xmrig | cb45ba969a3ed67ef818a8c9072540f6766138e682f72a2c585a327a379b961e

Analysis

max time kernel
150s
max time network
143s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
05/05/2024, 02:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
Size

2.3MB
MD5

1581b5eef39d6545f5ec2763a8ff7b7a
SHA1

a962700d7d0400347411b0de7a98ac34379202aa
SHA256

cb45ba969a3ed67ef818a8c9072540f6766138e682f72a2c585a327a379b961e
SHA512

3fb43b736f639e56ccb12cc12bfdae16166bd23c2a7f4ae9eba12f3afa14ecfabde6ff50b80a146ddf6a2cc375343722105ce23a5588907fdfaf83f75338f029
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9ce+:NAB3

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 20 IoCs

miner

resource	yara_rule
behavioral1/memory/2648-15-0x000000013FFC0000-0x00000001403B2000-memory.dmp	xmrig
behavioral1/memory/2204-14-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	xmrig
behavioral1/memory/1036-27-0x000000013F340000-0x000000013F732000-memory.dmp	xmrig
behavioral1/memory/2404-119-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	xmrig
behavioral1/memory/2312-125-0x000000013F3E0000-0x000000013F7D2000-memory.dmp	xmrig
behavioral1/memory/2636-127-0x000000013FDA0000-0x0000000140192000-memory.dmp	xmrig
behavioral1/memory/2856-132-0x000000013FCD0000-0x00000001400C2000-memory.dmp	xmrig
behavioral1/memory/2436-130-0x000000013FE40000-0x0000000140232000-memory.dmp	xmrig
behavioral1/memory/2576-124-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	xmrig
behavioral1/memory/1248-123-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	xmrig
behavioral1/memory/2572-120-0x000000013F3D0000-0x000000013F7C2000-memory.dmp	xmrig
behavioral1/memory/2648-5446-0x000000013FFC0000-0x00000001403B2000-memory.dmp	xmrig
behavioral1/memory/2572-5449-0x000000013F3D0000-0x000000013F7C2000-memory.dmp	xmrig
behavioral1/memory/2404-5450-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	xmrig
behavioral1/memory/1036-5452-0x000000013F340000-0x000000013F732000-memory.dmp	xmrig
behavioral1/memory/2204-5451-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	xmrig
behavioral1/memory/2436-5455-0x000000013FE40000-0x0000000140232000-memory.dmp	xmrig
behavioral1/memory/2576-5460-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	xmrig
behavioral1/memory/2856-5464-0x000000013FCD0000-0x00000001400C2000-memory.dmp	xmrig
behavioral1/memory/2312-10956-0x000000013FEF0000-0x00000001402E2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1868	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2204	ATneJJh.exe
2648	NiNYkFA.exe
1036	ZlyiMyN.exe
2404	cVdEaOx.exe
2572	pSTdSgm.exe
1248	EsQEkcW.exe
2576	xjyYAba.exe
2636	sdfdIdN.exe
2436	EmCSjQE.exe
2856	oSlcdSm.exe
2380	KintsAR.exe
2876	iUagiuD.exe
1856	DMsXjAI.exe
864	PWUdoJN.exe
1924	bUhgzPU.exe
2844	lFGAQhr.exe
2896	jZIRNJY.exe
2640	cOFRMeV.exe
1948	LgXhFwM.exe
320	qhQKlDz.exe
300	GJGRCBQ.exe
2240	kUemUEy.exe
1368	JRxqewy.exe
2040	cpqbsHq.exe
532	WgFimPa.exe
588	SJtnkYq.exe
816	oqZJvfe.exe
604	Npgjqrh.exe
2832	euoepbB.exe
2996	PywzBHu.exe
896	jzhSYli.exe
2792	qsjcXyt.exe
1284	MZATLYd.exe
3068	PIgTWfE.exe
292	qiozmXj.exe
636	kWFTKRv.exe
2780	roQYWXH.exe
2336	rRqiAmR.exe
1004	lJGXQMx.exe
1740	qyRZxCy.exe
1440	oxghqnL.exe
1880	rlIxVBU.exe
2984	grnmjQc.exe
1544	HNnnZvK.exe
2252	vyIoPZX.exe
2416	mnEHNci.exe
2724	FcnSmPM.exe
2288	JuMpnDT.exe
2600	TnuHWSW.exe
2976	nodAJFE.exe
332	sulMWjp.exe
448	gKmtQZn.exe
2696	FVvQjzV.exe
2956	fPiynEh.exe
2096	KdVFtcn.exe
852	PxdWmWP.exe
2016	kWxcYKz.exe
3020	maEDqsP.exe
2272	wXeovYs.exe
3004	RCTLTBV.exe
3096	eMutHro.exe
3128	VapIwAf.exe
3160	VrWlUqS.exe
2108	AwxImwC.exe

