xmrig | 97f6d1b288ee6670ab9aaffa8c9b99742cd1ca80cd134cb8bd34380a79964d90

Analysis

max time kernel
150s
max time network
142s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 23:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
Size

2.0MB
MD5

8254a95f1fde7c8fe0695396d01eaafa
SHA1

a4c4980c7ab7e167f77d26a891fc6b9e8ac3a689
SHA256

97f6d1b288ee6670ab9aaffa8c9b99742cd1ca80cd134cb8bd34380a79964d90
SHA512

80ecee0d2c8d9553860228262fa5ce857d1fd682707b9dc8957f518343e83531069a82df25eb9f206f1a0d062d481699bf00a18b9d27c574513b63bc0f07d123
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMz:NABL

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 21 IoCs

miner

resource	yara_rule
behavioral1/memory/2648-42-0x000000013FCD0000-0x00000001400C2000-memory.dmp	xmrig
behavioral1/memory/3020-75-0x000000013FFC0000-0x00000001403B2000-memory.dmp	xmrig
behavioral1/memory/1688-106-0x0000000003550000-0x0000000003942000-memory.dmp	xmrig
behavioral1/memory/1688-91-0x000000013F850000-0x000000013FC42000-memory.dmp	xmrig
behavioral1/memory/2444-65-0x000000013F2A0000-0x000000013F692000-memory.dmp	xmrig
behavioral1/memory/2784-876-0x000000013FB70000-0x000000013FF62000-memory.dmp	xmrig
behavioral1/memory/2780-875-0x000000013FF30000-0x0000000140322000-memory.dmp	xmrig
behavioral1/memory/2752-40-0x000000013F730000-0x000000013FB22000-memory.dmp	xmrig
behavioral1/memory/2724-39-0x000000013F6B0000-0x000000013FAA2000-memory.dmp	xmrig
behavioral1/memory/2720-38-0x000000013FEF0000-0x00000001402E2000-memory.dmp	xmrig
behavioral1/memory/2004-37-0x000000013F900000-0x000000013FCF2000-memory.dmp	xmrig
behavioral1/memory/2664-35-0x000000013F950000-0x000000013FD42000-memory.dmp	xmrig
behavioral1/memory/2444-1167-0x000000013F2A0000-0x000000013F692000-memory.dmp	xmrig
behavioral1/memory/3020-1561-0x000000013FFC0000-0x00000001403B2000-memory.dmp	xmrig
behavioral1/memory/2004-4939-0x000000013F900000-0x000000013FCF2000-memory.dmp	xmrig
behavioral1/memory/2720-5078-0x000000013FEF0000-0x00000001402E2000-memory.dmp	xmrig
behavioral1/memory/2648-5080-0x000000013FCD0000-0x00000001400C2000-memory.dmp	xmrig
behavioral1/memory/2444-5096-0x000000013F2A0000-0x000000013F692000-memory.dmp	xmrig
behavioral1/memory/2780-5109-0x000000013FF30000-0x0000000140322000-memory.dmp	xmrig
behavioral1/memory/3020-5108-0x000000013FFC0000-0x00000001403B2000-memory.dmp	xmrig
behavioral1/memory/2844-5084-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2300	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2664	DxeGQgq.exe
2004	NKJoHUw.exe
2720	OZmPdsd.exe
2724	JyHBJNv.exe
2752	jxiITvX.exe
2648	xzceyVT.exe
2780	qjfNOkS.exe
2444	BDGaGuk.exe
2784	nYKnijs.exe
3020	bkirtee.exe
2844	KEQWQlu.exe
2892	zysyGnn.exe
1696	CYjjlfK.exe
2024	gYgSaqM.exe
1672	TMGEufw.exe
2904	LudYjqO.exe
2224	rZzHiqN.exe
840	QOFjboz.exe
2344	rlJQItA.exe
2208	FWbGHDU.exe
1940	rbPVakn.exe
2624	cdZzvVk.exe
1560	YIBPZWu.exe
2044	PIKrKFh.exe
1088	sbfGyWm.exe
1536	zoZFczX.exe
2248	eTykyrj.exe
1680	LSRMJYU.exe
1616	mxlFANY.exe
2972	iSkgxIx.exe
1712	fHnDhBq.exe
892	yesRbla.exe
1384	CmgrJBS.exe
1304	SbpehUC.exe
1328	IvyzWJi.exe
2620	NxrWNdZ.exe
2704	whdPHxo.exe
1624	JFtUpBI.exe
2436	ttYQCTA.exe
2360	VgYJrDN.exe
576	YmmLRlP.exe
2096	VTGDUgk.exe
1708	rsOcNEo.exe
2876	NYVDQxu.exe
1136	KtmWpQt.exe
2840	WbNRXoZ.exe
1512	Vnbfpko.exe
1992	OigcnSl.exe
3052	QWdLtGN.exe
1352	TPCbuzv.exe
1704	sGWBgdj.exe
848	qnwYBJF.exe
3084	eYqmvud.exe
3116	mQmrstH.exe
1780	jqhJaiF.exe
3160	icIQIBD.exe
3192	xdHaqzv.exe
1872	bGNJLzU.exe
3236	EjJQSIC.exe
3268	CBZFCFg.exe
760	WctIelX.exe
3312	ktDzGNf.exe
3344	DXMPWWb.exe
3376	yCoDeat.exe

Loads dropped DLL 64 IoCs

pid	Process
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe

UPX packed file 62 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1688-0-0x000000013F850000-0x000000013FC42000-memory.dmp	upx
behavioral1/files/0x0036000000016103-6.dat	upx
behavioral1/files/0x000a0000000120fa-3.dat	upx
behavioral1/files/0x0007000000016c56-18.dat	upx
behavioral1/files/0x0007000000016abb-15.dat	upx
behavioral1/files/0x000700000001686d-11.dat	upx
