xmrig | abb70333be24929181b3a7e7012dbae0858fd7cf2fe31151959f53d8ecf8c103

Analysis

max time kernel
150s
max time network
142s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 00:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
Size

1.4MB
MD5

224fbcdd51eeca33257c200d6f3cce3e
SHA1

7d0d0ee3177754ae47ffc9627ceb1de9544a8bfa
SHA256

abb70333be24929181b3a7e7012dbae0858fd7cf2fe31151959f53d8ecf8c103
SHA512

39cba9620147ce10569b2cac620f137f09f847d3ad8c1760d636f21dd726d1dfad36a6d95e4f0a07756a0763084269fe03b726265e0b2470fb7b1928647fddf7
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYKpGncHBN/Vx+wa:Lz071uv4BPMkibTIA5CJQwa

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 17 IoCs

miner

resource	yara_rule
behavioral1/memory/2632-176-0x000000013F060000-0x000000013F452000-memory.dmp	xmrig
behavioral1/memory/2480-302-0x000000013F050000-0x000000013F442000-memory.dmp	xmrig
behavioral1/memory/1820-5550-0x000000013F3B0000-0x000000013F7A2000-memory.dmp	xmrig
behavioral1/memory/2092-5684-0x000000013FDD0000-0x00000001401C2000-memory.dmp	xmrig
behavioral1/memory/2944-5853-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	xmrig
behavioral1/memory/2564-5785-0x000000013FEA0000-0x0000000140292000-memory.dmp	xmrig
behavioral1/memory/2632-5737-0x000000013F060000-0x000000013F452000-memory.dmp	xmrig
behavioral1/memory/2576-5720-0x000000013F8F0000-0x000000013FCE2000-memory.dmp	xmrig
behavioral1/memory/2972-5625-0x000000013FCF0000-0x00000001400E2000-memory.dmp	xmrig
behavioral1/memory/2944-290-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	xmrig
behavioral1/memory/2564-288-0x000000013FEA0000-0x0000000140292000-memory.dmp	xmrig
behavioral1/memory/2720-286-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	xmrig
behavioral1/memory/2400-295-0x000000013F720000-0x000000013FB12000-memory.dmp	xmrig
behavioral1/memory/2092-157-0x000000013FDD0000-0x00000001401C2000-memory.dmp	xmrig
behavioral1/memory/2576-89-0x000000013F8F0000-0x000000013FCE2000-memory.dmp	xmrig
behavioral1/memory/2716-73-0x000000013F680000-0x000000013FA72000-memory.dmp	xmrig
behavioral1/memory/2972-60-0x000000013FCF0000-0x00000001400E2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3016	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1820	glIekTR.exe
2972	JuINkyw.exe
2716	ATvXIem.exe
2576	tsthZsN.exe
2092	yyjCddE.exe
2632	YFTlwmJ.exe
2720	hGSbGsu.exe
2564	DkEfwHL.exe
2480	jklGLEU.exe
2944	HfJRkmk.exe
2400	wUiAGJs.exe
1644	gPvUgiB.exe
2692	ePiWCpE.exe
1608	FaZiTsl.exe
2676	xeikpYX.exe
2520	iqWBjGc.exe
320	PrGFHtj.exe
1632	qrpbYqL.exe
1868	iFtEUDi.exe
2764	xROhAqQ.exe
1648	Wrtphpi.exe
1468	XYPGcTy.exe
2968	bOUczXJ.exe
2124	NtPCTGd.exe
1676	pMmxaZf.exe
600	TKarQHk.exe
1864	bbtOwOm.exe
2760	fViwKpM.exe
1624	xqjBUoD.exe
2260	chWQOKs.exe
1776	qBnbwMX.exe
2332	oVTcWWa.exe
2284	ydmucwg.exe
2552	SCdCJEm.exe
448	GwEYxVt.exe
3064	bnQjxrz.exe
1796	UDeaGxe.exe
1144	hpQmdFw.exe
1848	CEaRzep.exe
2884	woZxaKv.exe
272	dZEJbJo.exe
1728	eXElOht.exe
2892	nkahWOO.exe
2904	eOXTgBX.exe
1752	viwZujm.exe
3056	dVTjlSk.exe
1568	RAvCbkh.exe
2372	kjjZuWS.exe
2664	CejcnLe.exe
2612	zePxqiI.exe
1192	UUaBXQr.exe
1488	nHGhFxZ.exe
1812	lSwLdMp.exe
876	OKMbcEy.exe
644	ikPIKgp.exe
1180	uofvTqo.exe
1116	xRjICjh.exe
704	TVWTxpp.exe
636	MEGgBwq.exe
2896	bmeGWFG.exe
2180	xNhPUJQ.exe
3268	RUpdehI.exe
2324	VCvdEBL.exe
1976	OQinHZl.exe