Loads dropped DLL 64 IoCs

pid	Process
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe

UPX packed file 55 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2312-2-0x000000013FEF0000-0x00000001402E2000-memory.dmp	upx
behavioral1/files/0x000c000000015cbd-6.dat	upx
behavioral1/files/0x002e000000015d24-7.dat	upx
behavioral1/memory/2648-15-0x000000013FFC0000-0x00000001403B2000-memory.dmp	upx
behavioral1/memory/2204-14-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/files/0x0008000000015e6d-20.dat	upx
behavioral1/files/0x0007000000015f3c-30.dat	upx
behavioral1/memory/1036-27-0x000000013F340000-0x000000013F732000-memory.dmp	upx
behavioral1/files/0x0006000000016d1f-63.dat	upx
behavioral1/files/0x0006000000016db3-86.dat	upx
behavioral1/files/0x0006000000016fe8-93.dat	upx
behavioral1/files/0x00060000000173e5-112.dat	upx
behavioral1/files/0x0006000000016d3a-72.dat	upx
behavioral1/memory/2404-119-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	upx
behavioral1/memory/2636-127-0x000000013FDA0000-0x0000000140192000-memory.dmp	upx
behavioral1/files/0x00080000000160cc-38.dat	upx
behavioral1/files/0x002e000000015d44-145.dat	upx
behavioral1/files/0x000500000001865a-170.dat	upx
behavioral1/files/0x000500000001874a-184.dat	upx
behavioral1/files/0x0006000000018bba-191.dat	upx
behavioral1/files/0x00060000000175b8-158.dat	upx
behavioral1/files/0x000600000001739d-141.dat	upx
behavioral1/files/0x000500000001874c-186.dat	upx
behavioral1/files/0x0005000000018700-179.dat	upx
behavioral1/files/0x00050000000186c1-172.dat	upx
behavioral1/files/0x0009000000018640-165.dat	upx
behavioral1/files/0x000600000001744c-144.dat	upx
behavioral1/files/0x0006000000016e78-139.dat	upx
behavioral1/files/0x0006000000016da4-137.dat	upx
behavioral1/memory/2856-132-0x000000013FCD0000-0x00000001400C2000-memory.dmp	upx
behavioral1/memory/2436-130-0x000000013FE40000-0x0000000140232000-memory.dmp	upx
behavioral1/files/0x00060000000175ac-151.dat	upx
behavioral1/files/0x00050000000186d3-177.dat	upx
behavioral1/files/0x001500000001863c-163.dat	upx
behavioral1/files/0x00060000000175b2-156.dat	upx
behavioral1/files/0x0006000000016d32-106.dat	upx
behavioral1/files/0x0006000000016d16-104.dat	upx
behavioral1/files/0x0008000000016d05-85.dat	upx
behavioral1/files/0x0006000000016d9f-81.dat	upx
behavioral1/memory/2576-124-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	upx
behavioral1/memory/1248-123-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	upx
behavioral1/memory/2572-120-0x000000013F3D0000-0x000000013F7C2000-memory.dmp	upx
behavioral1/files/0x0006000000016d36-71.dat	upx
behavioral1/files/0x0006000000016d0e-52.dat	upx
behavioral1/files/0x00070000000161b3-45.dat	upx
behavioral1/files/0x001800000000558a-44.dat	upx
behavioral1/memory/2648-5446-0x000000013FFC0000-0x00000001403B2000-memory.dmp	upx
behavioral1/memory/2572-5449-0x000000013F3D0000-0x000000013F7C2000-memory.dmp	upx
behavioral1/memory/2404-5450-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	upx
behavioral1/memory/1036-5452-0x000000013F340000-0x000000013F732000-memory.dmp	upx
behavioral1/memory/2204-5451-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/memory/2436-5455-0x000000013FE40000-0x0000000140232000-memory.dmp	upx
behavioral1/memory/2576-5460-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	upx
behavioral1/memory/2856-5464-0x000000013FCD0000-0x00000001400C2000-memory.dmp	upx
behavioral1/memory/2312-10956-0x000000013FEF0000-0x00000001402E2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\YcApEQo.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\deCeNMP.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\YZxdyhg.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\IgvjTgt.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\pvGvzve.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\NVNzSNC.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\YbaDSQw.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\ZKoGwbg.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\utNnoBY.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\BynMGxJ.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\pFnXCSb.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\WmtGeaG.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\yyGHYHm.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\foNrwco.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\DNwpuwA.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\tnzIncX.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\ZOzRekp.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\YzWDbQN.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\ZeAguFf.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\XIpEQnh.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\FFzTzJJ.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\FzMFNCQ.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\KExBOwQ.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\dPGIEiQ.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\NPzEDuo.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\JiKtJtd.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\cajzihC.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\qOPdNGg.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\bSggFle.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\qJqanWa.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\lMCxYii.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\dCTbLjA.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\AZIenjV.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\AuvROHm.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\dJrsvvJ.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\wWgUjPu.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\qZgDGcB.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\gjSaSpo.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\SHNkluu.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\qFCcQna.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\MpavDmC.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\iiTKyTI.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\MCNCOpJ.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\ovEMcRa.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\ICneOmS.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\jfeRUFj.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\HEEPpPl.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\vVYYyAk.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\WkYqCro.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\cdTUHuU.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\BGJWKBR.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\JmypDXZ.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\xlTovsG.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\jISNsYy.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\wQHKrGd.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\crfmJpv.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\QlHKpcb.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\hGJJFaK.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\BARLsYB.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\lYZlNKd.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\JEPezPs.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\mwFoTWM.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\JpUNcdb.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
File created	C:\Windows\System\AyXwVdi.exe	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1868	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
Token: SeDebugPrivilege	1868	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 1868	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	29
PID 2312 wrote to memory of 1868	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	29
PID 2312 wrote to memory of 1868	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	29
PID 2312 wrote to memory of 2204	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	30
PID 2312 wrote to memory of 2204	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	30
PID 2312 wrote to memory of 2204	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	30
PID 2312 wrote to memory of 2648	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	31
PID 2312 wrote to memory of 2648	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	31
PID 2312 wrote to memory of 2648	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	31
PID 2312 wrote to memory of 1036	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	32
PID 2312 wrote to memory of 1036	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	32
PID 2312 wrote to memory of 1036	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	32
PID 2312 wrote to memory of 2576	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	33
PID 2312 wrote to memory of 2576	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	33
PID 2312 wrote to memory of 2576	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	33
PID 2312 wrote to memory of 2404	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	34
PID 2312 wrote to memory of 2404	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	34
PID 2312 wrote to memory of 2404	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	34
PID 2312 wrote to memory of 2436	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	35
PID 2312 wrote to memory of 2436	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	35
PID 2312 wrote to memory of 2436	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	35
PID 2312 wrote to memory of 2572	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	36
PID 2312 wrote to memory of 2572	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	36
PID 2312 wrote to memory of 2572	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	36
PID 2312 wrote to memory of 2876	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	37
PID 2312 wrote to memory of 2876	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	37
PID 2312 wrote to memory of 2876	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	37
PID 2312 wrote to memory of 1248	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	38
PID 2312 wrote to memory of 1248	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	38
PID 2312 wrote to memory of 1248	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	38
PID 2312 wrote to memory of 1924	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	39
PID 2312 wrote to memory of 1924	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	39
PID 2312 wrote to memory of 1924	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	39
PID 2312 wrote to memory of 2636	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	40
PID 2312 wrote to memory of 2636	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	40
PID 2312 wrote to memory of 2636	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	40
PID 2312 wrote to memory of 2844	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	41
PID 2312 wrote to memory of 2844	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	41
PID 2312 wrote to memory of 2844	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	41
PID 2312 wrote to memory of 2856	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	42
PID 2312 wrote to memory of 2856	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	42
PID 2312 wrote to memory of 2856	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	42
PID 2312 wrote to memory of 2896	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	43
PID 2312 wrote to memory of 2896	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	43
PID 2312 wrote to memory of 2896	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	43
PID 2312 wrote to memory of 2380	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	44
PID 2312 wrote to memory of 2380	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	44
PID 2312 wrote to memory of 2380	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	44
PID 2312 wrote to memory of 1948	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	45
PID 2312 wrote to memory of 1948	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	45
PID 2312 wrote to memory of 1948	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	45
PID 2312 wrote to memory of 1856	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	46
PID 2312 wrote to memory of 1856	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	46
PID 2312 wrote to memory of 1856	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	46
PID 2312 wrote to memory of 320	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	47
PID 2312 wrote to memory of 320	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	47
PID 2312 wrote to memory of 320	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	47
PID 2312 wrote to memory of 864	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	48
PID 2312 wrote to memory of 864	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	48
PID 2312 wrote to memory of 864	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	48
PID 2312 wrote to memory of 300	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	49
PID 2312 wrote to memory of 300	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	49
PID 2312 wrote to memory of 300	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	49
PID 2312 wrote to memory of 2640	2312	1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1581b5eef39d6545f5ec2763a8ff7b7a_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1868
- C:\Windows\System\ATneJJh.exe
  C:\Windows\System\ATneJJh.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\NiNYkFA.exe
  C:\Windows\System\NiNYkFA.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\ZlyiMyN.exe
  C:\Windows\System\ZlyiMyN.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\xjyYAba.exe
  C:\Windows\System\xjyYAba.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\cVdEaOx.exe
  C:\Windows\System\cVdEaOx.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\EmCSjQE.exe
  C:\Windows\System\EmCSjQE.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\pSTdSgm.exe
  C:\Windows\System\pSTdSgm.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\iUagiuD.exe
  C:\Windows\System\iUagiuD.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\EsQEkcW.exe
  C:\Windows\System\EsQEkcW.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\bUhgzPU.exe
  C:\Windows\System\bUhgzPU.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\sdfdIdN.exe
  C:\Windows\System\sdfdIdN.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\lFGAQhr.exe
  C:\Windows\System\lFGAQhr.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\oSlcdSm.exe
  C:\Windows\System\oSlcdSm.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\jZIRNJY.exe
  C:\Windows\System\jZIRNJY.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\KintsAR.exe
  C:\Windows\System\KintsAR.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\LgXhFwM.exe
  C:\Windows\System\LgXhFwM.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\DMsXjAI.exe
  C:\Windows\System\DMsXjAI.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\qhQKlDz.exe
  C:\Windows\System\qhQKlDz.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\PWUdoJN.exe
  C:\Windows\System\PWUdoJN.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\GJGRCBQ.exe
  C:\Windows\System\GJGRCBQ.exe
  2⤵
  - Executes dropped EXE
  PID:300
- C:\Windows\System\cOFRMeV.exe
  C:\Windows\System\cOFRMeV.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\kUemUEy.exe
  C:\Windows\System\kUemUEy.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\JRxqewy.exe
  C:\Windows\System\JRxqewy.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\AwxImwC.exe
  C:\Windows\System\AwxImwC.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\cpqbsHq.exe
  C:\Windows\System\cpqbsHq.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\KXaNsNH.exe
  C:\Windows\System\KXaNsNH.exe
  2⤵
  PID:676
- C:\Windows\System\WgFimPa.exe
  C:\Windows\System\WgFimPa.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\jHYMdIv.exe
  C:\Windows\System\jHYMdIv.exe
  2⤵
  PID:2492
- C:\Windows\System\SJtnkYq.exe
  C:\Windows\System\SJtnkYq.exe
  2⤵
  - Executes dropped EXE
  PID:588
- C:\Windows\System\dbfgsZy.exe
  C:\Windows\System\dbfgsZy.exe
  2⤵
  PID:2796
- C:\Windows\System\oqZJvfe.exe
  C:\Windows\System\oqZJvfe.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\NhcmwFg.exe
  C:\Windows\System\NhcmwFg.exe
  2⤵
  PID:1164
- C:\Windows\System\Npgjqrh.exe
  C:\Windows\System\Npgjqrh.exe
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\System\ZcOzpNU.exe
  C:\Windows\System\ZcOzpNU.exe
  2⤵
  PID:3040
- C:\Windows\System\euoepbB.exe
  C:\Windows\System\euoepbB.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\JTDwYsp.exe
  C:\Windows\System\JTDwYsp.exe
  2⤵
  PID:1120
- C:\Windows\System\PywzBHu.exe
  C:\Windows\System\PywzBHu.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\pSAweXy.exe
  C:\Windows\System\pSAweXy.exe
  2⤵
  PID:2224
- C:\Windows\System\jzhSYli.exe
  C:\Windows\System\jzhSYli.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\IETIoTC.exe
  C:\Windows\System\IETIoTC.exe
  2⤵
  PID:1292
- C:\Windows\System\qsjcXyt.exe
  C:\Windows\System\qsjcXyt.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\xVSgNvT.exe
  C:\Windows\System\xVSgNvT.exe
  2⤵
  PID:1896
- C:\Windows\System\MZATLYd.exe
  C:\Windows\System\MZATLYd.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\XyJFTFy.exe
  C:\Windows\System\XyJFTFy.exe
  2⤵
  PID:1804
- C:\Windows\System\PIgTWfE.exe
  C:\Windows\System\PIgTWfE.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\KbNqTsj.exe
  C:\Windows\System\KbNqTsj.exe
  2⤵
  PID:2760
- C:\Windows\System\qiozmXj.exe
  C:\Windows\System\qiozmXj.exe
  2⤵
  - Executes dropped EXE
  PID:292
- C:\Windows\System\VAlAVko.exe
  C:\Windows\System\VAlAVko.exe
  2⤵
  PID:952
- C:\Windows\System\kWFTKRv.exe
  C:\Windows\System\kWFTKRv.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\xtJUzHQ.exe
  C:\Windows\System\xtJUzHQ.exe
  2⤵
  PID:2160
- C:\Windows\System\roQYWXH.exe
  C:\Windows\System\roQYWXH.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\mbcxNVl.exe
  C:\Windows\System\mbcxNVl.exe
  2⤵
  PID:1756
- C:\Windows\System\rRqiAmR.exe
  C:\Windows\System\rRqiAmR.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\RFUYpuB.exe
  C:\Windows\System\RFUYpuB.exe
  2⤵
  PID:704
- C:\Windows\System\lJGXQMx.exe
  C:\Windows\System\lJGXQMx.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\YHbqcZy.exe
  C:\Windows\System\YHbqcZy.exe
  2⤵
  PID:1132
- C:\Windows\System\qyRZxCy.exe
  C:\Windows\System\qyRZxCy.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\upHfCSs.exe
  C:\Windows\System\upHfCSs.exe
  2⤵
  PID:1952
- C:\Windows\System\oxghqnL.exe
  C:\Windows\System\oxghqnL.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\dsbyrVn.exe
  C:\Windows\System\dsbyrVn.exe
  2⤵
  PID:900
- C:\Windows\System\rlIxVBU.exe
  C:\Windows\System\rlIxVBU.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\ukTOGHF.exe
  C:\Windows\System\ukTOGHF.exe
  2⤵
  PID:1196
- C:\Windows\System\grnmjQc.exe
  C:\Windows\System\grnmjQc.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\ibfDCPq.exe
  C:\Windows\System\ibfDCPq.exe
  2⤵
  PID:1540
