-0x00007FF7D72A0000-0x00007FF7D7692000-memory.dmp	upx
behavioral2/memory/1208-398-0x00007FF6F1400000-0x00007FF6F17F2000-memory.dmp	upx
behavioral2/memory/1528-350-0x00007FF75EA50000-0x00007FF75EE42000-memory.dmp	upx
behavioral2/memory/2684-347-0x00007FF7D4600000-0x00007FF7D49F2000-memory.dmp	upx
behavioral2/memory/3384-281-0x00007FF65F0C0000-0x00007FF65F4B2000-memory.dmp	upx
behavioral2/memory/4588-268-0x00007FF6158A0000-0x00007FF615C92000-memory.dmp	upx
behavioral2/memory/4728-263-0x00007FF72DF90000-0x00007FF72E382000-memory.dmp	upx
behavioral2/memory/804-240-0x00007FF649EB0000-0x00007FF64A2A2000-memory.dmp	upx
behavioral2/memory/4016-226-0x00007FF640DC0000-0x00007FF6411B2000-memory.dmp	upx
behavioral2/memory/2912-211-0x00007FF6E0D30000-0x00007FF6E1122000-memory.dmp	upx
behavioral2/memory/5044-210-0x00007FF67F3B0000-0x00007FF67F7A2000-memory.dmp	upx
behavioral2/files/0x000a000000023bcf-189.dat	upx
behavioral2/files/0x000a000000023bce-187.dat	upx
behavioral2/files/0x000a000000023bc1-184.dat	upx
behavioral2/files/0x000a000000023bcd-183.dat	upx
behavioral2/files/0x000a000000023bcc-182.dat	upx
behavioral2/files/0x000a000000023bcb-180.dat	upx
behavioral2/files/0x000c000000023b9e-179.dat	upx
behavioral2/files/0x000a000000023bc7-177.dat	upx
behavioral2/memory/4348-176-0x00007FF795710000-0x00007FF795B02000-memory.dmp	upx
behavioral2/files/0x000a000000023bca-175.dat	upx
behavioral2/files/0x000a000000023bc9-173.dat	upx
behavioral2/files/0x000a000000023bbb-156.dat	upx
behavioral2/files/0x000a000000023bc8-151.dat	upx
behavioral2/files/0x000a000000023bc0-149.dat	upx
behavioral2/files/0x000a000000023bba-146.dat	upx
behavioral2/files/0x000a000000023bbf-141.dat	upx
behavioral2/files/0x000a000000023bc5-134.dat	upx
behavioral2/files/0x000a000000023bc4-133.dat	upx
behavioral2/files/0x000a000000023bc3-132.dat	upx
behavioral2/files/0x0031000000023bbc-130.dat	upx
behavioral2/files/0x000a000000023bc2-129.dat	upx
behavioral2/files/0x000a000000023bc6-174.dat	upx
behavioral2/files/0x000a000000023bb9-119.dat	upx
behavioral2/files/0x0031000000023bbe-113.dat	upx
behavioral2/memory/4952-106-0x00007FF700C60000-0x00007FF701052000-memory.dmp	upx
behavioral2/files/0x0031000000023bbd-100.dat	upx
behavioral2/files/0x000a000000023bb6-90.dat	upx
behavioral2/files/0x000a000000023bb4-85.dat	upx
behavioral2/files/0x000a000000023bb3-82.dat	upx
behavioral2/memory/4272-60-0x00007FF71D390000-0x00007FF71D782000-memory.dmp	upx
behavioral2/files/0x000a000000023bb7-59.dat	upx
behavioral2/files/0x000a000000023bad-55.dat	upx
behavioral2/files/0x000a000000023bac-40.dat	upx
behavioral2/files/0x000a000000023baf-35.dat	upx
behavioral2/files/0x000a000000023bab-29.dat	upx
behavioral2/files/0x000a000000023bae-47.dat	upx
behavioral2/files/0x000e000000023b9d-22.dat	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\GOgjQys.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\eHTLRJc.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\fucIxvH.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\bLKXcox.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\ekoSapP.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\efMejcJ.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\CvMXfxk.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\JevWWgN.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\ihHDuqZ.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\sCVIJlX.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\ybQvfUt.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\VuWqABJ.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\mHuHUOZ.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\wwrSokf.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\irvUMIg.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\YjcevUd.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\EoFnhzC.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\tWgjgAB.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\SPUHvqj.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\bNNrhyt.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\RNynVfq.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\awZmwKL.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\FihUYZT.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\mScEEzN.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\BPzThhq.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\OWNfBet.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\eVXdmUE.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\POBrdBo.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\luuqsqC.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\MdtEVXi.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\hYNPlxK.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\FjaTwEy.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\tLyrmpq.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\tIqCati.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\ABWoBMK.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\yifnMlo.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\vTALVBa.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\OlGxUCx.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\spHsiwN.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\tuFrooB.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\MDfYtJh.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\kKAbofh.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\XSDMpza.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\nXBNGnI.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\zPUtIDK.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\XyeEiIR.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\tQEcGEB.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\TADItXF.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\HYolRCx.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\qgLkrVe.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\qHAQzTG.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\SYfsupC.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\hgbsHTI.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\qWjEFOK.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\JuQjtaR.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\CCxwEYu.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\xyQNYkT.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\zXPgEmf.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\NWdTKBJ.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\jmDyqZi.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\GXMRbcP.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\xOsFaym.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\WUdfvuP.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
File created	C:\Windows\System\gTFXqtv.exe	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3344	powershell.exe
3344	powershell.exe
3344	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
Token: SeDebugPrivilege	3344	powershell.exe
Token: SeLockMemoryPrivilege	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 3344	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	84
PID 1620 wrote to memory of 3344	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	84
PID 1620 wrote to memory of 4272	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	85
PID 1620 wrote to memory of 4272	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	85
PID 1620 wrote to memory of 868	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	86
PID 1620 wrote to memory of 868	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	86
PID 1620 wrote to memory of 4952	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	87
PID 1620 wrote to memory of 4952	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	87
PID 1620 wrote to memory of 4348	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	88
PID 1620 wrote to memory of 4348	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	88
PID 1620 wrote to memory of 4632	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	89
PID 1620 wrote to memory of 4632	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	89
PID 1620 wrote to memory of 440	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	90
PID 1620 wrote to memory of 440	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	90
PID 1620 wrote to memory of 4064	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	91
PID 1620 wrote to memory of 4064	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	91
PID 1620 wrote to memory of 5044	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	92
PID 1620 wrote to memory of 5044	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	92
PID 1620 wrote to memory of 3880	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	93
PID 1620 wrote to memory of 3880	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	93
PID 1620 wrote to memory of 2912	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	94
PID 1620 wrote to memory of 2912	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	94
PID 1620 wrote to memory of 4016	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	95
PID 1620 wrote to memory of 4016	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	95
PID 1620 wrote to memory of 804	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	96
PID 1620 wrote to memory of 804	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	96
PID 1620 wrote to memory of 4728	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	97
PID 1620 wrote to memory of 4728	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	97
PID 1620 wrote to memory of 4588	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	98
PID 1620 wrote to memory of 4588	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	98
PID 1620 wrote to memory of 1632	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	99
PID 1620 wrote to memory of 1632	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	99
PID 1620 wrote to memory of 2684	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	100
PID 1620 wrote to memory of 2684	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	100
PID 1620 wrote to memory of 2460	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	101
PID 1620 wrote to memory of 2460	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	101
PID 1620 wrote to memory of 3584	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	102
PID 1620 wrote to memory of 3584	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	102
PID 1620 wrote to memory of 3384	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	103
PID 1620 wrote to memory of 3384	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	103
PID 1620 wrote to memory of 4184	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	104
PID 1620 wrote to memory of 4184	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	104
PID 1620 wrote to memory of 372	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	105
PID 1620 wrote to memory of 372	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	105
PID 1620 wrote to memory of 1528	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	106
PID 1620 wrote to memory of 1528	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	106
PID 1620 wrote to memory of 4376	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	107
PID 1620 wrote to memory of 4376	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	107
PID 1620 wrote to memory of 1208	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	108
PID 1620 wrote to memory of 1208	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	108
PID 1620 wrote to memory of 4212	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	109
PID 1620 wrote to memory of 4212	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	109
PID 1620 wrote to memory of 2496	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	110
PID 1620 wrote to memory of 2496	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	110
PID 1620 wrote to memory of 4532	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	111
PID 1620 wrote to memory of 4532	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	111
PID 1620 wrote to memory of 3124	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	112
PID 1620 wrote to memory of 3124	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	112
PID 1620 wrote to memory of 8	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	113
PID 1620 wrote to memory of 8	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	113
PID 1620 wrote to memory of 4928	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	114
PID 1620 wrote to memory of 4928	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	114
PID 1620 wrote to memory of 3192	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	115
PID 1620 wrote to memory of 3192	1620	0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0eaf16e2c5b8f412d5859696948ec27a_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3344
- C:\Windows\System\tSGtdSv.exe
  C:\Windows\System\tSGtdSv.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\RBedfnQ.exe
  C:\Windows\System\RBedfnQ.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\NaMGkup.exe
  C:\Windows\System\NaMGkup.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\zXCljSJ.exe
  C:\Windows\System\zXCljSJ.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\wEUxynW.exe
  C:\Windows\System\wEUxynW.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\HIHlMJU.exe
  C:\Windows\System\HIHlMJU.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\cxxbDPG.exe
  C:\Windows\System\cxxbDPG.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\LWbjznr.exe
  C:\Windows\System\LWbjznr.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\rDtKcvv.exe
  C:\Windows\System\rDtKcvv.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\FtzJKnc.exe
  C:\Windows\System\FtzJKnc.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\tNNblWb.exe
  C:\Windows\System\tNNblWb.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\AYtCfhT.exe
  C:\Windows\System\AYtCfhT.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\ARKyZHC.exe
  C:\Windows\System\ARKyZHC.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\xeUEuQW.exe
  C:\Windows\System\xeUEuQW.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\uBFBqCE.exe
  C:\Windows\System\uBFBqCE.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\AATKjiD.exe
  C:\Windows\System\AATKjiD.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\WQFrNLy.exe
  C:\Windows\System\WQFrNLy.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\GbqhRDS.exe
  C:\Windows\System\GbqhRDS.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\FgNLXXE.exe
  C:\Windows\System\FgNLXXE.exe
  2⤵
  - Executes dropped EXE
  PID:3384
- C:\Windows\System\GHtsZhn.exe
  C:\Windows\System\GHtsZhn.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\VChyPsG.exe
  C:\Windows\System\VChyPsG.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\JZjEKRm.exe
  C:\Windows\System\JZjEKRm.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\KdZpIpv.exe
  C:\Windows\System\KdZpIpv.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\UHVvFsG.exe
  C:\Windows\System\UHVvFsG.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\JDvuoHQ.exe
  C:\Windows\System\JDvuoHQ.exe
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Windows\System\rqlhScX.exe
  C:\Windows\System\rqlhScX.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\qZNzDQj.exe
  C:\Windows\System\qZNzDQj.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\NazNCSQ.exe
  C:\Windows\System\NazNCSQ.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\eUTkngG.exe
  C:\Windows\System\eUTkngG.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\xNmDtdE.exe
  C:\Windows\System\xNmDtdE.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\ZTDdkmK.exe
  C:\Windows\System\ZTDdkmK.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\KDdRoFj.exe
  C:\Windows\System\KDdRoFj.exe
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Windows\System\GvoPYmM.exe
