xmrig | 91f488398d4aca958fa574fa99a1268851a4a242d81d7820aac25cec1f0eee62

Analysis

max time kernel
120s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/05/2024, 00:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
Size

1.9MB
MD5

0f425a4707b96550d100b3637d0bb6d0
SHA1

313d5a06d35f018650fb4277aad532457022a666
SHA256

91f488398d4aca958fa574fa99a1268851a4a242d81d7820aac25cec1f0eee62
SHA512

42c39a4efb222cf538f80bb8da411fba2bf9cf150fb456803eca07d0e23017bf7f380dbd6673af9d29238ef19001f30096f6c138f8d6559893d3705246bb3a25
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p1HzDgUUDh:NABa

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 24 IoCs

miner

resource	yara_rule
behavioral1/memory/1612-13-0x000000013FB50000-0x000000013FF42000-memory.dmp	xmrig
behavioral1/memory/1628-146-0x000000013F140000-0x000000013F532000-memory.dmp	xmrig
behavioral1/memory/1480-144-0x000000013F420000-0x000000013F812000-memory.dmp	xmrig
behavioral1/memory/3028-142-0x000000013F750000-0x000000013FB42000-memory.dmp	xmrig
behavioral1/memory/2320-140-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	xmrig
behavioral1/memory/2404-138-0x000000013FD90000-0x0000000140182000-memory.dmp	xmrig
behavioral1/memory/2436-136-0x000000013FE80000-0x0000000140272000-memory.dmp	xmrig
behavioral1/memory/2568-134-0x000000013F8A0000-0x000000013FC92000-memory.dmp	xmrig
behavioral1/memory/2944-132-0x000000013FE20000-0x0000000140212000-memory.dmp	xmrig
behavioral1/memory/1152-130-0x000000013F8B0000-0x000000013FCA2000-memory.dmp	xmrig
behavioral1/memory/2712-128-0x000000013F820000-0x000000013FC12000-memory.dmp	xmrig
behavioral1/memory/2664-126-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	xmrig
behavioral1/memory/1612-2232-0x000000013FB50000-0x000000013FF42000-memory.dmp	xmrig
behavioral1/memory/2712-2233-0x000000013F820000-0x000000013FC12000-memory.dmp	xmrig
behavioral1/memory/2944-2235-0x000000013FE20000-0x0000000140212000-memory.dmp	xmrig
behavioral1/memory/2664-2234-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	xmrig
behavioral1/memory/2436-2236-0x000000013FE80000-0x0000000140272000-memory.dmp	xmrig
behavioral1/memory/2568-2237-0x000000013F8A0000-0x000000013FC92000-memory.dmp	xmrig
behavioral1/memory/1152-2238-0x000000013F8B0000-0x000000013FCA2000-memory.dmp	xmrig
behavioral1/memory/2320-2240-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	xmrig
behavioral1/memory/1480-2239-0x000000013F420000-0x000000013F812000-memory.dmp	xmrig
behavioral1/memory/3028-2242-0x000000013F750000-0x000000013FB42000-memory.dmp	xmrig
behavioral1/memory/2404-2241-0x000000013FD90000-0x0000000140182000-memory.dmp	xmrig
behavioral1/memory/1628-2243-0x000000013F140000-0x000000013F532000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2968	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1612	tnVIPzz.exe
2664	jblBxwc.exe
2712	cNsJIdh.exe
1152	BDHVrGc.exe
2944	kwSUOPa.exe
2568	pgbuKzO.exe
2436	mIhqVuQ.exe
2404	gsPJcCT.exe
2320	onoitKt.exe
3028	AJKDBXT.exe
1480	LNnbQco.exe
1628	KsEdBOi.exe
1792	VIxfJrv.exe
800	HuVLnFm.exe
1028	yXIOHaX.exe
2648	zIqCdUf.exe
2644	VRxJdzy.exe
2736	eWHjmfe.exe
1996	DjsLkDc.exe
1500	MnrILoE.exe
1296	izemhrL.exe
1332	PQbkwHC.exe
1680	zfDxjVR.exe
2504	wsiHgtK.exe
3048	vaXQVTW.exe
324	dVLPhoA.exe
528	LoBQuHc.exe
2152	ychZqor.exe
2104	euVBkUz.exe
2060	DNdfNKE.exe
3036	JyRtbDN.exe
600	gSMsqjr.exe
1832	AYTOQao.exe
1336	aMNnRpU.exe
1656	hKJsnnU.exe
964	swoALJP.exe
1856	rDUDhki.exe
2128	zrcaspu.exe
1316	YJdKwww.exe
892	LXHWtlp.exe
948	UZmAKHO.exe
1524	TUSvpbY.exe
2164	KKkpOKV.exe
1476	dsyGrIM.exe
2264	BuFynae.exe
1392	sTfQXQJ.exe
1484	pEaHEuM.exe
2300	NdbMWYo.exe
2192	DCnTbrD.exe
2832	TkSAggl.exe
2780	iIVtHTb.exe
1592	zGpgeLO.exe
2952	MnYPpju.exe
3020	RagMbvY.exe
2596	NKzNSzX.exe
2720	aofrZFx.exe
2532	orqucEz.exe
2764	nVIxutO.exe
2860	GiYMZGe.exe
3024	vvtGUNd.exe
552	IDyastm.exe
1104	uCjPFQy.exe
1876	ehSWUqS.exe
1620	DkslJxL.exe