Loads dropped DLL 64 IoCs

pid	Process
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe

UPX packed file 59 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2148-1-0x000000013F040000-0x000000013F432000-memory.dmp	upx
behavioral1/files/0x000c0000000141c0-3.dat	upx
behavioral1/files/0x00090000000143ec-16.dat	upx
behavioral1/files/0x0008000000014539-20.dat	upx
behavioral1/memory/1820-23-0x000000013F3B0000-0x000000013F7A2000-memory.dmp	upx
behavioral1/files/0x000f000000005578-28.dat	upx
behavioral1/files/0x00080000000146a2-32.dat	upx
behavioral1/files/0x00090000000146b8-34.dat	upx
behavioral1/files/0x00090000000146c0-41.dat	upx
behavioral1/files/0x0009000000014825-46.dat	upx
behavioral1/files/0x00070000000149f5-56.dat	upx
behavioral1/files/0x00060000000155ed-90.dat	upx
behavioral1/files/0x0006000000015616-106.dat	upx
behavioral1/files/0x0006000000015605-178.dat	upx
behavioral1/memory/2632-176-0x000000013F060000-0x000000013F452000-memory.dmp	upx
behavioral1/files/0x0006000000015d0f-173.dat	upx
behavioral1/files/0x0006000000015d07-166.dat	upx
behavioral1/memory/2480-302-0x000000013F050000-0x000000013F442000-memory.dmp	upx
behavioral1/memory/1820-5550-0x000000013F3B0000-0x000000013F7A2000-memory.dmp	upx
behavioral1/memory/2092-5684-0x000000013FDD0000-0x00000001401C2000-memory.dmp	upx
behavioral1/memory/2944-5853-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	upx
behavioral1/memory/2564-5785-0x000000013FEA0000-0x0000000140292000-memory.dmp	upx
behavioral1/memory/2632-5737-0x000000013F060000-0x000000013F452000-memory.dmp	upx
behavioral1/memory/2576-5720-0x000000013F8F0000-0x000000013FCE2000-memory.dmp	upx
behavioral1/memory/2972-5625-0x000000013FCF0000-0x00000001400E2000-memory.dmp	upx
behavioral1/memory/2944-290-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	upx
behavioral1/memory/2564-288-0x000000013FEA0000-0x0000000140292000-memory.dmp	upx
behavioral1/memory/2720-286-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	upx
behavioral1/memory/2400-295-0x000000013F720000-0x000000013FB12000-memory.dmp	upx
behavioral1/files/0x000900000001448a-170.dat	upx
behavioral1/files/0x0006000000015cf6-165.dat	upx
behavioral1/files/0x0006000000015cce-164.dat	upx
behavioral1/files/0x0006000000015c9f-163.dat	upx
behavioral1/files/0x0006000000015c78-162.dat	upx
behavioral1/files/0x0006000000015c52-161.dat	upx
behavioral1/files/0x0006000000015b6f-160.dat	upx
behavioral1/files/0x0006000000015616-159.dat	upx
behavioral1/files/0x00060000000155f7-158.dat	upx
behavioral1/memory/2092-157-0x000000013FDD0000-0x00000001401C2000-memory.dmp	upx
behavioral1/files/0x0006000000015cce-141.dat	upx
behavioral1/files/0x0006000000015c78-126.dat	upx
behavioral1/files/0x0006000000014b70-98.dat	upx
behavioral1/files/0x00060000000155f3-156.dat	upx
behavioral1/files/0x0006000000015cfe-151.dat	upx
behavioral1/files/0x0006000000015cee-144.dat	upx
behavioral1/files/0x0006000000015cb6-138.dat	upx
behavioral1/files/0x0006000000015018-134.dat	upx
behavioral1/files/0x0006000000015c83-129.dat	upx
behavioral1/files/0x0006000000015c6b-123.dat	upx
behavioral1/files/0x0006000000014de9-118.dat	upx
behavioral1/files/0x0006000000015c3d-116.dat	upx
behavioral1/files/0x0006000000015626-109.dat	upx
behavioral1/files/0x0006000000014ef8-81.dat	upx
behavioral1/memory/2576-89-0x000000013F8F0000-0x000000013FCE2000-memory.dmp	upx
behavioral1/files/0x0006000000014b31-87.dat	upx
behavioral1/memory/2716-73-0x000000013F680000-0x000000013FA72000-memory.dmp	upx
behavioral1/files/0x0007000000014abe-65.dat	upx
behavioral1/files/0x0007000000014af6-68.dat	upx
behavioral1/memory/2972-60-0x000000013FCF0000-0x00000001400E2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\BLDCSXY.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\eMtfhvE.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\LrfNoWH.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\HeHJLGM.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\qNwchHs.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\LKUjhPk.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\qcferdZ.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\scZblqI.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\WmzqcZK.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\usCOHmr.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\yBtKanb.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\hJzWSaa.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\ZFvYthV.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\baiCJjX.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\ahYHZYo.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\TcxPztq.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\KfimXSh.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\NFesCVi.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\zkympDA.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\kLdznba.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\nSenEQp.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\rOcflwh.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\iRLwOEX.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\uVnFznJ.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\QpBCSOO.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\giljbhz.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\lTwQNDs.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\YkNbfnq.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\OZRskkQ.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\RzPPNSl.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\bpSsFYg.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\upaSTDc.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\OUtGvFq.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\EPxhVii.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\OPzvIEG.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\FykbAmM.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\eMwnWCv.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\XgxkbIE.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\UULBAdw.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\gaisVyE.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\WKdLQws.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\roPuuOn.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\dJCaCjT.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\BNYydFm.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\LSHXfnv.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\KqvWlHk.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\IHvrUQY.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\lugkWjH.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\tYuszZk.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\FFYtLEH.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\pVEnoNn.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\wsdXqvr.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\idfqUgR.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\rlUOPuN.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\iwXomeL.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\pXxrxYu.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\CxgoAfS.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\bYYeTjh.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\uCyKoHg.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\lvFqcvw.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\AiqhweG.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\BTYrfRg.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\tCHgWeB.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\BQbPCNT.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3016	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
Token: SeDebugPrivilege	3016	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 3016	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	29
PID 2148 wrote to memory of 3016	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	29
PID 2148 wrote to memory of 3016	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	29
PID 2148 wrote to memory of 1820	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	30
PID 2148 wrote to memory of 1820	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	30
PID 2148 wrote to memory of 1820	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	30
PID 2148 wrote to memory of 2972	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	31
PID 2148 wrote to memory of 2972	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	31
PID 2148 wrote to memory of 2972	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	31
PID 2148 wrote to memory of 2716	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	32
PID 2148 wrote to memory of 2716	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	32
PID 2148 wrote to memory of 2716	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	32
PID 2148 wrote to memory of 2576	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	33
PID 2148 wrote to memory of 2576	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	33
PID 2148 wrote to memory of 2576	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	33
PID 2148 wrote to memory of 2092	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	34
PID 2148 wrote to memory of 2092	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	34
PID 2148 wrote to memory of 2092	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	34
PID 2148 wrote to memory of 2632	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	35
PID 2148 wrote to memory of 2632	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	35
PID 2148 wrote to memory of 2632	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	35
PID 2148 wrote to memory of 2720	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	36
PID 2148 wrote to memory of 2720	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	36
PID 2148 wrote to memory of 2720	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	36
PID 2148 wrote to memory of 2564	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	37
PID 2148 wrote to memory of 2564	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	37
PID 2148 wrote to memory of 2564	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	37
PID 2148 wrote to memory of 2480	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	38
PID 2148 wrote to memory of 2480	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	38
PID 2148 wrote to memory of 2480	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	38
PID 2148 wrote to memory of 2944	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	39
PID 2148 wrote to memory of 2944	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	39
PID 2148 wrote to memory of 2944	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	39
PID 2148 wrote to memory of 2400	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	40
PID 2148 wrote to memory of 2400	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	40
PID 2148 wrote to memory of 2400	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	40
PID 2148 wrote to memory of 1644	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	41
PID 2148 wrote to memory of 1644	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	41
PID 2148 wrote to memory of 1644	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	41
PID 2148 wrote to memory of 2692	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	42
PID 2148 wrote to memory of 2692	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	42
PID 2148 wrote to memory of 2692	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	42
PID 2148 wrote to memory of 2520	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	43
PID 2148 wrote to memory of 2520	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	43
PID 2148 wrote to memory of 2520	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	43
PID 2148 wrote to memory of 1608	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	44
PID 2148 wrote to memory of 1608	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	44
PID 2148 wrote to memory of 1608	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	44
PID 2148 wrote to memory of 320	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	45
PID 2148 wrote to memory of 320	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	45
PID 2148 wrote to memory of 320	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	45
PID 2148 wrote to memory of 2676	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	46
PID 2148 wrote to memory of 2676	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	46
PID 2148 wrote to memory of 2676	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	46
PID 2148 wrote to memory of 1632	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	47
PID 2148 wrote to memory of 1632	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	47
PID 2148 wrote to memory of 1632	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	47
PID 2148 wrote to memory of 1868	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	48
PID 2148 wrote to memory of 1868	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	48
PID 2148 wrote to memory of 1868	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	48
PID 2148 wrote to memory of 1864	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	49
PID 2148 wrote to memory of 1864	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	49
PID 2148 wrote to memory of 1864	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	49
PID 2148 wrote to memory of 2764	2148	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3016
- C:\Windows\System\glIekTR.exe
  C:\Windows\System\glIekTR.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\JuINkyw.exe
  C:\Windows\System\JuINkyw.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\ATvXIem.exe
  C:\Windows\System\ATvXIem.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\tsthZsN.exe
  C:\Windows\System\tsthZsN.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\yyjCddE.exe
  C:\Windows\System\yyjCddE.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\YFTlwmJ.exe
  C:\Windows\System\YFTlwmJ.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\hGSbGsu.exe
  C:\Windows\System\hGSbGsu.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\DkEfwHL.exe
  C:\Windows\System\DkEfwHL.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\jklGLEU.exe
  C:\Windows\System\jklGLEU.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\HfJRkmk.exe
  C:\Windows\System\HfJRkmk.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\wUiAGJs.exe
  C:\Windows\System\wUiAGJs.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\gPvUgiB.exe
  C:\Windows\System\gPvUgiB.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\ePiWCpE.exe
  C:\Windows\System\ePiWCpE.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\iqWBjGc.exe
  C:\Windows\System\iqWBjGc.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\FaZiTsl.exe
  C:\Windows\System\FaZiTsl.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\PrGFHtj.exe
  C:\Windows\System\PrGFHtj.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\xeikpYX.exe
  C:\Windows\System\xeikpYX.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\qrpbYqL.exe
  C:\Windows\System\qrpbYqL.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\iFtEUDi.exe
  C:\Windows\System\iFtEUDi.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\bbtOwOm.exe
  C:\Windows\System\bbtOwOm.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\xROhAqQ.exe
  C:\Windows\System\xROhAqQ.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\fViwKpM.exe
  C:\Windows\System\fViwKpM.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\Wrtphpi.exe
  C:\Windows\System\Wrtphpi.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\xqjBUoD.exe
  C:\Windows\System\xqjBUoD.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\XYPGcTy.exe
  C:\Windows\System\XYPGcTy.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\chWQOKs.exe
  C:\Windows\System\chWQOKs.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\bOUczXJ.exe
  C:\Windows\System\bOUczXJ.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\qBnbwMX.exe
  C:\Windows\System\qBnbwMX.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\NtPCTGd.exe
  C:\Windows\System\NtPCTGd.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\oVTcWWa.exe
  C:\Windows\System\oVTcWWa.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\pMmxaZf.exe
  C:\Windows\System\pMmxaZf.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\ydmucwg.exe
  C:\Windows\System\ydmucwg.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\TKarQHk.exe
  C:\Windows\System\TKarQHk.exe
  2⤵
  - Executes dropped EXE
  PID:600
- C:\Windows\System\SCdCJEm.exe
  C:\Windows\System\SCdCJEm.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\GwEYxVt.exe
  C:\Windows\System\GwEYxVt.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\nHGhFxZ.exe
  C:\Windows\System\nHGhFxZ.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\bnQjxrz.exe
  C:\Windows\System\bnQjxrz.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\lSwLdMp.exe
  C:\Windows\System\lSwLdMp.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\UDeaGxe.exe
  C:\Windows\System\UDeaGxe.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\OKMbcEy.exe
  C:\Windows\System\OKMbcEy.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\hpQmdFw.exe
  C:\Windows\System\hpQmdFw.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\ikPIKgp.exe
  C:\Windows\System\ikPIKgp.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\CEaRzep.exe
  C:\Windows\System\CEaRzep.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\uofvTqo.exe
  C:\Windows\System\uofvTqo.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\woZxaKv.exe
  C:\Windows\System\woZxaKv.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\xRjICjh.exe
  C:\Windows\System\xRjICjh.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\dZEJbJo.exe
  C:\Windows\System\dZEJbJo.exe
  2⤵
  - Executes dropped EXE
  PID:272
- C:\Windows\System\TVWTxpp.exe
  C:\Windows\System\TVWTxpp.exe
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Windows\System\eXElOht.exe
  C:\Windows\System\eXElOht.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\MEGgBwq.exe
  C:\Windows\System\MEGgBwq.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\nkahWOO.exe
  C:\Windows\System\nkahWOO.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\bmeGWFG.exe
  C:\Windows\System\bmeGWFG.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\eOXTgBX.exe
  C:\Windows\System\eOXTgBX.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\xNhPUJQ.exe
  C:\Windows\System\xNhPUJQ.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\viwZujm.exe
  C:\Windows\System\viwZujm.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\VCvdEBL.exe
  C:\Windows\System\VCvdEBL.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\dVTjlSk.exe
  C:\Windows\System\dVTjlSk.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\OQinHZl.exe
  C:\Windows\System\OQinHZl.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\RAvCbkh.exe
  C:\Windows\System\RAvCbkh.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\fFEiCOM.exe
  C:\Windows\System\fFEiCOM.exe
  2⤵
  PID:1692
- C:\Windows\System\kjjZuWS.exe