  C:\Windows\System\GvoPYmM.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\HSVAvhE.exe
  C:\Windows\System\HSVAvhE.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\LnkCzia.exe
  C:\Windows\System\LnkCzia.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\xHwZlsX.exe
  C:\Windows\System\xHwZlsX.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\ndgfEOs.exe
  C:\Windows\System\ndgfEOs.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\sDmsSDO.exe
  C:\Windows\System\sDmsSDO.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\AlXlFuh.exe
  C:\Windows\System\AlXlFuh.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\iyomvpb.exe
  C:\Windows\System\iyomvpb.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\MEbNGDt.exe
  C:\Windows\System\MEbNGDt.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\TvncTiz.exe
  C:\Windows\System\TvncTiz.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\QdoySci.exe
  C:\Windows\System\QdoySci.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\aamIeLH.exe
  C:\Windows\System\aamIeLH.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\mJzfYgg.exe
  C:\Windows\System\mJzfYgg.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\uquaOpP.exe
  C:\Windows\System\uquaOpP.exe
  2⤵
  - Executes dropped EXE
  PID:184
- C:\Windows\System\ZwtBOce.exe
  C:\Windows\System\ZwtBOce.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\gIhJVfK.exe
  C:\Windows\System\gIhJVfK.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\vMktHot.exe
  C:\Windows\System\vMktHot.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\QxHVgti.exe
  C:\Windows\System\QxHVgti.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\oVUkBoK.exe
  C:\Windows\System\oVUkBoK.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\InamDeB.exe
  C:\Windows\System\InamDeB.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\kfXOsAX.exe
  C:\Windows\System\kfXOsAX.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\GrwbjNW.exe
  C:\Windows\System\GrwbjNW.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\CIthGRm.exe
  C:\Windows\System\CIthGRm.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\DJdaHOW.exe
  C:\Windows\System\DJdaHOW.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\wotuEKK.exe
  C:\Windows\System\wotuEKK.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\qCxRwLk.exe
  C:\Windows\System\qCxRwLk.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\mbVTWro.exe
  C:\Windows\System\mbVTWro.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\KkDwKSd.exe
  C:\Windows\System\KkDwKSd.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\IenbhBs.exe
  C:\Windows\System\IenbhBs.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\uITItSI.exe
  C:\Windows\System\uITItSI.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\TpsmjCV.exe
  C:\Windows\System\TpsmjCV.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\FCsuJfR.exe
  C:\Windows\System\FCsuJfR.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\wBeGaJb.exe
  C:\Windows\System\wBeGaJb.exe
  2⤵
  PID:2480
- C:\Windows\System\pGuZtph.exe
  C:\Windows\System\pGuZtph.exe
  2⤵
  PID:4488
- C:\Windows\System\mCKHNbM.exe
  C:\Windows\System\mCKHNbM.exe
  2⤵
  PID:1920
- C:\Windows\System\UbqXDjL.exe
  C:\Windows\System\UbqXDjL.exe
  2⤵
  PID:4964
- C:\Windows\System\tFtNdVS.exe
  C:\Windows\System\tFtNdVS.exe
  2⤵
  PID:2144
- C:\Windows\System\fadgfqV.exe
  C:\Windows\System\fadgfqV.exe
  2⤵
  PID:5008
- C:\Windows\System\BVDzCxG.exe
  C:\Windows\System\BVDzCxG.exe
  2⤵
  PID:4968
- C:\Windows\System\jJSITSu.exe
  C:\Windows\System\jJSITSu.exe
  2⤵
  PID:2288
- C:\Windows\System\zPBfJRZ.exe
  C:\Windows\System\zPBfJRZ.exe
  2⤵
  PID:5124
- C:\Windows\System\tGpasLX.exe
  C:\Windows\System\tGpasLX.exe
  2⤵
  PID:5140
- C:\Windows\System\pNUCpOg.exe
  C:\Windows\System\pNUCpOg.exe
  2⤵
  PID:5164
- C:\Windows\System\hTQOXQJ.exe
  C:\Windows\System\hTQOXQJ.exe
  2⤵
  PID:5184
- C:\Windows\System\ICTbSzT.exe
  C:\Windows\System\ICTbSzT.exe
  2⤵
  PID:5232
- C:\Windows\System\tYRmYEj.exe
  C:\Windows\System\tYRmYEj.exe
  2⤵
  PID:5248
- C:\Windows\System\uRCOvRb.exe
  C:\Windows\System\uRCOvRb.exe
  2⤵
  PID:5268
- C:\Windows\System\xilfbam.exe
  C:\Windows\System\xilfbam.exe
  2⤵
  PID:5288
- C:\Windows\System\ffmqfol.exe
  C:\Windows\System\ffmqfol.exe
  2⤵
  PID:5304
- C:\Windows\System\TFlonbp.exe
  C:\Windows\System\TFlonbp.exe
  2⤵
  PID:5324
- C:\Windows\System\FYUFpUS.exe
  C:\Windows\System\FYUFpUS.exe
  2⤵
  PID:5340
- C:\Windows\System\OuLrLyy.exe
  C:\Windows\System\OuLrLyy.exe
  2⤵
  PID:5356
- C:\Windows\System\HYUxovC.exe
  C:\Windows\System\HYUxovC.exe
  2⤵
  PID:5384
- C:\Windows\System\foqRmAm.exe
  C:\Windows\System\foqRmAm.exe
  2⤵
  PID:5412
- C:\Windows\System\RodYxuX.exe
  C:\Windows\System\RodYxuX.exe
  2⤵
  PID:5436
- C:\Windows\System\RQzvDar.exe
  C:\Windows\System\RQzvDar.exe
  2⤵
  PID:5456
- C:\Windows\System\cxFOvwx.exe
  C:\Windows\System\cxFOvwx.exe
  2⤵
  PID:5472
- C:\Windows\System\VZumgvB.exe
  C:\Windows\System\VZumgvB.exe
  2⤵
  PID:5500
- C:\Windows\System\cgoSPPD.exe
  C:\Windows\System\cgoSPPD.exe
  2⤵
  PID:5520
- C:\Windows\System\xDUBzbK.exe
  C:\Windows\System\xDUBzbK.exe
  2⤵
  PID:5540
- C:\Windows\System\czqdLCJ.exe
  C:\Windows\System\czqdLCJ.exe
  2⤵
  PID:5568
- C:\Windows\System\sKJlsfh.exe
  C:\Windows\System\sKJlsfh.exe
  2⤵
  PID:5592
- C:\Windows\System\TYMoenj.exe
  C:\Windows\System\TYMoenj.exe
  2⤵
  PID:5608
- C:\Windows\System\mZMUHqi.exe
  C:\Windows\System\mZMUHqi.exe
  2⤵
  PID:5788
- C:\Windows\System\XKMPpeA.exe
  C:\Windows\System\XKMPpeA.exe
  2⤵
  PID:5816
- C:\Windows\System\bMBgqai.exe
  C:\Windows\System\bMBgqai.exe
  2⤵
  PID:5876
- C:\Windows\System\QUybEdC.exe
  C:\Windows\System\QUybEdC.exe
  2⤵
  PID:5900
- C:\Windows\System\gMDDwnt.exe
  C:\Windows\System\gMDDwnt.exe
  2⤵
  PID:5932
- C:\Windows\System\iVzZqUX.exe
  C:\Windows\System\iVzZqUX.exe
  2⤵
  PID:5952
- C:\Windows\System\idgmklC.exe
  C:\Windows\System\idgmklC.exe
  2⤵
  PID:5976
- C:\Windows\System\uQWJOnf.exe
  C:\Windows\System\uQWJOnf.exe
  2⤵
  PID:6008
- C:\Windows\System\puXLrCf.exe
  C:\Windows\System\puXLrCf.exe
  2⤵
  PID:6024
- C:\Windows\System\gKYLVFg.exe
  C:\Windows\System\gKYLVFg.exe
  2⤵
  PID:6044
- C:\Windows\System\tLeyIyZ.exe
  C:\Windows\System\tLeyIyZ.exe
  2⤵
  PID:6076
- C:\Windows\System\iRAPZka.exe
  C:\Windows\System\iRAPZka.exe
  2⤵
  PID:4920
- C:\Windows\System\XbqZfRA.exe
  C:\Windows\System\XbqZfRA.exe
  2⤵
  PID:4744
- C:\Windows\System\mYswGSm.exe
  C:\Windows\System\mYswGSm.exe
  2⤵
  PID:2240
- C:\Windows\System\GSpgCAe.exe
  C:\Windows\System\GSpgCAe.exe
  2⤵
  PID:5348
- C:\Windows\System\DpMpixQ.exe
  C:\Windows\System\DpMpixQ.exe
  2⤵
  PID:5376
- C:\Windows\System\XdEIgDI.exe
  C:\Windows\System\XdEIgDI.exe
  2⤵
  PID:5404
- C:\Windows\System\zNNfcOc.exe
  C:\Windows\System\zNNfcOc.exe
  2⤵
  PID:5444
- C:\Windows\System\kNHcWgy.exe
  C:\Windows\System\kNHcWgy.exe
  2⤵
  PID:5468
- C:\Windows\System\ftbikDh.exe
  C:\Windows\System\ftbikDh.exe
  2⤵
  PID:5508
- C:\Windows\System\QzXjhVs.exe
  C:\Windows\System\QzXjhVs.exe
  2⤵
  PID:5548
- C:\Windows\System\rYcmMDb.exe
  C:\Windows\System\rYcmMDb.exe
  2⤵
  PID:5564
- C:\Windows\System\LCZXaJe.exe
  C:\Windows\System\LCZXaJe.exe
  2⤵
  PID:5656
- C:\Windows\System\vlipxsv.exe
  C:\Windows\System\vlipxsv.exe
  2⤵
  PID:5716
- C:\Windows\System\nzrqOKE.exe
  C:\Windows\System\nzrqOKE.exe
  2⤵
  PID:4416
- C:\Windows\System\YtYPJee.exe
  C:\Windows\System\YtYPJee.exe
  2⤵
  PID:1608
- C:\Windows\System\KoRTFid.exe
  C:\Windows\System\KoRTFid.exe
  2⤵
  PID:4092
- C:\Windows\System\euxsMeH.exe
  C:\Windows\System\euxsMeH.exe
  2⤵
  PID:2672
- C:\Windows\System\LEhgRLq.exe
  C:\Windows\System\LEhgRLq.exe
  2⤵
  PID:5748
- C:\Windows\System\FqyOJpc.exe
  C:\Windows\System\FqyOJpc.exe
  2⤵
  PID:6088
- C:\Windows\System\iziqWov.exe
  C:\Windows\System\iziqWov.exe
  2⤵
  PID:6052
- C:\Windows\System\vjYwRgT.exe
  C:\Windows\System\vjYwRgT.exe
  2⤵
  PID:6020
- C:\Windows\System\LgKjaFb.exe
  C:\Windows\System\LgKjaFb.exe
  2⤵
  PID:5908
- C:\Windows\System\votBXzb.exe
  C:\Windows\System\votBXzb.exe
  2⤵
  PID:5860
- C:\Windows\System\QyfFBIw.exe
  C:\Windows\System\QyfFBIw.exe
  2⤵
  PID:5824
- C:\Windows\System\eMYoXcp.exe
  C:\Windows\System\eMYoXcp.exe
  2⤵
  PID:6132
- C:\Windows\System\hYbDKAx.exe
  C:\Windows\System\hYbDKAx.exe
  2⤵
  PID:4428
- C:\Windows\System\SpKVBzg.exe
  C:\Windows\System\SpKVBzg.exe
  2⤵
  PID:6156
- C:\Windows\System\UsBNRla.exe
  C:\Windows\System\UsBNRla.exe
  2⤵
  PID:6176
- C:\Windows\System\rPEPkRV.exe
  C:\Windows\System\rPEPkRV.exe
  2⤵
  PID:6200
- C:\Windows\System\aGhZvNO.exe
  C:\Windows\System\aGhZvNO.exe
  2⤵
  PID:6600
- C:\Windows\System\PPsGSSS.exe
  C:\Windows\System\PPsGSSS.exe
  2⤵
  PID:6652
- C:\Windows\System\FZTCDrN.exe
  C:\Windows\System\FZTCDrN.exe
  2⤵
  PID:6700
- C:\Windows\System\FxKxdOv.exe
  C:\Windows\System\FxKxdOv.exe
  2⤵
  PID:6716
- C:\Windows\System\TOisJCE.exe
  C:\Windows\System\TOisJCE.exe
  2⤵
  PID:6744
- C:\Windows\System\bqfMoru.exe
  C:\Windows\System\bqfMoru.exe
  2⤵
  PID:6768
- C:\Windows\System\qKhxhiw.exe
  C:\Windows\System\qKhxhiw.exe
  2⤵
  PID:6800
- C:\Windows\System\riccLne.exe
  C:\Windows\System\riccLne.exe
  2⤵
  PID:6816
- C:\Windows\System\RCLAtrX.exe
  C:\Windows\System\RCLAtrX.exe
  2⤵
  PID:6840
- C:\Windows\System\NENXYvM.exe
  C:\Windows\System\NENXYvM.exe
  2⤵
  PID:6864
- C:\Windows\System\rvRjKol.exe
  C:\Windows\System\rvRjKol.exe
  2⤵
  PID:6884
- C:\Windows\System\cBPjkNX.exe
  C:\Windows\System\cBPjkNX.exe
  2⤵
  PID:6900
- C:\Windows\System\EhYHhCN.exe
  C:\Windows\System\EhYHhCN.exe
  2⤵
  PID:6944
- C:\Windows\System\HpbvzWF.exe
  C:\Windows\System\HpbvzWF.exe
  2⤵
  PID:6988
- C:\Windows\System\WnzIklh.exe
  C:\Windows\System\WnzIklh.exe
  2⤵
  PID:7032
- C:\Windows\System\KUPQdBq.exe
  C:\Windows\System\KUPQdBq.exe
  2⤵
  PID:7068
- C:\Windows\System\ArRHbzN.exe
  C:\Windows\System\ArRHbzN.exe
  2⤵
  PID:7096
- C:\Windows\System\cMxkRsT.exe
  C:\Windows\System\cMxkRsT.exe
  2⤵
  PID:7116
- C:\Windows\System\unYGDuB.exe
  C:\Windows\System\unYGDuB.exe
  2⤵
  PID:7140
- C:\Windows\System\CSigUnQ.exe
  C:\Windows\System\CSigUnQ.exe
  2⤵
  PID:7160
- C:\Windows\System\HBzeYUZ.exe
  C:\Windows\System\HBzeYUZ.exe
  2⤵
  PID:5336
- C:\Windows\System\YkiAooZ.exe
  C:\Windows\System\YkiAooZ.exe
  2⤵
  PID:5424
- C:\Windows\System\onusnwi.exe
  C:\Windows\System\onusnwi.exe
  2⤵
  PID:5528
- C:\Windows\System\SeDinqp.exe
  C:\Windows\System\SeDinqp.exe
  2⤵
  PID:3700
- C:\Windows\System\fnEjfck.exe
  C:\Windows\System\fnEjfck.exe
  2⤵
  PID:6092
- C:\Windows\System\VGdEJQY.exe
  C:\Windows\System\VGdEJQY.exe
  2⤵
  PID:2280
- C:\Windows\System\KNSYWnO.exe
  C:\Windows\System\KNSYWnO.exe
  2⤵
  PID:5836
- C:\Windows\System\wYQznQw.exe
  C:\Windows\System\wYQznQw.exe
  2⤵
  PID:5988
- C:\Windows\System\ERwtjhf.exe
  C:\Windows\System\ERwtjhf.exe
  2⤵
  PID:6216
- C:\Windows\System\xIabBKI.exe
  C:\Windows\System\xIabBKI.exe
  2⤵
  PID:6368
- C:\Windows\System\aonFaKD.exe
  C:\Windows\System\aonFaKD.exe
  2⤵
  PID:6400
- C:\Windows\System\IkMiVrE.exe
  C:\Windows\System\IkMiVrE.exe
  2⤵
  PID:820
- C:\Windows\System\cZOTgEN.exe
  C:\Windows\System\cZOTgEN.exe
  2⤵
  PID:4800
- C:\Windows\System\BhMrvdg.exe
  C:\Windows\System\BhMrvdg.exe
  2⤵
  PID:3852
- C:\Windows\System\iJecNji.exe
  C:\Windows\System\iJecNji.exe
  2⤵
  PID:2604
- C:\Windows\System\LoBwgtw.exe
  C:\Windows\System\LoBwgtw.exe
  2⤵
  PID:5048
- C:\Windows\System\elcjDOd.exe
  C:\Windows\System\elcjDOd.exe
  2⤵
  PID:2404
- C:\Windows\System\VRZpwJi.exe
  C:\Windows\System\VRZpwJi.exe
  2⤵
  PID:6516
- C:\Windows\System\kYxFkWV.exe
  C:\Windows\System\kYxFkWV.exe
  2⤵
  PID:1668
- C:\Windows\System\umafGkf.exe
  C:\Windows\System\umafGkf.exe
  2⤵
  PID:6540
- C:\Windows\System\dNozdNw.exe
  C:\Windows\System\dNozdNw.exe
  2⤵
  PID:6560
- C:\Windows\System\jBvjpSU.exe
  C:\Windows\System\jBvjpSU.exe
  2⤵
  PID:3448
- C:\Windows\System\kjqTGbE.exe
  C:\Windows\System\kjqTGbE.exe
  2⤵
  PID:5684
- C:\Windows\System\iACbIbX.exe
  C:\Windows\System\iACbIbX.exe
  2⤵
  PID:4180
- C:\Windows\System\sHOPXez.exe
  C:\Windows\System\sHOPXez.exe
  2⤵
  PID:5616
- C:\Windows\System\hAhiNPd.exe
  C:\Windows\System\hAhiNPd.exe
  2⤵
  PID:5020
- C:\Windows\System\NWhxUwx.exe
  C:\Windows\System\NWhxUwx.exe
  2⤵
  PID:6616
- C:\Windows\System\ojVyaPd.exe
  C:\Windows\System\ojVyaPd.exe
  2⤵
  PID:5172
- C:\Windows\System\JbFSbSj.exe
  C:\Windows\System\JbFSbSj.exe
  2⤵
  PID:2744
- C:\Windows\System\MGFyplZ.exe
  C:\Windows\System\MGFyplZ.exe
  2⤵
  PID:6752
- C:\Windows\System\lCVBreV.exe
  C:\Windows\System\lCVBreV.exe
  2⤵
  PID:6920
- C:\Windows\System\NTukYGv.exe
  C:\Windows\System\NTukYGv.exe
  2⤵
  PID:6832
- C:\Windows\System\dvVaDef.exe
  C:\Windows\System\dvVaDef.exe
  2⤵
  PID:7040
- C:\Windows\System\xhiSrOy.exe
  C:\Windows\System\xhiSrOy.exe
  2⤵
  PID:7080
- C:\Windows\System\rSMeXMu.exe
  C:\Windows\System\rSMeXMu.exe
  2⤵
  PID:7112
- C:\Windows\System\lxakpll.exe
  C:\Windows\System\lxakpll.exe
  2⤵
  PID:6964
- C:\Windows\System\BZvHYno.exe
  C:\Windows\System\BZvHYno.exe
  2⤵
  PID:5296
- C:\Windows\System\MshRizn.exe
  C:\Windows\System\MshRizn.exe
  2⤵
  PID:1672
- C:\Windows\System\HkPlBDV.exe
  C:\Windows\System\HkPlBDV.exe
  2⤵
  PID:6960
- C:\Windows\System\ltqBVyY.exe
  C:\Windows\System\ltqBVyY.exe
  2⤵
  PID:5940
- C:\Windows\System\odHxIrr.exe
  C:\Windows\System\odHxIrr.exe
  2⤵
  PID:7152
- C:\Windows\System\annZmGg.exe
  C:\Windows\System\annZmGg.exe
  2⤵
  PID:6344
- C:\Windows\System\CXMbOLX.exe
  C:\Windows\System\CXMbOLX.exe
  2⤵
  PID:6272
- C:\Windows\System\pdzKVIZ.exe
  C:\Windows\System\pdzKVIZ.exe
  2⤵
  PID:5732
- C:\Windows\System\risWRVp.exe
  C:\Windows\System\risWRVp.exe
  2⤵
  PID:3400
- C:\Windows\System\BBBWhug.exe
  C:\Windows\System\BBBWhug.exe
  2⤵
  PID:6168
- C:\Windows\System\rnpCHoR.exe
  C:\Windows\System\rnpCHoR.exe
  2⤵
  PID:2400
- C:\Windows\System\ouVbzvZ.exe
  C:\Windows\System\ouVbzvZ.exe
  2⤵
  PID:4408
- C:\Windows\System\GqtbnaH.exe
  C:\Windows\System\GqtbnaH.exe
  2⤵
  PID:6512
- C:\Windows\System\CdQkzIL.exe
  C:\Windows\System\CdQkzIL.exe
  2⤵
  PID:6536
- C:\Windows\System\sqKHhTl.exe
  C:\Windows\System\sqKHhTl.exe
  2⤵
  PID:4876
- C:\Windows\System\wvFJnEQ.exe
  C:\Windows\System\wvFJnEQ.exe
  2⤵
  PID:6628
- C:\Windows\System\ltcgjcy.exe
  C:\Windows\System\ltcgjcy.exe
  2⤵
  PID:2268
- C:\Windows\System\QBuqEwg.exe
  C:\Windows\System\QBuqEwg.exe
  2⤵
  PID:6872
- C:\Windows\System\XDEamBE.exe
  C:\Windows\System\XDEamBE.exe
  2⤵
  PID:6936
- C:\Windows\System\iiysQjO.exe
  C:\Windows\System\iiysQjO.exe
  2⤵
  PID:6792
- C:\Windows\System\HKSeOtE.exe
  C:\Windows\System\HKSeOtE.exe
  2⤵
  PID:2040
- C:\Windows\System\vQygGGC.exe
  C:\Windows\System\vQygGGC.exe
  2⤵
  PID:7056
- C:\Windows\System\zzGByZJ.exe
  C:\Windows\System\zzGByZJ.exe
  2⤵
  PID:4080
- C:\Windows\System\tsbCAKC.exe
  C:\Windows\System\tsbCAKC.exe
  2⤵
  PID:4084
- C:\Windows\System\XtXDUmd.exe
  C:\Windows\System\XtXDUmd.exe
  2⤵
  PID:1776
- C:\Windows\System\JfUsreh.exe
  C:\Windows\System\JfUsreh.exe
  2⤵
  PID:6808
- C:\Windows\System\CUOJfrA.exe
  C:\Windows\System\CUOJfrA.exe
  2⤵
  PID:5148
- C:\Windows\System\qmNGazc.exe
  C:\Windows\System\qmNGazc.exe
  2⤵
  PID:7004
- C:\Windows\System\BDAsjbE.exe
  C:\Windows\System\BDAsjbE.exe
  2⤵
  PID:6208
- C:\Windows\System\HFikCfQ.exe
  C:\Windows\System\HFikCfQ.exe
  2⤵
  PID:6288
- C:\Windows\System\SAZYdjb.exe
  C:\Windows\System\SAZYdjb.exe
  2⤵
  PID:5948
- C:\Windows\System\WIssjEr.exe
  C:\Windows\System\WIssjEr.exe
  2⤵
  PID:6532
- C:\Windows\System\efIlLHD.exe
  C:\Windows\System\efIlLHD.exe
  2⤵
  PID:7184
- C:\Windows\System\AetkIOx.exe
  C:\Windows\System\AetkIOx.exe
  2⤵
  PID:7232
- C:\Windows\System\wpLgbER.exe
  C:\Windows\System\wpLgbER.exe
  2⤵
  PID:7256
- C:\Windows\System\ayOweEg.exe
  C:\Windows\System\ayOweEg.exe
  2⤵
  PID:7296
- C:\Windows\System\ZCiCcOm.exe
