xmrig | d3f0df90061a84dba9d37b6868c2eeca4c53f60a28ce448da45f0b52201b0a08

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 14:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
Size

1.4MB
MD5

0ec640803f1b1bc9856fa8b4ce7d7f95
SHA1

58c6c8aae58d40f736f006aed51484acf7a02949
SHA256

d3f0df90061a84dba9d37b6868c2eeca4c53f60a28ce448da45f0b52201b0a08
SHA512

c6601f1b5035392ebe75acef0b16f42e2bff7fb22243c43ea606c509cc191015314a820d5da6cdbc6153ecf99e036ffff5dc8556fd973797c7576c10be7be280
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYKpGncHBN/VxzCk:Lz071uv4BPMkibTIA5CJRL

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 35 IoCs

miner

resource	yara_rule
behavioral2/memory/4964-150-0x00007FF69D5B0000-0x00007FF69D9A2000-memory.dmp	xmrig
behavioral2/memory/2268-83-0x00007FF6EB950000-0x00007FF6EBD42000-memory.dmp	xmrig
behavioral2/memory/4820-514-0x00007FF618A00000-0x00007FF618DF2000-memory.dmp	xmrig
behavioral2/memory/4852-815-0x00007FF794330000-0x00007FF794722000-memory.dmp	xmrig
behavioral2/memory/2028-824-0x00007FF6BD970000-0x00007FF6BDD62000-memory.dmp	xmrig
behavioral2/memory/4844-828-0x00007FF73EC40000-0x00007FF73F032000-memory.dmp	xmrig
behavioral2/memory/2520-827-0x00007FF79FA60000-0x00007FF79FE52000-memory.dmp	xmrig
behavioral2/memory/2864-826-0x00007FF702860000-0x00007FF702C52000-memory.dmp	xmrig
behavioral2/memory/4180-825-0x00007FF729760000-0x00007FF729B52000-memory.dmp	xmrig
behavioral2/memory/3676-823-0x00007FF7AF060000-0x00007FF7AF452000-memory.dmp	xmrig
behavioral2/memory/3196-822-0x00007FF6C39F0000-0x00007FF6C3DE2000-memory.dmp	xmrig
behavioral2/memory/848-821-0x00007FF78DC90000-0x00007FF78E082000-memory.dmp	xmrig
behavioral2/memory/4992-820-0x00007FF6FD7C0000-0x00007FF6FDBB2000-memory.dmp	xmrig
behavioral2/memory/1784-819-0x00007FF776D40000-0x00007FF777132000-memory.dmp	xmrig
behavioral2/memory/1452-818-0x00007FF744780000-0x00007FF744B72000-memory.dmp	xmrig
behavioral2/memory/2276-817-0x00007FF776B40000-0x00007FF776F32000-memory.dmp	xmrig
behavioral2/memory/3692-816-0x00007FF698F50000-0x00007FF699342000-memory.dmp	xmrig
behavioral2/memory/1328-812-0x00007FF650090000-0x00007FF650482000-memory.dmp	xmrig
behavioral2/memory/5088-811-0x00007FF7BB870000-0x00007FF7BBC62000-memory.dmp	xmrig
behavioral2/memory/5092-739-0x00007FF6EF070000-0x00007FF6EF462000-memory.dmp	xmrig
behavioral2/memory/1564-518-0x00007FF77D340000-0x00007FF77D732000-memory.dmp	xmrig
behavioral2/memory/3584-477-0x00007FF6E0A10000-0x00007FF6E0E02000-memory.dmp	xmrig
behavioral2/memory/4892-392-0x00007FF729170000-0x00007FF729562000-memory.dmp	xmrig
behavioral2/memory/4804-387-0x00007FF75AB10000-0x00007FF75AF02000-memory.dmp	xmrig
behavioral2/memory/2520-6534-0x00007FF79FA60000-0x00007FF79FE52000-memory.dmp	xmrig
behavioral2/memory/4820-6549-0x00007FF618A00000-0x00007FF618DF2000-memory.dmp	xmrig
behavioral2/memory/4892-6709-0x00007FF729170000-0x00007FF729562000-memory.dmp	xmrig
behavioral2/memory/1564-6724-0x00007FF77D340000-0x00007FF77D732000-memory.dmp	xmrig
behavioral2/memory/4844-6778-0x00007FF73EC40000-0x00007FF73F032000-memory.dmp	xmrig
behavioral2/memory/4992-6927-0x00007FF6FD7C0000-0x00007FF6FDBB2000-memory.dmp	xmrig
behavioral2/memory/2028-6944-0x00007FF6BD970000-0x00007FF6BDD62000-memory.dmp	xmrig
behavioral2/memory/2864-6958-0x00007FF702860000-0x00007FF702C52000-memory.dmp	xmrig
behavioral2/memory/4180-6959-0x00007FF729760000-0x00007FF729B52000-memory.dmp	xmrig
behavioral2/memory/3676-6965-0x00007FF7AF060000-0x00007FF7AF452000-memory.dmp	xmrig
behavioral2/memory/2276-6956-0x00007FF776B40000-0x00007FF776F32000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4452	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2268	WYObsYL.exe
2520	drnlKuT.exe
4964	ptCCQYJ.exe
4804	hqaeiDh.exe
4892	vuYPCPw.exe
3584	qLxPLEF.exe
4820	vFRmNiQ.exe
1564	zFenayY.exe
5092	wFqbciS.exe
5088	gHlAZLt.exe
1328	NxjqhPW.exe
4852	TQgRrMB.exe
3692	PjsUnEN.exe
4844	RLKIAce.exe
2276	RtlgAQu.exe
1452	WcGiisw.exe
1784	hWLkgZD.exe
4992	djWQWzK.exe
848	GhGnXxT.exe
3196	hTNKPGU.exe
3676	qHZKQua.exe
2028	RjRvzPz.exe
4180	tvTmLkn.exe
2864	sRqnccN.exe
2212	oKIkSae.exe
4348	DjjnHEZ.exe
1584	TmIgUVr.exe
2156	vjUXllt.exe
4720	ALIlkSG.exe
1720	GTDmOpB.exe
980	wchfALM.exe
4320	ZHmjpnp.exe
4496	DKEyzJz.exe
3348	ihEPVgu.exe
3952	uSvUkre.exe
3240	TlSnenr.exe
2304	PehFbVJ.exe
4780	xLxPHJt.exe
408	WGdsSFY.exe
3192	PHahwWc.exe
4008	AbsWHXg.exe
3036	PURuECM.exe
1460	xLvwdYZ.exe
3244	lXpgkri.exe
2488	wfELopJ.exe
1568	mtAptwA.exe
4928	dpgpOAz.exe
4184	tDqbXrs.exe
2668	jijDteM.exe
3640	pufBNaY.exe
2720	EBqfjRi.exe
4544	OuQtrhP.exe
4412	pCfxivp.exe
3436	gZzMQyv.exe
2752	mBhOpEZ.exe
3544	DWsbUwP.exe
3572	qWJRHFJ.exe
1724	HBmDLSl.exe
3524	LagtnkM.exe
672	BWabSjS.exe
840	pZYwctJ.exe
4304	oHKgWmg.exe
2388	rvStsSp.exe
4272	XzDJkbE.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/400-0-0x00007FF648A20000-0x00007FF648E12000-memory.dmp	upx
behavioral2/files/0x000600000002297c-5.dat	upx
behavioral2/files/0x0009000000023380-12.dat	upx
behavioral2/files/0x0008000000023382-7.dat	upx
behavioral2/files/0x0008000000023383-62.dat	upx
behavioral2/files/0x0007000000023437-166.dat	upx
behavioral2/files/0x0007000000023436-165.dat	upx
behavioral2/files/0x000a00000002338c-153.dat	upx
behavioral2/files/0x0007000000023434-152.dat	upx
behavioral2/files/0x000a00000002338a-138.dat	upx
behavioral2/files/0x0008000000023389-135.dat	upx
behavioral2/files/0x0008000000023433-132.dat	upx
behavioral2/files/0x0007000000023442-198.dat	upx
behavioral2/files/0x0009000000023432-197.dat	upx
behavioral2/files/0x00080000000233a7-128.dat	upx
behavioral2/files/0x00080000000233a6-127.dat	upx
behavioral2/files/0x0007000000023441-190.dat	upx
behavioral2/files/0x00080000000233a5-117.dat	upx
behavioral2/files/0x000700000002343b-174.dat	upx
behavioral2/files/0x000d000000023394-105.dat	upx
behavioral2/files/0x0008000000023395-104.dat	upx
behavioral2/files/0x00080000000233a4-103.dat	upx
behavioral2/files/0x00080000000233a3-100.dat	upx
behavioral2/files/0x00080000000233a2-95.dat	upx
behavioral2/files/0x0007000000023435-156.dat	upx
behavioral2/files/0x000800000002339e-89.dat	upx
behavioral2/files/0x000800000002339d-88.dat	upx
behavioral2/memory/4964-150-0x00007FF69D5B0000-0x00007FF69D9A2000-memory.dmp	upx
behavioral2/memory/2268-83-0x00007FF6EB950000-0x00007FF6EBD42000-memory.dmp	upx
behavioral2/files/0x000900000002342d-130.dat	upx
behavioral2/files/0x000800000002339c-78.dat	upx
behavioral2/files/0x0008000000023385-67.dat	upx
behavioral2/files/0x000800000002339b-94.dat	upx
behavioral2/files/0x0008000000023397-93.dat	upx
behavioral2/files/0x0008000000023396-90.dat	upx
behavioral2/files/0x0008000000023388-55.dat	upx
behavioral2/files/0x0008000000023386-71.dat	upx
behavioral2/memory/4820-514-0x00007FF618A00000-0x00007FF618DF2000-memory.dmp	upx
behavioral2/memory/4852-815-0x00007FF794330000-0x00007FF794722000-memory.dmp	upx
behavioral2/memory/2028-824-0x00007FF6BD970000-0x00007FF6BDD62000-memory.dmp	upx
behavioral2/memory/4844-828-0x00007FF73EC40000-0x00007FF73F032000-memory.dmp	upx
behavioral2/memory/2520-827-0x00007FF79FA60000-0x00007FF79FE52000-memory.dmp	upx
behavioral2/memory/2864-826-0x00007FF702860000-0x00007FF702C52000-memory.dmp	upx
behavioral2/memory/4180-825-0x00007FF729760000-0x00007FF729B52000-memory.dmp	upx
behavioral2/memory/3676-823-0x00007FF7AF060000-0x00007FF7AF452000-memory.dmp	upx
behavioral2/memory/3196-822-0x00007FF6C39F0000-0x00007FF6C3DE2000-memory.dmp	upx
behavioral2/memory/848-821-0x00007FF78DC90000-0x00007FF78E082000-memory.dmp	upx
behavioral2/memory/4992-820-0x00007FF6FD7C0000-0x00007FF6FDBB2000-memory.dmp	upx
behavioral2/memory/1784-819-0x00007FF776D40000-0x00007FF777132000-memory.dmp	upx
behavioral2/memory/1452-818-0x00007FF744780000-0x00007FF744B72000-memory.dmp	upx
behavioral2/memory/2276-817-0x00007FF776B40000-0x00007FF776F32000-memory.dmp	upx
behavioral2/memory/3692-816-0x00007FF698F50000-0x00007FF699342000-memory.dmp	upx
behavioral2/memory/1328-812-0x00007FF650090000-0x00007FF650482000-memory.dmp	upx
behavioral2/memory/5088-811-0x00007FF7BB870000-0x00007FF7BBC62000-memory.dmp	upx
behavioral2/memory/5092-739-0x00007FF6EF070000-0x00007FF6EF462000-memory.dmp	upx
behavioral2/memory/1564-518-0x00007FF77D340000-0x00007FF77D732000-memory.dmp	upx
behavioral2/memory/3584-477-0x00007FF6E0A10000-0x00007FF6E0E02000-memory.dmp	upx
behavioral2/memory/4892-392-0x00007FF729170000-0x00007FF729562000-memory.dmp	upx
behavioral2/memory/4804-387-0x00007FF75AB10000-0x00007FF75AF02000-memory.dmp	upx
behavioral2/files/0x0007000000023448-204.dat	upx
behavioral2/files/0x0007000000023447-203.dat	upx
behavioral2/files/0x0007000000023446-202.dat	upx
behavioral2/files/0x0007000000023445-201.dat	upx
behavioral2/files/0x0007000000023444-200.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\yKgwucl.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\YQeYNLN.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\VMqfWMr.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\qJeRaXK.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\hUHCchs.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\aQiAQFe.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\Qaemshh.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\ZnIKyXh.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\BdounNi.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\VynDacz.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\eiyDGGg.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\TLrzkqp.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\okmVeGq.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\gpPWlbb.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\tzTvgRE.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\rMkuVis.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\ljfEZBC.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\zyyvsMz.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\TtvnZWt.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\MvUgPwE.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\GWNgVrV.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\vqhPNQd.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\YudYoHV.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\bzJocNZ.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\fmszJPp.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\qlzQPOX.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\oLXSLhs.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\TCRIoBJ.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\DjdAxvV.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\ouWFznQ.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\oYGVnZq.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\SHOYiQy.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\WVyQKiv.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\cmKSAmz.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\vchYZwp.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\zviWhko.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\fTIIVEe.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\bfMhERm.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\lPhgRGp.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\McnTfXV.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\AWZKare.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\RHIySwj.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\wyTjBAm.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\wdwVzuv.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\nVIJOnt.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\HDaAWlZ.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\gdymqtU.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\xGkUVrG.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\KJQTSGm.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\oONiNjo.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\ifdhsPB.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\OPpFjJe.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\lrjrIVL.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\IDWzLOY.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\DeFokLa.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\EqRbtNA.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\xloWRQi.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\clVxfLR.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\chaynEL.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\ENzVdXW.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\cyeVkdj.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\IWVUxog.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\YNisvrW.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\mBpjIjf.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4452	powershell.exe
4452	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
Token: SeDebugPrivilege	4452	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 400 wrote to memory of 4452	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	85
PID 400 wrote to memory of 4452	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	85
PID 400 wrote to memory of 2268	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	86
PID 400 wrote to memory of 2268	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	86
PID 400 wrote to memory of 2520	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	87
PID 400 wrote to memory of 2520	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	87
PID 400 wrote to memory of 4964	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	88
PID 400 wrote to memory of 4964	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	88
PID 400 wrote to memory of 4804	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	89
PID 400 wrote to memory of 4804	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	89
PID 400 wrote to memory of 4892	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	90
PID 400 wrote to memory of 4892	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	90
PID 400 wrote to memory of 3584	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	91
PID 400 wrote to memory of 3584	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	91
PID 400 wrote to memory of 4820	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	92
PID 400 wrote to memory of 4820	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	92
PID 400 wrote to memory of 4852	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	93
PID 400 wrote to memory of 4852	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	93
PID 400 wrote to memory of 1564	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	94
PID 400 wrote to memory of 1564	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	94
PID 400 wrote to memory of 5092	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	95
PID 400 wrote to memory of 5092	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	95
PID 400 wrote to memory of 5088	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	96
PID 400 wrote to memory of 5088	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	96
PID 400 wrote to memory of 1328	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	97
PID 400 wrote to memory of 1328	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	97
PID 400 wrote to memory of 3692	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	98
PID 400 wrote to memory of 3692	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	98
PID 400 wrote to memory of 1784	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	99
PID 400 wrote to memory of 1784	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	99
PID 400 wrote to memory of 4992	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	100
PID 400 wrote to memory of 4992	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	100
PID 400 wrote to memory of 4844	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	101
PID 400 wrote to memory of 4844	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	101
PID 400 wrote to memory of 2276	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	102
PID 400 wrote to memory of 2276	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	102
PID 400 wrote to memory of 1452	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	103
PID 400 wrote to memory of 1452	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	103
PID 400 wrote to memory of 848	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	104
PID 400 wrote to memory of 848	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	104
PID 400 wrote to memory of 3196	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	105
PID 400 wrote to memory of 3196	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	105
PID 400 wrote to memory of 3676	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	106
PID 400 wrote to memory of 3676	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	106
PID 400 wrote to memory of 2028	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	107
PID 400 wrote to memory of 2028	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	107