Loads dropped DLL 64 IoCs

pid	Process
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe

UPX packed file 63 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3016-0-0x000000013F3A0000-0x000000013F792000-memory.dmp	upx
behavioral1/files/0x0009000000015c23-5.dat	upx
behavioral1/memory/1612-13-0x000000013FB50000-0x000000013FF42000-memory.dmp	upx
behavioral1/files/0x0027000000015c69-17.dat	upx
behavioral1/files/0x000f0000000006fd-18.dat	upx
behavioral1/files/0x0009000000015db4-23.dat	upx
behavioral1/files/0x0007000000015e02-32.dat	upx
behavioral1/files/0x0009000000015e5b-35.dat	upx
behavioral1/files/0x0007000000016b5e-41.dat	upx
behavioral1/files/0x0006000000018b15-51.dat	upx
behavioral1/files/0x0006000000018b33-58.dat	upx
behavioral1/files/0x0006000000018b37-62.dat	upx
behavioral1/files/0x0006000000018b42-65.dat	upx
behavioral1/files/0x0006000000018b4a-72.dat	upx
behavioral1/files/0x00050000000192c9-98.dat	upx
behavioral1/files/0x0005000000019333-107.dat	upx
behavioral1/files/0x000500000001946b-174.dat	upx
behavioral1/files/0x0005000000019473-185.dat	upx
behavioral1/files/0x00050000000194a4-194.dat	upx
behavioral1/files/0x00050000000194a4-192.dat	upx
behavioral1/files/0x0005000000019485-188.dat	upx
behavioral1/files/0x0005000000019485-186.dat	upx
behavioral1/files/0x00050000000193b0-165.dat	upx
behavioral1/files/0x000500000001946f-178.dat	upx
behavioral1/files/0x0005000000019410-168.dat	upx
behavioral1/files/0x0005000000019377-153.dat	upx
behavioral1/files/0x0005000000019377-151.dat	upx
behavioral1/files/0x000500000001939b-155.dat	upx
behavioral1/files/0x00050000000192f4-101.dat	upx
behavioral1/files/0x00050000000192f4-148.dat	upx
behavioral1/files/0x0006000000018d06-95.dat	upx
behavioral1/memory/1628-146-0x000000013F140000-0x000000013F532000-memory.dmp	upx
behavioral1/memory/1480-144-0x000000013F420000-0x000000013F812000-memory.dmp	upx
behavioral1/memory/3028-142-0x000000013F750000-0x000000013FB42000-memory.dmp	upx
behavioral1/memory/2320-140-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	upx
behavioral1/memory/2404-138-0x000000013FD90000-0x0000000140182000-memory.dmp	upx
behavioral1/memory/2436-136-0x000000013FE80000-0x0000000140272000-memory.dmp	upx
behavioral1/memory/2568-134-0x000000013F8A0000-0x000000013FC92000-memory.dmp	upx
behavioral1/memory/2944-132-0x000000013FE20000-0x0000000140212000-memory.dmp	upx
behavioral1/memory/1152-130-0x000000013F8B0000-0x000000013FCA2000-memory.dmp	upx
behavioral1/memory/2712-128-0x000000013F820000-0x000000013FC12000-memory.dmp	upx
behavioral1/memory/2664-126-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	upx
behavioral1/files/0x0005000000019368-118.dat	upx
behavioral1/files/0x000500000001931b-117.dat	upx
behavioral1/files/0x00050000000192c9-115.dat	upx
behavioral1/files/0x0006000000018ba2-91.dat	upx
behavioral1/files/0x0006000000018b96-85.dat	upx
behavioral1/files/0x0006000000018b73-83.dat	upx
behavioral1/files/0x0006000000018b6a-80.dat	upx
behavioral1/files/0x0006000000018b6a-77.dat	upx
behavioral1/files/0x0006000000018ae8-47.dat	upx
behavioral1/memory/1612-2232-0x000000013FB50000-0x000000013FF42000-memory.dmp	upx
behavioral1/memory/2712-2233-0x000000013F820000-0x000000013FC12000-memory.dmp	upx
behavioral1/memory/2944-2235-0x000000013FE20000-0x0000000140212000-memory.dmp	upx
behavioral1/memory/2664-2234-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	upx
behavioral1/memory/2436-2236-0x000000013FE80000-0x0000000140272000-memory.dmp	upx
behavioral1/memory/2568-2237-0x000000013F8A0000-0x000000013FC92000-memory.dmp	upx
behavioral1/memory/1152-2238-0x000000013F8B0000-0x000000013FCA2000-memory.dmp	upx
behavioral1/memory/2320-2240-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	upx
behavioral1/memory/1480-2239-0x000000013F420000-0x000000013F812000-memory.dmp	upx
behavioral1/memory/3028-2242-0x000000013F750000-0x000000013FB42000-memory.dmp	upx
behavioral1/memory/2404-2241-0x000000013FD90000-0x0000000140182000-memory.dmp	upx
behavioral1/memory/1628-2243-0x000000013F140000-0x000000013F532000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\jblBxwc.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\feZquOQ.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\PNQGDkg.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\RxnDRxp.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\zZKLxnR.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\jvPmdPr.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\hQevbmP.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\BcbCWZy.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\oVKRcLz.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\sqqlhCN.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\aGNfbRF.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\pFgfAxh.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\kygZbjc.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\qCljkxo.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\VvajTXY.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\ZAFDcVH.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\mGnnbXw.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\QYDDecQ.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\aKqQFss.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\pHpOCKc.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\fxvrkuU.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\uUDYDyv.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\VJrmKew.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\DzZcKDF.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\NGmepji.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\zQmWTrU.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\ouvHMIx.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\LaLYfqU.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\bmgCLob.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\FaLAwIY.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\cRKcZRI.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\ehSWUqS.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\DoJLgXU.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\ZSgAlvj.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\xkLakrc.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\LmpVpJc.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\PmrwYeU.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\pMlaLsR.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\ByqVixR.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\lMxxUbg.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\KJiQRIr.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\PFNrbCW.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\SYbifES.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\DWdcUcI.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\DBqrAYg.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\rDUDhki.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\vvtGUNd.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\aklxMVw.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\UdipWSv.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\iwmozfl.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\gMoFzxr.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\YsxssVj.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\UkJjvvd.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\bGgIaVt.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\ptamSZm.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\mIhqVuQ.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\uBxdbAz.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\JXCZrtI.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\LBMdJtR.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\ZTasfnu.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\axzZANG.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\zrcaspu.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\plFvKsd.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
File created	C:\Windows\System\KHuQTkY.exe	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2968	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
Token: SeDebugPrivilege	2968	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2968	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	29
PID 3016 wrote to memory of 2968	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	29
PID 3016 wrote to memory of 2968	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	29
PID 3016 wrote to memory of 1612	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	30
PID 3016 wrote to memory of 1612	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	30
PID 3016 wrote to memory of 1612	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	30
PID 3016 wrote to memory of 2664	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	31
PID 3016 wrote to memory of 2664	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	31
PID 3016 wrote to memory of 2664	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	31
PID 3016 wrote to memory of 2712	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	32
PID 3016 wrote to memory of 2712	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	32
PID 3016 wrote to memory of 2712	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	32
PID 3016 wrote to memory of 1152	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	33
PID 3016 wrote to memory of 1152	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	33
PID 3016 wrote to memory of 1152	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	33
PID 3016 wrote to memory of 2944	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	34
PID 3016 wrote to memory of 2944	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	34
PID 3016 wrote to memory of 2944	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	34
PID 3016 wrote to memory of 2568	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	35
PID 3016 wrote to memory of 2568	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	35
PID 3016 wrote to memory of 2568	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	35
PID 3016 wrote to memory of 2436	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	36
PID 3016 wrote to memory of 2436	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	36
PID 3016 wrote to memory of 2436	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	36
PID 3016 wrote to memory of 2404	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	37
PID 3016 wrote to memory of 2404	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	37
PID 3016 wrote to memory of 2404	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	37
PID 3016 wrote to memory of 2320	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	38
PID 3016 wrote to memory of 2320	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	38
PID 3016 wrote to memory of 2320	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	38
PID 3016 wrote to memory of 3028	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	39
PID 3016 wrote to memory of 3028	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	39
PID 3016 wrote to memory of 3028	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	39
PID 3016 wrote to memory of 1480	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	40
PID 3016 wrote to memory of 1480	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	40
PID 3016 wrote to memory of 1480	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	40
PID 3016 wrote to memory of 1628	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	41
PID 3016 wrote to memory of 1628	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	41
PID 3016 wrote to memory of 1628	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	41
PID 3016 wrote to memory of 1792	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	42
PID 3016 wrote to memory of 1792	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	42
PID 3016 wrote to memory of 1792	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	42
PID 3016 wrote to memory of 800	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	43
PID 3016 wrote to memory of 800	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	43
PID 3016 wrote to memory of 800	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	43
PID 3016 wrote to memory of 1028	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	44
PID 3016 wrote to memory of 1028	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	44
PID 3016 wrote to memory of 1028	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	44
PID 3016 wrote to memory of 2648	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	45
PID 3016 wrote to memory of 2648	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	45
PID 3016 wrote to memory of 2648	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	45
PID 3016 wrote to memory of 2644	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	46
PID 3016 wrote to memory of 2644	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	46
PID 3016 wrote to memory of 2644	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	46
PID 3016 wrote to memory of 2736	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	47
PID 3016 wrote to memory of 2736	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	47
PID 3016 wrote to memory of 2736	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	47
PID 3016 wrote to memory of 1996	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	48
PID 3016 wrote to memory of 1996	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	48
PID 3016 wrote to memory of 1996	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	48
PID 3016 wrote to memory of 1332	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	49
PID 3016 wrote to memory of 1332	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	49
PID 3016 wrote to memory of 1332	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	49
PID 3016 wrote to memory of 1500	3016	0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0f425a4707b96550d100b3637d0bb6d0_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2968
- C:\Windows\System\tnVIPzz.exe
  C:\Windows\System\tnVIPzz.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\jblBxwc.exe
  C:\Windows\System\jblBxwc.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\cNsJIdh.exe
  C:\Windows\System\cNsJIdh.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\BDHVrGc.exe
  C:\Windows\System\BDHVrGc.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\kwSUOPa.exe
  C:\Windows\System\kwSUOPa.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\pgbuKzO.exe
  C:\Windows\System\pgbuKzO.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\mIhqVuQ.exe
  C:\Windows\System\mIhqVuQ.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\gsPJcCT.exe
  C:\Windows\System\gsPJcCT.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\onoitKt.exe
  C:\Windows\System\onoitKt.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\AJKDBXT.exe
  C:\Windows\System\AJKDBXT.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\LNnbQco.exe
  C:\Windows\System\LNnbQco.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\KsEdBOi.exe
  C:\Windows\System\KsEdBOi.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\VIxfJrv.exe
  C:\Windows\System\VIxfJrv.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\HuVLnFm.exe
  C:\Windows\System\HuVLnFm.exe
  2⤵
  - Executes dropped EXE
  PID:800
- C:\Windows\System\yXIOHaX.exe
  C:\Windows\System\yXIOHaX.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\zIqCdUf.exe
  C:\Windows\System\zIqCdUf.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\VRxJdzy.exe
  C:\Windows\System\VRxJdzy.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\eWHjmfe.exe
  C:\Windows\System\eWHjmfe.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\DjsLkDc.exe
  C:\Windows\System\DjsLkDc.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\PQbkwHC.exe
  C:\Windows\System\PQbkwHC.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\MnrILoE.exe
  C:\Windows\System\MnrILoE.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\zfDxjVR.exe
  C:\Windows\System\zfDxjVR.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\izemhrL.exe
  C:\Windows\System\izemhrL.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\wsiHgtK.exe
  C:\Windows\System\wsiHgtK.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\vaXQVTW.exe
  C:\Windows\System\vaXQVTW.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\dVLPhoA.exe
  C:\Windows\System\dVLPhoA.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\LoBQuHc.exe
  C:\Windows\System\LoBQuHc.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\ychZqor.exe
  C:\Windows\System\ychZqor.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\euVBkUz.exe
  C:\Windows\System\euVBkUz.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\DNdfNKE.exe
  C:\Windows\System\DNdfNKE.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\JyRtbDN.exe
  C:\Windows\System\JyRtbDN.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\gSMsqjr.exe
  C:\Windows\System\gSMsqjr.exe
  2⤵
  - Executes dropped EXE
  PID:600
- C:\Windows\System\AYTOQao.exe
  C:\Windows\System\AYTOQao.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\aMNnRpU.exe
  C:\Windows\System\aMNnRpU.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\hKJsnnU.exe
  C:\Windows\System\hKJsnnU.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\swoALJP.exe
  C:\Windows\System\swoALJP.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\rDUDhki.exe
  C:\Windows\System\rDUDhki.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\zrcaspu.exe
  C:\Windows\System\zrcaspu.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\YJdKwww.exe
  C:\Windows\System\YJdKwww.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\LXHWtlp.exe
  C:\Windows\System\LXHWtlp.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\UZmAKHO.exe
  C:\Windows\System\UZmAKHO.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\TUSvpbY.exe
  C:\Windows\System\TUSvpbY.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\KKkpOKV.exe
  C:\Windows\System\KKkpOKV.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\BuFynae.exe
  C:\Windows\System\BuFynae.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\dsyGrIM.exe
  C:\Windows\System\dsyGrIM.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\pEaHEuM.exe
  C:\Windows\System\pEaHEuM.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\sTfQXQJ.exe
  C:\Windows\System\sTfQXQJ.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\NdbMWYo.exe
  C:\Windows\System\NdbMWYo.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\DCnTbrD.exe
  C:\Windows\System\DCnTbrD.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\TkSAggl.exe
  C:\Windows\System\TkSAggl.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\iIVtHTb.exe
  C:\Windows\System\iIVtHTb.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\zGpgeLO.exe
  C:\Windows\System\zGpgeLO.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\MnYPpju.exe
  C:\Windows\System\MnYPpju.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\RagMbvY.exe
  C:\Windows\System\RagMbvY.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\NKzNSzX.exe
  C:\Windows\System\NKzNSzX.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\orqucEz.exe
  C:\Windows\System\orqucEz.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\aofrZFx.exe