  C:\Windows\System\ZCiCcOm.exe
  2⤵
  PID:7316
- C:\Windows\System\OmZclFw.exe
  C:\Windows\System\OmZclFw.exe
  2⤵
  PID:7340
- C:\Windows\System\DfAiyek.exe
  C:\Windows\System\DfAiyek.exe
  2⤵
  PID:7364
- C:\Windows\System\DIYmEJe.exe
  C:\Windows\System\DIYmEJe.exe
  2⤵
  PID:7384
- C:\Windows\System\xmdQKiR.exe
  C:\Windows\System\xmdQKiR.exe
  2⤵
  PID:7408
- C:\Windows\System\YdWAEkf.exe
  C:\Windows\System\YdWAEkf.exe
  2⤵
  PID:7432
- C:\Windows\System\myquMAN.exe
  C:\Windows\System\myquMAN.exe
  2⤵
  PID:7456
- C:\Windows\System\YJGkMep.exe
  C:\Windows\System\YJGkMep.exe
  2⤵
  PID:7480
- C:\Windows\System\entfeCG.exe
  C:\Windows\System\entfeCG.exe
  2⤵
  PID:7500
- C:\Windows\System\PZlFcwg.exe
  C:\Windows\System\PZlFcwg.exe
  2⤵
  PID:7524
- C:\Windows\System\uRoPGes.exe
  C:\Windows\System\uRoPGes.exe
  2⤵
  PID:7552
- C:\Windows\System\CfFCtKO.exe
  C:\Windows\System\CfFCtKO.exe
  2⤵
  PID:7572
- C:\Windows\System\CIQNSye.exe
  C:\Windows\System\CIQNSye.exe
  2⤵
  PID:7592
- C:\Windows\System\xvzcJVn.exe
  C:\Windows\System\xvzcJVn.exe
  2⤵
  PID:7620
- C:\Windows\System\nZepSrD.exe
  C:\Windows\System\nZepSrD.exe
  2⤵
  PID:7640
- C:\Windows\System\juBdQfL.exe
  C:\Windows\System\juBdQfL.exe
  2⤵
  PID:7664
- C:\Windows\System\OHYYvKC.exe
  C:\Windows\System\OHYYvKC.exe
  2⤵
  PID:7692
- C:\Windows\System\yCmKvzJ.exe
  C:\Windows\System\yCmKvzJ.exe
  2⤵
  PID:7708
- C:\Windows\System\kDPceFl.exe
  C:\Windows\System\kDPceFl.exe
  2⤵
  PID:7732
- C:\Windows\System\zOmIHYa.exe
  C:\Windows\System\zOmIHYa.exe
  2⤵
  PID:7756
- C:\Windows\System\cfnBIjI.exe
  C:\Windows\System\cfnBIjI.exe
  2⤵
  PID:7776
- C:\Windows\System\SIsLAmN.exe
  C:\Windows\System\SIsLAmN.exe
  2⤵
  PID:7792
- C:\Windows\System\CdBbKLi.exe
  C:\Windows\System\CdBbKLi.exe
  2⤵
  PID:7832
- C:\Windows\System\ELzooqe.exe
  C:\Windows\System\ELzooqe.exe
  2⤵
  PID:7868
- C:\Windows\System\ksvxowU.exe
  C:\Windows\System\ksvxowU.exe
  2⤵
  PID:7904
- C:\Windows\System\ojmRWMV.exe
  C:\Windows\System\ojmRWMV.exe
  2⤵
  PID:7920
- C:\Windows\System\FqYPmXu.exe
  C:\Windows\System\FqYPmXu.exe
  2⤵
  PID:7960
- C:\Windows\System\XgiGhcL.exe
  C:\Windows\System\XgiGhcL.exe
  2⤵
  PID:7984
- C:\Windows\System\uMZDoKa.exe
  C:\Windows\System\uMZDoKa.exe
  2⤵
  PID:8008
- C:\Windows\System\utkDtBI.exe
  C:\Windows\System\utkDtBI.exe
  2⤵
  PID:8032
- C:\Windows\System\cxgIfTh.exe
  C:\Windows\System\cxgIfTh.exe
  2⤵
  PID:8052
- C:\Windows\System\fQYpVoV.exe
  C:\Windows\System\fQYpVoV.exe
  2⤵
  PID:8076
- C:\Windows\System\QnZQZZO.exe
  C:\Windows\System\QnZQZZO.exe
  2⤵
  PID:8096
- C:\Windows\System\tZQcQNP.exe
  C:\Windows\System\tZQcQNP.exe
  2⤵
  PID:8124
- C:\Windows\System\NnNDmAc.exe
  C:\Windows\System\NnNDmAc.exe
  2⤵
  PID:8152
- C:\Windows\System\NrPmJCo.exe
  C:\Windows\System\NrPmJCo.exe
  2⤵
  PID:8176
- C:\Windows\System\oNHSMyq.exe
  C:\Windows\System\oNHSMyq.exe
  2⤵
  PID:7012
- C:\Windows\System\wSwEwIq.exe
  C:\Windows\System\wSwEwIq.exe
  2⤵
  PID:6892
- C:\Windows\System\dvzpACL.exe
  C:\Windows\System\dvzpACL.exe
  2⤵
  PID:6980
- C:\Windows\System\mnQReJc.exe
  C:\Windows\System\mnQReJc.exe
  2⤵
  PID:5516
- C:\Windows\System\uDLwglm.exe
  C:\Windows\System\uDLwglm.exe
  2⤵
  PID:3876
- C:\Windows\System\sGRYjyi.exe
  C:\Windows\System\sGRYjyi.exe
  2⤵
  PID:2844
- C:\Windows\System\byKpAGO.exe
  C:\Windows\System\byKpAGO.exe
  2⤵
  PID:548
- C:\Windows\System\vBsbdHT.exe
  C:\Windows\System\vBsbdHT.exe
  2⤵
  PID:1452
- C:\Windows\System\bDyYHGD.exe
  C:\Windows\System\bDyYHGD.exe
  2⤵
  PID:6788
- C:\Windows\System\RDKCUpD.exe
  C:\Windows\System\RDKCUpD.exe
  2⤵
  PID:7324
- C:\Windows\System\dBwgjvp.exe
  C:\Windows\System\dBwgjvp.exe
  2⤵
  PID:7404
- C:\Windows\System\DJNJdqf.exe
  C:\Windows\System\DJNJdqf.exe
  2⤵
  PID:7452
- C:\Windows\System\gnvdKek.exe
  C:\Windows\System\gnvdKek.exe
  2⤵
  PID:7568
- C:\Windows\System\yeZKjDR.exe
  C:\Windows\System\yeZKjDR.exe
  2⤵
  PID:5636
- C:\Windows\System\kMzbHEV.exe
  C:\Windows\System\kMzbHEV.exe
  2⤵
  PID:2788
- C:\Windows\System\stppeDq.exe
  C:\Windows\System\stppeDq.exe
  2⤵
  PID:7684
- C:\Windows\System\cpBWTZY.exe
  C:\Windows\System\cpBWTZY.exe
  2⤵
  PID:7788
- C:\Windows\System\PTwyzHm.exe
  C:\Windows\System\PTwyzHm.exe
  2⤵
  PID:7280
- C:\Windows\System\aPsdJko.exe
  C:\Windows\System\aPsdJko.exe
  2⤵
  PID:7844
- C:\Windows\System\quQseQy.exe
  C:\Windows\System\quQseQy.exe
  2⤵
  PID:7916
- C:\Windows\System\JKPBmUH.exe
  C:\Windows\System\JKPBmUH.exe
  2⤵
  PID:7952
- C:\Windows\System\OMJLOjJ.exe
  C:\Windows\System\OMJLOjJ.exe
  2⤵
  PID:8000
- C:\Windows\System\syyWOFV.exe
  C:\Windows\System\syyWOFV.exe
  2⤵
  PID:8024
- C:\Windows\System\nDsVHdl.exe
  C:\Windows\System\nDsVHdl.exe
  2⤵
  PID:8196
- C:\Windows\System\IRIbaix.exe
  C:\Windows\System\IRIbaix.exe
  2⤵
  PID:8224
- C:\Windows\System\ZzPwiax.exe
  C:\Windows\System\ZzPwiax.exe
  2⤵
  PID:8244
- C:\Windows\System\tDfDWvZ.exe
  C:\Windows\System\tDfDWvZ.exe
  2⤵
  PID:8264
- C:\Windows\System\MnYknlX.exe
  C:\Windows\System\MnYknlX.exe
  2⤵
  PID:8288
- C:\Windows\System\EQMIVJE.exe
  C:\Windows\System\EQMIVJE.exe
  2⤵
  PID:8324
- C:\Windows\System\XrgCpJx.exe
  C:\Windows\System\XrgCpJx.exe
  2⤵
  PID:8340
- C:\Windows\System\ZnsxaMJ.exe
  C:\Windows\System\ZnsxaMJ.exe
  2⤵
  PID:8364
- C:\Windows\System\QFWvOGM.exe
  C:\Windows\System\QFWvOGM.exe
  2⤵
  PID:8380
- C:\Windows\System\NCoMehz.exe
  C:\Windows\System\NCoMehz.exe
  2⤵
  PID:8408
- C:\Windows\System\vFWexBj.exe
  C:\Windows\System\vFWexBj.exe
  2⤵
  PID:8428
- C:\Windows\System\JmqjICu.exe
  C:\Windows\System\JmqjICu.exe
  2⤵
  PID:8460
- C:\Windows\System\DJnTCob.exe
  C:\Windows\System\DJnTCob.exe
  2⤵
  PID:8488
- C:\Windows\System\biHhhon.exe
  C:\Windows\System\biHhhon.exe
  2⤵
  PID:8504
- C:\Windows\System\ckidZQR.exe
  C:\Windows\System\ckidZQR.exe
  2⤵
  PID:8528
- C:\Windows\System\aTIerpj.exe
  C:\Windows\System\aTIerpj.exe
  2⤵
  PID:8548
- C:\Windows\System\cJfvDnN.exe
  C:\Windows\System\cJfvDnN.exe
  2⤵
  PID:8572
- C:\Windows\System\mJkuMJm.exe
  C:\Windows\System\mJkuMJm.exe
  2⤵
  PID:8600
- C:\Windows\System\sFCUcXb.exe
  C:\Windows\System\sFCUcXb.exe
  2⤵
  PID:8628
- C:\Windows\System\NAuLMXS.exe
  C:\Windows\System\NAuLMXS.exe
  2⤵
  PID:8664
- C:\Windows\System\QPkueoJ.exe
  C:\Windows\System\QPkueoJ.exe
  2⤵
  PID:8684
- C:\Windows\System\ddbmDxm.exe
  C:\Windows\System\ddbmDxm.exe
  2⤵
  PID:8704
- C:\Windows\System\vHrhqAq.exe
  C:\Windows\System\vHrhqAq.exe
  2⤵
  PID:8732
- C:\Windows\System\IwfpWxl.exe
  C:\Windows\System\IwfpWxl.exe
  2⤵
  PID:8752
- C:\Windows\System\HZpFGLA.exe
  C:\Windows\System\HZpFGLA.exe
  2⤵
  PID:8780
- C:\Windows\System\RQpgfYg.exe
  C:\Windows\System\RQpgfYg.exe
  2⤵
  PID:8800
- C:\Windows\System\tSCBGjl.exe
  C:\Windows\System\tSCBGjl.exe
  2⤵
  PID:8828
- C:\Windows\System\PIJUige.exe
  C:\Windows\System\PIJUige.exe
  2⤵
  PID:8848
- C:\Windows\System\dKIPGoX.exe
  C:\Windows\System\dKIPGoX.exe
  2⤵
  PID:8872
- C:\Windows\System\oVPKMtd.exe
  C:\Windows\System\oVPKMtd.exe
  2⤵
  PID:8892
- C:\Windows\System\mPNgeKT.exe
  C:\Windows\System\mPNgeKT.exe
  2⤵
  PID:8916
- C:\Windows\System\AiPqpAB.exe
  C:\Windows\System\AiPqpAB.exe
  2⤵
  PID:8944
- C:\Windows\System\nvtxkzB.exe
  C:\Windows\System\nvtxkzB.exe
  2⤵
  PID:8964
- C:\Windows\System\xeLbAOn.exe
  C:\Windows\System\xeLbAOn.exe
  2⤵
  PID:8992
- C:\Windows\System\NiVPTzd.exe
  C:\Windows\System\NiVPTzd.exe
  2⤵
  PID:9012
- C:\Windows\System\dtxfaIm.exe
  C:\Windows\System\dtxfaIm.exe
  2⤵
  PID:9032
- C:\Windows\System\pKagLjd.exe
  C:\Windows\System\pKagLjd.exe
  2⤵
  PID:9056
- C:\Windows\System\NFlCFVA.exe
  C:\Windows\System\NFlCFVA.exe
  2⤵
  PID:9084
- C:\Windows\System\QgpzQFj.exe
  C:\Windows\System\QgpzQFj.exe
  2⤵
  PID:9108
- C:\Windows\System\hjrIaoJ.exe
  C:\Windows\System\hjrIaoJ.exe
  2⤵
  PID:9132
- C:\Windows\System\OGyYBak.exe
  C:\Windows\System\OGyYBak.exe
  2⤵
  PID:9152
- C:\Windows\System\YCqaIwq.exe
  C:\Windows\System\YCqaIwq.exe
  2⤵
  PID:9172
- C:\Windows\System\EtxbiJA.exe
  C:\Windows\System\EtxbiJA.exe
  2⤵
  PID:9196
- C:\Windows\System\eGxcfpL.exe
  C:\Windows\System\eGxcfpL.exe
  2⤵
  PID:8148
- C:\Windows\System\XqTauUa.exe
  C:\Windows\System\XqTauUa.exe
  2⤵
  PID:7216
- C:\Windows\System\zEymMWp.exe
  C:\Windows\System\zEymMWp.exe
  2⤵
  PID:7744
- C:\Windows\System\lKCMFYc.exe
  C:\Windows\System\lKCMFYc.exe
  2⤵
  PID:7784
- C:\Windows\System\zaHSvwo.exe
  C:\Windows\System\zaHSvwo.exe
  2⤵
  PID:7176
- C:\Windows\System\XQJPflO.exe
  C:\Windows\System\XQJPflO.exe
  2⤵
  PID:7880
- C:\Windows\System\BYskwVa.exe
  C:\Windows\System\BYskwVa.exe
  2⤵
  PID:7968
- C:\Windows\System\uNLsecb.exe
  C:\Windows\System\uNLsecb.exe
  2⤵
  PID:7400
- C:\Windows\System\uGwulik.exe
  C:\Windows\System\uGwulik.exe
  2⤵
  PID:7636
- C:\Windows\System\DfwyEFi.exe
  C:\Windows\System\DfwyEFi.exe
  2⤵
  PID:7492
- C:\Windows\System\hQBTpyv.exe
  C:\Windows\System\hQBTpyv.exe
  2⤵
  PID:7912
- C:\Windows\System\QqIXlsG.exe
  C:\Windows\System\QqIXlsG.exe
  2⤵
  PID:7428
- C:\Windows\System\bmOzjZp.exe
  C:\Windows\System\bmOzjZp.exe
  2⤵
  PID:8116
- C:\Windows\System\ImeHDWt.exe
  C:\Windows\System\ImeHDWt.exe
  2⤵
  PID:8168
- C:\Windows\System\tUnQSEp.exe
  C:\Windows\System\tUnQSEp.exe
  2⤵
  PID:8236
- C:\Windows\System\usCYXqo.exe
  C:\Windows\System\usCYXqo.exe
  2⤵
  PID:8260
- C:\Windows\System\EpigoZT.exe
  C:\Windows\System\EpigoZT.exe
  2⤵
  PID:8312
- C:\Windows\System\JjDGSdW.exe
  C:\Windows\System\JjDGSdW.exe
  2⤵
  PID:7724
- C:\Windows\System\hlYCcMP.exe
  C:\Windows\System\hlYCcMP.exe
  2⤵
  PID:5888
- C:\Windows\System\YdJFfkY.exe
  C:\Windows\System\YdJFfkY.exe
  2⤵
  PID:7272
- C:\Windows\System\kNtmjaO.exe
  C:\Windows\System\kNtmjaO.exe
  2⤵
  PID:8484
- C:\Windows\System\pPxjRVb.exe
  C:\Windows\System\pPxjRVb.exe
  2⤵
  PID:7088
- C:\Windows\System\CaAMZuY.exe
  C:\Windows\System\CaAMZuY.exe
  2⤵
  PID:8556
- C:\Windows\System\LtnnXEi.exe
  C:\Windows\System\LtnnXEi.exe
  2⤵
  PID:8592
- C:\Windows\System\dYsdZOE.exe
  C:\Windows\System\dYsdZOE.exe
  2⤵
  PID:3452
- C:\Windows\System\RiKPZeP.exe
  C:\Windows\System\RiKPZeP.exe
  2⤵
  PID:7720
- C:\Windows\System\rTvMdKe.exe
  C:\Windows\System\rTvMdKe.exe
  2⤵
  PID:8792
- C:\Windows\System\jGnmYlB.exe
  C:\Windows\System\jGnmYlB.exe
  2⤵
  PID:8836
- C:\Windows\System\MrmRxEa.exe
  C:\Windows\System\MrmRxEa.exe
  2⤵
  PID:8980
- C:\Windows\System\dbiFHWG.exe
  C:\Windows\System\dbiFHWG.exe
  2⤵
  PID:8104
- C:\Windows\System\NtoAqVv.exe
  C:\Windows\System\NtoAqVv.exe
  2⤵
  PID:9040
- C:\Windows\System\EecrgWH.exe
  C:\Windows\System\EecrgWH.exe
  2⤵
  PID:9220
- C:\Windows\System\nhOUJdG.exe
  C:\Windows\System\nhOUJdG.exe
  2⤵
  PID:9236
- C:\Windows\System\OTUbojE.exe
  C:\Windows\System\OTUbojE.exe
  2⤵
  PID:9260
- C:\Windows\System\hCIwqMp.exe
  C:\Windows\System\hCIwqMp.exe
  2⤵
  PID:9292
- C:\Windows\System\lFztDNj.exe
  C:\Windows\System\lFztDNj.exe
  2⤵
  PID:9312
- C:\Windows\System\fSPLHOL.exe
  C:\Windows\System\fSPLHOL.exe
  2⤵
  PID:9336
- C:\Windows\System\KITpAeQ.exe
  C:\Windows\System\KITpAeQ.exe
  2⤵
  PID:9368
- C:\Windows\System\NtUYoYs.exe
  C:\Windows\System\NtUYoYs.exe
  2⤵
  PID:9388
- C:\Windows\System\YbKUuDf.exe
  C:\Windows\System\YbKUuDf.exe
  2⤵
  PID:9408
- C:\Windows\System\GTCUDIW.exe
  C:\Windows\System\GTCUDIW.exe
  2⤵
  PID:9432
- C:\Windows\System\MGoOhtd.exe
  C:\Windows\System\MGoOhtd.exe
  2⤵
  PID:9452
- C:\Windows\System\saRjtSh.exe
  C:\Windows\System\saRjtSh.exe
  2⤵
  PID:9472
- C:\Windows\System\qvYvjmj.exe
  C:\Windows\System\qvYvjmj.exe
  2⤵
  PID:9496
- C:\Windows\System\lpGwGnJ.exe
  C:\Windows\System\lpGwGnJ.exe
  2⤵
  PID:9516
- C:\Windows\System\QMrXlxa.exe
  C:\Windows\System\QMrXlxa.exe
  2⤵
  PID:9540
- C:\Windows\System\dFoTjei.exe
  C:\Windows\System\dFoTjei.exe
  2⤵
  PID:9560
- C:\Windows\System\MdNRfFJ.exe
  C:\Windows\System\MdNRfFJ.exe
  2⤵
  PID:9588
- C:\Windows\System\ExBkvWU.exe
  C:\Windows\System\ExBkvWU.exe
  2⤵
  PID:9608
- C:\Windows\System\hLhPpJe.exe
  C:\Windows\System\hLhPpJe.exe
  2⤵
  PID:9632
- C:\Windows\System\FzGVcFP.exe
  C:\Windows\System\FzGVcFP.exe
  2⤵
  PID:9652
- C:\Windows\System\nmBWrls.exe
  C:\Windows\System\nmBWrls.exe
  2⤵
  PID:9672
- C:\Windows\System\IPjybgU.exe
  C:\Windows\System\IPjybgU.exe
  2⤵
  PID:9696
- C:\Windows\System\ETBSenT.exe
  C:\Windows\System\ETBSenT.exe
  2⤵
  PID:10104
- C:\Windows\System\sCVCuSy.exe
  C:\Windows\System\sCVCuSy.exe
  2⤵
  PID:10128
- C:\Windows\System\loUwzWd.exe
  C:\Windows\System\loUwzWd.exe
  2⤵
  PID:10152
- C:\Windows\System\dniVupm.exe
  C:\Windows\System\dniVupm.exe
  2⤵
  PID:10176
- C:\Windows\System\aPoYxTi.exe
  C:\Windows\System\aPoYxTi.exe
  2⤵
  PID:10204
- C:\Windows\System\rJkEVcz.exe
  C:\Windows\System\rJkEVcz.exe
  2⤵
  PID:10232
- C:\Windows\System\BXqiAmO.exe
  C:\Windows\System\BXqiAmO.exe
  2⤵
  PID:9128
- C:\Windows\System\jUkPYeW.exe
  C:\Windows\System\jUkPYeW.exe
  2⤵
  PID:8420
- C:\Windows\System\pmXPblQ.exe
  C:\Windows\System\pmXPblQ.exe
  2⤵
  PID:6836
- C:\Windows\System\jHtBNSj.exe
  C:\Windows\System\jHtBNSj.exe
  2⤵
  PID:7512
- C:\Windows\System\xEswTwu.exe
  C:\Windows\System\xEswTwu.exe
  2⤵
  PID:7440
- C:\Windows\System\yULzukp.exe
  C:\Windows\System\yULzukp.exe
  2⤵
  PID:7816
- C:\Windows\System\DkiIbSZ.exe
  C:\Windows\System\DkiIbSZ.exe
  2⤵
  PID:7356
- C:\Windows\System\emoSLGd.exe
  C:\Windows\System\emoSLGd.exe
  2⤵
  PID:9420
- C:\Windows\System\ZcjHvPz.exe
  C:\Windows\System\ZcjHvPz.exe
  2⤵
  PID:9616
- C:\Windows\System\dczsoNJ.exe
  C:\Windows\System\dczsoNJ.exe
  2⤵
  PID:8624
- C:\Windows\System\IrIALRe.exe
  C:\Windows\System\IrIALRe.exe
  2⤵
  PID:8728
- C:\Windows\System\KDOnKZv.exe
  C:\Windows\System\KDOnKZv.exe
  2⤵
  PID:8376
- C:\Windows\System\xITYQlv.exe
  C:\Windows\System\xITYQlv.exe
  2⤵
  PID:7488
- C:\Windows\System\nSETEeS.exe
  C:\Windows\System\nSETEeS.exe
  2⤵
  PID:9908
- C:\Windows\System\uPfmzVH.exe
  C:\Windows\System\uPfmzVH.exe
  2⤵
  PID:9168
- C:\Windows\System\vvOSrxz.exe
  C:\Windows\System\vvOSrxz.exe
  2⤵
  PID:9328
- C:\Windows\System\ZZXTMSB.exe
  C:\Windows\System\ZZXTMSB.exe
  2⤵
  PID:8112
- C:\Windows\System\TgTsiZK.exe
  C:\Windows\System\TgTsiZK.exe
  2⤵
  PID:3428
- C:\Windows\System\qsQlknd.exe
  C:\Windows\System\qsQlknd.exe
  2⤵
  PID:9552
- C:\Windows\System\BqCHeMT.exe
  C:\Windows\System\BqCHeMT.exe
  2⤵
  PID:10068
- C:\Windows\System\jxHFaUn.exe
  C:\Windows\System\jxHFaUn.exe
  2⤵
  PID:10168
- C:\Windows\System\uZRSfwc.exe
  C:\Windows\System\uZRSfwc.exe
  2⤵
  PID:8280
- C:\Windows\System\DwKHzwo.exe
  C:\Windows\System\DwKHzwo.exe
  2⤵
  PID:8136
- C:\Windows\System\bdTmJPK.exe
  C:\Windows\System\bdTmJPK.exe
  2⤵
  PID:9812
- C:\Windows\System\EZGDwVx.exe
  C:\Windows\System\EZGDwVx.exe
  2⤵
  PID:8588
- C:\Windows\System\wArvqiw.exe
  C:\Windows\System\wArvqiw.exe
  2⤵
  PID:7288
- C:\Windows\System\gbJSqzx.exe
  C:\Windows\System\gbJSqzx.exe
  2⤵
  PID:10248
- C:\Windows\System\KCEpBjq.exe
  C:\Windows\System\KCEpBjq.exe
  2⤵
  PID:10272
- C:\Windows\System\tLNXYtH.exe
  C:\Windows\System\tLNXYtH.exe
  2⤵
  PID:10312
- C:\Windows\System\MvtAydV.exe
  C:\Windows\System\MvtAydV.exe
  2⤵
  PID:10352
- C:\Windows\System\uUVqkkW.exe
  C:\Windows\System\uUVqkkW.exe
  2⤵
  PID:10376
- C:\Windows\System\sKYikLp.exe
  C:\Windows\System\sKYikLp.exe
  2⤵
  PID:10392
- C:\Windows\System\mTeXPmm.exe
  C:\Windows\System\mTeXPmm.exe
  2⤵
  PID:10420
- C:\Windows\System\wNKDPUb.exe
  C:\Windows\System\wNKDPUb.exe
  2⤵
  PID:10456
- C:\Windows\System\YZMlnwk.exe
  C:\Windows\System\YZMlnwk.exe
  2⤵
  PID:10480
- C:\Windows\System\ALbfQBZ.exe
  C:\Windows\System\ALbfQBZ.exe
  2⤵
  PID:10500
- C:\Windows\System\pTcZrQD.exe
  C:\Windows\System\pTcZrQD.exe
  2⤵
  PID:10520
- C:\Windows\System\RabdHYX.exe
  C:\Windows\System\RabdHYX.exe
  2⤵
  PID:10548
- C:\Windows\System\koVlwCS.exe
  C:\Windows\System\koVlwCS.exe
  2⤵
  PID:10580
- C:\Windows\System\AqzhPUi.exe