- C:\Windows\System\HNnnZvK.exe
  C:\Windows\System\HNnnZvK.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\TDNhMuu.exe
  C:\Windows\System\TDNhMuu.exe
  2⤵
  PID:2604
- C:\Windows\System\vyIoPZX.exe
  C:\Windows\System\vyIoPZX.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\EpispHj.exe
  C:\Windows\System\EpispHj.exe
  2⤵
  PID:2676
- C:\Windows\System\mnEHNci.exe
  C:\Windows\System\mnEHNci.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\vNAntYj.exe
  C:\Windows\System\vNAntYj.exe
  2⤵
  PID:2880
- C:\Windows\System\FcnSmPM.exe
  C:\Windows\System\FcnSmPM.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\IJVcpjy.exe
  C:\Windows\System\IJVcpjy.exe
  2⤵
  PID:2908
- C:\Windows\System\JuMpnDT.exe
  C:\Windows\System\JuMpnDT.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\FixcpXy.exe
  C:\Windows\System\FixcpXy.exe
  2⤵
  PID:812
- C:\Windows\System\TnuHWSW.exe
  C:\Windows\System\TnuHWSW.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\DqgAGyS.exe
  C:\Windows\System\DqgAGyS.exe
  2⤵
  PID:2460
- C:\Windows\System\nodAJFE.exe
  C:\Windows\System\nodAJFE.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\PGpBOqm.exe
  C:\Windows\System\PGpBOqm.exe
  2⤵
  PID:1848
- C:\Windows\System\sulMWjp.exe
  C:\Windows\System\sulMWjp.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\gLqKoBv.exe
  C:\Windows\System\gLqKoBv.exe
  2⤵
  PID:1720
- C:\Windows\System\gKmtQZn.exe
  C:\Windows\System\gKmtQZn.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\aJXiHis.exe
  C:\Windows\System\aJXiHis.exe
  2⤵
  PID:1496
- C:\Windows\System\FVvQjzV.exe
  C:\Windows\System\FVvQjzV.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\oCqkXme.exe
  C:\Windows\System\oCqkXme.exe
  2⤵
  PID:1600
- C:\Windows\System\fPiynEh.exe
  C:\Windows\System\fPiynEh.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\MnqksEg.exe
  C:\Windows\System\MnqksEg.exe
  2⤵
  PID:3048
- C:\Windows\System\KdVFtcn.exe
  C:\Windows\System\KdVFtcn.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\AIDTCSc.exe
  C:\Windows\System\AIDTCSc.exe
  2⤵
  PID:2284
- C:\Windows\System\PxdWmWP.exe
  C:\Windows\System\PxdWmWP.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\nUydgHJ.exe
  C:\Windows\System\nUydgHJ.exe
  2⤵
  PID:2948
- C:\Windows\System\kWxcYKz.exe
  C:\Windows\System\kWxcYKz.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\vSIWedp.exe
  C:\Windows\System\vSIWedp.exe
  2⤵
  PID:2232
- C:\Windows\System\maEDqsP.exe
  C:\Windows\System\maEDqsP.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\aiHGwmA.exe
  C:\Windows\System\aiHGwmA.exe
  2⤵
  PID:1072
- C:\Windows\System\wXeovYs.exe
  C:\Windows\System\wXeovYs.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\rPIBQeZ.exe
  C:\Windows\System\rPIBQeZ.exe
  2⤵
  PID:1912
- C:\Windows\System\RCTLTBV.exe
  C:\Windows\System\RCTLTBV.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\VYFBrwK.exe
  C:\Windows\System\VYFBrwK.exe
  2⤵
  PID:3080
- C:\Windows\System\eMutHro.exe
  C:\Windows\System\eMutHro.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\wgmkTVu.exe
  C:\Windows\System\wgmkTVu.exe
  2⤵
  PID:3112
- C:\Windows\System\VapIwAf.exe
  C:\Windows\System\VapIwAf.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\gPxVtIV.exe
  C:\Windows\System\gPxVtIV.exe
  2⤵
  PID:3144
- C:\Windows\System\VrWlUqS.exe
  C:\Windows\System\VrWlUqS.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\PlqIclK.exe
  C:\Windows\System\PlqIclK.exe
  2⤵
  PID:3464
- C:\Windows\System\BAbfSkY.exe
  C:\Windows\System\BAbfSkY.exe
  2⤵
  PID:3840
- C:\Windows\System\ydfXmyM.exe
  C:\Windows\System\ydfXmyM.exe
  2⤵
  PID:3864
- C:\Windows\System\jyibGnk.exe
  C:\Windows\System\jyibGnk.exe
  2⤵
  PID:3880
- C:\Windows\System\nYjChgf.exe
  C:\Windows\System\nYjChgf.exe
  2⤵
  PID:3896
- C:\Windows\System\DigIJDT.exe
  C:\Windows\System\DigIJDT.exe
  2⤵
  PID:3912
- C:\Windows\System\cWnELjP.exe
  C:\Windows\System\cWnELjP.exe
  2⤵
  PID:3928
- C:\Windows\System\JJtKZCa.exe
  C:\Windows\System\JJtKZCa.exe
  2⤵
  PID:3944
- C:\Windows\System\xuRjVcp.exe
  C:\Windows\System\xuRjVcp.exe
  2⤵
  PID:3960
- C:\Windows\System\tkWUhSH.exe
  C:\Windows\System\tkWUhSH.exe
  2⤵
  PID:3976
- C:\Windows\System\OlIlqLd.exe
  C:\Windows\System\OlIlqLd.exe
  2⤵
  PID:3992
- C:\Windows\System\GKiFvWT.exe
  C:\Windows\System\GKiFvWT.exe
  2⤵
  PID:4008
- C:\Windows\System\lWjoDPX.exe
  C:\Windows\System\lWjoDPX.exe
  2⤵
  PID:4044
- C:\Windows\System\hoZuInQ.exe
  C:\Windows\System\hoZuInQ.exe
  2⤵
  PID:4080
- C:\Windows\System\BjAZSmX.exe
  C:\Windows\System\BjAZSmX.exe
  2⤵
  PID:2868
- C:\Windows\System\NSaTLeY.exe
  C:\Windows\System\NSaTLeY.exe
  2⤵
  PID:3136
- C:\Windows\System\ljUqWcJ.exe
  C:\Windows\System\ljUqWcJ.exe
  2⤵
  PID:2784
- C:\Windows\System\jvFtKQU.exe
  C:\Windows\System\jvFtKQU.exe
  2⤵
  PID:2340
- C:\Windows\System\WJBVWMR.exe
  C:\Windows\System\WJBVWMR.exe
  2⤵
  PID:2364
- C:\Windows\System\duJpEKK.exe
  C:\Windows\System\duJpEKK.exe
  2⤵
  PID:2172
- C:\Windows\System\nYoGrMX.exe
  C:\Windows\System\nYoGrMX.exe
  2⤵
  PID:2520
- C:\Windows\System\MDnizaL.exe
  C:\Windows\System\MDnizaL.exe
  2⤵
  PID:3172
- C:\Windows\System\FUkZFWw.exe
  C:\Windows\System\FUkZFWw.exe
  2⤵
  PID:3228
- C:\Windows\System\YyOGMaa.exe
  C:\Windows\System\YyOGMaa.exe
  2⤵
  PID:3244
- C:\Windows\System\bDhVrkm.exe
  C:\Windows\System\bDhVrkm.exe
  2⤵
  PID:3264
- C:\Windows\System\LuYbPpW.exe
  C:\Windows\System\LuYbPpW.exe
  2⤵
  PID:3284
- C:\Windows\System\ooQnkSd.exe
  C:\Windows\System\ooQnkSd.exe
  2⤵
  PID:3308
- C:\Windows\System\cgifbZP.exe
  C:\Windows\System\cgifbZP.exe
  2⤵
  PID:3324
- C:\Windows\System\wxPfNEf.exe
  C:\Windows\System\wxPfNEf.exe
  2⤵
  PID:3340
- C:\Windows\System\DOPGQUB.exe
  C:\Windows\System\DOPGQUB.exe
  2⤵
  PID:3356
- C:\Windows\System\mRkvipV.exe
  C:\Windows\System\mRkvipV.exe
  2⤵
  PID:3372
- C:\Windows\System\VoxCZPp.exe
  C:\Windows\System\VoxCZPp.exe
  2⤵
  PID:3388
- C:\Windows\System\paDJLam.exe
  C:\Windows\System\paDJLam.exe
  2⤵
  PID:3408
- C:\Windows\System\uKNdNTz.exe
  C:\Windows\System\uKNdNTz.exe
  2⤵
  PID:3424
- C:\Windows\System\pANtidi.exe
  C:\Windows\System\pANtidi.exe
  2⤵
  PID:3444
- C:\Windows\System\KpyxVdr.exe
  C:\Windows\System\KpyxVdr.exe
  2⤵
  PID:1864
- C:\Windows\System\CdCHnbs.exe
  C:\Windows\System\CdCHnbs.exe
  2⤵
  PID:3852
- C:\Windows\System\zWRaOOI.exe
  C:\Windows\System\zWRaOOI.exe
  2⤵
  PID:3924
- C:\Windows\System\TywgKAU.exe
  C:\Windows\System\TywgKAU.exe
  2⤵
  PID:3984
- C:\Windows\System\stwpHxg.exe
  C:\Windows\System\stwpHxg.exe
  2⤵
  PID:240
- C:\Windows\System\UvUkIkD.exe
  C:\Windows\System\UvUkIkD.exe
  2⤵
  PID:4020
- C:\Windows\System\NPmtYGf.exe
  C:\Windows\System\NPmtYGf.exe
  2⤵
  PID:4036
- C:\Windows\System\RRFTRfj.exe
  C:\Windows\System\RRFTRfj.exe
  2⤵
  PID:4088
- C:\Windows\System\OwedDIm.exe
  C:\Windows\System\OwedDIm.exe
  2⤵
  PID:1256
- C:\Windows\System\nUkaCPE.exe
  C:\Windows\System\nUkaCPE.exe
  2⤵
  PID:2912
- C:\Windows\System\QDnEXsS.exe
  C:\Windows\System\QDnEXsS.exe
  2⤵
  PID:488
- C:\Windows\System\xwRligF.exe
  C:\Windows\System\xwRligF.exe
  2⤵
  PID:1000
- C:\Windows\System\oTiubnA.exe
  C:\Windows\System\oTiubnA.exe
  2⤵
  PID:1076
- C:\Windows\System\HAILLzg.exe
  C:\Windows\System\HAILLzg.exe
  2⤵
  PID:1560
- C:\Windows\System\brmIqyr.exe
  C:\Windows\System\brmIqyr.exe
  2⤵
  PID:352
- C:\Windows\System\yalnZAR.exe
  C:\Windows\System\yalnZAR.exe
  2⤵
  PID:1944
- C:\Windows\System\pYkaHvB.exe
  C:\Windows\System\pYkaHvB.exe
  2⤵
  PID:2000
- C:\Windows\System\gvbCqSg.exe
  C:\Windows\System\gvbCqSg.exe
  2⤵
  PID:3836
- C:\Windows\System\ZXGYejO.exe
  C:\Windows\System\ZXGYejO.exe
  2⤵
  PID:3972
- C:\Windows\System\ArmDaTG.exe
  C:\Windows\System\ArmDaTG.exe
  2⤵
  PID:4056
- C:\Windows\System\oyMPZBa.exe
  C:\Windows\System\oyMPZBa.exe
  2⤵
  PID:1468
- C:\Windows\System\LQwByeA.exe
  C:\Windows\System\LQwByeA.exe
  2⤵
  PID:4076
- C:\Windows\System\JdPLrzK.exe
  C:\Windows\System\JdPLrzK.exe
  2⤵
  PID:628
- C:\Windows\System\nZQXZwy.exe
  C:\Windows\System\nZQXZwy.exe
  2⤵
  PID:3504
- C:\Windows\System\MiLRplJ.exe
  C:\Windows\System\MiLRplJ.exe
  2⤵
  PID:2524
- C:\Windows\System\wvGPIdC.exe
  C:\Windows\System\wvGPIdC.exe
  2⤵
  PID:1760
- C:\Windows\System\hPqijbg.exe
  C:\Windows\System\hPqijbg.exe
  2⤵
  PID:2472
- C:\Windows\System\orUJnpf.exe
  C:\Windows\System\orUJnpf.exe
  2⤵
  PID:1572
- C:\Windows\System\DIAaiQM.exe
  C:\Windows\System\DIAaiQM.exe
  2⤵
  PID:1916
- C:\Windows\System\tPchhtj.exe
  C:\Windows\System\tPchhtj.exe
  2⤵
  PID:472
- C:\Windows\System\ABxlHle.exe
  C:\Windows\System\ABxlHle.exe
  2⤵
  PID:1616
- C:\Windows\System\yxNnBbO.exe
  C:\Windows\System\yxNnBbO.exe
  2⤵
  PID:3092
- C:\Windows\System\YCbEVxI.exe
  C:\Windows\System\YCbEVxI.exe
  2⤵
  PID:1200
- C:\Windows\System\UhaDtTH.exe
  C:\Windows\System\UhaDtTH.exe
  2⤵
  PID:3860
- C:\Windows\System\VskKZtb.exe
  C:\Windows\System\VskKZtb.exe
  2⤵
  PID:3872
- C:\Windows\System\ynHRivj.exe
  C:\Windows\System\ynHRivj.exe
  2⤵
  PID:4000
- C:\Windows\System\JGvzHkl.exe
  C:\Windows\System\JGvzHkl.exe
  2⤵
  PID:2044
- C:\Windows\System\gQlnKOs.exe
  C:\Windows\System\gQlnKOs.exe
  2⤵
  PID:2400
- C:\Windows\System\DwtpKLO.exe
  C:\Windows\System\DwtpKLO.exe
  2⤵
  PID:1360
- C:\Windows\System\GpKmfdU.exe
  C:\Windows\System\GpKmfdU.exe
  2⤵
  PID:904
- C:\Windows\System\EJxyqUN.exe
  C:\Windows\System\EJxyqUN.exe
  2⤵
  PID:1904
- C:\Windows\System\YcApEQo.exe
  C:\Windows\System\YcApEQo.exe
  2⤵
  PID:3364
- C:\Windows\System\ZKoGwbg.exe
  C:\Windows\System\ZKoGwbg.exe
  2⤵
  PID:3368
- C:\Windows\System\iDZSqmw.exe
  C:\Windows\System\iDZSqmw.exe
  2⤵
  PID:3280
- C:\Windows\System\JxEOIzC.exe
  C:\Windows\System\JxEOIzC.exe
  2⤵
  PID:3856
- C:\Windows\System\tPxehum.exe
  C:\Windows\System\tPxehum.exe
  2⤵
  PID:3956
- C:\Windows\System\xOHFKtP.exe
  C:\Windows\System\xOHFKtP.exe
  2⤵
  PID:2540
- C:\Windows\System\BZyOEvz.exe
  C:\Windows\System\BZyOEvz.exe
  2⤵
  PID:1444
- C:\Windows\System\VeqHHSH.exe
  C:\Windows\System\VeqHHSH.exe
  2⤵
  PID:2500
- C:\Windows\System\KrPIOHv.exe
  C:\Windows\System\KrPIOHv.exe
  2⤵
  PID:3320
- C:\Windows\System\UchnQab.exe
  C:\Windows\System\UchnQab.exe
  2⤵
  PID:3380
- C:\Windows\System\OuzIiJc.exe
  C:\Windows\System\OuzIiJc.exe
  2⤵
  PID:1344
- C:\Windows\System\xAHYUjk.exe
  C:\Windows\System\xAHYUjk.exe
  2⤵
  PID:1892
- C:\Windows\System\LLrjkHQ.exe
  C:\Windows\System\LLrjkHQ.exe
  2⤵
  PID:556
- C:\Windows\System\EIfHMfW.exe
  C:\Windows\System\EIfHMfW.exe
  2⤵
  PID:1860
- C:\Windows\System\rJPmkXd.exe
  C:\Windows\System\rJPmkXd.exe
  2⤵
  PID:2700
- C:\Windows\System\kBTMIMt.exe
  C:\Windows\System\kBTMIMt.exe
  2⤵
  PID:1700
- C:\Windows\System\kzSKzIL.exe
  C:\Windows\System\kzSKzIL.exe
  2⤵
  PID:2608
- C:\Windows\System\SElzrqV.exe
  C:\Windows\System\SElzrqV.exe
  2⤵
  PID:3292
- C:\Windows\System\DgReVGg.exe
  C:\Windows\System\DgReVGg.exe
  2⤵
  PID:3336
- C:\Windows\System\ZPcFLOJ.exe
  C:\Windows\System\ZPcFLOJ.exe
  2⤵
  PID:3460
- C:\Windows\System\AfRHrbE.exe
  C:\Windows\System\AfRHrbE.exe
  2⤵
  PID:4104
- C:\Windows\System\wlgpCOA.exe
  C:\Windows\System\wlgpCOA.exe
  2⤵
  PID:4120
- C:\Windows\System\AWkklOT.exe
  C:\Windows\System\AWkklOT.exe
  2⤵
  PID:4136
- C:\Windows\System\yYZdpuj.exe
  C:\Windows\System\yYZdpuj.exe
  2⤵
  PID:4152
- C:\Windows\System\JnnNiIG.exe
  C:\Windows\System\JnnNiIG.exe
  2⤵
  PID:4168
- C:\Windows\System\TFQREFZ.exe
  C:\Windows\System\TFQREFZ.exe
  2⤵
  PID:4184
- C:\Windows\System\PcQXwBV.exe
  C:\Windows\System\PcQXwBV.exe
  2⤵
  PID:4200
- C:\Windows\System\UFqbiAi.exe
  C:\Windows\System\UFqbiAi.exe
  2⤵
  PID:4216
- C:\Windows\System\iPhfdxB.exe
  C:\Windows\System\iPhfdxB.exe
  2⤵
  PID:4236
- C:\Windows\System\LakiiPl.exe
  C:\Windows\System\LakiiPl.exe
  2⤵
  PID:4252
- C:\Windows\System\ihiaYeD.exe
  C:\Windows\System\ihiaYeD.exe
  2⤵
  PID:4364
- C:\Windows\System\BeELYSR.exe
  C:\Windows\System\BeELYSR.exe
  2⤵
  PID:4424
- C:\Windows\System\vFXvwhh.exe
  C:\Windows\System\vFXvwhh.exe
  2⤵
  PID:4440
- C:\Windows\System\MgTkUnR.exe
  C:\Windows\System\MgTkUnR.exe
  2⤵
  PID:4456
- C:\Windows\System\OwgdvQf.exe
  C:\Windows\System\OwgdvQf.exe
  2⤵
  PID:4472
- C:\Windows\System\frgXfyQ.exe
  C:\Windows\System\frgXfyQ.exe
  2⤵
  PID:4488
- C:\Windows\System\gUhcVCK.exe
  C:\Windows\System\gUhcVCK.exe
  2⤵
  PID:4508
- C:\Windows\System\rzMdBBz.exe
  C:\Windows\System\rzMdBBz.exe
  2⤵
  PID:4524
- C:\Windows\System\rVUOLOL.exe
  C:\Windows\System\rVUOLOL.exe
  2⤵
  PID:4540
- C:\Windows\System\AHLixHp.exe
  C:\Windows\System\AHLixHp.exe
  2⤵
  PID:4556
- C:\Windows\System\uyLWYTt.exe
  C:\Windows\System\uyLWYTt.exe
  2⤵
  PID:4572
- C:\Windows\System\iZsKGbb.exe
  C:\Windows\System\iZsKGbb.exe
  2⤵
  PID:4588
- C:\Windows\System\TvNciUH.exe
  C:\Windows\System\TvNciUH.exe
  2⤵
  PID:4608
- C:\Windows\System\BHbVKvY.exe
  C:\Windows\System\BHbVKvY.exe
  2⤵
  PID:4624
- C:\Windows\System\OanbXPR.exe
  C:\Windows\System\OanbXPR.exe
  2⤵
  PID:4640
- C:\Windows\System\ibpyBVZ.exe
  C:\Windows\System\ibpyBVZ.exe
  2⤵
  PID:4656
- C:\Windows\System\sSvycPv.exe
  C:\Windows\System\sSvycPv.exe
  2⤵
  PID:4672
- C:\Windows\System\hTIakVH.exe
  C:\Windows\System\hTIakVH.exe
  2⤵
  PID:4688
- C:\Windows\System\dYkFQKG.exe
  C:\Windows\System\dYkFQKG.exe
  2⤵
  PID:4704
- C:\Windows\System\jvCefkk.exe
  C:\Windows\System\jvCefkk.exe
  2⤵
  PID:4724
- C:\Windows\System\NFEMMGC.exe
  C:\Windows\System\NFEMMGC.exe
  2⤵
  PID:4740
- C:\Windows\System\usUaXdD.exe
  C:\Windows\System\usUaXdD.exe
  2⤵
  PID:4756
- C:\Windows\System\akFwvDm.exe
  C:\Windows\System\akFwvDm.exe
  2⤵
  PID:4772
- C:\Windows\System\dhZWqeM.exe
  C:\Windows\System\dhZWqeM.exe
  2⤵
  PID:4788
- C:\Windows\System\IWqITGe.exe
  C:\Windows\System\IWqITGe.exe
  2⤵
  PID:4804
- C:\Windows\System\gjTqNFf.exe
  C:\Windows\System\gjTqNFf.exe
  2⤵
  PID:4820
- C:\Windows\System\pAYizue.exe
  C:\Windows\System\pAYizue.exe
  2⤵
  PID:4844
- C:\Windows\System\pLrCtZm.exe
  C:\Windows\System\pLrCtZm.exe
  2⤵
  PID:4860
- C:\Windows\System\JhAJzqm.exe
  C:\Windows\System\JhAJzqm.exe
  2⤵
  PID:4876
- C:\Windows\System\dCXcILk.exe
  C:\Windows\System\dCXcILk.exe
  2⤵
  PID:4896
- C:\Windows\System\WyEhLKV.exe
  C:\Windows\System\WyEhLKV.exe
  2⤵
  PID:4940
- C:\Windows\System\xSxgKoJ.exe
  C:\Windows\System\xSxgKoJ.exe
  2⤵
  PID:4960
- C:\Windows\System\wdzFQKh.exe
  C:\Windows\System\wdzFQKh.exe
  2⤵
  PID:4984
- C:\Windows\System\tcPgRPB.exe
  C:\Windows\System\tcPgRPB.exe
  2⤵
  PID:5012
- C:\Windows\System\AEuWnaR.exe
  C:\Windows\System\AEuWnaR.exe
  2⤵
  PID:5032
- C:\Windows\System\QVCAlca.exe
  C:\Windows\System\QVCAlca.exe
  2⤵
  PID:1236
- C:\Windows\System\cFPhkOB.exe
  C:\Windows\System\cFPhkOB.exe
  2⤵
  PID:2744
- C:\Windows\System\aindYoF.exe
  C:\Windows\System\aindYoF.exe
  2⤵
  PID:3332
- C:\Windows\System\noeURKg.exe
  C:\Windows\System\noeURKg.exe
  2⤵
  PID:4132
- C:\Windows\System\wDqsUnl.exe
  C:\Windows\System\wDqsUnl.exe
  2⤵
  PID:4224
- C:\Windows\System\iZPXGNM.exe
  C:\Windows\System\iZPXGNM.exe
  2⤵
  PID:4272
- C:\Windows\System\QvnNOZi.exe
  C:\Windows\System\QvnNOZi.exe
  2⤵
  PID:4288
- C:\Windows\System\ebkdbSi.exe
  C:\Windows\System\ebkdbSi.exe
  2⤵
  PID:4304
- C:\Windows\System\iiTKyTI.exe
  C:\Windows\System\iiTKyTI.exe
  2⤵
  PID:4320
- C:\Windows\System\HSQSmFr.exe
  C:\Windows\System\HSQSmFr.exe
  2⤵
  PID:4436
- C:\Windows\System\GkJdeNS.exe
  C:\Windows\System\GkJdeNS.exe
  2⤵
  PID:1956
- C:\Windows\System\NTAjvHb.exe
  C:\Windows\System\NTAjvHb.exe
  2⤵
  PID:2196
- C:\Windows\System\lZMpnZK.exe
  C:\Windows\System\lZMpnZK.exe
  2⤵
  PID:2732
- C:\Windows\System\NyhKmHD.exe
  C:\Windows\System\NyhKmHD.exe
  2⤵
  PID:4532
- C:\Windows\System\KTQGpyQ.exe
  C:\Windows\System\KTQGpyQ.exe
  2⤵
  PID:4596
- C:\Windows\System\GcrnEdH.exe
  C:\Windows\System\GcrnEdH.exe
  2⤵
  PID:4636
- C:\Windows\System\ADjODqj.exe
  C:\Windows\System\ADjODqj.exe
  2⤵
  PID:4732
- C:\Windows\System\DNwBQAd.exe
  C:\Windows\System\DNwBQAd.exe
  2⤵
  PID:4828
- C:\Windows\System\LjtHfht.exe
  C:\Windows\System\LjtHfht.exe
  2⤵
  PID:692
- C:\Windows\System\aBSiHmQ.exe
  C:\Windows\System\aBSiHmQ.exe
  2⤵
  PID:1636
- C:\Windows\System\fNRTduE.exe
  C:\Windows\System\fNRTduE.exe
  2⤵
  PID:4908
- C:\Windows\System\GMqzIAF.exe
  C:\Windows\System\GMqzIAF.exe
  2⤵
  PID:1532
- C:\Windows\System\FqfBaZQ.exe
  C:\Windows\System\FqfBaZQ.exe
  2⤵
  PID:2752
- C:\Windows\System\RTxeEqj.exe
  C:\Windows\System\RTxeEqj.exe
  2⤵
  PID:3268
- C:\Windows\System\pDjNjOw.exe
  C:\Windows\System\pDjNjOw.exe
  2⤵
  PID:3436
- C:\Windows\System\MEWEYKy.exe
  C:\Windows\System\MEWEYKy.exe
  2⤵
  PID:3352
- C:\Windows\System\okgbEKR.exe
  C:\Windows\System\okgbEKR.exe
  2⤵
  PID:4928
- C:\Windows\System\ojKfLZN.exe
  C:\Windows\System\ojKfLZN.exe
  2⤵
  PID:4980
- C:\Windows\System\RvzJfxQ.exe
  C:\Windows\System\RvzJfxQ.exe
  2⤵
  PID:3104
- C:\Windows\System\mFQVbEs.exe
  C:\Windows\System\mFQVbEs.exe
  2⤵
  PID:3416
- C:\Windows\System\zhKOFPh.exe
  C:\Windows\System\zhKOFPh.exe
  2⤵
  PID:4176
- C:\Windows\System\jUgLJbx.exe
  C:\Windows\System\jUgLJbx.exe
  2⤵
  PID:4208
- C:\Windows\System\rhjYVHO.exe
  C:\Windows\System\rhjYVHO.exe
  2⤵
  PID:5020
- C:\Windows\System\EFWgfIf.exe
  C:\Windows\System\EFWgfIf.exe
  2⤵
  PID:4384
- C:\Windows\System\PVEHiaQ.exe
  C:\Windows\System\PVEHiaQ.exe
  2⤵
  PID:4400
- C:\Windows\System\XxJyHWp.exe
  C:\Windows\System\XxJyHWp.exe
  2⤵
  PID:4416
- C:\Windows\System\gBwJzdb.exe
  C:\Windows\System\gBwJzdb.exe
  2⤵
  PID:4480
- C:\Windows\System\orLZRvS.exe
  C:\Windows\System\orLZRvS.exe
  2⤵
  PID:4548
- C:\Windows\System\SGGzRRC.exe
  C:\Windows\System\SGGzRRC.exe
  2⤵
  PID:4616
- C:\Windows\System\YYYVUkz.exe
  C:\Windows\System\YYYVUkz.exe
  2⤵
  PID:4684
- C:\Windows\System\pWyuamy.exe
  C:\Windows\System\pWyuamy.exe
  2⤵
  PID:4748
- C:\Windows\System\SgjfmKE.exe
  C:\Windows\System\SgjfmKE.exe
  2⤵
  PID:4812
- C:\Windows\System\zeEqqdp.exe
  C:\Windows\System\zeEqqdp.exe
  2⤵
  PID:4884
- C:\Windows\System\UJGVOzP.exe
  C:\Windows\System\UJGVOzP.exe
  2⤵
  PID:4952
- C:\Windows\System\MGQYafd.exe
  C:\Windows\System\MGQYafd.exe
  2⤵
  PID:4992
- C:\Windows\System\HzxrQEe.exe
  C:\Windows\System\HzxrQEe.exe
  2⤵
  PID:5004
- C:\Windows\System\cJtYfPD.exe
  C:\Windows\System\cJtYfPD.exe
  2⤵
  PID:4100
- C:\Windows\System\yXkSqaK.exe
  C:\Windows\System\yXkSqaK.exe
  2⤵
  PID:4232
- C:\Windows\System\YYevzTh.exe
  C:\Windows\System\YYevzTh.exe
  2⤵
  PID:5056
- C:\Windows\System\qMaKorz.exe
  C:\Windows\System\qMaKorz.exe
  2⤵
  PID:5072
- C:\Windows\System\CFSirTt.exe
  C:\Windows\System\CFSirTt.exe
  2⤵
  PID:5088
- C:\Windows\System\hhPwGwW.exe
  C:\Windows\System\hhPwGwW.exe
  2⤵
  PID:5112
- C:\Windows\System\CGDiJYC.exe
  C:\Windows\System\CGDiJYC.exe
  2⤵
  PID:4016
- C:\Windows\System\iWCirfg.exe
  C:\Windows\System\iWCirfg.exe
  2⤵
  PID:2120
- C:\Windows\System\bbMqqgj.exe
  C:\Windows\System\bbMqqgj.exe
  2⤵
  PID:3208
- C:\Windows\System\MRzdNSq.exe
  C:\Windows\System\MRzdNSq.exe
  2⤵
  PID:1488
- C:\Windows\System\pSpOaTS.exe
  C:\Windows\System\pSpOaTS.exe
  2⤵
  PID:1548
- C:\Windows\System\FOiEvyV.exe
