xmrig | 265179604493c718ff76d7e31467fe866294d414e320eb015031cbf63174df63

Analysis

max time kernel
150s
max time network
146s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 09:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
Size

2.0MB
MD5

12134060b4e3d09aedb7e1f404a8976a
SHA1

0c6ea60f888a1a483e908c23483692883b61e17b
SHA256

265179604493c718ff76d7e31467fe866294d414e320eb015031cbf63174df63
SHA512

69d9849b2fb5c2b2443191c81b89888673aac30a52036980b1fea0efcfd960bee9d532b8274c4d1319afdd420c47d81ce8ce75972938f6d2bed614b1c0c7d4f8
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafHt:NAB4

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 14 IoCs

miner

resource	yara_rule
behavioral1/memory/2072-208-0x000000013F540000-0x000000013F932000-memory.dmp	xmrig
behavioral1/memory/2104-88-0x000000013F480000-0x000000013F872000-memory.dmp	xmrig
behavioral1/memory/2644-50-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	xmrig
behavioral1/memory/2624-5187-0x000000013F330000-0x000000013F722000-memory.dmp	xmrig
behavioral1/memory/2568-6838-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	xmrig
behavioral1/memory/2616-6839-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	xmrig
behavioral1/memory/2868-6840-0x000000013F130000-0x000000013F522000-memory.dmp	xmrig
behavioral1/memory/2472-6841-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	xmrig
behavioral1/memory/2652-6842-0x000000013F090000-0x000000013F482000-memory.dmp	xmrig
behavioral1/memory/2736-6846-0x000000013F0A0000-0x000000013F492000-memory.dmp	xmrig
behavioral1/memory/2644-6845-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	xmrig
behavioral1/memory/2776-6844-0x000000013FA20000-0x000000013FE12000-memory.dmp	xmrig
behavioral1/memory/3064-6843-0x000000013F3A0000-0x000000013F792000-memory.dmp	xmrig
behavioral1/memory/2072-6848-0x000000013F540000-0x000000013F932000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1160	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2072	okLbkLb.exe
2644	ENDQDgw.exe
2624	frRlBeK.exe
2568	GsltqFi.exe
2868	ndwzQef.exe
2472	jEXshkO.exe
2616	yWlVrXD.exe
2652	fcvSadt.exe
3064	Pdabprh.exe
2776	nquLBcL.exe
2736	RrcKvzy.exe
3008	IPxAjjL.exe
2424	cOzgxrm.exe
1844	VGRFWSC.exe
2496	OGCBkdu.exe
2808	qfiXwGB.exe
1904	RhztoFp.exe
832	KFNFHQP.exe
2260	ZgmhOLH.exe
676	KdXKJsj.exe
2872	JNFpUnn.exe
1452	zgZGrhL.exe
1040	QPOrXrI.exe
2172	haYVyyo.exe
1804	nikdevG.exe
740	WBOGLfo.exe
1156	ASOoWzz.exe
2884	MkSvewK.exe
1944	uJbzWBg.exe
1396	qPCIMDt.exe
1712	mAtviMQ.exe
752	UPPJZoA.exe
2352	qCNTGZb.exe
3044	ehlKSzE.exe
2896	hwWHEiC.exe
1028	KctEUVx.exe
876	IEKTVMX.exe
2208	aJvQWeo.exe
1604	NDvzxmG.exe
564	VHvUcno.exe
2528	NcWGway.exe
2944	HOivlyy.exe
1332	LIVjNev.exe
1084	eZjpibY.exe
1644	eeLuLLs.exe
1080	gqiUGfO.exe
1864	qhbQDno.exe
2372	WSGzldB.exe
804	ckqnDKH.exe
3088	RwKneOc.exe
3120	hTmMgMp.exe
3152	GFiWrKg.exe
3184	cLIGJBj.exe
3216	xjUBMTj.exe
3248	gfwhfwr.exe
3280	JgOhqZh.exe
3312	WWFZAxV.exe
3344	NACaoDe.exe
3380	XKPYopp.exe
3412	aoJsjrO.exe
3444	TKLtBrv.exe
3476	dMDzVXS.exe
3508	iJzjuiV.exe
3540	yDywqYB.exe

