xmrig | a52332a81c2df826d24290fe76739b5460c6d923b140260af79f5f27ff1e1fea

Analysis

max time kernel
132s
max time network
142s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 15:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
Size

2.2MB
MD5

0ee2e0a249e705fc8c05354c6c5a4315
SHA1

e5cd72d4b019b86776531b6caef0654f215f2ef2
SHA256

a52332a81c2df826d24290fe76739b5460c6d923b140260af79f5f27ff1e1fea
SHA512

b8f78208d6edfad7da8e7f87aa3c778f48ede2f44026c47b4e95e646c496b1c673025de80c78dbd56117ea91b3d760aba3c41d10928d623086140bdd434c5d0e
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfm:NAB3

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 16 IoCs

miner

resource	yara_rule
behavioral1/memory/2524-135-0x000000013F500000-0x000000013F8F2000-memory.dmp	xmrig
behavioral1/memory/2432-196-0x000000013F280000-0x000000013F672000-memory.dmp	xmrig
behavioral1/memory/1048-195-0x000000013FF20000-0x0000000140312000-memory.dmp	xmrig
behavioral1/memory/2592-194-0x000000013FDA0000-0x0000000140192000-memory.dmp	xmrig
behavioral1/memory/2440-189-0x000000013F720000-0x000000013FB12000-memory.dmp	xmrig
behavioral1/memory/2536-187-0x000000013FF40000-0x0000000140332000-memory.dmp	xmrig
behavioral1/memory/2812-186-0x000000013FB90000-0x000000013FF82000-memory.dmp	xmrig
behavioral1/memory/2052-106-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	xmrig
behavioral1/memory/2440-5772-0x000000013F720000-0x000000013FB12000-memory.dmp	xmrig
behavioral1/memory/2536-5776-0x000000013FF40000-0x0000000140332000-memory.dmp	xmrig
behavioral1/memory/2812-5895-0x000000013FB90000-0x000000013FF82000-memory.dmp	xmrig
behavioral1/memory/1048-5931-0x000000013FF20000-0x0000000140312000-memory.dmp	xmrig
behavioral1/memory/2432-5944-0x000000013F280000-0x000000013F672000-memory.dmp	xmrig
behavioral1/memory/2592-5943-0x000000013FDA0000-0x0000000140192000-memory.dmp	xmrig
behavioral1/memory/2524-5945-0x000000013F500000-0x000000013F8F2000-memory.dmp	xmrig
behavioral1/memory/1960-5955-0x000000013F760000-0x000000013FB52000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2308	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1960	yLStSBG.exe
2052	MTAheaS.exe
2524	sDebthY.exe
2812	tiexdMq.exe
2536	iHeogXf.exe
2440	ODklMmo.exe
2592	YouQhuk.exe
1048	DbsskIn.exe
2432	QbaWgFZ.exe
2476	ULjYofz.exe
1900	cWaJKPE.exe
2904	WJPogYv.exe
2760	wxZOIHS.exe
2420	hHEbDBH.exe
2460	KFxtnGw.exe
2480	wPdoxYe.exe
1324	YRfzEDT.exe
2784	sCjzRpc.exe
2360	tUxHdiQ.exe
2504	dbgVjwx.exe
2252	EpEsHFU.exe
796	LRwKXio.exe
356	kRdTDzz.exe
1428	DiIAEls.exe
1040	gjTycIn.exe
1868	yXbmmsG.exe
2028	xyORylp.exe
2136	JHYpMMj.exe
692	ywlulZV.exe
2964	txPApWV.exe
1484	FgQzAFS.exe
2608	MIDXLJV.exe
2120	YJzaRlu.exe
1528	BuCCtYZ.exe
2296	wzENuvO.exe
2692	ljCPBpo.exe
1756	qgEGwqx.exe
1208	ZEqZhdW.exe
2348	XhduSBn.exe
2108	czyxfwt.exe
544	dOdstcE.exe
1028	onCZahK.exe
680	NPCUSAq.exe
2576	gYrfyYO.exe
2776	uhmrUgT.exe
884	UIvrtvu.exe
1812	wDMZMEP.exe
960	eneajfJ.exe
2844	DkpVHuW.exe
2600	OrlLOpd.exe
1448	TNvNYUW.exe
1696	ccECeIg.exe
2696	DJyjohI.exe
2880	fujXXQI.exe
2300	XfZWwdP.exe
2520	fZPlpvR.exe
2080	lGgzYgt.exe
1648	PIjsXJu.exe
2400	LWLINQJ.exe
1132	VQYfOJx.exe
2196	GVtGXzS.exe
2852	qLxPgwU.exe
2868	FCISOns.exe
2128	FJAkxWE.exe

