xmrig | d79c5c82a5955fa5745c0b7d54d2cecfb22b691b6bf0dcd79e97bf4f4f31108d

Analysis

max time kernel
149s
max time network
144s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13-05-2024 23:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
Size

2.1MB
MD5

3cedf3473f42fe9537fe8fa084d660e6
SHA1

ded1b3c2cb296f5f9ec06ecb2dd01ebbd53809c5
SHA256

d79c5c82a5955fa5745c0b7d54d2cecfb22b691b6bf0dcd79e97bf4f4f31108d
SHA512

5be16718a54cf43f3990e3317c99a1a5c726e2a5d87da706eb55b717b30a917be2662b9699123f862a0955c6ab352d9dd7e2d453dfd1f680f15654e4b6441d61
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafJca:NABW

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 22 IoCs

miner

resource	yara_rule
behavioral1/memory/2624-39-0x000000013F680000-0x000000013FA72000-memory.dmp	xmrig
behavioral1/memory/2224-12-0x000000013FDD0000-0x00000001401C2000-memory.dmp	xmrig
behavioral1/memory/616-81-0x000000013F060000-0x000000013F452000-memory.dmp	xmrig
behavioral1/memory/2552-65-0x000000013F480000-0x000000013F872000-memory.dmp	xmrig
behavioral1/memory/2780-64-0x000000013FFA0000-0x0000000140392000-memory.dmp	xmrig
behavioral1/memory/2560-70-0x000000013F180000-0x000000013F572000-memory.dmp	xmrig
behavioral1/memory/616-90-0x000000013F890000-0x000000013FC82000-memory.dmp	xmrig
behavioral1/memory/2092-89-0x000000013FB50000-0x000000013FF42000-memory.dmp	xmrig
behavioral1/memory/2980-73-0x000000013F620000-0x000000013FA12000-memory.dmp	xmrig
behavioral1/memory/1272-281-0x000000013FA80000-0x000000013FE72000-memory.dmp	xmrig
behavioral1/memory/2624-5439-0x000000013F680000-0x000000013FA72000-memory.dmp	xmrig
behavioral1/memory/1272-5440-0x000000013FA80000-0x000000013FE72000-memory.dmp	xmrig
behavioral1/memory/2224-5443-0x000000013FDD0000-0x00000001401C2000-memory.dmp	xmrig
behavioral1/memory/2696-5444-0x000000013F890000-0x000000013FC82000-memory.dmp	xmrig
behavioral1/memory/2552-5469-0x000000013F480000-0x000000013F872000-memory.dmp	xmrig
behavioral1/memory/2712-5464-0x000000013F230000-0x000000013F622000-memory.dmp	xmrig
behavioral1/memory/2780-5461-0x000000013FFA0000-0x0000000140392000-memory.dmp	xmrig
behavioral1/memory/2560-5458-0x000000013F180000-0x000000013F572000-memory.dmp	xmrig
behavioral1/memory/2980-6709-0x000000013F620000-0x000000013FA12000-memory.dmp	xmrig
behavioral1/memory/2860-6708-0x000000013F740000-0x000000013FB32000-memory.dmp	xmrig
behavioral1/memory/2092-6712-0x000000013FB50000-0x000000013FF42000-memory.dmp	xmrig
behavioral1/memory/616-9935-0x000000013F890000-0x000000013FC82000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1804	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2224	ZEjjhMe.exe
1272	mtaQDYh.exe
2696	MDehdoy.exe
2624	bYGXATe.exe
2712	FcpYWMA.exe
2780	FUPFzUp.exe
2552	KkdqEbN.exe
2560	uVfczNk.exe
2980	rulkmkW.exe
2860	myQEifY.exe
2092	JCLrPui.exe
2008	WsnpJfQ.exe
316	EyKlLox.exe
2756	lrHZOoj.exe
2868	mlcJcZe.exe
1612	eSxFmVI.exe
2076	cRHMBID.exe
2284	vWrroFd.exe
2300	RxEfTYT.exe
2116	OChJZBc.exe
704	dTfCvpt.exe
1632	BTMKoOA.exe
2100	ctYHsgL.exe
1760	AOYDqbu.exe
2380	sinVLCn.exe
1732	JOCvooD.exe
1056	AIqIlRx.exe
1088	EUwYAHs.exe
2276	xSCzMrA.exe
1852	ujMDOuQ.exe
2384	FMHqGqG.exe
3008	UdKBmIa.exe
2292	fpOptZg.exe
540	bbTGKhI.exe
1488	QcpzGLk.exe
2940	Oyyrehz.exe
2220	CUnPhkc.exe
1592	TovYaWl.exe
2992	gnfppsj.exe
2648	bopftgH.exe
2528	eTtPcdI.exe
1148	ExGfyeN.exe
2616	ybAZQEK.exe
1300	xNtFRZv.exe
2976	VShaVQC.exe
2124	JJxgXoL.exe
1028	mivtUqr.exe
748	ukgCBVD.exe
2484	jTOLSdD.exe
2172	fMgIGGK.exe
860	vCafPVT.exe
3052	SdUfAuW.exe
2996	UFhIaIH.exe
2056	OlPHrHC.exe
1116	wjNwXDc.exe
3084	qzJjwSR.exe
3116	EkYQYtL.exe
3148	qmosJnI.exe
3180	GLoFvwz.exe
3212	qbyqloL.exe
3244	sJEwRhd.exe
3276	caZOaBv.exe
3308	InSPyaZ.exe
3340	xErRWMr.exe