Loads dropped DLL 64 IoCs

pid	Process
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2072-18-0x000000013F540000-0x000000013F932000-memory.dmp	upx
behavioral1/memory/2568-60-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	upx
behavioral1/memory/3064-71-0x000000013F3A0000-0x000000013F792000-memory.dmp	upx
behavioral1/memory/2736-76-0x000000013F0A0000-0x000000013F492000-memory.dmp	upx
behavioral1/files/0x0006000000015d8f-112.dat	upx
behavioral1/files/0x0006000000015d79-106.dat	upx
behavioral1/files/0x0006000000016d1e-184.dat	upx
behavioral1/memory/2072-208-0x000000013F540000-0x000000013F932000-memory.dmp	upx
behavioral1/files/0x0006000000016d0d-179.dat	upx
behavioral1/files/0x0006000000016cb7-172.dat	upx
behavioral1/files/0x0006000000016c63-165.dat	upx
behavioral1/files/0x0006000000016a9a-158.dat	upx
behavioral1/files/0x000600000001661c-151.dat	upx
behavioral1/files/0x00060000000164b2-144.dat	upx
behavioral1/files/0x00060000000161e7-137.dat	upx
behavioral1/files/0x0006000000015fe9-130.dat	upx
behavioral1/files/0x0006000000015eaf-123.dat	upx
behavioral1/files/0x0006000000015d9b-116.dat	upx
behavioral1/files/0x0006000000015d87-109.dat	upx
behavioral1/files/0x0006000000015d6f-99.dat	upx
behavioral1/files/0x0007000000004e76-89.dat	upx
behavioral1/memory/2104-88-0x000000013F480000-0x000000013F872000-memory.dmp	upx
behavioral1/files/0x0007000000015ce1-32.dat	upx
behavioral1/files/0x0007000000015d5e-87.dat	upx
behavioral1/files/0x0007000000014b63-27.dat	upx
behavioral1/files/0x0006000000015d4a-78.dat	upx
behavioral1/files/0x0006000000015d07-38.dat	upx
behavioral1/files/0x0006000000016ce4-177.dat	upx
behavioral1/files/0x0006000000016c6b-170.dat	upx
behavioral1/files/0x0006000000016c4a-163.dat	upx
behavioral1/files/0x0006000000016843-156.dat	upx
behavioral1/files/0x0006000000016572-149.dat	upx
behavioral1/files/0x000600000001630b-142.dat	upx
behavioral1/files/0x0006000000016117-135.dat	upx
behavioral1/files/0x0006000000015f6d-128.dat	upx
behavioral1/files/0x0006000000015e3a-121.dat	upx
behavioral1/files/0x0006000000015d67-97.dat	upx
behavioral1/memory/2776-74-0x000000013FA20000-0x000000013FE12000-memory.dmp	upx
behavioral1/memory/2652-69-0x000000013F090000-0x000000013F482000-memory.dmp	upx
behavioral1/memory/2616-68-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/files/0x000a000000014bea-67.dat	upx
behavioral1/memory/2472-62-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	upx
behavioral1/memory/2868-61-0x000000013F130000-0x000000013F522000-memory.dmp	upx
behavioral1/memory/2624-59-0x000000013F330000-0x000000013F722000-memory.dmp	upx
behavioral1/files/0x0006000000015d28-58.dat	upx
behavioral1/files/0x0006000000015ceb-57.dat	upx
behavioral1/files/0x000a000000014e51-56.dat	upx
behavioral1/files/0x0007000000014baa-55.dat	upx
behavioral1/files/0x0007000000014b27-54.dat	upx
behavioral1/files/0x000c0000000144e4-53.dat	upx
behavioral1/memory/2644-50-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	upx
behavioral1/memory/2104-5-0x000000013F480000-0x000000013F872000-memory.dmp	upx
behavioral1/files/0x003400000001471d-10.dat	upx
behavioral1/memory/2624-5187-0x000000013F330000-0x000000013F722000-memory.dmp	upx
behavioral1/memory/2568-6838-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	upx
behavioral1/memory/2616-6839-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/memory/2868-6840-0x000000013F130000-0x000000013F522000-memory.dmp	upx
behavioral1/memory/2472-6841-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	upx
behavioral1/memory/2652-6842-0x000000013F090000-0x000000013F482000-memory.dmp	upx
behavioral1/memory/2736-6846-0x000000013F0A0000-0x000000013F492000-memory.dmp	upx
behavioral1/memory/2644-6845-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	upx
behavioral1/memory/2776-6844-0x000000013FA20000-0x000000013FE12000-memory.dmp	upx
behavioral1/memory/3064-6843-0x000000013F3A0000-0x000000013F792000-memory.dmp	upx
behavioral1/memory/2072-6848-0x000000013F540000-0x000000013F932000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\eTaNnTy.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\tdqrBfl.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\puUdQNg.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\iKNVpVG.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\vqzAlSw.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\KfMMGjQ.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\UkPZTdL.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\mQjecyj.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\XhZaqVT.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\cpgTtEn.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\JbmDRNl.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\BisKzjf.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\CcMtpub.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\XalKfOw.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\nbAkixu.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\YfJcgMP.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\WJqeCQc.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\BazgdbA.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\CkDEkcH.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\blIOkDx.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\ttagtvz.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\HrewNzB.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\rkyXjqs.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\SRvqGOh.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\UXkIGDp.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\KWERQJS.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\NtiPVAW.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\RhztoFp.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\SBdFxUy.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\ZxmEkQg.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\VIIURgh.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\JEJFFSz.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\RgxSxiK.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\FVTeABB.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\gRhTPak.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\kkHVOma.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\wOGuaYk.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\sJqPmOR.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\YKkeoIk.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\bXwICOb.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\fHTqoJb.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\uzcQYtI.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\hDsDUZw.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\VqwRhsT.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\pCrcDWZ.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\xDSedtY.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\OdSErVQ.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\ZlDPMQt.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\UQiSxKc.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\IUdLnpb.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\wrDGNNo.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\RNfbXIk.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\sOKHFIl.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\xOajsIv.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\qvIOkLr.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\HYtHYbG.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\kHRqdSb.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\zpmpcjW.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\qulRnDs.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\uxAwKpn.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\HXrqMkm.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\gTuTfrz.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\mIrMlsr.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
File created	C:\Windows\System\OopTARw.exe	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1160	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
Token: SeDebugPrivilege	1160	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 1160	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	29
PID 2104 wrote to memory of 1160	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	29
PID 2104 wrote to memory of 1160	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	29
PID 2104 wrote to memory of 2624	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	30
PID 2104 wrote to memory of 2624	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	30
PID 2104 wrote to memory of 2624	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	30
PID 2104 wrote to memory of 2072	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	31
PID 2104 wrote to memory of 2072	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	31
PID 2104 wrote to memory of 2072	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	31
PID 2104 wrote to memory of 2568	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	32
PID 2104 wrote to memory of 2568	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	32
PID 2104 wrote to memory of 2568	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	32
PID 2104 wrote to memory of 2644	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	33
PID 2104 wrote to memory of 2644	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	33
PID 2104 wrote to memory of 2644	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	33
PID 2104 wrote to memory of 2868	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	34
PID 2104 wrote to memory of 2868	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	34
PID 2104 wrote to memory of 2868	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	34
PID 2104 wrote to memory of 3064	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	35
PID 2104 wrote to memory of 3064	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	35
PID 2104 wrote to memory of 3064	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	35
PID 2104 wrote to memory of 2472	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	36
PID 2104 wrote to memory of 2472	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	36
PID 2104 wrote to memory of 2472	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	36
PID 2104 wrote to memory of 2776	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	37
PID 2104 wrote to memory of 2776	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	37
PID 2104 wrote to memory of 2776	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	37
PID 2104 wrote to memory of 2616	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	38
PID 2104 wrote to memory of 2616	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	38
PID 2104 wrote to memory of 2616	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	38
PID 2104 wrote to memory of 2736	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	39
PID 2104 wrote to memory of 2736	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	39
PID 2104 wrote to memory of 2736	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	39
PID 2104 wrote to memory of 2652	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	40
PID 2104 wrote to memory of 2652	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	40
PID 2104 wrote to memory of 2652	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	40
PID 2104 wrote to memory of 2988	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	41
PID 2104 wrote to memory of 2988	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	41
PID 2104 wrote to memory of 2988	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	41
PID 2104 wrote to memory of 3008	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	42
PID 2104 wrote to memory of 3008	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	42
PID 2104 wrote to memory of 3008	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	42
PID 2104 wrote to memory of 2128	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	43
PID 2104 wrote to memory of 2128	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	43
PID 2104 wrote to memory of 2128	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	43
PID 2104 wrote to memory of 2424	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	44
PID 2104 wrote to memory of 2424	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	44
PID 2104 wrote to memory of 2424	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	44
PID 2104 wrote to memory of 1556	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	45
PID 2104 wrote to memory of 1556	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	45
PID 2104 wrote to memory of 1556	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	45
PID 2104 wrote to memory of 1844	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	46
PID 2104 wrote to memory of 1844	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	46
PID 2104 wrote to memory of 1844	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	46
PID 2104 wrote to memory of 2504	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	47
PID 2104 wrote to memory of 2504	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	47
PID 2104 wrote to memory of 2504	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	47
PID 2104 wrote to memory of 2496	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	48
PID 2104 wrote to memory of 2496	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	48
PID 2104 wrote to memory of 2496	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	48
PID 2104 wrote to memory of 2764	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	49
PID 2104 wrote to memory of 2764	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	49
PID 2104 wrote to memory of 2764	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	49
PID 2104 wrote to memory of 2808	2104	12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\12134060b4e3d09aedb7e1f404a8976a_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1160
- C:\Windows\System\frRlBeK.exe
  C:\Windows\System\frRlBeK.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\okLbkLb.exe
  C:\Windows\System\okLbkLb.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\GsltqFi.exe
  C:\Windows\System\GsltqFi.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\ENDQDgw.exe
  C:\Windows\System\ENDQDgw.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\ndwzQef.exe
  C:\Windows\System\ndwzQef.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\Pdabprh.exe
  C:\Windows\System\Pdabprh.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\jEXshkO.exe
  C:\Windows\System\jEXshkO.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\nquLBcL.exe
  C:\Windows\System\nquLBcL.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\yWlVrXD.exe
  C:\Windows\System\yWlVrXD.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\RrcKvzy.exe
  C:\Windows\System\RrcKvzy.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\fcvSadt.exe
  C:\Windows\System\fcvSadt.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\dyYRbto.exe
  C:\Windows\System\dyYRbto.exe
  2⤵
  PID:2988
- C:\Windows\System\IPxAjjL.exe
  C:\Windows\System\IPxAjjL.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\VudQNVH.exe
  C:\Windows\System\VudQNVH.exe
  2⤵
  PID:2128
- C:\Windows\System\cOzgxrm.exe
  C:\Windows\System\cOzgxrm.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\DPDjjHv.exe
  C:\Windows\System\DPDjjHv.exe
  2⤵
  PID:1556
- C:\Windows\System\VGRFWSC.exe
  C:\Windows\System\VGRFWSC.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\izOndEM.exe
  C:\Windows\System\izOndEM.exe
  2⤵
  PID:2504
- C:\Windows\System\OGCBkdu.exe
  C:\Windows\System\OGCBkdu.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\VbVtNLG.exe
  C:\Windows\System\VbVtNLG.exe
  2⤵
  PID:2764
- C:\Windows\System\qfiXwGB.exe
  C:\Windows\System\qfiXwGB.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\AslzjjH.exe
  C:\Windows\System\AslzjjH.exe
  2⤵
  PID:2832
- C:\Windows\System\RhztoFp.exe
  C:\Windows\System\RhztoFp.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\DJfbnKr.exe
  C:\Windows\System\DJfbnKr.exe
  2⤵
  PID:1324
- C:\Windows\System\KFNFHQP.exe
  C:\Windows\System\KFNFHQP.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\LpFoqkL.exe
  C:\Windows\System\LpFoqkL.exe
  2⤵
  PID:540
- C:\Windows\System\ZgmhOLH.exe
  C:\Windows\System\ZgmhOLH.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\xWMKiZa.exe
  C:\Windows\System\xWMKiZa.exe
  2⤵
  PID:1964
- C:\Windows\System\KdXKJsj.exe
  C:\Windows\System\KdXKJsj.exe
  2⤵
  - Executes dropped EXE
  PID:676
- C:\Windows\System\eNDbkjz.exe
  C:\Windows\System\eNDbkjz.exe
  2⤵
  PID:2876
- C:\Windows\System\JNFpUnn.exe
  C:\Windows\System\JNFpUnn.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\ZQDOHHp.exe
  C:\Windows\System\ZQDOHHp.exe
  2⤵
  PID:1776
- C:\Windows\System\zgZGrhL.exe
  C:\Windows\System\zgZGrhL.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\NjohUAE.exe
  C:\Windows\System\NjohUAE.exe
  2⤵
  PID:984
- C:\Windows\System\QPOrXrI.exe
  C:\Windows\System\QPOrXrI.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\xqmWFXU.exe
  C:\Windows\System\xqmWFXU.exe
  2⤵
  PID:588
- C:\Windows\System\haYVyyo.exe
  C:\Windows\System\haYVyyo.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\oRTqNSg.exe
  C:\Windows\System\oRTqNSg.exe
  2⤵
  PID:1596
- C:\Windows\System\nikdevG.exe
  C:\Windows\System\nikdevG.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\wjNUNfs.exe
  C:\Windows\System\wjNUNfs.exe
  2⤵
  PID:1592
- C:\Windows\System\WBOGLfo.exe
  C:\Windows\System\WBOGLfo.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\YYRgFDI.exe
  C:\Windows\System\YYRgFDI.exe
  2⤵
  PID:2396
- C:\Windows\System\ASOoWzz.exe
  C:\Windows\System\ASOoWzz.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\EnHoYwr.exe
  C:\Windows\System\EnHoYwr.exe
  2⤵
  PID:2368
- C:\Windows\System\MkSvewK.exe
  C:\Windows\System\MkSvewK.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\OZqWWPE.exe
  C:\Windows\System\OZqWWPE.exe
  2⤵
  PID:1532
- C:\Windows\System\uJbzWBg.exe
  C:\Windows\System\uJbzWBg.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\MAaJKvo.exe
  C:\Windows\System\MAaJKvo.exe
  2⤵
  PID:1288
- C:\Windows\System\qPCIMDt.exe
  C:\Windows\System\qPCIMDt.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\YpozSVU.exe
  C:\Windows\System\YpozSVU.exe
  2⤵
  PID:1304
- C:\Windows\System\mAtviMQ.exe
  C:\Windows\System\mAtviMQ.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\UJBToNK.exe
  C:\Windows\System\UJBToNK.exe
  2⤵
  PID:764
- C:\Windows\System\UPPJZoA.exe
  C:\Windows\System\UPPJZoA.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\yMSJEcP.exe
  C:\Windows\System\yMSJEcP.exe
  2⤵
  PID:2848
- C:\Windows\System\qCNTGZb.exe
  C:\Windows\System\qCNTGZb.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\pfUWKWf.exe
  C:\Windows\System\pfUWKWf.exe
  2⤵
  PID:1656
- C:\Windows\System\ehlKSzE.exe
  C:\Windows\System\ehlKSzE.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\Jgyteha.exe
  C:\Windows\System\Jgyteha.exe
  2⤵
  PID:1940
- C:\Windows\System\hwWHEiC.exe
  C:\Windows\System\hwWHEiC.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\Ezuzmal.exe
  C:\Windows\System\Ezuzmal.exe
  2⤵
  PID:2296
- C:\Windows\System\KctEUVx.exe
  C:\Windows\System\KctEUVx.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\xzdxHlH.exe