  C:\Windows\System\kjjZuWS.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\opDCzzL.exe
  C:\Windows\System\opDCzzL.exe
  2⤵
  PID:2288
- C:\Windows\System\CejcnLe.exe
  C:\Windows\System\CejcnLe.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\iqiSeVL.exe
  C:\Windows\System\iqiSeVL.exe
  2⤵
  PID:2604
- C:\Windows\System\zePxqiI.exe
  C:\Windows\System\zePxqiI.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\ihYwsiz.exe
  C:\Windows\System\ihYwsiz.exe
  2⤵
  PID:2488
- C:\Windows\System\UUaBXQr.exe
  C:\Windows\System\UUaBXQr.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\VRBSIFR.exe
  C:\Windows\System\VRBSIFR.exe
  2⤵
  PID:2460
- C:\Windows\System\RUpdehI.exe
  C:\Windows\System\RUpdehI.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\uKHryaT.exe
  C:\Windows\System\uKHryaT.exe
  2⤵
  PID:3320
- C:\Windows\System\aLUbAly.exe
  C:\Windows\System\aLUbAly.exe
  2⤵
  PID:3352
- C:\Windows\System\LhCqbvy.exe
  C:\Windows\System\LhCqbvy.exe
  2⤵
  PID:3416
- C:\Windows\System\dWGhfrl.exe
  C:\Windows\System\dWGhfrl.exe
  2⤵
  PID:3432
- C:\Windows\System\xxjBWXn.exe
  C:\Windows\System\xxjBWXn.exe
  2⤵
  PID:3452
- C:\Windows\System\qLrbxCx.exe
  C:\Windows\System\qLrbxCx.exe
  2⤵
  PID:3476
- C:\Windows\System\SrNRkgX.exe
  C:\Windows\System\SrNRkgX.exe
  2⤵
  PID:3500
- C:\Windows\System\RxCpbDn.exe
  C:\Windows\System\RxCpbDn.exe
  2⤵
  PID:3520
- C:\Windows\System\xTnxJBw.exe
  C:\Windows\System\xTnxJBw.exe
  2⤵
  PID:3540
- C:\Windows\System\SurjMLi.exe
  C:\Windows\System\SurjMLi.exe
  2⤵
  PID:3560
- C:\Windows\System\OnEPJKg.exe
  C:\Windows\System\OnEPJKg.exe
  2⤵
  PID:3580
- C:\Windows\System\BMaJbgb.exe
  C:\Windows\System\BMaJbgb.exe
  2⤵
  PID:3600
- C:\Windows\System\XDOxubf.exe
  C:\Windows\System\XDOxubf.exe
  2⤵
  PID:3620
- C:\Windows\System\kxzWXot.exe
  C:\Windows\System\kxzWXot.exe
  2⤵
  PID:3640
- C:\Windows\System\uWPVpOq.exe
  C:\Windows\System\uWPVpOq.exe
  2⤵
  PID:3660
- C:\Windows\System\jDmMmiY.exe
  C:\Windows\System\jDmMmiY.exe
  2⤵
  PID:3680
- C:\Windows\System\KetUzWD.exe
  C:\Windows\System\KetUzWD.exe
  2⤵
  PID:3700
- C:\Windows\System\lNTTzZd.exe
  C:\Windows\System\lNTTzZd.exe
  2⤵
  PID:3720
- C:\Windows\System\VxbaKWH.exe
  C:\Windows\System\VxbaKWH.exe
  2⤵
  PID:3740
- C:\Windows\System\aANPILa.exe
  C:\Windows\System\aANPILa.exe
  2⤵
  PID:3760
- C:\Windows\System\nZjvnCp.exe
  C:\Windows\System\nZjvnCp.exe
  2⤵
  PID:3780
- C:\Windows\System\WGgSpWv.exe
  C:\Windows\System\WGgSpWv.exe
  2⤵
  PID:3800
- C:\Windows\System\iSFmAUo.exe
  C:\Windows\System\iSFmAUo.exe
  2⤵
  PID:3820
- C:\Windows\System\cjJfxVF.exe
  C:\Windows\System\cjJfxVF.exe
  2⤵
  PID:3844
- C:\Windows\System\ZssjBPs.exe
  C:\Windows\System\ZssjBPs.exe
  2⤵
  PID:3864
- C:\Windows\System\bwbnfZW.exe
  C:\Windows\System\bwbnfZW.exe
  2⤵
  PID:3884
- C:\Windows\System\XhqpXpR.exe
  C:\Windows\System\XhqpXpR.exe
  2⤵
  PID:3904
- C:\Windows\System\LSXTUtQ.exe
  C:\Windows\System\LSXTUtQ.exe
  2⤵
  PID:3924
- C:\Windows\System\ZILAIFk.exe
  C:\Windows\System\ZILAIFk.exe
  2⤵
  PID:3944
- C:\Windows\System\QdFYeUo.exe
  C:\Windows\System\QdFYeUo.exe
  2⤵
  PID:3964
- C:\Windows\System\QbDqZZT.exe
  C:\Windows\System\QbDqZZT.exe
  2⤵
  PID:3984
- C:\Windows\System\BrLOHeh.exe
  C:\Windows\System\BrLOHeh.exe
  2⤵
  PID:4000
- C:\Windows\System\PdBywcB.exe
  C:\Windows\System\PdBywcB.exe
  2⤵
  PID:4016
- C:\Windows\System\rIIofAm.exe
  C:\Windows\System\rIIofAm.exe
  2⤵
  PID:4032
- C:\Windows\System\crQMBss.exe
  C:\Windows\System\crQMBss.exe
  2⤵
  PID:4052
- C:\Windows\System\pcgQRJl.exe
  C:\Windows\System\pcgQRJl.exe
  2⤵
  PID:4068
- C:\Windows\System\YrdngkO.exe
  C:\Windows\System\YrdngkO.exe
  2⤵
  PID:4084
- C:\Windows\System\LcDcbWj.exe
  C:\Windows\System\LcDcbWj.exe
  2⤵
  PID:952
- C:\Windows\System\eUgzuxy.exe
  C:\Windows\System\eUgzuxy.exe
  2⤵
  PID:1988
- C:\Windows\System\cprxJAa.exe
  C:\Windows\System\cprxJAa.exe
  2⤵
  PID:2544
- C:\Windows\System\KiuPwDQ.exe
  C:\Windows\System\KiuPwDQ.exe
  2⤵
  PID:944
- C:\Windows\System\WrqPOzX.exe
  C:\Windows\System\WrqPOzX.exe
  2⤵
  PID:2792
- C:\Windows\System\WfdRrsz.exe
  C:\Windows\System\WfdRrsz.exe
  2⤵
  PID:2920
- C:\Windows\System\jLsHpFQ.exe
  C:\Windows\System\jLsHpFQ.exe
  2⤵
  PID:2680
- C:\Windows\System\fjagTht.exe
  C:\Windows\System\fjagTht.exe
  2⤵
  PID:1536
- C:\Windows\System\LArhLYF.exe
  C:\Windows\System\LArhLYF.exe
  2⤵
  PID:2252
- C:\Windows\System\voxvsNo.exe
  C:\Windows\System\voxvsNo.exe
  2⤵
  PID:1756
- C:\Windows\System\PwrHLEh.exe
  C:\Windows\System\PwrHLEh.exe
  2⤵
  PID:1472
- C:\Windows\System\YoyPLRi.exe
  C:\Windows\System\YoyPLRi.exe
  2⤵
  PID:1732
- C:\Windows\System\pAeGwvF.exe
  C:\Windows\System\pAeGwvF.exe
  2⤵
  PID:576
- C:\Windows\System\vThToqC.exe
  C:\Windows\System\vThToqC.exe
  2⤵
  PID:2988
- C:\Windows\System\zRonBjw.exe
  C:\Windows\System\zRonBjw.exe
  2⤵
  PID:2376
- C:\Windows\System\hFnqseH.exe
  C:\Windows\System\hFnqseH.exe
  2⤵
  PID:3052
- C:\Windows\System\uVnouiw.exe
  C:\Windows\System\uVnouiw.exe
  2⤵
  PID:1840
- C:\Windows\System\KuhkiWR.exe
  C:\Windows\System\KuhkiWR.exe
  2⤵
  PID:2608
- C:\Windows\System\UEvcbFt.exe
  C:\Windows\System\UEvcbFt.exe
  2⤵
  PID:2512
- C:\Windows\System\cgTrRte.exe
  C:\Windows\System\cgTrRte.exe
  2⤵
  PID:1844
- C:\Windows\System\FoKHmGP.exe
  C:\Windows\System\FoKHmGP.exe
  2⤵
  PID:2996
- C:\Windows\System\XnapVMB.exe
  C:\Windows\System\XnapVMB.exe
  2⤵
  PID:2192
- C:\Windows\System\LxxKYsa.exe
  C:\Windows\System\LxxKYsa.exe
  2⤵
  PID:1912
- C:\Windows\System\CyzMmrJ.exe
  C:\Windows\System\CyzMmrJ.exe
  2⤵
  PID:1584
- C:\Windows\System\zNBjKLq.exe
  C:\Windows\System\zNBjKLq.exe
  2⤵
  PID:2868
- C:\Windows\System\nLwUGVZ.exe
  C:\Windows\System\nLwUGVZ.exe
  2⤵
  PID:2496
- C:\Windows\System\zAEvkBv.exe
  C:\Windows\System\zAEvkBv.exe
  2⤵
  PID:1296
- C:\Windows\System\UYdWaKY.exe
  C:\Windows\System\UYdWaKY.exe
  2⤵
  PID:2176
- C:\Windows\System\LgJMoRq.exe
  C:\Windows\System\LgJMoRq.exe
  2⤵
  PID:3160
- C:\Windows\System\eyVAbwU.exe
  C:\Windows\System\eyVAbwU.exe
  2⤵
  PID:3176
- C:\Windows\System\zduJqIm.exe
  C:\Windows\System\zduJqIm.exe
  2⤵
  PID:3192
- C:\Windows\System\LRRMkNR.exe
  C:\Windows\System\LRRMkNR.exe
  2⤵
  PID:3208
- C:\Windows\System\SwMydIv.exe
  C:\Windows\System\SwMydIv.exe
  2⤵
  PID:3228
- C:\Windows\System\mDQEnlN.exe
  C:\Windows\System\mDQEnlN.exe
  2⤵
  PID:3332
- C:\Windows\System\ftuLEdA.exe
  C:\Windows\System\ftuLEdA.exe
  2⤵
  PID:3424
- C:\Windows\System\lNFznyn.exe
  C:\Windows\System\lNFznyn.exe
  2⤵
  PID:3488
- C:\Windows\System\ZyraIAL.exe
  C:\Windows\System\ZyraIAL.exe
  2⤵
  PID:3512
- C:\Windows\System\paHILcL.exe
  C:\Windows\System\paHILcL.exe
  2⤵
  PID:3568
- C:\Windows\System\nOXTMfX.exe
  C:\Windows\System\nOXTMfX.exe
  2⤵
  PID:3572
- C:\Windows\System\HlsGOJV.exe
  C:\Windows\System\HlsGOJV.exe
  2⤵
  PID:2808
- C:\Windows\System\xlGTXvK.exe
  C:\Windows\System\xlGTXvK.exe
  2⤵
  PID:3628
- C:\Windows\System\ruvzpNq.exe
  C:\Windows\System\ruvzpNq.exe
  2⤵
  PID:3632
- C:\Windows\System\ofanRrW.exe
  C:\Windows\System\ofanRrW.exe
  2⤵
  PID:3676
- C:\Windows\System\RonBYij.exe
  C:\Windows\System\RonBYij.exe
  2⤵
  PID:3736
- C:\Windows\System\hnwrRuA.exe
  C:\Windows\System\hnwrRuA.exe
  2⤵
  PID:1740
- C:\Windows\System\LCAWsvt.exe
  C:\Windows\System\LCAWsvt.exe
  2⤵
  PID:3752
- C:\Windows\System\PchaQiS.exe
  C:\Windows\System\PchaQiS.exe
  2⤵
  PID:3788
- C:\Windows\System\RbcAFus.exe
  C:\Windows\System\RbcAFus.exe
  2⤵
  PID:3812
- C:\Windows\System\LFVIRHf.exe
  C:\Windows\System\LFVIRHf.exe
  2⤵
  PID:2136
- C:\Windows\System\IvBEEGx.exe
  C:\Windows\System\IvBEEGx.exe
  2⤵
  PID:2956
- C:\Windows\System\GsbLhgG.exe
  C:\Windows\System\GsbLhgG.exe
  2⤵
  PID:3880
- C:\Windows\System\TCDnbGj.exe
  C:\Windows\System\TCDnbGj.exe
  2⤵
  PID:2672
- C:\Windows\System\rQHzDuZ.exe
  C:\Windows\System\rQHzDuZ.exe
  2⤵
  PID:1524
- C:\Windows\System\osSAjTv.exe
  C:\Windows\System\osSAjTv.exe
  2⤵
  PID:4012
- C:\Windows\System\frGZrTV.exe
  C:\Windows\System\frGZrTV.exe
  2⤵
  PID:2660
- C:\Windows\System\ONwxVml.exe
  C:\Windows\System\ONwxVml.exe
  2⤵
  PID:2940
- C:\Windows\System\dlCfkXv.exe
  C:\Windows\System\dlCfkXv.exe
  2⤵
  PID:4048
- C:\Windows\System\ynzplFF.exe
  C:\Windows\System\ynzplFF.exe
  2⤵
  PID:940
- C:\Windows\System\bpiYpQE.exe
  C:\Windows\System\bpiYpQE.exe
  2⤵
  PID:4028
- C:\Windows\System\eBILHHx.exe
  C:\Windows\System\eBILHHx.exe
  2⤵
  PID:1604
- C:\Windows\System\zunsICj.exe
  C:\Windows\System\zunsICj.exe
  2⤵
  PID:1852
- C:\Windows\System\tKUUIxF.exe
  C:\Windows\System\tKUUIxF.exe
  2⤵
  PID:2456
- C:\Windows\System\OPzvIEG.exe
  C:\Windows\System\OPzvIEG.exe
  2⤵
  PID:4092
- C:\Windows\System\xgwWLwQ.exe
  C:\Windows\System\xgwWLwQ.exe
  2⤵
  PID:2848
- C:\Windows\System\fexDkKC.exe
  C:\Windows\System\fexDkKC.exe
  2⤵
  PID:2056
- C:\Windows\System\YQOxpzB.exe
  C:\Windows\System\YQOxpzB.exe
  2⤵
  PID:1640
- C:\Windows\System\UVGRNDC.exe
  C:\Windows\System\UVGRNDC.exe
  2⤵
  PID:3012
- C:\Windows\System\RwMEJag.exe
  C:\Windows\System\RwMEJag.exe
  2⤵
  PID:864
- C:\Windows\System\xiDfwPe.exe
  C:\Windows\System\xiDfwPe.exe
  2⤵
  PID:2728
- C:\Windows\System\bvHuKwX.exe
  C:\Windows\System\bvHuKwX.exe
  2⤵
  PID:1444
- C:\Windows\System\tDOyMDu.exe
  C:\Windows\System\tDOyMDu.exe
  2⤵
  PID:3376
- C:\Windows\System\EMpXZDO.exe
  C:\Windows\System\EMpXZDO.exe
  2⤵
  PID:1476
- C:\Windows\System\pboImDq.exe
  C:\Windows\System\pboImDq.exe
  2⤵
  PID:2916
- C:\Windows\System\YCSFCOS.exe
  C:\Windows\System\YCSFCOS.exe
  2⤵
  PID:3448
- C:\Windows\System\EaHiaTQ.exe
  C:\Windows\System\EaHiaTQ.exe
  2⤵
  PID:1480
- C:\Windows\System\RRMZhRH.exe
  C:\Windows\System\RRMZhRH.exe
  2⤵
  PID:1916
- C:\Windows\System\THOsRGk.exe
  C:\Windows\System\THOsRGk.exe
  2⤵
  PID:772
- C:\Windows\System\bYQuVFk.exe
  C:\Windows\System\bYQuVFk.exe
  2⤵
  PID:2704
- C:\Windows\System\WVrsNTc.exe
  C:\Windows\System\WVrsNTc.exe
  2⤵
  PID:3168
- C:\Windows\System\nIFvOtz.exe
  C:\Windows\System\nIFvOtz.exe
  2⤵
  PID:292
- C:\Windows\System\vFgRSol.exe
  C:\Windows\System\vFgRSol.exe
  2⤵
  PID:3224
- C:\Windows\System\SMcwqin.exe
  C:\Windows\System\SMcwqin.exe
  2⤵
  PID:3492
- C:\Windows\System\scneWpm.exe
  C:\Windows\System\scneWpm.exe
  2⤵
  PID:3216
- C:\Windows\System\VLhPHJM.exe
  C:\Windows\System\VLhPHJM.exe
  2⤵
  PID:3464
- C:\Windows\System\ZrisnLU.exe
  C:\Windows\System\ZrisnLU.exe
  2⤵
  PID:3548
- C:\Windows\System\fPpjqII.exe
  C:\Windows\System\fPpjqII.exe
  2⤵
  PID:3648
- C:\Windows\System\gsllhdk.exe
  C:\Windows\System\gsllhdk.exe
  2⤵
  PID:3708
- C:\Windows\System\dWLfFYY.exe
  C:\Windows\System\dWLfFYY.exe
  2⤵
  PID:3748
- C:\Windows\System\SgEkrHf.exe
  C:\Windows\System\SgEkrHf.exe
  2⤵
  PID:1860
- C:\Windows\System\NhFbLcu.exe
  C:\Windows\System\NhFbLcu.exe
  2⤵
  PID:3900
- C:\Windows\System\IIrJXXs.exe
  C:\Windows\System\IIrJXXs.exe
  2⤵
  PID:684
- C:\Windows\System\IqdzykO.exe
  C:\Windows\System\IqdzykO.exe
  2⤵
  PID:3960
- C:\Windows\System\aWLzwkT.exe
  C:\Windows\System\aWLzwkT.exe
  2⤵
  PID:3772
- C:\Windows\System\QxTWFxT.exe
  C:\Windows\System\QxTWFxT.exe
  2⤵
  PID:3828
- C:\Windows\System\zhbHBcA.exe
  C:\Windows\System\zhbHBcA.exe
  2⤵
  PID:3776
- C:\Windows\System\koUqYwI.exe
  C:\Windows\System\koUqYwI.exe
  2⤵
  PID:2112
- C:\Windows\System\SLBEeHM.exe
  C:\Windows\System\SLBEeHM.exe
  2⤵
  PID:1972
- C:\Windows\System\SDaVhkA.exe
  C:\Windows\System\SDaVhkA.exe
  2⤵
  PID:2688
- C:\Windows\System\ssCVGIM.exe
  C:\Windows\System\ssCVGIM.exe
  2⤵
  PID:1668
- C:\Windows\System\enyPnCS.exe
  C:\Windows\System\enyPnCS.exe
  2⤵
  PID:2976
- C:\Windows\System\APxecYU.exe
  C:\Windows\System\APxecYU.exe
  2⤵
  PID:1580
- C:\Windows\System\isaKbOs.exe
  C:\Windows\System\isaKbOs.exe
  2⤵
  PID:2756
- C:\Windows\System\tVODZQE.exe
  C:\Windows\System\tVODZQE.exe
  2⤵
  PID:2064
- C:\Windows\System\qVtPnMN.exe
  C:\Windows\System\qVtPnMN.exe
  2⤵
  PID:2128
- C:\Windows\System\KKKgkaO.exe
  C:\Windows\System\KKKgkaO.exe
  2⤵
  PID:2596
- C:\Windows\System\MPilrmO.exe
  C:\Windows\System\MPilrmO.exe
  2⤵
  PID:324
- C:\Windows\System\jWyCqcn.exe
  C:\Windows\System\jWyCqcn.exe
  2⤵
  PID:3276
- C:\Windows\System\uzaLsJP.exe
  C:\Windows\System\uzaLsJP.exe
  2⤵
  PID:1816
- C:\Windows\System\mHjMSHL.exe
  C:\Windows\System\mHjMSHL.exe
  2⤵
  PID:2736
- C:\Windows\System\BFwyAuR.exe
  C:\Windows\System\BFwyAuR.exe
  2⤵
  PID:2256
- C:\Windows\System\xFrujPe.exe
  C:\Windows\System\xFrujPe.exe
  2⤵
  PID:2020
- C:\Windows\System\PgNOUft.exe
  C:\Windows\System\PgNOUft.exe
  2⤵
  PID:3152
- C:\Windows\System\PmdNBDx.exe
  C:\Windows\System\PmdNBDx.exe
  2⤵
  PID:3144
- C:\Windows\System\WhLDTCn.exe
  C:\Windows\System\WhLDTCn.exe
  2⤵
  PID:3336
- C:\Windows\System\LPavGkn.exe
  C:\Windows\System\LPavGkn.exe
  2⤵
  PID:3484
- C:\Windows\System\CSkRZcV.exe
  C:\Windows\System\CSkRZcV.exe
  2⤵
  PID:3608
- C:\Windows\System\XZAZCnY.exe
  C:\Windows\System\XZAZCnY.exe
  2⤵
  PID:3796
- C:\Windows\System\cVJSwBc.exe
  C:\Windows\System\cVJSwBc.exe
  2⤵
  PID:3728
- C:\Windows\System\lIbNVnV.exe
  C:\Windows\System\lIbNVnV.exe
  2⤵
  PID:1980
- C:\Windows\System\DMeRejD.exe
  C:\Windows\System\DMeRejD.exe
  2⤵
  PID:2168
- C:\Windows\System\xzvaYPP.exe
  C:\Windows\System\xzvaYPP.exe
  2⤵
  PID:3832
- C:\Windows\System\xPVtjen.exe
  C:\Windows\System\xPVtjen.exe
  2⤵
  PID:3936
- C:\Windows\System\gxBFhMC.exe
  C:\Windows\System\gxBFhMC.exe
  2⤵
  PID:3992
- C:\Windows\System\uCVZEMM.exe
  C:\Windows\System\uCVZEMM.exe
  2⤵
  PID:1464
- C:\Windows\System\RoNmDGP.exe
  C:\Windows\System\RoNmDGP.exe
  2⤵
  PID:3872
- C:\Windows\System\sVBcwrr.exe
  C:\Windows\System\sVBcwrr.exe
  2⤵
  PID:1420
- C:\Windows\System\JbLURlL.exe
  C:\Windows\System\JbLURlL.exe
  2⤵
  PID:908
- C:\Windows\System\GFSVfhF.exe
  C:\Windows\System\GFSVfhF.exe
  2⤵
  PID:4040
- C:\Windows\System\CTmhqPQ.exe
  C:\Windows\System\CTmhqPQ.exe
  2⤵
  PID:4060
- C:\Windows\System\DlDYnzj.exe
  C:\Windows\System\DlDYnzj.exe
  2⤵
  PID:784
- C:\Windows\System\LzcxqWt.exe
  C:\Windows\System\LzcxqWt.exe
  2⤵
  PID:844
- C:\Windows\System\QnvjJvb.exe
  C:\Windows\System\QnvjJvb.exe
  2⤵
  PID:3296
- C:\Windows\System\hhqEVrp.exe
  C:\Windows\System\hhqEVrp.exe
  2⤵
  PID:2640
- C:\Windows\System\EySnOJC.exe
  C:\Windows\System\EySnOJC.exe
  2⤵
  PID:564
- C:\Windows\System\wJzzSbx.exe
  C:\Windows\System\wJzzSbx.exe
  2⤵
  PID:380
- C:\Windows\System\RYphpax.exe
  C:\Windows\System\RYphpax.exe
  2⤵
  PID:2416
- C:\Windows\System\rkKzSGI.exe
  C:\Windows\System\rkKzSGI.exe
  2⤵
  PID:2032
- C:\Windows\System\qVqYqrl.exe
  C:\Windows\System\qVqYqrl.exe
  2⤵
  PID:2528
- C:\Windows\System\vuTkPCa.exe
  C:\Windows\System\vuTkPCa.exe
  2⤵
  PID:2508
- C:\Windows\System\ymVYTPh.exe
  C:\Windows\System\ymVYTPh.exe
  2⤵
  PID:3184
- C:\Windows\System\XOwpqYg.exe
  C:\Windows\System\XOwpqYg.exe
  2⤵
  PID:3616
- C:\Windows\System\KvKbsTf.exe
  C:\Windows\System\KvKbsTf.exe
  2⤵
  PID:3716
- C:\Windows\System\zWEgDus.exe
  C:\Windows\System\zWEgDus.exe
  2⤵
  PID:4104
- C:\Windows\System\NueNqUJ.exe
  C:\Windows\System\NueNqUJ.exe
  2⤵
  PID:4120
- C:\Windows\System\bYYeTjh.exe
  C:\Windows\System\bYYeTjh.exe
  2⤵
  PID:4136
- C:\Windows\System\HGiikUR.exe
  C:\Windows\System\HGiikUR.exe
  2⤵
  PID:4152
- C:\Windows\System\eXvwZyF.exe
  C:\Windows\System\eXvwZyF.exe
  2⤵
  PID:4168
- C:\Windows\System\TDBEEoj.exe
  C:\Windows\System\TDBEEoj.exe
  2⤵
  PID:4184
- C:\Windows\System\OadPAPJ.exe
  C:\Windows\System\OadPAPJ.exe
  2⤵
  PID:4200
- C:\Windows\System\XuxhnRq.exe
  C:\Windows\System\XuxhnRq.exe
  2⤵
  PID:4220
- C:\Windows\System\SbnNAsT.exe
  C:\Windows\System\SbnNAsT.exe
  2⤵
  PID:4236
- C:\Windows\System\vtuNwWa.exe
  C:\Windows\System\vtuNwWa.exe
  2⤵
  PID:4252
- C:\Windows\System\TSwBVgW.exe
  C:\Windows\System\TSwBVgW.exe
  2⤵
  PID:4268
- C:\Windows\System\BEPozFC.exe
  C:\Windows\System\BEPozFC.exe
  2⤵
  PID:4284
- C:\Windows\System\tFSOXYL.exe
  C:\Windows\System\tFSOXYL.exe
  2⤵
  PID:4300
- C:\Windows\System\FFoOZkk.exe
  C:\Windows\System\FFoOZkk.exe
  2⤵
  PID:4364
- C:\Windows\System\BGqYnfJ.exe
  C:\Windows\System\BGqYnfJ.exe
  2⤵
  PID:4484
- C:\Windows\System\khbrqaN.exe
  C:\Windows\System\khbrqaN.exe
  2⤵
  PID:4508
- C:\Windows\System\YeiVAjq.exe
  C:\Windows\System\YeiVAjq.exe
  2⤵
  PID:4524
- C:\Windows\System\xyzKtWa.exe
  C:\Windows\System\xyzKtWa.exe
  2⤵
  PID:4540
- C:\Windows\System\bhmfmxi.exe
  C:\Windows\System\bhmfmxi.exe
  2⤵
  PID:4556
- C:\Windows\System\QBeDOYh.exe
  C:\Windows\System\QBeDOYh.exe
  2⤵
  PID:4580
- C:\Windows\System\QOQsLNe.exe
  C:\Windows\System\QOQsLNe.exe
  2⤵
  PID:4596
- C:\Windows\System\owtAbDN.exe
  C:\Windows\System\owtAbDN.exe
  2⤵
  PID:4612
- C:\Windows\System\SEEGQJL.exe
  C:\Windows\System\SEEGQJL.exe
  2⤵
  PID:4628
- C:\Windows\System\JhQFosA.exe
  C:\Windows\System\JhQFosA.exe
  2⤵
  PID:4696
- C:\Windows\System\EpbXhrj.exe
  C:\Windows\System\EpbXhrj.exe
  2⤵
  PID:4712
- C:\Windows\System\NHxxuZs.exe
  C:\Windows\System\NHxxuZs.exe
  2⤵
  PID:4728
- C:\Windows\System\vwaOVdu.exe
  C:\Windows\System\vwaOVdu.exe
  2⤵
  PID:4752
- C:\Windows\System\SzScTmV.exe
  C:\Windows\System\SzScTmV.exe
  2⤵
  PID:4768
- C:\Windows\System\JWEjCeL.exe
  C:\Windows\System\JWEjCeL.exe
  2⤵
  PID:4784
- C:\Windows\System\ZuRPCmO.exe
  C:\Windows\System\ZuRPCmO.exe
  2⤵
  PID:4800
- C:\Windows\System\SURyJlo.exe
  C:\Windows\System\SURyJlo.exe
  2⤵
  PID:4824
- C:\Windows\System\QKzkNvW.exe
  C:\Windows\System\QKzkNvW.exe
  2⤵
  PID:4840
- C:\Windows\System\IHvrUQY.exe
  C:\Windows\System\IHvrUQY.exe
  2⤵
  PID:4856
- C:\Windows\System\fydCbxZ.exe
  C:\Windows\System\fydCbxZ.exe
  2⤵
  PID:4880
- C:\Windows\System\yvknxGM.exe
  C:\Windows\System\yvknxGM.exe
  2⤵
  PID:4908
- C:\Windows\System\blgPIxJ.exe
  C:\Windows\System\blgPIxJ.exe
  2⤵
  PID:4940
- C:\Windows\System\faUpFok.exe
  C:\Windows\System\faUpFok.exe
  2⤵
  PID:4956
- C:\Windows\System\hfQoFyP.exe
  C:\Windows\System\hfQoFyP.exe
  2⤵
  PID:4972
- C:\Windows\System\wxhciMv.exe
  C:\Windows\System\wxhciMv.exe
  2⤵
  PID:4988
- C:\Windows\System\sluWeJC.exe
  C:\Windows\System\sluWeJC.exe
  2⤵
  PID:5004
- C:\Windows\System\rmAKIqs.exe
  C:\Windows\System\rmAKIqs.exe
  2⤵
  PID:5020
- C:\Windows\System\MIddUYh.exe
  C:\Windows\System\MIddUYh.exe
  2⤵
  PID:5036
- C:\Windows\System\RgBDBrS.exe
  C:\Windows\System\RgBDBrS.exe
  2⤵
  PID:5052
- C:\Windows\System\rAcreAf.exe
  C:\Windows\System\rAcreAf.exe
  2⤵
  PID:5068
- C:\Windows\System\IApgJIQ.exe
  C:\Windows\System\IApgJIQ.exe
  2⤵
  PID:5088
- C:\Windows\System\TzANGEP.exe
  C:\Windows\System\TzANGEP.exe
  2⤵
  PID:5104
- C:\Windows\System\XeeThhM.exe
  C:\Windows\System\XeeThhM.exe
  2⤵
  PID:3860
- C:\Windows\System\UQWPugB.exe
  C:\Windows\System\UQWPugB.exe
  2⤵
  PID:4044
- C:\Windows\System\JUcboKD.exe
  C:\Windows\System\JUcboKD.exe
  2⤵
  PID:884
- C:\Windows\System\BXwrUFI.exe
  C:\Windows\System\BXwrUFI.exe
  2⤵
  PID:3972
- C:\Windows\System\fuuZIaS.exe
  C:\Windows\System\fuuZIaS.exe
  2⤵
  PID:4064
- C:\Windows\System\dXqpcCN.exe
  C:\Windows\System\dXqpcCN.exe
  2⤵
  PID:3696
- C:\Windows\System\tOlncTv.exe
  C:\Windows\System\tOlncTv.exe
  2⤵
  PID:2212