behavioral1/files/0x00080000000165a8-9.dat	upx
behavioral1/memory/2648-42-0x000000013FCD0000-0x00000001400C2000-memory.dmp	upx
behavioral1/memory/2780-51-0x000000013FF30000-0x0000000140322000-memory.dmp	upx
behavioral1/files/0x0007000000004e76-57.dat	upx
behavioral1/memory/3020-75-0x000000013FFC0000-0x00000001403B2000-memory.dmp	upx
behavioral1/files/0x0006000000018663-92.dat	upx
behavioral1/files/0x001100000001867a-99.dat	upx
behavioral1/files/0x00050000000186e6-110.dat	upx
behavioral1/files/0x0005000000019228-145.dat	upx
behavioral1/files/0x000500000001923b-155.dat	upx
behavioral1/files/0x000500000001925d-153.dat	upx
behavioral1/files/0x0006000000017477-167.dat	upx
behavioral1/files/0x0005000000019283-172.dat	upx
behavioral1/files/0x0005000000019275-164.dat	upx
behavioral1/files/0x00050000000193a5-190.dat	upx
behavioral1/files/0x0006000000017495-184.dat	upx
behavioral1/files/0x0005000000019381-180.dat	upx
behavioral1/files/0x0036000000016255-138.dat	upx
behavioral1/files/0x0005000000018787-128.dat	upx
behavioral1/files/0x0005000000018739-118.dat	upx
behavioral1/files/0x00050000000186f1-111.dat	upx
behavioral1/files/0x0005000000018686-102.dat	upx
behavioral1/files/0x0014000000018669-95.dat	upx
behavioral1/memory/1688-91-0x000000013F850000-0x000000013FC42000-memory.dmp	upx
behavioral1/files/0x0006000000017486-88.dat	upx
behavioral1/files/0x000500000001939f-189.dat	upx
behavioral1/files/0x000500000001933a-178.dat	upx
behavioral1/files/0x0007000000016eb9-72.dat	upx
behavioral1/files/0x0005000000019277-171.dat	upx
behavioral1/files/0x0005000000019260-160.dat	upx
behavioral1/memory/2784-67-0x000000013FB70000-0x000000013FF62000-memory.dmp	upx
behavioral1/memory/2444-65-0x000000013F2A0000-0x000000013F692000-memory.dmp	upx
behavioral1/files/0x0006000000018bf0-144.dat	upx
behavioral1/files/0x000500000001878d-134.dat	upx
behavioral1/memory/2784-876-0x000000013FB70000-0x000000013FF62000-memory.dmp	upx
behavioral1/memory/2780-875-0x000000013FF30000-0x0000000140322000-memory.dmp	upx
behavioral1/files/0x000500000001873f-126.dat	upx
behavioral1/files/0x00050000000186ff-116.dat	upx
behavioral1/memory/2844-79-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	upx
behavioral1/files/0x0006000000017042-78.dat	upx
behavioral1/files/0x0008000000016c7a-56.dat	upx
behavioral1/memory/2752-40-0x000000013F730000-0x000000013FB22000-memory.dmp	upx
behavioral1/memory/2724-39-0x000000013F6B0000-0x000000013FAA2000-memory.dmp	upx
behavioral1/memory/2720-38-0x000000013FEF0000-0x00000001402E2000-memory.dmp	upx
behavioral1/memory/2004-37-0x000000013F900000-0x000000013FCF2000-memory.dmp	upx
behavioral1/memory/2664-35-0x000000013F950000-0x000000013FD42000-memory.dmp	upx
behavioral1/files/0x0009000000016c71-46.dat	upx
behavioral1/memory/2444-1167-0x000000013F2A0000-0x000000013F692000-memory.dmp	upx
behavioral1/memory/3020-1561-0x000000013FFC0000-0x00000001403B2000-memory.dmp	upx
behavioral1/memory/2004-4939-0x000000013F900000-0x000000013FCF2000-memory.dmp	upx
behavioral1/memory/2720-5078-0x000000013FEF0000-0x00000001402E2000-memory.dmp	upx
behavioral1/memory/2648-5080-0x000000013FCD0000-0x00000001400C2000-memory.dmp	upx
behavioral1/memory/2444-5096-0x000000013F2A0000-0x000000013F692000-memory.dmp	upx
behavioral1/memory/2780-5109-0x000000013FF30000-0x0000000140322000-memory.dmp	upx
behavioral1/memory/3020-5108-0x000000013FFC0000-0x00000001403B2000-memory.dmp	upx
behavioral1/memory/2844-5084-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\cMtoyIr.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\MTCzJYA.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\ouHfquV.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\otjOMLC.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\jqiVxUI.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\TciZSec.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\OGZzBli.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\ECElQZf.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\CHZqwuD.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\nHUSKzh.