  C:\Windows\System\AqzhPUi.exe
  2⤵
  PID:10608
- C:\Windows\System\oNwYaKw.exe
  C:\Windows\System\oNwYaKw.exe
  2⤵
  PID:10636
- C:\Windows\System\tikWqai.exe
  C:\Windows\System\tikWqai.exe
  2⤵
  PID:10656
- C:\Windows\System\iAmCIbP.exe
  C:\Windows\System\iAmCIbP.exe
  2⤵
  PID:10676
- C:\Windows\System\HncZkck.exe
  C:\Windows\System\HncZkck.exe
  2⤵
  PID:10700
- C:\Windows\System\dvVTver.exe
  C:\Windows\System\dvVTver.exe
  2⤵
  PID:10736
- C:\Windows\System\qgyejWY.exe
  C:\Windows\System\qgyejWY.exe
  2⤵
  PID:10756
- C:\Windows\System\bzLexLb.exe
  C:\Windows\System\bzLexLb.exe
  2⤵
  PID:10784
- C:\Windows\System\tBNBbuJ.exe
  C:\Windows\System\tBNBbuJ.exe
  2⤵
  PID:10804
- C:\Windows\System\phJGwgR.exe
  C:\Windows\System\phJGwgR.exe
  2⤵
  PID:10824
- C:\Windows\System\oMeQpwe.exe
  C:\Windows\System\oMeQpwe.exe
  2⤵
  PID:10844
- C:\Windows\System\uFvuHiI.exe
  C:\Windows\System\uFvuHiI.exe
  2⤵
  PID:10860
- C:\Windows\System\ZkuNYEu.exe
  C:\Windows\System\ZkuNYEu.exe
  2⤵
  PID:10884
- C:\Windows\System\VpbuDrt.exe
  C:\Windows\System\VpbuDrt.exe
  2⤵
  PID:10900
- C:\Windows\System\LtpBtlv.exe
  C:\Windows\System\LtpBtlv.exe
  2⤵
  PID:10916
- C:\Windows\System\FLWKZkL.exe
  C:\Windows\System\FLWKZkL.exe
  2⤵
  PID:10932
- C:\Windows\System\bdCVWrw.exe
  C:\Windows\System\bdCVWrw.exe
  2⤵
  PID:10948
- C:\Windows\System\rXigyMG.exe
  C:\Windows\System\rXigyMG.exe
  2⤵
  PID:10968
- C:\Windows\System\BtBJIXM.exe
  C:\Windows\System\BtBJIXM.exe
  2⤵
  PID:10984
- C:\Windows\System\iEkEvvJ.exe
  C:\Windows\System\iEkEvvJ.exe
  2⤵
  PID:11004
- C:\Windows\System\fxwZlDj.exe
  C:\Windows\System\fxwZlDj.exe
  2⤵
  PID:11028
- C:\Windows\System\jqCzPJe.exe
  C:\Windows\System\jqCzPJe.exe
  2⤵
  PID:11048
- C:\Windows\System\QQvgXTU.exe
  C:\Windows\System\QQvgXTU.exe
  2⤵
  PID:11068
- C:\Windows\System\BSnbALW.exe
  C:\Windows\System\BSnbALW.exe
  2⤵
  PID:11088
- C:\Windows\System\WwcUAOJ.exe
  C:\Windows\System\WwcUAOJ.exe
  2⤵
  PID:11112
- C:\Windows\System\VUzIaXH.exe
  C:\Windows\System\VUzIaXH.exe
  2⤵
  PID:11140
- C:\Windows\System\OyLgufn.exe
  C:\Windows\System\OyLgufn.exe
  2⤵
  PID:11168
- C:\Windows\System\QLHYhKw.exe
  C:\Windows\System\QLHYhKw.exe
  2⤵
  PID:11184
- C:\Windows\System\OVJEnUu.exe
  C:\Windows\System\OVJEnUu.exe
  2⤵
  PID:11208
- C:\Windows\System\fQRjTCg.exe
  C:\Windows\System\fQRjTCg.exe
  2⤵
  PID:11240
- C:\Windows\System\ZdlJPXm.exe
  C:\Windows\System\ZdlJPXm.exe
  2⤵
  PID:9052
- C:\Windows\System\bcdEaGz.exe
  C:\Windows\System\bcdEaGz.exe
  2⤵
  PID:9232
- C:\Windows\System\qBYMmRY.exe
  C:\Windows\System\qBYMmRY.exe
  2⤵
  PID:10016
- C:\Windows\System\YhQSvPt.exe
  C:\Windows\System\YhQSvPt.exe
  2⤵
  PID:9448
- C:\Windows\System\jBJTNof.exe
  C:\Windows\System\jBJTNof.exe
  2⤵
  PID:9512
- C:\Windows\System\bXhLXYt.exe
  C:\Windows\System\bXhLXYt.exe
  2⤵
  PID:8644
- C:\Windows\System\OpImBpX.exe
  C:\Windows\System\OpImBpX.exe
  2⤵
  PID:9708
- C:\Windows\System\UYUJJRr.exe
  C:\Windows\System\UYUJJRr.exe
  2⤵
  PID:8608
- C:\Windows\System\PlUEFeJ.exe
  C:\Windows\System\PlUEFeJ.exe
  2⤵
  PID:8880
- C:\Windows\System\ZGracBK.exe
  C:\Windows\System\ZGracBK.exe
  2⤵
  PID:10200
- C:\Windows\System\XyNjNuf.exe
  C:\Windows\System\XyNjNuf.exe
  2⤵
  PID:9204
- C:\Windows\System\KPrzIwu.exe
  C:\Windows\System\KPrzIwu.exe
  2⤵
  PID:7016
- C:\Windows\System\MGfPpXq.exe
  C:\Windows\System\MGfPpXq.exe
  2⤵
  PID:9788
- C:\Windows\System\kSVyHnd.exe
  C:\Windows\System\kSVyHnd.exe
  2⤵
  PID:10116
- C:\Windows\System\sWMBcdg.exe
  C:\Windows\System\sWMBcdg.exe
  2⤵
  PID:9868
- C:\Windows\System\ADaTgpF.exe
  C:\Windows\System\ADaTgpF.exe
  2⤵
  PID:9916
- C:\Windows\System\TkfAgyL.exe
  C:\Windows\System\TkfAgyL.exe
  2⤵
  PID:9964
- C:\Windows\System\MbWLmKg.exe
  C:\Windows\System\MbWLmKg.exe
  2⤵
  PID:10368
- C:\Windows\System\mqZbNch.exe
  C:\Windows\System\mqZbNch.exe
  2⤵
  PID:10508
- C:\Windows\System\YcuxHXB.exe
  C:\Windows\System\YcuxHXB.exe
  2⤵
  PID:8396
- C:\Windows\System\mkyaFTx.exe
  C:\Windows\System\mkyaFTx.exe
  2⤵
  PID:10648
- C:\Windows\System\JgKcXYk.exe
  C:\Windows\System\JgKcXYk.exe
  2⤵
  PID:10716
- C:\Windows\System\SUQySkq.exe
  C:\Windows\System\SUQySkq.exe
  2⤵
  PID:11280
- C:\Windows\System\ViesPlM.exe
  C:\Windows\System\ViesPlM.exe
  2⤵
  PID:11300
- C:\Windows\System\DZnZjtc.exe
  C:\Windows\System\DZnZjtc.exe
  2⤵
  PID:11328
- C:\Windows\System\tZnVjHb.exe
  C:\Windows\System\tZnVjHb.exe
  2⤵
  PID:11352
- C:\Windows\System\iigJHpI.exe
  C:\Windows\System\iigJHpI.exe
  2⤵
  PID:11376
- C:\Windows\System\kgazrIu.exe
  C:\Windows\System\kgazrIu.exe
  2⤵
  PID:11408
- C:\Windows\System\FWIKYWR.exe
  C:\Windows\System\FWIKYWR.exe
  2⤵
  PID:11428
- C:\Windows\System\YsgbCEO.exe
  C:\Windows\System\YsgbCEO.exe
  2⤵
  PID:11444
- C:\Windows\System\qfCSzae.exe
  C:\Windows\System\qfCSzae.exe
  2⤵
  PID:11464
- C:\Windows\System\YVmcdaQ.exe
  C:\Windows\System\YVmcdaQ.exe
  2⤵
  PID:11488
- C:\Windows\System\dRzZOUC.exe
  C:\Windows\System\dRzZOUC.exe
  2⤵
  PID:11508
- C:\Windows\System\JkKcRyT.exe
  C:\Windows\System\JkKcRyT.exe
  2⤵
  PID:11528
- C:\Windows\System\cDEATmb.exe
  C:\Windows\System\cDEATmb.exe
  2⤵
  PID:11548
- C:\Windows\System\rTWzycz.exe
  C:\Windows\System\rTWzycz.exe
  2⤵
  PID:11568
- C:\Windows\System\AmfPpVy.exe
  C:\Windows\System\AmfPpVy.exe
  2⤵
  PID:11596
- C:\Windows\System\rwqDgcX.exe
  C:\Windows\System\rwqDgcX.exe
  2⤵
  PID:11620
- C:\Windows\System\BgsVmoX.exe
  C:\Windows\System\BgsVmoX.exe
  2⤵
  PID:11644
- C:\Windows\System\nTqXIbr.exe
  C:\Windows\System\nTqXIbr.exe
  2⤵
  PID:11668
- C:\Windows\System\tsuKQsF.exe
  C:\Windows\System\tsuKQsF.exe
  2⤵
  PID:11684
- C:\Windows\System\hUjWjiE.exe
  C:\Windows\System\hUjWjiE.exe
  2⤵
  PID:11700
- C:\Windows\System\fAPgkBR.exe
  C:\Windows\System\fAPgkBR.exe
  2⤵
  PID:11716
- C:\Windows\System\DejojiR.exe
  C:\Windows\System\DejojiR.exe
  2⤵
  PID:11732
- C:\Windows\System\HzZCDQm.exe
  C:\Windows\System\HzZCDQm.exe
  2⤵
  PID:11748
- C:\Windows\System\tisjEGC.exe
  C:\Windows\System\tisjEGC.exe
  2⤵
  PID:11768
- C:\Windows\System\vdtzqfg.exe
  C:\Windows\System\vdtzqfg.exe
  2⤵
  PID:11784
- C:\Windows\System\jRXdjLF.exe
  C:\Windows\System\jRXdjLF.exe
  2⤵
  PID:11804
- C:\Windows\System\xnWpJwR.exe
  C:\Windows\System\xnWpJwR.exe
  2⤵
  PID:11824
- C:\Windows\System\YpUsGTv.exe
  C:\Windows\System\YpUsGTv.exe
  2⤵
  PID:11848
- C:\Windows\System\vgQHcTK.exe
  C:\Windows\System\vgQHcTK.exe
  2⤵
  PID:11872
- C:\Windows\System\fzuatou.exe
  C:\Windows\System\fzuatou.exe
  2⤵
  PID:11892
- C:\Windows\System\TfGMMAU.exe
  C:\Windows\System\TfGMMAU.exe
  2⤵
  PID:11912
- C:\Windows\System\BNFRntY.exe
  C:\Windows\System\BNFRntY.exe
  2⤵
  PID:11928
- C:\Windows\System\gnmABdC.exe
  C:\Windows\System\gnmABdC.exe
  2⤵
  PID:11952
- C:\Windows\System\tFJrzeL.exe
  C:\Windows\System\tFJrzeL.exe
  2⤵
  PID:11980
- C:\Windows\System\arANOpo.exe
  C:\Windows\System\arANOpo.exe
  2⤵
  PID:12004
- C:\Windows\System\UklWZwk.exe
  C:\Windows\System\UklWZwk.exe
  2⤵
  PID:12024
- C:\Windows\System\XVbOhOs.exe
  C:\Windows\System\XVbOhOs.exe
  2⤵
  PID:12044
- C:\Windows\System\lzpqFNd.exe
  C:\Windows\System\lzpqFNd.exe
  2⤵
  PID:12064
- C:\Windows\System\FosOfOl.exe
  C:\Windows\System\FosOfOl.exe
  2⤵
  PID:12084
- C:\Windows\System\tsMmmqE.exe
  C:\Windows\System\tsMmmqE.exe
  2⤵
  PID:12108
- C:\Windows\System\rncPjUo.exe
  C:\Windows\System\rncPjUo.exe
  2⤵
  PID:12132
- C:\Windows\System\DAkUDHu.exe
  C:\Windows\System\DAkUDHu.exe
  2⤵
  PID:12156
- C:\Windows\System\PgordwM.exe
  C:\Windows\System\PgordwM.exe
  2⤵
  PID:12176
- C:\Windows\System\lThdJaf.exe
  C:\Windows\System\lThdJaf.exe
  2⤵
  PID:12200
- C:\Windows\System\KUyTneg.exe
  C:\Windows\System\KUyTneg.exe
  2⤵
  PID:12220
- C:\Windows\System\KBJxQzZ.exe
  C:\Windows\System\KBJxQzZ.exe
  2⤵
  PID:12252
- C:\Windows\System\fgFslGg.exe
  C:\Windows\System\fgFslGg.exe
  2⤵
  PID:12276
- C:\Windows\System\eDgzOis.exe
  C:\Windows\System\eDgzOis.exe
  2⤵
  PID:10856
- C:\Windows\System\pxfsmJk.exe
  C:\Windows\System\pxfsmJk.exe
  2⤵
  PID:10940
- C:\Windows\System\lYkkwcL.exe
  C:\Windows\System\lYkkwcL.exe
  2⤵
  PID:7292
- C:\Windows\System\tKJhfqr.exe
  C:\Windows\System\tKJhfqr.exe
  2⤵
  PID:6928
- C:\Windows\System\yYziSaI.exe
  C:\Windows\System\yYziSaI.exe
  2⤵
  PID:6184
- C:\Windows\System\DVKJpab.exe
  C:\Windows\System\DVKJpab.exe
  2⤵
  PID:11176
- C:\Windows\System\pXCbRDC.exe
  C:\Windows\System\pXCbRDC.exe
  2⤵
  PID:7848
- C:\Windows\System\yOMQmIG.exe
  C:\Windows\System\yOMQmIG.exe
  2⤵
  PID:6624
- C:\Windows\System\YSgUyWy.exe
  C:\Windows\System\YSgUyWy.exe
  2⤵
  PID:8864
- C:\Windows\System\SZnyfTn.exe
  C:\Windows\System\SZnyfTn.exe
  2⤵
  PID:10384
- C:\Windows\System\feLXxkb.exe
  C:\Windows\System\feLXxkb.exe
  2⤵
  PID:10448
- C:\Windows\System\jeCeymg.exe
  C:\Windows\System\jeCeymg.exe
  2⤵
  PID:10144
- C:\Windows\System\QxBQSyv.exe
  C:\Windows\System\QxBQSyv.exe
  2⤵
  PID:10224
- C:\Windows\System\KrIOMIt.exe
  C:\Windows\System\KrIOMIt.exe
  2⤵
  PID:4280
- C:\Windows\System\rtyTHRO.exe
  C:\Windows\System\rtyTHRO.exe
  2⤵
  PID:10624
- C:\Windows\System\xdAvKYb.exe
  C:\Windows\System\xdAvKYb.exe
  2⤵
  PID:7264
- C:\Windows\System\Xqyfjvi.exe
  C:\Windows\System\Xqyfjvi.exe
  2⤵
  PID:10684
- C:\Windows\System\JGZOtOI.exe
  C:\Windows\System\JGZOtOI.exe
  2⤵
  PID:4596
- C:\Windows\System\CpMMWEt.exe
  C:\Windows\System\CpMMWEt.exe
  2⤵
  PID:11312
- C:\Windows\System\sysvqyV.exe
  C:\Windows\System\sysvqyV.exe
  2⤵
  PID:10752
- C:\Windows\System\jQqktWe.exe
  C:\Windows\System\jQqktWe.exe
  2⤵
  PID:11384
- C:\Windows\System\JLFpEvT.exe
  C:\Windows\System\JLFpEvT.exe
  2⤵
  PID:11456
- C:\Windows\System\lTBvkWw.exe
  C:\Windows\System\lTBvkWw.exe
  2⤵
  PID:11480
- C:\Windows\System\PZwzFXC.exe
  C:\Windows\System\PZwzFXC.exe
  2⤵
  PID:7828
- C:\Windows\System\pTKOUgM.exe
  C:\Windows\System\pTKOUgM.exe
  2⤵
  PID:9536
- C:\Windows\System\mhuYLUM.exe
  C:\Windows\System\mhuYLUM.exe
  2⤵
  PID:11760
- C:\Windows\System\gkvdRmo.exe
  C:\Windows\System\gkvdRmo.exe
  2⤵
  PID:9764
- C:\Windows\System\FcgMCpE.exe
  C:\Windows\System\FcgMCpE.exe
  2⤵
  PID:11868
- C:\Windows\System\FGoOnvi.exe
  C:\Windows\System\FGoOnvi.exe
  2⤵
  PID:11904
- C:\Windows\System\BYbYKGt.exe
  C:\Windows\System\BYbYKGt.exe
  2⤵
  PID:10256
- C:\Windows\System\dgbJTbg.exe
  C:\Windows\System\dgbJTbg.exe
  2⤵
  PID:10308
- C:\Windows\System\QjQdOqO.exe
  C:\Windows\System\QjQdOqO.exe
  2⤵
  PID:12292
- C:\Windows\System\xUcDuXa.exe
  C:\Windows\System\xUcDuXa.exe
  2⤵
  PID:12308
- C:\Windows\System\xQRWRhT.exe
  C:\Windows\System\xQRWRhT.exe
  2⤵
  PID:12328
- C:\Windows\System\aLJJPIP.exe
  C:\Windows\System\aLJJPIP.exe
  2⤵
  PID:12352
- C:\Windows\System\biTLOnv.exe
  C:\Windows\System\biTLOnv.exe
  2⤵
  PID:12372
- C:\Windows\System\enuZBty.exe
  C:\Windows\System\enuZBty.exe
  2⤵
  PID:12400
- C:\Windows\System\ncLBEaY.exe
  C:\Windows\System\ncLBEaY.exe
  2⤵
  PID:12428
- C:\Windows\System\EyRBaOI.exe
  C:\Windows\System\EyRBaOI.exe
  2⤵
  PID:12452
- C:\Windows\System\IeRBAqv.exe
  C:\Windows\System\IeRBAqv.exe
  2⤵
  PID:12476
- C:\Windows\System\FfcKkIM.exe
  C:\Windows\System\FfcKkIM.exe
  2⤵
  PID:12500
- C:\Windows\System\hGXIRrY.exe
  C:\Windows\System\hGXIRrY.exe
  2⤵
  PID:12520
- C:\Windows\System\jGleVqi.exe
  C:\Windows\System\jGleVqi.exe
  2⤵
  PID:12544
- C:\Windows\System\rammQeB.exe
  C:\Windows\System\rammQeB.exe
  2⤵
  PID:11076
- C:\Windows\System\VyyehSN.exe
  C:\Windows\System\VyyehSN.exe
  2⤵
  PID:10908
- C:\Windows\System\TpEgpqH.exe
  C:\Windows\System\TpEgpqH.exe
  2⤵
  PID:10692
- C:\Windows\System\OBiQrmK.exe
  C:\Windows\System\OBiQrmK.exe
  2⤵
  PID:12628
- C:\Windows\System\BSbsjSr.exe
  C:\Windows\System\BSbsjSr.exe
  2⤵
  PID:11388
- C:\Windows\System\beyzhgb.exe
  C:\Windows\System\beyzhgb.exe
  2⤵
  PID:12756
- C:\Windows\System\UayFcAm.exe
  C:\Windows\System\UayFcAm.exe
  2⤵
  PID:7768
- C:\Windows\System\IAwHRYR.exe
  C:\Windows\System\IAwHRYR.exe
  2⤵
  PID:12924
- C:\Windows\System\zXDDJqb.exe
  C:\Windows\System\zXDDJqb.exe
  2⤵
  PID:9840
- C:\Windows\System\CQrOLQU.exe
  C:\Windows\System\CQrOLQU.exe
  2⤵
  PID:12768
- C:\Windows\System\HQxCwQt.exe
  C:\Windows\System\HQxCwQt.exe
  2⤵
  PID:10492
- C:\Windows\System\PInpzzH.exe
  C:\Windows\System\PInpzzH.exe
  2⤵
  PID:11676
- C:\Windows\System\PaRLvkn.exe
  C:\Windows\System\PaRLvkn.exe
  2⤵
  PID:12324
- C:\Windows\System\ScAQTNU.exe
  C:\Windows\System\ScAQTNU.exe
  2⤵
  PID:11696
- C:\Windows\System\BYuQSpF.exe
  C:\Windows\System\BYuQSpF.exe
  2⤵
  PID:12212
- C:\Windows\System\wYOPaKK.exe
  C:\Windows\System\wYOPaKK.exe
  2⤵
  PID:8620
- C:\Windows\System\aUYkHER.exe
  C:\Windows\System\aUYkHER.exe
  2⤵
  PID:11740
- C:\Windows\System\dbNXGvq.exe
  C:\Windows\System\dbNXGvq.exe
  2⤵
  PID:11232
- C:\Windows\System\ObJgkxH.exe
  C:\Windows\System\ObJgkxH.exe
  2⤵
  PID:12124
- C:\Windows\System\IPtjKmr.exe
  C:\Windows\System\IPtjKmr.exe
  2⤵
  PID:9888
- C:\Windows\System\lSgpIMn.exe
  C:\Windows\System\lSgpIMn.exe
  2⤵
  PID:12340
- C:\Windows\System\vlCLbeM.exe
  C:\Windows\System\vlCLbeM.exe
  2⤵
  PID:11832
- C:\Windows\System\dqesUSH.exe
  C:\Windows\System\dqesUSH.exe
  2⤵
  PID:11920
- C:\Windows\System\PDZIpRN.exe
  C:\Windows\System\PDZIpRN.exe
  2⤵
  PID:9008
- C:\Windows\System\bvgmghj.exe
  C:\Windows\System\bvgmghj.exe
  2⤵
  PID:11400
- C:\Windows\System\UpZejjR.exe
  C:\Windows\System\UpZejjR.exe
  2⤵
  PID:12728
- C:\Windows\System\FCNGrnj.exe
  C:\Windows\System\FCNGrnj.exe
  2⤵
  PID:9308
- C:\Windows\System\lArORRn.exe
  C:\Windows\System\lArORRn.exe
  2⤵
  PID:2372
- C:\Windows\System\aPCZkiQ.exe
  C:\Windows\System\aPCZkiQ.exe
  2⤵
  PID:12852
- C:\Windows\System\zYZOTDK.exe
  C:\Windows\System\zYZOTDK.exe
  2⤵
  PID:13212
- C:\Windows\System\ZwzRXaG.exe
  C:\Windows\System\ZwzRXaG.exe
  2⤵
  PID:13300
- C:\Windows\System\aieFZoU.exe
  C:\Windows\System\aieFZoU.exe
  2⤵
  PID:11152
- C:\Windows\System\TGPHlVW.exe
  C:\Windows\System\TGPHlVW.exe
  2⤵
  PID:12908
- C:\Windows\System\mBNlCTW.exe
  C:\Windows\System\mBNlCTW.exe
  2⤵
  PID:11296
- C:\Windows\System\MODszhY.exe
  C:\Windows\System\MODszhY.exe
  2⤵
  PID:9928
- C:\Windows\System\BzpUyGn.exe
  C:\Windows\System\BzpUyGn.exe
  2⤵
  PID:1136
- C:\Windows\System\LQeAxbC.exe
  C:\Windows\System\LQeAxbC.exe
  2⤵
  PID:1708
- C:\Windows\System\GVEkntt.exe
  C:\Windows\System\GVEkntt.exe
  2⤵
  PID:13168
- C:\Windows\System\hRjcSXT.exe
  C:\Windows\System\hRjcSXT.exe
  2⤵
  PID:11992
- C:\Windows\System\dfemEca.exe
  C:\Windows\System\dfemEca.exe
  2⤵
  PID:10268
- C:\Windows\System\PHSeBzH.exe
  C:\Windows\System\PHSeBzH.exe
  2⤵
  PID:12580
- C:\Windows\System\WoSBecD.exe
  C:\Windows\System\WoSBecD.exe
  2⤵
  PID:8472
- C:\Windows\System\IPueWNN.exe
  C:\Windows\System\IPueWNN.exe
  2⤵
  PID:10564
- C:\Windows\System\TDZxqtA.exe
  C:\Windows\System\TDZxqtA.exe
  2⤵
  PID:8860
- C:\Windows\System\GqGgtmf.exe
  C:\Windows\System\GqGgtmf.exe
  2⤵
  PID:9772
- C:\Windows\System\QAPQWvH.exe
  C:\Windows\System\QAPQWvH.exe
  2⤵
  PID:12976
- C:\Windows\System\sJznhDU.exe
  C:\Windows\System\sJznhDU.exe
  2⤵
  PID:12304
- C:\Windows\System\NvTdjCW.exe
  C:\Windows\System\NvTdjCW.exe
  2⤵
  PID:10088
- C:\Windows\System\snSOzxv.exe
  C:\Windows\System\snSOzxv.exe
  2⤵
  PID:3256
- C:\Windows\System\JXdQMjI.exe
  C:\Windows\System\JXdQMjI.exe
  2⤵
  PID:9424
- C:\Windows\System\HlaKLVP.exe
  C:\Windows\System\HlaKLVP.exe
  2⤵
  PID:2900
- C:\Windows\System\ptJKNoP.exe
  C:\Windows\System\ptJKNoP.exe
  2⤵
  PID:2996
- C:\Windows\System\ioUmBvL.exe
  C:\Windows\System\ioUmBvL.exe
  2⤵
  PID:13136
- C:\Windows\System\hqLtZNH.exe
  C:\Windows\System\hqLtZNH.exe
  2⤵
  PID:12368
- C:\Windows\System\zRwRjly.exe
  C:\Windows\System\zRwRjly.exe
  2⤵
  PID:4624
- C:\Windows\System\oigLNCb.exe
  C:\Windows\System\oigLNCb.exe
  2⤵
  PID:9400
- C:\Windows\System\qzLsnmd.exe