Loads dropped DLL 64 IoCs

pid	Process
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe

UPX packed file 58 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1972-0-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	upx
behavioral1/files/0x0009000000016176-3.dat	upx
behavioral1/memory/1960-12-0x000000013F760000-0x000000013FB52000-memory.dmp	upx
behavioral1/files/0x0009000000016a29-18.dat	upx
behavioral1/files/0x000f000000005578-23.dat	upx
behavioral1/files/0x0008000000016c51-24.dat	upx
behavioral1/files/0x0007000000016c7c-34.dat	upx
behavioral1/files/0x0009000000016cbe-41.dat	upx
behavioral1/files/0x0007000000016d3e-60.dat	upx
behavioral1/files/0x0006000000017422-103.dat	upx
behavioral1/memory/2524-135-0x000000013F500000-0x000000013F8F2000-memory.dmp	upx
behavioral1/files/0x0009000000016be2-169.dat	upx
behavioral1/files/0x00050000000191c8-175.dat	upx
behavioral1/files/0x0006000000019052-164.dat	upx
behavioral1/files/0x0006000000018ed8-163.dat	upx
behavioral1/files/0x0006000000018ba1-162.dat	upx
behavioral1/files/0x0006000000016e24-68.dat	upx
behavioral1/files/0x0005000000019159-154.dat	upx
behavioral1/files/0x0006000000016d51-150.dat	upx
behavioral1/files/0x00050000000191da-178.dat	upx
behavioral1/files/0x00050000000191b0-172.dat	upx
behavioral1/files/0x000600000001737c-86.dat	upx
behavioral1/files/0x0007000000016d1a-122.dat	upx
behavioral1/memory/2432-196-0x000000013F280000-0x000000013F672000-memory.dmp	upx
behavioral1/memory/1048-195-0x000000013FF20000-0x0000000140312000-memory.dmp	upx
behavioral1/memory/2592-194-0x000000013FDA0000-0x0000000140192000-memory.dmp	upx
behavioral1/memory/2440-189-0x000000013F720000-0x000000013FB12000-memory.dmp	upx
behavioral1/memory/2536-187-0x000000013FF40000-0x0000000140332000-memory.dmp	upx
behavioral1/memory/2812-186-0x000000013FB90000-0x000000013FF82000-memory.dmp	upx
behavioral1/files/0x0005000000019185-165.dat	upx
behavioral1/files/0x0006000000019064-151.dat	upx
behavioral1/files/0x0006000000018fbf-144.dat	upx
behavioral1/files/0x0006000000018bab-137.dat	upx
behavioral1/files/0x000500000001860c-130.dat	upx
behavioral1/files/0x00140000000185e9-129.dat	upx
behavioral1/files/0x0007000000016cc6-120.dat	upx
behavioral1/files/0x0005000000018717-119.dat	upx
behavioral1/files/0x000d0000000185f4-113.dat	upx
behavioral1/files/0x00060000000174a5-107.dat	upx
behavioral1/files/0x00060000000173f2-102.dat	upx
behavioral1/files/0x0006000000017374-101.dat	upx
behavioral1/files/0x000600000001735a-100.dat	upx
behavioral1/files/0x0006000000016e4a-99.dat	upx
behavioral1/files/0x0006000000016d57-98.dat	upx
behavioral1/files/0x0006000000017407-95.dat	upx
behavioral1/files/0x0006000000017371-80.dat	upx
behavioral1/files/0x0006000000016fed-74.dat	upx
behavioral1/memory/2052-106-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	upx
behavioral1/files/0x0007000000016d16-59.dat	upx
behavioral1/files/0x000a000000016cb6-36.dat	upx
behavioral1/memory/2440-5772-0x000000013F720000-0x000000013FB12000-memory.dmp	upx
behavioral1/memory/2536-5776-0x000000013FF40000-0x0000000140332000-memory.dmp	upx
behavioral1/memory/2812-5895-0x000000013FB90000-0x000000013FF82000-memory.dmp	upx
behavioral1/memory/1048-5931-0x000000013FF20000-0x0000000140312000-memory.dmp	upx
behavioral1/memory/2432-5944-0x000000013F280000-0x000000013F672000-memory.dmp	upx
behavioral1/memory/2592-5943-0x000000013FDA0000-0x0000000140192000-memory.dmp	upx
behavioral1/memory/2524-5945-0x000000013F500000-0x000000013F8F2000-memory.dmp	upx
behavioral1/memory/1960-5955-0x000000013F760000-0x000000013FB52000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\yadpdxu.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\KwfPqKX.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\QuianKa.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\LdQOvlS.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\dJLIlDP.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\fSPEZsa.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\rGsqXho.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\FEtunlH.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\bVidUnh.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\wzENuvO.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\BAiMnVw.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\sApUinM.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\LyjGtkr.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\yeNfkJc.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\kfeMQDk.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\CENuyWg.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\GvmyOfL.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\CeMpbIF.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\qzcAucC.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\jVZjHMN.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\sselToX.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\Whpnfqn.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\CGXZTuo.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\mgESXEj.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\PjJACYs.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\jOFsOPH.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\FUDUjqX.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\SrzudQI.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\FWQcnGL.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\qtUpKel.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\AfERSkj.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\PcGXWSn.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\gpjqGSE.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\oefVlip.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\VbZZjXb.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\IDJrjyt.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\KXqiBHn.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\WpDkwQt.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\mwDXBoe.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\yzKRxdu.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\bkPhXjE.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\qYCvFCq.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\GrBZAoz.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\GfCrfxq.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\QNepchW.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\dGOPGMT.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\hrXIFIG.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\UwWFjIv.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\VGoWsqm.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\ZzwExSk.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\mmhDCuE.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\bGhilvI.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\HPCJids.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\hlqgFHG.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\smDTBRC.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\sKGLLFL.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\cjIQYmh.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\AqbaItu.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\JOVhTRt.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\HhpMMeU.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\ylmgijg.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\Neuikha.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\FBuhLRh.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
File created	C:\Windows\System\vFRGlkW.exe	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2308	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
Token: SeDebugPrivilege	2308	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2308	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	29
PID 1972 wrote to memory of 2308	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	29
PID 1972 wrote to memory of 2308	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	29
PID 1972 wrote to memory of 1960	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	30
PID 1972 wrote to memory of 1960	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	30
PID 1972 wrote to memory of 1960	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	30
PID 1972 wrote to memory of 2052	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	31
PID 1972 wrote to memory of 2052	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	31
PID 1972 wrote to memory of 2052	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	31
PID 1972 wrote to memory of 2524	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	32
PID 1972 wrote to memory of 2524	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	32
PID 1972 wrote to memory of 2524	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	32
PID 1972 wrote to memory of 2536	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	33
PID 1972 wrote to memory of 2536	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	33
PID 1972 wrote to memory of 2536	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	33
PID 1972 wrote to memory of 2812	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	34
PID 1972 wrote to memory of 2812	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	34
PID 1972 wrote to memory of 2812	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	34
PID 1972 wrote to memory of 2440	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	35
PID 1972 wrote to memory of 2440	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	35
PID 1972 wrote to memory of 2440	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	35
PID 1972 wrote to memory of 2592	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	36
PID 1972 wrote to memory of 2592	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	36
PID 1972 wrote to memory of 2592	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	36
PID 1972 wrote to memory of 2460	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	37
PID 1972 wrote to memory of 2460	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	37
PID 1972 wrote to memory of 2460	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	37
PID 1972 wrote to memory of 1048	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	38
PID 1972 wrote to memory of 1048	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	38
PID 1972 wrote to memory of 1048	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	38
PID 1972 wrote to memory of 2480	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	39
PID 1972 wrote to memory of 2480	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	39
PID 1972 wrote to memory of 2480	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	39
PID 1972 wrote to memory of 2432	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	40
PID 1972 wrote to memory of 2432	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	40
PID 1972 wrote to memory of 2432	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	40
PID 1972 wrote to memory of 2504	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	41
PID 1972 wrote to memory of 2504	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	41
PID 1972 wrote to memory of 2504	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	41
PID 1972 wrote to memory of 2476	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	42
PID 1972 wrote to memory of 2476	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	42
PID 1972 wrote to memory of 2476	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	42
PID 1972 wrote to memory of 2964	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	43
PID 1972 wrote to memory of 2964	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	43
PID 1972 wrote to memory of 2964	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	43
PID 1972 wrote to memory of 1900	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	44
PID 1972 wrote to memory of 1900	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	44
PID 1972 wrote to memory of 1900	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	44
PID 1972 wrote to memory of 1484	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	45
PID 1972 wrote to memory of 1484	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	45
PID 1972 wrote to memory of 1484	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	45
PID 1972 wrote to memory of 2904	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	46
PID 1972 wrote to memory of 2904	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	46
PID 1972 wrote to memory of 2904	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	46
PID 1972 wrote to memory of 2608	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	47
PID 1972 wrote to memory of 2608	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	47
PID 1972 wrote to memory of 2608	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	47
PID 1972 wrote to memory of 2760	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	48
PID 1972 wrote to memory of 2760	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	48
PID 1972 wrote to memory of 2760	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	48
PID 1972 wrote to memory of 1528	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	49
PID 1972 wrote to memory of 1528	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	49
PID 1972 wrote to memory of 1528	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	49
PID 1972 wrote to memory of 2420	1972	0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0ee2e0a249e705fc8c05354c6c5a4315_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2308
- C:\Windows\System\yLStSBG.exe
  C:\Windows\System\yLStSBG.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\MTAheaS.exe
  C:\Windows\System\MTAheaS.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\sDebthY.exe
  C:\Windows\System\sDebthY.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\iHeogXf.exe
  C:\Windows\System\iHeogXf.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\tiexdMq.exe
  C:\Windows\System\tiexdMq.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\ODklMmo.exe
  C:\Windows\System\ODklMmo.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\YouQhuk.exe
  C:\Windows\System\YouQhuk.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\KFxtnGw.exe
  C:\Windows\System\KFxtnGw.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\DbsskIn.exe
  C:\Windows\System\DbsskIn.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\wPdoxYe.exe
  C:\Windows\System\wPdoxYe.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\QbaWgFZ.exe
  C:\Windows\System\QbaWgFZ.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\dbgVjwx.exe
  C:\Windows\System\dbgVjwx.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\ULjYofz.exe
  C:\Windows\System\ULjYofz.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\txPApWV.exe
  C:\Windows\System\txPApWV.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\cWaJKPE.exe
  C:\Windows\System\cWaJKPE.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\FgQzAFS.exe
  C:\Windows\System\FgQzAFS.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\WJPogYv.exe
  C:\Windows\System\WJPogYv.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\MIDXLJV.exe
  C:\Windows\System\MIDXLJV.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\wxZOIHS.exe
  C:\Windows\System\wxZOIHS.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\BuCCtYZ.exe
  C:\Windows\System\BuCCtYZ.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\hHEbDBH.exe
  C:\Windows\System\hHEbDBH.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\wzENuvO.exe
  C:\Windows\System\wzENuvO.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\YRfzEDT.exe
  C:\Windows\System\YRfzEDT.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\ljCPBpo.exe
  C:\Windows\System\ljCPBpo.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\sCjzRpc.exe
  C:\Windows\System\sCjzRpc.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\qgEGwqx.exe
  C:\Windows\System\qgEGwqx.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\tUxHdiQ.exe
  C:\Windows\System\tUxHdiQ.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\ZEqZhdW.exe
  C:\Windows\System\ZEqZhdW.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\EpEsHFU.exe
  C:\Windows\System\EpEsHFU.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\czyxfwt.exe
  C:\Windows\System\czyxfwt.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\LRwKXio.exe
  C:\Windows\System\LRwKXio.exe
  2⤵
  - Executes dropped EXE
  PID:796
- C:\Windows\System\dOdstcE.exe
  C:\Windows\System\dOdstcE.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\kRdTDzz.exe
  C:\Windows\System\kRdTDzz.exe
  2⤵
  - Executes dropped EXE
  PID:356
- C:\Windows\System\onCZahK.exe
  C:\Windows\System\onCZahK.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\DiIAEls.exe
  C:\Windows\System\DiIAEls.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\NPCUSAq.exe
  C:\Windows\System\NPCUSAq.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\gjTycIn.exe
  C:\Windows\System\gjTycIn.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\uhmrUgT.exe
  C:\Windows\System\uhmrUgT.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\yXbmmsG.exe
  C:\Windows\System\yXbmmsG.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\UIvrtvu.exe
  C:\Windows\System\UIvrtvu.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\xyORylp.exe
  C:\Windows\System\xyORylp.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\wDMZMEP.exe
  C:\Windows\System\wDMZMEP.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\JHYpMMj.exe
  C:\Windows\System\JHYpMMj.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\eneajfJ.exe
  C:\Windows\System\eneajfJ.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\ywlulZV.exe
  C:\Windows\System\ywlulZV.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\DkpVHuW.exe
  C:\Windows\System\DkpVHuW.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\YJzaRlu.exe
  C:\Windows\System\YJzaRlu.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\TNvNYUW.exe
  C:\Windows\System\TNvNYUW.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\XhduSBn.exe
  C:\Windows\System\XhduSBn.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\ccECeIg.exe
  C:\Windows\System\ccECeIg.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\gYrfyYO.exe
  C:\Windows\System\gYrfyYO.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\DJyjohI.exe
  C:\Windows\System\DJyjohI.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\OrlLOpd.exe
  C:\Windows\System\OrlLOpd.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\fujXXQI.exe
  C:\Windows\System\fujXXQI.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\XfZWwdP.exe
  C:\Windows\System\XfZWwdP.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\fZPlpvR.exe
  C:\Windows\System\fZPlpvR.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\lGgzYgt.exe
  C:\Windows\System\lGgzYgt.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\PIjsXJu.exe
  C:\Windows\System\PIjsXJu.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\LWLINQJ.exe
  C:\Windows\System\LWLINQJ.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\VQYfOJx.exe
  C:\Windows\System\VQYfOJx.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\GVtGXzS.exe
