xmrig | 8259a54199c3442abcff6f2c0ec29c46c849e1ecb68e2986cf5c8a3117189d95

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 17:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
Size

2.7MB
MD5

3b48fb1a67165967e314b2431c7ffb35
SHA1

9b3b7dd90dc02955acc53dd2d7a1436237eaa958
SHA256

8259a54199c3442abcff6f2c0ec29c46c849e1ecb68e2986cf5c8a3117189d95
SHA512

f7fbc25706a6f8ca348576bdfb692c07e33adb38bab28735600657bbdab41a45e6559805d744808904fde53abab11415ecefc53042a8466337793534c90513f6
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5I/9:NABW

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 25 IoCs

miner

resource	yara_rule
behavioral1/memory/2708-143-0x000000013F170000-0x000000013F562000-memory.dmp	xmrig
behavioral1/memory/2876-153-0x000000013FF20000-0x0000000140312000-memory.dmp	xmrig
behavioral1/memory/2656-151-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	xmrig
behavioral1/memory/2628-149-0x000000013F320000-0x000000013F712000-memory.dmp	xmrig
behavioral1/memory/2624-146-0x000000013F960000-0x000000013FD52000-memory.dmp	xmrig
behavioral1/memory/2216-12-0x000000013F280000-0x000000013F672000-memory.dmp	xmrig
behavioral1/memory/3024-156-0x000000013F8F0000-0x000000013FCE2000-memory.dmp	xmrig
behavioral1/memory/2544-158-0x000000013FB90000-0x000000013FF82000-memory.dmp	xmrig
behavioral1/memory/2508-160-0x000000013F620000-0x000000013FA12000-memory.dmp	xmrig
behavioral1/memory/2572-162-0x000000013F140000-0x000000013F532000-memory.dmp	xmrig
behavioral1/memory/2980-164-0x000000013FDE0000-0x00000001401D2000-memory.dmp	xmrig
behavioral1/memory/2996-166-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	xmrig
behavioral1/memory/2216-4992-0x000000013F280000-0x000000013F672000-memory.dmp	xmrig
behavioral1/memory/2628-4995-0x000000013F320000-0x000000013F712000-memory.dmp	xmrig
behavioral1/memory/2708-4996-0x000000013F170000-0x000000013F562000-memory.dmp	xmrig
behavioral1/memory/2544-5000-0x000000013FB90000-0x000000013FF82000-memory.dmp	xmrig
behavioral1/memory/2624-5015-0x000000013F960000-0x000000013FD52000-memory.dmp	xmrig
behavioral1/memory/2656-5021-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	xmrig
behavioral1/memory/2876-5007-0x000000013FF20000-0x0000000140312000-memory.dmp	xmrig
behavioral1/memory/3024-5011-0x000000013F8F0000-0x000000013FCE2000-memory.dmp	xmrig
behavioral1/memory/2572-5022-0x000000013F140000-0x000000013F532000-memory.dmp	xmrig
behavioral1/memory/2980-5031-0x000000013FDE0000-0x00000001401D2000-memory.dmp	xmrig
behavioral1/memory/2996-5032-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	xmrig
behavioral1/memory/2508-5029-0x000000013F620000-0x000000013FA12000-memory.dmp	xmrig
behavioral1/memory/616-9581-0x000000013F610000-0x000000013FA02000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1804	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2216	ObIWUOc.exe
2708	QLXhcTB.exe
2624	zcdQIeo.exe
2628	oBIJDzf.exe
2656	rmzShrx.exe
2876	KzUIrJf.exe
3024	rgXqXnA.exe
2544	pDBKDgp.exe
2508	YouBYqF.exe
2572	GuLcUVn.exe
2980	SyXzieR.exe
2996	ctQYgGE.exe
2860	dGRsdre.exe
2592	wmajwyu.exe
1484	yWTOQwm.exe
2828	oNmhXGv.exe
1936	eygkDNp.exe
380	MmohQFQ.exe
1844	PgQjQEo.exe
2840	HUmaEwl.exe
1924	oCZoSiR.exe
1672	XJsXqhO.exe
1284	aTheYWm.exe
268	EhQMdoN.exe
1092	cbkALMv.exe
776	XZnlFIJ.exe
2732	nnvdnTU.exe
1544	UjPSmNJ.exe
1088	ixwficI.exe
2276	IDQFEjy.exe
1852	SWQifSF.exe
2384	JHiVBjJ.exe
3020	TcwUfSJ.exe
2944	uZjzSwJ.exe
2052	iZfZwxk.exe
1492	psXeXgH.exe
2888	zfkKJDR.exe
1596	cqGAqUY.exe
2800	byPQQVn.exe
2604	LFRFjDs.exe
2784	xvRVpuM.exe
2676	bMmDtfy.exe
1376	KjSjXQX.exe
2964	cZuwYhr.exe
1928	eFywQVH.exe
1616	bsgHhHP.exe
1124	IvQslaj.exe
1904	ZVfaDSe.exe
2396	nRQcUvz.exe
1588	jceHEVO.exe
2796	xOEAwQg.exe
3084	gFfyFYR.exe
3116	JDIKjZW.exe
3148	fpnIEel.exe
3180	juaGWFw.exe
3212	KxbyGYm.exe
3244	mljjleP.exe
3276	aGZWPTN.exe
3308	oLsJYOc.exe
3340	DvcHnRK.exe
3372	KxbkFDk.exe
3404	obPuSwy.exe
3436	lkyRRTp.exe
3468	wFrIUOa.exe