PID 400 wrote to memory of 4180	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	108
PID 400 wrote to memory of 4180	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	108
PID 400 wrote to memory of 2864	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	109
PID 400 wrote to memory of 2864	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	109
PID 400 wrote to memory of 2212	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	110
PID 400 wrote to memory of 2212	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	110
PID 400 wrote to memory of 4008	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	111
PID 400 wrote to memory of 4008	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	111
PID 400 wrote to memory of 4348	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	112
PID 400 wrote to memory of 4348	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	112
PID 400 wrote to memory of 1584	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	113
PID 400 wrote to memory of 1584	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	113
PID 400 wrote to memory of 2156	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	114
PID 400 wrote to memory of 2156	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	114
PID 400 wrote to memory of 4720	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	115
PID 400 wrote to memory of 4720	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	115
PID 400 wrote to memory of 1720	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	116
PID 400 wrote to memory of 1720	400	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4452
- C:\Windows\System\WYObsYL.exe
  C:\Windows\System\WYObsYL.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\drnlKuT.exe
  C:\Windows\System\drnlKuT.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\ptCCQYJ.exe
  C:\Windows\System\ptCCQYJ.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\hqaeiDh.exe
  C:\Windows\System\hqaeiDh.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\vuYPCPw.exe
  C:\Windows\System\vuYPCPw.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\qLxPLEF.exe
  C:\Windows\System\qLxPLEF.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\vFRmNiQ.exe
  C:\Windows\System\vFRmNiQ.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\TQgRrMB.exe
  C:\Windows\System\TQgRrMB.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\zFenayY.exe
  C:\Windows\System\zFenayY.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\wFqbciS.exe
  C:\Windows\System\wFqbciS.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\gHlAZLt.exe
  C:\Windows\System\gHlAZLt.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\NxjqhPW.exe
  C:\Windows\System\NxjqhPW.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\PjsUnEN.exe
  C:\Windows\System\PjsUnEN.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\hWLkgZD.exe
  C:\Windows\System\hWLkgZD.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\djWQWzK.exe
  C:\Windows\System\djWQWzK.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\RLKIAce.exe
  C:\Windows\System\RLKIAce.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\RtlgAQu.exe
  C:\Windows\System\RtlgAQu.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\WcGiisw.exe
  C:\Windows\System\WcGiisw.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\GhGnXxT.exe
  C:\Windows\System\GhGnXxT.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\hTNKPGU.exe
  C:\Windows\System\hTNKPGU.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\qHZKQua.exe
  C:\Windows\System\qHZKQua.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System\RjRvzPz.exe
  C:\Windows\System\RjRvzPz.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\tvTmLkn.exe
  C:\Windows\System\tvTmLkn.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\sRqnccN.exe
  C:\Windows\System\sRqnccN.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\oKIkSae.exe
  C:\Windows\System\oKIkSae.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\AbsWHXg.exe
  C:\Windows\System\AbsWHXg.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\DjjnHEZ.exe
  C:\Windows\System\DjjnHEZ.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\TmIgUVr.exe
  C:\Windows\System\TmIgUVr.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\vjUXllt.exe
  C:\Windows\System\vjUXllt.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\ALIlkSG.exe
  C:\Windows\System\ALIlkSG.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\GTDmOpB.exe
  C:\Windows\System\GTDmOpB.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\wchfALM.exe
  C:\Windows\System\wchfALM.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\ZHmjpnp.exe
  C:\Windows\System\ZHmjpnp.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\DKEyzJz.exe
  C:\Windows\System\DKEyzJz.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\ihEPVgu.exe
  C:\Windows\System\ihEPVgu.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\uSvUkre.exe
  C:\Windows\System\uSvUkre.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\TlSnenr.exe
  C:\Windows\System\TlSnenr.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\PehFbVJ.exe
  C:\Windows\System\PehFbVJ.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\xLxPHJt.exe
  C:\Windows\System\xLxPHJt.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\WGdsSFY.exe
  C:\Windows\System\WGdsSFY.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\PHahwWc.exe
  C:\Windows\System\PHahwWc.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\PURuECM.exe
  C:\Windows\System\PURuECM.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\xLvwdYZ.exe
  C:\Windows\System\xLvwdYZ.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\lXpgkri.exe
  C:\Windows\System\lXpgkri.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\wfELopJ.exe
  C:\Windows\System\wfELopJ.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\mtAptwA.exe
  C:\Windows\System\mtAptwA.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\dpgpOAz.exe
  C:\Windows\System\dpgpOAz.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\tDqbXrs.exe
  C:\Windows\System\tDqbXrs.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\jijDteM.exe
  C:\Windows\System\jijDteM.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\pufBNaY.exe
  C:\Windows\System\pufBNaY.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\EBqfjRi.exe
  C:\Windows\System\EBqfjRi.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\OuQtrhP.exe
  C:\Windows\System\OuQtrhP.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\pCfxivp.exe
  C:\Windows\System\pCfxivp.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\gZzMQyv.exe
  C:\Windows\System\gZzMQyv.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\mBhOpEZ.exe
  C:\Windows\System\mBhOpEZ.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\DWsbUwP.exe
  C:\Windows\System\DWsbUwP.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\qWJRHFJ.exe
  C:\Windows\System\qWJRHFJ.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\HBmDLSl.exe
  C:\Windows\System\HBmDLSl.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\LagtnkM.exe
  C:\Windows\System\LagtnkM.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\BWabSjS.exe
  C:\Windows\System\BWabSjS.exe
  2⤵
  - Executes dropped EXE
  PID:672
- C:\Windows\System\pZYwctJ.exe
  C:\Windows\System\pZYwctJ.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\oHKgWmg.exe
  C:\Windows\System\oHKgWmg.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\CYjTTxn.exe
  C:\Windows\System\CYjTTxn.exe
  2⤵
  PID:1496
- C:\Windows\System\rvStsSp.exe
  C:\Windows\System\rvStsSp.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\ontzXhx.exe
  C:\Windows\System\ontzXhx.exe
  2⤵
  PID:4276
- C:\Windows\System\XzDJkbE.exe
  C:\Windows\System\XzDJkbE.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\xylRnzR.exe
  C:\Windows\System\xylRnzR.exe
  2⤵
  PID:4696
- C:\Windows\System\WjILIMa.exe
  C:\Windows\System\WjILIMa.exe
  2⤵
  PID:3256
- C:\Windows\System\LxqmaFK.exe
  C:\Windows\System\LxqmaFK.exe
  2⤵
  PID:3212
- C:\Windows\System\zHiyBjy.exe
  C:\Windows\System\zHiyBjy.exe
  2⤵
  PID:3708
- C:\Windows\System\pVMXVxI.exe
  C:\Windows\System\pVMXVxI.exe
  2⤵
  PID:2084
- C:\Windows\System\tQKxcXJ.exe
  C:\Windows\System\tQKxcXJ.exe
  2⤵
  PID:3504
- C:\Windows\System\ICkAstz.exe
  C:\Windows\System\ICkAstz.exe
  2⤵
  PID:5080
- C:\Windows\System\tffDWNc.exe
  C:\Windows\System\tffDWNc.exe
  2⤵
  PID:4812
- C:\Windows\System\zMKgEmZ.exe
  C:\Windows\System\zMKgEmZ.exe
  2⤵
  PID:1736
- C:\Windows\System\ElxyncL.exe
  C:\Windows\System\ElxyncL.exe
  2⤵
  PID:4548
- C:\Windows\System\wJzXOtx.exe
  C:\Windows\System\wJzXOtx.exe
  2⤵
  PID:1628
- C:\Windows\System\reBcxJF.exe
  C:\Windows\System\reBcxJF.exe
  2⤵
  PID:1420
- C:\Windows\System\bjVZPOd.exe
  C:\Windows\System\bjVZPOd.exe
  2⤵
  PID:968
- C:\Windows\System\ItGPTtc.exe
  C:\Windows\System\ItGPTtc.exe
  2⤵
  PID:1176
- C:\Windows\System\AzGAjkX.exe
  C:\Windows\System\AzGAjkX.exe
  2⤵
  PID:2312
- C:\Windows\System\vDsbVVL.exe
  C:\Windows\System\vDsbVVL.exe
  2⤵
  PID:5136
- C:\Windows\System\vkzvJSj.exe
  C:\Windows\System\vkzvJSj.exe
  2⤵
  PID:5156
- C:\Windows\System\BwpXnnK.exe
  C:\Windows\System\BwpXnnK.exe
  2⤵
  PID:5184
- C:\Windows\System\HAZeNjJ.exe
  C:\Windows\System\HAZeNjJ.exe
  2⤵
  PID:5208
- C:\Windows\System\alfEpVY.exe
  C:\Windows\System\alfEpVY.exe
  2⤵
  PID:5224
- C:\Windows\System\sbwjrnj.exe
  C:\Windows\System\sbwjrnj.exe
  2⤵
  PID:5276
- C:\Windows\System\JZvReXv.exe
  C:\Windows\System\JZvReXv.exe
  2⤵
  PID:5304
- C:\Windows\System\miELRte.exe
  C:\Windows\System\miELRte.exe
  2⤵
  PID:5320
- C:\Windows\System\uVtIMmV.exe
  C:\Windows\System\uVtIMmV.exe
  2⤵
  PID:5340
- C:\Windows\System\ycIqsbY.exe
  C:\Windows\System\ycIqsbY.exe
  2⤵
  PID:5360
- C:\Windows\System\nNZwaJR.exe
  C:\Windows\System\nNZwaJR.exe
  2⤵
  PID:5380
- C:\Windows\System\TUhslWA.exe
  C:\Windows\System\TUhslWA.exe
  2⤵
  PID:5396
- C:\Windows\System\bbvDMDQ.exe
  C:\Windows\System\bbvDMDQ.exe
  2⤵
  PID:5416
- C:\Windows\System\RmPZfHL.exe
  C:\Windows\System\RmPZfHL.exe
  2⤵
  PID:5436
- C:\Windows\System\UYUbLzr.exe
  C:\Windows\System\UYUbLzr.exe
  2⤵
  PID:5464
- C:\Windows\System\zMBrAof.exe
  C:\Windows\System\zMBrAof.exe
  2⤵
  PID:5480
- C:\Windows\System\tGkwlHJ.exe
  C:\Windows\System\tGkwlHJ.exe
  2⤵
  PID:5504
- C:\Windows\System\GuxlxQU.exe
  C:\Windows\System\GuxlxQU.exe
  2⤵
  PID:5520
- C:\Windows\System\bZkDPrc.exe
  C:\Windows\System\bZkDPrc.exe
  2⤵
  PID:5544
- C:\Windows\System\puDyZEQ.exe
  C:\Windows\System\puDyZEQ.exe
  2⤵
  PID:5560
- C:\Windows\System\PlyxlAm.exe
  C:\Windows\System\PlyxlAm.exe
  2⤵
  PID:5584
- C:\Windows\System\oMCbBCM.exe
  C:\Windows\System\oMCbBCM.exe
  2⤵
  PID:5600
- C:\Windows\System\gPwGgGC.exe
  C:\Windows\System\gPwGgGC.exe
  2⤵
  PID:5616
- C:\Windows\System\pMidAne.exe
  C:\Windows\System\pMidAne.exe
  2⤵
  PID:5644
- C:\Windows\System\WFAhZYp.exe
  C:\Windows\System\WFAhZYp.exe
  2⤵
  PID:5660
- C:\Windows\System\OyWpSOV.exe
  C:\Windows\System\OyWpSOV.exe
  2⤵
  PID:5680
- C:\Windows\System\iElkPFi.exe
  C:\Windows\System\iElkPFi.exe
  2⤵
  PID:5696
- C:\Windows\System\uNLsALX.exe
  C:\Windows\System\uNLsALX.exe
  2⤵
  PID:5720
- C:\Windows\System\EantXOU.exe
  C:\Windows\System\EantXOU.exe
  2⤵
  PID:5736
- C:\Windows\System\qJPrMLT.exe
  C:\Windows\System\qJPrMLT.exe
  2⤵
  PID:5760
- C:\Windows\System\afOClni.exe
  C:\Windows\System\afOClni.exe
  2⤵
  PID:5788
- C:\Windows\System\myfFgVC.exe
  C:\Windows\System\myfFgVC.exe
  2⤵
  PID:5808
- C:\Windows\System\pVGVxvw.exe
  C:\Windows\System\pVGVxvw.exe
  2⤵
  PID:5840
- C:\Windows\System\abjdGGv.exe
  C:\Windows\System\abjdGGv.exe
  2⤵
  PID:5864
- C:\Windows\System\upgcjCe.exe
  C:\Windows\System\upgcjCe.exe
  2⤵
  PID:5880
- C:\Windows\System\hdXyxGO.exe
  C:\Windows\System\hdXyxGO.exe
  2⤵
  PID:5904
- C:\Windows\System\tusGpAo.exe
  C:\Windows\System\tusGpAo.exe
  2⤵
  PID:5920
- C:\Windows\System\vOTdbNc.exe
  C:\Windows\System\vOTdbNc.exe
  2⤵
  PID:5944
- C:\Windows\System\EVlLcYj.exe
  C:\Windows\System\EVlLcYj.exe
  2⤵
  PID:5960
- C:\Windows\System\pfCczJQ.exe
  C:\Windows\System\pfCczJQ.exe
  2⤵
  PID:5988
- C:\Windows\System\uZRlvwR.exe
  C:\Windows\System\uZRlvwR.exe
  2⤵
  PID:6008
- C:\Windows\System\ohfJran.exe
  C:\Windows\System\ohfJran.exe
  2⤵
  PID:6024
- C:\Windows\System\WvtGyKX.exe
  C:\Windows\System\WvtGyKX.exe
  2⤵
  PID:6048
- C:\Windows\System\iyrURLJ.exe
  C:\Windows\System\iyrURLJ.exe
  2⤵
  PID:6068
- C:\Windows\System\BYzSkEp.exe
  C:\Windows\System\BYzSkEp.exe
  2⤵
  PID:6088
- C:\Windows\System\XmbzILm.exe
  C:\Windows\System\XmbzILm.exe
  2⤵
  PID:6112
- C:\Windows\System\eNcCOFc.exe
  C:\Windows\System\eNcCOFc.exe
  2⤵
  PID:1740
- C:\Windows\System\NzEQHtk.exe
  C:\Windows\System\NzEQHtk.exe
  2⤵
  PID:1980
- C:\Windows\System\JTLwAFs.exe
  C:\Windows\System\JTLwAFs.exe
  2⤵
  PID:4736
- C:\Windows\System\hsqFYnY.exe
  C:\Windows\System\hsqFYnY.exe
  2⤵
  PID:4456
- C:\Windows\System\GtYTjBM.exe
  C:\Windows\System\GtYTjBM.exe
  2⤵
  PID:4424
- C:\Windows\System\rsWugZe.exe
  C:\Windows\System\rsWugZe.exe
  2⤵
  PID:4512
- C:\Windows\System\iACsDGg.exe
  C:\Windows\System\iACsDGg.exe
  2⤵
  PID:1808
- C:\Windows\System\dwiXJoJ.exe
  C:\Windows\System\dwiXJoJ.exe
  2⤵
  PID:2324
- C:\Windows\System\LxlxOhF.exe
  C:\Windows\System\LxlxOhF.exe
  2⤵
  PID:2176
- C:\Windows\System\eBJTTLw.exe
  C:\Windows\System\eBJTTLw.exe
  2⤵
  PID:1332
- C:\Windows\System\apZqmaQ.exe
  C:\Windows\System\apZqmaQ.exe
  2⤵
  PID:5116
- C:\Windows\System\SVvKQWt.exe
  C:\Windows\System\SVvKQWt.exe
  2⤵
  PID:2000
- C:\Windows\System\lDwiZIT.exe
  C:\Windows\System\lDwiZIT.exe
  2⤵
  PID:436
- C:\Windows\System\GvufrsN.exe
  C:\Windows\System\GvufrsN.exe
  2⤵
  PID:4764
- C:\Windows\System\uEunlqT.exe
  C:\Windows\System\uEunlqT.exe
  2⤵
  PID:5284
- C:\Windows\System\rlLFgNN.exe
  C:\Windows\System\rlLFgNN.exe
  2⤵
  PID:624
- C:\Windows\System\mHsLIFa.exe
  C:\Windows\System\mHsLIFa.exe
  2⤵
  PID:5576
- C:\Windows\System\ddeIdTK.exe
  C:\Windows\System\ddeIdTK.exe
  2⤵
  PID:6156
- C:\Windows\System\sawpDbF.exe
  C:\Windows\System\sawpDbF.exe
  2⤵
  PID:6172
- C:\Windows\System\sCVjtAm.exe
  C:\Windows\System\sCVjtAm.exe
  2⤵
  PID:6192
- C:\Windows\System\QbUrbJC.exe
  C:\Windows\System\QbUrbJC.exe
  2⤵
  PID:6216
- C:\Windows\System\FJLLnFC.exe
  C:\Windows\System\FJLLnFC.exe
  2⤵
  PID:6244
- C:\Windows\System\dlwnyPJ.exe
  C:\Windows\System\dlwnyPJ.exe
  2⤵
  PID:6264
- C:\Windows\System\uYshvFM.exe
  C:\Windows\System\uYshvFM.exe
  2⤵
  PID:6288
- C:\Windows\System\CoyXicM.exe
  C:\Windows\System\CoyXicM.exe
  2⤵
  PID:6308
- C:\Windows\System\CQPZfHb.exe
  C:\Windows\System\CQPZfHb.exe
  2⤵
  PID:6324
- C:\Windows\System\LajPaUw.exe
  C:\Windows\System\LajPaUw.exe
  2⤵
  PID:6376
- C:\Windows\System\ltafzoO.exe
  C:\Windows\System\ltafzoO.exe
  2⤵
  PID:6392
- C:\Windows\System\inpmcJk.exe
  C:\Windows\System\inpmcJk.exe
  2⤵
  PID:6420
- C:\Windows\System\YwkCcsZ.exe
  C:\Windows\System\YwkCcsZ.exe
  2⤵
  PID:6436
- C:\Windows\System\RNKgdrj.exe
  C:\Windows\System\RNKgdrj.exe
  2⤵
  PID:6452
- C:\Windows\System\JHGeLoL.exe
  C:\Windows\System\JHGeLoL.exe
  2⤵
  PID:6468
- C:\Windows\System\VDpwslZ.exe
  C:\Windows\System\VDpwslZ.exe
  2⤵
  PID:6492
- C:\Windows\System\aYLKfID.exe
  C:\Windows\System\aYLKfID.exe
  2⤵
  PID:6508
- C:\Windows\System\rVFyKKv.exe
  C:\Windows\System\rVFyKKv.exe
  2⤵
  PID:6532
- C:\Windows\System\vzKjXlB.exe
  C:\Windows\System\vzKjXlB.exe
  2⤵
  PID:6552
- C:\Windows\System\hvQsqEn.exe
  C:\Windows\System\hvQsqEn.exe
  2⤵
  PID:6568
- C:\Windows\System\SDqWCLo.exe
  C:\Windows\System\SDqWCLo.exe
  2⤵
  PID:6592
- C:\Windows\System\lNJgrXt.exe
  C:\Windows\System\lNJgrXt.exe
  2⤵
  PID:6620
- C:\Windows\System\xzVbPGf.exe
  C:\Windows\System\xzVbPGf.exe
  2⤵
  PID:6640
- C:\Windows\System\uzTMsUj.exe
  C:\Windows\System\uzTMsUj.exe
  2⤵
  PID:6660
- C:\Windows\System\pglDNHB.exe
  C:\Windows\System\pglDNHB.exe
  2⤵
  PID:6676
- C:\Windows\System\VgFZQUh.exe
  C:\Windows\System\VgFZQUh.exe
  2⤵
  PID:6700
- C:\Windows\System\wRqOGNU.exe
  C:\Windows\System\wRqOGNU.exe
  2⤵
  PID:6720
- C:\Windows\System\svtfDnM.exe
  C:\Windows\System\svtfDnM.exe
  2⤵
  PID:6736
- C:\Windows\System\jPPSKzg.exe
  C:\Windows\System\jPPSKzg.exe
  2⤵
  PID:6756
- C:\Windows\System\VRWSSMK.exe
  C:\Windows\System\VRWSSMK.exe
  2⤵
  PID:6776
- C:\Windows\System\ZmZwBOY.exe
  C:\Windows\System\ZmZwBOY.exe
  2⤵
  PID:6796
- C:\Windows\System\mCWqwdv.exe
  C:\Windows\System\mCWqwdv.exe
  2⤵
  PID:6816
- C:\Windows\System\egGOyMB.exe
  C:\Windows\System\egGOyMB.exe
  2⤵
  PID:6836
- C:\Windows\System\GLeFrKs.exe
  C:\Windows\System\GLeFrKs.exe
  2⤵
  PID:6860
- C:\Windows\System\zxOPDNM.exe
  C:\Windows\System\zxOPDNM.exe
  2⤵
  PID:6876
- C:\Windows\System\jvfdnfa.exe
  C:\Windows\System\jvfdnfa.exe
  2⤵
  PID:6900