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\jGfMoIW.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\zyIizib.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\tlxjHcL.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\LoIqFwo.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\uopflKZ.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\nGBdoqA.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\hTteQGz.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\vlPAfCo.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\OiECutt.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\WJLpOfv.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\pOrCkge.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\zMAiGFe.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\acEQjYG.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\PSmurcO.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\aISACdV.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\dlIllQL.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\ktQBAno.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\VJDIOjd.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\ULMgFim.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\uopEPPz.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\hWwKAiP.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\djuGzYG.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\JJnjcwe.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\cmoJqdo.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\gUiYEaP.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\VovdaGk.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\lWzAsIk.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\PrmWYGW.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\TVHMvEI.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\CmeRWAw.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\sBhvVaN.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\GhRhsRS.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\wwsoxXx.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\mZuTZIM.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\bTuGQZW.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\TNjjsKE.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\KBdXniR.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\sifqMFr.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\PIKrKFh.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\vfBRtmk.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\bJrAmmY.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\WWDGNUU.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\WrJPaWr.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\RWsBHiu.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\AQqdfwc.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\NAAJUzg.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\rhVjDzj.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\eaPaMap.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\kLKVfnS.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\flTktvW.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\qnwYBJF.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\vxwSOSe.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\JTxdxuL.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\JaaHyxG.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2300	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
Token: SeDebugPrivilege	2300	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2300	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	29
PID 1688 wrote to memory of 2300	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	29
PID 1688 wrote to memory of 2300	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	29
PID 1688 wrote to memory of 2004	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	30
PID 1688 wrote to memory of 2004	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	30
PID 1688 wrote to memory of 2004	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	30