  C:\Windows\System\xzdxHlH.exe
  2⤵
  PID:1504
- C:\Windows\System\IEKTVMX.exe
  C:\Windows\System\IEKTVMX.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\nMnoutw.exe
  C:\Windows\System\nMnoutw.exe
  2⤵
  PID:2236
- C:\Windows\System\aJvQWeo.exe
  C:\Windows\System\aJvQWeo.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\gwKtibd.exe
  C:\Windows\System\gwKtibd.exe
  2⤵
  PID:1808
- C:\Windows\System\NDvzxmG.exe
  C:\Windows\System\NDvzxmG.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\KUfCVEZ.exe
  C:\Windows\System\KUfCVEZ.exe
  2⤵
  PID:1188
- C:\Windows\System\VHvUcno.exe
  C:\Windows\System\VHvUcno.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System\RVVXHaL.exe
  C:\Windows\System\RVVXHaL.exe
  2⤵
  PID:2444
- C:\Windows\System\NcWGway.exe
  C:\Windows\System\NcWGway.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\OeXEDSW.exe
  C:\Windows\System\OeXEDSW.exe
  2⤵
  PID:2008
- C:\Windows\System\HOivlyy.exe
  C:\Windows\System\HOivlyy.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\XQfOShp.exe
  C:\Windows\System\XQfOShp.exe
  2⤵
  PID:2100
- C:\Windows\System\LIVjNev.exe
  C:\Windows\System\LIVjNev.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\FgnzOmC.exe
  C:\Windows\System\FgnzOmC.exe
  2⤵
  PID:2812
- C:\Windows\System\eZjpibY.exe
  C:\Windows\System\eZjpibY.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\YiGafXg.exe
  C:\Windows\System\YiGafXg.exe
  2⤵
  PID:488
- C:\Windows\System\eeLuLLs.exe
  C:\Windows\System\eeLuLLs.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\VTTuPaG.exe
  C:\Windows\System\VTTuPaG.exe
  2⤵
  PID:1796
- C:\Windows\System\gqiUGfO.exe
  C:\Windows\System\gqiUGfO.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\WeegVqq.exe
  C:\Windows\System\WeegVqq.exe
  2⤵
  PID:1536
- C:\Windows\System\qhbQDno.exe
  C:\Windows\System\qhbQDno.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\uRaMguX.exe
  C:\Windows\System\uRaMguX.exe
  2⤵
  PID:928
- C:\Windows\System\WSGzldB.exe
  C:\Windows\System\WSGzldB.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\uijyAEa.exe
  C:\Windows\System\uijyAEa.exe
  2⤵
  PID:2136
- C:\Windows\System\ckqnDKH.exe
  C:\Windows\System\ckqnDKH.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\xTWTGbO.exe
  C:\Windows\System\xTWTGbO.exe
  2⤵
  PID:2748
- C:\Windows\System\RwKneOc.exe
  C:\Windows\System\RwKneOc.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\ZUPEnJz.exe
  C:\Windows\System\ZUPEnJz.exe
  2⤵
  PID:3104
- C:\Windows\System\hTmMgMp.exe
  C:\Windows\System\hTmMgMp.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\PKbciFO.exe
  C:\Windows\System\PKbciFO.exe
  2⤵
  PID:3136
- C:\Windows\System\GFiWrKg.exe
  C:\Windows\System\GFiWrKg.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\HYogrMm.exe
  C:\Windows\System\HYogrMm.exe
  2⤵
  PID:3168
- C:\Windows\System\cLIGJBj.exe
  C:\Windows\System\cLIGJBj.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\VRrLsMO.exe
  C:\Windows\System\VRrLsMO.exe
  2⤵
  PID:3200
- C:\Windows\System\xjUBMTj.exe
  C:\Windows\System\xjUBMTj.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\aaYngjI.exe
  C:\Windows\System\aaYngjI.exe
  2⤵
  PID:3232
- C:\Windows\System\gfwhfwr.exe
  C:\Windows\System\gfwhfwr.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\jKWUUND.exe
  C:\Windows\System\jKWUUND.exe
  2⤵
  PID:3264
- C:\Windows\System\JgOhqZh.exe
  C:\Windows\System\JgOhqZh.exe
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Windows\System\VWeGPXH.exe
  C:\Windows\System\VWeGPXH.exe
  2⤵
  PID:3296
- C:\Windows\System\WWFZAxV.exe
  C:\Windows\System\WWFZAxV.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\smcBrEJ.exe
  C:\Windows\System\smcBrEJ.exe
  2⤵
  PID:3328
- C:\Windows\System\NACaoDe.exe
  C:\Windows\System\NACaoDe.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System\gdnPoJX.exe
  C:\Windows\System\gdnPoJX.exe
  2⤵
  PID:3364
- C:\Windows\System\XKPYopp.exe
  C:\Windows\System\XKPYopp.exe
  2⤵
  - Executes dropped EXE
  PID:3380
- C:\Windows\System\JwQTJtU.exe
  C:\Windows\System\JwQTJtU.exe
  2⤵
  PID:3396
- C:\Windows\System\aoJsjrO.exe
  C:\Windows\System\aoJsjrO.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\vhllXFh.exe
  C:\Windows\System\vhllXFh.exe
  2⤵
  PID:3428
- C:\Windows\System\TKLtBrv.exe
  C:\Windows\System\TKLtBrv.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\NINWZLL.exe
  C:\Windows\System\NINWZLL.exe
  2⤵
  PID:3460
- C:\Windows\System\dMDzVXS.exe
  C:\Windows\System\dMDzVXS.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\UmNhPPE.exe
  C:\Windows\System\UmNhPPE.exe
  2⤵
  PID:3492
- C:\Windows\System\iJzjuiV.exe
  C:\Windows\System\iJzjuiV.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\RAqVAmU.exe
  C:\Windows\System\RAqVAmU.exe
  2⤵
  PID:3524
- C:\Windows\System\yDywqYB.exe
  C:\Windows\System\yDywqYB.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\MPMEGUz.exe
  C:\Windows\System\MPMEGUz.exe
  2⤵
  PID:3556
- C:\Windows\System\joWybyw.exe
  C:\Windows\System\joWybyw.exe
  2⤵
  PID:3572
- C:\Windows\System\YEkHjhk.exe
  C:\Windows\System\YEkHjhk.exe
  2⤵
  PID:3588
- C:\Windows\System\nuNibWQ.exe
  C:\Windows\System\nuNibWQ.exe
  2⤵
  PID:3604
- C:\Windows\System\iAntkfG.exe
  C:\Windows\System\iAntkfG.exe
  2⤵
  PID:3620
- C:\Windows\System\YXZcikd.exe
  C:\Windows\System\YXZcikd.exe
  2⤵
  PID:3636
- C:\Windows\System\vLfbYWE.exe
  C:\Windows\System\vLfbYWE.exe
  2⤵
  PID:3652
- C:\Windows\System\buCwvLY.exe
  C:\Windows\System\buCwvLY.exe
  2⤵
  PID:3668
- C:\Windows\System\faswsXu.exe
  C:\Windows\System\faswsXu.exe
  2⤵
  PID:3684
- C:\Windows\System\PzZArAT.exe
  C:\Windows\System\PzZArAT.exe
  2⤵
  PID:3700
- C:\Windows\System\hWqzFMh.exe
  C:\Windows\System\hWqzFMh.exe
  2⤵
  PID:3716
- C:\Windows\System\cSSkpGp.exe
  C:\Windows\System\cSSkpGp.exe
  2⤵
  PID:3732
- C:\Windows\System\OtHAzVq.exe
  C:\Windows\System\OtHAzVq.exe
  2⤵
  PID:3748
- C:\Windows\System\tqbKLuX.exe
  C:\Windows\System\tqbKLuX.exe
  2⤵
  PID:3764
- C:\Windows\System\jxDDUkZ.exe
  C:\Windows\System\jxDDUkZ.exe
  2⤵
  PID:3780
- C:\Windows\System\fCEvgzd.exe
  C:\Windows\System\fCEvgzd.exe
  2⤵
  PID:3796
- C:\Windows\System\WcgDKab.exe
  C:\Windows\System\WcgDKab.exe
  2⤵
  PID:3812
- C:\Windows\System\OvRIckn.exe
  C:\Windows\System\OvRIckn.exe
  2⤵
  PID:3828
- C:\Windows\System\mEPrDel.exe
  C:\Windows\System\mEPrDel.exe
  2⤵
  PID:3844
- C:\Windows\System\jwAsVOX.exe
  C:\Windows\System\jwAsVOX.exe
  2⤵
  PID:3860
- C:\Windows\System\tkkQPdt.exe
  C:\Windows\System\tkkQPdt.exe
  2⤵
  PID:3876
- C:\Windows\System\UgMnHNV.exe
  C:\Windows\System\UgMnHNV.exe
  2⤵
  PID:3892
- C:\Windows\System\cMqMyLa.exe
  C:\Windows\System\cMqMyLa.exe
  2⤵
  PID:3908
- C:\Windows\System\cIXfdNG.exe
  C:\Windows\System\cIXfdNG.exe
  2⤵
  PID:3924
- C:\Windows\System\mSbfnaT.exe
  C:\Windows\System\mSbfnaT.exe
  2⤵
  PID:3940
- C:\Windows\System\DZXYbPw.exe
  C:\Windows\System\DZXYbPw.exe
  2⤵
  PID:3956
- C:\Windows\System\wUlWhME.exe
  C:\Windows\System\wUlWhME.exe
  2⤵
  PID:3972
- C:\Windows\System\jMEusKw.exe
  C:\Windows\System\jMEusKw.exe
  2⤵
  PID:3988
- C:\Windows\System\TtszwrX.exe
  C:\Windows\System\TtszwrX.exe
  2⤵
  PID:4004
- C:\Windows\System\fMupFIT.exe
  C:\Windows\System\fMupFIT.exe
  2⤵
  PID:4020
- C:\Windows\System\uWfGsqv.exe
  C:\Windows\System\uWfGsqv.exe
  2⤵
  PID:4036
- C:\Windows\System\zBggJKl.exe
  C:\Windows\System\zBggJKl.exe
  2⤵
  PID:4052
- C:\Windows\System\gGlZPaj.exe
  C:\Windows\System\gGlZPaj.exe
  2⤵
  PID:4068
- C:\Windows\System\PaZETsT.exe
  C:\Windows\System\PaZETsT.exe
  2⤵
  PID:4084
- C:\Windows\System\sbHFJll.exe
  C:\Windows\System\sbHFJll.exe
  2⤵
  PID:2548
- C:\Windows\System\zpodGdI.exe
  C:\Windows\System\zpodGdI.exe
  2⤵
  PID:2716
- C:\Windows\System\sQLPIVs.exe
  C:\Windows\System\sQLPIVs.exe
  2⤵
  PID:1640
- C:\Windows\System\CShvNLU.exe
  C:\Windows\System\CShvNLU.exe
  2⤵
  PID:2536
- C:\Windows\System\gBqNuBo.exe
  C:\Windows\System\gBqNuBo.exe
  2⤵
  PID:2344
- C:\Windows\System\kmoHDfJ.exe
  C:\Windows\System\kmoHDfJ.exe
  2⤵
  PID:3128
- C:\Windows\System\XalKfOw.exe
  C:\Windows\System\XalKfOw.exe
  2⤵
  PID:2592
- C:\Windows\System\uYHPsTU.exe
  C:\Windows\System\uYHPsTU.exe
  2⤵
  PID:2756
- C:\Windows\System\HeViXcf.exe
  C:\Windows\System\HeViXcf.exe
  2⤵
  PID:2728
- C:\Windows\System\SBmALBA.exe
  C:\Windows\System\SBmALBA.exe
  2⤵
  PID:3292
- C:\Windows\System\QxCzTEo.exe
  C:\Windows\System\QxCzTEo.exe
  2⤵
  PID:2508
- C:\Windows\System\EtltvnB.exe
  C:\Windows\System\EtltvnB.exe
  2⤵
  PID:3352
- C:\Windows\System\oYiFsPY.exe
  C:\Windows\System\oYiFsPY.exe
  2⤵
  PID:3424
- C:\Windows\System\LvGLJuy.exe
  C:\Windows\System\LvGLJuy.exe
  2⤵
  PID:2488
- C:\Windows\System\qWhyjxc.exe
  C:\Windows\System\qWhyjxc.exe
  2⤵
  PID:3516
- C:\Windows\System\ZcKsuYp.exe
  C:\Windows\System\ZcKsuYp.exe
  2⤵
  PID:3580
- C:\Windows\System\cFlslzS.exe
  C:\Windows\System\cFlslzS.exe
  2⤵
  PID:3644
- C:\Windows\System\yGRWOfS.exe
  C:\Windows\System\yGRWOfS.exe
  2⤵
  PID:3708
- C:\Windows\System\mWLohzz.exe
  C:\Windows\System\mWLohzz.exe
  2⤵
  PID:3772
- C:\Windows\System\uXpDeOf.exe
  C:\Windows\System\uXpDeOf.exe
  2⤵
  PID:3836
- C:\Windows\System\ukFmwin.exe
  C:\Windows\System\ukFmwin.exe
  2⤵
  PID:3900
- C:\Windows\System\ZpGrAxF.exe
  C:\Windows\System\ZpGrAxF.exe
  2⤵
  PID:3964
- C:\Windows\System\fwZoWsf.exe
  C:\Windows\System\fwZoWsf.exe
  2⤵
  PID:4028
- C:\Windows\System\AGXbRRY.exe
  C:\Windows\System\AGXbRRY.exe
  2⤵
  PID:4092
- C:\Windows\System\SVuJrfx.exe
  C:\Windows\System\SVuJrfx.exe
  2⤵
  PID:4112
- C:\Windows\System\LHNVvXV.exe
  C:\Windows\System\LHNVvXV.exe
  2⤵
  PID:4128
- C:\Windows\System\GPtFwrM.exe
  C:\Windows\System\GPtFwrM.exe
  2⤵
  PID:4144
- C:\Windows\System\QOccWCO.exe
  C:\Windows\System\QOccWCO.exe
  2⤵
  PID:4160
- C:\Windows\System\lSjUtto.exe
  C:\Windows\System\lSjUtto.exe
  2⤵
  PID:4176
- C:\Windows\System\CTDAmjl.exe
  C:\Windows\System\CTDAmjl.exe
  2⤵
  PID:4192
- C:\Windows\System\WsCrFQC.exe
  C:\Windows\System\WsCrFQC.exe
  2⤵
  PID:4208
- C:\Windows\System\oWfBeUX.exe
  C:\Windows\System\oWfBeUX.exe
  2⤵
  PID:4224
- C:\Windows\System\UuqJHTJ.exe
  C:\Windows\System\UuqJHTJ.exe
  2⤵
  PID:4240
- C:\Windows\System\qXwNeFn.exe
  C:\Windows\System\qXwNeFn.exe
  2⤵
  PID:4256
- C:\Windows\System\wAmmkEH.exe
  C:\Windows\System\wAmmkEH.exe
  2⤵
  PID:4272
- C:\Windows\System\DTKqChU.exe
  C:\Windows\System\DTKqChU.exe
  2⤵
  PID:4288
- C:\Windows\System\ytbhrbp.exe
  C:\Windows\System\ytbhrbp.exe
  2⤵
  PID:4304
- C:\Windows\System\udtnJjo.exe
  C:\Windows\System\udtnJjo.exe
  2⤵
  PID:4320
- C:\Windows\System\xPIbilP.exe
  C:\Windows\System\xPIbilP.exe
  2⤵
  PID:4336
- C:\Windows\System\gBMEDIy.exe
  C:\Windows\System\gBMEDIy.exe
  2⤵
  PID:4352
- C:\Windows\System\dEgJwED.exe
  C:\Windows\System\dEgJwED.exe
  2⤵
  PID:4368
- C:\Windows\System\tpgnESw.exe
  C:\Windows\System\tpgnESw.exe
  2⤵
  PID:4384
- C:\Windows\System\syxRzhc.exe
  C:\Windows\System\syxRzhc.exe
  2⤵
  PID:4400
- C:\Windows\System\qZsDgZf.exe
  C:\Windows\System\qZsDgZf.exe
  2⤵
  PID:4416
- C:\Windows\System\UBLotcH.exe
  C:\Windows\System\UBLotcH.exe
  2⤵
  PID:4432
- C:\Windows\System\jJYsmlK.exe
  C:\Windows\System\jJYsmlK.exe
  2⤵
  PID:4448
- C:\Windows\System\KFTPOul.exe
  C:\Windows\System\KFTPOul.exe
  2⤵
  PID:4464
- C:\Windows\System\qBApNvv.exe
  C:\Windows\System\qBApNvv.exe
  2⤵
  PID:4480
- C:\Windows\System\nSdbjhQ.exe
  C:\Windows\System\nSdbjhQ.exe
  2⤵
  PID:4496
- C:\Windows\System\uNaOSef.exe
  C:\Windows\System\uNaOSef.exe
  2⤵
  PID:4516
- C:\Windows\System\aGDDQnV.exe
  C:\Windows\System\aGDDQnV.exe
  2⤵
  PID:4532
- C:\Windows\System\ChKAZgP.exe
  C:\Windows\System\ChKAZgP.exe
  2⤵
  PID:4548
- C:\Windows\System\qDltHhf.exe
  C:\Windows\System\qDltHhf.exe
  2⤵
  PID:4564
- C:\Windows\System\UXqenOr.exe
  C:\Windows\System\UXqenOr.exe
  2⤵
  PID:4580
- C:\Windows\System\MoFsUZJ.exe
  C:\Windows\System\MoFsUZJ.exe
  2⤵
  PID:4596
- C:\Windows\System\jKHFTLS.exe
  C:\Windows\System\jKHFTLS.exe
  2⤵
  PID:4612
- C:\Windows\System\cNEkHki.exe
  C:\Windows\System\cNEkHki.exe
  2⤵
  PID:4628
- C:\Windows\System\RhBomkl.exe
  C:\Windows\System\RhBomkl.exe
  2⤵
  PID:4644
- C:\Windows\System\FlcXCWJ.exe
  C:\Windows\System\FlcXCWJ.exe
  2⤵
  PID:4660
- C:\Windows\System\xXDIKba.exe
  C:\Windows\System\xXDIKba.exe
  2⤵
  PID:4676
- C:\Windows\System\NtQcKfg.exe
  C:\Windows\System\NtQcKfg.exe
  2⤵
  PID:4692
- C:\Windows\System\xSrvpid.exe
  C:\Windows\System\xSrvpid.exe
  2⤵
  PID:4708
- C:\Windows\System\xFfYjxH.exe
  C:\Windows\System\xFfYjxH.exe
  2⤵
  PID:4724
- C:\Windows\System\xLUdRmx.exe
  C:\Windows\System\xLUdRmx.exe
  2⤵
  PID:4740
- C:\Windows\System\hzyAmLI.exe
  C:\Windows\System\hzyAmLI.exe
  2⤵
  PID:4756
- C:\Windows\System\gQCerdC.exe
  C:\Windows\System\gQCerdC.exe
  2⤵
  PID:4772
- C:\Windows\System\chwrXvU.exe
  C:\Windows\System\chwrXvU.exe
  2⤵
  PID:4788
- C:\Windows\System\keZBVVv.exe
  C:\Windows\System\keZBVVv.exe
  2⤵
  PID:4804
- C:\Windows\System\YvYZoek.exe
  C:\Windows\System\YvYZoek.exe
  2⤵
  PID:4820
- C:\Windows\System\zwEuLHT.exe
  C:\Windows\System\zwEuLHT.exe
  2⤵
  PID:4836
- C:\Windows\System\OLfyUcM.exe
  C:\Windows\System\OLfyUcM.exe
  2⤵
  PID:4852
- C:\Windows\System\DvPnAaY.exe
  C:\Windows\System\DvPnAaY.exe
  2⤵
  PID:4868
- C:\Windows\System\NNaidel.exe
  C:\Windows\System\NNaidel.exe
  2⤵
  PID:4884
- C:\Windows\System\PmVPXUI.exe
  C:\Windows\System\PmVPXUI.exe
  2⤵
  PID:4900
- C:\Windows\System\fJeFhME.exe
  C:\Windows\System\fJeFhME.exe
  2⤵
  PID:4916
- C:\Windows\System\qzEfuBA.exe
  C:\Windows\System\qzEfuBA.exe
  2⤵
  PID:4932
- C:\Windows\System\AOymAiv.exe
  C:\Windows\System\AOymAiv.exe
  2⤵
  PID:4948
- C:\Windows\System\peROrCM.exe
  C:\Windows\System\peROrCM.exe
  2⤵
  PID:4964
- C:\Windows\System\ZhkmAIj.exe
  C:\Windows\System\ZhkmAIj.exe
  2⤵
  PID:4980
- C:\Windows\System\zlzXqDI.exe
  C:\Windows\System\zlzXqDI.exe
  2⤵
  PID:4996
- C:\Windows\System\ilQtrpf.exe
  C:\Windows\System\ilQtrpf.exe
  2⤵
  PID:5012
- C:\Windows\System\vSJNFAh.exe
  C:\Windows\System\vSJNFAh.exe
  2⤵
  PID:5028
- C:\Windows\System\swlGKnH.exe
  C:\Windows\System\swlGKnH.exe
  2⤵
  PID:5044
- C:\Windows\System\ysyfDOB.exe
  C:\Windows\System\ysyfDOB.exe
  2⤵
  PID:5060
- C:\Windows\System\qOyBQQU.exe
  C:\Windows\System\qOyBQQU.exe
  2⤵
  PID:5076
- C:\Windows\System\tvSkDlN.exe
  C:\Windows\System\tvSkDlN.exe
  2⤵
  PID:5092
- C:\Windows\System\hloXxwU.exe
  C:\Windows\System\hloXxwU.exe
  2⤵
  PID:5108
- C:\Windows\System\UhIsmdD.exe
  C:\Windows\System\UhIsmdD.exe
  2⤵
  PID:2564
- C:\Windows\System\hvFORwD.exe
  C:\Windows\System\hvFORwD.exe
  2⤵
  PID:1888
- C:\Windows\System\wiibmsz.exe
  C:\Windows\System\wiibmsz.exe
  2⤵
  PID:2672
- C:\Windows\System\IJKarxE.exe
  C:\Windows\System\IJKarxE.exe
  2⤵
  PID:3420
- C:\Windows\System\XsWgcoy.exe
  C:\Windows\System\XsWgcoy.exe
  2⤵
  PID:3612
- C:\Windows\System\kTkBPUS.exe
  C:\Windows\System\kTkBPUS.exe
  2⤵
  PID:3744
- C:\Windows\System\LbyeFkh.exe
  C:\Windows\System\LbyeFkh.exe
  2⤵
  PID:3996
- C:\Windows\System\SVcJRdC.exe
  C:\Windows\System\SVcJRdC.exe
  2⤵
  PID:4108
- C:\Windows\System\ghAYGmd.exe
  C:\Windows\System\ghAYGmd.exe
  2⤵
  PID:4172
- C:\Windows\System\pFvpegK.exe
  C:\Windows\System\pFvpegK.exe
  2⤵
  PID:4204
- C:\Windows\System\FuUEJho.exe
  C:\Windows\System\FuUEJho.exe
  2⤵
  PID:4268
- C:\Windows\System\mZvlHDQ.exe
  C:\Windows\System\mZvlHDQ.exe
  2⤵
  PID:1192
- C:\Windows\System\YQuXiAH.exe
  C:\Windows\System\YQuXiAH.exe
  2⤵
  PID:4364
- C:\Windows\System\nqgEfgZ.exe
  C:\Windows\System\nqgEfgZ.exe
  2⤵
  PID:4424
- C:\Windows\System\dtmyrGb.exe
  C:\Windows\System\dtmyrGb.exe
  2⤵
  PID:4492
- C:\Windows\System\dvzOSwa.exe
  C:\Windows\System\dvzOSwa.exe
  2⤵
  PID:4556
- C:\Windows\System\xlQMrym.exe
  C:\Windows\System\xlQMrym.exe
  2⤵
  PID:4620
- C:\Windows\System\eOjcKsA.exe
  C:\Windows\System\eOjcKsA.exe
  2⤵
  PID:4684
- C:\Windows\System\JjTSADR.exe
  C:\Windows\System\JjTSADR.exe
  2⤵
  PID:4748
- C:\Windows\System\YdusLIG.exe
  C:\Windows\System\YdusLIG.exe
  2⤵
  PID:4812
- C:\Windows\System\EJUmNyw.exe
  C:\Windows\System\EJUmNyw.exe
  2⤵
  PID:4876
- C:\Windows\System\kzvFSJH.exe
  C:\Windows\System\kzvFSJH.exe
  2⤵
  PID:4940
- C:\Windows\System\scBiMLT.exe
  C:\Windows\System\scBiMLT.exe
  2⤵
  PID:4976
- C:\Windows\System\lJnaYnZ.exe
  C:\Windows\System\lJnaYnZ.exe
  2⤵
  PID:5040
- C:\Windows\System\qyzmsvB.exe
  C:\Windows\System\qyzmsvB.exe
  2⤵
  PID:1276
- C:\Windows\System\SAVclen.exe
  C:\Windows\System\SAVclen.exe
  2⤵
  PID:3392
- C:\Windows\System\pNkvQvc.exe
  C:\Windows\System\pNkvQvc.exe
  2⤵
  PID:4104
- C:\Windows\System\LYNMEUp.exe
  C:\Windows\System\LYNMEUp.exe
  2⤵
  PID:2796
- C:\Windows\System\RfqzhQR.exe
  C:\Windows\System\RfqzhQR.exe
  2⤵
  PID:4428
- C:\Windows\System\AYYtaMz.exe
  C:\Windows\System\AYYtaMz.exe
  2⤵
  PID:1912
- C:\Windows\System\VvqLsSB.exe
  C:\Windows\System\VvqLsSB.exe
  2⤵
  PID:4784
- C:\Windows\System\MAqdSdI.exe
  C:\Windows\System\MAqdSdI.exe
  2⤵
  PID:2056
- C:\Windows\System\XesuBFn.exe
  C:\Windows\System\XesuBFn.exe
  2⤵
  PID:4912
- C:\Windows\System\FnycETt.exe
  C:\Windows\System\FnycETt.exe
  2⤵
  PID:1820
- C:\Windows\System\alDKWEL.exe
  C:\Windows\System\alDKWEL.exe
  2⤵
  PID:580
- C:\Windows\System\opfxnAg.exe
  C:\Windows\System\opfxnAg.exe
  2⤵
  PID:5132
- C:\Windows\System\NIHkqRg.exe
  C:\Windows\System\NIHkqRg.exe
  2⤵
  PID:5148
- C:\Windows\System\UDBSdAz.exe
  C:\Windows\System\UDBSdAz.exe
  2⤵
  PID:5164
- C:\Windows\System\EDlQnxt.exe
  C:\Windows\System\EDlQnxt.exe
  2⤵
  PID:5180
- C:\Windows\System\pjuKfAl.exe
  C:\Windows\System\pjuKfAl.exe
  2⤵
  PID:5196
- C:\Windows\System\umzuHpx.exe
  C:\Windows\System\umzuHpx.exe
  2⤵
  PID:5212
- C:\Windows\System\brQdynQ.exe
  C:\Windows\System\brQdynQ.exe
  2⤵
  PID:5228
- C:\Windows\System\sGkPBVC.exe
  C:\Windows\System\sGkPBVC.exe
  2⤵
  PID:5244
- C:\Windows\System\eyAEGkl.exe
  C:\Windows\System\eyAEGkl.exe
  2⤵
  PID:5260
- C:\Windows\System\XPsoFtG.exe
  C:\Windows\System\XPsoFtG.exe
  2⤵
  PID:5276
- C:\Windows\System\LTkiOIH.exe
  C:\Windows\System\LTkiOIH.exe
  2⤵
  PID:5292
- C:\Windows\System\HaWvRdJ.exe
  C:\Windows\System\HaWvRdJ.exe
  2⤵
  PID:5308
- C:\Windows\System\UiZXiff.exe
  C:\Windows\System\UiZXiff.exe
  2⤵
  PID:5324
- C:\Windows\System\LcKrJeO.exe
  C:\Windows\System\LcKrJeO.exe
  2⤵
  PID:5340
- C:\Windows\System\YkgYDWi.exe
  C:\Windows\System\YkgYDWi.exe
  2⤵
  PID:5356
- C:\Windows\System\Lpnqwwq.exe
  C:\Windows\System\Lpnqwwq.exe
  2⤵
  PID:5384
- C:\Windows\System\vRgZyiI.exe
  C:\Windows\System\vRgZyiI.exe
  2⤵
  PID:5408
- C:\Windows\System\ERZbYxH.exe
  C:\Windows\System\ERZbYxH.exe
  2⤵
  PID:5428
- C:\Windows\System\rBSqWCE.exe
  C:\Windows\System\rBSqWCE.exe
  2⤵
  PID:5444
- C:\Windows\System\YmNvZAl.exe
  C:\Windows\System\YmNvZAl.exe
  2⤵
  PID:5460
- C:\Windows\System\wmYJakw.exe
  C:\Windows\System\wmYJakw.exe
  2⤵
  PID:5476
- C:\Windows\System\AxltLft.exe
  C:\Windows\System\AxltLft.exe
  2⤵
  PID:5492
- C:\Windows\System\NmNAXmJ.exe
  C:\Windows\System\NmNAXmJ.exe
  2⤵
  PID:5508
- C:\Windows\System\ntZnFRJ.exe
  C:\Windows\System\ntZnFRJ.exe
  2⤵
  PID:5524
- C:\Windows\System\wuCaNpW.exe
  C:\Windows\System\wuCaNpW.exe
  2⤵
  PID:5544
- C:\Windows\System\ceVwvIP.exe