Loads dropped DLL 64 IoCs

pid	Process
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/616-1-0x000000013F060000-0x000000013F452000-memory.dmp	upx
behavioral1/files/0x000b000000012286-3.dat	upx
behavioral1/files/0x0038000000015686-6.dat	upx
behavioral1/memory/1272-16-0x000000013FA80000-0x000000013FE72000-memory.dmp	upx
behavioral1/files/0x0008000000015cb8-17.dat	upx
behavioral1/files/0x0007000000015cdf-30.dat	upx
behavioral1/memory/2624-39-0x000000013F680000-0x000000013FA72000-memory.dmp	upx
behavioral1/files/0x0007000000015ce8-41.dat	upx
behavioral1/files/0x0007000000015cc7-20.dat	upx
behavioral1/memory/2712-40-0x000000013F230000-0x000000013F622000-memory.dmp	upx
behavioral1/memory/2696-37-0x000000013F890000-0x000000013FC82000-memory.dmp	upx
behavioral1/files/0x000d00000000549e-49.dat	upx
behavioral1/memory/2224-12-0x000000013FDD0000-0x00000001401C2000-memory.dmp	upx
behavioral1/files/0x0037000000015693-53.dat	upx
behavioral1/files/0x0009000000015d12-61.dat	upx
behavioral1/memory/616-81-0x000000013F060000-0x000000013F452000-memory.dmp	upx
behavioral1/files/0x0006000000016581-79.dat	upx
behavioral1/files/0x0008000000016455-76.dat	upx
behavioral1/files/0x0006000000016835-93.dat	upx
behavioral1/files/0x0006000000016c52-102.dat	upx
behavioral1/files/0x0006000000016c78-108.dat	upx
behavioral1/memory/2552-65-0x000000013F480000-0x000000013F872000-memory.dmp	upx
behavioral1/memory/2780-64-0x000000013FFA0000-0x0000000140392000-memory.dmp	upx
behavioral1/files/0x0006000000016ceb-117.dat	upx
behavioral1/files/0x0006000000016d2a-124.dat	upx
behavioral1/files/0x0006000000016d3b-131.dat	upx
behavioral1/files/0x00060000000173ca-187.dat	upx
behavioral1/memory/2560-70-0x000000013F180000-0x000000013F572000-memory.dmp	upx
behavioral1/files/0x0006000000017223-182.dat	upx
behavioral1/files/0x0006000000016de3-175.dat	upx
behavioral1/files/0x0006000000016dd1-168.dat	upx
behavioral1/files/0x0006000000016dba-161.dat	upx
behavioral1/files/0x0006000000016d8b-154.dat	upx
behavioral1/files/0x0006000000016d68-147.dat	upx
behavioral1/memory/2092-89-0x000000013FB50000-0x000000013FF42000-memory.dmp	upx
behavioral1/memory/2860-87-0x000000013F740000-0x000000013FB32000-memory.dmp	upx
behavioral1/files/0x00060000000165e1-82.dat	upx
behavioral1/files/0x0006000000016d5f-140.dat	upx
behavioral1/files/0x0006000000016d43-133.dat	upx
behavioral1/files/0x0006000000016d32-126.dat	upx
behavioral1/files/0x0006000000016d17-119.dat	upx
behavioral1/files/0x0006000000016cc1-112.dat	upx
behavioral1/files/0x0006000000016c6f-103.dat	upx
behavioral1/files/0x0006000000016a8a-95.dat	upx
behavioral1/memory/2980-73-0x000000013F620000-0x000000013FA12000-memory.dmp	upx
behavioral1/memory/1272-281-0x000000013FA80000-0x000000013FE72000-memory.dmp	upx
behavioral1/files/0x00060000000171d7-180.dat	upx
behavioral1/files/0x0006000000016ddc-173.dat	upx
behavioral1/files/0x0006000000016dc8-166.dat	upx
behavioral1/files/0x0006000000016d9f-159.dat	upx
behavioral1/files/0x0006000000016d6f-152.dat	upx
behavioral1/files/0x0006000000016d64-145.dat	upx
behavioral1/files/0x0006000000016d4b-138.dat	upx
behavioral1/memory/2624-5439-0x000000013F680000-0x000000013FA72000-memory.dmp	upx
behavioral1/memory/1272-5440-0x000000013FA80000-0x000000013FE72000-memory.dmp	upx
behavioral1/memory/2224-5443-0x000000013FDD0000-0x00000001401C2000-memory.dmp	upx
behavioral1/memory/2696-5444-0x000000013F890000-0x000000013FC82000-memory.dmp	upx
behavioral1/memory/2552-5469-0x000000013F480000-0x000000013F872000-memory.dmp	upx
behavioral1/memory/2712-5464-0x000000013F230000-0x000000013F622000-memory.dmp	upx
behavioral1/memory/2780-5461-0x000000013FFA0000-0x0000000140392000-memory.dmp	upx
behavioral1/memory/2560-5458-0x000000013F180000-0x000000013F572000-memory.dmp	upx
behavioral1/memory/2980-6709-0x000000013F620000-0x000000013FA12000-memory.dmp	upx
behavioral1/memory/2860-6708-0x000000013F740000-0x000000013FB32000-memory.dmp	upx
behavioral1/memory/2092-6712-0x000000013FB50000-0x000000013FF42000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\JBaRZEx.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\zlkvLyL.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\FhwlHEN.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\wUklOjP.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\kVWbZcQ.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\PdrFPOV.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\tqdIRjY.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\uTmnCOE.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\cruvbSB.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\UqYFjBy.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\CjVAnHr.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\pHSimPh.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\RVDASVo.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\sTrYQrW.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\hRULXdm.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\uBtiiaK.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\DkcRHlN.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\FvzKiDZ.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\UzOKbeM.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\dthQNHF.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\YKYJumx.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\JFZFSui.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\PMjZvmX.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\zuPFDUh.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\MxvEJKk.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\yvnAwhE.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\xJmDGye.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\MGDaEXK.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\AnoabpN.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\bCPwznS.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\aYvtQqC.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\gwdqPjX.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\XTbHutB.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\ccxfmaS.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\jxfgIgx.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\jkVZqfa.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\DrohySo.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\QPYhtox.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\jTfEwyZ.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\KcyiuLZ.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\cOPCDea.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\LZSAXQc.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\RWYbhNU.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\ULPdXYm.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\lJmpLnP.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\NJEpDcR.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\eDHNtNu.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\nBveFDo.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\qFDQyWa.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\LrZNuVu.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\VqDGiwv.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\ceWruZL.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\TcJaRJB.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\gQnzrOe.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\GUOBslY.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\wrFzAip.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\XJdccwG.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\gJhVZwX.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\KRkeruj.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\bpwHaPx.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\tMKHfAf.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\AkOlaBJ.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\QHsbRLf.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\bPPacTd.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1804	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
Token: SeDebugPrivilege	1804	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 616 wrote to memory of 1804	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	29
PID 616 wrote to memory of 1804	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	29
PID 616 wrote to memory of 1804	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	29
PID 616 wrote to memory of 2224	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	30
PID 616 wrote to memory of 2224	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	30
PID 616 wrote to memory of 2224	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	30
PID 616 wrote to memory of 1272	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	31
PID 616 wrote to memory of 1272	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	31
PID 616 wrote to memory of 1272	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	31
PID 616 wrote to memory of 2696	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	32
PID 616 wrote to memory of 2696	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	32
PID 616 wrote to memory of 2696	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	32
PID 616 wrote to memory of 2712	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	33
PID 616 wrote to memory of 2712	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	33
PID 616 wrote to memory of 2712	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	33
PID 616 wrote to memory of 2624	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	34
PID 616 wrote to memory of 2624	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	34
PID 616 wrote to memory of 2624	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	34
PID 616 wrote to memory of 2780	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	35
PID 616 wrote to memory of 2780	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	35
PID 616 wrote to memory of 2780	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	35
PID 616 wrote to memory of 2552	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	36
PID 616 wrote to memory of 2552	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	36
PID 616 wrote to memory of 2552	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	36
PID 616 wrote to memory of 2560	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	37
PID 616 wrote to memory of 2560	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	37
PID 616 wrote to memory of 2560	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	37
PID 616 wrote to memory of 2980	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	38
PID 616 wrote to memory of 2980	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	38
PID 616 wrote to memory of 2980	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	38
PID 616 wrote to memory of 2860	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	39
PID 616 wrote to memory of 2860	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	39
PID 616 wrote to memory of 2860	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	39
PID 616 wrote to memory of 2092	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	40
PID 616 wrote to memory of 2092	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	40
PID 616 wrote to memory of 2092	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	40
PID 616 wrote to memory of 2828	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	41
PID 616 wrote to memory of 2828	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	41
PID 616 wrote to memory of 2828	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	41
PID 616 wrote to memory of 2008	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	42
PID 616 wrote to memory of 2008	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	42
PID 616 wrote to memory of 2008	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	42
PID 616 wrote to memory of 2032	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	43
PID 616 wrote to memory of 2032	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	43
PID 616 wrote to memory of 2032	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	43
PID 616 wrote to memory of 316	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	44
PID 616 wrote to memory of 316	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	44
PID 616 wrote to memory of 316	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	44
PID 616 wrote to memory of 2564	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	45
PID 616 wrote to memory of 2564	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	45
PID 616 wrote to memory of 2564	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	45
PID 616 wrote to memory of 2756	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	46
PID 616 wrote to memory of 2756	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	46
PID 616 wrote to memory of 2756	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	46
PID 616 wrote to memory of 2832	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	47
PID 616 wrote to memory of 2832	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	47
PID 616 wrote to memory of 2832	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	47
PID 616 wrote to memory of 2868	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	48
PID 616 wrote to memory of 2868	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	48
PID 616 wrote to memory of 2868	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	48
PID 616 wrote to memory of 1736	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	49
PID 616 wrote to memory of 1736	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	49
PID 616 wrote to memory of 1736	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	49
PID 616 wrote to memory of 1612	616	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:616
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1804
- C:\Windows\System\ZEjjhMe.exe
  C:\Windows\System\ZEjjhMe.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\mtaQDYh.exe
  C:\Windows\System\mtaQDYh.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\MDehdoy.exe
  C:\Windows\System\MDehdoy.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\FcpYWMA.exe
  C:\Windows\System\FcpYWMA.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\bYGXATe.exe
  C:\Windows\System\bYGXATe.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\FUPFzUp.exe
  C:\Windows\System\FUPFzUp.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\KkdqEbN.exe
  C:\Windows\System\KkdqEbN.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\uVfczNk.exe
  C:\Windows\System\uVfczNk.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\rulkmkW.exe
  C:\Windows\System\rulkmkW.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\myQEifY.exe
  C:\Windows\System\myQEifY.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\JCLrPui.exe
  C:\Windows\System\JCLrPui.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\JtxniIi.exe
  C:\Windows\System\JtxniIi.exe
  2⤵
  PID:2828
- C:\Windows\System\WsnpJfQ.exe
  C:\Windows\System\WsnpJfQ.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\FwkxfpY.exe
  C:\Windows\System\FwkxfpY.exe
  2⤵
  PID:2032
- C:\Windows\System\EyKlLox.exe
  C:\Windows\System\EyKlLox.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\jQlXrjb.exe
  C:\Windows\System\jQlXrjb.exe
  2⤵
  PID:2564
- C:\Windows\System\lrHZOoj.exe
  C:\Windows\System\lrHZOoj.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\yYRfdou.exe
  C:\Windows\System\yYRfdou.exe
  2⤵
  PID:2832
- C:\Windows\System\mlcJcZe.exe
  C:\Windows\System\mlcJcZe.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\OLJzPdg.exe
  C:\Windows\System\OLJzPdg.exe
  2⤵
  PID:1736
- C:\Windows\System\eSxFmVI.exe
  C:\Windows\System\eSxFmVI.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\dduCsql.exe
  C:\Windows\System\dduCsql.exe
  2⤵
  PID:1664
- C:\Windows\System\cRHMBID.exe
  C:\Windows\System\cRHMBID.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\wGdfXGb.exe
  C:\Windows\System\wGdfXGb.exe
  2⤵
  PID:1520
- C:\Windows\System\vWrroFd.exe
  C:\Windows\System\vWrroFd.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\ziNwUBJ.exe
  C:\Windows\System\ziNwUBJ.exe
  2⤵
  PID:1964
- C:\Windows\System\RxEfTYT.exe
  C:\Windows\System\RxEfTYT.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\zACzdbl.exe
  C:\Windows\System\zACzdbl.exe
  2⤵
  PID:2912
- C:\Windows\System\OChJZBc.exe
  C:\Windows\System\OChJZBc.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\gEPERiP.exe
  C:\Windows\System\gEPERiP.exe
  2⤵
  PID:664
- C:\Windows\System\dTfCvpt.exe
  C:\Windows\System\dTfCvpt.exe
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Windows\System\BbZHbpj.exe
  C:\Windows\System\BbZHbpj.exe
  2⤵
  PID:1468
- C:\Windows\System\BTMKoOA.exe
  C:\Windows\System\BTMKoOA.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\CiUAPDz.exe
  C:\Windows\System\CiUAPDz.exe
  2⤵
  PID:1836
- C:\Windows\System\ctYHsgL.exe
  C:\Windows\System\ctYHsgL.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\mPCbQoH.exe
  C:\Windows\System\mPCbQoH.exe
  2⤵
  PID:1068
- C:\Windows\System\AOYDqbu.exe
  C:\Windows\System\AOYDqbu.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\jiLZJSf.exe
  C:\Windows\System\jiLZJSf.exe
  2⤵
  PID:444
- C:\Windows\System\sinVLCn.exe
  C:\Windows\System\sinVLCn.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\TNrcXRy.exe
  C:\Windows\System\TNrcXRy.exe
  2⤵
  PID:1776
- C:\Windows\System\JOCvooD.exe
  C:\Windows\System\JOCvooD.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\CpNFLmg.exe
  C:\Windows\System\CpNFLmg.exe
  2⤵
  PID:1528
- C:\Windows\System\AIqIlRx.exe
  C:\Windows\System\AIqIlRx.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\OsisTOt.exe
  C:\Windows\System\OsisTOt.exe
  2⤵
  PID:1320
- C:\Windows\System\EUwYAHs.exe
  C:\Windows\System\EUwYAHs.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\XtzLgmt.exe
  C:\Windows\System\XtzLgmt.exe
  2⤵
  PID:1908
- C:\Windows\System\xSCzMrA.exe
  C:\Windows\System\xSCzMrA.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\rrCgCgY.exe
  C:\Windows\System\rrCgCgY.exe
  2⤵
  PID:1236
- C:\Windows\System\ujMDOuQ.exe
  C:\Windows\System\ujMDOuQ.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\XJXZkof.exe
  C:\Windows\System\XJXZkof.exe
  2⤵
  PID:896
- C:\Windows\System\FMHqGqG.exe
  C:\Windows\System\FMHqGqG.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\EnfybqE.exe
  C:\Windows\System\EnfybqE.exe
  2⤵
  PID:1316
- C:\Windows\System\UdKBmIa.exe
  C:\Windows\System\UdKBmIa.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\HPiSwAC.exe
  C:\Windows\System\HPiSwAC.exe
  2⤵
  PID:3060
- C:\Windows\System\fpOptZg.exe
  C:\Windows\System\fpOptZg.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\CqoytSU.exe
  C:\Windows\System\CqoytSU.exe
  2⤵
  PID:2308
- C:\Windows\System\bbTGKhI.exe
  C:\Windows\System\bbTGKhI.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\atpEGVd.exe
  C:\Windows\System\atpEGVd.exe
  2⤵
  PID:1828
- C:\Windows\System\QcpzGLk.exe
  C:\Windows\System\QcpzGLk.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\LMqzNCX.exe
  C:\Windows\System\LMqzNCX.exe
  2⤵
  PID:2340
- C:\Windows\System\Oyyrehz.exe
  C:\Windows\System\Oyyrehz.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\fbrMENA.exe