Loads dropped DLL 64 IoCs

pid	Process
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe

UPX packed file 63 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000015cdf-33.dat	upx
behavioral1/files/0x0007000000015ce8-34.dat	upx
behavioral1/files/0x0007000000015cf0-43.dat	upx
behavioral1/files/0x0008000000016455-52.dat	upx
behavioral1/files/0x00060000000165e1-59.dat	upx
behavioral1/files/0x0006000000016581-58.dat	upx
behavioral1/files/0x0006000000016a8a-72.dat	upx
behavioral1/files/0x0006000000016d32-110.dat	upx
behavioral1/files/0x0006000000016d43-117.dat	upx
behavioral1/files/0x0006000000016d68-132.dat	upx
behavioral1/memory/2708-143-0x000000013F170000-0x000000013F562000-memory.dmp	upx
behavioral1/memory/2876-153-0x000000013FF20000-0x0000000140312000-memory.dmp	upx
behavioral1/files/0x0006000000016dba-172.dat	upx
behavioral1/files/0x0006000000016de3-191.dat	upx
behavioral1/files/0x0006000000017223-199.dat	upx
behavioral1/files/0x0006000000016d2a-102.dat	upx
behavioral1/files/0x0006000000016ceb-93.dat	upx
behavioral1/files/0x0006000000016c78-97.dat	upx
behavioral1/files/0x0006000000016dd1-183.dat	upx
behavioral1/memory/2656-151-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	upx
behavioral1/memory/2628-149-0x000000013F320000-0x000000013F712000-memory.dmp	upx
behavioral1/files/0x0006000000016d8b-147.dat	upx
behavioral1/memory/2624-146-0x000000013F960000-0x000000013FD52000-memory.dmp	upx
behavioral1/files/0x0006000000016d5f-126.dat	upx
behavioral1/files/0x0006000000016d17-100.dat	upx
behavioral1/files/0x0006000000016cc1-91.dat	upx
behavioral1/files/0x0006000000016c52-77.dat	upx
behavioral1/files/0x0006000000016c6f-82.dat	upx
behavioral1/files/0x0006000000016835-67.dat	upx
behavioral1/files/0x0008000000015d12-48.dat	upx
behavioral1/files/0x0008000000015cc7-28.dat	upx
behavioral1/files/0x000d00000000549e-17.dat	upx
behavioral1/files/0x0038000000015686-18.dat	upx
behavioral1/memory/2216-12-0x000000013F280000-0x000000013F672000-memory.dmp	upx
behavioral1/files/0x000b000000012286-6.dat	upx
behavioral1/memory/616-5-0x000000013F610000-0x000000013FA02000-memory.dmp	upx
behavioral1/memory/3024-156-0x000000013F8F0000-0x000000013FCE2000-memory.dmp	upx
behavioral1/memory/2544-158-0x000000013FB90000-0x000000013FF82000-memory.dmp	upx
behavioral1/memory/2508-160-0x000000013F620000-0x000000013FA12000-memory.dmp	upx
behavioral1/memory/2572-162-0x000000013F140000-0x000000013F532000-memory.dmp	upx
behavioral1/files/0x0006000000016d9f-154.dat	upx
behavioral1/files/0x0006000000016d6f-135.dat	upx
behavioral1/files/0x0006000000016d64-127.dat	upx
behavioral1/files/0x0006000000016d4b-119.dat	upx
behavioral1/files/0x0006000000016d3b-111.dat	upx
behavioral1/memory/2980-164-0x000000013FDE0000-0x00000001401D2000-memory.dmp	upx
behavioral1/files/0x0006000000016ddc-184.dat	upx
behavioral1/files/0x0006000000016dc8-175.dat	upx
behavioral1/memory/2996-166-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	upx
behavioral1/files/0x00060000000171d7-193.dat	upx
behavioral1/memory/2216-4992-0x000000013F280000-0x000000013F672000-memory.dmp	upx
behavioral1/memory/2628-4995-0x000000013F320000-0x000000013F712000-memory.dmp	upx
behavioral1/memory/2708-4996-0x000000013F170000-0x000000013F562000-memory.dmp	upx
behavioral1/memory/2544-5000-0x000000013FB90000-0x000000013FF82000-memory.dmp	upx
behavioral1/memory/2624-5015-0x000000013F960000-0x000000013FD52000-memory.dmp	upx
behavioral1/memory/2656-5021-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	upx
behavioral1/memory/2876-5007-0x000000013FF20000-0x0000000140312000-memory.dmp	upx
behavioral1/memory/3024-5011-0x000000013F8F0000-0x000000013FCE2000-memory.dmp	upx
behavioral1/memory/2572-5022-0x000000013F140000-0x000000013F532000-memory.dmp	upx
behavioral1/memory/2980-5031-0x000000013FDE0000-0x00000001401D2000-memory.dmp	upx
behavioral1/memory/2996-5032-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	upx
behavioral1/memory/2508-5029-0x000000013F620000-0x000000013FA12000-memory.dmp	upx
behavioral1/memory/616-9581-0x000000013F610000-0x000000013FA02000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\SetmLSE.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\eQDEpGi.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\wYpxLRi.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\xYwaVEh.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\ZTGOOJR.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\kYLCoEQ.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\qzaHELl.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\GmOPAlF.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\OWypUGB.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\swTEdAo.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\qeBRNsQ.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\LTKmlDT.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\uUugDkP.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\ozJuJSN.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\Igbyeyd.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\hgjPUSJ.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\zTTsyIT.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\VPMzfIU.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\qUpPpWz.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\Xiuzbct.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\mQgpHVJ.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\zRZKKZU.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\IXUVFDi.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\GUJVcCd.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\GheFTBI.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\VIMPLXO.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\BZTsdkM.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\wCVneNZ.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\FoAbCOn.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\OlCofGl.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\PQBwUos.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\LzbwOlL.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\NDCeHLI.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\SdIDOAq.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\NpVDBSL.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\UWFENLs.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\pvPSydB.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\WmCuNam.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\pDPYTvQ.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\HRszBIB.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\oWDBOVp.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\jXPcQsB.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\ZzJShbu.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\sMhlDfo.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\VuQGAld.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\XNwFldE.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\YcAxVoj.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\KsgPduP.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\LPHROAq.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\DvyKXrD.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\QnzNNaO.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\dYtAZXH.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\NoHDwCY.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\SiqTPPC.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\ksnSbmj.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\JCnYtVu.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\OFpHAJl.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\JNstwoi.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\qdFSLox.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\oEemvlQ.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\GBKzLhN.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\schTTTd.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\BriawNW.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\TxgiZXx.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1804	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
Token: SeDebugPrivilege	1804	powershell.exe
Token: SeLockMemoryPrivilege	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 616 wrote to memory of 1804	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	29
PID 616 wrote to memory of 1804	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	29
PID 616 wrote to memory of 1804	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	29
PID 616 wrote to memory of 2216	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	30
PID 616 wrote to memory of 2216	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	30
PID 616 wrote to memory of 2216	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	30
PID 616 wrote to memory of 2708	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	31
PID 616 wrote to memory of 2708	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	31
PID 616 wrote to memory of 2708	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	31
PID 616 wrote to memory of 2624	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	32
PID 616 wrote to memory of 2624	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	32
PID 616 wrote to memory of 2624	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	32
PID 616 wrote to memory of 2628	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	33
PID 616 wrote to memory of 2628	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	33
PID 616 wrote to memory of 2628	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	33
PID 616 wrote to memory of 2656	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	34
PID 616 wrote to memory of 2656	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	34
PID 616 wrote to memory of 2656	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	34
PID 616 wrote to memory of 2876	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	35
PID 616 wrote to memory of 2876	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	35
PID 616 wrote to memory of 2876	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	35
PID 616 wrote to memory of 3024	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	36
PID 616 wrote to memory of 3024	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	36
PID 616 wrote to memory of 3024	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	36
PID 616 wrote to memory of 2544	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	37
PID 616 wrote to memory of 2544	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	37
PID 616 wrote to memory of 2544	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	37
PID 616 wrote to memory of 2508	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	38
PID 616 wrote to memory of 2508	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	38
PID 616 wrote to memory of 2508	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	38
PID 616 wrote to memory of 2572	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	39
PID 616 wrote to memory of 2572	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	39
PID 616 wrote to memory of 2572	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	39
PID 616 wrote to memory of 2980	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	40
PID 616 wrote to memory of 2980	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	40
PID 616 wrote to memory of 2980	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	40
PID 616 wrote to memory of 2996	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	41
PID 616 wrote to memory of 2996	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	41
PID 616 wrote to memory of 2996	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	41
PID 616 wrote to memory of 2860	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	42
PID 616 wrote to memory of 2860	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	42
PID 616 wrote to memory of 2860	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	42
PID 616 wrote to memory of 2592	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	43
PID 616 wrote to memory of 2592	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	43
PID 616 wrote to memory of 2592	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	43
PID 616 wrote to memory of 1484	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	44
PID 616 wrote to memory of 1484	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	44
PID 616 wrote to memory of 1484	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	44
PID 616 wrote to memory of 1936	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	45
PID 616 wrote to memory of 1936	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	45
PID 616 wrote to memory of 1936	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	45
PID 616 wrote to memory of 2828	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	46
PID 616 wrote to memory of 2828	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	46
PID 616 wrote to memory of 2828	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	46
PID 616 wrote to memory of 2732	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	47
PID 616 wrote to memory of 2732	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	47
PID 616 wrote to memory of 2732	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	47
PID 616 wrote to memory of 380	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	48
PID 616 wrote to memory of 380	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	48
PID 616 wrote to memory of 380	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	48
PID 616 wrote to memory of 1948	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	49
PID 616 wrote to memory of 1948	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	49
PID 616 wrote to memory of 1948	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	49
PID 616 wrote to memory of 1844	616	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:616
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1804
- C:\Windows\System\ObIWUOc.exe
  C:\Windows\System\ObIWUOc.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\QLXhcTB.exe
  C:\Windows\System\QLXhcTB.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\zcdQIeo.exe
  C:\Windows\System\zcdQIeo.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\oBIJDzf.exe
  C:\Windows\System\oBIJDzf.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\rmzShrx.exe
  C:\Windows\System\rmzShrx.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\KzUIrJf.exe
  C:\Windows\System\KzUIrJf.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\rgXqXnA.exe
  C:\Windows\System\rgXqXnA.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\pDBKDgp.exe
  C:\Windows\System\pDBKDgp.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\YouBYqF.exe
  C:\Windows\System\YouBYqF.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\GuLcUVn.exe
  C:\Windows\System\GuLcUVn.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\SyXzieR.exe
  C:\Windows\System\SyXzieR.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\ctQYgGE.exe
  C:\Windows\System\ctQYgGE.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\dGRsdre.exe
  C:\Windows\System\dGRsdre.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\wmajwyu.exe
  C:\Windows\System\wmajwyu.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\yWTOQwm.exe
  C:\Windows\System\yWTOQwm.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\eygkDNp.exe
  C:\Windows\System\eygkDNp.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\oNmhXGv.exe
  C:\Windows\System\oNmhXGv.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\nnvdnTU.exe
  C:\Windows\System\nnvdnTU.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\MmohQFQ.exe
  C:\Windows\System\MmohQFQ.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\yfckBqg.exe
  C:\Windows\System\yfckBqg.exe
  2⤵
  PID:1948
- C:\Windows\System\PgQjQEo.exe
  C:\Windows\System\PgQjQEo.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\NnAgdMT.exe
  C:\Windows\System\NnAgdMT.exe
  2⤵
  PID:556
- C:\Windows\System\HUmaEwl.exe
  C:\Windows\System\HUmaEwl.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\DwiwfXU.exe
  C:\Windows\System\DwiwfXU.exe
  2⤵
  PID:2824
- C:\Windows\System\oCZoSiR.exe
  C:\Windows\System\oCZoSiR.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\paFRhuc.exe
  C:\Windows\System\paFRhuc.exe
  2⤵
  PID:1812
- C:\Windows\System\XJsXqhO.exe
  C:\Windows\System\XJsXqhO.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\TpIvClq.exe
  C:\Windows\System\TpIvClq.exe
  2⤵
  PID:1580
- C:\Windows\System\aTheYWm.exe
  C:\Windows\System\aTheYWm.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\tzIwZGV.exe
  C:\Windows\System\tzIwZGV.exe
  2⤵
  PID:2920
- C:\Windows\System\EhQMdoN.exe
  C:\Windows\System\EhQMdoN.exe
  2⤵
  - Executes dropped EXE
  PID:268
- C:\Windows\System\EoSpvQA.exe
  C:\Windows\System\EoSpvQA.exe
  2⤵
  PID:1476
- C:\Windows\System\cbkALMv.exe
  C:\Windows\System\cbkALMv.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\ZIlFrwY.exe
  C:\Windows\System\ZIlFrwY.exe
  2⤵
  PID:1968
- C:\Windows\System\XZnlFIJ.exe
  C:\Windows\System\XZnlFIJ.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\EDWvtQp.exe
  C:\Windows\System\EDWvtQp.exe
  2⤵
  PID:1760
- C:\Windows\System\UjPSmNJ.exe
  C:\Windows\System\UjPSmNJ.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\ZwLUXCc.exe
  C:\Windows\System\ZwLUXCc.exe
  2⤵
  PID:1320
- C:\Windows\System\ixwficI.exe
  C:\Windows\System\ixwficI.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\gSVeJUi.exe
  C:\Windows\System\gSVeJUi.exe
  2⤵
  PID:1908
- C:\Windows\System\IDQFEjy.exe
  C:\Windows\System\IDQFEjy.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\NLPYQkG.exe
  C:\Windows\System\NLPYQkG.exe
  2⤵
  PID:1236
- C:\Windows\System\SWQifSF.exe
  C:\Windows\System\SWQifSF.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\SetmLSE.exe
  C:\Windows\System\SetmLSE.exe
  2⤵
  PID:896
- C:\Windows\System\JHiVBjJ.exe
  C:\Windows\System\JHiVBjJ.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\ZcmntkJ.exe
  C:\Windows\System\ZcmntkJ.exe
  2⤵
  PID:3008
- C:\Windows\System\TcwUfSJ.exe
  C:\Windows\System\TcwUfSJ.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\moUeDrO.exe
  C:\Windows\System\moUeDrO.exe
  2⤵
  PID:1316
- C:\Windows\System\uZjzSwJ.exe
  C:\Windows\System\uZjzSwJ.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\JYdkUlu.exe
  C:\Windows\System\JYdkUlu.exe
  2⤵
  PID:1008
- C:\Windows\System\iZfZwxk.exe
  C:\Windows\System\iZfZwxk.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\jOvshMq.exe
  C:\Windows\System\jOvshMq.exe
  2⤵
  PID:1372
- C:\Windows\System\psXeXgH.exe
  C:\Windows\System\psXeXgH.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\IsCYqVo.exe
  C:\Windows\System\IsCYqVo.exe
  2⤵
  PID:1796
- C:\Windows\System\zfkKJDR.exe
  C:\Windows\System\zfkKJDR.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\TXVWIcr.exe
  C:\Windows\System\TXVWIcr.exe
  2⤵
  PID:1512
- C:\Windows\System\cqGAqUY.exe
  C:\Windows\System\cqGAqUY.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\InerzVk.exe
  C:\Windows\System\InerzVk.exe
  2⤵
  PID:1592
- C:\Windows\System\byPQQVn.exe
  C:\Windows\System\byPQQVn.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\TDXGQKM.exe
  C:\Windows\System\TDXGQKM.exe
  2⤵
  PID:2064
- C:\Windows\System\LFRFjDs.exe