  C:\Windows\System\ceVwvIP.exe
  2⤵
  PID:5568
- C:\Windows\System\BDHDpzr.exe
  C:\Windows\System\BDHDpzr.exe
  2⤵
  PID:5584
- C:\Windows\System\bRHiGUM.exe
  C:\Windows\System\bRHiGUM.exe
  2⤵
  PID:5600
- C:\Windows\System\btINNwD.exe
  C:\Windows\System\btINNwD.exe
  2⤵
  PID:5616
- C:\Windows\System\vawZEwR.exe
  C:\Windows\System\vawZEwR.exe
  2⤵
  PID:5632
- C:\Windows\System\llKUhla.exe
  C:\Windows\System\llKUhla.exe
  2⤵
  PID:5648
- C:\Windows\System\NTAMaCC.exe
  C:\Windows\System\NTAMaCC.exe
  2⤵
  PID:5664
- C:\Windows\System\IwSJeOQ.exe
  C:\Windows\System\IwSJeOQ.exe
  2⤵
  PID:5680
- C:\Windows\System\LfCtmNb.exe
  C:\Windows\System\LfCtmNb.exe
  2⤵
  PID:5696
- C:\Windows\System\CyuzLEv.exe
  C:\Windows\System\CyuzLEv.exe
  2⤵
  PID:5712
- C:\Windows\System\AEfpjEu.exe
  C:\Windows\System\AEfpjEu.exe
  2⤵
  PID:5732
- C:\Windows\System\RAjnOXV.exe
  C:\Windows\System\RAjnOXV.exe
  2⤵
  PID:5748
- C:\Windows\System\mwpvIlU.exe
  C:\Windows\System\mwpvIlU.exe
  2⤵
  PID:5764
- C:\Windows\System\XYNronI.exe
  C:\Windows\System\XYNronI.exe
  2⤵
  PID:5780
- C:\Windows\System\CHkzudj.exe
  C:\Windows\System\CHkzudj.exe
  2⤵
  PID:5796
- C:\Windows\System\yHKBxqt.exe
  C:\Windows\System\yHKBxqt.exe
  2⤵
  PID:5812
- C:\Windows\System\usPEddW.exe
  C:\Windows\System\usPEddW.exe
  2⤵
  PID:5828
- C:\Windows\System\cJeuMSK.exe
  C:\Windows\System\cJeuMSK.exe
  2⤵
  PID:5844
- C:\Windows\System\GilMToD.exe
  C:\Windows\System\GilMToD.exe
  2⤵
  PID:5860
- C:\Windows\System\lxXAPTL.exe
  C:\Windows\System\lxXAPTL.exe
  2⤵
  PID:5876
- C:\Windows\System\hMngtvR.exe
  C:\Windows\System\hMngtvR.exe
  2⤵
  PID:5892
- C:\Windows\System\kKVhQya.exe
  C:\Windows\System\kKVhQya.exe
  2⤵
  PID:5908
- C:\Windows\System\IEyAWJM.exe
  C:\Windows\System\IEyAWJM.exe
  2⤵
  PID:5924
- C:\Windows\System\dfhQBmd.exe
  C:\Windows\System\dfhQBmd.exe
  2⤵
  PID:5940
- C:\Windows\System\XyKeciJ.exe
  C:\Windows\System\XyKeciJ.exe
  2⤵
  PID:5956
- C:\Windows\System\rcfBNHl.exe
  C:\Windows\System\rcfBNHl.exe
  2⤵
  PID:5972
- C:\Windows\System\WdBWtaJ.exe
  C:\Windows\System\WdBWtaJ.exe
  2⤵
  PID:5988
- C:\Windows\System\TgKRiln.exe
  C:\Windows\System\TgKRiln.exe
  2⤵
  PID:6004
- C:\Windows\System\YNDarrE.exe
  C:\Windows\System\YNDarrE.exe
  2⤵
  PID:6020
- C:\Windows\System\NDzfbmH.exe
  C:\Windows\System\NDzfbmH.exe
  2⤵
  PID:6036
- C:\Windows\System\uTCbvtM.exe
  C:\Windows\System\uTCbvtM.exe
  2⤵
  PID:6056
- C:\Windows\System\ZSoPows.exe
  C:\Windows\System\ZSoPows.exe
  2⤵
  PID:6072
- C:\Windows\System\htEHVov.exe
  C:\Windows\System\htEHVov.exe
  2⤵
  PID:6088
- C:\Windows\System\kAzFlTi.exe
  C:\Windows\System\kAzFlTi.exe
  2⤵
  PID:6104
- C:\Windows\System\nodewgL.exe
  C:\Windows\System\nodewgL.exe
  2⤵
  PID:6120
- C:\Windows\System\jQYZMZm.exe
  C:\Windows\System\jQYZMZm.exe
  2⤵
  PID:6136
- C:\Windows\System\htxPwvx.exe
  C:\Windows\System\htxPwvx.exe
  2⤵
  PID:272
- C:\Windows\System\EtvVIdb.exe
  C:\Windows\System\EtvVIdb.exe
  2⤵
  PID:1636
- C:\Windows\System\yHJLvIA.exe
  C:\Windows\System\yHJLvIA.exe
  2⤵
  PID:2484
- C:\Windows\System\oiLFgcy.exe
  C:\Windows\System\oiLFgcy.exe
  2⤵
  PID:5128
- C:\Windows\System\FVxyptj.exe
  C:\Windows\System\FVxyptj.exe
  2⤵
  PID:5160
- C:\Windows\System\hAvXBmJ.exe
  C:\Windows\System\hAvXBmJ.exe
  2⤵
  PID:5220
- C:\Windows\System\UYhWdGG.exe
  C:\Windows\System\UYhWdGG.exe
  2⤵
  PID:5284
- C:\Windows\System\kDoIlEo.exe
  C:\Windows\System\kDoIlEo.exe
  2⤵
  PID:5348
- C:\Windows\System\fTmevsY.exe
  C:\Windows\System\fTmevsY.exe
  2⤵
  PID:2976
- C:\Windows\System\ZNnkWar.exe
  C:\Windows\System\ZNnkWar.exe
  2⤵
  PID:2648
- C:\Windows\System\zPibYeg.exe
  C:\Windows\System\zPibYeg.exe
  2⤵
  PID:2724
- C:\Windows\System\EEfLUIK.exe
  C:\Windows\System\EEfLUIK.exe
  2⤵
  PID:6160
- C:\Windows\System\wssQHcG.exe
  C:\Windows\System\wssQHcG.exe
  2⤵
  PID:6176
- C:\Windows\System\FtbZaOP.exe
  C:\Windows\System\FtbZaOP.exe
  2⤵
  PID:6192
- C:\Windows\System\FJOZfuW.exe
  C:\Windows\System\FJOZfuW.exe
  2⤵
  PID:6208
- C:\Windows\System\JkGTdDP.exe
  C:\Windows\System\JkGTdDP.exe
  2⤵
  PID:6224
- C:\Windows\System\aAuifqq.exe
  C:\Windows\System\aAuifqq.exe
  2⤵
  PID:6240
- C:\Windows\System\pzJLUNM.exe
  C:\Windows\System\pzJLUNM.exe
  2⤵
  PID:6256
- C:\Windows\System\CvacuAu.exe
  C:\Windows\System\CvacuAu.exe
  2⤵
  PID:6272
- C:\Windows\System\pfAWGLo.exe
  C:\Windows\System\pfAWGLo.exe
  2⤵
  PID:6288
- C:\Windows\System\QcQwpNe.exe
  C:\Windows\System\QcQwpNe.exe
  2⤵
  PID:6304
- C:\Windows\System\ekvGSOP.exe
  C:\Windows\System\ekvGSOP.exe
  2⤵
  PID:6320
- C:\Windows\System\BDguVVn.exe
  C:\Windows\System\BDguVVn.exe
  2⤵
  PID:6336
- C:\Windows\System\eCrcNcv.exe
  C:\Windows\System\eCrcNcv.exe
  2⤵
  PID:6352
- C:\Windows\System\EgafVTU.exe
  C:\Windows\System\EgafVTU.exe
  2⤵
  PID:6368
- C:\Windows\System\ZAgAqCW.exe
  C:\Windows\System\ZAgAqCW.exe
  2⤵
  PID:6388
- C:\Windows\System\afdGbPM.exe
  C:\Windows\System\afdGbPM.exe
  2⤵
  PID:6404
- C:\Windows\System\FBNkcqu.exe
  C:\Windows\System\FBNkcqu.exe
  2⤵
  PID:6420
- C:\Windows\System\jwSHrox.exe
  C:\Windows\System\jwSHrox.exe
  2⤵
  PID:6436
- C:\Windows\System\HCENHHM.exe
  C:\Windows\System\HCENHHM.exe
  2⤵
  PID:6452
- C:\Windows\System\hsTJbCI.exe
  C:\Windows\System\hsTJbCI.exe
  2⤵
  PID:6472
- C:\Windows\System\YocfvxX.exe
  C:\Windows\System\YocfvxX.exe
  2⤵
  PID:6488
- C:\Windows\System\pqZBjto.exe
  C:\Windows\System\pqZBjto.exe
  2⤵
  PID:6504
- C:\Windows\System\awlQdnJ.exe
  C:\Windows\System\awlQdnJ.exe
  2⤵
  PID:6520
- C:\Windows\System\kSCFwss.exe
  C:\Windows\System\kSCFwss.exe
  2⤵
  PID:6536
- C:\Windows\System\MTzGMWM.exe
  C:\Windows\System\MTzGMWM.exe
  2⤵
  PID:6552
- C:\Windows\System\ImxvbJg.exe
  C:\Windows\System\ImxvbJg.exe
  2⤵
  PID:6568
- C:\Windows\System\nMrgboi.exe
  C:\Windows\System\nMrgboi.exe
  2⤵
  PID:6584
- C:\Windows\System\nGKeIni.exe
  C:\Windows\System\nGKeIni.exe
  2⤵
  PID:6604
- C:\Windows\System\shydJlC.exe
  C:\Windows\System\shydJlC.exe
  2⤵
  PID:6620
- C:\Windows\System\ghHZWRh.exe
  C:\Windows\System\ghHZWRh.exe
  2⤵
  PID:6636
- C:\Windows\System\WrePddt.exe
  C:\Windows\System\WrePddt.exe
  2⤵
  PID:6652
- C:\Windows\System\HPQZUWU.exe
  C:\Windows\System\HPQZUWU.exe
  2⤵
  PID:6668
- C:\Windows\System\IZrnHqS.exe
  C:\Windows\System\IZrnHqS.exe
  2⤵
  PID:6684
- C:\Windows\System\pCrcDWZ.exe
  C:\Windows\System\pCrcDWZ.exe
  2⤵
  PID:6700
- C:\Windows\System\cXjkTBy.exe
  C:\Windows\System\cXjkTBy.exe
  2⤵
  PID:6716
- C:\Windows\System\AbWvGUv.exe
  C:\Windows\System\AbWvGUv.exe
  2⤵
  PID:6732
- C:\Windows\System\EbTqJja.exe
  C:\Windows\System\EbTqJja.exe
  2⤵
  PID:6752
- C:\Windows\System\EijDjie.exe
  C:\Windows\System\EijDjie.exe
  2⤵
  PID:6768
- C:\Windows\System\bKQfwuE.exe
  C:\Windows\System\bKQfwuE.exe
  2⤵
  PID:6784
- C:\Windows\System\jvsSkgx.exe
  C:\Windows\System\jvsSkgx.exe
  2⤵
  PID:6800
- C:\Windows\System\XHTunyz.exe
  C:\Windows\System\XHTunyz.exe
  2⤵
  PID:6816
- C:\Windows\System\MgjYTBW.exe
  C:\Windows\System\MgjYTBW.exe
  2⤵
  PID:6832
- C:\Windows\System\QskFpWV.exe
  C:\Windows\System\QskFpWV.exe
  2⤵
  PID:6848
- C:\Windows\System\ZGWchwj.exe
  C:\Windows\System\ZGWchwj.exe
  2⤵
  PID:6864
- C:\Windows\System\tJWsmsk.exe
  C:\Windows\System\tJWsmsk.exe
  2⤵
  PID:6880
- C:\Windows\System\qSSagYa.exe
  C:\Windows\System\qSSagYa.exe
  2⤵
  PID:6896
- C:\Windows\System\mvPIwZi.exe
  C:\Windows\System\mvPIwZi.exe
  2⤵
  PID:6912
- C:\Windows\System\LcErXDh.exe
  C:\Windows\System\LcErXDh.exe
  2⤵
  PID:6928
- C:\Windows\System\IOOYqvh.exe
  C:\Windows\System\IOOYqvh.exe
  2⤵
  PID:6948
- C:\Windows\System\CsQtwaB.exe
  C:\Windows\System\CsQtwaB.exe
  2⤵
  PID:6964
- C:\Windows\System\crqBCfS.exe
  C:\Windows\System\crqBCfS.exe
  2⤵
  PID:6980
- C:\Windows\System\eJpnHxh.exe
  C:\Windows\System\eJpnHxh.exe
  2⤵
  PID:6996
- C:\Windows\System\iWyxdzi.exe
  C:\Windows\System\iWyxdzi.exe
  2⤵
  PID:7012
- C:\Windows\System\DmdvEmi.exe
  C:\Windows\System\DmdvEmi.exe
  2⤵
  PID:7028
- C:\Windows\System\HItoLRS.exe
  C:\Windows\System\HItoLRS.exe
  2⤵
  PID:7044
- C:\Windows\System\RUnoJoS.exe
  C:\Windows\System\RUnoJoS.exe
  2⤵
  PID:7060
- C:\Windows\System\JkyiDPY.exe
  C:\Windows\System\JkyiDPY.exe
  2⤵
  PID:7076
- C:\Windows\System\HCAFUZm.exe
  C:\Windows\System\HCAFUZm.exe
  2⤵
  PID:7092
- C:\Windows\System\OzYQKBx.exe
  C:\Windows\System\OzYQKBx.exe
  2⤵
  PID:7112
- C:\Windows\System\iOcCOqz.exe
  C:\Windows\System\iOcCOqz.exe
  2⤵
  PID:7128
- C:\Windows\System\auDiUpG.exe
  C:\Windows\System\auDiUpG.exe
  2⤵
  PID:7144
- C:\Windows\System\CgKCgUY.exe
  C:\Windows\System\CgKCgUY.exe
  2⤵
  PID:7160
- C:\Windows\System\BLloFjX.exe
  C:\Windows\System\BLloFjX.exe
  2⤵
  PID:1704
- C:\Windows\System\KTQbYro.exe
  C:\Windows\System\KTQbYro.exe
  2⤵
  PID:2248
- C:\Windows\System\AWrIBab.exe
  C:\Windows\System\AWrIBab.exe
  2⤵
  PID:7180
- C:\Windows\System\VarfRax.exe
  C:\Windows\System\VarfRax.exe
  2⤵
  PID:7196
- C:\Windows\System\LLyRPZy.exe
  C:\Windows\System\LLyRPZy.exe
  2⤵
  PID:7212
- C:\Windows\System\TUIpgZA.exe
  C:\Windows\System\TUIpgZA.exe
  2⤵
  PID:7228
- C:\Windows\System\hFEvBgB.exe
  C:\Windows\System\hFEvBgB.exe
  2⤵
  PID:7244
- C:\Windows\System\BjeFeLw.exe
  C:\Windows\System\BjeFeLw.exe
  2⤵
  PID:7260
- C:\Windows\System\vQUpELC.exe
  C:\Windows\System\vQUpELC.exe
  2⤵
  PID:7276
- C:\Windows\System\MklCJtg.exe
  C:\Windows\System\MklCJtg.exe
  2⤵
  PID:7292
- C:\Windows\System\souZFPh.exe
  C:\Windows\System\souZFPh.exe
  2⤵
  PID:7308
- C:\Windows\System\BkpjNyR.exe
  C:\Windows\System\BkpjNyR.exe
  2⤵
  PID:7324
- C:\Windows\System\ThXGyjY.exe
  C:\Windows\System\ThXGyjY.exe
  2⤵
  PID:7352
- C:\Windows\System\jcwKJdQ.exe
  C:\Windows\System\jcwKJdQ.exe
  2⤵
  PID:7368
- C:\Windows\System\LZXGNQh.exe
  C:\Windows\System\LZXGNQh.exe
  2⤵
  PID:7388
- C:\Windows\System\bdcxQpB.exe
  C:\Windows\System\bdcxQpB.exe
  2⤵
  PID:7404
- C:\Windows\System\OWRNZsQ.exe
  C:\Windows\System\OWRNZsQ.exe
  2⤵
  PID:7504
- C:\Windows\System\cPtAClN.exe
  C:\Windows\System\cPtAClN.exe
  2⤵
  PID:7520
- C:\Windows\System\vklbSyz.exe
  C:\Windows\System\vklbSyz.exe
  2⤵
  PID:7536
- C:\Windows\System\OTCYdMI.exe
  C:\Windows\System\OTCYdMI.exe
  2⤵
  PID:7552
- C:\Windows\System\ocuuijr.exe
  C:\Windows\System\ocuuijr.exe
  2⤵
  PID:7568
- C:\Windows\System\VQlmEqU.exe
  C:\Windows\System\VQlmEqU.exe
  2⤵
  PID:7584
- C:\Windows\System\kFMBCPW.exe
  C:\Windows\System\kFMBCPW.exe
  2⤵
  PID:7604
- C:\Windows\System\LBCxsia.exe
  C:\Windows\System\LBCxsia.exe
  2⤵
  PID:7628
- C:\Windows\System\sLiintU.exe
  C:\Windows\System\sLiintU.exe
  2⤵
  PID:7644
- C:\Windows\System\HIQyOzo.exe
  C:\Windows\System\HIQyOzo.exe
  2⤵
  PID:7660
- C:\Windows\System\GnrgVIZ.exe
  C:\Windows\System\GnrgVIZ.exe
  2⤵
  PID:7676
- C:\Windows\System\KqWnrYm.exe
  C:\Windows\System\KqWnrYm.exe
  2⤵
  PID:7692
- C:\Windows\System\PVNQBBK.exe
  C:\Windows\System\PVNQBBK.exe
  2⤵
  PID:7712
- C:\Windows\System\jojJJID.exe
  C:\Windows\System\jojJJID.exe
  2⤵
  PID:7728
- C:\Windows\System\OOwuMUd.exe
  C:\Windows\System\OOwuMUd.exe
  2⤵
  PID:7744
- C:\Windows\System\dMEztZF.exe
  C:\Windows\System\dMEztZF.exe
  2⤵
  PID:7760
- C:\Windows\System\KntgdKn.exe
  C:\Windows\System\KntgdKn.exe
  2⤵
  PID:7776
- C:\Windows\System\LSBrnMD.exe
  C:\Windows\System\LSBrnMD.exe
  2⤵
  PID:7792
- C:\Windows\System\KLKHUiv.exe
  C:\Windows\System\KLKHUiv.exe
  2⤵
  PID:7812
- C:\Windows\System\JIdtARB.exe
  C:\Windows\System\JIdtARB.exe
  2⤵
  PID:7828
- C:\Windows\System\jUQRGkc.exe
  C:\Windows\System\jUQRGkc.exe
  2⤵
  PID:7844
- C:\Windows\System\PNFbhHv.exe
  C:\Windows\System\PNFbhHv.exe
  2⤵
  PID:7864
- C:\Windows\System\RnXUAAk.exe
  C:\Windows\System\RnXUAAk.exe
  2⤵
  PID:7884
- C:\Windows\System\eyneftJ.exe
  C:\Windows\System\eyneftJ.exe
  2⤵
  PID:7904
- C:\Windows\System\ESSnHlW.exe
  C:\Windows\System\ESSnHlW.exe
  2⤵
  PID:7924
- C:\Windows\System\wtXrcbM.exe
  C:\Windows\System\wtXrcbM.exe
  2⤵
  PID:7940
- C:\Windows\System\aHSKMBR.exe
  C:\Windows\System\aHSKMBR.exe
  2⤵
  PID:7956
- C:\Windows\System\VKJQFKL.exe
  C:\Windows\System\VKJQFKL.exe
  2⤵
  PID:7972
- C:\Windows\System\OipdJhA.exe
  C:\Windows\System\OipdJhA.exe
  2⤵
  PID:7988
- C:\Windows\System\uLSjYJE.exe
  C:\Windows\System\uLSjYJE.exe
  2⤵
  PID:8004
- C:\Windows\System\RViibPG.exe
  C:\Windows\System\RViibPG.exe
  2⤵
  PID:8028
- C:\Windows\System\GHeGhpn.exe
  C:\Windows\System\GHeGhpn.exe
  2⤵
  PID:8044
- C:\Windows\System\bPuTwCO.exe
  C:\Windows\System\bPuTwCO.exe
  2⤵
  PID:8060
- C:\Windows\System\OzyLUWN.exe
  C:\Windows\System\OzyLUWN.exe
  2⤵
  PID:8076
- C:\Windows\System\ZqCuXIt.exe
  C:\Windows\System\ZqCuXIt.exe
  2⤵
  PID:8092
- C:\Windows\System\sXrAunk.exe
  C:\Windows\System\sXrAunk.exe
  2⤵
  PID:8112
- C:\Windows\System\GVmErLo.exe
  C:\Windows\System\GVmErLo.exe
  2⤵
  PID:8136
- C:\Windows\System\WrgVewL.exe
  C:\Windows\System\WrgVewL.exe
  2⤵
  PID:8160
- C:\Windows\System\reAMiZc.exe
  C:\Windows\System\reAMiZc.exe
  2⤵
  PID:8184
- C:\Windows\System\gquDVFQ.exe
  C:\Windows\System\gquDVFQ.exe
  2⤵
  PID:1340
- C:\Windows\System\oMVcZoB.exe
  C:\Windows\System\oMVcZoB.exe
  2⤵
  PID:1088
- C:\Windows\System\nvZcUxT.exe
  C:\Windows\System\nvZcUxT.exe
  2⤵
  PID:2288
- C:\Windows\System\AOHhmFr.exe
  C:\Windows\System\AOHhmFr.exe
  2⤵
  PID:1568
- C:\Windows\System\eBqSJWa.exe
  C:\Windows\System\eBqSJWa.exe
  2⤵
  PID:1612
- C:\Windows\System\ShmpsIP.exe
  C:\Windows\System\ShmpsIP.exe
  2⤵
  PID:1772
- C:\Windows\System\clIkmBv.exe
  C:\Windows\System\clIkmBv.exe
  2⤵
  PID:3116
- C:\Windows\System\bcerAaW.exe
  C:\Windows\System\bcerAaW.exe
  2⤵
  PID:3272
- C:\Windows\System\JPGaOxb.exe
  C:\Windows\System\JPGaOxb.exe
  2⤵
  PID:3532
- C:\Windows\System\yhhSDTS.exe
  C:\Windows\System\yhhSDTS.exe
  2⤵
  PID:3628
- C:\Windows\System\XBGnKVa.exe
  C:\Windows\System\XBGnKVa.exe
  2⤵
  PID:3884
- C:\Windows\System\xhZuiHB.exe
  C:\Windows\System\xhZuiHB.exe
  2⤵
  PID:3980
- C:\Windows\System\gRUfVSp.exe
  C:\Windows\System\gRUfVSp.exe
  2⤵
  PID:4048
- C:\Windows\System\XPhkdVL.exe
  C:\Windows\System\XPhkdVL.exe
  2⤵
  PID:2152
- C:\Windows\System\uQxuMYW.exe
  C:\Windows\System\uQxuMYW.exe
  2⤵
  PID:2588
- C:\Windows\System\pMmafFu.exe
  C:\Windows\System\pMmafFu.exe
  2⤵
  PID:3904
- C:\Windows\System\jJCAOAs.exe
  C:\Windows\System\jJCAOAs.exe
  2⤵
  PID:4380
- C:\Windows\System\iRQvHMc.exe
  C:\Windows\System\iRQvHMc.exe
  2⤵
  PID:4508
- C:\Windows\System\FnwDKSp.exe
  C:\Windows\System\FnwDKSp.exe
  2⤵
  PID:4636
- C:\Windows\System\DfChfVN.exe
  C:\Windows\System\DfChfVN.exe
  2⤵
  PID:8200
- C:\Windows\System\LcNvFLQ.exe
  C:\Windows\System\LcNvFLQ.exe
  2⤵
  PID:8220
- C:\Windows\System\UkEJjkv.exe
  C:\Windows\System\UkEJjkv.exe
  2⤵
  PID:8252
- C:\Windows\System\KifcoTW.exe
  C:\Windows\System\KifcoTW.exe
  2⤵
  PID:8276
- C:\Windows\System\LSrsjWQ.exe
  C:\Windows\System\LSrsjWQ.exe
  2⤵
  PID:8300
- C:\Windows\System\RstLIqs.exe
  C:\Windows\System\RstLIqs.exe
  2⤵
  PID:8324
- C:\Windows\System\ZYJhSAl.exe
  C:\Windows\System\ZYJhSAl.exe
  2⤵
  PID:8348
- C:\Windows\System\ehOJlpH.exe
  C:\Windows\System\ehOJlpH.exe
  2⤵
  PID:8376
- C:\Windows\System\yZQoHoP.exe
  C:\Windows\System\yZQoHoP.exe
  2⤵
  PID:8404
- C:\Windows\System\vvXyemK.exe
  C:\Windows\System\vvXyemK.exe
  2⤵
  PID:8432
- C:\Windows\System\MJbzSHp.exe
  C:\Windows\System\MJbzSHp.exe
  2⤵
  PID:8452
- C:\Windows\System\WUIxIdA.exe
  C:\Windows\System\WUIxIdA.exe
  2⤵
  PID:8484
- C:\Windows\System\vxoeptn.exe
  C:\Windows\System\vxoeptn.exe
  2⤵
  PID:8504
- C:\Windows\System\HSDlqbF.exe
  C:\Windows\System\HSDlqbF.exe
  2⤵
  PID:8520
- C:\Windows\System\jPehtxv.exe
  C:\Windows\System\jPehtxv.exe
  2⤵
  PID:8540
- C:\Windows\System\hhGGOLm.exe
  C:\Windows\System\hhGGOLm.exe
  2⤵
  PID:8556
- C:\Windows\System\dIBDFZp.exe
  C:\Windows\System\dIBDFZp.exe
  2⤵
  PID:8572
- C:\Windows\System\ZmFlyJn.exe
  C:\Windows\System\ZmFlyJn.exe
  2⤵
  PID:8592
- C:\Windows\System\bYfdHWp.exe
  C:\Windows\System\bYfdHWp.exe
  2⤵
  PID:8608
- C:\Windows\System\wDyxEAA.exe
  C:\Windows\System\wDyxEAA.exe
  2⤵
  PID:8624
- C:\Windows\System\jdDDJTa.exe
  C:\Windows\System\jdDDJTa.exe
  2⤵
  PID:8640
- C:\Windows\System\pbOEuKD.exe
  C:\Windows\System\pbOEuKD.exe
  2⤵
  PID:8656
- C:\Windows\System\ksymRRR.exe
  C:\Windows\System\ksymRRR.exe
  2⤵
  PID:8676
- C:\Windows\System\OHhsLPh.exe
  C:\Windows\System\OHhsLPh.exe
  2⤵
  PID:8692
- C:\Windows\System\NnIgYMk.exe
  C:\Windows\System\NnIgYMk.exe
  2⤵
  PID:8708
- C:\Windows\System\OLosYDs.exe
  C:\Windows\System\OLosYDs.exe
  2⤵
  PID:8724
- C:\Windows\System\BLiCrwo.exe
  C:\Windows\System\BLiCrwo.exe
  2⤵
  PID:8744
- C:\Windows\System\HbCynUP.exe
  C:\Windows\System\HbCynUP.exe
  2⤵
  PID:8760
- C:\Windows\System\GlnhMpn.exe
  C:\Windows\System\GlnhMpn.exe
  2⤵
  PID:8776
- C:\Windows\System\PNTIEtn.exe
  C:\Windows\System\PNTIEtn.exe
  2⤵
  PID:8792
- C:\Windows\System\hzmtijE.exe
  C:\Windows\System\hzmtijE.exe
  2⤵
  PID:8808
- C:\Windows\System\RFmtBeG.exe
  C:\Windows\System\RFmtBeG.exe
  2⤵
  PID:8824
- C:\Windows\System\KIjnsbM.exe
  C:\Windows\System\KIjnsbM.exe
  2⤵
  PID:8844
- C:\Windows\System\wAJxaBV.exe
  C:\Windows\System\wAJxaBV.exe
  2⤵
  PID:8860
- C:\Windows\System\enxUbcA.exe
  C:\Windows\System\enxUbcA.exe
  2⤵
  PID:8876
- C:\Windows\System\TlIzDJC.exe
  C:\Windows\System\TlIzDJC.exe
  2⤵
  PID:8892
- C:\Windows\System\NwCEZyH.exe
  C:\Windows\System\NwCEZyH.exe
  2⤵
  PID:8908
- C:\Windows\System\eliVEHN.exe
  C:\Windows\System\eliVEHN.exe
  2⤵
  PID:8924
- C:\Windows\System\mMefvmu.exe
  C:\Windows\System\mMefvmu.exe
  2⤵
  PID:8944
- C:\Windows\System\ZVoGmhn.exe
  C:\Windows\System\ZVoGmhn.exe
  2⤵
  PID:8960
- C:\Windows\System\nOIpYkZ.exe
  C:\Windows\System\nOIpYkZ.exe
  2⤵
  PID:8980
- C:\Windows\System\ovzpLeS.exe
  C:\Windows\System\ovzpLeS.exe
  2⤵
  PID:8996
- C:\Windows\System\whFrSkN.exe
  C:\Windows\System\whFrSkN.exe
  2⤵
  PID:9016
- C:\Windows\System\nGRsDLJ.exe
  C:\Windows\System\nGRsDLJ.exe
  2⤵
  PID:9032
- C:\Windows\System\wxqbwro.exe
  C:\Windows\System\wxqbwro.exe
  2⤵
  PID:4828
- C:\Windows\System\AxzKzhV.exe
  C:\Windows\System\AxzKzhV.exe
  2⤵
  PID:9856
- C:\Windows\System\JUMOzBo.exe
  C:\Windows\System\JUMOzBo.exe
  2⤵
  PID:10096
- C:\Windows\System\tyXMwfS.exe
  C:\Windows\System\tyXMwfS.exe
  2⤵
  PID:10132
- C:\Windows\System\vpuyrtJ.exe
  C:\Windows\System\vpuyrtJ.exe
  2⤵
  PID:10152
- C:\Windows\System\ZbycKfh.exe
  C:\Windows\System\ZbycKfh.exe
  2⤵
  PID:10176
- C:\Windows\System\FuQpPgz.exe
  C:\Windows\System\FuQpPgz.exe
  2⤵
  PID:10196
- C:\Windows\System\coevBOY.exe
  C:\Windows\System\coevBOY.exe
  2⤵
  PID:10216
- C:\Windows\System\MIljmMU.exe
  C:\Windows\System\MIljmMU.exe
  2⤵
  PID:10232
- C:\Windows\System\CApRpys.exe
  C:\Windows\System\CApRpys.exe
  2⤵
  PID:2824
- C:\Windows\System\osPVQty.exe
  C:\Windows\System\osPVQty.exe
  2⤵
  PID:9028
- C:\Windows\System\gdhKxsb.exe
  C:\Windows\System\gdhKxsb.exe
  2⤵
  PID:8852
- C:\Windows\System\vtiLhWO.exe
  C:\Windows\System\vtiLhWO.exe
  2⤵
  PID:2928
- C:\Windows\System\gUfwxlY.exe
  C:\Windows\System\gUfwxlY.exe
  2⤵
  PID:8992
- C:\Windows\System\niVjcJa.exe
  C:\Windows\System\niVjcJa.exe
  2⤵
  PID:8932
- C:\Windows\System\DRHdwgE.exe
  C:\Windows\System\DRHdwgE.exe