- C:\Windows\System\ahYHZYo.exe
  C:\Windows\System\ahYHZYo.exe
  2⤵
  PID:1164
- C:\Windows\System\oDtwUOq.exe
  C:\Windows\System\oDtwUOq.exe
  2⤵
  PID:4312
- C:\Windows\System\YbKufrb.exe
  C:\Windows\System\YbKufrb.exe
  2⤵
  PID:2044
- C:\Windows\System\oDsklxG.exe
  C:\Windows\System\oDsklxG.exe
  2⤵
  PID:4280
- C:\Windows\System\IQTCKmx.exe
  C:\Windows\System\IQTCKmx.exe
  2⤵
  PID:4132
- C:\Windows\System\eIrumWP.exe
  C:\Windows\System\eIrumWP.exe
  2⤵
  PID:4360
- C:\Windows\System\WxryxTu.exe
  C:\Windows\System\WxryxTu.exe
  2⤵
  PID:4232
- C:\Windows\System\VfElzPL.exe
  C:\Windows\System\VfElzPL.exe
  2⤵
  PID:2536
- C:\Windows\System\cOlOhIP.exe
  C:\Windows\System\cOlOhIP.exe
  2⤵
  PID:4228
- C:\Windows\System\xstZzLY.exe
  C:\Windows\System\xstZzLY.exe
  2⤵
  PID:4396
- C:\Windows\System\cgHBRXo.exe
  C:\Windows\System\cgHBRXo.exe
  2⤵
  PID:4380
- C:\Windows\System\VrDKeod.exe
  C:\Windows\System\VrDKeod.exe
  2⤵
  PID:4412
- C:\Windows\System\WlxHpre.exe
  C:\Windows\System\WlxHpre.exe
  2⤵
  PID:4456
- C:\Windows\System\ysddOkG.exe
  C:\Windows\System\ysddOkG.exe
  2⤵
  PID:4436
- C:\Windows\System\ElMJlnO.exe
  C:\Windows\System\ElMJlnO.exe
  2⤵
  PID:4452
- C:\Windows\System\WrDWkOl.exe
  C:\Windows\System\WrDWkOl.exe
  2⤵
  PID:4472
- C:\Windows\System\QuuDQdS.exe
  C:\Windows\System\QuuDQdS.exe
  2⤵
  PID:4516
- C:\Windows\System\CHtuSyi.exe
  C:\Windows\System\CHtuSyi.exe
  2⤵
  PID:4548
- C:\Windows\System\WHLHrGh.exe
  C:\Windows\System\WHLHrGh.exe
  2⤵
  PID:4572
- C:\Windows\System\piWjhVS.exe
  C:\Windows\System\piWjhVS.exe
  2⤵
  PID:4640
- C:\Windows\System\EifhoBr.exe
  C:\Windows\System\EifhoBr.exe
  2⤵
  PID:4648
- C:\Windows\System\VQErOQW.exe
  C:\Windows\System\VQErOQW.exe
  2⤵
  PID:4660
- C:\Windows\System\AqpDhnV.exe
  C:\Windows\System\AqpDhnV.exe
  2⤵
  PID:1304
- C:\Windows\System\zFAvbHO.exe
  C:\Windows\System\zFAvbHO.exe
  2⤵
  PID:4720
- C:\Windows\System\roPuuOn.exe
  C:\Windows\System\roPuuOn.exe
  2⤵
  PID:4764
- C:\Windows\System\eXgVTNt.exe
  C:\Windows\System\eXgVTNt.exe
  2⤵
  PID:1148
- C:\Windows\System\xWEcCXW.exe
  C:\Windows\System\xWEcCXW.exe
  2⤵
  PID:4796
- C:\Windows\System\TWhLSzi.exe
  C:\Windows\System\TWhLSzi.exe
  2⤵
  PID:4816
- C:\Windows\System\azIMgSr.exe
  C:\Windows\System\azIMgSr.exe
  2⤵
  PID:4852
- C:\Windows\System\OeUCfuR.exe
  C:\Windows\System\OeUCfuR.exe
  2⤵
  PID:4896
- C:\Windows\System\IFvgfwJ.exe
  C:\Windows\System\IFvgfwJ.exe
  2⤵
  PID:4900
- C:\Windows\System\HGtTeaa.exe
  C:\Windows\System\HGtTeaa.exe
  2⤵
  PID:4928
- C:\Windows\System\iWrwEsW.exe
  C:\Windows\System\iWrwEsW.exe
  2⤵
  PID:4936
- C:\Windows\System\WvzDikd.exe
  C:\Windows\System\WvzDikd.exe
  2⤵
  PID:5000
- C:\Windows\System\OVIQznF.exe
  C:\Windows\System\OVIQznF.exe
  2⤵
  PID:4968
- C:\Windows\System\pfxbBGD.exe
  C:\Windows\System\pfxbBGD.exe
  2⤵
  PID:1956
- C:\Windows\System\AmwByFI.exe
  C:\Windows\System\AmwByFI.exe
  2⤵
  PID:3980
- C:\Windows\System\HxwYOUD.exe
  C:\Windows\System\HxwYOUD.exe
  2⤵
  PID:5080
- C:\Windows\System\NzmuuNG.exe
  C:\Windows\System\NzmuuNG.exe
  2⤵
  PID:932
- C:\Windows\System\wGYFYOH.exe
  C:\Windows\System\wGYFYOH.exe
  2⤵
  PID:3136
- C:\Windows\System\IDonAYu.exe
  C:\Windows\System\IDonAYu.exe
  2⤵
  PID:5044
- C:\Windows\System\jgCJbZE.exe
  C:\Windows\System\jgCJbZE.exe
  2⤵
  PID:3756
- C:\Windows\System\cYJsXWr.exe
  C:\Windows\System\cYJsXWr.exe
  2⤵
  PID:4292
- C:\Windows\System\shYANWN.exe
  C:\Windows\System\shYANWN.exe
  2⤵
  PID:3220
- C:\Windows\System\dJCaCjT.exe
  C:\Windows\System\dJCaCjT.exe
  2⤵
  PID:3732
- C:\Windows\System\fGqReTu.exe
  C:\Windows\System\fGqReTu.exe
  2⤵
  PID:4320
- C:\Windows\System\OquGrnh.exe
  C:\Windows\System\OquGrnh.exe
  2⤵
  PID:2556
- C:\Windows\System\EjdiUrv.exe
  C:\Windows\System\EjdiUrv.exe
  2⤵
  PID:1652
- C:\Windows\System\cNWVGkW.exe
  C:\Windows\System\cNWVGkW.exe
  2⤵
  PID:4148
- C:\Windows\System\CfVtGPA.exe
  C:\Windows\System\CfVtGPA.exe
  2⤵
  PID:2700
- C:\Windows\System\scLcrzO.exe
  C:\Windows\System\scLcrzO.exe
  2⤵
  PID:4208
- C:\Windows\System\SCpGggz.exe
  C:\Windows\System\SCpGggz.exe
  2⤵
  PID:3260
- C:\Windows\System\yUuDWRZ.exe
  C:\Windows\System\yUuDWRZ.exe
  2⤵
  PID:4196
- C:\Windows\System\uqLXKOY.exe
  C:\Windows\System\uqLXKOY.exe
  2⤵
  PID:4376
- C:\Windows\System\auPMYVx.exe
  C:\Windows\System\auPMYVx.exe
  2⤵
  PID:4448
- C:\Windows\System\uCyKoHg.exe
  C:\Windows\System\uCyKoHg.exe
  2⤵
  PID:4588
- C:\Windows\System\rfyqLCU.exe
  C:\Windows\System\rfyqLCU.exe
  2⤵
  PID:4620
- C:\Windows\System\NNWCIoP.exe
  C:\Windows\System\NNWCIoP.exe
  2⤵
  PID:4464
- C:\Windows\System\sJXvGTy.exe
  C:\Windows\System\sJXvGTy.exe
  2⤵
  PID:4920
- C:\Windows\System\EJzkHpI.exe
  C:\Windows\System\EJzkHpI.exe
  2⤵
  PID:4536
- C:\Windows\System\iRJpNzK.exe
  C:\Windows\System\iRJpNzK.exe
  2⤵
  PID:4708
- C:\Windows\System\ARfzcMh.exe
  C:\Windows\System\ARfzcMh.exe
  2⤵
  PID:4812
- C:\Windows\System\SHlALeE.exe
  C:\Windows\System\SHlALeE.exe
  2⤵
  PID:2296
- C:\Windows\System\nypZXZb.exe
  C:\Windows\System\nypZXZb.exe
  2⤵
  PID:4264
- C:\Windows\System\stDXAhv.exe
  C:\Windows\System\stDXAhv.exe
  2⤵
  PID:4248
- C:\Windows\System\bHAUXrI.exe
  C:\Windows\System\bHAUXrI.exe
  2⤵
  PID:5032
- C:\Windows\System\qlSufVq.exe
  C:\Windows\System\qlSufVq.exe
  2⤵
  PID:4332
- C:\Windows\System\jMMyXuq.exe
  C:\Windows\System\jMMyXuq.exe
  2⤵
  PID:5100
- C:\Windows\System\IiwYsjs.exe
  C:\Windows\System\IiwYsjs.exe
  2⤵
  PID:1984
- C:\Windows\System\CgWJQPq.exe
  C:\Windows\System\CgWJQPq.exe
  2⤵
  PID:2100
- C:\Windows\System\HubQxUH.exe
  C:\Windows\System\HubQxUH.exe
  2⤵
  PID:4748
- C:\Windows\System\BBFsOCB.exe
  C:\Windows\System\BBFsOCB.exe
  2⤵
  PID:4924
- C:\Windows\System\avHWYbe.exe
  C:\Windows\System\avHWYbe.exe
  2⤵
  PID:5076
- C:\Windows\System\rkQajLg.exe
  C:\Windows\System\rkQajLg.exe
  2⤵
  PID:4388
- C:\Windows\System\DTlfmPh.exe
  C:\Windows\System\DTlfmPh.exe
  2⤵
  PID:4496
- C:\Windows\System\oSdmgos.exe
  C:\Windows\System\oSdmgos.exe
  2⤵
  PID:4776
- C:\Windows\System\kppkBMx.exe
  C:\Windows\System\kppkBMx.exe
  2⤵
  PID:3528
- C:\Windows\System\lMHePHk.exe
  C:\Windows\System\lMHePHk.exe
  2⤵
  PID:4180
- C:\Windows\System\dJUeLUx.exe
  C:\Windows\System\dJUeLUx.exe
  2⤵
  PID:2800
- C:\Windows\System\KscmHKo.exe
  C:\Windows\System\KscmHKo.exe
  2⤵
  PID:548
- C:\Windows\System\HfdoXaz.exe
  C:\Windows\System\HfdoXaz.exe
  2⤵
  PID:4792
- C:\Windows\System\cnRcGAc.exe
  C:\Windows\System\cnRcGAc.exe
  2⤵
  PID:4848
- C:\Windows\System\zkympDA.exe
  C:\Windows\System\zkympDA.exe
  2⤵
  PID:4468
- C:\Windows\System\xaapPoc.exe
  C:\Windows\System\xaapPoc.exe
  2⤵
  PID:4592
- C:\Windows\System\ANqRhmz.exe
  C:\Windows\System\ANqRhmz.exe
  2⤵
  PID:4604
- C:\Windows\System\vcfPRDz.exe
  C:\Windows\System\vcfPRDz.exe
  2⤵
  PID:5128
- C:\Windows\System\WBJMPiY.exe
  C:\Windows\System\WBJMPiY.exe
  2⤵
  PID:5144
- C:\Windows\System\aRSJsVc.exe
  C:\Windows\System\aRSJsVc.exe
  2⤵
  PID:5232
- C:\Windows\System\GgrezIM.exe
  C:\Windows\System\GgrezIM.exe
  2⤵
  PID:5248
- C:\Windows\System\VBbOABL.exe
  C:\Windows\System\VBbOABL.exe
  2⤵
  PID:5264
- C:\Windows\System\gwkTuLA.exe
  C:\Windows\System\gwkTuLA.exe
  2⤵
  PID:5280
- C:\Windows\System\xZfcNns.exe
  C:\Windows\System\xZfcNns.exe
  2⤵
  PID:5296
- C:\Windows\System\zaylZLm.exe
  C:\Windows\System\zaylZLm.exe
  2⤵
  PID:5312
- C:\Windows\System\upgkeos.exe
  C:\Windows\System\upgkeos.exe
  2⤵
  PID:5328
- C:\Windows\System\OADlNNv.exe
  C:\Windows\System\OADlNNv.exe
  2⤵
  PID:5344
- C:\Windows\System\wKwkgiu.exe
  C:\Windows\System\wKwkgiu.exe
  2⤵
  PID:5360
- C:\Windows\System\MFYFJjv.exe
  C:\Windows\System\MFYFJjv.exe
  2⤵
  PID:5376
- C:\Windows\System\RVzjpME.exe
  C:\Windows\System\RVzjpME.exe
  2⤵
  PID:5392
- C:\Windows\System\QaiZJkS.exe
  C:\Windows\System\QaiZJkS.exe
  2⤵
  PID:5412
- C:\Windows\System\CzDLZHW.exe
  C:\Windows\System\CzDLZHW.exe
  2⤵
  PID:5428
- C:\Windows\System\BkAZSym.exe
  C:\Windows\System\BkAZSym.exe
  2⤵
  PID:5444
- C:\Windows\System\UgpMnZg.exe
  C:\Windows\System\UgpMnZg.exe
  2⤵
  PID:5460
- C:\Windows\System\OSCAWoV.exe
  C:\Windows\System\OSCAWoV.exe
  2⤵
  PID:5624
- C:\Windows\System\MialVcP.exe
  C:\Windows\System\MialVcP.exe
  2⤵
  PID:5640
- C:\Windows\System\sQRJvsl.exe
  C:\Windows\System\sQRJvsl.exe
  2⤵
  PID:5656
- C:\Windows\System\KAncWZD.exe
  C:\Windows\System\KAncWZD.exe
  2⤵
  PID:5672
- C:\Windows\System\RTWZvjz.exe
  C:\Windows\System\RTWZvjz.exe
  2⤵
  PID:5688
- C:\Windows\System\TKyYTpZ.exe
  C:\Windows\System\TKyYTpZ.exe
  2⤵
  PID:5704
- C:\Windows\System\nOnvqZU.exe
  C:\Windows\System\nOnvqZU.exe
  2⤵
  PID:5720
- C:\Windows\System\ZOnpDko.exe
  C:\Windows\System\ZOnpDko.exe
  2⤵
  PID:5736
- C:\Windows\System\sRlhnZv.exe
  C:\Windows\System\sRlhnZv.exe
  2⤵
  PID:5752
- C:\Windows\System\bgotzgq.exe
  C:\Windows\System\bgotzgq.exe
  2⤵
  PID:5768
- C:\Windows\System\sYewPUV.exe
  C:\Windows\System\sYewPUV.exe
  2⤵
  PID:5784
- C:\Windows\System\vpZieXT.exe
  C:\Windows\System\vpZieXT.exe
  2⤵
  PID:5804
- C:\Windows\System\dDfJeTb.exe
  C:\Windows\System\dDfJeTb.exe
  2⤵
  PID:5820
- C:\Windows\System\UynZAkI.exe
  C:\Windows\System\UynZAkI.exe
  2⤵
  PID:5836
- C:\Windows\System\cWcdlHQ.exe
  C:\Windows\System\cWcdlHQ.exe
  2⤵
  PID:5852
- C:\Windows\System\sNTQqrj.exe
  C:\Windows\System\sNTQqrj.exe
  2⤵
  PID:5868
- C:\Windows\System\suCcXuB.exe
  C:\Windows\System\suCcXuB.exe
  2⤵
  PID:5884
- C:\Windows\System\aMVEvIQ.exe
  C:\Windows\System\aMVEvIQ.exe
  2⤵
  PID:5960
- C:\Windows\System\cXGFoaQ.exe
  C:\Windows\System\cXGFoaQ.exe
  2⤵
  PID:5976
- C:\Windows\System\uTjJnjc.exe
  C:\Windows\System\uTjJnjc.exe
  2⤵
  PID:5992
- C:\Windows\System\SrlNmEE.exe
  C:\Windows\System\SrlNmEE.exe
  2⤵
  PID:6008
- C:\Windows\System\iSWqefX.exe
  C:\Windows\System\iSWqefX.exe
  2⤵
  PID:6024
- C:\Windows\System\jmfCque.exe
  C:\Windows\System\jmfCque.exe
  2⤵
  PID:6040
- C:\Windows\System\STybPgw.exe
  C:\Windows\System\STybPgw.exe
  2⤵
  PID:6060
- C:\Windows\System\idfqUgR.exe
  C:\Windows\System\idfqUgR.exe
  2⤵
  PID:6076
- C:\Windows\System\eKTMwbb.exe
  C:\Windows\System\eKTMwbb.exe
  2⤵
  PID:6092
- C:\Windows\System\PKpNjoj.exe
  C:\Windows\System\PKpNjoj.exe
  2⤵
  PID:6108
- C:\Windows\System\SWPMWSR.exe
  C:\Windows\System\SWPMWSR.exe
  2⤵
  PID:6128
- C:\Windows\System\UkdXjZV.exe
  C:\Windows\System\UkdXjZV.exe
  2⤵
  PID:4684
- C:\Windows\System\FkEfCqH.exe
  C:\Windows\System\FkEfCqH.exe
  2⤵
  PID:3472
- C:\Windows\System\HLyaksd.exe
  C:\Windows\System\HLyaksd.exe
  2⤵
  PID:4568
- C:\Windows\System\sJkxyQM.exe
  C:\Windows\System\sJkxyQM.exe
  2⤵
  PID:2880
- C:\Windows\System\cSXBZxj.exe
  C:\Windows\System\cSXBZxj.exe
  2⤵
  PID:5172
- C:\Windows\System\mYkABQL.exe
  C:\Windows\System\mYkABQL.exe
  2⤵
  PID:5276
- C:\Windows\System\BsPXZRe.exe
  C:\Windows\System\BsPXZRe.exe
  2⤵
  PID:5340
- C:\Windows\System\ULDidbd.exe
  C:\Windows\System\ULDidbd.exe
  2⤵
  PID:5372
- C:\Windows\System\PaEXSGu.exe
  C:\Windows\System\PaEXSGu.exe
  2⤵
  PID:5472
- C:\Windows\System\PkLyrBY.exe
  C:\Windows\System\PkLyrBY.exe
  2⤵
  PID:5484
- C:\Windows\System\SoycZIX.exe
  C:\Windows\System\SoycZIX.exe
  2⤵
  PID:5500
- C:\Windows\System\aYqRida.exe
  C:\Windows\System\aYqRida.exe
  2⤵
  PID:5176
- C:\Windows\System\RbFSiTP.exe
  C:\Windows\System\RbFSiTP.exe
  2⤵
  PID:2492
- C:\Windows\System\fSuEBRX.exe
  C:\Windows\System\fSuEBRX.exe
  2⤵
  PID:4432
- C:\Windows\System\McSgKSd.exe
  C:\Windows\System\McSgKSd.exe
  2⤵
  PID:5168
- C:\Windows\System\BpGkjOI.exe
  C:\Windows\System\BpGkjOI.exe
  2⤵
  PID:5200
- C:\Windows\System\khOAGqH.exe
  C:\Windows\System\khOAGqH.exe
  2⤵
  PID:5220
- C:\Windows\System\lhGXnEY.exe
  C:\Windows\System\lhGXnEY.exe
  2⤵
  PID:5256
- C:\Windows\System\vbCpuBR.exe
  C:\Windows\System\vbCpuBR.exe
  2⤵
  PID:5356
- C:\Windows\System\mZVhaAs.exe
  C:\Windows\System\mZVhaAs.exe
  2⤵
  PID:5420
- C:\Windows\System\gvYMTNR.exe
  C:\Windows\System\gvYMTNR.exe
  2⤵
  PID:4984
- C:\Windows\System\aGfVtGO.exe
  C:\Windows\System\aGfVtGO.exe
  2⤵
  PID:5532
- C:\Windows\System\dAnfPCV.exe
  C:\Windows\System\dAnfPCV.exe
  2⤵
  PID:5548
- C:\Windows\System\EfOziYH.exe
  C:\Windows\System\EfOziYH.exe
  2⤵
  PID:5520
- C:\Windows\System\VuWEJNt.exe
  C:\Windows\System\VuWEJNt.exe
  2⤵
  PID:5572
- C:\Windows\System\izihZRs.exe
  C:\Windows\System\izihZRs.exe
  2⤵
  PID:5580
- C:\Windows\System\UNwmPsv.exe
  C:\Windows\System\UNwmPsv.exe
  2⤵
  PID:5608
- C:\Windows\System\CMyrxGz.exe
  C:\Windows\System\CMyrxGz.exe
  2⤵
  PID:5616
- C:\Windows\System\kBINQSv.exe
  C:\Windows\System\kBINQSv.exe
  2⤵
  PID:5648
- C:\Windows\System\ZbxiNQm.exe
  C:\Windows\System\ZbxiNQm.exe
  2⤵
  PID:2364
- C:\Windows\System\YgOkdip.exe
  C:\Windows\System\YgOkdip.exe
  2⤵
  PID:5744
- C:\Windows\System\yBqjClC.exe
  C:\Windows\System\yBqjClC.exe
  2⤵
  PID:5812
- C:\Windows\System\nAOolAX.exe
  C:\Windows\System\nAOolAX.exe
  2⤵
  PID:5748
- C:\Windows\System\NWxOLsC.exe
  C:\Windows\System\NWxOLsC.exe
  2⤵
  PID:5892
- C:\Windows\System\qEXdwku.exe
  C:\Windows\System\qEXdwku.exe
  2⤵
  PID:6004
- C:\Windows\System\yjURGUI.exe
  C:\Windows\System\yjURGUI.exe
  2⤵
  PID:6072
- C:\Windows\System\GTLdTEq.exe
  C:\Windows\System\GTLdTEq.exe
  2⤵
  PID:6140
- C:\Windows\System\avymlZz.exe
  C:\Windows\System\avymlZz.exe
  2⤵
  PID:4892
- C:\Windows\System\qRlBELd.exe
  C:\Windows\System\qRlBELd.exe
  2⤵
  PID:5764
- C:\Windows\System\MuAOumf.exe
  C:\Windows\System\MuAOumf.exe
  2⤵
  PID:5832
- C:\Windows\System\MGYIvTE.exe
  C:\Windows\System\MGYIvTE.exe
  2⤵
  PID:6016
- C:\Windows\System\dJIUboa.exe
  C:\Windows\System\dJIUboa.exe
  2⤵
  PID:6084
- C:\Windows\System\UKEuzhH.exe
  C:\Windows\System\UKEuzhH.exe
  2⤵
  PID:5924
- C:\Windows\System\gqNCGDm.exe
  C:\Windows\System\gqNCGDm.exe
  2⤵
  PID:5940
- C:\Windows\System\KXgbAPw.exe
  C:\Windows\System\KXgbAPw.exe
  2⤵
  PID:5896
- C:\Windows\System\vuqqJYt.exe
  C:\Windows\System\vuqqJYt.exe
  2⤵
  PID:6056
- C:\Windows\System\JbgcPvp.exe
  C:\Windows\System\JbgcPvp.exe
  2⤵
  PID:4888
- C:\Windows\System\kEWPAgs.exe
  C:\Windows\System\kEWPAgs.exe
  2⤵
  PID:4704
- C:\Windows\System\sDsXBVY.exe
  C:\Windows\System\sDsXBVY.exe
  2⤵
  PID:2120
- C:\Windows\System\xPNxeUL.exe
  C:\Windows\System\xPNxeUL.exe
  2⤵
  PID:2836
- C:\Windows\System\UPBupyV.exe
  C:\Windows\System\UPBupyV.exe
  2⤵
  PID:3300
- C:\Windows\System\sgdztfm.exe
  C:\Windows\System\sgdztfm.exe
  2⤵
  PID:5336
- C:\Windows\System\BluQTAE.exe
  C:\Windows\System\BluQTAE.exe
  2⤵
  PID:4372
- C:\Windows\System\HYvtJzh.exe
  C:\Windows\System\HYvtJzh.exe
  2⤵
  PID:5216
- C:\Windows\System\xYARoEN.exe
  C:\Windows\System\xYARoEN.exe
  2⤵
  PID:6224
- C:\Windows\System\SUUbjjA.exe
  C:\Windows\System\SUUbjjA.exe
  2⤵
  PID:6240
- C:\Windows\System\ZNzAsTZ.exe
  C:\Windows\System\ZNzAsTZ.exe
  2⤵
  PID:6256
- C:\Windows\System\XdFPHTg.exe
  C:\Windows\System\XdFPHTg.exe
  2⤵
  PID:6272
- C:\Windows\System\imZOgBk.exe
  C:\Windows\System\imZOgBk.exe
  2⤵
  PID:6288
- C:\Windows\System\WPzJJHL.exe
  C:\Windows\System\WPzJJHL.exe
  2⤵
  PID:6304
- C:\Windows\System\FxORRlk.exe
  C:\Windows\System\FxORRlk.exe
  2⤵
  PID:6320
- C:\Windows\System\mfTlVef.exe
  C:\Windows\System\mfTlVef.exe
  2⤵
  PID:6336
- C:\Windows\System\vcAxgNK.exe
  C:\Windows\System\vcAxgNK.exe
  2⤵
  PID:6360
- C:\Windows\System\jgXMzRU.exe
  C:\Windows\System\jgXMzRU.exe
  2⤵
  PID:6376
- C:\Windows\System\UsqnpYI.exe
  C:\Windows\System\UsqnpYI.exe
  2⤵
  PID:6392
- C:\Windows\System\CackWvX.exe
  C:\Windows\System\CackWvX.exe
  2⤵
  PID:6408
- C:\Windows\System\FykbAmM.exe
  C:\Windows\System\FykbAmM.exe
  2⤵
  PID:6428
- C:\Windows\System\Huokvvz.exe
  C:\Windows\System\Huokvvz.exe
  2⤵
  PID:6444
- C:\Windows\System\AhYWmvt.exe
  C:\Windows\System\AhYWmvt.exe
  2⤵
  PID:6460
- C:\Windows\System\MARSvgu.exe
  C:\Windows\System\MARSvgu.exe
  2⤵
  PID:6476
- C:\Windows\System\BmqpyVe.exe
  C:\Windows\System\BmqpyVe.exe
  2⤵
  PID:6492
- C:\Windows\System\UdabIdB.exe
  C:\Windows\System\UdabIdB.exe
  2⤵
  PID:6508
- C:\Windows\System\cZaVlva.exe
  C:\Windows\System\cZaVlva.exe
  2⤵
  PID:6524
- C:\Windows\System\MopWrzL.exe
  C:\Windows\System\MopWrzL.exe
  2⤵
  PID:6540
- C:\Windows\System\adPLbaD.exe
  C:\Windows\System\adPLbaD.exe
  2⤵
  PID:6556
- C:\Windows\System\LMAZtGE.exe
  C:\Windows\System\LMAZtGE.exe
  2⤵
  PID:6572
- C:\Windows\System\QUWbiGq.exe
  C:\Windows\System\QUWbiGq.exe
  2⤵
  PID:6588
- C:\Windows\System\uQbbOnm.exe
  C:\Windows\System\uQbbOnm.exe
  2⤵
  PID:6604
- C:\Windows\System\RuxBDwu.exe
  C:\Windows\System\RuxBDwu.exe
  2⤵
  PID:6624
- C:\Windows\System\JmqVlhD.exe
  C:\Windows\System\JmqVlhD.exe
  2⤵
  PID:6640
- C:\Windows\System\PDNKCAa.exe
  C:\Windows\System\PDNKCAa.exe
  2⤵
  PID:6656
- C:\Windows\System\gOWUjke.exe
  C:\Windows\System\gOWUjke.exe
  2⤵
  PID:6776
- C:\Windows\System\VLWYBEQ.exe
  C:\Windows\System\VLWYBEQ.exe
  2⤵
  PID:6792
- C:\Windows\System\SqYFLfx.exe
  C:\Windows\System\SqYFLfx.exe
  2⤵
  PID:6812
- C:\Windows\System\FjLssCx.exe
  C:\Windows\System\FjLssCx.exe
  2⤵
  PID:6828
- C:\Windows\System\HIWmoRI.exe
  C:\Windows\System\HIWmoRI.exe
  2⤵
  PID:6844
- C:\Windows\System\tJISHBp.exe
  C:\Windows\System\tJISHBp.exe
  2⤵
  PID:6860
- C:\Windows\System\uDpXxJG.exe
  C:\Windows\System\uDpXxJG.exe
  2⤵
  PID:6876
- C:\Windows\System\qtyqnSD.exe
  C:\Windows\System\qtyqnSD.exe
  2⤵
  PID:6960
- C:\Windows\System\zvBinOW.exe
  C:\Windows\System\zvBinOW.exe
  2⤵
  PID:6976
- C:\Windows\System\bNabeNb.exe
  C:\Windows\System\bNabeNb.exe
  2⤵
  PID:6992
- C:\Windows\System\YkWzfSe.exe
  C:\Windows\System\YkWzfSe.exe
  2⤵
  PID:7008
- C:\Windows\System\JtxhYtZ.exe
  C:\Windows\System\JtxhYtZ.exe
  2⤵
  PID:7024
- C:\Windows\System\QAJaBBO.exe
  C:\Windows\System\QAJaBBO.exe
  2⤵
  PID:7072
- C:\Windows\System\lsrAwfq.exe
  C:\Windows\System\lsrAwfq.exe
  2⤵
  PID:7088
- C:\Windows\System\bXxSfmK.exe
  C:\Windows\System\bXxSfmK.exe
  2⤵
  PID:7104
- C:\Windows\System\nWcslOU.exe
  C:\Windows\System\nWcslOU.exe
  2⤵
  PID:7124
- C:\Windows\System\oMHNdxd.exe
  C:\Windows\System\oMHNdxd.exe
  2⤵
  PID:7140
- C:\Windows\System\mHnknCg.exe
  C:\Windows\System\mHnknCg.exe
  2⤵
  PID:5516
- C:\Windows\System\CqFokLV.exe
  C:\Windows\System\CqFokLV.exe
  2⤵
  PID:5544
- C:\Windows\System\uvzGZYd.exe
  C:\Windows\System\uvzGZYd.exe
  2⤵
  PID:5324
- C:\Windows\System\cZINRFT.exe
  C:\Windows\System\cZINRFT.exe
  2⤵
  PID:6104
- C:\Windows\System\lcrbwol.exe
  C:\Windows\System\lcrbwol.exe
  2⤵
  PID:5848
- C:\Windows\System\mLRwrzK.exe
  C:\Windows\System\mLRwrzK.exe
  2⤵
  PID:5496
- C:\Windows\System\nGBphqh.exe
  C:\Windows\System\nGBphqh.exe
  2⤵
  PID:5828
- C:\Windows\System\SbqYHwS.exe
  C:\Windows\System\SbqYHwS.exe
  2⤵
  PID:5936
- C:\Windows\System\YdBONtz.exe
  C:\Windows\System\YdBONtz.exe
  2⤵
  PID:6048
- C:\Windows\System\kTSdNhk.exe
  C:\Windows\System\kTSdNhk.exe
  2⤵
  PID:5476
- C:\Windows\System\bbyhmDO.exe
  C:\Windows\System\bbyhmDO.exe
  2⤵
  PID:5164
- C:\Windows\System\kMOUSjw.exe
  C:\Windows\System\kMOUSjw.exe
  2⤵
  PID:5212
- C:\Windows\System\XzUSCdk.exe
  C:\Windows\System\XzUSCdk.exe
  2⤵