  C:\Windows\System\FOiEvyV.exe
  2⤵
  PID:3224
- C:\Windows\System\CrJMfmG.exe
  C:\Windows\System\CrJMfmG.exe
  2⤵
  PID:4316
- C:\Windows\System\DEnApkU.exe
  C:\Windows\System\DEnApkU.exe
  2⤵
  PID:4328
- C:\Windows\System\UOnHsVX.exe
  C:\Windows\System\UOnHsVX.exe
  2⤵
  PID:4336
- C:\Windows\System\uVYxqUk.exe
  C:\Windows\System\uVYxqUk.exe
  2⤵
  PID:4344
- C:\Windows\System\IfgssJC.exe
  C:\Windows\System\IfgssJC.exe
  2⤵
  PID:1964
- C:\Windows\System\xhemNPO.exe
  C:\Windows\System\xhemNPO.exe
  2⤵
  PID:2024
- C:\Windows\System\WgcTHUh.exe
  C:\Windows\System\WgcTHUh.exe
  2⤵
  PID:1792
- C:\Windows\System\WCEkJHe.exe
  C:\Windows\System\WCEkJHe.exe
  2⤵
  PID:2516
- C:\Windows\System\IlYmSmy.exe
  C:\Windows\System\IlYmSmy.exe
  2⤵
  PID:4432
- C:\Windows\System\YsOTugY.exe
  C:\Windows\System\YsOTugY.exe
  2⤵
  PID:4604
- C:\Windows\System\faviJUy.exe
  C:\Windows\System\faviJUy.exe
  2⤵
  PID:4504
- C:\Windows\System\myftcxm.exe
  C:\Windows\System\myftcxm.exe
  2⤵
  PID:4568
- C:\Windows\System\NbjBiOy.exe
  C:\Windows\System\NbjBiOy.exe
  2⤵
  PID:2032
- C:\Windows\System\SpyCPaa.exe
  C:\Windows\System\SpyCPaa.exe
  2⤵
  PID:4796
- C:\Windows\System\bLNatjI.exe
  C:\Windows\System\bLNatjI.exe
  2⤵
  PID:4836
- C:\Windows\System\FpOflEe.exe
  C:\Windows\System\FpOflEe.exe
  2⤵
  PID:2532
- C:\Windows\System\ADFCfPT.exe
  C:\Windows\System\ADFCfPT.exe
  2⤵
  PID:2592
- C:\Windows\System\nnJMSis.exe
  C:\Windows\System\nnJMSis.exe
  2⤵
  PID:2060
- C:\Windows\System\ngaOFEd.exe
  C:\Windows\System\ngaOFEd.exe
  2⤵
  PID:2612
- C:\Windows\System\GffHDBX.exe
  C:\Windows\System\GffHDBX.exe
  2⤵
  PID:3044
- C:\Windows\System\vxEhSRd.exe
  C:\Windows\System\vxEhSRd.exe
  2⤵
  PID:1552
- C:\Windows\System\PGxYUyS.exe
  C:\Windows\System\PGxYUyS.exe
  2⤵
  PID:1604
- C:\Windows\System\pCZNgcP.exe
  C:\Windows\System\pCZNgcP.exe
  2⤵
  PID:4396
- C:\Windows\System\Foluklf.exe
  C:\Windows\System\Foluklf.exe
  2⤵
  PID:4584
- C:\Windows\System\ZqLUGtB.exe
  C:\Windows\System\ZqLUGtB.exe
  2⤵
  PID:4376
- C:\Windows\System\vqfigst.exe
  C:\Windows\System\vqfigst.exe
  2⤵
  PID:4516
- C:\Windows\System\CoLlelj.exe
  C:\Windows\System\CoLlelj.exe
  2⤵
  PID:3120
- C:\Windows\System\DDZgwIa.exe
  C:\Windows\System\DDZgwIa.exe
  2⤵
  PID:4128
- C:\Windows\System\PldbfGv.exe
  C:\Windows\System\PldbfGv.exe
  2⤵
  PID:2020
- C:\Windows\System\FZlHVrx.exe
  C:\Windows\System\FZlHVrx.exe
  2⤵
  PID:4696
- C:\Windows\System\BGJWKBR.exe
  C:\Windows\System\BGJWKBR.exe
  2⤵
  PID:3476
- C:\Windows\System\eJdhwwf.exe
  C:\Windows\System\eJdhwwf.exe
  2⤵
  PID:4924
- C:\Windows\System\ONZqxZz.exe
  C:\Windows\System\ONZqxZz.exe
  2⤵
  PID:4768
- C:\Windows\System\XcPstGq.exe
  C:\Windows\System\XcPstGq.exe
  2⤵
  PID:1436
- C:\Windows\System\YLLXXOe.exe
  C:\Windows\System\YLLXXOe.exe
  2⤵
  PID:2052
- C:\Windows\System\wtFlLTM.exe
  C:\Windows\System\wtFlLTM.exe
  2⤵
  PID:4244
- C:\Windows\System\TQHebWo.exe
  C:\Windows\System\TQHebWo.exe
  2⤵
  PID:4392
- C:\Windows\System\kpbXYca.exe
  C:\Windows\System\kpbXYca.exe
  2⤵
  PID:4680
- C:\Windows\System\MGXWLWA.exe
  C:\Windows\System\MGXWLWA.exe
  2⤵
  PID:4652
- C:\Windows\System\bkFmatA.exe
  C:\Windows\System\bkFmatA.exe
  2⤵
  PID:5052
- C:\Windows\System\LhyioRs.exe
  C:\Windows\System\LhyioRs.exe
  2⤵
  PID:5096
- C:\Windows\System\qVxaqxp.exe
  C:\Windows\System\qVxaqxp.exe
  2⤵
  PID:5028
- C:\Windows\System\FZitLtO.exe
  C:\Windows\System\FZitLtO.exe
  2⤵
  PID:412
- C:\Windows\System\fJpiQqL.exe
  C:\Windows\System\fJpiQqL.exe
  2⤵
  PID:4720
- C:\Windows\System\qkoJBMq.exe
  C:\Windows\System\qkoJBMq.exe
  2⤵
  PID:1500
- C:\Windows\System\mvLPYCc.exe
  C:\Windows\System\mvLPYCc.exe
  2⤵
  PID:1520
- C:\Windows\System\gInOMXa.exe
  C:\Windows\System\gInOMXa.exe
  2⤵
  PID:1800
- C:\Windows\System\ygmGoTp.exe
  C:\Windows\System\ygmGoTp.exe
  2⤵
  PID:1932
- C:\Windows\System\KzbicrW.exe
  C:\Windows\System\KzbicrW.exe
  2⤵
  PID:4564
- C:\Windows\System\BXdsxtq.exe
  C:\Windows\System\BXdsxtq.exe
  2⤵
  PID:5140
- C:\Windows\System\iUBdtqU.exe
  C:\Windows\System\iUBdtqU.exe
  2⤵
  PID:5156
- C:\Windows\System\awPRELv.exe
  C:\Windows\System\awPRELv.exe
  2⤵
  PID:5176
- C:\Windows\System\mDmsPTN.exe
  C:\Windows\System\mDmsPTN.exe
  2⤵
  PID:5196
- C:\Windows\System\YFJyfLJ.exe
  C:\Windows\System\YFJyfLJ.exe
  2⤵
  PID:5220
- C:\Windows\System\YlNkFlL.exe
  C:\Windows\System\YlNkFlL.exe
  2⤵
  PID:5236
- C:\Windows\System\sKFjKRR.exe
  C:\Windows\System\sKFjKRR.exe
  2⤵
  PID:5252
- C:\Windows\System\udBRpIC.exe
  C:\Windows\System\udBRpIC.exe
  2⤵
  PID:5268
- C:\Windows\System\rnjRlao.exe
  C:\Windows\System\rnjRlao.exe
  2⤵
  PID:5288
- C:\Windows\System\zeGZFef.exe
  C:\Windows\System\zeGZFef.exe
  2⤵
  PID:5304
- C:\Windows\System\hCiZLXX.exe
  C:\Windows\System\hCiZLXX.exe
  2⤵
  PID:5320
- C:\Windows\System\cIceLYI.exe
  C:\Windows\System\cIceLYI.exe
  2⤵
  PID:5340
- C:\Windows\System\KIPHRZk.exe
  C:\Windows\System\KIPHRZk.exe
  2⤵
  PID:5384
- C:\Windows\System\ucTQbTf.exe
  C:\Windows\System\ucTQbTf.exe
  2⤵
  PID:5412
- C:\Windows\System\NlXnedI.exe
  C:\Windows\System\NlXnedI.exe
  2⤵
  PID:5428
- C:\Windows\System\UToqppM.exe
  C:\Windows\System\UToqppM.exe
  2⤵
  PID:5444
- C:\Windows\System\WmCnPZs.exe
  C:\Windows\System\WmCnPZs.exe
  2⤵
  PID:5460
- C:\Windows\System\jFfxNzV.exe
  C:\Windows\System\jFfxNzV.exe
  2⤵
  PID:5476
- C:\Windows\System\NdtiwgE.exe
  C:\Windows\System\NdtiwgE.exe
  2⤵
  PID:5496
- C:\Windows\System\yOGFZZx.exe
  C:\Windows\System\yOGFZZx.exe
  2⤵
  PID:5512
- C:\Windows\System\KREpiVq.exe
  C:\Windows\System\KREpiVq.exe
  2⤵
  PID:5528
- C:\Windows\System\jHxrpGC.exe
  C:\Windows\System\jHxrpGC.exe
  2⤵
  PID:5548
- C:\Windows\System\RYOepXO.exe
  C:\Windows\System\RYOepXO.exe
  2⤵
  PID:5564
- C:\Windows\System\HOrqHDE.exe
  C:\Windows\System\HOrqHDE.exe
  2⤵
  PID:5580
- C:\Windows\System\gJSnDct.exe
  C:\Windows\System\gJSnDct.exe
  2⤵
  PID:5596
- C:\Windows\System\fXdLEKn.exe
  C:\Windows\System\fXdLEKn.exe
  2⤵
  PID:5628
- C:\Windows\System\omvhTfd.exe
  C:\Windows\System\omvhTfd.exe
  2⤵
  PID:5644
- C:\Windows\System\NErpPMk.exe
  C:\Windows\System\NErpPMk.exe
  2⤵
  PID:5660
- C:\Windows\System\ryalCZs.exe
  C:\Windows\System\ryalCZs.exe
  2⤵
  PID:5676
- C:\Windows\System\PxWPRRF.exe
  C:\Windows\System\PxWPRRF.exe
  2⤵
  PID:5692
- C:\Windows\System\PxyXSod.exe
  C:\Windows\System\PxyXSod.exe
  2⤵
  PID:5708
- C:\Windows\System\TnXdONb.exe
  C:\Windows\System\TnXdONb.exe
  2⤵
  PID:5728
- C:\Windows\System\ioGqZvu.exe
  C:\Windows\System\ioGqZvu.exe
  2⤵
  PID:5752
- C:\Windows\System\qwGjqCo.exe
  C:\Windows\System\qwGjqCo.exe
  2⤵
  PID:5768
- C:\Windows\System\aUhhCZl.exe
  C:\Windows\System\aUhhCZl.exe
  2⤵
  PID:5784
- C:\Windows\System\ijNRhSH.exe
  C:\Windows\System\ijNRhSH.exe
  2⤵
  PID:5800
- C:\Windows\System\CLRYmSN.exe
  C:\Windows\System\CLRYmSN.exe
  2⤵
  PID:5816
- C:\Windows\System\stLZhcl.exe
  C:\Windows\System\stLZhcl.exe
  2⤵
  PID:5832
- C:\Windows\System\DFDLYWc.exe
  C:\Windows\System\DFDLYWc.exe
  2⤵
  PID:5848
- C:\Windows\System\jvncIpo.exe
  C:\Windows\System\jvncIpo.exe
  2⤵
  PID:5868
- C:\Windows\System\qEADdjk.exe
  C:\Windows\System\qEADdjk.exe
  2⤵
  PID:5884
- C:\Windows\System\KhDeSVy.exe
  C:\Windows\System\KhDeSVy.exe
  2⤵
  PID:5900
- C:\Windows\System\CpnhozE.exe
  C:\Windows\System\CpnhozE.exe
  2⤵
  PID:5916
- C:\Windows\System\gsbmYtT.exe
  C:\Windows\System\gsbmYtT.exe
  2⤵
  PID:5936
- C:\Windows\System\zNKqYth.exe
  C:\Windows\System\zNKqYth.exe
  2⤵
  PID:5952
- C:\Windows\System\oNvYSWX.exe
  C:\Windows\System\oNvYSWX.exe
  2⤵
  PID:5968
- C:\Windows\System\RuvRyyz.exe
  C:\Windows\System\RuvRyyz.exe
  2⤵
  PID:5984
- C:\Windows\System\AXblsII.exe
  C:\Windows\System\AXblsII.exe
  2⤵
  PID:6000
- C:\Windows\System\ikgujNN.exe
  C:\Windows\System\ikgujNN.exe
  2⤵
  PID:6016
- C:\Windows\System\EsWQhwo.exe
  C:\Windows\System\EsWQhwo.exe
  2⤵
  PID:6036
- C:\Windows\System\JlBfMMk.exe
  C:\Windows\System\JlBfMMk.exe
  2⤵
  PID:6056
- C:\Windows\System\incwZTj.exe
  C:\Windows\System\incwZTj.exe
  2⤵
  PID:6076
- C:\Windows\System\REPtque.exe
  C:\Windows\System\REPtque.exe
  2⤵
  PID:6100
- C:\Windows\System\snegmrc.exe
  C:\Windows\System\snegmrc.exe
  2⤵
  PID:4852
- C:\Windows\System\qeCoXtA.exe
  C:\Windows\System\qeCoXtA.exe
  2⤵
  PID:288
- C:\Windows\System\kwmIIlT.exe
  C:\Windows\System\kwmIIlT.exe
  2⤵
  PID:5148
- C:\Windows\System\nOVXlCU.exe
  C:\Windows\System\nOVXlCU.exe
  2⤵
  PID:5188
- C:\Windows\System\PAtjWUp.exe
  C:\Windows\System\PAtjWUp.exe
  2⤵
  PID:5228
- C:\Windows\System\lsDMTjJ.exe
  C:\Windows\System\lsDMTjJ.exe
  2⤵
  PID:5300
- C:\Windows\System\GbaQOyq.exe
  C:\Windows\System\GbaQOyq.exe
  2⤵
  PID:5332
- C:\Windows\System\eFYgOHU.exe
  C:\Windows\System\eFYgOHU.exe
  2⤵
  PID:1992
- C:\Windows\System\siAkVGI.exe
  C:\Windows\System\siAkVGI.exe
  2⤵
  PID:2848
- C:\Windows\System\rdKngNZ.exe
  C:\Windows\System\rdKngNZ.exe
  2⤵
  PID:1664
- C:\Windows\System\peQdlpz.exe
  C:\Windows\System\peQdlpz.exe
  2⤵
  PID:5164
- C:\Windows\System\AhnFVBj.exe
  C:\Windows\System\AhnFVBj.exe
  2⤵
  PID:5284
- C:\Windows\System\dEIFXsH.exe
  C:\Windows\System\dEIFXsH.exe
  2⤵
  PID:3940
- C:\Windows\System\SmVoJMF.exe
  C:\Windows\System\SmVoJMF.exe
  2⤵
  PID:4112
- C:\Windows\System\HmlIUqo.exe
  C:\Windows\System\HmlIUqo.exe
  2⤵
  PID:2464
- C:\Windows\System\rwfBmww.exe
  C:\Windows\System\rwfBmww.exe
  2⤵
  PID:3968
- C:\Windows\System\bGFbaED.exe
  C:\Windows\System\bGFbaED.exe
  2⤵
  PID:5136
- C:\Windows\System\qnKDiKK.exe
  C:\Windows\System\qnKDiKK.exe
  2⤵
  PID:5212
- C:\Windows\System\PTODqSk.exe
  C:\Windows\System\PTODqSk.exe
  2⤵
  PID:5376
- C:\Windows\System\AVMDkHo.exe
  C:\Windows\System\AVMDkHo.exe
  2⤵
  PID:5536
- C:\Windows\System\NYLrlEo.exe
  C:\Windows\System\NYLrlEo.exe
  2⤵
  PID:5544
- C:\Windows\System\DLydTwM.exe
  C:\Windows\System\DLydTwM.exe
  2⤵
  PID:5408
- C:\Windows\System\wlIkSiX.exe
  C:\Windows\System\wlIkSiX.exe
  2⤵
  PID:5716
- C:\Windows\System\WpZoTZP.exe
  C:\Windows\System\WpZoTZP.exe
  2⤵
  PID:5760
- C:\Windows\System\XzhPRyK.exe
  C:\Windows\System\XzhPRyK.exe
  2⤵
  PID:5792
- C:\Windows\System\yeZULFu.exe
  C:\Windows\System\yeZULFu.exe
  2⤵
  PID:5864
- C:\Windows\System\yRhYZIN.exe
  C:\Windows\System\yRhYZIN.exe
  2⤵
  PID:5924
- C:\Windows\System\rRkoiMR.exe
  C:\Windows\System\rRkoiMR.exe
  2⤵
  PID:5964
- C:\Windows\System\PpQyNFf.exe
  C:\Windows\System\PpQyNFf.exe
  2⤵
  PID:6096
- C:\Windows\System\wBqsDXu.exe
  C:\Windows\System\wBqsDXu.exe
  2⤵
  PID:6068
- C:\Windows\System\iRSvVzO.exe
  C:\Windows\System\iRSvVzO.exe
  2⤵
  PID:4248
- C:\Windows\System\HYLjBzB.exe
  C:\Windows\System\HYLjBzB.exe
  2⤵
  PID:4948
- C:\Windows\System\GumpwOJ.exe
  C:\Windows\System\GumpwOJ.exe
  2⤵
  PID:5392
- C:\Windows\System\tFtTboS.exe
  C:\Windows\System\tFtTboS.exe
  2⤵
  PID:5736
- C:\Windows\System\CaXGetR.exe
  C:\Windows\System\CaXGetR.exe
  2⤵
  PID:5520
- C:\Windows\System\mtdMtqU.exe
  C:\Windows\System\mtdMtqU.exe
  2⤵
  PID:5452
- C:\Windows\System\PrRfrQY.exe
  C:\Windows\System\PrRfrQY.exe
  2⤵
  PID:5492
- C:\Windows\System\ZLbdzzO.exe
  C:\Windows\System\ZLbdzzO.exe
  2⤵
  PID:5640
- C:\Windows\System\AJnLIBo.exe
  C:\Windows\System\AJnLIBo.exe
  2⤵
  PID:5748
- C:\Windows\System\NwEYTpX.exe
  C:\Windows\System\NwEYTpX.exe
  2⤵
  PID:5840
- C:\Windows\System\BrHFtdf.exe
  C:\Windows\System\BrHFtdf.exe
  2⤵
  PID:5948
- C:\Windows\System\GgjSCsT.exe
  C:\Windows\System\GgjSCsT.exe
  2⤵
  PID:6092
- C:\Windows\System\uVescrg.exe
  C:\Windows\System\uVescrg.exe
  2⤵
  PID:6116
- C:\Windows\System\BQOxBqC.exe
  C:\Windows\System\BQOxBqC.exe
  2⤵
  PID:5364
- C:\Windows\System\VfYfVtz.exe
  C:\Windows\System\VfYfVtz.exe
  2⤵
  PID:4764
- C:\Windows\System\YdiZhTw.exe
  C:\Windows\System\YdiZhTw.exe
  2⤵
  PID:5080
- C:\Windows\System\BqcSwiz.exe
  C:\Windows\System\BqcSwiz.exe
  2⤵
  PID:5624
- C:\Windows\System\xRzePrY.exe
  C:\Windows\System\xRzePrY.exe
  2⤵
  PID:6124
- C:\Windows\System\VwMzbjA.exe
  C:\Windows\System\VwMzbjA.exe
  2⤵
  PID:5960
- C:\Windows\System\ycDPaUd.exe
  C:\Windows\System\ycDPaUd.exe
  2⤵
  PID:3180
- C:\Windows\System\OmZQAwP.exe
  C:\Windows\System\OmZQAwP.exe
  2⤵
  PID:5656
- C:\Windows\System\gVoKbhI.exe
  C:\Windows\System\gVoKbhI.exe
  2⤵
  PID:5860
- C:\Windows\System\yoYuFhZ.exe
  C:\Windows\System\yoYuFhZ.exe
  2⤵
  PID:5484
- C:\Windows\System\rAgcZPP.exe
  C:\Windows\System\rAgcZPP.exe
  2⤵
  PID:5744
- C:\Windows\System\nrVmnzt.exe
  C:\Windows\System\nrVmnzt.exe
  2⤵
  PID:5700
- C:\Windows\System\APpQeOa.exe
  C:\Windows\System\APpQeOa.exe
  2⤵
  PID:6064
- C:\Windows\System\WwFUCWT.exe
  C:\Windows\System\WwFUCWT.exe
  2⤵
  PID:5636
- C:\Windows\System\EUWQCQj.exe
  C:\Windows\System\EUWQCQj.exe
  2⤵
  PID:5588
- C:\Windows\System\mkKGSni.exe
  C:\Windows\System\mkKGSni.exe
  2⤵
  PID:5992
- C:\Windows\System\TYIlLfx.exe
  C:\Windows\System\TYIlLfx.exe
  2⤵
  PID:4716
- C:\Windows\System\McGZOpB.exe
  C:\Windows\System\McGZOpB.exe
  2⤵
  PID:5352
- C:\Windows\System\deCeNMP.exe
  C:\Windows\System\deCeNMP.exe
  2⤵
  PID:4312
- C:\Windows\System\YHRmNKJ.exe
  C:\Windows\System\YHRmNKJ.exe
  2⤵
  PID:5316
- C:\Windows\System\kpRDqQl.exe
  C:\Windows\System\kpRDqQl.exe
  2⤵
  PID:2536
- C:\Windows\System\WwRoFeZ.exe
  C:\Windows\System\WwRoFeZ.exe
  2⤵
  PID:4352
- C:\Windows\System\GWQQCqQ.exe
  C:\Windows\System\GWQQCqQ.exe
  2⤵
  PID:4116
- C:\Windows\System\pczFXNu.exe
  C:\Windows\System\pczFXNu.exe
  2⤵
  PID:6112
- C:\Windows\System\mzYIeaA.exe
  C:\Windows\System\mzYIeaA.exe
  2⤵
  PID:6136
- C:\Windows\System\aYCJfIA.exe
  C:\Windows\System\aYCJfIA.exe
  2⤵
  PID:2372
- C:\Windows\System\ZzQnraF.exe
  C:\Windows\System\ZzQnraF.exe
  2⤵
  PID:5980
- C:\Windows\System\Dabtsmh.exe
  C:\Windows\System\Dabtsmh.exe
  2⤵
  PID:5812
- C:\Windows\System\GkeNedw.exe
  C:\Windows\System\GkeNedw.exe
  2⤵
  PID:6012
- C:\Windows\System\UYhmQXn.exe
  C:\Windows\System\UYhmQXn.exe
  2⤵
  PID:5844
- C:\Windows\System\odcQMDJ.exe
  C:\Windows\System\odcQMDJ.exe
  2⤵
  PID:6148
- C:\Windows\System\IAmXcfT.exe
  C:\Windows\System\IAmXcfT.exe
  2⤵
  PID:6164
- C:\Windows\System\BYlrxLG.exe
  C:\Windows\System\BYlrxLG.exe
  2⤵
  PID:6180
- C:\Windows\System\pupoXzd.exe
  C:\Windows\System\pupoXzd.exe
  2⤵
  PID:6196
- C:\Windows\System\ejGMOzp.exe
  C:\Windows\System\ejGMOzp.exe
  2⤵
  PID:6212
- C:\Windows\System\DopiJSx.exe
  C:\Windows\System\DopiJSx.exe
  2⤵
  PID:6228
- C:\Windows\System\yukQgJq.exe
  C:\Windows\System\yukQgJq.exe
  2⤵
  PID:6372
- C:\Windows\System\kYjHlZN.exe
  C:\Windows\System\kYjHlZN.exe
  2⤵
  PID:6388
- C:\Windows\System\Vlpuuge.exe
  C:\Windows\System\Vlpuuge.exe
  2⤵
  PID:6404
- C:\Windows\System\JXMQuQs.exe
  C:\Windows\System\JXMQuQs.exe
  2⤵
  PID:6424
- C:\Windows\System\fKYiBeB.exe
  C:\Windows\System\fKYiBeB.exe
  2⤵
  PID:6440
- C:\Windows\System\QUdhruo.exe
  C:\Windows\System\QUdhruo.exe
  2⤵
  PID:6456
- C:\Windows\System\cYJvBYe.exe
  C:\Windows\System\cYJvBYe.exe
  2⤵
  PID:6472
- C:\Windows\System\CyLCIjs.exe
  C:\Windows\System\CyLCIjs.exe
  2⤵
  PID:6488
- C:\Windows\System\SYdcdxV.exe
  C:\Windows\System\SYdcdxV.exe
  2⤵
  PID:6504
- C:\Windows\System\myfPUyP.exe
  C:\Windows\System\myfPUyP.exe
  2⤵
  PID:6520
- C:\Windows\System\fCpRrVo.exe
  C:\Windows\System\fCpRrVo.exe
  2⤵
  PID:6536
- C:\Windows\System\FhzmAXW.exe
  C:\Windows\System\FhzmAXW.exe
  2⤵
  PID:6552
- C:\Windows\System\sXyaBAl.exe
  C:\Windows\System\sXyaBAl.exe
  2⤵
  PID:6568
- C:\Windows\System\YQrqHmw.exe
  C:\Windows\System\YQrqHmw.exe
  2⤵
  PID:6584
- C:\Windows\System\JyasDwR.exe
  C:\Windows\System\JyasDwR.exe
  2⤵
  PID:6600
- C:\Windows\System\xQvaXDI.exe
  C:\Windows\System\xQvaXDI.exe
  2⤵
  PID:6616
- C:\Windows\System\SgDAvVF.exe
  C:\Windows\System\SgDAvVF.exe
  2⤵
  PID:6640
- C:\Windows\System\MJLrnoh.exe
  C:\Windows\System\MJLrnoh.exe
  2⤵
  PID:6660
- C:\Windows\System\dQKngsR.exe
  C:\Windows\System\dQKngsR.exe
  2⤵
  PID:6684
- C:\Windows\System\VPpNlXi.exe
  C:\Windows\System\VPpNlXi.exe
  2⤵
  PID:6704
- C:\Windows\System\TmsDziV.exe
  C:\Windows\System\TmsDziV.exe
  2⤵
  PID:6728
- C:\Windows\System\wQHKrGd.exe
  C:\Windows\System\wQHKrGd.exe
  2⤵
  PID:6808
- C:\Windows\System\wsOTUJh.exe
  C:\Windows\System\wsOTUJh.exe
  2⤵
  PID:6828
- C:\Windows\System\JuKWyNJ.exe
  C:\Windows\System\JuKWyNJ.exe
  2⤵
  PID:6844
- C:\Windows\System\rtbiLJt.exe
  C:\Windows\System\rtbiLJt.exe
  2⤵
  PID:6860
- C:\Windows\System\yNPMePE.exe
  C:\Windows\System\yNPMePE.exe
  2⤵
  PID:6876
- C:\Windows\System\VRuwpkY.exe
  C:\Windows\System\VRuwpkY.exe
  2⤵
  PID:6900
- C:\Windows\System\KKnCpNE.exe
  C:\Windows\System\KKnCpNE.exe
  2⤵
  PID:6916
- C:\Windows\System\eJJpCQk.exe
  C:\Windows\System\eJJpCQk.exe
  2⤵
  PID:6932
- C:\Windows\System\xAjiLEJ.exe
  C:\Windows\System\xAjiLEJ.exe
  2⤵
  PID:6948
- C:\Windows\System\wLjZJTp.exe
  C:\Windows\System\wLjZJTp.exe
  2⤵
  PID:6964
- C:\Windows\System\RkMsbrZ.exe
  C:\Windows\System\RkMsbrZ.exe
  2⤵
  PID:6980
- C:\Windows\System\USWcqcy.exe
  C:\Windows\System\USWcqcy.exe
  2⤵
  PID:6996
- C:\Windows\System\eowpCQU.exe
  C:\Windows\System\eowpCQU.exe
  2⤵
  PID:7012
- C:\Windows\System\VhEuaSR.exe
  C:\Windows\System\VhEuaSR.exe
  2⤵
  PID:7028
- C:\Windows\System\aPUGfoe.exe
  C:\Windows\System\aPUGfoe.exe
  2⤵
  PID:7044
- C:\Windows\System\lDoGNNz.exe
  C:\Windows\System\lDoGNNz.exe
  2⤵
  PID:7060
- C:\Windows\System\LNIVzlH.exe
  C:\Windows\System\LNIVzlH.exe
  2⤵
  PID:7076
- C:\Windows\System\DTdAaek.exe
  C:\Windows\System\DTdAaek.exe
  2⤵
  PID:7092
- C:\Windows\System\RGSzKHt.exe
  C:\Windows\System\RGSzKHt.exe
  2⤵
  PID:7108
- C:\Windows\System\nPmWTwB.exe
  C:\Windows\System\nPmWTwB.exe
  2⤵
  PID:7124
- C:\Windows\System\nzvQnDB.exe
  C:\Windows\System\nzvQnDB.exe
  2⤵
  PID:7140
- C:\Windows\System\AQOWlZL.exe
  C:\Windows\System\AQOWlZL.exe
  2⤵
  PID:7156
- C:\Windows\System\ZPsPeSz.exe
  C:\Windows\System\ZPsPeSz.exe
  2⤵
  PID:6156
- C:\Windows\System\qdDWaDL.exe
  C:\Windows\System\qdDWaDL.exe
  2⤵
  PID:6192
- C:\Windows\System\tdvRmTu.exe
  C:\Windows\System\tdvRmTu.exe
  2⤵
  PID:2004
- C:\Windows\System\HGiOruD.exe
  C:\Windows\System\HGiOruD.exe
  2⤵
  PID:6028
- C:\Windows\System\NCpmcHM.exe
  C:\Windows\System\NCpmcHM.exe
  2⤵
  PID:5184
- C:\Windows\System\CUVAyas.exe
  C:\Windows\System\CUVAyas.exe
  2⤵
  PID:5280
- C:\Windows\System\XJcxInE.exe
  C:\Windows\System\XJcxInE.exe
  2⤵
  PID:4668
- C:\Windows\System\aYsQtvH.exe
  C:\Windows\System\aYsQtvH.exe
  2⤵
  PID:4032
- C:\Windows\System\bbCdsFF.exe
  C:\Windows\System\bbCdsFF.exe
  2⤵
  PID:5472
- C:\Windows\System\ocLzufN.exe
  C:\Windows\System\ocLzufN.exe
  2⤵
  PID:560
- C:\Windows\System\JLteToC.exe
  C:\Windows\System\JLteToC.exe
  2⤵
  PID:5740
- C:\Windows\System\AtRggfT.exe
  C:\Windows\System\AtRggfT.exe
  2⤵
  PID:6044
- C:\Windows\System\ElAaSct.exe
  C:\Windows\System\ElAaSct.exe
  2⤵
  PID:5356
- C:\Windows\System\yuKkhno.exe
  C:\Windows\System\yuKkhno.exe
  2⤵
  PID:5380
- C:\Windows\System\mGBOjWg.exe
  C:\Windows\System\mGBOjWg.exe
  2⤵
  PID:5592
- C:\Windows\System\yLMMNBx.exe
  C:\Windows\System\yLMMNBx.exe
  2⤵
  PID:2256