  C:\Windows\System\qzLsnmd.exe
  2⤵
  PID:13248
- C:\Windows\System\EmJfyNq.exe
  C:\Windows\System\EmJfyNq.exe
  2⤵
  PID:12980
- C:\Windows\System\wDkUvFn.exe
  C:\Windows\System\wDkUvFn.exe
  2⤵
  PID:4712
- C:\Windows\System\SmPluAP.exe
  C:\Windows\System\SmPluAP.exe
  2⤵
  PID:13204
- C:\Windows\System\nBhmoyx.exe
  C:\Windows\System\nBhmoyx.exe
  2⤵
  PID:3692
- C:\Windows\System\bJOStnW.exe
  C:\Windows\System\bJOStnW.exe
  2⤵
  PID:6860
- C:\Windows\System\hGuHsTv.exe
  C:\Windows\System\hGuHsTv.exe
  2⤵
  PID:11476
- C:\Windows\System\uIcuYIL.exe
  C:\Windows\System\uIcuYIL.exe
  2⤵
  PID:2120
- C:\Windows\System\maPAegK.exe
  C:\Windows\System\maPAegK.exe
  2⤵
  PID:10956
- C:\Windows\System\cPULyDP.exe
  C:\Windows\System\cPULyDP.exe
  2⤵
  PID:12556
- C:\Windows\System\YoLaczz.exe
  C:\Windows\System\YoLaczz.exe
  2⤵
  PID:12344
- C:\Windows\System\jWlMYJd.exe
  C:\Windows\System\jWlMYJd.exe
  2⤵
  PID:4380
- C:\Windows\System\bISTZpv.exe
  C:\Windows\System\bISTZpv.exe
  2⤵
  PID:3252
- C:\Windows\System\lLDNDDp.exe
  C:\Windows\System\lLDNDDp.exe
  2⤵
  PID:4040
- C:\Windows\System\whFmKHG.exe
  C:\Windows\System\whFmKHG.exe
  2⤵
  PID:4360
- C:\Windows\System\jUnYrJi.exe
  C:\Windows\System\jUnYrJi.exe
  2⤵
  PID:3112
- C:\Windows\System\FYQRcKW.exe
  C:\Windows\System\FYQRcKW.exe
  2⤵
  PID:13296
- C:\Windows\System\qOyrgYO.exe
  C:\Windows\System\qOyrgYO.exe
  2⤵
  PID:220
- C:\Windows\System\ioBHevT.exe
  C:\Windows\System\ioBHevT.exe
  2⤵
  PID:2728
- C:\Windows\System\qwyjbHE.exe
  C:\Windows\System\qwyjbHE.exe
  2⤵
  PID:12116
- C:\Windows\System\CDSNQZj.exe
  C:\Windows\System\CDSNQZj.exe
  2⤵
  PID:3956
- C:\Windows\System\SmtLoUd.exe
  C:\Windows\System\SmtLoUd.exe
  2⤵
  PID:4656
- C:\Windows\System\pbtCsVQ.exe
  C:\Windows\System\pbtCsVQ.exe
  2⤵
  PID:1140
- C:\Windows\System\JkHAzoF.exe
  C:\Windows\System\JkHAzoF.exe
  2⤵
  PID:13176
- C:\Windows\System\GCkBBIy.exe
  C:\Windows\System\GCkBBIy.exe
  2⤵
  PID:13292
- C:\Windows\System\izFuiJk.exe
  C:\Windows\System\izFuiJk.exe
  2⤵
  PID:392
- C:\Windows\System\ZtrnqOz.exe
  C:\Windows\System\ZtrnqOz.exe
  2⤵
  PID:4436
- C:\Windows\System\OHfdyzR.exe
  C:\Windows\System\OHfdyzR.exe
  2⤵
  PID:13088
- C:\Windows\System\CgZqQUw.exe
  C:\Windows\System\CgZqQUw.exe
  2⤵
  PID:4892
- C:\Windows\System\QmOzDsY.exe
  C:\Windows\System\QmOzDsY.exe
  2⤵
  PID:2188
- C:\Windows\System\BmSAXsR.exe
  C:\Windows\System\BmSAXsR.exe
  2⤵
  PID:556
- C:\Windows\System\pIGBLfx.exe
  C:\Windows\System\pIGBLfx.exe
  2⤵
  PID:6036
- C:\Windows\System\KkzCxje.exe
  C:\Windows\System\KkzCxje.exe
  2⤵
  PID:6916
- C:\Windows\System\QfQiGpK.exe
  C:\Windows\System\QfQiGpK.exe
  2⤵
  PID:4672
- C:\Windows\System\TZWMQOb.exe
  C:\Windows\System\TZWMQOb.exe
  2⤵
  PID:2536
- C:\Windows\System\eacEIrA.exe
  C:\Windows\System\eacEIrA.exe
  2⤵
  PID:3468
- C:\Windows\System\mRMNjMU.exe
  C:\Windows\System\mRMNjMU.exe
  2⤵
  PID:6912
- C:\Windows\System\BnIlrxz.exe
  C:\Windows\System\BnIlrxz.exe
  2⤵
  PID:7048
- C:\Windows\System\mcFfjDX.exe
  C:\Windows\System\mcFfjDX.exe
  2⤵
  PID:7064
- C:\Windows\System\ZwhUDyb.exe
  C:\Windows\System\ZwhUDyb.exe
  2⤵
  PID:3104
- C:\Windows\System\mqKBAfm.exe
  C:\Windows\System\mqKBAfm.exe
  2⤵
  PID:2640
- C:\Windows\System\SHXTfNw.exe
  C:\Windows\System\SHXTfNw.exe
  2⤵
  PID:6780
- C:\Windows\System\hgbbzcp.exe
  C:\Windows\System\hgbbzcp.exe
  2⤵
  PID:7172
- C:\Windows\System\yPhPfEb.exe
  C:\Windows\System\yPhPfEb.exe
  2⤵
  PID:5196
- C:\Windows\System\QEoMTNu.exe
  C:\Windows\System\QEoMTNu.exe
  2⤵
  PID:5228
- C:\Windows\System\IRUyeSp.exe
  C:\Windows\System\IRUyeSp.exe
  2⤵
  PID:5644
- C:\Windows\System\xlCxVvT.exe
  C:\Windows\System\xlCxVvT.exe
  2⤵
  PID:5560
- C:\Windows\System\nPzbsup.exe
  C:\Windows\System\nPzbsup.exe
  2⤵
  PID:13196
- C:\Windows\System\EMdHiRG.exe
  C:\Windows\System\EMdHiRG.exe
  2⤵
  PID:4524
- C:\Windows\System\sAKlhEU.exe
  C:\Windows\System\sAKlhEU.exe
  2⤵
  PID:5260
- C:\Windows\System\ZKuRVVK.exe
  C:\Windows\System\ZKuRVVK.exe
  2⤵
  PID:100
- C:\Windows\System\xYeCDgQ.exe
  C:\Windows\System\xYeCDgQ.exe
  2⤵
  PID:5432
- C:\Windows\System\MgFwIOW.exe
  C:\Windows\System\MgFwIOW.exe
  2⤵
  PID:5840
- C:\Windows\System\DBXtqdz.exe
  C:\Windows\System\DBXtqdz.exe
  2⤵
  PID:5628
- C:\Windows\System\jCkUZKx.exe
  C:\Windows\System\jCkUZKx.exe
  2⤵
  PID:5752
- C:\Windows\System\tKzgbzG.exe
  C:\Windows\System\tKzgbzG.exe
  2⤵
  PID:2700
- C:\Windows\System\Xlkeepj.exe
  C:\Windows\System\Xlkeepj.exe
  2⤵
  PID:11132
- C:\Windows\System\MQLmwGh.exe
  C:\Windows\System\MQLmwGh.exe
  2⤵
  PID:3096
- C:\Windows\System\lyXKtvY.exe
  C:\Windows\System\lyXKtvY.exe
  2⤵
  PID:10820
- C:\Windows\System\spYgmdj.exe
  C:\Windows\System\spYgmdj.exe
  2⤵
  PID:2720
- C:\Windows\System\SMOKBAl.exe
  C:\Windows\System\SMOKBAl.exe
  2⤵
  PID:904
- C:\Windows\System\MdrFwtg.exe
  C:\Windows\System\MdrFwtg.exe
  2⤵
  PID:5924
- C:\Windows\System\ElCPlCG.exe
  C:\Windows\System\ElCPlCG.exe
  2⤵
  PID:3276
- C:\Windows\System\pQEQfNo.exe
  C:\Windows\System\pQEQfNo.exe
  2⤵
  PID:6136
- C:\Windows\System\wBJeOrO.exe
  C:\Windows\System\wBJeOrO.exe
  2⤵
  PID:12164
- C:\Windows\System\pYOmERJ.exe
  C:\Windows\System\pYOmERJ.exe
  2⤵
  PID:11200
- C:\Windows\System\FbiJPul.exe
  C:\Windows\System\FbiJPul.exe
  2⤵
  PID:2020
- C:\Windows\System\dnCqJyd.exe
  C:\Windows\System\dnCqJyd.exe
  2⤵
  PID:3528
- C:\Windows\System\eBZybYC.exe
  C:\Windows\System\eBZybYC.exe
  2⤵
  PID:1924
- C:\Windows\System\lAHVzkh.exe
  C:\Windows\System\lAHVzkh.exe
  2⤵
  PID:5132
- C:\Windows\System\qkHXaJC.exe
  C:\Windows\System\qkHXaJC.exe
  2⤵
  PID:6580
- C:\Windows\System\dIQxUTP.exe
  C:\Windows\System\dIQxUTP.exe
  2⤵
  PID:892
- C:\Windows\System\tvNdkdV.exe
  C:\Windows\System\tvNdkdV.exe
  2⤵
  PID:5452
- C:\Windows\System\mfcnYmI.exe
  C:\Windows\System\mfcnYmI.exe
  2⤵
  PID:6648
- C:\Windows\System\qsnMgYG.exe
  C:\Windows\System\qsnMgYG.exe
  2⤵
  PID:3300
- C:\Windows\System\cAMYFaP.exe
  C:\Windows\System\cAMYFaP.exe
  2⤵
  PID:10832
- C:\Windows\System\wGoShva.exe
  C:\Windows\System\wGoShva.exe
  2⤵
  PID:5280
- C:\Windows\System\oAFTAjc.exe
  C:\Windows\System\oAFTAjc.exe
  2⤵
  PID:5300
- C:\Windows\System\AJtrYrq.exe
  C:\Windows\System\AJtrYrq.exe
  2⤵
  PID:5116
- C:\Windows\System\lNLEvmB.exe
  C:\Windows\System\lNLEvmB.exe
  2⤵
  PID:5176
- C:\Windows\System\ZUdfMwW.exe
  C:\Windows\System\ZUdfMwW.exe
  2⤵
  PID:3760
- C:\Windows\System\lQBcQKn.exe
  C:\Windows\System\lQBcQKn.exe
  2⤵
  PID:5640
- C:\Windows\System\RVEsLkQ.exe
  C:\Windows\System\RVEsLkQ.exe
  2⤵
  PID:5720
- C:\Windows\System\BPzThhq.exe
  C:\Windows\System\BPzThhq.exe
  2⤵
  PID:408
- C:\Windows\System\QIzIKCY.exe
  C:\Windows\System\QIzIKCY.exe
  2⤵
  PID:5864
- C:\Windows\System\znGKPtL.exe
  C:\Windows\System\znGKPtL.exe
  2⤵
  PID:3016
- C:\Windows\System\fpUEpTe.exe
  C:\Windows\System\fpUEpTe.exe
  2⤵
  PID:5896
- C:\Windows\System\BLrQavG.exe
  C:\Windows\System\BLrQavG.exe
  2⤵
  PID:5856
- C:\Windows\System\YlIipCV.exe
  C:\Windows\System\YlIipCV.exe
  2⤵
  PID:5800
- C:\Windows\System\YqPxzNY.exe
  C:\Windows\System\YqPxzNY.exe
  2⤵
  PID:6252
- C:\Windows\System\qQLTrgU.exe
  C:\Windows\System\qQLTrgU.exe
  2⤵
  PID:4668
- C:\Windows\System\wrTKqPC.exe
  C:\Windows\System\wrTKqPC.exe
  2⤵
  PID:4056
- C:\Windows\System\GNfKRpF.exe
  C:\Windows\System\GNfKRpF.exe
  2⤵
  PID:5224
- C:\Windows\System\PvAojNO.exe
  C:\Windows\System\PvAojNO.exe
  2⤵
  PID:2036
- C:\Windows\System\vKwohkd.exe
  C:\Windows\System\vKwohkd.exe
  2⤵
  PID:6280
- C:\Windows\System\bMqsWsz.exe
  C:\Windows\System\bMqsWsz.exe
  2⤵
  PID:1928
- C:\Windows\System\QgGAySv.exe
  C:\Windows\System\QgGAySv.exe
  2⤵
  PID:6268
- C:\Windows\System\RVJjTQt.exe
  C:\Windows\System\RVJjTQt.exe
  2⤵
  PID:5696
- C:\Windows\System\dnxkUnM.exe
  C:\Windows\System\dnxkUnM.exe
  2⤵
  PID:10364
- C:\Windows\System\CYTbDBn.exe
  C:\Windows\System\CYTbDBn.exe
  2⤵
  PID:1644
- C:\Windows\System\bdBTrhv.exe
  C:\Windows\System\bdBTrhv.exe
  2⤵
  PID:6348
- C:\Windows\System\AzlKwBb.exe
  C:\Windows\System\AzlKwBb.exe
  2⤵
  PID:1792
- C:\Windows\System\BoUbTQo.exe
  C:\Windows\System\BoUbTQo.exe
  2⤵
  PID:6420
- C:\Windows\System\uMuAaXE.exe
  C:\Windows\System\uMuAaXE.exe
  2⤵
  PID:12644
- C:\Windows\System\kOJTOaH.exe
  C:\Windows\System\kOJTOaH.exe
  2⤵
  PID:3564
- C:\Windows\System\yejtsZw.exe
  C:\Windows\System\yejtsZw.exe
  2⤵
  PID:5920
- C:\Windows\System\NGFpKef.exe
  C:\Windows\System\NGFpKef.exe
  2⤵
  PID:6640
- C:\Windows\System\GzkxstC.exe
  C:\Windows\System\GzkxstC.exe
  2⤵
  PID:4564
- C:\Windows\System\SRDlEfj.exe
  C:\Windows\System\SRDlEfj.exe
  2⤵
  PID:6852
- C:\Windows\System\GocIWGE.exe
  C:\Windows\System\GocIWGE.exe
  2⤵
  PID:6284
- C:\Windows\System\mWLttIu.exe
  C:\Windows\System\mWLttIu.exe
  2⤵
  PID:6380
- C:\Windows\System\TJGrsCz.exe
  C:\Windows\System\TJGrsCz.exe
  2⤵
  PID:5760
- C:\Windows\System\HvKXJzn.exe
  C:\Windows\System\HvKXJzn.exe
  2⤵
  PID:6212
- C:\Windows\System\elZYhCt.exe
  C:\Windows\System\elZYhCt.exe
  2⤵
  PID:13072
- C:\Windows\System\yBoiJAW.exe
  C:\Windows\System\yBoiJAW.exe
  2⤵
  PID:4912
- C:\Windows\System\FAoijwp.exe
  C:\Windows\System\FAoijwp.exe
  2⤵
  PID:4448
- C:\Windows\System\vmgzJyT.exe
  C:\Windows\System\vmgzJyT.exe
  2⤵
  PID:5620
- C:\Windows\System\nqVyfiW.exe
  C:\Windows\System\nqVyfiW.exe
  2⤵
  PID:13340
- C:\Windows\System\dGKXSkj.exe
  C:\Windows\System\dGKXSkj.exe
  2⤵
  PID:13368
- C:\Windows\System\xxvTsMp.exe
  C:\Windows\System\xxvTsMp.exe
  2⤵
  PID:13396
- C:\Windows\System\bduGEME.exe
  C:\Windows\System\bduGEME.exe
  2⤵
  PID:13416
- C:\Windows\System\JKNBuiT.exe
  C:\Windows\System\JKNBuiT.exe
  2⤵
  PID:13808
- C:\Windows\System\muBIoJR.exe
  C:\Windows\System\muBIoJR.exe
  2⤵
  PID:13832
- C:\Windows\System\QsYlCHb.exe
  C:\Windows\System\QsYlCHb.exe
  2⤵
  PID:13904
- C:\Windows\System\FAMeXSC.exe
  C:\Windows\System\FAMeXSC.exe
  2⤵
  PID:13948
- C:\Windows\System\rwzGBYQ.exe
  C:\Windows\System\rwzGBYQ.exe
  2⤵
  PID:14036
- C:\Windows\System\utPjvKM.exe
  C:\Windows\System\utPjvKM.exe
  2⤵
  PID:14060
- C:\Windows\System\iQbZmLT.exe
  C:\Windows\System\iQbZmLT.exe
  2⤵
  PID:14112
- C:\Windows\System\weyBlKO.exe
  C:\Windows\System\weyBlKO.exe
  2⤵
  PID:14164
- C:\Windows\System\oTkuDHG.exe
  C:\Windows\System\oTkuDHG.exe
  2⤵
  PID:14184
- C:\Windows\System\rQzDOru.exe
  C:\Windows\System\rQzDOru.exe
  2⤵
  PID:14216
- C:\Windows\System\OOAJneG.exe
  C:\Windows\System\OOAJneG.exe
  2⤵
  PID:14240
- C:\Windows\System\JzhBCWt.exe
  C:\Windows\System\JzhBCWt.exe
  2⤵
  PID:14296
- C:\Windows\System\OYWUjmu.exe
  C:\Windows\System\OYWUjmu.exe
  2⤵
  PID:14332
- C:\Windows\System\AnPMwXa.exe
  C:\Windows\System\AnPMwXa.exe
  2⤵
  PID:13388
- C:\Windows\System\YHrKYon.exe
  C:\Windows\System\YHrKYon.exe
  2⤵
  PID:13516
- C:\Windows\System\pILPKPa.exe
  C:\Windows\System\pILPKPa.exe
  2⤵
  PID:13672
- C:\Windows\System\PTdGmmF.exe
  C:\Windows\System\PTdGmmF.exe
  2⤵
  PID:13688
- C:\Windows\System\xrXuuTO.exe
  C:\Windows\System\xrXuuTO.exe
  2⤵
  PID:13680
- C:\Windows\System\ltatmKd.exe
  C:\Windows\System\ltatmKd.exe
  2⤵
  PID:13728
- C:\Windows\System\AOqrPze.exe
  C:\Windows\System\AOqrPze.exe
  2⤵
  PID:13756
- C:\Windows\System\AZSrDtD.exe
  C:\Windows\System\AZSrDtD.exe
  2⤵
  PID:13764
- C:\Windows\System\DoeSpnV.exe
  C:\Windows\System\DoeSpnV.exe
  2⤵
  PID:13800
- C:\Windows\System\eNGnRJI.exe
  C:\Windows\System\eNGnRJI.exe
  2⤵
  PID:13828
- C:\Windows\System\kAckiJE.exe
  C:\Windows\System\kAckiJE.exe
  2⤵
  PID:13988
- C:\Windows\System\aMRlpsN.exe
  C:\Windows\System\aMRlpsN.exe
  2⤵
  PID:3748
- C:\Windows\System\qZYhKpk.exe
  C:\Windows\System\qZYhKpk.exe
  2⤵
  PID:14084
- C:\Windows\System\tMyZqcf.exe
  C:\Windows\System\tMyZqcf.exe
  2⤵
  PID:14104
- C:\Windows\System\oaGHJxZ.exe
  C:\Windows\System\oaGHJxZ.exe
  2⤵
  PID:14144
- C:\Windows\System\enbWNgD.exe
  C:\Windows\System\enbWNgD.exe
  2⤵
  PID:14196
- C:\Windows\System\uMNEkBd.exe
  C:\Windows\System\uMNEkBd.exe
  2⤵
  PID:14212
- C:\Windows\System\jjfzrkL.exe
  C:\Windows\System\jjfzrkL.exe
  2⤵
  PID:14272
- C:\Windows\System\BYnPIKi.exe
  C:\Windows\System\BYnPIKi.exe
  2⤵
  PID:13424
- C:\Windows\System\KQEvzjY.exe
  C:\Windows\System\KQEvzjY.exe
  2⤵
  PID:13564
- C:\Windows\System\hGTHzJR.exe
  C:\Windows\System\hGTHzJR.exe
  2⤵
  PID:6776
- C:\Windows\System\RFIzlsw.exe
  C:\Windows\System\RFIzlsw.exe
  2⤵
  PID:13640
- C:\Windows\System\NzeHWfO.exe
  C:\Windows\System\NzeHWfO.exe
  2⤵
  PID:13736
- C:\Windows\System\rpthHEt.exe
  C:\Windows\System\rpthHEt.exe
  2⤵
  PID:13752
- C:\Windows\System\mMhfOXB.exe
  C:\Windows\System\mMhfOXB.exe
  2⤵
  PID:13804
- C:\Windows\System\iHlRvMm.exe
  C:\Windows\System\iHlRvMm.exe
  2⤵
  PID:13900
- C:\Windows\System\eDRIHtI.exe
  C:\Windows\System\eDRIHtI.exe
  2⤵
  PID:14020
- C:\Windows\System\sAMXxAS.exe
  C:\Windows\System\sAMXxAS.exe
  2⤵
  PID:14024
- C:\Windows\System\bdKNddq.exe
  C:\Windows\System\bdKNddq.exe
  2⤵
  PID:7284
- C:\Windows\System\pLsIbOD.exe
  C:\Windows\System\pLsIbOD.exe
  2⤵
  PID:14140
- C:\Windows\System\XIayMff.exe
  C:\Windows\System\XIayMff.exe
  2⤵
  PID:14224
- C:\Windows\System\VAIjcMB.exe
  C:\Windows\System\VAIjcMB.exe
  2⤵
  PID:6428
- C:\Windows\System\WFullBq.exe
  C:\Windows\System\WFullBq.exe
  2⤵
  PID:13348
- C:\Windows\System\gLKyJmx.exe
  C:\Windows\System\gLKyJmx.exe
  2⤵
  PID:13456
- C:\Windows\System\ghvHxvA.exe
  C:\Windows\System\ghvHxvA.exe
  2⤵
  PID:13464
- C:\Windows\System\AbouTfV.exe
  C:\Windows\System\AbouTfV.exe
  2⤵
  PID:7728
- C:\Windows\System\rpzZknL.exe
  C:\Windows\System\rpzZknL.exe
  2⤵
  PID:13576
- C:\Windows\System\WQnEQoa.exe
  C:\Windows\System\WQnEQoa.exe
  2⤵
  PID:13580
- C:\Windows\System\VUvJuNu.exe
  C:\Windows\System\VUvJuNu.exe
  2⤵
  PID:6984
- C:\Windows\System\wljwmhp.exe
  C:\Windows\System\wljwmhp.exe
  2⤵
  PID:12444
- C:\Windows\System\ohjwkfo.exe
  C:\Windows\System\ohjwkfo.exe
  2⤵
  PID:7676
- C:\Windows\System\hZrivax.exe
  C:\Windows\System\hZrivax.exe
  2⤵
  PID:14016
- C:\Windows\System\gjIjAQW.exe
  C:\Windows\System\gjIjAQW.exe
  2⤵
  PID:13940
- C:\Windows\System\KBVMpBa.exe
  C:\Windows\System\KBVMpBa.exe
  2⤵
  PID:7688
- C:\Windows\System\SynIwNv.exe
  C:\Windows\System\SynIwNv.exe
  2⤵
  PID:5312
- C:\Windows\System\dtlqglP.exe
  C:\Windows\System\dtlqglP.exe
  2⤵
  PID:13972
- C:\Windows\System\nOuNBKn.exe
  C:\Windows\System\nOuNBKn.exe
  2⤵
  PID:14096
- C:\Windows\System\uGDkgHs.exe
  C:\Windows\System\uGDkgHs.exe
  2⤵
  PID:14320
- C:\Windows\System\NGGRpul.exe
  C:\Windows\System\NGGRpul.exe
  2⤵
  PID:14328
- C:\Windows\System\jVfqkKw.exe
  C:\Windows\System\jVfqkKw.exe
  2⤵
  PID:8140
- C:\Windows\System\LmrAzJn.exe
  C:\Windows\System\LmrAzJn.exe
  2⤵
  PID:13528
- C:\Windows\System\QdSQGYF.exe
  C:\Windows\System\QdSQGYF.exe
  2⤵
  PID:5804
- C:\Windows\System\PShXHyc.exe
  C:\Windows\System\PShXHyc.exe
  2⤵
  PID:13596
- C:\Windows\System\rXlLXuV.exe
  C:\Windows\System\rXlLXuV.exe
  2⤵
  PID:13532
- C:\Windows\System\fDPGQxP.exe
  C:\Windows\System\fDPGQxP.exe
  2⤵
  PID:7976
- C:\Windows\System\qIOUEsK.exe
  C:\Windows\System\qIOUEsK.exe
  2⤵
  PID:13364
- C:\Windows\System\CKOIGcP.exe
  C:\Windows\System\CKOIGcP.exe
  2⤵
  PID:9148
- C:\Windows\System\dbDkFRV.exe
  C:\Windows\System\dbDkFRV.exe
  2⤵
  PID:13860
- C:\Windows\System\uanXPLf.exe
  C:\Windows\System\uanXPLf.exe
  2⤵
  PID:9096
- C:\Windows\System\rVuUGQp.exe
  C:\Windows\System\rVuUGQp.exe
  2⤵
  PID:13792
- C:\Windows\System\LaKYMdZ.exe
  C:\Windows\System\LaKYMdZ.exe
  2⤵
  PID:9076
- C:\Windows\System\nwUGTfN.exe
  C:\Windows\System\nwUGTfN.exe
  2⤵
  PID:8524
- C:\Windows\System\XyYeOKE.exe
  C:\Windows\System\XyYeOKE.exe
  2⤵
  PID:8824
- C:\Windows\System\LkVKnqP.exe
  C:\Windows\System\LkVKnqP.exe
  2⤵
  PID:7740
- C:\Windows\System\GWuTnAy.exe
  C:\Windows\System\GWuTnAy.exe
  2⤵
  PID:7948
- C:\Windows\System\PpwZNTY.exe
  C:\Windows\System\PpwZNTY.exe