- C:\Windows\System\dkTiLUn.exe
  C:\Windows\System\dkTiLUn.exe
  2⤵
  PID:6916
- C:\Windows\System\DEtbKWe.exe
  C:\Windows\System\DEtbKWe.exe
  2⤵
  PID:6940
- C:\Windows\System\xMBDttk.exe
  C:\Windows\System\xMBDttk.exe
  2⤵
  PID:5732
- C:\Windows\System\NwosZSm.exe
  C:\Windows\System\NwosZSm.exe
  2⤵
  PID:4392
- C:\Windows\System\OmfdkKz.exe
  C:\Windows\System\OmfdkKz.exe
  2⤵
  PID:4692
- C:\Windows\System\JtOxxJI.exe
  C:\Windows\System\JtOxxJI.exe
  2⤵
  PID:4420
- C:\Windows\System\FXISFWQ.exe
  C:\Windows\System\FXISFWQ.exe
  2⤵
  PID:2456
- C:\Windows\System\WJOXVAh.exe
  C:\Windows\System\WJOXVAh.exe
  2⤵
  PID:2492
- C:\Windows\System\anKABek.exe
  C:\Windows\System\anKABek.exe
  2⤵
  PID:964
- C:\Windows\System\zOMuzqW.exe
  C:\Windows\System\zOMuzqW.exe
  2⤵
  PID:5628
- C:\Windows\System\fltqgUW.exe
  C:\Windows\System\fltqgUW.exe
  2⤵
  PID:976
- C:\Windows\System\kvPDmWK.exe
  C:\Windows\System\kvPDmWK.exe
  2⤵
  PID:3260
- C:\Windows\System\UNmdCFY.exe
  C:\Windows\System\UNmdCFY.exe
  2⤵
  PID:6320
- C:\Windows\System\DKNhRtH.exe
  C:\Windows\System\DKNhRtH.exe
  2⤵
  PID:5196
- C:\Windows\System\akgOCJe.exe
  C:\Windows\System\akgOCJe.exe
  2⤵
  PID:5248
- C:\Windows\System\gZIiPxb.exe
  C:\Windows\System\gZIiPxb.exe
  2⤵
  PID:4380
- C:\Windows\System\fKPScna.exe
  C:\Windows\System\fKPScna.exe
  2⤵
  PID:5428
- C:\Windows\System\nPVFBhc.exe
  C:\Windows\System\nPVFBhc.exe
  2⤵
  PID:5392
- C:\Windows\System\gXTuVyj.exe
  C:\Windows\System\gXTuVyj.exe
  2⤵
  PID:5444
- C:\Windows\System\NUyObkb.exe
  C:\Windows\System\NUyObkb.exe
  2⤵
  PID:6560
- C:\Windows\System\zxBtiem.exe
  C:\Windows\System\zxBtiem.exe
  2⤵
  PID:6444
- C:\Windows\System\XyAnsJk.exe
  C:\Windows\System\XyAnsJk.exe
  2⤵
  PID:6184
- C:\Windows\System\miibPor.exe
  C:\Windows\System\miibPor.exe
  2⤵
  PID:6208
- C:\Windows\System\pHhwnEr.exe
  C:\Windows\System\pHhwnEr.exe
  2⤵
  PID:6748
- C:\Windows\System\PYfHGBA.exe
  C:\Windows\System\PYfHGBA.exe
  2⤵
  PID:5476
- C:\Windows\System\MIqQeOf.exe
  C:\Windows\System\MIqQeOf.exe
  2⤵
  PID:5512
- C:\Windows\System\hNcTWjb.exe
  C:\Windows\System\hNcTWjb.exe
  2⤵
  PID:5612
- C:\Windows\System\JIXPjmz.exe
  C:\Windows\System\JIXPjmz.exe
  2⤵
  PID:6180
- C:\Windows\System\YSJGHqN.exe
  C:\Windows\System\YSJGHqN.exe
  2⤵
  PID:5672
- C:\Windows\System\dwxIKia.exe
  C:\Windows\System\dwxIKia.exe
  2⤵
  PID:5712
- C:\Windows\System\WcMvQfg.exe
  C:\Windows\System\WcMvQfg.exe
  2⤵
  PID:7172
- C:\Windows\System\AXfVDSG.exe
  C:\Windows\System\AXfVDSG.exe
  2⤵
  PID:7196
- C:\Windows\System\rGqYUtP.exe
  C:\Windows\System\rGqYUtP.exe
  2⤵
  PID:7216
- C:\Windows\System\SqMFHBs.exe
  C:\Windows\System\SqMFHBs.exe
  2⤵
  PID:7232
- C:\Windows\System\RLTzrXD.exe
  C:\Windows\System\RLTzrXD.exe
  2⤵
  PID:7256
- C:\Windows\System\bqNisiw.exe
  C:\Windows\System\bqNisiw.exe
  2⤵
  PID:7272
- C:\Windows\System\BwdiOdB.exe
  C:\Windows\System\BwdiOdB.exe
  2⤵
  PID:7296
- C:\Windows\System\wsKuLzr.exe
  C:\Windows\System\wsKuLzr.exe
  2⤵
  PID:7316
- C:\Windows\System\whBYgrs.exe
  C:\Windows\System\whBYgrs.exe
  2⤵
  PID:7336
- C:\Windows\System\fRYuedR.exe
  C:\Windows\System\fRYuedR.exe
  2⤵
  PID:7360
- C:\Windows\System\tZoZZEy.exe
  C:\Windows\System\tZoZZEy.exe
  2⤵
  PID:7380
- C:\Windows\System\oEgMpnv.exe
  C:\Windows\System\oEgMpnv.exe
  2⤵
  PID:7404
- C:\Windows\System\oBwqTuE.exe
  C:\Windows\System\oBwqTuE.exe
  2⤵
  PID:7428
- C:\Windows\System\dTyyYYH.exe
  C:\Windows\System\dTyyYYH.exe
  2⤵
  PID:7496
- C:\Windows\System\AtFAvQs.exe
  C:\Windows\System\AtFAvQs.exe
  2⤵
  PID:7516
- C:\Windows\System\ZgDdhPA.exe
  C:\Windows\System\ZgDdhPA.exe
  2⤵
  PID:7536
- C:\Windows\System\jQhOTgJ.exe
  C:\Windows\System\jQhOTgJ.exe
  2⤵
  PID:7556
- C:\Windows\System\uJTwhUn.exe
  C:\Windows\System\uJTwhUn.exe
  2⤵
  PID:7576
- C:\Windows\System\kfhiWgs.exe
  C:\Windows\System\kfhiWgs.exe
  2⤵
  PID:7596
- C:\Windows\System\tWIeKFB.exe
  C:\Windows\System\tWIeKFB.exe
  2⤵
  PID:7616
- C:\Windows\System\xAsxFCk.exe
  C:\Windows\System\xAsxFCk.exe
  2⤵
  PID:7636
- C:\Windows\System\EmMXOwf.exe
  C:\Windows\System\EmMXOwf.exe
  2⤵
  PID:7656
- C:\Windows\System\WgiJqXd.exe
  C:\Windows\System\WgiJqXd.exe
  2⤵
  PID:7676
- C:\Windows\System\IjGymtl.exe
  C:\Windows\System\IjGymtl.exe
  2⤵
  PID:7700
- C:\Windows\System\RjTBsqC.exe
  C:\Windows\System\RjTBsqC.exe
  2⤵
  PID:7716
- C:\Windows\System\EjQkXNH.exe
  C:\Windows\System\EjQkXNH.exe
  2⤵
  PID:7740
- C:\Windows\System\hwdVrYk.exe
  C:\Windows\System\hwdVrYk.exe
  2⤵
  PID:7756
- C:\Windows\System\sOYrkaQ.exe
  C:\Windows\System\sOYrkaQ.exe
  2⤵
  PID:7780
- C:\Windows\System\OUigeUy.exe
  C:\Windows\System\OUigeUy.exe
  2⤵
  PID:7796
- C:\Windows\System\HJcGWFc.exe
  C:\Windows\System\HJcGWFc.exe
  2⤵
  PID:7820
- C:\Windows\System\MzptlHh.exe
  C:\Windows\System\MzptlHh.exe
  2⤵
  PID:7840
- C:\Windows\System\ItUybKr.exe
  C:\Windows\System\ItUybKr.exe
  2⤵
  PID:7860
- C:\Windows\System\puiCPhD.exe
  C:\Windows\System\puiCPhD.exe
  2⤵
  PID:7880
- C:\Windows\System\eSkVQMH.exe
  C:\Windows\System\eSkVQMH.exe
  2⤵
  PID:7896
- C:\Windows\System\JOJUjav.exe
  C:\Windows\System\JOJUjav.exe
  2⤵
  PID:7920
- C:\Windows\System\fYsmoji.exe
  C:\Windows\System\fYsmoji.exe
  2⤵
  PID:7936
- C:\Windows\System\CENgMdp.exe
  C:\Windows\System\CENgMdp.exe
  2⤵
  PID:7960
- C:\Windows\System\ifkhcpo.exe
  C:\Windows\System\ifkhcpo.exe
  2⤵
  PID:7976
- C:\Windows\System\JuOtBKo.exe
  C:\Windows\System\JuOtBKo.exe
  2⤵
  PID:7996
- C:\Windows\System\MkIspiu.exe
  C:\Windows\System\MkIspiu.exe
  2⤵
  PID:8016
- C:\Windows\System\XCFklLZ.exe
  C:\Windows\System\XCFklLZ.exe
  2⤵
  PID:8044
- C:\Windows\System\sIPbpxs.exe
  C:\Windows\System\sIPbpxs.exe
  2⤵
  PID:8064
- C:\Windows\System\LXLxbPa.exe
  C:\Windows\System\LXLxbPa.exe
  2⤵
  PID:8084
- C:\Windows\System\zebpZgp.exe
  C:\Windows\System\zebpZgp.exe
  2⤵
  PID:8100
- C:\Windows\System\lCbLhpw.exe
  C:\Windows\System\lCbLhpw.exe
  2⤵
  PID:8124
- C:\Windows\System\LwrkFUf.exe
  C:\Windows\System\LwrkFUf.exe
  2⤵
  PID:8144
- C:\Windows\System\ZZkYaBG.exe
  C:\Windows\System\ZZkYaBG.exe
  2⤵
  PID:8160
- C:\Windows\System\dpcOhji.exe
  C:\Windows\System\dpcOhji.exe
  2⤵
  PID:8180
- C:\Windows\System\DdjLrdg.exe
  C:\Windows\System\DdjLrdg.exe
  2⤵
  PID:5832
- C:\Windows\System\ETuwiYw.exe
  C:\Windows\System\ETuwiYw.exe
  2⤵
  PID:5896
- C:\Windows\System\TxFOqaF.exe
  C:\Windows\System\TxFOqaF.exe
  2⤵
  PID:5928
- C:\Windows\System\qHrosYY.exe
  C:\Windows\System\qHrosYY.exe
  2⤵
  PID:5956
- C:\Windows\System\AlQLhLm.exe
  C:\Windows\System\AlQLhLm.exe
  2⤵
  PID:6000
- C:\Windows\System\LwvsOIB.exe
  C:\Windows\System\LwvsOIB.exe
  2⤵
  PID:6044
- C:\Windows\System\ybUSdAI.exe
  C:\Windows\System\ybUSdAI.exe
  2⤵
  PID:6096
- C:\Windows\System\hoMgBhD.exe
  C:\Windows\System\hoMgBhD.exe
  2⤵
  PID:4588
- C:\Windows\System\lOmuUgF.exe
  C:\Windows\System\lOmuUgF.exe
  2⤵
  PID:912
- C:\Windows\System\qwJIdPA.exe
  C:\Windows\System\qwJIdPA.exe
  2⤵
  PID:6768
- C:\Windows\System\pxtYwzK.exe
  C:\Windows\System\pxtYwzK.exe
  2⤵
  PID:6844
- C:\Windows\System\wCGrCJE.exe
  C:\Windows\System\wCGrCJE.exe
  2⤵
  PID:4540
- C:\Windows\System\BGVQbRu.exe
  C:\Windows\System\BGVQbRu.exe
  2⤵
  PID:6828
- C:\Windows\System\whYIwgX.exe
  C:\Windows\System\whYIwgX.exe
  2⤵
  PID:2480
- C:\Windows\System\WUieGIO.exe
  C:\Windows\System\WUieGIO.exe
  2⤵
  PID:4932
- C:\Windows\System\qSvYXDO.exe
  C:\Windows\System\qSvYXDO.exe
  2⤵
  PID:6984
- C:\Windows\System\gFIBsYp.exe
  C:\Windows\System\gFIBsYp.exe
  2⤵
  PID:8208
- C:\Windows\System\ONwnoOU.exe
  C:\Windows\System\ONwnoOU.exe
  2⤵
  PID:8232
- C:\Windows\System\lmLOLPW.exe
  C:\Windows\System\lmLOLPW.exe
  2⤵
  PID:8248
- C:\Windows\System\GZemImM.exe
  C:\Windows\System\GZemImM.exe
  2⤵
  PID:8272
- C:\Windows\System\joRfTZK.exe
  C:\Windows\System\joRfTZK.exe
  2⤵
  PID:8296
- C:\Windows\System\kdeuVeI.exe
  C:\Windows\System\kdeuVeI.exe
  2⤵
  PID:8316
- C:\Windows\System\RBKhJXs.exe
  C:\Windows\System\RBKhJXs.exe
  2⤵
  PID:8332
- C:\Windows\System\ChvnmnN.exe
  C:\Windows\System\ChvnmnN.exe
  2⤵
  PID:8348
- C:\Windows\System\UhxFQLQ.exe
  C:\Windows\System\UhxFQLQ.exe
  2⤵
  PID:8376
- C:\Windows\System\WeuFwcC.exe
  C:\Windows\System\WeuFwcC.exe
  2⤵
  PID:8396
- C:\Windows\System\WglAkqJ.exe
  C:\Windows\System\WglAkqJ.exe
  2⤵
  PID:8424
- C:\Windows\System\qVVGmGs.exe
  C:\Windows\System\qVVGmGs.exe
  2⤵
  PID:8444
- C:\Windows\System\BFBBUuu.exe
  C:\Windows\System\BFBBUuu.exe
  2⤵
  PID:8468
- C:\Windows\System\aSxAdpX.exe
  C:\Windows\System\aSxAdpX.exe
  2⤵
  PID:8484
- C:\Windows\System\QneoHsy.exe
  C:\Windows\System\QneoHsy.exe
  2⤵
  PID:8500
- C:\Windows\System\bjGlmZA.exe
  C:\Windows\System\bjGlmZA.exe
  2⤵
  PID:8520
- C:\Windows\System\EokdZcg.exe
  C:\Windows\System\EokdZcg.exe
  2⤵
  PID:8536
- C:\Windows\System\ZSRvpfw.exe
  C:\Windows\System\ZSRvpfw.exe
  2⤵
  PID:8556
- C:\Windows\System\XzGPzuK.exe
  C:\Windows\System\XzGPzuK.exe
  2⤵
  PID:8832
- C:\Windows\System\XqKKQwW.exe
  C:\Windows\System\XqKKQwW.exe
  2⤵
  PID:8848
- C:\Windows\System\yGuGLmq.exe
  C:\Windows\System\yGuGLmq.exe
  2⤵
  PID:8864
- C:\Windows\System\epmfOZq.exe
  C:\Windows\System\epmfOZq.exe
  2⤵
  PID:8880
- C:\Windows\System\yDbJnHv.exe
  C:\Windows\System\yDbJnHv.exe
  2⤵
  PID:8896
- C:\Windows\System\omdLZok.exe
  C:\Windows\System\omdLZok.exe
  2⤵
  PID:8912
- C:\Windows\System\GlyPgoj.exe
  C:\Windows\System\GlyPgoj.exe
  2⤵
  PID:8928
- C:\Windows\System\LthkHOr.exe
  C:\Windows\System\LthkHOr.exe
  2⤵
  PID:8944
- C:\Windows\System\vFXltLQ.exe
  C:\Windows\System\vFXltLQ.exe
  2⤵
  PID:8960
- C:\Windows\System\FcIFvnj.exe
  C:\Windows\System\FcIFvnj.exe
  2⤵
  PID:8976
- C:\Windows\System\OMSSUKV.exe
  C:\Windows\System\OMSSUKV.exe
  2⤵
  PID:8992
- C:\Windows\System\cMnvKaT.exe
  C:\Windows\System\cMnvKaT.exe
  2⤵
  PID:9008
- C:\Windows\System\psWbjuL.exe
  C:\Windows\System\psWbjuL.exe
  2⤵
  PID:9024
- C:\Windows\System\BzOUGsc.exe
  C:\Windows\System\BzOUGsc.exe
  2⤵
  PID:9040
- C:\Windows\System\XgjiIzu.exe
  C:\Windows\System\XgjiIzu.exe
  2⤵
  PID:9056
- C:\Windows\System\IDNbAUV.exe
  C:\Windows\System\IDNbAUV.exe
  2⤵
  PID:9072
- C:\Windows\System\xgEqdHr.exe
  C:\Windows\System\xgEqdHr.exe
  2⤵
  PID:9088
- C:\Windows\System\WOXsFNm.exe
  C:\Windows\System\WOXsFNm.exe
  2⤵
  PID:9104
- C:\Windows\System\Vipjmwz.exe
  C:\Windows\System\Vipjmwz.exe
  2⤵
  PID:9124
- C:\Windows\System\LhpLeiV.exe
  C:\Windows\System\LhpLeiV.exe
  2⤵
  PID:9144
- C:\Windows\System\LklUuJR.exe
  C:\Windows\System\LklUuJR.exe
  2⤵
  PID:9160
- C:\Windows\System\wvPJTeI.exe
  C:\Windows\System\wvPJTeI.exe
  2⤵
  PID:9176
- C:\Windows\System\sAciguR.exe
  C:\Windows\System\sAciguR.exe
  2⤵
  PID:9204
- C:\Windows\System\IKGRiyk.exe
  C:\Windows\System\IKGRiyk.exe
  2⤵
  PID:1948
- C:\Windows\System\YiEuDNA.exe
  C:\Windows\System\YiEuDNA.exe
  2⤵
  PID:6908
- C:\Windows\System\OoOSIBw.exe
  C:\Windows\System\OoOSIBw.exe
  2⤵
  PID:2036
- C:\Windows\System\pFsLVee.exe
  C:\Windows\System\pFsLVee.exe
  2⤵
  PID:7012
- C:\Windows\System\alAHdkH.exe
  C:\Windows\System\alAHdkH.exe
  2⤵
  PID:7128
- C:\Windows\System\wrwZBYI.exe
  C:\Windows\System\wrwZBYI.exe
  2⤵
  PID:3548
- C:\Windows\System\oTjQvmf.exe
  C:\Windows\System\oTjQvmf.exe
  2⤵
  PID:3152
- C:\Windows\System\rZwBuyQ.exe
  C:\Windows\System\rZwBuyQ.exe
  2⤵
  PID:4296
- C:\Windows\System\GKEkFEh.exe
  C:\Windows\System\GKEkFEh.exe
  2⤵
  PID:5148
- C:\Windows\System\jOswPjH.exe
  C:\Windows\System\jOswPjH.exe
  2⤵
  PID:5404
- C:\Windows\System\LBkdyJq.exe
  C:\Windows\System\LBkdyJq.exe
  2⤵
  PID:5528
- C:\Windows\System\eMzYiFf.exe
  C:\Windows\System\eMzYiFf.exe
  2⤵
  PID:7240
- C:\Windows\System\hTJarna.exe
  C:\Windows\System\hTJarna.exe
  2⤵
  PID:7392
- C:\Windows\System\LWzdMNs.exe
  C:\Windows\System\LWzdMNs.exe
  2⤵
  PID:7480
- C:\Windows\System\WYpJTbC.exe
  C:\Windows\System\WYpJTbC.exe
  2⤵
  PID:7572
- C:\Windows\System\xqTxfNN.exe
  C:\Windows\System\xqTxfNN.exe
  2⤵
  PID:7724
- C:\Windows\System\ySBvrSf.exe
  C:\Windows\System\ySBvrSf.exe
  2⤵
  PID:7984
- C:\Windows\System\nuUqXbT.exe
  C:\Windows\System\nuUqXbT.exe
  2⤵
  PID:8176
- C:\Windows\System\HhktTsq.exe
  C:\Windows\System\HhktTsq.exe
  2⤵
  PID:8344
- C:\Windows\System\oJFAJyR.exe
  C:\Windows\System\oJFAJyR.exe
  2⤵
  PID:8412
- C:\Windows\System\XCZxvwN.exe
  C:\Windows\System\XCZxvwN.exe
  2⤵
  PID:8440
- C:\Windows\System\tAkWZTE.exe
  C:\Windows\System\tAkWZTE.exe
  2⤵
  PID:8492
- C:\Windows\System\cbaLTCx.exe
  C:\Windows\System\cbaLTCx.exe
  2⤵
  PID:8528
- C:\Windows\System\SOyjnzO.exe
  C:\Windows\System\SOyjnzO.exe
  2⤵
  PID:9220
- C:\Windows\System\LthqEmn.exe
  C:\Windows\System\LthqEmn.exe
  2⤵
  PID:9244
- C:\Windows\System\YecEYyh.exe
  C:\Windows\System\YecEYyh.exe
  2⤵
  PID:9260
- C:\Windows\System\YCNRyDE.exe
  C:\Windows\System\YCNRyDE.exe
  2⤵
  PID:9280
- C:\Windows\System\vGmikeD.exe
  C:\Windows\System\vGmikeD.exe
  2⤵
  PID:9296
- C:\Windows\System\ZjDeTMW.exe
  C:\Windows\System\ZjDeTMW.exe
  2⤵
  PID:9316
- C:\Windows\System\AHaLwhQ.exe
  C:\Windows\System\AHaLwhQ.exe
  2⤵
  PID:9332
- C:\Windows\System\LJgfLBm.exe
  C:\Windows\System\LJgfLBm.exe
  2⤵
  PID:9360
- C:\Windows\System\vdLoCoU.exe
  C:\Windows\System\vdLoCoU.exe
  2⤵
  PID:9376
- C:\Windows\System\LcPziLV.exe
  C:\Windows\System\LcPziLV.exe
  2⤵
  PID:9396
- C:\Windows\System\zYYQJBQ.exe
  C:\Windows\System\zYYQJBQ.exe
  2⤵
  PID:9416
- C:\Windows\System\VLpzzlO.exe
  C:\Windows\System\VLpzzlO.exe
  2⤵
  PID:9432
- C:\Windows\System\oSmyVrJ.exe
  C:\Windows\System\oSmyVrJ.exe
  2⤵
  PID:9452
- C:\Windows\System\rgkGdUD.exe
  C:\Windows\System\rgkGdUD.exe
  2⤵
  PID:9468
- C:\Windows\System\CrGjyDp.exe
  C:\Windows\System\CrGjyDp.exe
  2⤵
  PID:9488
- C:\Windows\System\yxrlBdb.exe
  C:\Windows\System\yxrlBdb.exe
  2⤵
  PID:9508
- C:\Windows\System\tYxhtOi.exe
  C:\Windows\System\tYxhtOi.exe
  2⤵
  PID:9524
- C:\Windows\System\mQbtQKy.exe
  C:\Windows\System\mQbtQKy.exe
  2⤵
  PID:9548
- C:\Windows\System\JTHZXNP.exe
  C:\Windows\System\JTHZXNP.exe
  2⤵
  PID:9564
- C:\Windows\System\LPepfhI.exe
  C:\Windows\System\LPepfhI.exe
  2⤵
  PID:9808
- C:\Windows\System\qmvpeZV.exe
  C:\Windows\System\qmvpeZV.exe
  2⤵
  PID:9824
- C:\Windows\System\gQtsYAU.exe
  C:\Windows\System\gQtsYAU.exe
  2⤵
  PID:9844
- C:\Windows\System\NnzbwaN.exe
  C:\Windows\System\NnzbwaN.exe
  2⤵
  PID:9864
- C:\Windows\System\wtlhjJF.exe
  C:\Windows\System\wtlhjJF.exe
  2⤵
  PID:9880
- C:\Windows\System\UjqfKwj.exe
  C:\Windows\System\UjqfKwj.exe
  2⤵
  PID:9896
- C:\Windows\System\rQyGPLw.exe
  C:\Windows\System\rQyGPLw.exe
  2⤵
  PID:9920
- C:\Windows\System\pZvUSkP.exe
  C:\Windows\System\pZvUSkP.exe
  2⤵
  PID:9936
- C:\Windows\System\EMgXuUQ.exe
  C:\Windows\System\EMgXuUQ.exe
  2⤵
  PID:9956
- C:\Windows\System\fuxjOHG.exe
  C:\Windows\System\fuxjOHG.exe
  2⤵
  PID:9972
- C:\Windows\System\JDXFxFS.exe
  C:\Windows\System\JDXFxFS.exe
  2⤵
  PID:9992
- C:\Windows\System\TbnXSIl.exe
  C:\Windows\System\TbnXSIl.exe
  2⤵
  PID:10012
- C:\Windows\System\mYWCzkF.exe
  C:\Windows\System\mYWCzkF.exe
  2⤵
  PID:10028
- C:\Windows\System\oMBSUbE.exe
  C:\Windows\System\oMBSUbE.exe
  2⤵
  PID:10048
- C:\Windows\System\AhuQwgN.exe
  C:\Windows\System\AhuQwgN.exe
  2⤵
  PID:10068
- C:\Windows\System\hKklplt.exe
  C:\Windows\System\hKklplt.exe
  2⤵
  PID:10084
- C:\Windows\System\zlwBvdn.exe
  C:\Windows\System\zlwBvdn.exe
  2⤵
  PID:10100
- C:\Windows\System\iFohdXK.exe
  C:\Windows\System\iFohdXK.exe
  2⤵
  PID:10120
- C:\Windows\System\knYemEZ.exe
  C:\Windows\System\knYemEZ.exe
  2⤵
  PID:10140
- C:\Windows\System\HznRnlM.exe
  C:\Windows\System\HznRnlM.exe
  2⤵
  PID:10160
- C:\Windows\System\UdDWfDU.exe
  C:\Windows\System\UdDWfDU.exe
  2⤵
  PID:10176
- C:\Windows\System\CVEcBeQ.exe
  C:\Windows\System\CVEcBeQ.exe
  2⤵
  PID:10196
- C:\Windows\System\mxJaWrh.exe
  C:\Windows\System\mxJaWrh.exe
  2⤵
  PID:10216
- C:\Windows\System\ppPoddg.exe
  C:\Windows\System\ppPoddg.exe
  2⤵
  PID:10232
- C:\Windows\System\vbArPed.exe
  C:\Windows\System\vbArPed.exe
  2⤵
  PID:6732
- C:\Windows\System\rRUKmuO.exe
  C:\Windows\System\rRUKmuO.exe
  2⤵
  PID:6976
- C:\Windows\System\FxeCcRr.exe
  C:\Windows\System\FxeCcRr.exe
  2⤵
  PID:7120
- C:\Windows\System\larJNvY.exe
  C:\Windows\System\larJNvY.exe
  2⤵
  PID:6712
- C:\Windows\System\CqVWIvI.exe
  C:\Windows\System\CqVWIvI.exe
  2⤵
  PID:10252
- C:\Windows\System\sZpPQdc.exe
  C:\Windows\System\sZpPQdc.exe
  2⤵
  PID:10272
- C:\Windows\System\enpOZPU.exe
  C:\Windows\System\enpOZPU.exe
  2⤵
  PID:10288
- C:\Windows\System\oogSapo.exe
  C:\Windows\System\oogSapo.exe
  2⤵
  PID:10304
- C:\Windows\System\ehteFvx.exe
  C:\Windows\System\ehteFvx.exe
  2⤵
  PID:10400
- C:\Windows\System\DUGCmyM.exe
  C:\Windows\System\DUGCmyM.exe
  2⤵
  PID:10592
- C:\Windows\System\vtJhvmC.exe
  C:\Windows\System\vtJhvmC.exe