- C:\Windows\System\JDFlDVu.exe
  C:\Windows\System\JDFlDVu.exe
  2⤵
  PID:6208
- C:\Windows\System\eCnpfMz.exe
  C:\Windows\System\eCnpfMz.exe
  2⤵
  PID:6248
- C:\Windows\System\BevHHCX.exe
  C:\Windows\System\BevHHCX.exe
  2⤵
  PID:6264
- C:\Windows\System\sNfZkoL.exe
  C:\Windows\System\sNfZkoL.exe
  2⤵
  PID:6280
- C:\Windows\System\xqoFHpj.exe
  C:\Windows\System\xqoFHpj.exe
  2⤵
  PID:6292
- C:\Windows\System\WiadVOg.exe
  C:\Windows\System\WiadVOg.exe
  2⤵
  PID:6308
- C:\Windows\System\gtqxEBZ.exe
  C:\Windows\System\gtqxEBZ.exe
  2⤵
  PID:6320
- C:\Windows\System\ZZBtkyu.exe
  C:\Windows\System\ZZBtkyu.exe
  2⤵
  PID:6340
- C:\Windows\System\LtpMQCZ.exe
  C:\Windows\System\LtpMQCZ.exe
  2⤵
  PID:6380
- C:\Windows\System\ZwMeNyI.exe
  C:\Windows\System\ZwMeNyI.exe
  2⤵
  PID:6416
- C:\Windows\System\wSZJgsx.exe
  C:\Windows\System\wSZJgsx.exe
  2⤵
  PID:6480
- C:\Windows\System\IxgBjWa.exe
  C:\Windows\System\IxgBjWa.exe
  2⤵
  PID:6548
- C:\Windows\System\jTOSLme.exe
  C:\Windows\System\jTOSLme.exe
  2⤵
  PID:6396
- C:\Windows\System\fJbjwdP.exe
  C:\Windows\System\fJbjwdP.exe
  2⤵
  PID:6464
- C:\Windows\System\kRwQrNK.exe
  C:\Windows\System\kRwQrNK.exe
  2⤵
  PID:6528
- C:\Windows\System\ZPKcZlV.exe
  C:\Windows\System\ZPKcZlV.exe
  2⤵
  PID:6592
- C:\Windows\System\IXLaqCj.exe
  C:\Windows\System\IXLaqCj.exe
  2⤵
  PID:6580
- C:\Windows\System\jKDZyTO.exe
  C:\Windows\System\jKDZyTO.exe
  2⤵
  PID:6636
- C:\Windows\System\NgvxEMt.exe
  C:\Windows\System\NgvxEMt.exe
  2⤵
  PID:6672
- C:\Windows\System\UHxIHvK.exe
  C:\Windows\System\UHxIHvK.exe
  2⤵
  PID:6696
- C:\Windows\System\LMjCZVA.exe
  C:\Windows\System\LMjCZVA.exe
  2⤵
  PID:6740
- C:\Windows\System\xyGdPrk.exe
  C:\Windows\System\xyGdPrk.exe
  2⤵
  PID:6716
- C:\Windows\System\IRXmgcj.exe
  C:\Windows\System\IRXmgcj.exe
  2⤵
  PID:6768
- C:\Windows\System\utNnoBY.exe
  C:\Windows\System\utNnoBY.exe
  2⤵
  PID:6784
- C:\Windows\System\CXtXOhG.exe
  C:\Windows\System\CXtXOhG.exe
  2⤵
  PID:6800
- C:\Windows\System\qXnWCow.exe
  C:\Windows\System\qXnWCow.exe
  2⤵
  PID:6816
- C:\Windows\System\JUPMngl.exe
  C:\Windows\System\JUPMngl.exe
  2⤵
  PID:6892
- C:\Windows\System\LwRapdB.exe
  C:\Windows\System\LwRapdB.exe
  2⤵
  PID:6872
- C:\Windows\System\JwlyMiI.exe
  C:\Windows\System\JwlyMiI.exe
  2⤵
  PID:6840
- C:\Windows\System\WckHFhD.exe
  C:\Windows\System\WckHFhD.exe
  2⤵
  PID:6944
- C:\Windows\System\xffonHt.exe
  C:\Windows\System\xffonHt.exe
  2⤵
  PID:7008
- C:\Windows\System\OgLqyYC.exe
  C:\Windows\System\OgLqyYC.exe
  2⤵
  PID:7068
- C:\Windows\System\rEBfhzT.exe
  C:\Windows\System\rEBfhzT.exe
  2⤵
  PID:7132
- C:\Windows\System\pdVfjrb.exe
  C:\Windows\System\pdVfjrb.exe
  2⤵
  PID:5208
- C:\Windows\System\VIoYzqX.exe
  C:\Windows\System\VIoYzqX.exe
  2⤵
  PID:2512
- C:\Windows\System\kIoTBOv.exe
  C:\Windows\System\kIoTBOv.exe
  2⤵
  PID:7056
- C:\Windows\System\JLXwEXM.exe
  C:\Windows\System\JLXwEXM.exe
  2⤵
  PID:2508
- C:\Windows\System\EhXKVWQ.exe
  C:\Windows\System\EhXKVWQ.exe
  2⤵
  PID:6956
- C:\Windows\System\ZnYxhyf.exe
  C:\Windows\System\ZnYxhyf.exe
  2⤵
  PID:7024
- C:\Windows\System\NhnMFXl.exe
  C:\Windows\System\NhnMFXl.exe
  2⤵
  PID:7148
- C:\Windows\System\rqJgEgQ.exe
  C:\Windows\System\rqJgEgQ.exe
  2⤵
  PID:6188
- C:\Windows\System\URkipnG.exe
  C:\Windows\System\URkipnG.exe
  2⤵
  PID:5892
- C:\Windows\System\hcIfztF.exe
  C:\Windows\System\hcIfztF.exe
  2⤵
  PID:4648
- C:\Windows\System\iuWNhHH.exe
  C:\Windows\System\iuWNhHH.exe
  2⤵
  PID:6204
- C:\Windows\System\dyjKVYC.exe
  C:\Windows\System\dyjKVYC.exe
  2⤵
  PID:6256
- C:\Windows\System\uuATmSt.exe
  C:\Windows\System\uuATmSt.exe
  2⤵
  PID:6024
- C:\Windows\System\WWHyAHM.exe
  C:\Windows\System\WWHyAHM.exe
  2⤵
  PID:6316
- C:\Windows\System\UzAPXoq.exe
  C:\Windows\System\UzAPXoq.exe
  2⤵
  PID:6452
- C:\Windows\System\ldfnFGf.exe
  C:\Windows\System\ldfnFGf.exe
  2⤵
  PID:6304
- C:\Windows\System\xqHAfJj.exe
  C:\Windows\System\xqHAfJj.exe
  2⤵
  PID:6272
- C:\Windows\System\rRPbUVf.exe
  C:\Windows\System\rRPbUVf.exe
  2⤵
  PID:6300
- C:\Windows\System\MvhHCSJ.exe
  C:\Windows\System\MvhHCSJ.exe
  2⤵
  PID:6512
- C:\Windows\System\YelyJKJ.exe
  C:\Windows\System\YelyJKJ.exe
  2⤵
  PID:6692
- C:\Windows\System\OyaDXEP.exe
  C:\Windows\System\OyaDXEP.exe
  2⤵
  PID:6544
- C:\Windows\System\HnSbtGN.exe
  C:\Windows\System\HnSbtGN.exe
  2⤵
  PID:6724
- C:\Windows\System\sktrtLW.exe
  C:\Windows\System\sktrtLW.exe
  2⤵
  PID:6824
- C:\Windows\System\xDKhkhz.exe
  C:\Windows\System\xDKhkhz.exe
  2⤵
  PID:6836
- C:\Windows\System\NVRzsaM.exe
  C:\Windows\System\NVRzsaM.exe
  2⤵
  PID:7004
- C:\Windows\System\dIFqaZY.exe
  C:\Windows\System\dIFqaZY.exe
  2⤵
  PID:6680
- C:\Windows\System\ZIGFtfq.exe
  C:\Windows\System\ZIGFtfq.exe
  2⤵
  PID:6888
- C:\Windows\System\bJtRllm.exe
  C:\Windows\System\bJtRllm.exe
  2⤵
  PID:5248
- C:\Windows\System\vCojrxM.exe
  C:\Windows\System\vCojrxM.exe
  2⤵
  PID:7040
- C:\Windows\System\zsBDbnb.exe
  C:\Windows\System\zsBDbnb.exe
  2⤵
  PID:6928
- C:\Windows\System\FTWnSHI.exe
  C:\Windows\System\FTWnSHI.exe
  2⤵
  PID:6988
- C:\Windows\System\mJftPPu.exe
  C:\Windows\System\mJftPPu.exe
  2⤵
  PID:6160
- C:\Windows\System\gxolEqV.exe
  C:\Windows\System\gxolEqV.exe
  2⤵
  PID:4144
- C:\Windows\System\OlCcRhY.exe
  C:\Windows\System\OlCcRhY.exe
  2⤵
  PID:7104
- C:\Windows\System\saTjrMa.exe
  C:\Windows\System\saTjrMa.exe
  2⤵
  PID:6336
- C:\Windows\System\NpXJeqr.exe
  C:\Windows\System\NpXJeqr.exe
  2⤵
  PID:6780
- C:\Windows\System\DkZexna.exe
  C:\Windows\System\DkZexna.exe
  2⤵
  PID:6436
- C:\Windows\System\GqkTLTm.exe
  C:\Windows\System\GqkTLTm.exe
  2⤵
  PID:1524
- C:\Windows\System\VsnfQzG.exe
  C:\Windows\System\VsnfQzG.exe
  2⤵
  PID:5896
- C:\Windows\System\KhWnhUB.exe
  C:\Windows\System\KhWnhUB.exe
  2⤵
  PID:6288
- C:\Windows\System\mKrLXhl.exe
  C:\Windows\System\mKrLXhl.exe
  2⤵
  PID:6516
- C:\Windows\System\AHyNTeM.exe
  C:\Windows\System\AHyNTeM.exe
  2⤵
  PID:5828
- C:\Windows\System\CyLldSg.exe
  C:\Windows\System\CyLldSg.exe
  2⤵
  PID:6632
- C:\Windows\System\vhIXDvr.exe
  C:\Windows\System\vhIXDvr.exe
  2⤵
  PID:6368
- C:\Windows\System\wJGxPpw.exe
  C:\Windows\System\wJGxPpw.exe
  2⤵
  PID:7116
- C:\Windows\System\MEFODay.exe
  C:\Windows\System\MEFODay.exe
  2⤵
  PID:6756
- C:\Windows\System\kPdHmZy.exe
  C:\Windows\System\kPdHmZy.exe
  2⤵
  PID:5612
- C:\Windows\System\QYNFfJn.exe
  C:\Windows\System\QYNFfJn.exe
  2⤵
  PID:6328
- C:\Windows\System\oBJBSEo.exe
  C:\Windows\System\oBJBSEo.exe
  2⤵
  PID:6648
- C:\Windows\System\rDNrHGN.exe
  C:\Windows\System\rDNrHGN.exe
  2⤵
  PID:6736
- C:\Windows\System\XXddkss.exe
  C:\Windows\System\XXddkss.exe
  2⤵
  PID:6656
- C:\Windows\System\bDnTAdp.exe
  C:\Windows\System\bDnTAdp.exe
  2⤵
  PID:6260
- C:\Windows\System\NPCwiKe.exe
  C:\Windows\System\NPCwiKe.exe
  2⤵
  PID:7184
- C:\Windows\System\rojzASy.exe
  C:\Windows\System\rojzASy.exe
  2⤵
  PID:7200
- C:\Windows\System\Lglxuqb.exe
  C:\Windows\System\Lglxuqb.exe
  2⤵
  PID:7216
- C:\Windows\System\ypOExTC.exe
  C:\Windows\System\ypOExTC.exe
  2⤵
  PID:7232
- C:\Windows\System\VYFPiFM.exe
  C:\Windows\System\VYFPiFM.exe
  2⤵
  PID:7248
- C:\Windows\System\cWYaheQ.exe
  C:\Windows\System\cWYaheQ.exe
  2⤵
  PID:7264
- C:\Windows\System\TdMemIn.exe
  C:\Windows\System\TdMemIn.exe
  2⤵
  PID:7280
- C:\Windows\System\bxXXjpM.exe
  C:\Windows\System\bxXXjpM.exe
  2⤵
  PID:7296
- C:\Windows\System\uZTHXxM.exe
  C:\Windows\System\uZTHXxM.exe
  2⤵
  PID:7312
- C:\Windows\System\jVDuNCB.exe
  C:\Windows\System\jVDuNCB.exe
  2⤵
  PID:7328
- C:\Windows\System\SphiegT.exe
  C:\Windows\System\SphiegT.exe
  2⤵
  PID:7344
- C:\Windows\System\EtpPXuy.exe
  C:\Windows\System\EtpPXuy.exe
  2⤵
  PID:7360
- C:\Windows\System\bqoZFRI.exe
  C:\Windows\System\bqoZFRI.exe
  2⤵
  PID:7376
- C:\Windows\System\OxqBaKU.exe
  C:\Windows\System\OxqBaKU.exe
  2⤵
  PID:7392
- C:\Windows\System\SegWSqP.exe
  C:\Windows\System\SegWSqP.exe
  2⤵
  PID:7408
- C:\Windows\System\nxVIVdJ.exe
  C:\Windows\System\nxVIVdJ.exe
  2⤵
  PID:7424
- C:\Windows\System\tCJmVrO.exe
  C:\Windows\System\tCJmVrO.exe
  2⤵
  PID:7440
- C:\Windows\System\jzICVDD.exe
  C:\Windows\System\jzICVDD.exe
  2⤵
  PID:7456
- C:\Windows\System\yaIlrFx.exe
  C:\Windows\System\yaIlrFx.exe
  2⤵
  PID:7472
- C:\Windows\System\ILcBNlK.exe
  C:\Windows\System\ILcBNlK.exe
  2⤵
  PID:7488
- C:\Windows\System\arPgEbE.exe
  C:\Windows\System\arPgEbE.exe
  2⤵
  PID:7508
- C:\Windows\System\buHwuOD.exe
  C:\Windows\System\buHwuOD.exe
  2⤵
  PID:7524
- C:\Windows\System\oJaoAKs.exe
  C:\Windows\System\oJaoAKs.exe
  2⤵
  PID:7540
- C:\Windows\System\MlLdtgJ.exe
  C:\Windows\System\MlLdtgJ.exe
  2⤵
  PID:7556
- C:\Windows\System\degDEMI.exe
  C:\Windows\System\degDEMI.exe
  2⤵
  PID:7572
- C:\Windows\System\IFgZLNB.exe
  C:\Windows\System\IFgZLNB.exe
  2⤵
  PID:7588
- C:\Windows\System\FXYAPyd.exe
  C:\Windows\System\FXYAPyd.exe
  2⤵
  PID:7604
- C:\Windows\System\FUXiftX.exe
  C:\Windows\System\FUXiftX.exe
  2⤵
  PID:7624
- C:\Windows\System\evVKQlp.exe
  C:\Windows\System\evVKQlp.exe
  2⤵
  PID:7640
- C:\Windows\System\prnRVvX.exe
  C:\Windows\System\prnRVvX.exe
  2⤵
  PID:7656
- C:\Windows\System\oMUdNgE.exe
  C:\Windows\System\oMUdNgE.exe
  2⤵
  PID:7672
- C:\Windows\System\FFNwebj.exe
  C:\Windows\System\FFNwebj.exe
  2⤵
  PID:7728
- C:\Windows\System\GxRzAXd.exe
  C:\Windows\System\GxRzAXd.exe
  2⤵
  PID:7744
- C:\Windows\System\lsMOiYH.exe
  C:\Windows\System\lsMOiYH.exe
  2⤵
  PID:7760
- C:\Windows\System\tGIdhMU.exe
  C:\Windows\System\tGIdhMU.exe
  2⤵
  PID:7776
- C:\Windows\System\piYzvZF.exe
  C:\Windows\System\piYzvZF.exe
  2⤵
  PID:7792
- C:\Windows\System\ZOzRekp.exe
  C:\Windows\System\ZOzRekp.exe
  2⤵
  PID:7808
- C:\Windows\System\mGLhMtK.exe
  C:\Windows\System\mGLhMtK.exe
  2⤵
  PID:7828
- C:\Windows\System\BDGLDkL.exe
  C:\Windows\System\BDGLDkL.exe
  2⤵
  PID:7844
- C:\Windows\System\FkppwjV.exe
  C:\Windows\System\FkppwjV.exe
  2⤵
  PID:7860
- C:\Windows\System\RQjMQPb.exe
  C:\Windows\System\RQjMQPb.exe
  2⤵
  PID:7876
- C:\Windows\System\OSxhLHr.exe
  C:\Windows\System\OSxhLHr.exe
  2⤵
  PID:7892
- C:\Windows\System\QVVdtFu.exe
  C:\Windows\System\QVVdtFu.exe
  2⤵
  PID:7908
- C:\Windows\System\bxCNzup.exe
  C:\Windows\System\bxCNzup.exe
  2⤵
  PID:7924
- C:\Windows\System\ustCTXd.exe
  C:\Windows\System\ustCTXd.exe
  2⤵
  PID:7940
- C:\Windows\System\HVANJIC.exe
  C:\Windows\System\HVANJIC.exe
  2⤵
  PID:7956
- C:\Windows\System\XUXDqNf.exe
  C:\Windows\System\XUXDqNf.exe
  2⤵
  PID:7972
- C:\Windows\System\BUKOJFB.exe
  C:\Windows\System\BUKOJFB.exe
  2⤵
  PID:7988
- C:\Windows\System\AUbazhr.exe
  C:\Windows\System\AUbazhr.exe
  2⤵
  PID:8004
- C:\Windows\System\fYmanfJ.exe
  C:\Windows\System\fYmanfJ.exe
  2⤵
  PID:8024
- C:\Windows\System\Cgrbfta.exe
  C:\Windows\System\Cgrbfta.exe
  2⤵
  PID:8040
- C:\Windows\System\hICVQeN.exe
  C:\Windows\System\hICVQeN.exe
  2⤵
  PID:8060
- C:\Windows\System\pQmmpuD.exe
  C:\Windows\System\pQmmpuD.exe
  2⤵
  PID:8076
- C:\Windows\System\EFGQtgM.exe
  C:\Windows\System\EFGQtgM.exe
  2⤵
  PID:8092
- C:\Windows\System\rHxWEcP.exe
  C:\Windows\System\rHxWEcP.exe
  2⤵
  PID:8108
- C:\Windows\System\ZOPxEtQ.exe
  C:\Windows\System\ZOPxEtQ.exe
  2⤵
  PID:8128
- C:\Windows\System\COqPgJh.exe
  C:\Windows\System\COqPgJh.exe
  2⤵
  PID:8144
- C:\Windows\System\bwtuzVj.exe
  C:\Windows\System\bwtuzVj.exe
  2⤵
  PID:8164
- C:\Windows\System\DsVBatf.exe
  C:\Windows\System\DsVBatf.exe
  2⤵
  PID:8180
- C:\Windows\System\RmIwyJX.exe
  C:\Windows\System\RmIwyJX.exe
  2⤵
  PID:6560
- C:\Windows\System\ksNTkTI.exe
  C:\Windows\System\ksNTkTI.exe
  2⤵
  PID:7196
- C:\Windows\System\CgNhdct.exe
  C:\Windows\System\CgNhdct.exe
  2⤵
  PID:7260
- C:\Windows\System\rQskhLZ.exe
  C:\Windows\System\rQskhLZ.exe
  2⤵
  PID:7400
- C:\Windows\System\OPWdnQZ.exe
  C:\Windows\System\OPWdnQZ.exe
  2⤵
  PID:7464
- C:\Windows\System\JpDXYQM.exe
  C:\Windows\System\JpDXYQM.exe
  2⤵
  PID:7356
- C:\Windows\System\BcfRKHD.exe
  C:\Windows\System\BcfRKHD.exe
  2⤵
  PID:7420
- C:\Windows\System\mFXrjXm.exe
  C:\Windows\System\mFXrjXm.exe
  2⤵
  PID:7536
- C:\Windows\System\cctADOa.exe
  C:\Windows\System\cctADOa.exe
  2⤵
  PID:7600
- C:\Windows\System\JZvBSsN.exe
  C:\Windows\System\JZvBSsN.exe
  2⤵
  PID:7596
- C:\Windows\System\XumCutA.exe
  C:\Windows\System\XumCutA.exe
  2⤵
  PID:7484
- C:\Windows\System\brqrZNT.exe
  C:\Windows\System\brqrZNT.exe
  2⤵
  PID:7620
- C:\Windows\System\IOxJrjK.exe
  C:\Windows\System\IOxJrjK.exe
  2⤵
  PID:7580
- C:\Windows\System\ygbuqZF.exe
  C:\Windows\System\ygbuqZF.exe
  2⤵
  PID:7652
- C:\Windows\System\EwGZQWy.exe
  C:\Windows\System\EwGZQWy.exe
  2⤵
  PID:7692
- C:\Windows\System\YARCUwX.exe
  C:\Windows\System\YARCUwX.exe
  2⤵
  PID:7708
- C:\Windows\System\CkjbTQB.exe
  C:\Windows\System\CkjbTQB.exe
  2⤵
  PID:7740
- C:\Windows\System\kbmNUwv.exe
  C:\Windows\System\kbmNUwv.exe
  2⤵
  PID:7840
- C:\Windows\System\QEepAZt.exe
  C:\Windows\System\QEepAZt.exe
  2⤵
  PID:7784
- C:\Windows\System\SokGUxx.exe
  C:\Windows\System\SokGUxx.exe
  2⤵
  PID:7824
- C:\Windows\System\zMQeqhn.exe
  C:\Windows\System\zMQeqhn.exe
  2⤵
  PID:7916
- C:\Windows\System\TRBtlkH.exe
  C:\Windows\System\TRBtlkH.exe
  2⤵
  PID:7980
- C:\Windows\System\LawEmaw.exe
  C:\Windows\System\LawEmaw.exe
  2⤵
  PID:7948
- C:\Windows\System\vODJITc.exe
  C:\Windows\System\vODJITc.exe
  2⤵
  PID:7868
- C:\Windows\System\RrsVnxo.exe
  C:\Windows\System\RrsVnxo.exe
  2⤵
  PID:7904
- C:\Windows\System\OKCrxZf.exe
  C:\Windows\System\OKCrxZf.exe
  2⤵
  PID:7964
- C:\Windows\System\aFnsfqo.exe
  C:\Windows\System\aFnsfqo.exe
  2⤵
  PID:8032
- C:\Windows\System\IATjvzq.exe
  C:\Windows\System\IATjvzq.exe
  2⤵
  PID:8088
- C:\Windows\System\GUfeKSR.exe
  C:\Windows\System\GUfeKSR.exe
  2⤵
  PID:8152
- C:\Windows\System\eVhGwTf.exe
  C:\Windows\System\eVhGwTf.exe
  2⤵
  PID:7164
- C:\Windows\System\kdUxhts.exe
  C:\Windows\System\kdUxhts.exe
  2⤵
  PID:8104
- C:\Windows\System\HqRnfEc.exe
  C:\Windows\System\HqRnfEc.exe
  2⤵
  PID:8172
- C:\Windows\System\ytVIXtX.exe
  C:\Windows\System\ytVIXtX.exe
  2⤵
  PID:7192
- C:\Windows\System\dMYWWfE.exe
  C:\Windows\System\dMYWWfE.exe
  2⤵
  PID:6364
- C:\Windows\System\MPGyMaP.exe
  C:\Windows\System\MPGyMaP.exe
  2⤵
  PID:5420
- C:\Windows\System\KlLoVwp.exe
  C:\Windows\System\KlLoVwp.exe
  2⤵
  PID:7208
- C:\Windows\System\RRsXbnD.exe
  C:\Windows\System\RRsXbnD.exe
  2⤵
  PID:7276
- C:\Windows\System\iHhxPtn.exe
  C:\Windows\System\iHhxPtn.exe
  2⤵
  PID:7336
- C:\Windows\System\SexfMTX.exe
  C:\Windows\System\SexfMTX.exe
  2⤵
  PID:7384
- C:\Windows\System\QqBSPSr.exe
  C:\Windows\System\QqBSPSr.exe
  2⤵
  PID:7496
- C:\Windows\System\gfAphFy.exe
  C:\Windows\System\gfAphFy.exe
  2⤵
  PID:7500
- C:\Windows\System\nHZnYAg.exe
  C:\Windows\System\nHZnYAg.exe
  2⤵
  PID:7520
- C:\Windows\System\jEuHEBj.exe
  C:\Windows\System\jEuHEBj.exe
  2⤵
  PID:7736
- C:\Windows\System\MHKLSIF.exe
  C:\Windows\System\MHKLSIF.exe
  2⤵
  PID:7612
- C:\Windows\System\dodtocO.exe
  C:\Windows\System\dodtocO.exe
  2⤵
  PID:7820
- C:\Windows\System\wpAxTCe.exe
  C:\Windows\System\wpAxTCe.exe
  2⤵
  PID:7900
- C:\Windows\System\AVwIswh.exe
  C:\Windows\System\AVwIswh.exe
  2⤵
  PID:8120
- C:\Windows\System\bpCSPAF.exe
  C:\Windows\System\bpCSPAF.exe
  2⤵
  PID:7292
- C:\Windows\System\ZTWAtAg.exe
  C:\Windows\System\ZTWAtAg.exe
  2⤵
  PID:7240
- C:\Windows\System\GPdJxVa.exe
  C:\Windows\System\GPdJxVa.exe
  2⤵
  PID:7372
- C:\Windows\System\lwSRIbm.exe
  C:\Windows\System\lwSRIbm.exe
  2⤵
  PID:7952
- C:\Windows\System\tuDjmNh.exe
  C:\Windows\System\tuDjmNh.exe
  2⤵
  PID:8072
- C:\Windows\System\SWYINiE.exe
  C:\Windows\System\SWYINiE.exe
  2⤵
  PID:6240
- C:\Windows\System\uuppnGc.exe
  C:\Windows\System\uuppnGc.exe
  2⤵
  PID:6668
- C:\Windows\System\aaDjMpV.exe
  C:\Windows\System\aaDjMpV.exe
  2⤵
  PID:7308
- C:\Windows\System\IbovZId.exe
  C:\Windows\System\IbovZId.exe
  2⤵
  PID:7452
- C:\Windows\System\lQrXGFo.exe
  C:\Windows\System\lQrXGFo.exe
  2⤵
  PID:7388
- C:\Windows\System\avBZwWL.exe
  C:\Windows\System\avBZwWL.exe
  2⤵
  PID:7616
- C:\Windows\System\CCbSSXL.exe
  C:\Windows\System\CCbSSXL.exe
  2⤵
  PID:8220
- C:\Windows\System\qUfcYgA.exe
  C:\Windows\System\qUfcYgA.exe
  2⤵
  PID:8236
- C:\Windows\System\CIQQpzD.exe
  C:\Windows\System\CIQQpzD.exe
  2⤵
  PID:8252
- C:\Windows\System\ZGRXYBK.exe
  C:\Windows\System\ZGRXYBK.exe
  2⤵
  PID:8268
- C:\Windows\System\xTZmhKD.exe
  C:\Windows\System\xTZmhKD.exe
  2⤵
  PID:8284
- C:\Windows\System\bkHmRGz.exe
  C:\Windows\System\bkHmRGz.exe
  2⤵
  PID:8300
- C:\Windows\System\KelhPBT.exe
  C:\Windows\System\KelhPBT.exe
  2⤵
  PID:8320
- C:\Windows\System\zrOhiAy.exe
  C:\Windows\System\zrOhiAy.exe
  2⤵
  PID:8336
- C:\Windows\System\hfKZuvR.exe
  C:\Windows\System\hfKZuvR.exe
  2⤵
  PID:8352
- C:\Windows\System\zNmwDwG.exe
  C:\Windows\System\zNmwDwG.exe
  2⤵
  PID:8368
- C:\Windows\System\UPFNDNl.exe
  C:\Windows\System\UPFNDNl.exe
  2⤵
  PID:8384
- C:\Windows\System\yWrUEPS.exe
  C:\Windows\System\yWrUEPS.exe
  2⤵
  PID:8400
- C:\Windows\System\lgSooJe.exe
  C:\Windows\System\lgSooJe.exe
  2⤵
  PID:8416
- C:\Windows\System\QMHnWMA.exe
  C:\Windows\System\QMHnWMA.exe
  2⤵
  PID:8432
- C:\Windows\System\ybZTQIZ.exe
  C:\Windows\System\ybZTQIZ.exe
  2⤵
  PID:8448
- C:\Windows\System\Fbpwvoo.exe
  C:\Windows\System\Fbpwvoo.exe
  2⤵
  PID:8472
- C:\Windows\System\iAWaJDv.exe
  C:\Windows\System\iAWaJDv.exe
  2⤵
  PID:8488
- C:\Windows\System\NkHZDXc.exe
  C:\Windows\System\NkHZDXc.exe
  2⤵
  PID:8504
- C:\Windows\System\gcTlfGW.exe
  C:\Windows\System\gcTlfGW.exe
  2⤵
  PID:8524
- C:\Windows\System\OBIpVBh.exe
  C:\Windows\System\OBIpVBh.exe
  2⤵
  PID:8540
- C:\Windows\System\PCNcTpJ.exe
  C:\Windows\System\PCNcTpJ.exe
  2⤵
  PID:8676
- C:\Windows\System\OZPxVhP.exe
  C:\Windows\System\OZPxVhP.exe
  2⤵
  PID:8696
- C:\Windows\System\tlmpinc.exe
  C:\Windows\System\tlmpinc.exe
  2⤵
  PID:8712
- C:\Windows\System\MIFurGz.exe
  C:\Windows\System\MIFurGz.exe
  2⤵
  PID:8728
- C:\Windows\System\WaEwZQW.exe
  C:\Windows\System\WaEwZQW.exe
  2⤵
  PID:8744
- C:\Windows\System\Jicryac.exe
  C:\Windows\System\Jicryac.exe
  2⤵
  PID:8760
- C:\Windows\System\GPmdsbD.exe
  C:\Windows\System\GPmdsbD.exe
  2⤵
  PID:8776
- C:\Windows\System\JKDkPOH.exe
  C:\Windows\System\JKDkPOH.exe
  2⤵
  PID:8792
- C:\Windows\System\WWjbvbH.exe
  C:\Windows\System\WWjbvbH.exe
  2⤵
  PID:8808
- C:\Windows\System\VInFPOv.exe
  C:\Windows\System\VInFPOv.exe
  2⤵
  PID:8824
- C:\Windows\System\YsioNRd.exe
  C:\Windows\System\YsioNRd.exe
  2⤵
  PID:8840
- C:\Windows\System\JUQniVw.exe
  C:\Windows\System\JUQniVw.exe
  2⤵
  PID:8856
- C:\Windows\System\qPdUbbt.exe
  C:\Windows\System\qPdUbbt.exe
  2⤵
  PID:8872
- C:\Windows\System\jvyDLSp.exe
  C:\Windows\System\jvyDLSp.exe
  2⤵
  PID:8888
- C:\Windows\System\isvLUur.exe
  C:\Windows\System\isvLUur.exe
  2⤵
  PID:8904
- C:\Windows\System\rmUIfli.exe
  C:\Windows\System\rmUIfli.exe
  2⤵
  PID:8920
- C:\Windows\System\vgUiJXY.exe
  C:\Windows\System\vgUiJXY.exe
  2⤵
  PID:8936
- C:\Windows\System\JLkGMvq.exe
  C:\Windows\System\JLkGMvq.exe
  2⤵
  PID:8952
- C:\Windows\System\stBJKVm.exe
  C:\Windows\System\stBJKVm.exe