  2⤵
  PID:8616
- C:\Windows\System\xwEmTiw.exe
  C:\Windows\System\xwEmTiw.exe
  2⤵
  PID:14172
- C:\Windows\System\lkeIgyQ.exe
  C:\Windows\System\lkeIgyQ.exe
  2⤵
  PID:8812
- C:\Windows\System\GHlyOmd.exe
  C:\Windows\System\GHlyOmd.exe
  2⤵
  PID:7308
- C:\Windows\System\AKQXtjI.exe
  C:\Windows\System\AKQXtjI.exe
  2⤵
  PID:8976
- C:\Windows\System\oNHPuSa.exe
  C:\Windows\System\oNHPuSa.exe
  2⤵
  PID:7852
- C:\Windows\System\MnfmJqR.exe
  C:\Windows\System\MnfmJqR.exe
  2⤵
  PID:6612
- C:\Windows\System\wwGOIJx.exe
  C:\Windows\System\wwGOIJx.exe
  2⤵
  PID:8672
- C:\Windows\System\EhjBvND.exe
  C:\Windows\System\EhjBvND.exe
  2⤵
  PID:13700
- C:\Windows\System\XChvdrJ.exe
  C:\Windows\System\XChvdrJ.exe
  2⤵
  PID:9160
- C:\Windows\System\IBMYoaQ.exe
  C:\Windows\System\IBMYoaQ.exe
  2⤵
  PID:8468
- C:\Windows\System\vXuzniv.exe
  C:\Windows\System\vXuzniv.exe
  2⤵
  PID:4976
- C:\Windows\System\HXwrzpA.exe
  C:\Windows\System\HXwrzpA.exe
  2⤵
  PID:6760
- C:\Windows\System\zzxfRVb.exe
  C:\Windows\System\zzxfRVb.exe
  2⤵
  PID:7212
- C:\Windows\System\ulGGnpt.exe
  C:\Windows\System\ulGGnpt.exe
  2⤵
  PID:7900
- C:\Windows\System\SLxtoqY.exe
  C:\Windows\System\SLxtoqY.exe
  2⤵
  PID:6196
- C:\Windows\System\txCvuWJ.exe
  C:\Windows\System\txCvuWJ.exe
  2⤵
  PID:8868
- C:\Windows\System\letmZiG.exe
  C:\Windows\System\letmZiG.exe
  2⤵
  PID:14264
- C:\Windows\System\iureHUI.exe
  C:\Windows\System\iureHUI.exe
  2⤵
  PID:14076
- C:\Windows\System\BbhAxyg.exe
  C:\Windows\System\BbhAxyg.exe
  2⤵
  PID:8204
- C:\Windows\System\jFiQoKv.exe
  C:\Windows\System\jFiQoKv.exe
  2⤵
  PID:9860
- C:\Windows\System\yFqBPlr.exe
  C:\Windows\System\yFqBPlr.exe
  2⤵
  PID:8856
- C:\Windows\System\xbNOTjQ.exe
  C:\Windows\System\xbNOTjQ.exe
  2⤵
  PID:13652
- C:\Windows\System\aSyZVsC.exe
  C:\Windows\System\aSyZVsC.exe
  2⤵
  PID:13548
- C:\Windows\System\zLEWepc.exe
  C:\Windows\System\zLEWepc.exe
  2⤵
  PID:9324
- C:\Windows\System\mOvVWzp.exe
  C:\Windows\System\mOvVWzp.exe
  2⤵
  PID:8088
- C:\Windows\System\gukvNWY.exe
  C:\Windows\System\gukvNWY.exe
  2⤵
  PID:9364
- C:\Windows\System\mNXshzb.exe
  C:\Windows\System\mNXshzb.exe
  2⤵
  PID:9580
- C:\Windows\System\GSOARWf.exe
  C:\Windows\System\GSOARWf.exe
  2⤵
  PID:6124
- C:\Windows\System\bXPqkLE.exe
  C:\Windows\System\bXPqkLE.exe
  2⤵
  PID:10020
- C:\Windows\System\TaHKzrn.exe
  C:\Windows\System\TaHKzrn.exe
  2⤵
  PID:9984
- C:\Windows\System\YFYohQv.exe
  C:\Windows\System\YFYohQv.exe
  2⤵
  PID:7716
- C:\Windows\System\UVEifVj.exe
  C:\Windows\System\UVEifVj.exe
  2⤵
  PID:8520
- C:\Windows\System\LrPPFBS.exe
  C:\Windows\System\LrPPFBS.exe
  2⤵
  PID:9252
- C:\Windows\System\MFtNCfG.exe
  C:\Windows\System\MFtNCfG.exe
  2⤵
  PID:10052
- C:\Windows\System\NveaFkC.exe
  C:\Windows\System\NveaFkC.exe
  2⤵
  PID:8516
- C:\Windows\System\QBGFNFe.exe
  C:\Windows\System\QBGFNFe.exe
  2⤵
  PID:9904
- C:\Windows\System\UdNBiLg.exe
  C:\Windows\System\UdNBiLg.exe
  2⤵
  PID:14396
- C:\Windows\System\eFdgJVA.exe
  C:\Windows\System\eFdgJVA.exe
  2⤵
  PID:14416
- C:\Windows\System\ceAxOnB.exe
  C:\Windows\System\ceAxOnB.exe
  2⤵
  PID:14432
- C:\Windows\System\MFvaqNP.exe
  C:\Windows\System\MFvaqNP.exe
  2⤵
  PID:14448
- C:\Windows\System\KyDdjnK.exe
  C:\Windows\System\KyDdjnK.exe
  2⤵
  PID:14472
- C:\Windows\System\uUrCeeM.exe
  C:\Windows\System\uUrCeeM.exe
  2⤵
  PID:14496
- C:\Windows\System\dIAroRD.exe
  C:\Windows\System\dIAroRD.exe
  2⤵
  PID:14520
- C:\Windows\System\VlYevxe.exe
  C:\Windows\System\VlYevxe.exe
  2⤵
  PID:14540
- C:\Windows\System\bSJcfVT.exe
  C:\Windows\System\bSJcfVT.exe
  2⤵
  PID:14560
- C:\Windows\System\TAByRND.exe
  C:\Windows\System\TAByRND.exe
  2⤵
  PID:14588
- C:\Windows\System\NroqwhJ.exe
  C:\Windows\System\NroqwhJ.exe
  2⤵
  PID:14612
- C:\Windows\System\CjxKGcU.exe
  C:\Windows\System\CjxKGcU.exe
  2⤵
  PID:14632
- C:\Windows\System\JDcIJwf.exe
  C:\Windows\System\JDcIJwf.exe
  2⤵
  PID:14660
- C:\Windows\System\Rquncca.exe
  C:\Windows\System\Rquncca.exe
  2⤵
  PID:14836
- C:\Windows\System\ZLFKUjT.exe
  C:\Windows\System\ZLFKUjT.exe
  2⤵
  PID:14860
- C:\Windows\System\fnRVsvo.exe
  C:\Windows\System\fnRVsvo.exe
  2⤵
  PID:14892
- C:\Windows\System\IxPCGnx.exe
  C:\Windows\System\IxPCGnx.exe
  2⤵
  PID:14912
- C:\Windows\System\nOZsDEp.exe
  C:\Windows\System\nOZsDEp.exe
  2⤵
  PID:14956
- C:\Windows\System\WvgYAhj.exe
  C:\Windows\System\WvgYAhj.exe
  2⤵
  PID:14984
- C:\Windows\System\WytQndB.exe
  C:\Windows\System\WytQndB.exe
  2⤵
  PID:15000
- C:\Windows\System\cAOIPqI.exe
  C:\Windows\System\cAOIPqI.exe
  2⤵
  PID:15016
- C:\Windows\System\owlztWb.exe
  C:\Windows\System\owlztWb.exe
  2⤵
  PID:15048
- C:\Windows\System\CNYxuRR.exe
  C:\Windows\System\CNYxuRR.exe
  2⤵
  PID:15064
- C:\Windows\System\bpXVtWV.exe
  C:\Windows\System\bpXVtWV.exe
  2⤵
  PID:15088
- C:\Windows\System\QoJHzsq.exe
  C:\Windows\System\QoJHzsq.exe
  2⤵
  PID:15112
- C:\Windows\System\XHxnAZJ.exe
  C:\Windows\System\XHxnAZJ.exe
  2⤵
  PID:15144
- C:\Windows\System\uynyRYG.exe
  C:\Windows\System\uynyRYG.exe
  2⤵
  PID:15176
- C:\Windows\System\QSWrfXl.exe
  C:\Windows\System\QSWrfXl.exe
  2⤵
  PID:15208
- C:\Windows\System\xWsZWZC.exe
  C:\Windows\System\xWsZWZC.exe
  2⤵
  PID:15228
- C:\Windows\System\obkPEzc.exe
  C:\Windows\System\obkPEzc.exe
  2⤵
  PID:15260
- C:\Windows\System\EpaanXb.exe
  C:\Windows\System\EpaanXb.exe
  2⤵
  PID:15288
- C:\Windows\System\GXFrIZU.exe
  C:\Windows\System\GXFrIZU.exe
  2⤵
  PID:15312
- C:\Windows\System\rTKhvVE.exe
  C:\Windows\System\rTKhvVE.exe
  2⤵
  PID:15344
- C:\Windows\System\oipOCHE.exe
  C:\Windows\System\oipOCHE.exe
  2⤵
  PID:10072
- C:\Windows\System\kgwPiKR.exe
  C:\Windows\System\kgwPiKR.exe
  2⤵
  PID:9660
- C:\Windows\System\DlDGGTM.exe
  C:\Windows\System\DlDGGTM.exe
  2⤵
  PID:9740
- C:\Windows\System\fIvWZAx.exe
  C:\Windows\System\fIvWZAx.exe
  2⤵
  PID:13924
- C:\Windows\System\sVwmdtA.exe
  C:\Windows\System\sVwmdtA.exe
  2⤵
  PID:13888
- C:\Windows\System\tbjiNCW.exe
  C:\Windows\System\tbjiNCW.exe
  2⤵
  PID:8932
- C:\Windows\System\hXOSmsm.exe
  C:\Windows\System\hXOSmsm.exe
  2⤵
  PID:10084
- C:\Windows\System\wuHniQL.exe
  C:\Windows\System\wuHniQL.exe
  2⤵
  PID:8372
- C:\Windows\System\wZhXRoE.exe
  C:\Windows\System\wZhXRoE.exe
  2⤵
  PID:10628
- C:\Windows\System\RWJGabG.exe
  C:\Windows\System\RWJGabG.exe
  2⤵
  PID:9212
- C:\Windows\System\IcsBetI.exe
  C:\Windows\System\IcsBetI.exe
  2⤵
  PID:8084
- C:\Windows\System\OjPoCMq.exe
  C:\Windows\System\OjPoCMq.exe
  2⤵
  PID:8436
- C:\Windows\System\CCKUrZY.exe
  C:\Windows\System\CCKUrZY.exe
  2⤵
  PID:14364
- C:\Windows\System\eCnhVAZ.exe
  C:\Windows\System\eCnhVAZ.exe
  2⤵
  PID:9760
- C:\Windows\System\ixnLIaI.exe
  C:\Windows\System\ixnLIaI.exe
  2⤵
  PID:8284
- C:\Windows\System\YjvQOje.exe
  C:\Windows\System\YjvQOje.exe
  2⤵
  PID:9804
- C:\Windows\System\XrVuqBW.exe
  C:\Windows\System\XrVuqBW.exe
  2⤵
  PID:14444
- C:\Windows\System\NLMVaoF.exe
  C:\Windows\System\NLMVaoF.exe
  2⤵
  PID:7564
- C:\Windows\System\jpaVUPp.exe
  C:\Windows\System\jpaVUPp.exe
  2⤵
  PID:11216
- C:\Windows\System\nCsqRiP.exe
  C:\Windows\System\nCsqRiP.exe
  2⤵
  PID:10728
- C:\Windows\System\mYRgTRw.exe
  C:\Windows\System\mYRgTRw.exe
  2⤵
  PID:9356
- C:\Windows\System\dPrJynN.exe
  C:\Windows\System\dPrJynN.exe
  2⤵
  PID:10572
- C:\Windows\System\FMrPhIc.exe
  C:\Windows\System\FMrPhIc.exe
  2⤵
  PID:13684
- C:\Windows\System\POkjTfB.exe
  C:\Windows\System\POkjTfB.exe
  2⤵
  PID:14672
- C:\Windows\System\XrCDaGI.exe
  C:\Windows\System\XrCDaGI.exe
  2⤵
  PID:7804
- C:\Windows\System\LKQvtRF.exe
  C:\Windows\System\LKQvtRF.exe
  2⤵
  PID:8092
- C:\Windows\System\TLVVEqa.exe
  C:\Windows\System\TLVVEqa.exe
  2⤵
  PID:14572
- C:\Windows\System\GWEXCEX.exe
  C:\Windows\System\GWEXCEX.exe
  2⤵
  PID:8952
- C:\Windows\System\cCumyBK.exe
  C:\Windows\System\cCumyBK.exe
  2⤵
  PID:7704
- C:\Windows\System\GrNTMtz.exe
  C:\Windows\System\GrNTMtz.exe
  2⤵
  PID:10992
- C:\Windows\System\PEyKDDR.exe
  C:\Windows\System\PEyKDDR.exe
  2⤵
  PID:8440
- C:\Windows\System\GVXuUlc.exe
  C:\Windows\System\GVXuUlc.exe
  2⤵
  PID:14492
- C:\Windows\System\gRaqUnk.exe
  C:\Windows\System\gRaqUnk.exe
  2⤵
  PID:14928
- C:\Windows\System\tpMDZtH.exe
  C:\Windows\System\tpMDZtH.exe
  2⤵
  PID:14760
- C:\Windows\System\UqnfDUa.exe
  C:\Windows\System\UqnfDUa.exe
  2⤵
  PID:14996
- C:\Windows\System\AARqJgI.exe
  C:\Windows\System\AARqJgI.exe
  2⤵
  PID:10812
- C:\Windows\System\clgmAqT.exe
  C:\Windows\System\clgmAqT.exe
  2⤵
  PID:10408
- C:\Windows\System\IrUippq.exe
  C:\Windows\System\IrUippq.exe
  2⤵
  PID:10452
- C:\Windows\System\zGbMZEY.exe
  C:\Windows\System\zGbMZEY.exe
  2⤵
  PID:12208
- C:\Windows\System\yActAiV.exe
  C:\Windows\System\yActAiV.exe
  2⤵
  PID:14360
- C:\Windows\System\cpCfTel.exe
  C:\Windows\System\cpCfTel.exe
  2⤵
  PID:8060
- C:\Windows\System\QpwKDJl.exe
  C:\Windows\System\QpwKDJl.exe
  2⤵
  PID:10124
- C:\Windows\System\DTvnHpG.exe
  C:\Windows\System\DTvnHpG.exe
  2⤵
  PID:9344
- C:\Windows\System\AaJMSwi.exe
  C:\Windows\System\AaJMSwi.exe
  2⤵
  PID:3716
- C:\Windows\System\OarukBf.exe
  C:\Windows\System\OarukBf.exe
  2⤵
  PID:10140
- C:\Windows\System\dFjNuxW.exe
  C:\Windows\System\dFjNuxW.exe
  2⤵
  PID:10960
- C:\Windows\System\UVzOPxJ.exe
  C:\Windows\System\UVzOPxJ.exe
  2⤵
  PID:14408
- C:\Windows\System\qbmRaeF.exe
  C:\Windows\System\qbmRaeF.exe
  2⤵
  PID:14704
- C:\Windows\System\cszNESg.exe
  C:\Windows\System\cszNESg.exe
  2⤵
  PID:9824
- C:\Windows\System\sRieJzG.exe
  C:\Windows\System\sRieJzG.exe
  2⤵
  PID:10136
- C:\Windows\System\sKlIQzr.exe
  C:\Windows\System\sKlIQzr.exe
  2⤵
  PID:12652
- C:\Windows\System\vZGlHrw.exe
  C:\Windows\System\vZGlHrw.exe
  2⤵
  PID:8912
- C:\Windows\System\kYDLQiu.exe
  C:\Windows\System\kYDLQiu.exe
  2⤵
  PID:11108
- C:\Windows\System\DwlWwhA.exe
  C:\Windows\System\DwlWwhA.exe
  2⤵
  PID:7648
- C:\Windows\System\uqNnCtM.exe
  C:\Windows\System\uqNnCtM.exe
  2⤵
  PID:10664
- C:\Windows\System\EodsMjT.exe
  C:\Windows\System\EodsMjT.exe
  2⤵
  PID:4256
- C:\Windows\System\orNoAPo.exe
  C:\Windows\System\orNoAPo.exe
  2⤵
  PID:11120
- C:\Windows\System\QjtqaXj.exe
  C:\Windows\System\QjtqaXj.exe
  2⤵
  PID:11404
- C:\Windows\System\VcjbrOY.exe
  C:\Windows\System\VcjbrOY.exe
  2⤵
  PID:14980
- C:\Windows\System\dUxLPdH.exe
  C:\Windows\System\dUxLPdH.exe
  2⤵
  PID:11840
- C:\Windows\System\hLjPrdi.exe
  C:\Windows\System\hLjPrdi.exe
  2⤵
  PID:12956
- C:\Windows\System\mKoydgp.exe
  C:\Windows\System\mKoydgp.exe
  2⤵
  PID:14776
- C:\Windows\System\ufEgySx.exe
  C:\Windows\System\ufEgySx.exe
  2⤵
  PID:10188
- C:\Windows\System\sBvdoZZ.exe
  C:\Windows\System\sBvdoZZ.exe
  2⤵
  PID:12888
- C:\Windows\System\qZmQXFO.exe
  C:\Windows\System\qZmQXFO.exe
  2⤵
  PID:12572
- C:\Windows\System\zzgkcxM.exe
  C:\Windows\System\zzgkcxM.exe
  2⤵
  PID:10776
- C:\Windows\System\cWBVxGi.exe
  C:\Windows\System\cWBVxGi.exe
  2⤵
  PID:12772
- C:\Windows\System\VnoVOiz.exe
  C:\Windows\System\VnoVOiz.exe
  2⤵
  PID:12360
- C:\Windows\System\dLVRUHZ.exe
  C:\Windows\System\dLVRUHZ.exe
  2⤵
  PID:2972
- C:\Windows\System\noyFCNu.exe
  C:\Windows\System\noyFCNu.exe
  2⤵
  PID:10768
- C:\Windows\System\HJZjwNQ.exe
  C:\Windows\System\HJZjwNQ.exe
  2⤵
  PID:12484
- C:\Windows\System\ATEiFJx.exe
  C:\Windows\System\ATEiFJx.exe
  2⤵
  PID:12232
- C:\Windows\System\TKxnCnq.exe
  C:\Windows\System\TKxnCnq.exe
  2⤵
  PID:14348
- C:\Windows\System\EznrHKw.exe
  C:\Windows\System\EznrHKw.exe
  2⤵
  PID:12168
- C:\Windows\System\XiyZLUe.exe
  C:\Windows\System\XiyZLUe.exe
  2⤵
  PID:12592
- C:\Windows\System\CABxxTq.exe
  C:\Windows\System\CABxxTq.exe
  2⤵
  PID:13200
- C:\Windows\System\xZtAiGg.exe
  C:\Windows\System\xZtAiGg.exe
  2⤵
  PID:14380
- C:\Windows\System\THsiViz.exe
  C:\Windows\System\THsiViz.exe
  2⤵
  PID:9100
- C:\Windows\System\TFllZYz.exe
  C:\Windows\System\TFllZYz.exe
  2⤵
  PID:8960
- C:\Windows\System\iLKnahU.exe
  C:\Windows\System\iLKnahU.exe
  2⤵
  PID:11336
- C:\Windows\System\loLUdGz.exe
  C:\Windows\System\loLUdGz.exe
  2⤵
  PID:13092
- C:\Windows\System\Rleqzbk.exe
  C:\Windows\System\Rleqzbk.exe
  2⤵
  PID:7672
- C:\Windows\System\eMcjEBq.exe
  C:\Windows\System\eMcjEBq.exe
  2⤵
  PID:11128
- C:\Windows\System\NwASRUu.exe
  C:\Windows\System\NwASRUu.exe
  2⤵
  PID:8544
- C:\Windows\System\eFCQXUU.exe
  C:\Windows\System\eFCQXUU.exe
  2⤵
  PID:14488
- C:\Windows\System\mHveZOd.exe
  C:\Windows\System\mHveZOd.exe
  2⤵
  PID:10348
- C:\Windows\System\qNZgZsA.exe
  C:\Windows\System\qNZgZsA.exe
  2⤵
  PID:10440
- C:\Windows\System\VuOyWfF.exe
  C:\Windows\System\VuOyWfF.exe
  2⤵
  PID:11224
- C:\Windows\System\mnJbShL.exe
  C:\Windows\System\mnJbShL.exe
  2⤵
  PID:12600
- C:\Windows\System\mZjIEHv.exe
  C:\Windows\System\mZjIEHv.exe
  2⤵
  PID:12488
- C:\Windows\System\DTGwEPC.exe
  C:\Windows\System\DTGwEPC.exe
  2⤵
  PID:15172
- C:\Windows\System\SLmFhfV.exe
  C:\Windows\System\SLmFhfV.exe
  2⤵
  PID:12508
- C:\Windows\System\CCjMrPv.exe
  C:\Windows\System\CCjMrPv.exe
  2⤵
  PID:3788
- C:\Windows\System\ubOwBWc.exe
  C:\Windows\System\ubOwBWc.exe
  2⤵
  PID:9104
- C:\Windows\System\UrmQiHs.exe
  C:\Windows\System\UrmQiHs.exe
  2⤵
  PID:12624
- C:\Windows\System\XFIaWbS.exe
  C:\Windows\System\XFIaWbS.exe
  2⤵
  PID:15124
- C:\Windows\System\Hhscjxf.exe
  C:\Windows\System\Hhscjxf.exe
  2⤵
  PID:9468
- C:\Windows\System\bxjizGe.exe
  C:\Windows\System\bxjizGe.exe
  2⤵
  PID:1604
- C:\Windows\System\TBsjVYb.exe
  C:\Windows\System\TBsjVYb.exe
  2⤵
  PID:13096
- C:\Windows\System\QbtIiXS.exe
  C:\Windows\System\QbtIiXS.exe
  2⤵
  PID:10288
- C:\Windows\System\glNlrzl.exe
  C:\Windows\System\glNlrzl.exe
  2⤵
  PID:10416
- C:\Windows\System\JJXGPyn.exe
  C:\Windows\System\JJXGPyn.exe
  2⤵
  PID:9680
- C:\Windows\System\fcijCeq.exe
  C:\Windows\System\fcijCeq.exe
  2⤵
  PID:12320
- C:\Windows\System\ssPaynK.exe
  C:\Windows\System\ssPaynK.exe
  2⤵
  PID:12880
- C:\Windows\System\pSWivrD.exe
  C:\Windows\System\pSWivrD.exe
  2⤵
  PID:11156
- C:\Windows\System\MQzwmIx.exe
  C:\Windows\System\MQzwmIx.exe
  2⤵
  PID:5004
- C:\Windows\System\ePJIsyN.exe
  C:\Windows\System\ePJIsyN.exe
  2⤵
  PID:14352
- C:\Windows\System\QpkWuiY.exe
  C:\Windows\System\QpkWuiY.exe
  2⤵
  PID:15104
- C:\Windows\System\SEAkWrK.exe
  C:\Windows\System\SEAkWrK.exe
  2⤵
  PID:10000
- C:\Windows\System\EKVMtbD.exe
  C:\Windows\System\EKVMtbD.exe
  2⤵
  PID:13152
- C:\Windows\System\bIulmGO.exe
  C:\Windows\System\bIulmGO.exe
  2⤵
  PID:4552
- C:\Windows\System\MZiQyzJ.exe
  C:\Windows\System\MZiQyzJ.exe
  2⤵
  PID:13272
- C:\Windows\System\OSWPpaz.exe
  C:\Windows\System\OSWPpaz.exe
  2⤵
  PID:11256
- C:\Windows\System\uYzyqLq.exe
  C:\Windows\System\uYzyqLq.exe
  2⤵
  PID:14344
- C:\Windows\System\xAWZmFW.exe
  C:\Windows\System\xAWZmFW.exe
  2⤵
  PID:11936
- C:\Windows\System\wPZQDaD.exe
  C:\Windows\System\wPZQDaD.exe
  2⤵
  PID:12620
- C:\Windows\System\wrsSErb.exe
  C:\Windows\System\wrsSErb.exe
  2⤵
  PID:14764
- C:\Windows\System\TlaGDKd.exe
  C:\Windows\System\TlaGDKd.exe
  2⤵
  PID:8636
- C:\Windows\System\mXmTOCL.exe
  C:\Windows\System\mXmTOCL.exe
  2⤵
  PID:12832
- C:\Windows\System\MXghWQH.exe
  C:\Windows\System\MXghWQH.exe
  2⤵
  PID:12944
- C:\Windows\System\CTofPDb.exe
  C:\Windows\System\CTofPDb.exe
  2⤵
  PID:4316
- C:\Windows\System\rkxcWYj.exe
  C:\Windows\System\rkxcWYj.exe
  2⤵
  PID:11104
- C:\Windows\System\dlLDQex.exe
  C:\Windows\System\dlLDQex.exe
  2⤵
  PID:12736
- C:\Windows\System\aInmToT.exe
  C:\Windows\System\aInmToT.exe
  2⤵
  PID:12512
- C:\Windows\System\QyqfGjG.exe
  C:\Windows\System\QyqfGjG.exe
  2⤵
  PID:12516
- C:\Windows\System\rRylEuZ.exe
  C:\Windows\System\rRylEuZ.exe
  2⤵
  PID:12964
- C:\Windows\System\sgVaLWm.exe
  C:\Windows\System\sgVaLWm.exe
  2⤵
  PID:12392
- C:\Windows\System\RmsdqOr.exe
  C:\Windows\System\RmsdqOr.exe
  2⤵
  PID:12152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\693APRNP\home-993d2c38b2c1[1].css