  PID:5760
- C:\Windows\System\ojmzbyj.exe
  C:\Windows\System\ojmzbyj.exe
  2⤵
  PID:5904
- C:\Windows\System\TXYqPGR.exe
  C:\Windows\System\TXYqPGR.exe
  2⤵
  PID:5952
- C:\Windows\System\NccUZxg.exe
  C:\Windows\System\NccUZxg.exe
  2⤵
  PID:4176
- C:\Windows\System\cHnPuBz.exe
  C:\Windows\System\cHnPuBz.exe
  2⤵
  PID:6152
- C:\Windows\System\ZMBbbGd.exe
  C:\Windows\System\ZMBbbGd.exe
  2⤵
  PID:6176
- C:\Windows\System\yXVUMzd.exe
  C:\Windows\System\yXVUMzd.exe
  2⤵
  PID:5588
- C:\Windows\System\EXjfKaR.exe
  C:\Windows\System\EXjfKaR.exe
  2⤵
  PID:5400
- C:\Windows\System\sJdKLRu.exe
  C:\Windows\System\sJdKLRu.exe
  2⤵
  PID:5512
- C:\Windows\System\esaRVQB.exe
  C:\Windows\System\esaRVQB.exe
  2⤵
  PID:6216
- C:\Windows\System\kMSpBBv.exe
  C:\Windows\System\kMSpBBv.exe
  2⤵
  PID:5192
- C:\Windows\System\LKUjhPk.exe
  C:\Windows\System\LKUjhPk.exe
  2⤵
  PID:6220
- C:\Windows\System\NkHvoBg.exe
  C:\Windows\System\NkHvoBg.exe
  2⤵
  PID:6332
- C:\Windows\System\GvzVWsm.exe
  C:\Windows\System\GvzVWsm.exe
  2⤵
  PID:6400
- C:\Windows\System\gYhvYMB.exe
  C:\Windows\System\gYhvYMB.exe
  2⤵
  PID:6440
- C:\Windows\System\fVpYMZz.exe
  C:\Windows\System\fVpYMZz.exe
  2⤵
  PID:6352
- C:\Windows\System\NWqmZWe.exe
  C:\Windows\System\NWqmZWe.exe
  2⤵
  PID:6536
- C:\Windows\System\wUyDxsN.exe
  C:\Windows\System\wUyDxsN.exe
  2⤵
  PID:6552
- C:\Windows\System\ElukHKj.exe
  C:\Windows\System\ElukHKj.exe
  2⤵
  PID:6316
- C:\Windows\System\avVVnlo.exe
  C:\Windows\System\avVVnlo.exe
  2⤵
  PID:6516
- C:\Windows\System\fVyghoa.exe
  C:\Windows\System\fVyghoa.exe
  2⤵
  PID:6672
- C:\Windows\System\voGvLkK.exe
  C:\Windows\System\voGvLkK.exe
  2⤵
  PID:6680
- C:\Windows\System\bywvxuG.exe
  C:\Windows\System\bywvxuG.exe
  2⤵
  PID:6700
- C:\Windows\System\bgICnfg.exe
  C:\Windows\System\bgICnfg.exe
  2⤵
  PID:6708
- C:\Windows\System\GpDdeUu.exe
  C:\Windows\System\GpDdeUu.exe
  2⤵
  PID:6732
- C:\Windows\System\LNJuoCb.exe
  C:\Windows\System\LNJuoCb.exe
  2⤵
  PID:6744
- C:\Windows\System\WiFZvXz.exe
  C:\Windows\System\WiFZvXz.exe
  2⤵
  PID:6760
- C:\Windows\System\JsbKYpr.exe
  C:\Windows\System\JsbKYpr.exe
  2⤵
  PID:6784
- C:\Windows\System\GZYmJEV.exe
  C:\Windows\System\GZYmJEV.exe
  2⤵
  PID:6852
- C:\Windows\System\KFAPUNm.exe
  C:\Windows\System\KFAPUNm.exe
  2⤵
  PID:6868
- C:\Windows\System\aMuvfBU.exe
  C:\Windows\System\aMuvfBU.exe
  2⤵
  PID:6900
- C:\Windows\System\lzqAzft.exe
  C:\Windows\System\lzqAzft.exe
  2⤵
  PID:6888
- C:\Windows\System\MUmsYJM.exe
  C:\Windows\System\MUmsYJM.exe
  2⤵
  PID:6920
- C:\Windows\System\wOuFUlX.exe
  C:\Windows\System\wOuFUlX.exe
  2⤵
  PID:6940
- C:\Windows\System\PKJDaUZ.exe
  C:\Windows\System\PKJDaUZ.exe
  2⤵
  PID:7040
- C:\Windows\System\eRagIdC.exe
  C:\Windows\System\eRagIdC.exe
  2⤵
  PID:6956
- C:\Windows\System\uuuDUbS.exe
  C:\Windows\System\uuuDUbS.exe
  2⤵
  PID:7020
- C:\Windows\System\LAtCSpG.exe
  C:\Windows\System\LAtCSpG.exe
  2⤵
  PID:7064
- C:\Windows\System\ZOPIRbv.exe
  C:\Windows\System\ZOPIRbv.exe
  2⤵
  PID:7152
- C:\Windows\System\uWLJvav.exe
  C:\Windows\System\uWLJvav.exe
  2⤵
  PID:5320
- C:\Windows\System\vXnDhwy.exe
  C:\Windows\System\vXnDhwy.exe
  2⤵
  PID:7096
- C:\Windows\System\DuJTVam.exe
  C:\Windows\System\DuJTVam.exe
  2⤵
  PID:5700
- C:\Windows\System\MUdqIOR.exe
  C:\Windows\System\MUdqIOR.exe
  2⤵
  PID:4836
- C:\Windows\System\OSUKNhq.exe
  C:\Windows\System\OSUKNhq.exe
  2⤵
  PID:5920
- C:\Windows\System\JpIbyQA.exe
  C:\Windows\System\JpIbyQA.exe
  2⤵
  PID:7136
- C:\Windows\System\HMxNYtp.exe
  C:\Windows\System\HMxNYtp.exe
  2⤵
  PID:5680
- C:\Windows\System\NoKlRXV.exe
  C:\Windows\System\NoKlRXV.exe
  2⤵
  PID:5524
- C:\Windows\System\ASifwVO.exe
  C:\Windows\System\ASifwVO.exe
  2⤵
  PID:5384
- C:\Windows\System\LRmCryI.exe
  C:\Windows\System\LRmCryI.exe
  2⤵
  PID:6200
- C:\Windows\System\vFtZqkg.exe
  C:\Windows\System\vFtZqkg.exe
  2⤵
  PID:6188
- C:\Windows\System\IhwqNfF.exe
  C:\Windows\System\IhwqNfF.exe
  2⤵
  PID:6284
- C:\Windows\System\ZERYRAK.exe
  C:\Windows\System\ZERYRAK.exe
  2⤵
  PID:5776
- C:\Windows\System\twrzXQl.exe
  C:\Windows\System\twrzXQl.exe
  2⤵
  PID:6036
- C:\Windows\System\muMpSvq.exe
  C:\Windows\System\muMpSvq.exe
  2⤵
  PID:5988
- C:\Windows\System\oCAyQZu.exe
  C:\Windows\System\oCAyQZu.exe
  2⤵
  PID:6248
- C:\Windows\System\cfpRHXk.exe
  C:\Windows\System\cfpRHXk.exe
  2⤵
  PID:5488
- C:\Windows\System\lPHyftl.exe
  C:\Windows\System\lPHyftl.exe
  2⤵
  PID:6456
- C:\Windows\System\jOyqOCH.exe
  C:\Windows\System\jOyqOCH.exe
  2⤵
  PID:6548
- C:\Windows\System\YLkjLnS.exe
  C:\Windows\System\YLkjLnS.exe
  2⤵
  PID:6616
- C:\Windows\System\KHQTZRI.exe
  C:\Windows\System\KHQTZRI.exe
  2⤵
  PID:6424
- C:\Windows\System\PGWtkxq.exe
  C:\Windows\System\PGWtkxq.exe
  2⤵
  PID:6300
- C:\Windows\System\FApSuRi.exe
  C:\Windows\System\FApSuRi.exe
  2⤵
  PID:6748
- C:\Windows\System\WrBPuqX.exe
  C:\Windows\System\WrBPuqX.exe
  2⤵
  PID:6856
- C:\Windows\System\qocMmNn.exe
  C:\Windows\System\qocMmNn.exe
  2⤵
  PID:6768
- C:\Windows\System\mQieItQ.exe
  C:\Windows\System\mQieItQ.exe
  2⤵
  PID:6728
- C:\Windows\System\PMzPeAV.exe
  C:\Windows\System\PMzPeAV.exe
  2⤵
  PID:5636
- C:\Windows\System\boyLUSq.exe
  C:\Windows\System\boyLUSq.exe
  2⤵
  PID:6772
- C:\Windows\System\pbuGVOr.exe
  C:\Windows\System\pbuGVOr.exe
  2⤵
  PID:6124
- C:\Windows\System\TptQIxI.exe
  C:\Windows\System\TptQIxI.exe
  2⤵
  PID:7004
- C:\Windows\System\KccdFMo.exe
  C:\Windows\System\KccdFMo.exe
  2⤵
  PID:7000
- C:\Windows\System\RjFDXGT.exe
  C:\Windows\System\RjFDXGT.exe
  2⤵
  PID:6988
- C:\Windows\System\PwFDCPe.exe
  C:\Windows\System\PwFDCPe.exe
  2⤵
  PID:3312
- C:\Windows\System\RbLSldr.exe
  C:\Windows\System\RbLSldr.exe
  2⤵
  PID:7116
- C:\Windows\System\wqfXcKA.exe
  C:\Windows\System\wqfXcKA.exe
  2⤵
  PID:6500
- C:\Windows\System\ZcbgqOR.exe
  C:\Windows\System\ZcbgqOR.exe
  2⤵
  PID:3316
- C:\Windows\System\WiHPkgp.exe
  C:\Windows\System\WiHPkgp.exe
  2⤵
  PID:5244
- C:\Windows\System\rtJfcqT.exe
  C:\Windows\System\rtJfcqT.exe
  2⤵
  PID:5180
- C:\Windows\System\wUQmzsZ.exe
  C:\Windows\System\wUQmzsZ.exe
  2⤵
  PID:6472
- C:\Windows\System\hyQcwTd.exe
  C:\Windows\System\hyQcwTd.exe
  2⤵
  PID:4624
- C:\Windows\System\KoikvSr.exe
  C:\Windows\System\KoikvSr.exe
  2⤵
  PID:5900
- C:\Windows\System\zZaVJRu.exe
  C:\Windows\System\zZaVJRu.exe
  2⤵
  PID:5504
- C:\Windows\System\jaOWoMk.exe
  C:\Windows\System\jaOWoMk.exe
  2⤵
  PID:4408
- C:\Windows\System\KevSjja.exe
  C:\Windows\System\KevSjja.exe
  2⤵
  PID:6184
- C:\Windows\System\FjtROoc.exe
  C:\Windows\System\FjtROoc.exe
  2⤵
  PID:6532
- C:\Windows\System\vCvRAXN.exe
  C:\Windows\System\vCvRAXN.exe
  2⤵
  PID:5844
- C:\Windows\System\AiedGgZ.exe
  C:\Windows\System\AiedGgZ.exe
  2⤵
  PID:6032
- C:\Windows\System\ROljpJg.exe
  C:\Windows\System\ROljpJg.exe
  2⤵
  PID:5540
- C:\Windows\System\vEWDnZP.exe
  C:\Windows\System\vEWDnZP.exe
  2⤵
  PID:6164
- C:\Windows\System\kQOLhye.exe
  C:\Windows\System\kQOLhye.exe
  2⤵
  PID:5260
- C:\Windows\System\JMQGhRX.exe
  C:\Windows\System\JMQGhRX.exe
  2⤵
  PID:5668
- C:\Windows\System\VKrOBKA.exe
  C:\Windows\System\VKrOBKA.exe
  2⤵
  PID:6232
- C:\Windows\System\ZZpZOoK.exe
  C:\Windows\System\ZZpZOoK.exe
  2⤵
  PID:6724
- C:\Windows\System\YXGJNfM.exe
  C:\Windows\System\YXGJNfM.exe
  2⤵
  PID:6948
- C:\Windows\System\SjCCZDl.exe
  C:\Windows\System\SjCCZDl.exe
  2⤵
  PID:6356
- C:\Windows\System\bnfOFmM.exe
  C:\Windows\System\bnfOFmM.exe
  2⤵
  PID:6156
- C:\Windows\System\GCvPqFp.exe
  C:\Windows\System\GCvPqFp.exe
  2⤵
  PID:6704
- C:\Windows\System\gDZMrNC.exe
  C:\Windows\System\gDZMrNC.exe
  2⤵
  PID:6972
- C:\Windows\System\jortNht.exe
  C:\Windows\System\jortNht.exe
  2⤵
  PID:7132
- C:\Windows\System\MdsZMLN.exe
  C:\Windows\System\MdsZMLN.exe
  2⤵
  PID:5732
- C:\Windows\System\DwXRTDE.exe
  C:\Windows\System\DwXRTDE.exe
  2⤵
  PID:5912
- C:\Windows\System\WAimNXq.exe
  C:\Windows\System\WAimNXq.exe
  2⤵
  PID:6688
- C:\Windows\System\yrZZBSr.exe
  C:\Windows\System\yrZZBSr.exe
  2⤵
  PID:6740
- C:\Windows\System\ArLbUwq.exe
  C:\Windows\System\ArLbUwq.exe
  2⤵
  PID:6936
- C:\Windows\System\xJulNfN.exe
  C:\Windows\System\xJulNfN.exe
  2⤵
  PID:7112
- C:\Windows\System\GlYxflL.exe
  C:\Windows\System\GlYxflL.exe
  2⤵
  PID:6136
- C:\Windows\System\fvAWanQ.exe
  C:\Windows\System\fvAWanQ.exe
  2⤵
  PID:6804
- C:\Windows\System\EgdHwkb.exe
  C:\Windows\System\EgdHwkb.exe
  2⤵
  PID:6612
- C:\Windows\System\RrnWosU.exe
  C:\Windows\System\RrnWosU.exe
  2⤵
  PID:2964
- C:\Windows\System\bvaPfrg.exe
  C:\Windows\System\bvaPfrg.exe
  2⤵
  PID:3004
- C:\Windows\System\XFhFgKZ.exe
  C:\Windows\System\XFhFgKZ.exe
  2⤵
  PID:7172
- C:\Windows\System\cBbYvLQ.exe
  C:\Windows\System\cBbYvLQ.exe
  2⤵
  PID:7188
- C:\Windows\System\xJdaybm.exe
  C:\Windows\System\xJdaybm.exe
  2⤵
  PID:7204
- C:\Windows\System\WmzqcZK.exe
  C:\Windows\System\WmzqcZK.exe
  2⤵
  PID:7224
- C:\Windows\System\zNAsVqw.exe
  C:\Windows\System\zNAsVqw.exe
  2⤵
  PID:7240
- C:\Windows\System\OwSpDLu.exe
  C:\Windows\System\OwSpDLu.exe
  2⤵
  PID:7256
- C:\Windows\System\SHsOiiY.exe
  C:\Windows\System\SHsOiiY.exe
  2⤵
  PID:7272
- C:\Windows\System\jEDVkkb.exe
  C:\Windows\System\jEDVkkb.exe
  2⤵
  PID:7288
- C:\Windows\System\gTtzLjv.exe
  C:\Windows\System\gTtzLjv.exe
  2⤵
  PID:7304
- C:\Windows\System\mTdmIDu.exe
  C:\Windows\System\mTdmIDu.exe
  2⤵
  PID:7320
- C:\Windows\System\xunvlEV.exe
  C:\Windows\System\xunvlEV.exe
  2⤵
  PID:7336
- C:\Windows\System\yioGOTZ.exe
  C:\Windows\System\yioGOTZ.exe
  2⤵
  PID:7352
- C:\Windows\System\igIThsK.exe
  C:\Windows\System\igIThsK.exe
  2⤵
  PID:7368
- C:\Windows\System\WUsTszP.exe
  C:\Windows\System\WUsTszP.exe
  2⤵
  PID:7384
- C:\Windows\System\iiCSvKc.exe
  C:\Windows\System\iiCSvKc.exe
  2⤵
  PID:7400
- C:\Windows\System\hRvAxaP.exe
  C:\Windows\System\hRvAxaP.exe
  2⤵
  PID:7420
- C:\Windows\System\sWyYTMp.exe
  C:\Windows\System\sWyYTMp.exe
  2⤵
  PID:7440
- C:\Windows\System\tYsMHTK.exe
  C:\Windows\System\tYsMHTK.exe
  2⤵
  PID:7456
- C:\Windows\System\ZLIVRZy.exe
  C:\Windows\System\ZLIVRZy.exe
  2⤵
  PID:7472
- C:\Windows\System\mdDzBAk.exe
  C:\Windows\System\mdDzBAk.exe
  2⤵
  PID:7488
- C:\Windows\System\JjTaLqx.exe
  C:\Windows\System\JjTaLqx.exe
  2⤵
  PID:7516
- C:\Windows\System\tBGeAcU.exe
  C:\Windows\System\tBGeAcU.exe
  2⤵
  PID:7532
- C:\Windows\System\sMYEGgF.exe
  C:\Windows\System\sMYEGgF.exe
  2⤵
  PID:7548
- C:\Windows\System\ZWzJXif.exe
  C:\Windows\System\ZWzJXif.exe
  2⤵
  PID:7564
- C:\Windows\System\RZIFNcP.exe
  C:\Windows\System\RZIFNcP.exe
  2⤵
  PID:7580
- C:\Windows\System\EGlqyOA.exe
  C:\Windows\System\EGlqyOA.exe
  2⤵
  PID:7600
- C:\Windows\System\sZJIWum.exe
  C:\Windows\System\sZJIWum.exe
  2⤵
  PID:7616
- C:\Windows\System\CeTPLIs.exe
  C:\Windows\System\CeTPLIs.exe
  2⤵
  PID:7632
- C:\Windows\System\KmgsUna.exe
  C:\Windows\System\KmgsUna.exe
  2⤵
  PID:7648
- C:\Windows\System\rdSItyz.exe
  C:\Windows\System\rdSItyz.exe
  2⤵
  PID:7664
- C:\Windows\System\QJiboVA.exe
  C:\Windows\System\QJiboVA.exe
  2⤵
  PID:7680
- C:\Windows\System\QskyGzn.exe
  C:\Windows\System\QskyGzn.exe
  2⤵
  PID:7696
- C:\Windows\System\ORYEeHM.exe
  C:\Windows\System\ORYEeHM.exe
  2⤵
  PID:7712
- C:\Windows\System\qbnlxTy.exe
  C:\Windows\System\qbnlxTy.exe
  2⤵
  PID:7728
- C:\Windows\System\xfUiViH.exe
  C:\Windows\System\xfUiViH.exe
  2⤵
  PID:7744
- C:\Windows\System\PMwtMix.exe
  C:\Windows\System\PMwtMix.exe
  2⤵
  PID:7760
- C:\Windows\System\CYdYsZR.exe
  C:\Windows\System\CYdYsZR.exe
  2⤵
  PID:7776
- C:\Windows\System\lnCfPax.exe
  C:\Windows\System\lnCfPax.exe
  2⤵
  PID:7792
- C:\Windows\System\YlBRBfy.exe
  C:\Windows\System\YlBRBfy.exe
  2⤵
  PID:7808
- C:\Windows\System\TtKFTvf.exe
  C:\Windows\System\TtKFTvf.exe
  2⤵
  PID:7832
- C:\Windows\System\eJgEEDI.exe
  C:\Windows\System\eJgEEDI.exe
  2⤵
  PID:7848
- C:\Windows\System\PtCXCpI.exe
  C:\Windows\System\PtCXCpI.exe
  2⤵
  PID:7864
- C:\Windows\System\QWBGaVN.exe
  C:\Windows\System\QWBGaVN.exe
  2⤵
  PID:7880
- C:\Windows\System\IkDTXeW.exe
  C:\Windows\System\IkDTXeW.exe
  2⤵
  PID:7900
- C:\Windows\System\apApLEJ.exe
  C:\Windows\System\apApLEJ.exe
  2⤵
  PID:7916
- C:\Windows\System\ZcjUxjd.exe
  C:\Windows\System\ZcjUxjd.exe
  2⤵
  PID:7932
- C:\Windows\System\IaXwdvr.exe
  C:\Windows\System\IaXwdvr.exe
  2⤵
  PID:7948
- C:\Windows\System\mobcKfr.exe
  C:\Windows\System\mobcKfr.exe
  2⤵
  PID:7964
- C:\Windows\System\zWqDhnr.exe
  C:\Windows\System\zWqDhnr.exe
  2⤵
  PID:7980
- C:\Windows\System\MkZdMiC.exe
  C:\Windows\System\MkZdMiC.exe
  2⤵
  PID:7996
- C:\Windows\System\kHiHpHY.exe
  C:\Windows\System\kHiHpHY.exe
  2⤵
  PID:8016
- C:\Windows\System\BLDCSXY.exe
  C:\Windows\System\BLDCSXY.exe
  2⤵
  PID:8036
- C:\Windows\System\AtooGWO.exe
  C:\Windows\System\AtooGWO.exe
  2⤵
  PID:3232
- C:\Windows\System\SRNEaRs.exe
  C:\Windows\System\SRNEaRs.exe
  2⤵
  PID:7052
- C:\Windows\System\nxfJHqh.exe
  C:\Windows\System\nxfJHqh.exe
  2⤵
  PID:6172
- C:\Windows\System\aoOkvYk.exe
  C:\Windows\System\aoOkvYk.exe
  2⤵
  PID:7200
- C:\Windows\System\tSDNrFo.exe
  C:\Windows\System\tSDNrFo.exe
  2⤵
  PID:7296
- C:\Windows\System\iwDqouQ.exe
  C:\Windows\System\iwDqouQ.exe
  2⤵
  PID:7360
- C:\Windows\System\eMPwdWU.exe
  C:\Windows\System\eMPwdWU.exe
  2⤵
  PID:7428
- C:\Windows\System\xAohElt.exe
  C:\Windows\System\xAohElt.exe
  2⤵
  PID:7496
- C:\Windows\System\eDExwGJ.exe
  C:\Windows\System\eDExwGJ.exe
  2⤵
  PID:7512
- C:\Windows\System\UBnyfIx.exe
  C:\Windows\System\UBnyfIx.exe
  2⤵
  PID:7544
- C:\Windows\System\ffvqJnB.exe
  C:\Windows\System\ffvqJnB.exe
  2⤵
  PID:7640
- C:\Windows\System\jUNitCV.exe
  C:\Windows\System\jUNitCV.exe
  2⤵
  PID:7800
- C:\Windows\System\pPsDbKY.exe
  C:\Windows\System\pPsDbKY.exe
  2⤵
  PID:7804
- C:\Windows\System\OYcbTvQ.exe
  C:\Windows\System\OYcbTvQ.exe
  2⤵
  PID:7480
- C:\Windows\System\TkfzEkL.exe
  C:\Windows\System\TkfzEkL.exe
  2⤵
  PID:7560
- C:\Windows\System\SAyHdVc.exe
  C:\Windows\System\SAyHdVc.exe
  2⤵
  PID:7872
- C:\Windows\System\ZDcyOlu.exe
  C:\Windows\System\ZDcyOlu.exe
  2⤵
  PID:7656
- C:\Windows\System\aEzqEyE.exe
  C:\Windows\System\aEzqEyE.exe
  2⤵
  PID:7720
- C:\Windows\System\SFOsMKG.exe
  C:\Windows\System\SFOsMKG.exe
  2⤵
  PID:7788
- C:\Windows\System\srHwuYI.exe
  C:\Windows\System\srHwuYI.exe
  2⤵
  PID:7408
- C:\Windows\System\qtAbyxt.exe
  C:\Windows\System\qtAbyxt.exe
  2⤵
  PID:7892
- C:\Windows\System\jfOKFZX.exe
  C:\Windows\System\jfOKFZX.exe
  2⤵
  PID:7860
- C:\Windows\System\rOcflwh.exe
  C:\Windows\System\rOcflwh.exe
  2⤵
  PID:7928
- C:\Windows\System\cKdYsJZ.exe
  C:\Windows\System\cKdYsJZ.exe
  2⤵
  PID:8004
- C:\Windows\System\lJpMiUM.exe
  C:\Windows\System\lJpMiUM.exe
  2⤵
  PID:7988
- C:\Windows\System\sWjFIJI.exe
  C:\Windows\System\sWjFIJI.exe
  2⤵
  PID:8028
- C:\Windows\System\wAYVPQe.exe
  C:\Windows\System\wAYVPQe.exe
  2⤵
  PID:8044
- C:\Windows\System\HcVKaIu.exe
  C:\Windows\System\HcVKaIu.exe
  2⤵
  PID:8176
- C:\Windows\System\rJZsruv.exe
  C:\Windows\System\rJZsruv.exe
  2⤵
  PID:8080
- C:\Windows\System\PBUlUMb.exe
  C:\Windows\System\PBUlUMb.exe
  2⤵
  PID:8096
- C:\Windows\System\OUGMHvO.exe
  C:\Windows\System\OUGMHvO.exe
  2⤵
  PID:8112
- C:\Windows\System\QvGRKBg.exe
  C:\Windows\System\QvGRKBg.exe
  2⤵
  PID:8128
- C:\Windows\System\eBIytVa.exe
  C:\Windows\System\eBIytVa.exe
  2⤵
  PID:8144
- C:\Windows\System\QTsvzhl.exe
  C:\Windows\System\QTsvzhl.exe
  2⤵
  PID:7216
- C:\Windows\System\hVDGNfh.exe
  C:\Windows\System\hVDGNfh.exe
  2⤵
  PID:6896
- C:\Windows\System\KddFsvh.exe
  C:\Windows\System\KddFsvh.exe
  2⤵
  PID:6632
- C:\Windows\System\RGLqtTG.exe
  C:\Windows\System\RGLqtTG.exe
  2⤵
  PID:2812
- C:\Windows\System\lIFtnin.exe
  C:\Windows\System\lIFtnin.exe
  2⤵
  PID:7436
- C:\Windows\System\Nbvjshv.exe
  C:\Windows\System\Nbvjshv.exe
  2⤵
  PID:7348
- C:\Windows\System\spWavFJ.exe
  C:\Windows\System\spWavFJ.exe
  2⤵
  PID:7312
- C:\Windows\System\fauldWW.exe
  C:\Windows\System\fauldWW.exe
  2⤵
  PID:7236
- C:\Windows\System\CqESIoB.exe
  C:\Windows\System\CqESIoB.exe
  2⤵
  PID:7392
- C:\Windows\System\FylLlfG.exe
  C:\Windows\System\FylLlfG.exe
  2⤵
  PID:7672
- C:\Windows\System\QuKtNBe.exe
  C:\Windows\System\QuKtNBe.exe
  2⤵
  PID:7772
- C:\Windows\System\iriMlkk.exe
  C:\Windows\System\iriMlkk.exe
  2⤵
  PID:7596
- C:\Windows\System\yueKDDa.exe
  C:\Windows\System\yueKDDa.exe
  2⤵
  PID:7820
- C:\Windows\System\amhVyMs.exe
  C:\Windows\System\amhVyMs.exe
  2⤵
  PID:7972
- C:\Windows\System\wkAEKiZ.exe
  C:\Windows\System\wkAEKiZ.exe
  2⤵
  PID:7344
- C:\Windows\System\QfFqaio.exe
  C:\Windows\System\QfFqaio.exe
  2⤵
  PID:7752
- C:\Windows\System\ZKIoinN.exe
  C:\Windows\System\ZKIoinN.exe
  2⤵
  PID:8188
- C:\Windows\System\NqmtKXa.exe
  C:\Windows\System\NqmtKXa.exe
  2⤵
  PID:7556
- C:\Windows\System\KfUJoPS.exe
  C:\Windows\System\KfUJoPS.exe
  2⤵
  PID:8184
- C:\Windows\System\BFgJJAU.exe
  C:\Windows\System\BFgJJAU.exe
  2⤵
  PID:6944
- C:\Windows\System\PyPLcSr.exe
  C:\Windows\System\PyPLcSr.exe
  2⤵
  PID:8052
- C:\Windows\System\rMrmxoQ.exe
  C:\Windows\System\rMrmxoQ.exe
  2⤵
  PID:8064
- C:\Windows\System\poOIEYO.exe
  C:\Windows\System\poOIEYO.exe
  2⤵
  PID:8076
- C:\Windows\System\bhHsGwp.exe
  C:\Windows\System\bhHsGwp.exe
  2⤵
  PID:8152
- C:\Windows\System\rKNdZPL.exe
  C:\Windows\System\rKNdZPL.exe
  2⤵
  PID:8136
- C:\Windows\System\SZqmSMu.exe
  C:\Windows\System\SZqmSMu.exe
  2⤵
  PID:7284
- C:\Windows\System\roEuMnj.exe
  C:\Windows\System\roEuMnj.exe
  2⤵
  PID:5480
- C:\Windows\System\ddkOlCS.exe
  C:\Windows\System\ddkOlCS.exe
  2⤵
  PID:5136
- C:\Windows\System\McesIMm.exe
  C:\Windows\System\McesIMm.exe
  2⤵
  PID:7688
- C:\Windows\System\vLHtbnY.exe
  C:\Windows\System\vLHtbnY.exe
  2⤵
  PID:8024
- C:\Windows\System\fjHFoYe.exe
  C:\Windows\System\fjHFoYe.exe
  2⤵
  PID:7876
- C:\Windows\System\JVtrFkd.exe
  C:\Windows\System\JVtrFkd.exe
  2⤵
  PID:7220
- C:\Windows\System\uxIWXdQ.exe
  C:\Windows\System\uxIWXdQ.exe
  2⤵
  PID:7572
- C:\Windows\System\msIYUcU.exe
  C:\Windows\System\msIYUcU.exe
  2⤵
  PID:5288
- C:\Windows\System\oauySKI.exe
  C:\Windows\System\oauySKI.exe
  2⤵
  PID:7608
- C:\Windows\System\FyGglgV.exe
  C:\Windows\System\FyGglgV.exe
  2⤵
  PID:7396
- C:\Windows\System\bObQmNl.exe
  C:\Windows\System\bObQmNl.exe
  2⤵
  PID:8172
- C:\Windows\System\YVyfFDj.exe
  C:\Windows\System\YVyfFDj.exe
  2⤵
  PID:7708
- C:\Windows\System\qoKSgvG.exe
  C:\Windows\System\qoKSgvG.exe
  2⤵
  PID:7896
- C:\Windows\System\sGbUcpQ.exe
  C:\Windows\System\sGbUcpQ.exe
  2⤵
  PID:6720
- C:\Windows\System\OSkjVIQ.exe
  C:\Windows\System\OSkjVIQ.exe
  2⤵
  PID:8120
- C:\Windows\System\oWOtzUQ.exe
  C:\Windows\System\oWOtzUQ.exe
  2⤵
  PID:6652
- C:\Windows\System\PHnttjF.exe
  C:\Windows\System\PHnttjF.exe
  2⤵
  PID:7180
- C:\Windows\System\TZdapJQ.exe
  C:\Windows\System\TZdapJQ.exe
  2⤵
  PID:8012
- C:\Windows\System\wLdiMTn.exe
  C:\Windows\System\wLdiMTn.exe
  2⤵
  PID:8208
- C:\Windows\System\WcjVAAf.exe
  C:\Windows\System\WcjVAAf.exe
  2⤵
  PID:8228
- C:\Windows\System\DyXeoBi.exe
  C:\Windows\System\DyXeoBi.exe
  2⤵
  PID:8244
- C:\Windows\System\qggcIxi.exe
  C:\Windows\System\qggcIxi.exe