  2⤵
  PID:8968
- C:\Windows\System\TJyfkvE.exe
  C:\Windows\System\TJyfkvE.exe
  2⤵
  PID:8984
- C:\Windows\System\oViSisD.exe
  C:\Windows\System\oViSisD.exe
  2⤵
  PID:9000
- C:\Windows\System\jGRwdKo.exe
  C:\Windows\System\jGRwdKo.exe
  2⤵
  PID:9016
- C:\Windows\System\IVDnKZk.exe
  C:\Windows\System\IVDnKZk.exe
  2⤵
  PID:9032
- C:\Windows\System\HjfKgoR.exe
  C:\Windows\System\HjfKgoR.exe
  2⤵
  PID:9048
- C:\Windows\System\mkuYqZx.exe
  C:\Windows\System\mkuYqZx.exe
  2⤵
  PID:9064
- C:\Windows\System\XEcaYvg.exe
  C:\Windows\System\XEcaYvg.exe
  2⤵
  PID:9080
- C:\Windows\System\JyhKZmH.exe
  C:\Windows\System\JyhKZmH.exe
  2⤵
  PID:9096
- C:\Windows\System\fsWGHNA.exe
  C:\Windows\System\fsWGHNA.exe
  2⤵
  PID:9112
- C:\Windows\System\UbTwCGX.exe
  C:\Windows\System\UbTwCGX.exe
  2⤵
  PID:9128
- C:\Windows\System\uCislyF.exe
  C:\Windows\System\uCislyF.exe
  2⤵
  PID:9144
- C:\Windows\System\QPsrMaB.exe
  C:\Windows\System\QPsrMaB.exe
  2⤵
  PID:9160
- C:\Windows\System\bPndYAc.exe
  C:\Windows\System\bPndYAc.exe
  2⤵
  PID:9180
- C:\Windows\System\dESBecN.exe
  C:\Windows\System\dESBecN.exe
  2⤵
  PID:9196
- C:\Windows\System\wsYPjGr.exe
  C:\Windows\System\wsYPjGr.exe
  2⤵
  PID:9212
- C:\Windows\System\srQKRLa.exe
  C:\Windows\System\srQKRLa.exe
  2⤵
  PID:7920
- C:\Windows\System\ZaBUNKR.exe
  C:\Windows\System\ZaBUNKR.exe
  2⤵
  PID:6976
- C:\Windows\System\DcTIKjX.exe
  C:\Windows\System\DcTIKjX.exe
  2⤵
  PID:7272
- C:\Windows\System\SkCdXDF.exe
  C:\Windows\System\SkCdXDF.exe
  2⤵
  PID:8020
- C:\Windows\System\HFhsZxJ.exe
  C:\Windows\System\HFhsZxJ.exe
  2⤵
  PID:7352
- C:\Windows\System\gWqfLoF.exe
  C:\Windows\System\gWqfLoF.exe
  2⤵
  PID:8196
- C:\Windows\System\JMAxeBj.exe
  C:\Windows\System\JMAxeBj.exe
  2⤵
  PID:8216
- C:\Windows\System\eIHGZmU.exe
  C:\Windows\System\eIHGZmU.exe
  2⤵
  PID:8056
- C:\Windows\System\qPJzTnv.exe
  C:\Windows\System\qPJzTnv.exe
  2⤵
  PID:8244
- C:\Windows\System\PFvKzTo.exe
  C:\Windows\System\PFvKzTo.exe
  2⤵
  PID:8308
- C:\Windows\System\IABjZWR.exe
  C:\Windows\System\IABjZWR.exe
  2⤵
  PID:8332
- C:\Windows\System\IVsHgSy.exe
  C:\Windows\System\IVsHgSy.exe
  2⤵
  PID:8424
- C:\Windows\System\ClKwPKc.exe
  C:\Windows\System\ClKwPKc.exe
  2⤵
  PID:8496
- C:\Windows\System\UMtvOOK.exe
  C:\Windows\System\UMtvOOK.exe
  2⤵
  PID:8232
- C:\Windows\System\NzRUiVD.exe
  C:\Windows\System\NzRUiVD.exe
  2⤵
  PID:8460
- C:\Windows\System\omXyayP.exe
  C:\Windows\System\omXyayP.exe
  2⤵
  PID:8500
- C:\Windows\System\ktcqvgy.exe
  C:\Windows\System\ktcqvgy.exe
  2⤵
  PID:8380
- C:\Windows\System\xWGpRou.exe
  C:\Windows\System\xWGpRou.exe
  2⤵
  PID:8444
- C:\Windows\System\MUdVFJY.exe
  C:\Windows\System\MUdVFJY.exe
  2⤵
  PID:8520
- C:\Windows\System\NmwRuTq.exe
  C:\Windows\System\NmwRuTq.exe
  2⤵
  PID:8560
- C:\Windows\System\grYWUXY.exe
  C:\Windows\System\grYWUXY.exe
  2⤵
  PID:8480
- C:\Windows\System\rNQFfRI.exe
  C:\Windows\System\rNQFfRI.exe
  2⤵
  PID:8592
- C:\Windows\System\IrFoWGr.exe
  C:\Windows\System\IrFoWGr.exe
  2⤵
  PID:8608
- C:\Windows\System\ICIPsBp.exe
  C:\Windows\System\ICIPsBp.exe
  2⤵
  PID:8620
- C:\Windows\System\FrHybHo.exe
  C:\Windows\System\FrHybHo.exe
  2⤵
  PID:8648
- C:\Windows\System\HEqDxHR.exe
  C:\Windows\System\HEqDxHR.exe
  2⤵
  PID:8668
- C:\Windows\System\mgUZjCF.exe
  C:\Windows\System\mgUZjCF.exe
  2⤵
  PID:8708
- C:\Windows\System\StNkXcb.exe
  C:\Windows\System\StNkXcb.exe
  2⤵
  PID:8740
- C:\Windows\System\aqYFcoj.exe
  C:\Windows\System\aqYFcoj.exe
  2⤵
  PID:8900
- C:\Windows\System\EZwuGqK.exe
  C:\Windows\System\EZwuGqK.exe
  2⤵
  PID:8884
- C:\Windows\System\RBsdPVt.exe
  C:\Windows\System\RBsdPVt.exe
  2⤵
  PID:8912
- C:\Windows\System\pJSzxNn.exe
  C:\Windows\System\pJSzxNn.exe
  2⤵
  PID:8976
- C:\Windows\System\okPPQaS.exe
  C:\Windows\System\okPPQaS.exe
  2⤵
  PID:8964
- C:\Windows\System\iBnHnKp.exe
  C:\Windows\System\iBnHnKp.exe
  2⤵
  PID:9056
- C:\Windows\System\JWTPoba.exe
  C:\Windows\System\JWTPoba.exe
  2⤵
  PID:9092
- C:\Windows\System\zYfZJIF.exe
  C:\Windows\System\zYfZJIF.exe
  2⤵
  PID:9152
- C:\Windows\System\oSbBbPh.exe
  C:\Windows\System\oSbBbPh.exe
  2⤵
  PID:9192
- C:\Windows\System\bOWVvIk.exe
  C:\Windows\System\bOWVvIk.exe
  2⤵
  PID:8124
- C:\Windows\System\zaOfQuE.exe
  C:\Windows\System\zaOfQuE.exe
  2⤵
  PID:7436
- C:\Windows\System\cYsoVQO.exe
  C:\Windows\System\cYsoVQO.exe
  2⤵
  PID:8208
- C:\Windows\System\vcRWNmi.exe
  C:\Windows\System\vcRWNmi.exe
  2⤵
  PID:7180
- C:\Windows\System\LmapEbe.exe
  C:\Windows\System\LmapEbe.exe
  2⤵
  PID:9136
- C:\Windows\System\iyAraHt.exe
  C:\Windows\System\iyAraHt.exe
  2⤵
  PID:9208
- C:\Windows\System\gOmlMIj.exe
  C:\Windows\System\gOmlMIj.exe
  2⤵
  PID:8212
- C:\Windows\System\ZIWuexD.exe
  C:\Windows\System\ZIWuexD.exe
  2⤵
  PID:8276
- C:\Windows\System\UllpVnw.exe
  C:\Windows\System\UllpVnw.exe
  2⤵
  PID:8228
- C:\Windows\System\hcoUJPG.exe
  C:\Windows\System\hcoUJPG.exe
  2⤵
  PID:8392
- C:\Windows\System\ECVLxBs.exe
  C:\Windows\System\ECVLxBs.exe
  2⤵
  PID:8292
- C:\Windows\System\mvyZgYx.exe
  C:\Windows\System\mvyZgYx.exe
  2⤵
  PID:8516
- C:\Windows\System\gOExjGq.exe
  C:\Windows\System\gOExjGq.exe
  2⤵
  PID:8600
- C:\Windows\System\gFMevWi.exe
  C:\Windows\System\gFMevWi.exe
  2⤵
  PID:8412
- C:\Windows\System\irvuizU.exe
  C:\Windows\System\irvuizU.exe
  2⤵
  PID:8656
- C:\Windows\System\WphQlMf.exe
  C:\Windows\System\WphQlMf.exe
  2⤵
  PID:8584
- C:\Windows\System\VJDGpzG.exe
  C:\Windows\System\VJDGpzG.exe
  2⤵
  PID:8624
- C:\Windows\System\wGfOBFM.exe
  C:\Windows\System\wGfOBFM.exe
  2⤵
  PID:8772
- C:\Windows\System\zFkGXUO.exe
  C:\Windows\System\zFkGXUO.exe
  2⤵
  PID:8788
- C:\Windows\System\mkwGPWk.exe
  C:\Windows\System\mkwGPWk.exe
  2⤵
  PID:9028
- C:\Windows\System\byvvnZd.exe
  C:\Windows\System\byvvnZd.exe
  2⤵
  PID:7684
- C:\Windows\System\TwygXDg.exe
  C:\Windows\System\TwygXDg.exe
  2⤵
  PID:9176
- C:\Windows\System\extyJGn.exe
  C:\Windows\System\extyJGn.exe
  2⤵
  PID:8944
- C:\Windows\System\FLHWaPl.exe
  C:\Windows\System\FLHWaPl.exe
  2⤵
  PID:8068
- C:\Windows\System\mfvQtqG.exe
  C:\Windows\System\mfvQtqG.exe
  2⤵
  PID:8992
- C:\Windows\System\wWJSoSi.exe
  C:\Windows\System\wWJSoSi.exe
  2⤵
  PID:6992
- C:\Windows\System\VoUOKBl.exe
  C:\Windows\System\VoUOKBl.exe
  2⤵
  PID:9108
- C:\Windows\System\LNUnAyI.exe
  C:\Windows\System\LNUnAyI.exe
  2⤵
  PID:8312
- C:\Windows\System\auFglhe.exe
  C:\Windows\System\auFglhe.exe
  2⤵
  PID:8376
- C:\Windows\System\DLVSauj.exe
  C:\Windows\System\DLVSauj.exe
  2⤵
  PID:8556
- C:\Windows\System\VeRUsbr.exe
  C:\Windows\System\VeRUsbr.exe
  2⤵
  PID:8456
- C:\Windows\System\KADkmKs.exe
  C:\Windows\System\KADkmKs.exe
  2⤵
  PID:8672
- C:\Windows\System\fJkMRqt.exe
  C:\Windows\System\fJkMRqt.exe
  2⤵
  PID:8832
- C:\Windows\System\iKQrMLb.exe
  C:\Windows\System\iKQrMLb.exe
  2⤵
  PID:8756
- C:\Windows\System\prPscEK.exe
  C:\Windows\System\prPscEK.exe
  2⤵
  PID:8868
- C:\Windows\System\DnaTyqq.exe
  C:\Windows\System\DnaTyqq.exe
  2⤵
  PID:8932
- C:\Windows\System\mwFoTWM.exe
  C:\Windows\System\mwFoTWM.exe
  2⤵
  PID:8820
- C:\Windows\System\uZJXHkQ.exe
  C:\Windows\System\uZJXHkQ.exe
  2⤵
  PID:9072
- C:\Windows\System\BvKjZHS.exe
  C:\Windows\System\BvKjZHS.exe
  2⤵
  PID:7712
- C:\Windows\System\EDfuhnf.exe
  C:\Windows\System\EDfuhnf.exe
  2⤵
  PID:8628
- C:\Windows\System\UUCGbCq.exe
  C:\Windows\System\UUCGbCq.exe
  2⤵
  PID:9236
- C:\Windows\System\oPMyBOu.exe
  C:\Windows\System\oPMyBOu.exe
  2⤵
  PID:9256
- C:\Windows\System\VyVRNXL.exe
  C:\Windows\System\VyVRNXL.exe
  2⤵
  PID:9272
- C:\Windows\System\biMCmgl.exe
  C:\Windows\System\biMCmgl.exe
  2⤵
  PID:9288
- C:\Windows\System\dxBZINL.exe
  C:\Windows\System\dxBZINL.exe
  2⤵
  PID:9304
- C:\Windows\System\VIWUbIb.exe
  C:\Windows\System\VIWUbIb.exe
  2⤵
  PID:9320
- C:\Windows\System\mvuLBNf.exe
  C:\Windows\System\mvuLBNf.exe
  2⤵
  PID:9340
- C:\Windows\System\vDmPdYE.exe
  C:\Windows\System\vDmPdYE.exe
  2⤵
  PID:9356
- C:\Windows\System\GemdJMx.exe
  C:\Windows\System\GemdJMx.exe
  2⤵
  PID:9372
- C:\Windows\System\VnvJVNJ.exe
  C:\Windows\System\VnvJVNJ.exe
  2⤵
  PID:9388
- C:\Windows\System\ABvOFnm.exe
  C:\Windows\System\ABvOFnm.exe
  2⤵
  PID:9404
- C:\Windows\System\ktTTNxL.exe
  C:\Windows\System\ktTTNxL.exe
  2⤵
  PID:9420
- C:\Windows\System\ruDpHMw.exe
  C:\Windows\System\ruDpHMw.exe
  2⤵
  PID:9440
- C:\Windows\System\LysfApj.exe
  C:\Windows\System\LysfApj.exe
  2⤵
  PID:9456
- C:\Windows\System\FzmRjLI.exe
  C:\Windows\System\FzmRjLI.exe
  2⤵
  PID:9476
- C:\Windows\System\DQNbWcC.exe
  C:\Windows\System\DQNbWcC.exe
  2⤵
  PID:9492
- C:\Windows\System\CmNrRGp.exe
  C:\Windows\System\CmNrRGp.exe
  2⤵
  PID:9508
- C:\Windows\System\yQGLYYX.exe
  C:\Windows\System\yQGLYYX.exe
  2⤵
  PID:9524
- C:\Windows\System\kmLwrib.exe
  C:\Windows\System\kmLwrib.exe
  2⤵
  PID:9540
- C:\Windows\System\HWGHFhg.exe
  C:\Windows\System\HWGHFhg.exe
  2⤵
  PID:9556
- C:\Windows\System\TPUOMAs.exe
  C:\Windows\System\TPUOMAs.exe
  2⤵
  PID:9576
- C:\Windows\System\dYUkRvO.exe
  C:\Windows\System\dYUkRvO.exe
  2⤵
  PID:9592
- C:\Windows\System\DnFUUVr.exe
  C:\Windows\System\DnFUUVr.exe
  2⤵
  PID:9608
- C:\Windows\System\tdQqSud.exe
  C:\Windows\System\tdQqSud.exe
  2⤵
  PID:9628
- C:\Windows\System\rvrySWg.exe
  C:\Windows\System\rvrySWg.exe
  2⤵
  PID:9652
- C:\Windows\System\zaMpLcO.exe
  C:\Windows\System\zaMpLcO.exe
  2⤵
  PID:9668
- C:\Windows\System\fKjVNuc.exe
  C:\Windows\System\fKjVNuc.exe
  2⤵
  PID:9688
- C:\Windows\System\euqjvDe.exe
  C:\Windows\System\euqjvDe.exe
  2⤵
  PID:9704
- C:\Windows\System\nNYLOIW.exe
  C:\Windows\System\nNYLOIW.exe
  2⤵
  PID:9724
- C:\Windows\System\nMFAbMt.exe
  C:\Windows\System\nMFAbMt.exe
  2⤵
  PID:9740
- C:\Windows\System\AGQgZzm.exe
  C:\Windows\System\AGQgZzm.exe
  2⤵
  PID:9756
- C:\Windows\System\vwduxZs.exe
  C:\Windows\System\vwduxZs.exe
  2⤵
  PID:9776
- C:\Windows\System\GGsaNup.exe
  C:\Windows\System\GGsaNup.exe
  2⤵
  PID:9792
- C:\Windows\System\hkLzGmJ.exe
  C:\Windows\System\hkLzGmJ.exe
  2⤵
  PID:9808
- C:\Windows\System\vTDUfAd.exe
  C:\Windows\System\vTDUfAd.exe
  2⤵
  PID:9824
- C:\Windows\System\lmpxMQU.exe
  C:\Windows\System\lmpxMQU.exe
  2⤵
  PID:9840
- C:\Windows\System\jPdhXqW.exe
  C:\Windows\System\jPdhXqW.exe
  2⤵
  PID:9908
- C:\Windows\System\AwnUahh.exe
  C:\Windows\System\AwnUahh.exe
  2⤵
  PID:9924
- C:\Windows\System\IctkIFq.exe
  C:\Windows\System\IctkIFq.exe
  2⤵
  PID:9940
- C:\Windows\System\qdrHUes.exe
  C:\Windows\System\qdrHUes.exe
  2⤵
  PID:9964
- C:\Windows\System\YRoSbeD.exe
  C:\Windows\System\YRoSbeD.exe
  2⤵
  PID:9980
- C:\Windows\System\VQDKkbd.exe
  C:\Windows\System\VQDKkbd.exe
  2⤵
  PID:9996
- C:\Windows\System\nfxodSb.exe
  C:\Windows\System\nfxodSb.exe
  2⤵
  PID:10012
- C:\Windows\System\kvkpkbs.exe
  C:\Windows\System\kvkpkbs.exe
  2⤵
  PID:10032
- C:\Windows\System\xzgxcDV.exe
  C:\Windows\System\xzgxcDV.exe
  2⤵
  PID:10048
- C:\Windows\System\iraULko.exe
  C:\Windows\System\iraULko.exe
  2⤵
  PID:10064
- C:\Windows\System\whAFeUK.exe
  C:\Windows\System\whAFeUK.exe
  2⤵
  PID:10084
- C:\Windows\System\mTaTcCv.exe
  C:\Windows\System\mTaTcCv.exe
  2⤵
  PID:10100
- C:\Windows\System\LONyEZE.exe
  C:\Windows\System\LONyEZE.exe
  2⤵
  PID:10116
- C:\Windows\System\GNLNjVh.exe
  C:\Windows\System\GNLNjVh.exe
  2⤵
  PID:10136
- C:\Windows\System\aTaNnMS.exe
  C:\Windows\System\aTaNnMS.exe
  2⤵
  PID:10152
- C:\Windows\System\kqSTGVd.exe
  C:\Windows\System\kqSTGVd.exe
  2⤵
  PID:10168
- C:\Windows\System\WRsCaCU.exe
  C:\Windows\System\WRsCaCU.exe
  2⤵
  PID:10184
- C:\Windows\System\bohjxWD.exe
  C:\Windows\System\bohjxWD.exe
  2⤵
  PID:10200
- C:\Windows\System\rBYvSVO.exe
  C:\Windows\System\rBYvSVO.exe
  2⤵
  PID:10216
- C:\Windows\System\MDYaUKM.exe
  C:\Windows\System\MDYaUKM.exe
  2⤵
  PID:10232
- C:\Windows\System\TlsUNgp.exe
  C:\Windows\System\TlsUNgp.exe
  2⤵
  PID:8552
- C:\Windows\System\JwxXmsQ.exe
  C:\Windows\System\JwxXmsQ.exe
  2⤵
  PID:8960
- C:\Windows\System\YMhWmfw.exe
  C:\Windows\System\YMhWmfw.exe
  2⤵
  PID:8464
- C:\Windows\System\dijSYBg.exe
  C:\Windows\System\dijSYBg.exe
  2⤵
  PID:9280
- C:\Windows\System\rSnDkIw.exe
  C:\Windows\System\rSnDkIw.exe
  2⤵
  PID:9316
- C:\Windows\System\RcXSYTe.exe
  C:\Windows\System\RcXSYTe.exe
  2⤵
  PID:8784
- C:\Windows\System\MAGkzZM.exe
  C:\Windows\System\MAGkzZM.exe
  2⤵
  PID:9380
- C:\Windows\System\JxzYgfj.exe
  C:\Windows\System\JxzYgfj.exe
  2⤵
  PID:8688
- C:\Windows\System\MqdUfPG.exe
  C:\Windows\System\MqdUfPG.exe
  2⤵
  PID:8616
- C:\Windows\System\CTjusmW.exe
  C:\Windows\System\CTjusmW.exe
  2⤵
  PID:8816
- C:\Windows\System\rUEADMG.exe
  C:\Windows\System\rUEADMG.exe
  2⤵
  PID:9224
- C:\Windows\System\yVOpEAf.exe
  C:\Windows\System\yVOpEAf.exe
  2⤵
  PID:9268
- C:\Windows\System\DNsrAxN.exe
  C:\Windows\System\DNsrAxN.exe
  2⤵
  PID:9332
- C:\Windows\System\axUGwqy.exe
  C:\Windows\System\axUGwqy.exe
  2⤵
  PID:9396
- C:\Windows\System\RtAmpcC.exe
  C:\Windows\System\RtAmpcC.exe
  2⤵
  PID:9464
- C:\Windows\System\srYSvzB.exe
  C:\Windows\System\srYSvzB.exe
  2⤵
  PID:9516
- C:\Windows\System\wZmgxLe.exe
  C:\Windows\System\wZmgxLe.exe
  2⤵
  PID:9564
- C:\Windows\System\ZUtXJms.exe
  C:\Windows\System\ZUtXJms.exe
  2⤵
  PID:9588
- C:\Windows\System\UPfAUAX.exe
  C:\Windows\System\UPfAUAX.exe
  2⤵
  PID:9660
- C:\Windows\System\gNkISQF.exe
  C:\Windows\System\gNkISQF.exe
  2⤵
  PID:9600
- C:\Windows\System\zHbzezc.exe
  C:\Windows\System\zHbzezc.exe
  2⤵
  PID:9696
- C:\Windows\System\MfNADkh.exe
  C:\Windows\System\MfNADkh.exe
  2⤵
  PID:9732
- C:\Windows\System\HoXWMIC.exe
  C:\Windows\System\HoXWMIC.exe
  2⤵
  PID:9712
- C:\Windows\System\umiiIij.exe
  C:\Windows\System\umiiIij.exe
  2⤵
  PID:9768
- C:\Windows\System\IOHagvF.exe
  C:\Windows\System\IOHagvF.exe
  2⤵
  PID:9748
- C:\Windows\System\hrEyRxf.exe
  C:\Windows\System\hrEyRxf.exe
  2⤵
  PID:9788
- C:\Windows\System\ICdsUXy.exe
  C:\Windows\System\ICdsUXy.exe
  2⤵
  PID:9832
- C:\Windows\System\EVaPsMl.exe
  C:\Windows\System\EVaPsMl.exe
  2⤵
  PID:9860
- C:\Windows\System\GwlDBcZ.exe
  C:\Windows\System\GwlDBcZ.exe
  2⤵
  PID:9876
- C:\Windows\System\lAHBGjF.exe
  C:\Windows\System\lAHBGjF.exe
  2⤵
  PID:9892
- C:\Windows\System\WREFltn.exe
  C:\Windows\System\WREFltn.exe
  2⤵
  PID:9948
- C:\Windows\System\AohYuia.exe
  C:\Windows\System\AohYuia.exe
  2⤵
  PID:9988
- C:\Windows\System\vfaWIMD.exe
  C:\Windows\System\vfaWIMD.exe
  2⤵
  PID:10060
- C:\Windows\System\CmKXCLm.exe
  C:\Windows\System\CmKXCLm.exe
  2⤵
  PID:10092
- C:\Windows\System\KmcOABq.exe
  C:\Windows\System\KmcOABq.exe
  2⤵
  PID:10096
- C:\Windows\System\emJYoPG.exe
  C:\Windows\System\emJYoPG.exe
  2⤵
  PID:10164
- C:\Windows\System\eohHlDv.exe
  C:\Windows\System\eohHlDv.exe
  2⤵
  PID:10228
- C:\Windows\System\dITpLNh.exe
  C:\Windows\System\dITpLNh.exe
  2⤵
  PID:10008
- C:\Windows\System\jCrQrpi.exe
  C:\Windows\System\jCrQrpi.exe
  2⤵
  PID:9252
- C:\Windows\System\DcrjQsH.exe
  C:\Windows\System\DcrjQsH.exe
  2⤵
  PID:10028
- C:\Windows\System\JpUNcdb.exe
  C:\Windows\System\JpUNcdb.exe
  2⤵
  PID:10144
- C:\Windows\System\MQRDHWi.exe
  C:\Windows\System\MQRDHWi.exe
  2⤵
  PID:8572
- C:\Windows\System\jiLkxLW.exe
  C:\Windows\System\jiLkxLW.exe
  2⤵
  PID:8848
- C:\Windows\System\hkuDjUK.exe
  C:\Windows\System\hkuDjUK.exe
  2⤵
  PID:9352
- C:\Windows\System\hhKBnRA.exe
  C:\Windows\System\hhKBnRA.exe
  2⤵
  PID:9484
- C:\Windows\System\yQkeQoT.exe
  C:\Windows\System\yQkeQoT.exe
  2⤵
  PID:9264
- C:\Windows\System\JOCsiCe.exe
  C:\Windows\System\JOCsiCe.exe
  2⤵
  PID:9488
- C:\Windows\System\lphmMiP.exe
  C:\Windows\System\lphmMiP.exe
  2⤵
  PID:9648
- C:\Windows\System\vnTxdVw.exe
  C:\Windows\System\vnTxdVw.exe
  2⤵
  PID:9676
- C:\Windows\System\AKnrEvf.exe
  C:\Windows\System\AKnrEvf.exe
  2⤵
  PID:9784
- C:\Windows\System\QkhSiHc.exe
  C:\Windows\System\QkhSiHc.exe
  2⤵
  PID:9888
- C:\Windows\System\CsSXwcc.exe
  C:\Windows\System\CsSXwcc.exe
  2⤵
  PID:8864
- C:\Windows\System\FRUTdku.exe
  C:\Windows\System\FRUTdku.exe
  2⤵
  PID:9772
- C:\Windows\System\KNcjGpn.exe
  C:\Windows\System\KNcjGpn.exe
  2⤵
  PID:9432
- C:\Windows\System\yBGtXkr.exe
  C:\Windows\System\yBGtXkr.exe
  2⤵
  PID:9620
- C:\Windows\System\EfVQCLa.exe
  C:\Windows\System\EfVQCLa.exe
  2⤵
  PID:9684
- C:\Windows\System\IDUQhYt.exe
  C:\Windows\System\IDUQhYt.exe
  2⤵
  PID:9872
- C:\Windows\System\KAQUWkx.exe
  C:\Windows\System\KAQUWkx.exe
  2⤵
  PID:9936
- C:\Windows\System\BnJXMvT.exe
  C:\Windows\System\BnJXMvT.exe
  2⤵
  PID:9904
- C:\Windows\System\kAFDrMy.exe
  C:\Windows\System\kAFDrMy.exe
  2⤵
  PID:10180
- C:\Windows\System\NwLdzFo.exe
  C:\Windows\System\NwLdzFo.exe
  2⤵
  PID:9008
- C:\Windows\System\DzCvLxu.exe
  C:\Windows\System\DzCvLxu.exe
  2⤵
  PID:10112
- C:\Windows\System\jLugAZz.exe
  C:\Windows\System\jLugAZz.exe
  2⤵
  PID:10212
- C:\Windows\System\grAcyvW.exe
  C:\Windows\System\grAcyvW.exe
  2⤵
  PID:9232
- C:\Windows\System\TwlEYqg.exe
  C:\Windows\System\TwlEYqg.exe
  2⤵
  PID:9804
- C:\Windows\System\XGcIiij.exe
  C:\Windows\System\XGcIiij.exe
  2⤵
  PID:9368
- C:\Windows\System\pINWSZZ.exe
  C:\Windows\System\pINWSZZ.exe
  2⤵
  PID:9472
- C:\Windows\System\HXrIxLS.exe
  C:\Windows\System\HXrIxLS.exe
  2⤵
  PID:9884
- C:\Windows\System\ANQbVEH.exe
  C:\Windows\System\ANQbVEH.exe
  2⤵
  PID:9328
- C:\Windows\System\ltyFTWX.exe
  C:\Windows\System\ltyFTWX.exe
  2⤵
  PID:9664
- C:\Windows\System\aarWdmY.exe
  C:\Windows\System\aarWdmY.exe
  2⤵
  PID:9992
- C:\Windows\System\oDoUQUt.exe
  C:\Windows\System\oDoUQUt.exe
  2⤵
  PID:10072
- C:\Windows\System\JiqBdst.exe
  C:\Windows\System\JiqBdst.exe
  2⤵
  PID:9312
- C:\Windows\System\GXyPzro.exe
  C:\Windows\System\GXyPzro.exe
  2⤵
  PID:9548
- C:\Windows\System\RgcJkpl.exe
  C:\Windows\System\RgcJkpl.exe
  2⤵
  PID:10108
- C:\Windows\System\WGFHsBx.exe
  C:\Windows\System\WGFHsBx.exe
  2⤵
  PID:10252
- C:\Windows\System\NQvCxPG.exe
  C:\Windows\System\NQvCxPG.exe
  2⤵
  PID:10268
- C:\Windows\System\chwzTpw.exe
  C:\Windows\System\chwzTpw.exe
  2⤵
  PID:10284
- C:\Windows\System\Pqliymm.exe
  C:\Windows\System\Pqliymm.exe
  2⤵
  PID:10300
- C:\Windows\System\EodmVYk.exe
  C:\Windows\System\EodmVYk.exe
  2⤵
  PID:10316
- C:\Windows\System\oGYHMeO.exe
  C:\Windows\System\oGYHMeO.exe
  2⤵
  PID:10332
- C:\Windows\System\oojiCld.exe
  C:\Windows\System\oojiCld.exe
  2⤵
  PID:10348
- C:\Windows\System\FzRxmqE.exe
  C:\Windows\System\FzRxmqE.exe
  2⤵
  PID:10364
- C:\Windows\System\ZYrAlvO.exe
  C:\Windows\System\ZYrAlvO.exe
  2⤵
  PID:10380
- C:\Windows\System\tVvKtly.exe
  C:\Windows\System\tVvKtly.exe
  2⤵
  PID:10396
- C:\Windows\System\GVYAxDb.exe
  C:\Windows\System\GVYAxDb.exe
  2⤵
  PID:10412
- C:\Windows\System\gSjRBTC.exe
  C:\Windows\System\gSjRBTC.exe
  2⤵
  PID:10428
- C:\Windows\System\YcKmjqh.exe
  C:\Windows\System\YcKmjqh.exe
  2⤵
  PID:10444
- C:\Windows\System\gsTlxYE.exe
  C:\Windows\System\gsTlxYE.exe
  2⤵
  PID:10460
- C:\Windows\System\TStCDAo.exe
  C:\Windows\System\TStCDAo.exe
  2⤵
  PID:10476
- C:\Windows\System\wspgrop.exe
  C:\Windows\System\wspgrop.exe
  2⤵
  PID:10492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ATneJJh.exe