  C:\Windows\System\fbrMENA.exe
  2⤵
  PID:2928
- C:\Windows\System\CUnPhkc.exe
  C:\Windows\System\CUnPhkc.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\mLpLAzP.exe
  C:\Windows\System\mLpLAzP.exe
  2⤵
  PID:1596
- C:\Windows\System\TovYaWl.exe
  C:\Windows\System\TovYaWl.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\JgGdFJT.exe
  C:\Windows\System\JgGdFJT.exe
  2⤵
  PID:2684
- C:\Windows\System\gnfppsj.exe
  C:\Windows\System\gnfppsj.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\tOsVRpC.exe
  C:\Windows\System\tOsVRpC.exe
  2⤵
  PID:2876
- C:\Windows\System\bopftgH.exe
  C:\Windows\System\bopftgH.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\vVTiHFs.exe
  C:\Windows\System\vVTiHFs.exe
  2⤵
  PID:2492
- C:\Windows\System\eTtPcdI.exe
  C:\Windows\System\eTtPcdI.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\GEpkehd.exe
  C:\Windows\System\GEpkehd.exe
  2⤵
  PID:2532
- C:\Windows\System\ExGfyeN.exe
  C:\Windows\System\ExGfyeN.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\tuoXKIS.exe
  C:\Windows\System\tuoXKIS.exe
  2⤵
  PID:2688
- C:\Windows\System\ybAZQEK.exe
  C:\Windows\System\ybAZQEK.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\rskfigg.exe
  C:\Windows\System\rskfigg.exe
  2⤵
  PID:1844
- C:\Windows\System\xNtFRZv.exe
  C:\Windows\System\xNtFRZv.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\gIpvSoK.exe
  C:\Windows\System\gIpvSoK.exe
  2⤵
  PID:2864
- C:\Windows\System\VShaVQC.exe
  C:\Windows\System\VShaVQC.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\UHIicHt.exe
  C:\Windows\System\UHIicHt.exe
  2⤵
  PID:1240
- C:\Windows\System\JJxgXoL.exe
  C:\Windows\System\JJxgXoL.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\NmTVLNU.exe
  C:\Windows\System\NmTVLNU.exe
  2⤵
  PID:2916
- C:\Windows\System\mivtUqr.exe
  C:\Windows\System\mivtUqr.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\GlgzhLV.exe
  C:\Windows\System\GlgzhLV.exe
  2⤵
  PID:1840
- C:\Windows\System\ukgCBVD.exe
  C:\Windows\System\ukgCBVD.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\IgZMFNZ.exe
  C:\Windows\System\IgZMFNZ.exe
  2⤵
  PID:2324
- C:\Windows\System\jTOLSdD.exe
  C:\Windows\System\jTOLSdD.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\AgHRtNw.exe
  C:\Windows\System\AgHRtNw.exe
  2⤵
  PID:1888
- C:\Windows\System\fMgIGGK.exe
  C:\Windows\System\fMgIGGK.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\ApnzAKb.exe
  C:\Windows\System\ApnzAKb.exe
  2⤵
  PID:2944
- C:\Windows\System\vCafPVT.exe
  C:\Windows\System\vCafPVT.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\ZaoVqml.exe
  C:\Windows\System\ZaoVqml.exe
  2⤵
  PID:1584
- C:\Windows\System\SdUfAuW.exe
  C:\Windows\System\SdUfAuW.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\ufPDSwj.exe
  C:\Windows\System\ufPDSwj.exe
  2⤵
  PID:1512
- C:\Windows\System\UFhIaIH.exe
  C:\Windows\System\UFhIaIH.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\mTgTzPQ.exe
  C:\Windows\System\mTgTzPQ.exe
  2⤵
  PID:2872
- C:\Windows\System\OlPHrHC.exe
  C:\Windows\System\OlPHrHC.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\cwsWSNK.exe
  C:\Windows\System\cwsWSNK.exe
  2⤵
  PID:1412
- C:\Windows\System\wjNwXDc.exe
  C:\Windows\System\wjNwXDc.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\sqPYLEN.exe
  C:\Windows\System\sqPYLEN.exe
  2⤵
  PID:2772
- C:\Windows\System\qzJjwSR.exe
  C:\Windows\System\qzJjwSR.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\LVpfhZN.exe
  C:\Windows\System\LVpfhZN.exe
  2⤵
  PID:3100
- C:\Windows\System\EkYQYtL.exe
  C:\Windows\System\EkYQYtL.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\urNqOhR.exe
  C:\Windows\System\urNqOhR.exe
  2⤵
  PID:3132
- C:\Windows\System\qmosJnI.exe
  C:\Windows\System\qmosJnI.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\qNEkpWM.exe
  C:\Windows\System\qNEkpWM.exe
  2⤵
  PID:3164
- C:\Windows\System\GLoFvwz.exe
  C:\Windows\System\GLoFvwz.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\gnGyPyx.exe
  C:\Windows\System\gnGyPyx.exe
  2⤵
  PID:3196
- C:\Windows\System\qbyqloL.exe
  C:\Windows\System\qbyqloL.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\DMortuU.exe
  C:\Windows\System\DMortuU.exe
  2⤵
  PID:3228
- C:\Windows\System\sJEwRhd.exe
  C:\Windows\System\sJEwRhd.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\ByzXCaq.exe
  C:\Windows\System\ByzXCaq.exe
  2⤵
  PID:3260
- C:\Windows\System\caZOaBv.exe
  C:\Windows\System\caZOaBv.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\uqkEKZS.exe
  C:\Windows\System\uqkEKZS.exe
  2⤵
  PID:3292
- C:\Windows\System\InSPyaZ.exe
  C:\Windows\System\InSPyaZ.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System\TSgflfo.exe
  C:\Windows\System\TSgflfo.exe
  2⤵
  PID:3324
- C:\Windows\System\xErRWMr.exe
  C:\Windows\System\xErRWMr.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\FErBAZJ.exe
  C:\Windows\System\FErBAZJ.exe
  2⤵
  PID:3356
- C:\Windows\System\ySWLUAS.exe
  C:\Windows\System\ySWLUAS.exe
  2⤵
  PID:3372
- C:\Windows\System\BrWtDmK.exe
  C:\Windows\System\BrWtDmK.exe
  2⤵
  PID:3388
- C:\Windows\System\bxYdZDf.exe
  C:\Windows\System\bxYdZDf.exe
  2⤵
  PID:3404
- C:\Windows\System\UpppEFS.exe
  C:\Windows\System\UpppEFS.exe
  2⤵
  PID:3420
- C:\Windows\System\qWIyAKq.exe
  C:\Windows\System\qWIyAKq.exe
  2⤵
  PID:3436
- C:\Windows\System\MZBYHFQ.exe
  C:\Windows\System\MZBYHFQ.exe
  2⤵
  PID:3452
- C:\Windows\System\gcgmaWp.exe
  C:\Windows\System\gcgmaWp.exe
  2⤵
  PID:3468
- C:\Windows\System\hqfaykN.exe
  C:\Windows\System\hqfaykN.exe
  2⤵
  PID:3484
- C:\Windows\System\XAzZfVN.exe
  C:\Windows\System\XAzZfVN.exe
  2⤵
  PID:3500
- C:\Windows\System\gAiWOrv.exe
  C:\Windows\System\gAiWOrv.exe
  2⤵
  PID:3516
- C:\Windows\System\RDJygJj.exe
  C:\Windows\System\RDJygJj.exe
  2⤵
  PID:3532
- C:\Windows\System\DCqUUSr.exe
  C:\Windows\System\DCqUUSr.exe
  2⤵
  PID:3548
- C:\Windows\System\TByYIIk.exe
  C:\Windows\System\TByYIIk.exe
  2⤵
  PID:3564
- C:\Windows\System\xnIrztr.exe
  C:\Windows\System\xnIrztr.exe
  2⤵
  PID:3580
- C:\Windows\System\qiMytlY.exe
  C:\Windows\System\qiMytlY.exe
  2⤵
  PID:3596
- C:\Windows\System\AdRHWmu.exe
  C:\Windows\System\AdRHWmu.exe
  2⤵
  PID:3612
- C:\Windows\System\WVyZbBG.exe
  C:\Windows\System\WVyZbBG.exe
  2⤵
  PID:3628
- C:\Windows\System\PJSfZlo.exe
  C:\Windows\System\PJSfZlo.exe
  2⤵
  PID:3644
- C:\Windows\System\tlQGxKY.exe
  C:\Windows\System\tlQGxKY.exe
  2⤵
  PID:3660
- C:\Windows\System\rTMSyuS.exe
  C:\Windows\System\rTMSyuS.exe
  2⤵
  PID:3676
- C:\Windows\System\MebhIRi.exe
  C:\Windows\System\MebhIRi.exe
  2⤵
  PID:3692
- C:\Windows\System\lCQEzpt.exe
  C:\Windows\System\lCQEzpt.exe
  2⤵
  PID:3708
- C:\Windows\System\jDeHqiW.exe
  C:\Windows\System\jDeHqiW.exe
  2⤵
  PID:3724
- C:\Windows\System\zbeJotA.exe
  C:\Windows\System\zbeJotA.exe
  2⤵
  PID:3740
- C:\Windows\System\CKZLeGO.exe
  C:\Windows\System\CKZLeGO.exe
  2⤵
  PID:3756
- C:\Windows\System\LgLQazt.exe
  C:\Windows\System\LgLQazt.exe
  2⤵
  PID:3772
- C:\Windows\System\KnZnOOW.exe
  C:\Windows\System\KnZnOOW.exe
  2⤵
  PID:3788
- C:\Windows\System\fiDidRD.exe
  C:\Windows\System\fiDidRD.exe
  2⤵
  PID:3804
- C:\Windows\System\fnWclbK.exe
  C:\Windows\System\fnWclbK.exe
  2⤵
  PID:3820
- C:\Windows\System\mGwwCfd.exe
  C:\Windows\System\mGwwCfd.exe
  2⤵
  PID:3836
- C:\Windows\System\QXDJDDH.exe
  C:\Windows\System\QXDJDDH.exe
  2⤵
  PID:3852
- C:\Windows\System\UCkbURU.exe
  C:\Windows\System\UCkbURU.exe
  2⤵
  PID:3868
- C:\Windows\System\CwTfmUD.exe
  C:\Windows\System\CwTfmUD.exe
  2⤵
  PID:3884
- C:\Windows\System\KbdazYm.exe
  C:\Windows\System\KbdazYm.exe
  2⤵
  PID:3900
- C:\Windows\System\HWpqSJG.exe
  C:\Windows\System\HWpqSJG.exe
  2⤵
  PID:3916
- C:\Windows\System\nCtwokf.exe
  C:\Windows\System\nCtwokf.exe
  2⤵
  PID:3932
- C:\Windows\System\DpviQfI.exe
  C:\Windows\System\DpviQfI.exe
  2⤵
  PID:3952
- C:\Windows\System\aXAYBCX.exe
  C:\Windows\System\aXAYBCX.exe
  2⤵
  PID:3968
- C:\Windows\System\UemzLyR.exe
  C:\Windows\System\UemzLyR.exe
  2⤵
  PID:3984
- C:\Windows\System\IpbgBti.exe
  C:\Windows\System\IpbgBti.exe
  2⤵
  PID:4000
- C:\Windows\System\rbHuTvb.exe
  C:\Windows\System\rbHuTvb.exe
  2⤵
  PID:4016
- C:\Windows\System\oRGpzNi.exe
  C:\Windows\System\oRGpzNi.exe
  2⤵
  PID:4032
- C:\Windows\System\qzjyctw.exe
  C:\Windows\System\qzjyctw.exe
  2⤵
  PID:4048
- C:\Windows\System\lNvWVuX.exe
  C:\Windows\System\lNvWVuX.exe
  2⤵
  PID:4064
- C:\Windows\System\GwwtLra.exe
  C:\Windows\System\GwwtLra.exe
  2⤵
  PID:4080
- C:\Windows\System\ShxOcrV.exe
  C:\Windows\System\ShxOcrV.exe
  2⤵
  PID:752
- C:\Windows\System\KexhHJF.exe
  C:\Windows\System\KexhHJF.exe
  2⤵
  PID:2280
- C:\Windows\System\rfdpCpX.exe
  C:\Windows\System\rfdpCpX.exe
  2⤵
  PID:1672
- C:\Windows\System\wuWtkpX.exe
  C:\Windows\System\wuWtkpX.exe
  2⤵
  PID:3096
- C:\Windows\System\KLFixRo.exe
  C:\Windows\System\KLFixRo.exe
  2⤵
  PID:3188
- C:\Windows\System\nBveFDo.exe
  C:\Windows\System\nBveFDo.exe
  2⤵
  PID:2244
- C:\Windows\System\gzRaXZK.exe
  C:\Windows\System\gzRaXZK.exe
  2⤵
  PID:3284
- C:\Windows\System\BqtEmvy.exe
  C:\Windows\System\BqtEmvy.exe
  2⤵
  PID:2456
- C:\Windows\System\StDxKoL.exe
  C:\Windows\System\StDxKoL.exe
  2⤵
  PID:3380
- C:\Windows\System\HtjCJmg.exe
  C:\Windows\System\HtjCJmg.exe
  2⤵
  PID:2920
- C:\Windows\System\iECTsbv.exe
  C:\Windows\System\iECTsbv.exe
  2⤵
  PID:3476
- C:\Windows\System\vfDFUqg.exe
  C:\Windows\System\vfDFUqg.exe
  2⤵
  PID:264
- C:\Windows\System\NDvomzU.exe
  C:\Windows\System\NDvomzU.exe
  2⤵
  PID:3544
- C:\Windows\System\CeMWwqG.exe
  C:\Windows\System\CeMWwqG.exe
  2⤵
  PID:544
- C:\Windows\System\zlQakZd.exe
  C:\Windows\System\zlQakZd.exe
  2⤵
  PID:972
- C:\Windows\System\kUAvHLA.exe
  C:\Windows\System\kUAvHLA.exe
  2⤵
  PID:3668
- C:\Windows\System\NpjgZOw.exe
  C:\Windows\System\NpjgZOw.exe
  2⤵
  PID:2332
- C:\Windows\System\gwLEzNu.exe
  C:\Windows\System\gwLEzNu.exe
  2⤵
  PID:3736
- C:\Windows\System\uIZkeUk.exe
  C:\Windows\System\uIZkeUk.exe
  2⤵
  PID:3800
- C:\Windows\System\NITlpXU.exe
  C:\Windows\System\NITlpXU.exe
  2⤵
  PID:3864
- C:\Windows\System\eFAPVlM.exe
  C:\Windows\System\eFAPVlM.exe
  2⤵
  PID:3928
- C:\Windows\System\gnSNaTB.exe
  C:\Windows\System\gnSNaTB.exe
  2⤵
  PID:3996
- C:\Windows\System\IXUyGsA.exe
  C:\Windows\System\IXUyGsA.exe
  2⤵
  PID:4060
- C:\Windows\System\QlrUqOx.exe
  C:\Windows\System\QlrUqOx.exe
  2⤵
  PID:1416
- C:\Windows\System\OuVBTuc.exe
  C:\Windows\System\OuVBTuc.exe
  2⤵
  PID:1624
- C:\Windows\System\psGjpmh.exe
  C:\Windows\System\psGjpmh.exe
  2⤵
  PID:3128
- C:\Windows\System\csQcGdy.exe
  C:\Windows\System\csQcGdy.exe
  2⤵
  PID:2896
- C:\Windows\System\owpMrIJ.exe
  C:\Windows\System\owpMrIJ.exe
  2⤵
  PID:2852
- C:\Windows\System\gGisQzP.exe
  C:\Windows\System\gGisQzP.exe
  2⤵
  PID:2700
- C:\Windows\System\cbDJonk.exe
  C:\Windows\System\cbDJonk.exe
  2⤵
  PID:4112
- C:\Windows\System\itlZHLw.exe
  C:\Windows\System\itlZHLw.exe
  2⤵
  PID:4128
- C:\Windows\System\dMdyUvX.exe
  C:\Windows\System\dMdyUvX.exe
  2⤵
  PID:4144
- C:\Windows\System\xYRyoub.exe
  C:\Windows\System\xYRyoub.exe
  2⤵
  PID:4160
- C:\Windows\System\niyrKBb.exe
  C:\Windows\System\niyrKBb.exe
  2⤵
  PID:4644
- C:\Windows\System\aivuOKc.exe
  C:\Windows\System\aivuOKc.exe
  2⤵
  PID:4676
- C:\Windows\System\aDxYTSX.exe
  C:\Windows\System\aDxYTSX.exe
  2⤵
  PID:4696
- C:\Windows\System\jsqUUhw.exe
  C:\Windows\System\jsqUUhw.exe
  2⤵
  PID:4712
- C:\Windows\System\WkoqVfF.exe
  C:\Windows\System\WkoqVfF.exe
  2⤵
  PID:4732
- C:\Windows\System\yyjPqDS.exe
  C:\Windows\System\yyjPqDS.exe
  2⤵
  PID:4748
- C:\Windows\System\RHezZug.exe
  C:\Windows\System\RHezZug.exe
  2⤵
  PID:4764
- C:\Windows\System\oQKdLjN.exe
  C:\Windows\System\oQKdLjN.exe
  2⤵
  PID:4780
- C:\Windows\System\qXLZCzv.exe
  C:\Windows\System\qXLZCzv.exe
  2⤵
  PID:4796
- C:\Windows\System\rqUHMrQ.exe
  C:\Windows\System\rqUHMrQ.exe
  2⤵
  PID:4812
- C:\Windows\System\rODdkpJ.exe
  C:\Windows\System\rODdkpJ.exe
  2⤵
  PID:4828
- C:\Windows\System\sZQBATy.exe
  C:\Windows\System\sZQBATy.exe
  2⤵
  PID:4848
- C:\Windows\System\WsKzfVg.exe
  C:\Windows\System\WsKzfVg.exe
  2⤵
  PID:4864
- C:\Windows\System\fnqdrUo.exe
  C:\Windows\System\fnqdrUo.exe
  2⤵
  PID:4880
- C:\Windows\System\jjUpNzm.exe
  C:\Windows\System\jjUpNzm.exe
  2⤵
  PID:4896
- C:\Windows\System\CfJyRck.exe
  C:\Windows\System\CfJyRck.exe
  2⤵
  PID:4912
- C:\Windows\System\toofmWc.exe
  C:\Windows\System\toofmWc.exe
  2⤵
  PID:4928
- C:\Windows\System\ApRbJDS.exe
  C:\Windows\System\ApRbJDS.exe
  2⤵
  PID:4948
- C:\Windows\System\lBdEMdp.exe
  C:\Windows\System\lBdEMdp.exe
  2⤵
  PID:4964
- C:\Windows\System\mQeJVzp.exe
  C:\Windows\System\mQeJVzp.exe
  2⤵
  PID:4980
- C:\Windows\System\QsocYJm.exe
  C:\Windows\System\QsocYJm.exe
  2⤵
  PID:4996
- C:\Windows\System\EkmwIFj.exe
  C:\Windows\System\EkmwIFj.exe
  2⤵
  PID:5012
- C:\Windows\System\RBYLwbq.exe
  C:\Windows\System\RBYLwbq.exe
  2⤵
  PID:5028
- C:\Windows\System\kIYnCQx.exe
  C:\Windows\System\kIYnCQx.exe
  2⤵
  PID:5052
- C:\Windows\System\gUryPaR.exe
  C:\Windows\System\gUryPaR.exe
  2⤵
  PID:5068
- C:\Windows\System\DDNcuSQ.exe
  C:\Windows\System\DDNcuSQ.exe
  2⤵
  PID:5084
- C:\Windows\System\mtviWln.exe
  C:\Windows\System\mtviWln.exe
  2⤵
  PID:5100
- C:\Windows\System\REgOzyC.exe
  C:\Windows\System\REgOzyC.exe
  2⤵
  PID:2188
- C:\Windows\System\qYIJMdp.exe
  C:\Windows\System\qYIJMdp.exe
  2⤵
  PID:1656
- C:\Windows\System\ramhUzU.exe
  C:\Windows\System\ramhUzU.exe
  2⤵
  PID:1916
- C:\Windows\System\KaLkLOG.exe
  C:\Windows\System\KaLkLOG.exe
  2⤵
  PID:3048
- C:\Windows\System\ZAFpryB.exe
  C:\Windows\System\ZAFpryB.exe
  2⤵
  PID:2904
- C:\Windows\System\UmtpSTr.exe
  C:\Windows\System\UmtpSTr.exe
  2⤵
  PID:872
- C:\Windows\System\alOLmwI.exe
  C:\Windows\System\alOLmwI.exe
  2⤵
  PID:1216
- C:\Windows\System\kMNetXB.exe
  C:\Windows\System\kMNetXB.exe
  2⤵
  PID:2748
- C:\Windows\System\pgVBkNp.exe
  C:\Windows\System\pgVBkNp.exe
  2⤵
  PID:2544
- C:\Windows\System\wcTkCxz.exe
  C:\Windows\System\wcTkCxz.exe
  2⤵
  PID:2472
- C:\Windows\System\pbpuJgp.exe
  C:\Windows\System\pbpuJgp.exe
  2⤵
  PID:3352
- C:\Windows\System\PMJaMuG.exe
  C:\Windows\System\PMJaMuG.exe
  2⤵
  PID:3608
- C:\Windows\System\NDhcDXN.exe
  C:\Windows\System\NDhcDXN.exe
  2⤵
  PID:3796
- C:\Windows\System\JXbgdrd.exe
  C:\Windows\System\JXbgdrd.exe
  2⤵
  PID:4056
- C:\Windows\System\mfJcIOJ.exe
  C:\Windows\System\mfJcIOJ.exe
  2⤵
  PID:2820
- C:\Windows\System\WoXgqAz.exe
  C:\Windows\System\WoXgqAz.exe
  2⤵
  PID:4124
- C:\Windows\System\oSqgSxP.exe
  C:\Windows\System\oSqgSxP.exe
  2⤵
  PID:4656
- C:\Windows\System\VFfuMoI.exe
  C:\Windows\System\VFfuMoI.exe
  2⤵
  PID:4668
- C:\Windows\System\yZjDGYu.exe
  C:\Windows\System\yZjDGYu.exe
  2⤵
  PID:532
- C:\Windows\System\LGxawDp.exe
  C:\Windows\System\LGxawDp.exe
  2⤵
  PID:2132
- C:\Windows\System\XAraSKu.exe
  C:\Windows\System\XAraSKu.exe
  2⤵
  PID:1372
- C:\Windows\System\OWOBYNO.exe
  C:\Windows\System\OWOBYNO.exe
  2⤵
  PID:2068
- C:\Windows\System\EQscKZl.exe
  C:\Windows\System\EQscKZl.exe
  2⤵
  PID:940
- C:\Windows\System\UERgopE.exe
  C:\Windows\System\UERgopE.exe
  2⤵
  PID:3108
- C:\Windows\System\lIIfbHM.exe
  C:\Windows\System\lIIfbHM.exe
  2⤵
  PID:3172
- C:\Windows\System\oRKSdoF.exe
  C:\Windows\System\oRKSdoF.exe
  2⤵
  PID:3236
- C:\Windows\System\uyKNcGc.exe
  C:\Windows\System\uyKNcGc.exe
  2⤵
  PID:3272
- C:\Windows\System\buBVxgV.exe
  C:\Windows\System\buBVxgV.exe
  2⤵
  PID:5048
- C:\Windows\System\zfSTNRH.exe
  C:\Windows\System\zfSTNRH.exe
  2⤵
  PID:5112
- C:\Windows\System\EVDwZye.exe
  C:\Windows\System\EVDwZye.exe
  2⤵
  PID:4804
- C:\Windows\System\mGezlEa.exe
  C:\Windows\System\mGezlEa.exe
  2⤵
  PID:4944
- C:\Windows\System\RDbXFgx.exe
  C:\Windows\System\RDbXFgx.exe
  2⤵
  PID:3400
- C:\Windows\System\dmFAKOF.exe
  C:\Windows\System\dmFAKOF.exe
  2⤵
  PID:3464
- C:\Windows\System\CaTwjZB.exe
  C:\Windows\System\CaTwjZB.exe
  2⤵
  PID:5080
- C:\Windows\System\odKFakO.exe
  C:\Windows\System\odKFakO.exe
  2⤵
  PID:3524
- C:\Windows\System\UlwGYqv.exe
  C:\Windows\System\UlwGYqv.exe
  2⤵
  PID:3592
- C:\Windows\System\VMPhmtX.exe
  C:\Windows\System\VMPhmtX.exe
  2⤵
  PID:3684
- C:\Windows\System\mfzPjBc.exe
  C:\Windows\System\mfzPjBc.exe
  2⤵
  PID:3748
- C:\Windows\System\AqmVBzQ.exe
  C:\Windows\System\AqmVBzQ.exe
  2⤵
  PID:3812
- C:\Windows\System\OpBDWBL.exe
  C:\Windows\System\OpBDWBL.exe
  2⤵
  PID:3880
- C:\Windows\System\hsJgUVd.exe
  C:\Windows\System\hsJgUVd.exe
  2⤵
  PID:3944
- C:\Windows\System\UaJrcFV.exe
  C:\Windows\System\UaJrcFV.exe
  2⤵
  PID:2260
- C:\Windows\System\ESwLvor.exe
  C:\Windows\System\ESwLvor.exe
  2⤵
  PID:4040
- C:\Windows\System\IRPNhTG.exe
  C:\Windows\System\IRPNhTG.exe
  2⤵
  PID:2720
- C:\Windows\System\WasvZrQ.exe
  C:\Windows\System\WasvZrQ.exe
  2⤵
  PID:2848
- C:\Windows\System\odSRjwN.exe
  C:\Windows\System\odSRjwN.exe
  2⤵
  PID:788
- C:\Windows\System\iRjyWHY.exe
  C:\Windows\System\iRjyWHY.exe
  2⤵
  PID:1580
- C:\Windows\System\ABicdOX.exe
  C:\Windows\System\ABicdOX.exe
  2⤵
  PID:1504
- C:\Windows\System\kZBgaSs.exe
  C:\Windows\System\kZBgaSs.exe
  2⤵
  PID:476
- C:\Windows\System\bpwHaPx.exe
  C:\Windows\System\bpwHaPx.exe
  2⤵
  PID:1968
- C:\Windows\System\iSdjJgt.exe
  C:\Windows\System\iSdjJgt.exe
  2⤵
  PID:2956
- C:\Windows\System\tgZtyGX.exe
  C:\Windows\System\tgZtyGX.exe
  2⤵
  PID:1676
- C:\Windows\System\TroUdPy.exe
  C:\Windows\System\TroUdPy.exe
  2⤵
  PID:4156
- C:\Windows\System\THVEBgr.exe
  C:\Windows\System\THVEBgr.exe
  2⤵
  PID:2816
- C:\Windows\System\YXDflqn.exe
  C:\Windows\System\YXDflqn.exe
  2⤵
  PID:1072
- C:\Windows\System\hRYGQrz.exe
  C:\Windows\System\hRYGQrz.exe
  2⤵
  PID:3268
- C:\Windows\System\seKqLpu.exe
  C:\Windows\System\seKqLpu.exe
  2⤵
  PID:2536
- C:\Windows\System\EWQXwHA.exe
  C:\Windows\System\EWQXwHA.exe
  2⤵
  PID:2064
- C:\Windows\System\XUlSNxR.exe
  C:\Windows\System\XUlSNxR.exe
  2⤵
  PID:2096
- C:\Windows\System\VaPHtAZ.exe
  C:\Windows\System\VaPHtAZ.exe
  2⤵
  PID:2012
- C:\Windows\System\FYaDxwS.exe
  C:\Windows\System\FYaDxwS.exe
  2⤵
  PID:3220
- C:\Windows\System\OZAcSim.exe
  C:\Windows\System\OZAcSim.exe
  2⤵
  PID:2908
- C:\Windows\System\tFHOCSu.exe
  C:\Windows\System\tFHOCSu.exe
  2⤵
  PID:3576
- C:\Windows\System\JuAJPYa.exe
  C:\Windows\System\JuAJPYa.exe
  2⤵
  PID:3732
- C:\Windows\System\MhYKXba.exe
  C:\Windows\System\MhYKXba.exe
  2⤵
  PID:3992
- C:\Windows\System\zsLUyzZ.exe
  C:\Windows\System\zsLUyzZ.exe
  2⤵
  PID:2984
- C:\Windows\System\sODKDnP.exe
  C:\Windows\System\sODKDnP.exe
  2⤵
  PID:4108
- C:\Windows\System\lpAZTdG.exe
  C:\Windows\System\lpAZTdG.exe
  2⤵
  PID:4172
- C:\Windows\System\DKKBwUI.exe
  C:\Windows\System\DKKBwUI.exe
  2⤵
  PID:4188
- C:\Windows\System\oQHERBy.exe
  C:\Windows\System\oQHERBy.exe
  2⤵
  PID:4208
- C:\Windows\System\aLAakXA.exe
  C:\Windows\System\aLAakXA.exe
  2⤵
  PID:4228
- C:\Windows\System\lVNYFzD.exe
  C:\Windows\System\lVNYFzD.exe
  2⤵
  PID:4248
- C:\Windows\System\aDQCfcG.exe
  C:\Windows\System\aDQCfcG.exe
  2⤵
  PID:4264
- C:\Windows\System\JWwXSgJ.exe
  C:\Windows\System\JWwXSgJ.exe
  2⤵
  PID:4280
- C:\Windows\System\oYxFfeJ.exe
  C:\Windows\System\oYxFfeJ.exe
  2⤵
  PID:4296