  C:\Windows\System\GVtGXzS.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\qLxPgwU.exe
  C:\Windows\System\qLxPgwU.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\FCISOns.exe
  C:\Windows\System\FCISOns.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\FJAkxWE.exe
  C:\Windows\System\FJAkxWE.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\scnJqxo.exe
  C:\Windows\System\scnJqxo.exe
  2⤵
  PID:2764
- C:\Windows\System\BjzfBVe.exe
  C:\Windows\System\BjzfBVe.exe
  2⤵
  PID:1744
- C:\Windows\System\cZhYFiE.exe
  C:\Windows\System\cZhYFiE.exe
  2⤵
  PID:2584
- C:\Windows\System\mnkUVpA.exe
  C:\Windows\System\mnkUVpA.exe
  2⤵
  PID:2744
- C:\Windows\System\HrxmBAr.exe
  C:\Windows\System\HrxmBAr.exe
  2⤵
  PID:1332
- C:\Windows\System\QKtSnNA.exe
  C:\Windows\System\QKtSnNA.exe
  2⤵
  PID:1200
- C:\Windows\System\Keydrfa.exe
  C:\Windows\System\Keydrfa.exe
  2⤵
  PID:2328
- C:\Windows\System\KIxfaIx.exe
  C:\Windows\System\KIxfaIx.exe
  2⤵
  PID:1732
- C:\Windows\System\lHUZSiv.exe
  C:\Windows\System\lHUZSiv.exe
  2⤵
  PID:2060
- C:\Windows\System\jqnjUKx.exe
  C:\Windows\System\jqnjUKx.exe
  2⤵
  PID:608
- C:\Windows\System\ztBTNAu.exe
  C:\Windows\System\ztBTNAu.exe
  2⤵
  PID:452
- C:\Windows\System\PrOevbW.exe
  C:\Windows\System\PrOevbW.exe
  2⤵
  PID:1148
- C:\Windows\System\lAerNtz.exe
  C:\Windows\System\lAerNtz.exe
  2⤵
  PID:2684
- C:\Windows\System\zomRVSP.exe
  C:\Windows\System\zomRVSP.exe
  2⤵
  PID:1804
- C:\Windows\System\AfWFRtw.exe
  C:\Windows\System\AfWFRtw.exe
  2⤵
  PID:1432
- C:\Windows\System\zmfHPtu.exe
  C:\Windows\System\zmfHPtu.exe
  2⤵
  PID:1940
- C:\Windows\System\LTYOrwE.exe
  C:\Windows\System\LTYOrwE.exe
  2⤵
  PID:1320
- C:\Windows\System\nNWSJeV.exe
  C:\Windows\System\nNWSJeV.exe
  2⤵
  PID:2152
- C:\Windows\System\QEWNlgQ.exe
  C:\Windows\System\QEWNlgQ.exe
  2⤵
  PID:2968
- C:\Windows\System\txeTKnb.exe
  C:\Windows\System\txeTKnb.exe
  2⤵
  PID:1372
- C:\Windows\System\RfDztPA.exe
  C:\Windows\System\RfDztPA.exe
  2⤵
  PID:2772
- C:\Windows\System\ZAkUECi.exe
  C:\Windows\System\ZAkUECi.exe
  2⤵
  PID:1640
- C:\Windows\System\RSfneyK.exe
  C:\Windows\System\RSfneyK.exe
  2⤵
  PID:1508
- C:\Windows\System\QqayfqS.exe
  C:\Windows\System\QqayfqS.exe
  2⤵
  PID:1552
- C:\Windows\System\lSzXDkB.exe
  C:\Windows\System\lSzXDkB.exe
  2⤵
  PID:1616
- C:\Windows\System\dDXJAgJ.exe
  C:\Windows\System\dDXJAgJ.exe
  2⤵
  PID:2704
- C:\Windows\System\AEsRzFK.exe
  C:\Windows\System\AEsRzFK.exe
  2⤵
  PID:1984
- C:\Windows\System\aOBgRBU.exe
  C:\Windows\System\aOBgRBU.exe
  2⤵
  PID:3056
- C:\Windows\System\YqncDRR.exe
  C:\Windows\System\YqncDRR.exe
  2⤵
  PID:572
- C:\Windows\System\ZfdFaBI.exe
  C:\Windows\System\ZfdFaBI.exe
  2⤵
  PID:2876
- C:\Windows\System\pnfgsrb.exe
  C:\Windows\System\pnfgsrb.exe
  2⤵
  PID:2560
- C:\Windows\System\xjKKGpv.exe
  C:\Windows\System\xjKKGpv.exe
  2⤵
  PID:2628
- C:\Windows\System\pLXVnKz.exe
  C:\Windows\System\pLXVnKz.exe
  2⤵
  PID:2228
- C:\Windows\System\wuLZtzM.exe
  C:\Windows\System\wuLZtzM.exe
  2⤵
  PID:1676
- C:\Windows\System\SmMTYJb.exe
  C:\Windows\System\SmMTYJb.exe
  2⤵
  PID:2472
- C:\Windows\System\PUdaFIo.exe
  C:\Windows\System\PUdaFIo.exe
  2⤵
  PID:2452
- C:\Windows\System\fgOvfNt.exe
  C:\Windows\System\fgOvfNt.exe
  2⤵
  PID:3008
- C:\Windows\System\opfyqNB.exe
  C:\Windows\System\opfyqNB.exe
  2⤵
  PID:2984
- C:\Windows\System\JEuzlFU.exe
  C:\Windows\System\JEuzlFU.exe
  2⤵
  PID:1480
- C:\Windows\System\wJtAYpy.exe
  C:\Windows\System\wJtAYpy.exe
  2⤵
  PID:2236
- C:\Windows\System\oeRLVDp.exe
  C:\Windows\System\oeRLVDp.exe
  2⤵
  PID:2496
- C:\Windows\System\whRoWXT.exe
  C:\Windows\System\whRoWXT.exe
  2⤵
  PID:1580
- C:\Windows\System\SWjaExM.exe
  C:\Windows\System\SWjaExM.exe
  2⤵
  PID:2392
- C:\Windows\System\QSDihOd.exe
  C:\Windows\System\QSDihOd.exe
  2⤵
  PID:2232
- C:\Windows\System\qXGHiyJ.exe
  C:\Windows\System\qXGHiyJ.exe
  2⤵
  PID:2412
- C:\Windows\System\FtCKBmM.exe
  C:\Windows\System\FtCKBmM.exe
  2⤵
  PID:2572
- C:\Windows\System\DvUnzJy.exe
  C:\Windows\System\DvUnzJy.exe
  2⤵
  PID:668
- C:\Windows\System\urKNFwi.exe
  C:\Windows\System\urKNFwi.exe
  2⤵
  PID:1584
- C:\Windows\System\icjiYsW.exe
  C:\Windows\System\icjiYsW.exe
  2⤵
  PID:2444
- C:\Windows\System\HDxPAVv.exe
  C:\Windows\System\HDxPAVv.exe
  2⤵
  PID:2352
- C:\Windows\System\sZZdkkD.exe
  C:\Windows\System\sZZdkkD.exe
  2⤵
  PID:2908
- C:\Windows\System\mhepELY.exe
  C:\Windows\System\mhepELY.exe
  2⤵
  PID:2800
- C:\Windows\System\TPMErMH.exe
  C:\Windows\System\TPMErMH.exe
  2⤵
  PID:2700
- C:\Windows\System\uwVfQdy.exe
  C:\Windows\System\uwVfQdy.exe
  2⤵
  PID:2224
- C:\Windows\System\VjESnrK.exe
  C:\Windows\System\VjESnrK.exe
  2⤵
  PID:3076
- C:\Windows\System\VelaYPS.exe
  C:\Windows\System\VelaYPS.exe
  2⤵
  PID:3128
- C:\Windows\System\WBPjvXm.exe
  C:\Windows\System\WBPjvXm.exe
  2⤵
  PID:3144
- C:\Windows\System\jwNEdUP.exe
  C:\Windows\System\jwNEdUP.exe
  2⤵
  PID:3160
- C:\Windows\System\byOWJYc.exe
  C:\Windows\System\byOWJYc.exe
  2⤵
  PID:3176
- C:\Windows\System\ZuKyLdS.exe
  C:\Windows\System\ZuKyLdS.exe
  2⤵
  PID:3192
- C:\Windows\System\FYmAvXW.exe
  C:\Windows\System\FYmAvXW.exe
  2⤵
  PID:3208
- C:\Windows\System\fbOKBBv.exe
  C:\Windows\System\fbOKBBv.exe
  2⤵
  PID:3224
- C:\Windows\System\xFVOnWJ.exe
  C:\Windows\System\xFVOnWJ.exe
  2⤵
  PID:3240
- C:\Windows\System\ZXiPkwM.exe
  C:\Windows\System\ZXiPkwM.exe
  2⤵
  PID:3256
- C:\Windows\System\sqyhNat.exe
  C:\Windows\System\sqyhNat.exe
  2⤵
  PID:3272
- C:\Windows\System\BEarEnD.exe
  C:\Windows\System\BEarEnD.exe
  2⤵
  PID:3288
- C:\Windows\System\maXGNlq.exe
  C:\Windows\System\maXGNlq.exe
  2⤵
  PID:3304
- C:\Windows\System\eVkgMrv.exe
  C:\Windows\System\eVkgMrv.exe
  2⤵
  PID:3324
- C:\Windows\System\QUxwhzq.exe
  C:\Windows\System\QUxwhzq.exe
  2⤵
  PID:3340
- C:\Windows\System\szIisoZ.exe
  C:\Windows\System\szIisoZ.exe
  2⤵
  PID:3356
- C:\Windows\System\wOTNsNI.exe
  C:\Windows\System\wOTNsNI.exe
  2⤵
  PID:3372
- C:\Windows\System\JzZOSZc.exe
  C:\Windows\System\JzZOSZc.exe
  2⤵
  PID:3388
- C:\Windows\System\IDROLkv.exe
  C:\Windows\System\IDROLkv.exe
  2⤵
  PID:3404
- C:\Windows\System\wlUmjXl.exe
  C:\Windows\System\wlUmjXl.exe
  2⤵
  PID:3420
- C:\Windows\System\JozYoWQ.exe
  C:\Windows\System\JozYoWQ.exe
  2⤵
  PID:3436
- C:\Windows\System\xNWZWSy.exe
  C:\Windows\System\xNWZWSy.exe
  2⤵
  PID:3452
- C:\Windows\System\ReNjGVC.exe
  C:\Windows\System\ReNjGVC.exe
  2⤵
  PID:3468
- C:\Windows\System\dIqcvBR.exe
  C:\Windows\System\dIqcvBR.exe
  2⤵
  PID:3484
- C:\Windows\System\ounoemy.exe
  C:\Windows\System\ounoemy.exe
  2⤵
  PID:3500
- C:\Windows\System\johHPqr.exe
  C:\Windows\System\johHPqr.exe
  2⤵
  PID:3516
- C:\Windows\System\UnOswUV.exe
  C:\Windows\System\UnOswUV.exe
  2⤵
  PID:3536
- C:\Windows\System\CKcpLOa.exe
  C:\Windows\System\CKcpLOa.exe
  2⤵
  PID:3552
- C:\Windows\System\LHCZmgU.exe
  C:\Windows\System\LHCZmgU.exe
  2⤵
  PID:3568
- C:\Windows\System\CbviOXh.exe
  C:\Windows\System\CbviOXh.exe
  2⤵
  PID:3584
- C:\Windows\System\wTtZAsO.exe
  C:\Windows\System\wTtZAsO.exe
  2⤵
  PID:3604
- C:\Windows\System\uGyZsdy.exe
  C:\Windows\System\uGyZsdy.exe
  2⤵
  PID:3620
- C:\Windows\System\jVZjHMN.exe
  C:\Windows\System\jVZjHMN.exe
  2⤵
  PID:3636
- C:\Windows\System\xJuCalp.exe
  C:\Windows\System\xJuCalp.exe
  2⤵
  PID:3652
- C:\Windows\System\UHJvPDp.exe
  C:\Windows\System\UHJvPDp.exe
  2⤵
  PID:3668
- C:\Windows\System\ufFyLcH.exe
  C:\Windows\System\ufFyLcH.exe
  2⤵
  PID:3684
- C:\Windows\System\JYMrOSi.exe
  C:\Windows\System\JYMrOSi.exe
  2⤵
  PID:3720
- C:\Windows\System\bzaOIxZ.exe
  C:\Windows\System\bzaOIxZ.exe
  2⤵
  PID:3740
- C:\Windows\System\SnRxkEI.exe
  C:\Windows\System\SnRxkEI.exe
  2⤵
  PID:3756
- C:\Windows\System\emtfEOz.exe
  C:\Windows\System\emtfEOz.exe
  2⤵
  PID:3772
- C:\Windows\System\DgkBzZK.exe
  C:\Windows\System\DgkBzZK.exe
  2⤵
  PID:3788
- C:\Windows\System\zdXiMYM.exe
  C:\Windows\System\zdXiMYM.exe
  2⤵
  PID:3804
- C:\Windows\System\niDGVkC.exe
  C:\Windows\System\niDGVkC.exe
  2⤵
  PID:3820
- C:\Windows\System\rdPbhMY.exe
  C:\Windows\System\rdPbhMY.exe
  2⤵
  PID:3836
- C:\Windows\System\AxsUpXo.exe
  C:\Windows\System\AxsUpXo.exe
  2⤵
  PID:3852
- C:\Windows\System\ySunEgS.exe
  C:\Windows\System\ySunEgS.exe
  2⤵
  PID:3868
- C:\Windows\System\SJKiVph.exe
  C:\Windows\System\SJKiVph.exe
  2⤵
  PID:3884
- C:\Windows\System\JzDjHnv.exe
  C:\Windows\System\JzDjHnv.exe
  2⤵
  PID:3904
- C:\Windows\System\AMarczS.exe
  C:\Windows\System\AMarczS.exe
  2⤵
  PID:3920
- C:\Windows\System\GazioRg.exe
  C:\Windows\System\GazioRg.exe
  2⤵
  PID:3936
- C:\Windows\System\DQhLnxU.exe
  C:\Windows\System\DQhLnxU.exe
  2⤵
  PID:3952
- C:\Windows\System\LgDMwlM.exe
  C:\Windows\System\LgDMwlM.exe
  2⤵
  PID:3968
- C:\Windows\System\pIJgBTv.exe
  C:\Windows\System\pIJgBTv.exe
  2⤵
  PID:3984
- C:\Windows\System\GTiNVRR.exe
  C:\Windows\System\GTiNVRR.exe
  2⤵
  PID:4004
- C:\Windows\System\tbrGcZm.exe
  C:\Windows\System\tbrGcZm.exe
  2⤵
  PID:4020
- C:\Windows\System\rJdFZla.exe
  C:\Windows\System\rJdFZla.exe
  2⤵
  PID:4036
- C:\Windows\System\xrbMkgj.exe
  C:\Windows\System\xrbMkgj.exe
  2⤵
  PID:4052
- C:\Windows\System\nxYCXnR.exe
  C:\Windows\System\nxYCXnR.exe
  2⤵
  PID:4068
- C:\Windows\System\ipuhpaR.exe
  C:\Windows\System\ipuhpaR.exe
  2⤵
  PID:4084
- C:\Windows\System\EGBNHQv.exe
  C:\Windows\System\EGBNHQv.exe
  2⤵
  PID:828
- C:\Windows\System\ibrAKXW.exe
  C:\Windows\System\ibrAKXW.exe
  2⤵
  PID:1540
- C:\Windows\System\drtmPhb.exe
  C:\Windows\System\drtmPhb.exe
  2⤵
  PID:1724
- C:\Windows\System\PHaCwha.exe
  C:\Windows\System\PHaCwha.exe
  2⤵
  PID:500
- C:\Windows\System\OPnuHOU.exe
  C:\Windows\System\OPnuHOU.exe
  2⤵
  PID:1124
- C:\Windows\System\DhltJyB.exe
  C:\Windows\System\DhltJyB.exe
  2⤵
  PID:2892
- C:\Windows\System\WUTkLhw.exe
  C:\Windows\System\WUTkLhw.exe
  2⤵
  PID:3100
- C:\Windows\System\VGoWsqm.exe
  C:\Windows\System\VGoWsqm.exe
  2⤵
  PID:3116
- C:\Windows\System\qUTpPFZ.exe
  C:\Windows\System\qUTpPFZ.exe
  2⤵
  PID:3152
- C:\Windows\System\mOttSqM.exe
  C:\Windows\System\mOttSqM.exe
  2⤵
  PID:3216
- C:\Windows\System\TddwHpr.exe
  C:\Windows\System\TddwHpr.exe
  2⤵
  PID:3252
- C:\Windows\System\jbWXYsr.exe
  C:\Windows\System\jbWXYsr.exe
  2⤵
  PID:3320
- C:\Windows\System\xhBksWx.exe
  C:\Windows\System\xhBksWx.exe
  2⤵
  PID:3412
- C:\Windows\System\iTHkqyR.exe
  C:\Windows\System\iTHkqyR.exe
  2⤵
  PID:3476
- C:\Windows\System\doPowcu.exe
  C:\Windows\System\doPowcu.exe
  2⤵
  PID:3544
- C:\Windows\System\kLiEGut.exe
  C:\Windows\System\kLiEGut.exe
  2⤵
  PID:3612
- C:\Windows\System\nFwDImq.exe
  C:\Windows\System\nFwDImq.exe
  2⤵
  PID:3676
- C:\Windows\System\Xkcliid.exe
  C:\Windows\System\Xkcliid.exe
  2⤵
  PID:2468
- C:\Windows\System\jdmqCxD.exe
  C:\Windows\System\jdmqCxD.exe
  2⤵
  PID:3140
- C:\Windows\System\AZcrzcS.exe
  C:\Windows\System\AZcrzcS.exe
  2⤵
  PID:4100
- C:\Windows\System\guUxYUk.exe
  C:\Windows\System\guUxYUk.exe
  2⤵
  PID:4116
- C:\Windows\System\MZylAPV.exe
  C:\Windows\System\MZylAPV.exe
  2⤵
  PID:4132
- C:\Windows\System\uipjGUd.exe
  C:\Windows\System\uipjGUd.exe
  2⤵
  PID:4148
- C:\Windows\System\MwYtqzS.exe
  C:\Windows\System\MwYtqzS.exe
  2⤵
  PID:4164
- C:\Windows\System\JjdyUVr.exe
  C:\Windows\System\JjdyUVr.exe
  2⤵
  PID:4180
- C:\Windows\System\OLxGHhs.exe
  C:\Windows\System\OLxGHhs.exe
  2⤵
  PID:4196
- C:\Windows\System\bZooUpu.exe
  C:\Windows\System\bZooUpu.exe
  2⤵
  PID:4212
- C:\Windows\System\LLbNQbN.exe
  C:\Windows\System\LLbNQbN.exe
  2⤵
  PID:4228
- C:\Windows\System\IbbLgdO.exe
  C:\Windows\System\IbbLgdO.exe
  2⤵
  PID:4248
- C:\Windows\System\WTbrBvw.exe
  C:\Windows\System\WTbrBvw.exe
  2⤵
  PID:4264
- C:\Windows\System\GHjJDGa.exe
  C:\Windows\System\GHjJDGa.exe
  2⤵
  PID:4280
- C:\Windows\System\uZORMxy.exe
  C:\Windows\System\uZORMxy.exe
  2⤵
  PID:4296
- C:\Windows\System\ifPWbMm.exe
  C:\Windows\System\ifPWbMm.exe
  2⤵
  PID:4312
- C:\Windows\System\ZztXpRG.exe
  C:\Windows\System\ZztXpRG.exe
  2⤵
  PID:4328
- C:\Windows\System\TOSkEba.exe
  C:\Windows\System\TOSkEba.exe
  2⤵
  PID:4344
- C:\Windows\System\pLPfjKu.exe
  C:\Windows\System\pLPfjKu.exe
  2⤵
  PID:4360
- C:\Windows\System\ZfpOCFC.exe
  C:\Windows\System\ZfpOCFC.exe
  2⤵
  PID:4376
- C:\Windows\System\RSgdWbM.exe
  C:\Windows\System\RSgdWbM.exe
  2⤵
  PID:4392
- C:\Windows\System\lRCOxHG.exe
  C:\Windows\System\lRCOxHG.exe
  2⤵
  PID:4412
- C:\Windows\System\zbEVyrW.exe
  C:\Windows\System\zbEVyrW.exe
  2⤵
  PID:4428
- C:\Windows\System\OfbvMWS.exe
  C:\Windows\System\OfbvMWS.exe
  2⤵
  PID:4444
- C:\Windows\System\CEzTZpb.exe
  C:\Windows\System\CEzTZpb.exe
  2⤵
  PID:4460
- C:\Windows\System\tNMwxpR.exe
  C:\Windows\System\tNMwxpR.exe
  2⤵
  PID:4476
- C:\Windows\System\foIWBYI.exe
  C:\Windows\System\foIWBYI.exe
  2⤵
  PID:4492
- C:\Windows\System\wUPNlDl.exe
  C:\Windows\System\wUPNlDl.exe
  2⤵
  PID:4512
- C:\Windows\System\zyrFuuo.exe
  C:\Windows\System\zyrFuuo.exe
  2⤵
  PID:4552
- C:\Windows\System\fSYPmBy.exe
  C:\Windows\System\fSYPmBy.exe
  2⤵
  PID:4576
- C:\Windows\System\ZUEfVvE.exe
  C:\Windows\System\ZUEfVvE.exe
  2⤵
  PID:4592
- C:\Windows\System\xcIqJKW.exe
  C:\Windows\System\xcIqJKW.exe
  2⤵
  PID:4608
- C:\Windows\System\EpABSjC.exe
  C:\Windows\System\EpABSjC.exe
  2⤵
  PID:4624
- C:\Windows\System\eTAnNMP.exe
  C:\Windows\System\eTAnNMP.exe
  2⤵
  PID:4640
- C:\Windows\System\PXtGJjy.exe
  C:\Windows\System\PXtGJjy.exe
  2⤵
  PID:4656
- C:\Windows\System\gbQUvYV.exe
  C:\Windows\System\gbQUvYV.exe
  2⤵
  PID:4672
- C:\Windows\System\oVDvhwj.exe
  C:\Windows\System\oVDvhwj.exe
  2⤵
  PID:4688
- C:\Windows\System\iEYpALU.exe
  C:\Windows\System\iEYpALU.exe
  2⤵
  PID:4704
- C:\Windows\System\vRfesgU.exe
  C:\Windows\System\vRfesgU.exe
  2⤵
  PID:4720
- C:\Windows\System\lzItSAO.exe
  C:\Windows\System\lzItSAO.exe
  2⤵
  PID:4736
- C:\Windows\System\frvLGMT.exe
  C:\Windows\System\frvLGMT.exe
  2⤵
  PID:4752
- C:\Windows\System\VaSDXco.exe
  C:\Windows\System\VaSDXco.exe
  2⤵
  PID:4768
- C:\Windows\System\nyTerPY.exe
  C:\Windows\System\nyTerPY.exe
  2⤵
  PID:4784
- C:\Windows\System\PWRbbyn.exe
  C:\Windows\System\PWRbbyn.exe
  2⤵
  PID:4800
- C:\Windows\System\NVzEHPT.exe
  C:\Windows\System\NVzEHPT.exe
  2⤵
  PID:4816
- C:\Windows\System\gwSUJbl.exe
  C:\Windows\System\gwSUJbl.exe
  2⤵
  PID:4832
- C:\Windows\System\ywPnsdn.exe
  C:\Windows\System\ywPnsdn.exe
  2⤵
  PID:4848
- C:\Windows\System\gVJQiJJ.exe
  C:\Windows\System\gVJQiJJ.exe
  2⤵
  PID:4864
- C:\Windows\System\PQlbsLf.exe
  C:\Windows\System\PQlbsLf.exe
  2⤵
  PID:4880
- C:\Windows\System\ksptRbi.exe
  C:\Windows\System\ksptRbi.exe
  2⤵
  PID:4896
- C:\Windows\System\STIhNlK.exe
  C:\Windows\System\STIhNlK.exe
  2⤵
  PID:4912
- C:\Windows\System\mZQhFAF.exe
  C:\Windows\System\mZQhFAF.exe
  2⤵
  PID:4928
- C:\Windows\System\WZnHWUT.exe
  C:\Windows\System\WZnHWUT.exe
  2⤵
  PID:4948
- C:\Windows\System\ipMoqaY.exe
  C:\Windows\System\ipMoqaY.exe
  2⤵
  PID:4964
- C:\Windows\System\kkSIdKq.exe
  C:\Windows\System\kkSIdKq.exe
  2⤵
  PID:4980
- C:\Windows\System\zwJQSMh.exe
  C:\Windows\System\zwJQSMh.exe
  2⤵
  PID:4996
- C:\Windows\System\gaYCfyC.exe
  C:\Windows\System\gaYCfyC.exe
  2⤵
  PID:5016
- C:\Windows\System\VvSpBdI.exe
  C:\Windows\System\VvSpBdI.exe
  2⤵
  PID:5032
- C:\Windows\System\fDuLGAr.exe
  C:\Windows\System\fDuLGAr.exe
  2⤵
  PID:5048
- C:\Windows\System\sSCBLbz.exe
  C:\Windows\System\sSCBLbz.exe
  2⤵
  PID:5064
- C:\Windows\System\cWuuvFZ.exe
  C:\Windows\System\cWuuvFZ.exe
  2⤵
  PID:5080
- C:\Windows\System\DeHhZmh.exe
  C:\Windows\System\DeHhZmh.exe
  2⤵
  PID:5096
- C:\Windows\System\YaUbuPa.exe
  C:\Windows\System\YaUbuPa.exe
  2⤵
  PID:5112
- C:\Windows\System\YfyhxUW.exe
  C:\Windows\System\YfyhxUW.exe
  2⤵
  PID:3236
- C:\Windows\System\jleJAZu.exe
  C:\Windows\System\jleJAZu.exe
  2⤵
  PID:3300
- C:\Windows\System\xvBsCXq.exe
  C:\Windows\System\xvBsCXq.exe
  2⤵
  PID:3368
- C:\Windows\System\TqLLxOc.exe
  C:\Windows\System\TqLLxOc.exe
  2⤵
  PID:3428
- C:\Windows\System\pMWrnvc.exe
  C:\Windows\System\pMWrnvc.exe
  2⤵
  PID:3828
- C:\Windows\System\AhOsqcT.exe
  C:\Windows\System\AhOsqcT.exe
  2⤵
  PID:3896
- C:\Windows\System\qGMIDpf.exe
  C:\Windows\System\qGMIDpf.exe
  2⤵
  PID:3932
- C:\Windows\System\dbNkAFd.exe
  C:\Windows\System\dbNkAFd.exe
  2⤵
  PID:4000
- C:\Windows\System\YOewBSy.exe
  C:\Windows\System\YOewBSy.exe
  2⤵
  PID:4064
- C:\Windows\System\RyTGKPN.exe
  C:\Windows\System\RyTGKPN.exe
  2⤵
  PID:2464
- C:\Windows\System\irPucdR.exe
  C:\Windows\System\irPucdR.exe
  2⤵
  PID:3124
- C:\Windows\System\gwNbrwH.exe
  C:\Windows\System\gwNbrwH.exe
  2⤵
  PID:3352
- C:\Windows\System\UYKtoOv.exe
  C:\Windows\System\UYKtoOv.exe
  2⤵
  PID:3648
- C:\Windows\System\jmEwsFu.exe
  C:\Windows\System\jmEwsFu.exe
  2⤵
  PID:3136
- C:\Windows\System\YZMQbPD.exe
  C:\Windows\System\YZMQbPD.exe
  2⤵
  PID:4144
- C:\Windows\System\liLVLGK.exe
  C:\Windows\System\liLVLGK.exe
  2⤵
  PID:4208
- C:\Windows\System\ycEMmxr.exe
  C:\Windows\System\ycEMmxr.exe
  2⤵
  PID:4272
- C:\Windows\System\dXpREZd.exe
  C:\Windows\System\dXpREZd.exe
  2⤵
  PID:4340
- C:\Windows\System\RQvGiMD.exe
  C:\Windows\System\RQvGiMD.exe
  2⤵
  PID:4404
- C:\Windows\System\FLtTrCr.exe
  C:\Windows\System\FLtTrCr.exe
  2⤵
  PID:4468
- C:\Windows\System\feGGQoB.exe
  C:\Windows\System\feGGQoB.exe
  2⤵
  PID:4508
- C:\Windows\System\QxxDMGy.exe
  C:\Windows\System\QxxDMGy.exe
  2⤵
  PID:4560
- C:\Windows\System\gQxcdaF.exe
  C:\Windows\System\gQxcdaF.exe
  2⤵
  PID:3532
- C:\Windows\System\OFpnoqR.exe
  C:\Windows\System\OFpnoqR.exe
  2⤵
  PID:3600
- C:\Windows\System\dXFChDX.exe
  C:\Windows\System\dXFChDX.exe
  2⤵
  PID:4604
- C:\Windows\System\IMhAVGK.exe
  C:\Windows\System\IMhAVGK.exe
  2⤵
  PID:4696
- C:\Windows\System\jefEkae.exe
  C:\Windows\System\jefEkae.exe
  2⤵
  PID:1612
- C:\Windows\System\XixBXTy.exe
  C:\Windows\System\XixBXTy.exe
  2⤵
  PID:4828
- C:\Windows\System\zDrNtQD.exe
  C:\Windows\System\zDrNtQD.exe
  2⤵
  PID:2796
- C:\Windows\System\TXYgPIy.exe
  C:\Windows\System\TXYgPIy.exe
  2⤵
  PID:3580
- C:\Windows\System\XkAqxgm.exe
  C:\Windows\System\XkAqxgm.exe
  2⤵
  PID:4124
- C:\Windows\System\MUXXZWm.exe
  C:\Windows\System\MUXXZWm.exe
  2⤵
  PID:4224
- C:\Windows\System\dEnfCnV.exe
  C:\Windows\System\dEnfCnV.exe
  2⤵
  PID:4292
- C:\Windows\System\bRXskBO.exe
  C:\Windows\System\bRXskBO.exe
  2⤵
  PID:4388
- C:\Windows\System\aTAqFhA.exe
  C:\Windows\System\aTAqFhA.exe
  2⤵
  PID:4484
- C:\Windows\System\HAPSlzF.exe
  C:\Windows\System\HAPSlzF.exe
  2⤵
  PID:4584
- C:\Windows\System\XFqwdZu.exe
  C:\Windows\System\XFqwdZu.exe
  2⤵
  PID:4648
- C:\Windows\System\cVPNguw.exe
  C:\Windows\System\cVPNguw.exe
  2⤵
  PID:4712
- C:\Windows\System\ihJhVrp.exe
  C:\Windows\System\ihJhVrp.exe
  2⤵
  PID:3464
- C:\Windows\System\AjGsbum.exe
  C:\Windows\System\AjGsbum.exe
  2⤵
  PID:2548
- C:\Windows\System\luAfSya.exe
  C:\Windows\System\luAfSya.exe
  2⤵
  PID:4128
- C:\Windows\System\sCsnADd.exe
  C:\Windows\System\sCsnADd.exe
  2⤵
  PID:4384
- C:\Windows\System\kzMUtQP.exe
  C:\Windows\System\kzMUtQP.exe
  2⤵
  PID:4532
- C:\Windows\System\PyLgKyx.exe
  C:\Windows\System\PyLgKyx.exe