Filesize
2.3MB

MD5
7bf1e5f9dff5b8a18d14df9adc300012

SHA1
4b12f71b9ae73639c0ff609b701c7c813cfe8ee8

SHA256
58828e5c1d1996b0842e5595c5f6b8d64c0dbe372bca7cff557875cd2de8f739

SHA512
19ba39a6bdec3bd70c93dc425df582666e074194313d11963ef6b80a9ce3b71d4900dfaa1fb8acc7fc9f654949b740a42cb8f35686fb9cf1499abf6750de3de0

Download Submit
C:\Windows\system\EsQEkcW.exe

Filesize
2.3MB

MD5
613ca9f82daeca35c906fb02f3be1391

SHA1
609973db6ce0c72f26e876cb339da0b804ce9eb7

SHA256
ae7f331c79ac68dc4f6d4b707cb3f7ae40e104062883adc1530e985b0ab686a7

SHA512
b9974316412a08f927780019329cbb1f3d5d0b590ddd40ba070213b6e3dbc1018ff5c9c9e1ee5d252feb375db76a7733d0c27de82691a740b673a1d664a4afe8

Download Submit
C:\Windows\system\GJGRCBQ.exe

Filesize
2.3MB

MD5
ae37df6a53c9542a137d39def3dcd7c1

SHA1
b8be49a12b52a3ab34266c2fef6c405f31a8f576

SHA256
aa04765408c37928ae258b1c10e2540642f9cefb232625845f0c8f62a7e75f78

SHA512
39a02af6f26446eeb0ab6240bda8b9ca133a1387b22f12c9b53011aa6564e36645489ba76e85a15b0a4925a5441079aa3827bbfeba2d1446572c4785be189e59

Download Submit
C:\Windows\system\JsLEdHM.exe

Filesize
8B

MD5
2adac273ce248e8d242a4b12f749bb46

SHA1
300bd2c60c669d978305195f11eaf26c73d9e457

SHA256
5a695799bf8f73300a4f9c4a59fd25b209a2457abf1051a262d540e520557456

SHA512
011941b215532355e8e4d21af78180da68d2fe04927118ebe818ec14ec4bfb6a7a2d9aaa01fdfd0cd2c6dc84968b5f642ccf10cc92c29aa0e1d06bcf6f120232

Download Submit
C:\Windows\system\KintsAR.exe

Filesize
2.3MB

MD5
91c5ee2bc0b792cc45349ed0f6a6e8ea

SHA1
803514d026d4b8598ac11f566c495b6610f8f0cc

SHA256
ca2e6b3abd1049c0c5b58391779f2431bd1a3aa8963f22759a7753b576b4d801

SHA512
b523b53b75964acbf53aa3eaff14dd62a5c6d1b44c874f2e90ac7349a376d621d0ec1058ad1e6f32208c7128b1eb8cbf919a0df0b810dcaf7036514bebf53017

Download Submit
C:\Windows\system\LgXhFwM.exe

Filesize
2.3MB

MD5
d1fe21d3957d12c279c1ae64f7ef6218

SHA1
b46c38380b6fb5334f239a35381e35203adcb1d3

SHA256
daa8d123614cc8449c663391d077a4b43810574858321479cb47b33fa2907384

SHA512
62466df28d7162566410a35ff36a92f75eee4523fff447e81011bb29d26db2db48a5dc01b902f6137cb2e3ce0e3ef18aa52591c5c58abdce7f04a9213a12305c