  2⤵
  PID:2940
- C:\Windows\System\DusBaCY.exe
  C:\Windows\System\DusBaCY.exe
  2⤵
  PID:8740
- C:\Windows\System\PlWSYuu.exe
  C:\Windows\System\PlWSYuu.exe
  2⤵
  PID:8904
- C:\Windows\System\OqDcpnS.exe
  C:\Windows\System\OqDcpnS.exe
  2⤵
  PID:2388
- C:\Windows\System\FRnErwP.exe
  C:\Windows\System\FRnErwP.exe
  2⤵
  PID:5472
- C:\Windows\System\AuVrdiG.exe
  C:\Windows\System\AuVrdiG.exe
  2⤵
  PID:4992
- C:\Windows\System\uVaBfCY.exe
  C:\Windows\System\uVaBfCY.exe
  2⤵
  PID:5272
- C:\Windows\System\gCJcOWl.exe
  C:\Windows\System\gCJcOWl.exe
  2⤵
  PID:5304
- C:\Windows\System\atkMVoo.exe
  C:\Windows\System\atkMVoo.exe
  2⤵
  PID:5532
- C:\Windows\System\WebCxYC.exe
  C:\Windows\System\WebCxYC.exe
  2⤵
  PID:9336
- C:\Windows\System\eSPcitx.exe
  C:\Windows\System\eSPcitx.exe
  2⤵
  PID:5144
- C:\Windows\System\AseFHXP.exe
  C:\Windows\System\AseFHXP.exe
  2⤵
  PID:5100
- C:\Windows\System\ybSyiMM.exe
  C:\Windows\System\ybSyiMM.exe
  2⤵
  PID:2600
- C:\Windows\System\uWBiHxL.exe
  C:\Windows\System\uWBiHxL.exe
  2⤵
  PID:2408
- C:\Windows\System\NLnuXSl.exe
  C:\Windows\System\NLnuXSl.exe
  2⤵
  PID:9412
- C:\Windows\System\zAxobFA.exe
  C:\Windows\System\zAxobFA.exe
  2⤵
  PID:5172
- C:\Windows\System\UdGKDCo.exe
  C:\Windows\System\UdGKDCo.exe
  2⤵
  PID:5072
- C:\Windows\System\ObwTqbv.exe
  C:\Windows\System\ObwTqbv.exe
  2⤵
  PID:4332
- C:\Windows\System\jicYgZH.exe
  C:\Windows\System\jicYgZH.exe
  2⤵
  PID:5204
- C:\Windows\System\rEziGcu.exe
  C:\Windows\System\rEziGcu.exe
  2⤵
  PID:4944
- C:\Windows\System\exsmnPG.exe
  C:\Windows\System\exsmnPG.exe
  2⤵
  PID:4488
- C:\Windows\System\txRpUle.exe
  C:\Windows\System\txRpUle.exe
  2⤵
  PID:2720
- C:\Windows\System\uoWIZUg.exe
  C:\Windows\System\uoWIZUg.exe
  2⤵
  PID:2700
- C:\Windows\System\VeVtTIm.exe
  C:\Windows\System\VeVtTIm.exe
  2⤵
  PID:2760
- C:\Windows\System\PvsnTDN.exe
  C:\Windows\System\PvsnTDN.exe
  2⤵
  PID:1292
- C:\Windows\System\DWaoPvx.exe
  C:\Windows\System\DWaoPvx.exe
  2⤵
  PID:9468
- C:\Windows\System\cncVHUv.exe
  C:\Windows\System\cncVHUv.exe
  2⤵
  PID:9488
- C:\Windows\System\vWFnznr.exe
  C:\Windows\System\vWFnznr.exe
  2⤵
  PID:9496
- C:\Windows\System\QzNVARg.exe
  C:\Windows\System\QzNVARg.exe
  2⤵
  PID:6764
- C:\Windows\System\uHzXixi.exe
  C:\Windows\System\uHzXixi.exe
  2⤵
  PID:8068
- C:\Windows\System\tLiMoDI.exe
  C:\Windows\System\tLiMoDI.exe
  2⤵
  PID:6204
- C:\Windows\System\KpDXgcW.exe
  C:\Windows\System\KpDXgcW.exe
  2⤵
  PID:6400
- C:\Windows\System\QWKajMf.exe
  C:\Windows\System\QWKajMf.exe
  2⤵
  PID:4988
- C:\Windows\System\vWPqhDZ.exe
  C:\Windows\System\vWPqhDZ.exe
  2⤵
  PID:2220
- C:\Windows\System\AuXaCBW.exe
  C:\Windows\System\AuXaCBW.exe
  2⤵
  PID:1860
- C:\Windows\System\opUAwgO.exe
  C:\Windows\System\opUAwgO.exe
  2⤵
  PID:6012
- C:\Windows\System\FgyZbXJ.exe
  C:\Windows\System\FgyZbXJ.exe
  2⤵
  PID:3692
- C:\Windows\System\stHCvfT.exe
  C:\Windows\System\stHCvfT.exe
  2⤵
  PID:6528
- C:\Windows\System\TksIOkG.exe
  C:\Windows\System\TksIOkG.exe
  2⤵
  PID:4012
- C:\Windows\System\RbSXmNf.exe
  C:\Windows\System\RbSXmNf.exe
  2⤵
  PID:6828
- C:\Windows\System\qUMycTY.exe
  C:\Windows\System\qUMycTY.exe
  2⤵
  PID:7220
- C:\Windows\System\cFetEuJ.exe
  C:\Windows\System\cFetEuJ.exe
  2⤵
  PID:6628
- C:\Windows\System\VTeYASN.exe
  C:\Windows\System\VTeYASN.exe
  2⤵
  PID:6048
- C:\Windows\System\iOFpmMG.exe
  C:\Windows\System\iOFpmMG.exe
  2⤵
  PID:5884
- C:\Windows\System\DqjdqOn.exe
  C:\Windows\System\DqjdqOn.exe
  2⤵
  PID:4300
- C:\Windows\System\FzALsmm.exe
  C:\Windows\System\FzALsmm.exe
  2⤵
  PID:7784
- C:\Windows\System\cAmEDEF.exe
  C:\Windows\System\cAmEDEF.exe
  2⤵
  PID:6564
- C:\Windows\System\xnNRaqP.exe
  C:\Windows\System\xnNRaqP.exe
  2⤵
  PID:6044
- C:\Windows\System\aJcGcPP.exe
  C:\Windows\System\aJcGcPP.exe
  2⤵
  PID:8636
- C:\Windows\System\UvJyUuW.exe
  C:\Windows\System\UvJyUuW.exe
  2⤵
  PID:1984
- C:\Windows\System\DWZRSBI.exe
  C:\Windows\System\DWZRSBI.exe
  2⤵
  PID:7056
- C:\Windows\System\UBkaPhz.exe
  C:\Windows\System\UBkaPhz.exe
  2⤵
  PID:6660
- C:\Windows\System\huZgpiD.exe
  C:\Windows\System\huZgpiD.exe
  2⤵
  PID:8716
- C:\Windows\System\sAzIgsA.exe
  C:\Windows\System\sAzIgsA.exe
  2⤵
  PID:6760
- C:\Windows\System\Kbkpqqp.exe
  C:\Windows\System\Kbkpqqp.exe
  2⤵
  PID:2556
- C:\Windows\System\zNaEHsd.exe
  C:\Windows\System\zNaEHsd.exe
  2⤵
  PID:7512
- C:\Windows\System\BgHjjKR.exe
  C:\Windows\System\BgHjjKR.exe
  2⤵
  PID:5720
- C:\Windows\System\brwwcKp.exe
  C:\Windows\System\brwwcKp.exe
  2⤵
  PID:3872
- C:\Windows\System\LQxQpcX.exe
  C:\Windows\System\LQxQpcX.exe
  2⤵
  PID:7968
- C:\Windows\System\rsHWYfi.exe
  C:\Windows\System\rsHWYfi.exe
  2⤵
  PID:5756
- C:\Windows\System\bpzVkHh.exe
  C:\Windows\System\bpzVkHh.exe
  2⤵
  PID:5660
- C:\Windows\System\qVcgwIv.exe
  C:\Windows\System\qVcgwIv.exe
  2⤵
  PID:7824
- C:\Windows\System\dYAHQLY.exe
  C:\Windows\System\dYAHQLY.exe
  2⤵
  PID:8648
- C:\Windows\System\uHlVQKn.exe
  C:\Windows\System\uHlVQKn.exe
  2⤵
  PID:2280
- C:\Windows\System\JSQaakL.exe
  C:\Windows\System\JSQaakL.exe
  2⤵
  PID:9560
- C:\Windows\System\VyPnlQR.exe
  C:\Windows\System\VyPnlQR.exe
  2⤵
  PID:8104
- C:\Windows\System\ngykKZv.exe
  C:\Windows\System\ngykKZv.exe
  2⤵
  PID:9608
- C:\Windows\System\PUluSpo.exe
  C:\Windows\System\PUluSpo.exe
  2⤵
  PID:9620
- C:\Windows\System\MpuhiDo.exe
  C:\Windows\System\MpuhiDo.exe
  2⤵
  PID:6792
- C:\Windows\System\eJJLFOq.exe
  C:\Windows\System\eJJLFOq.exe
  2⤵
  PID:6236
- C:\Windows\System\HnatZLH.exe
  C:\Windows\System\HnatZLH.exe
  2⤵
  PID:5056
- C:\Windows\System\mrSbZVN.exe
  C:\Windows\System\mrSbZVN.exe
  2⤵
  PID:6920
- C:\Windows\System\vkftGvS.exe
  C:\Windows\System\vkftGvS.exe
  2⤵
  PID:324
- C:\Windows\System\tAjPBii.exe
  C:\Windows\System\tAjPBii.exe
  2⤵
  PID:6080
- C:\Windows\System\DbhwwgR.exe
  C:\Windows\System\DbhwwgR.exe
  2⤵
  PID:6664
- C:\Windows\System\MwKQHhx.exe
  C:\Windows\System\MwKQHhx.exe
  2⤵
  PID:4544
- C:\Windows\System\xnbDwBQ.exe
  C:\Windows\System\xnbDwBQ.exe
  2⤵
  PID:6496
- C:\Windows\System\wDgiGBA.exe
  C:\Windows\System\wDgiGBA.exe
  2⤵
  PID:6956
- C:\Windows\System\FQUcLKo.exe
  C:\Windows\System\FQUcLKo.exe
  2⤵
  PID:8752
- C:\Windows\System\CWyIKjS.exe
  C:\Windows\System\CWyIKjS.exe
  2⤵
  PID:8512
- C:\Windows\System\LOHIBmh.exe
  C:\Windows\System\LOHIBmh.exe
  2⤵
  PID:6468
- C:\Windows\System\LwIXYDU.exe
  C:\Windows\System\LwIXYDU.exe
  2⤵
  PID:9596
- C:\Windows\System\dstTIYH.exe
  C:\Windows\System\dstTIYH.exe
  2⤵
  PID:9588
- C:\Windows\System\pdHtqJx.exe
  C:\Windows\System\pdHtqJx.exe
  2⤵
  PID:9648
- C:\Windows\System\CjqaNQM.exe
  C:\Windows\System\CjqaNQM.exe
  2⤵
  PID:9668
- C:\Windows\System\vDTsvzT.exe
  C:\Windows\System\vDTsvzT.exe
  2⤵
  PID:9760
- C:\Windows\System\Phxlevu.exe
  C:\Windows\System\Phxlevu.exe
  2⤵
  PID:9688
- C:\Windows\System\zTjoIfq.exe
  C:\Windows\System\zTjoIfq.exe
  2⤵
  PID:9636
- C:\Windows\System\mngDxEe.exe
  C:\Windows\System\mngDxEe.exe
  2⤵
  PID:9704
- C:\Windows\System\eOZAtwb.exe
  C:\Windows\System\eOZAtwb.exe
  2⤵
  PID:9732
- C:\Windows\System\bnWZqeB.exe
  C:\Windows\System\bnWZqeB.exe
  2⤵
  PID:9740
- C:\Windows\System\msGRxoJ.exe
  C:\Windows\System\msGRxoJ.exe
  2⤵
  PID:8464
- C:\Windows\System\uqWWuhy.exe
  C:\Windows\System\uqWWuhy.exe
  2⤵
  PID:9872
- C:\Windows\System\PXRfskj.exe
  C:\Windows\System\PXRfskj.exe
  2⤵
  PID:9888
- C:\Windows\System\wrrKuqs.exe
  C:\Windows\System\wrrKuqs.exe
  2⤵
  PID:9820
- C:\Windows\System\GydjTVC.exe
  C:\Windows\System\GydjTVC.exe
  2⤵
  PID:9896
- C:\Windows\System\yWkDXjT.exe
  C:\Windows\System\yWkDXjT.exe
  2⤵
  PID:9976
- C:\Windows\System\uaEqPyp.exe
  C:\Windows\System\uaEqPyp.exe
  2⤵
  PID:9924
- C:\Windows\System\vqzAlSw.exe
  C:\Windows\System\vqzAlSw.exe
  2⤵
  PID:9940
- C:\Windows\System\nrMtgTc.exe
  C:\Windows\System\nrMtgTc.exe
  2⤵
  PID:9960
- C:\Windows\System\YShuysP.exe
  C:\Windows\System\YShuysP.exe
  2⤵
  PID:10000
- C:\Windows\System\GrdWdWd.exe
  C:\Windows\System\GrdWdWd.exe
  2⤵
  PID:10016
- C:\Windows\System\YsFIFtA.exe
  C:\Windows\System\YsFIFtA.exe
  2⤵
  PID:9984
- C:\Windows\System\IZvxneH.exe
  C:\Windows\System\IZvxneH.exe
  2⤵
  PID:9796
- C:\Windows\System\hcSSpYG.exe
  C:\Windows\System\hcSSpYG.exe
  2⤵
  PID:9816
- C:\Windows\System\VFiLkbG.exe
  C:\Windows\System\VFiLkbG.exe
  2⤵
  PID:2272
- C:\Windows\System\rLaSZdk.exe
  C:\Windows\System\rLaSZdk.exe
  2⤵
  PID:1540
- C:\Windows\System\LQpwnqW.exe
  C:\Windows\System\LQpwnqW.exe
  2⤵
  PID:10040
- C:\Windows\System\UZVwOuZ.exe
  C:\Windows\System\UZVwOuZ.exe
  2⤵
  PID:10068
- C:\Windows\System\xxGdPrO.exe
  C:\Windows\System\xxGdPrO.exe
  2⤵
  PID:10088
- C:\Windows\System\qRKhOII.exe
  C:\Windows\System\qRKhOII.exe
  2⤵
  PID:4956
- C:\Windows\System\ZIVoLwM.exe
  C:\Windows\System\ZIVoLwM.exe
  2⤵
  PID:10168
- C:\Windows\System\yJtNTXJ.exe
  C:\Windows\System\yJtNTXJ.exe
  2⤵
  PID:10148
- C:\Windows\System\rHDMIKj.exe
  C:\Windows\System\rHDMIKj.exe
  2⤵
  PID:8772
- C:\Windows\System\phSgLWh.exe
  C:\Windows\System\phSgLWh.exe
  2⤵
  PID:5500
- C:\Windows\System\gDDTPcD.exe
  C:\Windows\System\gDDTPcD.exe
  2⤵
  PID:5176
- C:\Windows\System\NenjUZT.exe
  C:\Windows\System\NenjUZT.exe
  2⤵
  PID:10184
- C:\Windows\System\OAqsMOL.exe
  C:\Windows\System\OAqsMOL.exe
  2⤵
  PID:10228
- C:\Windows\System\lnEfpDc.exe
  C:\Windows\System\lnEfpDc.exe
  2⤵
  PID:5392
- C:\Windows\System\EXgclVZ.exe
  C:\Windows\System\EXgclVZ.exe
  2⤵
  PID:10044
- C:\Windows\System\XJWqYwS.exe
  C:\Windows\System\XJWqYwS.exe
  2⤵
  PID:5268
- C:\Windows\System\ycjkbNv.exe
  C:\Windows\System\ycjkbNv.exe
  2⤵
  PID:5036
- C:\Windows\System\jLZSiiI.exe
  C:\Windows\System\jLZSiiI.exe
  2⤵
  PID:9456
- C:\Windows\System\YlpRTeS.exe
  C:\Windows\System\YlpRTeS.exe
  2⤵
  PID:9476
- C:\Windows\System\CPWsRXO.exe
  C:\Windows\System\CPWsRXO.exe
  2⤵
  PID:7120
- C:\Windows\System\mORvxNZ.exe
  C:\Windows\System\mORvxNZ.exe
  2⤵
  PID:6432
- C:\Windows\System\XIXsqHk.exe
  C:\Windows\System\XIXsqHk.exe
  2⤵
  PID:10104
- C:\Windows\System\XvFnhbq.exe
  C:\Windows\System\XvFnhbq.exe
  2⤵
  PID:10120
- C:\Windows\System\YcydrmR.exe
  C:\Windows\System\YcydrmR.exe
  2⤵
  PID:10124
- C:\Windows\System\CFNWCzI.exe
  C:\Windows\System\CFNWCzI.exe
  2⤵
  PID:8988
- C:\Windows\System\KpmeCYV.exe
  C:\Windows\System\KpmeCYV.exe
  2⤵
  PID:4000
- C:\Windows\System\pfkqWlq.exe
  C:\Windows\System\pfkqWlq.exe
  2⤵
  PID:5020
- C:\Windows\System\rISZOir.exe
  C:\Windows\System\rISZOir.exe
  2⤵
  PID:4120
- C:\Windows\System\puUUFQH.exe
  C:\Windows\System\puUUFQH.exe
  2⤵
  PID:8040
- C:\Windows\System\kJIaicT.exe
  C:\Windows\System\kJIaicT.exe
  2⤵
  PID:6632
- C:\Windows\System\gPzhWQe.exe
  C:\Windows\System\gPzhWQe.exe
  2⤵
  PID:5760
- C:\Windows\System\RUFkbJU.exe
  C:\Windows\System\RUFkbJU.exe
  2⤵
  PID:7284
- C:\Windows\System\qGXYOBs.exe
  C:\Windows\System\qGXYOBs.exe
  2⤵
  PID:6428
- C:\Windows\System\XvXFIri.exe
  C:\Windows\System\XvXFIri.exe
  2⤵
  PID:7152
- C:\Windows\System\qIQACWz.exe
  C:\Windows\System\qIQACWz.exe
  2⤵
  PID:5856
- C:\Windows\System\gNDkXiB.exe
  C:\Windows\System\gNDkXiB.exe
  2⤵
  PID:3724
- C:\Windows\System\GBuQdLg.exe
  C:\Windows\System\GBuQdLg.exe
  2⤵
  PID:8212
- C:\Windows\System\FuYHCAm.exe
  C:\Windows\System\FuYHCAm.exe
  2⤵
  PID:5052
- C:\Windows\System\sOEACBN.exe
  C:\Windows\System\sOEACBN.exe
  2⤵
  PID:776
- C:\Windows\System\HEdcCZJ.exe
  C:\Windows\System\HEdcCZJ.exe
  2⤵
  PID:552
- C:\Windows\System\kMRorPP.exe
  C:\Windows\System\kMRorPP.exe
  2⤵
  PID:2300
- C:\Windows\System\LpaVVQV.exe
  C:\Windows\System\LpaVVQV.exe
  2⤵
  PID:6116
- C:\Windows\System\vXNNtJw.exe
  C:\Windows\System\vXNNtJw.exe
  2⤵
  PID:5984
- C:\Windows\System\GvxBIxg.exe
  C:\Windows\System\GvxBIxg.exe
  2⤵
  PID:6268
- C:\Windows\System\VVsNoQY.exe
  C:\Windows\System\VVsNoQY.exe
  2⤵
  PID:5980
- C:\Windows\System\KQCQeYb.exe
  C:\Windows\System\KQCQeYb.exe
  2⤵
  PID:9544
- C:\Windows\System\gmpnizH.exe
  C:\Windows\System\gmpnizH.exe
  2⤵
  PID:9556
- C:\Windows\System\DYlYGnX.exe
  C:\Windows\System\DYlYGnX.exe
  2⤵
  PID:6600
- C:\Windows\System\cdwYCZC.exe
  C:\Windows\System\cdwYCZC.exe
  2⤵
  PID:8444
- C:\Windows\System\kJkaaVV.exe
  C:\Windows\System\kJkaaVV.exe
  2⤵
  PID:9548
- C:\Windows\System\fLFQKDX.exe
  C:\Windows\System\fLFQKDX.exe
  2⤵
  PID:5788
- C:\Windows\System\qjfaxdC.exe
  C:\Windows\System\qjfaxdC.exe
  2⤵
  PID:6824
- C:\Windows\System\SxNJyGR.exe
  C:\Windows\System\SxNJyGR.exe
  2⤵
  PID:9600
- C:\Windows\System\JgRqwfs.exe
  C:\Windows\System\JgRqwfs.exe
  2⤵
  PID:7320
- C:\Windows\System\FJfHnPo.exe
  C:\Windows\System\FJfHnPo.exe
  2⤵
  PID:8208
- C:\Windows\System\VazWqUU.exe
  C:\Windows\System\VazWqUU.exe
  2⤵
  PID:6856
- C:\Windows\System\YYsWvBL.exe
  C:\Windows\System\YYsWvBL.exe
  2⤵
  PID:1784
- C:\Windows\System\WVcKpwH.exe
  C:\Windows\System\WVcKpwH.exe
  2⤵
  PID:9720
- C:\Windows\System\sXvIwki.exe
  C:\Windows\System\sXvIwki.exe
  2⤵
  PID:9524
- C:\Windows\System\SKtmXtn.exe
  C:\Windows\System\SKtmXtn.exe
  2⤵
  PID:9656
- C:\Windows\System\aNoESkk.exe
  C:\Windows\System\aNoESkk.exe
  2⤵
  PID:9624
- C:\Windows\System\eQHefMF.exe
  C:\Windows\System\eQHefMF.exe
  2⤵
  PID:9644
- C:\Windows\System\ppYvATy.exe
  C:\Windows\System\ppYvATy.exe
  2⤵
  PID:9776
- C:\Windows\System\OsfborR.exe
  C:\Windows\System\OsfborR.exe
  2⤵
  PID:9752
- C:\Windows\System\XHuLdtB.exe
  C:\Windows\System\XHuLdtB.exe
  2⤵
  PID:9808
- C:\Windows\System\VKKkvJk.exe
  C:\Windows\System\VKKkvJk.exe
  2⤵
  PID:2268
- C:\Windows\System\VTotUBe.exe
  C:\Windows\System\VTotUBe.exe
  2⤵
  PID:9680
- C:\Windows\System\dLsyIsO.exe
  C:\Windows\System\dLsyIsO.exe
  2⤵
  PID:1480
- C:\Windows\System\ezzClTP.exe
  C:\Windows\System\ezzClTP.exe
  2⤵
  PID:9832
- C:\Windows\System\VrVzFoD.exe
  C:\Windows\System\VrVzFoD.exe
  2⤵
  PID:9920
- C:\Windows\System\dIlFVnr.exe
  C:\Windows\System\dIlFVnr.exe
  2⤵
  PID:10012
- C:\Windows\System\mJZRCxo.exe
  C:\Windows\System\mJZRCxo.exe
  2⤵
  PID:10076
- C:\Windows\System\RmCSCmZ.exe
  C:\Windows\System\RmCSCmZ.exe
  2⤵
  PID:10052
- C:\Windows\System\HgzCIEs.exe
  C:\Windows\System\HgzCIEs.exe
  2⤵
  PID:9780
- C:\Windows\System\lpkSVBu.exe
  C:\Windows\System\lpkSVBu.exe
  2⤵
  PID:8940
- C:\Windows\System\kAOyMpA.exe
  C:\Windows\System\kAOyMpA.exe
  2⤵
  PID:10192
- C:\Windows\System\tdfdTuC.exe
  C:\Windows\System\tdfdTuC.exe
  2⤵
  PID:5436
- C:\Windows\System\gQPuHoA.exe
  C:\Windows\System\gQPuHoA.exe
  2⤵
  PID:8316
- C:\Windows\System\tfSTrrH.exe
  C:\Windows\System\tfSTrrH.exe
  2⤵
  PID:8900
- C:\Windows\System\mKvuxBw.exe
  C:\Windows\System\mKvuxBw.exe
  2⤵
  PID:7420
- C:\Windows\System\EMCTYJA.exe
  C:\Windows\System\EMCTYJA.exe
  2⤵
  PID:8152
- C:\Windows\System\eFCUxdD.exe
  C:\Windows\System\eFCUxdD.exe
  2⤵
  PID:1700
- C:\Windows\System\lKOuhJq.exe
  C:\Windows\System\lKOuhJq.exe
  2⤵
  PID:7252
- C:\Windows\System\cfhajkF.exe
  C:\Windows\System\cfhajkF.exe
  2⤵
  PID:2184
- C:\Windows\System\TQAYeYb.exe
  C:\Windows\System\TQAYeYb.exe
  2⤵
  PID:2032
- C:\Windows\System\SNwXYic.exe
  C:\Windows\System\SNwXYic.exe
  2⤵
  PID:6084
- C:\Windows\System\oVkhQBw.exe
  C:\Windows\System\oVkhQBw.exe
  2⤵
  PID:7576
- C:\Windows\System\UfDAgmU.exe
  C:\Windows\System\UfDAgmU.exe
  2⤵
  PID:6328
- C:\Windows\System\qDsrovF.exe
  C:\Windows\System\qDsrovF.exe
  2⤵
  PID:5116
- C:\Windows\System\dFnLjQe.exe
  C:\Windows\System\dFnLjQe.exe
  2⤵
  PID:1312
- C:\Windows\System\IqpPuAZ.exe
  C:\Windows\System\IqpPuAZ.exe
  2⤵
  PID:6232
- C:\Windows\System\UmRVuGo.exe
  C:\Windows\System\UmRVuGo.exe
  2⤵
  PID:8548
- C:\Windows\System\RKtDYdY.exe
  C:\Windows\System\RKtDYdY.exe
  2⤵
  PID:8312
- C:\Windows\System\Xkkplnz.exe
  C:\Windows\System\Xkkplnz.exe
  2⤵
  PID:8364
- C:\Windows\System\qZUPcIO.exe
  C:\Windows\System\qZUPcIO.exe
  2⤵
  PID:2092
- C:\Windows\System\gwwweaX.exe
  C:\Windows\System\gwwweaX.exe
  2⤵
  PID:7088
- C:\Windows\System\TlDBEpU.exe
  C:\Windows\System\TlDBEpU.exe
  2⤵
  PID:8516
- C:\Windows\System\dFRBMce.exe
  C:\Windows\System\dFRBMce.exe
  2⤵
  PID:8652
- C:\Windows\System\FVTeABB.exe
  C:\Windows\System\FVTeABB.exe
  2⤵
  PID:6728
- C:\Windows\System\KrMAkAI.exe
  C:\Windows\System\KrMAkAI.exe
  2⤵
  PID:7316
- C:\Windows\System\GcBXqEV.exe
  C:\Windows\System\GcBXqEV.exe
  2⤵
  PID:9772
- C:\Windows\System\OgCkwkp.exe
  C:\Windows\System\OgCkwkp.exe
  2⤵
  PID:9824
- C:\Windows\System\weysuUX.exe
  C:\Windows\System\weysuUX.exe
  2⤵
  PID:9936
- C:\Windows\System\gnZxLaC.exe
  C:\Windows\System\gnZxLaC.exe
  2⤵
  PID:9724
- C:\Windows\System\omZnEjF.exe
  C:\Windows\System\omZnEjF.exe
  2⤵
  PID:9916
- C:\Windows\System\YFgPrgy.exe
  C:\Windows\System\YFgPrgy.exe
  2⤵
  PID:9804
- C:\Windows\System\ridnfkI.exe
  C:\Windows\System\ridnfkI.exe
  2⤵
  PID:10212
- C:\Windows\System\cvDgsLO.exe
  C:\Windows\System\cvDgsLO.exe
  2⤵
  PID:10080
- C:\Windows\System\BoODNjJ.exe
  C:\Windows\System\BoODNjJ.exe
  2⤵
  PID:10008
- C:\Windows\System\GbuMabt.exe
  C:\Windows\System\GbuMabt.exe
  2⤵
  PID:5400
- C:\Windows\System\zEfqtza.exe
  C:\Windows\System\zEfqtza.exe
  2⤵
  PID:8956
- C:\Windows\System\oOpniKQ.exe
  C:\Windows\System\oOpniKQ.exe
  2⤵
  PID:1564
- C:\Windows\System\BSsbrDo.exe
  C:\Windows\System\BSsbrDo.exe
  2⤵
  PID:2972
- C:\Windows\System\lqKxrEL.exe
  C:\Windows\System\lqKxrEL.exe
  2⤵
  PID:5580
- C:\Windows\System\daXJydl.exe
  C:\Windows\System\daXJydl.exe
  2⤵
  PID:4624
- C:\Windows\System\hHPKiyI.exe
  C:\Windows\System\hHPKiyI.exe
  2⤵
  PID:6296
- C:\Windows\System\KTzBeGf.exe
  C:\Windows\System\KTzBeGf.exe
  2⤵
  PID:4720
- C:\Windows\System\CNVfpnc.exe
  C:\Windows\System\CNVfpnc.exe
  2⤵
  PID:10208
- C:\Windows\System\gDRWoGJ.exe
  C:\Windows\System\gDRWoGJ.exe
  2⤵
  PID:2956
- C:\Windows\System\avFPJYl.exe
  C:\Windows\System\avFPJYl.exe
  2⤵
  PID:2176
- C:\Windows\System\aFVOPdX.exe
  C:\Windows\System\aFVOPdX.exe
  2⤵
  PID:8720
- C:\Windows\System\bGIXXeN.exe
  C:\Windows\System\bGIXXeN.exe
  2⤵
  PID:7936
- C:\Windows\System\uWzIDNl.exe
  C:\Windows\System\uWzIDNl.exe
  2⤵
  PID:2532
- C:\Windows\System\blIOkDx.exe
  C:\Windows\System\blIOkDx.exe
  2⤵
  PID:9552
- C:\Windows\System\fdyEfUT.exe
  C:\Windows\System\fdyEfUT.exe
  2⤵
  PID:7516
- C:\Windows\System\RlUixbr.exe
  C:\Windows\System\RlUixbr.exe
  2⤵
  PID:7548
- C:\Windows\System\exyhGpj.exe
  C:\Windows\System\exyhGpj.exe
  2⤵
  PID:9516
- C:\Windows\System\IUdLnpb.exe
  C:\Windows\System\IUdLnpb.exe
  2⤵
  PID:9868
- C:\Windows\System\nEyEkva.exe
  C:\Windows\System\nEyEkva.exe
  2⤵
  PID:9800
- C:\Windows\System\NHGOfSz.exe
  C:\Windows\System\NHGOfSz.exe
  2⤵
  PID:2228
- C:\Windows\System\BPVDbYm.exe
  C:\Windows\System\BPVDbYm.exe
  2⤵
  PID:5024
- C:\Windows\System\YEfkrKA.exe
  C:\Windows\System\YEfkrKA.exe
  2⤵
  PID:10108
- C:\Windows\System\YOloWVM.exe
  C:\Windows\System\YOloWVM.exe
  2⤵
  PID:4264
- C:\Windows\System\VhiuiRq.exe
  C:\Windows\System\VhiuiRq.exe
  2⤵
  PID:6464
- C:\Windows\System\znFPdGc.exe
  C:\Windows\System\znFPdGc.exe
  2⤵
  PID:10140
- C:\Windows\System\AySvUhT.exe
  C:\Windows\System\AySvUhT.exe
  2⤵
  PID:5948
- C:\Windows\System\PUcjxXG.exe
  C:\Windows\System\PUcjxXG.exe
  2⤵
  PID:10252
- C:\Windows\System\jtJIbPp.exe
  C:\Windows\System\jtJIbPp.exe
  2⤵
  PID:10268