  2⤵
  PID:1524
- C:\Windows\System\TKjZgWU.exe
  C:\Windows\System\TKjZgWU.exe
  2⤵
  PID:3692
- C:\Windows\System\FSNvwDP.exe
  C:\Windows\System\FSNvwDP.exe
  2⤵
  PID:3708
- C:\Windows\System\HLXkAWW.exe
  C:\Windows\System\HLXkAWW.exe
  2⤵
  PID:3752
- C:\Windows\System\PlBhaAp.exe
  C:\Windows\System\PlBhaAp.exe
  2⤵
  PID:3816
- C:\Windows\System\PVhNmYJ.exe
  C:\Windows\System\PVhNmYJ.exe
  2⤵
  PID:3880
- C:\Windows\System\rOmZDuB.exe
  C:\Windows\System\rOmZDuB.exe
  2⤵
  PID:3948
- C:\Windows\System\xquoCFV.exe
  C:\Windows\System\xquoCFV.exe
  2⤵
  PID:4016
- C:\Windows\System\zzatkiF.exe
  C:\Windows\System\zzatkiF.exe
  2⤵
  PID:2888
- C:\Windows\System\oxmCWJy.exe
  C:\Windows\System\oxmCWJy.exe
  2⤵
  PID:2668
- C:\Windows\System\NLHwZrB.exe
  C:\Windows\System\NLHwZrB.exe
  2⤵
  PID:3112
- C:\Windows\System\kSZofUi.exe
  C:\Windows\System\kSZofUi.exe
  2⤵
  PID:4944
- C:\Windows\System\QNepchW.exe
  C:\Windows\System\QNepchW.exe
  2⤵
  PID:4976
- C:\Windows\System\LUOHNpb.exe
  C:\Windows\System\LUOHNpb.exe
  2⤵
  PID:5028
- C:\Windows\System\gyibZkK.exe
  C:\Windows\System\gyibZkK.exe
  2⤵
  PID:5092
- C:\Windows\System\PaUFSis.exe
  C:\Windows\System\PaUFSis.exe
  2⤵
  PID:3232
- C:\Windows\System\maWtoiL.exe
  C:\Windows\System\maWtoiL.exe
  2⤵
  PID:5072
- C:\Windows\System\XwcVnop.exe
  C:\Windows\System\XwcVnop.exe
  2⤵
  PID:3796
- C:\Windows\System\qYLbYtJ.exe
  C:\Windows\System\qYLbYtJ.exe
  2⤵
  PID:3400
- C:\Windows\System\XEUMWim.exe
  C:\Windows\System\XEUMWim.exe
  2⤵
  PID:3768
- C:\Windows\System\VbwQhop.exe
  C:\Windows\System\VbwQhop.exe
  2⤵
  PID:3864
- C:\Windows\System\bQUwacg.exe
  C:\Windows\System\bQUwacg.exe
  2⤵
  PID:3384
- C:\Windows\System\dvnSPrE.exe
  C:\Windows\System\dvnSPrE.exe
  2⤵
  PID:3992
- C:\Windows\System\XnaxhVR.exe
  C:\Windows\System\XnaxhVR.exe
  2⤵
  PID:4240
- C:\Windows\System\gMVErPo.exe
  C:\Windows\System\gMVErPo.exe
  2⤵
  PID:2932
- C:\Windows\System\GTxNYDv.exe
  C:\Windows\System\GTxNYDv.exe
  2⤵
  PID:4500
- C:\Windows\System\YsBufyH.exe
  C:\Windows\System\YsBufyH.exe
  2⤵
  PID:1588
- C:\Windows\System\hpjTgsf.exe
  C:\Windows\System\hpjTgsf.exe
  2⤵
  PID:4572
- C:\Windows\System\mMvGFYc.exe
  C:\Windows\System\mMvGFYc.exe
  2⤵
  PID:1092
- C:\Windows\System\NNSSGNv.exe
  C:\Windows\System\NNSSGNv.exe
  2⤵
  PID:3172
- C:\Windows\System\PhYXrHY.exe
  C:\Windows\System\PhYXrHY.exe
  2⤵
  PID:4452
- C:\Windows\System\GjQHykU.exe
  C:\Windows\System\GjQHykU.exe
  2⤵
  PID:4744
- C:\Windows\System\YWDPCOW.exe
  C:\Windows\System\YWDPCOW.exe
  2⤵
  PID:3248
- C:\Windows\System\gqjKbGU.exe
  C:\Windows\System\gqjKbGU.exe
  2⤵
  PID:2620
- C:\Windows\System\yrrRNKU.exe
  C:\Windows\System\yrrRNKU.exe
  2⤵
  PID:4308
- C:\Windows\System\MMaklbW.exe
  C:\Windows\System\MMaklbW.exe
  2⤵
  PID:1096
- C:\Windows\System\dMHwMrN.exe
  C:\Windows\System\dMHwMrN.exe
  2⤵
  PID:3716
- C:\Windows\System\omavnrF.exe
  C:\Windows\System\omavnrF.exe
  2⤵
  PID:3980
- C:\Windows\System\szAVPDO.exe
  C:\Windows\System\szAVPDO.exe
  2⤵
  PID:3188
- C:\Windows\System\kshSBEg.exe
  C:\Windows\System\kshSBEg.exe
  2⤵
  PID:4664
- C:\Windows\System\krWDwZy.exe
  C:\Windows\System\krWDwZy.exe
  2⤵
  PID:4548
- C:\Windows\System\HvVZQAg.exe
  C:\Windows\System\HvVZQAg.exe
  2⤵
  PID:3628
- C:\Windows\System\IikDxVs.exe
  C:\Windows\System\IikDxVs.exe
  2⤵
  PID:2240
- C:\Windows\System\hUwfCQZ.exe
  C:\Windows\System\hUwfCQZ.exe
  2⤵
  PID:4892
- C:\Windows\System\upgsMal.exe
  C:\Windows\System\upgsMal.exe
  2⤵
  PID:4792
- C:\Windows\System\CzGWXRZ.exe
  C:\Windows\System\CzGWXRZ.exe
  2⤵
  PID:4940
- C:\Windows\System\SUrShRS.exe
  C:\Windows\System\SUrShRS.exe
  2⤵
  PID:2552
- C:\Windows\System\SlUobad.exe
  C:\Windows\System\SlUobad.exe
  2⤵
  PID:4076
- C:\Windows\System\RkTFtQS.exe
  C:\Windows\System\RkTFtQS.exe
  2⤵
  PID:2408
- C:\Windows\System\ackRvKV.exe
  C:\Windows\System\ackRvKV.exe
  2⤵
  PID:4684
- C:\Windows\System\zuCCKBn.exe
  C:\Windows\System\zuCCKBn.exe
  2⤵
  PID:4920
- C:\Windows\System\RmJxklU.exe
  C:\Windows\System\RmJxklU.exe
  2⤵
  PID:4924
- C:\Windows\System\cCvOups.exe
  C:\Windows\System\cCvOups.exe
  2⤵
  PID:2952
- C:\Windows\System\brrAYuK.exe
  C:\Windows\System\brrAYuK.exe
  2⤵
  PID:1440
- C:\Windows\System\FEKgzOH.exe
  C:\Windows\System\FEKgzOH.exe
  2⤵
  PID:2740
- C:\Windows\System\qISkTZI.exe
  C:\Windows\System\qISkTZI.exe
  2⤵
  PID:4876
- C:\Windows\System\ppBsyJd.exe
  C:\Windows\System\ppBsyJd.exe
  2⤵
  PID:3928
- C:\Windows\System\zGKXRzn.exe
  C:\Windows\System\zGKXRzn.exe
  2⤵
  PID:4988
- C:\Windows\System\JTkGKEp.exe
  C:\Windows\System\JTkGKEp.exe
  2⤵
  PID:3528
- C:\Windows\System\crquzdz.exe
  C:\Windows\System\crquzdz.exe
  2⤵
  PID:1108
- C:\Windows\System\ZDbONll.exe
  C:\Windows\System\ZDbONll.exe
  2⤵
  PID:3204
- C:\Windows\System\AhUCCaI.exe
  C:\Windows\System\AhUCCaI.exe
  2⤵
  PID:3736
- C:\Windows\System\fmpFOzB.exe
  C:\Windows\System\fmpFOzB.exe
  2⤵
  PID:3096
- C:\Windows\System\QaoVdDy.exe
  C:\Windows\System\QaoVdDy.exe
  2⤵
  PID:4288
- C:\Windows\System\CJiilHH.exe
  C:\Windows\System\CJiilHH.exe
  2⤵
  PID:2088
- C:\Windows\System\vwPpQqE.exe
  C:\Windows\System\vwPpQqE.exe
  2⤵
  PID:1632
- C:\Windows\System\WAoRhnq.exe
  C:\Windows\System\WAoRhnq.exe
  2⤵
  PID:4304
- C:\Windows\System\cGIVkyV.exe
  C:\Windows\System\cGIVkyV.exe
  2⤵
  PID:1908
- C:\Windows\System\FdNuCvD.exe
  C:\Windows\System\FdNuCvD.exe
  2⤵
  PID:4192
- C:\Windows\System\kccvvFy.exe
  C:\Windows\System\kccvvFy.exe
  2⤵
  PID:908
- C:\Windows\System\tgPTDvh.exe
  C:\Windows\System\tgPTDvh.exe
  2⤵
  PID:4436
- C:\Windows\System\CrFzxsA.exe
  C:\Windows\System\CrFzxsA.exe
  2⤵
  PID:4808
- C:\Windows\System\fMfqrCJ.exe
  C:\Windows\System\fMfqrCJ.exe
  2⤵
  PID:1936
- C:\Windows\System\BvdLpHz.exe
  C:\Windows\System\BvdLpHz.exe
  2⤵
  PID:1928
- C:\Windows\System\NXoIPSO.exe
  C:\Windows\System\NXoIPSO.exe
  2⤵
  PID:4960
- C:\Windows\System\AAmBvVp.exe
  C:\Windows\System\AAmBvVp.exe
  2⤵
  PID:3876
- C:\Windows\System\FYjipJF.exe
  C:\Windows\System\FYjipJF.exe
  2⤵
  PID:3296
- C:\Windows\System\hgbDxhG.exe
  C:\Windows\System\hgbDxhG.exe
  2⤵
  PID:2112
- C:\Windows\System\DOoiANP.exe
  C:\Windows\System\DOoiANP.exe
  2⤵
  PID:5040
- C:\Windows\System\KEEluff.exe
  C:\Windows\System\KEEluff.exe
  2⤵
  PID:2660
- C:\Windows\System\ISVrDWS.exe
  C:\Windows\System\ISVrDWS.exe
  2⤵
  PID:3704
- C:\Windows\System\moNlXtT.exe
  C:\Windows\System\moNlXtT.exe
  2⤵
  PID:4872
- C:\Windows\System\hQSPfpE.exe
  C:\Windows\System\hQSPfpE.exe
  2⤵
  PID:4140
- C:\Windows\System\Gqzgkht.exe
  C:\Windows\System\Gqzgkht.exe
  2⤵
  PID:4400
- C:\Windows\System\TeVImtd.exe
  C:\Windows\System\TeVImtd.exe
  2⤵
  PID:4188
- C:\Windows\System\tlBAwqA.exe
  C:\Windows\System\tlBAwqA.exe
  2⤵
  PID:5124
- C:\Windows\System\qtUpKel.exe
  C:\Windows\System\qtUpKel.exe
  2⤵
  PID:5140
- C:\Windows\System\vRYpHAn.exe
  C:\Windows\System\vRYpHAn.exe
  2⤵
  PID:5156
- C:\Windows\System\jNTTiSl.exe
  C:\Windows\System\jNTTiSl.exe
  2⤵
  PID:5172
- C:\Windows\System\YxKtQuR.exe
  C:\Windows\System\YxKtQuR.exe
  2⤵
  PID:5188
- C:\Windows\System\NBlTWIk.exe
  C:\Windows\System\NBlTWIk.exe
  2⤵
  PID:5204
- C:\Windows\System\mRWjqmp.exe
  C:\Windows\System\mRWjqmp.exe
  2⤵
  PID:5220
- C:\Windows\System\PUjvUSC.exe
  C:\Windows\System\PUjvUSC.exe
  2⤵
  PID:5236
- C:\Windows\System\txueoyu.exe
  C:\Windows\System\txueoyu.exe
  2⤵
  PID:5252
- C:\Windows\System\LgVhLdh.exe
  C:\Windows\System\LgVhLdh.exe
  2⤵
  PID:5268
- C:\Windows\System\ORujEwy.exe
  C:\Windows\System\ORujEwy.exe
  2⤵
  PID:5284
- C:\Windows\System\ecUMuPT.exe
  C:\Windows\System\ecUMuPT.exe
  2⤵
  PID:5300
- C:\Windows\System\tHGygSQ.exe
  C:\Windows\System\tHGygSQ.exe
  2⤵
  PID:5316
- C:\Windows\System\tXPQwcR.exe
  C:\Windows\System\tXPQwcR.exe
  2⤵
  PID:5332
- C:\Windows\System\THmpyBh.exe
  C:\Windows\System\THmpyBh.exe
  2⤵
  PID:5348
- C:\Windows\System\BBjGkYV.exe
  C:\Windows\System\BBjGkYV.exe
  2⤵
  PID:5364
- C:\Windows\System\dzHvMHB.exe
  C:\Windows\System\dzHvMHB.exe
  2⤵
  PID:5380
- C:\Windows\System\ZDSqLjB.exe
  C:\Windows\System\ZDSqLjB.exe
  2⤵
  PID:5396
- C:\Windows\System\bhBWAIs.exe
  C:\Windows\System\bhBWAIs.exe
  2⤵
  PID:5412
- C:\Windows\System\hAHdJlf.exe
  C:\Windows\System\hAHdJlf.exe
  2⤵
  PID:5428
- C:\Windows\System\PyGsKTj.exe
  C:\Windows\System\PyGsKTj.exe
  2⤵
  PID:5444
- C:\Windows\System\tuwbIIV.exe
  C:\Windows\System\tuwbIIV.exe
  2⤵
  PID:5460
- C:\Windows\System\Vnuzncj.exe
  C:\Windows\System\Vnuzncj.exe
  2⤵
  PID:5476
- C:\Windows\System\TvcHjew.exe
  C:\Windows\System\TvcHjew.exe
  2⤵
  PID:5492
- C:\Windows\System\WrbjNJG.exe
  C:\Windows\System\WrbjNJG.exe
  2⤵
  PID:5508
- C:\Windows\System\eIxpqnw.exe
  C:\Windows\System\eIxpqnw.exe
  2⤵
  PID:5524
- C:\Windows\System\FFfbAfV.exe
  C:\Windows\System\FFfbAfV.exe
  2⤵
  PID:5540
- C:\Windows\System\GtESIrr.exe
  C:\Windows\System\GtESIrr.exe
  2⤵
  PID:5556
- C:\Windows\System\iIHIzDG.exe
  C:\Windows\System\iIHIzDG.exe
  2⤵
  PID:5572
- C:\Windows\System\MblgFrc.exe
  C:\Windows\System\MblgFrc.exe
  2⤵
  PID:5588
- C:\Windows\System\hgYOcIP.exe
  C:\Windows\System\hgYOcIP.exe
  2⤵
  PID:5604
- C:\Windows\System\cSCkPIR.exe
  C:\Windows\System\cSCkPIR.exe
  2⤵
  PID:5620
- C:\Windows\System\JbCeKjF.exe
  C:\Windows\System\JbCeKjF.exe
  2⤵
  PID:5636
- C:\Windows\System\lgcJmYm.exe
  C:\Windows\System\lgcJmYm.exe
  2⤵
  PID:5652
- C:\Windows\System\cTBWQNx.exe
  C:\Windows\System\cTBWQNx.exe
  2⤵
  PID:5668
- C:\Windows\System\CPTrURT.exe
  C:\Windows\System\CPTrURT.exe
  2⤵
  PID:5684
- C:\Windows\System\XsEtdRL.exe
  C:\Windows\System\XsEtdRL.exe
  2⤵
  PID:5700
- C:\Windows\System\ejjbzah.exe
  C:\Windows\System\ejjbzah.exe
  2⤵
  PID:5716
- C:\Windows\System\IMzYOaQ.exe
  C:\Windows\System\IMzYOaQ.exe
  2⤵
  PID:5732
- C:\Windows\System\jeamhoD.exe
  C:\Windows\System\jeamhoD.exe
  2⤵
  PID:5748
- C:\Windows\System\tQcLmAw.exe
  C:\Windows\System\tQcLmAw.exe
  2⤵
  PID:5764
- C:\Windows\System\glOHWjT.exe
  C:\Windows\System\glOHWjT.exe
  2⤵
  PID:5780
- C:\Windows\System\lsNNLnM.exe
  C:\Windows\System\lsNNLnM.exe
  2⤵
  PID:5796
- C:\Windows\System\oZxxCXa.exe
  C:\Windows\System\oZxxCXa.exe
  2⤵
  PID:5816
- C:\Windows\System\UoANCmE.exe
  C:\Windows\System\UoANCmE.exe
  2⤵
  PID:5832
- C:\Windows\System\vAmeTXl.exe
  C:\Windows\System\vAmeTXl.exe
  2⤵
  PID:5848
- C:\Windows\System\opBmElK.exe
  C:\Windows\System\opBmElK.exe
  2⤵
  PID:5864
- C:\Windows\System\jfupFec.exe
  C:\Windows\System\jfupFec.exe
  2⤵
  PID:5880
- C:\Windows\System\MwbxsRB.exe
  C:\Windows\System\MwbxsRB.exe
  2⤵
  PID:5952
- C:\Windows\System\KSrOEmW.exe
  C:\Windows\System\KSrOEmW.exe
  2⤵
  PID:6032
- C:\Windows\System\Tumciqe.exe
  C:\Windows\System\Tumciqe.exe
  2⤵
  PID:6052
- C:\Windows\System\qEsYOvS.exe
  C:\Windows\System\qEsYOvS.exe
  2⤵
  PID:6068
- C:\Windows\System\kPaHPNj.exe
  C:\Windows\System\kPaHPNj.exe
  2⤵
  PID:6084
- C:\Windows\System\CqnMklv.exe
  C:\Windows\System\CqnMklv.exe
  2⤵
  PID:6100
- C:\Windows\System\zyugtoJ.exe
  C:\Windows\System\zyugtoJ.exe
  2⤵
  PID:6116
- C:\Windows\System\qxGhqJE.exe
  C:\Windows\System\qxGhqJE.exe
  2⤵
  PID:6132
- C:\Windows\System\qMcVySD.exe
  C:\Windows\System\qMcVySD.exe
  2⤵
  PID:2092
- C:\Windows\System\cSepLHW.exe
  C:\Windows\System\cSepLHW.exe
  2⤵
  PID:5136
- C:\Windows\System\uEaPsbu.exe
  C:\Windows\System\uEaPsbu.exe
  2⤵
  PID:5196
- C:\Windows\System\YWUrawS.exe
  C:\Windows\System\YWUrawS.exe
  2⤵
  PID:5232
- C:\Windows\System\njSvpLQ.exe
  C:\Windows\System\njSvpLQ.exe
  2⤵
  PID:5292
- C:\Windows\System\NejqMpn.exe
  C:\Windows\System\NejqMpn.exe
  2⤵
  PID:5356
- C:\Windows\System\AsDpGRt.exe
  C:\Windows\System\AsDpGRt.exe
  2⤵
  PID:5420
- C:\Windows\System\ibUQuaQ.exe
  C:\Windows\System\ibUQuaQ.exe
  2⤵
  PID:5484
- C:\Windows\System\eDaJeGp.exe
  C:\Windows\System\eDaJeGp.exe
  2⤵
  PID:5520
- C:\Windows\System\FbMFNsu.exe
  C:\Windows\System\FbMFNsu.exe
  2⤵
  PID:3812
- C:\Windows\System\OqZQjGR.exe
  C:\Windows\System\OqZQjGR.exe
  2⤵
  PID:4080
- C:\Windows\System\mXhOaws.exe
  C:\Windows\System\mXhOaws.exe
  2⤵
  PID:5088
- C:\Windows\System\PUtVfWo.exe
  C:\Windows\System\PUtVfWo.exe
  2⤵
  PID:5584
- C:\Windows\System\XgWXZyA.exe
  C:\Windows\System\XgWXZyA.exe
  2⤵
  PID:5648
- C:\Windows\System\WZwMttk.exe
  C:\Windows\System\WZwMttk.exe
  2⤵
  PID:3268
- C:\Windows\System\hSkXyJc.exe
  C:\Windows\System\hSkXyJc.exe
  2⤵
  PID:1216
- C:\Windows\System\ocyPLVi.exe
  C:\Windows\System\ocyPLVi.exe
  2⤵
  PID:5152
- C:\Windows\System\ufNYFNr.exe
  C:\Windows\System\ufNYFNr.exe
  2⤵
  PID:5276
- C:\Windows\System\buiqkAF.exe
  C:\Windows\System\buiqkAF.exe
  2⤵
  PID:5340
- C:\Windows\System\jGZGTJp.exe
  C:\Windows\System\jGZGTJp.exe
  2⤵
  PID:5404
- C:\Windows\System\KLChnXs.exe
  C:\Windows\System\KLChnXs.exe
  2⤵
  PID:5472
- C:\Windows\System\YAlDqqq.exe
  C:\Windows\System\YAlDqqq.exe
  2⤵
  PID:5536
- C:\Windows\System\QmvoNZX.exe
  C:\Windows\System\QmvoNZX.exe
  2⤵
  PID:5600
- C:\Windows\System\tjakWZc.exe
  C:\Windows\System\tjakWZc.exe
  2⤵
  PID:5692
- C:\Windows\System\sREddWH.exe
  C:\Windows\System\sREddWH.exe
  2⤵
  PID:5756
- C:\Windows\System\CnhEMNB.exe
  C:\Windows\System\CnhEMNB.exe
  2⤵
  PID:5888
- C:\Windows\System\jpTxNtI.exe
  C:\Windows\System\jpTxNtI.exe
  2⤵
  PID:5860
- C:\Windows\System\dBYkrAh.exe
  C:\Windows\System\dBYkrAh.exe
  2⤵
  PID:5900
- C:\Windows\System\gDkxUDl.exe
  C:\Windows\System\gDkxUDl.exe
  2⤵
  PID:5912
- C:\Windows\System\KzOOqjK.exe
  C:\Windows\System\KzOOqjK.exe
  2⤵
  PID:5928
- C:\Windows\System\ULEQRaT.exe
  C:\Windows\System\ULEQRaT.exe
  2⤵
  PID:5944
- C:\Windows\System\NTSGVaX.exe
  C:\Windows\System\NTSGVaX.exe
  2⤵
  PID:5976
- C:\Windows\System\cPfpEgD.exe
  C:\Windows\System\cPfpEgD.exe
  2⤵
  PID:5984
- C:\Windows\System\ZMGCMOY.exe
  C:\Windows\System\ZMGCMOY.exe
  2⤵
  PID:5996
- C:\Windows\System\hEwBjgU.exe
  C:\Windows\System\hEwBjgU.exe
  2⤵
  PID:2832
- C:\Windows\System\SbhdAZy.exe
  C:\Windows\System\SbhdAZy.exe
  2⤵
  PID:6040
- C:\Windows\System\DWjKvJX.exe
  C:\Windows\System\DWjKvJX.exe
  2⤵
  PID:6016
- C:\Windows\System\mqzsRFl.exe
  C:\Windows\System\mqzsRFl.exe
  2⤵
  PID:6028
- C:\Windows\System\AafLFyh.exe
  C:\Windows\System\AafLFyh.exe
  2⤵
  PID:6108
- C:\Windows\System\UMJteny.exe
  C:\Windows\System\UMJteny.exe
  2⤵
  PID:5168
- C:\Windows\System\RmgWhCt.exe
  C:\Windows\System\RmgWhCt.exe
  2⤵
  PID:6092
- C:\Windows\System\kVKLSJe.exe
  C:\Windows\System\kVKLSJe.exe
  2⤵
  PID:5488
- C:\Windows\System\idWOQaY.exe
  C:\Windows\System\idWOQaY.exe
  2⤵
  PID:5392
- C:\Windows\System\ewFPqnz.exe
  C:\Windows\System\ewFPqnz.exe
  2⤵
  PID:5908
- C:\Windows\System\sJgqqmT.exe
  C:\Windows\System\sJgqqmT.exe
  2⤵
  PID:5452
- C:\Windows\System\YdXfjtt.exe
  C:\Windows\System\YdXfjtt.exe
  2⤵
  PID:5644
- C:\Windows\System\fSPEZsa.exe
  C:\Windows\System\fSPEZsa.exe
  2⤵
  PID:4728
- C:\Windows\System\SnqKxrw.exe
  C:\Windows\System\SnqKxrw.exe
  2⤵
  PID:2448
- C:\Windows\System\ZIfYfIB.exe
  C:\Windows\System\ZIfYfIB.exe
  2⤵
  PID:5680
- C:\Windows\System\lcujBky.exe
  C:\Windows\System\lcujBky.exe
  2⤵
  PID:5712
- C:\Windows\System\STgDsri.exe
  C:\Windows\System\STgDsri.exe
  2⤵
  PID:5744
- C:\Windows\System\gNIaqJz.exe
  C:\Windows\System\gNIaqJz.exe
  2⤵
  PID:4732
- C:\Windows\System\SGjgvjQ.exe
  C:\Windows\System\SGjgvjQ.exe
  2⤵
  PID:4764
- C:\Windows\System\RDMbVPD.exe
  C:\Windows\System\RDMbVPD.exe
  2⤵
  PID:4636
- C:\Windows\System\TMtBBCJ.exe
  C:\Windows\System\TMtBBCJ.exe
  2⤵
  PID:3848
- C:\Windows\System\OumAnhp.exe
  C:\Windows\System\OumAnhp.exe
  2⤵
  PID:5840
- C:\Windows\System\jLORqrO.exe
  C:\Windows\System\jLORqrO.exe
  2⤵
  PID:4204
- C:\Windows\System\VofTBfR.exe
  C:\Windows\System\VofTBfR.exe
  2⤵
  PID:3444
- C:\Windows\System\xnIcjJH.exe
  C:\Windows\System\xnIcjJH.exe
  2⤵
  PID:5216
- C:\Windows\System\DhwYfDV.exe
  C:\Windows\System\DhwYfDV.exe
  2⤵
  PID:5312
- C:\Windows\System\zNhigOn.exe
  C:\Windows\System\zNhigOn.exe
  2⤵
  PID:5440
- C:\Windows\System\rGsqXho.exe
  C:\Windows\System\rGsqXho.exe
  2⤵
  PID:5568
- C:\Windows\System\BAiMnVw.exe
  C:\Windows\System\BAiMnVw.exe
  2⤵
  PID:5660
- C:\Windows\System\MFvEABj.exe
  C:\Windows\System\MFvEABj.exe
  2⤵
  PID:5824
- C:\Windows\System\eJcsTeu.exe
  C:\Windows\System\eJcsTeu.exe
  2⤵
  PID:1044
- C:\Windows\System\EnnujUu.exe
  C:\Windows\System\EnnujUu.exe
  2⤵
  PID:5940
- C:\Windows\System\HWhNxIB.exe
  C:\Windows\System\HWhNxIB.exe
  2⤵
  PID:5960
- C:\Windows\System\ruTkiRP.exe
  C:\Windows\System\ruTkiRP.exe
  2⤵
  PID:5968
- C:\Windows\System\rMppNUY.exe
  C:\Windows\System\rMppNUY.exe
  2⤵
  PID:5992
- C:\Windows\System\RmFccld.exe
  C:\Windows\System\RmFccld.exe
  2⤵
  PID:1824
- C:\Windows\System\dqSbFvD.exe
  C:\Windows\System\dqSbFvD.exe
  2⤵
  PID:1128
- C:\Windows\System\lahPMDf.exe
  C:\Windows\System\lahPMDf.exe
  2⤵
  PID:6140
- C:\Windows\System\NBCzNcY.exe
  C:\Windows\System\NBCzNcY.exe
  2⤵
  PID:4544
- C:\Windows\System\ANYttXu.exe
  C:\Windows\System\ANYttXu.exe
  2⤵
  PID:5360
- C:\Windows\System\nMWeCZb.exe
  C:\Windows\System\nMWeCZb.exe
  2⤵
  PID:1296
- C:\Windows\System\PQunqfZ.exe
  C:\Windows\System\PQunqfZ.exe
  2⤵
  PID:856
- C:\Windows\System\GOBAIaW.exe
  C:\Windows\System\GOBAIaW.exe
  2⤵
  PID:5212
- C:\Windows\System\StlOZhc.exe
  C:\Windows\System\StlOZhc.exe
  2⤵
  PID:5804
- C:\Windows\System\dNOOUzR.exe
  C:\Windows\System\dNOOUzR.exe
  2⤵
  PID:6064
- C:\Windows\System\oGrbKol.exe
  C:\Windows\System\oGrbKol.exe
  2⤵
  PID:2748
- C:\Windows\System\xfNVbKI.exe
  C:\Windows\System\xfNVbKI.exe
  2⤵
  PID:4520
- C:\Windows\System\ofBUbLf.exe
  C:\Windows\System\ofBUbLf.exe
  2⤵
  PID:5504
- C:\Windows\System\JQoEiQy.exe
  C:\Windows\System\JQoEiQy.exe
  2⤵
  PID:1172
- C:\Windows\System\TMuRIiV.exe
  C:\Windows\System\TMuRIiV.exe
  2⤵
  PID:5808
- C:\Windows\System\osHQCTA.exe
  C:\Windows\System\osHQCTA.exe
  2⤵
  PID:6008
- C:\Windows\System\poshXwe.exe
  C:\Windows\System\poshXwe.exe
  2⤵
  PID:5328
- C:\Windows\System\ZpnvsPa.exe
  C:\Windows\System\ZpnvsPa.exe
  2⤵
  PID:5664
- C:\Windows\System\KAukfWT.exe
  C:\Windows\System\KAukfWT.exe
  2⤵
  PID:5776
- C:\Windows\System\ibgTQTK.exe
  C:\Windows\System\ibgTQTK.exe
  2⤵
  PID:5788
- C:\Windows\System\snaPytf.exe
  C:\Windows\System\snaPytf.exe
  2⤵
  PID:5920
- C:\Windows\System\roefYxc.exe
  C:\Windows\System\roefYxc.exe
  2⤵
  PID:5148
- C:\Windows\System\IJgIJFR.exe
  C:\Windows\System\IJgIJFR.exe
  2⤵
  PID:3200
- C:\Windows\System\tKPSHnP.exe
  C:\Windows\System\tKPSHnP.exe
  2⤵
  PID:6012
- C:\Windows\System\PXRIKiG.exe
  C:\Windows\System\PXRIKiG.exe
  2⤵
  PID:1456
- C:\Windows\System\NjujnCk.exe
  C:\Windows\System\NjujnCk.exe
  2⤵
  PID:3700
- C:\Windows\System\juxNhSl.exe
  C:\Windows\System\juxNhSl.exe
  2⤵
  PID:5728
- C:\Windows\System\FgzJoRT.exe
  C:\Windows\System\FgzJoRT.exe
  2⤵
  PID:4796
- C:\Windows\System\utfTSAl.exe
  C:\Windows\System\utfTSAl.exe
  2⤵
  PID:5972
- C:\Windows\System\ypyaNhb.exe
  C:\Windows\System\ypyaNhb.exe
  2⤵
  PID:5632
- C:\Windows\System\YhJkJYu.exe
  C:\Windows\System\YhJkJYu.exe
  2⤵
  PID:6160
- C:\Windows\System\cNVLpiQ.exe