Download Submit
C:\Windows\system\Npgjqrh.exe

Filesize
2.3MB

MD5
9168ded42f988e7432d4c906c5e303d2

SHA1
6ccc0df8695160441dc92c16a03e9f6eba302221

SHA256
c9fb366ab2c77502c2fa127e2e035ae3a3ac87a2f66da35c5fc56da5e2c93132

SHA512
0b07592a79718ab3bf7aee0a40f5deb15b60641beda3d86da8e6cbc00dece5a778c2444ac68eadb428a4906d007ee458c3f05148343637952ac39d144b4fb894

Download Submit
C:\Windows\system\SJtnkYq.exe

Filesize
2.3MB

MD5
8c175458d99da52415881e289a5c628a

SHA1
d9c63e4add4259be5018d78a95e58db3126cf72e

SHA256
8016c538cbd07943f7c02af90fd038879a7bc57a79e81d1bbde7f7ec50fd99dd

SHA512
286df66f36301216b759631565189e9c24f560e3a81d4f326aedb996038a85baafafe758efbcce44f5e4b10ed39d822d80e68742c5d012de07e674307192d121

Download Submit
C:\Windows\system\WgFimPa.exe

Filesize
2.3MB

MD5
0146c1cc9d811eaa650e73e0247e70c5

SHA1
8081f1e85b43b126831e98fd39fdd7a290cea8b0

SHA256
1baa0213371b7c4c9555b878699c765bcb08c84aedc67d58fe6234ee85448607

SHA512
d9465dfcaa9a5fcd993300fba1ceed023e9cb2a68db99ac6f83c24bae45c9ac1b38a75130894577ab5b475c9fc330e7de754801033ec8a0bfd2af106508716df

Download Submit
C:\Windows\system\ZlyiMyN.exe

Filesize
2.3MB

MD5
fdd9f457a0d982ae9db75d64e23b3525

SHA1
744e9159831babb3d1ff365c16036290405d05be

SHA256
d62a501519db8ace3f6eb8c5c6f2bc6d9cf91e0c99e747ceccd880f81e332af9

SHA512
40351919c6d9b80f3cf844b2f1e072437c6b1618d14df8afb443688f55ef1e867e6951fccb61e37f00fd606705eb7b63d6ba74b62902e1460beef468508563df

Download Submit
C:\Windows\system\bUhgzPU.exe

Filesize
2.3MB

MD5
45079b2323dc8b27a794b0265bea2c96

SHA1
12677c2a46a0b166e93699e976d5729170432ee7

SHA256
6fdad6ef8b9a6ef65e8f613151b47b2640539106f7e23576cfcf9dde2f540ceb

SHA512
b86572510620e53eec726c0fa50c70e54c58f19fdaaa05e484a98cedb09093f7fe1eca0c38f7cd8d0c817ec4d3ffe39ee27b0e5b19068fe485c1169fb33393e4

Download Submit
C:\Windows\system\cOFRMeV.exe

Filesize
2.3MB

MD5
ffc106955a3ac5ce77d98df03beece83

SHA1
d359389e72b9de6d3f683365b07cbdbad91f7a62

SHA256
9923e43c72b9543b95072dae16da573909f9a956cf74e5e6b8d5966667052486

SHA512
f077a70baeed2d7d42124cdf89184845ba84d3abfb7cada37cc997e80e90700c146ef59c6ba9a1a8156a748c041242297c5ff097e9e60fa07050fecf7f77410d

Download Submit
C:\Windows\system\cVdEaOx.exe

Filesize
2.3MB

MD5
15c83c98e348b0cc1c1882dea9e551f7

SHA1
84cea4ec3187af34492dff736489e09dcfbabf32

SHA256
8ffe20964bc17a6f077183fb1b5ada9ad962516290e7534cecb396ba544ba49b

SHA512
aa89b7e8204d155174201afceac999ddded17bce04084eabe19bd1a1b318f600a0930c707eb76e513c0f9db3f3f3fa0cc8a750785e37e4cb5af718c31d813167

Download Submit
C:\Windows\system\cpqbsHq.exe

Filesize
2.3MB

MD5
c84c58e0a5c2528e3dc6f16d89c4ae62

SHA1
ed2715e05329a7631b8685b52c6814ebeb03fad9

SHA256
979550039f40084fa8a492b0d725a14b4380fda4479316942e1b92ba4392a31c

SHA512
607ad2513a064ace69124516cb1cb303ab3fb29d2740ad1d1889099b51632a17b43a996d971261f33e669d5bd0f22ea2da8e4d2f5630e70bda8af56d3a30ff03

Download Submit
C:\Windows\system\euoepbB.exe

Filesize
2.3MB

MD5
e7012bbb4ec5c15333349545dfaada8d

SHA1
1126d4c97f5eb6ca52c3d156d301180a9e76812c

SHA256
f303c8454fd8d1a0535388124b6f7a81d90ae83a2f80afd82ec3697d900fa4ad

SHA512
f19b968b7ac4eedc7a5dbeaf4a4172e94a7803d7e34f83da664492617552cacca8b0097677ff6c8bd046396fe464c8c0613c9ab4bbac6571213d64f8ac5275f4

Download Submit
C:\Windows\system\iUagiuD.exe

Filesize
2.3MB

MD5
4832283556b6b5982c7081d43ab4265a

SHA1
9165b9c85293509aa0b8d22790f4596609aaf983

SHA256
77c383c45e69b151fccb60ad954e39e871ad3d7bda9baa70a474f31050b44b27

SHA512
634720f69021502f8606f41b590ceee358395f17ce3f360d7428eeb1b33d5a0b7fcc6e255dccbc01ce1cc05ca4c921ffb05ebb00254a45e7becee855a40a7f8d

Download Submit
C:\Windows\system\kUemUEy.exe

Filesize
2.3MB

MD5
f8b564945dd7add14f36741ed26d9d5c

SHA1
ed005d5e51210ec8ad8ba7b896a09973537ce2b7

SHA256
b2a99f9b3587d5d228c984cf9007bfebf6ec40c20152e7aab6d41ef60140156f

SHA512
ea958e3f69f95136487de60fd92595a5111cf960ed5769640c388afcd5cc714ba6b6a3868adbfa0d8c42f925e142d4fa26f65369e55bea45307c737c718cba20

Download Submit
C:\Windows\system\lFGAQhr.exe

Filesize
2.3MB

MD5
48137480a313e66e6085263d5dac2db4

SHA1
0b3f065a3fbf5cf31e14cb99158093937e6bc8d7

SHA256
3afbe890e19d5958086e438b54eec9d442902093665796019d3ed7de0976d586

SHA512
1b2f1442e7db9120a8faff32150af1e8ca4a97d42b5caa81529fa0a26ca93867721dd09d8f7d8308ee4426c9533b664f2e0369043039bb82ca501dedd5ce6f51

Download Submit
C:\Windows\system\oSlcdSm.exe

Filesize
2.3MB

MD5
f3a99521b3f66f23009d64a13147e5fb

SHA1
8765478ee5ea154c80b79f0799e0b952e08245d5

SHA256
8d063fad57e604785c384f0ffe7a7d6f9bcbbad88c8e2601c785941318ba750c

SHA512
8cba55f9a572134bf76e59e6649cde70e73ed32a45432bcf7e871412cd09823ccd02302669c9dbd8c533d460fe941472a1a0513097735e7748cd5f7955ef1688

Download Submit
C:\Windows\system\oqZJvfe.exe

Filesize
2.3MB

MD5
3006bec8f6c2e91bd3b9499b10207592

SHA1
d940bef5c9db1fcf607a5174984396fb89be21e3

SHA256
4e939e3aa43310ee63a48832998f63803a8380347a707a95d0f2dbb390b91a55

SHA512
877bf7834a0b90d28c684c6d44dd36864cb4fc105246abd51057cb01a88bc348bc6310c37b075efb8f486d32be899a90df16f340dcc22e5f46c0be27ae68284e

Download Submit
C:\Windows\system\pSTdSgm.exe

Filesize
2.3MB

MD5
e68ff6d18dd99ce6093e00309df34eb0

SHA1
0695a22a287eefe4a7cc67cb854dcd4a9306c404

SHA256
0d0fb1cd9d885888774cf6c418c16145410392db3d69579d86aa210c7de9818c

SHA512
28277b378bdd97f4eaa5e6c9d96717acf5e7f9e0a4a5b42d0c576fc92f1dd4b65fe14b31e76959a40d98de2c39210285ff53f2573ed9c71eca951ff2684e8fc3

Download Submit
C:\Windows\system\qhQKlDz.exe

Filesize
2.3MB

MD5
1383fe19dd8726913783eb09239380a7

SHA1
b7b237f340461cf10265c7a2749dd6ea91d14b66

SHA256
c9b65419f9c6b32f187d1f3032dd6819c5986b1389d43dc5316786f10a91d21f

SHA512
8b304d888a38999f7bd40f933fcdb26252474f62620d9c020d2d95902e5565d5793372f5aac7f90b937b774e90ee91fd8af4fcd6ae84a56000eb2b9f18cc932a

Download Submit
C:\Windows\system\sdfdIdN.exe

Filesize
2.3MB

MD5
a2ecbc0f10a9018d83c614d561426e6d

SHA1
a92492049abfea948cbb0e97d769ce45ba90084e

SHA256
d79140d45aebcd43ee61da2345f69056562cdd3088a0bf24bbb00c5ddd04ccad

SHA512
c37ccfe4d9b1ca014422b90fc52efc33e1225841e1f759506e7e9b3570169b88c451f72dddad097fced76abb9d8cd29ab407fe988e7d8132e78451b67e8ca866

Download Submit
\Windows\system\AwxImwC.exe

Filesize
2.3MB

MD5
75f846307fb312a627357c00222c607e

SHA1
43e0001f00368b0c8694b3f86edef11c40276e02

SHA256
2e466743345c9ca239111e198a142ec1c68405af4deedee07da2b9298315c586

SHA512
bd083f92d4e5b64432193f85962bfd41289b5ceb3fc1ceb25a854b4eaeae6b2c3441adf62706a2e2114cfe65066c9a9d7d6ce3167bb9b8aedf04804696e7e915

Download Submit
\Windows\system\DMsXjAI.exe

Filesize
2.3MB

MD5
12f2e928523ee9406486a5a90d748450

SHA1
27f0c90d0f9eb1bbbeb90c472ddf86eb157cedd0

SHA256
825c8c8a8591e60fed9cf1b9e36c93c30f5405bb4bae5aa8a12aa109a7ef0d25

SHA512
862266ab645c6a08f2ba39cc8e0916ea56a14d7c88cdedc640d93f8a399f9a69d18ab48e832f12741d4f55ba66edb722378f333a4863ef05e066355b4de28611

Download Submit
\Windows\system\EmCSjQE.exe

Filesize
2.3MB

MD5
b6240796725fe19e352a0a9b08bb2f90

SHA1
b901006f856155e195cf5e2cad1c7d79a8d09131

SHA256
7f6e237c5790ca084c7b8610bd92f09b95feb58eccabcf2c3fb0e90d4c5f3a60

SHA512
c084f1588541bb0674cae7b9a71e29a4c683f00a0db540b65b2976297d61c5c66ef05503e3b23123bd6cd647a3b76ad9e28e613d761ead60e20487c09fa9a931

Download Submit
\Windows\system\JRxqewy.exe

Filesize
2.3MB

MD5
b14b22db6ea6e2c68d2243fd18473c9c

SHA1
a7eda45f69f47b2ccb38f91b10c19d86bdd8a33d

SHA256
e7185c83948d807402f488c20995d178f8e653dafb4023e3b24db265df83a206

SHA512
1b47c37bd58f3fa22e2f725a8af82b402d96fa698dceff7fd6cd0a7b3bf169da1d7939cded7156f1cfb017af5d854f43ede9b1027b40533da6943ca67d18a535

Download Submit
\Windows\system\KXaNsNH.exe

Filesize
2.3MB

MD5
b70f5d5ddd92580507b245b54f90ba61

SHA1
9940bb14ba3e9c38957654fa0310d7c160c2e621

SHA256
eef8d4a12190be6a7b45c8cc2e5a035bcb29ce62acb9538049cb1892fc91d787

SHA512
d2a7ece6fc084cac8a26bdbea63b378a9451ff7833b7ed41b981c365daec917802dad573e5ab185f5c6e6f8022421792e2f5807b6585955d9d6dc3f766bee7c6

Download Submit
\Windows\system\NhcmwFg.exe

Filesize
2.3MB

MD5
8d601eaf924091e3f876646616a14581

SHA1
3617d07bd025dfb762b12428a397b0c31643e984

SHA256
729566efc366a97cd9a7414a1470aec8b62362d767916cf71dab007368f836dc

SHA512
98eefbfa7308275e469af7c4b9c9d17275056c20b80d42f1a907b2164bc920a5fcbd936cd9543b2b58fdb54b371be430b3dd9689e2602705054bbcc21d381069

Download Submit
\Windows\system\NiNYkFA.exe

Filesize
2.3MB

MD5
b262e206967d5c986b70a8a4bfa98499

SHA1
996ed8bda29bad2433d661c4bcf61dbea8a7b256

SHA256
4c810f0300df0591c4dac69f15f2a4f7b6e3bc215f8a234a5087a318f60bf46d

SHA512
1e0f355745455c8ae16295b0b24c684bf65cb4623a8439b99185b1c8f3716e9278a11a51e1577be76a16751b4d1308385a512072479c8e8102ca325fe87dfe56

Download Submit
\Windows\system\PWUdoJN.exe

Filesize
2.3MB

MD5
f705598943866d7e54b4c34b440e8f16

SHA1
16b026f8b32ab428bd8e212b43acbadbd5ccc97c

SHA256
d0e3794dda2be1ca5f16d79c9d8007af1b960f38e5d77d50f7800b5885821255

SHA512
bd6773a130a89677bdd3c0dd6ff1b4ab74f6c978a2a0468d3eb8bc0da3375460b8d3ec62c3427c939f11f70998f6724051430835e9bc3dc9a08d0458ef437f33

Download Submit
\Windows\system\ZcOzpNU.exe

Filesize
2.3MB

MD5
a3daf982b0b03796b74c64f2cf8c7ae2

SHA1
d3d6bba4c7132d3af4cd49879b53797af6fc1261

SHA256
5172da388ce6f38aafe58ea92b307c3d02246ccfc4fa9e4e6e290f9f43ee07a7

SHA512
2e10318bcfb1ae35659654b090680ad8b23822e0cba60590856fb2a7d0e9d724a7c8edad1ffb896f104411563b9efc101e20da22b6880a07b6600e309537924f

Download Submit
\Windows\system\dbfgsZy.exe

Filesize
2.3MB

MD5
ff07df7e50ade395dc485fee8534b597

SHA1
4465af80dbb3fd15ddcae8a005916c5e8c06bd42

SHA256
f3f6063423112c9efd32defd98671804237903a478c4e8436cb0a2e34608b582

SHA512
b9cf8212ca20df21fffa3eea585716e5b35a225cf894cbe0596cbc75c4f9db317db55eba6f3323afe6699beaf54d80b8cfdb8c6ee11b01c55b262adb2d8b051a

Download Submit
\Windows\system\jHYMdIv.exe

Filesize
2.3MB

MD5
7b5156f3118097e41e3cb5ad74705044

SHA1
6c23aa0adf22c3e1bcdf815dc16b3047033c3276

SHA256
400d560c12ff7e3d85762b3e43e83785f627b8dbe748e6cadcd6a657c5e7e091

SHA512
47b3481cdb269b473517864380e4ef4b595a76ed7f1e55261be94dd2836e954f66d428888daa655e1195697ab6ecb13418279856738882250be0690891d03541

Download Submit
\Windows\system\jZIRNJY.exe

Filesize
2.3MB

MD5
e24d095d8952f29222c17a233961dcdb

SHA1
93fd158ae2af5bae05d9a0d1aa860e9f97202e84

SHA256
47ad6ecebf5ad15edddd319080f7907879f6ebe6055a8e8d3aafe09280551e3c

SHA512
5ce4bed2121118d8cc3c4c7b4bd52892d43fb6593b0a7c1db7f0ba75fb14e3ef0486e742fbf9610d37b2d6d8d8c675b35796e841ae7da325299bb0a74dfdb7ce

Download Submit
\Windows\system\xjyYAba.exe

Filesize
2.3MB

MD5
6d252deb7adff401e61a6663e7756c48

SHA1
ca3ff27cf3ee9a70109c74daf42a052ef4df4268

SHA256
d1260c76b0a7f980bfece3f41eee17c15a9e6d5c03bf9fb972b900f5e829a712

SHA512
81c6da24e8137e96af37a2fa3878fcc540f14904e02365cf53940c29a26c617120197c359773caef94895584daf219151b745d238af8fc8b72ebb344001c1b45

Download Submit
memory/1036-5452-0x000000013F340000-0x000000013F732000-memory.dmp

Filesize
3.9MB

Download
memory/1036-27-0x000000013F340000-0x000000013F732000-memory.dmp

Filesize
3.9MB

Download
memory/1248-123-0x000000013F8E0000-0x000000013FCD2000-memory.dmp

Filesize
3.9MB

Download
memory/1868-31-0x000000001B590000-0x000000001B872000-memory.dmp

Filesize
2.9MB

Download
memory/1868-29-0x000007FEF5DAE000-0x000007FEF5DAF000-memory.dmp

Filesize
4KB

Download
memory/1868-113-0x000007FEF5AF0000-0x000007FEF648D000-memory.dmp

Filesize
9.6MB

Download
memory/1868-459-0x000007FEF5AF0000-0x000007FEF648D000-memory.dmp

Filesize
9.6MB

Download
memory/1868-28-0x0000000001E50000-0x0000000001ED0000-memory.dmp

Filesize
512KB

Download
memory/1868-32-0x0000000002250000-0x0000000002258000-memory.dmp

Filesize
32KB

Download
memory/2204-5451-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2204-14-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2312-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2312-121-0x000000013F790000-0x000000013FB82000-memory.dmp

Filesize
3.9MB

Download
memory/2312-12-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2312-26-0x000000013F340000-0x000000013F732000-memory.dmp

Filesize
3.9MB

Download
memory/2312-13762-0x000000013F110000-0x000000013F502000-memory.dmp

Filesize
3.9MB

Download
memory/2312-131-0x0000000003610000-0x0000000003A02000-memory.dmp

Filesize
3.9MB

Download
memory/2312-13724-0x0000000003610000-0x0000000003A02000-memory.dmp

Filesize
3.9MB

Download
memory/2312-133-0x000000013F3F0000-0x000000013F7E2000-memory.dmp

Filesize
3.9MB

Download
memory/2312-126-0x0000000003610000-0x0000000003A02000-memory.dmp

Filesize
3.9MB

Download
memory/2312-13499-0x000000013F790000-0x000000013FB82000-memory.dmp

Filesize
3.9MB

Download
memory/2312-136-0x000000013F5D0000-0x000000013F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/2312-128-0x000000013F110000-0x000000013F502000-memory.dmp

Filesize
3.9MB

Download
memory/2312-13310-0x0000000003610000-0x0000000003A02000-memory.dmp

Filesize
3.9MB

Download
memory/2312-118-0x000000013F3D0000-0x000000013F7C2000-memory.dmp

Filesize
3.9MB

Download
memory/2312-115-0x0000000003610000-0x0000000003A02000-memory.dmp

Filesize
3.9MB

Download
memory/2312-114-0x000000013F4F0000-0x000000013F8E2000-memory.dmp

Filesize
3.9MB

Download
memory/2312-125-0x000000013F3E0000-0x000000013F7D2000-memory.dmp

Filesize
3.9MB

Download
memory/2312-122-0x000000013F8E0000-0x000000013FCD2000-memory.dmp

Filesize
3.9MB

Download
memory/2312-11854-0x0000000003190000-0x0000000003582000-memory.dmp

Filesize
3.9MB

Download
memory/2312-16-0x0000000003190000-0x0000000003582000-memory.dmp

Filesize
3.9MB

Download
memory/2312-10956-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/2312-2-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/2404-5450-0x000000013F4F0000-0x000000013F8E2000-memory.dmp

Filesize
3.9MB

Download
memory/2404-119-0x000000013F4F0000-0x000000013F8E2000-memory.dmp

Filesize
3.9MB

Download
memory/2436-5455-0x000000013FE40000-0x0000000140232000-memory.dmp

Filesize
3.9MB

Download
memory/2436-130-0x000000013FE40000-0x0000000140232000-memory.dmp

Filesize
3.9MB

Download
memory/2572-5449-0x000000013F3D0000-0x000000013F7C2000-memory.dmp

Filesize
3.9MB

Download
memory/2572-120-0x000000013F3D0000-0x000000013F7C2000-memory.dmp

Filesize
3.9MB

Download
memory/2576-5460-0x000000013F5D0000-0x000000013F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/2576-124-0x000000013F5D0000-0x000000013F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/2636-127-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/2648-5446-0x000000013FFC0000-0x00000001403B2000-memory.dmp

Filesize
3.9MB

Download
memory/2648-15-0x000000013FFC0000-0x00000001403B2000-memory.dmp

Filesize
3.9MB

Download
memory/2856-5464-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/2856-132-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download