Filesize
11KB

MD5
6328d6d9a6b00ce7f992230b97b17c1f

SHA1
88837b802bdde407e37e92641072ea2eeec95556

SHA256
c9d9b80794cebd7d97daf52f7f0ce0e31bcf7a6f65a6e07851c688d67f10dba8

SHA512
993d2c38b2c15499aebdb39c1f9c21d0501d4c2a5973caec65be9ddc3ddfd6e46d06449e7483daa4fa9afa17cb81ff27a391519a64629169eb15c52911aab2c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ynf0qyxz.l2u.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AATKjiD.exe

Filesize
2.2MB

MD5
fd9f7c27660fb84d366796332034049d

SHA1
ad366f6f22febf87efd7efc12511be0aed0e703f

SHA256
a087dae1f87be5b18eeb70fe62fd9c8d473a17c48d94a73f50e2222c0ecbb1f5

SHA512
7c0e04e8b3bbb9f618d06b9a55e1b9f91b94271e714e12910b02eafbe276cdfef46bbbf8dc5c852fee879a450a312c5015fdd8d2d73dba7ff2966c51d8edc3ff

Download Submit
C:\Windows\System\ARKyZHC.exe

Filesize
2.2MB

MD5
fb85dd6a8ec26d3fd1989904b25dabe7

SHA1
090cc3dc67951997c18f4b03f00a73d60ec8d66e

SHA256
b05617cbbe4d0adb22cfd7a860630aa795b560af97d8954dc3854825ac62f2b2

SHA512
1f6533b4ad026d8e1a70bfe8743e9062f764faf1916f7d20f85d376cbaf8fb3eef70563f8b0bd4cb0b88936b86de6bb6c7a467960cf2d5ae3b10dc99d1f0ac3d

Download Submit
C:\Windows\System\AYtCfhT.exe

Filesize
2.2MB

MD5
41035d8107ed24761621d49df93831de

SHA1
e2b1beb099bbf2a2942fb66da26d067bf2b7a7bc

SHA256
55771e0a52c3c699159ff680573b584221463d64ca0b58646c25f29139109d57

SHA512
67b69eb3a868d171cb476b828ce9ec55180aecd4f2aa2cbfaeb33bf414338d2cc51839c84e8c3315e805b8f9bfb7825da5649ebffd37b3f67223b4b275eda020

Download Submit
C:\Windows\System\AlXlFuh.exe

Filesize
2.2MB

MD5
5ed991fb1eea793f7ea8953e7df22b8a

SHA1
416d9d7be2d9cd32aa884c98b8f6d4d294384f10

SHA256
88c963479b0c7286a959cefb4d14d9749fcc782d856d52b21c5b906650c9b49c

SHA512
3e699fd096b12981d3043771709c56d7f9d3ad4954616a0e2d676e6bc710c440b38b29fc20548670ffd0b3c57c4dc00a25e79d1a9a21f9d9e86cb0f07aa07347

Download Submit
C:\Windows\System\FgNLXXE.exe

Filesize
2.2MB

MD5
bc8beb02ee9be631db9075416957bb26

SHA1
519f801815939b6410ae070e4ba7029eb3749897

SHA256
314a3f485aa8706ff1c32eeb0d081d66dade7e5c67f363688628df6745b528da

SHA512
d03837297f3dbc597e7e2729438e2e8bf5f042032726ecb3c888cd5ef0248a9d97fc3b2de566416c021fcee0d1e9559ca39afa999635607c6e30d96f9c897665

Download Submit
C:\Windows\System\FtzJKnc.exe

Filesize
2.2MB

MD5
11ff4bb6e0efe3064aa83e830acb2734

SHA1
84c0932857656a7685d93a96c12e98731e380222

SHA256
39967ea9daccb21fcf711d55bd21ca27a82f81b4449c0c65afccf9c9af268a39

SHA512
c3d5717fa8e0bb8ee012f30531daf1a607a3213af5818304268f87d6739a9601cb214680f89f4f17f10b2b23f99a60a9f0c7e58a872bf11eee780b8f2874e676

Download Submit
C:\Windows\System\GHtsZhn.exe

Filesize
2.2MB

MD5
dc38dfc2f0b19ce8ea679e807ef2b359

SHA1
52be95190d3f87cfebfd1fb6c2d4f4ec5b248b43

SHA256
5d62d26afa754d82e7816481f10f270958cbb9f19d0e31d22425eec5184e9e4b

SHA512
7c9969197f5ce4baef04c091f58bf718cb4e5364dd99cbc00145cb3759a7116d0e9b6263daa73f90a3efc319ab903feea025f625a1606f1b631993502bd9c387

Download Submit
C:\Windows\System\GbqhRDS.exe

Filesize
2.2MB

MD5
9277bff3565482549cf1470538d89939

SHA1
18c791b5c30442f0d1a2889f17896c4e74ed6ebf

SHA256
84e0b86d3810832f81bd7ac0d7c477db60a16db1eeb94b7c9877a9535159f538

SHA512
a62728295fabf239a03d46afd6007b0dcf1edab0019cb69e387efcca16b05aa197dcc3bea4dde864d9fe68b06461483334e4ed8cf505e41b4fcf7eec02b607f6

Download Submit
C:\Windows\System\GvoPYmM.exe

Filesize
2.2MB

MD5
1bac5db109bacd1ea41ec0d1cb235b9a

SHA1
96ef680422923acd7cb3432e8fd0b772a478efd2

SHA256
27c78598f4b9b44495832ff0bde8bd103f339e5285a05d7eec0692dd72f5a4e5

SHA512
289cbde9efebc18fb3b1117cb9f12f1cfd55d23fe703163e4b51c825461f107cfa5919e6c43624593a15d6808c243197a5bf43e4384a60af240572a49f907267

Download Submit
C:\Windows\System\HIHlMJU.exe

Filesize
2.2MB

MD5
0e10367122578247495c9f0bbdc031bf

SHA1
17d8e465c1bd31c3e02340772c27a7a989354254

SHA256
8bc5da6671b4970633c29645807e5da99b15f5f1f92ce966a043cba3f3a4394d

SHA512
af22b71a13f3847daf99439234060fd2ddad9e05e13a2994899ca3ef9b7dbf3f747451d150b51f076d46125135b72f87532d01d0e217d1b7177f61f0640a9512

Download Submit
C:\Windows\System\HSVAvhE.exe

Filesize
2.2MB

MD5
c6e4329c8cba490a15280f438d92c482

SHA1
5edf9e694e009669ef5aee8a153514428ce7c922

SHA256
c4dabbb672d4e3e8bb10eff5a04ad36d5f960614ee0cd6092efbf511ec304e6d

SHA512
9bf957292be5718cc9e637401cd7d4d5efccfde8b0923f2212d1c7876eb480ed28b9451af1fac4d8ab4a1f0c6cc493afaa60a220434e541ade6268aa20ae060b

Download Submit
C:\Windows\System\JDvuoHQ.exe

Filesize
2.2MB

MD5
4069132d1c1aad8f2db57712048b4989

SHA1
76ee3b2dbb9085de499373d4757cdfa6f3635da7

SHA256
2c633dbac5c94a7aa2d025238ce7d4a07bea943e31ef1fa17a3d92b943216b05

SHA512
6e99cb6c4a00f6562ca7e58bab1227bba57480d3a8b6737c4404fac874bd18a239cbd8b6c8030e0d47eccf7368ab0614903bfe7063fb3310e6f13361a4781a2a

Download Submit
C:\Windows\System\JZjEKRm.exe

Filesize
2.2MB

MD5
0ce52d7cfa45341b1983f7847cbeedf7

SHA1
bf7b114ddd3369f69b1f637eb298eee5bb646309

SHA256
0efc05481d0a983f228a7ceaf9166ba96734a5613868baafec5cbf375de1720d

SHA512
bdf9f7b44ff2680caba48979556fc61a0fa5b4c44aa255380c8922c764f27a34b634144fbdade0fd85aaf79f21cce43653610860b7a8bbd11ce3a6aad3c966c7

Download Submit
C:\Windows\System\KDdRoFj.exe

Filesize
2.2MB

MD5
ee4eb2388fbd7d2972dbc7c38759ecfd

SHA1
5cc6df8d414e5888e2bee2b300dc6930934ebf4e

SHA256
a790d9887a26979054da7c2c9079931e52813872dc065d2f72ad70209ccbe5e3

SHA512
60924a161b6707128e69443a0c9ca7e012c06f4c486427f7411060cc90941c56dc1abad062ba3bcee6030ff978933f6be4ee4b945457d1ba0d84e3e177c5b841

Download Submit
C:\Windows\System\KdZpIpv.exe

Filesize
2.2MB

MD5
0b88bf8402e1789f8686d644e22056f2

SHA1
75d993be058d7ca2f495a69e41c222a7cf49c6fe

SHA256
475385a5db320f6fe25c1d27651975f0fc18db12ee14a273a711f399cde3cb52

SHA512
9dfb0f2d11aa50485823d8a72fa98759deed00e341df9e60e434f7f327e86c18ff00d90d52f1eb9c8ba5d9bfa5f612a085e20e8f74d4f44f490ba27a94107894