  C:\Windows\System\cNVLpiQ.exe
  2⤵
  PID:6176
- C:\Windows\System\tvigdfh.exe
  C:\Windows\System\tvigdfh.exe
  2⤵
  PID:6192
- C:\Windows\System\eMCCaGH.exe
  C:\Windows\System\eMCCaGH.exe
  2⤵
  PID:6212
- C:\Windows\System\CdzFAWf.exe
  C:\Windows\System\CdzFAWf.exe
  2⤵
  PID:6232
- C:\Windows\System\jyXrUTD.exe
  C:\Windows\System\jyXrUTD.exe
  2⤵
  PID:6248
- C:\Windows\System\xtgjLwR.exe
  C:\Windows\System\xtgjLwR.exe
  2⤵
  PID:6264
- C:\Windows\System\wQtOaDI.exe
  C:\Windows\System\wQtOaDI.exe
  2⤵
  PID:6284
- C:\Windows\System\gCOJgvI.exe
  C:\Windows\System\gCOJgvI.exe
  2⤵
  PID:6304
- C:\Windows\System\FYFyPUz.exe
  C:\Windows\System\FYFyPUz.exe
  2⤵
  PID:6320
- C:\Windows\System\PtFpVvc.exe
  C:\Windows\System\PtFpVvc.exe
  2⤵
  PID:6336
- C:\Windows\System\ZIGJoVx.exe
  C:\Windows\System\ZIGJoVx.exe
  2⤵
  PID:6352
- C:\Windows\System\lCEliWm.exe
  C:\Windows\System\lCEliWm.exe
  2⤵
  PID:6368
- C:\Windows\System\AjqPRGs.exe
  C:\Windows\System\AjqPRGs.exe
  2⤵
  PID:6384
- C:\Windows\System\YcmTGfG.exe
  C:\Windows\System\YcmTGfG.exe
  2⤵
  PID:6400
- C:\Windows\System\olxlovY.exe
  C:\Windows\System\olxlovY.exe
  2⤵
  PID:6416
- C:\Windows\System\zByLYpa.exe
  C:\Windows\System\zByLYpa.exe
  2⤵
  PID:6432
- C:\Windows\System\UnrODQI.exe
  C:\Windows\System\UnrODQI.exe
  2⤵
  PID:6448
- C:\Windows\System\MkZqBzi.exe
  C:\Windows\System\MkZqBzi.exe
  2⤵
  PID:6464
- C:\Windows\System\JXBJWKh.exe
  C:\Windows\System\JXBJWKh.exe
  2⤵
  PID:6596
- C:\Windows\System\yoeSbEV.exe
  C:\Windows\System\yoeSbEV.exe
  2⤵
  PID:6620
- C:\Windows\System\gzcCRek.exe
  C:\Windows\System\gzcCRek.exe
  2⤵
  PID:6640
- C:\Windows\System\zbXgjmK.exe
  C:\Windows\System\zbXgjmK.exe
  2⤵
  PID:6656
- C:\Windows\System\gqYMuzp.exe
  C:\Windows\System\gqYMuzp.exe
  2⤵
  PID:6672
- C:\Windows\System\fOAYjlm.exe
  C:\Windows\System\fOAYjlm.exe
  2⤵
  PID:6692
- C:\Windows\System\ThCULcP.exe
  C:\Windows\System\ThCULcP.exe
  2⤵
  PID:6720
- C:\Windows\System\FJaMEYR.exe
  C:\Windows\System\FJaMEYR.exe
  2⤵
  PID:6736
- C:\Windows\System\WmVhOcU.exe
  C:\Windows\System\WmVhOcU.exe
  2⤵
  PID:6756
- C:\Windows\System\euFNiht.exe
  C:\Windows\System\euFNiht.exe
  2⤵
  PID:6772
- C:\Windows\System\gZIYpku.exe
  C:\Windows\System\gZIYpku.exe
  2⤵
  PID:6788
- C:\Windows\System\jXoEgPY.exe
  C:\Windows\System\jXoEgPY.exe
  2⤵
  PID:6804
- C:\Windows\System\AeCpsZM.exe
  C:\Windows\System\AeCpsZM.exe
  2⤵
  PID:6820
- C:\Windows\System\geZqrDe.exe
  C:\Windows\System\geZqrDe.exe
  2⤵
  PID:6836
- C:\Windows\System\BryxxOB.exe
  C:\Windows\System\BryxxOB.exe
  2⤵
  PID:6856
- C:\Windows\System\hQldHdo.exe
  C:\Windows\System\hQldHdo.exe
  2⤵
  PID:6872
- C:\Windows\System\YENrMMS.exe
  C:\Windows\System\YENrMMS.exe
  2⤵
  PID:6888
- C:\Windows\System\QwnIVRl.exe
  C:\Windows\System\QwnIVRl.exe
  2⤵
  PID:6904
- C:\Windows\System\rOyqlwF.exe
  C:\Windows\System\rOyqlwF.exe
  2⤵
  PID:6924
- C:\Windows\System\sozLeNT.exe
  C:\Windows\System\sozLeNT.exe
  2⤵
  PID:6940
- C:\Windows\System\DRqrQrQ.exe
  C:\Windows\System\DRqrQrQ.exe
  2⤵
  PID:6956
- C:\Windows\System\GGXlPcb.exe
  C:\Windows\System\GGXlPcb.exe
  2⤵
  PID:6976
- C:\Windows\System\WSDOICv.exe
  C:\Windows\System\WSDOICv.exe
  2⤵
  PID:6992
- C:\Windows\System\lAaoZvX.exe
  C:\Windows\System\lAaoZvX.exe
  2⤵
  PID:7008
- C:\Windows\System\aFjhcuH.exe
  C:\Windows\System\aFjhcuH.exe
  2⤵
  PID:7052
- C:\Windows\System\AfAtZDG.exe
  C:\Windows\System\AfAtZDG.exe
  2⤵
  PID:1468
- C:\Windows\System\lzLMflk.exe
  C:\Windows\System\lzLMflk.exe
  2⤵
  PID:6184
- C:\Windows\System\gvRpCDA.exe
  C:\Windows\System\gvRpCDA.exe
  2⤵
  PID:6260
- C:\Windows\System\bdXivYc.exe
  C:\Windows\System\bdXivYc.exe
  2⤵
  PID:2116
- C:\Windows\System\xeeJChb.exe
  C:\Windows\System\xeeJChb.exe
  2⤵
  PID:6300
- C:\Windows\System\Lnrhjcv.exe
  C:\Windows\System\Lnrhjcv.exe
  2⤵
  PID:6060
- C:\Windows\System\CGpGXSO.exe
  C:\Windows\System\CGpGXSO.exe
  2⤵
  PID:6316
- C:\Windows\System\DNGwIbP.exe
  C:\Windows\System\DNGwIbP.exe
  2⤵
  PID:6168
- C:\Windows\System\ULjMzAl.exe
  C:\Windows\System\ULjMzAl.exe
  2⤵
  PID:6424
- C:\Windows\System\igkHjOX.exe
  C:\Windows\System\igkHjOX.exe
  2⤵
  PID:6240
- C:\Windows\System\afYvYTG.exe
  C:\Windows\System\afYvYTG.exe
  2⤵
  PID:6460
- C:\Windows\System\QgXcziP.exe
  C:\Windows\System\QgXcziP.exe
  2⤵
  PID:6380
- C:\Windows\System\pychxEv.exe
  C:\Windows\System\pychxEv.exe
  2⤵
  PID:6476
- C:\Windows\System\nnNVOLY.exe
  C:\Windows\System\nnNVOLY.exe
  2⤵
  PID:6488
- C:\Windows\System\ppnZVuf.exe
  C:\Windows\System\ppnZVuf.exe
  2⤵
  PID:3024
- C:\Windows\System\NnQSXAH.exe
  C:\Windows\System\NnQSXAH.exe
  2⤵
  PID:6516
- C:\Windows\System\FKKqQWP.exe
  C:\Windows\System\FKKqQWP.exe
  2⤵
  PID:6532
- C:\Windows\System\hJjVYwE.exe
  C:\Windows\System\hJjVYwE.exe
  2⤵
  PID:6560
- C:\Windows\System\yJUqBgw.exe
  C:\Windows\System\yJUqBgw.exe
  2⤵
  PID:6572
- C:\Windows\System\sdKSuut.exe
  C:\Windows\System\sdKSuut.exe
  2⤵
  PID:6592
- C:\Windows\System\hoJEGJE.exe
  C:\Windows\System\hoJEGJE.exe
  2⤵
  PID:6652
- C:\Windows\System\eHxQVMo.exe
  C:\Windows\System\eHxQVMo.exe
  2⤵
  PID:6896
- C:\Windows\System\gCmLrhd.exe
  C:\Windows\System\gCmLrhd.exe
  2⤵
  PID:6708
- C:\Windows\System\WiNCszf.exe
  C:\Windows\System\WiNCszf.exe
  2⤵
  PID:6636
- C:\Windows\System\UnWdUOn.exe
  C:\Windows\System\UnWdUOn.exe
  2⤵
  PID:7032
- C:\Windows\System\weNoUTO.exe
  C:\Windows\System\weNoUTO.exe
  2⤵
  PID:7028
- C:\Windows\System\ZplbkII.exe
  C:\Windows\System\ZplbkII.exe
  2⤵
  PID:6852
- C:\Windows\System\AupFDPX.exe
  C:\Windows\System\AupFDPX.exe
  2⤵
  PID:6916
- C:\Windows\System\hwyPIGr.exe
  C:\Windows\System\hwyPIGr.exe
  2⤵
  PID:6984
- C:\Windows\System\wRbumOq.exe
  C:\Windows\System\wRbumOq.exe
  2⤵
  PID:7036
- C:\Windows\System\fnsDVFv.exe
  C:\Windows\System\fnsDVFv.exe
  2⤵
  PID:7048
- C:\Windows\System\yOlOsMC.exe
  C:\Windows\System\yOlOsMC.exe
  2⤵
  PID:7128
- C:\Windows\System\RzHvblT.exe
  C:\Windows\System\RzHvblT.exe
  2⤵
  PID:7148
- C:\Windows\System\dvJqDTI.exe
  C:\Windows\System\dvJqDTI.exe
  2⤵
  PID:5436
- C:\Windows\System\RHOprop.exe
  C:\Windows\System\RHOprop.exe
  2⤵
  PID:6204
- C:\Windows\System\TFDufzF.exe
  C:\Windows\System\TFDufzF.exe
  2⤵
  PID:6272
- C:\Windows\System\wBkqePv.exe
  C:\Windows\System\wBkqePv.exe
  2⤵
  PID:6408
- C:\Windows\System\fxuDVdL.exe
  C:\Windows\System\fxuDVdL.exe
  2⤵
  PID:6484
- C:\Windows\System\vjPxAnD.exe
  C:\Windows\System\vjPxAnD.exe
  2⤵
  PID:6548
- C:\Windows\System\ZyMKQbC.exe
  C:\Windows\System\ZyMKQbC.exe
  2⤵
  PID:6608
- C:\Windows\System\WklAzEt.exe
  C:\Windows\System\WklAzEt.exe
  2⤵
  PID:6764
- C:\Windows\System\sbeoYwE.exe
  C:\Windows\System\sbeoYwE.exe
  2⤵
  PID:6936
- C:\Windows\System\MZerpAg.exe
  C:\Windows\System\MZerpAg.exe
  2⤵
  PID:7000
- C:\Windows\System\rAOKzyG.exe
  C:\Windows\System\rAOKzyG.exe
  2⤵
  PID:6780
- C:\Windows\System\qTbGBRs.exe
  C:\Windows\System\qTbGBRs.exe
  2⤵
  PID:6848
- C:\Windows\System\fMwNpWi.exe
  C:\Windows\System\fMwNpWi.exe
  2⤵
  PID:6716
- C:\Windows\System\wmKwxzd.exe
  C:\Windows\System\wmKwxzd.exe
  2⤵
  PID:6332
- C:\Windows\System\BERjZip.exe
  C:\Windows\System\BERjZip.exe
  2⤵
  PID:6220
- C:\Windows\System\dmRSGlf.exe
  C:\Windows\System\dmRSGlf.exe
  2⤵
  PID:6500
- C:\Windows\System\JuQdQEY.exe
  C:\Windows\System\JuQdQEY.exe
  2⤵
  PID:6684
- C:\Windows\System\QQQLxgI.exe
  C:\Windows\System\QQQLxgI.exe
  2⤵
  PID:6440
- C:\Windows\System\ahhZDmW.exe
  C:\Windows\System\ahhZDmW.exe
  2⤵
  PID:6588
- C:\Windows\System\QaTJIIf.exe
  C:\Windows\System\QaTJIIf.exe
  2⤵
  PID:6456
- C:\Windows\System\bchxWcx.exe
  C:\Windows\System\bchxWcx.exe
  2⤵
  PID:6540
- C:\Windows\System\DdOVtxV.exe
  C:\Windows\System\DdOVtxV.exe
  2⤵
  PID:6732
- C:\Windows\System\qynztjb.exe
  C:\Windows\System\qynztjb.exe
  2⤵
  PID:7136
- C:\Windows\System\BnztRSz.exe
  C:\Windows\System\BnztRSz.exe
  2⤵
  PID:6828
- C:\Windows\System\wIiqdzj.exe
  C:\Windows\System\wIiqdzj.exe
  2⤵
  PID:6920
- C:\Windows\System\wKLSYtV.exe
  C:\Windows\System\wKLSYtV.exe
  2⤵
  PID:6800
- C:\Windows\System\RIPkImV.exe
  C:\Windows\System\RIPkImV.exe
  2⤵
  PID:6444
- C:\Windows\System\koowhMb.exe
  C:\Windows\System\koowhMb.exe
  2⤵
  PID:7116
- C:\Windows\System\OMmHiiI.exe
  C:\Windows\System\OMmHiiI.exe
  2⤵
  PID:6156
- C:\Windows\System\kSkCvie.exe
  C:\Windows\System\kSkCvie.exe
  2⤵
  PID:6884
- C:\Windows\System\uBsNlgn.exe
  C:\Windows\System\uBsNlgn.exe
  2⤵
  PID:7144
- C:\Windows\System\EkqHPDv.exe
  C:\Windows\System\EkqHPDv.exe
  2⤵
  PID:7156
- C:\Windows\System\obOhLjR.exe
  C:\Windows\System\obOhLjR.exe
  2⤵
  PID:7180
- C:\Windows\System\vWBgVWP.exe
  C:\Windows\System\vWBgVWP.exe
  2⤵
  PID:7196
- C:\Windows\System\CQYCDcF.exe
  C:\Windows\System\CQYCDcF.exe
  2⤵
  PID:7212
- C:\Windows\System\FUduZSK.exe
  C:\Windows\System\FUduZSK.exe
  2⤵
  PID:7228
- C:\Windows\System\atgSGlG.exe
  C:\Windows\System\atgSGlG.exe
  2⤵
  PID:7244
- C:\Windows\System\vSYuJxq.exe
  C:\Windows\System\vSYuJxq.exe
  2⤵
  PID:7260
- C:\Windows\System\dcupUVW.exe
  C:\Windows\System\dcupUVW.exe
  2⤵
  PID:7276
- C:\Windows\System\fojSZlL.exe
  C:\Windows\System\fojSZlL.exe
  2⤵
  PID:7296
- C:\Windows\System\VCIXemK.exe
  C:\Windows\System\VCIXemK.exe
  2⤵
  PID:7344
- C:\Windows\System\KoBgSQX.exe
  C:\Windows\System\KoBgSQX.exe
  2⤵
  PID:7360
- C:\Windows\System\uKNgLHS.exe
  C:\Windows\System\uKNgLHS.exe
  2⤵
  PID:7376
- C:\Windows\System\FLDTIVa.exe
  C:\Windows\System\FLDTIVa.exe
  2⤵
  PID:7392
- C:\Windows\System\WLLQvfh.exe
  C:\Windows\System\WLLQvfh.exe
  2⤵
  PID:7408
- C:\Windows\System\MNFBHpL.exe
  C:\Windows\System\MNFBHpL.exe
  2⤵
  PID:7424
- C:\Windows\System\rDofGNf.exe
  C:\Windows\System\rDofGNf.exe
  2⤵
  PID:7440
- C:\Windows\System\RlRiVqp.exe
  C:\Windows\System\RlRiVqp.exe
  2⤵
  PID:7456
- C:\Windows\System\bhObtAu.exe
  C:\Windows\System\bhObtAu.exe
  2⤵
  PID:7472
- C:\Windows\System\daMdciU.exe
  C:\Windows\System\daMdciU.exe
  2⤵
  PID:7488
- C:\Windows\System\muHqCzv.exe
  C:\Windows\System\muHqCzv.exe
  2⤵
  PID:7504
- C:\Windows\System\UCdWbVI.exe
  C:\Windows\System\UCdWbVI.exe
  2⤵
  PID:7520
- C:\Windows\System\lfajIyf.exe
  C:\Windows\System\lfajIyf.exe
  2⤵
  PID:7536
- C:\Windows\System\TIoFQoc.exe
  C:\Windows\System\TIoFQoc.exe
  2⤵
  PID:7552
- C:\Windows\System\ZZPHTfN.exe
  C:\Windows\System\ZZPHTfN.exe
  2⤵
  PID:7568
- C:\Windows\System\GkmLnpn.exe
  C:\Windows\System\GkmLnpn.exe
  2⤵
  PID:7584
- C:\Windows\System\YieDFYL.exe
  C:\Windows\System\YieDFYL.exe
  2⤵
  PID:7600
- C:\Windows\System\oeyhuTe.exe
  C:\Windows\System\oeyhuTe.exe
  2⤵
  PID:7616
- C:\Windows\System\EWPvnEa.exe
  C:\Windows\System\EWPvnEa.exe
  2⤵
  PID:7632
- C:\Windows\System\wWTPUak.exe
  C:\Windows\System\wWTPUak.exe
  2⤵
  PID:7648
- C:\Windows\System\CowskQp.exe
  C:\Windows\System\CowskQp.exe
  2⤵
  PID:7664
- C:\Windows\System\jsZotAe.exe
  C:\Windows\System\jsZotAe.exe
  2⤵
  PID:7680
- C:\Windows\System\xMMlxgp.exe
  C:\Windows\System\xMMlxgp.exe
  2⤵
  PID:7696
- C:\Windows\System\BuwMyMH.exe
  C:\Windows\System\BuwMyMH.exe
  2⤵
  PID:7712
- C:\Windows\System\tPXXSpS.exe
  C:\Windows\System\tPXXSpS.exe
  2⤵
  PID:7728
- C:\Windows\System\ifdcQMF.exe
  C:\Windows\System\ifdcQMF.exe
  2⤵
  PID:7744
- C:\Windows\System\GjTGkre.exe
  C:\Windows\System\GjTGkre.exe
  2⤵
  PID:7760
- C:\Windows\System\gaaCBjl.exe
  C:\Windows\System\gaaCBjl.exe
  2⤵
  PID:7776
- C:\Windows\System\HOBjGud.exe
  C:\Windows\System\HOBjGud.exe
  2⤵
  PID:7792
- C:\Windows\System\vsSiRLx.exe
  C:\Windows\System\vsSiRLx.exe
  2⤵
  PID:7808
- C:\Windows\System\naftTyS.exe
  C:\Windows\System\naftTyS.exe
  2⤵
  PID:7824
- C:\Windows\System\zqtEcfN.exe
  C:\Windows\System\zqtEcfN.exe
  2⤵
  PID:7840
- C:\Windows\System\jPzfQoF.exe
  C:\Windows\System\jPzfQoF.exe
  2⤵
  PID:7856
- C:\Windows\System\XEtfIjA.exe
  C:\Windows\System\XEtfIjA.exe
  2⤵
  PID:7872
- C:\Windows\System\jbFMblq.exe
  C:\Windows\System\jbFMblq.exe
  2⤵
  PID:7888
- C:\Windows\System\bkPhXjE.exe
  C:\Windows\System\bkPhXjE.exe
  2⤵
  PID:7904
- C:\Windows\System\cQMKZJN.exe
  C:\Windows\System\cQMKZJN.exe
  2⤵
  PID:7920
- C:\Windows\System\XpUkcvQ.exe
  C:\Windows\System\XpUkcvQ.exe
  2⤵
  PID:7936
- C:\Windows\System\nKzitZh.exe
  C:\Windows\System\nKzitZh.exe
  2⤵
  PID:7952
- C:\Windows\System\BfnSVlo.exe
  C:\Windows\System\BfnSVlo.exe
  2⤵
  PID:7968
- C:\Windows\System\xTPzbun.exe
  C:\Windows\System\xTPzbun.exe
  2⤵
  PID:7984
- C:\Windows\System\AFUMnPd.exe
  C:\Windows\System\AFUMnPd.exe
  2⤵
  PID:8000
- C:\Windows\System\YFtMPYw.exe
  C:\Windows\System\YFtMPYw.exe
  2⤵
  PID:8016
- C:\Windows\System\TCMlCeS.exe
  C:\Windows\System\TCMlCeS.exe
  2⤵
  PID:8032
- C:\Windows\System\uzdIbio.exe
  C:\Windows\System\uzdIbio.exe
  2⤵
  PID:8048
- C:\Windows\System\tflxJZf.exe
  C:\Windows\System\tflxJZf.exe
  2⤵
  PID:8064
- C:\Windows\System\CNltaoG.exe
  C:\Windows\System\CNltaoG.exe
  2⤵
  PID:8080
- C:\Windows\System\SFkZDgh.exe
  C:\Windows\System\SFkZDgh.exe
  2⤵
  PID:8096
- C:\Windows\System\jOFsOPH.exe
  C:\Windows\System\jOFsOPH.exe
  2⤵
  PID:8112
- C:\Windows\System\eJtWenm.exe
  C:\Windows\System\eJtWenm.exe
  2⤵
  PID:8128
- C:\Windows\System\DxpvHZF.exe
  C:\Windows\System\DxpvHZF.exe
  2⤵
  PID:8144
- C:\Windows\System\lawAzis.exe
  C:\Windows\System\lawAzis.exe
  2⤵
  PID:8160
- C:\Windows\System\sQHzrCp.exe
  C:\Windows\System\sQHzrCp.exe
  2⤵
  PID:8176
- C:\Windows\System\xdEXPMw.exe
  C:\Windows\System\xdEXPMw.exe
  2⤵
  PID:2808
- C:\Windows\System\kBxzikV.exe
  C:\Windows\System\kBxzikV.exe
  2⤵
  PID:6796
- C:\Windows\System\FOywnKL.exe
  C:\Windows\System\FOywnKL.exe
  2⤵
  PID:7224
- C:\Windows\System\xGsatCo.exe
  C:\Windows\System\xGsatCo.exe
  2⤵
  PID:7288
- C:\Windows\System\hOkXlaE.exe
  C:\Windows\System\hOkXlaE.exe
  2⤵
  PID:6528
- C:\Windows\System\OJHyhku.exe
  C:\Windows\System\OJHyhku.exe
  2⤵
  PID:6704
- C:\Windows\System\heppAlL.exe
  C:\Windows\System\heppAlL.exe
  2⤵
  PID:6392
- C:\Windows\System\yQumouo.exe
  C:\Windows\System\yQumouo.exe
  2⤵
  PID:6604
- C:\Windows\System\JIZFpvR.exe
  C:\Windows\System\JIZFpvR.exe
  2⤵
  PID:6396
- C:\Windows\System\hYJMduq.exe
  C:\Windows\System\hYJMduq.exe
  2⤵
  PID:6864
- C:\Windows\System\qvQAaPI.exe
  C:\Windows\System\qvQAaPI.exe
  2⤵
  PID:6616
- C:\Windows\System\PIvdWeS.exe
  C:\Windows\System\PIvdWeS.exe
  2⤵
  PID:6504
- C:\Windows\System\AkSjyXi.exe
  C:\Windows\System\AkSjyXi.exe
  2⤵
  PID:6224
- C:\Windows\System\YXFLPoQ.exe
  C:\Windows\System\YXFLPoQ.exe
  2⤵
  PID:7208
- C:\Windows\System\DESKZkP.exe
  C:\Windows\System\DESKZkP.exe
  2⤵
  PID:7356
- C:\Windows\System\dlMarnu.exe
  C:\Windows\System\dlMarnu.exe
  2⤵
  PID:7312
- C:\Windows\System\MfelXFK.exe
  C:\Windows\System\MfelXFK.exe
  2⤵
  PID:7336
- C:\Windows\System\kwpFrHB.exe
  C:\Windows\System\kwpFrHB.exe
  2⤵
  PID:7420
- C:\Windows\System\VJxGpTi.exe
  C:\Windows\System\VJxGpTi.exe
  2⤵
  PID:7484
- C:\Windows\System\ISJBSsO.exe
  C:\Windows\System\ISJBSsO.exe
  2⤵
  PID:7548
- C:\Windows\System\SnIeomT.exe
  C:\Windows\System\SnIeomT.exe
  2⤵
  PID:7580
- C:\Windows\System\IGmooYR.exe
  C:\Windows\System\IGmooYR.exe
  2⤵
  PID:7432
- C:\Windows\System\KkUtJTZ.exe
  C:\Windows\System\KkUtJTZ.exe
  2⤵
  PID:7464
- C:\Windows\System\EulSqQf.exe
  C:\Windows\System\EulSqQf.exe
  2⤵
  PID:7528
- C:\Windows\System\sLoSvKU.exe
  C:\Windows\System\sLoSvKU.exe
  2⤵
  PID:7564
- C:\Windows\System\DLNZuBh.exe
  C:\Windows\System\DLNZuBh.exe
  2⤵
  PID:7672
- C:\Windows\System\yadpdxu.exe
  C:\Windows\System\yadpdxu.exe
  2⤵
  PID:7704
- C:\Windows\System\rSDXyAC.exe
  C:\Windows\System\rSDXyAC.exe
  2⤵
  PID:7768
- C:\Windows\System\pCPvshh.exe
  C:\Windows\System\pCPvshh.exe
  2⤵
  PID:7724
- C:\Windows\System\AAOwZZs.exe
  C:\Windows\System\AAOwZZs.exe
  2⤵
  PID:7836
- C:\Windows\System\esXrkFW.exe
  C:\Windows\System\esXrkFW.exe
  2⤵
  PID:7688
- C:\Windows\System\CJOKozM.exe
  C:\Windows\System\CJOKozM.exe
  2⤵
  PID:7788
- C:\Windows\System\feohjjh.exe
  C:\Windows\System\feohjjh.exe
  2⤵
  PID:7900
- C:\Windows\System\bTzdbTS.exe
  C:\Windows\System\bTzdbTS.exe
  2⤵
  PID:7880
- C:\Windows\System\yjvJYsX.exe
  C:\Windows\System\yjvJYsX.exe
  2⤵
  PID:7932
- C:\Windows\System\oeZFuae.exe
  C:\Windows\System\oeZFuae.exe
  2⤵
  PID:7928
- C:\Windows\System\dzYgPey.exe
  C:\Windows\System\dzYgPey.exe
  2⤵
  PID:7980
- C:\Windows\System\KbwGQzr.exe
  C:\Windows\System\KbwGQzr.exe
  2⤵
  PID:8088
- C:\Windows\System\naXXIxd.exe
  C:\Windows\System\naXXIxd.exe
  2⤵
  PID:8152
- C:\Windows\System\Lhjmhzc.exe
  C:\Windows\System\Lhjmhzc.exe
  2⤵
  PID:5772
- C:\Windows\System\LnLDZEe.exe
  C:\Windows\System\LnLDZEe.exe
  2⤵
  PID:8012
- C:\Windows\System\NlicqYe.exe
  C:\Windows\System\NlicqYe.exe
  2⤵
  PID:7256
- C:\Windows\System\wnLHkjx.exe
  C:\Windows\System\wnLHkjx.exe
  2⤵
  PID:8044
- C:\Windows\System\cLsswKV.exe
  C:\Windows\System\cLsswKV.exe
  2⤵
  PID:8140
- C:\Windows\System\ZOvwDFp.exe
  C:\Windows\System\ZOvwDFp.exe
  2⤵
  PID:7160
- C:\Windows\System\MlCNiwP.exe
  C:\Windows\System\MlCNiwP.exe
  2⤵
  PID:6868
- C:\Windows\System\nJqZKLu.exe
  C:\Windows\System\nJqZKLu.exe
  2⤵
  PID:6952
- C:\Windows\System\yvlBcnj.exe
  C:\Windows\System\yvlBcnj.exe
  2⤵
  PID:7272
- C:\Windows\System\XOTDBDQ.exe
  C:\Windows\System\XOTDBDQ.exe
  2⤵
  PID:7352
- C:\Windows\System\TkSGOjB.exe
  C:\Windows\System\TkSGOjB.exe
  2⤵
  PID:7452
- C:\Windows\System\VPWNiuF.exe
  C:\Windows\System\VPWNiuF.exe
  2⤵
  PID:7372
- C:\Windows\System\rMBiDWs.exe
  C:\Windows\System\rMBiDWs.exe
  2⤵
  PID:7560
- C:\Windows\System\GmcVxAU.exe
  C:\Windows\System\GmcVxAU.exe
  2⤵
  PID:7640
- C:\Windows\System\TMHyTtF.exe
  C:\Windows\System\TMHyTtF.exe
  2⤵
  PID:7624
- C:\Windows\System\ADJGxTW.exe
  C:\Windows\System\ADJGxTW.exe
  2⤵
  PID:7740
- C:\Windows\System\JcTmSwL.exe
  C:\Windows\System\JcTmSwL.exe
  2⤵
  PID:7692
- C:\Windows\System\fgaHXeM.exe
  C:\Windows\System\fgaHXeM.exe
  2⤵
  PID:7848
- C:\Windows\System\BcDfnDG.exe
  C:\Windows\System\BcDfnDG.exe
  2⤵
  PID:7944
- C:\Windows\System\XhDpQuW.exe
  C:\Windows\System\XhDpQuW.exe
  2⤵
  PID:7720
- C:\Windows\System\csEOgiQ.exe
  C:\Windows\System\csEOgiQ.exe
  2⤵
  PID:8040
- C:\Windows\System\mHcPtPo.exe
  C:\Windows\System\mHcPtPo.exe
  2⤵
  PID:8008
- C:\Windows\System\ygGGkYt.exe
  C:\Windows\System\ygGGkYt.exe
  2⤵
  PID:8168
- C:\Windows\System\wFPNihr.exe
  C:\Windows\System\wFPNihr.exe
  2⤵
  PID:6328
- C:\Windows\System\ByCSnOF.exe
  C:\Windows\System\ByCSnOF.exe
  2⤵
  PID:7416
- C:\Windows\System\GvmyOfL.exe
  C:\Windows\System\GvmyOfL.exe
  2⤵
  PID:7516
- C:\Windows\System\JydNcig.exe
  C:\Windows\System\JydNcig.exe
  2⤵
  PID:7912
- C:\Windows\System\emkbqSP.exe
  C:\Windows\System\emkbqSP.exe
  2⤵
  PID:7896
- C:\Windows\System\FmKgPQw.exe
  C:\Windows\System\FmKgPQw.exe
  2⤵
  PID:7976
- C:\Windows\System\FyWsmtm.exe
  C:\Windows\System\FyWsmtm.exe
  2⤵
  PID:7220
- C:\Windows\System\WkzhCJG.exe
  C:\Windows\System\WkzhCJG.exe
  2⤵
  PID:7868
- C:\Windows\System\rNAhrjF.exe
  C:\Windows\System\rNAhrjF.exe
  2⤵
  PID:7320
- C:\Windows\System\HqWVpfH.exe
  C:\Windows\System\HqWVpfH.exe
  2⤵
  PID:6668
- C:\Windows\System\coXoleY.exe