  C:\Windows\System\LFRFjDs.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\modBPDk.exe
  C:\Windows\System\modBPDk.exe
  2⤵
  PID:2620
- C:\Windows\System\xvRVpuM.exe
  C:\Windows\System\xvRVpuM.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\oIxmZQT.exe
  C:\Windows\System\oIxmZQT.exe
  2⤵
  PID:2520
- C:\Windows\System\bMmDtfy.exe
  C:\Windows\System\bMmDtfy.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\dTDirbV.exe
  C:\Windows\System\dTDirbV.exe
  2⤵
  PID:2528
- C:\Windows\System\KjSjXQX.exe
  C:\Windows\System\KjSjXQX.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\xWSCSKK.exe
  C:\Windows\System\xWSCSKK.exe
  2⤵
  PID:3000
- C:\Windows\System\cZuwYhr.exe
  C:\Windows\System\cZuwYhr.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\laqUbFO.exe
  C:\Windows\System\laqUbFO.exe
  2⤵
  PID:2092
- C:\Windows\System\eFywQVH.exe
  C:\Windows\System\eFywQVH.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\IrrAQjy.exe
  C:\Windows\System\IrrAQjy.exe
  2⤵
  PID:2832
- C:\Windows\System\bsgHhHP.exe
  C:\Windows\System\bsgHhHP.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\UKbxwFz.exe
  C:\Windows\System\UKbxwFz.exe
  2⤵
  PID:968
- C:\Windows\System\IvQslaj.exe
  C:\Windows\System\IvQslaj.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\gDSsfXa.exe
  C:\Windows\System\gDSsfXa.exe
  2⤵
  PID:944
- C:\Windows\System\ZVfaDSe.exe
  C:\Windows\System\ZVfaDSe.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\okMMWlw.exe
  C:\Windows\System\okMMWlw.exe
  2⤵
  PID:2172
- C:\Windows\System\nRQcUvz.exe
  C:\Windows\System\nRQcUvz.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\vKEhaIu.exe
  C:\Windows\System\vKEhaIu.exe
  2⤵
  PID:1644
- C:\Windows\System\jceHEVO.exe
  C:\Windows\System\jceHEVO.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\NtkAdOr.exe
  C:\Windows\System\NtkAdOr.exe
  2⤵
  PID:1384
- C:\Windows\System\xOEAwQg.exe
  C:\Windows\System\xOEAwQg.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\bEWlLBZ.exe
  C:\Windows\System\bEWlLBZ.exe
  2⤵
  PID:1624
- C:\Windows\System\gFfyFYR.exe
  C:\Windows\System\gFfyFYR.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\tAwmcyX.exe
  C:\Windows\System\tAwmcyX.exe
  2⤵
  PID:3100
- C:\Windows\System\JDIKjZW.exe
  C:\Windows\System\JDIKjZW.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\aHJAbiA.exe
  C:\Windows\System\aHJAbiA.exe
  2⤵
  PID:3132
- C:\Windows\System\fpnIEel.exe
  C:\Windows\System\fpnIEel.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\NtbNBWo.exe
  C:\Windows\System\NtbNBWo.exe
  2⤵
  PID:3164
- C:\Windows\System\juaGWFw.exe
  C:\Windows\System\juaGWFw.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\ViZdbVe.exe
  C:\Windows\System\ViZdbVe.exe
  2⤵
  PID:3196
- C:\Windows\System\KxbyGYm.exe
  C:\Windows\System\KxbyGYm.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\QgdaQJB.exe
  C:\Windows\System\QgdaQJB.exe
  2⤵
  PID:3228
- C:\Windows\System\mljjleP.exe
  C:\Windows\System\mljjleP.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\wteXwKn.exe
  C:\Windows\System\wteXwKn.exe
  2⤵
  PID:3260
- C:\Windows\System\aGZWPTN.exe
  C:\Windows\System\aGZWPTN.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\ubdEmoN.exe
  C:\Windows\System\ubdEmoN.exe
  2⤵
  PID:3292
- C:\Windows\System\oLsJYOc.exe
  C:\Windows\System\oLsJYOc.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System\wGSpfKP.exe
  C:\Windows\System\wGSpfKP.exe
  2⤵
  PID:3324
- C:\Windows\System\DvcHnRK.exe
  C:\Windows\System\DvcHnRK.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\pdntpRf.exe
  C:\Windows\System\pdntpRf.exe
  2⤵
  PID:3356
- C:\Windows\System\KxbkFDk.exe
  C:\Windows\System\KxbkFDk.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\eRXNmPv.exe
  C:\Windows\System\eRXNmPv.exe
  2⤵
  PID:3388
- C:\Windows\System\obPuSwy.exe
  C:\Windows\System\obPuSwy.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\QzkAvxA.exe
  C:\Windows\System\QzkAvxA.exe
  2⤵
  PID:3420
- C:\Windows\System\lkyRRTp.exe
  C:\Windows\System\lkyRRTp.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\mvPMXfA.exe
  C:\Windows\System\mvPMXfA.exe
  2⤵
  PID:3452
- C:\Windows\System\wFrIUOa.exe
  C:\Windows\System\wFrIUOa.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\htsqAcg.exe
  C:\Windows\System\htsqAcg.exe
  2⤵
  PID:3484
- C:\Windows\System\BYYCGMG.exe
  C:\Windows\System\BYYCGMG.exe
  2⤵
  PID:3500
- C:\Windows\System\gBBPtsJ.exe
  C:\Windows\System\gBBPtsJ.exe
  2⤵
  PID:3516
- C:\Windows\System\iWNezqY.exe
  C:\Windows\System\iWNezqY.exe
  2⤵
  PID:3532
- C:\Windows\System\HFpQyXW.exe
  C:\Windows\System\HFpQyXW.exe
  2⤵
  PID:3548
- C:\Windows\System\GASVsTh.exe
  C:\Windows\System\GASVsTh.exe
  2⤵
  PID:3564
- C:\Windows\System\fdLIGmr.exe
  C:\Windows\System\fdLIGmr.exe
  2⤵
  PID:3580
- C:\Windows\System\nhrACWe.exe
  C:\Windows\System\nhrACWe.exe
  2⤵
  PID:3596
- C:\Windows\System\uXtmgXL.exe
  C:\Windows\System\uXtmgXL.exe
  2⤵
  PID:3612
- C:\Windows\System\BOSUSBw.exe
  C:\Windows\System\BOSUSBw.exe
  2⤵
  PID:3628
- C:\Windows\System\BgcHjyv.exe
  C:\Windows\System\BgcHjyv.exe
  2⤵
  PID:3644
- C:\Windows\System\ultQVBa.exe
  C:\Windows\System\ultQVBa.exe
  2⤵
  PID:3660
- C:\Windows\System\YPWWhva.exe
  C:\Windows\System\YPWWhva.exe
  2⤵
  PID:3676
- C:\Windows\System\LgvmWvs.exe
  C:\Windows\System\LgvmWvs.exe
  2⤵
  PID:3692
- C:\Windows\System\iMdqCzG.exe
  C:\Windows\System\iMdqCzG.exe
  2⤵
  PID:3708
- C:\Windows\System\yZfKEVs.exe
  C:\Windows\System\yZfKEVs.exe
  2⤵
  PID:3724
- C:\Windows\System\JECmEjZ.exe
  C:\Windows\System\JECmEjZ.exe
  2⤵
  PID:3740
- C:\Windows\System\FpfQETu.exe
  C:\Windows\System\FpfQETu.exe
  2⤵
  PID:3756
- C:\Windows\System\RiWcpwt.exe
  C:\Windows\System\RiWcpwt.exe
  2⤵
  PID:3772
- C:\Windows\System\zoBhMJk.exe
  C:\Windows\System\zoBhMJk.exe
  2⤵
  PID:3788
- C:\Windows\System\FoyGPqz.exe
  C:\Windows\System\FoyGPqz.exe
  2⤵
  PID:3804
- C:\Windows\System\aNyRWSH.exe
  C:\Windows\System\aNyRWSH.exe
  2⤵
  PID:3820
- C:\Windows\System\bSMUwrg.exe
  C:\Windows\System\bSMUwrg.exe
  2⤵
  PID:3836
- C:\Windows\System\jSElfaC.exe
  C:\Windows\System\jSElfaC.exe
  2⤵
  PID:3852
- C:\Windows\System\rxNBMTb.exe
  C:\Windows\System\rxNBMTb.exe
  2⤵
  PID:3868
- C:\Windows\System\OFpHAJl.exe
  C:\Windows\System\OFpHAJl.exe
  2⤵
  PID:3884
- C:\Windows\System\uBJdYbr.exe
  C:\Windows\System\uBJdYbr.exe
  2⤵
  PID:3900
- C:\Windows\System\KEULzBZ.exe
  C:\Windows\System\KEULzBZ.exe
  2⤵
  PID:3916
- C:\Windows\System\cnnpRJc.exe
  C:\Windows\System\cnnpRJc.exe
  2⤵
  PID:3932
- C:\Windows\System\YyPLpdq.exe
  C:\Windows\System\YyPLpdq.exe
  2⤵
  PID:3948
- C:\Windows\System\UYpwEtg.exe
  C:\Windows\System\UYpwEtg.exe
  2⤵
  PID:3964
- C:\Windows\System\vngXGcv.exe
  C:\Windows\System\vngXGcv.exe
  2⤵
  PID:3980
- C:\Windows\System\QtTJqCd.exe
  C:\Windows\System\QtTJqCd.exe
  2⤵
  PID:3996
- C:\Windows\System\HDfmSlD.exe
  C:\Windows\System\HDfmSlD.exe
  2⤵
  PID:4012
- C:\Windows\System\SnPVCHE.exe
  C:\Windows\System\SnPVCHE.exe
  2⤵
  PID:4028
- C:\Windows\System\tfTqnSg.exe
  C:\Windows\System\tfTqnSg.exe
  2⤵
  PID:4044
- C:\Windows\System\GdEiPgg.exe
  C:\Windows\System\GdEiPgg.exe
  2⤵
  PID:4060
- C:\Windows\System\ckPdESK.exe
  C:\Windows\System\ckPdESK.exe
  2⤵
  PID:4076
- C:\Windows\System\JoMubmm.exe
  C:\Windows\System\JoMubmm.exe
  2⤵
  PID:4092
- C:\Windows\System\PHAHuru.exe
  C:\Windows\System\PHAHuru.exe
  2⤵
  PID:1072
- C:\Windows\System\isRomLd.exe
  C:\Windows\System\isRomLd.exe
  2⤵
  PID:604
- C:\Windows\System\ofzoRQO.exe
  C:\Windows\System\ofzoRQO.exe
  2⤵
  PID:1980
- C:\Windows\System\YLXfWAR.exe
  C:\Windows\System\YLXfWAR.exe
  2⤵
  PID:3092
- C:\Windows\System\JQOaRYh.exe
  C:\Windows\System\JQOaRYh.exe
  2⤵
  PID:3156
- C:\Windows\System\uOEPKJm.exe
  C:\Windows\System\uOEPKJm.exe
  2⤵
  PID:3220
- C:\Windows\System\EcoAeEf.exe
  C:\Windows\System\EcoAeEf.exe
  2⤵
  PID:3284
- C:\Windows\System\wvLoWju.exe
  C:\Windows\System\wvLoWju.exe
  2⤵
  PID:3348
- C:\Windows\System\gRUYPpu.exe
  C:\Windows\System\gRUYPpu.exe
  2⤵
  PID:3412
- C:\Windows\System\XNACCdI.exe
  C:\Windows\System\XNACCdI.exe
  2⤵
  PID:3476
- C:\Windows\System\cxAmjms.exe
  C:\Windows\System\cxAmjms.exe
  2⤵
  PID:3540
- C:\Windows\System\CIJAOmc.exe
  C:\Windows\System\CIJAOmc.exe
  2⤵
  PID:3604
- C:\Windows\System\BQiwAcy.exe
  C:\Windows\System\BQiwAcy.exe
  2⤵
  PID:3640
- C:\Windows\System\BHnhpLv.exe
  C:\Windows\System\BHnhpLv.exe
  2⤵
  PID:3700
- C:\Windows\System\XEwMPPI.exe
  C:\Windows\System\XEwMPPI.exe
  2⤵
  PID:3764
- C:\Windows\System\QwDbUNB.exe
  C:\Windows\System\QwDbUNB.exe
  2⤵
  PID:3828
- C:\Windows\System\XhTTQRM.exe
  C:\Windows\System\XhTTQRM.exe
  2⤵
  PID:3892
- C:\Windows\System\FqYWSGE.exe
  C:\Windows\System\FqYWSGE.exe
  2⤵
  PID:3956
- C:\Windows\System\ZJEdRHE.exe
  C:\Windows\System\ZJEdRHE.exe
  2⤵
  PID:4020
- C:\Windows\System\WmwQzOh.exe
  C:\Windows\System\WmwQzOh.exe
  2⤵
  PID:4084
- C:\Windows\System\HfrEFUh.exe
  C:\Windows\System\HfrEFUh.exe
  2⤵
  PID:4108
- C:\Windows\System\lllzmXT.exe
  C:\Windows\System\lllzmXT.exe
  2⤵
  PID:4124
- C:\Windows\System\qogofkn.exe
  C:\Windows\System\qogofkn.exe
  2⤵
  PID:4140
- C:\Windows\System\uJTslSH.exe
  C:\Windows\System\uJTslSH.exe
  2⤵
  PID:4156
- C:\Windows\System\tNHWuwb.exe
  C:\Windows\System\tNHWuwb.exe
  2⤵
  PID:4172
- C:\Windows\System\FjPpVOv.exe
  C:\Windows\System\FjPpVOv.exe
  2⤵
  PID:4188
- C:\Windows\System\jcdcLhG.exe
  C:\Windows\System\jcdcLhG.exe
  2⤵
  PID:4204
- C:\Windows\System\MriaCxa.exe
  C:\Windows\System\MriaCxa.exe
  2⤵
  PID:4220
- C:\Windows\System\HWpVVae.exe
  C:\Windows\System\HWpVVae.exe
  2⤵
  PID:4236
- C:\Windows\System\WolrJRH.exe
  C:\Windows\System\WolrJRH.exe
  2⤵
  PID:4252
- C:\Windows\System\sIFcENT.exe
  C:\Windows\System\sIFcENT.exe
  2⤵
  PID:4268
- C:\Windows\System\ajNiuOv.exe
  C:\Windows\System\ajNiuOv.exe
  2⤵
  PID:4284
- C:\Windows\System\bYiYJbe.exe
  C:\Windows\System\bYiYJbe.exe
  2⤵
  PID:4300
- C:\Windows\System\IFZEFix.exe
  C:\Windows\System\IFZEFix.exe
  2⤵
  PID:4316
- C:\Windows\System\IVGMMdx.exe
  C:\Windows\System\IVGMMdx.exe
  2⤵
  PID:4332
- C:\Windows\System\KQKLLAV.exe
  C:\Windows\System\KQKLLAV.exe
  2⤵
  PID:4348
- C:\Windows\System\YkYnWfP.exe
  C:\Windows\System\YkYnWfP.exe
  2⤵
  PID:4364
- C:\Windows\System\LZgrEUW.exe
  C:\Windows\System\LZgrEUW.exe
  2⤵
  PID:4380
- C:\Windows\System\VzSHkop.exe
  C:\Windows\System\VzSHkop.exe
  2⤵
  PID:4396
- C:\Windows\System\pIUcShn.exe
  C:\Windows\System\pIUcShn.exe
  2⤵
  PID:4412
- C:\Windows\System\YQUdmWh.exe
  C:\Windows\System\YQUdmWh.exe
  2⤵
  PID:4428
- C:\Windows\System\ollIjEp.exe
  C:\Windows\System\ollIjEp.exe
  2⤵
  PID:4444
- C:\Windows\System\xKvcSWy.exe
  C:\Windows\System\xKvcSWy.exe
  2⤵
  PID:4460
- C:\Windows\System\hivsYyI.exe
  C:\Windows\System\hivsYyI.exe
  2⤵
  PID:4476
- C:\Windows\System\YoFPlBU.exe
  C:\Windows\System\YoFPlBU.exe
  2⤵
  PID:4492
- C:\Windows\System\kPEtWFd.exe
  C:\Windows\System\kPEtWFd.exe
  2⤵
  PID:4508
- C:\Windows\System\UIpxhrg.exe
  C:\Windows\System\UIpxhrg.exe
  2⤵
  PID:4524
- C:\Windows\System\xSQzAtB.exe
  C:\Windows\System\xSQzAtB.exe
  2⤵
  PID:4540
- C:\Windows\System\FRVQioz.exe
  C:\Windows\System\FRVQioz.exe
  2⤵
  PID:4556
- C:\Windows\System\VTZiLrg.exe
  C:\Windows\System\VTZiLrg.exe
  2⤵
  PID:4572
- C:\Windows\System\RFWvymm.exe
  C:\Windows\System\RFWvymm.exe
  2⤵
  PID:4588
- C:\Windows\System\lJqNRaW.exe
  C:\Windows\System\lJqNRaW.exe
  2⤵
  PID:4604
- C:\Windows\System\aQxaUlq.exe
  C:\Windows\System\aQxaUlq.exe
  2⤵
  PID:4620
- C:\Windows\System\yepLKsq.exe
  C:\Windows\System\yepLKsq.exe
  2⤵
  PID:4636
- C:\Windows\System\WemIJIZ.exe
  C:\Windows\System\WemIJIZ.exe
  2⤵
  PID:4652
- C:\Windows\System\gplqIEZ.exe
  C:\Windows\System\gplqIEZ.exe
  2⤵
  PID:4668
- C:\Windows\System\reHqNuC.exe
  C:\Windows\System\reHqNuC.exe
  2⤵
  PID:4684
- C:\Windows\System\QCbDNkl.exe
  C:\Windows\System\QCbDNkl.exe
  2⤵
  PID:4700
- C:\Windows\System\TYnZdQm.exe
  C:\Windows\System\TYnZdQm.exe
  2⤵
  PID:4716
- C:\Windows\System\yWVIpKc.exe
  C:\Windows\System\yWVIpKc.exe
  2⤵
  PID:4732
- C:\Windows\System\kRCSoNV.exe
  C:\Windows\System\kRCSoNV.exe
  2⤵
  PID:4752
- C:\Windows\System\dHLaGWa.exe
  C:\Windows\System\dHLaGWa.exe
  2⤵
  PID:4768
- C:\Windows\System\tIFxFgY.exe
  C:\Windows\System\tIFxFgY.exe
  2⤵
  PID:4784
- C:\Windows\System\jMYgRRK.exe
  C:\Windows\System\jMYgRRK.exe
  2⤵
  PID:4800
- C:\Windows\System\nblfzKF.exe
  C:\Windows\System\nblfzKF.exe
  2⤵
  PID:4816
- C:\Windows\System\yloyuFz.exe
  C:\Windows\System\yloyuFz.exe
  2⤵
  PID:4832
- C:\Windows\System\qhDlglt.exe
  C:\Windows\System\qhDlglt.exe
  2⤵
  PID:4848
- C:\Windows\System\UtpgSeX.exe
  C:\Windows\System\UtpgSeX.exe
  2⤵
  PID:4864
- C:\Windows\System\EnuADTj.exe
  C:\Windows\System\EnuADTj.exe
  2⤵
  PID:4880
- C:\Windows\System\CIcovEA.exe
  C:\Windows\System\CIcovEA.exe
  2⤵
  PID:4896
- C:\Windows\System\fsRYRjX.exe
  C:\Windows\System\fsRYRjX.exe
  2⤵
  PID:4912
- C:\Windows\System\ETiAOmE.exe
  C:\Windows\System\ETiAOmE.exe
  2⤵
  PID:4928
- C:\Windows\System\IGdBROc.exe
  C:\Windows\System\IGdBROc.exe
  2⤵
  PID:4944
- C:\Windows\System\qtPOyzu.exe
  C:\Windows\System\qtPOyzu.exe
  2⤵
  PID:4960
- C:\Windows\System\PxnaMLI.exe
  C:\Windows\System\PxnaMLI.exe
  2⤵
  PID:4976
- C:\Windows\System\yIPrDrK.exe
  C:\Windows\System\yIPrDrK.exe
  2⤵
  PID:4992
- C:\Windows\System\AmJrIXq.exe
  C:\Windows\System\AmJrIXq.exe
  2⤵
  PID:5008
- C:\Windows\System\aNZlxeu.exe
  C:\Windows\System\aNZlxeu.exe
  2⤵
  PID:5024
- C:\Windows\System\FJTKSAO.exe
  C:\Windows\System\FJTKSAO.exe
  2⤵
  PID:5040
- C:\Windows\System\cqKKzul.exe
  C:\Windows\System\cqKKzul.exe
  2⤵
  PID:5056
- C:\Windows\System\lISZpor.exe
  C:\Windows\System\lISZpor.exe
  2⤵
  PID:5072
- C:\Windows\System\eWnDAgg.exe
  C:\Windows\System\eWnDAgg.exe
  2⤵
  PID:5088
- C:\Windows\System\ltxrwhX.exe
  C:\Windows\System\ltxrwhX.exe
  2⤵
  PID:5104
- C:\Windows\System\JYxsAVM.exe
  C:\Windows\System\JYxsAVM.exe
  2⤵
  PID:2464
- C:\Windows\System\rrpuTAj.exe
  C:\Windows\System\rrpuTAj.exe
  2⤵
  PID:3188
- C:\Windows\System\oltUFYg.exe
  C:\Windows\System\oltUFYg.exe
  2⤵
  PID:3444
- C:\Windows\System\llYsBFl.exe
  C:\Windows\System\llYsBFl.exe
  2⤵
  PID:3572
- C:\Windows\System\yCDjFnt.exe
  C:\Windows\System\yCDjFnt.exe
  2⤵
  PID:3796
- C:\Windows\System\wzTPxyW.exe
  C:\Windows\System\wzTPxyW.exe
  2⤵
  PID:4052
- C:\Windows\System\JoMJBxE.exe
  C:\Windows\System\JoMJBxE.exe
  2⤵
  PID:4148
- C:\Windows\System\SDwLyvB.exe
  C:\Windows\System\SDwLyvB.exe
  2⤵
  PID:2780
- C:\Windows\System\aHiokhA.exe
  C:\Windows\System\aHiokhA.exe
  2⤵
  PID:4212
- C:\Windows\System\MSCxpPT.exe
  C:\Windows\System\MSCxpPT.exe
  2⤵
  PID:4276
- C:\Windows\System\gQHJTrp.exe
  C:\Windows\System\gQHJTrp.exe
  2⤵
  PID:2004
- C:\Windows\System\ITLlJHq.exe
  C:\Windows\System\ITLlJHq.exe
  2⤵
  PID:2156
- C:\Windows\System\SEnIzLq.exe
  C:\Windows\System\SEnIzLq.exe
  2⤵
  PID:4988
- C:\Windows\System\NpRbUQj.exe
  C:\Windows\System\NpRbUQj.exe
  2⤵
  PID:2812
- C:\Windows\System\PveHkfn.exe
  C:\Windows\System\PveHkfn.exe
  2⤵
  PID:2260
- C:\Windows\System\zYfEMyu.exe
  C:\Windows\System\zYfEMyu.exe
  2⤵
  PID:5204
- C:\Windows\System\VUnuDmv.exe
  C:\Windows\System\VUnuDmv.exe
  2⤵
  PID:5292
- C:\Windows\System\nXdkirP.exe
  C:\Windows\System\nXdkirP.exe
  2⤵
  PID:5308
- C:\Windows\System\MMWULpv.exe
  C:\Windows\System\MMWULpv.exe
  2⤵
  PID:5324
- C:\Windows\System\qwUvKYQ.exe
  C:\Windows\System\qwUvKYQ.exe
  2⤵
  PID:5340
- C:\Windows\System\ssHZEhr.exe
  C:\Windows\System\ssHZEhr.exe
  2⤵
  PID:5356
- C:\Windows\System\XMYUMPn.exe
  C:\Windows\System\XMYUMPn.exe
  2⤵
  PID:5372
- C:\Windows\System\PlRKsaR.exe
  C:\Windows\System\PlRKsaR.exe
  2⤵
  PID:5392
- C:\Windows\System\ZoAcVOa.exe
  C:\Windows\System\ZoAcVOa.exe
  2⤵
  PID:5412
- C:\Windows\System\uTKCQdd.exe
  C:\Windows\System\uTKCQdd.exe
  2⤵
  PID:5432
- C:\Windows\System\JgKroro.exe
  C:\Windows\System\JgKroro.exe
  2⤵
  PID:5452
- C:\Windows\System\MUWuuoF.exe
  C:\Windows\System\MUWuuoF.exe
  2⤵
  PID:5488
- C:\Windows\System\hEgEQPe.exe
  C:\Windows\System\hEgEQPe.exe
  2⤵
  PID:5508
- C:\Windows\System\rqlSllF.exe
  C:\Windows\System\rqlSllF.exe
  2⤵
  PID:5552
- C:\Windows\System\wlRmxBg.exe
  C:\Windows\System\wlRmxBg.exe
  2⤵
  PID:5580
- C:\Windows\System\UeCRxwc.exe
  C:\Windows\System\UeCRxwc.exe
  2⤵
  PID:5596
- C:\Windows\System\pdpXaUT.exe
  C:\Windows\System\pdpXaUT.exe
  2⤵
  PID:5612
- C:\Windows\System\WmVPqIy.exe
  C:\Windows\System\WmVPqIy.exe
  2⤵
  PID:5628
- C:\Windows\System\RYvbHOq.exe
  C:\Windows\System\RYvbHOq.exe
  2⤵
  PID:5668
- C:\Windows\System\SzSwGjt.exe
  C:\Windows\System\SzSwGjt.exe
  2⤵
  PID:5684
- C:\Windows\System\uQJwZzT.exe
  C:\Windows\System\uQJwZzT.exe
  2⤵
  PID:5700
- C:\Windows\System\ByuARJY.exe
  C:\Windows\System\ByuARJY.exe
  2⤵
  PID:5716
- C:\Windows\System\xyWAMQh.exe
  C:\Windows\System\xyWAMQh.exe
  2⤵
  PID:5748
- C:\Windows\System\UPwxVwJ.exe
  C:\Windows\System\UPwxVwJ.exe
  2⤵
  PID:5788
- C:\Windows\System\LdogbRN.exe
  C:\Windows\System\LdogbRN.exe
  2⤵
  PID:5812
- C:\Windows\System\tzLFhYI.exe
  C:\Windows\System\tzLFhYI.exe
  2⤵
  PID:5828
- C:\Windows\System\LaJCsxG.exe
  C:\Windows\System\LaJCsxG.exe
  2⤵
  PID:5844
- C:\Windows\System\NCZVJHB.exe
  C:\Windows\System\NCZVJHB.exe
  2⤵
  PID:5860
- C:\Windows\System\UVCwVGH.exe
  C:\Windows\System\UVCwVGH.exe
  2⤵
  PID:5884
- C:\Windows\System\lkBmGVV.exe
  C:\Windows\System\lkBmGVV.exe
  2⤵
  PID:5908
- C:\Windows\System\aBplIhp.exe
  C:\Windows\System\aBplIhp.exe
  2⤵
  PID:5924
- C:\Windows\System\fxTJswc.exe
  C:\Windows\System\fxTJswc.exe
  2⤵
  PID:5940
- C:\Windows\System\hYEEVXr.exe
  C:\Windows\System\hYEEVXr.exe
  2⤵
  PID:5956
- C:\Windows\System\Cddwuoi.exe
  C:\Windows\System\Cddwuoi.exe
  2⤵
  PID:5980
- C:\Windows\System\yysDrEt.exe
  C:\Windows\System\yysDrEt.exe
  2⤵
  PID:5996
- C:\Windows\System\gEfHkzn.exe
  C:\Windows\System\gEfHkzn.exe
  2⤵
  PID:6012
- C:\Windows\System\ZhJLNBQ.exe
  C:\Windows\System\ZhJLNBQ.exe
  2⤵
  PID:6068
- C:\Windows\System\febUViK.exe
  C:\Windows\System\febUViK.exe
  2⤵
  PID:6092
- C:\Windows\System\zVMVzby.exe
  C:\Windows\System\zVMVzby.exe
  2⤵
  PID:6108
- C:\Windows\System\tgfWYaL.exe
  C:\Windows\System\tgfWYaL.exe
  2⤵
  PID:6124
- C:\Windows\System\lIazKaQ.exe
  C:\Windows\System\lIazKaQ.exe
  2⤵
  PID:756
- C:\Windows\System\NWIdRDZ.exe
  C:\Windows\System\NWIdRDZ.exe
  2⤵
  PID:2756
- C:\Windows\System\XzMuWHV.exe
  C:\Windows\System\XzMuWHV.exe
  2⤵
  PID:1612
- C:\Windows\System\tAmUBcm.exe
  C:\Windows\System\tAmUBcm.exe
  2⤵
  PID:2124
- C:\Windows\System\ZpZbFFR.exe
  C:\Windows\System\ZpZbFFR.exe
  2⤵
  PID:264
- C:\Windows\System\QnlSwRR.exe
  C:\Windows\System\QnlSwRR.exe
  2⤵
  PID:4920
- C:\Windows\System\exYCWTf.exe
  C:\Windows\System\exYCWTf.exe
  2⤵
  PID:1992
- C:\Windows\System\uKPCFwI.exe
  C:\Windows\System\uKPCFwI.exe
  2⤵
  PID:5224
- C:\Windows\System\VUYaZUN.exe
  C:\Windows\System\VUYaZUN.exe
  2⤵
  PID:5240
- C:\Windows\System\BEYoNrI.exe
  C:\Windows\System\BEYoNrI.exe
  2⤵
  PID:5256
- C:\Windows\System\GybBDLx.exe
  C:\Windows\System\GybBDLx.exe
  2⤵
  PID:5272
- C:\Windows\System\lLoxLEK.exe
  C:\Windows\System\lLoxLEK.exe
  2⤵
  PID:5288