  C:\Windows\System\aofrZFx.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\nVIxutO.exe
  C:\Windows\System\nVIxutO.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\GiYMZGe.exe
  C:\Windows\System\GiYMZGe.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\vvtGUNd.exe
  C:\Windows\System\vvtGUNd.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\IDyastm.exe
  C:\Windows\System\IDyastm.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\ehSWUqS.exe
  C:\Windows\System\ehSWUqS.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\uCjPFQy.exe
  C:\Windows\System\uCjPFQy.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\DkslJxL.exe
  C:\Windows\System\DkslJxL.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\EhuQoXy.exe
  C:\Windows\System\EhuQoXy.exe
  2⤵
  PID:2800
- C:\Windows\System\FUgLHXy.exe
  C:\Windows\System\FUgLHXy.exe
  2⤵
  PID:1396
- C:\Windows\System\CMCIYzS.exe
  C:\Windows\System\CMCIYzS.exe
  2⤵
  PID:2252
- C:\Windows\System\omuELZC.exe
  C:\Windows\System\omuELZC.exe
  2⤵
  PID:2632
- C:\Windows\System\FbSKaKf.exe
  C:\Windows\System\FbSKaKf.exe
  2⤵
  PID:1300
- C:\Windows\System\yKWhygt.exe
  C:\Windows\System\yKWhygt.exe
  2⤵
  PID:2248
- C:\Windows\System\ehRpdrf.exe
  C:\Windows\System\ehRpdrf.exe
  2⤵
  PID:1780
- C:\Windows\System\bFImWYk.exe
  C:\Windows\System\bFImWYk.exe
  2⤵
  PID:2992
- C:\Windows\System\xBqjibA.exe
  C:\Windows\System\xBqjibA.exe
  2⤵
  PID:1132
- C:\Windows\System\PmrwYeU.exe
  C:\Windows\System\PmrwYeU.exe
  2⤵
  PID:2148
- C:\Windows\System\sIQLVxI.exe
  C:\Windows\System\sIQLVxI.exe
  2⤵
  PID:440
- C:\Windows\System\UkPvgKM.exe
  C:\Windows\System\UkPvgKM.exe
  2⤵
  PID:1764
- C:\Windows\System\FXPuKfO.exe
  C:\Windows\System\FXPuKfO.exe
  2⤵
  PID:1952
- C:\Windows\System\Vwxxmxn.exe
  C:\Windows\System\Vwxxmxn.exe
  2⤵
  PID:2200
- C:\Windows\System\kSENlNo.exe
  C:\Windows\System\kSENlNo.exe
  2⤵
  PID:1608
- C:\Windows\System\MsFjCux.exe
  C:\Windows\System\MsFjCux.exe
  2⤵
  PID:2024
- C:\Windows\System\BpkCjKO.exe
  C:\Windows\System\BpkCjKO.exe
  2⤵
  PID:2792
- C:\Windows\System\GiYnvVb.exe
  C:\Windows\System\GiYnvVb.exe
  2⤵
  PID:3052
- C:\Windows\System\DFsJliK.exe
  C:\Windows\System\DFsJliK.exe
  2⤵
  PID:2012
- C:\Windows\System\rnyaeur.exe
  C:\Windows\System\rnyaeur.exe
  2⤵
  PID:2492
- C:\Windows\System\VzTPWyw.exe
  C:\Windows\System\VzTPWyw.exe
  2⤵
  PID:2260
- C:\Windows\System\aklxMVw.exe
  C:\Windows\System\aklxMVw.exe
  2⤵
  PID:2672
- C:\Windows\System\efqkjGn.exe
  C:\Windows\System\efqkjGn.exe
  2⤵
  PID:1632
- C:\Windows\System\QLBeGCK.exe
  C:\Windows\System\QLBeGCK.exe
  2⤵
  PID:2432
- C:\Windows\System\sPkcHrj.exe
  C:\Windows\System\sPkcHrj.exe
  2⤵
  PID:2476
- C:\Windows\System\tKBTMHa.exe
  C:\Windows\System\tKBTMHa.exe
  2⤵
  PID:872
- C:\Windows\System\VzIWWoI.exe
  C:\Windows\System\VzIWWoI.exe
  2⤵
  PID:2312
- C:\Windows\System\LbPteQS.exe
  C:\Windows\System\LbPteQS.exe
  2⤵
  PID:2836
- C:\Windows\System\fkxGATy.exe
  C:\Windows\System\fkxGATy.exe
  2⤵
  PID:2728
- C:\Windows\System\llIUyev.exe
  C:\Windows\System\llIUyev.exe
  2⤵
  PID:2656
- C:\Windows\System\RXntKAD.exe
  C:\Windows\System\RXntKAD.exe
  2⤵
  PID:2684
- C:\Windows\System\sffyNbc.exe
  C:\Windows\System\sffyNbc.exe
  2⤵
  PID:2480
- C:\Windows\System\BMeicBb.exe
  C:\Windows\System\BMeicBb.exe
  2⤵
  PID:2688
- C:\Windows\System\ckkuMci.exe
  C:\Windows\System\ckkuMci.exe
  2⤵
  PID:2304
- C:\Windows\System\CTKprCi.exe
  C:\Windows\System\CTKprCi.exe
  2⤵
  PID:1644
- C:\Windows\System\qBJraTE.exe
  C:\Windows\System\qBJraTE.exe
  2⤵
  PID:2744
- C:\Windows\System\GjuNcCq.exe
  C:\Windows\System\GjuNcCq.exe
  2⤵
  PID:1468
- C:\Windows\System\qbaAvBM.exe
  C:\Windows\System\qbaAvBM.exe
  2⤵
  PID:1732
- C:\Windows\System\lemwpah.exe
  C:\Windows\System\lemwpah.exe
  2⤵
  PID:1984
- C:\Windows\System\NKMxQLP.exe
  C:\Windows\System\NKMxQLP.exe
  2⤵
  PID:2064
- C:\Windows\System\drkrzsv.exe
  C:\Windows\System\drkrzsv.exe
  2⤵
  PID:1768
- C:\Windows\System\PqUfWYA.exe
  C:\Windows\System\PqUfWYA.exe
  2⤵
  PID:1784
- C:\Windows\System\snLINYv.exe
  C:\Windows\System\snLINYv.exe
  2⤵
  PID:1852
- C:\Windows\System\TOIqHvA.exe
  C:\Windows\System\TOIqHvA.exe
  2⤵
  PID:2588
- C:\Windows\System\UjgefAH.exe
  C:\Windows\System\UjgefAH.exe
  2⤵
  PID:924
- C:\Windows\System\oVKRcLz.exe
  C:\Windows\System\oVKRcLz.exe
  2⤵
  PID:2080
- C:\Windows\System\rMVclBC.exe
  C:\Windows\System\rMVclBC.exe
  2⤵
  PID:1248
- C:\Windows\System\jmcURDl.exe
  C:\Windows\System\jmcURDl.exe
  2⤵
  PID:2392
- C:\Windows\System\uclsDYz.exe
  C:\Windows\System\uclsDYz.exe
  2⤵
  PID:2584
- C:\Windows\System\FfXMKSz.exe
  C:\Windows\System\FfXMKSz.exe
  2⤵
  PID:2044
- C:\Windows\System\xSoIcCh.exe
  C:\Windows\System\xSoIcCh.exe
  2⤵
  PID:2040
- C:\Windows\System\pbeePVa.exe
  C:\Windows\System\pbeePVa.exe
  2⤵
  PID:624
- C:\Windows\System\SYCdWjo.exe
  C:\Windows\System\SYCdWjo.exe
  2⤵
  PID:1860
- C:\Windows\System\eUtwiqb.exe
  C:\Windows\System\eUtwiqb.exe
  2⤵
  PID:3040
- C:\Windows\System\JKkVVkx.exe
  C:\Windows\System\JKkVVkx.exe
  2⤵
  PID:1488
- C:\Windows\System\HZPzKpI.exe
  C:\Windows\System\HZPzKpI.exe
  2⤵
  PID:2900
- C:\Windows\System\KhRUABg.exe
  C:\Windows\System\KhRUABg.exe
  2⤵
  PID:2932
- C:\Windows\System\hDUEjCj.exe
  C:\Windows\System\hDUEjCj.exe
  2⤵
  PID:572
- C:\Windows\System\NyYWPYF.exe
  C:\Windows\System\NyYWPYF.exe
  2⤵
  PID:2204
- C:\Windows\System\YSXIhqJ.exe
  C:\Windows\System\YSXIhqJ.exe
  2⤵
  PID:2756
- C:\Windows\System\HkNwjEB.exe
  C:\Windows\System\HkNwjEB.exe
  2⤵
  PID:2032
- C:\Windows\System\UdipWSv.exe
  C:\Windows\System\UdipWSv.exe
  2⤵
  PID:2364
- C:\Windows\System\cxkgzYb.exe
  C:\Windows\System\cxkgzYb.exe
  2⤵
  PID:1044
- C:\Windows\System\kTNmzGu.exe
  C:\Windows\System\kTNmzGu.exe
  2⤵
  PID:2732
- C:\Windows\System\qkEcHpt.exe
  C:\Windows\System\qkEcHpt.exe
  2⤵
  PID:1264
- C:\Windows\System\WvbLaKV.exe
  C:\Windows\System\WvbLaKV.exe
  2⤵
  PID:1016
- C:\Windows\System\RMamACA.exe
  C:\Windows\System\RMamACA.exe
  2⤵
  PID:428
- C:\Windows\System\QlVHgqL.exe
  C:\Windows\System\QlVHgqL.exe
  2⤵
  PID:1128
- C:\Windows\System\ZAVgDKK.exe
  C:\Windows\System\ZAVgDKK.exe
  2⤵
  PID:2888
- C:\Windows\System\rdrQMoP.exe
  C:\Windows\System\rdrQMoP.exe
  2⤵
  PID:2112
- C:\Windows\System\PKnuMhO.exe
  C:\Windows\System\PKnuMhO.exe
  2⤵
  PID:1320
- C:\Windows\System\cftTNaT.exe
  C:\Windows\System\cftTNaT.exe
  2⤵
  PID:2136
- C:\Windows\System\XLNNVkL.exe
  C:\Windows\System\XLNNVkL.exe
  2⤵
  PID:1664
- C:\Windows\System\EByEkhn.exe
  C:\Windows\System\EByEkhn.exe
  2⤵
  PID:2920
- C:\Windows\System\zOoZKpA.exe
  C:\Windows\System\zOoZKpA.exe
  2⤵
  PID:1956
- C:\Windows\System\KQOFlZU.exe
  C:\Windows\System\KQOFlZU.exe
  2⤵
  PID:1512
- C:\Windows\System\TUVnbrr.exe
  C:\Windows\System\TUVnbrr.exe
  2⤵
  PID:1040
- C:\Windows\System\YhixfMU.exe
  C:\Windows\System\YhixfMU.exe
  2⤵
  PID:1812
- C:\Windows\System\VxZxOxB.exe
  C:\Windows\System\VxZxOxB.exe
  2⤵
  PID:1988
- C:\Windows\System\mGnnbXw.exe
  C:\Windows\System\mGnnbXw.exe
  2⤵
  PID:1116
- C:\Windows\System\mNMUWut.exe
  C:\Windows\System\mNMUWut.exe
  2⤵
  PID:1808
- C:\Windows\System\jTndMea.exe
  C:\Windows\System\jTndMea.exe
  2⤵
  PID:1012
- C:\Windows\System\tabamSB.exe
  C:\Windows\System\tabamSB.exe
  2⤵
  PID:1708
- C:\Windows\System\WGNESIi.exe
  C:\Windows\System\WGNESIi.exe
  2⤵
  PID:1256
- C:\Windows\System\opZVxns.exe
  C:\Windows\System\opZVxns.exe
  2⤵
  PID:2964
- C:\Windows\System\FAslCHL.exe
  C:\Windows\System\FAslCHL.exe
  2⤵
  PID:2536
- C:\Windows\System\dnTLUow.exe
  C:\Windows\System\dnTLUow.exe
  2⤵
  PID:2488
- C:\Windows\System\VQGcLaw.exe
  C:\Windows\System\VQGcLaw.exe
  2⤵
  PID:1308
- C:\Windows\System\wMSUrAA.exe
  C:\Windows\System\wMSUrAA.exe
  2⤵
  PID:1744
- C:\Windows\System\jgqpMOR.exe
  C:\Windows\System\jgqpMOR.exe
  2⤵
  PID:2776
- C:\Windows\System\iwmozfl.exe
  C:\Windows\System\iwmozfl.exe
  2⤵
  PID:2556
- C:\Windows\System\sqqlhCN.exe
  C:\Windows\System\sqqlhCN.exe
  2⤵
  PID:372
- C:\Windows\System\ZvfdbOd.exe
  C:\Windows\System\ZvfdbOd.exe
  2⤵
  PID:2524
- C:\Windows\System\rhkBwPm.exe
  C:\Windows\System\rhkBwPm.exe
  2⤵
  PID:2912
- C:\Windows\System\UAKWgaE.exe
  C:\Windows\System\UAKWgaE.exe
  2⤵
  PID:2988
- C:\Windows\System\KbVeZyV.exe
  C:\Windows\System\KbVeZyV.exe
  2⤵
  PID:2628
- C:\Windows\System\VMDnxiy.exe
  C:\Windows\System\VMDnxiy.exe
  2⤵
  PID:1728
- C:\Windows\System\gmvoGmK.exe
  C:\Windows\System\gmvoGmK.exe
  2⤵
  PID:1760
- C:\Windows\System\wKOrvnE.exe
  C:\Windows\System\wKOrvnE.exe
  2⤵
  PID:2904
- C:\Windows\System\bunrmLx.exe
  C:\Windows\System\bunrmLx.exe
  2⤵
  PID:1796
- C:\Windows\System\mUiGgzn.exe
  C:\Windows\System\mUiGgzn.exe
  2⤵
  PID:2196
- C:\Windows\System\BLRsMnR.exe
  C:\Windows\System\BLRsMnR.exe
  2⤵
  PID:3080
- C:\Windows\System\lnRvNBZ.exe
  C:\Windows\System\lnRvNBZ.exe
  2⤵
  PID:3104
- C:\Windows\System\RjQnipq.exe
  C:\Windows\System\RjQnipq.exe
  2⤵
  PID:3120
- C:\Windows\System\vZQInzc.exe
  C:\Windows\System\vZQInzc.exe
  2⤵
  PID:3140
- C:\Windows\System\legLohB.exe
  C:\Windows\System\legLohB.exe
  2⤵
  PID:3156
- C:\Windows\System\ENEmEez.exe
  C:\Windows\System\ENEmEez.exe
  2⤵
  PID:3216
- C:\Windows\System\dadGNrC.exe
  C:\Windows\System\dadGNrC.exe
  2⤵
  PID:3232
- C:\Windows\System\VGuBEUc.exe
  C:\Windows\System\VGuBEUc.exe
  2⤵
  PID:3248
- C:\Windows\System\vKnOvOi.exe
  C:\Windows\System\vKnOvOi.exe
  2⤵
  PID:3272
- C:\Windows\System\WVIstkG.exe
  C:\Windows\System\WVIstkG.exe
  2⤵
  PID:3288
- C:\Windows\System\aBLjhLH.exe
  C:\Windows\System\aBLjhLH.exe
  2⤵
  PID:3304
- C:\Windows\System\JWQqmbC.exe
  C:\Windows\System\JWQqmbC.exe
  2⤵
  PID:3320
- C:\Windows\System\uLOsPvi.exe
  C:\Windows\System\uLOsPvi.exe
  2⤵
  PID:3340
- C:\Windows\System\mRDvtRh.exe
  C:\Windows\System\mRDvtRh.exe
  2⤵
  PID:3356
- C:\Windows\System\vbYtmBh.exe
  C:\Windows\System\vbYtmBh.exe
  2⤵
  PID:3372
- C:\Windows\System\CnGyjWk.exe
  C:\Windows\System\CnGyjWk.exe
  2⤵
  PID:3388
- C:\Windows\System\baqFQrd.exe
  C:\Windows\System\baqFQrd.exe
  2⤵
  PID:3408
- C:\Windows\System\oZZmvSX.exe
  C:\Windows\System\oZZmvSX.exe
  2⤵
  PID:3428
- C:\Windows\System\YxAOjdG.exe
  C:\Windows\System\YxAOjdG.exe
  2⤵
  PID:3444
- C:\Windows\System\TmvvxPe.exe
  C:\Windows\System\TmvvxPe.exe
  2⤵
  PID:3492
- C:\Windows\System\MmSulyo.exe
  C:\Windows\System\MmSulyo.exe
  2⤵
  PID:3516
- C:\Windows\System\nkYbWql.exe
  C:\Windows\System\nkYbWql.exe
  2⤵
  PID:3532
- C:\Windows\System\pAbDhMd.exe
  C:\Windows\System\pAbDhMd.exe
  2⤵
  PID:3548
- C:\Windows\System\NuzsDHa.exe
  C:\Windows\System\NuzsDHa.exe
  2⤵
  PID:3564
- C:\Windows\System\ewGZdFT.exe
  C:\Windows\System\ewGZdFT.exe
  2⤵
  PID:3580
- C:\Windows\System\JXCZrtI.exe
  C:\Windows\System\JXCZrtI.exe
  2⤵
  PID:3596
- C:\Windows\System\HHwBczC.exe
  C:\Windows\System\HHwBczC.exe
  2⤵
  PID:3616
- C:\Windows\System\pVfVAVm.exe
  C:\Windows\System\pVfVAVm.exe
  2⤵
  PID:3632
- C:\Windows\System\FXmOUQy.exe
  C:\Windows\System\FXmOUQy.exe
  2⤵
  PID:3672
- C:\Windows\System\jRNKIfT.exe
  C:\Windows\System\jRNKIfT.exe
  2⤵
  PID:3692
- C:\Windows\System\oXiHwdS.exe
  C:\Windows\System\oXiHwdS.exe
  2⤵
  PID:3716
- C:\Windows\System\SSvfFFt.exe
  C:\Windows\System\SSvfFFt.exe
  2⤵
  PID:3732
- C:\Windows\System\IyRcoFg.exe
  C:\Windows\System\IyRcoFg.exe
  2⤵
  PID:3748
- C:\Windows\System\gnrHZxf.exe
  C:\Windows\System\gnrHZxf.exe
  2⤵
  PID:3776
- C:\Windows\System\vboiUri.exe
  C:\Windows\System\vboiUri.exe
  2⤵
  PID:3792
- C:\Windows\System\plFvKsd.exe
  C:\Windows\System\plFvKsd.exe
  2⤵
  PID:3812
- C:\Windows\System\zNMDrEL.exe
  C:\Windows\System\zNMDrEL.exe
  2⤵
  PID:3828
- C:\Windows\System\gZvTngK.exe
  C:\Windows\System\gZvTngK.exe
  2⤵
  PID:3848
- C:\Windows\System\krPrMFs.exe
  C:\Windows\System\krPrMFs.exe
  2⤵
  PID:3864
- C:\Windows\System\vOGvYbc.exe
  C:\Windows\System\vOGvYbc.exe
  2⤵
  PID:3880
- C:\Windows\System\nRjdDTU.exe
  C:\Windows\System\nRjdDTU.exe
  2⤵
  PID:3896
- C:\Windows\System\yjjlpaU.exe
  C:\Windows\System\yjjlpaU.exe
  2⤵
  PID:3912
- C:\Windows\System\LBMdJtR.exe
  C:\Windows\System\LBMdJtR.exe
  2⤵
  PID:3952
- C:\Windows\System\bZCfrww.exe
  C:\Windows\System\bZCfrww.exe
  2⤵
  PID:3968
- C:\Windows\System\CympycS.exe
  C:\Windows\System\CympycS.exe
  2⤵
  PID:3996
- C:\Windows\System\xYJGMgi.exe
  C:\Windows\System\xYJGMgi.exe
  2⤵
  PID:4012
- C:\Windows\System\iciXwvl.exe
  C:\Windows\System\iciXwvl.exe
  2⤵
  PID:4028
- C:\Windows\System\hIfdwIa.exe
  C:\Windows\System\hIfdwIa.exe
  2⤵
  PID:4044
- C:\Windows\System\sYcmHGM.exe
  C:\Windows\System\sYcmHGM.exe
  2⤵
  PID:4060
- C:\Windows\System\BeeiSrn.exe
  C:\Windows\System\BeeiSrn.exe
  2⤵
  PID:4084
- C:\Windows\System\ZfuFlaT.exe
  C:\Windows\System\ZfuFlaT.exe
  2⤵
  PID:2692
- C:\Windows\System\NsZhCbk.exe
  C:\Windows\System\NsZhCbk.exe
  2⤵
  PID:3076
- C:\Windows\System\AAWXDop.exe
  C:\Windows\System\AAWXDop.exe
  2⤵
  PID:1964
- C:\Windows\System\QeTHgDI.exe
  C:\Windows\System\QeTHgDI.exe
  2⤵
  PID:3100
- C:\Windows\System\hRyaqpi.exe
  C:\Windows\System\hRyaqpi.exe
  2⤵
  PID:3096
- C:\Windows\System\qkVGPQK.exe
  C:\Windows\System\qkVGPQK.exe
  2⤵
  PID:3184
- C:\Windows\System\BUlbtHX.exe
  C:\Windows\System\BUlbtHX.exe
  2⤵
  PID:3204
- C:\Windows\System\DAWMjas.exe
  C:\Windows\System\DAWMjas.exe
  2⤵
  PID:3224
- C:\Windows\System\roWUwxE.exe
  C:\Windows\System\roWUwxE.exe
  2⤵
  PID:3264
- C:\Windows\System\ioFkuob.exe
  C:\Windows\System\ioFkuob.exe
  2⤵
  PID:3296
- C:\Windows\System\SFclosz.exe
  C:\Windows\System\SFclosz.exe
  2⤵
  PID:3336
- C:\Windows\System\NWpxvZU.exe
  C:\Windows\System\NWpxvZU.exe
  2⤵
  PID:3404
- C:\Windows\System\FeObZAE.exe
  C:\Windows\System\FeObZAE.exe
  2⤵
  PID:3384
- C:\Windows\System\FTiRngV.exe
  C:\Windows\System\FTiRngV.exe
  2⤵
  PID:3420
- C:\Windows\System\ZTasfnu.exe
  C:\Windows\System\ZTasfnu.exe
  2⤵
  PID:3312
- C:\Windows\System\OrRLXho.exe
  C:\Windows\System\OrRLXho.exe
  2⤵
  PID:3468
- C:\Windows\System\XGvXhOq.exe
  C:\Windows\System\XGvXhOq.exe
  2⤵
  PID:3480
- C:\Windows\System\ZSgAlvj.exe
  C:\Windows\System\ZSgAlvj.exe
  2⤵
  PID:3508
- C:\Windows\System\pLsMqus.exe
  C:\Windows\System\pLsMqus.exe
  2⤵
  PID:3560
- C:\Windows\System\nVdDbPj.exe
  C:\Windows\System\nVdDbPj.exe
  2⤵
  PID:3576
- C:\Windows\System\LVeUFPE.exe
  C:\Windows\System\LVeUFPE.exe
  2⤵
  PID:3640
- C:\Windows\System\oISedIq.exe
  C:\Windows\System\oISedIq.exe
  2⤵
  PID:3660
- C:\Windows\System\KGmtvTj.exe
  C:\Windows\System\KGmtvTj.exe
  2⤵
  PID:3528
- C:\Windows\System\WZZBnYt.exe
  C:\Windows\System\WZZBnYt.exe
  2⤵
  PID:3700
- C:\Windows\System\AheMcdG.exe
  C:\Windows\System\AheMcdG.exe
  2⤵
  PID:3680
- C:\Windows\System\MnbxScY.exe
  C:\Windows\System\MnbxScY.exe
  2⤵
  PID:3740
- C:\Windows\System\ZoMOcQS.exe
  C:\Windows\System\ZoMOcQS.exe
  2⤵
  PID:3724
- C:\Windows\System\iOFMGbu.exe
  C:\Windows\System\iOFMGbu.exe
  2⤵
  PID:3784
- C:\Windows\System\ATcYHvD.exe
  C:\Windows\System\ATcYHvD.exe
  2⤵
  PID:3824
- C:\Windows\System\sfiOYJE.exe
  C:\Windows\System\sfiOYJE.exe
  2⤵
  PID:3920
- C:\Windows\System\UodCIte.exe
  C:\Windows\System\UodCIte.exe
  2⤵
  PID:3932
- C:\Windows\System\QBoMSuQ.exe
  C:\Windows\System\QBoMSuQ.exe
  2⤵
  PID:3944
- C:\Windows\System\KWIwFhO.exe
  C:\Windows\System\KWIwFhO.exe
  2⤵
  PID:1388
- C:\Windows\System\IGLCxXc.exe
  C:\Windows\System\IGLCxXc.exe
  2⤵
  PID:1772
- C:\Windows\System\iKkTPjH.exe
  C:\Windows\System\iKkTPjH.exe
  2⤵
  PID:3472
- C:\Windows\System\KXyytTu.exe
  C:\Windows\System\KXyytTu.exe
  2⤵
  PID:3904
- C:\Windows\System\uLYqbZQ.exe
  C:\Windows\System\uLYqbZQ.exe
  2⤵
  PID:4036
- C:\Windows\System\QKgrXCn.exe
  C:\Windows\System\QKgrXCn.exe
  2⤵
  PID:3148
- C:\Windows\System\gMoFzxr.exe
  C:\Windows\System\gMoFzxr.exe
  2⤵
  PID:3260
- C:\Windows\System\PpoHOUo.exe
  C:\Windows\System\PpoHOUo.exe
  2⤵
  PID:3284
- C:\Windows\System\NtSfOUH.exe
  C:\Windows\System\NtSfOUH.exe
  2⤵
  PID:3460
- C:\Windows\System\MDDDDSz.exe
  C:\Windows\System\MDDDDSz.exe
  2⤵
  PID:2380
- C:\Windows\System\mBXEjyD.exe
  C:\Windows\System\mBXEjyD.exe
  2⤵
  PID:3688
- C:\Windows\System\HBcMMlD.exe
  C:\Windows\System\HBcMMlD.exe
  2⤵
  PID:1840
- C:\Windows\System\shDomdp.exe
  C:\Windows\System\shDomdp.exe
  2⤵
  PID:4020
- C:\Windows\System\GFIeWDK.exe
  C:\Windows\System\GFIeWDK.exe
  2⤵
  PID:1668
- C:\Windows\System\mEsUeHn.exe
  C:\Windows\System\mEsUeHn.exe
  2⤵
  PID:648
- C:\Windows\System\ATnVoSb.exe
  C:\Windows\System\ATnVoSb.exe
  2⤵
  PID:3964
- C:\Windows\System\khLjLof.exe
  C:\Windows\System\khLjLof.exe
  2⤵
  PID:3380
- C:\Windows\System\OOSrlFW.exe
  C:\Windows\System\OOSrlFW.exe
  2⤵
  PID:3540
- C:\Windows\System\cftovGM.exe
  C:\Windows\System\cftovGM.exe
  2⤵
  PID:1364
- C:\Windows\System\rqJSYXa.exe
  C:\Windows\System\rqJSYXa.exe
  2⤵
  PID:3712
- C:\Windows\System\KrtrheG.exe
  C:\Windows\System\KrtrheG.exe
  2⤵
  PID:3856
- C:\Windows\System\ZGilpqj.exe
  C:\Windows\System\ZGilpqj.exe
  2⤵
  PID:3592
- C:\Windows\System\GZiGQlD.exe
  C:\Windows\System\GZiGQlD.exe
  2⤵
  PID:1736
- C:\Windows\System\YBGuSlX.exe
  C:\Windows\System\YBGuSlX.exe
  2⤵
  PID:3940
- C:\Windows\System\SHxFeda.exe
  C:\Windows\System\SHxFeda.exe
  2⤵
  PID:3352
- C:\Windows\System\sYwRrke.exe
  C:\Windows\System\sYwRrke.exe
  2⤵
  PID:3664
- C:\Windows\System\YKIlLNX.exe
  C:\Windows\System\YKIlLNX.exe
  2⤵
  PID:3488
- C:\Windows\System\LUSwVPb.exe
  C:\Windows\System\LUSwVPb.exe
  2⤵
  PID:3836
- C:\Windows\System\aWcncTX.exe
  C:\Windows\System\aWcncTX.exe
  2⤵
  PID:3396
- C:\Windows\System\klJcDQp.exe
  C:\Windows\System\klJcDQp.exe
  2⤵
  PID:3772
- C:\Windows\System\DzZcKDF.exe
  C:\Windows\System\DzZcKDF.exe
  2⤵
  PID:3808
- C:\Windows\System\dxlaLMp.exe
  C:\Windows\System\dxlaLMp.exe
  2⤵
  PID:3876
- C:\Windows\System\fjRkTCz.exe
  C:\Windows\System\fjRkTCz.exe
  2⤵
  PID:1328
- C:\Windows\System\acKaaky.exe
  C:\Windows\System\acKaaky.exe
  2⤵
  PID:4004
- C:\Windows\System\PFNrbCW.exe
  C:\Windows\System\PFNrbCW.exe
  2⤵
  PID:3192
- C:\Windows\System\FOLmaCn.exe
  C:\Windows\System\FOLmaCn.exe
  2⤵
  PID:2620
- C:\Windows\System\afvXAym.exe
  C:\Windows\System\afvXAym.exe
  2⤵
  PID:2808
- C:\Windows\System\gbqqXjI.exe
  C:\Windows\System\gbqqXjI.exe
  2⤵
  PID:3756
- C:\Windows\System\XTfGsAQ.exe
  C:\Windows\System\XTfGsAQ.exe
  2⤵
  PID:3744
- C:\Windows\System\PLkuJgE.exe
  C:\Windows\System\PLkuJgE.exe
  2⤵
  PID:3436
- C:\Windows\System\liKyEMY.exe
  C:\Windows\System\liKyEMY.exe
  2⤵
  PID:2084
- C:\Windows\System\zzPaUsv.exe
  C:\Windows\System\zzPaUsv.exe
  2⤵
  PID:3544
- C:\Windows\System\aCBIHiF.exe
  C:\Windows\System\aCBIHiF.exe
  2⤵
  PID:3644
- C:\Windows\System\UFztMSZ.exe
  C:\Windows\System\UFztMSZ.exe
  2⤵
  PID:1936
- C:\Windows\System\DmiweHv.exe
  C:\Windows\System\DmiweHv.exe
  2⤵
  PID:2740
- C:\Windows\System\VYdGuIo.exe
  C:\Windows\System\VYdGuIo.exe
  2⤵
  PID:3456
- C:\Windows\System\UOTxtQZ.exe
  C:\Windows\System\UOTxtQZ.exe
  2⤵
  PID:1032
- C:\Windows\System\TbZHfzm.exe
  C:\Windows\System\TbZHfzm.exe
  2⤵
  PID:3768
- C:\Windows\System\vLxaQzv.exe
  C:\Windows\System\vLxaQzv.exe
  2⤵
  PID:3988
- C:\Windows\System\GveSRdW.exe
  C:\Windows\System\GveSRdW.exe
  2⤵
  PID:3840