  C:\Windows\System\coXoleY.exe
  2⤵
  PID:6208
- C:\Windows\System\bXfwbsH.exe
  C:\Windows\System\bXfwbsH.exe
  2⤵
  PID:8028
- C:\Windows\System\phOpmZO.exe
  C:\Windows\System\phOpmZO.exe
  2⤵
  PID:6552
- C:\Windows\System\cfisrHM.exe
  C:\Windows\System\cfisrHM.exe
  2⤵
  PID:8156
- C:\Windows\System\KJiiCLe.exe
  C:\Windows\System\KJiiCLe.exe
  2⤵
  PID:7204
- C:\Windows\System\nJDKVVS.exe
  C:\Windows\System\nJDKVVS.exe
  2⤵
  PID:7832
- C:\Windows\System\EOlfWVu.exe
  C:\Windows\System\EOlfWVu.exe
  2⤵
  PID:7800
- C:\Windows\System\JoGndYO.exe
  C:\Windows\System\JoGndYO.exe
  2⤵
  PID:8200
- C:\Windows\System\AjQLett.exe
  C:\Windows\System\AjQLett.exe
  2⤵
  PID:8216
- C:\Windows\System\MwVvUUV.exe
  C:\Windows\System\MwVvUUV.exe
  2⤵
  PID:8232
- C:\Windows\System\JsLkozf.exe
  C:\Windows\System\JsLkozf.exe
  2⤵
  PID:8248
- C:\Windows\System\Xnktgpo.exe
  C:\Windows\System\Xnktgpo.exe
  2⤵
  PID:8264
- C:\Windows\System\CsokVQy.exe
  C:\Windows\System\CsokVQy.exe
  2⤵
  PID:8280
- C:\Windows\System\cXPKASq.exe
  C:\Windows\System\cXPKASq.exe
  2⤵
  PID:8296
- C:\Windows\System\bPTZcbg.exe
  C:\Windows\System\bPTZcbg.exe
  2⤵
  PID:8312
- C:\Windows\System\veCfnyK.exe
  C:\Windows\System\veCfnyK.exe
  2⤵
  PID:8328
- C:\Windows\System\FhOahNG.exe
  C:\Windows\System\FhOahNG.exe
  2⤵
  PID:8344
- C:\Windows\System\TOOkFpu.exe
  C:\Windows\System\TOOkFpu.exe
  2⤵
  PID:8364
- C:\Windows\System\CnJFdFd.exe
  C:\Windows\System\CnJFdFd.exe
  2⤵
  PID:8380
- C:\Windows\System\MqwpQCy.exe
  C:\Windows\System\MqwpQCy.exe
  2⤵
  PID:8396
- C:\Windows\System\dvTrbAS.exe
  C:\Windows\System\dvTrbAS.exe
  2⤵
  PID:8412
- C:\Windows\System\pgwAqvG.exe
  C:\Windows\System\pgwAqvG.exe
  2⤵
  PID:8428
- C:\Windows\System\TniNtuS.exe
  C:\Windows\System\TniNtuS.exe
  2⤵
  PID:8444
- C:\Windows\System\KQxrDNm.exe
  C:\Windows\System\KQxrDNm.exe
  2⤵
  PID:8460
- C:\Windows\System\kzZgrlj.exe
  C:\Windows\System\kzZgrlj.exe
  2⤵
  PID:8476
- C:\Windows\System\bJNqVxo.exe
  C:\Windows\System\bJNqVxo.exe
  2⤵
  PID:8492
- C:\Windows\System\EiLQEnb.exe
  C:\Windows\System\EiLQEnb.exe
  2⤵
  PID:8508
- C:\Windows\System\pumoCJL.exe
  C:\Windows\System\pumoCJL.exe
  2⤵
  PID:8524
- C:\Windows\System\KPCNmNN.exe
  C:\Windows\System\KPCNmNN.exe
  2⤵
  PID:8540
- C:\Windows\System\iZvMWwn.exe
  C:\Windows\System\iZvMWwn.exe
  2⤵
  PID:8556
- C:\Windows\System\UzfZwyu.exe
  C:\Windows\System\UzfZwyu.exe
  2⤵
  PID:8572
- C:\Windows\System\UJmBbMt.exe
  C:\Windows\System\UJmBbMt.exe
  2⤵
  PID:8588
- C:\Windows\System\EQebIcX.exe
  C:\Windows\System\EQebIcX.exe
  2⤵
  PID:8604
- C:\Windows\System\BtEJyvh.exe
  C:\Windows\System\BtEJyvh.exe
  2⤵
  PID:8620
- C:\Windows\System\ClyKLjo.exe
  C:\Windows\System\ClyKLjo.exe
  2⤵
  PID:8636
- C:\Windows\System\njJBGnR.exe
  C:\Windows\System\njJBGnR.exe
  2⤵
  PID:8652
- C:\Windows\System\axNmARM.exe
  C:\Windows\System\axNmARM.exe
  2⤵
  PID:8668
- C:\Windows\System\JotVsvW.exe
  C:\Windows\System\JotVsvW.exe
  2⤵
  PID:8684
- C:\Windows\System\duYmlet.exe
  C:\Windows\System\duYmlet.exe
  2⤵
  PID:8700
- C:\Windows\System\kwIgOBK.exe
  C:\Windows\System\kwIgOBK.exe
  2⤵
  PID:8716
- C:\Windows\System\nxIVRvL.exe
  C:\Windows\System\nxIVRvL.exe
  2⤵
  PID:8732
- C:\Windows\System\evgUnaw.exe
  C:\Windows\System\evgUnaw.exe
  2⤵
  PID:8748
- C:\Windows\System\aZOvSTy.exe
  C:\Windows\System\aZOvSTy.exe
  2⤵
  PID:8764
- C:\Windows\System\EFESLIf.exe
  C:\Windows\System\EFESLIf.exe
  2⤵
  PID:8780
- C:\Windows\System\cXffQXF.exe
  C:\Windows\System\cXffQXF.exe
  2⤵
  PID:8796
- C:\Windows\System\zMqXFSC.exe
  C:\Windows\System\zMqXFSC.exe
  2⤵
  PID:8812
- C:\Windows\System\IYStACY.exe
  C:\Windows\System\IYStACY.exe
  2⤵
  PID:8828
- C:\Windows\System\pniAceq.exe
  C:\Windows\System\pniAceq.exe
  2⤵
  PID:8844
- C:\Windows\System\XaEpBeE.exe
  C:\Windows\System\XaEpBeE.exe
  2⤵
  PID:8860
- C:\Windows\System\qyUXxwc.exe
  C:\Windows\System\qyUXxwc.exe
  2⤵
  PID:8876
- C:\Windows\System\hPELMPT.exe
  C:\Windows\System\hPELMPT.exe
  2⤵
  PID:8892
- C:\Windows\System\BzfWers.exe
  C:\Windows\System\BzfWers.exe
  2⤵
  PID:8908
- C:\Windows\System\RqKuMmD.exe
  C:\Windows\System\RqKuMmD.exe
  2⤵
  PID:8924
- C:\Windows\System\RNooYsF.exe
  C:\Windows\System\RNooYsF.exe
  2⤵
  PID:8940
- C:\Windows\System\HXPXuTo.exe
  C:\Windows\System\HXPXuTo.exe
  2⤵
  PID:8956
- C:\Windows\System\kTvUFzd.exe
  C:\Windows\System\kTvUFzd.exe
  2⤵
  PID:8972
- C:\Windows\System\jbppwew.exe
  C:\Windows\System\jbppwew.exe
  2⤵
  PID:8988
- C:\Windows\System\VSRhumF.exe
  C:\Windows\System\VSRhumF.exe
  2⤵
  PID:9004
- C:\Windows\System\McfOcpf.exe
  C:\Windows\System\McfOcpf.exe
  2⤵
  PID:9020
- C:\Windows\System\nWzkpEa.exe
  C:\Windows\System\nWzkpEa.exe
  2⤵
  PID:9036
- C:\Windows\System\QaAtDSW.exe
  C:\Windows\System\QaAtDSW.exe
  2⤵
  PID:9052
- C:\Windows\System\bJhfehy.exe
  C:\Windows\System\bJhfehy.exe
  2⤵
  PID:9076
- C:\Windows\System\jYeVQim.exe
  C:\Windows\System\jYeVQim.exe
  2⤵
  PID:9092
- C:\Windows\System\QOYXMgs.exe
  C:\Windows\System\QOYXMgs.exe
  2⤵
  PID:9108
- C:\Windows\System\gaqpnMK.exe
  C:\Windows\System\gaqpnMK.exe
  2⤵
  PID:9128
- C:\Windows\System\srFxZFz.exe
  C:\Windows\System\srFxZFz.exe
  2⤵
  PID:9144
- C:\Windows\System\isqZIGO.exe
  C:\Windows\System\isqZIGO.exe
  2⤵
  PID:9160
- C:\Windows\System\TRkgcOY.exe
  C:\Windows\System\TRkgcOY.exe
  2⤵
  PID:9176
- C:\Windows\System\SuyPeCs.exe
  C:\Windows\System\SuyPeCs.exe
  2⤵
  PID:9192
- C:\Windows\System\HmOvOHk.exe
  C:\Windows\System\HmOvOHk.exe
  2⤵
  PID:9208
- C:\Windows\System\wnvdcBS.exe
  C:\Windows\System\wnvdcBS.exe
  2⤵
  PID:8092
- C:\Windows\System\SCOHmYW.exe
  C:\Windows\System\SCOHmYW.exe
  2⤵
  PID:8240
- C:\Windows\System\ltXNPdI.exe
  C:\Windows\System\ltXNPdI.exe
  2⤵
  PID:7644
- C:\Windows\System\uxJXNKO.exe
  C:\Windows\System\uxJXNKO.exe
  2⤵
  PID:7756
- C:\Windows\System\KlTeNET.exe
  C:\Windows\System\KlTeNET.exe
  2⤵
  PID:8228
- C:\Windows\System\ZoSKDss.exe
  C:\Windows\System\ZoSKDss.exe
  2⤵
  PID:8304
- C:\Windows\System\IRPXHRA.exe
  C:\Windows\System\IRPXHRA.exe
  2⤵
  PID:8372
- C:\Windows\System\sDhyozj.exe
  C:\Windows\System\sDhyozj.exe
  2⤵
  PID:8436
- C:\Windows\System\uRZmgxd.exe
  C:\Windows\System\uRZmgxd.exe
  2⤵
  PID:8288
- C:\Windows\System\MMEwGRs.exe
  C:\Windows\System\MMEwGRs.exe
  2⤵
  PID:8500
- C:\Windows\System\iRRFOfV.exe
  C:\Windows\System\iRRFOfV.exe
  2⤵
  PID:8564
- C:\Windows\System\iBLgGAR.exe
  C:\Windows\System\iBLgGAR.exe
  2⤵
  PID:8324
- C:\Windows\System\OeydIlc.exe
  C:\Windows\System\OeydIlc.exe
  2⤵
  PID:8424
- C:\Windows\System\oaYHfpI.exe
  C:\Windows\System\oaYHfpI.exe
  2⤵
  PID:8552
- C:\Windows\System\woPwbZg.exe
  C:\Windows\System\woPwbZg.exe
  2⤵
  PID:6544
- C:\Windows\System\nKmcVMn.exe
  C:\Windows\System\nKmcVMn.exe
  2⤵
  PID:8660
- C:\Windows\System\fpxwnlE.exe
  C:\Windows\System\fpxwnlE.exe
  2⤵
  PID:8728
- C:\Windows\System\vSqHJMY.exe
  C:\Windows\System\vSqHJMY.exe
  2⤵
  PID:8820
- C:\Windows\System\mGvCqAQ.exe
  C:\Windows\System\mGvCqAQ.exe
  2⤵
  PID:8856
- C:\Windows\System\icXdsgk.exe
  C:\Windows\System\icXdsgk.exe
  2⤵
  PID:8916
- C:\Windows\System\OgxbLri.exe
  C:\Windows\System\OgxbLri.exe
  2⤵
  PID:8980
- C:\Windows\System\hnnILiW.exe
  C:\Windows\System\hnnILiW.exe
  2⤵
  PID:9044
- C:\Windows\System\mLAcBbW.exe
  C:\Windows\System\mLAcBbW.exe
  2⤵
  PID:8936
- C:\Windows\System\PZkdLsL.exe
  C:\Windows\System\PZkdLsL.exe
  2⤵
  PID:9068
- C:\Windows\System\sjUVREp.exe
  C:\Windows\System\sjUVREp.exe
  2⤵
  PID:8680
- C:\Windows\System\moOekpD.exe
  C:\Windows\System\moOekpD.exe
  2⤵
  PID:8932
- C:\Windows\System\KjjuxNb.exe
  C:\Windows\System\KjjuxNb.exe
  2⤵
  PID:9072
- C:\Windows\System\LJCyjpJ.exe
  C:\Windows\System\LJCyjpJ.exe
  2⤵
  PID:8712
- C:\Windows\System\laDXhnm.exe
  C:\Windows\System\laDXhnm.exe
  2⤵
  PID:8836
- C:\Windows\System\KUBUXNE.exe
  C:\Windows\System\KUBUXNE.exe
  2⤵
  PID:8996
- C:\Windows\System\RcbhFnR.exe
  C:\Windows\System\RcbhFnR.exe
  2⤵
  PID:9116
- C:\Windows\System\bmFIILq.exe
  C:\Windows\System\bmFIILq.exe
  2⤵
  PID:9184
- C:\Windows\System\OIOcleW.exe
  C:\Windows\System\OIOcleW.exe
  2⤵
  PID:7916
- C:\Windows\System\DrsOWMb.exe
  C:\Windows\System\DrsOWMb.exe
  2⤵
  PID:9104
- C:\Windows\System\Armngnd.exe
  C:\Windows\System\Armngnd.exe
  2⤵
  PID:9140
- C:\Windows\System\EhJSxQM.exe
  C:\Windows\System\EhJSxQM.exe
  2⤵
  PID:8208
- C:\Windows\System\bxRBlby.exe
  C:\Windows\System\bxRBlby.exe
  2⤵
  PID:8336
- C:\Windows\System\XKawYRv.exe
  C:\Windows\System\XKawYRv.exe
  2⤵
  PID:8404
- C:\Windows\System\XwivIxL.exe
  C:\Windows\System\XwivIxL.exe
  2⤵
  PID:8532
- C:\Windows\System\bvDntkD.exe
  C:\Windows\System\bvDntkD.exe
  2⤵
  PID:8292
- C:\Windows\System\HEmowPb.exe
  C:\Windows\System\HEmowPb.exe
  2⤵
  PID:8392
- C:\Windows\System\SxnkEtx.exe
  C:\Windows\System\SxnkEtx.exe
  2⤵
  PID:8724
- C:\Windows\System\fDoiErg.exe
  C:\Windows\System\fDoiErg.exe
  2⤵
  PID:8952
- C:\Windows\System\LtNkwHA.exe
  C:\Windows\System\LtNkwHA.exe
  2⤵
  PID:8644
- C:\Windows\System\knjcyZI.exe
  C:\Windows\System\knjcyZI.exe
  2⤵
  PID:8484
- C:\Windows\System\ohNXZqM.exe
  C:\Windows\System\ohNXZqM.exe
  2⤵
  PID:8776
- C:\Windows\System\HVLhQSE.exe
  C:\Windows\System\HVLhQSE.exe
  2⤵
  PID:8808
- C:\Windows\System\qIHBLjk.exe
  C:\Windows\System\qIHBLjk.exe
  2⤵
  PID:9032
- C:\Windows\System\rBSXeTW.exe
  C:\Windows\System\rBSXeTW.exe
  2⤵
  PID:8868
- C:\Windows\System\fhRWaIR.exe
  C:\Windows\System\fhRWaIR.exe
  2⤵
  PID:8872
- C:\Windows\System\uVCTdti.exe
  C:\Windows\System\uVCTdti.exe
  2⤵
  PID:9156
- C:\Windows\System\LDZWhRI.exe
  C:\Windows\System\LDZWhRI.exe
  2⤵
  PID:8212
- C:\Windows\System\bNcQgpe.exe
  C:\Windows\System\bNcQgpe.exe
  2⤵
  PID:8188
- C:\Windows\System\IDgxkmq.exe
  C:\Windows\System\IDgxkmq.exe
  2⤵
  PID:8360
- C:\Windows\System\NuKIZdM.exe
  C:\Windows\System\NuKIZdM.exe
  2⤵
  PID:8276
- C:\Windows\System\ktcwUuF.exe
  C:\Windows\System\ktcwUuF.exe
  2⤵
  PID:8888
- C:\Windows\System\zicnNgb.exe
  C:\Windows\System\zicnNgb.exe
  2⤵
  PID:9012
- C:\Windows\System\uIwwzOK.exe
  C:\Windows\System\uIwwzOK.exe
  2⤵
  PID:8488
- C:\Windows\System\Yboyrrt.exe
  C:\Windows\System\Yboyrrt.exe
  2⤵
  PID:8676
- C:\Windows\System\gnTPoEg.exe
  C:\Windows\System\gnTPoEg.exe
  2⤵
  PID:8272
- C:\Windows\System\neUcddb.exe
  C:\Windows\System\neUcddb.exe
  2⤵
  PID:1572
- C:\Windows\System\knfdSAB.exe
  C:\Windows\System\knfdSAB.exe
  2⤵
  PID:9204
- C:\Windows\System\MLJpvHz.exe
  C:\Windows\System\MLJpvHz.exe
  2⤵
  PID:8616
- C:\Windows\System\DxPgBQx.exe
  C:\Windows\System\DxPgBQx.exe
  2⤵
  PID:8076
- C:\Windows\System\nxJDOaL.exe
  C:\Windows\System\nxJDOaL.exe
  2⤵
  PID:9172
- C:\Windows\System\vqbDeJG.exe
  C:\Windows\System\vqbDeJG.exe
  2⤵
  PID:8968
- C:\Windows\System\mikyABS.exe
  C:\Windows\System\mikyABS.exe
  2⤵
  PID:8536
- C:\Windows\System\rNxgDrN.exe
  C:\Windows\System\rNxgDrN.exe
  2⤵
  PID:8648
- C:\Windows\System\EAYzRVg.exe
  C:\Windows\System\EAYzRVg.exe
  2⤵
  PID:9232
- C:\Windows\System\ShIcmSd.exe
  C:\Windows\System\ShIcmSd.exe
  2⤵
  PID:9248
- C:\Windows\System\xCanhfP.exe
  C:\Windows\System\xCanhfP.exe
  2⤵
  PID:9264
- C:\Windows\System\ctBemFD.exe
  C:\Windows\System\ctBemFD.exe
  2⤵
  PID:9280
- C:\Windows\System\MwEMIxX.exe
  C:\Windows\System\MwEMIxX.exe
  2⤵
  PID:9296
- C:\Windows\System\xFIEzjv.exe
  C:\Windows\System\xFIEzjv.exe
  2⤵
  PID:9312
- C:\Windows\System\InhQJar.exe
  C:\Windows\System\InhQJar.exe
  2⤵
  PID:9328
- C:\Windows\System\wUcevst.exe
  C:\Windows\System\wUcevst.exe
  2⤵
  PID:9344
- C:\Windows\System\PvtAdBy.exe
  C:\Windows\System\PvtAdBy.exe
  2⤵
  PID:9360
- C:\Windows\System\aToWqzc.exe
  C:\Windows\System\aToWqzc.exe
  2⤵
  PID:9376
- C:\Windows\System\dVPWfpQ.exe
  C:\Windows\System\dVPWfpQ.exe
  2⤵
  PID:9392
- C:\Windows\System\hHjeflB.exe
  C:\Windows\System\hHjeflB.exe
  2⤵
  PID:9408
- C:\Windows\System\YscIuGj.exe
  C:\Windows\System\YscIuGj.exe
  2⤵
  PID:9424
- C:\Windows\System\QhNaJil.exe
  C:\Windows\System\QhNaJil.exe
  2⤵
  PID:9440
- C:\Windows\System\lXiAgYt.exe
  C:\Windows\System\lXiAgYt.exe
  2⤵
  PID:9456
- C:\Windows\System\UroYPdp.exe
  C:\Windows\System\UroYPdp.exe
  2⤵
  PID:9472
- C:\Windows\System\pMtEcjd.exe
  C:\Windows\System\pMtEcjd.exe
  2⤵
  PID:9488
- C:\Windows\System\TzsKhdy.exe
  C:\Windows\System\TzsKhdy.exe
  2⤵
  PID:9508
- C:\Windows\System\tbqflvA.exe
  C:\Windows\System\tbqflvA.exe
  2⤵
  PID:9524
- C:\Windows\System\ZMSaHFe.exe
  C:\Windows\System\ZMSaHFe.exe
  2⤵
  PID:9540
- C:\Windows\System\rMERuJh.exe
  C:\Windows\System\rMERuJh.exe
  2⤵
  PID:9556
- C:\Windows\System\ohxHEzE.exe
  C:\Windows\System\ohxHEzE.exe
  2⤵
  PID:9584
- C:\Windows\System\gVtgFKr.exe
  C:\Windows\System\gVtgFKr.exe
  2⤵
  PID:9604
- C:\Windows\System\UBINslj.exe
  C:\Windows\System\UBINslj.exe
  2⤵
  PID:9620
- C:\Windows\System\QAhgRro.exe
  C:\Windows\System\QAhgRro.exe
  2⤵
  PID:9636
- C:\Windows\System\HQNceKI.exe
  C:\Windows\System\HQNceKI.exe
  2⤵
  PID:9652
- C:\Windows\System\bPxpanP.exe
  C:\Windows\System\bPxpanP.exe
  2⤵
  PID:9668
- C:\Windows\System\eSOrqyN.exe
  C:\Windows\System\eSOrqyN.exe
  2⤵
  PID:9684
- C:\Windows\System\mlcbutF.exe
  C:\Windows\System\mlcbutF.exe
  2⤵
  PID:9724
- C:\Windows\System\WYXuBbB.exe
  C:\Windows\System\WYXuBbB.exe
  2⤵
  PID:9740
- C:\Windows\System\uWGjazv.exe
  C:\Windows\System\uWGjazv.exe
  2⤵
  PID:9756
- C:\Windows\System\IMTKAMq.exe
  C:\Windows\System\IMTKAMq.exe
  2⤵
  PID:9772
- C:\Windows\System\lLNxqEe.exe
  C:\Windows\System\lLNxqEe.exe
  2⤵
  PID:9788
- C:\Windows\System\JDjeqXR.exe
  C:\Windows\System\JDjeqXR.exe
  2⤵
  PID:9804
- C:\Windows\System\OJVwMwf.exe
  C:\Windows\System\OJVwMwf.exe
  2⤵
  PID:9844
- C:\Windows\System\UgmLRGz.exe
  C:\Windows\System\UgmLRGz.exe
  2⤵
  PID:9868
- C:\Windows\System\YdyJQqI.exe
  C:\Windows\System\YdyJQqI.exe
  2⤵
  PID:9884
- C:\Windows\System\LEGEPnr.exe
  C:\Windows\System\LEGEPnr.exe
  2⤵
  PID:9904
- C:\Windows\System\DqBOrIg.exe
  C:\Windows\System\DqBOrIg.exe
  2⤵
  PID:9920
- C:\Windows\System\BUBGXFV.exe
  C:\Windows\System\BUBGXFV.exe
  2⤵
  PID:9940
- C:\Windows\System\sJfFXfc.exe
  C:\Windows\System\sJfFXfc.exe
  2⤵
  PID:9956
- C:\Windows\System\yAflRzr.exe
  C:\Windows\System\yAflRzr.exe
  2⤵
  PID:9972
- C:\Windows\System\wEpOlBv.exe
  C:\Windows\System\wEpOlBv.exe
  2⤵
  PID:9988
- C:\Windows\System\OmsRgrr.exe
  C:\Windows\System\OmsRgrr.exe
  2⤵
  PID:10004
- C:\Windows\System\OYprnSu.exe
  C:\Windows\System\OYprnSu.exe
  2⤵
  PID:10020
- C:\Windows\System\WmobiAk.exe
  C:\Windows\System\WmobiAk.exe
  2⤵
  PID:10036
- C:\Windows\System\QxgwMUv.exe
  C:\Windows\System\QxgwMUv.exe
  2⤵
  PID:10052
- C:\Windows\System\IfksFRU.exe
  C:\Windows\System\IfksFRU.exe
  2⤵
  PID:10068
- C:\Windows\System\mACiDhR.exe
  C:\Windows\System\mACiDhR.exe
  2⤵
  PID:10084
- C:\Windows\System\sfYzIiT.exe
  C:\Windows\System\sfYzIiT.exe
  2⤵
  PID:10100
- C:\Windows\System\hDQUHyH.exe
  C:\Windows\System\hDQUHyH.exe
  2⤵
  PID:10120
- C:\Windows\System\mCVsdmh.exe
  C:\Windows\System\mCVsdmh.exe
  2⤵
  PID:10136
- C:\Windows\System\RhmKmrr.exe
  C:\Windows\System\RhmKmrr.exe
  2⤵
  PID:10152
- C:\Windows\System\kIVkvvT.exe
  C:\Windows\System\kIVkvvT.exe
  2⤵
  PID:10168
- C:\Windows\System\UBnyiOO.exe
  C:\Windows\System\UBnyiOO.exe
  2⤵
  PID:10200
- C:\Windows\System\vTwXUVa.exe
  C:\Windows\System\vTwXUVa.exe
  2⤵
  PID:10216
- C:\Windows\System\gVjXcXz.exe
  C:\Windows\System\gVjXcXz.exe
  2⤵
  PID:10232
- C:\Windows\System\pigvlvM.exe
  C:\Windows\System\pigvlvM.exe
  2⤵
  PID:9256
- C:\Windows\System\pQJDBSZ.exe
  C:\Windows\System\pQJDBSZ.exe
  2⤵
  PID:9320
- C:\Windows\System\IyCUHuO.exe
  C:\Windows\System\IyCUHuO.exe
  2⤵
  PID:8708
- C:\Windows\System\vSDrhCv.exe
  C:\Windows\System\vSDrhCv.exe
  2⤵
  PID:9420
- C:\Windows\System\pgqpkqx.exe
  C:\Windows\System\pgqpkqx.exe
  2⤵
  PID:9452
- C:\Windows\System\oQLyqho.exe
  C:\Windows\System\oQLyqho.exe
  2⤵
  PID:9276
- C:\Windows\System\PmsrKSy.exe
  C:\Windows\System\PmsrKSy.exe
  2⤵
  PID:9432
- C:\Windows\System\XebfjKz.exe
  C:\Windows\System\XebfjKz.exe
  2⤵
  PID:9304
- C:\Windows\System\hDBzClD.exe
  C:\Windows\System\hDBzClD.exe
  2⤵
  PID:8696
- C:\Windows\System\pQYgzUX.exe
  C:\Windows\System\pQYgzUX.exe
  2⤵
  PID:9372
- C:\Windows\System\NlepSnT.exe
  C:\Windows\System\NlepSnT.exe
  2⤵
  PID:9436
- C:\Windows\System\kztzFrK.exe
  C:\Windows\System\kztzFrK.exe
  2⤵
  PID:9536
- C:\Windows\System\CDdnkJh.exe
  C:\Windows\System\CDdnkJh.exe
  2⤵
  PID:9580
- C:\Windows\System\HHAlHVl.exe
  C:\Windows\System\HHAlHVl.exe
  2⤵
  PID:9644
- C:\Windows\System\AnINZOP.exe
  C:\Windows\System\AnINZOP.exe
  2⤵
  PID:9700
- C:\Windows\System\pnuaFJc.exe
  C:\Windows\System\pnuaFJc.exe
  2⤵
  PID:9720
- C:\Windows\System\TwATyfx.exe
  C:\Windows\System\TwATyfx.exe
  2⤵
  PID:9780
- C:\Windows\System\ICOxMiC.exe
  C:\Windows\System\ICOxMiC.exe
  2⤵
  PID:9820
- C:\Windows\System\kRBUsrF.exe
  C:\Windows\System\kRBUsrF.exe
  2⤵
  PID:9840
- C:\Windows\System\pyPlJhb.exe
  C:\Windows\System\pyPlJhb.exe
  2⤵
  PID:9796
- C:\Windows\System\SPiEwVa.exe
  C:\Windows\System\SPiEwVa.exe
  2⤵
  PID:9852
- C:\Windows\System\EyvNNji.exe
  C:\Windows\System\EyvNNji.exe
  2⤵
  PID:9896
- C:\Windows\System\IVFRvxo.exe
  C:\Windows\System\IVFRvxo.exe
  2⤵
  PID:9880
- C:\Windows\System\hVqtNzI.exe
  C:\Windows\System\hVqtNzI.exe
  2⤵
  PID:9984
- C:\Windows\System\UvUITSs.exe
  C:\Windows\System\UvUITSs.exe
  2⤵
  PID:9948
- C:\Windows\System\GAHsSNg.exe
  C:\Windows\System\GAHsSNg.exe
  2⤵
  PID:10000
- C:\Windows\System\LQSqNuh.exe
  C:\Windows\System\LQSqNuh.exe
  2⤵
  PID:10032
- C:\Windows\System\kVsSUYQ.exe
  C:\Windows\System\kVsSUYQ.exe
  2⤵
  PID:10044
- C:\Windows\System\zpgjGsd.exe
  C:\Windows\System\zpgjGsd.exe
  2⤵
  PID:10164
- C:\Windows\System\ncNCnvb.exe
  C:\Windows\System\ncNCnvb.exe
  2⤵
  PID:10116
- C:\Windows\System\gJZFOPu.exe
  C:\Windows\System\gJZFOPu.exe
  2⤵
  PID:10184
- C:\Windows\System\slWwgnC.exe
  C:\Windows\System\slWwgnC.exe
  2⤵
  PID:10196
- C:\Windows\System\GxgAxsN.exe
  C:\Windows\System\GxgAxsN.exe
  2⤵
  PID:10228
- C:\Windows\System\nOqXEZz.exe
  C:\Windows\System\nOqXEZz.exe
  2⤵
  PID:9292
- C:\Windows\System\xguUUGU.exe
  C:\Windows\System\xguUUGU.exe
  2⤵
  PID:9356
- C:\Windows\System\IDJrjyt.exe
  C:\Windows\System\IDJrjyt.exe
  2⤵
  PID:9552
- C:\Windows\System\yLKWjCe.exe
  C:\Windows\System\yLKWjCe.exe
  2⤵
  PID:9484
- C:\Windows\System\cMsyqjR.exe
  C:\Windows\System\cMsyqjR.exe
  2⤵
  PID:9272
- C:\Windows\System\rTIzrOJ.exe
  C:\Windows\System\rTIzrOJ.exe
  2⤵
  PID:9340
- C:\Windows\System\MgjMaxm.exe
  C:\Windows\System\MgjMaxm.exe
  2⤵
  PID:9600
- C:\Windows\System\eVFyUEY.exe
  C:\Windows\System\eVFyUEY.exe
  2⤵
  PID:9664
- C:\Windows\System\LrnSlao.exe
  C:\Windows\System\LrnSlao.exe
  2⤵
  PID:9696
- C:\Windows\System\VbCVmEf.exe
  C:\Windows\System\VbCVmEf.exe
  2⤵
  PID:9612
- C:\Windows\System\MOqHRjS.exe
  C:\Windows\System\MOqHRjS.exe
  2⤵
  PID:9824
- C:\Windows\System\VWmatyc.exe
  C:\Windows\System\VWmatyc.exe
  2⤵
  PID:9860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DbsskIn.exe