- C:\Windows\System\qMksLhl.exe
  C:\Windows\System\qMksLhl.exe
  2⤵
  PID:5352
- C:\Windows\System\DyFUwRG.exe
  C:\Windows\System\DyFUwRG.exe
  2⤵
  PID:5420
- C:\Windows\System\lWhCQoG.exe
  C:\Windows\System\lWhCQoG.exe
  2⤵
  PID:5516
- C:\Windows\System\JIqKOid.exe
  C:\Windows\System\JIqKOid.exe
  2⤵
  PID:5712
- C:\Windows\System\kezXTOX.exe
  C:\Windows\System\kezXTOX.exe
  2⤵
  PID:5760
- C:\Windows\System\aJZQWCE.exe
  C:\Windows\System\aJZQWCE.exe
  2⤵
  PID:704
- C:\Windows\System\hOQKoeD.exe
  C:\Windows\System\hOQKoeD.exe
  2⤵
  PID:324
- C:\Windows\System\kuBNyIR.exe
  C:\Windows\System\kuBNyIR.exe
  2⤵
  PID:5852
- C:\Windows\System\SCfJphe.exe
  C:\Windows\System\SCfJphe.exe
  2⤵
  PID:5896
- C:\Windows\System\WiTjWmR.exe
  C:\Windows\System\WiTjWmR.exe
  2⤵
  PID:5976
- C:\Windows\System\NzPFnpu.exe
  C:\Windows\System\NzPFnpu.exe
  2⤵
  PID:6080
- C:\Windows\System\pFQepBb.exe
  C:\Windows\System\pFQepBb.exe
  2⤵
  PID:2820
- C:\Windows\System\ReBdblF.exe
  C:\Windows\System\ReBdblF.exe
  2⤵
  PID:4888
- C:\Windows\System\SXnfbjX.exe
  C:\Windows\System\SXnfbjX.exe
  2⤵
  PID:5248
- C:\Windows\System\eJfJfFS.exe
  C:\Windows\System\eJfJfFS.exe
  2⤵
  PID:5384
- C:\Windows\System\bdXSmSZ.exe
  C:\Windows\System\bdXSmSZ.exe
  2⤵
  PID:5772
- C:\Windows\System\JmKtYVE.exe
  C:\Windows\System\JmKtYVE.exe
  2⤵
  PID:5936
- C:\Windows\System\YDQUQKu.exe
  C:\Windows\System\YDQUQKu.exe
  2⤵
  PID:2192
- C:\Windows\System\dObcCnS.exe
  C:\Windows\System\dObcCnS.exe
  2⤵
  PID:2752
- C:\Windows\System\LseBDTn.exe
  C:\Windows\System\LseBDTn.exe
  2⤵
  PID:6160
- C:\Windows\System\yhRBPIx.exe
  C:\Windows\System\yhRBPIx.exe
  2⤵
  PID:6176
- C:\Windows\System\qqhPETO.exe
  C:\Windows\System\qqhPETO.exe
  2⤵
  PID:6208
- C:\Windows\System\mcMGBKL.exe
  C:\Windows\System\mcMGBKL.exe
  2⤵
  PID:6224
- C:\Windows\System\WmCuNam.exe
  C:\Windows\System\WmCuNam.exe
  2⤵
  PID:6240
- C:\Windows\System\QjlGgEW.exe
  C:\Windows\System\QjlGgEW.exe
  2⤵
  PID:6256
- C:\Windows\System\BRfCSGc.exe
  C:\Windows\System\BRfCSGc.exe
  2⤵
  PID:6276
- C:\Windows\System\eelmERv.exe
  C:\Windows\System\eelmERv.exe
  2⤵
  PID:6296
- C:\Windows\System\SXgfUSI.exe
  C:\Windows\System\SXgfUSI.exe
  2⤵
  PID:6316
- C:\Windows\System\tgMEsdS.exe
  C:\Windows\System\tgMEsdS.exe
  2⤵
  PID:6332
- C:\Windows\System\KtYITbH.exe
  C:\Windows\System\KtYITbH.exe
  2⤵
  PID:6352
- C:\Windows\System\dPWIQdR.exe
  C:\Windows\System\dPWIQdR.exe
  2⤵
  PID:6368
- C:\Windows\System\thHXUVl.exe
  C:\Windows\System\thHXUVl.exe
  2⤵
  PID:6384
- C:\Windows\System\oYqXphN.exe
  C:\Windows\System\oYqXphN.exe
  2⤵
  PID:6404
- C:\Windows\System\JeELFQb.exe
  C:\Windows\System\JeELFQb.exe
  2⤵
  PID:6424
- C:\Windows\System\psEVztB.exe
  C:\Windows\System\psEVztB.exe
  2⤵
  PID:6444
- C:\Windows\System\wcGUcan.exe
  C:\Windows\System\wcGUcan.exe
  2⤵
  PID:6460
- C:\Windows\System\kSGEMfP.exe
  C:\Windows\System\kSGEMfP.exe
  2⤵
  PID:6476
- C:\Windows\System\yFbBVmy.exe
  C:\Windows\System\yFbBVmy.exe
  2⤵
  PID:6492
- C:\Windows\System\ekGTxqa.exe
  C:\Windows\System\ekGTxqa.exe
  2⤵
  PID:6508
- C:\Windows\System\UOSDjpd.exe
  C:\Windows\System\UOSDjpd.exe
  2⤵
  PID:6524
- C:\Windows\System\tXOZxnI.exe
  C:\Windows\System\tXOZxnI.exe
  2⤵
  PID:6548
- C:\Windows\System\vncVEPT.exe
  C:\Windows\System\vncVEPT.exe
  2⤵
  PID:6576
- C:\Windows\System\cAoGVEe.exe
  C:\Windows\System\cAoGVEe.exe
  2⤵
  PID:6592
- C:\Windows\System\roQRIVk.exe
  C:\Windows\System\roQRIVk.exe
  2⤵
  PID:6608
- C:\Windows\System\gObXFSl.exe
  C:\Windows\System\gObXFSl.exe
  2⤵
  PID:6624
- C:\Windows\System\CeFeCpS.exe
  C:\Windows\System\CeFeCpS.exe
  2⤵
  PID:6640
- C:\Windows\System\VUiqSWK.exe
  C:\Windows\System\VUiqSWK.exe
  2⤵
  PID:6656
- C:\Windows\System\ACiVFxU.exe
  C:\Windows\System\ACiVFxU.exe
  2⤵
  PID:6672
- C:\Windows\System\NJooevP.exe
  C:\Windows\System\NJooevP.exe
  2⤵
  PID:6688
- C:\Windows\System\KKYJKYO.exe
  C:\Windows\System\KKYJKYO.exe
  2⤵
  PID:6704
- C:\Windows\System\IOfPlHK.exe
  C:\Windows\System\IOfPlHK.exe
  2⤵
  PID:6720
- C:\Windows\System\pENHYkz.exe
  C:\Windows\System\pENHYkz.exe
  2⤵
  PID:6736
- C:\Windows\System\kuKMzfG.exe
  C:\Windows\System\kuKMzfG.exe
  2⤵
  PID:6752
- C:\Windows\System\NyZZfvx.exe
  C:\Windows\System\NyZZfvx.exe
  2⤵
  PID:6772
- C:\Windows\System\GhpTHFw.exe
  C:\Windows\System\GhpTHFw.exe
  2⤵
  PID:6788
- C:\Windows\System\jRWFkWc.exe
  C:\Windows\System\jRWFkWc.exe
  2⤵
  PID:6804
- C:\Windows\System\yuOipZJ.exe
  C:\Windows\System\yuOipZJ.exe
  2⤵
  PID:6820
- C:\Windows\System\YIpqrBI.exe
  C:\Windows\System\YIpqrBI.exe
  2⤵
  PID:6836
- C:\Windows\System\kMxqgVg.exe
  C:\Windows\System\kMxqgVg.exe
  2⤵
  PID:6852
- C:\Windows\System\XtohPqv.exe
  C:\Windows\System\XtohPqv.exe
  2⤵
  PID:6868
- C:\Windows\System\hrwJAOW.exe
  C:\Windows\System\hrwJAOW.exe
  2⤵
  PID:6884
- C:\Windows\System\kqeOidG.exe
  C:\Windows\System\kqeOidG.exe
  2⤵
  PID:6900
- C:\Windows\System\OJHgunh.exe
  C:\Windows\System\OJHgunh.exe
  2⤵
  PID:6916
- C:\Windows\System\puXHLZo.exe
  C:\Windows\System\puXHLZo.exe
  2⤵
  PID:7020
- C:\Windows\System\xFrSlhW.exe
  C:\Windows\System\xFrSlhW.exe
  2⤵
  PID:7036
- C:\Windows\System\HPQBwQz.exe
  C:\Windows\System\HPQBwQz.exe
  2⤵
  PID:7052
- C:\Windows\System\kDXUDVX.exe
  C:\Windows\System\kDXUDVX.exe
  2⤵
  PID:7080
- C:\Windows\System\algrCsJ.exe
  C:\Windows\System\algrCsJ.exe
  2⤵
  PID:7096
- C:\Windows\System\DNMMOjs.exe
  C:\Windows\System\DNMMOjs.exe
  2⤵
  PID:7112
- C:\Windows\System\sYLYINI.exe
  C:\Windows\System\sYLYINI.exe
  2⤵
  PID:7128
- C:\Windows\System\apLDBOS.exe
  C:\Windows\System\apLDBOS.exe
  2⤵
  PID:7144
- C:\Windows\System\qmqcFJO.exe
  C:\Windows\System\qmqcFJO.exe
  2⤵
  PID:7164
- C:\Windows\System\aQfQFGL.exe
  C:\Windows\System\aQfQFGL.exe
  2⤵
  PID:2100
- C:\Windows\System\jPcaszm.exe
  C:\Windows\System\jPcaszm.exe
  2⤵
  PID:1528
- C:\Windows\System\jfvRiOd.exe
  C:\Windows\System\jfvRiOd.exe
  2⤵
  PID:1428
- C:\Windows\System\gDXOglr.exe
  C:\Windows\System\gDXOglr.exe
  2⤵
  PID:6204
- C:\Windows\System\gEEKUqk.exe
  C:\Windows\System\gEEKUqk.exe
  2⤵
  PID:7188
- C:\Windows\System\dHqiXkX.exe
  C:\Windows\System\dHqiXkX.exe
  2⤵
  PID:7204
- C:\Windows\System\FjmGfIo.exe
  C:\Windows\System\FjmGfIo.exe
  2⤵
  PID:7220
- C:\Windows\System\cnjgZKk.exe
  C:\Windows\System\cnjgZKk.exe
  2⤵
  PID:7492
- C:\Windows\System\WGWFSIl.exe
  C:\Windows\System\WGWFSIl.exe
  2⤵
  PID:7508
- C:\Windows\System\bWbbWVQ.exe
  C:\Windows\System\bWbbWVQ.exe
  2⤵
  PID:7528
- C:\Windows\System\MJBcQfb.exe
  C:\Windows\System\MJBcQfb.exe
  2⤵
  PID:7564
- C:\Windows\System\KvsMstd.exe
  C:\Windows\System\KvsMstd.exe
  2⤵
  PID:7600
- C:\Windows\System\zFgHmHT.exe
  C:\Windows\System\zFgHmHT.exe
  2⤵
  PID:7640
- C:\Windows\System\POvXcEZ.exe
  C:\Windows\System\POvXcEZ.exe
  2⤵
  PID:7656
- C:\Windows\System\LbHXofF.exe
  C:\Windows\System\LbHXofF.exe
  2⤵
  PID:7672
- C:\Windows\System\HiKlhwg.exe
  C:\Windows\System\HiKlhwg.exe
  2⤵
  PID:7712
- C:\Windows\System\xPiGrMe.exe
  C:\Windows\System\xPiGrMe.exe
  2⤵
  PID:7744
- C:\Windows\System\PEyucNn.exe
  C:\Windows\System\PEyucNn.exe
  2⤵
  PID:7764
- C:\Windows\System\murVEGj.exe
  C:\Windows\System\murVEGj.exe
  2⤵
  PID:7780
- C:\Windows\System\lZUCOHK.exe
  C:\Windows\System\lZUCOHK.exe
  2⤵
  PID:7824
- C:\Windows\System\BeQtoLh.exe
  C:\Windows\System\BeQtoLh.exe
  2⤵
  PID:7872
- C:\Windows\System\niSjpAB.exe
  C:\Windows\System\niSjpAB.exe
  2⤵
  PID:7896
- C:\Windows\System\xaqibOX.exe
  C:\Windows\System\xaqibOX.exe
  2⤵
  PID:7912
- C:\Windows\System\FtDRZXn.exe
  C:\Windows\System\FtDRZXn.exe
  2⤵
  PID:7928
- C:\Windows\System\tWiYhqE.exe
  C:\Windows\System\tWiYhqE.exe
  2⤵
  PID:7964
- C:\Windows\System\RTomGRd.exe
  C:\Windows\System\RTomGRd.exe
  2⤵
  PID:7996
- C:\Windows\System\vEBQeWf.exe
  C:\Windows\System\vEBQeWf.exe
  2⤵
  PID:8032
- C:\Windows\System\RUhsotY.exe
  C:\Windows\System\RUhsotY.exe
  2⤵
  PID:8052
- C:\Windows\System\RblNuPs.exe
  C:\Windows\System\RblNuPs.exe
  2⤵
  PID:8068
- C:\Windows\System\mZzEhMl.exe
  C:\Windows\System\mZzEhMl.exe
  2⤵
  PID:8108
- C:\Windows\System\lNHVRJk.exe
  C:\Windows\System\lNHVRJk.exe
  2⤵
  PID:7884
- C:\Windows\System\VRPHWRm.exe
  C:\Windows\System\VRPHWRm.exe
  2⤵
  PID:7988
- C:\Windows\System\NoyFWUG.exe
  C:\Windows\System\NoyFWUG.exe
  2⤵
  PID:8096
- C:\Windows\System\ZxPVdKI.exe
  C:\Windows\System\ZxPVdKI.exe
  2⤵
  PID:2264
- C:\Windows\System\HZfaDuI.exe
  C:\Windows\System\HZfaDuI.exe
  2⤵
  PID:328
- C:\Windows\System\cYZOWUv.exe
  C:\Windows\System\cYZOWUv.exe
  2⤵
  PID:5080
- C:\Windows\System\zPHyHwB.exe
  C:\Windows\System\zPHyHwB.exe
  2⤵
  PID:752
- C:\Windows\System\UJYTjxL.exe
  C:\Windows\System\UJYTjxL.exe
  2⤵
  PID:568
- C:\Windows\System\wZWmbrq.exe
  C:\Windows\System\wZWmbrq.exe
  2⤵
  PID:5128
- C:\Windows\System\eFXWWTx.exe
  C:\Windows\System\eFXWWTx.exe
  2⤵
  PID:5148
- C:\Windows\System\LNWUmZy.exe
  C:\Windows\System\LNWUmZy.exe
  2⤵
  PID:5164
- C:\Windows\System\aZDeqku.exe
  C:\Windows\System\aZDeqku.exe
  2⤵
  PID:5180
- C:\Windows\System\acNwbTj.exe
  C:\Windows\System\acNwbTj.exe
  2⤵
  PID:5196
- C:\Windows\System\wLXhWeG.exe
  C:\Windows\System\wLXhWeG.exe
  2⤵
  PID:5656
- C:\Windows\System\PZUqBZg.exe
  C:\Windows\System\PZUqBZg.exe
  2⤵
  PID:6044
- C:\Windows\System\wDQtlCK.exe
  C:\Windows\System\wDQtlCK.exe
  2⤵
  PID:788
- C:\Windows\System\lunnpRh.exe
  C:\Windows\System\lunnpRh.exe
  2⤵
  PID:7536
- C:\Windows\System\CwJZYIu.exe
  C:\Windows\System\CwJZYIu.exe
  2⤵
  PID:3384
- C:\Windows\System\WVqnodS.exe
  C:\Windows\System\WVqnodS.exe
  2⤵
  PID:3204
- C:\Windows\System\UhPfwry.exe
  C:\Windows\System\UhPfwry.exe
  2⤵
  PID:1736
- C:\Windows\System\hMREdba.exe
  C:\Windows\System\hMREdba.exe
  2⤵
  PID:2392
- C:\Windows\System\cFiocJd.exe
  C:\Windows\System\cFiocJd.exe
  2⤵
  PID:2660
- C:\Windows\System\dWNNKoC.exe
  C:\Windows\System\dWNNKoC.exe
  2⤵
  PID:2940
- C:\Windows\System\VFAjTLE.exe
  C:\Windows\System\VFAjTLE.exe
  2⤵
  PID:1460
- C:\Windows\System\WIAIOER.exe
  C:\Windows\System\WIAIOER.exe
  2⤵
  PID:5988
- C:\Windows\System\iqkNuUw.exe
  C:\Windows\System\iqkNuUw.exe
  2⤵
  PID:7548
- C:\Windows\System\zHMXLBY.exe
  C:\Windows\System\zHMXLBY.exe
  2⤵
  PID:7216
- C:\Windows\System\IawqPuK.exe
  C:\Windows\System\IawqPuK.exe
  2⤵
  PID:7060
- C:\Windows\System\ZiocjuB.exe
  C:\Windows\System\ZiocjuB.exe
  2⤵
  PID:7136
- C:\Windows\System\mpoJEQg.exe
  C:\Windows\System\mpoJEQg.exe
  2⤵
  PID:2072
- C:\Windows\System\mfehfSp.exe
  C:\Windows\System\mfehfSp.exe
  2⤵
  PID:6908
- C:\Windows\System\YJABahK.exe
  C:\Windows\System\YJABahK.exe
  2⤵
  PID:6844
- C:\Windows\System\bwvpPkI.exe
  C:\Windows\System\bwvpPkI.exe
  2⤵
  PID:6748
- C:\Windows\System\erSxEyP.exe
  C:\Windows\System\erSxEyP.exe
  2⤵
  PID:6652
- C:\Windows\System\BXeJmvF.exe
  C:\Windows\System\BXeJmvF.exe
  2⤵
  PID:6472
- C:\Windows\System\vfleolj.exe
  C:\Windows\System\vfleolj.exe
  2⤵
  PID:6400
- C:\Windows\System\bhDEKSO.exe
  C:\Windows\System\bhDEKSO.exe
  2⤵
  PID:5348
- C:\Windows\System\DknvifZ.exe
  C:\Windows\System\DknvifZ.exe
  2⤵
  PID:5228
- C:\Windows\System\PxYAuUq.exe
  C:\Windows\System\PxYAuUq.exe
  2⤵
  PID:4984
- C:\Windows\System\yhhJIxR.exe
  C:\Windows\System\yhhJIxR.exe
  2⤵
  PID:2816
- C:\Windows\System\IgGUJBG.exe
  C:\Windows\System\IgGUJBG.exe
  2⤵
  PID:6132
- C:\Windows\System\DbSIgmI.exe
  C:\Windows\System\DbSIgmI.exe
  2⤵
  PID:5640
- C:\Windows\System\ZLuBBAj.exe
  C:\Windows\System\ZLuBBAj.exe
  2⤵
  PID:5560
- C:\Windows\System\LpaLSGR.exe
  C:\Windows\System\LpaLSGR.exe
  2⤵
  PID:8044
- C:\Windows\System\qeLibTM.exe
  C:\Windows\System\qeLibTM.exe
  2⤵
  PID:5368
- C:\Windows\System\aafkzES.exe
  C:\Windows\System\aafkzES.exe
  2⤵
  PID:6056
- C:\Windows\System\TZwNEIs.exe
  C:\Windows\System\TZwNEIs.exe
  2⤵
  PID:5084
- C:\Windows\System\nFAeIax.exe
  C:\Windows\System\nFAeIax.exe
  2⤵
  PID:3928
- C:\Windows\System\olsghVi.exe
  C:\Windows\System\olsghVi.exe
  2⤵
  PID:5036
- C:\Windows\System\ZUlmVtj.exe
  C:\Windows\System\ZUlmVtj.exe
  2⤵
  PID:3448
- C:\Windows\System\cUaRXgL.exe
  C:\Windows\System\cUaRXgL.exe
  2⤵
  PID:8080
- C:\Windows\System\CGijUqM.exe
  C:\Windows\System\CGijUqM.exe
  2⤵
  PID:4516
- C:\Windows\System\DPFXvCc.exe
  C:\Windows\System\DPFXvCc.exe
  2⤵
  PID:4452
- C:\Windows\System\IGwyCxP.exe
  C:\Windows\System\IGwyCxP.exe
  2⤵
  PID:4260
- C:\Windows\System\NJCjeen.exe
  C:\Windows\System\NJCjeen.exe
  2⤵
  PID:4552
- C:\Windows\System\zITxSWA.exe
  C:\Windows\System\zITxSWA.exe
  2⤵
  PID:4676
- C:\Windows\System\BoEkVJk.exe
  C:\Windows\System\BoEkVJk.exe
  2⤵
  PID:4712
- C:\Windows\System\sCGqGxJ.exe
  C:\Windows\System\sCGqGxJ.exe
  2⤵
  PID:4780
- C:\Windows\System\TBuxuAg.exe
  C:\Windows\System\TBuxuAg.exe
  2⤵
  PID:4228
- C:\Windows\System\qScCePS.exe
  C:\Windows\System\qScCePS.exe
  2⤵
  PID:4812
- C:\Windows\System\jZWVRba.exe
  C:\Windows\System\jZWVRba.exe
  2⤵
  PID:3240
- C:\Windows\System\tXykzqR.exe
  C:\Windows\System\tXykzqR.exe
  2⤵
  PID:3332
- C:\Windows\System\mnifOMD.exe
  C:\Windows\System\mnifOMD.exe
  2⤵
  PID:3400
- C:\Windows\System\vPyhtRF.exe
  C:\Windows\System\vPyhtRF.exe
  2⤵
  PID:3496
- C:\Windows\System\ZpmTzCu.exe
  C:\Windows\System\ZpmTzCu.exe
  2⤵
  PID:3560
- C:\Windows\System\EtaCFaV.exe
  C:\Windows\System\EtaCFaV.exe
  2⤵
  PID:3624
- C:\Windows\System\KKZgSpl.exe
  C:\Windows\System\KKZgSpl.exe
  2⤵
  PID:3688
- C:\Windows\System\gkvhYTY.exe
  C:\Windows\System\gkvhYTY.exe
  2⤵
  PID:3752
- C:\Windows\System\AXocEMj.exe
  C:\Windows\System\AXocEMj.exe
  2⤵
  PID:3816
- C:\Windows\System\ZfsfrdF.exe
  C:\Windows\System\ZfsfrdF.exe
  2⤵
  PID:3880
- C:\Windows\System\mRHGarp.exe
  C:\Windows\System\mRHGarp.exe
  2⤵
  PID:3944
- C:\Windows\System\UWiXvea.exe
  C:\Windows\System\UWiXvea.exe
  2⤵
  PID:4008
- C:\Windows\System\XzSWKJN.exe
  C:\Windows\System\XzSWKJN.exe
  2⤵
  PID:2596
- C:\Windows\System\aeAKzBo.exe
  C:\Windows\System\aeAKzBo.exe
  2⤵
  PID:3304
- C:\Windows\System\jkzHuSL.exe
  C:\Windows\System\jkzHuSL.exe
  2⤵
  PID:3252
- C:\Windows\System\BzjIzOV.exe
  C:\Windows\System\BzjIzOV.exe
  2⤵
  PID:3860
- C:\Windows\System\HMKvmuZ.exe
  C:\Windows\System\HMKvmuZ.exe
  2⤵
  PID:4392
- C:\Windows\System\MNXvnPM.exe
  C:\Windows\System\MNXvnPM.exe
  2⤵
  PID:4612
- C:\Windows\System\VvugaBU.exe
  C:\Windows\System\VvugaBU.exe
  2⤵
  PID:4876
- C:\Windows\System\piTmveg.exe
  C:\Windows\System\piTmveg.exe
  2⤵
  PID:4936
- C:\Windows\System\luWxVKC.exe
  C:\Windows\System\luWxVKC.exe
  2⤵
  PID:5692
- C:\Windows\System\QdsIgJa.exe
  C:\Windows\System\QdsIgJa.exe
  2⤵
  PID:5796
- C:\Windows\System\kJKkwwY.exe
  C:\Windows\System\kJKkwwY.exe
  2⤵
  PID:2864
- C:\Windows\System\oRuYjyn.exe
  C:\Windows\System\oRuYjyn.exe
  2⤵
  PID:2012
- C:\Windows\System\wqsVLhK.exe
  C:\Windows\System\wqsVLhK.exe
  2⤵
  PID:5116
- C:\Windows\System\tzlIfaO.exe
  C:\Windows\System\tzlIfaO.exe
  2⤵
  PID:2016
- C:\Windows\System\twjBhJq.exe
  C:\Windows\System\twjBhJq.exe
  2⤵
  PID:5160
- C:\Windows\System\LOhGtAI.exe
  C:\Windows\System\LOhGtAI.exe
  2⤵
  PID:6196
- C:\Windows\System\iyKVwXM.exe
  C:\Windows\System\iyKVwXM.exe
  2⤵
  PID:5680
- C:\Windows\System\adQpVkx.exe
  C:\Windows\System\adQpVkx.exe
  2⤵
  PID:2616
- C:\Windows\System\irOeWoH.exe
  C:\Windows\System\irOeWoH.exe
  2⤵
  PID:7836
- C:\Windows\System\oOhgQtN.exe
  C:\Windows\System\oOhgQtN.exe
  2⤵
  PID:7940
- C:\Windows\System\NOnjKCl.exe
  C:\Windows\System\NOnjKCl.exe
  2⤵
  PID:8060
- C:\Windows\System\LUhwHiq.exe
  C:\Windows\System\LUhwHiq.exe
  2⤵
  PID:8008
- C:\Windows\System\NJlSrmY.exe
  C:\Windows\System\NJlSrmY.exe
  2⤵
  PID:6436
- C:\Windows\System\iXgGogg.exe
  C:\Windows\System\iXgGogg.exe
  2⤵
  PID:4104
- C:\Windows\System\tecfAMu.exe
  C:\Windows\System\tecfAMu.exe
  2⤵
  PID:3512
- C:\Windows\System\MGtZrKm.exe
  C:\Windows\System\MGtZrKm.exe
  2⤵
  PID:1252
- C:\Windows\System\NUplnDk.exe
  C:\Windows\System\NUplnDk.exe
  2⤵
  PID:4068
- C:\Windows\System\nnMGqtP.exe
  C:\Windows\System\nnMGqtP.exe
  2⤵
  PID:2704
- C:\Windows\System\qUyOVNL.exe
  C:\Windows\System\qUyOVNL.exe
  2⤵
  PID:3080
- C:\Windows\System\qwYIVOT.exe
  C:\Windows\System\qwYIVOT.exe
  2⤵
  PID:2652
- C:\Windows\System\aKZCrQg.exe
  C:\Windows\System\aKZCrQg.exe
  2⤵
  PID:2928
- C:\Windows\System\yUimAtc.exe
  C:\Windows\System\yUimAtc.exe
  2⤵
  PID:1888
- C:\Windows\System\XdvbZES.exe
  C:\Windows\System\XdvbZES.exe
  2⤵
  PID:2584
- C:\Windows\System\QZMjEhV.exe
  C:\Windows\System\QZMjEhV.exe
  2⤵
  PID:2668
- C:\Windows\System\CftjLvK.exe
  C:\Windows\System\CftjLvK.exe
  2⤵
  PID:2212
- C:\Windows\System\WLWTQQC.exe
  C:\Windows\System\WLWTQQC.exe
  2⤵
  PID:3236
- C:\Windows\System\eBTrhmP.exe
  C:\Windows\System\eBTrhmP.exe
  2⤵
  PID:5916
- C:\Windows\System\eMzlFFS.exe
  C:\Windows\System\eMzlFFS.exe
  2⤵
  PID:5992
- C:\Windows\System\UhmMQzE.exe
  C:\Windows\System\UhmMQzE.exe
  2⤵
  PID:7624
- C:\Windows\System\NQQXcua.exe
  C:\Windows\System\NQQXcua.exe
  2⤵
  PID:7104
- C:\Windows\System\KwhiRly.exe
  C:\Windows\System\KwhiRly.exe
  2⤵
  PID:6184
- C:\Windows\System\GLPKdjT.exe
  C:\Windows\System\GLPKdjT.exe
  2⤵
  PID:2792
- C:\Windows\System\FDVrbXe.exe
  C:\Windows\System\FDVrbXe.exe
  2⤵
  PID:2884
- C:\Windows\System\kUblWUV.exe
  C:\Windows\System\kUblWUV.exe
  2⤵
  PID:2240
- C:\Windows\System\rhqTnNK.exe
  C:\Windows\System\rhqTnNK.exe
  2⤵
  PID:6848
- C:\Windows\System\jqCnsJA.exe
  C:\Windows\System\jqCnsJA.exe
  2⤵
  PID:6712
- C:\Windows\System\NbkOjMc.exe
  C:\Windows\System\NbkOjMc.exe
  2⤵
  PID:6500
- C:\Windows\System\ZLgeLzs.exe
  C:\Windows\System\ZLgeLzs.exe
  2⤵
  PID:6432
- C:\Windows\System\FWaHElQ.exe
  C:\Windows\System\FWaHElQ.exe
  2⤵
  PID:6252
- C:\Windows\System\hKAVfeJ.exe
  C:\Windows\System\hKAVfeJ.exe
  2⤵
  PID:6364
- C:\Windows\System\IJUPilm.exe
  C:\Windows\System\IJUPilm.exe
  2⤵
  PID:6008
- C:\Windows\System\rJmCcTT.exe
  C:\Windows\System\rJmCcTT.exe
  2⤵
  PID:2740
- C:\Windows\System\KcJqJnq.exe
  C:\Windows\System\KcJqJnq.exe
  2⤵
  PID:1788
- C:\Windows\System\WTTVkpN.exe
  C:\Windows\System\WTTVkpN.exe
  2⤵
  PID:5624
- C:\Windows\System\TOfRVHv.exe
  C:\Windows\System\TOfRVHv.exe
  2⤵
  PID:5268
- C:\Windows\System\GywpZlW.exe
  C:\Windows\System\GywpZlW.exe
  2⤵
  PID:6100
- C:\Windows\System\QKuyzxD.exe
  C:\Windows\System\QKuyzxD.exe
  2⤵
  PID:5604
- C:\Windows\System\iKFHlOE.exe
  C:\Windows\System\iKFHlOE.exe
  2⤵
  PID:5336
- C:\Windows\System\eBOJDhR.exe
  C:\Windows\System\eBOJDhR.exe
  2⤵
  PID:5000
- C:\Windows\System\ieNShiU.exe
  C:\Windows\System\ieNShiU.exe
  2⤵
  PID:2664
- C:\Windows\System\IThdSNj.exe
  C:\Windows\System\IThdSNj.exe
  2⤵
  PID:5404
- C:\Windows\System\GNEslfj.exe
  C:\Windows\System\GNEslfj.exe
  2⤵
  PID:4388
- C:\Windows\System\BNpXoDP.exe
  C:\Windows\System\BNpXoDP.exe
  2⤵
  PID:4548
- C:\Windows\System\TIfBPOl.exe
  C:\Windows\System\TIfBPOl.exe
  2⤵
  PID:2492
- C:\Windows\System\qoMzzQL.exe
  C:\Windows\System\qoMzzQL.exe
  2⤵
  PID:4164
- C:\Windows\System\MxkMlWU.exe
  C:\Windows\System\MxkMlWU.exe
  2⤵
  PID:3368
- C:\Windows\System\NIDMHvN.exe
  C:\Windows\System\NIDMHvN.exe
  2⤵
  PID:3656
- C:\Windows\System\NRkvCZf.exe
  C:\Windows\System\NRkvCZf.exe
  2⤵
  PID:3272
- C:\Windows\System\WpCNYOM.exe