- C:\Windows\System\vLwLjJw.exe
  C:\Windows\System\vLwLjJw.exe
  2⤵
  PID:4312
- C:\Windows\System\kcQJKAu.exe
  C:\Windows\System\kcQJKAu.exe
  2⤵
  PID:4328
- C:\Windows\System\WAuOqrc.exe
  C:\Windows\System\WAuOqrc.exe
  2⤵
  PID:4344
- C:\Windows\System\ZZJOTXz.exe
  C:\Windows\System\ZZJOTXz.exe
  2⤵
  PID:4368
- C:\Windows\System\VZsHhDV.exe
  C:\Windows\System\VZsHhDV.exe
  2⤵
  PID:4384
- C:\Windows\System\UqZieCU.exe
  C:\Windows\System\UqZieCU.exe
  2⤵
  PID:4400
- C:\Windows\System\zzYrWIw.exe
  C:\Windows\System\zzYrWIw.exe
  2⤵
  PID:4416
- C:\Windows\System\DzFKUDQ.exe
  C:\Windows\System\DzFKUDQ.exe
  2⤵
  PID:4436
- C:\Windows\System\EmmDRyC.exe
  C:\Windows\System\EmmDRyC.exe
  2⤵
  PID:4468
- C:\Windows\System\VGQciQo.exe
  C:\Windows\System\VGQciQo.exe
  2⤵
  PID:3368
- C:\Windows\System\mZsppZz.exe
  C:\Windows\System\mZsppZz.exe
  2⤵
  PID:4492
- C:\Windows\System\uYhIFDm.exe
  C:\Windows\System\uYhIFDm.exe
  2⤵
  PID:3432
- C:\Windows\System\rxBkdgz.exe
  C:\Windows\System\rxBkdgz.exe
  2⤵
  PID:4532
- C:\Windows\System\nCMKKdB.exe
  C:\Windows\System\nCMKKdB.exe
  2⤵
  PID:4548
- C:\Windows\System\MHyHeLd.exe
  C:\Windows\System\MHyHeLd.exe
  2⤵
  PID:3492
- C:\Windows\System\WuLjmVI.exe
  C:\Windows\System\WuLjmVI.exe
  2⤵
  PID:3780
- C:\Windows\System\MlikcHL.exe
  C:\Windows\System\MlikcHL.exe
  2⤵
  PID:5108
- C:\Windows\System\ZIExKFG.exe
  C:\Windows\System\ZIExKFG.exe
  2⤵
  PID:2160
- C:\Windows\System\ioLLkOz.exe
  C:\Windows\System\ioLLkOz.exe
  2⤵
  PID:2752
- C:\Windows\System\VvRTlAN.exe
  C:\Windows\System\VvRTlAN.exe
  2⤵
  PID:1668
- C:\Windows\System\qaOQlaX.exe
  C:\Windows\System\qaOQlaX.exe
  2⤵
  PID:4568
- C:\Windows\System\RAvrZtI.exe
  C:\Windows\System\RAvrZtI.exe
  2⤵
  PID:4584
- C:\Windows\System\dYcsgWU.exe
  C:\Windows\System\dYcsgWU.exe
  2⤵
  PID:4600
- C:\Windows\System\PLTYhsm.exe
  C:\Windows\System\PLTYhsm.exe
  2⤵
  PID:4620
- C:\Windows\System\VThxspw.exe
  C:\Windows\System\VThxspw.exe
  2⤵
  PID:4684
- C:\Windows\System\aIaBGJu.exe
  C:\Windows\System\aIaBGJu.exe
  2⤵
  PID:4792
- C:\Windows\System\IqbNIBF.exe
  C:\Windows\System\IqbNIBF.exe
  2⤵
  PID:492
- C:\Windows\System\SJTcKZo.exe
  C:\Windows\System\SJTcKZo.exe
  2⤵
  PID:2212
- C:\Windows\System\fiuniRa.exe
  C:\Windows\System\fiuniRa.exe
  2⤵
  PID:3448
- C:\Windows\System\pGULrQQ.exe
  C:\Windows\System\pGULrQQ.exe
  2⤵
  PID:4120
- C:\Windows\System\FJigEOh.exe
  C:\Windows\System\FJigEOh.exe
  2⤵
  PID:3204
- C:\Windows\System\QxyhzIS.exe
  C:\Windows\System\QxyhzIS.exe
  2⤵
  PID:5044
- C:\Windows\System\ZxMoKja.exe
  C:\Windows\System\ZxMoKja.exe
  2⤵
  PID:3716
- C:\Windows\System\hLUllBe.exe
  C:\Windows\System\hLUllBe.exe
  2⤵
  PID:640
- C:\Windows\System\YIBPPxg.exe
  C:\Windows\System\YIBPPxg.exe
  2⤵
  PID:556
- C:\Windows\System\CjUCaFq.exe
  C:\Windows\System\CjUCaFq.exe
  2⤵
  PID:2628
- C:\Windows\System\twZTvIM.exe
  C:\Windows\System\twZTvIM.exe
  2⤵
  PID:4224
- C:\Windows\System\xeRaQBr.exe
  C:\Windows\System\xeRaQBr.exe
  2⤵
  PID:4044
- C:\Windows\System\HpjMjpF.exe
  C:\Windows\System\HpjMjpF.exe
  2⤵
  PID:2764
- C:\Windows\System\GrXLvLI.exe
  C:\Windows\System\GrXLvLI.exe
  2⤵
  PID:4756
- C:\Windows\System\MDpkTSB.exe
  C:\Windows\System\MDpkTSB.exe
  2⤵
  PID:4240
- C:\Windows\System\fXnHYgc.exe
  C:\Windows\System\fXnHYgc.exe
  2⤵
  PID:4340
- C:\Windows\System\UPBfoNy.exe
  C:\Windows\System\UPBfoNy.exe
  2⤵
  PID:4412
- C:\Windows\System\YwmDuzX.exe
  C:\Windows\System\YwmDuzX.exe
  2⤵
  PID:2644
- C:\Windows\System\wesUizI.exe
  C:\Windows\System\wesUizI.exe
  2⤵
  PID:1052
- C:\Windows\System\RXJHmvb.exe
  C:\Windows\System\RXJHmvb.exe
  2⤵
  PID:4636
- C:\Windows\System\gXRuWXR.exe
  C:\Windows\System\gXRuWXR.exe
  2⤵
  PID:4956
- C:\Windows\System\gpgDFdY.exe
  C:\Windows\System\gpgDFdY.exe
  2⤵
  PID:1892
- C:\Windows\System\YhyeWMl.exe
  C:\Windows\System\YhyeWMl.exe
  2⤵
  PID:2668
- C:\Windows\System\LpxMPhi.exe
  C:\Windows\System\LpxMPhi.exe
  2⤵
  PID:3948
- C:\Windows\System\fOvwOdp.exe
  C:\Windows\System\fOvwOdp.exe
  2⤵
  PID:1552
- C:\Windows\System\QqDQnfu.exe
  C:\Windows\System\QqDQnfu.exe
  2⤵
  PID:2468
- C:\Windows\System\QjGmihw.exe
  C:\Windows\System\QjGmihw.exe
  2⤵
  PID:1984
- C:\Windows\System\ZoYsjQT.exe
  C:\Windows\System\ZoYsjQT.exe
  2⤵
  PID:2844
- C:\Windows\System\QdOFtGI.exe
  C:\Windows\System\QdOFtGI.exe
  2⤵
  PID:5008
- C:\Windows\System\rrrOqnv.exe
  C:\Windows\System\rrrOqnv.exe
  2⤵
  PID:3560
- C:\Windows\System\ZXptTLP.exe
  C:\Windows\System\ZXptTLP.exe
  2⤵
  PID:2676
- C:\Windows\System\lEAFErD.exe
  C:\Windows\System\lEAFErD.exe
  2⤵
  PID:4180
- C:\Windows\System\eElysqF.exe
  C:\Windows\System\eElysqF.exe
  2⤵
  PID:2312
- C:\Windows\System\WxzCAtn.exe
  C:\Windows\System\WxzCAtn.exe
  2⤵
  PID:4260
- C:\Windows\System\JPamrsg.exe
  C:\Windows\System\JPamrsg.exe
  2⤵
  PID:4324
- C:\Windows\System\RkZevPh.exe
  C:\Windows\System\RkZevPh.exe
  2⤵
  PID:4360
- C:\Windows\System\XVrjMNG.exe
  C:\Windows\System\XVrjMNG.exe
  2⤵
  PID:4396
- C:\Windows\System\RTHDSEm.exe
  C:\Windows\System\RTHDSEm.exe
  2⤵
  PID:1096
- C:\Windows\System\BkHOCvS.exe
  C:\Windows\System\BkHOCvS.exe
  2⤵
  PID:2508
- C:\Windows\System\WGMBPGR.exe
  C:\Windows\System\WGMBPGR.exe
  2⤵
  PID:3144
- C:\Windows\System\lSwKDcD.exe
  C:\Windows\System\lSwKDcD.exe
  2⤵
  PID:4424
- C:\Windows\System\JzmwAJb.exe
  C:\Windows\System\JzmwAJb.exe
  2⤵
  PID:4480
- C:\Windows\System\wmiOfcN.exe
  C:\Windows\System\wmiOfcN.exe
  2⤵
  PID:3624
- C:\Windows\System\DQejSum.exe
  C:\Windows\System\DQejSum.exe
  2⤵
  PID:4720
- C:\Windows\System\iyxUCGM.exe
  C:\Windows\System\iyxUCGM.exe
  2⤵
  PID:4576
- C:\Windows\System\OGmMCiL.exe
  C:\Windows\System\OGmMCiL.exe
  2⤵
  PID:2964
- C:\Windows\System\TEpPGOF.exe
  C:\Windows\System\TEpPGOF.exe
  2⤵
  PID:4200
- C:\Windows\System\ksKrYvh.exe
  C:\Windows\System\ksKrYvh.exe
  2⤵
  PID:4336
- C:\Windows\System\bCmvWxZ.exe
  C:\Windows\System\bCmvWxZ.exe
  2⤵
  PID:4236
- C:\Windows\System\oLydtXq.exe
  C:\Windows\System\oLydtXq.exe
  2⤵
  PID:4824
- C:\Windows\System\XQepYcq.exe
  C:\Windows\System\XQepYcq.exe
  2⤵
  PID:4524
- C:\Windows\System\KBGUAfr.exe
  C:\Windows\System\KBGUAfr.exe
  2⤵
  PID:4408
- C:\Windows\System\JfMFlzw.exe
  C:\Windows\System\JfMFlzw.exe
  2⤵
  PID:4560
- C:\Windows\System\RVQPxjp.exe
  C:\Windows\System\RVQPxjp.exe
  2⤵
  PID:4628
- C:\Windows\System\AZmWvAu.exe
  C:\Windows\System\AZmWvAu.exe
  2⤵
  PID:5024
- C:\Windows\System\PgkEYnf.exe
  C:\Windows\System\PgkEYnf.exe
  2⤵
  PID:4988
- C:\Windows\System\ZomkANq.exe
  C:\Windows\System\ZomkANq.exe
  2⤵
  PID:1980
- C:\Windows\System\YUizEGv.exe
  C:\Windows\System\YUizEGv.exe
  2⤵
  PID:4212
- C:\Windows\System\PtnUvSF.exe
  C:\Windows\System\PtnUvSF.exe
  2⤵
  PID:268
- C:\Windows\System\fcEpLww.exe
  C:\Windows\System\fcEpLww.exe
  2⤵
  PID:768
- C:\Windows\System\sOCtPUv.exe
  C:\Windows\System\sOCtPUv.exe
  2⤵
  PID:4872
- C:\Windows\System\ZTbhsIi.exe
  C:\Windows\System\ZTbhsIi.exe
  2⤵
  PID:4708
- C:\Windows\System\hLlyQLe.exe
  C:\Windows\System\hLlyQLe.exe
  2⤵
  PID:1764
- C:\Windows\System\WcmddPj.exe
  C:\Windows\System\WcmddPj.exe
  2⤵
  PID:3316
- C:\Windows\System\vDefRFX.exe
  C:\Windows\System\vDefRFX.exe
  2⤵
  PID:4660
- C:\Windows\System\wNJcdOn.exe
  C:\Windows\System\wNJcdOn.exe
  2⤵
  PID:2016
- C:\Windows\System\THAURXk.exe
  C:\Windows\System\THAURXk.exe
  2⤵
  PID:2856
- C:\Windows\System\TtVgbfL.exe
  C:\Windows\System\TtVgbfL.exe
  2⤵
  PID:2812
- C:\Windows\System\XChqXAs.exe
  C:\Windows\System\XChqXAs.exe
  2⤵
  PID:3092
- C:\Windows\System\ScCKHQy.exe
  C:\Windows\System\ScCKHQy.exe
  2⤵
  PID:4008
- C:\Windows\System\sjIzzzP.exe
  C:\Windows\System\sjIzzzP.exe
  2⤵
  PID:2732
- C:\Windows\System\UEBZvcX.exe
  C:\Windows\System\UEBZvcX.exe
  2⤵
  PID:1572
- C:\Windows\System\xZHNwNh.exe
  C:\Windows\System\xZHNwNh.exe
  2⤵
  PID:3240
- C:\Windows\System\OtCTgko.exe
  C:\Windows\System\OtCTgko.exe
  2⤵
  PID:4544
- C:\Windows\System\eziTQot.exe
  C:\Windows\System\eziTQot.exe
  2⤵
  PID:4196
- C:\Windows\System\BxgGfvP.exe
  C:\Windows\System\BxgGfvP.exe
  2⤵
  PID:4516
- C:\Windows\System\oZfmvyF.exe
  C:\Windows\System\oZfmvyF.exe
  2⤵
  PID:4992
- C:\Windows\System\IJPOhtn.exe
  C:\Windows\System\IJPOhtn.exe
  2⤵
  PID:1048
- C:\Windows\System\iModZxd.exe
  C:\Windows\System\iModZxd.exe
  2⤵
  PID:328
- C:\Windows\System\wLEGhKM.exe
  C:\Windows\System\wLEGhKM.exe
  2⤵
  PID:576
- C:\Windows\System\fhvtTPv.exe
  C:\Windows\System\fhvtTPv.exe
  2⤵
  PID:3508
- C:\Windows\System\MtaRuyP.exe
  C:\Windows\System\MtaRuyP.exe
  2⤵
  PID:3320
- C:\Windows\System\sdyuTog.exe
  C:\Windows\System\sdyuTog.exe
  2⤵
  PID:1744
- C:\Windows\System\LUvSkhS.exe
  C:\Windows\System\LUvSkhS.exe
  2⤵
  PID:2004
- C:\Windows\System\hoXuHAO.exe
  C:\Windows\System\hoXuHAO.exe
  2⤵
  PID:4612
- C:\Windows\System\kteXOBk.exe
  C:\Windows\System\kteXOBk.exe
  2⤵
  PID:4488
- C:\Windows\System\ECwLLke.exe
  C:\Windows\System\ECwLLke.exe
  2⤵
  PID:4596
- C:\Windows\System\xkNhyQt.exe
  C:\Windows\System\xkNhyQt.exe
  2⤵
  PID:4924
- C:\Windows\System\JSCDuAQ.exe
  C:\Windows\System\JSCDuAQ.exe
  2⤵
  PID:2192
- C:\Windows\System\zvoWDta.exe
  C:\Windows\System\zvoWDta.exe
  2⤵
  PID:4840
- C:\Windows\System\Hjxfgjh.exe
  C:\Windows\System\Hjxfgjh.exe
  2⤵
  PID:4320
- C:\Windows\System\gMrWcse.exe
  C:\Windows\System\gMrWcse.exe
  2⤵
  PID:4140
- C:\Windows\System\JBrRfTS.exe
  C:\Windows\System\JBrRfTS.exe
  2⤵
  PID:624
- C:\Windows\System\YlvJhmv.exe
  C:\Windows\System\YlvJhmv.exe
  2⤵
  PID:2460
- C:\Windows\System\cyVoTxC.exe
  C:\Windows\System\cyVoTxC.exe
  2⤵
  PID:1296
- C:\Windows\System\ItzhxwY.exe
  C:\Windows\System\ItzhxwY.exe
  2⤵
  PID:1620
- C:\Windows\System\uphHjEy.exe
  C:\Windows\System\uphHjEy.exe
  2⤵
  PID:3300
- C:\Windows\System\GScfOIa.exe
  C:\Windows\System\GScfOIa.exe
  2⤵
  PID:4392
- C:\Windows\System\CLNVSDj.exe
  C:\Windows\System\CLNVSDj.exe
  2⤵
  PID:5064
- C:\Windows\System\yyOVbOF.exe
  C:\Windows\System\yyOVbOF.exe
  2⤵
  PID:1616
- C:\Windows\System\EiSDkcm.exe
  C:\Windows\System\EiSDkcm.exe
  2⤵
  PID:4876
- C:\Windows\System\jchjoON.exe
  C:\Windows\System\jchjoON.exe
  2⤵
  PID:3860
- C:\Windows\System\VyQEJwx.exe
  C:\Windows\System\VyQEJwx.exe
  2⤵
  PID:4304
- C:\Windows\System\dWVHifI.exe
  C:\Windows\System\dWVHifI.exe
  2⤵
  PID:4592
- C:\Windows\System\uqtIgIQ.exe
  C:\Windows\System\uqtIgIQ.exe
  2⤵
  PID:4428
- C:\Windows\System\pJwHkxS.exe
  C:\Windows\System\pJwHkxS.exe
  2⤵
  PID:4432
- C:\Windows\System\oyxWjzF.exe
  C:\Windows\System\oyxWjzF.exe
  2⤵
  PID:3024
- C:\Windows\System\HYnHnHB.exe
  C:\Windows\System\HYnHnHB.exe
  2⤵
  PID:5136
- C:\Windows\System\RkoSxZH.exe
  C:\Windows\System\RkoSxZH.exe
  2⤵
  PID:5152
- C:\Windows\System\YPrswBb.exe
  C:\Windows\System\YPrswBb.exe
  2⤵
  PID:5168
- C:\Windows\System\EngtTMR.exe
  C:\Windows\System\EngtTMR.exe
  2⤵
  PID:5184
- C:\Windows\System\nNVfMlV.exe
  C:\Windows\System\nNVfMlV.exe
  2⤵
  PID:5200
- C:\Windows\System\LZegPoQ.exe
  C:\Windows\System\LZegPoQ.exe
  2⤵
  PID:5216
- C:\Windows\System\WCJbUEt.exe
  C:\Windows\System\WCJbUEt.exe
  2⤵
  PID:5232
- C:\Windows\System\PsQqSbH.exe
  C:\Windows\System\PsQqSbH.exe
  2⤵
  PID:5252
- C:\Windows\System\MlIIXlj.exe
  C:\Windows\System\MlIIXlj.exe
  2⤵
  PID:5268
- C:\Windows\System\BsjfnSW.exe
  C:\Windows\System\BsjfnSW.exe
  2⤵
  PID:5284
- C:\Windows\System\JVvqsdQ.exe
  C:\Windows\System\JVvqsdQ.exe
  2⤵
  PID:5300
- C:\Windows\System\ZyaGyit.exe
  C:\Windows\System\ZyaGyit.exe
  2⤵
  PID:5316
- C:\Windows\System\tPNIJvI.exe
  C:\Windows\System\tPNIJvI.exe
  2⤵
  PID:5332
- C:\Windows\System\WCcgUcP.exe
  C:\Windows\System\WCcgUcP.exe
  2⤵
  PID:5352
- C:\Windows\System\jtDwEtw.exe
  C:\Windows\System\jtDwEtw.exe
  2⤵
  PID:5368
- C:\Windows\System\VvNWgbm.exe
  C:\Windows\System\VvNWgbm.exe
  2⤵
  PID:5384
- C:\Windows\System\LVVGZip.exe
  C:\Windows\System\LVVGZip.exe
  2⤵
  PID:5400
- C:\Windows\System\WIBCsXJ.exe
  C:\Windows\System\WIBCsXJ.exe
  2⤵
  PID:5416
- C:\Windows\System\BNDtUbT.exe
  C:\Windows\System\BNDtUbT.exe
  2⤵
  PID:5432
- C:\Windows\System\aJlCEth.exe
  C:\Windows\System\aJlCEth.exe
  2⤵
  PID:5448
- C:\Windows\System\DjISWSk.exe
  C:\Windows\System\DjISWSk.exe
  2⤵
  PID:5464
- C:\Windows\System\ENwGmQn.exe
  C:\Windows\System\ENwGmQn.exe
  2⤵
  PID:5480
- C:\Windows\System\ajYNecs.exe
  C:\Windows\System\ajYNecs.exe
  2⤵
  PID:5496
- C:\Windows\System\MjjNKbq.exe
  C:\Windows\System\MjjNKbq.exe
  2⤵
  PID:5512
- C:\Windows\System\zytUaZY.exe
  C:\Windows\System\zytUaZY.exe
  2⤵
  PID:5528
- C:\Windows\System\wEFhcva.exe
  C:\Windows\System\wEFhcva.exe
  2⤵
  PID:5544
- C:\Windows\System\iqtqYDz.exe
  C:\Windows\System\iqtqYDz.exe
  2⤵
  PID:5560
- C:\Windows\System\xGbEgbd.exe
  C:\Windows\System\xGbEgbd.exe
  2⤵
  PID:5576
- C:\Windows\System\PYaMzpA.exe
  C:\Windows\System\PYaMzpA.exe
  2⤵
  PID:5592
- C:\Windows\System\BwoUJMy.exe
  C:\Windows\System\BwoUJMy.exe
  2⤵
  PID:5608
- C:\Windows\System\avAcsNt.exe
  C:\Windows\System\avAcsNt.exe
  2⤵
  PID:5624
- C:\Windows\System\MZsIHuM.exe
  C:\Windows\System\MZsIHuM.exe
  2⤵
  PID:5640
- C:\Windows\System\GRmZJJN.exe
  C:\Windows\System\GRmZJJN.exe
  2⤵
  PID:5656
- C:\Windows\System\hBFUcIf.exe
  C:\Windows\System\hBFUcIf.exe
  2⤵
  PID:5672
- C:\Windows\System\FZDoYsE.exe
  C:\Windows\System\FZDoYsE.exe
  2⤵
  PID:5688
- C:\Windows\System\zGydeIJ.exe
  C:\Windows\System\zGydeIJ.exe
  2⤵
  PID:5704
- C:\Windows\System\hiampmE.exe
  C:\Windows\System\hiampmE.exe
  2⤵
  PID:5720
- C:\Windows\System\UABZiMp.exe
  C:\Windows\System\UABZiMp.exe
  2⤵
  PID:5736
- C:\Windows\System\MWHbcyt.exe
  C:\Windows\System\MWHbcyt.exe
  2⤵
  PID:5752
- C:\Windows\System\PVQuBjr.exe
  C:\Windows\System\PVQuBjr.exe
  2⤵
  PID:5768
- C:\Windows\System\AIIDPKm.exe
  C:\Windows\System\AIIDPKm.exe
  2⤵
  PID:5784
- C:\Windows\System\GYOnVHB.exe
  C:\Windows\System\GYOnVHB.exe
  2⤵
  PID:5800
- C:\Windows\System\RhHluZl.exe
  C:\Windows\System\RhHluZl.exe
  2⤵
  PID:5816
- C:\Windows\System\DxRnAfc.exe
  C:\Windows\System\DxRnAfc.exe
  2⤵
  PID:5832
- C:\Windows\System\fMGfUQc.exe
  C:\Windows\System\fMGfUQc.exe
  2⤵
  PID:5848
- C:\Windows\System\FLfpevV.exe
  C:\Windows\System\FLfpevV.exe
  2⤵
  PID:5864
- C:\Windows\System\SzualaB.exe
  C:\Windows\System\SzualaB.exe
  2⤵
  PID:5880
- C:\Windows\System\fbptvLe.exe
  C:\Windows\System\fbptvLe.exe
  2⤵
  PID:5900
- C:\Windows\System\RWlNIIG.exe
  C:\Windows\System\RWlNIIG.exe
  2⤵
  PID:5916
- C:\Windows\System\VMAjHhv.exe
  C:\Windows\System\VMAjHhv.exe
  2⤵
  PID:5932
- C:\Windows\System\XGimVNl.exe
  C:\Windows\System\XGimVNl.exe
  2⤵
  PID:5948
- C:\Windows\System\gaohbzu.exe
  C:\Windows\System\gaohbzu.exe
  2⤵
  PID:5964
- C:\Windows\System\jKHCZKY.exe
  C:\Windows\System\jKHCZKY.exe
  2⤵
  PID:5980
- C:\Windows\System\ZkVqWwQ.exe
  C:\Windows\System\ZkVqWwQ.exe
  2⤵
  PID:5996
- C:\Windows\System\HyRUahn.exe
  C:\Windows\System\HyRUahn.exe
  2⤵
  PID:6012
- C:\Windows\System\evJcoXO.exe
  C:\Windows\System\evJcoXO.exe
  2⤵
  PID:6032
- C:\Windows\System\VquGSAS.exe
  C:\Windows\System\VquGSAS.exe
  2⤵
  PID:6048
- C:\Windows\System\ukHwqky.exe
  C:\Windows\System\ukHwqky.exe
  2⤵
  PID:6064
- C:\Windows\System\dCmuPbk.exe
  C:\Windows\System\dCmuPbk.exe
  2⤵
  PID:6080
- C:\Windows\System\rGVAAeS.exe
  C:\Windows\System\rGVAAeS.exe
  2⤵
  PID:6096
- C:\Windows\System\UvshbcO.exe
  C:\Windows\System\UvshbcO.exe
  2⤵
  PID:6116
- C:\Windows\System\pruthLK.exe
  C:\Windows\System\pruthLK.exe
  2⤵
  PID:6132
- C:\Windows\System\JyDONXh.exe
  C:\Windows\System\JyDONXh.exe
  2⤵
  PID:4608
- C:\Windows\System\vCCDRYF.exe
  C:\Windows\System\vCCDRYF.exe
  2⤵
  PID:5240
- C:\Windows\System\eJSdzyl.exe
  C:\Windows\System\eJSdzyl.exe
  2⤵
  PID:5280
- C:\Windows\System\kpgZJSx.exe
  C:\Windows\System\kpgZJSx.exe
  2⤵
  PID:5340
- C:\Windows\System\bqGLLDV.exe
  C:\Windows\System\bqGLLDV.exe
  2⤵
  PID:2640
- C:\Windows\System\TQeSYvy.exe
  C:\Windows\System\TQeSYvy.exe
  2⤵
  PID:4484
- C:\Windows\System\aiecfvB.exe
  C:\Windows\System\aiecfvB.exe
  2⤵
  PID:4512
- C:\Windows\System\JpCUkWg.exe
  C:\Windows\System\JpCUkWg.exe
  2⤵
  PID:5160
- C:\Windows\System\FVJdBrv.exe
  C:\Windows\System\FVJdBrv.exe
  2⤵
  PID:5224
- C:\Windows\System\qrHHVjg.exe
  C:\Windows\System\qrHHVjg.exe
  2⤵
  PID:5296
- C:\Windows\System\UDNfqGX.exe
  C:\Windows\System\UDNfqGX.exe
  2⤵
  PID:5408
- C:\Windows\System\qwqmKRX.exe
  C:\Windows\System\qwqmKRX.exe
  2⤵
  PID:5364
- C:\Windows\System\guSYueU.exe
  C:\Windows\System\guSYueU.exe
  2⤵
  PID:5508
- C:\Windows\System\dCkhZza.exe
  C:\Windows\System\dCkhZza.exe
  2⤵
  PID:5572
- C:\Windows\System\vmiEIsg.exe
  C:\Windows\System\vmiEIsg.exe
  2⤵
  PID:5636
- C:\Windows\System\KKJvMak.exe
  C:\Windows\System\KKJvMak.exe
  2⤵
  PID:5488
- C:\Windows\System\CJmSvmY.exe
  C:\Windows\System\CJmSvmY.exe
  2⤵
  PID:5396
- C:\Windows\System\qFDQyWa.exe
  C:\Windows\System\qFDQyWa.exe
  2⤵
  PID:5524
- C:\Windows\System\mPUIMzT.exe
  C:\Windows\System\mPUIMzT.exe
  2⤵
  PID:5616
- C:\Windows\System\xlhEjEp.exe
  C:\Windows\System\xlhEjEp.exe
  2⤵
  PID:5668
- C:\Windows\System\UMRwXGK.exe
  C:\Windows\System\UMRwXGK.exe
  2⤵
  PID:5732
- C:\Windows\System\iobddqh.exe
  C:\Windows\System\iobddqh.exe
  2⤵
  PID:5712
- C:\Windows\System\gSvXknE.exe
  C:\Windows\System\gSvXknE.exe
  2⤵
  PID:5748
- C:\Windows\System\YwNZvSL.exe
  C:\Windows\System\YwNZvSL.exe
  2⤵
  PID:5828
- C:\Windows\System\oSUWiDd.exe
  C:\Windows\System\oSUWiDd.exe
  2⤵
  PID:5892
- C:\Windows\System\BnjnFEO.exe
  C:\Windows\System\BnjnFEO.exe
  2⤵
  PID:5960
- C:\Windows\System\NdpeeTN.exe
  C:\Windows\System\NdpeeTN.exe
  2⤵
  PID:6024
- C:\Windows\System\GNOoXkb.exe
  C:\Windows\System\GNOoXkb.exe
  2⤵
  PID:6088
- C:\Windows\System\INTcxKd.exe
  C:\Windows\System\INTcxKd.exe
  2⤵
  PID:5148
- C:\Windows\System\MiuIVyo.exe
  C:\Windows\System\MiuIVyo.exe
  2⤵
  PID:5840
- C:\Windows\System\ChxVZso.exe
  C:\Windows\System\ChxVZso.exe
  2⤵
  PID:5940
- C:\Windows\System\gQsTmoN.exe
  C:\Windows\System\gQsTmoN.exe
  2⤵
  PID:5876
- C:\Windows\System\yEgmOYd.exe
  C:\Windows\System\yEgmOYd.exe
  2⤵
  PID:5944
- C:\Windows\System\lXTlAZf.exe
  C:\Windows\System\lXTlAZf.exe
  2⤵
  PID:6040
- C:\Windows\System\CsfzMrn.exe
  C:\Windows\System\CsfzMrn.exe
  2⤵
  PID:6112
- C:\Windows\System\CwrfEHJ.exe
  C:\Windows\System\CwrfEHJ.exe
  2⤵
  PID:5176
- C:\Windows\System\bWKguau.exe
  C:\Windows\System\bWKguau.exe
  2⤵
  PID:5276
- C:\Windows\System\hhvjHyf.exe
  C:\Windows\System\hhvjHyf.exe
  2⤵
  PID:5248
- C:\Windows\System\ltxHCAn.exe
  C:\Windows\System\ltxHCAn.exe
  2⤵
  PID:5128
- C:\Windows\System\HFbgBgL.exe
  C:\Windows\System\HFbgBgL.exe
  2⤵
  PID:5312
- C:\Windows\System\YSdlgwz.exe
  C:\Windows\System\YSdlgwz.exe
  2⤵
  PID:5292
- C:\Windows\System\noDaSse.exe
  C:\Windows\System\noDaSse.exe
  2⤵
  PID:5444
- C:\Windows\System\XJJIybr.exe
  C:\Windows\System\XJJIybr.exe
  2⤵
  PID:5424
- C:\Windows\System\fIXEWUk.exe
  C:\Windows\System\fIXEWUk.exe
  2⤵
  PID:5504
- C:\Windows\System\FoTGHsf.exe
  C:\Windows\System\FoTGHsf.exe
  2⤵
  PID:5392
- C:\Windows\System\oRttByQ.exe
  C:\Windows\System\oRttByQ.exe
  2⤵
  PID:5652
- C:\Windows\System\pndmseR.exe
  C:\Windows\System\pndmseR.exe
  2⤵