PID 1688 wrote to memory of 2664	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	31
PID 1688 wrote to memory of 2664	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	31
PID 1688 wrote to memory of 2664	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	31
PID 1688 wrote to memory of 2720	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	32
PID 1688 wrote to memory of 2720	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	32
PID 1688 wrote to memory of 2720	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	32
PID 1688 wrote to memory of 2752	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	33
PID 1688 wrote to memory of 2752	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	33
PID 1688 wrote to memory of 2752	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	33
PID 1688 wrote to memory of 2724	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	34
PID 1688 wrote to memory of 2724	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	34
PID 1688 wrote to memory of 2724	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	34
PID 1688 wrote to memory of 2648	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	35
PID 1688 wrote to memory of 2648	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	35
PID 1688 wrote to memory of 2648	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	35
PID 1688 wrote to memory of 2780	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	36
PID 1688 wrote to memory of 2780	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	36
PID 1688 wrote to memory of 2780	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	36
PID 1688 wrote to memory of 2444	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	37
PID 1688 wrote to memory of 2444	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	37
PID 1688 wrote to memory of 2444	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	37
PID 1688 wrote to memory of 2784	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	38
PID 1688 wrote to memory of 2784	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	38
PID 1688 wrote to memory of 2784	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	38
PID 1688 wrote to memory of 3020	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	39
PID 1688 wrote to memory of 3020	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	39
PID 1688 wrote to memory of 3020	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	39
PID 1688 wrote to memory of 2844	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	40
PID 1688 wrote to memory of 2844	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	40
PID 1688 wrote to memory of 2844	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	40
PID 1688 wrote to memory of 2624	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	41
PID 1688 wrote to memory of 2624	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	41
PID 1688 wrote to memory of 2624	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	41
PID 1688 wrote to memory of 2892	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	42
PID 1688 wrote to memory of 2892	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	42
PID 1688 wrote to memory of 2892	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	42
PID 1688 wrote to memory of 1088	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	43
PID 1688 wrote to memory of 1088	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	43
PID 1688 wrote to memory of 1088	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	43
PID 1688 wrote to memory of 1696	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	44
PID 1688 wrote to memory of 1696	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	44
PID 1688 wrote to memory of 1696	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	44
PID 1688 wrote to memory of 2248	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	45
PID 1688 wrote to memory of 2248	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	45
PID 1688 wrote to memory of 2248	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	45