  C:\Windows\System\WpCNYOM.exe
  2⤵
  PID:4748
- C:\Windows\System\rvouhlm.exe
  C:\Windows\System\rvouhlm.exe
  2⤵
  PID:3592
- C:\Windows\System\wImwpDw.exe
  C:\Windows\System\wImwpDw.exe
  2⤵
  PID:860
- C:\Windows\System\QjFHeYU.exe
  C:\Windows\System\QjFHeYU.exe
  2⤵
  PID:3300
- C:\Windows\System\QquTcRq.exe
  C:\Windows\System\QquTcRq.exe
  2⤵
  PID:3876
- C:\Windows\System\UDRNVyf.exe
  C:\Windows\System\UDRNVyf.exe
  2⤵
  PID:4004
- C:\Windows\System\cjwekjb.exe
  C:\Windows\System\cjwekjb.exe
  2⤵
  PID:4420
- C:\Windows\System\theSBvz.exe
  C:\Windows\System\theSBvz.exe
  2⤵
  PID:5728
- C:\Windows\System\hxmJYyi.exe
  C:\Windows\System\hxmJYyi.exe
  2⤵
  PID:5724
- C:\Windows\System\yKBlAMS.exe
  C:\Windows\System\yKBlAMS.exe
  2⤵
  PID:5192
- C:\Windows\System\pOmKrHk.exe
  C:\Windows\System\pOmKrHk.exe
  2⤵
  PID:5172
- C:\Windows\System\MwsketR.exe
  C:\Windows\System\MwsketR.exe
  2⤵
  PID:5144
- C:\Windows\System\roZmBEe.exe
  C:\Windows\System\roZmBEe.exe
  2⤵
  PID:7772
- C:\Windows\System\olYsxHH.exe
  C:\Windows\System\olYsxHH.exe
  2⤵
  PID:7908
- C:\Windows\System\oUecEjP.exe
  C:\Windows\System\oUecEjP.exe
  2⤵
  PID:6376
- C:\Windows\System\RtjfHZD.exe
  C:\Windows\System\RtjfHZD.exe
  2⤵
  PID:408
- C:\Windows\System\yYGpqip.exe
  C:\Windows\System\yYGpqip.exe
  2⤵
  PID:3732
- C:\Windows\System\YXvzGCU.exe
  C:\Windows\System\YXvzGCU.exe
  2⤵
  PID:2748
- C:\Windows\System\cSJRgwv.exe
  C:\Windows\System\cSJRgwv.exe
  2⤵
  PID:1836
- C:\Windows\System\DLwZOOE.exe
  C:\Windows\System\DLwZOOE.exe
  2⤵
  PID:3208
- C:\Windows\System\ekPiPFW.exe
  C:\Windows\System\ekPiPFW.exe
  2⤵
  PID:5592
- C:\Windows\System\tWroGiu.exe
  C:\Windows\System\tWroGiu.exe
  2⤵
  PID:352
- C:\Windows\System\UGasUnl.exe
  C:\Windows\System\UGasUnl.exe
  2⤵
  PID:6784
- C:\Windows\System\ojNbSGC.exe
  C:\Windows\System\ojNbSGC.exe
  2⤵
  PID:7264
- C:\Windows\System\CYYKFEG.exe
  C:\Windows\System\CYYKFEG.exe
  2⤵
  PID:6876
- C:\Windows\System\xdXGXLM.exe
  C:\Windows\System\xdXGXLM.exe
  2⤵
  PID:6912
- C:\Windows\System\iTEZSdc.exe
  C:\Windows\System\iTEZSdc.exe
  2⤵
  PID:6324
- C:\Windows\System\fRHqBVI.exe
  C:\Windows\System\fRHqBVI.exe
  2⤵
  PID:6780
- C:\Windows\System\aGxPPEu.exe
  C:\Windows\System\aGxPPEu.exe
  2⤵
  PID:6216
- C:\Windows\System\rliAfIQ.exe
  C:\Windows\System\rliAfIQ.exe
  2⤵
  PID:5280
- C:\Windows\System\FLDIuyb.exe
  C:\Windows\System\FLDIuyb.exe
  2⤵
  PID:2036
- C:\Windows\System\CRoMpwp.exe
  C:\Windows\System\CRoMpwp.exe
  2⤵
  PID:5460
- C:\Windows\System\ktfyjdS.exe
  C:\Windows\System\ktfyjdS.exe
  2⤵
  PID:5568
- C:\Windows\System\NWwyksp.exe
  C:\Windows\System\NWwyksp.exe
  2⤵
  PID:2640
- C:\Windows\System\FcAHSTE.exe
  C:\Windows\System\FcAHSTE.exe
  2⤵
  PID:4248
- C:\Windows\System\dSkfkjw.exe
  C:\Windows\System\dSkfkjw.exe
  2⤵
  PID:5100
- C:\Windows\System\XuQQWjF.exe
  C:\Windows\System\XuQQWjF.exe
  2⤵
  PID:5068
- C:\Windows\System\FEsgOrc.exe
  C:\Windows\System\FEsgOrc.exe
  2⤵
  PID:3528
- C:\Windows\System\UYTLfGW.exe
  C:\Windows\System\UYTLfGW.exe
  2⤵
  PID:4040
- C:\Windows\System\jKFbXYB.exe
  C:\Windows\System\jKFbXYB.exe
  2⤵
  PID:3812
- C:\Windows\System\FNtqPUx.exe
  C:\Windows\System\FNtqPUx.exe
  2⤵
  PID:3620
- C:\Windows\System\emFkcac.exe
  C:\Windows\System\emFkcac.exe
  2⤵
  PID:4324
- C:\Windows\System\ZQUZxaA.exe
  C:\Windows\System\ZQUZxaA.exe
  2⤵
  PID:4100
- C:\Windows\System\plDdlEy.exe
  C:\Windows\System\plDdlEy.exe
  2⤵
  PID:4120
- C:\Windows\System\mginKOU.exe
  C:\Windows\System\mginKOU.exe
  2⤵
  PID:4972
- C:\Windows\System\AShDlDd.exe
  C:\Windows\System\AShDlDd.exe
  2⤵
  PID:1748
- C:\Windows\System\DviAfxp.exe
  C:\Windows\System\DviAfxp.exe
  2⤵
  PID:2680
- C:\Windows\System\MshPQsK.exe
  C:\Windows\System\MshPQsK.exe
  2⤵
  PID:3060
- C:\Windows\System\atPFUfL.exe
  C:\Windows\System\atPFUfL.exe
  2⤵
  PID:6328
- C:\Windows\System\LWGuDxA.exe
  C:\Windows\System\LWGuDxA.exe
  2⤵
  PID:7408
- C:\Windows\System\YiOfpsN.exe
  C:\Windows\System\YiOfpsN.exe
  2⤵
  PID:2900
- C:\Windows\System\cfNbmeV.exe
  C:\Windows\System\cfNbmeV.exe
  2⤵
  PID:7920
- C:\Windows\System\EpXJtJT.exe
  C:\Windows\System\EpXJtJT.exe
  2⤵
  PID:1584
- C:\Windows\System\heLjctN.exe
  C:\Windows\System\heLjctN.exe
  2⤵
  PID:4584
- C:\Windows\System\cbbZsNW.exe
  C:\Windows\System\cbbZsNW.exe
  2⤵
  PID:5140
- C:\Windows\System\hfgbICG.exe
  C:\Windows\System\hfgbICG.exe
  2⤵
  PID:6680
- C:\Windows\System\NRcBsWJ.exe
  C:\Windows\System\NRcBsWJ.exe
  2⤵
  PID:3784
- C:\Windows\System\HLBLCeP.exe
  C:\Windows\System\HLBLCeP.exe
  2⤵
  PID:4872
- C:\Windows\System\YmMVdaZ.exe
  C:\Windows\System\YmMVdaZ.exe
  2⤵
  PID:5496
- C:\Windows\System\HcrCcVa.exe
  C:\Windows\System\HcrCcVa.exe
  2⤵
  PID:3848
- C:\Windows\System\KIzFOxc.exe
  C:\Windows\System\KIzFOxc.exe
  2⤵
  PID:5948
- C:\Windows\System\VJXUqft.exe
  C:\Windows\System\VJXUqft.exe
  2⤵
  PID:7664
- C:\Windows\System\JOPgUnk.exe
  C:\Windows\System\JOPgUnk.exe
  2⤵
  PID:4680
- C:\Windows\System\NHaWYKk.exe
  C:\Windows\System\NHaWYKk.exe
  2⤵
  PID:5868
- C:\Windows\System\HIaaXEB.exe
  C:\Windows\System\HIaaXEB.exe
  2⤵
  PID:4968
- C:\Windows\System\HVemWYy.exe
  C:\Windows\System\HVemWYy.exe
  2⤵
  PID:7904
- C:\Windows\System\TxbHqyf.exe
  C:\Windows\System\TxbHqyf.exe
  2⤵
  PID:4356
- C:\Windows\System\lpBmELk.exe
  C:\Windows\System\lpBmELk.exe
  2⤵
  PID:5020
- C:\Windows\System\IWIZkeF.exe
  C:\Windows\System\IWIZkeF.exe
  2⤵
  PID:3112
- C:\Windows\System\SeewRqg.exe
  C:\Windows\System\SeewRqg.exe
  2⤵
  PID:5892
- C:\Windows\System\XfmAUOv.exe
  C:\Windows\System\XfmAUOv.exe
  2⤵
  PID:5676
- C:\Windows\System\CQnhEqi.exe
  C:\Windows\System\CQnhEqi.exe
  2⤵
  PID:6616
- C:\Windows\System\AGnbGTk.exe
  C:\Windows\System\AGnbGTk.exe
  2⤵
  PID:3988
- C:\Windows\System\PkGrHJt.exe
  C:\Windows\System\PkGrHJt.exe
  2⤵
  PID:8200
- C:\Windows\System\hDOYGmK.exe
  C:\Windows\System\hDOYGmK.exe
  2⤵
  PID:8216
- C:\Windows\System\khHJMyb.exe
  C:\Windows\System\khHJMyb.exe
  2⤵
  PID:8232
- C:\Windows\System\jVpcwHX.exe
  C:\Windows\System\jVpcwHX.exe
  2⤵
  PID:8248
- C:\Windows\System\UizhcOf.exe
  C:\Windows\System\UizhcOf.exe
  2⤵
  PID:8264
- C:\Windows\System\UPdZrVc.exe
  C:\Windows\System\UPdZrVc.exe
  2⤵
  PID:8280
- C:\Windows\System\iIHLoLw.exe
  C:\Windows\System\iIHLoLw.exe
  2⤵
  PID:8296
- C:\Windows\System\yUsFpaj.exe
  C:\Windows\System\yUsFpaj.exe
  2⤵
  PID:8312
- C:\Windows\System\NinnKvk.exe
  C:\Windows\System\NinnKvk.exe
  2⤵
  PID:8328
- C:\Windows\System\fUGMEMV.exe
  C:\Windows\System\fUGMEMV.exe
  2⤵
  PID:8344
- C:\Windows\System\xNrzQsl.exe
  C:\Windows\System\xNrzQsl.exe
  2⤵
  PID:8360
- C:\Windows\System\cOGGlgm.exe
  C:\Windows\System\cOGGlgm.exe
  2⤵
  PID:8376
- C:\Windows\System\fcVhqlA.exe
  C:\Windows\System\fcVhqlA.exe
  2⤵
  PID:8392
- C:\Windows\System\tOeZRvj.exe
  C:\Windows\System\tOeZRvj.exe
  2⤵
  PID:8408
- C:\Windows\System\VPmhUBo.exe
  C:\Windows\System\VPmhUBo.exe
  2⤵
  PID:8424
- C:\Windows\System\FPJdBzO.exe
  C:\Windows\System\FPJdBzO.exe
  2⤵
  PID:8440
- C:\Windows\System\EJjZCdA.exe
  C:\Windows\System\EJjZCdA.exe
  2⤵
  PID:8456
- C:\Windows\System\ZHzFjkb.exe
  C:\Windows\System\ZHzFjkb.exe
  2⤵
  PID:8472
- C:\Windows\System\jsDglwa.exe
  C:\Windows\System\jsDglwa.exe
  2⤵
  PID:8488
- C:\Windows\System\BOpzDKV.exe
  C:\Windows\System\BOpzDKV.exe
  2⤵
  PID:8504
- C:\Windows\System\hSycvrH.exe
  C:\Windows\System\hSycvrH.exe
  2⤵
  PID:8520
- C:\Windows\System\GucTUIw.exe
  C:\Windows\System\GucTUIw.exe
  2⤵
  PID:8536
- C:\Windows\System\qPSSsGM.exe
  C:\Windows\System\qPSSsGM.exe
  2⤵
  PID:8552
- C:\Windows\System\AHuESov.exe
  C:\Windows\System\AHuESov.exe
  2⤵
  PID:8568
- C:\Windows\System\pUrgupr.exe
  C:\Windows\System\pUrgupr.exe
  2⤵
  PID:8584
- C:\Windows\System\LvkAahO.exe
  C:\Windows\System\LvkAahO.exe
  2⤵
  PID:8600
- C:\Windows\System\XlKdFLn.exe
  C:\Windows\System\XlKdFLn.exe
  2⤵
  PID:8616
- C:\Windows\System\RPIDSOk.exe
  C:\Windows\System\RPIDSOk.exe
  2⤵
  PID:8632
- C:\Windows\System\qykFycn.exe
  C:\Windows\System\qykFycn.exe
  2⤵
  PID:8648
- C:\Windows\System\ZjAWbUv.exe
  C:\Windows\System\ZjAWbUv.exe
  2⤵
  PID:8664
- C:\Windows\System\FgxSauY.exe
  C:\Windows\System\FgxSauY.exe
  2⤵
  PID:8680
- C:\Windows\System\GDYoTLJ.exe
  C:\Windows\System\GDYoTLJ.exe
  2⤵
  PID:8696
- C:\Windows\System\FCpeeJL.exe
  C:\Windows\System\FCpeeJL.exe
  2⤵
  PID:8712
- C:\Windows\System\FytpmTn.exe
  C:\Windows\System\FytpmTn.exe
  2⤵
  PID:8728
- C:\Windows\System\DEqHrkg.exe
  C:\Windows\System\DEqHrkg.exe
  2⤵
  PID:8744
- C:\Windows\System\utbHeyr.exe
  C:\Windows\System\utbHeyr.exe
  2⤵
  PID:8760
- C:\Windows\System\pdZkTYH.exe
  C:\Windows\System\pdZkTYH.exe
  2⤵
  PID:8776
- C:\Windows\System\kzrUgGM.exe
  C:\Windows\System\kzrUgGM.exe
  2⤵
  PID:8792
- C:\Windows\System\NfNJibR.exe
  C:\Windows\System\NfNJibR.exe
  2⤵
  PID:8808
- C:\Windows\System\lbNOQOx.exe
  C:\Windows\System\lbNOQOx.exe
  2⤵
  PID:8824
- C:\Windows\System\AgWQFnO.exe
  C:\Windows\System\AgWQFnO.exe
  2⤵
  PID:8840
- C:\Windows\System\FwNqUfq.exe
  C:\Windows\System\FwNqUfq.exe
  2⤵
  PID:8856
- C:\Windows\System\YVpkqqI.exe
  C:\Windows\System\YVpkqqI.exe
  2⤵
  PID:8872
- C:\Windows\System\vVdpVDb.exe
  C:\Windows\System\vVdpVDb.exe
  2⤵
  PID:8888
- C:\Windows\System\LykuLRT.exe
  C:\Windows\System\LykuLRT.exe
  2⤵
  PID:8908
- C:\Windows\System\cxnUpAI.exe
  C:\Windows\System\cxnUpAI.exe
  2⤵
  PID:8924
- C:\Windows\System\QBrJVQg.exe
  C:\Windows\System\QBrJVQg.exe
  2⤵
  PID:8940
- C:\Windows\System\tUjzGrL.exe
  C:\Windows\System\tUjzGrL.exe
  2⤵
  PID:8956
- C:\Windows\System\oprKEMH.exe
  C:\Windows\System\oprKEMH.exe
  2⤵
  PID:8972
- C:\Windows\System\AaQLzZe.exe
  C:\Windows\System\AaQLzZe.exe
  2⤵
  PID:8988
- C:\Windows\System\WtGiJFc.exe
  C:\Windows\System\WtGiJFc.exe
  2⤵
  PID:9004
- C:\Windows\System\NILgjsR.exe
  C:\Windows\System\NILgjsR.exe
  2⤵
  PID:9020
- C:\Windows\System\LvNwsDb.exe
  C:\Windows\System\LvNwsDb.exe
  2⤵
  PID:9040
- C:\Windows\System\AVSDQPk.exe
  C:\Windows\System\AVSDQPk.exe
  2⤵
  PID:9056
- C:\Windows\System\RptSEIZ.exe
  C:\Windows\System\RptSEIZ.exe
  2⤵
  PID:9076
- C:\Windows\System\TVkFhri.exe
  C:\Windows\System\TVkFhri.exe
  2⤵
  PID:9092
- C:\Windows\System\LzJuwaW.exe
  C:\Windows\System\LzJuwaW.exe
  2⤵
  PID:9108
- C:\Windows\System\TyBseXF.exe
  C:\Windows\System\TyBseXF.exe
  2⤵
  PID:9124
- C:\Windows\System\YthYaUW.exe
  C:\Windows\System\YthYaUW.exe
  2⤵
  PID:9144
- C:\Windows\System\HhqcHYf.exe
  C:\Windows\System\HhqcHYf.exe
  2⤵
  PID:9160
- C:\Windows\System\ukebxDf.exe
  C:\Windows\System\ukebxDf.exe
  2⤵
  PID:9180
- C:\Windows\System\nMTwEYd.exe
  C:\Windows\System\nMTwEYd.exe
  2⤵
  PID:9196
- C:\Windows\System\CcpsiDp.exe
  C:\Windows\System\CcpsiDp.exe
  2⤵
  PID:9212
- C:\Windows\System\ONQQgsX.exe
  C:\Windows\System\ONQQgsX.exe
  2⤵
  PID:8244
- C:\Windows\System\silNgGg.exe
  C:\Windows\System\silNgGg.exe
  2⤵
  PID:1600
- C:\Windows\System\Owwugwn.exe
  C:\Windows\System\Owwugwn.exe
  2⤵
  PID:1240
- C:\Windows\System\BeuUyye.exe
  C:\Windows\System\BeuUyye.exe
  2⤵
  PID:4644
- C:\Windows\System\nGmrgXX.exe
  C:\Windows\System\nGmrgXX.exe
  2⤵
  PID:8256
- C:\Windows\System\WuhpQUD.exe
  C:\Windows\System\WuhpQUD.exe
  2⤵
  PID:8292
- C:\Windows\System\SYrkmXS.exe
  C:\Windows\System\SYrkmXS.exe
  2⤵
  PID:8336
- C:\Windows\System\vmLLvvI.exe
  C:\Windows\System\vmLLvvI.exe
  2⤵
  PID:8404
- C:\Windows\System\wBSEphh.exe
  C:\Windows\System\wBSEphh.exe
  2⤵
  PID:8468
- C:\Windows\System\CofrsNI.exe
  C:\Windows\System\CofrsNI.exe
  2⤵
  PID:8592
- C:\Windows\System\GgALxNd.exe
  C:\Windows\System\GgALxNd.exe
  2⤵
  PID:8656
- C:\Windows\System\KUcjvSH.exe
  C:\Windows\System\KUcjvSH.exe
  2⤵
  PID:8720
- C:\Windows\System\yjXfEZV.exe
  C:\Windows\System\yjXfEZV.exe
  2⤵
  PID:8784
- C:\Windows\System\Qshddsy.exe
  C:\Windows\System\Qshddsy.exe
  2⤵
  PID:8848
- C:\Windows\System\gcqFmKB.exe
  C:\Windows\System\gcqFmKB.exe
  2⤵
  PID:8916
- C:\Windows\System\JWcEQKR.exe
  C:\Windows\System\JWcEQKR.exe
  2⤵
  PID:8388
- C:\Windows\System\SvqfpGT.exe
  C:\Windows\System\SvqfpGT.exe
  2⤵
  PID:8608
- C:\Windows\System\nMXIExn.exe
  C:\Windows\System\nMXIExn.exe
  2⤵
  PID:8480
- C:\Windows\System\RLwevVG.exe
  C:\Windows\System\RLwevVG.exe
  2⤵
  PID:8516
- C:\Windows\System\xYpNSPI.exe
  C:\Windows\System\xYpNSPI.exe
  2⤵
  PID:8484
- C:\Windows\System\xeVsGGH.exe
  C:\Windows\System\xeVsGGH.exe
  2⤵
  PID:8580
- C:\Windows\System\BgyjaNM.exe
  C:\Windows\System\BgyjaNM.exe
  2⤵
  PID:8676
- C:\Windows\System\emgpXOz.exe
  C:\Windows\System\emgpXOz.exe
  2⤵
  PID:9016
- C:\Windows\System\GIacglO.exe
  C:\Windows\System\GIacglO.exe
  2⤵
  PID:9088
- C:\Windows\System\jXIcZqh.exe
  C:\Windows\System\jXIcZqh.exe
  2⤵
  PID:8772
- C:\Windows\System\pxLvGjQ.exe
  C:\Windows\System\pxLvGjQ.exe
  2⤵
  PID:8864
- C:\Windows\System\MWsMFNI.exe
  C:\Windows\System\MWsMFNI.exe
  2⤵
  PID:8936
- C:\Windows\System\blTqdbX.exe
  C:\Windows\System\blTqdbX.exe
  2⤵
  PID:9000
- C:\Windows\System\LcZWUXi.exe
  C:\Windows\System\LcZWUXi.exe
  2⤵
  PID:9156
- C:\Windows\System\paLVnAO.exe
  C:\Windows\System\paLVnAO.exe
  2⤵
  PID:9072
- C:\Windows\System\hbNDPqd.exe
  C:\Windows\System\hbNDPqd.exe
  2⤵
  PID:9036
- C:\Windows\System\wsOSSNa.exe
  C:\Windows\System\wsOSSNa.exe
  2⤵
  PID:9140
- C:\Windows\System\wjKwTFK.exe
  C:\Windows\System\wjKwTFK.exe
  2⤵
  PID:8212
- C:\Windows\System\smGUWVR.exe
  C:\Windows\System\smGUWVR.exe
  2⤵
  PID:8228
- C:\Windows\System\qOrmlBl.exe
  C:\Windows\System\qOrmlBl.exe
  2⤵
  PID:8276
- C:\Windows\System\swTEdAo.exe
  C:\Windows\System\swTEdAo.exe
  2⤵
  PID:7924
- C:\Windows\System\rqgMkTc.exe
  C:\Windows\System\rqgMkTc.exe
  2⤵
  PID:8400
- C:\Windows\System\oVFTwoa.exe
  C:\Windows\System\oVFTwoa.exe
  2⤵
  PID:8528
- C:\Windows\System\rprvFtF.exe
  C:\Windows\System\rprvFtF.exe
  2⤵
  PID:8628
- C:\Windows\System\OBeAXQu.exe
  C:\Windows\System\OBeAXQu.exe
  2⤵
  PID:8900
- C:\Windows\System\mDuXwRM.exe
  C:\Windows\System\mDuXwRM.exe
  2⤵
  PID:8884
- C:\Windows\System\RWyfQuv.exe
  C:\Windows\System\RWyfQuv.exe
  2⤵
  PID:8420
- C:\Windows\System\eTKaRDP.exe
  C:\Windows\System\eTKaRDP.exe
  2⤵
  PID:8740
- C:\Windows\System\BxoEjCp.exe
  C:\Windows\System\BxoEjCp.exe
  2⤵
  PID:8820
- C:\Windows\System\TAgOAyJ.exe
  C:\Windows\System\TAgOAyJ.exe
  2⤵
  PID:8948
- C:\Windows\System\ahIbrLZ.exe
  C:\Windows\System\ahIbrLZ.exe
  2⤵
  PID:8640
- C:\Windows\System\qWeNyDf.exe
  C:\Windows\System\qWeNyDf.exe
  2⤵
  PID:8836
- C:\Windows\System\SewgIwh.exe
  C:\Windows\System\SewgIwh.exe
  2⤵
  PID:8968
- C:\Windows\System\TVNckrr.exe
  C:\Windows\System\TVNckrr.exe
  2⤵
  PID:9132
- C:\Windows\System\imPpNei.exe
  C:\Windows\System\imPpNei.exe
  2⤵
  PID:9208
- C:\Windows\System\HCGKnnq.exe
  C:\Windows\System\HCGKnnq.exe
  2⤵
  PID:8372
- C:\Windows\System\LEtUegH.exe
  C:\Windows\System\LEtUegH.exe
  2⤵
  PID:8880
- C:\Windows\System\RkkbPIE.exe
  C:\Windows\System\RkkbPIE.exe
  2⤵
  PID:8452
- C:\Windows\System\EaqJqrK.exe
  C:\Windows\System\EaqJqrK.exe
  2⤵
  PID:9104
- C:\Windows\System\kuPIpbZ.exe
  C:\Windows\System\kuPIpbZ.exe
  2⤵
  PID:8304
- C:\Windows\System\NStnKAk.exe
  C:\Windows\System\NStnKAk.exe
  2⤵
  PID:8288
- C:\Windows\System\ALKLYlN.exe
  C:\Windows\System\ALKLYlN.exe
  2⤵
  PID:9232
- C:\Windows\System\bcZDNEF.exe
  C:\Windows\System\bcZDNEF.exe
  2⤵
  PID:9248
- C:\Windows\System\CDotnlG.exe
  C:\Windows\System\CDotnlG.exe
  2⤵
  PID:9264
- C:\Windows\System\JCIgpyh.exe
  C:\Windows\System\JCIgpyh.exe
  2⤵
  PID:9280
- C:\Windows\System\PQBwUos.exe
  C:\Windows\System\PQBwUos.exe
  2⤵
  PID:9296
- C:\Windows\System\kSUkWKw.exe
  C:\Windows\System\kSUkWKw.exe
  2⤵
  PID:9312
- C:\Windows\System\CzyfIef.exe
  C:\Windows\System\CzyfIef.exe
  2⤵
  PID:9328
- C:\Windows\System\XGwQmFK.exe
  C:\Windows\System\XGwQmFK.exe
  2⤵
  PID:9344
- C:\Windows\System\JdcnmsD.exe
  C:\Windows\System\JdcnmsD.exe
  2⤵
  PID:9360
- C:\Windows\System\CvwEIeV.exe
  C:\Windows\System\CvwEIeV.exe
  2⤵
  PID:9376
- C:\Windows\System\uJGhgum.exe
  C:\Windows\System\uJGhgum.exe
  2⤵
  PID:9392
- C:\Windows\System\AqLunaq.exe
  C:\Windows\System\AqLunaq.exe
  2⤵
  PID:9408
- C:\Windows\System\kDxCLxi.exe
  C:\Windows\System\kDxCLxi.exe
  2⤵
  PID:9424
- C:\Windows\System\eWKTout.exe
  C:\Windows\System\eWKTout.exe
  2⤵
  PID:9440
- C:\Windows\System\iKFaZRe.exe
  C:\Windows\System\iKFaZRe.exe
  2⤵
  PID:9456
- C:\Windows\System\QUdHlov.exe
  C:\Windows\System\QUdHlov.exe
  2⤵
  PID:9472
- C:\Windows\System\kHWuhEp.exe
  C:\Windows\System\kHWuhEp.exe
  2⤵
  PID:9488
- C:\Windows\System\TKcYUGu.exe
  C:\Windows\System\TKcYUGu.exe
  2⤵
  PID:9504
- C:\Windows\System\JtoAxIZ.exe
  C:\Windows\System\JtoAxIZ.exe
  2⤵
  PID:9520
- C:\Windows\System\NRtiKwu.exe
  C:\Windows\System\NRtiKwu.exe
  2⤵
  PID:9536
- C:\Windows\System\MkVIRvL.exe
  C:\Windows\System\MkVIRvL.exe
  2⤵
  PID:9552
- C:\Windows\System\XxREdPx.exe
  C:\Windows\System\XxREdPx.exe
  2⤵
  PID:9568
- C:\Windows\System\dLxXvNF.exe
  C:\Windows\System\dLxXvNF.exe
  2⤵
  PID:9588
- C:\Windows\System\yocPqZm.exe
  C:\Windows\System\yocPqZm.exe
  2⤵
  PID:9604
- C:\Windows\System\JZpvtol.exe
  C:\Windows\System\JZpvtol.exe
  2⤵
  PID:9620
- C:\Windows\System\TMtkELS.exe
  C:\Windows\System\TMtkELS.exe
  2⤵
  PID:9636
- C:\Windows\System\UyWbAvr.exe
  C:\Windows\System\UyWbAvr.exe
  2⤵
  PID:9652
- C:\Windows\System\RSDcXKH.exe
  C:\Windows\System\RSDcXKH.exe
  2⤵
  PID:9668
- C:\Windows\System\xqDNefQ.exe
  C:\Windows\System\xqDNefQ.exe
  2⤵
  PID:9684
- C:\Windows\System\eMFgmHG.exe
  C:\Windows\System\eMFgmHG.exe
  2⤵
  PID:9700
- C:\Windows\System\jUHZKrv.exe
  C:\Windows\System\jUHZKrv.exe
  2⤵
  PID:9716
- C:\Windows\System\WtvXLyb.exe
  C:\Windows\System\WtvXLyb.exe
  2⤵
  PID:9732
- C:\Windows\System\LUFIoDk.exe
  C:\Windows\System\LUFIoDk.exe
  2⤵
  PID:9748
- C:\Windows\System\OeDqUyB.exe
  C:\Windows\System\OeDqUyB.exe
  2⤵
  PID:9764
- C:\Windows\System\NgmeBiF.exe
  C:\Windows\System\NgmeBiF.exe
  2⤵
  PID:9780
- C:\Windows\System\OkIZGeU.exe
  C:\Windows\System\OkIZGeU.exe
  2⤵
  PID:9796
- C:\Windows\System\lFPygie.exe
  C:\Windows\System\lFPygie.exe
  2⤵
  PID:9812
- C:\Windows\System\ScpnzDP.exe
  C:\Windows\System\ScpnzDP.exe
  2⤵
  PID:9828
- C:\Windows\System\iYoXTsI.exe
  C:\Windows\System\iYoXTsI.exe
  2⤵
  PID:9844
- C:\Windows\System\HFXaxSv.exe
  C:\Windows\System\HFXaxSv.exe
  2⤵
  PID:9860
- C:\Windows\System\RwEuznp.exe
  C:\Windows\System\RwEuznp.exe
  2⤵
  PID:9876
- C:\Windows\System\spUvpPi.exe
  C:\Windows\System\spUvpPi.exe
  2⤵
  PID:9892
- C:\Windows\System\LTOfyNP.exe
  C:\Windows\System\LTOfyNP.exe
  2⤵
  PID:9908
- C:\Windows\System\ybkbWns.exe
  C:\Windows\System\ybkbWns.exe
  2⤵
  PID:9924
- C:\Windows\System\TeLtvBB.exe
  C:\Windows\System\TeLtvBB.exe
  2⤵
  PID:9940
- C:\Windows\System\VWbtGoS.exe
  C:\Windows\System\VWbtGoS.exe
  2⤵
  PID:9956
- C:\Windows\System\coWUmJD.exe
  C:\Windows\System\coWUmJD.exe
  2⤵
  PID:9972
- C:\Windows\System\LPYDNuL.exe
  C:\Windows\System\LPYDNuL.exe
  2⤵
  PID:9988
- C:\Windows\System\BRSRkQt.exe
  C:\Windows\System\BRSRkQt.exe
  2⤵
  PID:10004
- C:\Windows\System\CcxOJjn.exe
  C:\Windows\System\CcxOJjn.exe
  2⤵
  PID:10020
- C:\Windows\System\gBAfAQq.exe
  C:\Windows\System\gBAfAQq.exe