  2⤵
  PID:8404
- C:\Windows\System\ittppjp.exe
  C:\Windows\System\ittppjp.exe
  2⤵
  PID:8420
- C:\Windows\System\BplFjGN.exe
  C:\Windows\System\BplFjGN.exe
  2⤵
  PID:8436
- C:\Windows\System\YRDRpom.exe
  C:\Windows\System\YRDRpom.exe
  2⤵
  PID:8452
- C:\Windows\System\uXVpRym.exe
  C:\Windows\System\uXVpRym.exe
  2⤵
  PID:8468
- C:\Windows\System\LOHtYgb.exe
  C:\Windows\System\LOHtYgb.exe
  2⤵
  PID:8484
- C:\Windows\System\WuHAJai.exe
  C:\Windows\System\WuHAJai.exe
  2⤵
  PID:8500
- C:\Windows\System\TTLINtN.exe
  C:\Windows\System\TTLINtN.exe
  2⤵
  PID:8516
- C:\Windows\System\HMzZoUT.exe
  C:\Windows\System\HMzZoUT.exe
  2⤵
  PID:8532
- C:\Windows\System\sElIvCl.exe
  C:\Windows\System\sElIvCl.exe
  2⤵
  PID:8548
- C:\Windows\System\agfzouq.exe
  C:\Windows\System\agfzouq.exe
  2⤵
  PID:8564
- C:\Windows\System\vJGgpSk.exe
  C:\Windows\System\vJGgpSk.exe
  2⤵
  PID:8580
- C:\Windows\System\gdnBOyS.exe
  C:\Windows\System\gdnBOyS.exe
  2⤵
  PID:8596
- C:\Windows\System\QkbGLym.exe
  C:\Windows\System\QkbGLym.exe
  2⤵
  PID:8616
- C:\Windows\System\HdeRxlu.exe
  C:\Windows\System\HdeRxlu.exe
  2⤵
  PID:8636
- C:\Windows\System\uOCWhyw.exe
  C:\Windows\System\uOCWhyw.exe
  2⤵
  PID:8652
- C:\Windows\System\yONkxpK.exe
  C:\Windows\System\yONkxpK.exe
  2⤵
  PID:8672
- C:\Windows\System\UOglttP.exe
  C:\Windows\System\UOglttP.exe
  2⤵
  PID:8688
- C:\Windows\System\GcmHYOW.exe
  C:\Windows\System\GcmHYOW.exe
  2⤵
  PID:8708
- C:\Windows\System\mvAkpAU.exe
  C:\Windows\System\mvAkpAU.exe
  2⤵
  PID:8724
- C:\Windows\System\CRoJXwB.exe
  C:\Windows\System\CRoJXwB.exe
  2⤵
  PID:8740
- C:\Windows\System\eMtfhvE.exe
  C:\Windows\System\eMtfhvE.exe
  2⤵
  PID:8756
- C:\Windows\System\TRbMqlw.exe
  C:\Windows\System\TRbMqlw.exe
  2⤵
  PID:8772
- C:\Windows\System\oVTubIL.exe
  C:\Windows\System\oVTubIL.exe
  2⤵
  PID:8868
- C:\Windows\System\eYrGfNA.exe
  C:\Windows\System\eYrGfNA.exe
  2⤵
  PID:8884
- C:\Windows\System\HXcJSRE.exe
  C:\Windows\System\HXcJSRE.exe
  2⤵
  PID:8900
- C:\Windows\System\GyFeHOq.exe
  C:\Windows\System\GyFeHOq.exe
  2⤵
  PID:8916
- C:\Windows\System\bXdglUf.exe
  C:\Windows\System\bXdglUf.exe
  2⤵
  PID:8932
- C:\Windows\System\DxmuzAY.exe
  C:\Windows\System\DxmuzAY.exe
  2⤵
  PID:8948
- C:\Windows\System\BoFnSQD.exe
  C:\Windows\System\BoFnSQD.exe
  2⤵
  PID:8964
- C:\Windows\System\wGwmSVd.exe
  C:\Windows\System\wGwmSVd.exe
  2⤵
  PID:8980
- C:\Windows\System\aVKfTtO.exe
  C:\Windows\System\aVKfTtO.exe
  2⤵
  PID:9000
- C:\Windows\System\NCpcoFZ.exe
  C:\Windows\System\NCpcoFZ.exe
  2⤵
  PID:9020
- C:\Windows\System\uxkAIcd.exe
  C:\Windows\System\uxkAIcd.exe
  2⤵
  PID:9036
- C:\Windows\System\meXYPjR.exe
  C:\Windows\System\meXYPjR.exe
  2⤵
  PID:9052
- C:\Windows\System\Ywusmgc.exe
  C:\Windows\System\Ywusmgc.exe
  2⤵
  PID:9068
- C:\Windows\System\JpDDuIH.exe
  C:\Windows\System\JpDDuIH.exe
  2⤵
  PID:9084
- C:\Windows\System\vqcmffM.exe
  C:\Windows\System\vqcmffM.exe
  2⤵
  PID:9100
- C:\Windows\System\rmboWOP.exe
  C:\Windows\System\rmboWOP.exe
  2⤵
  PID:9116
- C:\Windows\System\naHCpqb.exe
  C:\Windows\System\naHCpqb.exe
  2⤵
  PID:9132
- C:\Windows\System\HrriaQU.exe
  C:\Windows\System\HrriaQU.exe
  2⤵
  PID:9148
- C:\Windows\System\VZVibJo.exe
  C:\Windows\System\VZVibJo.exe
  2⤵
  PID:9164
- C:\Windows\System\IvQUPcI.exe
  C:\Windows\System\IvQUPcI.exe
  2⤵
  PID:9180
- C:\Windows\System\jmCYIPh.exe
  C:\Windows\System\jmCYIPh.exe
  2⤵
  PID:9196
- C:\Windows\System\ERFmrvo.exe
  C:\Windows\System\ERFmrvo.exe
  2⤵
  PID:9212
- C:\Windows\System\eybyGak.exe
  C:\Windows\System\eybyGak.exe
  2⤵
  PID:7844
- C:\Windows\System\PZHFYRj.exe
  C:\Windows\System\PZHFYRj.exe
  2⤵
  PID:8196
- C:\Windows\System\GgQihnQ.exe
  C:\Windows\System\GgQihnQ.exe
  2⤵
  PID:8236
- C:\Windows\System\ZnymJCy.exe
  C:\Windows\System\ZnymJCy.exe
  2⤵
  PID:8332
- C:\Windows\System\uKOkyMT.exe
  C:\Windows\System\uKOkyMT.exe
  2⤵
  PID:8284
- C:\Windows\System\ZXFXeMY.exe
  C:\Windows\System\ZXFXeMY.exe
  2⤵
  PID:8340
- C:\Windows\System\aAqfiEr.exe
  C:\Windows\System\aAqfiEr.exe
  2⤵
  PID:4296
- C:\Windows\System\jaQrNQz.exe
  C:\Windows\System\jaQrNQz.exe
  2⤵
  PID:3284
- C:\Windows\System\fUTaUNP.exe
  C:\Windows\System\fUTaUNP.exe
  2⤵
  PID:7252
- C:\Windows\System\nhjRFvK.exe
  C:\Windows\System\nhjRFvK.exe
  2⤵
  PID:8216
- C:\Windows\System\xsxdLQn.exe
  C:\Windows\System\xsxdLQn.exe
  2⤵
  PID:8260
- C:\Windows\System\ufridMt.exe
  C:\Windows\System\ufridMt.exe
  2⤵
  PID:8276
- C:\Windows\System\hAbZPGu.exe
  C:\Windows\System\hAbZPGu.exe
  2⤵
  PID:8300
- C:\Windows\System\obNMiVc.exe
  C:\Windows\System\obNMiVc.exe
  2⤵
  PID:8348
- C:\Windows\System\GpKodEz.exe
  C:\Windows\System\GpKodEz.exe
  2⤵
  PID:8360
- C:\Windows\System\fgEuvmk.exe
  C:\Windows\System\fgEuvmk.exe
  2⤵
  PID:8380
- C:\Windows\System\cInMhtf.exe
  C:\Windows\System\cInMhtf.exe
  2⤵
  PID:8376
- C:\Windows\System\OpNNAOw.exe
  C:\Windows\System\OpNNAOw.exe
  2⤵
  PID:8428
- C:\Windows\System\SFezffo.exe
  C:\Windows\System\SFezffo.exe
  2⤵
  PID:8416
- C:\Windows\System\fkwtftB.exe
  C:\Windows\System\fkwtftB.exe
  2⤵
  PID:8508
- C:\Windows\System\QiuZoGL.exe
  C:\Windows\System\QiuZoGL.exe
  2⤵
  PID:8572
- C:\Windows\System\zgcuXLi.exe
  C:\Windows\System\zgcuXLi.exe
  2⤵
  PID:8624
- C:\Windows\System\IZQPORX.exe
  C:\Windows\System\IZQPORX.exe
  2⤵
  PID:8668
- C:\Windows\System\LZxkrxj.exe
  C:\Windows\System\LZxkrxj.exe
  2⤵
  PID:8736
- C:\Windows\System\OjYIAcl.exe
  C:\Windows\System\OjYIAcl.exe
  2⤵
  PID:8524
- C:\Windows\System\ejXfszT.exe
  C:\Windows\System\ejXfszT.exe
  2⤵
  PID:8628
- C:\Windows\System\PcfaAXK.exe
  C:\Windows\System\PcfaAXK.exe
  2⤵
  PID:8608
- C:\Windows\System\ZiYFTto.exe
  C:\Windows\System\ZiYFTto.exe
  2⤵
  PID:8680
- C:\Windows\System\SwwVtmT.exe
  C:\Windows\System\SwwVtmT.exe
  2⤵
  PID:8752
- C:\Windows\System\LjZxHdg.exe
  C:\Windows\System\LjZxHdg.exe
  2⤵
  PID:8804
- C:\Windows\System\DEgZVWX.exe
  C:\Windows\System\DEgZVWX.exe
  2⤵
  PID:8816
- C:\Windows\System\GRmkkFR.exe
  C:\Windows\System\GRmkkFR.exe
  2⤵
  PID:8788
- C:\Windows\System\FymOvIs.exe
  C:\Windows\System\FymOvIs.exe
  2⤵
  PID:8836
- C:\Windows\System\ebpAhFV.exe
  C:\Windows\System\ebpAhFV.exe
  2⤵
  PID:8896
- C:\Windows\System\OZRskkQ.exe
  C:\Windows\System\OZRskkQ.exe
  2⤵
  PID:8960
- C:\Windows\System\JKertug.exe
  C:\Windows\System\JKertug.exe
  2⤵
  PID:8848
- C:\Windows\System\tqKxLfJ.exe
  C:\Windows\System\tqKxLfJ.exe
  2⤵
  PID:9064
- C:\Windows\System\ORtkByi.exe
  C:\Windows\System\ORtkByi.exe
  2⤵
  PID:9092
- C:\Windows\System\BAqUQXx.exe
  C:\Windows\System\BAqUQXx.exe
  2⤵
  PID:9124
- C:\Windows\System\gDradgt.exe
  C:\Windows\System\gDradgt.exe
  2⤵
  PID:9188
- C:\Windows\System\SbtlMBA.exe
  C:\Windows\System\SbtlMBA.exe
  2⤵
  PID:8200
- C:\Windows\System\bsKGCRp.exe
  C:\Windows\System\bsKGCRp.exe
  2⤵
  PID:9048
- C:\Windows\System\kWKUKjU.exe
  C:\Windows\System\kWKUKjU.exe
  2⤵
  PID:6416
- C:\Windows\System\xopGWlI.exe
  C:\Windows\System\xopGWlI.exe
  2⤵
  PID:8976
- C:\Windows\System\wpRjLMy.exe
  C:\Windows\System\wpRjLMy.exe
  2⤵
  PID:9108
- C:\Windows\System\tFQQyto.exe
  C:\Windows\System\tFQQyto.exe
  2⤵
  PID:9172
- C:\Windows\System\CGnnSLC.exe
  C:\Windows\System\CGnnSLC.exe
  2⤵
  PID:7452
- C:\Windows\System\xcoOkrE.exe
  C:\Windows\System\xcoOkrE.exe
  2⤵
  PID:8068
- C:\Windows\System\bURvSCv.exe
  C:\Windows\System\bURvSCv.exe
  2⤵
  PID:7508
- C:\Windows\System\fXRlOkN.exe
  C:\Windows\System\fXRlOkN.exe
  2⤵
  PID:8996
- C:\Windows\System\lTTpwnW.exe
  C:\Windows\System\lTTpwnW.exe
  2⤵
  PID:7280
- C:\Windows\System\tLdlsvh.exe
  C:\Windows\System\tLdlsvh.exe
  2⤵
  PID:8288
- C:\Windows\System\YkdNRiw.exe
  C:\Windows\System\YkdNRiw.exe
  2⤵
  PID:8368
- C:\Windows\System\KYYfWMJ.exe
  C:\Windows\System\KYYfWMJ.exe
  2⤵
  PID:8448
- C:\Windows\System\JDUMtlg.exe
  C:\Windows\System\JDUMtlg.exe
  2⤵
  PID:8592
- C:\Windows\System\PqzLqXn.exe
  C:\Windows\System\PqzLqXn.exe
  2⤵
  PID:8560
- C:\Windows\System\lkBhnFG.exe
  C:\Windows\System\lkBhnFG.exe
  2⤵
  PID:8328
- C:\Windows\System\PdtYiyC.exe
  C:\Windows\System\PdtYiyC.exe
  2⤵
  PID:8460
- C:\Windows\System\hrHDMqL.exe
  C:\Windows\System\hrHDMqL.exe
  2⤵
  PID:8492
- C:\Windows\System\BdjEAFk.exe
  C:\Windows\System\BdjEAFk.exe
  2⤵
  PID:8764
- C:\Windows\System\FsYaNaR.exe
  C:\Windows\System\FsYaNaR.exe
  2⤵
  PID:8812
- C:\Windows\System\ADDhCWb.exe
  C:\Windows\System\ADDhCWb.exe
  2⤵
  PID:8792
- C:\Windows\System\ybMRcZS.exe
  C:\Windows\System\ybMRcZS.exe
  2⤵
  PID:8844
- C:\Windows\System\ldnIlAv.exe
  C:\Windows\System\ldnIlAv.exe
  2⤵
  PID:8928
- C:\Windows\System\wDFwopk.exe
  C:\Windows\System\wDFwopk.exe
  2⤵
  PID:9060
- C:\Windows\System\EXQysjP.exe
  C:\Windows\System\EXQysjP.exe
  2⤵
  PID:8304
- C:\Windows\System\TVwdBli.exe
  C:\Windows\System\TVwdBli.exe
  2⤵
  PID:8320
- C:\Windows\System\zcDEyJx.exe
  C:\Windows\System\zcDEyJx.exe
  2⤵
  PID:8648
- C:\Windows\System\IQlVNWv.exe
  C:\Windows\System\IQlVNWv.exe
  2⤵
  PID:8632
- C:\Windows\System\qAKydQL.exe
  C:\Windows\System\qAKydQL.exe
  2⤵
  PID:3248
- C:\Windows\System\HcrRXOn.exe
  C:\Windows\System\HcrRXOn.exe
  2⤵
  PID:9016
- C:\Windows\System\eIAxosY.exe
  C:\Windows\System\eIAxosY.exe
  2⤵
  PID:9144
- C:\Windows\System\borQARv.exe
  C:\Windows\System\borQARv.exe
  2⤵
  PID:8224
- C:\Windows\System\vXnQTmN.exe
  C:\Windows\System\vXnQTmN.exe
  2⤵
  PID:8556
- C:\Windows\System\QtTuugx.exe
  C:\Windows\System\QtTuugx.exe
  2⤵
  PID:8268
- C:\Windows\System\aLPQGok.exe
  C:\Windows\System\aLPQGok.exe
  2⤵
  PID:8748
- C:\Windows\System\VTgVfHh.exe
  C:\Windows\System\VTgVfHh.exe
  2⤵
  PID:9032
- C:\Windows\System\vbVzaiz.exe
  C:\Windows\System\vbVzaiz.exe
  2⤵
  PID:7992
- C:\Windows\System\kytOjJD.exe
  C:\Windows\System\kytOjJD.exe
  2⤵
  PID:9080
- C:\Windows\System\LXpFHyj.exe
  C:\Windows\System\LXpFHyj.exe
  2⤵
  PID:8576
- C:\Windows\System\IIUqkHu.exe
  C:\Windows\System\IIUqkHu.exe
  2⤵
  PID:9140
- C:\Windows\System\ceBeDPB.exe
  C:\Windows\System\ceBeDPB.exe
  2⤵
  PID:8720
- C:\Windows\System\CFwVdwG.exe
  C:\Windows\System\CFwVdwG.exe
  2⤵
  PID:8544
- C:\Windows\System\vfYOLGx.exe
  C:\Windows\System\vfYOLGx.exe
  2⤵
  PID:9232
- C:\Windows\System\zYhXTEB.exe
  C:\Windows\System\zYhXTEB.exe
  2⤵
  PID:9248
- C:\Windows\System\lyPPNkF.exe
  C:\Windows\System\lyPPNkF.exe
  2⤵
  PID:9264
- C:\Windows\System\fPwQrHm.exe
  C:\Windows\System\fPwQrHm.exe
  2⤵
  PID:9284
- C:\Windows\System\RlCNtfZ.exe
  C:\Windows\System\RlCNtfZ.exe
  2⤵
  PID:9300
- C:\Windows\System\AyFLckh.exe
  C:\Windows\System\AyFLckh.exe
  2⤵
  PID:9316
- C:\Windows\System\HZGzauw.exe
  C:\Windows\System\HZGzauw.exe
  2⤵
  PID:9332
- C:\Windows\System\BmGZsFW.exe
  C:\Windows\System\BmGZsFW.exe
  2⤵
  PID:9356
- C:\Windows\System\tjCZXSI.exe
  C:\Windows\System\tjCZXSI.exe
  2⤵
  PID:9372
- C:\Windows\System\wPxvbkk.exe
  C:\Windows\System\wPxvbkk.exe
  2⤵
  PID:9388
- C:\Windows\System\XpMmGpZ.exe
  C:\Windows\System\XpMmGpZ.exe
  2⤵
  PID:9404
- C:\Windows\System\KXurKJB.exe
  C:\Windows\System\KXurKJB.exe
  2⤵
  PID:9420
- C:\Windows\System\dNkZqfA.exe
  C:\Windows\System\dNkZqfA.exe
  2⤵
  PID:9436
- C:\Windows\System\EayZAjr.exe
  C:\Windows\System\EayZAjr.exe
  2⤵
  PID:9452
- C:\Windows\System\BFBTZDt.exe
  C:\Windows\System\BFBTZDt.exe
  2⤵
  PID:9468
- C:\Windows\System\bJqnVyN.exe
  C:\Windows\System\bJqnVyN.exe
  2⤵
  PID:9484
- C:\Windows\System\kMLtmzk.exe
  C:\Windows\System\kMLtmzk.exe
  2⤵
  PID:9500
- C:\Windows\System\jameTAa.exe
  C:\Windows\System\jameTAa.exe
  2⤵
  PID:9516
- C:\Windows\System\pJYFKHo.exe
  C:\Windows\System\pJYFKHo.exe
  2⤵
  PID:9532
- C:\Windows\System\LvtWgad.exe
  C:\Windows\System\LvtWgad.exe
  2⤵
  PID:9548
- C:\Windows\System\wjAIuPN.exe
  C:\Windows\System\wjAIuPN.exe
  2⤵
  PID:9564
- C:\Windows\System\tEFaEDh.exe
  C:\Windows\System\tEFaEDh.exe
  2⤵
  PID:9588
- C:\Windows\System\XUKiKbO.exe
  C:\Windows\System\XUKiKbO.exe
  2⤵
  PID:9604
- C:\Windows\System\mvHHTwO.exe
  C:\Windows\System\mvHHTwO.exe
  2⤵
  PID:9624
- C:\Windows\System\InDFGaq.exe
  C:\Windows\System\InDFGaq.exe
  2⤵
  PID:9640
- C:\Windows\System\HgZVjmZ.exe
  C:\Windows\System\HgZVjmZ.exe
  2⤵
  PID:9660
- C:\Windows\System\gywLfJQ.exe
  C:\Windows\System\gywLfJQ.exe
  2⤵
  PID:9676
- C:\Windows\System\XUmVUjX.exe
  C:\Windows\System\XUmVUjX.exe
  2⤵
  PID:9692
- C:\Windows\System\BYYrQcj.exe
  C:\Windows\System\BYYrQcj.exe
  2⤵
  PID:9708
- C:\Windows\System\gbdikcx.exe
  C:\Windows\System\gbdikcx.exe
  2⤵
  PID:9724
- C:\Windows\System\TJQxkPK.exe
  C:\Windows\System\TJQxkPK.exe
  2⤵
  PID:9740
- C:\Windows\System\FJlEvri.exe
  C:\Windows\System\FJlEvri.exe
  2⤵
  PID:9756
- C:\Windows\System\ojJKZSb.exe
  C:\Windows\System\ojJKZSb.exe
  2⤵
  PID:9772
- C:\Windows\System\YQNweAw.exe
  C:\Windows\System\YQNweAw.exe
  2⤵
  PID:9788
- C:\Windows\System\gxtSuCP.exe
  C:\Windows\System\gxtSuCP.exe
  2⤵
  PID:9804
- C:\Windows\System\BdvGRPK.exe
  C:\Windows\System\BdvGRPK.exe
  2⤵
  PID:9820
- C:\Windows\System\tAWZMgW.exe
  C:\Windows\System\tAWZMgW.exe
  2⤵
  PID:9836
- C:\Windows\System\PJbPQEz.exe
  C:\Windows\System\PJbPQEz.exe
  2⤵
  PID:9852
- C:\Windows\System\VpJJqNB.exe
  C:\Windows\System\VpJJqNB.exe
  2⤵
  PID:9868
- C:\Windows\System\uGcJXQU.exe
  C:\Windows\System\uGcJXQU.exe
  2⤵
  PID:9884
- C:\Windows\System\zwPGPLr.exe
  C:\Windows\System\zwPGPLr.exe
  2⤵
  PID:9900
- C:\Windows\System\eMwnWCv.exe
  C:\Windows\System\eMwnWCv.exe
  2⤵
  PID:9916
- C:\Windows\System\vOVbmcN.exe
  C:\Windows\System\vOVbmcN.exe
  2⤵
  PID:9932
- C:\Windows\System\NHxeqTU.exe
  C:\Windows\System\NHxeqTU.exe
  2⤵
  PID:9948
- C:\Windows\System\OOMEKDW.exe
  C:\Windows\System\OOMEKDW.exe
  2⤵
  PID:9964
- C:\Windows\System\ZXuKwor.exe
  C:\Windows\System\ZXuKwor.exe
  2⤵
  PID:9980
- C:\Windows\System\WFwpTGz.exe
  C:\Windows\System\WFwpTGz.exe
  2⤵
  PID:10000
- C:\Windows\System\kUSuUSA.exe
  C:\Windows\System\kUSuUSA.exe
  2⤵
  PID:10016
- C:\Windows\System\mDAiAIO.exe
  C:\Windows\System\mDAiAIO.exe
  2⤵
  PID:10032
- C:\Windows\System\uiKjouL.exe
  C:\Windows\System\uiKjouL.exe
  2⤵
  PID:10048
- C:\Windows\System\zzbwlFM.exe
  C:\Windows\System\zzbwlFM.exe
  2⤵
  PID:10064
- C:\Windows\System\jejteWa.exe
  C:\Windows\System\jejteWa.exe
  2⤵
  PID:10080
- C:\Windows\System\ahasnxO.exe
  C:\Windows\System\ahasnxO.exe
  2⤵
  PID:10096
- C:\Windows\System\NbkNcpu.exe
  C:\Windows\System\NbkNcpu.exe
  2⤵
  PID:10112
- C:\Windows\System\cJcpEEc.exe
  C:\Windows\System\cJcpEEc.exe
  2⤵
  PID:10128
- C:\Windows\System\wDXwTaL.exe
  C:\Windows\System\wDXwTaL.exe
  2⤵
  PID:10144
- C:\Windows\System\CNvutpZ.exe
  C:\Windows\System\CNvutpZ.exe
  2⤵
  PID:10164
- C:\Windows\System\KmzXrGr.exe
  C:\Windows\System\KmzXrGr.exe
  2⤵
  PID:10184
- C:\Windows\System\BSdNDUA.exe
  C:\Windows\System\BSdNDUA.exe
  2⤵
  PID:10212
- C:\Windows\System\VxbEGLd.exe
  C:\Windows\System\VxbEGLd.exe
  2⤵
  PID:10228
- C:\Windows\System\RDsRrMH.exe
  C:\Windows\System\RDsRrMH.exe
  2⤵
  PID:8768
- C:\Windows\System\bOSUUJf.exe
  C:\Windows\System\bOSUUJf.exe
  2⤵
  PID:9292
- C:\Windows\System\GkDCJvi.exe
  C:\Windows\System\GkDCJvi.exe
  2⤵
  PID:8344
- C:\Windows\System\qNLdiHt.exe
  C:\Windows\System\qNLdiHt.exe
  2⤵
  PID:9340
- C:\Windows\System\RUEbMcY.exe
  C:\Windows\System\RUEbMcY.exe
  2⤵
  PID:8784
- C:\Windows\System\fOqDtpT.exe
  C:\Windows\System\fOqDtpT.exe
  2⤵
  PID:7328
- C:\Windows\System\VKWjzSz.exe
  C:\Windows\System\VKWjzSz.exe
  2⤵
  PID:8828
- C:\Windows\System\IVlkGms.exe
  C:\Windows\System\IVlkGms.exe
  2⤵
  PID:9160
- C:\Windows\System\YVOPpvz.exe
  C:\Windows\System\YVOPpvz.exe
  2⤵
  PID:9448
- C:\Windows\System\KlvZCxn.exe
  C:\Windows\System\KlvZCxn.exe
  2⤵
  PID:9512
- C:\Windows\System\mDABbNm.exe
  C:\Windows\System\mDABbNm.exe
  2⤵
  PID:10252
- C:\Windows\System\rRayCZz.exe
  C:\Windows\System\rRayCZz.exe
  2⤵
  PID:10268
- C:\Windows\System\kWIUUYK.exe
  C:\Windows\System\kWIUUYK.exe
  2⤵
  PID:10284
- C:\Windows\System\TcxPztq.exe
  C:\Windows\System\TcxPztq.exe
  2⤵
  PID:10300
- C:\Windows\System\ixLvORj.exe
  C:\Windows\System\ixLvORj.exe
  2⤵
  PID:10316
- C:\Windows\System\XDTTcFE.exe
  C:\Windows\System\XDTTcFE.exe
  2⤵
  PID:10332
- C:\Windows\System\lugkWjH.exe
  C:\Windows\System\lugkWjH.exe
  2⤵
  PID:10348
- C:\Windows\System\HVaNTLU.exe
  C:\Windows\System\HVaNTLU.exe
  2⤵
  PID:10368
- C:\Windows\System\CEYpQUR.exe
  C:\Windows\System\CEYpQUR.exe
  2⤵
  PID:10384
- C:\Windows\System\tJlgeSB.exe
  C:\Windows\System\tJlgeSB.exe
  2⤵
  PID:10400
- C:\Windows\System\BNYydFm.exe
  C:\Windows\System\BNYydFm.exe
  2⤵
  PID:10420
- C:\Windows\System\euBRfMc.exe
  C:\Windows\System\euBRfMc.exe
  2⤵
  PID:10436
- C:\Windows\System\fIbBBUk.exe
  C:\Windows\System\fIbBBUk.exe
  2⤵
  PID:10452
- C:\Windows\System\BJXFJJX.exe
  C:\Windows\System\BJXFJJX.exe
  2⤵
  PID:10468
- C:\Windows\System\gvHUSEc.exe
  C:\Windows\System\gvHUSEc.exe
  2⤵
  PID:10488
- C:\Windows\System\TseQpyB.exe
  C:\Windows\System\TseQpyB.exe
  2⤵
  PID:10504
- C:\Windows\System\FsZQxIj.exe
  C:\Windows\System\FsZQxIj.exe
  2⤵
  PID:10520
- C:\Windows\System\xdahcfL.exe
  C:\Windows\System\xdahcfL.exe
  2⤵
  PID:10536
- C:\Windows\System\phRxIbW.exe
  C:\Windows\System\phRxIbW.exe
  2⤵
  PID:10560
- C:\Windows\System\OAPKrCA.exe
  C:\Windows\System\OAPKrCA.exe
  2⤵
  PID:10576
- C:\Windows\System\iSUxVZC.exe
  C:\Windows\System\iSUxVZC.exe
  2⤵
  PID:10592
- C:\Windows\System\YkNbfnq.exe
  C:\Windows\System\YkNbfnq.exe
  2⤵
  PID:10608
- C:\Windows\System\FZemrkk.exe
  C:\Windows\System\FZemrkk.exe
  2⤵
  PID:10628
- C:\Windows\System\AQYCmjp.exe
  C:\Windows\System\AQYCmjp.exe
  2⤵
  PID:10644
- C:\Windows\System\cblvqLz.exe
  C:\Windows\System\cblvqLz.exe
  2⤵
  PID:10660
- C:\Windows\System\azmwedD.exe
  C:\Windows\System\azmwedD.exe
  2⤵
  PID:10676
- C:\Windows\System\ypOyjuG.exe
  C:\Windows\System\ypOyjuG.exe
  2⤵
  PID:10692
- C:\Windows\System\UNjUFIg.exe
  C:\Windows\System\UNjUFIg.exe
  2⤵
  PID:10708
- C:\Windows\System\PAukTAM.exe
  C:\Windows\System\PAukTAM.exe
  2⤵
  PID:10724
- C:\Windows\System\oampSCq.exe
  C:\Windows\System\oampSCq.exe
  2⤵
  PID:10740
- C:\Windows\System\JyOESwa.exe
  C:\Windows\System\JyOESwa.exe
  2⤵
  PID:10756
- C:\Windows\System\oZoNTHG.exe
  C:\Windows\System\oZoNTHG.exe
  2⤵
  PID:10772
- C:\Windows\System\ouzARKl.exe
  C:\Windows\System\ouzARKl.exe
  2⤵
  PID:10788
- C:\Windows\System\rJgUdGV.exe
  C:\Windows\System\rJgUdGV.exe
  2⤵
  PID:10804
- C:\Windows\System\svPLyFE.exe
  C:\Windows\System\svPLyFE.exe
  2⤵
  PID:10820
- C:\Windows\System\UlziKsF.exe
  C:\Windows\System\UlziKsF.exe
  2⤵
  PID:10836
- C:\Windows\System\GjwEvGA.exe
  C:\Windows\System\GjwEvGA.exe
  2⤵
  PID:10852
- C:\Windows\System\OdjjItt.exe
  C:\Windows\System\OdjjItt.exe
  2⤵
  PID:10872
- C:\Windows\System\xLzVyIh.exe
  C:\Windows\System\xLzVyIh.exe
  2⤵
  PID:10888
- C:\Windows\System\xxETNck.exe
  C:\Windows\System\xxETNck.exe
  2⤵
  PID:10908
- C:\Windows\System\aBtdmJr.exe
  C:\Windows\System\aBtdmJr.exe
  2⤵
  PID:10924
- C:\Windows\System\bOaIflX.exe
  C:\Windows\System\bOaIflX.exe
  2⤵
  PID:10940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ATvXIem.exe