- C:\Windows\System\YoLSLpW.exe
  C:\Windows\System\YoLSLpW.exe
  2⤵
  PID:10284
- C:\Windows\System\qoJVUlb.exe
  C:\Windows\System\qoJVUlb.exe
  2⤵
  PID:10300
- C:\Windows\System\dWTRGZJ.exe
  C:\Windows\System\dWTRGZJ.exe
  2⤵
  PID:10316
- C:\Windows\System\kRHnUWc.exe
  C:\Windows\System\kRHnUWc.exe
  2⤵
  PID:10332
- C:\Windows\System\wKQJrhs.exe
  C:\Windows\System\wKQJrhs.exe
  2⤵
  PID:10348
- C:\Windows\System\KUuIUNV.exe
  C:\Windows\System\KUuIUNV.exe
  2⤵
  PID:10364
- C:\Windows\System\BfGjmpG.exe
  C:\Windows\System\BfGjmpG.exe
  2⤵
  PID:10380
- C:\Windows\System\cFOuxFg.exe
  C:\Windows\System\cFOuxFg.exe
  2⤵
  PID:10396
- C:\Windows\System\ozswbCH.exe
  C:\Windows\System\ozswbCH.exe
  2⤵
  PID:10412
- C:\Windows\System\dXbEOhC.exe
  C:\Windows\System\dXbEOhC.exe
  2⤵
  PID:10428
- C:\Windows\System\OaJfmeB.exe
  C:\Windows\System\OaJfmeB.exe
  2⤵
  PID:10444
- C:\Windows\System\eDUDgDc.exe
  C:\Windows\System\eDUDgDc.exe
  2⤵
  PID:10460
- C:\Windows\System\QmxiEkP.exe
  C:\Windows\System\QmxiEkP.exe
  2⤵
  PID:10476
- C:\Windows\System\dOGakeG.exe
  C:\Windows\System\dOGakeG.exe
  2⤵
  PID:10492
- C:\Windows\System\VzudHTQ.exe
  C:\Windows\System\VzudHTQ.exe
  2⤵
  PID:10508
- C:\Windows\System\mgjAdVl.exe
  C:\Windows\System\mgjAdVl.exe
  2⤵
  PID:10524
- C:\Windows\System\BKhqZiv.exe
  C:\Windows\System\BKhqZiv.exe
  2⤵
  PID:10540
- C:\Windows\System\xyJwIWD.exe
  C:\Windows\System\xyJwIWD.exe
  2⤵
  PID:10556
- C:\Windows\System\HUUraoZ.exe
  C:\Windows\System\HUUraoZ.exe
  2⤵
  PID:10572
- C:\Windows\System\WYGZcAn.exe
  C:\Windows\System\WYGZcAn.exe
  2⤵
  PID:10588
- C:\Windows\System\qyxxHkg.exe
  C:\Windows\System\qyxxHkg.exe
  2⤵
  PID:10604
- C:\Windows\System\dZBeotB.exe
  C:\Windows\System\dZBeotB.exe
  2⤵
  PID:10620
- C:\Windows\System\OIQpnye.exe
  C:\Windows\System\OIQpnye.exe
  2⤵
  PID:10636
- C:\Windows\System\fSgMOBk.exe
  C:\Windows\System\fSgMOBk.exe
  2⤵
  PID:10652
- C:\Windows\System\NvOVFCM.exe
  C:\Windows\System\NvOVFCM.exe
  2⤵
  PID:10668
- C:\Windows\System\XiJrduW.exe
  C:\Windows\System\XiJrduW.exe
  2⤵
  PID:10684
- C:\Windows\System\WDnIzUy.exe
  C:\Windows\System\WDnIzUy.exe
  2⤵
  PID:10700
- C:\Windows\System\FfyWxfp.exe
  C:\Windows\System\FfyWxfp.exe
  2⤵
  PID:10716
- C:\Windows\System\QvwPQcT.exe
  C:\Windows\System\QvwPQcT.exe
  2⤵
  PID:10732
- C:\Windows\System\umIASGi.exe
  C:\Windows\System\umIASGi.exe
  2⤵
  PID:10748
- C:\Windows\System\OrqLJZh.exe
  C:\Windows\System\OrqLJZh.exe
  2⤵
  PID:10764
- C:\Windows\System\YPetLFI.exe
  C:\Windows\System\YPetLFI.exe
  2⤵
  PID:10780
- C:\Windows\System\gZzWpFH.exe
  C:\Windows\System\gZzWpFH.exe
  2⤵
  PID:10796
- C:\Windows\System\OhGqdWH.exe
  C:\Windows\System\OhGqdWH.exe
  2⤵
  PID:10812
- C:\Windows\System\NgqjFaW.exe
  C:\Windows\System\NgqjFaW.exe
  2⤵
  PID:10828
- C:\Windows\System\fenGNdT.exe
  C:\Windows\System\fenGNdT.exe
  2⤵
  PID:10844
- C:\Windows\System\awBQpnY.exe
  C:\Windows\System\awBQpnY.exe
  2⤵
  PID:10860
- C:\Windows\System\TwrfdHS.exe
  C:\Windows\System\TwrfdHS.exe
  2⤵
  PID:10876
- C:\Windows\System\OGnuxmH.exe
  C:\Windows\System\OGnuxmH.exe
  2⤵
  PID:10892
- C:\Windows\System\QJhVRMD.exe
  C:\Windows\System\QJhVRMD.exe
  2⤵
  PID:10908
- C:\Windows\System\dWCcptX.exe
  C:\Windows\System\dWCcptX.exe
  2⤵
  PID:10924
- C:\Windows\System\YKkeoIk.exe
  C:\Windows\System\YKkeoIk.exe
  2⤵
  PID:10940
- C:\Windows\System\fZTmNKR.exe
  C:\Windows\System\fZTmNKR.exe
  2⤵
  PID:10956
- C:\Windows\System\BHEaJGw.exe
  C:\Windows\System\BHEaJGw.exe
  2⤵
  PID:10972
- C:\Windows\System\yrLliFL.exe
  C:\Windows\System\yrLliFL.exe
  2⤵
  PID:10988
- C:\Windows\System\kMRRWLd.exe
  C:\Windows\System\kMRRWLd.exe
  2⤵
  PID:11004
- C:\Windows\System\OpNFpZp.exe
  C:\Windows\System\OpNFpZp.exe
  2⤵
  PID:11020
- C:\Windows\System\UCBrpNF.exe
  C:\Windows\System\UCBrpNF.exe
  2⤵
  PID:11036
- C:\Windows\System\FDqiCUo.exe
  C:\Windows\System\FDqiCUo.exe
  2⤵
  PID:11052
- C:\Windows\System\nnApTWJ.exe
  C:\Windows\System\nnApTWJ.exe
  2⤵
  PID:11068
- C:\Windows\System\poCdmDb.exe
  C:\Windows\System\poCdmDb.exe
  2⤵
  PID:11084
- C:\Windows\System\lfHjpnl.exe
  C:\Windows\System\lfHjpnl.exe
  2⤵
  PID:11100
- C:\Windows\System\Gjfumoe.exe
  C:\Windows\System\Gjfumoe.exe
  2⤵
  PID:11116
- C:\Windows\System\TqKLlSt.exe
  C:\Windows\System\TqKLlSt.exe
  2⤵
  PID:11132
- C:\Windows\System\iAXgMSe.exe
  C:\Windows\System\iAXgMSe.exe
  2⤵
  PID:11148
- C:\Windows\System\BrObjzg.exe
  C:\Windows\System\BrObjzg.exe
  2⤵
  PID:11164
- C:\Windows\System\lzwYuhT.exe
  C:\Windows\System\lzwYuhT.exe
  2⤵
  PID:11180
- C:\Windows\System\unCqHIt.exe
  C:\Windows\System\unCqHIt.exe
  2⤵
  PID:11196
- C:\Windows\System\kKOgqCt.exe
  C:\Windows\System\kKOgqCt.exe
  2⤵
  PID:11212
- C:\Windows\System\WUBfrSB.exe
  C:\Windows\System\WUBfrSB.exe
  2⤵
  PID:11228
- C:\Windows\System\gsNoVSr.exe
  C:\Windows\System\gsNoVSr.exe
  2⤵
  PID:11244
- C:\Windows\System\DMizFxV.exe
  C:\Windows\System\DMizFxV.exe
  2⤵
  PID:11260
- C:\Windows\System\TkDFFBl.exe
  C:\Windows\System\TkDFFBl.exe
  2⤵
  PID:10292
- C:\Windows\System\zwuqbyV.exe
  C:\Windows\System\zwuqbyV.exe
  2⤵
  PID:3024
- C:\Windows\System\bLAhAod.exe
  C:\Windows\System\bLAhAod.exe
  2⤵
  PID:10420
- C:\Windows\System\zAbXOud.exe
  C:\Windows\System\zAbXOud.exe
  2⤵
  PID:10484
- C:\Windows\System\GMdpDqQ.exe
  C:\Windows\System\GMdpDqQ.exe
  2⤵
  PID:10520
- C:\Windows\System\qnWygoA.exe
  C:\Windows\System\qnWygoA.exe
  2⤵
  PID:10552
- C:\Windows\System\fIeQkga.exe
  C:\Windows\System\fIeQkga.exe
  2⤵
  PID:10612
- C:\Windows\System\XGLPvDv.exe
  C:\Windows\System\XGLPvDv.exe
  2⤵
  PID:10244
- C:\Windows\System\NMtqZmX.exe
  C:\Windows\System\NMtqZmX.exe
  2⤵
  PID:8756
- C:\Windows\System\pzOXxlc.exe
  C:\Windows\System\pzOXxlc.exe
  2⤵
  PID:10712
- C:\Windows\System\MilPXev.exe
  C:\Windows\System\MilPXev.exe
  2⤵
  PID:9840
- C:\Windows\System\SwyRizp.exe
  C:\Windows\System\SwyRizp.exe
  2⤵
  PID:9952
- C:\Windows\System\JUgLBCf.exe
  C:\Windows\System\JUgLBCf.exe
  2⤵
  PID:10776
- C:\Windows\System\XJdwnMc.exe
  C:\Windows\System\XJdwnMc.exe
  2⤵
  PID:7820
- C:\Windows\System\MGhbUHt.exe
  C:\Windows\System\MGhbUHt.exe
  2⤵
  PID:1576
- C:\Windows\System\HCnxHYp.exe
  C:\Windows\System\HCnxHYp.exe
  2⤵
  PID:10532
- C:\Windows\System\XiFOcUC.exe
  C:\Windows\System\XiFOcUC.exe
  2⤵
  PID:8920
- C:\Windows\System\OlYAAmK.exe
  C:\Windows\System\OlYAAmK.exe
  2⤵
  PID:9756
- C:\Windows\System\nvaHeSq.exe
  C:\Windows\System\nvaHeSq.exe
  2⤵
  PID:6892
- C:\Windows\System\JxpHcPk.exe
  C:\Windows\System\JxpHcPk.exe
  2⤵
  PID:9580
- C:\Windows\System\RadxLnT.exe
  C:\Windows\System\RadxLnT.exe
  2⤵
  PID:9408
- C:\Windows\System\fYWITwf.exe
  C:\Windows\System\fYWITwf.exe
  2⤵
  PID:7756
- C:\Windows\System\ltTWzds.exe
  C:\Windows\System\ltTWzds.exe
  2⤵
  PID:10504
- C:\Windows\System\jrBqaHM.exe
  C:\Windows\System\jrBqaHM.exe
  2⤵
  PID:10564
- C:\Windows\System\VpIoXzG.exe
  C:\Windows\System\VpIoXzG.exe
  2⤵
  PID:10280
- C:\Windows\System\QpizpyU.exe
  C:\Windows\System\QpizpyU.exe
  2⤵
  PID:10376
- C:\Windows\System\SWGqSTm.exe
  C:\Windows\System\SWGqSTm.exe
  2⤵
  PID:10856
- C:\Windows\System\zhiXUFx.exe
  C:\Windows\System\zhiXUFx.exe
  2⤵
  PID:10596
- C:\Windows\System\IjKPLSL.exe
  C:\Windows\System\IjKPLSL.exe
  2⤵
  PID:10664
- C:\Windows\System\tSUuVJg.exe
  C:\Windows\System\tSUuVJg.exe
  2⤵
  PID:10760
- C:\Windows\System\jUSirZO.exe
  C:\Windows\System\jUSirZO.exe
  2⤵
  PID:10820
- C:\Windows\System\yeYpxRT.exe
  C:\Windows\System\yeYpxRT.exe
  2⤵
  PID:10932
- C:\Windows\System\ETfeozy.exe
  C:\Windows\System\ETfeozy.exe
  2⤵
  PID:10920
- C:\Windows\System\jkPjvKo.exe
  C:\Windows\System\jkPjvKo.exe
  2⤵
  PID:10952
- C:\Windows\System\OoXbFJv.exe
  C:\Windows\System\OoXbFJv.exe
  2⤵
  PID:7720
- C:\Windows\System\mppkbBK.exe
  C:\Windows\System\mppkbBK.exe
  2⤵
  PID:10984
- C:\Windows\System\jkpAgmH.exe
  C:\Windows\System\jkpAgmH.exe
  2⤵
  PID:11076
- C:\Windows\System\pzXGfCx.exe
  C:\Windows\System\pzXGfCx.exe
  2⤵
  PID:11080
- C:\Windows\System\dfwuXhg.exe
  C:\Windows\System\dfwuXhg.exe
  2⤵
  PID:11112
- C:\Windows\System\DPzlPWr.exe
  C:\Windows\System\DPzlPWr.exe
  2⤵
  PID:11144
- C:\Windows\System\ypfxcRR.exe
  C:\Windows\System\ypfxcRR.exe
  2⤵
  PID:11192
- C:\Windows\System\fXfcNhC.exe
  C:\Windows\System\fXfcNhC.exe
  2⤵
  PID:11252
- C:\Windows\System\RCIhnse.exe
  C:\Windows\System\RCIhnse.exe
  2⤵
  PID:10324
- C:\Windows\System\izCVmmi.exe
  C:\Windows\System\izCVmmi.exe
  2⤵
  PID:11240
- C:\Windows\System\RolJMvf.exe
  C:\Windows\System\RolJMvf.exe
  2⤵
  PID:10452
- C:\Windows\System\hhRuYsA.exe
  C:\Windows\System\hhRuYsA.exe
  2⤵
  PID:10648
- C:\Windows\System\XDpkGwA.exe
  C:\Windows\System\XDpkGwA.exe
  2⤵
  PID:10372
- C:\Windows\System\CaclqQW.exe
  C:\Windows\System\CaclqQW.exe
  2⤵
  PID:10840
- C:\Windows\System\GjiMAqW.exe
  C:\Windows\System\GjiMAqW.exe
  2⤵
  PID:10584
- C:\Windows\System\oRhYxYX.exe
  C:\Windows\System\oRhYxYX.exe
  2⤵
  PID:10440
- C:\Windows\System\JnyVLRO.exe
  C:\Windows\System\JnyVLRO.exe
  2⤵
  PID:10728
- C:\Windows\System\bXwICOb.exe
  C:\Windows\System\bXwICOb.exe
  2⤵
  PID:10536
- C:\Windows\System\QlFQBca.exe
  C:\Windows\System\QlFQBca.exe
  2⤵
  PID:10516
- C:\Windows\System\zOVWxjv.exe
  C:\Windows\System\zOVWxjv.exe
  2⤵
  PID:4044
- C:\Windows\System\lERXzMP.exe
  C:\Windows\System\lERXzMP.exe
  2⤵
  PID:9736
- C:\Windows\System\vgwuetk.exe
  C:\Windows\System\vgwuetk.exe
  2⤵
  PID:7652
- C:\Windows\System\oeEboRf.exe
  C:\Windows\System\oeEboRf.exe
  2⤵
  PID:10248
- C:\Windows\System\HynExxf.exe
  C:\Windows\System\HynExxf.exe
  2⤵
  PID:10884
- C:\Windows\System\zgyygIH.exe
  C:\Windows\System\zgyygIH.exe
  2⤵
  PID:10888
- C:\Windows\System\gphvQgf.exe
  C:\Windows\System\gphvQgf.exe
  2⤵
  PID:10996
- C:\Windows\System\QeAlFRO.exe
  C:\Windows\System\QeAlFRO.exe
  2⤵
  PID:11044
- C:\Windows\System\QUmOzdR.exe
  C:\Windows\System\QUmOzdR.exe
  2⤵
  PID:11128
- C:\Windows\System\tcFcPbk.exe
  C:\Windows\System\tcFcPbk.exe
  2⤵
  PID:11108
- C:\Windows\System\fiTllGw.exe
  C:\Windows\System\fiTllGw.exe
  2⤵
  PID:10328
- C:\Windows\System\DDyxibO.exe
  C:\Windows\System\DDyxibO.exe
  2⤵
  PID:10744
- C:\Windows\System\mvsbUpq.exe
  C:\Windows\System\mvsbUpq.exe
  2⤵
  PID:10808
- C:\Windows\System\TYjkslF.exe
  C:\Windows\System\TYjkslF.exe
  2⤵
  PID:10872
- C:\Windows\System\LlqZpDJ.exe
  C:\Windows\System\LlqZpDJ.exe
  2⤵
  PID:10644
- C:\Windows\System\EXYcnSL.exe
  C:\Windows\System\EXYcnSL.exe
  2⤵
  PID:10676
- C:\Windows\System\Amueskc.exe
  C:\Windows\System\Amueskc.exe
  2⤵
  PID:4460
- C:\Windows\System\AsZpqMP.exe
  C:\Windows\System\AsZpqMP.exe
  2⤵
  PID:11236
- C:\Windows\System\SJSIxAo.exe
  C:\Windows\System\SJSIxAo.exe
  2⤵
  PID:11160
- C:\Windows\System\kcJIdDy.exe
  C:\Windows\System\kcJIdDy.exe
  2⤵
  PID:10980
- C:\Windows\System\WpjcfOB.exe
  C:\Windows\System\WpjcfOB.exe
  2⤵
  PID:11188
- C:\Windows\System\MhcJTwg.exe
  C:\Windows\System\MhcJTwg.exe
  2⤵
  PID:10852
- C:\Windows\System\xdWWUNy.exe
  C:\Windows\System\xdWWUNy.exe
  2⤵
  PID:10404
- C:\Windows\System\OcBhPRt.exe
  C:\Windows\System\OcBhPRt.exe
  2⤵
  PID:10756
- C:\Windows\System\mYtoKGI.exe
  C:\Windows\System\mYtoKGI.exe
  2⤵
  PID:10824
- C:\Windows\System\qNtYezJ.exe
  C:\Windows\System\qNtYezJ.exe
  2⤵
  PID:9904
- C:\Windows\System\mmCmpUs.exe
  C:\Windows\System\mmCmpUs.exe
  2⤵
  PID:11016
- C:\Windows\System\knMLFFJ.exe
  C:\Windows\System\knMLFFJ.exe
  2⤵
  PID:10580
- C:\Windows\System\uJVRMkh.exe
  C:\Windows\System\uJVRMkh.exe
  2⤵
  PID:11060
- C:\Windows\System\hAehrdt.exe
  C:\Windows\System\hAehrdt.exe
  2⤵
  PID:10968
- C:\Windows\System\gKtioZz.exe
  C:\Windows\System\gKtioZz.exe
  2⤵
  PID:10340
- C:\Windows\System\xZptkvk.exe
  C:\Windows\System\xZptkvk.exe
  2⤵
  PID:4592
- C:\Windows\System\FUELgjf.exe
  C:\Windows\System\FUELgjf.exe
  2⤵
  PID:11268
- C:\Windows\System\ETkzwPX.exe
  C:\Windows\System\ETkzwPX.exe
  2⤵
  PID:11288
- C:\Windows\System\llLDKUy.exe
  C:\Windows\System\llLDKUy.exe
  2⤵
  PID:11304
- C:\Windows\System\ngtcMsx.exe
  C:\Windows\System\ngtcMsx.exe
  2⤵
  PID:11320
- C:\Windows\System\ZTNGpUu.exe
  C:\Windows\System\ZTNGpUu.exe
  2⤵
  PID:11336
- C:\Windows\System\cFoppSl.exe
  C:\Windows\System\cFoppSl.exe
  2⤵
  PID:11352
- C:\Windows\System\mmbWfdH.exe
  C:\Windows\System\mmbWfdH.exe
  2⤵
  PID:11368
- C:\Windows\System\vUsnavc.exe
  C:\Windows\System\vUsnavc.exe
  2⤵
  PID:11384
- C:\Windows\System\NGYsgBv.exe
  C:\Windows\System\NGYsgBv.exe
  2⤵
  PID:11400
- C:\Windows\System\lvNQrmW.exe
  C:\Windows\System\lvNQrmW.exe
  2⤵
  PID:11416
- C:\Windows\System\vbLrrSQ.exe
  C:\Windows\System\vbLrrSQ.exe
  2⤵
  PID:11432
- C:\Windows\System\SVgQvVu.exe
  C:\Windows\System\SVgQvVu.exe
  2⤵
  PID:11448
- C:\Windows\System\KsxMJAr.exe
  C:\Windows\System\KsxMJAr.exe
  2⤵
  PID:11464
- C:\Windows\System\thllRwz.exe
  C:\Windows\System\thllRwz.exe
  2⤵
  PID:11480
- C:\Windows\System\eQcWbVS.exe
  C:\Windows\System\eQcWbVS.exe
  2⤵
  PID:11496
- C:\Windows\System\WROPKat.exe
  C:\Windows\System\WROPKat.exe
  2⤵
  PID:11512
- C:\Windows\System\sItjMGP.exe
  C:\Windows\System\sItjMGP.exe
  2⤵
  PID:11528
- C:\Windows\System\KVusRqR.exe
  C:\Windows\System\KVusRqR.exe
  2⤵
  PID:11544
- C:\Windows\System\IeGFVZx.exe
  C:\Windows\System\IeGFVZx.exe
  2⤵
  PID:11560
- C:\Windows\System\ECjfhxd.exe
  C:\Windows\System\ECjfhxd.exe
  2⤵
  PID:11576
- C:\Windows\System\VAeXtma.exe
  C:\Windows\System\VAeXtma.exe
  2⤵
  PID:11592
- C:\Windows\System\qsUrEOU.exe
  C:\Windows\System\qsUrEOU.exe
  2⤵
  PID:11608
- C:\Windows\System\PHXUmhG.exe
  C:\Windows\System\PHXUmhG.exe
  2⤵
  PID:11624
- C:\Windows\System\wAJiOgt.exe
  C:\Windows\System\wAJiOgt.exe
  2⤵
  PID:11640
- C:\Windows\System\ilnUWgd.exe
  C:\Windows\System\ilnUWgd.exe
  2⤵
  PID:11656
- C:\Windows\System\mcUHSgT.exe
  C:\Windows\System\mcUHSgT.exe
  2⤵
  PID:11672
- C:\Windows\System\CVULiAD.exe
  C:\Windows\System\CVULiAD.exe
  2⤵
  PID:11688
- C:\Windows\System\NATyIYs.exe
  C:\Windows\System\NATyIYs.exe
  2⤵
  PID:11704
- C:\Windows\System\XCGTqtD.exe
  C:\Windows\System\XCGTqtD.exe
  2⤵
  PID:11720
- C:\Windows\System\vlZGzlB.exe
  C:\Windows\System\vlZGzlB.exe
  2⤵
  PID:11736
- C:\Windows\System\dWEWLSr.exe
  C:\Windows\System\dWEWLSr.exe
  2⤵
  PID:11752
- C:\Windows\System\YWJtbMt.exe
  C:\Windows\System\YWJtbMt.exe
  2⤵
  PID:11768
- C:\Windows\System\BNEDcJB.exe
  C:\Windows\System\BNEDcJB.exe
  2⤵
  PID:11784
- C:\Windows\System\TjCQAsL.exe
  C:\Windows\System\TjCQAsL.exe
  2⤵
  PID:11800
- C:\Windows\System\tKFGKzz.exe
  C:\Windows\System\tKFGKzz.exe
  2⤵
  PID:11816
- C:\Windows\System\aXsiOxL.exe
  C:\Windows\System\aXsiOxL.exe
  2⤵
  PID:11832
- C:\Windows\System\BrzFPAw.exe
  C:\Windows\System\BrzFPAw.exe
  2⤵
  PID:11848
- C:\Windows\System\ZJVVNDU.exe
  C:\Windows\System\ZJVVNDU.exe
  2⤵
  PID:11864
- C:\Windows\System\NpoQmcE.exe
  C:\Windows\System\NpoQmcE.exe
  2⤵
  PID:11880
- C:\Windows\System\ajRIovP.exe
  C:\Windows\System\ajRIovP.exe
  2⤵
  PID:11896
- C:\Windows\System\QZKPeqw.exe
  C:\Windows\System\QZKPeqw.exe
  2⤵
  PID:11912
- C:\Windows\System\dKKtRVf.exe
  C:\Windows\System\dKKtRVf.exe
  2⤵
  PID:11928
- C:\Windows\System\EtLkNbT.exe
  C:\Windows\System\EtLkNbT.exe
  2⤵
  PID:11944
- C:\Windows\System\hwJSQSJ.exe
  C:\Windows\System\hwJSQSJ.exe
  2⤵
  PID:11960
- C:\Windows\System\EPikquC.exe
  C:\Windows\System\EPikquC.exe
  2⤵
  PID:11976
- C:\Windows\System\VIkevBR.exe
  C:\Windows\System\VIkevBR.exe
  2⤵
  PID:11992
- C:\Windows\System\eqhntiq.exe
  C:\Windows\System\eqhntiq.exe
  2⤵
  PID:12008
- C:\Windows\System\sSSofdT.exe
  C:\Windows\System\sSSofdT.exe
  2⤵
  PID:12024
- C:\Windows\System\wVxomfo.exe
  C:\Windows\System\wVxomfo.exe
  2⤵
  PID:12040
- C:\Windows\System\ZrEfBUq.exe
  C:\Windows\System\ZrEfBUq.exe
  2⤵
  PID:12056
- C:\Windows\System\hNrCOAi.exe
  C:\Windows\System\hNrCOAi.exe
  2⤵
  PID:12072
- C:\Windows\System\WzpimdX.exe
  C:\Windows\System\WzpimdX.exe
  2⤵
  PID:12088
- C:\Windows\System\VFPYWMd.exe
  C:\Windows\System\VFPYWMd.exe
  2⤵
  PID:12104
- C:\Windows\System\GMJPmxs.exe
  C:\Windows\System\GMJPmxs.exe
  2⤵
  PID:12120
- C:\Windows\System\nwdvawy.exe
  C:\Windows\System\nwdvawy.exe
  2⤵
  PID:12136
- C:\Windows\System\EYpogfv.exe
  C:\Windows\System\EYpogfv.exe
  2⤵
  PID:12152
- C:\Windows\System\SUzpIYt.exe
  C:\Windows\System\SUzpIYt.exe
  2⤵
  PID:12168
- C:\Windows\System\wOSMxoL.exe
  C:\Windows\System\wOSMxoL.exe
  2⤵
  PID:12184
- C:\Windows\System\LHolWbv.exe
  C:\Windows\System\LHolWbv.exe
  2⤵
  PID:12200
- C:\Windows\System\NwffrDn.exe
  C:\Windows\System\NwffrDn.exe
  2⤵
  PID:12216
- C:\Windows\System\kUSsaGC.exe
  C:\Windows\System\kUSsaGC.exe
  2⤵
  PID:12232
- C:\Windows\System\hOIdPfg.exe
  C:\Windows\System\hOIdPfg.exe
  2⤵
  PID:12248
- C:\Windows\System\aWJJJnY.exe
  C:\Windows\System\aWJJJnY.exe
  2⤵
  PID:12264
- C:\Windows\System\lwmbTfy.exe
  C:\Windows\System\lwmbTfy.exe
  2⤵
  PID:12280
- C:\Windows\System\AGINYVf.exe
  C:\Windows\System\AGINYVf.exe
  2⤵
  PID:11296
- C:\Windows\System\xUqDPNX.exe
  C:\Windows\System\xUqDPNX.exe
  2⤵
  PID:11332
- C:\Windows\System\xALGGfR.exe
  C:\Windows\System\xALGGfR.exe
  2⤵
  PID:11312
- C:\Windows\System\YCSnCvh.exe
  C:\Windows\System\YCSnCvh.exe
  2⤵
  PID:11316
- C:\Windows\System\oDrVPri.exe
  C:\Windows\System\oDrVPri.exe
  2⤵
  PID:11424
- C:\Windows\System\fIEVAfs.exe
  C:\Windows\System\fIEVAfs.exe
  2⤵
  PID:11460
- C:\Windows\System\IWdYUZH.exe
  C:\Windows\System\IWdYUZH.exe
  2⤵
  PID:11488
- C:\Windows\System\bFIxgap.exe
  C:\Windows\System\bFIxgap.exe
  2⤵
  PID:11472
- C:\Windows\System\TzPzTQT.exe
  C:\Windows\System\TzPzTQT.exe
  2⤵
  PID:11524
- C:\Windows\System\jZraVvo.exe
  C:\Windows\System\jZraVvo.exe
  2⤵
  PID:11588
- C:\Windows\System\csQzQyZ.exe
  C:\Windows\System\csQzQyZ.exe
  2⤵
  PID:11536
- C:\Windows\System\GqpWkoF.exe
  C:\Windows\System\GqpWkoF.exe
  2⤵
  PID:11572
- C:\Windows\System\LevEHqs.exe
  C:\Windows\System\LevEHqs.exe
  2⤵
  PID:11636
- C:\Windows\System\VSNakBv.exe
  C:\Windows\System\VSNakBv.exe
  2⤵
  PID:11664
- C:\Windows\System\Ninzgqt.exe
  C:\Windows\System\Ninzgqt.exe
  2⤵
  PID:11744
- C:\Windows\System\iiRIfYu.exe
  C:\Windows\System\iiRIfYu.exe
  2⤵
  PID:11728
- C:\Windows\System\sFlSsoy.exe
  C:\Windows\System\sFlSsoy.exe
  2⤵
  PID:11812
- C:\Windows\System\aNRVJNx.exe
  C:\Windows\System\aNRVJNx.exe
  2⤵
  PID:11764
- C:\Windows\System\mmKbhuT.exe
  C:\Windows\System\mmKbhuT.exe
  2⤵
  PID:11908
- C:\Windows\System\GGaFPNf.exe
  C:\Windows\System\GGaFPNf.exe
  2⤵
  PID:11972
- C:\Windows\System\WHEZSAB.exe
  C:\Windows\System\WHEZSAB.exe
  2⤵
  PID:11792
- C:\Windows\System\RSiylKL.exe
  C:\Windows\System\RSiylKL.exe
  2⤵
  PID:12068
- C:\Windows\System\XtcnDUx.exe
  C:\Windows\System\XtcnDUx.exe
  2⤵
  PID:12132
- C:\Windows\System\pQAcCPz.exe
  C:\Windows\System\pQAcCPz.exe
  2⤵
  PID:12196
- C:\Windows\System\cVQETGJ.exe
  C:\Windows\System\cVQETGJ.exe
  2⤵
  PID:12260
- C:\Windows\System\KZSRgZE.exe
  C:\Windows\System\KZSRgZE.exe
  2⤵
  PID:11284
- C:\Windows\System\nMeWJew.exe
  C:\Windows\System\nMeWJew.exe
  2⤵
  PID:11380
- C:\Windows\System\nfEhZOd.exe
  C:\Windows\System\nfEhZOd.exe
  2⤵
  PID:11508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ENDQDgw.exe