  2⤵
  PID:10692
- C:\Windows\System\uHYPTCF.exe
  C:\Windows\System\uHYPTCF.exe
  2⤵
  PID:10716
- C:\Windows\System\cVMEwCP.exe
  C:\Windows\System\cVMEwCP.exe
  2⤵
  PID:10736
- C:\Windows\System\otphMgZ.exe
  C:\Windows\System\otphMgZ.exe
  2⤵
  PID:10752
- C:\Windows\System\YvDZNBy.exe
  C:\Windows\System\YvDZNBy.exe
  2⤵
  PID:10768
- C:\Windows\System\JGgYZAb.exe
  C:\Windows\System\JGgYZAb.exe
  2⤵
  PID:10784
- C:\Windows\System\jJqKQDl.exe
  C:\Windows\System\jJqKQDl.exe
  2⤵
  PID:10800
- C:\Windows\System\AWLGrEK.exe
  C:\Windows\System\AWLGrEK.exe
  2⤵
  PID:10816
- C:\Windows\System\KXUvIOY.exe
  C:\Windows\System\KXUvIOY.exe
  2⤵
  PID:10832
- C:\Windows\System\bJswQYz.exe
  C:\Windows\System\bJswQYz.exe
  2⤵
  PID:10848
- C:\Windows\System\FQSsZaQ.exe
  C:\Windows\System\FQSsZaQ.exe
  2⤵
  PID:10868
- C:\Windows\System\rrwFHXN.exe
  C:\Windows\System\rrwFHXN.exe
  2⤵
  PID:10884
- C:\Windows\System\iOMpNSr.exe
  C:\Windows\System\iOMpNSr.exe
  2⤵
  PID:10908
- C:\Windows\System\ORPYLbz.exe
  C:\Windows\System\ORPYLbz.exe
  2⤵
  PID:10924
- C:\Windows\System\TIKDQHS.exe
  C:\Windows\System\TIKDQHS.exe
  2⤵
  PID:10944
- C:\Windows\System\eOmnQPZ.exe
  C:\Windows\System\eOmnQPZ.exe
  2⤵
  PID:10964
- C:\Windows\System\icSPUro.exe
  C:\Windows\System\icSPUro.exe
  2⤵
  PID:10984
- C:\Windows\System\UgqLLSB.exe
  C:\Windows\System\UgqLLSB.exe
  2⤵
  PID:11004
- C:\Windows\System\xGPxqdK.exe
  C:\Windows\System\xGPxqdK.exe
  2⤵
  PID:11024
- C:\Windows\System\DANjFoG.exe
  C:\Windows\System\DANjFoG.exe
  2⤵
  PID:11040
- C:\Windows\System\yUorheh.exe
  C:\Windows\System\yUorheh.exe
  2⤵
  PID:11060
- C:\Windows\System\wbrkgCG.exe
  C:\Windows\System\wbrkgCG.exe
  2⤵
  PID:11076
- C:\Windows\System\PXheUky.exe
  C:\Windows\System\PXheUky.exe
  2⤵
  PID:11096
- C:\Windows\System\dZxChjF.exe
  C:\Windows\System\dZxChjF.exe
  2⤵
  PID:11112
- C:\Windows\System\kzpJicK.exe
  C:\Windows\System\kzpJicK.exe
  2⤵
  PID:11132
- C:\Windows\System\DZZIaKB.exe
  C:\Windows\System\DZZIaKB.exe
  2⤵
  PID:11148
- C:\Windows\System\cvoNrfC.exe
  C:\Windows\System\cvoNrfC.exe
  2⤵
  PID:11172
- C:\Windows\System\WzfOLKz.exe
  C:\Windows\System\WzfOLKz.exe
  2⤵
  PID:11188
- C:\Windows\System\uALBMpp.exe
  C:\Windows\System\uALBMpp.exe
  2⤵
  PID:11208
- C:\Windows\System\TqyvYPc.exe
  C:\Windows\System\TqyvYPc.exe
  2⤵
  PID:11228
- C:\Windows\System\ZxefJDT.exe
  C:\Windows\System\ZxefJDT.exe
  2⤵
  PID:11244
- C:\Windows\System\vvvXkgN.exe
  C:\Windows\System\vvvXkgN.exe
  2⤵
  PID:5676
- C:\Windows\System\fnlpEtS.exe
  C:\Windows\System\fnlpEtS.exe
  2⤵
  PID:8360
- C:\Windows\System\BVuYNNR.exe
  C:\Windows\System\BVuYNNR.exe
  2⤵
  PID:8496
- C:\Windows\System\XTGwbfe.exe
  C:\Windows\System\XTGwbfe.exe
  2⤵
  PID:9268
- C:\Windows\System\aUbvGGz.exe
  C:\Windows\System\aUbvGGz.exe
  2⤵
  PID:9344
- C:\Windows\System\yFXXATm.exe
  C:\Windows\System\yFXXATm.exe
  2⤵
  PID:9384
- C:\Windows\System\HNvFFCM.exe
  C:\Windows\System\HNvFFCM.exe
  2⤵
  PID:9544
- C:\Windows\System\OFTrppl.exe
  C:\Windows\System\OFTrppl.exe
  2⤵
  PID:9580
- C:\Windows\System\PNHnQkj.exe
  C:\Windows\System\PNHnQkj.exe
  2⤵
  PID:2052
- C:\Windows\System\WhQshir.exe
  C:\Windows\System\WhQshir.exe
  2⤵
  PID:6896
- C:\Windows\System\oTHDlZB.exe
  C:\Windows\System\oTHDlZB.exe
  2⤵
  PID:10280
- C:\Windows\System\wpTRFBF.exe
  C:\Windows\System\wpTRFBF.exe
  2⤵
  PID:7876
- C:\Windows\System\XlYjGgd.exe
  C:\Windows\System\XlYjGgd.exe
  2⤵
  PID:7892
- C:\Windows\System\ZOVAZIN.exe
  C:\Windows\System\ZOVAZIN.exe
  2⤵
  PID:7992
- C:\Windows\System\WnxcXZq.exe
  C:\Windows\System\WnxcXZq.exe
  2⤵
  PID:10568
- C:\Windows\System\yWdIUqG.exe
  C:\Windows\System\yWdIUqG.exe
  2⤵
  PID:8156
- C:\Windows\System\FGqifeD.exe
  C:\Windows\System\FGqifeD.exe
  2⤵
  PID:6020
- C:\Windows\System\mozFrUY.exe
  C:\Windows\System\mozFrUY.exe
  2⤵
  PID:6752
- C:\Windows\System\YBrVUbc.exe
  C:\Windows\System\YBrVUbc.exe
  2⤵
  PID:10732
- C:\Windows\System\LfMIBxs.exe
  C:\Windows\System\LfMIBxs.exe
  2⤵
  PID:11268
- C:\Windows\System\AGlbPAq.exe
  C:\Windows\System\AGlbPAq.exe
  2⤵
  PID:11288
- C:\Windows\System\LJLqiTs.exe
  C:\Windows\System\LJLqiTs.exe
  2⤵
  PID:11320
- C:\Windows\System\nULDpvo.exe
  C:\Windows\System\nULDpvo.exe
  2⤵
  PID:11336
- C:\Windows\System\CEcaGbr.exe
  C:\Windows\System\CEcaGbr.exe
  2⤵
  PID:11356
- C:\Windows\System\vbPzXmH.exe
  C:\Windows\System\vbPzXmH.exe
  2⤵
  PID:11372
- C:\Windows\System\EhNJNoN.exe
  C:\Windows\System\EhNJNoN.exe
  2⤵
  PID:11396
- C:\Windows\System\MWyoNiF.exe
  C:\Windows\System\MWyoNiF.exe
  2⤵
  PID:11412
- C:\Windows\System\xzTiaiY.exe
  C:\Windows\System\xzTiaiY.exe
  2⤵
  PID:11432
- C:\Windows\System\dIHGDOT.exe
  C:\Windows\System\dIHGDOT.exe
  2⤵
  PID:11452
- C:\Windows\System\FZNHotE.exe
  C:\Windows\System\FZNHotE.exe
  2⤵
  PID:11472
- C:\Windows\System\QdVcrdo.exe
  C:\Windows\System\QdVcrdo.exe
  2⤵
  PID:11488
- C:\Windows\System\EXQJQEs.exe
  C:\Windows\System\EXQJQEs.exe
  2⤵
  PID:11504
- C:\Windows\System\SXzjXKT.exe
  C:\Windows\System\SXzjXKT.exe
  2⤵
  PID:11520
- C:\Windows\System\GwisYoV.exe
  C:\Windows\System\GwisYoV.exe
  2⤵
  PID:11536
- C:\Windows\System\cFdfGfU.exe
  C:\Windows\System\cFdfGfU.exe
  2⤵
  PID:11560
- C:\Windows\System\OdvvPTj.exe
  C:\Windows\System\OdvvPTj.exe
  2⤵
  PID:11580
- C:\Windows\System\oUJRoRg.exe
  C:\Windows\System\oUJRoRg.exe
  2⤵
  PID:11600
- C:\Windows\System\XNZJXfb.exe
  C:\Windows\System\XNZJXfb.exe
  2⤵
  PID:11624
- C:\Windows\System\EqxHxHm.exe
  C:\Windows\System\EqxHxHm.exe
  2⤵
  PID:11644
- C:\Windows\System\hYqCVqB.exe
  C:\Windows\System\hYqCVqB.exe
  2⤵
  PID:11668
- C:\Windows\System\HMBfJMU.exe
  C:\Windows\System\HMBfJMU.exe
  2⤵
  PID:11684
- C:\Windows\System\ZvPqrdN.exe
  C:\Windows\System\ZvPqrdN.exe
  2⤵
  PID:11704
- C:\Windows\System\TBnsnCj.exe
  C:\Windows\System\TBnsnCj.exe
  2⤵
  PID:11724
- C:\Windows\System\bJwlxYa.exe
  C:\Windows\System\bJwlxYa.exe
  2⤵
  PID:11740
- C:\Windows\System\azQcKFM.exe
  C:\Windows\System\azQcKFM.exe
  2⤵
  PID:11756
- C:\Windows\System\LRjVFic.exe
  C:\Windows\System\LRjVFic.exe
  2⤵
  PID:11772
- C:\Windows\System\tAWXNqg.exe
  C:\Windows\System\tAWXNqg.exe
  2⤵
  PID:11788
- C:\Windows\System\NHegBIu.exe
  C:\Windows\System\NHegBIu.exe
  2⤵
  PID:11804
- C:\Windows\System\OwOnRsg.exe
  C:\Windows\System\OwOnRsg.exe
  2⤵
  PID:11820
- C:\Windows\System\kRGxjoN.exe
  C:\Windows\System\kRGxjoN.exe
  2⤵
  PID:11836
- C:\Windows\System\LmwKaCI.exe
  C:\Windows\System\LmwKaCI.exe
  2⤵
  PID:11852
- C:\Windows\System\rejLQbh.exe
  C:\Windows\System\rejLQbh.exe
  2⤵
  PID:11868
- C:\Windows\System\zThuPtA.exe
  C:\Windows\System\zThuPtA.exe
  2⤵
  PID:11884
- C:\Windows\System\YpTCnQG.exe
  C:\Windows\System\YpTCnQG.exe
  2⤵
  PID:11900
- C:\Windows\System\haPhBoP.exe
  C:\Windows\System\haPhBoP.exe
  2⤵
  PID:11916
- C:\Windows\System\LpvQRaG.exe
  C:\Windows\System\LpvQRaG.exe
  2⤵
  PID:11932
- C:\Windows\System\RCoBufq.exe
  C:\Windows\System\RCoBufq.exe
  2⤵
  PID:12076
- C:\Windows\System\VxLJGmI.exe
  C:\Windows\System\VxLJGmI.exe
  2⤵
  PID:12092
- C:\Windows\System\pJztOIv.exe
  C:\Windows\System\pJztOIv.exe
  2⤵
  PID:12116
- C:\Windows\System\vxHLuvn.exe
  C:\Windows\System\vxHLuvn.exe
  2⤵
  PID:12140
- C:\Windows\System\XXGDLoT.exe
  C:\Windows\System\XXGDLoT.exe
  2⤵
  PID:12156
- C:\Windows\System\nFfDHvp.exe
  C:\Windows\System\nFfDHvp.exe
  2⤵
  PID:12180
- C:\Windows\System\KVCKIyE.exe
  C:\Windows\System\KVCKIyE.exe
  2⤵
  PID:12204
- C:\Windows\System\GtVnowE.exe
  C:\Windows\System\GtVnowE.exe
  2⤵
  PID:12224
- C:\Windows\System\jKTsrem.exe
  C:\Windows\System\jKTsrem.exe
  2⤵
  PID:12248
- C:\Windows\System\VVOCmvW.exe
  C:\Windows\System\VVOCmvW.exe
  2⤵
  PID:12264
- C:\Windows\System\HoZUWAC.exe
  C:\Windows\System\HoZUWAC.exe
  2⤵
  PID:10900
- C:\Windows\System\jRUPtzO.exe
  C:\Windows\System\jRUPtzO.exe
  2⤵
  PID:9356
- C:\Windows\System\IJEUNpt.exe
  C:\Windows\System\IJEUNpt.exe
  2⤵
  PID:9388
- C:\Windows\System\nkqXMvV.exe
  C:\Windows\System\nkqXMvV.exe
  2⤵
  PID:11088
- C:\Windows\System\qkVmpKV.exe
  C:\Windows\System\qkVmpKV.exe
  2⤵
  PID:11124
- C:\Windows\System\RwquIJU.exe
  C:\Windows\System\RwquIJU.exe
  2⤵
  PID:8844
- C:\Windows\System\didhGZC.exe
  C:\Windows\System\didhGZC.exe
  2⤵
  PID:8892
- C:\Windows\System\bHOTjUY.exe
  C:\Windows\System\bHOTjUY.exe
  2⤵
  PID:8920
- C:\Windows\System\bJNIojN.exe
  C:\Windows\System\bJNIojN.exe
  2⤵
  PID:8968
- C:\Windows\System\itJRicM.exe
  C:\Windows\System\itJRicM.exe
  2⤵
  PID:9000
- C:\Windows\System\tJZVyDp.exe
  C:\Windows\System\tJZVyDp.exe
  2⤵
  PID:9048
- C:\Windows\System\ZrHWOXD.exe
  C:\Windows\System\ZrHWOXD.exe
  2⤵
  PID:9096
- C:\Windows\System\eAHAQGL.exe
  C:\Windows\System\eAHAQGL.exe
  2⤵
  PID:9140
- C:\Windows\System\Holyaxa.exe
  C:\Windows\System\Holyaxa.exe
  2⤵
  PID:9200
- C:\Windows\System\zVzxqIM.exe
  C:\Windows\System\zVzxqIM.exe
  2⤵
  PID:6588
- C:\Windows\System\DtQdfaL.exe
  C:\Windows\System\DtQdfaL.exe
  2⤵
  PID:6612
- C:\Windows\System\sjrnyyp.exe
  C:\Windows\System\sjrnyyp.exe
  2⤵
  PID:4260
- C:\Windows\System\LpzmaNf.exe
  C:\Windows\System\LpzmaNf.exe
  2⤵
  PID:6936
- C:\Windows\System\uDkfQQL.exe
  C:\Windows\System\uDkfQQL.exe
  2⤵
  PID:7504
- C:\Windows\System\ZTIYTrX.exe
  C:\Windows\System\ZTIYTrX.exe
  2⤵
  PID:10300
- C:\Windows\System\sXcfcGe.exe
  C:\Windows\System\sXcfcGe.exe
  2⤵
  PID:7248
- C:\Windows\System\DicXtDC.exe
  C:\Windows\System\DicXtDC.exe
  2⤵
  PID:7388
- C:\Windows\System\aGlbwpo.exe
  C:\Windows\System\aGlbwpo.exe
  2⤵
  PID:7568
- C:\Windows\System\sVqtwhX.exe
  C:\Windows\System\sVqtwhX.exe
  2⤵
  PID:7696
- C:\Windows\System\JwceJUn.exe
  C:\Windows\System\JwceJUn.exe
  2⤵
  PID:7812
- C:\Windows\System\XhSZKqn.exe
  C:\Windows\System\XhSZKqn.exe
  2⤵
  PID:6652
- C:\Windows\System\uDvqIod.exe
  C:\Windows\System\uDvqIod.exe
  2⤵
  PID:8240
- C:\Windows\System\tGcLcXh.exe
  C:\Windows\System\tGcLcXh.exe
  2⤵
  PID:10700
- C:\Windows\System\NyALhzr.exe
  C:\Windows\System\NyALhzr.exe
  2⤵
  PID:9228
- C:\Windows\System\vpbqDRB.exe
  C:\Windows\System\vpbqDRB.exe
  2⤵
  PID:11072
- C:\Windows\System\nWwTkDn.exe
  C:\Windows\System\nWwTkDn.exe
  2⤵
  PID:9504
- C:\Windows\System\IecQDfT.exe
  C:\Windows\System\IecQDfT.exe
  2⤵
  PID:9540
- C:\Windows\System\HmhSVbj.exe
  C:\Windows\System\HmhSVbj.exe
  2⤵
  PID:1960
- C:\Windows\System\wEIicur.exe
  C:\Windows\System\wEIicur.exe
  2⤵
  PID:9832
- C:\Windows\System\wrJyFHW.exe
  C:\Windows\System\wrJyFHW.exe
  2⤵
  PID:9856
- C:\Windows\System\loCoqhJ.exe
  C:\Windows\System\loCoqhJ.exe
  2⤵
  PID:9888
- C:\Windows\System\OdjvXwB.exe
  C:\Windows\System\OdjvXwB.exe
  2⤵
  PID:9912
- C:\Windows\System\SvmcCUH.exe
  C:\Windows\System\SvmcCUH.exe
  2⤵
  PID:9944
- C:\Windows\System\MIuqfZA.exe
  C:\Windows\System\MIuqfZA.exe
  2⤵
  PID:9968
- C:\Windows\System\YyYxBTZ.exe
  C:\Windows\System\YyYxBTZ.exe
  2⤵
  PID:10000
- C:\Windows\System\ZFWHevA.exe
  C:\Windows\System\ZFWHevA.exe
  2⤵
  PID:10024
- C:\Windows\System\oieDvsK.exe
  C:\Windows\System\oieDvsK.exe
  2⤵
  PID:10076
- C:\Windows\System\IbZMjpR.exe
  C:\Windows\System\IbZMjpR.exe
  2⤵
  PID:10116
- C:\Windows\System\uxBZuBS.exe
  C:\Windows\System\uxBZuBS.exe
  2⤵
  PID:10152
- C:\Windows\System\zLHcYCQ.exe
  C:\Windows\System\zLHcYCQ.exe
  2⤵
  PID:10188
- C:\Windows\System\ldBHjLa.exe
  C:\Windows\System\ldBHjLa.exe
  2⤵
  PID:10212
- C:\Windows\System\IXdNmYw.exe
  C:\Windows\System\IXdNmYw.exe
  2⤵
  PID:6948
- C:\Windows\System\BqrXcat.exe
  C:\Windows\System\BqrXcat.exe
  2⤵
  PID:7280
- C:\Windows\System\ceugKvs.exe
  C:\Windows\System\ceugKvs.exe
  2⤵
  PID:10684
- C:\Windows\System\FBgenaw.exe
  C:\Windows\System\FBgenaw.exe
  2⤵
  PID:10780
- C:\Windows\System\XGOajzt.exe
  C:\Windows\System\XGOajzt.exe
  2⤵
  PID:10828
- C:\Windows\System\TAmAeKo.exe
  C:\Windows\System\TAmAeKo.exe
  2⤵
  PID:10860
- C:\Windows\System\TcdLxQg.exe
  C:\Windows\System\TcdLxQg.exe
  2⤵
  PID:10920
- C:\Windows\System\hINxOQQ.exe
  C:\Windows\System\hINxOQQ.exe
  2⤵
  PID:11128
- C:\Windows\System\ukuqHyF.exe
  C:\Windows\System\ukuqHyF.exe
  2⤵
  PID:11164
- C:\Windows\System\HuuCstJ.exe
  C:\Windows\System\HuuCstJ.exe
  2⤵
  PID:11236
- C:\Windows\System\RmorCWh.exe
  C:\Windows\System\RmorCWh.exe
  2⤵
  PID:12292
- C:\Windows\System\eSXNzUn.exe
  C:\Windows\System\eSXNzUn.exe
  2⤵
  PID:12316
- C:\Windows\System\gpChCDP.exe
  C:\Windows\System\gpChCDP.exe
  2⤵
  PID:12336
- C:\Windows\System\PASQDZn.exe
  C:\Windows\System\PASQDZn.exe
  2⤵
  PID:12352
- C:\Windows\System\pjnhCWr.exe
  C:\Windows\System\pjnhCWr.exe
  2⤵
  PID:12376
- C:\Windows\System\IbgKvcl.exe
  C:\Windows\System\IbgKvcl.exe
  2⤵
  PID:12404
- C:\Windows\System\RjBjuMV.exe
  C:\Windows\System\RjBjuMV.exe
  2⤵
  PID:12420
- C:\Windows\System\QqBZDHK.exe
  C:\Windows\System\QqBZDHK.exe
  2⤵
  PID:12444
- C:\Windows\System\UBGGwKo.exe
  C:\Windows\System\UBGGwKo.exe
  2⤵
  PID:12468
- C:\Windows\System\LezPBkd.exe
  C:\Windows\System\LezPBkd.exe
  2⤵
  PID:12488
- C:\Windows\System\itwBlSn.exe
  C:\Windows\System\itwBlSn.exe
  2⤵
  PID:12512
- C:\Windows\System\uEMBFDF.exe
  C:\Windows\System\uEMBFDF.exe
  2⤵
  PID:12528
- C:\Windows\System\ggEUAUV.exe
  C:\Windows\System\ggEUAUV.exe
  2⤵
  PID:12556
- C:\Windows\System\TZTPDpE.exe
  C:\Windows\System\TZTPDpE.exe
  2⤵
  PID:12580
- C:\Windows\System\dlpiche.exe
  C:\Windows\System\dlpiche.exe
  2⤵
  PID:12604
- C:\Windows\System\dYJmgso.exe
  C:\Windows\System\dYJmgso.exe
  2⤵
  PID:12624
- C:\Windows\System\UNvFEbz.exe
  C:\Windows\System\UNvFEbz.exe
  2⤵
  PID:12772
- C:\Windows\System\PmsVFUv.exe
  C:\Windows\System\PmsVFUv.exe
  2⤵
  PID:12796
- C:\Windows\System\HEeDcDQ.exe
  C:\Windows\System\HEeDcDQ.exe
  2⤵
  PID:12816
- C:\Windows\System\bPxnjKG.exe
  C:\Windows\System\bPxnjKG.exe
  2⤵
  PID:12832
- C:\Windows\System\PQCROZD.exe
  C:\Windows\System\PQCROZD.exe
  2⤵
  PID:12848
- C:\Windows\System\GFEDEBK.exe
  C:\Windows\System\GFEDEBK.exe
  2⤵
  PID:12864
- C:\Windows\System\CZTjliP.exe
  C:\Windows\System\CZTjliP.exe
  2⤵
  PID:12880
- C:\Windows\System\BxdydZk.exe
  C:\Windows\System\BxdydZk.exe
  2⤵
  PID:12896
- C:\Windows\System\SkfcDsn.exe
  C:\Windows\System\SkfcDsn.exe
  2⤵
  PID:13244
- C:\Windows\System\veGVYjp.exe
  C:\Windows\System\veGVYjp.exe
  2⤵
  PID:8764
- C:\Windows\System\oDnobmA.exe
  C:\Windows\System\oDnobmA.exe
  2⤵
  PID:9232
- C:\Windows\System\mLwRfro.exe
  C:\Windows\System\mLwRfro.exe
  2⤵
  PID:9372
- C:\Windows\System\qgAqhWI.exe
  C:\Windows\System\qgAqhWI.exe
  2⤵
  PID:5652
- C:\Windows\System\HnPlVgM.exe
  C:\Windows\System\HnPlVgM.exe
  2⤵
  PID:8096
- C:\Windows\System\OjjbIcJ.exe
  C:\Windows\System\OjjbIcJ.exe
  2⤵
  PID:12700
- C:\Windows\System\KHRPpMq.exe
  C:\Windows\System\KHRPpMq.exe
  2⤵
  PID:11844
- C:\Windows\System\MOuKcKJ.exe
  C:\Windows\System\MOuKcKJ.exe
  2⤵
  PID:12332
- C:\Windows\System\wAYOZDN.exe
  C:\Windows\System\wAYOZDN.exe
  2⤵
  PID:9464
- C:\Windows\System\GbXrCQo.exe
  C:\Windows\System\GbXrCQo.exe
  2⤵
  PID:11596
- C:\Windows\System\NURzkKO.exe
  C:\Windows\System\NURzkKO.exe
  2⤵
  PID:9932
- C:\Windows\System\gqVKACl.exe
  C:\Windows\System\gqVKACl.exe
  2⤵
  PID:9132
- C:\Windows\System\rfQeBVg.exe
  C:\Windows\System\rfQeBVg.exe
  2⤵
  PID:12412
- C:\Windows\System\mIqAKfz.exe
  C:\Windows\System\mIqAKfz.exe
  2⤵
  PID:12592
- C:\Windows\System\pdbBlHb.exe
  C:\Windows\System\pdbBlHb.exe
  2⤵
  PID:12576
- C:\Windows\System\qbXYxBe.exe
  C:\Windows\System\qbXYxBe.exe
  2⤵
  PID:10108
- C:\Windows\System\UvSAZzg.exe
  C:\Windows\System\UvSAZzg.exe
  2⤵
  PID:10764
- C:\Windows\System\NCfunXk.exe
  C:\Windows\System\NCfunXk.exe
  2⤵
  PID:13268
- C:\Windows\System\xvLwinB.exe
  C:\Windows\System\xvLwinB.exe
  2⤵
  PID:10896
- C:\Windows\System\bCqSOtE.exe
  C:\Windows\System\bCqSOtE.exe
  2⤵
  PID:2676
- C:\Windows\System\WaeXPsf.exe
  C:\Windows\System\WaeXPsf.exe
  2⤵
  PID:3924
- C:\Windows\System\bVFyyhY.exe
  C:\Windows\System\bVFyyhY.exe
  2⤵
  PID:1432
- C:\Windows\System\ucNVgSG.exe
  C:\Windows\System\ucNVgSG.exe
  2⤵
  PID:11620
- C:\Windows\System\opyZAJn.exe
  C:\Windows\System\opyZAJn.exe
  2⤵
  PID:11912
- C:\Windows\System\gzybSGh.exe
  C:\Windows\System\gzybSGh.exe
  2⤵
  PID:9872
- C:\Windows\System\pwXUeyf.exe
  C:\Windows\System\pwXUeyf.exe
  2⤵
  PID:12372
- C:\Windows\System\kLiclZo.exe
  C:\Windows\System\kLiclZo.exe
  2⤵
  PID:10748
- C:\Windows\System\woMlwJB.exe
  C:\Windows\System\woMlwJB.exe
  2⤵
  PID:1868
- C:\Windows\System\MeCjDIt.exe
  C:\Windows\System\MeCjDIt.exe
  2⤵
  PID:9908
- C:\Windows\System\DFQCpqt.exe
  C:\Windows\System\DFQCpqt.exe
  2⤵
  PID:11880
- C:\Windows\System\MpChpwJ.exe
  C:\Windows\System\MpChpwJ.exe
  2⤵
  PID:5772
- C:\Windows\System\yNcnZkI.exe
  C:\Windows\System\yNcnZkI.exe
  2⤵
  PID:11184
- C:\Windows\System\TjdyPEL.exe
  C:\Windows\System\TjdyPEL.exe
  2⤵
  PID:12152