  PID:5824
- C:\Windows\System\sdwxKhn.exe
  C:\Windows\System\sdwxKhn.exe
  2⤵
  PID:6060
- C:\Windows\System\NPahgDT.exe
  C:\Windows\System\NPahgDT.exe
  2⤵
  PID:5872
- C:\Windows\System\WrfjNFx.exe
  C:\Windows\System\WrfjNFx.exe
  2⤵
  PID:6124
- C:\Windows\System\JlKrVse.exe
  C:\Windows\System\JlKrVse.exe
  2⤵
  PID:5728
- C:\Windows\System\zYrpxxU.exe
  C:\Windows\System\zYrpxxU.exe
  2⤵
  PID:6128
- C:\Windows\System\MDsqAwF.exe
  C:\Windows\System\MDsqAwF.exe
  2⤵
  PID:6140
- C:\Windows\System\jQipgsH.exe
  C:\Windows\System\jQipgsH.exe
  2⤵
  PID:2932
- C:\Windows\System\qvwcDmk.exe
  C:\Windows\System\qvwcDmk.exe
  2⤵
  PID:4504
- C:\Windows\System\GRMfFZk.exe
  C:\Windows\System\GRMfFZk.exe
  2⤵
  PID:5492
- C:\Windows\System\DzYlFPj.exe
  C:\Windows\System\DzYlFPj.exe
  2⤵
  PID:5956
- C:\Windows\System\LPdkBCt.exe
  C:\Windows\System\LPdkBCt.exe
  2⤵
  PID:5992
- C:\Windows\System\vXKOCad.exe
  C:\Windows\System\vXKOCad.exe
  2⤵
  PID:5376
- C:\Windows\System\EQoJWCM.exe
  C:\Windows\System\EQoJWCM.exe
  2⤵
  PID:5348
- C:\Windows\System\oCOQCAh.exe
  C:\Windows\System\oCOQCAh.exe
  2⤵
  PID:5164
- C:\Windows\System\jrtjzLc.exe
  C:\Windows\System\jrtjzLc.exe
  2⤵
  PID:5328
- C:\Windows\System\AfLQCAw.exe
  C:\Windows\System\AfLQCAw.exe
  2⤵
  PID:5584
- C:\Windows\System\GqdtyCt.exe
  C:\Windows\System\GqdtyCt.exe
  2⤵
  PID:5716
- C:\Windows\System\NfsKEqj.exe
  C:\Windows\System\NfsKEqj.exe
  2⤵
  PID:5588
- C:\Windows\System\fqodBSb.exe
  C:\Windows\System\fqodBSb.exe
  2⤵
  PID:5440
- C:\Windows\System\XclCcyS.exe
  C:\Windows\System\XclCcyS.exe
  2⤵
  PID:5212
- C:\Windows\System\TWBQYQO.exe
  C:\Windows\System\TWBQYQO.exe
  2⤵
  PID:5380
- C:\Windows\System\xKhBqML.exe
  C:\Windows\System\xKhBqML.exe
  2⤵
  PID:3876
- C:\Windows\System\kCXGWdQ.exe
  C:\Windows\System\kCXGWdQ.exe
  2⤵
  PID:6108
- C:\Windows\System\MvXhbsv.exe
  C:\Windows\System\MvXhbsv.exe
  2⤵
  PID:6148
- C:\Windows\System\qHIKxtq.exe
  C:\Windows\System\qHIKxtq.exe
  2⤵
  PID:6164
- C:\Windows\System\TXKAUAp.exe
  C:\Windows\System\TXKAUAp.exe
  2⤵
  PID:6180
- C:\Windows\System\CeHWHQQ.exe
  C:\Windows\System\CeHWHQQ.exe
  2⤵
  PID:6196
- C:\Windows\System\CXxRFKd.exe
  C:\Windows\System\CXxRFKd.exe
  2⤵
  PID:6212
- C:\Windows\System\HsLZkPw.exe
  C:\Windows\System\HsLZkPw.exe
  2⤵
  PID:6228
- C:\Windows\System\liYQVDg.exe
  C:\Windows\System\liYQVDg.exe
  2⤵
  PID:6244
- C:\Windows\System\zzqLQUA.exe
  C:\Windows\System\zzqLQUA.exe
  2⤵
  PID:6260
- C:\Windows\System\VRllQrb.exe
  C:\Windows\System\VRllQrb.exe
  2⤵
  PID:6276
- C:\Windows\System\YPVlMsO.exe
  C:\Windows\System\YPVlMsO.exe
  2⤵
  PID:6292
- C:\Windows\System\pRyIgJw.exe
  C:\Windows\System\pRyIgJw.exe
  2⤵
  PID:6308
- C:\Windows\System\gmHGrOt.exe
  C:\Windows\System\gmHGrOt.exe
  2⤵
  PID:6324
- C:\Windows\System\SojOLpX.exe
  C:\Windows\System\SojOLpX.exe
  2⤵
  PID:6340
- C:\Windows\System\ZHuyYPF.exe
  C:\Windows\System\ZHuyYPF.exe
  2⤵
  PID:6356
- C:\Windows\System\kxilvkS.exe
  C:\Windows\System\kxilvkS.exe
  2⤵
  PID:6372
- C:\Windows\System\YxRmljy.exe
  C:\Windows\System\YxRmljy.exe
  2⤵
  PID:6388
- C:\Windows\System\phOehOD.exe
  C:\Windows\System\phOehOD.exe
  2⤵
  PID:6404
- C:\Windows\System\yqCqEUl.exe
  C:\Windows\System\yqCqEUl.exe
  2⤵
  PID:6420
- C:\Windows\System\fMBozEN.exe
  C:\Windows\System\fMBozEN.exe
  2⤵
  PID:6436
- C:\Windows\System\yjcBmPe.exe
  C:\Windows\System\yjcBmPe.exe
  2⤵
  PID:6452
- C:\Windows\System\iNQsScY.exe
  C:\Windows\System\iNQsScY.exe
  2⤵
  PID:6468
- C:\Windows\System\EOdopPj.exe
  C:\Windows\System\EOdopPj.exe
  2⤵
  PID:6484
- C:\Windows\System\wpRlmFY.exe
  C:\Windows\System\wpRlmFY.exe
  2⤵
  PID:6500
- C:\Windows\System\BZHGuEh.exe
  C:\Windows\System\BZHGuEh.exe
  2⤵
  PID:6516
- C:\Windows\System\FAqyCAS.exe
  C:\Windows\System\FAqyCAS.exe
  2⤵
  PID:6532
- C:\Windows\System\AqXQfHs.exe
  C:\Windows\System\AqXQfHs.exe
  2⤵
  PID:6548
- C:\Windows\System\eFJMfYJ.exe
  C:\Windows\System\eFJMfYJ.exe
  2⤵
  PID:6564
- C:\Windows\System\DUcjomZ.exe
  C:\Windows\System\DUcjomZ.exe
  2⤵
  PID:6580
- C:\Windows\System\kjwTXor.exe
  C:\Windows\System\kjwTXor.exe
  2⤵
  PID:6596
- C:\Windows\System\nzTneNK.exe
  C:\Windows\System\nzTneNK.exe
  2⤵
  PID:6612
- C:\Windows\System\kFNfhXh.exe
  C:\Windows\System\kFNfhXh.exe
  2⤵
  PID:6628
- C:\Windows\System\NjEkNYJ.exe
  C:\Windows\System\NjEkNYJ.exe
  2⤵
  PID:6644
- C:\Windows\System\iPlQFrx.exe
  C:\Windows\System\iPlQFrx.exe
  2⤵
  PID:6660
- C:\Windows\System\EcHylgw.exe
  C:\Windows\System\EcHylgw.exe
  2⤵
  PID:6676
- C:\Windows\System\BaJYdoA.exe
  C:\Windows\System\BaJYdoA.exe
  2⤵
  PID:6692
- C:\Windows\System\XmcilnL.exe
  C:\Windows\System\XmcilnL.exe
  2⤵
  PID:6708
- C:\Windows\System\AvEylXB.exe
  C:\Windows\System\AvEylXB.exe
  2⤵
  PID:6724
- C:\Windows\System\nkEiNia.exe
  C:\Windows\System\nkEiNia.exe
  2⤵
  PID:6740
- C:\Windows\System\fQXBwzz.exe
  C:\Windows\System\fQXBwzz.exe
  2⤵
  PID:6756
- C:\Windows\System\uXAqOlw.exe
  C:\Windows\System\uXAqOlw.exe
  2⤵
  PID:6772
- C:\Windows\System\TCEpuWq.exe
  C:\Windows\System\TCEpuWq.exe
  2⤵
  PID:6788
- C:\Windows\System\JBoHGLy.exe
  C:\Windows\System\JBoHGLy.exe
  2⤵
  PID:6804
- C:\Windows\System\gfOeanY.exe
  C:\Windows\System\gfOeanY.exe
  2⤵
  PID:6820
- C:\Windows\System\SeFyBog.exe
  C:\Windows\System\SeFyBog.exe
  2⤵
  PID:6836
- C:\Windows\System\KOWYyTs.exe
  C:\Windows\System\KOWYyTs.exe
  2⤵
  PID:6852
- C:\Windows\System\sWPsWzH.exe
  C:\Windows\System\sWPsWzH.exe
  2⤵
  PID:6868
- C:\Windows\System\ffRxwrB.exe
  C:\Windows\System\ffRxwrB.exe
  2⤵
  PID:6884
- C:\Windows\System\wUvkkhx.exe
  C:\Windows\System\wUvkkhx.exe
  2⤵
  PID:6900
- C:\Windows\System\tMKHfAf.exe
  C:\Windows\System\tMKHfAf.exe
  2⤵
  PID:6916
- C:\Windows\System\krqURxM.exe
  C:\Windows\System\krqURxM.exe
  2⤵
  PID:6932
- C:\Windows\System\EuccZHP.exe
  C:\Windows\System\EuccZHP.exe
  2⤵
  PID:6948
- C:\Windows\System\AvfZvZS.exe
  C:\Windows\System\AvfZvZS.exe
  2⤵
  PID:6964
- C:\Windows\System\yucMSnE.exe
  C:\Windows\System\yucMSnE.exe
  2⤵
  PID:6980
- C:\Windows\System\yhPvQeS.exe
  C:\Windows\System\yhPvQeS.exe
  2⤵
  PID:6996
- C:\Windows\System\pXJkJpy.exe
  C:\Windows\System\pXJkJpy.exe
  2⤵
  PID:7012
- C:\Windows\System\yDURqzL.exe
  C:\Windows\System\yDURqzL.exe
  2⤵
  PID:7032
- C:\Windows\System\LSMDQlA.exe
  C:\Windows\System\LSMDQlA.exe
  2⤵
  PID:7048
- C:\Windows\System\VrwonhN.exe
  C:\Windows\System\VrwonhN.exe
  2⤵
  PID:7064
- C:\Windows\System\akpXGXv.exe
  C:\Windows\System\akpXGXv.exe
  2⤵
  PID:7080
- C:\Windows\System\fNLnXlI.exe
  C:\Windows\System\fNLnXlI.exe
  2⤵
  PID:7096
- C:\Windows\System\SFvKZxM.exe
  C:\Windows\System\SFvKZxM.exe
  2⤵
  PID:7112
- C:\Windows\System\uHMclEX.exe
  C:\Windows\System\uHMclEX.exe
  2⤵
  PID:7128
- C:\Windows\System\VgmxYSv.exe
  C:\Windows\System\VgmxYSv.exe
  2⤵
  PID:7144
- C:\Windows\System\AKbcUfL.exe
  C:\Windows\System\AKbcUfL.exe
  2⤵
  PID:7160
- C:\Windows\System\wLiSpKs.exe
  C:\Windows\System\wLiSpKs.exe
  2⤵
  PID:6188
- C:\Windows\System\AzOHbXA.exe
  C:\Windows\System\AzOHbXA.exe
  2⤵
  PID:6252
- C:\Windows\System\OZgLZHx.exe
  C:\Windows\System\OZgLZHx.exe
  2⤵
  PID:6316
- C:\Windows\System\SMAAbnf.exe
  C:\Windows\System\SMAAbnf.exe
  2⤵
  PID:6172
- C:\Windows\System\mtIZYjv.exe
  C:\Windows\System\mtIZYjv.exe
  2⤵
  PID:6236
- C:\Windows\System\UYxKomD.exe
  C:\Windows\System\UYxKomD.exe
  2⤵
  PID:6412
- C:\Windows\System\ASIXYTS.exe
  C:\Windows\System\ASIXYTS.exe
  2⤵
  PID:6444
- C:\Windows\System\bZDcHJH.exe
  C:\Windows\System\bZDcHJH.exe
  2⤵
  PID:5912
- C:\Windows\System\wMBKTvF.exe
  C:\Windows\System\wMBKTvF.exe
  2⤵
  PID:6396
- C:\Windows\System\gupdYWS.exe
  C:\Windows\System\gupdYWS.exe
  2⤵
  PID:6336
- C:\Windows\System\AJavrZS.exe
  C:\Windows\System\AJavrZS.exe
  2⤵
  PID:6432
- C:\Windows\System\eHdZGsf.exe
  C:\Windows\System\eHdZGsf.exe
  2⤵
  PID:6512
- C:\Windows\System\ROgGBuX.exe
  C:\Windows\System\ROgGBuX.exe
  2⤵
  PID:6496
- C:\Windows\System\QXhJXAl.exe
  C:\Windows\System\QXhJXAl.exe
  2⤵
  PID:6576
- C:\Windows\System\CnndfHm.exe
  C:\Windows\System\CnndfHm.exe
  2⤵
  PID:6560
- C:\Windows\System\QwaGCUF.exe
  C:\Windows\System\QwaGCUF.exe
  2⤵
  PID:6620
- C:\Windows\System\CDPkELS.exe
  C:\Windows\System\CDPkELS.exe
  2⤵
  PID:6668
- C:\Windows\System\uJFximA.exe
  C:\Windows\System\uJFximA.exe
  2⤵
  PID:6652
- C:\Windows\System\VmHvvTZ.exe
  C:\Windows\System\VmHvvTZ.exe
  2⤵
  PID:6736
- C:\Windows\System\rXrAmcp.exe
  C:\Windows\System\rXrAmcp.exe
  2⤵
  PID:6800
- C:\Windows\System\gbyrWSs.exe
  C:\Windows\System\gbyrWSs.exe
  2⤵
  PID:6864
- C:\Windows\System\SuQMQfy.exe
  C:\Windows\System\SuQMQfy.exe
  2⤵
  PID:6928
- C:\Windows\System\bUOwHcY.exe
  C:\Windows\System\bUOwHcY.exe
  2⤵
  PID:6992
- C:\Windows\System\VNvvIfS.exe
  C:\Windows\System\VNvvIfS.exe
  2⤵
  PID:6748
- C:\Windows\System\JQzDAGs.exe
  C:\Windows\System\JQzDAGs.exe
  2⤵
  PID:6784
- C:\Windows\System\iBtYphF.exe
  C:\Windows\System\iBtYphF.exe
  2⤵
  PID:7028
- C:\Windows\System\LhgnZhv.exe
  C:\Windows\System\LhgnZhv.exe
  2⤵
  PID:6816
- C:\Windows\System\ZRFlpou.exe
  C:\Windows\System\ZRFlpou.exe
  2⤵
  PID:6972
- C:\Windows\System\stPySFM.exe
  C:\Windows\System\stPySFM.exe
  2⤵
  PID:6976
- C:\Windows\System\xawzizB.exe
  C:\Windows\System\xawzizB.exe
  2⤵
  PID:7044
- C:\Windows\System\rmWJkUl.exe
  C:\Windows\System\rmWJkUl.exe
  2⤵
  PID:7120
- C:\Windows\System\wqIYOhx.exe
  C:\Windows\System\wqIYOhx.exe
  2⤵
  PID:7104
- C:\Windows\System\kpWCjwC.exe
  C:\Windows\System\kpWCjwC.exe
  2⤵
  PID:6220
- C:\Windows\System\QwWWosZ.exe
  C:\Windows\System\QwWWosZ.exe
  2⤵
  PID:6284
- C:\Windows\System\qChAyVQ.exe
  C:\Windows\System\qChAyVQ.exe
  2⤵
  PID:6380
- C:\Windows\System\fVSwlaY.exe
  C:\Windows\System\fVSwlaY.exe
  2⤵
  PID:6204
- C:\Windows\System\zIPAksA.exe
  C:\Windows\System\zIPAksA.exe
  2⤵
  PID:6272
- C:\Windows\System\tPbJVWT.exe
  C:\Windows\System\tPbJVWT.exe
  2⤵
  PID:6544
- C:\Windows\System\HeBvRhr.exe
  C:\Windows\System\HeBvRhr.exe
  2⤵
  PID:6368
- C:\Windows\System\PGSyXrC.exe
  C:\Windows\System\PGSyXrC.exe
  2⤵
  PID:6480
- C:\Windows\System\qMVJaDJ.exe
  C:\Windows\System\qMVJaDJ.exe
  2⤵
  PID:6924
- C:\Windows\System\ULPdXYm.exe
  C:\Windows\System\ULPdXYm.exe
  2⤵
  PID:7020
- C:\Windows\System\oaDXnsA.exe
  C:\Windows\System\oaDXnsA.exe
  2⤵
  PID:6588
- C:\Windows\System\eVlVyxe.exe
  C:\Windows\System\eVlVyxe.exe
  2⤵
  PID:6640
- C:\Windows\System\iVBcaOD.exe
  C:\Windows\System\iVBcaOD.exe
  2⤵
  PID:6844
- C:\Windows\System\RBEXISW.exe
  C:\Windows\System\RBEXISW.exe
  2⤵
  PID:7108
- C:\Windows\System\ZYxykFu.exe
  C:\Windows\System\ZYxykFu.exe
  2⤵
  PID:6732
- C:\Windows\System\DZoZRVU.exe
  C:\Windows\System\DZoZRVU.exe
  2⤵
  PID:7072
- C:\Windows\System\gEGqJzw.exe
  C:\Windows\System\gEGqJzw.exe
  2⤵
  PID:6208
- C:\Windows\System\dTbLElR.exe
  C:\Windows\System\dTbLElR.exe
  2⤵
  PID:6912
- C:\Windows\System\cGwzAka.exe
  C:\Windows\System\cGwzAka.exe
  2⤵
  PID:6304
- C:\Windows\System\FaKeHLG.exe
  C:\Windows\System\FaKeHLG.exe
  2⤵
  PID:6332
- C:\Windows\System\IrZRXUU.exe
  C:\Windows\System\IrZRXUU.exe
  2⤵
  PID:6656
- C:\Windows\System\gVHaBLX.exe
  C:\Windows\System\gVHaBLX.exe
  2⤵
  PID:6428
- C:\Windows\System\NGTDQlt.exe
  C:\Windows\System\NGTDQlt.exe
  2⤵
  PID:6796
- C:\Windows\System\aPCluzz.exe
  C:\Windows\System\aPCluzz.exe
  2⤵
  PID:6704
- C:\Windows\System\GdOPzIX.exe
  C:\Windows\System\GdOPzIX.exe
  2⤵
  PID:6160
- C:\Windows\System\DtWlUDv.exe
  C:\Windows\System\DtWlUDv.exe
  2⤵
  PID:7056
- C:\Windows\System\mkwkJSv.exe
  C:\Windows\System\mkwkJSv.exe
  2⤵
  PID:6636
- C:\Windows\System\CwyucbN.exe
  C:\Windows\System\CwyucbN.exe
  2⤵
  PID:6960
- C:\Windows\System\DHMkGEn.exe
  C:\Windows\System\DHMkGEn.exe
  2⤵
  PID:6832
- C:\Windows\System\eznYQKu.exe
  C:\Windows\System\eznYQKu.exe
  2⤵
  PID:6880
- C:\Windows\System\HITkXTv.exe
  C:\Windows\System\HITkXTv.exe
  2⤵
  PID:7176
- C:\Windows\System\hESdpgw.exe
  C:\Windows\System\hESdpgw.exe
  2⤵
  PID:7192
- C:\Windows\System\DDRZqRR.exe
  C:\Windows\System\DDRZqRR.exe
  2⤵
  PID:7208
- C:\Windows\System\AcfzNkA.exe
  C:\Windows\System\AcfzNkA.exe
  2⤵
  PID:7224
- C:\Windows\System\saXTsKR.exe
  C:\Windows\System\saXTsKR.exe
  2⤵
  PID:7240
- C:\Windows\System\KrWExsZ.exe
  C:\Windows\System\KrWExsZ.exe
  2⤵
  PID:7256
- C:\Windows\System\kIWIDqn.exe
  C:\Windows\System\kIWIDqn.exe
  2⤵
  PID:7272
- C:\Windows\System\tbNHmCa.exe
  C:\Windows\System\tbNHmCa.exe
  2⤵
  PID:7288
- C:\Windows\System\BZooHTF.exe
  C:\Windows\System\BZooHTF.exe
  2⤵
  PID:7304
- C:\Windows\System\NuajPtU.exe
  C:\Windows\System\NuajPtU.exe
  2⤵
  PID:7320
- C:\Windows\System\GOuIxNm.exe
  C:\Windows\System\GOuIxNm.exe
  2⤵
  PID:7336
- C:\Windows\System\JzXcRba.exe
  C:\Windows\System\JzXcRba.exe
  2⤵
  PID:7352
- C:\Windows\System\UEZiUjg.exe
  C:\Windows\System\UEZiUjg.exe
  2⤵
  PID:7368
- C:\Windows\System\kYHZzUE.exe
  C:\Windows\System\kYHZzUE.exe
  2⤵
  PID:7384
- C:\Windows\System\tFlpQeJ.exe
  C:\Windows\System\tFlpQeJ.exe
  2⤵
  PID:7400
- C:\Windows\System\bfkJZGn.exe
  C:\Windows\System\bfkJZGn.exe
  2⤵
  PID:7416
- C:\Windows\System\brqMHBM.exe
  C:\Windows\System\brqMHBM.exe
  2⤵
  PID:7432
- C:\Windows\System\CIOZqoR.exe
  C:\Windows\System\CIOZqoR.exe
  2⤵
  PID:7448
- C:\Windows\System\LZpQFpP.exe
  C:\Windows\System\LZpQFpP.exe
  2⤵
  PID:7464
- C:\Windows\System\AZYkUIo.exe
  C:\Windows\System\AZYkUIo.exe
  2⤵
  PID:7480
- C:\Windows\System\kTfCEbn.exe
  C:\Windows\System\kTfCEbn.exe
  2⤵
  PID:7496
- C:\Windows\System\YBaALae.exe
  C:\Windows\System\YBaALae.exe
  2⤵
  PID:7512
- C:\Windows\System\RCDqHaF.exe
  C:\Windows\System\RCDqHaF.exe
  2⤵
  PID:7528
- C:\Windows\System\keYhSKI.exe
  C:\Windows\System\keYhSKI.exe
  2⤵
  PID:7544
- C:\Windows\System\vglaEeV.exe
  C:\Windows\System\vglaEeV.exe
  2⤵
  PID:7560
- C:\Windows\System\eanPJpd.exe
  C:\Windows\System\eanPJpd.exe
  2⤵
  PID:7576
- C:\Windows\System\EfpCtyB.exe
  C:\Windows\System\EfpCtyB.exe
  2⤵
  PID:7592
- C:\Windows\System\LKKmqcD.exe
  C:\Windows\System\LKKmqcD.exe
  2⤵
  PID:7608
- C:\Windows\System\TNHmelk.exe
  C:\Windows\System\TNHmelk.exe
  2⤵
  PID:7624
- C:\Windows\System\DyPAsJO.exe
  C:\Windows\System\DyPAsJO.exe
  2⤵
  PID:7640
- C:\Windows\System\GUWrhBa.exe
  C:\Windows\System\GUWrhBa.exe
  2⤵
  PID:7656
- C:\Windows\System\KstYoIp.exe
  C:\Windows\System\KstYoIp.exe
  2⤵
  PID:7672
- C:\Windows\System\EMKFzZK.exe
  C:\Windows\System\EMKFzZK.exe
  2⤵
  PID:7692
- C:\Windows\System\ImqGEzK.exe
  C:\Windows\System\ImqGEzK.exe
  2⤵
  PID:7708
- C:\Windows\System\FnUFPCW.exe
  C:\Windows\System\FnUFPCW.exe
  2⤵
  PID:7724
- C:\Windows\System\daJRQDH.exe
  C:\Windows\System\daJRQDH.exe
  2⤵
  PID:7740
- C:\Windows\System\aFHdIYD.exe
  C:\Windows\System\aFHdIYD.exe
  2⤵
  PID:7756
- C:\Windows\System\cilJUsP.exe
  C:\Windows\System\cilJUsP.exe
  2⤵
  PID:7772
- C:\Windows\System\ceZUXHA.exe
  C:\Windows\System\ceZUXHA.exe
  2⤵
  PID:7788
- C:\Windows\System\WenIITv.exe
  C:\Windows\System\WenIITv.exe
  2⤵
  PID:7804
- C:\Windows\System\FRLIeLF.exe
  C:\Windows\System\FRLIeLF.exe
  2⤵
  PID:7820
- C:\Windows\System\XPPdRpZ.exe
  C:\Windows\System\XPPdRpZ.exe
  2⤵
  PID:7840
- C:\Windows\System\ouuVgmk.exe
  C:\Windows\System\ouuVgmk.exe
  2⤵
  PID:7856
- C:\Windows\System\xDFJTSD.exe
  C:\Windows\System\xDFJTSD.exe
  2⤵
  PID:7872
- C:\Windows\System\jhKJpTj.exe
  C:\Windows\System\jhKJpTj.exe
  2⤵
  PID:7888
- C:\Windows\System\CAWpygO.exe
  C:\Windows\System\CAWpygO.exe
  2⤵
  PID:7904
- C:\Windows\System\vCsyXwo.exe
  C:\Windows\System\vCsyXwo.exe
  2⤵
  PID:7920
- C:\Windows\System\HDCTFjQ.exe
  C:\Windows\System\HDCTFjQ.exe
  2⤵
  PID:7936
- C:\Windows\System\MTQGsyp.exe
  C:\Windows\System\MTQGsyp.exe
  2⤵
  PID:7952
- C:\Windows\System\MorBaFU.exe
  C:\Windows\System\MorBaFU.exe
  2⤵
  PID:7968
- C:\Windows\System\TPSKFol.exe
  C:\Windows\System\TPSKFol.exe
  2⤵
  PID:7984
- C:\Windows\System\IAoIcoQ.exe
  C:\Windows\System\IAoIcoQ.exe
  2⤵
  PID:8000
- C:\Windows\System\dRaiBsU.exe
  C:\Windows\System\dRaiBsU.exe
  2⤵
  PID:8020
- C:\Windows\System\TJnQauW.exe
  C:\Windows\System\TJnQauW.exe
  2⤵
  PID:8036
- C:\Windows\System\TBidDhe.exe
  C:\Windows\System\TBidDhe.exe
  2⤵
  PID:8052
- C:\Windows\System\ChQhrmz.exe
  C:\Windows\System\ChQhrmz.exe
  2⤵
  PID:8068
- C:\Windows\System\KrUIrlB.exe
  C:\Windows\System\KrUIrlB.exe
  2⤵
  PID:8084
- C:\Windows\System\xKHYJDI.exe
  C:\Windows\System\xKHYJDI.exe
  2⤵
  PID:8100
- C:\Windows\System\WYJktAu.exe
  C:\Windows\System\WYJktAu.exe
  2⤵
  PID:8116
- C:\Windows\System\OFfEmVd.exe
  C:\Windows\System\OFfEmVd.exe
  2⤵
  PID:8132
- C:\Windows\System\uccuHmu.exe
  C:\Windows\System\uccuHmu.exe
  2⤵
  PID:8148
- C:\Windows\System\SaghmaQ.exe
  C:\Windows\System\SaghmaQ.exe
  2⤵
  PID:8164
- C:\Windows\System\KjZhvGo.exe
  C:\Windows\System\KjZhvGo.exe
  2⤵
  PID:8180
- C:\Windows\System\pzjVtxh.exe
  C:\Windows\System\pzjVtxh.exe
  2⤵
  PID:7188
- C:\Windows\System\XZjZmDh.exe
  C:\Windows\System\XZjZmDh.exe
  2⤵
  PID:7248
- C:\Windows\System\RYANfVd.exe
  C:\Windows\System\RYANfVd.exe
  2⤵
  PID:7312
- C:\Windows\System\mWyMZvR.exe
  C:\Windows\System\mWyMZvR.exe
  2⤵
  PID:7376
- C:\Windows\System\fvHdGyh.exe
  C:\Windows\System\fvHdGyh.exe
  2⤵
  PID:7440
- C:\Windows\System\LLzkFgj.exe
  C:\Windows\System\LLzkFgj.exe
  2⤵
  PID:7504
- C:\Windows\System\nIukBny.exe
  C:\Windows\System\nIukBny.exe
  2⤵
  PID:6720
- C:\Windows\System\QNENWGU.exe
  C:\Windows\System\QNENWGU.exe
  2⤵
  PID:7204
- C:\Windows\System\qJBUqNI.exe
  C:\Windows\System\qJBUqNI.exe
  2⤵
  PID:7232
- C:\Windows\System\MlsMPXy.exe
  C:\Windows\System\MlsMPXy.exe
  2⤵
  PID:7396
- C:\Windows\System\tTZsKYF.exe
  C:\Windows\System\tTZsKYF.exe
  2⤵
  PID:7520
- C:\Windows\System\FAFDcdj.exe
  C:\Windows\System\FAFDcdj.exe
  2⤵
  PID:7236
- C:\Windows\System\Wlhhtwg.exe
  C:\Windows\System\Wlhhtwg.exe
  2⤵
  PID:7328
- C:\Windows\System\nnMqsfl.exe
  C:\Windows\System\nnMqsfl.exe
  2⤵
  PID:7424
- C:\Windows\System\KlmOOZt.exe
  C:\Windows\System\KlmOOZt.exe
  2⤵
  PID:7524
- C:\Windows\System\EStDjrQ.exe
  C:\Windows\System\EStDjrQ.exe
  2⤵
  PID:7604
- C:\Windows\System\PnhJsJM.exe
  C:\Windows\System\PnhJsJM.exe
  2⤵
  PID:7668
- C:\Windows\System\pcRBPmb.exe
  C:\Windows\System\pcRBPmb.exe
  2⤵
  PID:7732
- C:\Windows\System\ymxCXEt.exe
  C:\Windows\System\ymxCXEt.exe
  2⤵
  PID:7716
- C:\Windows\System\ZSYIFEQ.exe
  C:\Windows\System\ZSYIFEQ.exe
  2⤵
  PID:7736
- C:\Windows\System\YraZZlh.exe
  C:\Windows\System\YraZZlh.exe
  2⤵
  PID:7780
- C:\Windows\System\jcLioRk.exe
  C:\Windows\System\jcLioRk.exe
  2⤵
  PID:7812
- C:\Windows\System\NQvYnWU.exe
  C:\Windows\System\NQvYnWU.exe
  2⤵
  PID:7836
- C:\Windows\System\ELjTnPr.exe
  C:\Windows\System\ELjTnPr.exe
  2⤵
  PID:7864
- C:\Windows\System\SuGDpVO.exe
  C:\Windows\System\SuGDpVO.exe
  2⤵
  PID:7928
- C:\Windows\System\OVAnFjk.exe
  C:\Windows\System\OVAnFjk.exe
  2⤵
  PID:7992
- C:\Windows\System\OimdPCE.exe
  C:\Windows\System\OimdPCE.exe
  2⤵
  PID:7912
- C:\Windows\System\UidNcPa.exe
  C:\Windows\System\UidNcPa.exe
  2⤵
  PID:7916
- C:\Windows\System\hNPPMtC.exe
  C:\Windows\System\hNPPMtC.exe
  2⤵
  PID:8044
- C:\Windows\System\sZPPJKd.exe