Filesize
2.0MB

MD5
aa791e88ce278fdce075e6b45b8a7cbc

SHA1
1805503f0f30d96d132178fe69b0310d980742ea

SHA256
2d8ffe0b529bf0bda725fb0539b923b8df01600366a6979186f06801340066ea

SHA512
a35fc4869025492e0c60f8d9802a00df55c2aac58b4b1608dee6e48f8857c7aa02e177b80ef940fec3dd093932cdd41f849f9a0bb22558d18bdb3b76fa70d89b

Download Submit
C:\Windows\system\GsltqFi.exe

Filesize
2.0MB

MD5
a9a90507b44ae3cbfd16be044f2788cb

SHA1
695d219bd9be8461e34ab2b748219234f1957b25

SHA256
f55396fd46ec7519d88b0ebae9358792b0212651255a10e54f9a636733ad3528

SHA512
1ea2c88c58448ef6e0a87b55a62273fd3566b153e23e727d4fb7f63fc5429cd5f4628dbb8a37276e5ea35e47cce4cb11a251b93838733d637bf47b556bae8bb6

Download Submit
C:\Windows\system\IPxAjjL.exe

Filesize
2.0MB

MD5
8e3d5d372f41fbc91ab30e63dc851c45

SHA1
e42afee8b3a64ec0a71babf3be0388c13e05696f

SHA256
b2c95bf0cef31c2ef0984247c9c57ae41381cbfe0f34d8ead05c362c1c66236b

SHA512
16c8a3d095aaf701e8ffbb3e65c1cac55b5bb3aadd23dc52f96881caef37cb863b4060172eb9a777106bdc562c3571a426ef7b5c677b48ed9ea705a66191f7a3

Download Submit
C:\Windows\system\JNFpUnn.exe

Filesize
2.0MB

MD5
9259edb2214e78c05908b8b5ff2d9069

SHA1
70fa47e499139c34fd54b72a1b78b87a3a4185b6

SHA256
790eb3d09a0d100c468501f7dda304dd115bf4ec886b93b8c86d8cd0372c576f

SHA512
6fb1f9b85651da8eaadaaebdf28d5b7c26725debd954c5878ab37f4f88fe501f38a758af653531a548e4d07309b48dc759f019dbf9efe708e49d6ecc601491d9

Download Submit
C:\Windows\system\KFNFHQP.exe

Filesize
2.0MB

MD5
12a6631fd2ca793fd908701aa4e9f261

SHA1
0825aacbb371385da3f48068cfdf931aa22cdf28

SHA256
7a069fb04eb1c350e30a85619a963bfa2b89216d3df1fe4a397b62e76ad129f1

SHA512
0f1834d7ff0028454c31b0cf9cfb6fa19c7adcc59f8701a03e0dd70751b8b815de8bf8adda0b1aa0fe09b3d33635ac0859feb8974d26477221d5280175b44efa

Download Submit
C:\Windows\system\KdXKJsj.exe

Filesize
2.0MB

MD5
0afb21a40ab6415d38ef5ca51a8dcc80

SHA1
7826e45214f1a3606cdf28a5cce131cde22f7780

SHA256
5ec19a11010cbfbf5401f492b9110c14028f70d4d87fcdfdd7b48dd62b681368

SHA512
8bee98a24bcd58a946757c1d4fb6fe4cb2933c890db40d0e590da1eda4c789244570b0c49c0cdc41c30bee43e234b792c3f725c45f8ea4a0c4e01a226dcb43ea

Download Submit
C:\Windows\system\Pdabprh.exe

Filesize
2.0MB

MD5
73c9142d1b01e483f194a766a381fa4a

SHA1
8375bb5f5b1df1af6a4ad71b9669e7b80555d4bf

SHA256
2303f0356a901c852b4a53848e22a7d416690aa3304e7ebfcfb996daedd22093

SHA512
b5733ae4390b0201e91db983857071c05d3531d533297d4af2f2abddebda7a5da5e18dedb241e9e5185db027ad52beb1f8d8624154bbabff59e7c4beba7eaf7e

Download Submit
C:\Windows\system\QPOrXrI.exe

Filesize
2.0MB

MD5
13c3139fc3e1795357758841e6212515

SHA1
1428dddaf1a7b9163e58dd70b98407121a77c94a

SHA256
57aa98c1ed290001f377fbd5ba628755c40c254f96c9ecbcb472696f0eaae73d

SHA512
927992428336afc8011ff98ad71ce8de80c2beedd60f7b6bfdd5635a856f8a93248a769f9ba62008604dbf195198ccf0d6c71c9fb2a64e0c4855cacd6d11c8c3

Download Submit
C:\Windows\system\RhztoFp.exe

Filesize
2.0MB

MD5
2785abd60e3cff8c2be9e251a4a4bc25

SHA1
6214ec7856a49be4da9aad2312c1b270481e6c9c

SHA256
b8333dc95a4ab35f01bd68955cacd2144be7ea5c431b3b79e48eda872ffc0fc6

SHA512
200b0b729658d7856d1e04bd13314fa421c11b622e5577ebd14599be20ec2d9f9b8d16ef3dc2513e925a06b2b93f73c20bdf354f9266d13061496233a8e227e3