- C:\Windows\System\GQSXdik.exe
  C:\Windows\System\GQSXdik.exe
  2⤵
  PID:11160
- C:\Windows\System\mwrpdMa.exe
  C:\Windows\System\mwrpdMa.exe
  2⤵
  PID:7140
- C:\Windows\System\hDNIDuO.exe
  C:\Windows\System\hDNIDuO.exe
  2⤵
  PID:12072
- C:\Windows\System\NjNnnNV.exe
  C:\Windows\System\NjNnnNV.exe
  2⤵
  PID:1840
- C:\Windows\System\sIjOJce.exe
  C:\Windows\System\sIjOJce.exe
  2⤵
  PID:5912
- C:\Windows\System\uSxHvry.exe
  C:\Windows\System\uSxHvry.exe
  2⤵
  PID:11800
- C:\Windows\System\MMYvmxv.exe
  C:\Windows\System\MMYvmxv.exe
  2⤵
  PID:9496
- C:\Windows\System\mLLQsMz.exe
  C:\Windows\System\mLLQsMz.exe
  2⤵
  PID:2736
- C:\Windows\System\evPmUud.exe
  C:\Windows\System\evPmUud.exe
  2⤵
  PID:7152
- C:\Windows\System\EzwkMmP.exe
  C:\Windows\System\EzwkMmP.exe
  2⤵
  PID:9168
- C:\Windows\System\nOyeyky.exe
  C:\Windows\System\nOyeyky.exe
  2⤵
  PID:12464
- C:\Windows\System\wghvGMK.exe
  C:\Windows\System\wghvGMK.exe
  2⤵
  PID:10364
- C:\Windows\System\bKqzSii.exe
  C:\Windows\System\bKqzSii.exe
  2⤵
  PID:10976
- C:\Windows\System\sWzWocF.exe
  C:\Windows\System\sWzWocF.exe
  2⤵
  PID:12244
- C:\Windows\System\QkJCuYo.exe
  C:\Windows\System\QkJCuYo.exe
  2⤵
  PID:1200
- C:\Windows\System\OchSPML.exe
  C:\Windows\System\OchSPML.exe
  2⤵
  PID:10796
- C:\Windows\System\CPIpMSF.exe
  C:\Windows\System\CPIpMSF.exe
  2⤵
  PID:1888
- C:\Windows\System\llUNTId.exe
  C:\Windows\System\llUNTId.exe
  2⤵
  PID:12108
- C:\Windows\System\QRTSfvD.exe
  C:\Windows\System\QRTSfvD.exe
  2⤵
  PID:2608
- C:\Windows\System\PEbYMNM.exe
  C:\Windows\System\PEbYMNM.exe
  2⤵
  PID:13288
- C:\Windows\System\bUyWNyL.exe
  C:\Windows\System\bUyWNyL.exe
  2⤵
  PID:5000
- C:\Windows\System\EjJKath.exe
  C:\Windows\System\EjJKath.exe
  2⤵
  PID:11144
- C:\Windows\System\bYaNGcL.exe
  C:\Windows\System\bYaNGcL.exe
  2⤵
  PID:7908
- C:\Windows\System\uIMwNVj.exe
  C:\Windows\System\uIMwNVj.exe
  2⤵
  PID:11084
- C:\Windows\System\LrNEimZ.exe
  C:\Windows\System\LrNEimZ.exe
  2⤵
  PID:10148
- C:\Windows\System\QAMoLll.exe
  C:\Windows\System\QAMoLll.exe
  2⤵
  PID:11120
- C:\Windows\System\OjmBxxY.exe
  C:\Windows\System\OjmBxxY.exe
  2⤵
  PID:4492
- C:\Windows\System\ZNkQcXu.exe
  C:\Windows\System\ZNkQcXu.exe
  2⤵
  PID:13332
- C:\Windows\System\TWCZDVz.exe
  C:\Windows\System\TWCZDVz.exe
  2⤵
  PID:13348
- C:\Windows\System\CAagAtu.exe
  C:\Windows\System\CAagAtu.exe
  2⤵
  PID:13368
- C:\Windows\System\nymUaTT.exe
  C:\Windows\System\nymUaTT.exe
  2⤵
  PID:13392
- C:\Windows\System\HSGTiJK.exe
  C:\Windows\System\HSGTiJK.exe
  2⤵
  PID:13408
- C:\Windows\System\xRpHTcu.exe
  C:\Windows\System\xRpHTcu.exe
  2⤵
  PID:13428
- C:\Windows\System\lttfEsP.exe
  C:\Windows\System\lttfEsP.exe
  2⤵
  PID:13444
- C:\Windows\System\DNuXkah.exe
  C:\Windows\System\DNuXkah.exe
  2⤵
  PID:13468
- C:\Windows\System\dxAxYpO.exe
  C:\Windows\System\dxAxYpO.exe
  2⤵
  PID:13488
- C:\Windows\System\wehdZWs.exe
  C:\Windows\System\wehdZWs.exe
  2⤵
  PID:13564
- C:\Windows\System\xeEaSYT.exe
  C:\Windows\System\xeEaSYT.exe
  2⤵
  PID:13892
- C:\Windows\System\kCdoShl.exe
  C:\Windows\System\kCdoShl.exe
  2⤵
  PID:14184
- C:\Windows\System\udKQLRO.exe
  C:\Windows\System\udKQLRO.exe
  2⤵
  PID:14300
- C:\Windows\System\byJXIVZ.exe
  C:\Windows\System\byJXIVZ.exe
  2⤵
  PID:14328
- C:\Windows\System\lxlZkLL.exe
  C:\Windows\System\lxlZkLL.exe
  2⤵
  PID:9152
- C:\Windows\System\STnXuph.exe
  C:\Windows\System\STnXuph.exe
  2⤵
  PID:8324
- C:\Windows\System\JQAJQhd.exe
  C:\Windows\System\JQAJQhd.exe
  2⤵
  PID:4612
- C:\Windows\System\mFkmBVQ.exe
  C:\Windows\System\mFkmBVQ.exe
  2⤵
  PID:3564
- C:\Windows\System\EHbppHd.exe
  C:\Windows\System\EHbppHd.exe
  2⤵
  PID:9292
- C:\Windows\System\cIQgfpl.exe
  C:\Windows\System\cIQgfpl.exe
  2⤵
  PID:4676
- C:\Windows\System\pYJaTuC.exe
  C:\Windows\System\pYJaTuC.exe
  2⤵
  PID:5028
- C:\Windows\System\NnmxOVh.exe
  C:\Windows\System\NnmxOVh.exe
  2⤵
  PID:7156
- C:\Windows\System\MvrNffu.exe
  C:\Windows\System\MvrNffu.exe
  2⤵
  PID:1596
- C:\Windows\System\pIbDBcC.exe
  C:\Windows\System\pIbDBcC.exe
  2⤵
  PID:9904
- C:\Windows\System\rePPcRO.exe
  C:\Windows\System\rePPcRO.exe
  2⤵
  PID:13240
- C:\Windows\System\bCBZOhs.exe
  C:\Windows\System\bCBZOhs.exe
  2⤵
  PID:13280
- C:\Windows\System\capJPaq.exe
  C:\Windows\System\capJPaq.exe
  2⤵
  PID:13320
- C:\Windows\System\uwbxfFM.exe
  C:\Windows\System\uwbxfFM.exe
  2⤵
  PID:13356
- C:\Windows\System\BuxkSaj.exe
  C:\Windows\System\BuxkSaj.exe
  2⤵
  PID:12004
- C:\Windows\System\bveWlpw.exe
  C:\Windows\System\bveWlpw.exe
  2⤵
  PID:12036
- C:\Windows\System\PbHdpJd.exe
  C:\Windows\System\PbHdpJd.exe
  2⤵
  PID:8288
- C:\Windows\System\dHPHmor.exe
  C:\Windows\System\dHPHmor.exe
  2⤵
  PID:4552
- C:\Windows\System\WxuaQPs.exe
  C:\Windows\System\WxuaQPs.exe
  2⤵
  PID:8564
- C:\Windows\System\kevmDkK.exe
  C:\Windows\System\kevmDkK.exe
  2⤵
  PID:13572
- C:\Windows\System\XWHgsxd.exe
  C:\Windows\System\XWHgsxd.exe
  2⤵
  PID:884
- C:\Windows\System\ASBxUjM.exe
  C:\Windows\System\ASBxUjM.exe
  2⤵
  PID:13340
- C:\Windows\System\qVKBVMq.exe
  C:\Windows\System\qVKBVMq.exe
  2⤵
  PID:13752
- C:\Windows\System\IDLghcT.exe
  C:\Windows\System\IDLghcT.exe
  2⤵
  PID:9928
- C:\Windows\System\NodSMiK.exe
  C:\Windows\System\NodSMiK.exe
  2⤵
  PID:13948
- C:\Windows\System\uASfCUz.exe
  C:\Windows\System\uASfCUz.exe
  2⤵
  PID:14080
- C:\Windows\System\LjIAaIP.exe
  C:\Windows\System\LjIAaIP.exe
  2⤵
  PID:13988
- C:\Windows\System\ujHWmke.exe
  C:\Windows\System\ujHWmke.exe
  2⤵
  PID:12824
- C:\Windows\System\sPjtIAl.exe
  C:\Windows\System\sPjtIAl.exe
  2⤵
  PID:14260
- C:\Windows\System\PWhUERm.exe
  C:\Windows\System\PWhUERm.exe
  2⤵
  PID:8872
- C:\Windows\System\mhBcnbd.exe
  C:\Windows\System\mhBcnbd.exe
  2⤵
  PID:7068
- C:\Windows\System\UtYqfJh.exe
  C:\Windows\System\UtYqfJh.exe
  2⤵
  PID:13940
- C:\Windows\System\mzpruOX.exe
  C:\Windows\System\mzpruOX.exe
  2⤵
  PID:9984
- C:\Windows\System\tIvbkMr.exe
  C:\Windows\System\tIvbkMr.exe
  2⤵
  PID:7612
- C:\Windows\System\DzdaOxJ.exe
  C:\Windows\System\DzdaOxJ.exe
  2⤵
  PID:13928
- C:\Windows\System\AmmcfpM.exe
  C:\Windows\System\AmmcfpM.exe
  2⤵
  PID:14032
- C:\Windows\System\cpTShhZ.exe
  C:\Windows\System\cpTShhZ.exe
  2⤵
  PID:14132
- C:\Windows\System\hmeZfmi.exe
  C:\Windows\System\hmeZfmi.exe
  2⤵
  PID:14096
- C:\Windows\System\bIPcYtp.exe
  C:\Windows\System\bIPcYtp.exe
  2⤵
  PID:14052
- C:\Windows\System\YihSzBs.exe
  C:\Windows\System\YihSzBs.exe
  2⤵
  PID:2756
- C:\Windows\System\jnSevmy.exe
  C:\Windows\System\jnSevmy.exe
  2⤵
  PID:14172
- C:\Windows\System\CXUJHOR.exe
  C:\Windows\System\CXUJHOR.exe
  2⤵
  PID:2196
- C:\Windows\System\pBwTBWs.exe
  C:\Windows\System\pBwTBWs.exe
  2⤵
  PID:9252
- C:\Windows\System\sKmiQLl.exe
  C:\Windows\System\sKmiQLl.exe
  2⤵
  PID:13764
- C:\Windows\System\XIISFJk.exe
  C:\Windows\System\XIISFJk.exe
  2⤵
  PID:11260
- C:\Windows\System\yDJAuqY.exe
  C:\Windows\System\yDJAuqY.exe
  2⤵
  PID:13644
- C:\Windows\System\RlnZiGo.exe
  C:\Windows\System\RlnZiGo.exe
  2⤵
  PID:14264
- C:\Windows\System\KPVVZKW.exe
  C:\Windows\System\KPVVZKW.exe
  2⤵
  PID:14276
- C:\Windows\System\FPIIDDi.exe
  C:\Windows\System\FPIIDDi.exe
  2⤵
  PID:13616
- C:\Windows\System\FQjCzGy.exe
  C:\Windows\System\FQjCzGy.exe
  2⤵
  PID:396
- C:\Windows\System\JBTCteS.exe
  C:\Windows\System\JBTCteS.exe
  2⤵
  PID:14192
- C:\Windows\System\scUvgqo.exe
  C:\Windows\System\scUvgqo.exe
  2⤵
  PID:11404
- C:\Windows\System\UZDSegC.exe
  C:\Windows\System\UZDSegC.exe
  2⤵
  PID:13972
- C:\Windows\System\DwFTgQh.exe
  C:\Windows\System\DwFTgQh.exe
  2⤵
  PID:1856
- C:\Windows\System\DDNYipy.exe
  C:\Windows\System\DDNYipy.exe
  2⤵
  PID:13308
- C:\Windows\System\lozHCJY.exe
  C:\Windows\System\lozHCJY.exe
  2⤵
  PID:10008
- C:\Windows\System\XhGbxdd.exe
  C:\Windows\System\XhGbxdd.exe
  2⤵
  PID:3312
- C:\Windows\System\fbRQxCt.exe
  C:\Windows\System\fbRQxCt.exe
  2⤵
  PID:13876
- C:\Windows\System\ylYmbkY.exe
  C:\Windows\System\ylYmbkY.exe
  2⤵
  PID:8812
- C:\Windows\System\sMyOasY.exe
  C:\Windows\System\sMyOasY.exe
  2⤵
  PID:14288
- C:\Windows\System\KwGbStI.exe
  C:\Windows\System\KwGbStI.exe
  2⤵
  PID:3144
- C:\Windows\System\bFdHlOM.exe
  C:\Windows\System\bFdHlOM.exe
  2⤵
  PID:14280
- C:\Windows\System\BejXebN.exe
  C:\Windows\System\BejXebN.exe
  2⤵
  PID:3660
- C:\Windows\System\jinHash.exe
  C:\Windows\System\jinHash.exe
  2⤵
  PID:9988
- C:\Windows\System\ULTncnU.exe
  C:\Windows\System\ULTncnU.exe
  2⤵
  PID:7492
- C:\Windows\System\gUoRyOM.exe
  C:\Windows\System\gUoRyOM.exe
  2⤵
  PID:13552
- C:\Windows\System\mHysMEJ.exe
  C:\Windows\System\mHysMEJ.exe
  2⤵
  PID:3380
- C:\Windows\System\LgAMDQr.exe
  C:\Windows\System\LgAMDQr.exe
  2⤵
  PID:14056
- C:\Windows\System\wUAaHRr.exe
  C:\Windows\System\wUAaHRr.exe
  2⤵
  PID:4168
- C:\Windows\System\RKKzcFk.exe
  C:\Windows\System\RKKzcFk.exe
  2⤵
  PID:9532
- C:\Windows\System\iLSrUnz.exe
  C:\Windows\System\iLSrUnz.exe
  2⤵
  PID:7748
- C:\Windows\System\EaqoIRb.exe
  C:\Windows\System\EaqoIRb.exe
  2⤵
  PID:3300
- C:\Windows\System\ZRrtEky.exe
  C:\Windows\System\ZRrtEky.exe
  2⤵
  PID:2956
- C:\Windows\System\maouASG.exe
  C:\Windows\System\maouASG.exe
  2⤵
  PID:5292
- C:\Windows\System\SoQyfbv.exe
  C:\Windows\System\SoQyfbv.exe
  2⤵
  PID:2500
- C:\Windows\System\wTMdspd.exe
  C:\Windows\System\wTMdspd.exe
  2⤵
  PID:12308
- C:\Windows\System\hZUqjGt.exe
  C:\Windows\System\hZUqjGt.exe
  2⤵
  PID:6708
- C:\Windows\System\vBiZIjc.exe
  C:\Windows\System\vBiZIjc.exe
  2⤵
  PID:4256
- C:\Windows\System\kBBbubB.exe
  C:\Windows\System\kBBbubB.exe
  2⤵
  PID:2064
- C:\Windows\System\EebRPRH.exe
  C:\Windows\System\EebRPRH.exe
  2⤵
  PID:3264
- C:\Windows\System\eeuDXRp.exe
  C:\Windows\System\eeuDXRp.exe
  2⤵
  PID:4484
- C:\Windows\System\rdQbKTj.exe
  C:\Windows\System\rdQbKTj.exe
  2⤵
  PID:4616
- C:\Windows\System\nydRcfY.exe
  C:\Windows\System\nydRcfY.exe
  2⤵
  PID:3316
- C:\Windows\System\PjSwMuU.exe
  C:\Windows\System\PjSwMuU.exe
  2⤵
  PID:12860
- C:\Windows\System\cOAmqTq.exe
  C:\Windows\System\cOAmqTq.exe
  2⤵
  PID:3868
- C:\Windows\System\fvDhBwA.exe
  C:\Windows\System\fvDhBwA.exe
  2⤵
  PID:2660
- C:\Windows\System\wZxwGfz.exe
  C:\Windows\System\wZxwGfz.exe
  2⤵
  PID:3880
- C:\Windows\System\QnGzPLn.exe
  C:\Windows\System\QnGzPLn.exe
  2⤵
  PID:2400
- C:\Windows\System\CjqxOsm.exe
  C:\Windows\System\CjqxOsm.exe
  2⤵
  PID:756
- C:\Windows\System\ixFsJBi.exe
  C:\Windows\System\ixFsJBi.exe
  2⤵
  PID:13920
- C:\Windows\System\RpnMzID.exe
  C:\Windows\System\RpnMzID.exe
  2⤵
  PID:12956
- C:\Windows\System\gtAAjHE.exe
  C:\Windows\System\gtAAjHE.exe
  2⤵
  PID:14048
- C:\Windows\System\JFrDbCD.exe
  C:\Windows\System\JFrDbCD.exe
  2⤵
  PID:6140
- C:\Windows\System\QZHDstk.exe
  C:\Windows\System\QZHDstk.exe
  2⤵
  PID:2008
- C:\Windows\System\QNagvzp.exe
  C:\Windows\System\QNagvzp.exe
  2⤵
  PID:14016
- C:\Windows\System\UQNnLKn.exe
  C:\Windows\System\UQNnLKn.exe
  2⤵
  PID:432
- C:\Windows\System\poIkjak.exe
  C:\Windows\System\poIkjak.exe
  2⤵
  PID:6240
- C:\Windows\System\OSmYBKh.exe
  C:\Windows\System\OSmYBKh.exe
  2⤵
  PID:1640
- C:\Windows\System\yIyLFcM.exe
  C:\Windows\System\yIyLFcM.exe
  2⤵
  PID:3508
- C:\Windows\System\kUSUvUN.exe
  C:\Windows\System\kUSUvUN.exe
  2⤵
  PID:13316
- C:\Windows\System\BjPcJPL.exe
  C:\Windows\System\BjPcJPL.exe
  2⤵
  PID:13440
- C:\Windows\System\rfasozh.exe
  C:\Windows\System\rfasozh.exe
  2⤵
  PID:384
- C:\Windows\System\pxGrSjx.exe
  C:\Windows\System\pxGrSjx.exe
  2⤵
  PID:6968
- C:\Windows\System\zHctBXJ.exe
  C:\Windows\System\zHctBXJ.exe
  2⤵
  PID:2416
- C:\Windows\System\gEnWdMY.exe
  C:\Windows\System\gEnWdMY.exe
  2⤵
  PID:3248
- C:\Windows\System\cRSTCZI.exe
  C:\Windows\System\cRSTCZI.exe
  2⤵
  PID:1424
- C:\Windows\System\mKgctJu.exe
  C:\Windows\System\mKgctJu.exe
  2⤵
  PID:7044
- C:\Windows\System\aWMaWcK.exe
  C:\Windows\System\aWMaWcK.exe
  2⤵
  PID:4144
- C:\Windows\System\PZpetSC.exe
  C:\Windows\System\PZpetSC.exe
  2⤵
  PID:7088
- C:\Windows\System\LblqNmD.exe
  C:\Windows\System\LblqNmD.exe
  2⤵
  PID:3832
- C:\Windows\System\DsZcLwH.exe
  C:\Windows\System\DsZcLwH.exe
  2⤵
  PID:7444
- C:\Windows\System\xOIMvuk.exe
  C:\Windows\System\xOIMvuk.exe
  2⤵
  PID:6928
- C:\Windows\System\qufFbWK.exe
  C:\Windows\System\qufFbWK.exe
  2⤵
  PID:5256
- C:\Windows\System\nkhbdpK.exe
  C:\Windows\System\nkhbdpK.exe
  2⤵
  PID:6084
- C:\Windows\System\wjXeiQC.exe
  C:\Windows\System\wjXeiQC.exe
  2⤵
  PID:5460
- C:\Windows\System\TaLIpwE.exe
  C:\Windows\System\TaLIpwE.exe
  2⤵
  PID:8264
- C:\Windows\System\cgovhMt.exe
  C:\Windows\System\cgovhMt.exe
  2⤵
  PID:5128
- C:\Windows\System\OWddzYa.exe
  C:\Windows\System\OWddzYa.exe
  2⤵
  PID:6352
- C:\Windows\System\rFEPaWZ.exe
  C:\Windows\System\rFEPaWZ.exe
  2⤵
  PID:13596
- C:\Windows\System\zTQRYAi.exe
  C:\Windows\System\zTQRYAi.exe
  2⤵
  PID:8584
- C:\Windows\System\bzNOmLR.exe
  C:\Windows\System\bzNOmLR.exe
  2⤵
  PID:5932
- C:\Windows\System\CdJylmH.exe
  C:\Windows\System\CdJylmH.exe
  2⤵
  PID:8604
- C:\Windows\System\tWcOYTU.exe
  C:\Windows\System\tWcOYTU.exe
  2⤵
  PID:7396
- C:\Windows\System\UlvoNsg.exe
  C:\Windows\System\UlvoNsg.exe
  2⤵
  PID:7484
- C:\Windows\System\HMNOcdC.exe
  C:\Windows\System\HMNOcdC.exe
  2⤵
  PID:8644
- C:\Windows\System\yLvgGcG.exe
  C:\Windows\System\yLvgGcG.exe
  2⤵
  PID:8652
- C:\Windows\System\UbYBHWH.exe
  C:\Windows\System\UbYBHWH.exe
  2⤵
  PID:7020
- C:\Windows\System\jvUZVjZ.exe
  C:\Windows\System\jvUZVjZ.exe
  2⤵
  PID:8692
- C:\Windows\System\XVLCcwS.exe
  C:\Windows\System\XVLCcwS.exe
  2⤵
  PID:2060
- C:\Windows\System\LlvLJkj.exe
  C:\Windows\System\LlvLJkj.exe
  2⤵
  PID:8776
- C:\Windows\System\BuOCKqp.exe
  C:\Windows\System\BuOCKqp.exe
  2⤵
  PID:5836
- C:\Windows\System\xfJGKzS.exe
  C:\Windows\System\xfJGKzS.exe
  2⤵
  PID:5152
- C:\Windows\System\pOujmno.exe
  C:\Windows\System\pOujmno.exe
  2⤵
  PID:5220
- C:\Windows\System\NLgDIAb.exe
  C:\Windows\System\NLgDIAb.exe
  2⤵
  PID:8404
- C:\Windows\System\HnXQcZp.exe
  C:\Windows\System\HnXQcZp.exe
  2⤵
  PID:8576
- C:\Windows\System\PikARUf.exe
  C:\Windows\System\PikARUf.exe
  2⤵
  PID:5448
- C:\Windows\System\JBEczaZ.exe
  C:\Windows\System\JBEczaZ.exe
  2⤵
  PID:1940
- C:\Windows\System\AFANkHw.exe
  C:\Windows\System\AFANkHw.exe
  2⤵
  PID:7324
- C:\Windows\System\UKzYeld.exe
  C:\Windows\System\UKzYeld.exe
  2⤵
  PID:12192
- C:\Windows\System\CtUAKpw.exe
  C:\Windows\System\CtUAKpw.exe
  2⤵
  PID:6988
- C:\Windows\System\olYosIl.exe
  C:\Windows\System\olYosIl.exe
  2⤵
  PID:10352
- C:\Windows\System\SKvWSTo.exe
  C:\Windows\System\SKvWSTo.exe
  2⤵
  PID:10360
- C:\Windows\System\zfjceKk.exe
  C:\Windows\System\zfjceKk.exe
  2⤵
  PID:10388
- C:\Windows\System\tDmyxCx.exe
  C:\Windows\System\tDmyxCx.exe
  2⤵
  PID:10408
- C:\Windows\System\cJNCWpf.exe
  C:\Windows\System\cJNCWpf.exe
  2⤵
  PID:10416
- C:\Windows\System\vsoMuKX.exe
  C:\Windows\System\vsoMuKX.exe
  2⤵
  PID:7328
- C:\Windows\System\kSInyPt.exe
  C:\Windows\System\kSInyPt.exe
  2⤵
  PID:8676
- C:\Windows\System\ZIPYsSV.exe
  C:\Windows\System\ZIPYsSV.exe
  2⤵
  PID:7592
- C:\Windows\System\aKhSGnh.exe
  C:\Windows\System\aKhSGnh.exe
  2⤵
  PID:10492
- C:\Windows\System\MPfnTbQ.exe
  C:\Windows\System\MPfnTbQ.exe
  2⤵
  PID:13324
- C:\Windows\System\MPmRcqv.exe
  C:\Windows\System\MPmRcqv.exe
  2⤵
  PID:10476
- C:\Windows\System\lejvpLi.exe
  C:\Windows\System\lejvpLi.exe
  2⤵
  PID:6600
- C:\Windows\System\xeyJbfF.exe
  C:\Windows\System\xeyJbfF.exe
  2⤵
  PID:4508
- C:\Windows\System\FxxkYRt.exe
  C:\Windows\System\FxxkYRt.exe
  2⤵
  PID:6848
- C:\Windows\System\gIoDsDI.exe
  C:\Windows\System\gIoDsDI.exe
  2⤵
  PID:10552
- C:\Windows\System\kDqpgam.exe
  C:\Windows\System\kDqpgam.exe
  2⤵
  PID:10580
- C:\Windows\System\ofBVquH.exe
  C:\Windows\System\ofBVquH.exe
  2⤵
  PID:7736
- C:\Windows\System\piueBqb.exe
  C:\Windows\System\piueBqb.exe
  2⤵
  PID:10620
- C:\Windows\System\JuwJAFr.exe
  C:\Windows\System\JuwJAFr.exe
  2⤵
  PID:3512
- C:\Windows\System\CDekMHn.exe
  C:\Windows\System\CDekMHn.exe
  2⤵
  PID:6888
- C:\Windows\System\HYErvkg.exe
  C:\Windows\System\HYErvkg.exe
  2⤵
  PID:8752
- C:\Windows\System\FqWeLfh.exe
  C:\Windows\System\FqWeLfh.exe
  2⤵
  PID:5260
- C:\Windows\System\uBPZJjO.exe
  C:\Windows\System\uBPZJjO.exe
  2⤵
  PID:8748
- C:\Windows\System\PcjeZqR.exe
  C:\Windows\System\PcjeZqR.exe
  2⤵
  PID:7412
- C:\Windows\System\fSazdyM.exe
  C:\Windows\System\fSazdyM.exe
  2⤵
  PID:9676
- C:\Windows\System\kjAWkwE.exe
  C:\Windows\System\kjAWkwE.exe
  2⤵
  PID:696
- C:\Windows\System\duxbVOb.exe
  C:\Windows\System\duxbVOb.exe
  2⤵
  PID:7112
- C:\Windows\System\cncOEhM.exe
  C:\Windows\System\cncOEhM.exe
  2⤵
  PID:9744
- C:\Windows\System\VOGRcBC.exe
  C:\Windows\System\VOGRcBC.exe
  2⤵
  PID:6272
- C:\Windows\System\sjtOrGf.exe
  C:\Windows\System\sjtOrGf.exe
  2⤵
  PID:9628