Filesize
1.4MB

MD5
0a48893b52b67e98416c498d8a7ba2ec

SHA1
3164511274e1f6b2f02e98399ab8db696a193b2a

SHA256
d3a07f7f04c8bacd67c503edd70ceef4a65b289085d12c37b2f271258458b336

SHA512
fa66f0801d9bbe600492c9f53830e51aff5381942f0ba0fbf8b04b5de89059cb7b042c42ef495dde389a4847f80a8e8e80122727bce214283c6762ebd1dc735c

Download Submit
C:\Windows\system\HfJRkmk.exe

Filesize
1.4MB

MD5
c75b9bb5e1f27fb2af82c2f553e5a644

SHA1
8697296cbdf233369c07e42aa80bbdc4d0d95087

SHA256
7f266a4c0640fbf25ee80e6e7982a9a7f7c8c7df874a801a3817f77e42b9b418

SHA512
ccc95db62ce20ae9ce78c8496cb4a543411c30c486cb1b79d33dd0f203d35299bb7e15eb02c5add587a4dd28cf8d47eb106a066e9a094afaaba151ed3dbb8dca

Download Submit
C:\Windows\system\JuINkyw.exe

Filesize
1.4MB

MD5
9ac92c1f124a09d0ab35948fe50a8962

SHA1
0fae2033c568ff65fdb2e53c29d610dce0f2931e

SHA256
b39092d433129536b250e1d9634299777b240c8a1c38578ee45ddb5c0a6d27d5

SHA512
91941bfcc6c6c745c13f65c55efac34295f0e41c3abc9a781a88a38c612cd5b0d5fc3e2da3a566a1e721089e4c7e408bcceeadd05238c11c80f8493b827f32ac

Download Submit
C:\Windows\system\NtPCTGd.exe

Filesize
1.4MB

MD5
27cdbacc2eb5c18cd398844f0e9e924b

SHA1
bdfb53eb6b75fbe4fee944e88248c58a89ae39cb

SHA256
3ffeed5434e25561b6d72ce3036c46acbaaa1cc768b2efc4f376aecbb5c3cbae

SHA512
469179588fa354fdb0f2d70e83daae8c6ad0bd30f057b4399609a5101eaaa3980de0a805dc652459838e3aec719742db4a2b155286e27ef431acdd7b21720270

Download Submit
C:\Windows\system\OlCGGUa.exe

Filesize
8B

MD5
2d0c2c2eeafda1eefbc846623106a651

SHA1
ebe1d12cc7355840b98bff551fa1e9b6ea05149b

SHA256
315fe12e8506c9a5679018a241c22762f38597a85e3d6906984d2cd8e0eb0749

SHA512
4747f2fca75d2722dc6b7850f1cf2e05f5ebac7e64d54a9f03247ac705b6e7fd5e4086e67fbc0da577c026e6cfc06192b9232b3f0c023c488535fb6f948376dc

Download Submit
C:\Windows\system\PrGFHtj.exe

Filesize
1.4MB

MD5
d1591c81b6e376bee136445190c6216e

SHA1
ea4a11929cfc4008b71480d6369d98a5ca58a8bc

SHA256
92e53732c5a61eb8c65c3e9a49c472db5db0e35ef3600e494e4ecdfab1d0fc5c

SHA512
0a3596fd13e9d70a989c7a3fe4a80339c270bb424910051624922088df2c215dfd69e53b37ea26efeb89bdb45fe6af6bebaaba1cbafda5bc6a9b71e6752a0e6a

Download Submit
C:\Windows\system\TKarQHk.exe

Filesize
1.4MB

MD5
0d6a5262606586e5b164ea380fd99c15

SHA1
0e2cbecaaddd2c5459ad748369547f4a570635f8

SHA256
6d8b70b360326713502e48d85f90432581a95bf8e06eacdc9ad41fb9b2a01a03

SHA512
e2b0d3d8c32efad02ffce3a76097c9346fe01a468c1567d757837cb58f81231e169527ae07b79d071b33255df3e9d280f5e3a7efd354d5696c0de408f61bfc38

Download Submit
C:\Windows\system\Wrtphpi.exe

Filesize
1.4MB

MD5
b75e045f503396f3e9aa0d96534afe15

SHA1
c2a8859649b12013dc3618bdfd6c9e36f408c5c5

SHA256
f98cf132da22a8f1c911543c7a0d7341f2f72715d4534fbd8b3835809930ac80

SHA512
12a317321f4f46482aadcb654679a989c327fe30a6829f75d94e6bf75b37cded9e8aba6464d80f34ab261db645b1ed89c643c7d4303ea560de970dd48e065610

Download Submit
C:\Windows\system\XYPGcTy.exe

Filesize
1.4MB

MD5
0af7a38b53204d8ac7ffd770825247f9

SHA1
7bce86e4f2c215370344102ad8e1e2cbf848e36e

SHA256
382f5d44953959d7798923dec8c64e62391470c2b07d8fcf8baafc2e83418a52

SHA512
a531ffbfe243ed555139a696c8fae75fdc0180387f70b4dc1e7dbea8247ea697f3cc743a188b8d923af0aa27b4a3ac219a17a1b0028e91a9e8439753e4ab2fe8

Download Submit
C:\Windows\system\bOUczXJ.exe

Filesize
1.4MB

MD5
acca8be81e50a993715780d7922b4f89

SHA1
9e8f88174524f0e2319d338cee96d0960f00d1b8

SHA256
075506e0ba391e75ba2f5246f8b604b1a7c455b0ab83eb4439b155bb344033dd

SHA512
7c9d14f7e19f39249cada8d9250e6ea9655bd9fb553249370ee2eef737b35b9f8a4334e83e0acb9d99ed25e14e2ef4fa07298699ce123dea0d29e086c013f9e3

Download Submit
C:\Windows\system\bbtOwOm.exe

Filesize
1.4MB

MD5
7f688bca7fd994770b334e1ad4add05c

SHA1
952b1fc074463ddedf752fc8e3a02daee83e725c

SHA256
96c0cafee718069a589940fccc90ce26325b0d5cf918839eaa80a05df5c060ea

SHA512
5022beb45b2bd8e00d3ba2df97c58c01cd5912d69fbf02d9bebf7db640f1f84656928871eee0142bf7bc44c2b25b260feda5987b5b0928e09669b37c545b4a33

Download Submit
C:\Windows\system\ePiWCpE.exe

Filesize
1.4MB

MD5
bab5e9b7ea37a12b29617ddc1d8e40d6

SHA1
7a73c447f6b84c80d47ab5bee88dbcc4c4daba9d

SHA256
fa4468336fa311caf02e1a6a66a1488f45c3f3e76437af25caace58d0db87917

SHA512
c253741af651c43b6cd75b5cea2794737da489471a8138d73f312fd3bb81362929f31c4ddef33f34e20573da8c9963f2d444151c6729324f3b7b66193c076d28