  C:\Windows\System\sZPPJKd.exe
  2⤵
  PID:8060
- C:\Windows\System\pabEqCN.exe
  C:\Windows\System\pabEqCN.exe
  2⤵
  PID:8124
- C:\Windows\System\zsgMUmN.exe
  C:\Windows\System\zsgMUmN.exe
  2⤵
  PID:8188
- C:\Windows\System\cGQpMKj.exe
  C:\Windows\System\cGQpMKj.exe
  2⤵
  PID:7408
- C:\Windows\System\PceUGFU.exe
  C:\Windows\System\PceUGFU.exe
  2⤵
  PID:8080
- C:\Windows\System\rwUjiHk.exe
  C:\Windows\System\rwUjiHk.exe
  2⤵
  PID:8140
- C:\Windows\System\GZwIYaZ.exe
  C:\Windows\System\GZwIYaZ.exe
  2⤵
  PID:8176
- C:\Windows\System\xqeTUjK.exe
  C:\Windows\System\xqeTUjK.exe
  2⤵
  PID:7472
- C:\Windows\System\jUOmYcV.exe
  C:\Windows\System\jUOmYcV.exe
  2⤵
  PID:7268
- C:\Windows\System\wYJAFDu.exe
  C:\Windows\System\wYJAFDu.exe
  2⤵
  PID:7572
- C:\Windows\System\zdebHze.exe
  C:\Windows\System\zdebHze.exe
  2⤵
  PID:7172
- C:\Windows\System\DdonmmD.exe
  C:\Windows\System\DdonmmD.exe
  2⤵
  PID:7636
- C:\Windows\System\VeXEkQk.exe
  C:\Windows\System\VeXEkQk.exe
  2⤵
  PID:7768
- C:\Windows\System\MawhbXZ.exe
  C:\Windows\System\MawhbXZ.exe
  2⤵
  PID:7588
- C:\Windows\System\fvxiMee.exe
  C:\Windows\System\fvxiMee.exe
  2⤵
  PID:7616
- C:\Windows\System\sEDfAWZ.exe
  C:\Windows\System\sEDfAWZ.exe
  2⤵
  PID:7896
- C:\Windows\System\XYWvxzx.exe
  C:\Windows\System\XYWvxzx.exe
  2⤵
  PID:8008
- C:\Windows\System\WaESkYS.exe
  C:\Windows\System\WaESkYS.exe
  2⤵
  PID:7280
- C:\Windows\System\fDavRKN.exe
  C:\Windows\System\fDavRKN.exe
  2⤵
  PID:7852
- C:\Windows\System\ctdIjRB.exe
  C:\Windows\System\ctdIjRB.exe
  2⤵
  PID:7344
- C:\Windows\System\uDmpcYc.exe
  C:\Windows\System\uDmpcYc.exe
  2⤵
  PID:7800
- C:\Windows\System\odGYLhp.exe
  C:\Windows\System\odGYLhp.exe
  2⤵
  PID:7964
- C:\Windows\System\neYSYyV.exe
  C:\Windows\System\neYSYyV.exe
  2⤵
  PID:8160
- C:\Windows\System\pbPxUfo.exe
  C:\Windows\System\pbPxUfo.exe
  2⤵
  PID:5700
- C:\Windows\System\GgVeQEJ.exe
  C:\Windows\System\GgVeQEJ.exe
  2⤵
  PID:7684
- C:\Windows\System\srgnOmc.exe
  C:\Windows\System\srgnOmc.exe
  2⤵
  PID:7648
- C:\Windows\System\lxuHDVR.exe
  C:\Windows\System\lxuHDVR.exe
  2⤵
  PID:8092
- C:\Windows\System\RkixYzy.exe
  C:\Windows\System\RkixYzy.exe
  2⤵
  PID:7568
- C:\Windows\System\SFhsqZS.exe
  C:\Windows\System\SFhsqZS.exe
  2⤵
  PID:8172
- C:\Windows\System\CObuRye.exe
  C:\Windows\System\CObuRye.exe
  2⤵
  PID:7884
- C:\Windows\System\WvlVhSo.exe
  C:\Windows\System\WvlVhSo.exe
  2⤵
  PID:8016
- C:\Windows\System\QqDrQvh.exe
  C:\Windows\System\QqDrQvh.exe
  2⤵
  PID:8028
- C:\Windows\System\fUVlfQk.exe
  C:\Windows\System\fUVlfQk.exe
  2⤵
  PID:7620
- C:\Windows\System\fEypnWL.exe
  C:\Windows\System\fEypnWL.exe
  2⤵
  PID:6812
- C:\Windows\System\LgggQIZ.exe
  C:\Windows\System\LgggQIZ.exe
  2⤵
  PID:7488
- C:\Windows\System\dzFPgai.exe
  C:\Windows\System\dzFPgai.exe
  2⤵
  PID:8196
- C:\Windows\System\hjKdZHY.exe
  C:\Windows\System\hjKdZHY.exe
  2⤵
  PID:8212
- C:\Windows\System\vRybROY.exe
  C:\Windows\System\vRybROY.exe
  2⤵
  PID:8228
- C:\Windows\System\RWcHmeQ.exe
  C:\Windows\System\RWcHmeQ.exe
  2⤵
  PID:8244
- C:\Windows\System\knqeQSr.exe
  C:\Windows\System\knqeQSr.exe
  2⤵
  PID:8260
- C:\Windows\System\KgABdLB.exe
  C:\Windows\System\KgABdLB.exe
  2⤵
  PID:8276
- C:\Windows\System\TOytnPr.exe
  C:\Windows\System\TOytnPr.exe
  2⤵
  PID:8292
- C:\Windows\System\KfYxOhK.exe
  C:\Windows\System\KfYxOhK.exe
  2⤵
  PID:8308
- C:\Windows\System\UgbKsZY.exe
  C:\Windows\System\UgbKsZY.exe
  2⤵
  PID:8324
- C:\Windows\System\FvuHmPD.exe
  C:\Windows\System\FvuHmPD.exe
  2⤵
  PID:8340
- C:\Windows\System\LHjsGwU.exe
  C:\Windows\System\LHjsGwU.exe
  2⤵
  PID:8356
- C:\Windows\System\rdYeJey.exe
  C:\Windows\System\rdYeJey.exe
  2⤵
  PID:8372
- C:\Windows\System\UlilKkn.exe
  C:\Windows\System\UlilKkn.exe
  2⤵
  PID:8388
- C:\Windows\System\vVwjhUx.exe
  C:\Windows\System\vVwjhUx.exe
  2⤵
  PID:8404
- C:\Windows\System\kljfLoE.exe
  C:\Windows\System\kljfLoE.exe
  2⤵
  PID:8420
- C:\Windows\System\tVEnzbf.exe
  C:\Windows\System\tVEnzbf.exe
  2⤵
  PID:8436
- C:\Windows\System\KPzmeDJ.exe
  C:\Windows\System\KPzmeDJ.exe
  2⤵
  PID:8452
- C:\Windows\System\uoPFPnc.exe
  C:\Windows\System\uoPFPnc.exe
  2⤵
  PID:8468
- C:\Windows\System\lpDeAsT.exe
  C:\Windows\System\lpDeAsT.exe
  2⤵
  PID:8484
- C:\Windows\System\KrtRiWX.exe
  C:\Windows\System\KrtRiWX.exe
  2⤵
  PID:8500
- C:\Windows\System\mPTAnGH.exe
  C:\Windows\System\mPTAnGH.exe
  2⤵
  PID:8516
- C:\Windows\System\WhJrWFh.exe
  C:\Windows\System\WhJrWFh.exe
  2⤵
  PID:8532
- C:\Windows\System\HGxVMjg.exe
  C:\Windows\System\HGxVMjg.exe
  2⤵
  PID:8548
- C:\Windows\System\kCqTXvO.exe
  C:\Windows\System\kCqTXvO.exe
  2⤵
  PID:8564
- C:\Windows\System\hBRtTuP.exe
  C:\Windows\System\hBRtTuP.exe
  2⤵
  PID:8580
- C:\Windows\System\TwGjXxv.exe
  C:\Windows\System\TwGjXxv.exe
  2⤵
  PID:8596
- C:\Windows\System\YLgixsJ.exe
  C:\Windows\System\YLgixsJ.exe
  2⤵
  PID:8612
- C:\Windows\System\vQlgRpl.exe
  C:\Windows\System\vQlgRpl.exe
  2⤵
  PID:8632
- C:\Windows\System\ORubVTi.exe
  C:\Windows\System\ORubVTi.exe
  2⤵
  PID:8648
- C:\Windows\System\FkFkqIJ.exe
  C:\Windows\System\FkFkqIJ.exe
  2⤵
  PID:8664
- C:\Windows\System\LSEESyv.exe
  C:\Windows\System\LSEESyv.exe
  2⤵
  PID:8680
- C:\Windows\System\lKxGPBB.exe
  C:\Windows\System\lKxGPBB.exe
  2⤵
  PID:8696
- C:\Windows\System\NnBTiqg.exe
  C:\Windows\System\NnBTiqg.exe
  2⤵
  PID:8712
- C:\Windows\System\VOpZhFI.exe
  C:\Windows\System\VOpZhFI.exe
  2⤵
  PID:8728
- C:\Windows\System\MYJGggb.exe
  C:\Windows\System\MYJGggb.exe
  2⤵
  PID:8744
- C:\Windows\System\gOAgIAI.exe
  C:\Windows\System\gOAgIAI.exe
  2⤵
  PID:8760
- C:\Windows\System\vjzfoBD.exe
  C:\Windows\System\vjzfoBD.exe
  2⤵
  PID:8776
- C:\Windows\System\wfiDnyP.exe
  C:\Windows\System\wfiDnyP.exe
  2⤵
  PID:8792
- C:\Windows\System\kVWbZcQ.exe
  C:\Windows\System\kVWbZcQ.exe
  2⤵
  PID:8808
- C:\Windows\System\BWWIymQ.exe
  C:\Windows\System\BWWIymQ.exe
  2⤵
  PID:8824
- C:\Windows\System\hfOYtrF.exe
  C:\Windows\System\hfOYtrF.exe
  2⤵
  PID:8840
- C:\Windows\System\LwXWxSg.exe
  C:\Windows\System\LwXWxSg.exe
  2⤵
  PID:8856
- C:\Windows\System\fScJMEi.exe
  C:\Windows\System\fScJMEi.exe
  2⤵
  PID:8872
- C:\Windows\System\aZhUPJn.exe
  C:\Windows\System\aZhUPJn.exe
  2⤵
  PID:8888
- C:\Windows\System\NyfRMHJ.exe
  C:\Windows\System\NyfRMHJ.exe
  2⤵
  PID:8904
- C:\Windows\System\jGieYtP.exe
  C:\Windows\System\jGieYtP.exe
  2⤵
  PID:8920
- C:\Windows\System\WofspKS.exe
  C:\Windows\System\WofspKS.exe
  2⤵
  PID:8936
- C:\Windows\System\pLamKUn.exe
  C:\Windows\System\pLamKUn.exe
  2⤵
  PID:8952
- C:\Windows\System\GCSJseZ.exe
  C:\Windows\System\GCSJseZ.exe
  2⤵
  PID:8968
- C:\Windows\System\OxwSEJB.exe
  C:\Windows\System\OxwSEJB.exe
  2⤵
  PID:8984
- C:\Windows\System\dbIZEQI.exe
  C:\Windows\System\dbIZEQI.exe
  2⤵
  PID:9000
- C:\Windows\System\mVPjUet.exe
  C:\Windows\System\mVPjUet.exe
  2⤵
  PID:9016
- C:\Windows\System\pgqDYps.exe
  C:\Windows\System\pgqDYps.exe
  2⤵
  PID:9032
- C:\Windows\System\vSyLJjt.exe
  C:\Windows\System\vSyLJjt.exe
  2⤵
  PID:9048
- C:\Windows\System\lxqStBq.exe
  C:\Windows\System\lxqStBq.exe
  2⤵
  PID:9064
- C:\Windows\System\NzZkgls.exe
  C:\Windows\System\NzZkgls.exe
  2⤵
  PID:9080
- C:\Windows\System\rEuevZU.exe
  C:\Windows\System\rEuevZU.exe
  2⤵
  PID:9096
- C:\Windows\System\UVlXOYQ.exe
  C:\Windows\System\UVlXOYQ.exe
  2⤵
  PID:9112
- C:\Windows\System\JUXmxVt.exe
  C:\Windows\System\JUXmxVt.exe
  2⤵
  PID:9128
- C:\Windows\System\plWLnxd.exe
  C:\Windows\System\plWLnxd.exe
  2⤵
  PID:9144
- C:\Windows\System\ENmDZsd.exe
  C:\Windows\System\ENmDZsd.exe
  2⤵
  PID:9160
- C:\Windows\System\sjngtzi.exe
  C:\Windows\System\sjngtzi.exe
  2⤵
  PID:9176
- C:\Windows\System\nStBioN.exe
  C:\Windows\System\nStBioN.exe
  2⤵
  PID:9192
- C:\Windows\System\HvGiZWY.exe
  C:\Windows\System\HvGiZWY.exe
  2⤵
  PID:9208
- C:\Windows\System\puoatFr.exe
  C:\Windows\System\puoatFr.exe
  2⤵
  PID:8032
- C:\Windows\System\aYtYsLc.exe
  C:\Windows\System\aYtYsLc.exe
  2⤵
  PID:8220
- C:\Windows\System\rXmAbyk.exe
  C:\Windows\System\rXmAbyk.exe
  2⤵
  PID:8204
- C:\Windows\System\RwTDBuO.exe
  C:\Windows\System\RwTDBuO.exe
  2⤵
  PID:8268
- C:\Windows\System\edJaKzy.exe
  C:\Windows\System\edJaKzy.exe
  2⤵
  PID:8240
- C:\Windows\System\JUXHuwu.exe
  C:\Windows\System\JUXHuwu.exe
  2⤵
  PID:8332
- C:\Windows\System\saoajAq.exe
  C:\Windows\System\saoajAq.exe
  2⤵
  PID:8380
- C:\Windows\System\fnogVYJ.exe
  C:\Windows\System\fnogVYJ.exe
  2⤵
  PID:8368
- C:\Windows\System\hWBVwiM.exe
  C:\Windows\System\hWBVwiM.exe
  2⤵
  PID:8444
- C:\Windows\System\ceDMFiV.exe
  C:\Windows\System\ceDMFiV.exe
  2⤵
  PID:8428
- C:\Windows\System\oEtnOLT.exe
  C:\Windows\System\oEtnOLT.exe
  2⤵
  PID:8540
- C:\Windows\System\qOYydxV.exe
  C:\Windows\System\qOYydxV.exe
  2⤵
  PID:8496
- C:\Windows\System\ADWrnVz.exe
  C:\Windows\System\ADWrnVz.exe
  2⤵
  PID:8556
- C:\Windows\System\zfVgNXU.exe
  C:\Windows\System\zfVgNXU.exe
  2⤵
  PID:8608
- C:\Windows\System\SQchOtv.exe
  C:\Windows\System\SQchOtv.exe
  2⤵
  PID:8672
- C:\Windows\System\spXxqCo.exe
  C:\Windows\System\spXxqCo.exe
  2⤵
  PID:8660
- C:\Windows\System\yGGkqCU.exe
  C:\Windows\System\yGGkqCU.exe
  2⤵
  PID:8688
- C:\Windows\System\NcwvjQV.exe
  C:\Windows\System\NcwvjQV.exe
  2⤵
  PID:8736
- C:\Windows\System\RWskhjy.exe
  C:\Windows\System\RWskhjy.exe
  2⤵
  PID:8724
- C:\Windows\System\kYiSSZi.exe
  C:\Windows\System\kYiSSZi.exe
  2⤵
  PID:8832
- C:\Windows\System\iljKpKP.exe
  C:\Windows\System\iljKpKP.exe
  2⤵
  PID:8896
- C:\Windows\System\NVMcCGp.exe
  C:\Windows\System\NVMcCGp.exe
  2⤵
  PID:8752
- C:\Windows\System\wAkHsan.exe
  C:\Windows\System\wAkHsan.exe
  2⤵
  PID:8848
- C:\Windows\System\EzVBMjD.exe
  C:\Windows\System\EzVBMjD.exe
  2⤵
  PID:8852
- C:\Windows\System\vIVwrha.exe
  C:\Windows\System\vIVwrha.exe
  2⤵
  PID:8916
- C:\Windows\System\FxYVUKE.exe
  C:\Windows\System\FxYVUKE.exe
  2⤵
  PID:8996
- C:\Windows\System\gFFeCwf.exe
  C:\Windows\System\gFFeCwf.exe
  2⤵
  PID:9060
- C:\Windows\System\fqzAAmH.exe
  C:\Windows\System\fqzAAmH.exe
  2⤵
  PID:9120
- C:\Windows\System\pHBRvQn.exe
  C:\Windows\System\pHBRvQn.exe
  2⤵
  PID:8980
- C:\Windows\System\ZHktVAQ.exe
  C:\Windows\System\ZHktVAQ.exe
  2⤵
  PID:8948
- C:\Windows\System\NtyFLPh.exe
  C:\Windows\System\NtyFLPh.exe
  2⤵
  PID:9072
- C:\Windows\System\qqlUGtq.exe
  C:\Windows\System\qqlUGtq.exe
  2⤵
  PID:9204
- C:\Windows\System\nYCOmDM.exe
  C:\Windows\System\nYCOmDM.exe
  2⤵
  PID:9108
- C:\Windows\System\IRWWwdV.exe
  C:\Windows\System\IRWWwdV.exe
  2⤵
  PID:7584
- C:\Windows\System\rqdsmoM.exe
  C:\Windows\System\rqdsmoM.exe
  2⤵
  PID:8256
- C:\Windows\System\hKixuXh.exe
  C:\Windows\System\hKixuXh.exe
  2⤵
  PID:8348
- C:\Windows\System\LenawHd.exe
  C:\Windows\System\LenawHd.exe
  2⤵
  PID:8508
- C:\Windows\System\lVrmTKf.exe
  C:\Windows\System\lVrmTKf.exe
  2⤵
  PID:8640
- C:\Windows\System\hGwXyzh.exe
  C:\Windows\System\hGwXyzh.exe
  2⤵
  PID:8288
- C:\Windows\System\ghhgqYE.exe
  C:\Windows\System\ghhgqYE.exe
  2⤵
  PID:8464
- C:\Windows\System\GhNRqZj.exe
  C:\Windows\System\GhNRqZj.exe
  2⤵
  PID:8412
- C:\Windows\System\cMeizON.exe
  C:\Windows\System\cMeizON.exe
  2⤵
  PID:8704
- C:\Windows\System\NMyvuwI.exe
  C:\Windows\System\NMyvuwI.exe
  2⤵
  PID:8624
- C:\Windows\System\hNKKHsr.exe
  C:\Windows\System\hNKKHsr.exe
  2⤵
  PID:8720
- C:\Windows\System\BLOJlzB.exe
  C:\Windows\System\BLOJlzB.exe
  2⤵
  PID:9028
- C:\Windows\System\TEQmEVo.exe
  C:\Windows\System\TEQmEVo.exe
  2⤵
  PID:9156
- C:\Windows\System\bRfSTBY.exe
  C:\Windows\System\bRfSTBY.exe
  2⤵
  PID:9104
- C:\Windows\System\xICsHFz.exe
  C:\Windows\System\xICsHFz.exe
  2⤵
  PID:8816
- C:\Windows\System\kzfnHjQ.exe
  C:\Windows\System\kzfnHjQ.exe
  2⤵
  PID:8944
- C:\Windows\System\QRgdEpz.exe
  C:\Windows\System\QRgdEpz.exe
  2⤵
  PID:9172
- C:\Windows\System\BzdpJTL.exe
  C:\Windows\System\BzdpJTL.exe
  2⤵
  PID:9200
- C:\Windows\System\iMDdrsL.exe
  C:\Windows\System\iMDdrsL.exe
  2⤵
  PID:8628
- C:\Windows\System\yyXZQYK.exe
  C:\Windows\System\yyXZQYK.exe
  2⤵
  PID:8576
- C:\Windows\System\AQvFAzY.exe
  C:\Windows\System\AQvFAzY.exe
  2⤵
  PID:8284
- C:\Windows\System\HPiuSxr.exe
  C:\Windows\System\HPiuSxr.exe
  2⤵
  PID:8524
- C:\Windows\System\nqrEskl.exe
  C:\Windows\System\nqrEskl.exe
  2⤵
  PID:8708
- C:\Windows\System\iKqnTkN.exe
  C:\Windows\System\iKqnTkN.exe
  2⤵
  PID:9152
- C:\Windows\System\YzngZCX.exe
  C:\Windows\System\YzngZCX.exe
  2⤵
  PID:8252
- C:\Windows\System\uDhBNIi.exe
  C:\Windows\System\uDhBNIi.exe
  2⤵
  PID:9168
- C:\Windows\System\BrNdfjt.exe
  C:\Windows\System\BrNdfjt.exe
  2⤵
  PID:9044
- C:\Windows\System\aaETTFX.exe
  C:\Windows\System\aaETTFX.exe
  2⤵
  PID:8932
- C:\Windows\System\BWyPZAS.exe
  C:\Windows\System\BWyPZAS.exe
  2⤵
  PID:9228
- C:\Windows\System\bMFrLIC.exe
  C:\Windows\System\bMFrLIC.exe
  2⤵
  PID:9244
- C:\Windows\System\VUcHefo.exe
  C:\Windows\System\VUcHefo.exe
  2⤵
  PID:9260
- C:\Windows\System\ZJfddhz.exe
  C:\Windows\System\ZJfddhz.exe
  2⤵
  PID:9276
- C:\Windows\System\EGGqEbt.exe
  C:\Windows\System\EGGqEbt.exe
  2⤵
  PID:9292
- C:\Windows\System\BUenJSA.exe
  C:\Windows\System\BUenJSA.exe
  2⤵
  PID:9308
- C:\Windows\System\FjAYOQD.exe
  C:\Windows\System\FjAYOQD.exe
  2⤵
  PID:9324
- C:\Windows\System\DRGYgni.exe
  C:\Windows\System\DRGYgni.exe
  2⤵
  PID:9340
- C:\Windows\System\MoqmmPm.exe
  C:\Windows\System\MoqmmPm.exe
  2⤵
  PID:9356
- C:\Windows\System\YfjIdPZ.exe
  C:\Windows\System\YfjIdPZ.exe
  2⤵
  PID:9372
- C:\Windows\System\OUuBFeV.exe
  C:\Windows\System\OUuBFeV.exe
  2⤵
  PID:9388
- C:\Windows\System\PTZsDVX.exe
  C:\Windows\System\PTZsDVX.exe
  2⤵
  PID:9404
- C:\Windows\System\ynUsJMp.exe
  C:\Windows\System\ynUsJMp.exe
  2⤵
  PID:9420
- C:\Windows\System\OLpRSFo.exe
  C:\Windows\System\OLpRSFo.exe
  2⤵
  PID:9436
- C:\Windows\System\dLGLSKv.exe
  C:\Windows\System\dLGLSKv.exe
  2⤵
  PID:9452
- C:\Windows\System\LGhZgsE.exe
  C:\Windows\System\LGhZgsE.exe
  2⤵
  PID:9472
- C:\Windows\System\rFYymfG.exe
  C:\Windows\System\rFYymfG.exe
  2⤵
  PID:9488
- C:\Windows\System\kDnrILF.exe
  C:\Windows\System\kDnrILF.exe
  2⤵
  PID:9504
- C:\Windows\System\hsofBdH.exe
  C:\Windows\System\hsofBdH.exe
  2⤵
  PID:9520
- C:\Windows\System\SdWKoWn.exe
  C:\Windows\System\SdWKoWn.exe
  2⤵
  PID:9536
- C:\Windows\System\SfAIXUr.exe
  C:\Windows\System\SfAIXUr.exe
  2⤵
  PID:9552
- C:\Windows\System\ERpSTGT.exe
  C:\Windows\System\ERpSTGT.exe
  2⤵
  PID:9568
- C:\Windows\System\lAFEfJs.exe
  C:\Windows\System\lAFEfJs.exe
  2⤵
  PID:9584
- C:\Windows\System\VwmrMGX.exe
  C:\Windows\System\VwmrMGX.exe
  2⤵
  PID:9600
- C:\Windows\System\sNQmllU.exe
  C:\Windows\System\sNQmllU.exe
  2⤵
  PID:9616
- C:\Windows\System\aacJerl.exe
  C:\Windows\System\aacJerl.exe
  2⤵
  PID:9632
- C:\Windows\System\BoGWFew.exe
  C:\Windows\System\BoGWFew.exe
  2⤵
  PID:9648
- C:\Windows\System\KOWTdCR.exe
  C:\Windows\System\KOWTdCR.exe
  2⤵
  PID:9664
- C:\Windows\System\DPoxGSu.exe
  C:\Windows\System\DPoxGSu.exe
  2⤵
  PID:9680
- C:\Windows\System\ildgAhS.exe
  C:\Windows\System\ildgAhS.exe
  2⤵
  PID:9696
- C:\Windows\System\HnqVVcx.exe
  C:\Windows\System\HnqVVcx.exe
  2⤵
  PID:9712
- C:\Windows\System\CXzChBO.exe
  C:\Windows\System\CXzChBO.exe
  2⤵
  PID:9728
- C:\Windows\System\GCrrOqe.exe
  C:\Windows\System\GCrrOqe.exe
  2⤵
  PID:9744
- C:\Windows\System\UJFqfVd.exe
  C:\Windows\System\UJFqfVd.exe
  2⤵
  PID:9760
- C:\Windows\System\wMsoGsJ.exe
  C:\Windows\System\wMsoGsJ.exe
  2⤵
  PID:9776
- C:\Windows\System\ZJIhxOY.exe
  C:\Windows\System\ZJIhxOY.exe
  2⤵
  PID:9792
- C:\Windows\System\qubQYYe.exe
  C:\Windows\System\qubQYYe.exe
  2⤵
  PID:9808
- C:\Windows\System\ctRlUoJ.exe
  C:\Windows\System\ctRlUoJ.exe
  2⤵
  PID:9824
- C:\Windows\System\vCdOXQe.exe
  C:\Windows\System\vCdOXQe.exe
  2⤵
  PID:9840
- C:\Windows\System\RrunghX.exe
  C:\Windows\System\RrunghX.exe
  2⤵
  PID:9856
- C:\Windows\System\ODJoqLn.exe
  C:\Windows\System\ODJoqLn.exe
  2⤵
  PID:9872
- C:\Windows\System\WKzXhvO.exe
  C:\Windows\System\WKzXhvO.exe
  2⤵
  PID:9888
- C:\Windows\System\ipfWubt.exe
  C:\Windows\System\ipfWubt.exe
  2⤵
  PID:9904
- C:\Windows\System\MqNXuxv.exe
  C:\Windows\System\MqNXuxv.exe
  2⤵
  PID:9920
- C:\Windows\System\iiIGcTL.exe
  C:\Windows\System\iiIGcTL.exe
  2⤵
  PID:9936
- C:\Windows\System\BYAgoZL.exe
  C:\Windows\System\BYAgoZL.exe
  2⤵
  PID:9952
- C:\Windows\System\wSURWqv.exe
  C:\Windows\System\wSURWqv.exe
  2⤵
  PID:9968
- C:\Windows\System\yNFLSOD.exe
  C:\Windows\System\yNFLSOD.exe
  2⤵
  PID:9984
- C:\Windows\System\fRUGzOv.exe
  C:\Windows\System\fRUGzOv.exe
  2⤵
  PID:10000
- C:\Windows\System\zuYAIiB.exe
  C:\Windows\System\zuYAIiB.exe
  2⤵
  PID:10016
- C:\Windows\System\rTZNNmA.exe
  C:\Windows\System\rTZNNmA.exe
  2⤵
  PID:10032
- C:\Windows\System\SgWJobO.exe
  C:\Windows\System\SgWJobO.exe
  2⤵
  PID:10048
- C:\Windows\System\oOIcFxm.exe
  C:\Windows\System\oOIcFxm.exe
  2⤵
  PID:10064
- C:\Windows\System\SQhvmiQ.exe
  C:\Windows\System\SQhvmiQ.exe
  2⤵
  PID:10080
- C:\Windows\System\KeQXPrQ.exe
  C:\Windows\System\KeQXPrQ.exe
  2⤵
  PID:10096
- C:\Windows\System\SCgBgxZ.exe
  C:\Windows\System\SCgBgxZ.exe
  2⤵
  PID:10112
- C:\Windows\System\dmqbtNn.exe
  C:\Windows\System\dmqbtNn.exe
  2⤵
  PID:10128
- C:\Windows\System\JAvTBGr.exe
  C:\Windows\System\JAvTBGr.exe
  2⤵
  PID:10144
- C:\Windows\System\szwyhcb.exe
  C:\Windows\System\szwyhcb.exe
  2⤵
  PID:10160
- C:\Windows\System\sRItnqW.exe
  C:\Windows\System\sRItnqW.exe
  2⤵
  PID:10176
- C:\Windows\System\SyBUpdI.exe
  C:\Windows\System\SyBUpdI.exe
  2⤵
  PID:10192
- C:\Windows\System\JIrDhOY.exe
  C:\Windows\System\JIrDhOY.exe
  2⤵
  PID:10208
- C:\Windows\System\BcEsZdc.exe
  C:\Windows\System\BcEsZdc.exe
  2⤵
  PID:10224
- C:\Windows\System\aUuhBee.exe
  C:\Windows\System\aUuhBee.exe
  2⤵
  PID:8112
- C:\Windows\System\WgLwkfm.exe
  C:\Windows\System\WgLwkfm.exe
  2⤵
  PID:9236
- C:\Windows\System\ApXkGmi.exe
  C:\Windows\System\ApXkGmi.exe
  2⤵
  PID:9268
- C:\Windows\System\AWhaYIh.exe
  C:\Windows\System\AWhaYIh.exe
  2⤵
  PID:9336
- C:\Windows\System\NkEYqPq.exe
  C:\Windows\System\NkEYqPq.exe
  2⤵
  PID:9400
- C:\Windows\System\FSjqDSU.exe
  C:\Windows\System\FSjqDSU.exe
  2⤵
  PID:9224
- C:\Windows\System\dlxpwBO.exe
  C:\Windows\System\dlxpwBO.exe
  2⤵
  PID:8592
- C:\Windows\System\pZVphIj.exe
  C:\Windows\System\pZVphIj.exe
  2⤵
  PID:9256
- C:\Windows\System\eGvBrTI.exe
  C:\Windows\System\eGvBrTI.exe
  2⤵
  PID:9316
- C:\Windows\System\UQzVcTB.exe
  C:\Windows\System\UQzVcTB.exe
  2⤵
  PID:9380
- C:\Windows\System\ZvbnmAT.exe
  C:\Windows\System\ZvbnmAT.exe
  2⤵
  PID:9444
- C:\Windows\System\iUAZdsW.exe
  C:\Windows\System\iUAZdsW.exe
  2⤵
  PID:9512
- C:\Windows\System\xJaIjee.exe
  C:\Windows\System\xJaIjee.exe
  2⤵
  PID:9564
- C:\Windows\System\BKDXBii.exe
  C:\Windows\System\BKDXBii.exe
  2⤵
  PID:9592
- C:\Windows\System\jHABiHy.exe
  C:\Windows\System\jHABiHy.exe
  2⤵
  PID:9624
- C:\Windows\System\cHxwqcv.exe
  C:\Windows\System\cHxwqcv.exe
  2⤵
  PID:9688
- C:\Windows\System\nXLQVMW.exe
  C:\Windows\System\nXLQVMW.exe
  2⤵
  PID:9608
- C:\Windows\System\DGHhKFr.exe
  C:\Windows\System\DGHhKFr.exe
  2⤵
  PID:9784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AOYDqbu.exe