- C:\Windows\System\yyvMzHC.exe
  C:\Windows\System\yyvMzHC.exe
  2⤵
  PID:9596
- C:\Windows\System\XvIiRkm.exe
  C:\Windows\System\XvIiRkm.exe
  2⤵
  PID:9600
- C:\Windows\System\YUyMuGl.exe
  C:\Windows\System\YUyMuGl.exe
  2⤵
  PID:9780
- C:\Windows\System\kgqpPFp.exe
  C:\Windows\System\kgqpPFp.exe
  2⤵
  PID:9688
- C:\Windows\System\nKIvcWi.exe
  C:\Windows\System\nKIvcWi.exe
  2⤵
  PID:9740
- C:\Windows\System\NThaXfg.exe
  C:\Windows\System\NThaXfg.exe
  2⤵
  PID:6448
- C:\Windows\System\jWvllrC.exe
  C:\Windows\System\jWvllrC.exe
  2⤵
  PID:9800
- C:\Windows\System\DZEjkiJ.exe
  C:\Windows\System\DZEjkiJ.exe
  2⤵
  PID:6548
- C:\Windows\System\oMZrroZ.exe
  C:\Windows\System\oMZrroZ.exe
  2⤵
  PID:9644
- C:\Windows\System\DKelWTH.exe
  C:\Windows\System\DKelWTH.exe
  2⤵
  PID:9756
- C:\Windows\System\Mayknvi.exe
  C:\Windows\System\Mayknvi.exe
  2⤵
  PID:9640
- C:\Windows\System\PBniSmK.exe
  C:\Windows\System\PBniSmK.exe
  2⤵
  PID:8080
- C:\Windows\System\LNujMUg.exe
  C:\Windows\System\LNujMUg.exe
  2⤵
  PID:8648
- C:\Windows\System\PlYVTYh.exe
  C:\Windows\System\PlYVTYh.exe
  2⤵
  PID:5496
- C:\Windows\System\bzxetQd.exe
  C:\Windows\System\bzxetQd.exe
  2⤵
  PID:11972
- C:\Windows\System\vIlvavr.exe
  C:\Windows\System\vIlvavr.exe
  2⤵
  PID:12000
- C:\Windows\System\gArtaGI.exe
  C:\Windows\System\gArtaGI.exe
  2⤵
  PID:7208
- C:\Windows\System\kKzwszY.exe
  C:\Windows\System\kKzwszY.exe
  2⤵
  PID:11156
- C:\Windows\System\aiCExxq.exe
  C:\Windows\System\aiCExxq.exe
  2⤵
  PID:11656
- C:\Windows\System\OhPgOzY.exe
  C:\Windows\System\OhPgOzY.exe
  2⤵
  PID:9660
- C:\Windows\System\mAWAdRV.exe
  C:\Windows\System\mAWAdRV.exe
  2⤵
  PID:11988
- C:\Windows\System\DXCjdOr.exe
  C:\Windows\System\DXCjdOr.exe
  2⤵
  PID:11108
- C:\Windows\System\RLNYrFp.exe
  C:\Windows\System\RLNYrFp.exe
  2⤵
  PID:7672
- C:\Windows\System\hqpwTYW.exe
  C:\Windows\System\hqpwTYW.exe
  2⤵
  PID:10516
- C:\Windows\System\wBjdefZ.exe
  C:\Windows\System\wBjdefZ.exe
  2⤵
  PID:8072
- C:\Windows\System\dzeMWOX.exe
  C:\Windows\System\dzeMWOX.exe
  2⤵
  PID:10524
- C:\Windows\System\pvNYmEr.exe
  C:\Windows\System\pvNYmEr.exe
  2⤵
  PID:7932
- C:\Windows\System\DOhRBOq.exe
  C:\Windows\System\DOhRBOq.exe
  2⤵
  PID:5828
- C:\Windows\System\vivTjET.exe
  C:\Windows\System\vivTjET.exe
  2⤵
  PID:8024
- C:\Windows\System\YlXNObN.exe
  C:\Windows\System\YlXNObN.exe
  2⤵
  PID:9020
- C:\Windows\System\nLzkBsg.exe
  C:\Windows\System\nLzkBsg.exe
  2⤵
  PID:12704
- C:\Windows\System\SLrVfGM.exe
  C:\Windows\System\SLrVfGM.exe
  2⤵
  PID:6080
- C:\Windows\System\AVUshjQ.exe
  C:\Windows\System\AVUshjQ.exe
  2⤵
  PID:5952
- C:\Windows\System\KUHrhYz.exe
  C:\Windows\System\KUHrhYz.exe
  2⤵
  PID:12792
- C:\Windows\System\BgrGrPc.exe
  C:\Windows\System\BgrGrPc.exe
  2⤵
  PID:10632
- C:\Windows\System\BYhinoj.exe
  C:\Windows\System\BYhinoj.exe
  2⤵
  PID:10344
- C:\Windows\System\lxqvJFY.exe
  C:\Windows\System\lxqvJFY.exe
  2⤵
  PID:12940
- C:\Windows\System\XBMCFdH.exe
  C:\Windows\System\XBMCFdH.exe
  2⤵
  PID:11220
- C:\Windows\System\REvNcYC.exe
  C:\Windows\System\REvNcYC.exe
  2⤵
  PID:12996
- C:\Windows\System\azAPZKc.exe
  C:\Windows\System\azAPZKc.exe
  2⤵
  PID:8200
- C:\Windows\System\skvWveG.exe
  C:\Windows\System\skvWveG.exe
  2⤵
  PID:4712
- C:\Windows\System\DIadrTa.exe
  C:\Windows\System\DIadrTa.exe
  2⤵
  PID:3776
- C:\Windows\System\oQQdskY.exe
  C:\Windows\System\oQQdskY.exe
  2⤵
  PID:6688
- C:\Windows\System\gdcckJv.exe
  C:\Windows\System\gdcckJv.exe
  2⤵
  PID:9608
- C:\Windows\System\LzuwKXR.exe
  C:\Windows\System\LzuwKXR.exe
  2⤵
  PID:9604
- C:\Windows\System\WvWGFzt.exe
  C:\Windows\System\WvWGFzt.exe
  2⤵
  PID:6464
- C:\Windows\System\mVOuJBu.exe
  C:\Windows\System\mVOuJBu.exe
  2⤵
  PID:9700
- C:\Windows\System\zohRwrG.exe
  C:\Windows\System\zohRwrG.exe
  2⤵
  PID:9772
- C:\Windows\System\vlpximg.exe
  C:\Windows\System\vlpximg.exe
  2⤵
  PID:13684
- C:\Windows\System\nuwEXbB.exe
  C:\Windows\System\nuwEXbB.exe
  2⤵
  PID:11168
- C:\Windows\System\AgkOBPn.exe
  C:\Windows\System\AgkOBPn.exe
  2⤵
  PID:5252
- C:\Windows\System\jJnAtXD.exe
  C:\Windows\System\jJnAtXD.exe
  2⤵
  PID:13104
- C:\Windows\System\IPSUJGO.exe
  C:\Windows\System\IPSUJGO.exe
  2⤵
  PID:3384
- C:\Windows\System\lINLIwK.exe
  C:\Windows\System\lINLIwK.exe
  2⤵
  PID:13052
- C:\Windows\System\ohcYuUB.exe
  C:\Windows\System\ohcYuUB.exe
  2⤵
  PID:7192
- C:\Windows\System\fNbZJWb.exe
  C:\Windows\System\fNbZJWb.exe
  2⤵
  PID:13068
- C:\Windows\System\vVBKkmL.exe
  C:\Windows\System\vVBKkmL.exe
  2⤵
  PID:10340
- C:\Windows\System\YJTQMOP.exe
  C:\Windows\System\YJTQMOP.exe
  2⤵
  PID:10372
- C:\Windows\System\dsnpwxJ.exe
  C:\Windows\System\dsnpwxJ.exe
  2⤵
  PID:10380
- C:\Windows\System\GZkUeNK.exe
  C:\Windows\System\GZkUeNK.exe
  2⤵
  PID:8664
- C:\Windows\System\JLjkYEj.exe
  C:\Windows\System\JLjkYEj.exe
  2⤵
  PID:12012
- C:\Windows\System\ngNSioq.exe
  C:\Windows\System\ngNSioq.exe
  2⤵
  PID:11240
- C:\Windows\System\EZYaUAe.exe
  C:\Windows\System\EZYaUAe.exe
  2⤵
  PID:11784
- C:\Windows\System\AGAmlij.exe
  C:\Windows\System\AGAmlij.exe
  2⤵
  PID:3596
- C:\Windows\System\ugffjlt.exe
  C:\Windows\System\ugffjlt.exe
  2⤵
  PID:8052
- C:\Windows\System\LcIPcOn.exe
  C:\Windows\System\LcIPcOn.exe
  2⤵
  PID:4504
- C:\Windows\System\glbSyZM.exe
  C:\Windows\System\glbSyZM.exe
  2⤵
  PID:10508
- C:\Windows\System\SKQnnoy.exe
  C:\Windows\System\SKQnnoy.exe
  2⤵
  PID:10936
- C:\Windows\System\SIzMFyf.exe
  C:\Windows\System\SIzMFyf.exe
  2⤵
  PID:1408
- C:\Windows\System\hWXoiwr.exe
  C:\Windows\System\hWXoiwr.exe
  2⤵
  PID:4064
- C:\Windows\System\qjjqkdw.exe
  C:\Windows\System\qjjqkdw.exe
  2⤵
  PID:12712
- C:\Windows\System\deWYLmF.exe
  C:\Windows\System\deWYLmF.exe
  2⤵
  PID:12716
- C:\Windows\System\qLBQGFw.exe
  C:\Windows\System\qLBQGFw.exe
  2⤵
  PID:11464
- C:\Windows\System\qBGmHRh.exe
  C:\Windows\System\qBGmHRh.exe
  2⤵
  PID:12260
- C:\Windows\System\MVCEpCz.exe
  C:\Windows\System\MVCEpCz.exe
  2⤵
  PID:7668
- C:\Windows\System\oacfsMZ.exe
  C:\Windows\System\oacfsMZ.exe
  2⤵
  PID:8924
- C:\Windows\System\dvRYCYd.exe
  C:\Windows\System\dvRYCYd.exe
  2⤵
  PID:4472
- C:\Windows\System\dNyIQoM.exe
  C:\Windows\System\dNyIQoM.exe
  2⤵
  PID:9240
- C:\Windows\System\qWEYGnS.exe
  C:\Windows\System\qWEYGnS.exe
  2⤵
  PID:10132
- C:\Windows\System\mYREASN.exe
  C:\Windows\System\mYREASN.exe
  2⤵
  PID:12920
- C:\Windows\System\MQnLaNc.exe
  C:\Windows\System\MQnLaNc.exe
  2⤵
  PID:7628
- C:\Windows\System\mDOZuvK.exe
  C:\Windows\System\mDOZuvK.exe
  2⤵
  PID:13300
- C:\Windows\System\ulERRWC.exe
  C:\Windows\System\ulERRWC.exe
  2⤵
  PID:2792
- C:\Windows\System\KZhgZCg.exe
  C:\Windows\System\KZhgZCg.exe
  2⤵
  PID:3140
- C:\Windows\System\TNArxbV.exe
  C:\Windows\System\TNArxbV.exe
  2⤵
  PID:12476
- C:\Windows\System\DOOgENs.exe
  C:\Windows\System\DOOgENs.exe
  2⤵
  PID:9652
- C:\Windows\System\VCGvUwV.exe
  C:\Windows\System\VCGvUwV.exe
  2⤵
  PID:13008
- C:\Windows\System\yTMJNNf.exe
  C:\Windows\System\yTMJNNf.exe
  2⤵
  PID:7072
- C:\Windows\System\wWyUYcP.exe
  C:\Windows\System\wWyUYcP.exe
  2⤵
  PID:2496
- C:\Windows\System\ckfHXzm.exe
  C:\Windows\System\ckfHXzm.exe
  2⤵
  PID:12980
- C:\Windows\System\hhbvwFm.exe
  C:\Windows\System\hhbvwFm.exe
  2⤵
  PID:8036
- C:\Windows\System\SEPitvk.exe
  C:\Windows\System\SEPitvk.exe
  2⤵
  PID:5132
- C:\Windows\System\KOXSmAy.exe
  C:\Windows\System\KOXSmAy.exe
  2⤵
  PID:10980
- C:\Windows\System\PxvVZie.exe
  C:\Windows\System\PxvVZie.exe
  2⤵
  PID:5552
- C:\Windows\System\nattrAZ.exe
  C:\Windows\System\nattrAZ.exe
  2⤵
  PID:10680
- C:\Windows\System\aiiODOp.exe
  C:\Windows\System\aiiODOp.exe
  2⤵
  PID:13536
- C:\Windows\System\dOjurBb.exe
  C:\Windows\System\dOjurBb.exe
  2⤵
  PID:9760
- C:\Windows\System\SjQWplL.exe
  C:\Windows\System\SjQWplL.exe
  2⤵
  PID:13632
- C:\Windows\System\KwUcoHb.exe
  C:\Windows\System\KwUcoHb.exe
  2⤵
  PID:7452
- C:\Windows\System\Snoerti.exe
  C:\Windows\System\Snoerti.exe
  2⤵
  PID:5164
- C:\Windows\System\SQgEMOl.exe
  C:\Windows\System\SQgEMOl.exe
  2⤵
  PID:3820
- C:\Windows\System\GtjBmkw.exe
  C:\Windows\System\GtjBmkw.exe
  2⤵
  PID:13976
- C:\Windows\System\orgUsOf.exe
  C:\Windows\System\orgUsOf.exe
  2⤵
  PID:13096
- C:\Windows\System\MnRDIVn.exe
  C:\Windows\System\MnRDIVn.exe
  2⤵
  PID:11428
- C:\Windows\System\rJvlmhf.exe
  C:\Windows\System\rJvlmhf.exe
  2⤵
  PID:14148
- C:\Windows\System\rfesOio.exe
  C:\Windows\System\rfesOio.exe
  2⤵
  PID:10444
- C:\Windows\System\KAZeJNP.exe
  C:\Windows\System\KAZeJNP.exe
  2⤵
  PID:11752
- C:\Windows\System\SMDfrIi.exe
  C:\Windows\System\SMDfrIi.exe
  2⤵
  PID:14220
- C:\Windows\System\cWCrMnE.exe
  C:\Windows\System\cWCrMnE.exe
  2⤵
  PID:9876
- C:\Windows\System\AWnxsDw.exe
  C:\Windows\System\AWnxsDw.exe
  2⤵
  PID:9852
- C:\Windows\System\qRpEvFl.exe
  C:\Windows\System\qRpEvFl.exe
  2⤵
  PID:8860
- C:\Windows\System\LQgvsDJ.exe
  C:\Windows\System\LQgvsDJ.exe
  2⤵
  PID:10504
- C:\Windows\System\fZNCklw.exe
  C:\Windows\System\fZNCklw.exe
  2⤵
  PID:7752
- C:\Windows\System\ZpGgmqt.exe
  C:\Windows\System\ZpGgmqt.exe
  2⤵
  PID:3892
- C:\Windows\System\AnSvBzb.exe
  C:\Windows\System\AnSvBzb.exe
  2⤵
  PID:11692
- C:\Windows\System\VipRTwJ.exe
  C:\Windows\System\VipRTwJ.exe
  2⤵
  PID:7004
- C:\Windows\System\mFfkaFn.exe
  C:\Windows\System\mFfkaFn.exe
  2⤵
  PID:748
- C:\Windows\System\EsKCmll.exe
  C:\Windows\System\EsKCmll.exe
  2⤵
  PID:13900
- C:\Windows\System\MuLFTOM.exe
  C:\Windows\System\MuLFTOM.exe
  2⤵
  PID:13640
- C:\Windows\System\XsbBrzP.exe
  C:\Windows\System\XsbBrzP.exe
  2⤵
  PID:13624
- C:\Windows\System\JbtehVz.exe
  C:\Windows\System\JbtehVz.exe
  2⤵
  PID:13964
- C:\Windows\System\EeckfkD.exe
  C:\Windows\System\EeckfkD.exe
  2⤵
  PID:12504
- C:\Windows\System\LsdWiAG.exe
  C:\Windows\System\LsdWiAG.exe
  2⤵
  PID:2876
- C:\Windows\System\ZSlkjrg.exe
  C:\Windows\System\ZSlkjrg.exe
  2⤵
  PID:12668
- C:\Windows\System\XpdKwkN.exe
  C:\Windows\System\XpdKwkN.exe
  2⤵
  PID:10556
- C:\Windows\System\GAspLnn.exe
  C:\Windows\System\GAspLnn.exe
  2⤵
  PID:7912
- C:\Windows\System\mHabJGA.exe
  C:\Windows\System\mHabJGA.exe
  2⤵
  PID:11716
- C:\Windows\System\KIGwvzp.exe
  C:\Windows\System\KIGwvzp.exe
  2⤵
  PID:12708
- C:\Windows\System\oItRTHI.exe
  C:\Windows\System\oItRTHI.exe
  2⤵
  PID:14000
- C:\Windows\System\iNHtxVa.exe
  C:\Windows\System\iNHtxVa.exe
  2⤵
  PID:11976
- C:\Windows\System\qsLHVdO.exe
  C:\Windows\System\qsLHVdO.exe
  2⤵
  PID:13648
- C:\Windows\System\ADcMOwz.exe
  C:\Windows\System\ADcMOwz.exe
  2⤵
  PID:7460
- C:\Windows\System\onlVqxR.exe
  C:\Windows\System\onlVqxR.exe
  2⤵
  PID:9520
- C:\Windows\System\KmzojhR.exe
  C:\Windows\System\KmzojhR.exe
  2⤵
  PID:7076
- C:\Windows\System\ojuUMCj.exe
  C:\Windows\System\ojuUMCj.exe
  2⤵
  PID:12564
- C:\Windows\System\ecAeaHP.exe
  C:\Windows\System\ecAeaHP.exe
  2⤵
  PID:12788
- C:\Windows\System\oZOMcqK.exe
  C:\Windows\System\oZOMcqK.exe
  2⤵
  PID:2544
- C:\Windows\System\HJBtANI.exe
  C:\Windows\System\HJBtANI.exe
  2⤵
  PID:1512
- C:\Windows\System\sOszFZY.exe
  C:\Windows\System\sOszFZY.exe
  2⤵
  PID:6100
- C:\Windows\System\WZRWtTk.exe
  C:\Windows\System\WZRWtTk.exe
  2⤵
  PID:13012
- C:\Windows\System\uoOupav.exe
  C:\Windows\System\uoOupav.exe
  2⤵
  PID:4976
- C:\Windows\System\LHRecci.exe
  C:\Windows\System\LHRecci.exe
  2⤵
  PID:9792
- C:\Windows\System\PybfKfZ.exe
  C:\Windows\System\PybfKfZ.exe
  2⤵
  PID:2020
- C:\Windows\System\nYQbHrZ.exe
  C:\Windows\System\nYQbHrZ.exe
  2⤵
  PID:736
- C:\Windows\System\IjKYRsA.exe
  C:\Windows\System\IjKYRsA.exe
  2⤵
  PID:13360
- C:\Windows\System\soGYOtq.exe
  C:\Windows\System\soGYOtq.exe
  2⤵
  PID:3920
- C:\Windows\System\DbMAPHd.exe
  C:\Windows\System\DbMAPHd.exe
  2⤵
  PID:13136
- C:\Windows\System\eMEHLhN.exe
  C:\Windows\System\eMEHLhN.exe
  2⤵
  PID:13100
- C:\Windows\System\erFQFDv.exe
  C:\Windows\System\erFQFDv.exe
  2⤵
  PID:11944
- C:\Windows\System\tiLwGoY.exe
  C:\Windows\System\tiLwGoY.exe
  2⤵
  PID:13836
- C:\Windows\System\YlPjMeK.exe
  C:\Windows\System\YlPjMeK.exe
  2⤵
  PID:14040
- C:\Windows\System\ShKYYFu.exe
  C:\Windows\System\ShKYYFu.exe
  2⤵
  PID:7768
- C:\Windows\System\IJTpNxi.exe
  C:\Windows\System\IJTpNxi.exe
  2⤵
  PID:11780
- C:\Windows\System\lFLjJum.exe
  C:\Windows\System\lFLjJum.exe
  2⤵
  PID:11048
- C:\Windows\System\mmdKJSd.exe
  C:\Windows\System\mmdKJSd.exe
  2⤵
  PID:12548
- C:\Windows\System\xzgCvZe.exe
  C:\Windows\System\xzgCvZe.exe
  2⤵
  PID:10856
- C:\Windows\System\PFPqqri.exe
  C:\Windows\System\PFPqqri.exe
  2⤵
  PID:13464
- C:\Windows\System\aUdQXxc.exe
  C:\Windows\System\aUdQXxc.exe
  2⤵
  PID:760
- C:\Windows\System\qIzLGGn.exe
  C:\Windows\System\qIzLGGn.exe
  2⤵
  PID:13828
- C:\Windows\System\WxssohQ.exe
  C:\Windows\System\WxssohQ.exe
  2⤵
  PID:6692
- C:\Windows\System\qVosTEO.exe
  C:\Windows\System\qVosTEO.exe
  2⤵
  PID:10656
- C:\Windows\System\vaJHSwx.exe
  C:\Windows\System\vaJHSwx.exe
  2⤵
  PID:6480
- C:\Windows\System\wqiMAPp.exe
  C:\Windows\System\wqiMAPp.exe
  2⤵
  PID:10528
- C:\Windows\System\StUJRfM.exe
  C:\Windows\System\StUJRfM.exe
  2⤵
  PID:14140
- C:\Windows\System\JGWeYGt.exe
  C:\Windows\System\JGWeYGt.exe
  2⤵
  PID:13848
- C:\Windows\System\OHAvrrc.exe
  C:\Windows\System\OHAvrrc.exe
  2⤵
  PID:10604
- C:\Windows\System\xVBUMeZ.exe
  C:\Windows\System\xVBUMeZ.exe
  2⤵
  PID:6604
- C:\Windows\System\YuJAAlw.exe
  C:\Windows\System\YuJAAlw.exe
  2⤵
  PID:11588
- C:\Windows\System\ojhurIf.exe
  C:\Windows\System\ojhurIf.exe
  2⤵
  PID:13628
- C:\Windows\System\unpjKjI.exe
  C:\Windows\System\unpjKjI.exe
  2⤵
  PID:13508
- C:\Windows\System\ZnvXxCN.exe
  C:\Windows\System\ZnvXxCN.exe
  2⤵
  PID:8464
- C:\Windows\System\UunKJih.exe
  C:\Windows\System\UunKJih.exe
  2⤵
  PID:4288
- C:\Windows\System\ItOkssK.exe
  C:\Windows\System\ItOkssK.exe
  2⤵
  PID:4560
- C:\Windows\System\OgxrVvW.exe
  C:\Windows\System\OgxrVvW.exe
  2⤵
  PID:6360
- C:\Windows\System\NUnAvzR.exe
  C:\Windows\System\NUnAvzR.exe
  2⤵
  PID:11284
- C:\Windows\System\acXjFRV.exe
  C:\Windows\System\acXjFRV.exe
  2⤵
  PID:13740
- C:\Windows\System\MqubwEE.exe
  C:\Windows\System\MqubwEE.exe
  2⤵
  PID:13540
- C:\Windows\System\OEzZaUr.exe
  C:\Windows\System\OEzZaUr.exe
  2⤵
  PID:13844
- C:\Windows\System\JzYWBsu.exe
  C:\Windows\System\JzYWBsu.exe
  2⤵
  PID:14176
- C:\Windows\System\EmdCIGA.exe
  C:\Windows\System\EmdCIGA.exe
  2⤵
  PID:10496
- C:\Windows\System\nnsZYqZ.exe
  C:\Windows\System\nnsZYqZ.exe
  2⤵
  PID:5572
- C:\Windows\System\zxUkDGH.exe
  C:\Windows\System\zxUkDGH.exe
  2⤵
  PID:11676
- C:\Windows\System\SHSkUbg.exe
  C:\Windows\System\SHSkUbg.exe
  2⤵
  PID:12840
- C:\Windows\System\eUnOaOs.exe
  C:\Windows\System\eUnOaOs.exe
  2⤵
  PID:12636
- C:\Windows\System\ArnlRQY.exe
  C:\Windows\System\ArnlRQY.exe
  2⤵
  PID:8060
- C:\Windows\System\TCEtztQ.exe
  C:\Windows\System\TCEtztQ.exe
  2⤵
  PID:8956
- C:\Windows\System\iyoHani.exe
  C:\Windows\System\iyoHani.exe
  2⤵
  PID:6764
- C:\Windows\System\gkgIPtR.exe
  C:\Windows\System\gkgIPtR.exe
  2⤵
  PID:14180
- C:\Windows\System\saOFRmV.exe
  C:\Windows\System\saOFRmV.exe
  2⤵
  PID:8592
- C:\Windows\System\hKVQays.exe
  C:\Windows\System\hKVQays.exe
  2⤵
  PID:14236
- C:\Windows\System\iOIqqlP.exe
  C:\Windows\System\iOIqqlP.exe
  2⤵
  PID:10776
- C:\Windows\System\ubQaCjF.exe
  C:\Windows\System\ubQaCjF.exe
  2⤵
  PID:9256
- C:\Windows\System\NKUrEGa.exe
  C:\Windows\System\NKUrEGa.exe
  2⤵
  PID:12768
- C:\Windows\System\jGiwlPL.exe
  C:\Windows\System\jGiwlPL.exe
  2⤵
  PID:2404
- C:\Windows\System\MeMzOZM.exe
  C:\Windows\System\MeMzOZM.exe
  2⤵
  PID:8640
- C:\Windows\System\kOZYMnT.exe
  C:\Windows\System\kOZYMnT.exe
  2⤵
  PID:12368
- C:\Windows\System\AJvfBBN.exe
  C:\Windows\System\AJvfBBN.exe
  2⤵
  PID:13524
- C:\Windows\System\gVVIaqI.exe
  C:\Windows\System\gVVIaqI.exe
  2⤵
  PID:13676
- C:\Windows\System\NMBfMxo.exe
  C:\Windows\System\NMBfMxo.exe
  2⤵
  PID:13608
- C:\Windows\System\WmeGbHz.exe
  C:\Windows\System\WmeGbHz.exe
  2⤵
  PID:14356
- C:\Windows\System\ugVzBbN.exe
  C:\Windows\System\ugVzBbN.exe
  2⤵
  PID:14384
- C:\Windows\System\UxcGyfw.exe
  C:\Windows\System\UxcGyfw.exe
  2⤵
  PID:14412
- C:\Windows\System\aGnhIYU.exe
  C:\Windows\System\aGnhIYU.exe
  2⤵
  PID:14440
- C:\Windows\System\ByJMIVy.exe
  C:\Windows\System\ByJMIVy.exe
  2⤵
  PID:14468
- C:\Windows\System\JxANJLL.exe
  C:\Windows\System\JxANJLL.exe
  2⤵
  PID:14496
- C:\Windows\System\SQOzHEE.exe
  C:\Windows\System\SQOzHEE.exe
  2⤵
  PID:14524
- C:\Windows\System\LhavMeS.exe
  C:\Windows\System\LhavMeS.exe
  2⤵
  PID:14552
- C:\Windows\System\LXXHima.exe
  C:\Windows\System\LXXHima.exe
  2⤵
  PID:14584
- C:\Windows\System\JDhYqwL.exe
  C:\Windows\System\JDhYqwL.exe
  2⤵
  PID:14612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b4r5yy0w.4i2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ALIlkSG.exe