PID 1688 wrote to memory of 2024	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	46
PID 1688 wrote to memory of 2024	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	46
PID 1688 wrote to memory of 2024	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	46
PID 1688 wrote to memory of 1680	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	47
PID 1688 wrote to memory of 1680	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	47
PID 1688 wrote to memory of 1680	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	47
PID 1688 wrote to memory of 1672	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	48
PID 1688 wrote to memory of 1672	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	48
PID 1688 wrote to memory of 1672	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	48
PID 1688 wrote to memory of 1712	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	49
PID 1688 wrote to memory of 1712	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	49
PID 1688 wrote to memory of 1712	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	49
PID 1688 wrote to memory of 2904	1688	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2300
- C:\Windows\System\NKJoHUw.exe
  C:\Windows\System\NKJoHUw.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\DxeGQgq.exe
  C:\Windows\System\DxeGQgq.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\OZmPdsd.exe
  C:\Windows\System\OZmPdsd.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\jxiITvX.exe
  C:\Windows\System\jxiITvX.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\JyHBJNv.exe
  C:\Windows\System\JyHBJNv.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\xzceyVT.exe
  C:\Windows\System\xzceyVT.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\qjfNOkS.exe
  C:\Windows\System\qjfNOkS.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\BDGaGuk.exe
  C:\Windows\System\BDGaGuk.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\nYKnijs.exe
  C:\Windows\System\nYKnijs.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\bkirtee.exe
  C:\Windows\System\bkirtee.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\KEQWQlu.exe
  C:\Windows\System\KEQWQlu.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\cdZzvVk.exe
  C:\Windows\System\cdZzvVk.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\zysyGnn.exe
  C:\Windows\System\zysyGnn.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\sbfGyWm.exe
  C:\Windows\System\sbfGyWm.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\CYjjlfK.exe
  C:\Windows\System\CYjjlfK.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\eTykyrj.exe
  C:\Windows\System\eTykyrj.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\gYgSaqM.exe
  C:\Windows\System\gYgSaqM.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\LSRMJYU.exe
  C:\Windows\System\LSRMJYU.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\TMGEufw.exe
  C:\Windows\System\TMGEufw.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\fHnDhBq.exe
  C:\Windows\System\fHnDhBq.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\LudYjqO.exe
  C:\Windows\System\LudYjqO.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\CmgrJBS.exe
  C:\Windows\System\CmgrJBS.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\rZzHiqN.exe
  C:\Windows\System\rZzHiqN.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\IvyzWJi.exe
  C:\Windows\System\IvyzWJi.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\QOFjboz.exe
  C:\Windows\System\QOFjboz.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\NxrWNdZ.exe
  C:\Windows\System\NxrWNdZ.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\rlJQItA.exe
  C:\Windows\System\rlJQItA.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\whdPHxo.exe
  C:\Windows\System\whdPHxo.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\FWbGHDU.exe
  C:\Windows\System\FWbGHDU.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\ttYQCTA.exe
  C:\Windows\System\ttYQCTA.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\rbPVakn.exe