Filesize
2.1MB

MD5
5227519bd24bfdb8033ffeb03767d2b8

SHA1
a2b06298198eb7d8e45e3ef13246fb70d943248d

SHA256
d1844c37ffc5933e393d4e8da297b3acde5455da117853c7a4c8b02b65e632c4

SHA512
d5a54b24b1f69bf1e2abc3755c843e855c7a9cbf7fe8ed2baa1817e8c64e70490c5f72f21d6b7fc22df7323c499f5dad6bb37d06b6d842d5177925b9c5ea10d4

Download Submit
C:\Windows\system\BKHzmic.exe

Filesize
8B

MD5
30a9dfceb37577cb23b97b50ee0ca790

SHA1
b56360a546aafbfa7ce003cd05916a7ab7239259

SHA256
44dda0d0cfe87b066fcb3ae3e2b0cbc86f86ca0fdd14c7ce736c7a63fedce1f4

SHA512
f1ae1743e6029aabc9e7387b476be46b30f000874bca6e0907b605cfb329a40abfc7d4eb3d891027c469be0356b370267e0531be7c50ab8183a5aad8ce1cbe57

Download Submit
C:\Windows\system\BTMKoOA.exe

Filesize
2.1MB

MD5
f30e9e7e4f6bbb0ab3e36d6430707c0b

SHA1
5d0cbd91df1bf29a3ab3d6f829a78072ea26e1f3

SHA256
15ed9cd4d01d6f2afe40d954c2a1c1a0078d1af9fa5791fbbb029b88604dd4cb

SHA512
423cb8c09797858f5fe350a0635449ce74e3c45751410c4884a109d1413e55424bebc29cffe0252a1a352aaed50ba9d14d705c247df3aac9d8b213ab0b5e206f

Download Submit
C:\Windows\system\EyKlLox.exe

Filesize
2.1MB

MD5
36d23b7630d39d254715c2a07cc48be1

SHA1
d52408f714695d0c416860e93a98f1155bb151c4

SHA256
4fdc58101ec8c2605a015edfdc92a13a9f9cb0c2af18e66fe0fcb134ec574070

SHA512
ca351e14b72d9d8575819068ac911a5e39d80095f31393061be27e53cd3247db21057113d7ee0096136a90aeec8b9652e5a149704ad4f95f7028ee643c2d2ec8

Download Submit
C:\Windows\system\JCLrPui.exe

Filesize
2.1MB

MD5
476048ed1a98a5bf21a49e6f2217336f

SHA1
177f053f36f487fb3c20e5dfd0a6e748ea12a647

SHA256
62c7f9a0d2160eba9f3e5ccc2b5bf44e07da02dbcf929064391ea0b2f5f45c21

SHA512
06c7a1b79fbeb47b4071009b50d61bdb9b8a97b2834f2e62d5304515db6548f662c25ff4ce650b83e7e21e7574ec8452eabc1915180ebf801a419845bf71810e

Download Submit
C:\Windows\system\KkdqEbN.exe

Filesize
2.1MB

MD5
17a72666c97d735d73aeb464f4a734bd

SHA1
6cd59d359a16aa4729f171dfca5f52ec89ac6d1d

SHA256
a5fabf0bd6d6ed446d249fceda2da609714b1dcfcb3e33c0778b34364d28aa66

SHA512
0e98e27f375518f622cb84ccc34955920463293ce2462f83a07f944dce85806b2d3a1b13b5d271caf8fb59854beb141e862dc8b941e33712f10687e5cda788ca

Download Submit
C:\Windows\system\OChJZBc.exe

Filesize
2.1MB

MD5
6adaf1ed4eb61523ee04ad5307d794bd

SHA1
5ef2147d4860bcaf7e3382431e75269fae47fe87

SHA256
bf402eb680d85c4159cd0b078da586b72cab1660694daf4d73e0b9f2c0526c45

SHA512
41598b2f78691cbec7f116de1c8558e5fed8be3f9df419f0b48d8121e8529c2c4936113cf41b904f1f0f5c6a533f39dddd104c2912a0314905063e3e6fca0502

Download Submit
C:\Windows\system\RxEfTYT.exe

Filesize
2.1MB

MD5
d090e8dbd10dbf9a6e4d94fadfa2d6c4

SHA1
dd7231d4c83c6b49e54a14f3b9a100867735eeee

SHA256
ea947bf9278060ba0157d9c842b6fb0967ca71a7a30de34c077120dbcfb7f979

SHA512
f72d2c7e5c967caae745174cd47c473e5ce533ab9fbd64701db03e895fec688e83fee9f59a1d6602f590b35fa894d11a57201fe17edd0a716ae07955306f6703

Download Submit
C:\Windows\system\WsnpJfQ.exe

Filesize
2.1MB

MD5
6459e62fa56e0e6cbf99043773e87758

SHA1
9fb454cb51dba596a3b640524c735f09b7a3fa72

SHA256
a132ddf4bfa61b570c310cca9d2f32738000c32b8122ef3c773f3346ad9ba169

SHA512
a0ac5eb1b2702a1abb51ff2c6b4aca45b33a272aa22596a7bde773fcc09580a0b3a0d9debbf737ff6db87edb6bf386a4063e6193ac7f5e54ecc2c341af25ae14