Filesize
1.4MB

MD5
313359b1cb8522bd2f578a8eae75a43d

SHA1
56f00fea279cc79075ad153bf95936beb20c8439

SHA256
e32fd37d7eab2fd27294512e47ee0c4b5a64a8732b3c481272699651fb3a44c7

SHA512
0a1feec74b4de158a685ea265034498f389b910bd17fae30b530db158c702a260ea1b0525b2a9c10c07842e769be1cf6193e86385b8da6278de361362c5543a9

Download Submit
C:\Windows\System\AbsWHXg.exe

Filesize
1.4MB

MD5
8ee8dd5505f37d67edf223d62da7dae7

SHA1
767022d90f7d7642b6fdc0f7be0621e016e36b78

SHA256
0ce62f62e9f1393db2dabf6559b4ceeb2f09406230773959c483d5bebbe79bb6

SHA512
35c57fe8d6522a2dcdce8690bff1a1cbd537d026467a9e9767c05fc2b0d9ce56cc6a23b753d6629a53b3fce57e4aca92564b037b293cdd00efe17eb28504056d

Download Submit
C:\Windows\System\DKEyzJz.exe

Filesize
1.4MB

MD5
a09fb8c4aaaff50b8da019ed2e5ceeb6

SHA1
83d084a63c7858f2b5a710b350983e5db34778ee

SHA256
36db75f2a2100170da212b1154dbfc9fd68457ef01a1d13b53d0d305253c1606

SHA512
0e17b12dbd251ef8a46428321d9eaa626e87230785d066bf6d16f646874167fc65d0eb46fb935cad57916da42be0d4426714f4a87492fc003e4c247e869ede5c

Download Submit
C:\Windows\System\DjjnHEZ.exe

Filesize
1.4MB

MD5
c57f18f93b1445917fde11c06b734b2d

SHA1
22024223635131e8e08876987113a7037da15edb

SHA256
85d241597c0d341b1eda4f93ce48834d8ccb74649d47d1e58d058e618b47e63c

SHA512
59e4772eba10c323b27370b4f2025aaa8c76ba95533be5f67584e960d8422b4f22de0bd59cd545f9e0bc70fe6d9ff81cf6cd252bbc6373569f3609a9eca79f6d

Download Submit
C:\Windows\System\GTDmOpB.exe

Filesize
1.4MB

MD5
e125dc678b307c70adf81747caf7e819

SHA1
f158a82e033c5cec1593076c20d5f55d83c79555

SHA256
e6a0dbecf87b24bfdbffd20969ca249b09ccd34e53f08fe7b5479e9cd1dd9cda

SHA512
27428d7700564986fca89c8c55d6be38766f0fe337b2cf451440f12113a3aec530ff071778bbf3318759d5ea5235fc4731675965f3f483a6eece4a635c544a29

Download Submit
C:\Windows\System\GhGnXxT.exe

Filesize
1.4MB

MD5
728440015476be3e989ac1e7c509edd8

SHA1
95f5155611a3894129bf7ed8ad413ea96b6e7436

SHA256
b9509fbc4d7dd46d8c9ec4e51ad2a5f91e5a33f9c0c9cdf184718adbbeba8b0b

SHA512
0938ef480121199f2eae36c1a4d8a3a3874376bcebf00b38173f009ccb014ef64fabd0c73ed41e84309f016b197999793a2831ffb178787170bd6f9a547a77d4

Download Submit
C:\Windows\System\NxjqhPW.exe

Filesize
1.4MB

MD5
4c2c38e5468f49bf45889104eb3bc107

SHA1
63886f2bf834bcdf489b79dce309df7893aba930

SHA256
8bb5263aa33df27485237a0a1801d3ac9ccc614d20e23bcb1eab5bc1c531306e

SHA512
30df0a63c1b857cab9089dba6ec2d72a4647d5845be246f044bf2d6521a157ecfe5df9cbe848c12b0e39c1fdf9d4bb16e8a4b11c9a2294f680e0f0f46df76453

Download Submit
C:\Windows\System\OQOOXjG.exe

Filesize
8B

MD5
2d0c2c2eeafda1eefbc846623106a651

SHA1
ebe1d12cc7355840b98bff551fa1e9b6ea05149b

SHA256
315fe12e8506c9a5679018a241c22762f38597a85e3d6906984d2cd8e0eb0749

SHA512
4747f2fca75d2722dc6b7850f1cf2e05f5ebac7e64d54a9f03247ac705b6e7fd5e4086e67fbc0da577c026e6cfc06192b9232b3f0c023c488535fb6f948376dc

Download Submit
C:\Windows\System\PHahwWc.exe

Filesize
1.4MB

MD5
540f167cfe80679f10241bec11da5b1a

SHA1
652679e408c39edc14a5df24ac29d8cfc90e18d7

SHA256
1dfbe78dc8df59772a9d9fb3e291cdc69d094758652125e4b68d5c48a836493d

SHA512
b89239d92e565f4e4e547ef5fca812f68d1b5b27c21f9f47cf88a38f5df09774cbcf85b094c0e234b24f75b685d34cff45cd6ef66dd0f1bff78a3b934bf3be6d

Download Submit
C:\Windows\System\PURuECM.exe

Filesize
1.4MB

MD5
bcc4eb8fb03579cf94297ae2256653a9

SHA1
6484d38f226853f7c157429be53d2f647fcf0bb5

SHA256
b8f61aee4631c6b7e19a99ef9c7a77a50689fc95182c9ba18d5f4bf2580907d5

SHA512
cc4233ea3c05e58cc8d815260be2284e88b4fa0ea5dd542a27300810d90b9843737ced405df8d2467ff5d850954424696cd6619e3558d15e331e9274d3bce7f3

Download Submit
C:\Windows\System\PehFbVJ.exe

Filesize
1.4MB

MD5
e28d05b5926b097960c64441583c76f1

SHA1
3b24f6cb30de042a2b927ff47a1a62894924abdf

SHA256
a4b70aafb98a8e3d8e49b1a8cae86272b32ce7344f9774ba7cd2d7f5b346bde4

SHA512
edc99b90824e2160c87dc4f80f1b43c399a6c6c83619eaa499ba2e190db47dbf115793ab1929215360c532323b18580750b176f672c795fe3c8047bf0bc2103c

Download Submit
C:\Windows\System\PjsUnEN.exe

Filesize
1.4MB

MD5
b2dc8e04e1eb5ea0b358c8f9d354a857

SHA1
39e1b694bd57d9fafb3b519ef2e78f88ce0a1b45

SHA256
1b1668c828bafb1f6ec283a843dd402ed408be48570324a0c39b30320e4cd1fa

SHA512
267af32640030298229fab21b6519a306eb412962fdb67febc738e4e6acc1d89be1ca1014426a44ffd999a6c5b2276dc84c31cd83edbba3ddcc1487f93fdc57d

Download Submit
C:\Windows\System\RLKIAce.exe

Filesize
1.4MB

MD5
1f3d1996ee5f205e932030ceb7cfa710

SHA1
118a81ce9e8e36eecabdaf1c842b6f2b441f48db

SHA256
ea5243868d8633fed171013fcd47aab6e33f25b307223a0eecf902d2606d9218

SHA512
e079fb079b47307330f2314c877f3e77de25a1af2da58fc643cd6922b8a542e76488da3af6f7ca9d4c2469cb1cd1f069f6f1e11e20679db2781d2f836ee19779

Download Submit
C:\Windows\System\RjRvzPz.exe

Filesize
1.4MB

MD5
0a4d1cc97addb755b3f527b40354d385

SHA1
f4be6f79753b9c9371f01068fb3afde2e804c74f

SHA256
71f72817fda9dce786ec444b7063b930eb4df38705cf13617a9db846a1e01a40

SHA512
8932afb47d87c1c2d2c597fd10efe2eed2151f3c890947667935ded5dc0ce9e255bc1f36f415b2e569603ea7cbf27915fc2584a26b87f1cd03698c139d23b4b3

Download Submit
C:\Windows\System\RtlgAQu.exe

Filesize
1.4MB

MD5
66884ec2d84ab3dfa4788bc263ecbc82

SHA1
173bef469074b1a31d44164282f4cb5a3e5bd99f

SHA256
7cd66084f9412062a63931fdfb89c63f6874ed5bca7e5dbe0d3deb76cc8d84cf

SHA512
d0e59bcc545465d960ad133e41f34e7225b6459fd538f8700c95f79859bd89b9a79feee0351cf3fb2e984c04fa6e80e6f42ab822fce0a99e2f60b2fc459be0d2

Download Submit
C:\Windows\System\TQgRrMB.exe

Filesize
1.4MB

MD5
57ebe34ae625d53386b658e967c1f804

SHA1
9c319a7452142e8c3aa2bbe3226eda08ecc5fe17

SHA256
8ef946a35582139b2969c074da17caade400a9d69b43f3bfa4a3c9f62410be66

SHA512
05f8149b245522244faf0d55405f257cf23c15206c414581dc5ee3726220d6685eaacbb02220c0a920715c8f31c9c014a061fc5608a1b3f9f140cd5b8272ac80

Download Submit
C:\Windows\System\TlSnenr.exe

Filesize
1.4MB

MD5
214f8f4336420fac711a1327055caec1

SHA1
8538a1016ae766a8c12c0e920d3dfda6831a42f5

SHA256
0b4a9773483e197640794aa255e653b67a161ecb06a07b2d2d8e75f03e67bb25

SHA512
53b780efd6dc4c73a98c669198deb1c058963d89c6655d8a4d5c1927462008a973487bd2e2bedacd3b2b7a18bbbcda3b8b6765a4b5b3df8a2dcad3d750d1d623

Download Submit
C:\Windows\System\TmIgUVr.exe

Filesize
1.4MB

MD5
389e7045351071bfc4795fca248d15d4

SHA1
1adf55c94ad911a83b95b5bc328719b7513f7e64

SHA256
26b002760dde2b3a4cb29f8ea4e595654f33f5cac670ac6ff795104299df7061

SHA512
29512c1af76c36b4f474a56d541bfe4f7a64f9a3bc5f0f33d7fce77cc56f72bacd351ace70d76721885a596338b972b9acf0c2230ca5c53eb2c10c94b95a896a

Download Submit
C:\Windows\System\WGdsSFY.exe

Filesize
1.4MB

MD5
b929e49fe4efd6f38edeeedd728da7fd

SHA1
0f091cb2f6150d4fec9f7f30152fc0d5edb0d268

SHA256
61c245fba4497dde71b4201c847d1c8c686e74553c027b2033a36f4b479a15bf

SHA512
50ccf5b65de9f71562ab60cbd1dce4b648048bdd1bc1fdcdb5149224455fe4a4108e4881028287e7adddcf26b1de6b62b636bb0f6abd8ac9ad55dbee8ccd90cc