Filesize
2.2MB

MD5
cd72f660b38f314ba4ac4284b7d78026

SHA1
489242ed0c464d3985c61fd6ede7ebbe418c5d4c

SHA256
feb7ad0e2d3c6e95b4c102f5dabdc6cf29caca68529402b1ec835fb5b2ec5d0c

SHA512
7a56c44e04bf03fe8b9e841c4d5cce5530305c4dfa76e6ef29a7d1cdc3b3d8257e56163f3c93abe2ba6247a4e7e2282644e80c870d2dc9d3cc969c663be44c96

Download Submit
C:\Windows\system\EpEsHFU.exe

Filesize
2.2MB

MD5
8c9a44c1b25008e9a87f80f7c030c90b

SHA1
bb4a6bfe2369f5adfbcf8e6854f76bc8b772a466

SHA256
ddb1468e794c59feabf054457b795d89efe77eb9b886621a75b43415067e9f2b

SHA512
dc8cf612370f02c5e40dcfb765a2ed0d89c33d24ad300167b6cb8feaeb592f3f3465549a2e11c01ce7a65133408c32732ca1b3da1a5060bedb31c1c82b4216b3

Download Submit
C:\Windows\system\KFxtnGw.exe

Filesize
2.2MB

MD5
d93262994d9a303717497c3353980f9a

SHA1
357afbe099b9369f4d516bbe5e77352c1ea5960e

SHA256
6e97bfbc370037434408d2379803b7044b58bd8316b3a350cc892c7923770fd8

SHA512
c30a1c146e042288e7124b624926bc7120fecc73a8300327cab76df8a403debccb483bb493af51d09ec5cc5b9d40b028fd7e29fc6533d6756077c544bd654a24

Download Submit
C:\Windows\system\LRwKXio.exe

Filesize
2.2MB

MD5
546355ec4536381551676a6a57ebf5aa

SHA1
a92c150f8b69d1ac6ae15a5f3a23293f2898401e

SHA256
0977ac1cf24870992d68d16f5b37f5ac1587eb24161753bfd1e82d1db6af77d2

SHA512
e211ac8bc4ee2797c4b24680b0fc7ee3ab82ffd6629534483134cc07a47640cf3b6c0cafd1ceec8f5bd21571fe92713ba92f88a4305ed17d8880d03b2fc5f9f2

Download Submit
C:\Windows\system\MTAheaS.exe

Filesize
2.2MB

MD5
9c17ba4565ec957ea5b31495e2fb07da

SHA1
39e51582afde33127a1ea3b75a8176c53cb096e6

SHA256
7db1a9fb24c8b55686f1ae4ada1cc8a894550d1c6f2cfe69d23814b954f1c84f

SHA512
61f5612fec74aeec111cf3485513df7a3076ce4e97af9717d41c8d7571edc8467e93481f4e7d202e00278440c22c4011db716ef1738edb86db3e629916eaf5d0

Download Submit
C:\Windows\system\MbIzuJt.exe

Filesize
8B

MD5
0b02220145771e90ebe4310a5742c9eb

SHA1
9bd568d96b03bd5446f96a7b59c08196eb5a57c3

SHA256
6135f164d0697be47c97ab606a7a1adcbc1eb3846ae4debecafb1a6ccfd23e4e

SHA512
cb08dee7f4e4dd1bb8de836a2364c078d9de5aef5dcb329e7e0b8e1cc2bfaa06c42f8b8ddf04bdb30392074759beef091a761854b0812b9a726b3c820c99a5a8

Download Submit
C:\Windows\system\QbaWgFZ.exe

Filesize
2.2MB

MD5
7e6d25e7ab55600cf1c89a7c511e3544

SHA1
86f477abd3c7dd7f5641685a6d2765801325672c

SHA256
5f07a4d6989644bd9a5a3694d44d9af4697e74bdd2bbd38d4c9012525c9a3af8

SHA512
5e67373cc6cf7bf9199e9d640c75854b0d4f69509a309b3a9b1853813b74e45c17f3aca04a88b9d1753d9b70408c4d5603dea40d68155965e3218751e38c71b8

Download Submit
C:\Windows\system\ULjYofz.exe

Filesize
2.2MB

MD5
791ffc4946a7ed5174ff61a3be394cea

SHA1
67bdf1b8f46ffd63f6d65bc3e6391fac4277f78a

SHA256
754add43abc1b8e5c396e94b8886a382e3faf8f96e77267d6fa289fc75bebc20

SHA512
3b2aae40e06c2fdc625d1b2c64bbda5520bd00716a3bc2eaf15463719e92a98ad53d918e3509cf611a487078ef815998ec815c8051e48494fe50a995183ed235

Download Submit
C:\Windows\system\WJPogYv.exe

Filesize
2.2MB

MD5
94d07c33b9e9a0d01d3e899b90013aa5

SHA1
8bfc5ee56c2f7ac423b1599bde1d9250115165df

SHA256
63c033fed86ffc62d01945e27e1b59f2c9be153c00550764e7c9c1ca01d2bfbe

SHA512
5cd02cef91b099665d7d1be2e9a8966bcae2fa875d5c00aa438dc8041ec2fca81464ee1774e88a238c90562d416a8619da70cc873851efa474e24e0882b0c971