- C:\Windows\System\zSbxPyf.exe
  C:\Windows\System\zSbxPyf.exe
  2⤵
  PID:3524
- C:\Windows\System\TbdqOYp.exe
  C:\Windows\System\TbdqOYp.exe
  2⤵
  PID:3624
- C:\Windows\System\BUVxIKw.exe
  C:\Windows\System\BUVxIKw.exe
  2⤵
  PID:3172
- C:\Windows\System\pXGWivd.exe
  C:\Windows\System\pXGWivd.exe
  2⤵
  PID:3168
- C:\Windows\System\JehsNxA.exe
  C:\Windows\System\JehsNxA.exe
  2⤵
  PID:3332
- C:\Windows\System\RwHmruL.exe
  C:\Windows\System\RwHmruL.exe
  2⤵
  PID:4104
- C:\Windows\System\kXUogQS.exe
  C:\Windows\System\kXUogQS.exe
  2⤵
  PID:4124
- C:\Windows\System\HQdExvB.exe
  C:\Windows\System\HQdExvB.exe
  2⤵
  PID:4140
- C:\Windows\System\NAyqKBE.exe
  C:\Windows\System\NAyqKBE.exe
  2⤵
  PID:4156
- C:\Windows\System\vFWHQeY.exe
  C:\Windows\System\vFWHQeY.exe
  2⤵
  PID:4172
- C:\Windows\System\eDIAHjs.exe
  C:\Windows\System\eDIAHjs.exe
  2⤵
  PID:4192
- C:\Windows\System\oFgMdPp.exe
  C:\Windows\System\oFgMdPp.exe
  2⤵
  PID:4220
- C:\Windows\System\exxcOUC.exe
  C:\Windows\System\exxcOUC.exe
  2⤵
  PID:4236
- C:\Windows\System\ErMqkEv.exe
  C:\Windows\System\ErMqkEv.exe
  2⤵
  PID:4252
- C:\Windows\System\LFLcvRm.exe
  C:\Windows\System\LFLcvRm.exe
  2⤵
  PID:4292
- C:\Windows\System\gmENfNA.exe
  C:\Windows\System\gmENfNA.exe
  2⤵
  PID:4324
- C:\Windows\System\WVluxDX.exe
  C:\Windows\System\WVluxDX.exe
  2⤵
  PID:4340
- C:\Windows\System\cAggRQg.exe
  C:\Windows\System\cAggRQg.exe
  2⤵
  PID:4356
- C:\Windows\System\bhherCG.exe
  C:\Windows\System\bhherCG.exe
  2⤵
  PID:4372
- C:\Windows\System\qzFIkoR.exe
  C:\Windows\System\qzFIkoR.exe
  2⤵
  PID:4388
- C:\Windows\System\SfrvTrp.exe
  C:\Windows\System\SfrvTrp.exe
  2⤵
  PID:4408
- C:\Windows\System\cnIWXdH.exe
  C:\Windows\System\cnIWXdH.exe
  2⤵
  PID:4424
- C:\Windows\System\IkYwThC.exe
  C:\Windows\System\IkYwThC.exe
  2⤵
  PID:4440
- C:\Windows\System\AMxGwpL.exe
  C:\Windows\System\AMxGwpL.exe
  2⤵
  PID:4460
- C:\Windows\System\Wtvchke.exe
  C:\Windows\System\Wtvchke.exe
  2⤵
  PID:4476
- C:\Windows\System\USOCVqh.exe
  C:\Windows\System\USOCVqh.exe
  2⤵
  PID:4492
- C:\Windows\System\rTeRmDc.exe
  C:\Windows\System\rTeRmDc.exe
  2⤵
  PID:4512
- C:\Windows\System\HnxPvWo.exe
  C:\Windows\System\HnxPvWo.exe
  2⤵
  PID:4528
- C:\Windows\System\TBgRbHn.exe
  C:\Windows\System\TBgRbHn.exe
  2⤵
  PID:4544
- C:\Windows\System\RrcHFtH.exe
  C:\Windows\System\RrcHFtH.exe
  2⤵
  PID:4560
- C:\Windows\System\AkxrppI.exe
  C:\Windows\System\AkxrppI.exe
  2⤵
  PID:4580
- C:\Windows\System\YvAOuAu.exe
  C:\Windows\System\YvAOuAu.exe
  2⤵
  PID:4632
- C:\Windows\System\PHygjwS.exe
  C:\Windows\System\PHygjwS.exe
  2⤵
  PID:4648
- C:\Windows\System\NIrBdqK.exe
  C:\Windows\System\NIrBdqK.exe
  2⤵
  PID:4664
- C:\Windows\System\gJVjBmw.exe
  C:\Windows\System\gJVjBmw.exe
  2⤵
  PID:4680
- C:\Windows\System\ZAljGhC.exe
  C:\Windows\System\ZAljGhC.exe
  2⤵
  PID:4700
- C:\Windows\System\ydSbrAi.exe
  C:\Windows\System\ydSbrAi.exe
  2⤵
  PID:4720
- C:\Windows\System\aWukNCZ.exe
  C:\Windows\System\aWukNCZ.exe
  2⤵
  PID:4736
- C:\Windows\System\LNIhwFp.exe
  C:\Windows\System\LNIhwFp.exe
  2⤵
  PID:4756
- C:\Windows\System\VPMpNpa.exe
  C:\Windows\System\VPMpNpa.exe
  2⤵
  PID:4772
- C:\Windows\System\YsSjRxl.exe
  C:\Windows\System\YsSjRxl.exe
  2⤵
  PID:4792
- C:\Windows\System\wlPtrcK.exe
  C:\Windows\System\wlPtrcK.exe
  2⤵
  PID:4812
- C:\Windows\System\CzzvvBA.exe
  C:\Windows\System\CzzvvBA.exe
  2⤵
  PID:4828
- C:\Windows\System\pMlaLsR.exe
  C:\Windows\System\pMlaLsR.exe
  2⤵
  PID:4844
- C:\Windows\System\fKcezRh.exe
  C:\Windows\System\fKcezRh.exe
  2⤵
  PID:4864
- C:\Windows\System\JcmXZeX.exe
  C:\Windows\System\JcmXZeX.exe
  2⤵
  PID:4880
- C:\Windows\System\jowupGg.exe
  C:\Windows\System\jowupGg.exe
  2⤵
  PID:4896
- C:\Windows\System\HQDUpmk.exe
  C:\Windows\System\HQDUpmk.exe
  2⤵
  PID:4912
- C:\Windows\System\zYThHcJ.exe
  C:\Windows\System\zYThHcJ.exe
  2⤵
  PID:4940
- C:\Windows\System\AASbXgE.exe
  C:\Windows\System\AASbXgE.exe
  2⤵
  PID:4972
- C:\Windows\System\DAyqNJi.exe
  C:\Windows\System\DAyqNJi.exe
  2⤵
  PID:4988
- C:\Windows\System\tHatAhb.exe
  C:\Windows\System\tHatAhb.exe
  2⤵
  PID:5004
- C:\Windows\System\xGjaRqA.exe
  C:\Windows\System\xGjaRqA.exe
  2⤵
  PID:5032
- C:\Windows\System\bXapofC.exe
  C:\Windows\System\bXapofC.exe
  2⤵
  PID:5048
- C:\Windows\System\laRewCt.exe
  C:\Windows\System\laRewCt.exe
  2⤵
  PID:5068
- C:\Windows\System\tqPFgCH.exe
  C:\Windows\System\tqPFgCH.exe
  2⤵
  PID:5084
- C:\Windows\System\JRpNezJ.exe
  C:\Windows\System\JRpNezJ.exe
  2⤵
  PID:5104
- C:\Windows\System\ZQAbUfH.exe
  C:\Windows\System\ZQAbUfH.exe
  2⤵
  PID:4076
- C:\Windows\System\ZBDaNAY.exe
  C:\Windows\System\ZBDaNAY.exe
  2⤵
  PID:3180
- C:\Windows\System\wGjbyYw.exe
  C:\Windows\System\wGjbyYw.exe
  2⤵
  PID:4188
- C:\Windows\System\TFSiwDw.exe
  C:\Windows\System\TFSiwDw.exe
  2⤵
  PID:4040
- C:\Windows\System\UanDKDf.exe
  C:\Windows\System\UanDKDf.exe
  2⤵
  PID:4112
- C:\Windows\System\eVqXnjG.exe
  C:\Windows\System\eVqXnjG.exe
  2⤵
  PID:4024
- C:\Windows\System\YsxssVj.exe
  C:\Windows\System\YsxssVj.exe
  2⤵
  PID:4232
- C:\Windows\System\vbBElVk.exe
  C:\Windows\System\vbBElVk.exe
  2⤵
  PID:4216
- C:\Windows\System\VqMTBtQ.exe
  C:\Windows\System\VqMTBtQ.exe
  2⤵
  PID:1968
- C:\Windows\System\XDRUwSr.exe
  C:\Windows\System\XDRUwSr.exe
  2⤵
  PID:4272
- C:\Windows\System\QrogsmB.exe
  C:\Windows\System\QrogsmB.exe
  2⤵
  PID:4284
- C:\Windows\System\EiqfSZs.exe
  C:\Windows\System\EiqfSZs.exe
  2⤵
  PID:4368
- C:\Windows\System\lvBoNiV.exe
  C:\Windows\System\lvBoNiV.exe
  2⤵
  PID:4352
- C:\Windows\System\qWZLEev.exe
  C:\Windows\System\qWZLEev.exe
  2⤵
  PID:4472
- C:\Windows\System\mFLcCnh.exe
  C:\Windows\System\mFLcCnh.exe
  2⤵
  PID:4504
- C:\Windows\System\MZPagdC.exe
  C:\Windows\System\MZPagdC.exe
  2⤵
  PID:4540
- C:\Windows\System\eZqKZfc.exe
  C:\Windows\System\eZqKZfc.exe
  2⤵
  PID:4384
- C:\Windows\System\QOOVowN.exe
  C:\Windows\System\QOOVowN.exe
  2⤵
  PID:4452
- C:\Windows\System\TJaNDRQ.exe
  C:\Windows\System\TJaNDRQ.exe
  2⤵
  PID:4640
- C:\Windows\System\biqeWWu.exe
  C:\Windows\System\biqeWWu.exe
  2⤵
  PID:4416
- C:\Windows\System\wWuRkbW.exe
  C:\Windows\System\wWuRkbW.exe
  2⤵
  PID:4524
- C:\Windows\System\SFFwlgY.exe
  C:\Windows\System\SFFwlgY.exe
  2⤵
  PID:4624
- C:\Windows\System\pVaBKkc.exe
  C:\Windows\System\pVaBKkc.exe
  2⤵
  PID:4612
- C:\Windows\System\kwpIfqI.exe
  C:\Windows\System\kwpIfqI.exe
  2⤵
  PID:4692
- C:\Windows\System\IjMQMMH.exe
  C:\Windows\System\IjMQMMH.exe
  2⤵
  PID:4732
- C:\Windows\System\VCIytiH.exe
  C:\Windows\System\VCIytiH.exe
  2⤵
  PID:4768
- C:\Windows\System\eOUQghJ.exe
  C:\Windows\System\eOUQghJ.exe
  2⤵
  PID:4892
- C:\Windows\System\thTIFSr.exe
  C:\Windows\System\thTIFSr.exe
  2⤵
  PID:4804
- C:\Windows\System\CMBNtLh.exe
  C:\Windows\System\CMBNtLh.exe
  2⤵
  PID:4788
- C:\Windows\System\WdxfNlZ.exe
  C:\Windows\System\WdxfNlZ.exe
  2⤵
  PID:4936
- C:\Windows\System\bgrRrli.exe
  C:\Windows\System\bgrRrli.exe
  2⤵
  PID:5012
- C:\Windows\System\LiPvohu.exe
  C:\Windows\System\LiPvohu.exe
  2⤵
  PID:5000
- C:\Windows\System\QIXGluP.exe
  C:\Windows\System\QIXGluP.exe
  2⤵
  PID:5024
- C:\Windows\System\kMaPMqt.exe
  C:\Windows\System\kMaPMqt.exe
  2⤵
  PID:5096
- C:\Windows\System\LCcuVLi.exe
  C:\Windows\System\LCcuVLi.exe
  2⤵
  PID:5040
- C:\Windows\System\RyRHJpN.exe
  C:\Windows\System\RyRHJpN.exe
  2⤵
  PID:1564
- C:\Windows\System\ieTLdpy.exe
  C:\Windows\System\ieTLdpy.exe
  2⤵
  PID:3928
- C:\Windows\System\dNGGFhv.exe
  C:\Windows\System\dNGGFhv.exe
  2⤵
  PID:4180
- C:\Windows\System\SHgDWoB.exe
  C:\Windows\System\SHgDWoB.exe
  2⤵
  PID:2752
- C:\Windows\System\EkqavVh.exe
  C:\Windows\System\EkqavVh.exe
  2⤵
  PID:4244
- C:\Windows\System\kMnWKkz.exe
  C:\Windows\System\kMnWKkz.exe
  2⤵
  PID:4268
- C:\Windows\System\zUhsCjh.exe
  C:\Windows\System\zUhsCjh.exe
  2⤵
  PID:604
- C:\Windows\System\zkvePof.exe
  C:\Windows\System\zkvePof.exe
  2⤵
  PID:4204
- C:\Windows\System\dtQFpxT.exe
  C:\Windows\System\dtQFpxT.exe
  2⤵
  PID:4288
- C:\Windows\System\vvEGTNy.exe
  C:\Windows\System\vvEGTNy.exe
  2⤵
  PID:4308
- C:\Windows\System\KuzeSll.exe
  C:\Windows\System\KuzeSll.exe
  2⤵
  PID:4572
- C:\Windows\System\bCZFdUu.exe
  C:\Windows\System\bCZFdUu.exe
  2⤵
  PID:4380
- C:\Windows\System\CMyXnhA.exe
  C:\Windows\System\CMyXnhA.exe
  2⤵
  PID:4676
- C:\Windows\System\eUOlICW.exe
  C:\Windows\System\eUOlICW.exe
  2⤵
  PID:4616
- C:\Windows\System\GUnAnBM.exe
  C:\Windows\System\GUnAnBM.exe
  2⤵
  PID:4604
- C:\Windows\System\JEEiCsm.exe
  C:\Windows\System\JEEiCsm.exe
  2⤵
  PID:4780
- C:\Windows\System\blrxiJA.exe
  C:\Windows\System\blrxiJA.exe
  2⤵
  PID:4728
- C:\Windows\System\dCkgeiH.exe
  C:\Windows\System\dCkgeiH.exe
  2⤵
  PID:4808
- C:\Windows\System\hHaKXBm.exe
  C:\Windows\System\hHaKXBm.exe
  2⤵
  PID:4960
- C:\Windows\System\UzKOCmN.exe
  C:\Windows\System\UzKOCmN.exe
  2⤵
  PID:4920
- C:\Windows\System\atxWPZg.exe
  C:\Windows\System\atxWPZg.exe
  2⤵
  PID:4872
- C:\Windows\System\xwcTMfJ.exe
  C:\Windows\System\xwcTMfJ.exe
  2⤵
  PID:5060
- C:\Windows\System\MKxkAVx.exe
  C:\Windows\System\MKxkAVx.exe
  2⤵
  PID:4132
- C:\Windows\System\ohpCYiX.exe
  C:\Windows\System\ohpCYiX.exe
  2⤵
  PID:5116
- C:\Windows\System\IcLWICU.exe
  C:\Windows\System\IcLWICU.exe
  2⤵
  PID:4052
- C:\Windows\System\femFWwU.exe
  C:\Windows\System\femFWwU.exe
  2⤵
  PID:4468
- C:\Windows\System\UMvUoEL.exe
  C:\Windows\System\UMvUoEL.exe
  2⤵
  PID:4336
- C:\Windows\System\SsMUSlC.exe
  C:\Windows\System\SsMUSlC.exe
  2⤵
  PID:4600
- C:\Windows\System\tRsBwgJ.exe
  C:\Windows\System\tRsBwgJ.exe
  2⤵
  PID:4520
- C:\Windows\System\UitlNMm.exe
  C:\Windows\System\UitlNMm.exe
  2⤵
  PID:4592
- C:\Windows\System\ncOsSWl.exe
  C:\Windows\System\ncOsSWl.exe
  2⤵
  PID:4716
- C:\Windows\System\dWkqVUe.exe
  C:\Windows\System\dWkqVUe.exe
  2⤵
  PID:4752
- C:\Windows\System\PkGQeIO.exe
  C:\Windows\System\PkGQeIO.exe
  2⤵
  PID:5016
- C:\Windows\System\VRalKAM.exe
  C:\Windows\System\VRalKAM.exe
  2⤵
  PID:4784
- C:\Windows\System\GAbTuXJ.exe
  C:\Windows\System\GAbTuXJ.exe
  2⤵
  PID:4164
- C:\Windows\System\bEZbMqU.exe
  C:\Windows\System\bEZbMqU.exe
  2⤵
  PID:5076
- C:\Windows\System\GBXefcm.exe
  C:\Windows\System\GBXefcm.exe
  2⤵
  PID:932
- C:\Windows\System\SfOsxtY.exe
  C:\Windows\System\SfOsxtY.exe
  2⤵
  PID:5112
- C:\Windows\System\mVZLnMK.exe
  C:\Windows\System\mVZLnMK.exe
  2⤵
  PID:4448
- C:\Windows\System\ahOpFcj.exe
  C:\Windows\System\ahOpFcj.exe
  2⤵
  PID:4888
- C:\Windows\System\olcwhrn.exe
  C:\Windows\System\olcwhrn.exe
  2⤵
  PID:4956
- C:\Windows\System\tuljezF.exe
  C:\Windows\System\tuljezF.exe
  2⤵
  PID:4500
- C:\Windows\System\mLRksYZ.exe
  C:\Windows\System\mLRksYZ.exe
  2⤵
  PID:4660
- C:\Windows\System\GSSpRgN.exe
  C:\Windows\System\GSSpRgN.exe
  2⤵
  PID:4588
- C:\Windows\System\NvfgiVS.exe
  C:\Windows\System\NvfgiVS.exe
  2⤵
  PID:4840
- C:\Windows\System\svFDfFw.exe
  C:\Windows\System\svFDfFw.exe
  2⤵
  PID:3500
- C:\Windows\System\LFouMKA.exe
  C:\Windows\System\LFouMKA.exe
  2⤵
  PID:3668
- C:\Windows\System\PSzlFmY.exe
  C:\Windows\System\PSzlFmY.exe
  2⤵
  PID:4688
- C:\Windows\System\xSwhQdY.exe
  C:\Windows\System\xSwhQdY.exe
  2⤵
  PID:5128
- C:\Windows\System\wMAclAJ.exe
  C:\Windows\System\wMAclAJ.exe
  2⤵
  PID:5144
- C:\Windows\System\XLGtHHe.exe
  C:\Windows\System\XLGtHHe.exe
  2⤵
  PID:5160
- C:\Windows\System\fkBmMYa.exe
  C:\Windows\System\fkBmMYa.exe
  2⤵
  PID:5176
- C:\Windows\System\gWkcVde.exe
  C:\Windows\System\gWkcVde.exe
  2⤵
  PID:5192
- C:\Windows\System\mvUvbAD.exe
  C:\Windows\System\mvUvbAD.exe
  2⤵
  PID:5208
- C:\Windows\System\GvFwVnD.exe
  C:\Windows\System\GvFwVnD.exe
  2⤵
  PID:5224
- C:\Windows\System\YjPbwnh.exe
  C:\Windows\System\YjPbwnh.exe
  2⤵
  PID:5240
- C:\Windows\System\LLwXRPT.exe
  C:\Windows\System\LLwXRPT.exe
  2⤵
  PID:5256
- C:\Windows\System\MtUJSWH.exe
  C:\Windows\System\MtUJSWH.exe
  2⤵
  PID:5272
- C:\Windows\System\lTBBrAe.exe
  C:\Windows\System\lTBBrAe.exe
  2⤵
  PID:5288
- C:\Windows\System\ihnoVLh.exe
  C:\Windows\System\ihnoVLh.exe
  2⤵
  PID:5304
- C:\Windows\System\HZGUHuf.exe
  C:\Windows\System\HZGUHuf.exe
  2⤵
  PID:5320
- C:\Windows\System\aUfIGHj.exe
  C:\Windows\System\aUfIGHj.exe
  2⤵
  PID:5336
- C:\Windows\System\kFPVorR.exe
  C:\Windows\System\kFPVorR.exe
  2⤵
  PID:5352
- C:\Windows\System\dunhPtK.exe
  C:\Windows\System\dunhPtK.exe
  2⤵
  PID:5368
- C:\Windows\System\bmApCIm.exe
  C:\Windows\System\bmApCIm.exe
  2⤵
  PID:5388
- C:\Windows\System\YFauKIA.exe
  C:\Windows\System\YFauKIA.exe
  2⤵
  PID:5404
- C:\Windows\System\RzKUItz.exe
  C:\Windows\System\RzKUItz.exe
  2⤵
  PID:5420
- C:\Windows\System\JXscneY.exe
  C:\Windows\System\JXscneY.exe
  2⤵
  PID:5436
- C:\Windows\System\kDMTPOl.exe
  C:\Windows\System\kDMTPOl.exe
  2⤵
  PID:5452
- C:\Windows\System\miPFkKy.exe
  C:\Windows\System\miPFkKy.exe
  2⤵
  PID:5468
- C:\Windows\System\ByqVixR.exe
  C:\Windows\System\ByqVixR.exe
  2⤵
  PID:5484
- C:\Windows\System\YtFlxCl.exe
  C:\Windows\System\YtFlxCl.exe
  2⤵
  PID:5500
- C:\Windows\System\EMCgFzL.exe
  C:\Windows\System\EMCgFzL.exe
  2⤵
  PID:5516
- C:\Windows\System\FwaGuZq.exe
  C:\Windows\System\FwaGuZq.exe
  2⤵
  PID:5532
- C:\Windows\System\bfUPAdW.exe
  C:\Windows\System\bfUPAdW.exe
  2⤵
  PID:5548
- C:\Windows\System\kUbaXsF.exe
  C:\Windows\System\kUbaXsF.exe
  2⤵
  PID:5564
- C:\Windows\System\adpXtFA.exe
  C:\Windows\System\adpXtFA.exe
  2⤵
  PID:5580
- C:\Windows\System\LlJvCrr.exe
  C:\Windows\System\LlJvCrr.exe
  2⤵
  PID:5596
- C:\Windows\System\ahpeSfz.exe
  C:\Windows\System\ahpeSfz.exe
  2⤵
  PID:5612
- C:\Windows\System\aqjFOkI.exe
  C:\Windows\System\aqjFOkI.exe
  2⤵
  PID:5628
- C:\Windows\System\WzAovra.exe
  C:\Windows\System\WzAovra.exe
  2⤵
  PID:5644
- C:\Windows\System\ZkfGpoL.exe
  C:\Windows\System\ZkfGpoL.exe
  2⤵
  PID:5660
- C:\Windows\System\Fwappst.exe
  C:\Windows\System\Fwappst.exe
  2⤵
  PID:5676
- C:\Windows\System\tylJprm.exe
  C:\Windows\System\tylJprm.exe
  2⤵
  PID:5692
- C:\Windows\System\LrJWzuZ.exe
  C:\Windows\System\LrJWzuZ.exe
  2⤵
  PID:5708
- C:\Windows\System\cVFxqtc.exe
  C:\Windows\System\cVFxqtc.exe
  2⤵
  PID:5724
- C:\Windows\System\CPCsqTe.exe
  C:\Windows\System\CPCsqTe.exe
  2⤵
  PID:5740
- C:\Windows\System\xkLakrc.exe
  C:\Windows\System\xkLakrc.exe
  2⤵
  PID:5756
- C:\Windows\System\aCBfNYu.exe
  C:\Windows\System\aCBfNYu.exe
  2⤵
  PID:5772
- C:\Windows\System\fwjJumt.exe
  C:\Windows\System\fwjJumt.exe
  2⤵
  PID:5788
- C:\Windows\System\VLVZYZa.exe
  C:\Windows\System\VLVZYZa.exe
  2⤵
  PID:5804
- C:\Windows\System\fGWwPiH.exe
  C:\Windows\System\fGWwPiH.exe
  2⤵
  PID:5820
- C:\Windows\System\oDfYLxT.exe
  C:\Windows\System\oDfYLxT.exe
  2⤵
  PID:5836
- C:\Windows\System\tdglWQq.exe
  C:\Windows\System\tdglWQq.exe
  2⤵
  PID:5852
- C:\Windows\System\RLVuZeN.exe
  C:\Windows\System\RLVuZeN.exe
  2⤵
  PID:5868
- C:\Windows\System\cXhnljI.exe
  C:\Windows\System\cXhnljI.exe
  2⤵
  PID:5884
- C:\Windows\System\jSHWimS.exe
  C:\Windows\System\jSHWimS.exe
  2⤵
  PID:5900
- C:\Windows\System\OUGzBrf.exe
  C:\Windows\System\OUGzBrf.exe
  2⤵
  PID:5916
- C:\Windows\System\NGmepji.exe
  C:\Windows\System\NGmepji.exe
  2⤵
  PID:5932
- C:\Windows\System\NUiqfRY.exe
  C:\Windows\System\NUiqfRY.exe
  2⤵
  PID:5948
- C:\Windows\System\ywLiKnt.exe
  C:\Windows\System\ywLiKnt.exe
  2⤵
  PID:5968
- C:\Windows\System\NhXfYxt.exe
  C:\Windows\System\NhXfYxt.exe
  2⤵
  PID:5984
- C:\Windows\System\IjfCrXT.exe
  C:\Windows\System\IjfCrXT.exe
  2⤵
  PID:6000
- C:\Windows\System\tZnxmKV.exe
  C:\Windows\System\tZnxmKV.exe
  2⤵
  PID:6016
- C:\Windows\System\LsCtFGl.exe
  C:\Windows\System\LsCtFGl.exe
  2⤵
  PID:6032
- C:\Windows\System\xdKesWR.exe
  C:\Windows\System\xdKesWR.exe
  2⤵
  PID:6048
- C:\Windows\System\MWQwAld.exe
  C:\Windows\System\MWQwAld.exe
  2⤵
  PID:6064
- C:\Windows\System\pGbKKEP.exe
  C:\Windows\System\pGbKKEP.exe
  2⤵
  PID:6080
- C:\Windows\System\Enasohr.exe
  C:\Windows\System\Enasohr.exe
  2⤵
  PID:6100
- C:\Windows\System\kCHWBuW.exe
  C:\Windows\System\kCHWBuW.exe
  2⤵
  PID:6116
- C:\Windows\System\hAQIdmD.exe
  C:\Windows\System\hAQIdmD.exe
  2⤵
  PID:6140
- C:\Windows\System\qZrDWAF.exe
  C:\Windows\System\qZrDWAF.exe
  2⤵
  PID:5140
- C:\Windows\System\vjnVQpS.exe
  C:\Windows\System\vjnVQpS.exe
  2⤵
  PID:5204
- C:\Windows\System\cmjIRqm.exe
  C:\Windows\System\cmjIRqm.exe
  2⤵
  PID:5268
- C:\Windows\System\TTLaSOu.exe
  C:\Windows\System\TTLaSOu.exe
  2⤵
  PID:4260
- C:\Windows\System\kbKgsbI.exe
  C:\Windows\System\kbKgsbI.exe
  2⤵
  PID:5332
- C:\Windows\System\qJuPTAx.exe
  C:\Windows\System\qJuPTAx.exe
  2⤵
  PID:5364
- C:\Windows\System\Ptrxzcl.exe
  C:\Windows\System\Ptrxzcl.exe
  2⤵
  PID:5248
- C:\Windows\System\EoCpnqf.exe
  C:\Windows\System\EoCpnqf.exe
  2⤵
  PID:5316
- C:\Windows\System\IpoUJQv.exe
  C:\Windows\System\IpoUJQv.exe
  2⤵
  PID:5464
- C:\Windows\System\yZaWMxD.exe
  C:\Windows\System\yZaWMxD.exe
  2⤵
  PID:5528
- C:\Windows\System\qxrxBof.exe
  C:\Windows\System\qxrxBof.exe
  2⤵
  PID:5376
- C:\Windows\System\fjwVBPo.exe
  C:\Windows\System\fjwVBPo.exe
  2⤵
  PID:5448
- C:\Windows\System\mlzRkXK.exe
  C:\Windows\System\mlzRkXK.exe
  2⤵
  PID:5476
- C:\Windows\System\Imfhqed.exe
  C:\Windows\System\Imfhqed.exe
  2⤵
  PID:5512
- C:\Windows\System\nmSmPLQ.exe
  C:\Windows\System\nmSmPLQ.exe
  2⤵
  PID:5604
- C:\Windows\System\gBFMKaF.exe
  C:\Windows\System\gBFMKaF.exe
  2⤵
  PID:5636
- C:\Windows\System\xsFewmg.exe
  C:\Windows\System\xsFewmg.exe
  2⤵
  PID:5684
- C:\Windows\System\gKLMZRz.exe
  C:\Windows\System\gKLMZRz.exe
  2⤵
  PID:5716
- C:\Windows\System\lrDnend.exe
  C:\Windows\System\lrDnend.exe
  2⤵
  PID:5732
- C:\Windows\System\nDBkfsQ.exe
  C:\Windows\System\nDBkfsQ.exe
  2⤵
  PID:5784
- C:\Windows\System\nPWxXWx.exe
  C:\Windows\System\nPWxXWx.exe
  2⤵
  PID:5848
- C:\Windows\System\mwKrbfH.exe
  C:\Windows\System\mwKrbfH.exe
  2⤵
  PID:5768
- C:\Windows\System\ahyAiAO.exe
  C:\Windows\System\ahyAiAO.exe
  2⤵
  PID:5832
- C:\Windows\System\QslncpM.exe
  C:\Windows\System\QslncpM.exe
  2⤵
  PID:5908
- C:\Windows\System\yTVqCsQ.exe
  C:\Windows\System\yTVqCsQ.exe
  2⤵
  PID:5976
- C:\Windows\System\oqlvqrL.exe
  C:\Windows\System\oqlvqrL.exe
  2⤵
  PID:6040
- C:\Windows\System\rIKZgDx.exe
  C:\Windows\System\rIKZgDx.exe
  2⤵
  PID:6060
- C:\Windows\System\qbRqewk.exe
  C:\Windows\System\qbRqewk.exe
  2⤵
  PID:5928
- C:\Windows\System\qKCwTGz.exe
  C:\Windows\System\qKCwTGz.exe
  2⤵
  PID:5960
- C:\Windows\System\gUgMnIR.exe
  C:\Windows\System\gUgMnIR.exe
  2⤵
  PID:5384
- C:\Windows\System\GfLwowp.exe
  C:\Windows\System\GfLwowp.exe
  2⤵
  PID:6112
- C:\Windows\System\nZrQXiF.exe
  C:\Windows\System\nZrQXiF.exe
  2⤵
  PID:5232
- C:\Windows\System\KWQzOvM.exe
  C:\Windows\System\KWQzOvM.exe
  2⤵
  PID:5172
- C:\Windows\System\CZGQjTD.exe
  C:\Windows\System\CZGQjTD.exe
  2⤵
  PID:5300
- C:\Windows\System\NtzMGbu.exe
  C:\Windows\System\NtzMGbu.exe
  2⤵
  PID:5220
- C:\Windows\System\szKrIqK.exe
  C:\Windows\System\szKrIqK.exe
  2⤵
  PID:5428
- C:\Windows\System\acWJueh.exe
  C:\Windows\System\acWJueh.exe
  2⤵
  PID:5524
- C:\Windows\System\zjRAcbz.exe
  C:\Windows\System\zjRAcbz.exe
  2⤵
  PID:5412
- C:\Windows\System\JfOibek.exe
  C:\Windows\System\JfOibek.exe
  2⤵
  PID:5576