  2⤵
  PID:10036
- C:\Windows\System\NbvOUhW.exe
  C:\Windows\System\NbvOUhW.exe
  2⤵
  PID:10052
- C:\Windows\System\XHRzMrv.exe
  C:\Windows\System\XHRzMrv.exe
  2⤵
  PID:10068
- C:\Windows\System\INTjmWl.exe
  C:\Windows\System\INTjmWl.exe
  2⤵
  PID:10084
- C:\Windows\System\egRgDqk.exe
  C:\Windows\System\egRgDqk.exe
  2⤵
  PID:10100
- C:\Windows\System\dWWDalF.exe
  C:\Windows\System\dWWDalF.exe
  2⤵
  PID:10116
- C:\Windows\System\HTyjyHX.exe
  C:\Windows\System\HTyjyHX.exe
  2⤵
  PID:10132
- C:\Windows\System\XMPxoXg.exe
  C:\Windows\System\XMPxoXg.exe
  2⤵
  PID:10148
- C:\Windows\System\PZMVSiJ.exe
  C:\Windows\System\PZMVSiJ.exe
  2⤵
  PID:10164
- C:\Windows\System\uViJryb.exe
  C:\Windows\System\uViJryb.exe
  2⤵
  PID:10180
- C:\Windows\System\QbmeMev.exe
  C:\Windows\System\QbmeMev.exe
  2⤵
  PID:10196
- C:\Windows\System\rPCeIjz.exe
  C:\Windows\System\rPCeIjz.exe
  2⤵
  PID:10212
- C:\Windows\System\XoYcGjk.exe
  C:\Windows\System\XoYcGjk.exe
  2⤵
  PID:10228
- C:\Windows\System\COXYZWr.exe
  C:\Windows\System\COXYZWr.exe
  2⤵
  PID:9228
- C:\Windows\System\cPybnyY.exe
  C:\Windows\System\cPybnyY.exe
  2⤵
  PID:9292
- C:\Windows\System\YRmlstv.exe
  C:\Windows\System\YRmlstv.exe
  2⤵
  PID:9172
- C:\Windows\System\yPJPPBH.exe
  C:\Windows\System\yPJPPBH.exe
  2⤵
  PID:8896
- C:\Windows\System\ZFXvsXt.exe
  C:\Windows\System\ZFXvsXt.exe
  2⤵
  PID:9120
- C:\Windows\System\jjiRDhk.exe
  C:\Windows\System\jjiRDhk.exe
  2⤵
  PID:7956
- C:\Windows\System\UzyXbCR.exe
  C:\Windows\System\UzyXbCR.exe
  2⤵
  PID:8708
- C:\Windows\System\GzxkYEf.exe
  C:\Windows\System\GzxkYEf.exe
  2⤵
  PID:9240
- C:\Windows\System\clkIgMf.exe
  C:\Windows\System\clkIgMf.exe
  2⤵
  PID:8816
- C:\Windows\System\bnrJpQM.exe
  C:\Windows\System\bnrJpQM.exe
  2⤵
  PID:9388
- C:\Windows\System\XQdfNSO.exe
  C:\Windows\System\XQdfNSO.exe
  2⤵
  PID:9420
- C:\Windows\System\zFyIqXd.exe
  C:\Windows\System\zFyIqXd.exe
  2⤵
  PID:9452
- C:\Windows\System\WnTOCZD.exe
  C:\Windows\System\WnTOCZD.exe
  2⤵
  PID:9308
- C:\Windows\System\tbsqUMd.exe
  C:\Windows\System\tbsqUMd.exe
  2⤵
  PID:9544
- C:\Windows\System\sZCBwoT.exe
  C:\Windows\System\sZCBwoT.exe
  2⤵
  PID:9612
- C:\Windows\System\YGuuoSO.exe
  C:\Windows\System\YGuuoSO.exe
  2⤵
  PID:9340
- C:\Windows\System\CaLNUoS.exe
  C:\Windows\System\CaLNUoS.exe
  2⤵
  PID:9712
- C:\Windows\System\GkBmRiy.exe
  C:\Windows\System\GkBmRiy.exe
  2⤵
  PID:9744
- C:\Windows\System\IsjqDYU.exe
  C:\Windows\System\IsjqDYU.exe
  2⤵
  PID:9368
- C:\Windows\System\FJokXMl.exe
  C:\Windows\System\FJokXMl.exe
  2⤵
  PID:9660
- C:\Windows\System\qLtoktW.exe
  C:\Windows\System\qLtoktW.exe
  2⤵
  PID:9464
- C:\Windows\System\GYMJZTg.exe
  C:\Windows\System\GYMJZTg.exe
  2⤵
  PID:9692
- C:\Windows\System\LEfJcRK.exe
  C:\Windows\System\LEfJcRK.exe
  2⤵
  PID:9560
- C:\Windows\System\MAycofy.exe
  C:\Windows\System\MAycofy.exe
  2⤵
  PID:9664
- C:\Windows\System\HrUKzdh.exe
  C:\Windows\System\HrUKzdh.exe
  2⤵
  PID:8752
- C:\Windows\System\yAkJeBd.exe
  C:\Windows\System\yAkJeBd.exe
  2⤵
  PID:9788
- C:\Windows\System\aWAVaSn.exe
  C:\Windows\System\aWAVaSn.exe
  2⤵
  PID:9872
- C:\Windows\System\wapYcfk.exe
  C:\Windows\System\wapYcfk.exe
  2⤵
  PID:9936
- C:\Windows\System\zppaEMM.exe
  C:\Windows\System\zppaEMM.exe
  2⤵
  PID:10000
- C:\Windows\System\oFWDhyI.exe
  C:\Windows\System\oFWDhyI.exe
  2⤵
  PID:10064
- C:\Windows\System\WOfoCoN.exe
  C:\Windows\System\WOfoCoN.exe
  2⤵
  PID:10096
- C:\Windows\System\zTSYNRA.exe
  C:\Windows\System\zTSYNRA.exe
  2⤵
  PID:9856
- C:\Windows\System\HOVaYIf.exe
  C:\Windows\System\HOVaYIf.exe
  2⤵
  PID:10160
- C:\Windows\System\KCJBfFR.exe
  C:\Windows\System\KCJBfFR.exe
  2⤵
  PID:9980
- C:\Windows\System\mrlWoAA.exe
  C:\Windows\System\mrlWoAA.exe
  2⤵
  PID:10044
- C:\Windows\System\HeZYwth.exe
  C:\Windows\System\HeZYwth.exe
  2⤵
  PID:10188
- C:\Windows\System\OUEAfBf.exe
  C:\Windows\System\OUEAfBf.exe
  2⤵
  PID:10112
- C:\Windows\System\DGebSuq.exe
  C:\Windows\System\DGebSuq.exe
  2⤵
  PID:9288
- C:\Windows\System\yTngMiJ.exe
  C:\Windows\System\yTngMiJ.exe
  2⤵
  PID:10176
- C:\Windows\System\uUjKzeA.exe
  C:\Windows\System\uUjKzeA.exe
  2⤵
  PID:6168
- C:\Windows\System\atefWkP.exe
  C:\Windows\System\atefWkP.exe
  2⤵
  PID:10236
- C:\Windows\System\DTUIHBw.exe
  C:\Windows\System\DTUIHBw.exe
  2⤵
  PID:8448
- C:\Windows\System\XgTzdnO.exe
  C:\Windows\System\XgTzdnO.exe
  2⤵
  PID:9384
- C:\Windows\System\ofSZhqH.exe
  C:\Windows\System\ofSZhqH.exe
  2⤵
  PID:9068
- C:\Windows\System\zTslRDa.exe
  C:\Windows\System\zTslRDa.exe
  2⤵
  PID:9580
- C:\Windows\System\QCAweBJ.exe
  C:\Windows\System\QCAweBJ.exe
  2⤵
  PID:9516
- C:\Windows\System\EWNaErw.exe
  C:\Windows\System\EWNaErw.exe
  2⤵
  PID:9680
- C:\Windows\System\TRosjsv.exe
  C:\Windows\System\TRosjsv.exe
  2⤵
  PID:9808
- C:\Windows\System\gonOqqz.exe
  C:\Windows\System\gonOqqz.exe
  2⤵
  PID:9432
- C:\Windows\System\SYRzIiK.exe
  C:\Windows\System\SYRzIiK.exe
  2⤵
  PID:9404
- C:\Windows\System\YqYOtie.exe
  C:\Windows\System\YqYOtie.exe
  2⤵
  PID:9840
- C:\Windows\System\FbDoZXJ.exe
  C:\Windows\System\FbDoZXJ.exe
  2⤵
  PID:9868
- C:\Windows\System\rOErcQB.exe
  C:\Windows\System\rOErcQB.exe
  2⤵
  PID:9884
- C:\Windows\System\TlKZTaL.exe
  C:\Windows\System\TlKZTaL.exe
  2⤵
  PID:9968
- C:\Windows\System\cftyikL.exe
  C:\Windows\System\cftyikL.exe
  2⤵
  PID:10156
- C:\Windows\System\coSvFoN.exe
  C:\Windows\System\coSvFoN.exe
  2⤵
  PID:10224
- C:\Windows\System\RyJXBgY.exe
  C:\Windows\System\RyJXBgY.exe
  2⤵
  PID:10016
- C:\Windows\System\dXmFQvF.exe
  C:\Windows\System\dXmFQvF.exe
  2⤵
  PID:10208
- C:\Windows\System\dUFqxJN.exe
  C:\Windows\System\dUFqxJN.exe
  2⤵
  PID:9136
- C:\Windows\System\vIMdSPI.exe
  C:\Windows\System\vIMdSPI.exe
  2⤵
  PID:9512
- C:\Windows\System\zTXIQoA.exe
  C:\Windows\System\zTXIQoA.exe
  2⤵
  PID:9276
- C:\Windows\System\cKqvgCl.exe
  C:\Windows\System\cKqvgCl.exe
  2⤵
  PID:9356
- C:\Windows\System\waGBaeY.exe
  C:\Windows\System\waGBaeY.exe
  2⤵
  PID:9724
- C:\Windows\System\sMAiLmv.exe
  C:\Windows\System\sMAiLmv.exe
  2⤵
  PID:9824
- C:\Windows\System\WPBCAhg.exe
  C:\Windows\System\WPBCAhg.exe
  2⤵
  PID:10172
- C:\Windows\System\lNGqefp.exe
  C:\Windows\System\lNGqefp.exe
  2⤵
  PID:10108
- C:\Windows\System\MpJLtzw.exe
  C:\Windows\System\MpJLtzw.exe
  2⤵
  PID:4456
- C:\Windows\System\JSaNYXm.exe
  C:\Windows\System\JSaNYXm.exe
  2⤵
  PID:8692
- C:\Windows\System\ayccPcC.exe
  C:\Windows\System\ayccPcC.exe
  2⤵
  PID:10060
- C:\Windows\System\rZsukgM.exe
  C:\Windows\System\rZsukgM.exe
  2⤵
  PID:10012
- C:\Windows\System\PVParhj.exe
  C:\Windows\System\PVParhj.exe
  2⤵
  PID:9628
- C:\Windows\System\hJMQtpY.exe
  C:\Windows\System\hJMQtpY.exe
  2⤵
  PID:9728
- C:\Windows\System\VnmiAtb.exe
  C:\Windows\System\VnmiAtb.exe
  2⤵
  PID:10128
- C:\Windows\System\ursmvPW.exe
  C:\Windows\System\ursmvPW.exe
  2⤵
  PID:9648
- C:\Windows\System\VUjvdZS.exe
  C:\Windows\System\VUjvdZS.exe
  2⤵
  PID:9448
- C:\Windows\System\cBHQOBE.exe
  C:\Windows\System\cBHQOBE.exe
  2⤵
  PID:10256
- C:\Windows\System\VCLlgAa.exe
  C:\Windows\System\VCLlgAa.exe
  2⤵
  PID:10272
- C:\Windows\System\OPhSvBe.exe
  C:\Windows\System\OPhSvBe.exe
  2⤵
  PID:10288
- C:\Windows\System\dxVIMNb.exe
  C:\Windows\System\dxVIMNb.exe
  2⤵
  PID:10304
- C:\Windows\System\sMhlDfo.exe
  C:\Windows\System\sMhlDfo.exe
  2⤵
  PID:10320
- C:\Windows\System\rPjzicX.exe
  C:\Windows\System\rPjzicX.exe
  2⤵
  PID:10336
- C:\Windows\System\WSsNlcM.exe
  C:\Windows\System\WSsNlcM.exe
  2⤵
  PID:10352
- C:\Windows\System\BJrwYrF.exe
  C:\Windows\System\BJrwYrF.exe
  2⤵
  PID:10368
- C:\Windows\System\cQWWvan.exe
  C:\Windows\System\cQWWvan.exe
  2⤵
  PID:10384
- C:\Windows\System\lrsUPGP.exe
  C:\Windows\System\lrsUPGP.exe
  2⤵
  PID:10400
- C:\Windows\System\IcQcHkw.exe
  C:\Windows\System\IcQcHkw.exe
  2⤵
  PID:10416
- C:\Windows\System\mVlVYnE.exe
  C:\Windows\System\mVlVYnE.exe
  2⤵
  PID:10432
- C:\Windows\System\pDrAWtc.exe
  C:\Windows\System\pDrAWtc.exe
  2⤵
  PID:10448
- C:\Windows\System\dlajaKY.exe
  C:\Windows\System\dlajaKY.exe
  2⤵
  PID:10464
- C:\Windows\System\pNZrCHt.exe
  C:\Windows\System\pNZrCHt.exe
  2⤵
  PID:10480
- C:\Windows\System\CBMiaTQ.exe
  C:\Windows\System\CBMiaTQ.exe
  2⤵
  PID:10496
- C:\Windows\System\EAZndlY.exe
  C:\Windows\System\EAZndlY.exe
  2⤵
  PID:10512
- C:\Windows\System\jeZvRSy.exe
  C:\Windows\System\jeZvRSy.exe
  2⤵
  PID:10528
- C:\Windows\System\sQWdxuo.exe
  C:\Windows\System\sQWdxuo.exe
  2⤵
  PID:10544
- C:\Windows\System\MGsCaVN.exe
  C:\Windows\System\MGsCaVN.exe
  2⤵
  PID:10560
- C:\Windows\System\JYjaNNG.exe
  C:\Windows\System\JYjaNNG.exe
  2⤵
  PID:10576
- C:\Windows\System\TCkHrQq.exe
  C:\Windows\System\TCkHrQq.exe
  2⤵
  PID:10592
- C:\Windows\System\WHFuKui.exe
  C:\Windows\System\WHFuKui.exe
  2⤵
  PID:10616
- C:\Windows\System\qjwOuvT.exe
  C:\Windows\System\qjwOuvT.exe
  2⤵
  PID:10632
- C:\Windows\System\kANGoKY.exe
  C:\Windows\System\kANGoKY.exe
  2⤵
  PID:10648
- C:\Windows\System\lBPNcEG.exe
  C:\Windows\System\lBPNcEG.exe
  2⤵
  PID:10664
- C:\Windows\System\dyTdSEp.exe
  C:\Windows\System\dyTdSEp.exe
  2⤵
  PID:10680
- C:\Windows\System\TcgwhZk.exe
  C:\Windows\System\TcgwhZk.exe
  2⤵
  PID:10696
- C:\Windows\System\YlkXEHi.exe
  C:\Windows\System\YlkXEHi.exe
  2⤵
  PID:10712
- C:\Windows\System\mNekdcW.exe
  C:\Windows\System\mNekdcW.exe
  2⤵
  PID:10728
- C:\Windows\System\gHsEcad.exe
  C:\Windows\System\gHsEcad.exe
  2⤵
  PID:10744
- C:\Windows\System\nKQvMkl.exe
  C:\Windows\System\nKQvMkl.exe
  2⤵
  PID:10760
- C:\Windows\System\sDjjuZH.exe
  C:\Windows\System\sDjjuZH.exe
  2⤵
  PID:10776
- C:\Windows\System\xAndnFl.exe
  C:\Windows\System\xAndnFl.exe
  2⤵
  PID:10792
- C:\Windows\System\RqJamHI.exe
  C:\Windows\System\RqJamHI.exe
  2⤵
  PID:10808
- C:\Windows\System\KfOJWWq.exe
  C:\Windows\System\KfOJWWq.exe
  2⤵
  PID:10824
- C:\Windows\System\YnyGMbX.exe
  C:\Windows\System\YnyGMbX.exe
  2⤵
  PID:10840
- C:\Windows\System\iVsnUja.exe
  C:\Windows\System\iVsnUja.exe
  2⤵
  PID:10856
- C:\Windows\System\JNjnQsd.exe
  C:\Windows\System\JNjnQsd.exe
  2⤵
  PID:10872
- C:\Windows\System\tLozvqJ.exe
  C:\Windows\System\tLozvqJ.exe
  2⤵
  PID:10888
- C:\Windows\System\bocqMcH.exe
  C:\Windows\System\bocqMcH.exe
  2⤵
  PID:10904
- C:\Windows\System\oHlypKV.exe
  C:\Windows\System\oHlypKV.exe
  2⤵
  PID:10920
- C:\Windows\System\rvhoMyb.exe
  C:\Windows\System\rvhoMyb.exe
  2⤵
  PID:10936
- C:\Windows\System\uSnrCOh.exe
  C:\Windows\System\uSnrCOh.exe
  2⤵
  PID:10952
- C:\Windows\System\sNuQaKA.exe
  C:\Windows\System\sNuQaKA.exe
  2⤵
  PID:10968
- C:\Windows\System\EGOYrMS.exe
  C:\Windows\System\EGOYrMS.exe
  2⤵
  PID:10984
- C:\Windows\System\VlNmzeE.exe
  C:\Windows\System\VlNmzeE.exe
  2⤵
  PID:11000
- C:\Windows\System\ecbrZNF.exe
  C:\Windows\System\ecbrZNF.exe
  2⤵
  PID:11036
- C:\Windows\System\HDoVJlB.exe
  C:\Windows\System\HDoVJlB.exe
  2⤵
  PID:11060
- C:\Windows\System\uzbLpGS.exe
  C:\Windows\System\uzbLpGS.exe
  2⤵
  PID:11076
- C:\Windows\System\gFusNzl.exe
  C:\Windows\System\gFusNzl.exe
  2⤵
  PID:11092
- C:\Windows\System\zOsXwRb.exe
  C:\Windows\System\zOsXwRb.exe
  2⤵
  PID:11108
- C:\Windows\System\zSrrtQM.exe
  C:\Windows\System\zSrrtQM.exe
  2⤵
  PID:11124
- C:\Windows\System\yfVEwOF.exe
  C:\Windows\System\yfVEwOF.exe
  2⤵
  PID:11140
- C:\Windows\System\BchMaYD.exe
  C:\Windows\System\BchMaYD.exe
  2⤵
  PID:11156
- C:\Windows\System\RBEBVfl.exe
  C:\Windows\System\RBEBVfl.exe
  2⤵
  PID:11172
- C:\Windows\System\lCxMsCB.exe
  C:\Windows\System\lCxMsCB.exe
  2⤵
  PID:11188
- C:\Windows\System\eJYAuUU.exe
  C:\Windows\System\eJYAuUU.exe
  2⤵
  PID:11208
- C:\Windows\System\bnXUgZy.exe
  C:\Windows\System\bnXUgZy.exe
  2⤵
  PID:11224
- C:\Windows\System\nNESoPb.exe
  C:\Windows\System\nNESoPb.exe
  2⤵
  PID:11240
- C:\Windows\System\udFrxKa.exe
  C:\Windows\System\udFrxKa.exe
  2⤵
  PID:11256
- C:\Windows\System\LoMbSwS.exe
  C:\Windows\System\LoMbSwS.exe
  2⤵
  PID:10248
- C:\Windows\System\EwthVat.exe
  C:\Windows\System\EwthVat.exe
  2⤵
  PID:10312
- C:\Windows\System\GBKzLhN.exe
  C:\Windows\System\GBKzLhN.exe
  2⤵
  PID:10268
- C:\Windows\System\pEJVgdd.exe
  C:\Windows\System\pEJVgdd.exe
  2⤵
  PID:10264
- C:\Windows\System\XmZvCvR.exe
  C:\Windows\System\XmZvCvR.exe
  2⤵
  PID:10348
- C:\Windows\System\XPXvZcT.exe
  C:\Windows\System\XPXvZcT.exe
  2⤵
  PID:10472
- C:\Windows\System\QjDXASY.exe
  C:\Windows\System\QjDXASY.exe
  2⤵
  PID:10540
- C:\Windows\System\fzsjyLD.exe
  C:\Windows\System\fzsjyLD.exe
  2⤵
  PID:10396
- C:\Windows\System\lUcRdjo.exe
  C:\Windows\System\lUcRdjo.exe
  2⤵
  PID:10572
- C:\Windows\System\AhiepqP.exe
  C:\Windows\System\AhiepqP.exe
  2⤵
  PID:10488
- C:\Windows\System\jGkzuMN.exe
  C:\Windows\System\jGkzuMN.exe
  2⤵
  PID:10524
- C:\Windows\System\oDtIayo.exe
  C:\Windows\System\oDtIayo.exe
  2⤵
  PID:10608
- C:\Windows\System\iFmXiCa.exe
  C:\Windows\System\iFmXiCa.exe
  2⤵
  PID:10672
- C:\Windows\System\isBCyzY.exe
  C:\Windows\System\isBCyzY.exe
  2⤵
  PID:10736
- C:\Windows\System\kzuYkle.exe
  C:\Windows\System\kzuYkle.exe
  2⤵
  PID:10800
- C:\Windows\System\VXPqbHs.exe
  C:\Windows\System\VXPqbHs.exe
  2⤵
  PID:10832
- C:\Windows\System\yOVEqem.exe
  C:\Windows\System\yOVEqem.exe
  2⤵
  PID:10692
- C:\Windows\System\ezePmwf.exe
  C:\Windows\System\ezePmwf.exe
  2⤵
  PID:10784
- C:\Windows\System\KrmfYyn.exe
  C:\Windows\System\KrmfYyn.exe
  2⤵
  PID:10868
- C:\Windows\System\UfedVIf.exe
  C:\Windows\System\UfedVIf.exe
  2⤵
  PID:10880
- C:\Windows\System\VpoDHgh.exe
  C:\Windows\System\VpoDHgh.exe
  2⤵
  PID:10928
- C:\Windows\System\QCXFsYe.exe
  C:\Windows\System\QCXFsYe.exe
  2⤵
  PID:10912
- C:\Windows\System\UTILDSa.exe
  C:\Windows\System\UTILDSa.exe
  2⤵
  PID:10948
- C:\Windows\System\VfAmkqh.exe
  C:\Windows\System\VfAmkqh.exe
  2⤵
  PID:11016
- C:\Windows\System\EqAbJiZ.exe
  C:\Windows\System\EqAbJiZ.exe
  2⤵
  PID:11044
- C:\Windows\System\BRHhpvg.exe
  C:\Windows\System\BRHhpvg.exe
  2⤵
  PID:11068
- C:\Windows\System\bbgPmzp.exe
  C:\Windows\System\bbgPmzp.exe
  2⤵
  PID:11084
- C:\Windows\System\upSCHIu.exe
  C:\Windows\System\upSCHIu.exe
  2⤵
  PID:11152
- C:\Windows\System\eIREhqH.exe
  C:\Windows\System\eIREhqH.exe
  2⤵
  PID:11216
- C:\Windows\System\HNQrRHr.exe
  C:\Windows\System\HNQrRHr.exe
  2⤵
  PID:11164
- C:\Windows\System\zbvyqQs.exe
  C:\Windows\System\zbvyqQs.exe
  2⤵
  PID:11204
- C:\Windows\System\YjlLgfI.exe
  C:\Windows\System\YjlLgfI.exe
  2⤵
  PID:10280
- C:\Windows\System\NlbKbaR.exe
  C:\Windows\System\NlbKbaR.exe
  2⤵
  PID:10328
- C:\Windows\System\nBevwjT.exe
  C:\Windows\System\nBevwjT.exe
  2⤵
  PID:10344
- C:\Windows\System\fwtMZnk.exe
  C:\Windows\System\fwtMZnk.exe
  2⤵
  PID:10508
- C:\Windows\System\uiKyhlu.exe
  C:\Windows\System\uiKyhlu.exe
  2⤵
  PID:10440
- C:\Windows\System\WLJUFoy.exe
  C:\Windows\System\WLJUFoy.exe
  2⤵
  PID:10536
- C:\Windows\System\KKjOcCX.exe
  C:\Windows\System\KKjOcCX.exe
  2⤵
  PID:10708
- C:\Windows\System\mVqvxNt.exe
  C:\Windows\System\mVqvxNt.exe
  2⤵
  PID:10568
- C:\Windows\System\AzCDRdc.exe
  C:\Windows\System\AzCDRdc.exe
  2⤵
  PID:10768
- C:\Windows\System\rKVzVaI.exe
  C:\Windows\System\rKVzVaI.exe
  2⤵
  PID:10752
- C:\Windows\System\zXgWsiA.exe
  C:\Windows\System\zXgWsiA.exe
  2⤵
  PID:10816
- C:\Windows\System\rzpsvUC.exe
  C:\Windows\System\rzpsvUC.exe
  2⤵
  PID:10944
- C:\Windows\System\tNNopbM.exe
  C:\Windows\System\tNNopbM.exe
  2⤵
  PID:10964
- C:\Windows\System\WSlInou.exe
  C:\Windows\System\WSlInou.exe
  2⤵
  PID:11012
- C:\Windows\System\oEtHLsm.exe
  C:\Windows\System\oEtHLsm.exe
  2⤵
  PID:11032
- C:\Windows\System\CzfDSXo.exe
  C:\Windows\System\CzfDSXo.exe
  2⤵
  PID:11100
- C:\Windows\System\HkGvEgs.exe
  C:\Windows\System\HkGvEgs.exe
  2⤵
  PID:11196
- C:\Windows\System\LBTFvWD.exe
  C:\Windows\System\LBTFvWD.exe
  2⤵
  PID:11136
- C:\Windows\System\gEABtNx.exe
  C:\Windows\System\gEABtNx.exe
  2⤵
  PID:10032
- C:\Windows\System\cUvlWWQ.exe
  C:\Windows\System\cUvlWWQ.exe
  2⤵
  PID:10332
- C:\Windows\System\LRCzCRC.exe
  C:\Windows\System\LRCzCRC.exe
  2⤵
  PID:10428
- C:\Windows\System\schTTTd.exe
  C:\Windows\System\schTTTd.exe
  2⤵
  PID:10612
- C:\Windows\System\kHQFpGd.exe
  C:\Windows\System\kHQFpGd.exe
  2⤵
  PID:10644
- C:\Windows\System\okKnyQT.exe
  C:\Windows\System\okKnyQT.exe
  2⤵
  PID:10960
- C:\Windows\System\UauTeOd.exe
  C:\Windows\System\UauTeOd.exe
  2⤵
  PID:10804
- C:\Windows\System\HiCDWJl.exe
  C:\Windows\System\HiCDWJl.exe
  2⤵
  PID:11008
- C:\Windows\System\XVHZVZW.exe
  C:\Windows\System\XVHZVZW.exe
  2⤵
  PID:11252
- C:\Windows\System\VRZxKsE.exe
  C:\Windows\System\VRZxKsE.exe
  2⤵
  PID:11132
- C:\Windows\System\Ntcvanb.exe
  C:\Windows\System\Ntcvanb.exe
  2⤵
  PID:10704
- C:\Windows\System\kNszFpU.exe
  C:\Windows\System\kNszFpU.exe
  2⤵
  PID:11028
- C:\Windows\System\YszWJrA.exe
  C:\Windows\System\YszWJrA.exe
  2⤵
  PID:10852
- C:\Windows\System\KinWtyf.exe
  C:\Windows\System\KinWtyf.exe
  2⤵
  PID:10640
- C:\Windows\System\NvNIiqV.exe
  C:\Windows\System\NvNIiqV.exe
  2⤵
  PID:11104
- C:\Windows\System\IKAindo.exe
  C:\Windows\System\IKAindo.exe
  2⤵
  PID:11272
- C:\Windows\System\MyejIpW.exe
  C:\Windows\System\MyejIpW.exe
  2⤵
  PID:11288
- C:\Windows\System\kUOpebL.exe
  C:\Windows\System\kUOpebL.exe
  2⤵
  PID:11304
- C:\Windows\System\izUylSZ.exe
  C:\Windows\System\izUylSZ.exe
  2⤵
  PID:11320
- C:\Windows\System\rEDgUle.exe
  C:\Windows\System\rEDgUle.exe
  2⤵
  PID:11336
- C:\Windows\System\ESeZcUD.exe
  C:\Windows\System\ESeZcUD.exe
  2⤵
  PID:11352
- C:\Windows\System\YWlAoam.exe
  C:\Windows\System\YWlAoam.exe
  2⤵
  PID:11368
- C:\Windows\System\LwefWIT.exe
  C:\Windows\System\LwefWIT.exe
  2⤵
  PID:11384
- C:\Windows\System\WYONzuX.exe
  C:\Windows\System\WYONzuX.exe
  2⤵
  PID:11400
- C:\Windows\System\VvyWycg.exe
  C:\Windows\System\VvyWycg.exe
  2⤵
  PID:11416
- C:\Windows\System\JzCmnnU.exe
  C:\Windows\System\JzCmnnU.exe
  2⤵
  PID:11432
- C:\Windows\System\EmVrmXd.exe
  C:\Windows\System\EmVrmXd.exe
  2⤵
  PID:11448
- C:\Windows\System\KNkwCKF.exe
  C:\Windows\System\KNkwCKF.exe
  2⤵
  PID:11464
- C:\Windows\System\skfaQIa.exe
  C:\Windows\System\skfaQIa.exe
  2⤵
  PID:11480
- C:\Windows\System\vjqlwqW.exe
  C:\Windows\System\vjqlwqW.exe
  2⤵
  PID:11496
- C:\Windows\System\iBTHFck.exe
  C:\Windows\System\iBTHFck.exe
  2⤵
  PID:11512
- C:\Windows\System\vHJlhKq.exe
  C:\Windows\System\vHJlhKq.exe
  2⤵
  PID:11528
- C:\Windows\System\WgqlLUu.exe
  C:\Windows\System\WgqlLUu.exe
  2⤵
  PID:11544
- C:\Windows\System\uBoSJia.exe
  C:\Windows\System\uBoSJia.exe
  2⤵
  PID:11560
- C:\Windows\System\wJQFfBh.exe
  C:\Windows\System\wJQFfBh.exe
  2⤵
  PID:11576
- C:\Windows\System\ZFLpMdx.exe
  C:\Windows\System\ZFLpMdx.exe
  2⤵
  PID:11592
- C:\Windows\System\kodlVIs.exe
  C:\Windows\System\kodlVIs.exe
  2⤵
  PID:11612
- C:\Windows\System\beDLrLw.exe
  C:\Windows\System\beDLrLw.exe
  2⤵
  PID:11628
- C:\Windows\System\XTsJrKt.exe
  C:\Windows\System\XTsJrKt.exe
  2⤵
  PID:11644
- C:\Windows\System\UtCdohm.exe
  C:\Windows\System\UtCdohm.exe
  2⤵
  PID:11660
- C:\Windows\System\KwdXhfE.exe
  C:\Windows\System\KwdXhfE.exe
  2⤵
  PID:11676
- C:\Windows\System\cCiBlFe.exe
  C:\Windows\System\cCiBlFe.exe
  2⤵
  PID:11692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\GuLcUVn.exe