  C:\Windows\System\rbPVakn.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\YmmLRlP.exe
  C:\Windows\System\YmmLRlP.exe
  2⤵
  - Executes dropped EXE
  PID:576
- C:\Windows\System\YIBPZWu.exe
  C:\Windows\System\YIBPZWu.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\KtmWpQt.exe
  C:\Windows\System\KtmWpQt.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\PIKrKFh.exe
  C:\Windows\System\PIKrKFh.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\qnwYBJF.exe
  C:\Windows\System\qnwYBJF.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\zoZFczX.exe
  C:\Windows\System\zoZFczX.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\jqhJaiF.exe
  C:\Windows\System\jqhJaiF.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\mxlFANY.exe
  C:\Windows\System\mxlFANY.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\bGNJLzU.exe
  C:\Windows\System\bGNJLzU.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\iSkgxIx.exe
  C:\Windows\System\iSkgxIx.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\WctIelX.exe
  C:\Windows\System\WctIelX.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\yesRbla.exe
  C:\Windows\System\yesRbla.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\tzloHpz.exe
  C:\Windows\System\tzloHpz.exe
  2⤵
  PID:952
- C:\Windows\System\SbpehUC.exe
  C:\Windows\System\SbpehUC.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\NoWYmEv.exe
  C:\Windows\System\NoWYmEv.exe
  2⤵
  PID:2120
- C:\Windows\System\JFtUpBI.exe
  C:\Windows\System\JFtUpBI.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\IBGLOuv.exe
  C:\Windows\System\IBGLOuv.exe
  2⤵
  PID:1620
- C:\Windows\System\VgYJrDN.exe
  C:\Windows\System\VgYJrDN.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\RRcOjPZ.exe
  C:\Windows\System\RRcOjPZ.exe
  2⤵
  PID:540
- C:\Windows\System\VTGDUgk.exe
  C:\Windows\System\VTGDUgk.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\JxFEujA.exe
  C:\Windows\System\JxFEujA.exe
  2⤵
  PID:1608
- C:\Windows\System\rsOcNEo.exe
  C:\Windows\System\rsOcNEo.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\OgmWrFz.exe
  C:\Windows\System\OgmWrFz.exe
  2⤵
  PID:2536
- C:\Windows\System\NYVDQxu.exe
  C:\Windows\System\NYVDQxu.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\QxtxPkA.exe
  C:\Windows\System\QxtxPkA.exe
  2⤵
  PID:2556
- C:\Windows\System\WbNRXoZ.exe
  C:\Windows\System\WbNRXoZ.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\VDUmwzk.exe
  C:\Windows\System\VDUmwzk.exe
  2⤵
  PID:1868
- C:\Windows\System\Vnbfpko.exe
  C:\Windows\System\Vnbfpko.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\OqEMStE.exe
  C:\Windows\System\OqEMStE.exe
  2⤵
  PID:1260
- C:\Windows\System\OigcnSl.exe
  C:\Windows\System\OigcnSl.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\FfbSJDV.exe
  C:\Windows\System\FfbSJDV.exe
  2⤵
  PID:2060
- C:\Windows\System\QWdLtGN.exe
  C:\Windows\System\QWdLtGN.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\UxSvYGB.exe
  C:\Windows\System\UxSvYGB.exe
  2⤵
  PID:2252
- C:\Windows\System\TPCbuzv.exe
  C:\Windows\System\TPCbuzv.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\ExhbhLJ.exe
  C:\Windows\System\ExhbhLJ.exe
  2⤵
  PID:612
- C:\Windows\System\sGWBgdj.exe
  C:\Windows\System\sGWBgdj.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\yzKmhuH.exe
  C:\Windows\System\yzKmhuH.exe
  2⤵
  PID:1576
- C:\Windows\System\eYqmvud.exe
  C:\Windows\System\eYqmvud.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\dnwtEOq.exe
  C:\Windows\System\dnwtEOq.exe
  2⤵
  PID:3100
- C:\Windows\System\mQmrstH.exe
  C:\Windows\System\mQmrstH.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\JVWsbor.exe
  C:\Windows\System\JVWsbor.exe
  2⤵
  PID:3136
- C:\Windows\System\icIQIBD.exe
  C:\Windows\System\icIQIBD.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\xvVIdEo.exe
  C:\Windows\System\xvVIdEo.exe
  2⤵
  PID:3176
- C:\Windows\System\xdHaqzv.exe
  C:\Windows\System\xdHaqzv.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\GrZJOzE.exe