- C:\Windows\System\cbwAxbH.exe
  C:\Windows\System\cbwAxbH.exe
  2⤵
  PID:5624
- C:\Windows\System\ARgpFky.exe
  C:\Windows\System\ARgpFky.exe
  2⤵
  PID:5672
- C:\Windows\System\tMPYNLX.exe
  C:\Windows\System\tMPYNLX.exe
  2⤵
  PID:5752
- C:\Windows\System\zGxuIbl.exe
  C:\Windows\System\zGxuIbl.exe
  2⤵
  PID:5864
- C:\Windows\System\QAlxAeS.exe
  C:\Windows\System\QAlxAeS.exe
  2⤵
  PID:6072
- C:\Windows\System\NsCNCBI.exe
  C:\Windows\System\NsCNCBI.exe
  2⤵
  PID:6028
- C:\Windows\System\smoeCVR.exe
  C:\Windows\System\smoeCVR.exe
  2⤵
  PID:6128
- C:\Windows\System\kpnPTbk.exe
  C:\Windows\System\kpnPTbk.exe
  2⤵
  PID:4836
- C:\Windows\System\odqSTTI.exe
  C:\Windows\System\odqSTTI.exe
  2⤵
  PID:5360
- C:\Windows\System\RusAZyU.exe
  C:\Windows\System\RusAZyU.exe
  2⤵
  PID:5280
- C:\Windows\System\PflKcyv.exe
  C:\Windows\System\PflKcyv.exe
  2⤵
  PID:5540
- C:\Windows\System\sLEtNUK.exe
  C:\Windows\System\sLEtNUK.exe
  2⤵
  PID:5748
- C:\Windows\System\qxJoxSH.exe
  C:\Windows\System\qxJoxSH.exe
  2⤵
  PID:5880
- C:\Windows\System\bXEKvGT.exe
  C:\Windows\System\bXEKvGT.exe
  2⤵
  PID:5860
- C:\Windows\System\hWKhgKh.exe
  C:\Windows\System\hWKhgKh.exe
  2⤵
  PID:5996
- C:\Windows\System\RxLkcYz.exe
  C:\Windows\System\RxLkcYz.exe
  2⤵
  PID:6076
- C:\Windows\System\jgjSacI.exe
  C:\Windows\System\jgjSacI.exe
  2⤵
  PID:5496
- C:\Windows\System\PXzHokN.exe
  C:\Windows\System\PXzHokN.exe
  2⤵
  PID:5796
- C:\Windows\System\LiOmQLK.exe
  C:\Windows\System\LiOmQLK.exe
  2⤵
  PID:5896
- C:\Windows\System\ZDhuFDj.exe
  C:\Windows\System\ZDhuFDj.exe
  2⤵
  PID:6008
- C:\Windows\System\dWvGQCp.exe
  C:\Windows\System\dWvGQCp.exe
  2⤵
  PID:6136
- C:\Windows\System\VNUsBVV.exe
  C:\Windows\System\VNUsBVV.exe
  2⤵
  PID:5560
- C:\Windows\System\ZFIDOkR.exe
  C:\Windows\System\ZFIDOkR.exe
  2⤵
  PID:6148
- C:\Windows\System\lLdcfWY.exe
  C:\Windows\System\lLdcfWY.exe
  2⤵
  PID:6164
- C:\Windows\System\nqpTRkB.exe
  C:\Windows\System\nqpTRkB.exe
  2⤵
  PID:6180
- C:\Windows\System\GdGAcJn.exe
  C:\Windows\System\GdGAcJn.exe
  2⤵
  PID:6196
- C:\Windows\System\RekJLIj.exe
  C:\Windows\System\RekJLIj.exe
  2⤵
  PID:6216
- C:\Windows\System\pLshAGK.exe
  C:\Windows\System\pLshAGK.exe
  2⤵
  PID:6232
- C:\Windows\System\QwudYML.exe
  C:\Windows\System\QwudYML.exe
  2⤵
  PID:6248
- C:\Windows\System\lCLaLyl.exe
  C:\Windows\System\lCLaLyl.exe
  2⤵
  PID:6264
- C:\Windows\System\iinhxOJ.exe
  C:\Windows\System\iinhxOJ.exe
  2⤵
  PID:6284
- C:\Windows\System\dslFXvX.exe
  C:\Windows\System\dslFXvX.exe
  2⤵
  PID:6304
- C:\Windows\System\dswQbCF.exe
  C:\Windows\System\dswQbCF.exe
  2⤵
  PID:6320
- C:\Windows\System\alJctkK.exe
  C:\Windows\System\alJctkK.exe
  2⤵
  PID:6336
- C:\Windows\System\gPdKkqa.exe
  C:\Windows\System\gPdKkqa.exe
  2⤵
  PID:6352
- C:\Windows\System\IFzynPj.exe
  C:\Windows\System\IFzynPj.exe
  2⤵
  PID:6368
- C:\Windows\System\XJWEfeW.exe
  C:\Windows\System\XJWEfeW.exe
  2⤵
  PID:6384
- C:\Windows\System\FAVyecS.exe
  C:\Windows\System\FAVyecS.exe
  2⤵
  PID:6400
- C:\Windows\System\wAMbpaQ.exe
  C:\Windows\System\wAMbpaQ.exe
  2⤵
  PID:6416
- C:\Windows\System\xyABEGe.exe
  C:\Windows\System\xyABEGe.exe
  2⤵
  PID:6432
- C:\Windows\System\RyMAvmb.exe
  C:\Windows\System\RyMAvmb.exe
  2⤵
  PID:6448
- C:\Windows\System\IYSBCze.exe
  C:\Windows\System\IYSBCze.exe
  2⤵
  PID:6464
- C:\Windows\System\SSYsmMK.exe
  C:\Windows\System\SSYsmMK.exe
  2⤵
  PID:6480
- C:\Windows\System\aGNfbRF.exe
  C:\Windows\System\aGNfbRF.exe
  2⤵
  PID:6496
- C:\Windows\System\PpLaLvv.exe
  C:\Windows\System\PpLaLvv.exe
  2⤵
  PID:6512
- C:\Windows\System\tKVQhTO.exe
  C:\Windows\System\tKVQhTO.exe
  2⤵
  PID:6556
- C:\Windows\System\NmHhYfN.exe
  C:\Windows\System\NmHhYfN.exe
  2⤵
  PID:6576
- C:\Windows\System\oiAJPBC.exe
  C:\Windows\System\oiAJPBC.exe
  2⤵
  PID:6596
- C:\Windows\System\WhEtQLW.exe
  C:\Windows\System\WhEtQLW.exe
  2⤵
  PID:6612
- C:\Windows\System\rUNlQhY.exe
  C:\Windows\System\rUNlQhY.exe
  2⤵
  PID:6628
- C:\Windows\System\cZqXyRG.exe
  C:\Windows\System\cZqXyRG.exe
  2⤵
  PID:6644
- C:\Windows\System\ygnBLOL.exe
  C:\Windows\System\ygnBLOL.exe
  2⤵
  PID:6660
- C:\Windows\System\QsZwwfj.exe
  C:\Windows\System\QsZwwfj.exe
  2⤵
  PID:6676
- C:\Windows\System\LDWuNKp.exe
  C:\Windows\System\LDWuNKp.exe
  2⤵
  PID:6692
- C:\Windows\System\QZqZdPQ.exe
  C:\Windows\System\QZqZdPQ.exe
  2⤵
  PID:6708
- C:\Windows\System\LnsMWck.exe
  C:\Windows\System\LnsMWck.exe
  2⤵
  PID:6728
- C:\Windows\System\fdbjGSP.exe
  C:\Windows\System\fdbjGSP.exe
  2⤵
  PID:6744
- C:\Windows\System\PbhrGpo.exe
  C:\Windows\System\PbhrGpo.exe
  2⤵
  PID:6760
- C:\Windows\System\uKVFMcw.exe
  C:\Windows\System\uKVFMcw.exe
  2⤵
  PID:6776
- C:\Windows\System\OyYfpww.exe
  C:\Windows\System\OyYfpww.exe
  2⤵
  PID:6792
- C:\Windows\System\ILtbSYn.exe
  C:\Windows\System\ILtbSYn.exe
  2⤵
  PID:6808
- C:\Windows\System\QfYmmDn.exe
  C:\Windows\System\QfYmmDn.exe
  2⤵
  PID:6824
- C:\Windows\System\MZcxkbV.exe
  C:\Windows\System\MZcxkbV.exe
  2⤵
  PID:6844
- C:\Windows\System\VYGJpjt.exe
  C:\Windows\System\VYGJpjt.exe
  2⤵
  PID:6864
- C:\Windows\System\NrXFyQr.exe
  C:\Windows\System\NrXFyQr.exe
  2⤵
  PID:6880
- C:\Windows\System\lsMqKEC.exe
  C:\Windows\System\lsMqKEC.exe
  2⤵
  PID:6896
- C:\Windows\System\AJfOyoI.exe
  C:\Windows\System\AJfOyoI.exe
  2⤵
  PID:6912
- C:\Windows\System\nYgzRMw.exe
  C:\Windows\System\nYgzRMw.exe
  2⤵
  PID:6928
- C:\Windows\System\RntgEHY.exe
  C:\Windows\System\RntgEHY.exe
  2⤵
  PID:6944
- C:\Windows\System\HhmqGZY.exe
  C:\Windows\System\HhmqGZY.exe
  2⤵
  PID:6960
- C:\Windows\System\DLMmSVN.exe
  C:\Windows\System\DLMmSVN.exe
  2⤵
  PID:6976
- C:\Windows\System\WrNYQjS.exe
  C:\Windows\System\WrNYQjS.exe
  2⤵
  PID:6992
- C:\Windows\System\CHQCeOm.exe
  C:\Windows\System\CHQCeOm.exe
  2⤵
  PID:7008
- C:\Windows\System\knLathd.exe
  C:\Windows\System\knLathd.exe
  2⤵
  PID:7024
- C:\Windows\System\HJEiAbS.exe
  C:\Windows\System\HJEiAbS.exe
  2⤵
  PID:7040
- C:\Windows\System\tlitESv.exe
  C:\Windows\System\tlitESv.exe
  2⤵
  PID:7056
- C:\Windows\System\tJvQwZu.exe
  C:\Windows\System\tJvQwZu.exe
  2⤵
  PID:7072
- C:\Windows\System\SanuaAt.exe
  C:\Windows\System\SanuaAt.exe
  2⤵
  PID:7088
- C:\Windows\System\OdZHKwq.exe
  C:\Windows\System\OdZHKwq.exe
  2⤵
  PID:7104
- C:\Windows\System\gPPxUfv.exe
  C:\Windows\System\gPPxUfv.exe
  2⤵
  PID:7120
- C:\Windows\System\WVLLbeg.exe
  C:\Windows\System\WVLLbeg.exe
  2⤵
  PID:7136
- C:\Windows\System\HuqQCJF.exe
  C:\Windows\System\HuqQCJF.exe
  2⤵
  PID:7152
- C:\Windows\System\LNEgtxy.exe
  C:\Windows\System\LNEgtxy.exe
  2⤵
  PID:6012
- C:\Windows\System\pFgfAxh.exe
  C:\Windows\System\pFgfAxh.exe
  2⤵
  PID:5592
- C:\Windows\System\HwAfcXb.exe
  C:\Windows\System\HwAfcXb.exe
  2⤵
  PID:6192
- C:\Windows\System\hgLWvPC.exe
  C:\Windows\System\hgLWvPC.exe
  2⤵
  PID:6212
- C:\Windows\System\lMxxUbg.exe
  C:\Windows\System\lMxxUbg.exe
  2⤵
  PID:6224
- C:\Windows\System\lqhpZPE.exe
  C:\Windows\System\lqhpZPE.exe
  2⤵
  PID:6328
- C:\Windows\System\SYbifES.exe
  C:\Windows\System\SYbifES.exe
  2⤵
  PID:6364
- C:\Windows\System\RbJEOJe.exe
  C:\Windows\System\RbJEOJe.exe
  2⤵
  PID:6244
- C:\Windows\System\vWFarPn.exe
  C:\Windows\System\vWFarPn.exe
  2⤵
  PID:6460
- C:\Windows\System\BsKLcUO.exe
  C:\Windows\System\BsKLcUO.exe
  2⤵
  PID:6348
- C:\Windows\System\rnFujut.exe
  C:\Windows\System\rnFujut.exe
  2⤵
  PID:6316
- C:\Windows\System\Doidzkx.exe
  C:\Windows\System\Doidzkx.exe
  2⤵
  PID:6408
- C:\Windows\System\MkbRMof.exe
  C:\Windows\System\MkbRMof.exe
  2⤵
  PID:6444
- C:\Windows\System\BVmYXuD.exe
  C:\Windows\System\BVmYXuD.exe
  2⤵
  PID:6524
- C:\Windows\System\rgcXWUP.exe
  C:\Windows\System\rgcXWUP.exe
  2⤵
  PID:6540
- C:\Windows\System\uGJDWMi.exe
  C:\Windows\System\uGJDWMi.exe
  2⤵
  PID:6584
- C:\Windows\System\zQmWTrU.exe
  C:\Windows\System\zQmWTrU.exe
  2⤵
  PID:6620
- C:\Windows\System\vRNcWDN.exe
  C:\Windows\System\vRNcWDN.exe
  2⤵
  PID:6624
- C:\Windows\System\hJvuSdW.exe
  C:\Windows\System\hJvuSdW.exe
  2⤵
  PID:6684
- C:\Windows\System\FnArOfm.exe
  C:\Windows\System\FnArOfm.exe
  2⤵
  PID:6700
- C:\Windows\System\KkcdEag.exe
  C:\Windows\System\KkcdEag.exe
  2⤵
  PID:6724
- C:\Windows\System\qHVQhFN.exe
  C:\Windows\System\qHVQhFN.exe
  2⤵
  PID:6784
- C:\Windows\System\VlVItcJ.exe
  C:\Windows\System\VlVItcJ.exe
  2⤵
  PID:6852
- C:\Windows\System\gSuLUDt.exe
  C:\Windows\System\gSuLUDt.exe
  2⤵
  PID:6832
- C:\Windows\System\QdyUFgp.exe
  C:\Windows\System\QdyUFgp.exe
  2⤵
  PID:6768
- C:\Windows\System\gvolbkA.exe
  C:\Windows\System\gvolbkA.exe
  2⤵
  PID:6920
- C:\Windows\System\dVsceCi.exe
  C:\Windows\System\dVsceCi.exe
  2⤵
  PID:6876
- C:\Windows\System\UxIucme.exe
  C:\Windows\System\UxIucme.exe
  2⤵
  PID:6952
- C:\Windows\System\zmEOADV.exe
  C:\Windows\System\zmEOADV.exe
  2⤵
  PID:6936
- C:\Windows\System\QwdUJqM.exe
  C:\Windows\System\QwdUJqM.exe
  2⤵
  PID:6972
- C:\Windows\System\pCVwSCs.exe
  C:\Windows\System\pCVwSCs.exe
  2⤵
  PID:7048
- C:\Windows\System\iawzmDh.exe
  C:\Windows\System\iawzmDh.exe
  2⤵
  PID:7064
- C:\Windows\System\MvEvpQc.exe
  C:\Windows\System\MvEvpQc.exe
  2⤵
  PID:7112
- C:\Windows\System\ssoGFzZ.exe
  C:\Windows\System\ssoGFzZ.exe
  2⤵
  PID:7128
- C:\Windows\System\ffYwvZz.exe
  C:\Windows\System\ffYwvZz.exe
  2⤵
  PID:6156
- C:\Windows\System\hIvclgt.exe
  C:\Windows\System\hIvclgt.exe
  2⤵
  PID:7132
- C:\Windows\System\PjeEHuo.exe
  C:\Windows\System\PjeEHuo.exe
  2⤵
  PID:6240
- C:\Windows\System\OwEycUs.exe
  C:\Windows\System\OwEycUs.exe
  2⤵
  PID:6376
- C:\Windows\System\IlPHbxn.exe
  C:\Windows\System\IlPHbxn.exe
  2⤵
  PID:6276
- C:\Windows\System\veZWKsG.exe
  C:\Windows\System\veZWKsG.exe
  2⤵
  PID:6508
- C:\Windows\System\WQtKgWf.exe
  C:\Windows\System\WQtKgWf.exe
  2⤵
  PID:6188
- C:\Windows\System\evqDXGR.exe
  C:\Windows\System\evqDXGR.exe
  2⤵
  PID:6544
- C:\Windows\System\TVoilqm.exe
  C:\Windows\System\TVoilqm.exe
  2⤵
  PID:6592
- C:\Windows\System\aYQjjdJ.exe
  C:\Windows\System\aYQjjdJ.exe
  2⤵
  PID:6716
- C:\Windows\System\XcihlTp.exe
  C:\Windows\System\XcihlTp.exe
  2⤵
  PID:6656
- C:\Windows\System\KGggvAj.exe
  C:\Windows\System\KGggvAj.exe
  2⤵
  PID:6836
- C:\Windows\System\rLzSmzT.exe
  C:\Windows\System\rLzSmzT.exe
  2⤵
  PID:6888
- C:\Windows\System\VkweLAW.exe
  C:\Windows\System\VkweLAW.exe
  2⤵
  PID:6924
- C:\Windows\System\TaoRyPT.exe
  C:\Windows\System\TaoRyPT.exe
  2⤵
  PID:7052
- C:\Windows\System\zGEZPwS.exe
  C:\Windows\System\zGEZPwS.exe
  2⤵
  PID:6872
- C:\Windows\System\cfwBVTO.exe
  C:\Windows\System\cfwBVTO.exe
  2⤵
  PID:6256
- C:\Windows\System\BqUwtjQ.exe
  C:\Windows\System\BqUwtjQ.exe
  2⤵
  PID:7084
- C:\Windows\System\QWshZNi.exe
  C:\Windows\System\QWshZNi.exe
  2⤵
  PID:6360
- C:\Windows\System\dPSchOK.exe
  C:\Windows\System\dPSchOK.exe
  2⤵
  PID:6548
- C:\Windows\System\dkDyczg.exe
  C:\Windows\System\dkDyczg.exe
  2⤵
  PID:6604
- C:\Windows\System\ORoctDn.exe
  C:\Windows\System\ORoctDn.exe
  2⤵
  PID:6892
- C:\Windows\System\feZquOQ.exe
  C:\Windows\System\feZquOQ.exe
  2⤵
  PID:7004
- C:\Windows\System\jGiZBWA.exe
  C:\Windows\System\jGiZBWA.exe
  2⤵
  PID:6988
- C:\Windows\System\GzwaUrK.exe
  C:\Windows\System\GzwaUrK.exe
  2⤵
  PID:7148
- C:\Windows\System\wRAQTLz.exe
  C:\Windows\System\wRAQTLz.exe
  2⤵
  PID:6840
- C:\Windows\System\htbfVis.exe
  C:\Windows\System\htbfVis.exe
  2⤵
  PID:7032
- C:\Windows\System\FSdDsWr.exe
  C:\Windows\System\FSdDsWr.exe
  2⤵
  PID:6312
- C:\Windows\System\Reotuvj.exe
  C:\Windows\System\Reotuvj.exe
  2⤵
  PID:7096
- C:\Windows\System\pjtgMmj.exe
  C:\Windows\System\pjtgMmj.exe
  2⤵
  PID:6492
- C:\Windows\System\LKWbolq.exe
  C:\Windows\System\LKWbolq.exe
  2⤵
  PID:6804
- C:\Windows\System\SSMooJe.exe
  C:\Windows\System\SSMooJe.exe
  2⤵
  PID:6820
- C:\Windows\System\wgFLJvq.exe
  C:\Windows\System\wgFLJvq.exe
  2⤵
  PID:6532
- C:\Windows\System\orbVSPK.exe
  C:\Windows\System\orbVSPK.exe
  2⤵
  PID:6752
- C:\Windows\System\eNhBSxA.exe
  C:\Windows\System\eNhBSxA.exe
  2⤵
  PID:7176
- C:\Windows\System\DiFFXWB.exe
  C:\Windows\System\DiFFXWB.exe
  2⤵
  PID:7196
- C:\Windows\System\VdzFvFi.exe
  C:\Windows\System\VdzFvFi.exe
  2⤵
  PID:7212
- C:\Windows\System\qzSmEBK.exe
  C:\Windows\System\qzSmEBK.exe
  2⤵
  PID:7228
- C:\Windows\System\JJIcmNa.exe
  C:\Windows\System\JJIcmNa.exe
  2⤵
  PID:7244
- C:\Windows\System\ugdJaXQ.exe
  C:\Windows\System\ugdJaXQ.exe
  2⤵
  PID:7260
- C:\Windows\System\JsSvpTd.exe
  C:\Windows\System\JsSvpTd.exe
  2⤵
  PID:7280
- C:\Windows\System\AhWMRfw.exe
  C:\Windows\System\AhWMRfw.exe
  2⤵
  PID:7300
- C:\Windows\System\doTgWil.exe
  C:\Windows\System\doTgWil.exe
  2⤵
  PID:7316
- C:\Windows\System\MAjdfdr.exe
  C:\Windows\System\MAjdfdr.exe
  2⤵
  PID:7332
- C:\Windows\System\BoIyLAL.exe
  C:\Windows\System\BoIyLAL.exe
  2⤵
  PID:7352
- C:\Windows\System\llEIvwL.exe
  C:\Windows\System\llEIvwL.exe
  2⤵
  PID:7372
- C:\Windows\System\KMLvTbN.exe
  C:\Windows\System\KMLvTbN.exe
  2⤵
  PID:7388
- C:\Windows\System\lEQuTuX.exe
  C:\Windows\System\lEQuTuX.exe
  2⤵
  PID:7404
- C:\Windows\System\FOcvkjk.exe
  C:\Windows\System\FOcvkjk.exe
  2⤵
  PID:7420
- C:\Windows\System\huglQMh.exe
  C:\Windows\System\huglQMh.exe
  2⤵
  PID:7436
- C:\Windows\System\CFnZABa.exe
  C:\Windows\System\CFnZABa.exe
  2⤵
  PID:7452
- C:\Windows\System\IBCxCIJ.exe
  C:\Windows\System\IBCxCIJ.exe
  2⤵
  PID:7468
- C:\Windows\System\WdmleYe.exe
  C:\Windows\System\WdmleYe.exe
  2⤵
  PID:7492
- C:\Windows\System\GhJUSnS.exe
  C:\Windows\System\GhJUSnS.exe
  2⤵
  PID:7508
- C:\Windows\System\rUVEWOf.exe
  C:\Windows\System\rUVEWOf.exe
  2⤵
  PID:7524
- C:\Windows\System\uVYDtVb.exe
  C:\Windows\System\uVYDtVb.exe
  2⤵
  PID:7540
- C:\Windows\System\lqVHCZH.exe
  C:\Windows\System\lqVHCZH.exe
  2⤵
  PID:7556
- C:\Windows\System\nrpaKjR.exe
  C:\Windows\System\nrpaKjR.exe
  2⤵
  PID:7572
- C:\Windows\System\fTvChLm.exe
  C:\Windows\System\fTvChLm.exe
  2⤵
  PID:7588
- C:\Windows\System\ahZWrqf.exe
  C:\Windows\System\ahZWrqf.exe
  2⤵
  PID:7612
- C:\Windows\System\kOPcyTw.exe
  C:\Windows\System\kOPcyTw.exe
  2⤵
  PID:7628
- C:\Windows\System\vpaUsrw.exe
  C:\Windows\System\vpaUsrw.exe
  2⤵
  PID:7644
- C:\Windows\System\UomoJJB.exe
  C:\Windows\System\UomoJJB.exe
  2⤵
  PID:7660
- C:\Windows\System\ejbMBCK.exe
  C:\Windows\System\ejbMBCK.exe
  2⤵
  PID:7676
- C:\Windows\System\RnqLlzY.exe
  C:\Windows\System\RnqLlzY.exe
  2⤵
  PID:7696
- C:\Windows\System\zRBMUWR.exe
  C:\Windows\System\zRBMUWR.exe
  2⤵
  PID:7712
- C:\Windows\System\LXeSOcQ.exe
  C:\Windows\System\LXeSOcQ.exe
  2⤵
  PID:7728
- C:\Windows\System\HjHyqEO.exe
  C:\Windows\System\HjHyqEO.exe
  2⤵
  PID:7744
- C:\Windows\System\tIRfuhL.exe
  C:\Windows\System\tIRfuhL.exe
  2⤵
  PID:7760
- C:\Windows\System\xzYLWqx.exe
  C:\Windows\System\xzYLWqx.exe
  2⤵
  PID:7776
- C:\Windows\System\jwSAdjO.exe
  C:\Windows\System\jwSAdjO.exe
  2⤵
  PID:7792
- C:\Windows\System\boFbCOF.exe
  C:\Windows\System\boFbCOF.exe
  2⤵
  PID:7808
- C:\Windows\System\vwlEEPu.exe
  C:\Windows\System\vwlEEPu.exe
  2⤵
  PID:7824
- C:\Windows\System\figUypZ.exe
  C:\Windows\System\figUypZ.exe
  2⤵
  PID:7844
- C:\Windows\System\lpXbpmb.exe
  C:\Windows\System\lpXbpmb.exe
  2⤵
  PID:7860
- C:\Windows\System\KJiQRIr.exe
  C:\Windows\System\KJiQRIr.exe
  2⤵
  PID:7876
- C:\Windows\System\pLEggnp.exe
  C:\Windows\System\pLEggnp.exe
  2⤵
  PID:7892
- C:\Windows\System\SOXpUwY.exe
  C:\Windows\System\SOXpUwY.exe
  2⤵
  PID:7908
- C:\Windows\System\yqGsjnG.exe
  C:\Windows\System\yqGsjnG.exe
  2⤵
  PID:7924
- C:\Windows\System\gDJIndg.exe
  C:\Windows\System\gDJIndg.exe
  2⤵
  PID:7940
- C:\Windows\System\RROwJrK.exe
  C:\Windows\System\RROwJrK.exe
  2⤵
  PID:7956
- C:\Windows\System\Xfqjiuu.exe
  C:\Windows\System\Xfqjiuu.exe
  2⤵
  PID:7972
- C:\Windows\System\HCLqskI.exe
  C:\Windows\System\HCLqskI.exe
  2⤵
  PID:7988
- C:\Windows\System\PBiaSoq.exe
  C:\Windows\System\PBiaSoq.exe
  2⤵
  PID:8004
- C:\Windows\System\AyfoTCE.exe
  C:\Windows\System\AyfoTCE.exe
  2⤵
  PID:8020
- C:\Windows\System\ZVNkpVW.exe
  C:\Windows\System\ZVNkpVW.exe
  2⤵
  PID:8036
- C:\Windows\System\nbeXCnl.exe
  C:\Windows\System\nbeXCnl.exe
  2⤵
  PID:8052
- C:\Windows\System\EMWBAsI.exe
  C:\Windows\System\EMWBAsI.exe
  2⤵
  PID:8068
- C:\Windows\System\RjkTgKH.exe
  C:\Windows\System\RjkTgKH.exe
  2⤵
  PID:8088
- C:\Windows\System\PfxVqVP.exe
  C:\Windows\System\PfxVqVP.exe
  2⤵
  PID:8104
- C:\Windows\System\yPIagXH.exe
  C:\Windows\System\yPIagXH.exe
  2⤵
  PID:8120
- C:\Windows\System\Ffjlogh.exe
  C:\Windows\System\Ffjlogh.exe
  2⤵
  PID:8140
- C:\Windows\System\ouvHMIx.exe
  C:\Windows\System\ouvHMIx.exe
  2⤵
  PID:8160
- C:\Windows\System\ppiWKWe.exe
  C:\Windows\System\ppiWKWe.exe
  2⤵
  PID:8184
- C:\Windows\System\HAhLuTc.exe
  C:\Windows\System\HAhLuTc.exe
  2⤵
  PID:7220
- C:\Windows\System\aTmWfSu.exe
  C:\Windows\System\aTmWfSu.exe
  2⤵
  PID:6520
- C:\Windows\System\TNgJhTq.exe
  C:\Windows\System\TNgJhTq.exe
  2⤵
  PID:7292
- C:\Windows\System\ESUFctJ.exe
  C:\Windows\System\ESUFctJ.exe
  2⤵
  PID:7360
- C:\Windows\System\yIlsBnJ.exe
  C:\Windows\System\yIlsBnJ.exe
  2⤵
  PID:7272
- C:\Windows\System\YIsjNWL.exe
  C:\Windows\System\YIsjNWL.exe
  2⤵
  PID:7340
- C:\Windows\System\TOfyWEN.exe
  C:\Windows\System\TOfyWEN.exe
  2⤵
  PID:7400
- C:\Windows\System\BYLzrln.exe
  C:\Windows\System\BYLzrln.exe
  2⤵
  PID:7432
- C:\Windows\System\fjIKrcs.exe
  C:\Windows\System\fjIKrcs.exe
  2⤵
  PID:7448
- C:\Windows\System\LdMfTQy.exe
  C:\Windows\System\LdMfTQy.exe
  2⤵
  PID:7532
- C:\Windows\System\dyrSsIV.exe
  C:\Windows\System\dyrSsIV.exe
  2⤵
  PID:7568
- C:\Windows\System\yGmoaQO.exe
  C:\Windows\System\yGmoaQO.exe
  2⤵
  PID:7480
- C:\Windows\System\nOGONzR.exe
  C:\Windows\System\nOGONzR.exe
  2⤵
  PID:7488
- C:\Windows\System\VsiRLDJ.exe
  C:\Windows\System\VsiRLDJ.exe
  2⤵
  PID:7548
- C:\Windows\System\njWbNlH.exe
  C:\Windows\System\njWbNlH.exe
  2⤵
  PID:7668
- C:\Windows\System\JizIkkl.exe
  C:\Windows\System\JizIkkl.exe
  2⤵
  PID:7656
- C:\Windows\System\phWIycG.exe
  C:\Windows\System\phWIycG.exe
  2⤵
  PID:7708
- C:\Windows\System\HDsJHiw.exe
  C:\Windows\System\HDsJHiw.exe
  2⤵
  PID:7720
- C:\Windows\System\DUbeHlK.exe
  C:\Windows\System\DUbeHlK.exe
  2⤵
  PID:7772
- C:\Windows\System\lVisYWv.exe
  C:\Windows\System\lVisYWv.exe
  2⤵
  PID:7784
- C:\Windows\System\YYagfgY.exe
  C:\Windows\System\YYagfgY.exe
  2⤵
  PID:6528
- C:\Windows\System\JehdwKu.exe
  C:\Windows\System\JehdwKu.exe
  2⤵
  PID:7816
- C:\Windows\System\rcxnAVq.exe
  C:\Windows\System\rcxnAVq.exe
  2⤵
  PID:7904
- C:\Windows\System\rWIstzf.exe
  C:\Windows\System\rWIstzf.exe
  2⤵
  PID:7888
- C:\Windows\System\VSZWiyw.exe
  C:\Windows\System\VSZWiyw.exe
  2⤵
  PID:7964
- C:\Windows\System\rGpWFjY.exe
  C:\Windows\System\rGpWFjY.exe
  2⤵
  PID:7980
- C:\Windows\System\nkFqmGo.exe
  C:\Windows\System\nkFqmGo.exe
  2⤵
  PID:8016
- C:\Windows\System\ZlMubNz.exe
  C:\Windows\System\ZlMubNz.exe
  2⤵
  PID:8064
- C:\Windows\System\ludMCSY.exe
  C:\Windows\System\ludMCSY.exe
  2⤵
  PID:8132
- C:\Windows\System\uiAntWk.exe
  C:\Windows\System\uiAntWk.exe
  2⤵
  PID:8180
- C:\Windows\System\LyCRUio.exe
  C:\Windows\System\LyCRUio.exe
  2⤵
  PID:8112
- C:\Windows\System\eSrwSUf.exe
  C:\Windows\System\eSrwSUf.exe
  2⤵
  PID:8048