Download Submit
C:\Windows\system\VGRFWSC.exe

Filesize
2.0MB

MD5
9cdbd3519e9598b042026f886074b212

SHA1
c7ea777de1cae5e9aaaa7309e25f50dab828a721

SHA256
4a3652a103f23e2cc5190bdaf61e715751877bf692df8af1f40b985eb78bd360

SHA512
312a557f88e714c116674c2f1093d1b9cfeec3a461f051fe710de208f649c38dc458a73ae8895c61ebffbde9f016b915348d18e644fc7bc0e2945c46028b2081

Download Submit
C:\Windows\system\ZgmhOLH.exe

Filesize
2.0MB

MD5
097cbfe5b590e8fcdc25c00d2f3f1578

SHA1
1ea6b7e4c54d2a7caaa68f78c019b19404377416

SHA256
a48d65d7378b982ee5f35a53c7f0f90108cfae4d17b8a2adb4df300ed29329d2

SHA512
0f5175550ca54cc4ab2403d2afd776299664bf2b19f4757e2c855eaa9a1410f9eb58ec21bb1e077a41604ca7e31493fc55d52eb4573d35448a35d1f12b734d75

Download Submit
C:\Windows\system\bakkvyi.exe

Filesize
8B

MD5
30a9dfceb37577cb23b97b50ee0ca790

SHA1
b56360a546aafbfa7ce003cd05916a7ab7239259

SHA256
44dda0d0cfe87b066fcb3ae3e2b0cbc86f86ca0fdd14c7ce736c7a63fedce1f4

SHA512
f1ae1743e6029aabc9e7387b476be46b30f000874bca6e0907b605cfb329a40abfc7d4eb3d891027c469be0356b370267e0531be7c50ab8183a5aad8ce1cbe57

Download Submit
C:\Windows\system\cOzgxrm.exe

Filesize
2.0MB

MD5
a384d5a0f44fb9069af68ef8865d6f1a

SHA1
5c7733d1c30c5e0558036b3529b26edf5c3de6f6

SHA256
ba05f2c2b64dfcbe707ac3c8bb02b25fd25d225df83bff3afa19e0073503f987

SHA512
9e40452c2c163fb0fe10c0bc264699ed742130e33020364d595a6dd7b2e87b04818a900898c093e5434a0f9783525044095041275171ac74cbf7365e84469032

Download Submit
C:\Windows\system\fcvSadt.exe

Filesize
2.0MB

MD5
5a5c5cddcd4e7acc5324fa3857104d49

SHA1
ab3b41b802829989c8b12ab0a815a04800bea9c2

SHA256
afa69859448ed8194c8ab9843909f3064e50b907a0248c231bda06e4423df1f0

SHA512
3ce5c121af06e2c30ec5e3a1bdc6080a357c073fff1fe008d92304a1824eda157bde802899549ba03537d016b14933009353ae79ac0704576986596cae815951

Download Submit
C:\Windows\system\frRlBeK.exe

Filesize
2.0MB

MD5
4e424501d7eca8a901981cf92fa3fc1b

SHA1
86566204734ee21e0dcb9dadd73443a213dbb8f6

SHA256
cc799729d9772262133de8ffd140058f6c1263d1ef2156612da1e460d86cb466

SHA512
67f77752024d5e4494abefcb466e114706d93b52541141d21c6d58779aa53b942d3d04b215a89ad58a9e916d1aa33d44cdcbc18c3597f981e981140faf682ff0

Download Submit
C:\Windows\system\haYVyyo.exe

Filesize
2.0MB

MD5
b2cc47210a460fc76b22d0081eb3f53f

SHA1
27b123fb6de87a27679235cc266fc53f35e2791a

SHA256
0ae0aa22cd7916d43d29558e260bcc0bd1ded3dfc35b36c1eaafa8fddee130b2

SHA512
e61b8dd3bd075e1972910ea6c19a759a6f54a48226208c92d856093dfa905e73a2f7377f1786c14eaadf71fc46466e64f4606d7e40bcdffa5acad1a49ce73f7c

Download Submit
C:\Windows\system\jEXshkO.exe

Filesize
2.0MB

MD5
e44b4745bafce5c0b48671901b4f0a82

SHA1
cda0e93b897e8b9db1fc03ef3a487236cd016955

SHA256
f66ea3116d8b0c9989977effd6d44334181b8e9451f93a509625edca5b24b139

SHA512
14bbc2bfd8342a5ca09bb6a12ce50f3b029f6fcfaa3e1c62f7d9bae510edc4411006c387583fb26774b7b2a5a449bdd02d23f480bab2bb040fc7a43b88307972

Download Submit
C:\Windows\system\ndwzQef.exe

Filesize
2.0MB

MD5
f4dcee11346c9a40c576f55ea3527d0e

SHA1
deee8d14c1aa33ca0c18f2924b8f59074f93e417

SHA256
41686fe295cf99323fa10a1e45b832c2d36363022e25276121077c7fbc58763f

SHA512
6752fae97e75c015664ab2e9d89f68d2b68ebec189fdf3a1ce2b1c92f9c433eacaade9a449e65c4755ae63c48e3ce91eba9096b174ac5b7dc2953338ae39ddb1

Download Submit
C:\Windows\system\nikdevG.exe

Filesize
2.0MB

MD5
0d42e2a4db0ccdf7180db2c5229d591e

SHA1
ea382178519c88b525b1271251fc053d4c9e14a8

SHA256
263734c34b1429e684051cb4053a919fa928a7c5cda92f2261ac557fa96035b8

SHA512
84147330305e6207a2198d9f6e57849d7e9876f18108ba60ef5adae148e4ca0400c8dcc6966e595274603330d70062835c474bf308d66345abb27c2f274035b1

Download Submit
C:\Windows\system\okLbkLb.exe

Filesize
2.0MB

MD5
a3bb62096697556d3bf30a4c9c0187dd

SHA1
37cfa198b1ac8632774be34e3de963c0e0626a9f

SHA256
a0ab7ab754fe906e5a61fe40ccf14ef4d806411583cf503b61ff725437155d41

SHA512
d9cf6bd2f6e2866f42f963dc62d5a32174acac6e83b4391256179668678ffd25a0ddd983754e32c009ca01b687ed6ef0426ba0a4135f4925081845540e74ec6c

Download Submit
C:\Windows\system\qfiXwGB.exe

Filesize
2.0MB

MD5
6b629f72f0d6f1f376d1ac35966ccd46

SHA1
8165f04a89e5d637932439c43646821e96ab5792

SHA256
7716f458ca107f8951fa59005fbdd4f061d08833e76a50b8f5f85e05e469a217

SHA512
63b8cc0deaaab7414e964bc70b4e0a34bed30a7e7c613859fadd99e36f060890dba168915a1fff914dfd508232746c0f3dbd3d7c3c684982ec891294862be4ef

Download Submit
C:\Windows\system\yWlVrXD.exe

Filesize
2.0MB

MD5
ec2175eafa5623aec00da80d233990a7

SHA1
b7891d99c690ea58e9fbb95edb596026f741bef5

SHA256
ea59a6b071e273f295ae1336b1aab319324b933662cf490a9b83e2764f04820b

SHA512
f6490919794904f7056f6eaa373ba7d280b98c06e345562b943c0fe6f92553b796d3a324237a92bca3ffe37d0840afed9b4c10faef857e2459e507818b68d835

Download Submit
C:\Windows\system\zgZGrhL.exe

Filesize
2.0MB

MD5
e22b9b0529a0c9a1b206bcae19f50c08

SHA1
db26bc9b38590b60974affcb2c1fc9b6656cafe2

SHA256
67719dd209ff64de749150a803475d848bc2bc5bdc13cf8614d4e033a96cc2bd

SHA512
5da445dbd600be1bfd07c58e722d71027c5ad2338aa528414ef86277b4972da8bdf6af64d436d2272df3954f396f1897fe56be88651e2a31281367e8ff064f9c

Download Submit
\Windows\system\AslzjjH.exe

Filesize
2.0MB

MD5
c47467bd3b285e998db0a21cca35802d

SHA1
9e60f499c9f918d659b893931f98c24ca82d6fd8

SHA256
0464a77610de912217398b55f697185df3715bf08c876246c37c098f6203650e

SHA512
6528447c5a1607d914111e8b1937ab5abcc5ae62355c02cb1f4e788397beed30048776d7bb8563796d36547151445c816aabf342b55993a38a9f27eb7a237963

Download Submit
\Windows\system\DJfbnKr.exe

Filesize
2.0MB

MD5
1379c37e8282b987c7aa91e6f6dd1f6e

SHA1
7a18d537fa6222cd86a14e4a7b4d3b8ce498a3c9

SHA256
39df589108ca7116896915cba23335bf5a5ea13400eb59e51f9700ee3e9c7600

SHA512
b22f1f8f340add236194ab70fa52b7109138a6d4104aacadf974385b85ef4bc81adb3bd6168eb99b8870f9089d7824dca50fc86e10dc25b464bc6d0876dd008f

Download Submit
\Windows\system\DPDjjHv.exe

Filesize
2.0MB

MD5
c57c3f97bb860cd66a2835fc77c66cf6

SHA1
8663bd7b1b629037637e41bfceb28fba72325c17

SHA256
f0767109b918e97e1c337d9b7c317ed8093564326b8a07da7f54d66c3a2fa274

SHA512
a136fcb1409ad95290c652d87cc06ac665830e4bd6e6161def13286fccd63a4e8cabd2c141af29bef25b435ceda9ac10a450a58de75ee1487b3fffc5cb4335df

Download Submit
\Windows\system\LpFoqkL.exe

Filesize
2.0MB

MD5
5b0cd46396a506fcf5f68c78251ae756

SHA1
d17abd8787129e47074055cf707e762fb35e574b

SHA256
ce31c8e988c841a146487787b4489206c8d922451c2ca1819f42cd0924d178b0

SHA512
6bcb41d1ce5faf68e68045705a90ff51d256dbe994cabfb88cb2d183374d59b583b2deebf22574af7cf9cbde5bfe2e63ff3391ef3b5c07deeb2e24c5d1a74b72

Download Submit
\Windows\system\NjohUAE.exe

Filesize
2.0MB

MD5
069cc90afa4bda2ed9d89a9a23944f1c

SHA1
62593c37e51f7c9a3219c1c5169b2e2fb75ca3cb

SHA256
c54ca331e273206d5f192f6c937ed7f46dcc068d4df761c0f18f4df5cfc1b856

SHA512
6834b6092bf8b41b45c0eee7f5192257fa0e647515975cd4c1f55ce5a0168b1bed3d25a937d1ed113ce9d20a61f6874dafefc2d4d6d442289658ccbc438012f2

Download Submit
\Windows\system\OGCBkdu.exe

Filesize
2.0MB

MD5
e041dadc818e9ea21ed6a1510338434b

SHA1
d0139f3f27df1561d3c00e5822778a4d8c5bf7d8

SHA256
ac361f4ab91f8334899b143ba2ab088d9fd747ac382cf9a1b477915202f2abf7

SHA512
381adb468389e297e9d048f858c27e7432b369f2783ee378ee507139f0d3a2cdacace9143aa05b41014068c2fe37c954a56767cd60cb2ff72fddf3c7ae786f7f

Download Submit
\Windows\system\RrcKvzy.exe

Filesize
2.0MB

MD5
4e5106551a25f8f99c9be2748b760f0e

SHA1
e1a11056410a4ae74f691b318817f721b37d9a08

SHA256
f7db53a38b0084d5c4c6483411416e25c2d26ff60ef5e9b0864bb28689a06765

SHA512
2e8b59651d3e11cb5f89e1fcc3b4e9c8d94f800ce947f28f0dc7a84c62b7b5e69affa3555df2a5a8641077643a7fef81c9601554d9d1e5873433e3f98a2174ea

Download Submit
\Windows\system\VbVtNLG.exe

Filesize
2.0MB

MD5
97f86f06500a5398a6b7730a5affa702

SHA1
d3304722dc948ea9386cb22fc357df0da365a74d

SHA256
52f7cd232b55d857386a8076bd25dac1dabc1193d93a60e383fa24f1f4d95d46

SHA512
12d112f6e25397cfeecca137e91b5e6f55b4231a08933f138e8eb1ff2ca0d6b917be8cdcbd2a900b626c9a4db4f269a11a21e47049a75b0f0ff98ffdfdcdeecd

Download Submit
\Windows\system\VudQNVH.exe

Filesize
2.0MB

MD5
bebd033bc4c7c70b5e2a161c862dd4cd

SHA1
161f4ad9a7d5a65814142816d066ba80ff9a39dc

SHA256
1dac0d4201c9680fa1a0b3793799e5fcad95687580e36a977d9c7fa9c5d33057

SHA512
0d12100a8ae41bd0cf93298344d9c213dea0475ac900e568c066f168829db5ab28b9d1af8cb4a956dfdc80001357b85b3cb0fa0b507f1c9ddd469b1e1e97e289

Download Submit
\Windows\system\ZQDOHHp.exe

Filesize
2.0MB

MD5
aa1ca7dfb71c13f5586f760ee05988be

SHA1
176378e838b63ce180aaf27c4e3f29daf78063e5

SHA256
f01fa30e7db5edbd02048f34cd29490ec2c5053036681922f57093ea925d01e5

SHA512
0c08fdc5cafda8340cf308b1e4fbb57305095127e8cc64796a432758ad766504b3860d04a477c81023ee0171917f74cff4d9284cff96e3f71fa01f9a09b6f41a

Download Submit
\Windows\system\dyYRbto.exe

Filesize
2.0MB

MD5
e37e786deae373bb5942c4a399228c19

SHA1
c1e000b3d439b93bc5c5462ab7abf116d95b4de9

SHA256
f72327a9896ddabd97afc2ed4252af974212fd55249d4e9b7cc82d15874b887e

SHA512
671711e5063c80daac9cf6a36400405a12c52e67e2e92af17cbbfd2c360aa10253bccf3d45bf18926c4cf8897aaffb845b8fe3d80ccca10181ea42b4e72916d8

Download Submit
\Windows\system\eNDbkjz.exe

Filesize
2.0MB

MD5
7855a86dd20a1ed4a0bcfd1defeaa097

SHA1
0502ff5ccf9120e23ebae49726c7d8a45782263f

SHA256
5adb52dcf69edca70ef5e69fe0e033fc5591723b392d733422a4005f59e76bb3

SHA512
ec8a40d178777c3667d926f0f09347cc70b03e0d7e18e5fa6c2d8e2be02d1dda4d461d700c2327ef0c00227ddbbf0ca71a397dffa776e7f77792d56b291e4aef

Download Submit
\Windows\system\izOndEM.exe

Filesize
2.0MB

MD5
a45e16d542cb8497a088796198616d44

SHA1
8b5edfc178ab62e6990821233407f86a594d22cd

SHA256
6233a1c9b62a523b0e76b922244cb98d6832f7eb3b5a3c6cbee7271e33e4f898

SHA512
14bce876a166eef5f967b9229673b73185504f1b66dd86f0bfe1d7be4697563eb1211e4f097b07956ea3980a9291eb47c49d9952325eb68c1c0dcc24777225ca

Download Submit
\Windows\system\nquLBcL.exe

Filesize
2.0MB

MD5
5fab4145f1208b7801899d6ac078e716

SHA1
3952f8a7474b5cd7c6262df41a2f0ac15bd46345

SHA256
8dedef5c0aed17ba2d35c5f797dc922eaf5992c639dc587c3a34320ea4b81aa5

SHA512
bdec8b4a88b6fb3fc470a6f161ba3d9ea45e50fe89c1109fde5bfce49bd260888435fd5c0122f27cb1a4baadd15841c279dd9538105b2f4ff2d49d0ef1573b25

Download Submit
\Windows\system\oRTqNSg.exe

Filesize
2.0MB

MD5
f9b4f8d5da5575376d2a634e5f76df38

SHA1
f3498efd84a82785ff3c0df212a10eeed650a413

SHA256
0c8bb00d2779232a91a5e622ea0b324fdba86350ec11320473503d5b485331e2

SHA512
acb3c4de2b27946a1fbae4ac88d84dc0281f4f7cd6fad7fd066a9a1214d78cc233c5543f1bd3c605a0ec667e3f975a9a17d9e2006555d0f575f461c9a6333eca

Download Submit
\Windows\system\xWMKiZa.exe

Filesize
2.0MB

MD5
3171859e6db81e7c15f5641aed05e4a3

SHA1
6f84231a1a4eec4ac622c8403a8ca4b8e3fc4d57

SHA256
b87095d5b5f30a31e1521f078042efa19ae74d4dcfcb8121c532d0aa4f1c5ac3

SHA512
234a016e85032bf6148d3664e199b369ef51cbabbc46e4fd09959030b59bffce42d2ed653282a0ffe4b20dd22029f510043f422310cc4680560e13e8b9ace74d

Download Submit
\Windows\system\xqmWFXU.exe

Filesize
2.0MB

MD5
dd44fe497728f75ee1e6b17d7387e9bf

SHA1
23ee06be38af3289269b9bd4a4513f6476f06187

SHA256
879d4445bc36b41a5aa2d86d67ba409cb1a46089db772c583d66862c232982a2

SHA512
d288884f784837160eb111f7f2ac71a2ba94c132b365afdc90f56bf6ffa7ba88c0fab286423822f711446c1ae5001164acba2a22600b7c330dccc14fb5c5be92

Download Submit
memory/1160-103-0x0000000001EE0000-0x0000000001EE8000-memory.dmp

Filesize
32KB

Download
memory/1160-70-0x000000001B6D0000-0x000000001B9B2000-memory.dmp

Filesize
2.9MB

Download
memory/2072-208-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/2072-18-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/2072-6848-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/2104-5-0x000000013F480000-0x000000013F872000-memory.dmp

Filesize
3.9MB

Download
memory/2104-49-0x0000000002FA0000-0x0000000003392000-memory.dmp

Filesize
3.9MB

Download
memory/2104-31-0x0000000002FA0000-0x0000000003392000-memory.dmp

Filesize
3.9MB

Download
memory/2104-46-0x0000000002FA0000-0x0000000003392000-memory.dmp

Filesize
3.9MB

Download
memory/2104-42-0x0000000002FA0000-0x0000000003392000-memory.dmp

Filesize
3.9MB

Download
memory/2104-88-0x000000013F480000-0x000000013F872000-memory.dmp

Filesize
3.9MB

Download
memory/2104-0-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/2104-25-0x0000000002FA0000-0x0000000003392000-memory.dmp

Filesize
3.9MB

Download
memory/2104-22-0x000000013FBF0000-0x000000013FFE2000-memory.dmp

Filesize
3.9MB

Download
memory/2104-47-0x0000000002FA0000-0x0000000003392000-memory.dmp

Filesize
3.9MB

Download
memory/2104-52-0x0000000002FA0000-0x0000000003392000-memory.dmp

Filesize
3.9MB

Download
memory/2104-51-0x000000013FA20000-0x000000013FE12000-memory.dmp

Filesize
3.9MB

Download
memory/2104-6-0x0000000002FA0000-0x0000000003392000-memory.dmp

Filesize
3.9MB

Download
memory/2104-48-0x0000000002FA0000-0x0000000003392000-memory.dmp

Filesize
3.9MB

Download
memory/2472-62-0x000000013F6E0000-0x000000013FAD2000-memory.dmp

Filesize
3.9MB

Download
memory/2472-6841-0x000000013F6E0000-0x000000013FAD2000-memory.dmp

Filesize
3.9MB

Download
memory/2568-60-0x000000013F6D0000-0x000000013FAC2000-memory.dmp

Filesize
3.9MB

Download
memory/2568-6838-0x000000013F6D0000-0x000000013FAC2000-memory.dmp

Filesize
3.9MB

Download
memory/2616-6839-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2616-68-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2624-59-0x000000013F330000-0x000000013F722000-memory.dmp

Filesize
3.9MB

Download
memory/2624-5187-0x000000013F330000-0x000000013F722000-memory.dmp

Filesize
3.9MB

Download
memory/2644-50-0x000000013FBF0000-0x000000013FFE2000-memory.dmp

Filesize
3.9MB

Download
memory/2644-6845-0x000000013FBF0000-0x000000013FFE2000-memory.dmp

Filesize
3.9MB

Download
memory/2652-69-0x000000013F090000-0x000000013F482000-memory.dmp

Filesize
3.9MB

Download
memory/2652-6842-0x000000013F090000-0x000000013F482000-memory.dmp

Filesize
3.9MB

Download
memory/2736-6846-0x000000013F0A0000-0x000000013F492000-memory.dmp

Filesize
3.9MB

Download
memory/2736-76-0x000000013F0A0000-0x000000013F492000-memory.dmp

Filesize
3.9MB

Download
memory/2776-74-0x000000013FA20000-0x000000013FE12000-memory.dmp

Filesize
3.9MB

Download
memory/2776-6844-0x000000013FA20000-0x000000013FE12000-memory.dmp

Filesize
3.9MB

Download
memory/2868-61-0x000000013F130000-0x000000013F522000-memory.dmp

Filesize
3.9MB

Download
memory/2868-6840-0x000000013F130000-0x000000013F522000-memory.dmp

Filesize
3.9MB

Download
memory/3064-6843-0x000000013F3A0000-0x000000013F792000-memory.dmp

Filesize
3.9MB

Download
memory/3064-71-0x000000013F3A0000-0x000000013F792000-memory.dmp

Filesize
3.9MB

Download