Download Submit
C:\Windows\System\LWbjznr.exe

Filesize
2.2MB

MD5
e10ce2bf77d77bbb653331999c77beb3

SHA1
749fe08a8f8ff7ce62c450ffcc9db56856f8bbd3

SHA256
219527b6ea5ccdb5025efb51fcd713dbc23b32adf347cefb952899ca6c67ff44

SHA512
c4a9bf03caaedda061913c1c3216fb8cf53407d1074d9151f6f9da831ba2bb25a0699614a34032960498c0f468b283fa1a0f133488b95ab3b88c41035e92b596

Download Submit
C:\Windows\System\LnkCzia.exe

Filesize
2.2MB

MD5
03d7e500a928fb83e0a947792d8cd757

SHA1
9a3d67b3ddbcc9c81d21b71db33f4d165fbf9fd0

SHA256
a3250d2574f618105bb63d40daad5eabaeac83e745bea37bef3eb71d11232161

SHA512
33e02f61c1377d5a0d193104ae606e609459c9cb7e7ff7b40ab111abf644542546ec1d5c823dbeaf65710a2988daeef76fbec22203bc7de49d974b32541041ab

Download Submit
C:\Windows\System\NaMGkup.exe

Filesize
2.2MB

MD5
44248003e60b821fa61bdd6266e158ee

SHA1
02c7a9a4ed26bdaab73bcdcf53da75510b76b9dc

SHA256
ba6caf2c166914157634d7165a4e469664a3c14ccb0350c2d3b106e2c32c88c9

SHA512
ade4778d521f2eef13d62b47947c2d8ad9a092526d12a2c748aa463d2ff2b1378bfff59050cded957e2a5d99c7fe017dbf0d13c74727ccf2d21d91a26d0fcc44

Download Submit
C:\Windows\System\NazNCSQ.exe

Filesize
2.2MB

MD5
adeea5983009bbd867e72d80987fee7f

SHA1
2f03403f5f8ccdd4499f243e7b265f5253bdab09

SHA256
8e2cca77c15839d6a963c1153a0a9e288b7e1a47d0694dad0fbb8adfb1c55e15

SHA512
80efebd3c4aedf5b76c563889a1bf76fc396d5779ac844ef2134a9e70a5460462f697242cffc5e9a5cef51ed6e7703ca41a95152a914537249b42d587598934e

Download Submit
C:\Windows\System\RBedfnQ.exe

Filesize
2.2MB

MD5
c45965a3f688a1b1e70e4115ee6fe887

SHA1
d0cefd829cc0c7fdc2c280aa6545b41ac608412b

SHA256
f066cc7fcffd2865739d1b39f3d69b8168a663b2736857cc3844c76f226cb00f

SHA512
257bbdea25c53a71b167326e7628a05ba2cf92a373aaa5380775ff76720aaa060593fc8abe1b1d0bb0161a6d0ca1244c4694e6564ef458156dfba6fd6197d0e9

Download Submit
C:\Windows\System\UHVvFsG.exe

Filesize
2.2MB

MD5
5521cf3d263853fe813eaba7048e2ee2

SHA1
bfb1f73ca3d9174660f200affcceb7ababf85698

SHA256
4ab1f6b9fef07fa3b54783b8a9e602fb4a2e45586b0ef1f695e320e4b3e52a56

SHA512
2a8235f1503488c8b40530bf2bde163a4eaa48c40b0e9288f971da8dbcf40704adbc8a8d9caac298bb2c87a67d7bc9bdb996094f6729761fc4ddb4c9c1a05d31

Download Submit
C:\Windows\System\VChyPsG.exe

Filesize
2.2MB

MD5
4c9ae6f529135219fbd5996c07eec434

SHA1
3138fd9cb28c42f8dbacc73c744fb20b9fa08b84

SHA256
5cb0bbb0d54ce9a455d8dc064e5a1f069485db66eb1f7fbd52988d7efae6d5e5

SHA512
e88b47a5c9583227900fecc35f84927b1edbf967a26672d27fa773c6d70617b9394ffd8f4e3578f020095d884fdd5fe7869c5ae9820be8b94fb3f360d2bfa09c

Download Submit
C:\Windows\System\WQFrNLy.exe

Filesize
2.2MB

MD5
aff5e8565fce58a10daa03ed49059079

SHA1
8712478321fab6c6556884b2c566477ca132941d

SHA256
20893a6d17a499059c43524ed7d9b47e868fb8822abe3c141345b52f92c3fc1a

SHA512
43dc6e6d18a10be65bd92d7f9cdd2b793d250da72316706fb20f6ef2bcf74dc8565a528c2e07c36bd82de3bb6ec30e7b7a6890710849c40d5ca2446a1808bb83

Download Submit
C:\Windows\System\ZTDdkmK.exe

Filesize
2.2MB

MD5
9e92691e5895930757bb9acee31f17e8

SHA1
16b47f89cd836ead42910c6cb5fcbba4c4d6c8db

SHA256
a96896361c6933a8f10d582dc0c2b249c9e36e44a2ab088eec0de995a14cfdfa

SHA512
5390b8a177ea656ff0ab1e7d1351f0b689a14984f88a8e2a529dfd71ca93846581e9417e1ab15cd3159a1633c9c197e98d8682234b117a7c96053f02294c6d38

Download Submit
C:\Windows\System\cxxbDPG.exe

Filesize
2.2MB

MD5
ce1b4d5ee94a727ff624f47773ff2495

SHA1
82db1beea318335d5b897ad77ab7ebbdef38175c

SHA256
fbf5376f0e2bdedb3a8a64472dd2a8fe74b066a44a30e3f56de79fe3d5591d66

SHA512
81573d2be307adbfc0e4149b92067c4e1aebaa97ba07d06c854fb24b3eb898264097707a366c6a9682d6283e0109513664d855e9e674c15cefd7392a77c30bd2

Download Submit
C:\Windows\System\eUTkngG.exe

Filesize
2.2MB

MD5
9b72fdbbfa182ff93a2e39260aa18668

SHA1
6aba1941aef2dec4920c8e5f65f059883c8b8490

SHA256
85400f7bffcb8100fad1db75ff2148cd8da7405cb34024573939796cdbd7dc55

SHA512
d7148d01903d3bcd2467e39707ba80a4f98eb40928f6702c96e4e2538fce54dc6ebdb4c7c453df83e45c67ecd607c83eab2127800281ed9029d6fd1fd9f8f20c

Download Submit
C:\Windows\System\kDagYZJ.exe

Filesize
18B

MD5
6fe0013890c63ded4f8ff8d16df87289

SHA1
289a7f6e7968aae7b8549ffdd9b978b9db978f87

SHA256
f199c68e43f0f5c8e50bcae2d18e89d3e5e39dfc93aaed12249762ab112691d0

SHA512
d134172fdc11063e45454e6619b8bda3721fc09f325a67b3b4cca8ebbee69cce74d83053e73b70efdb9a6a1fc832c4bc1df3f3d00e9ae3195b7ef87287e98e09

Download Submit
C:\Windows\System\mPUYJKB.exe

Filesize
8B

MD5
408407fe49e2a1bd1de2fb4f4e1c1e4e

SHA1
6781f0ed16b9f9a0e8a861848782ae1a9b183885

SHA256
413c20c52ba69478c63daee39bcd70926f09cbc71ce3aa1577802440938b324a

SHA512
51204da6f17b6725f4e9b8b9381f34a7ed365926b3780a3bfe9e8d70ab81ec8caad96b3f0838e87a0f0c0c6baeed1ea2ea2f5c7ee1fa6a13b720a1ec69c3f3fd

Download Submit
C:\Windows\System\ndgfEOs.exe

Filesize
2.2MB

MD5
0a5ebdf2ac9d5f5e67dcc90cce850445

SHA1
eb8f87982f0ce94dd78abcd0b281514f2f6f4cc2

SHA256
edcd308ccd8fe95ded481f5d472c406e0a22b99256247c85ae9fc8a3d6cf4be5

SHA512
3dd948017affbfa400314cbfcc02e8edc15de97eecbd9b3afdd03ee426ab1ffca28697ff0578845fc4a3464e300dc08db1c20c1c871a52b95cd80f58a3fcfcd1

Download Submit
C:\Windows\System\qZNzDQj.exe

Filesize
2.2MB

MD5
ce52924f3dd41cc050ec275c53669ab2

SHA1
3abb6594df880de5eea520db55033fa51b93d071

SHA256
680127b7f72faf081ecb7847717ab8399410f70a4c2618c6290ec3ec7910d7c1

SHA512
9cee88f201f0b14c52bc3daa5fcb6b8d80531f9250e1229b5749b2bd84fa4e92f4d2485a8cfecdc06dfe3a5da4d8de6dd718fa976da4c3005aa73316b31029ca

Download Submit
C:\Windows\System\rDtKcvv.exe

Filesize
2.2MB

MD5
3e90c0c9be13042de9719e127cd45cae

SHA1
d4a1e2d6fb7c7ca22adfde11ff309fddc48b9e0d

SHA256
ecdf218dfa6d9e5939f3e3c377d2f55357d5cadc98f53ad4241a8f1c1f37a6d4

SHA512
f7269a1f40547c1ea4e590dfa7fda8949a1d3cdfa5227b9ef50cbe3a7e5cc20c08099dbbf0d9c6ed06d466c822481f091224be2d50ae2601a6bba3e2a2d290a4

Download Submit
C:\Windows\System\rqlhScX.exe

Filesize
2.2MB

MD5
398dc63fb618582f9ca3339ecc00d55c

SHA1
ce5737e4dd9bb734407781961ce5da22e3029ada

SHA256
fd6082a25429adfd61b5fc37e94feff956563a83004cbd70fc7bba96b5f9654f

SHA512
eb6c47d5c8f19ffe96639f0d70de74a37f1e50ee2afc2b45da39cf39cb2e43a9665c67389776bd37d0ac1621493538499a3145ba3cd979666c1bfc8302df01f8

Download Submit
C:\Windows\System\sDmsSDO.exe

Filesize
2.2MB

MD5
d5588fa1e8f18b18851b4df7fded060a

SHA1
39b7fdbced67773cafdd2bca28f1b17435ed19b0

SHA256
a4f0fa1674b43f78dbfdf6a625b462ecd5830e902a3d4d073f4faa84709e6268

SHA512
3f91c428a762867870bce40e4a75e9a5bfcaa134bf34d92c8b6c2a053290cf93987ae07ecbcaea2080652017175425724f9632db01847c3ed4e33259c2b850e2

Download Submit
C:\Windows\System\tNNblWb.exe

Filesize
2.2MB

MD5
f048f0b439131f2ed2f90c638964f90d

SHA1
edc310f2e59ae59049396f9c9798c2e892a7ba29

SHA256
bebb3933627b2b211e7912d6f2fb67a94acfbc837913846a7feeba30baf776a1

SHA512
4cd0a0ead2c6332bd9b5a3ad1630a119395f12b2f0dc84ad1d85b26d0e100462c15b74da9d2e104d9576652918e28b2e24ba971b9c06542d423e9529727f5c1c

Download Submit
C:\Windows\System\tSGtdSv.exe

Filesize
2.2MB

MD5
1197980831806f5453b85b85d806eb7a

SHA1
a5ff64ff2f19d85d57a7e66ed83c051c8999ad08

SHA256
96c1a099e7437b4d466fc2d58fce4fb75d6848f833710825457503775a3f9a33

SHA512
58e4ec9eda165c4567d86d71936be3d5dce881db894598939c426695a47903f459d119db71e22635af22a85590a1db47677922b6565832f0d03c482428a9f112

Download Submit
C:\Windows\System\uBFBqCE.exe

Filesize
2.2MB

MD5
c6051098117c01d135fa78afa43cced3

SHA1
e4b5d89aaf0898b82a01c710db5790f8dfbcd15a

SHA256
d9fdc47126d688705bcde50fdb1882308254518d72216711017a6ea049f63380

SHA512
7e47a727e533e5fe968e5d1dcad7bd04a7fe54a7fd745c8776e41c1f5a25f8b2b4d20a03a155d6cc81c7f2be5730399a929fba0053b18904149774a7de0c1853

Download Submit
C:\Windows\System\wEUxynW.exe

Filesize
2.2MB

MD5
c8a1d08c7ec49077dd54ba5c3cb52a63

SHA1
7ae1c0e45869a2402e6f7bb4cc4b12e1cb2981f3

SHA256
01d64d238ba32ac3f31589e067885f7dbd13290937f0921cee7f982324e9e8b3

SHA512
03b55b7846b8fd9a4193297474435dd2b4c86264afd0ebf7320f435332ae71740324fd95345822b7c5be7cb3a31820c738246c41357632f9748a391893eb89d9

Download Submit
C:\Windows\System\xHwZlsX.exe

Filesize
2.2MB

MD5
33996ea48db9c4ab88ef73ce3967cc54

SHA1
ea126a335df00a1a5651177c7ae72a1f8014a90a

SHA256
0ab6823cb1855e21c12a7f1f0453c890aa52391d134b564c8c58ae8d4e8a9b85

SHA512
8edaacf0069022e74b13e64f5c81a878a4904db71cc434c6365aa5eafdd32f2a18945cba2c6789652237179faae37280e44339e77a120e2bd12831423e699d36

Download Submit
C:\Windows\System\xNmDtdE.exe

Filesize
2.2MB

MD5
acebede19b8f567affee70e208c62d67

SHA1
87b43d946694e50c01ae0c03e5a1f92e0f95779e

SHA256
7abf84176f8e1a30510af81889b44d2f33cc293bc071a555b3be6660570aac08

SHA512
e6236e9ff46181799ccf4b325b79cd4bc63bbb594d332c94f0c54b24da6084d7919c0102dac6d3ab22ff59577bf3831c0c01c95c2fb4076f4cd2e1e197f92ad9

Download Submit
C:\Windows\System\xeUEuQW.exe

Filesize
2.2MB

MD5
7ae8b643d94980a04192334b175d078f

SHA1
6ba56bd8d2c1092ae31cf67dcc2cdc2dd8b347fd

SHA256
6c464ed13710382c1fffc11f83f30d07e2903dd64117a29eb9be1d8800c31442

SHA512
c7c8b7dd72373017ffe6212912d4eeeab46eccf7ff095b6fb292de2cd8ec80432cb29c190b853525a368b2db7d2a4098d095e76f41c50435cc3e4fdcd483c38f

Download Submit
C:\Windows\System\zXCljSJ.exe

Filesize
2.2MB

MD5
72850bb631856245d9db99478488fab7

SHA1
30e74d6b81beeed95b51ef682e74178117d41938

SHA256
ae943a76b69b1c1748510223754a7274ccbe9f437bc1f6ea8a79246ffbefb59d

SHA512
030c80148f51706d0b241afac72e162e18ff320974225b19ec4509a5ba6940973875dad4f196364fd58010dec8d8b45e00d07d3c849c93cd74a9ce6478c16e34

Download Submit
memory/372-423-0x00007FF744500000-0x00007FF7448F2000-memory.dmp

Filesize
3.9MB

Download
memory/372-4848-0x00007FF744500000-0x00007FF7448F2000-memory.dmp

Filesize
3.9MB

Download
memory/440-137-0x00007FF639B90000-0x00007FF639F82000-memory.dmp

Filesize
3.9MB

Download
memory/804-4810-0x00007FF649EB0000-0x00007FF64A2A2000-memory.dmp

Filesize
3.9MB

Download
memory/804-240-0x00007FF649EB0000-0x00007FF64A2A2000-memory.dmp

Filesize
3.9MB

Download
memory/868-75-0x00007FF71B390000-0x00007FF71B782000-memory.dmp

Filesize
3.9MB

Download
memory/1208-4861-0x00007FF6F1400000-0x00007FF6F17F2000-memory.dmp

Filesize
3.9MB

Download
memory/1208-398-0x00007FF6F1400000-0x00007FF6F17F2000-memory.dmp

Filesize
3.9MB

Download
memory/1528-350-0x00007FF75EA50000-0x00007FF75EE42000-memory.dmp

Filesize
3.9MB

Download
memory/1620-0-0x00007FF7B28E0000-0x00007FF7B2CD2000-memory.dmp

Filesize
3.9MB

Download
memory/1620-1-0x0000020B37580000-0x0000020B37590000-memory.dmp

Filesize
64KB

Download
memory/1632-421-0x00007FF61C2F0000-0x00007FF61C6E2000-memory.dmp

Filesize
3.9MB

Download
memory/1632-4787-0x00007FF61C2F0000-0x00007FF61C6E2000-memory.dmp

Filesize
3.9MB

Download
memory/2460-4864-0x00007FF783B80000-0x00007FF783F72000-memory.dmp

Filesize
3.9MB

Download
memory/2460-356-0x00007FF783B80000-0x00007FF783F72000-memory.dmp

Filesize
3.9MB

Download
memory/2684-4853-0x00007FF7D4600000-0x00007FF7D49F2000-memory.dmp

Filesize
3.9MB

Download
memory/2684-347-0x00007FF7D4600000-0x00007FF7D49F2000-memory.dmp

Filesize
3.9MB

Download
memory/2912-4778-0x00007FF6E0D30000-0x00007FF6E1122000-memory.dmp

Filesize
3.9MB

Download
memory/2912-211-0x00007FF6E0D30000-0x00007FF6E1122000-memory.dmp

Filesize
3.9MB

Download
memory/3344-509-0x0000017D7A230000-0x0000017D7A9D6000-memory.dmp

Filesize
7.6MB

Download
memory/3344-10-0x00007FF9B0EF3000-0x00007FF9B0EF5000-memory.dmp

Filesize
8KB

Download
memory/3344-45-0x00007FF9B0EF0000-0x00007FF9B19B1000-memory.dmp

Filesize
10.8MB

Download
memory/3344-168-0x0000017D79380000-0x0000017D793A2000-memory.dmp

Filesize
136KB

Download
memory/3344-407-0x00007FF9B0EF0000-0x00007FF9B19B1000-memory.dmp

Filesize
10.8MB

Download
memory/3384-4815-0x00007FF65F0C0000-0x00007FF65F4B2000-memory.dmp

Filesize
3.9MB

Download
memory/3384-281-0x00007FF65F0C0000-0x00007FF65F4B2000-memory.dmp

Filesize
3.9MB

Download
memory/3584-422-0x00007FF7E2BF0000-0x00007FF7E2FE2000-memory.dmp

Filesize
3.9MB

Download
memory/3584-4843-0x00007FF7E2BF0000-0x00007FF7E2FE2000-memory.dmp

Filesize
3.9MB

Download
memory/3880-418-0x00007FF7D72A0000-0x00007FF7D7692000-memory.dmp

Filesize
3.9MB

Download
memory/3880-4792-0x00007FF7D72A0000-0x00007FF7D7692000-memory.dmp

Filesize
3.9MB

Download
memory/4016-226-0x00007FF640DC0000-0x00007FF6411B2000-memory.dmp

Filesize
3.9MB

Download
memory/4016-4804-0x00007FF640DC0000-0x00007FF6411B2000-memory.dmp

Filesize
3.9MB

Download
memory/4064-4772-0x00007FF6E30E0000-0x00007FF6E34D2000-memory.dmp

Filesize
3.9MB

Download
memory/4064-203-0x00007FF6E30E0000-0x00007FF6E34D2000-memory.dmp

Filesize
3.9MB

Download
memory/4184-296-0x00007FF797280000-0x00007FF797672000-memory.dmp

Filesize
3.9MB

Download
memory/4184-4790-0x00007FF797280000-0x00007FF797672000-memory.dmp

Filesize
3.9MB

Download
memory/4272-60-0x00007FF71D390000-0x00007FF71D782000-memory.dmp

Filesize
3.9MB

Download
memory/4348-4757-0x00007FF795710000-0x00007FF795B02000-memory.dmp

Filesize
3.9MB

Download
memory/4348-176-0x00007FF795710000-0x00007FF795B02000-memory.dmp

Filesize
3.9MB

Download
memory/4376-4832-0x00007FF6818B0000-0x00007FF681CA2000-memory.dmp

Filesize
3.9MB

Download
memory/4376-362-0x00007FF6818B0000-0x00007FF681CA2000-memory.dmp

Filesize
3.9MB

Download
memory/4588-268-0x00007FF6158A0000-0x00007FF615C92000-memory.dmp

Filesize
3.9MB

Download
memory/4588-4760-0x00007FF6158A0000-0x00007FF615C92000-memory.dmp

Filesize
3.9MB

Download
memory/4632-110-0x00007FF6C4B90000-0x00007FF6C4F82000-memory.dmp

Filesize
3.9MB

Download
memory/4632-4754-0x00007FF6C4B90000-0x00007FF6C4F82000-memory.dmp

Filesize
3.9MB

Download
memory/4728-4846-0x00007FF72DF90000-0x00007FF72E382000-memory.dmp

Filesize
3.9MB

Download
memory/4728-263-0x00007FF72DF90000-0x00007FF72E382000-memory.dmp

Filesize
3.9MB

Download
memory/4952-106-0x00007FF700C60000-0x00007FF701052000-memory.dmp

Filesize
3.9MB

Download
memory/5044-210-0x00007FF67F3B0000-0x00007FF67F7A2000-memory.dmp

Filesize
3.9MB

Download
memory/5044-4767-0x00007FF67F3B0000-0x00007FF67F7A2000-memory.dmp

Filesize
3.9MB

Download