- C:\Windows\System\wRayPXF.exe
  C:\Windows\System\wRayPXF.exe
  2⤵
  PID:8116
- C:\Windows\System\JakmzOx.exe
  C:\Windows\System\JakmzOx.exe
  2⤵
  PID:7192
- C:\Windows\System\xGzdoNX.exe
  C:\Windows\System\xGzdoNX.exe
  2⤵
  PID:7240
- C:\Windows\System\xSdUVzb.exe
  C:\Windows\System\xSdUVzb.exe
  2⤵
  PID:7328
- C:\Windows\System\WBhmkKW.exe
  C:\Windows\System\WBhmkKW.exe
  2⤵
  PID:7296
- C:\Windows\System\SQqeNXs.exe
  C:\Windows\System\SQqeNXs.exe
  2⤵
  PID:7364
- C:\Windows\System\pbEfvWe.exe
  C:\Windows\System\pbEfvWe.exe
  2⤵
  PID:7460
- C:\Windows\System\RNyDmvN.exe
  C:\Windows\System\RNyDmvN.exe
  2⤵
  PID:7600
- C:\Windows\System\zhgPtdE.exe
  C:\Windows\System\zhgPtdE.exe
  2⤵
  PID:7584
- C:\Windows\System\wQeMsEc.exe
  C:\Windows\System\wQeMsEc.exe
  2⤵
  PID:7620
- C:\Windows\System\qZZQzkv.exe
  C:\Windows\System\qZZQzkv.exe
  2⤵
  PID:7684
- C:\Windows\System\NXlLAzh.exe
  C:\Windows\System\NXlLAzh.exe
  2⤵
  PID:7768
- C:\Windows\System\VDjcyFB.exe
  C:\Windows\System\VDjcyFB.exe
  2⤵
  PID:7836
- C:\Windows\System\AazMjAr.exe
  C:\Windows\System\AazMjAr.exe
  2⤵
  PID:7916
- C:\Windows\System\fuyeHpS.exe
  C:\Windows\System\fuyeHpS.exe
  2⤵
  PID:7996
- C:\Windows\System\mqgiZvT.exe
  C:\Windows\System\mqgiZvT.exe
  2⤵
  PID:8060
- C:\Windows\System\tXVsHBc.exe
  C:\Windows\System\tXVsHBc.exe
  2⤵
  PID:6772
- C:\Windows\System\QYDDecQ.exe
  C:\Windows\System\QYDDecQ.exe
  2⤵
  PID:8084
- C:\Windows\System\YQjiGTb.exe
  C:\Windows\System\YQjiGTb.exe
  2⤵
  PID:7172
- C:\Windows\System\lveWZzH.exe
  C:\Windows\System\lveWZzH.exe
  2⤵
  PID:7208
- C:\Windows\System\MsgigvD.exe
  C:\Windows\System\MsgigvD.exe
  2⤵
  PID:7596
- C:\Windows\System\DoJLgXU.exe
  C:\Windows\System\DoJLgXU.exe
  2⤵
  PID:7396
- C:\Windows\System\PmwaJmQ.exe
  C:\Windows\System\PmwaJmQ.exe
  2⤵
  PID:7580
- C:\Windows\System\bCNHJqK.exe
  C:\Windows\System\bCNHJqK.exe
  2⤵
  PID:7872
- C:\Windows\System\gvddxpO.exe
  C:\Windows\System\gvddxpO.exe
  2⤵
  PID:8000
- C:\Windows\System\CwUuBzL.exe
  C:\Windows\System\CwUuBzL.exe
  2⤵
  PID:7932
- C:\Windows\System\vBvzoDm.exe
  C:\Windows\System\vBvzoDm.exe
  2⤵
  PID:7384
- C:\Windows\System\KtYULUr.exe
  C:\Windows\System\KtYULUr.exe
  2⤵
  PID:7288
- C:\Windows\System\hbwsLAo.exe
  C:\Windows\System\hbwsLAo.exe
  2⤵
  PID:8200
- C:\Windows\System\qWQhYOQ.exe
  C:\Windows\System\qWQhYOQ.exe
  2⤵
  PID:8220
- C:\Windows\System\baiKTgC.exe
  C:\Windows\System\baiKTgC.exe
  2⤵
  PID:8236
- C:\Windows\System\vBbSAbK.exe
  C:\Windows\System\vBbSAbK.exe
  2⤵
  PID:8252
- C:\Windows\System\fxabpyu.exe
  C:\Windows\System\fxabpyu.exe
  2⤵
  PID:8268
- C:\Windows\System\LcFIZVe.exe
  C:\Windows\System\LcFIZVe.exe
  2⤵
  PID:8284
- C:\Windows\System\vIvyeeX.exe
  C:\Windows\System\vIvyeeX.exe
  2⤵
  PID:8300
- C:\Windows\System\VkmVHBz.exe
  C:\Windows\System\VkmVHBz.exe
  2⤵
  PID:8328
- C:\Windows\System\QkUabhD.exe
  C:\Windows\System\QkUabhD.exe
  2⤵
  PID:8352
- C:\Windows\System\urSXQxS.exe
  C:\Windows\System\urSXQxS.exe
  2⤵
  PID:8368
- C:\Windows\System\ybMXyQI.exe
  C:\Windows\System\ybMXyQI.exe
  2⤵
  PID:8384
- C:\Windows\System\CbzKJcu.exe
  C:\Windows\System\CbzKJcu.exe
  2⤵
  PID:8400
- C:\Windows\System\SpcZydR.exe
  C:\Windows\System\SpcZydR.exe
  2⤵
  PID:8420
- C:\Windows\System\bIubFqj.exe
  C:\Windows\System\bIubFqj.exe
  2⤵
  PID:8436
- C:\Windows\System\DuLLTZj.exe
  C:\Windows\System\DuLLTZj.exe
  2⤵
  PID:8452
- C:\Windows\System\EnMNpSX.exe
  C:\Windows\System\EnMNpSX.exe
  2⤵
  PID:8468
- C:\Windows\System\YhzmcYC.exe
  C:\Windows\System\YhzmcYC.exe
  2⤵
  PID:8484
- C:\Windows\System\sylsTZA.exe
  C:\Windows\System\sylsTZA.exe
  2⤵
  PID:8500
- C:\Windows\System\CqRPmQG.exe
  C:\Windows\System\CqRPmQG.exe
  2⤵
  PID:8520
- C:\Windows\System\UtIeVXx.exe
  C:\Windows\System\UtIeVXx.exe
  2⤵
  PID:8536
- C:\Windows\System\UkJjvvd.exe
  C:\Windows\System\UkJjvvd.exe
  2⤵
  PID:8552
- C:\Windows\System\yVRRNHs.exe
  C:\Windows\System\yVRRNHs.exe
  2⤵
  PID:8568
- C:\Windows\System\QpCvymV.exe
  C:\Windows\System\QpCvymV.exe
  2⤵
  PID:8584
- C:\Windows\System\FrogWWk.exe
  C:\Windows\System\FrogWWk.exe
  2⤵
  PID:8600
- C:\Windows\System\IhfFzvY.exe
  C:\Windows\System\IhfFzvY.exe
  2⤵
  PID:8616
- C:\Windows\System\gEwLxwt.exe
  C:\Windows\System\gEwLxwt.exe
  2⤵
  PID:8684
- C:\Windows\System\siVRhkN.exe
  C:\Windows\System\siVRhkN.exe
  2⤵
  PID:8700
- C:\Windows\System\uENWbWu.exe
  C:\Windows\System\uENWbWu.exe
  2⤵
  PID:8716
- C:\Windows\System\rUiYbrM.exe
  C:\Windows\System\rUiYbrM.exe
  2⤵
  PID:8800
- C:\Windows\System\FLbZzvB.exe
  C:\Windows\System\FLbZzvB.exe
  2⤵
  PID:8816
- C:\Windows\System\sEnTGUP.exe
  C:\Windows\System\sEnTGUP.exe
  2⤵
  PID:8840
- C:\Windows\System\oTbnRVM.exe
  C:\Windows\System\oTbnRVM.exe
  2⤵
  PID:8856
- C:\Windows\System\qznBXdT.exe
  C:\Windows\System\qznBXdT.exe
  2⤵
  PID:8880
- C:\Windows\System\omWzYqJ.exe
  C:\Windows\System\omWzYqJ.exe
  2⤵
  PID:8896
- C:\Windows\System\TyyyYub.exe
  C:\Windows\System\TyyyYub.exe
  2⤵
  PID:8912
- C:\Windows\System\rJjOoUI.exe
  C:\Windows\System\rJjOoUI.exe
  2⤵
  PID:8944
- C:\Windows\System\AGDEsbw.exe
  C:\Windows\System\AGDEsbw.exe
  2⤵
  PID:8960
- C:\Windows\System\IcxpbUs.exe
  C:\Windows\System\IcxpbUs.exe
  2⤵
  PID:8976
- C:\Windows\System\nNMVfGf.exe
  C:\Windows\System\nNMVfGf.exe
  2⤵
  PID:8992
- C:\Windows\System\rheUTxF.exe
  C:\Windows\System\rheUTxF.exe
  2⤵
  PID:9008
- C:\Windows\System\TcAVzIx.exe
  C:\Windows\System\TcAVzIx.exe
  2⤵
  PID:9024
- C:\Windows\System\LaLYfqU.exe
  C:\Windows\System\LaLYfqU.exe
  2⤵
  PID:9040
- C:\Windows\System\GiUtbBM.exe
  C:\Windows\System\GiUtbBM.exe
  2⤵
  PID:9056
- C:\Windows\System\kEQmDAO.exe
  C:\Windows\System\kEQmDAO.exe
  2⤵
  PID:9072
- C:\Windows\System\PNQGDkg.exe
  C:\Windows\System\PNQGDkg.exe
  2⤵
  PID:9088
- C:\Windows\System\lHbqwTX.exe
  C:\Windows\System\lHbqwTX.exe
  2⤵
  PID:9104
- C:\Windows\System\vMFHGwl.exe
  C:\Windows\System\vMFHGwl.exe
  2⤵
  PID:9120
- C:\Windows\System\HDQeMeE.exe
  C:\Windows\System\HDQeMeE.exe
  2⤵
  PID:9136
- C:\Windows\System\KHuQTkY.exe
  C:\Windows\System\KHuQTkY.exe
  2⤵
  PID:9152
- C:\Windows\System\sVDOSkB.exe
  C:\Windows\System\sVDOSkB.exe
  2⤵
  PID:9168
- C:\Windows\System\SMKuNpr.exe
  C:\Windows\System\SMKuNpr.exe
  2⤵
  PID:9184
- C:\Windows\System\kHpKmKP.exe
  C:\Windows\System\kHpKmKP.exe
  2⤵
  PID:9200
- C:\Windows\System\kimwlEV.exe
  C:\Windows\System\kimwlEV.exe
  2⤵
  PID:7952
- C:\Windows\System\psLHLkk.exe
  C:\Windows\System\psLHLkk.exe
  2⤵
  PID:7344
- C:\Windows\System\mpjfGWR.exe
  C:\Windows\System\mpjfGWR.exe
  2⤵
  PID:8100
- C:\Windows\System\DvLdPCI.exe
  C:\Windows\System\DvLdPCI.exe
  2⤵
  PID:7412
- C:\Windows\System\wDhEEhD.exe
  C:\Windows\System\wDhEEhD.exe
  2⤵
  PID:7624
- C:\Windows\System\gxXjBcH.exe
  C:\Windows\System\gxXjBcH.exe
  2⤵
  PID:8276
- C:\Windows\System\WjWUFTW.exe
  C:\Windows\System\WjWUFTW.exe
  2⤵
  PID:8496
- C:\Windows\System\bqQEKDT.exe
  C:\Windows\System\bqQEKDT.exe
  2⤵
  PID:8596
- C:\Windows\System\APsPtZi.exe
  C:\Windows\System\APsPtZi.exe
  2⤵
  PID:8612
- C:\Windows\System\AtbEgLi.exe
  C:\Windows\System\AtbEgLi.exe
  2⤵
  PID:8712
- C:\Windows\System\mUtGAJt.exe
  C:\Windows\System\mUtGAJt.exe
  2⤵
  PID:8924
- C:\Windows\System\ZvUjncd.exe
  C:\Windows\System\ZvUjncd.exe
  2⤵
  PID:8972
- C:\Windows\System\jlHouhC.exe
  C:\Windows\System\jlHouhC.exe
  2⤵
  PID:8708
- C:\Windows\System\JGsAADY.exe
  C:\Windows\System\JGsAADY.exe
  2⤵
  PID:8732
- C:\Windows\System\GOPZYtO.exe
  C:\Windows\System\GOPZYtO.exe
  2⤵
  PID:8808
- C:\Windows\System\bPiCSGI.exe
  C:\Windows\System\bPiCSGI.exe
  2⤵
  PID:8832
- C:\Windows\System\XZLnrvz.exe
  C:\Windows\System\XZLnrvz.exe
  2⤵
  PID:8828
- C:\Windows\System\YEQbQiw.exe
  C:\Windows\System\YEQbQiw.exe
  2⤵
  PID:8952
- C:\Windows\System\ulNWrxl.exe
  C:\Windows\System\ulNWrxl.exe
  2⤵
  PID:9020
- C:\Windows\System\FGZmROZ.exe
  C:\Windows\System\FGZmROZ.exe
  2⤵
  PID:9116
- C:\Windows\System\MelSKKP.exe
  C:\Windows\System\MelSKKP.exe
  2⤵
  PID:8648
- C:\Windows\System\qgHDPEi.exe
  C:\Windows\System\qgHDPEi.exe
  2⤵
  PID:8660
- C:\Windows\System\pLDlVuZ.exe
  C:\Windows\System\pLDlVuZ.exe
  2⤵
  PID:8668
- C:\Windows\System\KYRIPXF.exe
  C:\Windows\System\KYRIPXF.exe
  2⤵
  PID:8492
- C:\Windows\System\wDeRzjG.exe
  C:\Windows\System\wDeRzjG.exe
  2⤵
  PID:8852
- C:\Windows\System\pQkjebL.exe
  C:\Windows\System\pQkjebL.exe
  2⤵
  PID:8932
- C:\Windows\System\XrSLuVh.exe
  C:\Windows\System\XrSLuVh.exe
  2⤵
  PID:9036
- C:\Windows\System\GozaqGU.exe
  C:\Windows\System\GozaqGU.exe
  2⤵
  PID:8608
- C:\Windows\System\fGIZvBU.exe
  C:\Windows\System\fGIZvBU.exe
  2⤵
  PID:8724
- C:\Windows\System\kWfBXax.exe
  C:\Windows\System\kWfBXax.exe
  2⤵
  PID:9016
- C:\Windows\System\gBBBJEE.exe
  C:\Windows\System\gBBBJEE.exe
  2⤵
  PID:8316
- C:\Windows\System\NNcbztN.exe
  C:\Windows\System\NNcbztN.exe
  2⤵
  PID:8432
- C:\Windows\System\gAyhKHU.exe
  C:\Windows\System\gAyhKHU.exe
  2⤵
  PID:9096
- C:\Windows\System\BjbJsiT.exe
  C:\Windows\System\BjbJsiT.exe
  2⤵
  PID:7324
- C:\Windows\System\eHrHIHC.exe
  C:\Windows\System\eHrHIHC.exe
  2⤵
  PID:9112
- C:\Windows\System\qwLATHs.exe
  C:\Windows\System\qwLATHs.exe
  2⤵
  PID:8692
- C:\Windows\System\XjYNjpp.exe
  C:\Windows\System\XjYNjpp.exe
  2⤵
  PID:8248
- C:\Windows\System\VPicjyU.exe
  C:\Windows\System\VPicjyU.exe
  2⤵
  PID:8448
- C:\Windows\System\hQxssAr.exe
  C:\Windows\System\hQxssAr.exe
  2⤵
  PID:8824
- C:\Windows\System\nIOuOFi.exe
  C:\Windows\System\nIOuOFi.exe
  2⤵
  PID:9132
- C:\Windows\System\euUKnav.exe
  C:\Windows\System\euUKnav.exe
  2⤵
  PID:8196
- C:\Windows\System\zDvuAIh.exe
  C:\Windows\System\zDvuAIh.exe
  2⤵
  PID:8292
- C:\Windows\System\iWRTCVj.exe
  C:\Windows\System\iWRTCVj.exe
  2⤵
  PID:8228
- C:\Windows\System\zcHgFiM.exe
  C:\Windows\System\zcHgFiM.exe
  2⤵
  PID:8312
- C:\Windows\System\olrNIrP.exe
  C:\Windows\System\olrNIrP.exe
  2⤵
  PID:8416
- C:\Windows\System\ZfoVqKb.exe
  C:\Windows\System\ZfoVqKb.exe
  2⤵
  PID:9068
- C:\Windows\System\KSwzXsh.exe
  C:\Windows\System\KSwzXsh.exe
  2⤵
  PID:9080
- C:\Windows\System\jNCLKru.exe
  C:\Windows\System\jNCLKru.exe
  2⤵
  PID:7256
- C:\Windows\System\ITCneZy.exe
  C:\Windows\System\ITCneZy.exe
  2⤵
  PID:8672
- C:\Windows\System\XKnQeoe.exe
  C:\Windows\System\XKnQeoe.exe
  2⤵
  PID:9052
- C:\Windows\System\DnbQFLv.exe
  C:\Windows\System\DnbQFLv.exe
  2⤵
  PID:8544
- C:\Windows\System\axzZANG.exe
  C:\Windows\System\axzZANG.exe
  2⤵
  PID:8872
- C:\Windows\System\ycNSaRx.exe
  C:\Windows\System\ycNSaRx.exe
  2⤵
  PID:8408
- C:\Windows\System\bGgIaVt.exe
  C:\Windows\System\bGgIaVt.exe
  2⤵
  PID:2544
- C:\Windows\System\YEdbUSF.exe
  C:\Windows\System\YEdbUSF.exe
  2⤵
  PID:2572
- C:\Windows\System\oycrrpA.exe
  C:\Windows\System\oycrrpA.exe
  2⤵
  PID:8984
- C:\Windows\System\gQoxjVQ.exe
  C:\Windows\System\gQoxjVQ.exe
  2⤵
  PID:860
- C:\Windows\System\aKqQFss.exe
  C:\Windows\System\aKqQFss.exe
  2⤵
  PID:8428
- C:\Windows\System\CgAkJck.exe
  C:\Windows\System\CgAkJck.exe
  2⤵
  PID:8360
- C:\Windows\System\dIDVKPG.exe
  C:\Windows\System\dIDVKPG.exe
  2⤵
  PID:8868
- C:\Windows\System\OdRGgqN.exe
  C:\Windows\System\OdRGgqN.exe
  2⤵
  PID:9224
- C:\Windows\System\OdnTknk.exe
  C:\Windows\System\OdnTknk.exe
  2⤵
  PID:9248
- C:\Windows\System\IzSFhqH.exe
  C:\Windows\System\IzSFhqH.exe
  2⤵
  PID:9264
- C:\Windows\System\MeZUnYQ.exe
  C:\Windows\System\MeZUnYQ.exe
  2⤵
  PID:9280
- C:\Windows\System\PqHFRSh.exe
  C:\Windows\System\PqHFRSh.exe
  2⤵
  PID:9296
- C:\Windows\System\iMcQGWO.exe
  C:\Windows\System\iMcQGWO.exe
  2⤵
  PID:9316
- C:\Windows\System\twWzXZo.exe
  C:\Windows\System\twWzXZo.exe
  2⤵
  PID:9332
- C:\Windows\System\pHpOCKc.exe
  C:\Windows\System\pHpOCKc.exe
  2⤵
  PID:9348
- C:\Windows\System\ZAKaHXp.exe
  C:\Windows\System\ZAKaHXp.exe
  2⤵
  PID:9368
- C:\Windows\System\NzEVbKH.exe
  C:\Windows\System\NzEVbKH.exe
  2⤵
  PID:9384
- C:\Windows\System\dDaHDuY.exe
  C:\Windows\System\dDaHDuY.exe
  2⤵
  PID:9400
- C:\Windows\System\paugDMO.exe
  C:\Windows\System\paugDMO.exe
  2⤵
  PID:9420
- C:\Windows\System\lWNacTA.exe
  C:\Windows\System\lWNacTA.exe
  2⤵
  PID:9436
- C:\Windows\System\qpPiJiD.exe
  C:\Windows\System\qpPiJiD.exe
  2⤵
  PID:9516
- C:\Windows\System\YIPvIaF.exe
  C:\Windows\System\YIPvIaF.exe
  2⤵
  PID:9536
- C:\Windows\System\osVTgrb.exe
  C:\Windows\System\osVTgrb.exe
  2⤵
  PID:9552
- C:\Windows\System\uMFHpto.exe
  C:\Windows\System\uMFHpto.exe
  2⤵
  PID:9748
- C:\Windows\System\DwfNRRl.exe
  C:\Windows\System\DwfNRRl.exe
  2⤵
  PID:9764
- C:\Windows\System\uxBxUnG.exe
  C:\Windows\System\uxBxUnG.exe
  2⤵
  PID:9780
- C:\Windows\System\OiVkYWS.exe
  C:\Windows\System\OiVkYWS.exe
  2⤵
  PID:9796
- C:\Windows\System\vySgiVn.exe
  C:\Windows\System\vySgiVn.exe
  2⤵
  PID:9812
- C:\Windows\System\EUlHlke.exe
  C:\Windows\System\EUlHlke.exe
  2⤵
  PID:9828
- C:\Windows\System\QPaEbYF.exe
  C:\Windows\System\QPaEbYF.exe
  2⤵
  PID:9844
- C:\Windows\System\tnVXtER.exe
  C:\Windows\System\tnVXtER.exe
  2⤵
  PID:9860
- C:\Windows\System\GOCRxjU.exe
  C:\Windows\System\GOCRxjU.exe
  2⤵
  PID:9876
- C:\Windows\System\BDfNJiw.exe
  C:\Windows\System\BDfNJiw.exe
  2⤵
  PID:9892
- C:\Windows\System\pLDvxWO.exe
  C:\Windows\System\pLDvxWO.exe
  2⤵
  PID:9912
- C:\Windows\System\TmnJWiC.exe
  C:\Windows\System\TmnJWiC.exe
  2⤵
  PID:9932
- C:\Windows\System\HJqNiPR.exe
  C:\Windows\System\HJqNiPR.exe
  2⤵
  PID:9948
- C:\Windows\System\qbvvFMG.exe
  C:\Windows\System\qbvvFMG.exe
  2⤵
  PID:9964
- C:\Windows\System\haZyxhx.exe
  C:\Windows\System\haZyxhx.exe
  2⤵
  PID:9980
- C:\Windows\System\wYYUVwD.exe
  C:\Windows\System\wYYUVwD.exe
  2⤵
  PID:10004
- C:\Windows\System\cUoOGJX.exe
  C:\Windows\System\cUoOGJX.exe
  2⤵
  PID:10020
- C:\Windows\System\oDnZQLS.exe
  C:\Windows\System\oDnZQLS.exe
  2⤵
  PID:10036
- C:\Windows\System\uzibWCq.exe
  C:\Windows\System\uzibWCq.exe
  2⤵
  PID:10052
- C:\Windows\System\sKAfQsP.exe
  C:\Windows\System\sKAfQsP.exe
  2⤵
  PID:10068
- C:\Windows\System\jPEVTFh.exe
  C:\Windows\System\jPEVTFh.exe
  2⤵
  PID:10084
- C:\Windows\System\AliayjV.exe
  C:\Windows\System\AliayjV.exe
  2⤵
  PID:10100
- C:\Windows\System\bmgCLob.exe
  C:\Windows\System\bmgCLob.exe
  2⤵
  PID:10120
- C:\Windows\System\yCUApWv.exe
  C:\Windows\System\yCUApWv.exe
  2⤵
  PID:10140
- C:\Windows\System\TPjniXz.exe
  C:\Windows\System\TPjniXz.exe
  2⤵
  PID:10156
- C:\Windows\System\wMfQdrB.exe
  C:\Windows\System\wMfQdrB.exe
  2⤵
  PID:10172
- C:\Windows\System\WWjHGOZ.exe
  C:\Windows\System\WWjHGOZ.exe
  2⤵
  PID:10188
- C:\Windows\System\xpCBczz.exe
  C:\Windows\System\xpCBczz.exe
  2⤵
  PID:10204
- C:\Windows\System\Jowekyt.exe
  C:\Windows\System\Jowekyt.exe
  2⤵
  PID:10220
- C:\Windows\System\tLYyqcc.exe
  C:\Windows\System\tLYyqcc.exe
  2⤵
  PID:8592
- C:\Windows\System\LaaVSSQ.exe
  C:\Windows\System\LaaVSSQ.exe
  2⤵
  PID:8664
- C:\Windows\System\Gptqktr.exe
  C:\Windows\System\Gptqktr.exe
  2⤵
  PID:8264
- C:\Windows\System\RxnDRxp.exe
  C:\Windows\System\RxnDRxp.exe
  2⤵
  PID:8460
- C:\Windows\System\npUJRdn.exe
  C:\Windows\System\npUJRdn.exe
  2⤵
  PID:9004
- C:\Windows\System\WJKWsfW.exe
  C:\Windows\System\WJKWsfW.exe
  2⤵
  PID:8784
- C:\Windows\System\wDMKBSE.exe
  C:\Windows\System\wDMKBSE.exe
  2⤵
  PID:8752
- C:\Windows\System\ZztHzUs.exe
  C:\Windows\System\ZztHzUs.exe
  2⤵
  PID:2228
- C:\Windows\System\ZkvYypj.exe
  C:\Windows\System\ZkvYypj.exe
  2⤵
  PID:8508
- C:\Windows\System\tGqJUoh.exe
  C:\Windows\System\tGqJUoh.exe
  2⤵
  PID:8560
- C:\Windows\System\oIejvbC.exe
  C:\Windows\System\oIejvbC.exe
  2⤵
  PID:8096
- C:\Windows\System\nfVncVm.exe
  C:\Windows\System\nfVncVm.exe
  2⤵
  PID:9244
- C:\Windows\System\JMwcRjj.exe
  C:\Windows\System\JMwcRjj.exe
  2⤵
  PID:9340
- C:\Windows\System\hNAtABx.exe
  C:\Windows\System\hNAtABx.exe
  2⤵
  PID:9376
- C:\Windows\System\nZrLstb.exe
  C:\Windows\System\nZrLstb.exe
  2⤵
  PID:9408
- C:\Windows\System\ZUmCKsU.exe
  C:\Windows\System\ZUmCKsU.exe
  2⤵
  PID:9364
- C:\Windows\System\zZKLxnR.exe
  C:\Windows\System\zZKLxnR.exe
  2⤵
  PID:9428
- C:\Windows\System\DWdcUcI.exe
  C:\Windows\System\DWdcUcI.exe
  2⤵
  PID:9448
- C:\Windows\System\nIcpKZL.exe
  C:\Windows\System\nIcpKZL.exe
  2⤵
  PID:9560
- C:\Windows\System\EoefpcG.exe
  C:\Windows\System\EoefpcG.exe
  2⤵
  PID:9468
- C:\Windows\System\yHpOnKD.exe
  C:\Windows\System\yHpOnKD.exe
  2⤵
  PID:9500
- C:\Windows\System\PRkiwJB.exe
  C:\Windows\System\PRkiwJB.exe
  2⤵
  PID:9496
- C:\Windows\System\ueJRJvW.exe
  C:\Windows\System\ueJRJvW.exe
  2⤵
  PID:9544
- C:\Windows\System\DBqrAYg.exe
  C:\Windows\System\DBqrAYg.exe
  2⤵
  PID:9572
- C:\Windows\System\DzVlbFM.exe
  C:\Windows\System\DzVlbFM.exe
  2⤵
  PID:9652
- C:\Windows\System\blRFIfY.exe
  C:\Windows\System\blRFIfY.exe
  2⤵
  PID:9668
- C:\Windows\System\kacHcQC.exe
  C:\Windows\System\kacHcQC.exe
  2⤵
  PID:9684
- C:\Windows\System\BDliDFz.exe
  C:\Windows\System\BDliDFz.exe
  2⤵
  PID:9612
- C:\Windows\System\XPVyZLN.exe
  C:\Windows\System\XPVyZLN.exe
  2⤵
  PID:9628
- C:\Windows\System\cOavnTF.exe
  C:\Windows\System\cOavnTF.exe
  2⤵
  PID:9760
- C:\Windows\System\tRMffst.exe
  C:\Windows\System\tRMffst.exe
  2⤵
  PID:9824
- C:\Windows\System\KOzSkKq.exe
  C:\Windows\System\KOzSkKq.exe
  2⤵
  PID:9708
- C:\Windows\System\llIhdCj.exe
  C:\Windows\System\llIhdCj.exe
  2⤵
  PID:9856
- C:\Windows\System\sTzXMaT.exe
  C:\Windows\System\sTzXMaT.exe
  2⤵
  PID:9924
- C:\Windows\System\fxvrkuU.exe
  C:\Windows\System\fxvrkuU.exe
  2⤵
  PID:9728
- C:\Windows\System\UVCokBw.exe
  C:\Windows\System\UVCokBw.exe
  2⤵
  PID:9960
- C:\Windows\System\PbtVFdf.exe
  C:\Windows\System\PbtVFdf.exe
  2⤵
  PID:9772
- C:\Windows\System\tIgpqUk.exe
  C:\Windows\System\tIgpqUk.exe
  2⤵
  PID:9900
- C:\Windows\System\KrjdXBF.exe
  C:\Windows\System\KrjdXBF.exe
  2⤵
  PID:10044
- C:\Windows\System\wCeWMOq.exe
  C:\Windows\System\wCeWMOq.exe
  2⤵
  PID:10076
- C:\Windows\System\BTbTdse.exe
  C:\Windows\System\BTbTdse.exe
  2⤵
  PID:10232
- C:\Windows\System\Xnrdtyd.exe
  C:\Windows\System\Xnrdtyd.exe
  2⤵
  PID:2576
- C:\Windows\System\aYXlDxN.exe
  C:\Windows\System\aYXlDxN.exe
  2⤵
  PID:2892
- C:\Windows\System\aPKLAUe.exe
  C:\Windows\System\aPKLAUe.exe
  2⤵
  PID:2224
- C:\Windows\System\eoCRgQy.exe
  C:\Windows\System\eoCRgQy.exe
  2⤵
  PID:8848
- C:\Windows\System\cDoqgLK.exe
  C:\Windows\System\cDoqgLK.exe
  2⤵
  PID:8548
- C:\Windows\System\fywYFco.exe
  C:\Windows\System\fywYFco.exe
  2⤵
  PID:9260
- C:\Windows\System\GKmtPRg.exe
  C:\Windows\System\GKmtPRg.exe
  2⤵
  PID:8516
- C:\Windows\System\XCcsOMF.exe
  C:\Windows\System\XCcsOMF.exe
  2⤵
  PID:8392
- C:\Windows\System\NvWvpJe.exe
  C:\Windows\System\NvWvpJe.exe
  2⤵
  PID:9236
- C:\Windows\System\WjFaavq.exe
  C:\Windows\System\WjFaavq.exe
  2⤵
  PID:9444
- C:\Windows\System\rkvHNdr.exe
  C:\Windows\System\rkvHNdr.exe
  2⤵
  PID:9328
- C:\Windows\System\FaLAwIY.exe
  C:\Windows\System\FaLAwIY.exe
  2⤵
  PID:9452
- C:\Windows\System\RAMOeGu.exe
  C:\Windows\System\RAMOeGu.exe
  2⤵
  PID:9460
- C:\Windows\System\xNPRlRN.exe
  C:\Windows\System\xNPRlRN.exe
  2⤵
  PID:9584
- C:\Windows\System\zyglTIK.exe
  C:\Windows\System\zyglTIK.exe
  2⤵
  PID:9644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AJKDBXT.exe