Filesize
2.7MB

MD5
92c4dc612b142e406f1402300036d05a

SHA1
5b586d0deeb7e8f77278294b25c637127ccb3cd3

SHA256
bd85aefda9d189b5eaf86855be713f66ed3a5118553747bfff496395aef25dc3

SHA512
0791aa3e8cc7be46b2fedc825f6ea4a7c6c32e64829b8375973cf2dee32dbc765d95b2862b79b2192235a5e2cc84e86532311185fdde51a61dbbf3b4a6bf9bf6

Download Submit
C:\Windows\system\HUmaEwl.exe

Filesize
2.7MB

MD5
35fa395719afbbc15b61f4b32df1f70e

SHA1
3586c3533b8f066cc812b87eebc9c1f4188f5b32

SHA256
a6a9d70af16beb50b9ecbbe88c359aff3431e21ec7d17a71ad9fdce2139d350d

SHA512
839ce4ed288976ccc8b5c7ebe5e36053a8d884a7676b918dd0c31a65ac70627236e3b420adb0bc01f68d332553b651c75b266b73c3304955e0ee29e684babf30

Download Submit
C:\Windows\system\MmohQFQ.exe

Filesize
2.7MB

MD5
36a502fa0eae03d3d315d3a749682c72

SHA1
a7d05109351875abd520a5384144ae264c20049f

SHA256
46347fed259a6707e8b154f527551fca56c328417d24055016da20f58621c35c

SHA512
8d46e58e11c57c98f28afe9f91e009891103e13c5a900da5e98723005355a308a321757806a1282b4a6636e2c08b460fae3f143788b3c94c27a81aeb8e734cc1

Download Submit
C:\Windows\system\ObIWUOc.exe

Filesize
2.7MB

MD5
1a4cdc4d7bda79e32dca02a0c3c7e4dd

SHA1
7c708ea8e43184d245b677756062324bbfcdbd09

SHA256
ca44d35f41082645619268b7639c82d7431476f24e04ff1e091e98dce3bf2da6

SHA512
484ae78ee344f0b5735907c2ae8c1a4ee93450d6857fa11d41bff984cd487c21d71793f57f6e2d91c3760b6d84a75360fc9c9a82ee53ec245a3d32ffeacb4926

Download Submit
C:\Windows\system\PgQjQEo.exe

Filesize
2.7MB

MD5
dbb4053ab4a7877fd49d237c4071a35a

SHA1
89289c350c6ced0ade9a06b1c85c8f6de3d30845

SHA256
7762998a5428be1efd7bddc7eb739396e4e56f2f0b132ac74e3065d9a2356183

SHA512
ea4a32a83bcb6a90df52c2365e6b6090fa9d96189a22511fb5932beddb51cca345928120990ee3b350ea21f88da8bc2d0aec304a648cf6717a3981a7084c8d69

Download Submit
C:\Windows\system\QLXhcTB.exe

Filesize
2.7MB

MD5
8eb2985278f4f863c745b0fabe9c4fe3

SHA1
4949c1a51bb80f38d11c10d556ab1f09431b0bea

SHA256
f19fd2c79a52349c4ee382c0ff2b475003a7ae4c3c53cd5b5a0df8ea3336f3f3

SHA512
5962dd1bc4dec4a61e2524d45ab62009f41131aeb895112ccacc89b54e29392f63c2c589ab4cd4eb9045b34220b6d3e1491f63d9c977ac713c08514e4f156185

Download Submit
C:\Windows\system\XJsXqhO.exe

Filesize
2.7MB

MD5
51637aea394336e35d3ec7f7c6088bf4

SHA1
22f18e67482405ecd1e22db64c78cd39bc03ead4

SHA256
59864aa3e90a0e679c8b268d75f82448918c9c87bdab53fe9b42e23c97ce642c

SHA512
0965b78655cc647280af3206f495400f5d47d08c9b3d9d48cf3860fe7e1182622bbbf281550c5440e00f66d9bb8cf0efeaa5787d3c22f87fe85b2b8805a5672c

Download Submit
C:\Windows\system\XZnlFIJ.exe

Filesize
2.8MB

MD5
1d0dafa6d934801b21a591c13547b2e0

SHA1
fd4200880f7c11b340aebcabae123c0efde29bd7

SHA256
901acaf45ce99045881723486591fbbfcf4db76a7b34c35f4f262b053101df4e

SHA512
12c7dda836925e7dd64847b6993bf014d20f694a27ced211426da4df920e2559e79d34c798c1c659a3ea8cfef26e7323cc6881c1b553f2119ba9f166491a9f62