  C:\Windows\System\GrZJOzE.exe
  2⤵
  PID:3212
- C:\Windows\System\EjJQSIC.exe
  C:\Windows\System\EjJQSIC.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\QhvmqFs.exe
  C:\Windows\System\QhvmqFs.exe
  2⤵
  PID:3252
- C:\Windows\System\CBZFCFg.exe
  C:\Windows\System\CBZFCFg.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\BcTWATu.exe
  C:\Windows\System\BcTWATu.exe
  2⤵
  PID:3288
- C:\Windows\System\ktDzGNf.exe
  C:\Windows\System\ktDzGNf.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\bCkQIjO.exe
  C:\Windows\System\bCkQIjO.exe
  2⤵
  PID:3328
- C:\Windows\System\DXMPWWb.exe
  C:\Windows\System\DXMPWWb.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System\pDeBFOc.exe
  C:\Windows\System\pDeBFOc.exe
  2⤵
  PID:3360
- C:\Windows\System\yCoDeat.exe
  C:\Windows\System\yCoDeat.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\gJycDuN.exe
  C:\Windows\System\gJycDuN.exe
  2⤵
  PID:3396
- C:\Windows\System\mWBlpQv.exe
  C:\Windows\System\mWBlpQv.exe
  2⤵
  PID:3412
- C:\Windows\System\HubcVLM.exe
  C:\Windows\System\HubcVLM.exe
  2⤵
  PID:3432
- C:\Windows\System\BeaDuji.exe
  C:\Windows\System\BeaDuji.exe
  2⤵
  PID:3452
- C:\Windows\System\YEobAcA.exe
  C:\Windows\System\YEobAcA.exe
  2⤵
  PID:3468
- C:\Windows\System\zIqcBDs.exe
  C:\Windows\System\zIqcBDs.exe
  2⤵
  PID:3488
- C:\Windows\System\NvoAwJJ.exe
  C:\Windows\System\NvoAwJJ.exe
  2⤵
  PID:3504
- C:\Windows\System\Bzlnlsm.exe
  C:\Windows\System\Bzlnlsm.exe
  2⤵
  PID:3524
- C:\Windows\System\geSUCoH.exe
  C:\Windows\System\geSUCoH.exe
  2⤵
  PID:3540
- C:\Windows\System\ArbyjSe.exe
  C:\Windows\System\ArbyjSe.exe
  2⤵
  PID:3560
- C:\Windows\System\GyLbgRQ.exe
  C:\Windows\System\GyLbgRQ.exe
  2⤵
  PID:3576
- C:\Windows\System\LekRbfL.exe
  C:\Windows\System\LekRbfL.exe
  2⤵
  PID:3596
- C:\Windows\System\djfTFtT.exe
  C:\Windows\System\djfTFtT.exe
  2⤵
  PID:3612
- C:\Windows\System\vPJpUlL.exe
  C:\Windows\System\vPJpUlL.exe
  2⤵
  PID:3632
- C:\Windows\System\imNlFhk.exe
  C:\Windows\System\imNlFhk.exe
  2⤵
  PID:3648
- C:\Windows\System\LRpcaIq.exe
  C:\Windows\System\LRpcaIq.exe
  2⤵
  PID:3668
- C:\Windows\System\Ibmfamy.exe
  C:\Windows\System\Ibmfamy.exe
  2⤵
  PID:3688
- C:\Windows\System\icLxtiF.exe
  C:\Windows\System\icLxtiF.exe
  2⤵
  PID:3704
- C:\Windows\System\YSwTjzT.exe
  C:\Windows\System\YSwTjzT.exe
  2⤵
  PID:3720
- C:\Windows\System\DtuSCNx.exe
  C:\Windows\System\DtuSCNx.exe
  2⤵
  PID:3736
- C:\Windows\System\ZaVHTvr.exe
  C:\Windows\System\ZaVHTvr.exe
  2⤵
  PID:3756
- C:\Windows\System\BLJXCbc.exe
  C:\Windows\System\BLJXCbc.exe
  2⤵
  PID:3772
- C:\Windows\System\vlpKDzX.exe
  C:\Windows\System\vlpKDzX.exe
  2⤵
  PID:3788
- C:\Windows\System\RpREUzQ.exe
  C:\Windows\System\RpREUzQ.exe
  2⤵
  PID:3804
- C:\Windows\System\UlFiCjJ.exe
  C:\Windows\System\UlFiCjJ.exe
  2⤵
  PID:3828
- C:\Windows\System\VvMeVla.exe
  C:\Windows\System\VvMeVla.exe
  2⤵
  PID:3844
- C:\Windows\System\jGkHZLs.exe
  C:\Windows\System\jGkHZLs.exe
  2⤵
  PID:3860
- C:\Windows\System\tZxqZkW.exe
  C:\Windows\System\tZxqZkW.exe
  2⤵
  PID:3876
- C:\Windows\System\PDaSphn.exe
  C:\Windows\System\PDaSphn.exe
  2⤵
  PID:3900
- C:\Windows\System\nwzabim.exe
  C:\Windows\System\nwzabim.exe
  2⤵
  PID:3916
- C:\Windows\System\XCDaBVC.exe
  C:\Windows\System\XCDaBVC.exe
  2⤵
  PID:3940
- C:\Windows\System\qphaKtk.exe
  C:\Windows\System\qphaKtk.exe
  2⤵
  PID:3964
- C:\Windows\System\tUwbkoo.exe
  C:\Windows\System\tUwbkoo.exe
  2⤵
  PID:3980
- C:\Windows\System\EkCqCvw.exe
  C:\Windows\System\EkCqCvw.exe
  2⤵
  PID:3996
- C:\Windows\System\yJUiaBR.exe
  C:\Windows\System\yJUiaBR.exe
  2⤵
  PID:4016
- C:\Windows\System\KedfiLa.exe
  C:\Windows\System\KedfiLa.exe
  2⤵
  PID:4036
- C:\Windows\System\wLhSxzI.exe
  C:\Windows\System\wLhSxzI.exe
  2⤵
  PID:4052
- C:\Windows\System\RtIpUfa.exe
  C:\Windows\System\RtIpUfa.exe
  2⤵
  PID:4068
- C:\Windows\System\uMmGTAa.exe
  C:\Windows\System\uMmGTAa.exe
  2⤵
  PID:4084
- C:\Windows\System\tZcBUyT.exe
  C:\Windows\System\tZcBUyT.exe