Filesize
1.9MB

MD5
110b1ca016579e8fd3b66ce706abc9e4

SHA1
64fc3f0321ccf1339cf4f09fef7943069f1a4178

SHA256
36a7bfb190b8aff8f54df47536a538fb11ed0ad51feb2eb634827ff31a659472

SHA512
7982943152e2d2932d66167799d8c122df3751214897a64886216ece6fd0a3a5b0f0c82fb2d5dfe89ade3b7728b6053657ec7454a5872588529b30289f2073b8

Download Submit
C:\Windows\system\DNdfNKE.exe

Filesize
1.9MB

MD5
62c4dad80a9beb483a31dc83b53b877f

SHA1
ac5df41ff4aa02020f0d963869e474798ba65699

SHA256
9cd185b080b7a952670d64317fcc5b88471d67741637d79bd7577c0fd3a0126a

SHA512
d31a66e215f17fac42cf780479b839640d7d2ae0c79febe1af345bfe87726ffcbb86ce66ada5fd9cf832f12a6ce88f63b2c252105bde98007444d89d558263ba

Download Submit
C:\Windows\system\DjsLkDc.exe

Filesize
1.9MB

MD5
bf3ff8e5885d51361d3e248e2d14bb0a

SHA1
e7898b24d0aa573e8a1d26f259474097d28067d3

SHA256
f7ba3e98a90186d84f3b4afbef5ac45297a9f4f2dc7c53ba21c71f9a2b2b2ba5

SHA512
ba28538b6028d03bad1ef291aa0bb567cd8962c5bc1973666dc6610068aaed69b373f757a0ebab4e7e25b0fab0d53448b0f69f4c4cfac9cb87755d25b7d41d9f

Download Submit
C:\Windows\system\HuVLnFm.exe

Filesize
1024KB

MD5
56e04114975f51a81eb2f8b9d8ea33ea

SHA1
ac5dba53fd512f53d1e0abc1a8c729217e442d4e

SHA256
435c3ca94ffe7a9adae968f5d7ee01108070cd801f8a2459300faa210a0ffa1f

SHA512
735d340f2ea4e7c759c516609f1c40201cf56fed9b0210fd7fc41286335fac00f4398b5f3de8ba5d7f2d4b357096ff14242f0aa0d52c3b174ac1e9d4c9df7e76

Download Submit
C:\Windows\system\JyRtbDN.exe

Filesize
1.9MB

MD5
d912c5dd5adade99c8ae0f4fa17dd86e

SHA1
43be9553c8d5769a8e78260d9117f727938940ee

SHA256
ce0ad36c906713342c0010a787bc918a34a4d5055dcfed175b747d2ce953ce08

SHA512
dc69ff3ff3c74122a02621d141d423ef5f6101ec21bf3e9e639265961f9c63bef2e254aaf9b226f6f91cacca9bf627097d13c1a02c4f862565202330711f80ac

Download Submit
C:\Windows\system\LNnbQco.exe

Filesize
1.9MB

MD5
e4e32426b4289480d4132366dd020826

SHA1
05c25529d68f99e59f83f2f143ca7ff85d03e39b

SHA256
a35150ef0ec113c7c65f74a9e4f09410a862024cc34b9e8ed57d03fce3281be5

SHA512
79d728c7fcce7ab6b4f838377ff2fe7c5b337cabfe65d2d55fb911a67e993d494dac6352f8585ca3e24fc74a04bb7d6d0e26bae58dc02e2cb4788aec21c482af

Download Submit
C:\Windows\system\LoBQuHc.exe

Filesize
1.9MB

MD5
2981e32bdb1c87e87b4f670b270b2a69

SHA1
b5d738fad269b5b4752be8887b469a31763659fa

SHA256
c709b012ba4273423d74a6ae714eb73ac0b90d63c0c38f05bd675c637b600e68

SHA512
f211079c446503537842eed3a2b85749fe468b8637fe71f7ad4323c51e9e4df5b3b49db1e2e7b6a41dec354971134c8797203b31df0b81f8ed9e12c5ccff0b3e

Download Submit
C:\Windows\system\MnrILoE.exe

Filesize
1.9MB

MD5
62c3cd8fa3703b6b320c96c04819412f

SHA1
5b7fa4a21024d624c8e0ebbfdb9cc99d5c7a660e

SHA256
ada5915aafe652ce72fccb992666d4114aa81243db146af3148e7fabd5144713

SHA512
8c16fa0df00f814e0cacbd3db5cc94092904d60916470fe1676be98e667d7b96dc1e514f54ecb8673538eb6d4227c6924eb2a962066ab96dd7a44ea35a1a418e