Download Submit
C:\Windows\system\bYGXATe.exe

Filesize
2.1MB

MD5
7aad7959e10c9712bf61f5162244d7c4

SHA1
073eab031eea0280e23c4e2e6de97996ce688791

SHA256
3644a8d4134c39b678c338d50d02228ddb0a89e85ca9092d707cb58adb6114df

SHA512
3682a3839e9b704b256d5256a901806e898f42753d677f50604eca816148af2a1e7579ea82b013fad9ee8fe1651bdac035f62209f3e6ec8ac1b967dbd809576d

Download Submit
C:\Windows\system\cRHMBID.exe

Filesize
2.1MB

MD5
94d14e47a2aaf3c8927a5eedca2dc7a0

SHA1
996d66bd15f3546b04cdf69712d3bb5a72ef8def

SHA256
1fae45dbb52b19c75fb77a33e73ef1185bee3b909b17e599c240c2fd7ef69a5f

SHA512
d6c8ca0e781ccaab4059827c7ed2e4d482bb7681acbf9611370fbf7b8dcf83dcdb6109df8ae46095051c88e69bf7529d466f8de4c503fe46ca8da135c6b4454a

Download Submit
C:\Windows\system\ctYHsgL.exe

Filesize
2.1MB

MD5
4d6ab942a8e7649511229b491b890ab4

SHA1
77d84894c21c1d8fe0a6fcbc959fee630bc09d0d

SHA256
cb1c67cf04404612b89aa34b2063028228dbc4bd9ff14cefe6a707b6a06d2f80

SHA512
75c14b40357f17f97fc1d5b5a8faca8b2d2bce7daed1a68e26635f6f9820066306a7411ff4e38bc869618aa46508bb24d6862e483ae84324749874effffc9a2d

Download Submit
C:\Windows\system\dTfCvpt.exe

Filesize
2.1MB

MD5
db357624bfd3d823a2b44163603f2238

SHA1
5887474670a416146c5964147bd7624f73c64df7

SHA256
e3f9785b1e549141fd107fd3bc532044471b3b6c81335c2080ac1d71de872f6e

SHA512
2028f93fc5619cc83bdf60495dda769f80b99ecf29ed49f1f779996e692582c4d5a43e6cb2bc6a8dd8cd5a118ceafbff676a1f17211a89db91cd1c2f72e4e797

Download Submit
C:\Windows\system\eSxFmVI.exe

Filesize
2.1MB

MD5
10a1ab23d2ed7f94b46909a279ddd2c2

SHA1
9b16cd32791898b8a926530a6802bf75b6064c50

SHA256
537017fa92460876b56b560f822ee96fb94aeaffd3e675755fc5c16a7ca06944

SHA512
bae02ad6b46c1d385fabb96abb3ee453fd51d0c3f4961526bb908c75ca6fc5142201aa7e8fbc40b083419ad3d2a3f587246aa53ac82b4cc27f7798212b4a9849

Download Submit
C:\Windows\system\mlcJcZe.exe

Filesize
2.1MB

MD5
9144f3baf557e949646e40c4bb9bba9d

SHA1
ead7bc1e5355a7d742dfa21b7ca99f4737797804

SHA256
a8f55f9575a6c76bc64cdb73d17413020253ae27ea89cd68a6cd55a94d145f0d

SHA512
e5f372f00f3b3ba5f3ff97b0774457b0ef8162ef91d6fd64ac192e38457204a608664b0b88cb645f43de61e17bea2f0194cad92da30b81560fe290ee94918bde

Download Submit
C:\Windows\system\myQEifY.exe

Filesize
2.1MB

MD5
7bb7112e31c4a4cfe7b665626fb20ec1

SHA1
ef8632526c79a0474cadbea5163da67c243a7872

SHA256
5cee1911b64c4ca9988bd7f286c5d89b1760242a80818097794dbe7846c605a7

SHA512
5f81b2b21b052800caa10da4a6d4d213cb757148886da364198a8c553286ee8f5edf4046eb5129a17d0afdac670c211d29416f89ee4289bcf601d3ea640426f5

Download Submit
C:\Windows\system\rulkmkW.exe

Filesize
2.1MB

MD5
ade16288c3c3744643a5b4297f26deaf

SHA1
dec5b1ad40e51afc671630ae67231bd55863027e

SHA256
0df8c3b85b962123574dee29ac9a158ca7ac65617840c6d352a46de6360388a7

SHA512
d7ef36dcb8dd2d65c3f519501838723343960b6c39aa40bb66df5fef66702ab86b09d672604c869c65e2d97f1fde286ce4a0d1c59c3f0b7d4270ecf2457c1824

Download Submit
C:\Windows\system\sinVLCn.exe

Filesize
2.1MB

MD5
d4da50f2047ff05855ed60be65885d7c

SHA1
302d26ed31dbd1eef0160a8d590eb37200f7bda7

SHA256
b08149928f04b4e44286546ac603f982fc810cb66c05dd0b7249f7a3a64b16b2

SHA512
7664e7f245d71878f055a7b6d6a491916087a1e809658515bf59f48dc01a64f60b846d9c2119091b58fdf1f56efba730e5ad147d5c3bbfa88d1ca425c7c07362

Download Submit
C:\Windows\system\vWrroFd.exe

Filesize
2.1MB

MD5
98263f8dc25cb03b6a2a854c3c24b25c

SHA1
c04770b77ed6b444d6b9b86a91b5d9ca6d3f88fc

SHA256
19c95c5ff724c7e393f67243957f90e1e3e7fa36ba46f8aa2082849950ad38fd

SHA512
f5d006f9529a1f98b0151470531c654db51a0be4cdb5265f914909dbb9e43f841e896ebb19001d97a427ef51c52649d12561b1da46a44585b95065f5be16c3fc

Download Submit
\Windows\system\BbZHbpj.exe

Filesize
2.1MB

MD5
d9a825efc455580e6161c1cbd5030110

SHA1
44b519137752d5a62a32d0c14fabfd4464fa0429

SHA256
f9896f050f4a93c6ef5e0c553b61b198733aaefd1369ce224d698969dd15244c

SHA512
ffb6d1403a94a84f61f970a52e1d4e8820ff1fe5bb65b363b357c778ffc389240a6593abd72098918ea5d94390fc5bf16af2fd6c190060b271ee17fb8371d5a8

Download Submit
\Windows\system\CiUAPDz.exe

Filesize
2.1MB

MD5
fd36381bb61573a82781c4030cc965c9

SHA1
b0c261769950e4e9dae13853667dcd4445326368

SHA256
e34f1003a932a4bebd2284cf058f158727c02cebbf1cb2bf787476c48c4bb419

SHA512
d56c7d743efe4ab48cf1a5f44367c69584874c0e27f22822c34c137f97ad6b7353bb91d0cc9fad3c0c3202a661843dea8a09b086f04b37256e66d788f373c749

Download Submit
\Windows\system\FUPFzUp.exe

Filesize
2.1MB

MD5
61135776fb82ff65917c905a10393e00

SHA1
e6dbcf92717c4ca43419e43c99051917a37a6cbb

SHA256
cfd0392ac39705f63d37c546b9b33cd5fdf3108a4783596045b818d981097a64

SHA512
3500cd3bf8b8927f7e8b3beb6477a17400a7aaeab8108df7942466ce71e07355169012842399500ba2474c3a1416d129e7f882dc99a6b62c2a84f7ea3e7b3fdd

Download Submit
\Windows\system\FcpYWMA.exe

Filesize
2.1MB

MD5
f14f95331a4b5e464d74a893b3414fe3

SHA1
8a42f1b21d39267216d97a90aeb8f9af199ca012

SHA256
d1af7521d6e421555ff7fba68e15ab701a9850e3d3438026e36d0e6d7794c85a

SHA512
88f0e8c558c4544b20c19e0054368dd73271417faa03cb37f9fe7ee4d32a6529c62f22afcaa8111cba4dfdf59ef44bb26f61d2255cf96c960b132669e32a8749

Download Submit
\Windows\system\FwkxfpY.exe

Filesize
2.1MB

MD5
1439386eda3cb43c19497e6024c93768

SHA1
8a417d6fc5169b22a05dc722ffd71b0ff486cf52

SHA256
fcb8e91ec7ec90260aaed5557f36327d871e481d31f896aed942c71d30c3e743

SHA512
7f68903650af267655fc1adbe8225aded41b169e92bcc8948eeb5e36b1793be1da92520a7935f5e01bcd7ec52c8f12a5e5dd10a5974aefd6f1f4048aca859bd6

Download Submit
\Windows\system\JtxniIi.exe

Filesize
2.1MB

MD5
a98c5ad8d0bf8df43a0da717d80c3af7

SHA1
5b67ff1a4cb692bf2644e3b0a996eb1962eb18cc

SHA256
a41163c3257cc7b4556b86c10f12d0095b8f5baa5627f8f5b828ca9a2c277745

SHA512
39cae809479d527200671d5fc39e84b12574046dc2251990daa35eaae15272f21e13e740708c31280b08601ec43d2f8df36b249d4ae5dea0a37c549eaeb271b9

Download Submit
\Windows\system\MDehdoy.exe

Filesize
2.1MB

MD5
8d6f174bdfda491a708d3517398663e3

SHA1
ad498937b9fe2a638c8bf8a890711a234aaca248

SHA256
fd7523531621247a2770396e30b700ac850ae38e8824039497ffe2f81d7efd78

SHA512
131d444037a4099d967413fed9739b022cd343b4d410807eea53995d62f55b06f6ed2498b93a01caf5d401321e420ec467f3255bb60717d7b61cdf21b6aab5f1

Download Submit
\Windows\system\OLJzPdg.exe

Filesize
2.1MB

MD5
8fa55c33a9d1e4b9c91f10cb83a0886c

SHA1
5612f953d58649a81d595aa6a46fa9bc26ccc16d

SHA256
976b9b1d1d7a6c499db9d160628a9f8003cee6419553d34d6e90c73d664791dc

SHA512
dcbbd0e511e019e8670de4b18977eff301bd95617b56353eba041ef2738efe8ce4e82c29b740700ad55e82cabeacd068093edb36a323acd9a441d323c1a13549

Download Submit
\Windows\system\ZEjjhMe.exe

Filesize
2.1MB

MD5
8f2bfdf2ff1b8e92722ecffe38fcb21d

SHA1
1fbb561a3a89e803d671e6652147ab88c3cce85e

SHA256
0bb90645ab76b474ff9682825c0de0ff16f681f873cbebb9696d9767dfe3a1f1

SHA512
f90ce3edf4c1ccba143d63a2f8096fcebb3e1e05af8d3e9ce2adcedfe8f6eb846b49629e784ef055d42bb20b2efb5613329e173b8a117873c49ee846712ffb1e

Download Submit
\Windows\system\dduCsql.exe

Filesize
2.1MB

MD5
b806037bbbf7002d7de1413c5080f832

SHA1
4af4e80c4a88147647e5b4df77e805f5c07b1d64

SHA256
afd90bd16c1ba2966e99c4852e12e10210662fd86a603ab39eb4c15da229e95e

SHA512
c504499b31c3638c2c9e997432cabaa08dfbffdb626f68731ae2f4f00970d207f0fbd8f1cd2c10166c3529f4304f67e97bc59632dce4ad6e233401e790964667

Download Submit
\Windows\system\gEPERiP.exe

Filesize
2.1MB

MD5
d825f33674fd6d1e895233f5c2812828

SHA1
7677b699cb0f18289c21c15469d018d090738538

SHA256
f7cfee6399430e73a899798afdb9e0e04a0b9932ecefaef8d8e9edfff285d2b6

SHA512
21e35b0ed9a42d70aa84ab5a8c9bf9816fa208149acaac4df28b173e16cd3fb8c2dee1982a953176ee547f06568c482d52d515234803a3c96067a9976622fd5a

Download Submit
\Windows\system\jQlXrjb.exe

Filesize
2.1MB

MD5
3177ef4f5c670a444f68d63f53c5c870

SHA1
760dc839851e735a941caa99b847857a32b1b833

SHA256
5a4984da4afa8764687b2a05d707537a4ea40b0eec621f66f7fc0c02b981b6de

SHA512
20c9ecaaf63bc28be6fef2f9c1dbc7aa7eaf815de52134720e4fe42897cdf6fb34434d4c5218f86c8584355a370231b1596ea4d8b5428920cd4db0a975101603

Download Submit
\Windows\system\jiLZJSf.exe

Filesize
2.1MB

MD5
906cbbf69d1f4919c51fae6561e3f0c9

SHA1
f23a85ce441f5052e813af14ba5e63025be53da9

SHA256
25f3960bbc25141332a6b7db2446249761bdfe42c6e813bf2194fd9ba9d55a38

SHA512
6f749da3d173fc6d8ee475f8a2a24907d93fdeaefe596d997b4462446da36695f59e5f7026045a54c75382183fc69ada1830ad21d805558f4630720e3e810ad7

Download Submit
\Windows\system\lrHZOoj.exe

Filesize
2.1MB

MD5
19b040d3fd6348967627286904573c22

SHA1
ed63e61159039bd9e2a7245aa02484592586ab4a

SHA256
e0a0201d34359d74df27198ceb5254926de2fb7b360907710065e139cd7be95f

SHA512
9a9d687e537dc71a1c457412eb1658b2e75af421a52cbb2e0cc73dc6f59ecf9e8c3eef05ed0c2fb3f7c358e98f66ec526ec537d8281732e3f51381f6d0dfd91f

Download Submit
\Windows\system\mPCbQoH.exe

Filesize
2.1MB

MD5
36de526c8537ab56b06fabb49a572647

SHA1
8bba8959a6f41a5b267e52a7230d10b7fc60e676

SHA256
7a63f65a11051128b199d358e2e722846a093fbe20168f259cb5ee2ea9d7bd3a

SHA512
5d96565cc7ac31f163fc9136a49f5babdff94adc589677f6341449a1d7ed8c4b9e26f349547bf84c8b845dcbd2eaeb2408687bdf1483713d54cb584d5e27233c

Download Submit
\Windows\system\mtaQDYh.exe

Filesize
2.1MB

MD5
c5132160ba0489f15be4d0d784ba3728

SHA1
1a583a2931d20a76cc7465cdeece3ada4c995e1d

SHA256
96bb421725c23cc2a981797cb62f84a2fa1af78edd3faf844f203510c583a395

SHA512
bd5cb2f7ce82a776de3fc91ee4ffd83e100de4ba9e0261e67982d8fae4d46d0e54e3f0c35899248a3079fdd3ff1457dc603d4931e67c21acd76b3169ecd324cc

Download Submit
\Windows\system\uVfczNk.exe

Filesize
2.1MB

MD5
3fdec6ee56ad58f7e0d74cbc1075b34e

SHA1
fafa006e0b3cc981d1a2ae2661de23834c4fd530

SHA256
c7ba30e4add33f01f7a43d3645687f1ff71cc65b1d3ac792c9922e1105fd7c64

SHA512
35282e04fad90addc9ff0a82478dcb43d6219fc4971c16ee4a1b15aefdb859883e9c6a80db273ee90b08012e7b8c7206050e474f2fbbd46ca7cfb865d4d06740

Download Submit
\Windows\system\wGdfXGb.exe

Filesize
2.1MB

MD5
3b86a6560160abd83bc28545f314d490

SHA1
32ebd333ee0ec1a0a4b7a075935efdf4b63bd402

SHA256
25a8308128c894a427833615471f746acb77190e2780ce36e6b2f421f8efbb2d

SHA512
a3f5fe6711b222ee236a9a0118d368cf3e1ce63467d2da5102908040a72732aa178a3dd4076b08a9d3f04a5c117d30d89b68a7a591411d108b2092ec7a077a25

Download Submit
\Windows\system\yYRfdou.exe

Filesize
2.1MB

MD5
b38d095a38ccf69a07878af5c88565fe

SHA1
e8e4d09553da0e612888ea9accce820029a81cf3

SHA256
5613dc0c970ac0550cc7636563d6c7d7058b7b7656b5117344a84b8a8be70276

SHA512
6712a81bf50a8e6c39f1f674cbed50d2d80e4e6d6a8cba901a5885a1be5da34ba8b533cdf35da9eecbe23190245b67ee2d3b9653645214b5e3f11f5ba4389f77

Download Submit
\Windows\system\zACzdbl.exe

Filesize
2.1MB

MD5
b9afd439f224c27d69a986cb3c6f5b50

SHA1
ad5c23c595413c8da1f4c24cc4d18cfa9011c026

SHA256
5b37b9049f6f18e5db939783148aa208a4abb23a6b2134a7a9594322ae24dc72

SHA512
7d446c8c31229bed3de582aefcce723f996180c206721be897d8bbbeaec962aadf8de2d0cbfe2eda6ceb8e9a2acab85ab78c2b66e3bf87d9ce33cde4ce9850c6

Download Submit
\Windows\system\ziNwUBJ.exe

Filesize
2.1MB

MD5
61e385c5af587d1abc0b9887bbcf9381

SHA1
95fd7d43e729606e42997d397e83ea460fcdd861

SHA256
014c94be05fd63cd979bb397b2ec9850a679d7c70e51dc60de6548db7d27ca2a

SHA512
15055efb4ab4dfc403f6ada4e9646f555d3261ca911680981f076b61467108e869a633a79ab6b3c5b85fe40a6a524590030f0fe1efa79edb0cea940e3e44dbad

Download Submit
memory/616-74-0x000000013F480000-0x000000013F872000-memory.dmp

Filesize
3.9MB

Download
memory/616-63-0x000000013FFA0000-0x0000000140392000-memory.dmp

Filesize
3.9MB

Download
memory/616-66-0x0000000003450000-0x0000000003842000-memory.dmp

Filesize
3.9MB

Download
memory/616-9935-0x000000013F890000-0x000000013FC82000-memory.dmp

Filesize
3.9MB

Download
memory/616-101-0x000000013FF50000-0x0000000140342000-memory.dmp

Filesize
3.9MB

Download
memory/616-90-0x000000013F890000-0x000000013FC82000-memory.dmp

Filesize
3.9MB

Download
memory/616-72-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/616-88-0x000000013FB50000-0x000000013FF42000-memory.dmp

Filesize
3.9MB

Download
memory/616-81-0x000000013F060000-0x000000013F452000-memory.dmp

Filesize
3.9MB

Download
memory/616-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/616-9-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/616-14-0x000000013FA80000-0x000000013FE72000-memory.dmp

Filesize
3.9MB

Download
memory/616-27-0x000000013F680000-0x000000013FA72000-memory.dmp

Filesize
3.9MB

Download
memory/616-26-0x000000013F890000-0x000000013FC82000-memory.dmp

Filesize
3.9MB

Download
memory/616-1-0x000000013F060000-0x000000013F452000-memory.dmp

Filesize
3.9MB

Download
memory/616-8357-0x0000000003450000-0x0000000003842000-memory.dmp

Filesize
3.9MB

Download
memory/616-28-0x0000000002F10000-0x0000000003302000-memory.dmp

Filesize
3.9MB

Download
memory/616-75-0x000000013F740000-0x000000013FB32000-memory.dmp

Filesize
3.9MB

Download
memory/1272-5440-0x000000013FA80000-0x000000013FE72000-memory.dmp

Filesize
3.9MB

Download
memory/1272-281-0x000000013FA80000-0x000000013FE72000-memory.dmp

Filesize
3.9MB

Download
memory/1272-16-0x000000013FA80000-0x000000013FE72000-memory.dmp

Filesize
3.9MB

Download
memory/1804-51-0x00000000002F0000-0x00000000002F8000-memory.dmp

Filesize
32KB

Download
memory/1804-42-0x000000001B670000-0x000000001B952000-memory.dmp

Filesize
2.9MB

Download
memory/2092-89-0x000000013FB50000-0x000000013FF42000-memory.dmp

Filesize
3.9MB

Download
memory/2092-6712-0x000000013FB50000-0x000000013FF42000-memory.dmp

Filesize
3.9MB

Download
memory/2224-5443-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/2224-12-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/2552-65-0x000000013F480000-0x000000013F872000-memory.dmp

Filesize
3.9MB

Download
memory/2552-5469-0x000000013F480000-0x000000013F872000-memory.dmp

Filesize
3.9MB

Download
memory/2560-5458-0x000000013F180000-0x000000013F572000-memory.dmp

Filesize
3.9MB

Download
memory/2560-70-0x000000013F180000-0x000000013F572000-memory.dmp

Filesize
3.9MB

Download
memory/2624-39-0x000000013F680000-0x000000013FA72000-memory.dmp

Filesize
3.9MB

Download
memory/2624-5439-0x000000013F680000-0x000000013FA72000-memory.dmp

Filesize
3.9MB

Download
memory/2696-5444-0x000000013F890000-0x000000013FC82000-memory.dmp

Filesize
3.9MB

Download
memory/2696-37-0x000000013F890000-0x000000013FC82000-memory.dmp

Filesize
3.9MB

Download
memory/2712-5464-0x000000013F230000-0x000000013F622000-memory.dmp

Filesize
3.9MB

Download
memory/2712-40-0x000000013F230000-0x000000013F622000-memory.dmp

Filesize
3.9MB

Download
memory/2780-5461-0x000000013FFA0000-0x0000000140392000-memory.dmp

Filesize
3.9MB

Download
memory/2780-64-0x000000013FFA0000-0x0000000140392000-memory.dmp

Filesize
3.9MB

Download
memory/2860-87-0x000000013F740000-0x000000013FB32000-memory.dmp

Filesize
3.9MB

Download
memory/2860-6708-0x000000013F740000-0x000000013FB32000-memory.dmp

Filesize
3.9MB

Download
memory/2980-73-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/2980-6709-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download