Download Submit
C:\Windows\System\WYObsYL.exe

Filesize
1.4MB

MD5
2c6b2279d56efb025b5d50e067d66a9f

SHA1
20316e6c36a11db6dd0fd33def921138298bf804

SHA256
6441dea3ac59184591824d8ecc27a2cda8d78c25be30de4a230f23f82f0f86fc

SHA512
e2a1a704b5396041dd260daff7e0faf655fb8cb9baa3220c4b2171846727825cc5e93a4ff784a2214fe0d41ad525036c06a04cc6c35ab3b8b385d68f7a719d9d

Download Submit
C:\Windows\System\WcGiisw.exe

Filesize
1.4MB

MD5
7983c78f0bc7cfe4ae6a77f590115a06

SHA1
9c5a87c1d9dabff32c09d27e75f4135d1fa80a97

SHA256
0a531a2077b73e1c25089f9c1e80410e43f6c2ba8810075759fa5ae8834b00d8

SHA512
8be7e859ac03663fb01c06e963c7fb04d0feb6cb1297813616476ea9b50da0eda5a91efa615a0dc155728a796ac834b79dba5383f4e4d2e68ad3f8d60b7e4c88

Download Submit
C:\Windows\System\ZHmjpnp.exe

Filesize
1.4MB

MD5
09ea127aba4d100b7ed3c3d30fa30b39

SHA1
72dcae622e027ea4f6145ac5b9896534c6b73663

SHA256
59205f0db63743c3917edc39e79276bc477754227c822f6b3f2a203c51cce039

SHA512
65e8358938f2c42e5a0e83a241351d7887986521e326f4bf89031e54cde9eabb363047487582c52eef2f19377872ea894e5cbca9a17c2f86721f6a5c3b46a789

Download Submit
C:\Windows\System\djWQWzK.exe

Filesize
1.4MB

MD5
45209c6732feedbaeade98fbaed242eb

SHA1
2d75aba9a9ea1d58a892ef6d066e17d5fbbe3500

SHA256
a5de2f86cbe885475290a5e742b0f80ff793b80055aa6f7d2e0cbf9a7d1d5d79

SHA512
438fddc3777e619d37698b8361ebf58d2a9770ee49a332e2f09f504750044a988bfac356b494c8f6513f1618c279e33670e7250858909045c700b648cc2f7760

Download Submit
C:\Windows\System\dpgpOAz.exe

Filesize
1.4MB

MD5
49620e87829c63f9db6a978af3f40826

SHA1
80fd0255736d5e6e226ba43095fd480f6ab8d9e7

SHA256
7a8dffad3ee402d35860496500bc2306b7c6866593aa39f57498b719d8ff5624

SHA512
9c82ea7fad6aaa614e2dbe6c3046600ad6ccedf9bec3baccbbdd47640e30d3940f604c4323e1f3cc2d2275abe5b3f91758a0cc0d5daaf0da02f867f16c4d4b9e

Download Submit
C:\Windows\System\drnlKuT.exe

Filesize
1.4MB

MD5
3df7fca00a3a3ae27c2573398840b5c0

SHA1
cc4a3eb8d7051750e5d3b2d1ffb205da923f69f6

SHA256
45cb13a2585397e0c5123b00a5543a713c5104f4acecdfaeb5a94e047ee4acd4

SHA512
bf51ea0a9216a6a18a63c4ba2c2f5623acc8c53f944a14ae72a3aa11d50ba888354242f0b38e8461c398c3e461af88f7070f73e3ca88d2f216927110c39d08ea

Download Submit
C:\Windows\System\gHlAZLt.exe

Filesize
1.4MB

MD5
617127474305a921b0d6d6d0a836fa77

SHA1
8b0c173e5c5ef554f47b927e815c5201b988a63b

SHA256
36c87312ff3a2ca17c6506879d214ad7f495afd70b1fa1bc5fc9308cdce3e2a0

SHA512
3543bf6a436cec6ee91e5e844fed7f2bf8a4dec805b65da89171a96be943ac004b58b4626f8e06190c9a3524c368615319abbb61e938e7436dfb93d780607db7

Download Submit
C:\Windows\System\hTNKPGU.exe

Filesize
1.4MB

MD5
6de3c58472ce91acfee2464dedbb2bed

SHA1
afcefbac5a395bac1b570ffa13cb482761bd0635

SHA256
894ea6c62de1465b1d1953ab0d0a3375ce0e964b4394714a3b564d4749477bc1

SHA512
b1d9602c3ffdc43632b8ad57c7bd1f4d4903d5da1df8829b9a24aef313fd7d9911691bce09c5c3b47412f53072fa8aafba5cdcef8f10b1926b9c4c0a364e4f94

Download Submit
C:\Windows\System\hWLkgZD.exe

Filesize
1.4MB

MD5
830f33f7a031b60fdb1924b601ffc3aa

SHA1
3e9afb1b86e8a0898e53ac057f224b79fa2f5e1c

SHA256
ff8b483747b1b7cc3499199da7c520bdf250793dfb175beadc23fd726c2b4345

SHA512
775a42ad6c8155abe228913bd5f035e111c3a22e02b9902dd682e5b1b9984fe99e0cce32bf2f29f7cd77f712d9ef89788ec3331a08a1d0eb5b221c477fcb70a4

Download Submit
C:\Windows\System\hqaeiDh.exe

Filesize
1.4MB

MD5
e9394cb4a1c2fbe55e79b9185074c608

SHA1
4a544ad2f2cb1142d64aa527ed95631ffb275921

SHA256
ba8b55f3707cd2b53b6c873256628fc9b353f4463f8aafda5711cca2d1f4de83

SHA512
c6e5f7355cd1ebdd82c7e1edc78dcd51f17d4a8c9c9e8602a13abd0201fc71ac5e0275dc7907c548fd87da721f0e790b4708dccab0bb448ab972af2855475bd3

Download Submit
C:\Windows\System\ihEPVgu.exe

Filesize
1.4MB

MD5
458efdb12e3fbedbe6f43fe8550d8547

SHA1
0e5b3bfac367fcccb8af4804d9339aaafcfc2b41

SHA256
9886f13ae462277129f464e04b6fd97c0b4f3ec21e9cbeaba038189d201e8088

SHA512
875214a6b68d0bb8c6e068f612ac51f7fb4552e14b873efd1937ed4a880207f4dad1f735caa5e4a06443c64865ebb4c7d5387144f6c4146cd7404103b52f2036

Download Submit
C:\Windows\System\lXpgkri.exe

Filesize
1.4MB

MD5
d0f5847c531ec396202d965925c5e5eb

SHA1
856204a7d4119daf6d338bda569f825eef264751

SHA256
d7e3449a27fe97c089a4796611974622d17579a776cabff960085e642932bd8a

SHA512
c4d5c1b8a884a105fbccf18f22d58ff059fb4203e8b62c8a25ba020bd47dd00b090d16ee356bc870d3d5fb78f266edb1e2af645e49c510bb56d53429a7774b86

Download Submit
C:\Windows\System\mtAptwA.exe

Filesize
1.4MB

MD5
547b9e39dcd833263486f71c04f49229

SHA1
28778a324d3f5536670ac7b14802066a8dd64565

SHA256
555df64b356bfb2ed2f84650bfa4c623b4fb5ca305fa65d1519debf66c6d456d

SHA512
d4223fbee10c9858d2cca2321a64823c2a3ddfb6209afb45b58125dd84066b9094e2afdb2ab9613f0b3555908d9f2d7d5397ee92fcd8b852ab970d1b33fa0c16

Download Submit
C:\Windows\System\mygquKi.exe

Filesize
18B

MD5
98dbaea0a2672edce823e25a4d8bd0fe

SHA1
d09cac58408a9d9053b9d0becfa29a282f563bb8

SHA256
2d04180dbb71e06b64f51e97726eb98b2b7e2dbc8ed2da0335f09cc3e8eb655a

SHA512
feb2efbe8d617531973fca0389c760d6c816b08acfb396adbecd9f490d83d0988eecc0f8b29124400314382427cd97a66a37eefa4f8971c22dc2834a65c91cbc

Download Submit
C:\Windows\System\oKIkSae.exe

Filesize
1.4MB

MD5
9e2cb1d382c3c823b5faf75a734dedc0

SHA1
5885930b5aee456c08debb7282acc7e667c3d086

SHA256
aac59a780ae54011c6d7574b87b9b8c318c6e7e8ee5005a6c17a7f5e8bc6cd9d

SHA512
41f2721ae47a97b15a53474f2c5b21b0e7f23d311014c70137d54aeebf52ab8f9805d2c87a965e769edf2ed7a8e4b2c3b08d5eb46a9fb072d8955d581946add5

Download Submit
C:\Windows\System\ptCCQYJ.exe

Filesize
1.4MB

MD5
ef6108d6319f65cfbb87ddb3876b163d

SHA1
94e90dd2e6aa6a08946d42369d8bdce45a04f803

SHA256
50f3c2fb9fc64a174ec02661997bda78970fc89224e68f6e3e8b91687b3243d4

SHA512
2500b90300a53705c338bdec6ad97a2b360c6c5f88ead859daa4b0251ba7fff372ce7d9a002bbb592e784b876f4c4c4af7998f6ea1ae5cce78ecdd345b82ff04

Download Submit
C:\Windows\System\qHZKQua.exe

Filesize
1.4MB

MD5
7666542382a9220c0569cf6b04b56718

SHA1
3816e8d0128d527d75fc114e206bf578320e597c

SHA256
509a21f0f0eaf0515e9e496114f3c32d90e56b8487a57b8bb567b70ccbb17bd4

SHA512
cc0b05707818cab0aed9ca42991ab758e65c6f59bb452a755fa32e87ae346b5b94c8f917c66fbf7942e67b087b822fb7e89a200eee3d67ca0552d12dc3514078

Download Submit
C:\Windows\System\qLxPLEF.exe

Filesize
1.4MB

MD5
b5035404cd924ad46e169c9b99039a08

SHA1
ff6a3f5dcd861f2b197093eddd47020ee67351c8

SHA256
cfdd8e509792176b8213412da74ac01a03669398c2fe8b23d0a2532a056cc8f7

SHA512
d833c13fb3c922644a1a96bb893802e72708078e64ebce06246500c7cbe70fab4f32f6f139b9d7c877515fa3df9177e8b77b8c84da48ffabeb8cf4c973a53381

Download Submit
C:\Windows\System\sRqnccN.exe

Filesize
1.4MB

MD5
b1d936813552307cd18a28640414429a

SHA1
b9417cb4e2e529fad677c04cdac1c34771b477d0

SHA256
a46bcddbdcd2283006deb142e5fbc9e336584e13e26f23d025d72dcb32e208b3

SHA512
a2156ee4c96927948afd57c8cd5c39ea72e32610ae318985dc6342b03228fa398987c3b1384b6995a716f24f474f43275a4b4bf591c23dfcc2a06615bbe99af0

Download Submit
C:\Windows\System\tDqbXrs.exe

Filesize
1.4MB

MD5
1ac751b8fab0afb622d080849da150b5

SHA1
f36c7fde120e391977c08b8ff268f226ab85b862

SHA256
c4a1de64ffa4717d277f0ce9b7358b5e5fa1d9f6a4d0213b5fa0be1ed3b155ba

SHA512
6f11da1ec9d3b4de02663bf029e460ac4a65e7e896aea796ed068d0eafd1ca9f5d2ef7db9ed134289764c0ca1c58b53786f8bdcdd473ab14e96d896be0366ba4

Download Submit
C:\Windows\System\tvTmLkn.exe

Filesize
1.4MB

MD5
f1f22faf4596ed461e839c3b44db3111

SHA1
62d3a65d59928d719873a7eec1893c8069606890

SHA256
f9660cb4a49fb8945356fbcec5fdf089d0944203882a1e51f2061bb81e48edc2

SHA512
9ba9c348fe29584f3cc4a9ccd8056cd9d5441e03cd743f7665df565a991aac4f685bff8edef8ed96315f1d8e71e574e111e1698af94b486bf67c6305a1c6a26d

Download Submit
C:\Windows\System\uSvUkre.exe

Filesize
1.4MB

MD5
f3a436658edcf8780782bbc50e6b1002

SHA1
9dc05d3ac38c2eb6756488662bf06ea95a87998a

SHA256
0db3b27478e376c4afb17b03ccc9056e4142c2a022c603026fc88437efd469cb

SHA512
8f420a36191b3bc8ccfc4611042fc753d0fd67f3e5fb73902f3d45f7e5d28f169c5b629bae95ee7a6477aa93a38b73e2f3e0fe214c147d3c3981467e9333ba2f

Download Submit
C:\Windows\System\vFRmNiQ.exe

Filesize
1.4MB

MD5
36dc97061e545a7c056fbbeb8ffadafa

SHA1
c0763069ffd1adacc38a199c5f82fdbb6464d0f5

SHA256
4cb6d28872d64855b32be60dcd449aba1134efe7da46c6ac95e33a0a5f746289

SHA512
4c1f3564ca0ad22c6b67cae2ce64c4671f6e199d51af9b0b6cab4b2cfa965be6d3a5680cec8f3c7a2644b71c5dd133c7aba1e6193eac8f2d31b809b91f0ad355

Download Submit
C:\Windows\System\vjUXllt.exe

Filesize
1.4MB

MD5
bbd555d5e3a84c4062bfba47cb05eac2

SHA1
125619d61731b7825c247db18e9432387c04a5ea

SHA256
98d1c6764bb5c2d71ca5e29547c03cebc1197bbe6abd21a121ec0b062056e631

SHA512
1e0fcc389c127bf411cc52c1162f53e8f353f38f1a110a4b8ebc259e73a84c9df47e414508aefd181eef38bbfd74e22ec025c7a2ce1f07622b228dff7831e770

Download Submit
C:\Windows\System\vuYPCPw.exe

Filesize
1.4MB

MD5
c3a135e5c37bff2828a9325dd98f344a

SHA1
38dbdd09057e47726eeaba32168d30e624514f5d

SHA256
0991f3b9a9af8122d21c6e3ce9822ddf5342c4d45cb9a898a7e976346f28aaaf

SHA512
ace366d4af403c97b29bade655b1b5490bc115ba840f673fa4fe4541936d611c00b4d751de9c7713aa00ec24670f10562bbb358f5be28812969e6d5044f66607

Download Submit
C:\Windows\System\wFqbciS.exe

Filesize
1.4MB

MD5
d699cf3a4794111cfcca5c767ae2ef49

SHA1
c4d6f4669ca5e830cd926a14ff8761c0d24a1ee9

SHA256
9511a96fd415c8f68ae43b285f5f4298ca0ed1e8a1907f9bfcd80d1bfacc1a11

SHA512
7e87a8e6a41fdc6f002219933f18f181bd6e31a8069ed8b23ba1d3672f819cf0348578b013ab2aacde1b755a2070ce3a29e3880541b4548a1e7d8ca655100651

Download Submit
C:\Windows\System\wchfALM.exe

Filesize
1.4MB

MD5
c7caefccff5f9cf0bda26aac51803a65

SHA1
13852eaaa748c4325ad09b5315b01127a12608a5

SHA256
69095d04aae6efb8a25392468168d38837582a404a05277a5be160da1a50e6be

SHA512
32a9c90ed135776f78a800c7da32479a5bba6384fc9faae0c4c9b5773dde1f038ddcbcf2be9610923af67fe749bc787c21a2cbddea5e4c3c751be16b2c5eebf6

Download Submit
C:\Windows\System\wfELopJ.exe

Filesize
1.4MB

MD5
0f6b247ecbae967bed618b825f506895

SHA1
2cbbdb44e5463f73cb9759c233a68dbc7af18fb4

SHA256
054e8fd3806d850e37c519dff9b26d2caef86f04294ef2a0b2a663c27c962809

SHA512
19de0227d6036e17e3bd0824e4f44e22a9685d3201eb36d13529af9b8b90c973bdfeb08f64c0efff50e2e519f1914f83cb7781bd4dae22ae28a588df63180286

Download Submit
C:\Windows\System\xLvwdYZ.exe

Filesize
1.4MB

MD5
e3e65f3cbfc942b352132a0de208be1c

SHA1
b349545c9b8ebc91272831aeca19a6b10b84671e

SHA256
162d61573c3e6aeb44ca590f04c4fc5eec9ad96faf3b28b72e98ec9a171d9871

SHA512
264e6ed9e12ac1492a2bfdfac440c7fe0b9c6a737a4e6bd11cf589f330b98af4ed78c9627ff26527477a3231ef2817efc124c9b5f511acf505d8338b5948e9ff

Download Submit
C:\Windows\System\xLxPHJt.exe

Filesize
1.4MB

MD5
a0936724d3eb991ab29015fe7c0bddfd

SHA1
f01af5256128c3e6055a1d0e69a2ffdf9ac3b08d

SHA256
63e662ed03bb0c3dcf9749bfd9a65d833a21aff19575211e900b90de2c7137de

SHA512
f61d4cd155b400b6d06f09173b8ef3b6775d22844bb249d9a984028e7eafcf73d754b733535666faeb868031fbe34f4ad1e3e0e5b96a53e449e0da1559e99b17

Download Submit
C:\Windows\System\zFenayY.exe

Filesize
1.4MB

MD5
04d1e2618f9de47433246d7d47ce233b

SHA1
259a47c7607c61fea823cc5b586ef4deea5407ae

SHA256
a32a553fe719c2ce99f0e84651b9df2273ba1ca1841553df9019430814aa6d92

SHA512
6cab1610ffe53250c0198e6f5de38b4c9b7fe07ede8d564890021edefebf2fd1c2dc1d5c67fae8bc7b7bb4f412a134412107a80232b404fc26307dc28faf7948

Download Submit
memory/400-0-0x00007FF648A20000-0x00007FF648E12000-memory.dmp

Filesize
3.9MB

Download
memory/400-1-0x000001E5EBA50000-0x000001E5EBA60000-memory.dmp

Filesize
64KB

Download
memory/848-821-0x00007FF78DC90000-0x00007FF78E082000-memory.dmp

Filesize
3.9MB

Download
memory/1328-812-0x00007FF650090000-0x00007FF650482000-memory.dmp

Filesize
3.9MB

Download
memory/1452-818-0x00007FF744780000-0x00007FF744B72000-memory.dmp

Filesize
3.9MB

Download
memory/1564-518-0x00007FF77D340000-0x00007FF77D732000-memory.dmp

Filesize
3.9MB

Download
memory/1564-6724-0x00007FF77D340000-0x00007FF77D732000-memory.dmp

Filesize
3.9MB

Download
memory/1784-819-0x00007FF776D40000-0x00007FF777132000-memory.dmp

Filesize
3.9MB

Download
memory/2028-6944-0x00007FF6BD970000-0x00007FF6BDD62000-memory.dmp

Filesize
3.9MB

Download
memory/2028-824-0x00007FF6BD970000-0x00007FF6BDD62000-memory.dmp

Filesize
3.9MB

Download
memory/2268-83-0x00007FF6EB950000-0x00007FF6EBD42000-memory.dmp

Filesize
3.9MB

Download
memory/2276-6956-0x00007FF776B40000-0x00007FF776F32000-memory.dmp

Filesize
3.9MB

Download
memory/2276-817-0x00007FF776B40000-0x00007FF776F32000-memory.dmp

Filesize
3.9MB

Download
memory/2520-6534-0x00007FF79FA60000-0x00007FF79FE52000-memory.dmp

Filesize
3.9MB

Download
memory/2520-827-0x00007FF79FA60000-0x00007FF79FE52000-memory.dmp

Filesize
3.9MB

Download
memory/2864-6958-0x00007FF702860000-0x00007FF702C52000-memory.dmp

Filesize
3.9MB

Download
memory/2864-826-0x00007FF702860000-0x00007FF702C52000-memory.dmp

Filesize
3.9MB

Download
memory/3196-822-0x00007FF6C39F0000-0x00007FF6C3DE2000-memory.dmp

Filesize
3.9MB

Download
memory/3584-477-0x00007FF6E0A10000-0x00007FF6E0E02000-memory.dmp

Filesize
3.9MB

Download
memory/3676-823-0x00007FF7AF060000-0x00007FF7AF452000-memory.dmp

Filesize
3.9MB

Download
memory/3676-6965-0x00007FF7AF060000-0x00007FF7AF452000-memory.dmp

Filesize
3.9MB

Download
memory/3692-816-0x00007FF698F50000-0x00007FF699342000-memory.dmp

Filesize
3.9MB

Download
memory/4180-825-0x00007FF729760000-0x00007FF729B52000-memory.dmp

Filesize
3.9MB

Download
memory/4180-6959-0x00007FF729760000-0x00007FF729B52000-memory.dmp

Filesize
3.9MB

Download
memory/4452-534-0x000001DA7A300000-0x000001DA7A322000-memory.dmp

Filesize
136KB

Download
memory/4452-51-0x00007FFD23260000-0x00007FFD23D21000-memory.dmp

Filesize
10.8MB

Download
memory/4452-8-0x00007FFD23263000-0x00007FFD23265000-memory.dmp

Filesize
8KB

Download
memory/4452-274-0x00007FFD23260000-0x00007FFD23D21000-memory.dmp

Filesize
10.8MB

Download
memory/4452-2003-0x00007FFD23260000-0x00007FFD23D21000-memory.dmp

Filesize
10.8MB

Download
memory/4804-387-0x00007FF75AB10000-0x00007FF75AF02000-memory.dmp

Filesize
3.9MB

Download
memory/4820-514-0x00007FF618A00000-0x00007FF618DF2000-memory.dmp

Filesize
3.9MB

Download
memory/4820-6549-0x00007FF618A00000-0x00007FF618DF2000-memory.dmp

Filesize
3.9MB

Download
memory/4844-828-0x00007FF73EC40000-0x00007FF73F032000-memory.dmp

Filesize
3.9MB

Download
memory/4844-6778-0x00007FF73EC40000-0x00007FF73F032000-memory.dmp

Filesize
3.9MB

Download
memory/4852-815-0x00007FF794330000-0x00007FF794722000-memory.dmp

Filesize
3.9MB

Download
memory/4892-6709-0x00007FF729170000-0x00007FF729562000-memory.dmp

Filesize
3.9MB

Download
memory/4892-392-0x00007FF729170000-0x00007FF729562000-memory.dmp

Filesize
3.9MB

Download
memory/4964-150-0x00007FF69D5B0000-0x00007FF69D9A2000-memory.dmp

Filesize
3.9MB

Download
memory/4992-6927-0x00007FF6FD7C0000-0x00007FF6FDBB2000-memory.dmp

Filesize
3.9MB

Download
memory/4992-820-0x00007FF6FD7C0000-0x00007FF6FDBB2000-memory.dmp

Filesize
3.9MB

Download
memory/5088-811-0x00007FF7BB870000-0x00007FF7BBC62000-memory.dmp

Filesize
3.9MB

Download
memory/5092-739-0x00007FF6EF070000-0x00007FF6EF462000-memory.dmp

Filesize
3.9MB

Download