Download Submit
C:\Windows\system\PQbkwHC.exe

Filesize
1.9MB

MD5
1d30d6e9cfb26e4badf6e9a5fe8b4357

SHA1
53fe4c8fc8bead1c651640415ddb610447ec3387

SHA256
318f22b62be940f7a4648e1317b6f0907a78f009e6182b6b008463071aa32209

SHA512
0a9c4e1916ce042a982521dc169eec2be9c9e000438fd3d4ff6657fff73895afe908d55451c484553f4b9569447b4ca5ea0caaa68ece728ad8f955ce9bdab212

Download Submit
C:\Windows\system\VIxfJrv.exe

Filesize
1.9MB

MD5
f087d93a43478ee928523ac3399b1bd0

SHA1
aa4c99ebc9299dd56439149e185d09ae3df65152

SHA256
aa2b7addc74b4c6a8704d0d111e916d440383b6bdcd02d95727c64f517cb322d

SHA512
49bbb80d63f371856a85c5a8069a3a15ea50b598e89cffb57317a60416d5eca4d65d59007c7e88494b2e00da5aee54b72ccabf6723fec1778ce8668f9c918566

Download Submit
C:\Windows\system\VRxJdzy.exe

Filesize
1.9MB

MD5
6e3ec6d24c31e87fee139397502a2d40

SHA1
e44173d81ac991ac4068fc2f21ff17c2f8ff9081

SHA256
e02b3c564990dc48c6dfe4a7f89e7a9a4cf04b029c964b527d770d20103132b0

SHA512
8018269a01581b4030eacac487e304bc0dd041afe3b3f851036c8527d059b17c1f2ed91a6ed2f97302dcfdb70463f0de45f8fa6a3aa5977b96715502b7d04815

Download Submit
C:\Windows\system\cNsJIdh.exe

Filesize
1.9MB

MD5
04e6d0c96b52c17245f3755a22f31063

SHA1
93917fe422de3ee03d8bdca2f7e6df45eb2a3631

SHA256
a7328a1d3f4eab04a6ade08e1a3c3dd4c9a4a2db1a14e5edde23b0345b4728d6

SHA512
113f6ed072ac518a1f5f6f4752307f9e2bd8dcc293aa012ead6449aff38416e5efd8d94d26dc0f63a403f4189b47335a343cbe97551e80a2362000c6cd0e5424

Download Submit
C:\Windows\system\dVLPhoA.exe

Filesize
1.9MB

MD5
655cb477b75f3a963fe5715f7e1e29c0

SHA1
6b23f5498b63aa495d864a5ed4b4f28cab3b3440

SHA256
50e84b412a62112c2d4a4cff1337ce1cc51580c96f41f67e89669bfaa0fc7b1a

SHA512
bdccc3ab3a084b371055d86f3e5cc3d1b74578d4a7152c319ff451c0a9c0296b01725a1e53a9ab60a1c72c31bb8755e666ac403e076cc0a87dbd14358f3ddf48

Download Submit
C:\Windows\system\eWHjmfe.exe

Filesize
1.9MB

MD5
c215035306205e092ef9cae29a6f634a

SHA1
8fb8b6440fa51310bb310a2f6c5bd0cee66a2332

SHA256
aea413ac3812cd56cfdd80ebed36c6ee4a16973dacfcfa26a69193b0da12b0ed

SHA512
adefd8415deec52514b6d5ce0124bc8f4d1034bdeb177ee0841d3c14ac545e891161b0e56a8932a76eca7f2e545ce21dc93873ce75e0ff1b8e15f9ef07a830d8

Download Submit
C:\Windows\system\euVBkUz.exe

Filesize
1.9MB

MD5
63bcbfe0a583bdac14d35bb9e4a943ab

SHA1
8ed0618d57631295fbec3da35b741bbf4a8143b4

SHA256
931d3d5860d4dc7674b5343348ab4c9811362920b723d8f835bf034f9fb808f1

SHA512
7f26e9c3e105ac7a2bd83fc922ba2b6016371e50930403149654e9e6c2d295fb57d6c39231e0d896c0fff749ebec3a1de53502295775a73c56688b4ddeb1e3d2

Download Submit
C:\Windows\system\gSMsqjr.exe

Filesize
1.6MB

MD5
859aa49e4882a26f410a2340f787bd37

SHA1
8d5d4aa1ea16066b1474abd41044c3bdd899f177

SHA256
057cf22fd488946b22a9d89b5ca2d319c1dff9a7f80dd181f8966764ddb80e3a

SHA512
80e97bcc01cee7de79ee6f8452b73d3ce80fc700cef42a636dd46cc5ee20611ddeb358b1a3ab6995fb85e4bd2c55fe3ea8eb1242ea6e7fc78d5f5172472914e8

Download Submit
C:\Windows\system\gsPJcCT.exe

Filesize
1.9MB

MD5
ef4773f30e52426ee7b2c3320237743d

SHA1
e2f8bdf22528918f85fad17275fbadff6bc2322e

SHA256
05502690c8e913e10354beb139885f5dc83d37a2c899e17c79cfc7bbf8e318c3

SHA512
ed3ebf973240d1e2186632df2ef64f95e4625fd7c75de3267face42f4743b142e4bf36e400483cd788b4ea6737256ae66435f272d4bc748f62372c47a42f643e

Download Submit
C:\Windows\system\izemhrL.exe

Filesize
1.9MB

MD5
46c333cdd09cf06528293386da284ec6

SHA1
5e270ce58c5346f1eab20455aa3281b3bb2d5569

SHA256
d5a10af7af48b4a92f8cb05e9e2fe32e4941e05862243fee131e8203a6fe2283

SHA512
e42bebbc203dfc15b33ba9e872cc67290d073d270ca01b184b4d9b77ec6ec367861475fa59e2fe014f2efe391ac78979c31d4854ec8ac7cfaff7c9268dc80902

Download Submit
C:\Windows\system\jblBxwc.exe

Filesize
1.9MB

MD5
ed315b0582ee26c4ca7fbd3771fd7678

SHA1
26f9507083dfb15a2a33463743d00a43664c012b

SHA256
6b34bfb33edfbbba926542fbef2f187c7033d25c05cdf32e008b981e1185b716

SHA512
499727ba97bd62d10ef3c91a755ff809bc060f9c027ac8186de0d59e32fc0f4c4ae1627be4b0570526d4ea9647017a1d66b2ac33cc03d328f684a279df047d56

Download Submit
C:\Windows\system\kwSUOPa.exe

Filesize
1.9MB

MD5
779157640d123809435d2a076b5a72bc

SHA1
b8ed594b258bcee998f70c637306e8ca3862a0f9

SHA256
23dd66391c0db8bc5eb997967e96c7570a397fced1217dc3918be7532ca9cb3d

SHA512
5fccb97d67460f54605a11a8aaa39e1bc602e1fe5efbdecbb84e392bdbcaf0db2729a5b9a305b271267891384dd6e2e7e8e2538bf231f91099306bd4265974f2

Download Submit
C:\Windows\system\mIhqVuQ.exe

Filesize
1.9MB

MD5
800fec089fb3eb913cbf7602f6c84f06

SHA1
a832d3a12d5461a82fa3a84d7bfd1c0e49caa809

SHA256
52a9d8f8d355bb6a10b4fc56d387202212ceaebc34ea0611c058f2d4691fae2f

SHA512
5097fd8277c1e243f3ec90738f9ca3401838e33326fcd2f09993e00f0525141fdc4a48af24a1f91cc86ed96dad003610b109f61f55e339fe187eb28999d9ae3e

Download Submit
C:\Windows\system\onoitKt.exe

Filesize
1.9MB

MD5
f18e656486edbba5c338c91ca328b799

SHA1
f141944d34c9ab6589dd95ff8816da6d44be0b20

SHA256
756a217313361491d27753c1fe5208433ec73f5558a04858f54a500fef5f31ca

SHA512
4d02bba33ee7f61ad28d85060c692aa810a7dc3b96879b163dd56f9c3f34113100f907b3d33d4668a10af2c3258b1ec37a23fb0145432493045e6a2fae2e5005

Download Submit
C:\Windows\system\pgbuKzO.exe

Filesize
1.9MB

MD5
ede4099a517e914a1f88abc8ce16c248

SHA1
d8ea519d3417be601b883844cbf30d02b0dddcf4

SHA256
4b177e7b4f96d9d6eddd9f171eec1293a7f02fbee4390bf08946cb0907dd69d2

SHA512
701815a6dcdec2ea3581ca44e9f01554130ea74260b4fb1041365dd678d573ad640f284539bcbfede1859039de86d3f45d45fcb319c72e5fad6e670c5887ca37

Download Submit
C:\Windows\system\tnVIPzz.exe

Filesize
1.9MB

MD5
660fe057018c0a78fcdb3c1b5a3faf34

SHA1
52e24ee855d4fdca95e5d0a8c4d73b5367fd1d6c

SHA256
c6353e7b82e5e585b9492effbc256c271dd827f4fd40bf8f61c995491494bea0

SHA512
f57679134a9913bede5eb046fd1d21191ff42691d4a8dffa5c83ab102852ca5572c2e76ca30300832a122ed1103f8514a879728200edef03e4d1172933eaccb4

Download Submit
C:\Windows\system\wsiHgtK.exe

Filesize
1.9MB

MD5
480dfda666c4a05d6a3b2ec8d2947ff5

SHA1
7c3c0bb3f1e079eb6ac36199395f6fc723564957

SHA256
61217059321dcab31dea37db2cae3692188b03bb366ed52b48e59724f4e4436c

SHA512
cc198d7e304bcbd25475844197c3d258739e9f1513f5c0c1bc5f9e54586827776d9dd63fc0941f4dacc01ab4b117768c6f9d4bbaf6a1fbeda96d96b954b2dcbf

Download Submit
C:\Windows\system\yXIOHaX.exe

Filesize
1.9MB

MD5
6c0c3d4cd1c2a06515266e3a5e599d42

SHA1
ea91cfbc82aa3cadc6bb6b1c7703f8a087798a58

SHA256
68fbaea5bc01b952332ccfb3fe6a62575e1cb9870402227f10b359cbb487484c

SHA512
0e60d07c7cf2445b1e26aad4e006e41c25d918b8e6c180ff4491bac30aadd6153fbe6a988da37a876e661bc1c91a26fce6d4742b9d3246a580cad13e517d3e10

Download Submit
C:\Windows\system\ychZqor.exe

Filesize
1.9MB

MD5
3c91dd8ce6099b35e95149e9385785e4

SHA1
bc0a1fc592900322b3645443a9f0bb448bdf7773

SHA256
0d07eb68d5289d33ea5ba4876203b407b0afad93e3eb2ffc68eb379c3f9e29a0

SHA512
307c7b6b75467abb473030391775a0a1f14d325ac30c7f6e858c19e85b67ce99b513f6cb34d7c4c8a10ba2c47e8ff98dff3b0455d7362a08655ecfb89daf581c

Download Submit
\Windows\system\BDHVrGc.exe

Filesize
1.9MB

MD5
c369a1edc391fd70beadff59a4199a54

SHA1
7e2cd83544e93a24af1fe29383e96be96e4a4a90

SHA256
21f856479c55a2c36ab06523b2db503032f2a74e18e2c4c6b4375176d52a5933

SHA512
b8f2a06fe8c8893c81ad5ab4ec34a4918e17da6595c73e405b419abd6f2a12b436bc9d60a05f7e4b5d0301c5393babcc7012a430350a3c035295b4ff53344594

Download Submit
\Windows\system\DjsLkDc.exe

Filesize
896KB

MD5
c9ac085628003047a7ff298bf120fd48

SHA1
30a75262a89b1031b3c3c1c69e98068305624afe

SHA256
2047ea3fcc3f9653268cb00e74bc8938f1623af5e51d536491181ebe3df322c8

SHA512
9de277c7cfced077517bf5a2062824da2f4d9e7db1a8daccd949c2ef88c18e873484f6977acfacc6db7f45c1649b11252216f9382eae312d23f0ab3fcd4b4bb7

Download Submit
\Windows\system\HuVLnFm.exe

Filesize
1.4MB

MD5
8c65bf048d79c20d76a6ab977bdbe46d

SHA1
9ea4e92aec6dec88dfe6bd542a346aeb787732da

SHA256
ad569c0225fa96f78c0937c41bd21a1e91c64d90cb4ce697f14f9a5f1e2f4506

SHA512
39d348eae857f2097704385e0803075573c149ddbdadedd19f01cf7e9beff3cf6094febd226f27958db3d9c422c833413a00b6d7b2a3ebccbb9969ef676cc097

Download Submit
\Windows\system\JyRtbDN.exe

Filesize
1.1MB

MD5
f36ec215f82a5782ccb9780f94b752e1

SHA1
84e88485b6d38ceb84b71ea3a8d522e35df6936c

SHA256
03fda1835733bb0ac6e0cad0059f41e8e03a186960850d77c277bd82ea67b2bb

SHA512
837902d3a8cc8cdadb087904e19dbdbcd2ca7df108c5a5f618e56b2e37354f8b4f58466f427ff4d84efb58508f8929304ad3e5ed0828fc3afde0bcede8033bb8

Download Submit
\Windows\system\KsEdBOi.exe

Filesize
1.9MB

MD5
edcab7a377b321c71027cfb13bf05b20

SHA1
98ff38cea82e8f6d00e09669dd32da39ac3f5e27

SHA256
d2b75b2f306027dd4346e0894811585211339307aae9faf4513002537babaffe

SHA512
9df5a9e8388167ec633b862a581b3a10d8bdffb51f7189726eb54dc7c0179b801aacbd6a1542ab683acde91238a233ff908149c675053ba7e05feb5668ef8762

Download Submit
\Windows\system\PQbkwHC.exe

Filesize
1.1MB

MD5
a093996abe7835e88584180c57950227

SHA1
f5920a542348decd0056be3a87a1ebc9c3386a7e

SHA256
93daf8ef56540f6302ad2d84984497e4b8556382a87ce404daadbc7c57d91d3e

SHA512
1242dd7797f9ae6b8802e7416446c32b2e7b0547d149b48b7c9a2d2c3f7931daf0de7c76d0b42629f664b31654b498df0ac76a74be79956db543888d1af56c75

Download Submit
\Windows\system\gSMsqjr.exe

Filesize
1.9MB

MD5
0925ae79966486abc16d26cafd0c94b2

SHA1
a6e620c384f432c34413d5477172beb2f27361f7

SHA256
fd267506821b66c9d2f98fd482de107b8e8f410ae4698a605a6e558908f52c2b

SHA512
efcdd9d7b823ece4770085a81cdfc79e10629b6e5d0a9ed988d74ddebf259baa5d9d0cf5569df40a409bece74ce12e221df6c77c4bcdf822cbb36365c667429c

Download Submit
\Windows\system\vaXQVTW.exe

Filesize
1.9MB

MD5
c9541ea83ac5611ead1d40827e0384e9

SHA1
32d6dd996171b89259e8c8d997fa17aa42268833

SHA256
575b4d44f204a1a2a4eb30122a4bf60713d62ea78c423a47b6e19b0f2be3aaf2

SHA512
a080d3633a7e48e95a07a1076999f391bd89357aae63bf2bc1d3bbb1d6e4626c431f75cd7950300accac9ad023f1133a68612214b6255c6449480e5f4145d285

Download Submit
\Windows\system\wsiHgtK.exe

Filesize
1.3MB

MD5
e939bdb3c090c1d97c35dfaa298ff061

SHA1
42e418b5e6462ea4c34623d2f5e9f033d2ddb20a

SHA256
18588727b00e08d028363042ad026064f26f0b1ea49f35a1546a3d3ecf462bb8

SHA512
e68acd2b673895b31d2d619e1e03c4956dd86c5ea6c8d69ede1c05876ce06520f81ce2c2a0688d49ad72adcceac1973c720586579e735d7708054b819204a640

Download Submit
\Windows\system\zIqCdUf.exe

Filesize
1.9MB

MD5
d814ff1533c3d8c5a419e34ecc962123

SHA1
76740d3c72ea1de79822f965fc472e7638fa7038

SHA256
2aff5e506dbb0a9de3751c9e0de762d8d68c154ed6fd0bd2bb40ec08583ee52b

SHA512
a86a6c2b0358211fd81dba7e60afcf52d26f6e92f122b35643b1cd2a2c7d470299250d9cab353237e0874363b6018d97e97343867357d06bc298356233cf586f

Download Submit
\Windows\system\zfDxjVR.exe

Filesize
1.9MB

MD5
05f8ac6eb9e3e2bb673346724bc84bfd

SHA1
f1809e52da0ee1cf876b4e59884f7e48ec0063af

SHA256
b8402da2fb9592d43b8f7fd7922e22e2a48a7720fbc555d4754d1d8704f59af2

SHA512
6f1150a7119b0ca154a31a56d3b6c8684cdf2bcf91d873f8152e1af87443bc9b48e9bc8b641fd5b06f8fa3c73de6a6d011998953cd64b17ab1873a6df27ecba7

Download Submit
memory/1152-130-0x000000013F8B0000-0x000000013FCA2000-memory.dmp

Filesize
3.9MB

Download
memory/1152-2238-0x000000013F8B0000-0x000000013FCA2000-memory.dmp

Filesize
3.9MB

Download
memory/1480-2239-0x000000013F420000-0x000000013F812000-memory.dmp

Filesize
3.9MB

Download
memory/1480-144-0x000000013F420000-0x000000013F812000-memory.dmp

Filesize
3.9MB

Download
memory/1612-2232-0x000000013FB50000-0x000000013FF42000-memory.dmp

Filesize
3.9MB

Download
memory/1612-13-0x000000013FB50000-0x000000013FF42000-memory.dmp

Filesize
3.9MB

Download
memory/1628-146-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download
memory/1628-2243-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download
memory/2320-140-0x000000013F8D0000-0x000000013FCC2000-memory.dmp

Filesize
3.9MB

Download
memory/2320-2240-0x000000013F8D0000-0x000000013FCC2000-memory.dmp

Filesize
3.9MB

Download
memory/2404-2241-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2404-138-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2436-136-0x000000013FE80000-0x0000000140272000-memory.dmp

Filesize
3.9MB

Download
memory/2436-2236-0x000000013FE80000-0x0000000140272000-memory.dmp

Filesize
3.9MB

Download
memory/2568-134-0x000000013F8A0000-0x000000013FC92000-memory.dmp

Filesize
3.9MB

Download
memory/2568-2237-0x000000013F8A0000-0x000000013FC92000-memory.dmp

Filesize
3.9MB

Download
memory/2664-2234-0x000000013F5F0000-0x000000013F9E2000-memory.dmp

Filesize
3.9MB

Download
memory/2664-126-0x000000013F5F0000-0x000000013F9E2000-memory.dmp

Filesize
3.9MB

Download
memory/2712-128-0x000000013F820000-0x000000013FC12000-memory.dmp

Filesize
3.9MB

Download
memory/2712-2233-0x000000013F820000-0x000000013FC12000-memory.dmp

Filesize
3.9MB

Download
memory/2944-2235-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/2944-132-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/2968-121-0x000007FEF5C90000-0x000007FEF662D000-memory.dmp

Filesize
9.6MB

Download
memory/2968-74-0x000000001B2C0000-0x000000001B5A2000-memory.dmp

Filesize
2.9MB

Download
memory/2968-14-0x000007FEF5F4E000-0x000007FEF5F4F000-memory.dmp

Filesize
4KB

Download
memory/2968-75-0x00000000023F0000-0x00000000023F8000-memory.dmp

Filesize
32KB

Download
memory/2968-147-0x000007FEF5C90000-0x000007FEF662D000-memory.dmp

Filesize
9.6MB

Download
memory/2968-235-0x000007FEF5C90000-0x000007FEF662D000-memory.dmp

Filesize
9.6MB

Download
memory/2968-97-0x000007FEF5C90000-0x000007FEF662D000-memory.dmp

Filesize
9.6MB

Download
memory/3016-133-0x000000013F8A0000-0x000000013FC92000-memory.dmp

Filesize
3.9MB

Download
memory/3016-145-0x00000000033D0000-0x00000000037C2000-memory.dmp

Filesize
3.9MB

Download
memory/3016-135-0x000000013FE80000-0x0000000140272000-memory.dmp

Filesize
3.9MB

Download
memory/3016-139-0x000000013F8D0000-0x000000013FCC2000-memory.dmp

Filesize
3.9MB

Download
memory/3016-141-0x00000000033D0000-0x00000000037C2000-memory.dmp

Filesize
3.9MB

Download
memory/3016-1-0x0000000000300000-0x0000000000310000-memory.dmp

Filesize
64KB

Download
memory/3016-143-0x00000000033D0000-0x00000000037C2000-memory.dmp

Filesize
3.9MB

Download
memory/3016-137-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/3016-0-0x000000013F3A0000-0x000000013F792000-memory.dmp

Filesize
3.9MB

Download
memory/3016-131-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/3016-129-0x000000013F8B0000-0x000000013FCA2000-memory.dmp

Filesize
3.9MB

Download
memory/3016-127-0x000000013F820000-0x000000013FC12000-memory.dmp

Filesize
3.9MB

Download
memory/3016-8-0x000000013FB50000-0x000000013FF42000-memory.dmp

Filesize
3.9MB

Download
memory/3016-125-0x0000000002EC0000-0x00000000032B2000-memory.dmp

Filesize
3.9MB

Download
memory/3028-2242-0x000000013F750000-0x000000013FB42000-memory.dmp

Filesize
3.9MB

Download
memory/3028-142-0x000000013F750000-0x000000013FB42000-memory.dmp

Filesize
3.9MB

Download