Download Submit
C:\Windows\system\gPvUgiB.exe

Filesize
1.4MB

MD5
d5888cb8781b587afe2eac6ee403b65d

SHA1
2f8c8ebc1f9148722441f124de81dbaed25703c3

SHA256
24a2cf6fda5d9bca3a9d129e72b634ddeb9c619a099c0095d96cb7ff82698050

SHA512
96646b5b9008e1bf1223de1f32fcb9d6ff39a045441564d2f6475da42f1390b0389fcf5faf2293b6cc8bcff722cb5846c01b729f9c859c0d97b40e7e05a5edab

Download Submit
C:\Windows\system\iFtEUDi.exe

Filesize
1.4MB

MD5
a945cba167e3249898059603b5228cd5

SHA1
91b1b944c7994281b0a81439206bd6d1862e7e22

SHA256
e8a0eb48a95e51624e0530badc005272b7594f541438678261b16fbc5791a0fb

SHA512
be260b158877b4728d0a476864b2d11e82920e56bd3b131f572a1a5991a1f1714d10525446d9246aeaeb6dde67740f6fa56d4a4cd5f77e89f67714b8318961fe

Download Submit
C:\Windows\system\iqWBjGc.exe

Filesize
1.4MB

MD5
e926c7748940a4babf8f6d6eb0168f54

SHA1
3114e3653a08f121de4c138b97faedc6b1cbb605

SHA256
148896bc4e0540654438962f23187e8ff5accbfbf29e5a0654f6dca60e77decf

SHA512
910fbead7643544cf41ca79aa19c808d8d7a6154ebdbe80d899f8b9182b249c21c225adef3f2a4d0d6fa0bbee083eeebeb0c699466d2b722eb5d6fe8da1c84d7

Download Submit
C:\Windows\system\jklGLEU.exe

Filesize
1.4MB

MD5
dbff33cc0dbfad761f7fe88c1b070ddc

SHA1
3e65dad307292d11cf1fa7fcd42ebd795ba2f93f

SHA256
98633d1ac2e9926a49f716ab258b477d59a513c60a3a15006a8a1db252dfd776

SHA512
5b6cf024372ed829e8a347a1fe9ece11e1259344b71fda158ce2e4408f3d6a28739c504cda3f5019ec2acce3ba9920c17724c0ba30fe6a1b2a4e0831d37d13cf

Download Submit
C:\Windows\system\pMmxaZf.exe

Filesize
896KB

MD5
a59d58f45976059046c9d874047f12c7

SHA1
2e5bcd8d8c3ad152a59297dbdc9ea8645bee1ea9

SHA256
892d99621587dfa1d11051c9abf2802c76992803a9e064f2ff576d359c913b09

SHA512
c7d54827527fc3e8f037dff12768eb4717526a1932dd284f5939ba7bb7ea1958dc4700db7272d2ed180884999506b080658dc44a18237184b79502140b2458f9

Download Submit
C:\Windows\system\qrpbYqL.exe

Filesize
1.4MB

MD5
ac04f98409cb0a4d6df78c74524ec846

SHA1
1f091c50da2b43406d2b47783605f4cbb573320a

SHA256
929978763f31e8df9260afea8290802ec688b1a82d159ff90b45002e780f68cb

SHA512
b2516c5fa6c843ba10d37809d38e40fdb059cdedabd021b5a040cba1f948d91d815890e7ac93d49a81b5116501b11dbbe6aad577e09cd5589e7eaff9f18133df

Download Submit
C:\Windows\system\tsthZsN.exe

Filesize
1.4MB

MD5
450fd03b1bff9c79d956163b7d724e0e

SHA1
1349bd8fa742b246d1b376bf15a6fc659917099d

SHA256
697141ad7f72d4471143f59945f9e0108b253f82aa19215214bcce6924d66169

SHA512
f3d26ef6d447198c32735aca4526590772a97b45f43d326ccdc2f0cfb7782b4cea9193f50d6d26366596ab5e56c4547a0cf5b964e945ff2e0b782151aa6487eb

Download Submit
C:\Windows\system\wUiAGJs.exe

Filesize
1.4MB

MD5
c87350ac5506d6c2bd4f36bfd099e54b

SHA1
8f7374027ba3320813dc60dc81729cc88d47e62e

SHA256
ae5e8a1d7f4498653d496b11de3d9de8ad7076f0400cdd8ca7b31513657b5774

SHA512
ed841fe00d03ac79c90045f0affacbdacc4209f49b0814fc41a5113f67f0cc8c4a5ceb215c5e76815166ee7594d061e975e0824398dead62907e2129ffa220ae

Download Submit
C:\Windows\system\xROhAqQ.exe

Filesize
1.4MB

MD5
dad258686dc934dadc20130981c75a01

SHA1
10ebef24e14134635bc8547f40ba56c8dd978c35

SHA256
bd820cb6db2e368b361ae8250e624df093417082a7c0e723459b358adb742d5c

SHA512
b8ee5305212b7a55630604ad514249f96a69763aaf76a89674bb94c0efcf9ae5baa6d1f3b8c39305d1d0b02d52cd350e4389c2a889a7fc24e12254acf9bd4c86

Download Submit
C:\Windows\system\yyjCddE.exe

Filesize
1.4MB

MD5
65b7046e45d30fcf277f9d99bcaa63dd

SHA1
36fd396feaeb9ddeccb57e62b647c2d150b3247a

SHA256
4043387e5d3dd14837b6afbe25cde19a06e9d660ba3a2b1d30f8e3937fe6d881

SHA512
05b6cddc47ec60eaca85af13f4e514822b15aa51e85054feeb49c918f4ff3c407a83ff3460beeba924f8ddb3ad9fd5ba96fd8b7a79df182c65b0dea48c628d9c

Download Submit
\Windows\system\DkEfwHL.exe

Filesize
1.4MB

MD5
8640da8bd4a06e690503dfda568923fa

SHA1
a41937ecbe6fc59f2eba313ae8cce2a111bd6b3d

SHA256
eb6324b77c8a1ee9a85c67aa8ce1997b4303a876f564f9f2f088b7f6d288bb61

SHA512
7bf7190dc53fe234ddfb61192dba72f658ef30d6b2fa1e57433a628cb88a2976e59b554cef3d9136fbe372468ae8fb9c3ccd1ddaf022c75f5595deabcb5da37a

Download Submit
\Windows\system\FaZiTsl.exe

Filesize
1.4MB

MD5
5783ff6132cb1cd14821f094f003f241

SHA1
9cc7e775a2614435356c3388aad1eb4fc8be0183

SHA256
c4f88fcdeb5793c729e7b0c09b4555bf333b7b0af5638bfd3c42e9c997bf2885

SHA512
79a7a32a1701f0ce0ed1355810ea1f781dc1f0df23cf609f1769ec1aee7f94a03f0980fb88f3c7ee1e6e8ba67d9c764f153db7627a0d73cbc7cff89703dbc699

Download Submit
\Windows\system\GwEYxVt.exe

Filesize
1.4MB

MD5
4ced1a36e87bfcf3057022a2db52b831

SHA1
3c40cc63ae43435a8c06fb12af6c866a2688da40

SHA256
7af9036ef8bbacf2a0cfc54f5d912838aafba2fe43a442dc551ef3731ad590c7

SHA512
1ec4a28ccf91f5d99ac92a6fa70f9c7889db9a8ab72fdfa73f036e9087f05385203713acb21a254ff7122c82df3f7d9bd4149c25f4f3f3419178be67e7841273

Download Submit
\Windows\system\SCdCJEm.exe

Filesize
1.4MB

MD5
517736bcdc699090044036500d96ef65

SHA1
c430162a8649c470e0ad34e37b5fa33008cf0985

SHA256
8ed017c0744507c84ddeddae9ccf3bb7c7ed60383f1fc7695bb759826be7c48f

SHA512
e808128cfc837ebff62c343d94849268a54f12f17df08907c00bc73d10a89e0fd791eea3f578e46b47ffcfdeeb744a81f7922216d70a67bb3874a19895c771ba

Download Submit
\Windows\system\YFTlwmJ.exe

Filesize
1.4MB

MD5
943cae5d3b8f43cbbe209548827c2771

SHA1
7f7fc58b75e2da49e64dc0b8417435d8f627aa7e

SHA256
49e97a9221cf33146fdae9c31cb8688452139bc7f7847a6cf80e60202968576e

SHA512
cef3a5476b8031657fb58330d2178dec2a2098cbbf301c91e9bab749da226a1f7bce8c4bb2765a1b58ac70a74cb823f6dba051e5e8b1951b2e0a88ec35062171

Download Submit
\Windows\system\bOUczXJ.exe

Filesize
1.4MB

MD5
0b90066c296beb5212b9257442c999b4

SHA1
8ef03cce3180c62b2b8723e7a620e7dd971949f5

SHA256
352857d491a29d3573d17909160a6d3ab3f8cc0df6e3b32f89d14e9147ec25f6

SHA512
461bd51eeb4ee8f97f39bab226edc437927e16a6d8279e0d03f21e45b240e002938fd7b98a69f2b91618bc620e57ea1af368f08a08a07e17b679d87b00431084

Download Submit
\Windows\system\bnQjxrz.exe

Filesize
1.4MB

MD5
f2035758c839f224dd857b50e44e2995

SHA1
c27350ce9e1769ea86ef6e64998b3a1cb6671cce

SHA256
719c325155806225a271b8160c9b36ff434184ff02d7fb7badaaf8515cc9989f

SHA512
6260bf67b7ef800ae4ea29730da15ed17a52f0285d8179e320a87ca016fa8b41216426410fa739970744729c688be3661c962d69df1b7440123ebc18f0764f11

Download Submit
\Windows\system\chWQOKs.exe

Filesize
1.4MB

MD5
a047da23f0c2f6a472533a851b2aac28

SHA1
0ef397b559726ff9f6cae71e28e459c0db390c44

SHA256
943005c7fe80a6d1ea31f1e4d00800d4a7f330a6e5254404a291a9bd28082adb

SHA512
9c0e0845dc257028be40521c91774f37c4ae5318e46d0c1726fb1eecc8432be9c639d6e2c1fb969ad34fb8fd40cd17bfe78940e2b5e628b1e9b8b6d16fbfd8da

Download Submit
\Windows\system\fViwKpM.exe

Filesize
1.4MB

MD5
f4eff51cf9ce1a698286696b000582d1

SHA1
753a6a1b6f62227f58578f9ecd5cf9560db54c21

SHA256
8dfce5a711d75003b2b4e1758afb0b6d32955698af7cad0321ec9099fd73082b

SHA512
b3648a1bbd44c5a76627c4e03be0b68d28361b9089fd99e886777838f6d524aeccc42896a798dcf18c2fb5c14e547d46cece9acfde0bf5f7d15f84db709063c4

Download Submit
\Windows\system\glIekTR.exe

Filesize
1.4MB

MD5
a5a550f25fdc962d2a0f4db08ce83bd7

SHA1
6c0a43f30b4bf02f96fec6ddc724c80bc935af63

SHA256
cf9b2bf5c9c741815151fa1f5c663bae70af082ed585c7d4be0e23e6577bebf9

SHA512
99d1ddc497ab667ef403a92d2ac69ebc62ad8da5f0ffea399b4fdec3a856f85d015778a719af955e87f89c1e118a190d7086b0b1def4ae9b36fb9f91593fbb6a

Download Submit
\Windows\system\hGSbGsu.exe

Filesize
1.4MB

MD5
cb8b331fa94deddaeabfef9ab78ddbae

SHA1
de3944fda8198ed5b285ffffeff3b9d4154200a6

SHA256
c23cd029a079bbd5775bbd7d61fa50c69c81b3abc56de5dd6e847338c9853c75

SHA512
b0998afa2b157ad65c52f25ac0d54323b7ec8bafcd062ac7c73a8e4acc66d0a8d7ae1e8f75758e6ad9b0ae419cbf69d0a7b1a7fddc92a370b3d8dc2551bb414e

Download Submit
\Windows\system\nHGhFxZ.exe

Filesize
1.4MB

MD5
9abc435f96e66d703f613f16dc718c7a

SHA1
f79b94206255f4dfd699ad74741f02ee4c957105

SHA256
d8657a54a0f09adddfafdcd3569e5e20f8629b914f6e75db1c0275766935d7cb

SHA512
768dba59ed97614d26c9f0d6e0231c3255c4406f5c890f07bc6cdab316cf7d558cd909e20dcd142b6fac6c494bb643a8a76be495c9ffb4ec12bb589a7db142ca

Download Submit
\Windows\system\oVTcWWa.exe

Filesize
1.4MB

MD5
0f4e1799d9c096d1d87d4aeaf0e5aff1

SHA1
3c5ccfa6f9a21099a046c98ac4ee34cef3039a38

SHA256
eba5d4af1e33276831259f0b13e7a07b4ceccd51e7a9c460b68a73825b70ad7f

SHA512
51ad1b15d5403d99859fe055ba47b7dfb6a99dbd98a1594f481ddb5338a8aa268a1f24898b306599b07be6346d35edc352f708774f12c6a06b3a48718ade0692

Download Submit
\Windows\system\pMmxaZf.exe

Filesize
1.2MB

MD5
74569c1058ee8219d693618199a357ad

SHA1
dc1b5927108fe68c2839af69311c3b0ef0263d30

SHA256
52356f3b45373b0ff1150867f1c6c8ea9e30c6ead9f93e493aa1a3a501f5db52

SHA512
2576c5a7c1e2de7dec18caf5e638d76b011ab4671e6fa37e1721db3e3533695a2370aecb906b8679fa6950af68826486b45245fcde435cdf0e51ad8bc1f0d122

Download Submit
\Windows\system\qBnbwMX.exe

Filesize
1.4MB

MD5
226831114a92786643a7ae36c5aeaf06

SHA1
088670fe0c43145eb26775b48d10b55c844d7975

SHA256
b147f5273e014b21101b4afec85faeec81d4e03aaef27eae344f666426b4484f

SHA512
26aab7a5ca8f09f02732d494129458df5d08561e76b3743caf0e75800159dd86bcf09e8e7f6700e9c186ad61591b48d9c7e63755061a632f28186eeab59a14ea

Download Submit
\Windows\system\xROhAqQ.exe

Filesize
1.1MB

MD5
861fb250b05a6730bd0e7b2484d592c5

SHA1
2be0f966223e414afdeb63b01446036f5c251bb8

SHA256
19f0a6f2b6cefd7654bead5087109d1aecf888d3f2bb519762466d0acffbdc16

SHA512
17ef9ab05110905b1683109e1f00a96c538b4527d5a30f62cfa6301274379fd091c1e6a2f7df634eeb43a643c7511a7263d0f138bc58b820914348a124524cbf

Download Submit
\Windows\system\xeikpYX.exe

Filesize
1.4MB

MD5
cd63cefbf2f1a26b24c36f6f3d43ccb4

SHA1
5f9e95e7c9cb94cba83faecbd09c0f32dd510bde

SHA256
c1e1d77722a2e1ca00ca3c9bac05606cf5276d7ce5c1bd257dc0dcc9bacb9144

SHA512
e6b27f42b801a06ab93ed584c882dd01c5e5d92e4e1ac24150df5d73775b056b95cc09ac83bd5f4276e9ef41ef39ea6e724c458772ef19df7150f3b9d5562306

Download Submit
\Windows\system\xqjBUoD.exe

Filesize
1.4MB

MD5
3e4eae043b04a51eea479cb685b0547b

SHA1
e68917777e243f8217cfa38c274d297dcd2c1ceb

SHA256
4c939442e03caec0696492cb39355bfd776f4ca48fe25cbdfea34e2f7543b1d3

SHA512
622b891d55b67d70db321a6df2591af09c12fe8ebad53286ef1fa98f906d8b22312ebf191e2f4d4effc56a508cb078c7b1f87870a95c4ab4c042af76cd9a3103

Download Submit
\Windows\system\ydmucwg.exe

Filesize
1.4MB

MD5
38390e4f6fa41bbe962adf98516ced2b

SHA1
ff2115ca82dd8730c6f36be167392057f40174ad

SHA256
88ecbabe4ca8b2a4cab62918d8229519e7b6e15e1d96292e5decc06be1dfa79f

SHA512
a501aaf0b75dd8d4c5074c0f0dc35899ce69fa910efda3c780b4ca856852bbffe05fb5f3921e6d59821733ce1dc4d944deaad981e97fbd6a483258d4e42c462d

Download Submit
memory/1820-23-0x000000013F3B0000-0x000000013F7A2000-memory.dmp

Filesize
3.9MB

Download
memory/1820-5550-0x000000013F3B0000-0x000000013F7A2000-memory.dmp

Filesize
3.9MB

Download
memory/2092-157-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/2092-5684-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/2148-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2148-169-0x0000000003640000-0x0000000003A32000-memory.dmp

Filesize
3.9MB

Download
memory/2148-285-0x000000013F4B0000-0x000000013F8A2000-memory.dmp

Filesize
3.9MB

Download
memory/2148-9531-0x000000013FCF0000-0x00000001400E2000-memory.dmp

Filesize
3.9MB

Download
memory/2148-9378-0x000000013F940000-0x000000013FD32000-memory.dmp

Filesize
3.9MB

Download
memory/2148-299-0x000000013FCF0000-0x00000001400E2000-memory.dmp

Filesize
3.9MB

Download
memory/2148-291-0x000000013F720000-0x000000013FB12000-memory.dmp

Filesize
3.9MB

Download
memory/2148-9231-0x000000013F720000-0x000000013FB12000-memory.dmp

Filesize
3.9MB

Download
memory/2148-9560-0x000000013F9C0000-0x000000013FDB2000-memory.dmp

Filesize
3.9MB

Download
memory/2148-297-0x000000013F940000-0x000000013FD32000-memory.dmp

Filesize
3.9MB

Download
memory/2148-296-0x000000013F980000-0x000000013FD72000-memory.dmp

Filesize
3.9MB

Download
memory/2148-300-0x000000013F8F0000-0x000000013FCE2000-memory.dmp

Filesize
3.9MB

Download
memory/2148-8928-0x0000000003640000-0x0000000003A32000-memory.dmp

Filesize
3.9MB

Download
memory/2148-9553-0x000000013F8F0000-0x000000013FCE2000-memory.dmp

Filesize
3.9MB

Download
memory/2148-1-0x000000013F040000-0x000000013F432000-memory.dmp

Filesize
3.9MB

Download
memory/2148-303-0x000000013F9C0000-0x000000013FDB2000-memory.dmp

Filesize
3.9MB

Download
memory/2148-287-0x000000013FEA0000-0x0000000140292000-memory.dmp

Filesize
3.9MB

Download
memory/2148-8020-0x000000013F4B0000-0x000000013F8A2000-memory.dmp

Filesize
3.9MB

Download
memory/2148-61-0x000000013F680000-0x000000013FA72000-memory.dmp

Filesize
3.9MB

Download
memory/2148-7-0x0000000002FF0000-0x00000000033E2000-memory.dmp

Filesize
3.9MB

Download
memory/2148-8850-0x000000013FEA0000-0x0000000140292000-memory.dmp

Filesize
3.9MB

Download
memory/2148-105-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/2148-8765-0x0000000003640000-0x0000000003A32000-memory.dmp

Filesize
3.9MB

Download
memory/2148-289-0x0000000003640000-0x0000000003A32000-memory.dmp

Filesize
3.9MB

Download
memory/2400-295-0x000000013F720000-0x000000013FB12000-memory.dmp

Filesize
3.9MB

Download
memory/2480-302-0x000000013F050000-0x000000013F442000-memory.dmp

Filesize
3.9MB

Download
memory/2564-288-0x000000013FEA0000-0x0000000140292000-memory.dmp

Filesize
3.9MB

Download
memory/2564-5785-0x000000013FEA0000-0x0000000140292000-memory.dmp

Filesize
3.9MB

Download
memory/2576-89-0x000000013F8F0000-0x000000013FCE2000-memory.dmp

Filesize
3.9MB

Download
memory/2576-5720-0x000000013F8F0000-0x000000013FCE2000-memory.dmp

Filesize
3.9MB

Download
memory/2632-176-0x000000013F060000-0x000000013F452000-memory.dmp

Filesize
3.9MB

Download
memory/2632-5737-0x000000013F060000-0x000000013F452000-memory.dmp

Filesize
3.9MB

Download
memory/2716-73-0x000000013F680000-0x000000013FA72000-memory.dmp

Filesize
3.9MB

Download
memory/2720-286-0x000000013F4B0000-0x000000013F8A2000-memory.dmp

Filesize
3.9MB

Download
memory/2944-290-0x000000013F9C0000-0x000000013FDB2000-memory.dmp

Filesize
3.9MB

Download
memory/2944-5853-0x000000013F9C0000-0x000000013FDB2000-memory.dmp

Filesize
3.9MB

Download
memory/2972-5625-0x000000013FCF0000-0x00000001400E2000-memory.dmp

Filesize
3.9MB

Download
memory/2972-60-0x000000013FCF0000-0x00000001400E2000-memory.dmp

Filesize
3.9MB

Download
memory/3016-58-0x000007FEF5CE0000-0x000007FEF667D000-memory.dmp

Filesize
9.6MB

Download
memory/3016-55-0x000007FEF5CE0000-0x000007FEF667D000-memory.dmp

Filesize
9.6MB

Download
memory/3016-59-0x000007FEF5CE0000-0x000007FEF667D000-memory.dmp

Filesize
9.6MB

Download
memory/3016-37-0x000000001B520000-0x000000001B802000-memory.dmp

Filesize
2.9MB

Download
memory/3016-257-0x000007FEF5CE0000-0x000007FEF667D000-memory.dmp

Filesize
9.6MB

Download
memory/3016-284-0x000007FEF5CE0000-0x000007FEF667D000-memory.dmp

Filesize
9.6MB

Download
memory/3016-24-0x000007FEF5F9E000-0x000007FEF5F9F000-memory.dmp

Filesize
4KB

Download
memory/3016-40-0x0000000002800000-0x0000000002808000-memory.dmp

Filesize
32KB

Download