Download Submit
C:\Windows\system\YouBYqF.exe

Filesize
2.7MB

MD5
2e70f2f53c3850579077561b64b6fd67

SHA1
eba4881f296f81b358d437d62f3de4a0c9dba3d4

SHA256
0d9e34ed41776fd3ec209c826a511cd897ebc548006b0b34eb46060d841c08d4

SHA512
3c8b3b60d4bdeef27d139b9ff1324f0bee168607dc89ddcd1b3c34084d658441e0a483dd5a8a543fc5078bf00663f7d93a478ed665ec6fb33f45c3e1dd7b9add

Download Submit
C:\Windows\system\aTheYWm.exe

Filesize
2.7MB

MD5
c53d892f6523359691962a8fd9b12d14

SHA1
a30c4ede185d410daa7fce45bc98932b58ea8182

SHA256
fb58de0bb083e7fc1d01ae688bc7e4fe56efef1c1c429242a3e46dd2775cef50

SHA512
ee0272ab7a707dde9c7adb79009e1289b741ad19f236daf327850c1c26d353253de92c0f5536ed2fe4831fa3e65ec2af744bc154a2c7121cde5c5eda45d40d90

Download Submit
C:\Windows\system\cbkALMv.exe

Filesize
2.7MB

MD5
57e617fffd085396f2d3b4e10de0543a

SHA1
4fbd5fcf0cdfd47452d281e70573e8ad2792d203

SHA256
61e5da0bfb51545610a216bbabd48bea7bb9064df0def314c117bece3d678460

SHA512
d3564d90d18c66363525f8a97d07288a0519c6f4961fdbe761ca4649334a94ac0569658f2187809bbb64bffdb3955d830f0882ce87adb14712e7752b165f81c8

Download Submit
C:\Windows\system\ctQYgGE.exe

Filesize
2.7MB

MD5
f9b4f4d251a1ab5d4bad407e421edcc4

SHA1
c5898c8847470e795729fa69a61eb22e76f89ea1

SHA256
70f7612dad24ef333d5b03e23f72a884b3000f9cb24f683d1e1d5d398d149f98

SHA512
4602ca139684df5489f450a676f75f9274bf851a1ca9c0de61d2843f1d943a5e8f1b34e0d9e9d0337dd409feeb32e4f2a2692ac4faddffa9836113ed85c400fd

Download Submit
C:\Windows\system\dGRsdre.exe

Filesize
2.7MB

MD5
d1415bd742d9c57337006529684ebb87

SHA1
9c6b8623fd153644dc6129f034996f0e14052d21

SHA256
0398d2b4f8fc16b9b0b086151cd8e2a713c8e01bc86c1f2c23c2329a287d2eb7

SHA512
1a4e6424749eba700803b0f10a2c38c0b619e24c60bdba7af8addc3a9358e704fb342fb54a8867cf78cf94add14a0972c54aec97c2e9d45ecce2cac1474712a5

Download Submit
C:\Windows\system\eygkDNp.exe

Filesize
2.7MB

MD5
bbfc9ef394b2e565ced6efeed7dd75b9

SHA1
24f395233984717e59b56939e8538b7a6970f82a

SHA256
f1bf202c4d187009b0772b1deb445a4cc7f12b9e2cfae286733bba77ca25a569

SHA512
ec05ef1d1ea824f8e7b540767a6ac257a23b94b15a566af19bc69cd83cede29134f26264b0649f60f168b9d0a4ba901ada8ced86d712f460e8f9a4caecdbbe40

Download Submit
C:\Windows\system\oBIJDzf.exe

Filesize
2.7MB

MD5
4decf2651f248f4a2298b5717e59b590

SHA1
a2072599da35565dd18b6aa75b690f07ecb1d8c4

SHA256
84ccf1d00a57bae170d420fa32c3b78d2a487fe096c72373620b3418cd400036

SHA512
c2b5e54954f802482d55e6be9fe53c288dca8306baa7d388ce59f483937c7be38fc737692078beb01ce6f5a7dd0fc8352f39c88987da1dbdf1b80572958cbd1b

Download Submit
C:\Windows\system\oCZoSiR.exe

Filesize
2.7MB

MD5
fa215c34d30b09e198e9ecc7cd109017

SHA1
3ff8f6c3b480e53d54668121f6552b0d8c1247ce

SHA256
70d8842d1206117455fa971bb0984fc89ac7db84cd5062036a07aaaaec36282a

SHA512
4adc1649fd7dd861bb46fb701b3eeba78939b032b753b5d5d6efefb27a6513a14f2f299c4f84159337e861618bf6ad0f6ebb5be5f99f0f8517b9c5c2ba587c3c

Download Submit
C:\Windows\system\oNmhXGv.exe

Filesize
2.7MB

MD5
bf0d427bf9cbdc62d296ba135206d901

SHA1
8428aaa53fda2c89b4e40a9a7b3add4c73c87221

SHA256
ac0b9d6d56e8b19f9081f6a23d540ecfa150ceed90def71b7b6890df81be2120

SHA512
10496b4874e690d45277db666cbae0b9e3aa98099fd0718dabfbd00c73a0b1be2aab17bd85f9d9bce6ff7e58ad4439e1660ba17ed48e6c6c095a9afb769ce1b8

Download Submit
C:\Windows\system\pDBKDgp.exe

Filesize
2.7MB

MD5
4d5e59e7430d0445ddd8d6713787a9ca

SHA1
7713aeb0c8d90c187beb9c803281339608100f2f

SHA256
1733f7698eeaa4b891ad877d23f885d095c31fc610e11fe1f159bc600b2a9ae5

SHA512
0361243c0c1aa9b3076da3cd4519f680005754ff5ac3dc015dd06887cc3b8eb17b244b80455129c4d708b237fe63844f7d4ffd1a7a0f0c9ca81ba57cea7231e6

Download Submit
C:\Windows\system\rgXqXnA.exe

Filesize
2.7MB

MD5
8a5fe125f274b1367317d97b640adfab

SHA1
b96a490fe6b5536919354bb0b6660da54eb9b103

SHA256
bbd712e2c0f84d607b9dfaf69d3e5f8a4d85992baeca6a3180dcc5b45dbeff09

SHA512
5f33c663222f7c399d8e8b252a72eadebe5a674d2b672cd3735cfe94d8cd35d5e1702bffc8055551853e4d74b6b7f6bdd775e9f99ee97a517c991f3c4e1d0f5f

Download Submit
C:\Windows\system\rmzShrx.exe

Filesize
2.7MB

MD5
8129d4055a895214d99a6daebf91644f

SHA1
09f6fa79c3bc2aedb30a9c1c8c0fa60ca481fef1

SHA256
3abc01c6e33c903380072566ea87e68a75e32091530d787e8fbaa95de01929f6

SHA512
4c2ded8448588db3e96acd6d8c82bcad52b8a873e5fca2fef7b795148118c36b2c857e2f13c0d05dae28e55deeb701a4e23e4755d46148d1a5fdeead3849939c

Download Submit
C:\Windows\system\wmajwyu.exe

Filesize
2.7MB

MD5
7b1c055278c3d27234e4285154f5560d

SHA1
15f0c0d15fde187677995da8ce31e5e527faf89b

SHA256
189bbc39f9e46d238adb01cd099ad48c9ae38a77b6064fa6f58e138c8f334bd5

SHA512
eedbd6249ae142e3494f855d2407f318aee530afd7e2f5e6b8f55116b46e901be519e4dafe4c38ad4eddc97d64e9bc888819e1e02568489f06360c583ccb9eff

Download Submit
C:\Windows\system\yWTOQwm.exe

Filesize
2.7MB

MD5
089ff4741b36dce2fd2be88f10c79673

SHA1
755a47670a537f111f242fcb725f1c43ba95fbe9

SHA256
8107d84861d14d69e35a8c3e751e62bfbb99f286ecec4cfd7e0d6f3ab2bbf556

SHA512
c19bf2afaee2ca3e1e9787e42f28660dce4db98d7b9535bbe818228f2e062c886920df8b0cccefcb66fddceb8e00788c3cf7ffeb94578410220d3ae893046e9b

Download Submit
C:\Windows\system\zcdQIeo.exe

Filesize
2.7MB

MD5
18eca68cb7de03baa169ac611e8787de

SHA1
94acf03f9d2b2a231899b1db57f3b1f50c45e120

SHA256
96eb67a75950b50b104ce7d555d4ce8e7719ceab59363c72d4a98329fb4d3e7f

SHA512
67541ec12fcfd03623e5c270822cf2aa3df2020bff5aebea937c3e0bfad14c749c687d1f0ed755c1c0fe2b9a4590ee8a1dab644ad7f17b25d56890683be78ce6

Download Submit
\Windows\system\DwiwfXU.exe

Filesize
2.7MB

MD5
9ecc0139b5e40d66d97852984c91eece

SHA1
7773aa29e708b6b8d83fad942032a4524ba5a6d5

SHA256
5b4bb0ab2d990a00364531163bdc316181da48984977de66d02b62793c720ab5

SHA512
82f51500f973d54a848d7527bc0bd0e0cf18d2e400741cce83cb4f9e6fccd111f60fa45639465db8197fa066b961601b69f57464e34549a6a873059b9359eac4

Download Submit
\Windows\system\EDWvtQp.exe

Filesize
2.8MB

MD5
5459e0a4e2c78755d583b5873a47930b

SHA1
4caa446ea369f59651f012087e8ca524d9984be4

SHA256
17225ebff7b8d19fb6afdafc3c84c0d25fd7e35f35be639326718ed9d588940c

SHA512
b0b076b45d7f104865c704cdfdbd187637c2a16a91aac26a9c6d05e5c9a1a5871ba84f98089a516751cab21db961767a5ed2d62cabe33dfd94428bbbcc151256

Download Submit
\Windows\system\EhQMdoN.exe

Filesize
2.7MB

MD5
e9c58ac454577535d1d29ff452252f7c

SHA1
1a9115549369adf89f044350d7e4a327ddf463f1

SHA256
01a5ffae36d788901a5c9bf01874e71d1852d871bf6ae2f8eaceecd424fcec3b

SHA512
883d77999e9af9c28672ce5d63081a64f71ef48564ce6b1ccf75d6a5cb6d8331a3f60873711deba19dfa12f08eacc2472e846fc29f445ea6bb8d9fb05fa9861c

Download Submit
\Windows\system\EoSpvQA.exe

Filesize
2.7MB

MD5
035aca6cd5d972c1a3fa2ecc479e2d52

SHA1
8dab17b4dbc79cdabc79854705c319a33c8465a6

SHA256
54ab5f416f32b3f25705cbbd0d2cc4213dd5ba73999e032bb8f8dd81524fd7e5

SHA512
b0beb2bfa2e7cd3f4f844cf3305954dafc2c2efd936bfc5089f7e5c95286e9900216c4ff8b2697c9846950b6f1057138cf527709ff14dbc019bf35259d04ada0

Download Submit
\Windows\system\KzUIrJf.exe

Filesize
2.7MB

MD5
2c74735255ca0144f70ddc77e68f50a7

SHA1
b0e299d963946a35344a886768472fbb4e762120

SHA256
2ff71b400d71320fcb598b98bf1d37e5837e25dba83fb060277d4e2edc56c28f

SHA512
4675ac61ed9cde9f021efd5b04a6a0e0f561939aa75fa735e65796941ac11a956e608ef89146bd29336857f26eda2e334e2a9382b4504e0ce3f5df9c1310ef5a

Download Submit
\Windows\system\NnAgdMT.exe

Filesize
2.7MB

MD5
ba94a16388afd927bf7185f790d64ac7

SHA1
d33e2436af20738727a7d5e2dc6e9ac87330609f

SHA256
134ef24dd74787f9e4815131424a28d366beeb89f8a89a40e2afe4dafc121ee4

SHA512
ea45fca4d143f17cd1110c8d8df033da490fcb6e79d4f0cac5b46563e5d8d695b304af8fc8d036f8817ff33ac7e475491bf629cc3c378ce9635f690667433209

Download Submit
\Windows\system\SyXzieR.exe

Filesize
2.7MB

MD5
9f5f6cf11aec88b76b95cb0f085d7f08

SHA1
b4565a23bd45c08d1af22ec3e17d8eacd2d3d19c

SHA256
bbd5f53238ba03d3decf9e3f70100bf12593f8ea6a6c5254b9b162d5659a5862

SHA512
beaa8115f7bb639e2b298178aef6c45f0b8cc3e36e83d230a655ab65bd8e7102462c29c48ff70c9c59b358ccf954d09e24b5d7ac0242efa21037b1743447fbd6

Download Submit
\Windows\system\TpIvClq.exe

Filesize
2.7MB

MD5
757f764d22c910956541b9db262db17f

SHA1
a7badd282e2d43c95c837322cf5138c6ed88e2f3

SHA256
d4f369ffaa08510d16b91e91b0faed4905eb00cb077876c8ce63f0e7e24c3f85

SHA512
bfc8b11f96988e220052c1876f0a07367c108ee95e23e79ba480da8648daf2d09dce9030d2d816cedf5ddfb2fa13f7fe01d2e3b7ce22b9d8bd199f1cfb9576b3

Download Submit
\Windows\system\UjPSmNJ.exe

Filesize
2.8MB

MD5
11f07357a1c54a6167d1d0f00a3c088b

SHA1
5a097e0f4922a9f2192ecc33b2d622492c6a8df6

SHA256
caa7135c3918b5d1c0310f98a9e396b2678dd95627a8a40fd08e3011b23676a0

SHA512
218c81236e3a2e8a44b93deb8b4b59f3472de0e551a8425a62e4d2f663db3f79d1438d0dc3afcce0c83b56196035bffda67a4c60ce36be9181c313962b268f47

Download Submit
\Windows\system\ZIlFrwY.exe

Filesize
2.8MB

MD5
7415f4c2c0ababe7c64a8e249fe5a114

SHA1
5fc2611330ed60e9eee0c64bc1f759e3d835fe42

SHA256
beb4948051ef91cf3498adae8766be4e381bb6ce91345c260a0571d3315b3c46

SHA512
763a0c3b78c7eea290b3e41a84a1456244a91309aee4c75f47bb556b5e50ffa9a02491f0f0ad0d11e3e81968ec9a026f4db1b88d2f0f503dd8fe9c812014c2f5

Download Submit
\Windows\system\nnvdnTU.exe

Filesize
2.7MB

MD5
b40b4d4c052e58f377ce666745f88dcc

SHA1
9cb483f2da03c50c4a15c5db0ed2fca5394ceb0d

SHA256
ec75f46b8a0e8fce0c43090aecdcc2c2175ec34eacef3b2e4cf3dec69469b846

SHA512
870962488c7921489924076defcd6989bc785aeb4f4b860552c7c99088dc03ede2b2bf7a60d55126ffeaa2d26b4b41a3ca379f1a9db206c1ff14dc5d4052e8e4

Download Submit
\Windows\system\paFRhuc.exe

Filesize
2.7MB

MD5
120609a5d12d225cb5f4c7811b0a5e5d

SHA1
0ef38b9aa908b3fdf5950317fbcca4aabc0479cb

SHA256
9a242eca8f018a056cf7eea446e119d075f1f2a9a5c470f79265f77ee72841e4

SHA512
62787bab531aa8f8f9671907483caa635010a4df811757a9dad7c3c83b48ac0236fa6e690746101923043d322ecc02fe6cea996cc1bb9fc28b6e18dc2214ddfb

Download Submit
\Windows\system\tzIwZGV.exe

Filesize
2.7MB

MD5
08959a2b0bce93838d5e69401f1b79f6

SHA1
07a2fd20d9c9bd8ed70460b978126322fd05a274

SHA256
ca2801c68a0bcb8efaa1771102934dbfebbbc94aa16dd498ceeb583bed05836a

SHA512
ee0a5a0f0a925dc2c432fa88c7234222ec4f50f8b05d680d1dfe9516018a773710a917f3f1456a2e92bd6ee73cd13eb88efef4b897930f593478f35e93c2281e

Download Submit
\Windows\system\yfckBqg.exe

Filesize
2.7MB

MD5
923750da0110361eb1f7dc1eee15e32a

SHA1
385c450c03f680fd117ebb96ed4e27e5e51dec88

SHA256
ee736fbab4c381f664e477518638a76007c12b596d44e202665cc9d7d808963d

SHA512
aef662547457d285502bd80a0c21588ed0250e9248d8da4b9e422b3275c62da041e49b2a6e177ef60b77f19171a0a97f5caf9fc0895ba4664fac0051e5cbf6e9

Download Submit
memory/616-5-0x000000013F610000-0x000000013FA02000-memory.dmp

Filesize
3.9MB

Download
memory/616-10154-0x0000000003070000-0x0000000003462000-memory.dmp

Filesize
3.9MB

Download
memory/616-145-0x0000000003070000-0x0000000003462000-memory.dmp

Filesize
3.9MB

Download
memory/616-169-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/616-150-0x0000000003070000-0x0000000003462000-memory.dmp

Filesize
3.9MB

Download
memory/616-167-0x0000000003070000-0x0000000003462000-memory.dmp

Filesize
3.9MB

Download
memory/616-10951-0x0000000003070000-0x0000000003462000-memory.dmp

Filesize
3.9MB

Download
memory/616-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/616-165-0x000000013FAC0000-0x000000013FEB2000-memory.dmp

Filesize
3.9MB

Download
memory/616-155-0x0000000003070000-0x0000000003462000-memory.dmp

Filesize
3.9MB

Download
memory/616-10169-0x0000000003070000-0x0000000003462000-memory.dmp

Filesize
3.9MB

Download
memory/616-157-0x000000013FB90000-0x000000013FF82000-memory.dmp

Filesize
3.9MB

Download
memory/616-10183-0x0000000003070000-0x0000000003462000-memory.dmp

Filesize
3.9MB

Download
memory/616-159-0x0000000003070000-0x0000000003462000-memory.dmp

Filesize
3.9MB

Download
memory/616-9581-0x000000013F610000-0x000000013FA02000-memory.dmp

Filesize
3.9MB

Download
memory/616-161-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download
memory/616-10197-0x000000013FF20000-0x0000000140312000-memory.dmp

Filesize
3.9MB

Download
memory/616-163-0x000000013FDE0000-0x00000001401D2000-memory.dmp

Filesize
3.9MB

Download
memory/616-148-0x0000000003070000-0x0000000003462000-memory.dmp

Filesize
3.9MB

Download
memory/616-10211-0x0000000003070000-0x0000000003462000-memory.dmp

Filesize
3.9MB

Download
memory/616-10238-0x0000000003070000-0x0000000003462000-memory.dmp

Filesize
3.9MB

Download
memory/616-152-0x000000013FF20000-0x0000000140312000-memory.dmp

Filesize
3.9MB

Download
memory/1804-89-0x000000001B680000-0x000000001B962000-memory.dmp

Filesize
2.9MB

Download
memory/1804-141-0x000007FEF5130000-0x000007FEF5ACD000-memory.dmp

Filesize
9.6MB

Download
memory/1804-105-0x0000000001C10000-0x0000000001C18000-memory.dmp

Filesize
32KB

Download
memory/1804-13-0x00000000028F0000-0x0000000002970000-memory.dmp

Filesize
512KB

Download
memory/1804-14-0x000007FEF53EE000-0x000007FEF53EF000-memory.dmp

Filesize
4KB

Download
memory/1804-168-0x000007FEF5130000-0x000007FEF5ACD000-memory.dmp

Filesize
9.6MB

Download
memory/2216-12-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/2216-4992-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/2508-160-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/2508-5029-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/2544-158-0x000000013FB90000-0x000000013FF82000-memory.dmp

Filesize
3.9MB

Download
memory/2544-5000-0x000000013FB90000-0x000000013FF82000-memory.dmp

Filesize
3.9MB

Download
memory/2572-5022-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download
memory/2572-162-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download
memory/2624-146-0x000000013F960000-0x000000013FD52000-memory.dmp

Filesize
3.9MB

Download
memory/2624-5015-0x000000013F960000-0x000000013FD52000-memory.dmp

Filesize
3.9MB

Download
memory/2628-4995-0x000000013F320000-0x000000013F712000-memory.dmp

Filesize
3.9MB

Download
memory/2628-149-0x000000013F320000-0x000000013F712000-memory.dmp

Filesize
3.9MB

Download
memory/2656-151-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/2656-5021-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/2708-4996-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/2708-143-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/2876-153-0x000000013FF20000-0x0000000140312000-memory.dmp

Filesize
3.9MB

Download
memory/2876-5007-0x000000013FF20000-0x0000000140312000-memory.dmp

Filesize
3.9MB

Download
memory/2980-5031-0x000000013FDE0000-0x00000001401D2000-memory.dmp

Filesize
3.9MB

Download
memory/2980-164-0x000000013FDE0000-0x00000001401D2000-memory.dmp

Filesize
3.9MB

Download
memory/2996-5032-0x000000013FAC0000-0x000000013FEB2000-memory.dmp

Filesize
3.9MB

Download
memory/2996-166-0x000000013FAC0000-0x000000013FEB2000-memory.dmp

Filesize
3.9MB

Download
memory/3024-5011-0x000000013F8F0000-0x000000013FCE2000-memory.dmp

Filesize
3.9MB

Download
memory/3024-156-0x000000013F8F0000-0x000000013FCE2000-memory.dmp

Filesize
3.9MB

Download