Download Submit
C:\Windows\system\cWaJKPE.exe

Filesize
2.2MB

MD5
154c0e6fe3956305f7d575887532f27a

SHA1
cc522977554ffde7b44d5051be2425ddb4ec9402

SHA256
f76895c7ece0b4dccc835906143bc199e7513272569ca2f1ad125e1ce8a19f9a

SHA512
5c8ff57207e402d5e9b4c6c9f18b4288e087d3758687c1ac1fb321a80cded924657fb984a05d16170315d00c13cebe89f0eadfc7f6daedc8e6a16f65107b0176

Download Submit
C:\Windows\system\dbgVjwx.exe

Filesize
2.2MB

MD5
d0dffbe5ed3b51abd7479a6f78090ef2

SHA1
c2c92a26f2aea73cca5cb89ea5e6017e1c909e7b

SHA256
1a4168d41f083b980223f15cfb0a9d00c11d0273349aed009b618184e94454e8

SHA512
d7b37e2acb8cc973263da08168a873683fb5a82fc55ebdf536c5d0b00d1dfd2f2a83aeaa4d949f1ba98e7482aa66f49ca5cbbfdc9bf5d083512449869ff8813c

Download Submit
C:\Windows\system\hHEbDBH.exe

Filesize
2.2MB

MD5
d23a25a63374c203159d3b3d4c757afb

SHA1
9f1160104eac87370b8f67a324e2ee56d8e841f4

SHA256
9ebbd5511e24b80b224ad118a0b6e07833aefbf26a2c94d9dbf8d929eb5570ae

SHA512
ca6cde5e125704550b08fd8ecd1ca82a91efe9960032592aaaaf9ead8f8d87100eb153b6743882e0220f41fad48516badfc20d23359a0730ac4cb7ba35c66416

Download Submit
C:\Windows\system\kRdTDzz.exe

Filesize
2.2MB

MD5
4e1e60779191d267935bd060cb8143b9

SHA1
3ab29dd45b416cbd144bac06a0e9575f2a9568cc

SHA256
1f34eb57599f408fc528dba676446e43c9344a5e215baf63c12919d2523824a1

SHA512
3274575d8306701583d7343be5a7defa0b5cbfb7c1e1db4e63507ce32aa48f216cfb3d60a4edd1e0911ffbd580177fa759a778c14d35ece78453710a44316e41

Download Submit
C:\Windows\system\sCjzRpc.exe

Filesize
2.2MB

MD5
6dded7dc29c4dd66b817b92f5c242460

SHA1
077f31d39b23434e08429f3b81f94999474506a8

SHA256
c39e8fd78b42c8bd5a71b64a8f867b8196228fb2bb5d59419cb912595882d4c5

SHA512
14ef488ed6722a496115ac4887cbbcb7780c07fd0061182fce0e43be28e7d70a658e5ee5a721c5a0eda556947b4ba30cd8e008ebee150e80788e417d3c1fa2ec

Download Submit
C:\Windows\system\sDebthY.exe

Filesize
2.2MB

MD5
1b6c438501bd1f3b51e63ee84c0f7734

SHA1
004d896cddf5b50bfece1bd71c416e93b4df12fd

SHA256
d8fe2b025eee9d3d5b57cbfdfb268d42cf8f6099ee9e87eea988587e47edd300

SHA512
f1dcb65f1184799f43cd2ca26294e4f24cbd9f1e2304dc63fb93b21aec165a6a6571f7d44616f42b0e644da4d8c01dd7ff03fb7eab5ca78f890e9427b79f84a6

Download Submit
C:\Windows\system\tUxHdiQ.exe

Filesize
2.2MB

MD5
d8a62eee0203716deb2ae81448522924

SHA1
8c595d8d36bca0e06e34646b95d10f585e963540

SHA256
e261702228972179b1a10c6e5319ae182dcdc5a0617d662e98ade3787a7350e2

SHA512
eb3cb5d5df7aac0058d4774b504aefd52b317b5581b53e0746413014dd9a0ac5aa8d000a5aa2787afdd6faa9ebe6eac8521fdef7677ff6114648e54fb1bcf6f5

Download Submit
C:\Windows\system\tiexdMq.exe

Filesize
2.2MB

MD5
f787ba8096f4784809095aca0dcd81d6

SHA1
e5ae80c6b686d377e7e9bda81d6fc7c94f97830b

SHA256
c0789481aac83637e4b1f4374cdf3b29c958d3fac182f60edb1f957e5064306a

SHA512
c4b9a150fa3c63ab3771a92fa0d583014b42901a51766fbfa234ce4cbe53a66a6b7446ec845cb3d8735e2233d970e3f547bb5c502006bfb5cfe5de665b0652f6

Download Submit
C:\Windows\system\wPdoxYe.exe

Filesize
2.2MB

MD5
d421887194571b3df99455816a4a9d6b

SHA1
13df646e6c5e6e96320641d5b675b2145272f04f

SHA256
04a92e976407029d68364f3205909d6b79c61841defd5c6656a92424274c0597

SHA512
dda6caf71ac49f7e150136d6aa99439a28e10a81a2996975b3f239578fb26a920c4db7657581041398533116e6ec58afa75b1841da1e08f76c0ae2505291ab4e

Download Submit
C:\Windows\system\wxZOIHS.exe

Filesize
2.2MB

MD5
8815e740c2d816bece70e4d55a693128

SHA1
7adde29688606425a63697a3561ee8f58a89e6e4

SHA256
389bf6ff40ca7f6a6db05531e45906e4b22b01d0ee48c2c09abd85f4530e407d

SHA512
b030f59028331b314bb57bac34ce863fbc1920afeaeff17a7b0e99316bf66bf3def9ae4e778c777a7585f80c77ee9398120d9e99ec4b6368f781155bd2a351db

Download Submit
\Windows\system\BuCCtYZ.exe

Filesize
2.2MB

MD5
21840126f74d67c7e59abdd27ec1e010

SHA1
8eef99cbdaf71f9c77a9f13fe9f1312c12f85189

SHA256
f474ecdc7859ca05676bc482356e713689c36edf3e6daa8aa3494e228f8c0c19

SHA512
0aa8453ea238bb0ac8f08455bb886643617270df2a398f2b7b28464f1049ff4ea05a14b6ceb7c7c21c67d89dfb969f00d8e7ee9497cae8e2d2696fda64e48c06

Download Submit
\Windows\system\DiIAEls.exe

Filesize
2.2MB

MD5
abf88a36cf700025a655214373608b9c

SHA1
7455f552cc677769e3ec5a31636357647de6cdc3

SHA256
11dd41bae28a024d36a7c7c8451f049866b8471c1002d6e4385f1cc7d34ee7f4

SHA512
cf532958ee1eafa1b79e23488565a91894efb690a0e2334a679d87a950a3dcc682badfd41775fbdd192672a76805f86910bf0cee5db2eb790bde7353c433cf79

Download Submit
\Windows\system\FgQzAFS.exe

Filesize
2.2MB

MD5
627338c5e57c3d62ef2547c14262b6f1

SHA1
b24274549e933c0aadfefca5b19e8dbb08b88832

SHA256
3823e931322d0667246b7b556eca3c2b9fc87731eebfce9c0fa3cd4ecd3be0dd

SHA512
0f62c23cde9cc00557d80d2f61b366bc29aeae3fc8379eeff875de2aa73afdd6b3f953d88063cda1beb183a83ad21379c9ccfb29c73ee6a2c261928c0797bac6

Download Submit
\Windows\system\MIDXLJV.exe

Filesize
2.2MB

MD5
a045092ad1f46d1e942a2ee4c8c11772

SHA1
a6fdcfceb4a4e87fe13abb8ea57510151e335abe

SHA256
e1dd4a26aab00dce0692dc510ba6fca40aa896d60d91aa13af1a3574185e1480

SHA512
769afc41dbf5dfff747a36748443bd5fa827d4b9ab3d85389cd6b15607a6f671362b271fffe119034b563ffa237ec9cc32e51f5b8f4eb2f27ec8e966c3177d0c

Download Submit
\Windows\system\NPCUSAq.exe

Filesize
2.2MB

MD5
42ce105f05be28078ab297228f8f33e5

SHA1
b042459b4614c1211242d87ead6b8cf489b4b23b

SHA256
86c62179972e8138ae829da8d402aae8003bfc06e41ff50c1c553368f6d318f3

SHA512
c5a8f81fefa3e1178fe1164a3790000872605e7be015dc37c6b3da75f8694c948790725f23c1f26fe80db8b0965cefd78ef991cc18c4cec3d906b0c7c19a3f69

Download Submit
\Windows\system\ODklMmo.exe

Filesize
2.2MB

MD5
305d64f2580081ef229590ecd1323d7b

SHA1
a1c48116d4953c49382243bd54d3a90829b4288d

SHA256
20ebec4789e1aa61086156fae0cde4493ed966163c942ff73157ef98a85b4096

SHA512
7c68ea51c0b8e37de7701318a79378db9eac8ab5e9ef39cf34d70971fa22dd8af586dd43facc013d26ac897dd929dede02c28b64cbbb57f8d1c406aa848aec6b

Download Submit
\Windows\system\UIvrtvu.exe

Filesize
2.2MB

MD5
c8e24ceb981c54b901d4acde52d63c91

SHA1
7850c4bf697b8472348a53f5806878e52fa63146

SHA256
a27d0c436b6907157f98b68fd75ffd1f627acf606cf5b3f4cb31c14983219d6f

SHA512
b02330f10bf7b8cd20a1c5ef64a49a4f84ffea9062c6b72c9689faedccf29fadc74827bfdae5680d440c2849aa6888190c7aad4783c0a28cb59c04ba711a3de8

Download Submit
\Windows\system\YRfzEDT.exe

Filesize
2.2MB

MD5
37a7ae5d5ee4f0f04cf055b195f3743b

SHA1
f33d3628af8377d57aca34350a88f3db24e3b455

SHA256
fea8f35e9684c5d02dd0839d9b931a7a3ebc1ccafc452f747ae72e1d68a18a4d

SHA512
baa06f8e0fb3895c58926c59027e1289d36d94c76024731a919b16e4cd0510c0630619fac99da75bef6ac84e42f2c9b7d1f354ce540b03f288151c18d8b784f9

Download Submit
\Windows\system\YouQhuk.exe

Filesize
2.2MB

MD5
01a63eacda5864654b7d2be3f3bc4b21

SHA1
14b93545cd27b30841c2c3d314aa20181e639726

SHA256
c2037f6e7f0eff513510766dfab211f158000dc123e498b77b986367093e5ebd

SHA512
2bdf8f404f98183e31857dfdca67edbe168125545ad016e48ac190b08a27fbe3ac72e23fa5fe8afabdb475dcc29ccca4f924b3175c073c16f6a38b89083f34d5

Download Submit
\Windows\system\ZEqZhdW.exe

Filesize
2.2MB

MD5
09626f83d6c30b159f2e5d38d77bd614

SHA1
e8732fccc47a665a1b5d7be85a1ec88793934edf

SHA256
745f60da76dff86177de9b172c707934b19549dce9f9e39c744f27153741a4ab

SHA512
eb122a89a9979f040d266b229ce573069b960d22b30bc8f455ba39e33d5d05687fdba762d38e14ab9567c782ac75967789b3e6575cd28ca8dae2cef560767301

Download Submit
\Windows\system\czyxfwt.exe

Filesize
2.2MB

MD5
9ca2c220f41b16ffab02d1e829ca73f4

SHA1
741e5f98dbf76c55de9c1dc4e87f188125d82758

SHA256
383027ef74b7c7cc712241d7e2550d191fed39a23a52e6653c850ff8e1202c28

SHA512
0de358beaeee03237faf35e9f44b0b687d6ec46c64e5c8f3b4fdaebc4a3848633663a39cfa045bf5676498f60e03a57f500e7fe7dec0373f25f7338702241702

Download Submit
\Windows\system\dOdstcE.exe

Filesize
2.2MB

MD5
c694a7674d36669de4227716478c5071

SHA1
c3605430da2cd9175a67c959404c427155b061c9

SHA256
68ad98697ab1d6b669d7bb80a3375469cadefef2d8b7c52a825cfe10dac5fe9d

SHA512
d854a508a73e87996354d9dcd4d6ef73f0e27906d380b116e2c1d8d533fcbf6eae84b1297e3bb195621ecf6b57ee7b0d715f080738a71b677a9d64fee1d1e095

Download Submit
\Windows\system\gjTycIn.exe

Filesize
2.2MB

MD5
c5f697d716ce8882c1b7086b7c6fbe4f

SHA1
b179f1144c933f82ac32f05e418eeee5de2f3965

SHA256
155f3529c26029632866dce93625ab3df19e3aaef9e2950efaa58bf91dc30332

SHA512
a39bddaa38dd633108880aca8bdb60c0d599383523df33d6991d263c22b3866b85e403c49476ff7bce5966f850ae9da1140c2baec1d957874f94b4771af5fdfc

Download Submit
\Windows\system\iHeogXf.exe

Filesize
2.2MB

MD5
0017214595e471555f26da00859e3295

SHA1
ab13a35e3f102163610f5e2732d773d939833872

SHA256
4cd06cb443d4f84b814ae5b52cb58eec865406349c63dd361d7cacb64db98337

SHA512
914491c432451f6c4ad408219f215773b5ddd39f8a16fd69026d6a7a5ac023f02cfbe45917d3f445f743ed5a57a946a1a1d92e37e5c1603b28975ea9b27c6cc4

Download Submit
\Windows\system\ljCPBpo.exe

Filesize
2.2MB

MD5
0b6e7d0392cf3cdd29abdd99f497c061

SHA1
f57bf3bdf886eff49340e0b96f7397bffadfdad4

SHA256
1332942951fd5e25ec2860d65c22d548a8f7935773eed4ee80bdaa1e07d51516

SHA512
f715184e59926b4e0beffe7700e0036dd8a1cdd6a63293942ddcce84b3ab980c3edd6ac02802cf14f6f85a6d750b6cdef14824c69f7b8837ed09faaeb6194d86

Download Submit
\Windows\system\onCZahK.exe

Filesize
2.2MB

MD5
d6be45029ff48dc4ca0f06f869a82859

SHA1
5070b093d3b321fb2d7f4bcf16c28ffc2880e2a0

SHA256
d25120669bcd87f741512537b1670cfaa414eae03eb0bf6b77029ae32f4e700a

SHA512
e996556e0ca39e04661cca65fc437aa4428410fe43150299ddca7d99bb0a1e9fa7d89ea4392a298cfaaa69a030fa9325f042586e987067394e444039289902aa

Download Submit
\Windows\system\qgEGwqx.exe

Filesize
2.2MB

MD5
d984d89eb527c45d22f638ecaa3913d5

SHA1
cf88d56ca1ff12601d5bd0d860bec9128f4db8ef

SHA256
cf1625fad4e68d0761a754d2f7a22fedafa8c78ad00f2b848725776c3b8692bd

SHA512
6d77aa878b00ac350bce4cd22f279c62673d1ed5521277fca4d4d556d892857563320354db0918340dd59381c5602f5d6d98f481c58377d31fa603678a68703e

Download Submit
\Windows\system\txPApWV.exe

Filesize
2.2MB

MD5
5f6948199c3dab99555476d0ebdc72a5

SHA1
43613c298e778e35f6af4718b27448a9b4dafb3e

SHA256
5b670380e6c2da8460cc5333c8f7fb63c4ebc8143b94ce3bc93fd9166536c481

SHA512
1eae6df975694f4d22f1231aa449b12f67337622e894e2e3bd79ca623ea195791a522fcc182b1841712b1d44cb564f83c6b7558ff621786101fb3f4d9026cfea

Download Submit
\Windows\system\uhmrUgT.exe

Filesize
2.2MB

MD5
d5baf7e928b0d07d758ee1678c56753d

SHA1
711140ee169c890b265c80a7ba2e14be4ac8fafe

SHA256
e5053fb956fc1373f2bf3c6c72df9e7d2471f8a164549dec2d068c2f4ef69bd2

SHA512
11f1f2708b2bba2236353e2a9e46b84fda755f4111893b9d72a1a302468296f56793679c0976e61d1ffa702ce2a2f0165dcc88252f7899c7e37b2a287a02af9d

Download Submit
\Windows\system\wzENuvO.exe

Filesize
2.2MB

MD5
239ed77dc60d797369cc4c6ecefdb5d2

SHA1
be83aaca57085d85066116a0f717e841a06c83ca

SHA256
9d19daa6f9632d4821cbb5ae109095d14f4ad3fbd362dfc4f8747ac7d96cc368

SHA512
08ad14228546c63fd87ca1fc1a4ecb8993cb6dff0752eca3da270b43e46f08394d8dbec4dd684ae63e53e155cdcb3ed8225ba27f2958f35e4b483c2b84a1194b

Download Submit
\Windows\system\yLStSBG.exe

Filesize
2.2MB

MD5
929038965d5641489533fdb4dc2b5e48

SHA1
9e74c3f3efc9a9a247149db226e3c1ef396a8033

SHA256
46a828e494d0d07007f4e33e38cebb39535ab5afedbecf952c9dc1dfcfa28863

SHA512
c8b83516054790c1070cfc93ecbe00d138ec83d3189234feb39138f99029289224b23e87d217f54437f28e3506102b1b6320b7f69969e391ded4238b35cff5c9

Download Submit
\Windows\system\yXbmmsG.exe

Filesize
2.2MB

MD5
2c5cb1465593e1711d52d18f13e53d25

SHA1
d51f9f7f6a3d12bdc47d60b9806cb3f358132e12

SHA256
7c725e2ed68118f33ed8905e1c1ea52e709418a03928267014db96d3d38354e6

SHA512
081f50af02394150e50ba19fe1e676b3113f4186d99edb7be3a501b75ad18930defbbc236579af7e6094a2f758700821aed3b3c7db5ccc4228f42c58db2a4d8b

Download Submit
memory/1048-5931-0x000000013FF20000-0x0000000140312000-memory.dmp

Filesize
3.9MB

Download
memory/1048-195-0x000000013FF20000-0x0000000140312000-memory.dmp

Filesize
3.9MB

Download
memory/1960-5955-0x000000013F760000-0x000000013FB52000-memory.dmp

Filesize
3.9MB

Download
memory/1960-12-0x000000013F760000-0x000000013FB52000-memory.dmp

Filesize
3.9MB

Download
memory/1972-6-0x00000000030C0000-0x00000000034B2000-memory.dmp

Filesize
3.9MB

Download
memory/1972-202-0x00000000030C0000-0x00000000034B2000-memory.dmp

Filesize
3.9MB

Download
memory/1972-192-0x000000013FF20000-0x0000000140312000-memory.dmp

Filesize
3.9MB

Download
memory/1972-193-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/1972-188-0x00000000035E0000-0x00000000039D2000-memory.dmp

Filesize
3.9MB

Download
memory/1972-191-0x00000000035E0000-0x00000000039D2000-memory.dmp

Filesize
3.9MB

Download
memory/1972-190-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/1972-1-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/1972-197-0x000000013F3D0000-0x000000013F7C2000-memory.dmp

Filesize
3.9MB

Download
memory/1972-161-0x000000013FF40000-0x0000000140332000-memory.dmp

Filesize
3.9MB

Download
memory/1972-0-0x000000013F8D0000-0x000000013FCC2000-memory.dmp

Filesize
3.9MB

Download
memory/1972-201-0x00000000035E0000-0x00000000039D2000-memory.dmp

Filesize
3.9MB

Download
memory/1972-200-0x00000000035E0000-0x00000000039D2000-memory.dmp

Filesize
3.9MB

Download
memory/2052-106-0x000000013F9C0000-0x000000013FDB2000-memory.dmp

Filesize
3.9MB

Download
memory/2308-256-0x000007FEF5BD0000-0x000007FEF656D000-memory.dmp

Filesize
9.6MB

Download
memory/2308-64-0x000007FEF5BD0000-0x000007FEF656D000-memory.dmp

Filesize
9.6MB

Download
memory/2308-28-0x0000000002960000-0x0000000002968000-memory.dmp

Filesize
32KB

Download
memory/2308-27-0x000000001B590000-0x000000001B872000-memory.dmp

Filesize
2.9MB

Download
memory/2308-183-0x000007FEF5BD0000-0x000007FEF656D000-memory.dmp

Filesize
9.6MB

Download
memory/2308-13-0x00000000029A0000-0x0000000002A20000-memory.dmp

Filesize
512KB

Download
memory/2308-14-0x000007FEF5E8E000-0x000007FEF5E8F000-memory.dmp

Filesize
4KB

Download
memory/2432-5944-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/2432-196-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/2440-189-0x000000013F720000-0x000000013FB12000-memory.dmp

Filesize
3.9MB

Download
memory/2440-5772-0x000000013F720000-0x000000013FB12000-memory.dmp

Filesize
3.9MB

Download
memory/2524-135-0x000000013F500000-0x000000013F8F2000-memory.dmp

Filesize
3.9MB

Download
memory/2524-5945-0x000000013F500000-0x000000013F8F2000-memory.dmp

Filesize
3.9MB

Download
memory/2536-5776-0x000000013FF40000-0x0000000140332000-memory.dmp

Filesize
3.9MB

Download
memory/2536-187-0x000000013FF40000-0x0000000140332000-memory.dmp

Filesize
3.9MB

Download
memory/2592-194-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/2592-5943-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/2812-5895-0x000000013FB90000-0x000000013FF82000-memory.dmp

Filesize
3.9MB

Download
memory/2812-186-0x000000013FB90000-0x000000013FF82000-memory.dmp

Filesize
3.9MB

Download