  2⤵
  PID:568
- C:\Windows\System\WTJHevA.exe
  C:\Windows\System\WTJHevA.exe
  2⤵
  PID:1216
- C:\Windows\System\ZLtftZm.exe
  C:\Windows\System\ZLtftZm.exe
  2⤵
  PID:1100
- C:\Windows\System\aEnVQKQ.exe
  C:\Windows\System\aEnVQKQ.exe
  2⤵
  PID:2156
- C:\Windows\System\LCSYuiq.exe
  C:\Windows\System\LCSYuiq.exe
  2⤵
  PID:3124
- C:\Windows\System\kJJdEjQ.exe
  C:\Windows\System\kJJdEjQ.exe
  2⤵
  PID:3172
- C:\Windows\System\RHHnhMY.exe
  C:\Windows\System\RHHnhMY.exe
  2⤵
  PID:2172
- C:\Windows\System\yrNisEp.exe
  C:\Windows\System\yrNisEp.exe
  2⤵
  PID:3276
- C:\Windows\System\uVqYfJl.exe
  C:\Windows\System\uVqYfJl.exe
  2⤵
  PID:3356
- C:\Windows\System\olWDrMO.exe
  C:\Windows\System\olWDrMO.exe
  2⤵
  PID:3420
- C:\Windows\System\BGkstmd.exe
  C:\Windows\System\BGkstmd.exe
  2⤵
  PID:3500
- C:\Windows\System\NHXiTrZ.exe
  C:\Windows\System\NHXiTrZ.exe
  2⤵
  PID:3572
- C:\Windows\System\GFlHFyj.exe
  C:\Windows\System\GFlHFyj.exe
  2⤵
  PID:3644
- C:\Windows\System\sRdSDvy.exe
  C:\Windows\System\sRdSDvy.exe
  2⤵
  PID:3716
- C:\Windows\System\YTwGeyS.exe
  C:\Windows\System\YTwGeyS.exe
  2⤵
  PID:3780
- C:\Windows\System\PnwVOZl.exe
  C:\Windows\System\PnwVOZl.exe
  2⤵
  PID:3852
- C:\Windows\System\MjAKfCY.exe
  C:\Windows\System\MjAKfCY.exe
  2⤵
  PID:3896
- C:\Windows\System\yoJgpYO.exe
  C:\Windows\System\yoJgpYO.exe
  2⤵
  PID:3932
- C:\Windows\System\PoJWUCM.exe
  C:\Windows\System\PoJWUCM.exe
  2⤵
  PID:4004
- C:\Windows\System\ckNAwsN.exe
  C:\Windows\System\ckNAwsN.exe
  2⤵
  PID:4076
- C:\Windows\System\FHZomUX.exe
  C:\Windows\System\FHZomUX.exe
  2⤵
  PID:2816
- C:\Windows\System\YOhpqsj.exe
  C:\Windows\System\YOhpqsj.exe
  2⤵
  PID:4044
- C:\Windows\System\nuYucrd.exe
  C:\Windows\System\nuYucrd.exe
  2⤵
  PID:1980
- C:\Windows\System\phRmpuY.exe
  C:\Windows\System\phRmpuY.exe
  2⤵
  PID:2884
- C:\Windows\System\ePjXksb.exe
  C:\Windows\System\ePjXksb.exe
  2⤵
  PID:1776
- C:\Windows\System\UKyoGEB.exe
  C:\Windows\System\UKyoGEB.exe
  2⤵
  PID:1060
- C:\Windows\System\TpuWgGq.exe
  C:\Windows\System\TpuWgGq.exe
  2⤵
  PID:632
- C:\Windows\System\PAEybGd.exe
  C:\Windows\System\PAEybGd.exe
  2⤵
  PID:1580
- C:\Windows\System\sQtHMFT.exe
  C:\Windows\System\sQtHMFT.exe
  2⤵
  PID:2684
- C:\Windows\System\XYZtiJp.exe
  C:\Windows\System\XYZtiJp.exe
  2⤵
  PID:2448
- C:\Windows\System\PuAUBUX.exe
  C:\Windows\System\PuAUBUX.exe
  2⤵
  PID:2176
- C:\Windows\System\EYibpET.exe
  C:\Windows\System\EYibpET.exe
  2⤵
  PID:1760
- C:\Windows\System\GYoghev.exe
  C:\Windows\System\GYoghev.exe
  2⤵
  PID:2748
- C:\Windows\System\lSjCzkn.exe
  C:\Windows\System\lSjCzkn.exe
  2⤵
  PID:2160
- C:\Windows\System\XZhWtgu.exe
  C:\Windows\System\XZhWtgu.exe
  2⤵
  PID:2508
- C:\Windows\System\UJZUdOZ.exe
  C:\Windows\System\UJZUdOZ.exe
  2⤵
  PID:1724
- C:\Windows\System\klumdoV.exe
  C:\Windows\System\klumdoV.exe
  2⤵
  PID:2480
- C:\Windows\System\DdGtbkV.exe
  C:\Windows\System\DdGtbkV.exe
  2⤵
  PID:764
- C:\Windows\System\vOBgwen.exe
  C:\Windows\System\vOBgwen.exe
  2⤵
  PID:956
- C:\Windows\System\zHmBiFE.exe
  C:\Windows\System\zHmBiFE.exe
  2⤵
  PID:348
- C:\Windows\System\vzykjMc.exe
  C:\Windows\System\vzykjMc.exe
  2⤵
  PID:908
- C:\Windows\System\wNLoPxk.exe
  C:\Windows\System\wNLoPxk.exe
  2⤵
  PID:1976
- C:\Windows\System\kJdXfLw.exe
  C:\Windows\System\kJdXfLw.exe
  2⤵
  PID:2612
- C:\Windows\System\uCbGyNc.exe
  C:\Windows\System\uCbGyNc.exe
  2⤵
  PID:2520
- C:\Windows\System\zBebsLV.exe
  C:\Windows\System\zBebsLV.exe
  2⤵
  PID:3228
- C:\Windows\System\TBlfWzb.exe
  C:\Windows\System\TBlfWzb.exe
  2⤵
  PID:2672
- C:\Windows\System\skOSrHZ.exe
  C:\Windows\System\skOSrHZ.exe
  2⤵
  PID:3624
- C:\Windows\System\WbvEbpF.exe
  C:\Windows\System\WbvEbpF.exe
  2⤵
  PID:2084
- C:\Windows\System\HsCnEEi.exe
  C:\Windows\System\HsCnEEi.exe
  2⤵
  PID:1612
- C:\Windows\System\dizSZJU.exe
  C:\Windows\System\dizSZJU.exe
  2⤵
  PID:304
- C:\Windows\System\LiqacBE.exe
  C:\Windows\System\LiqacBE.exe
  2⤵
  PID:3248
- C:\Windows\System\mKTkKqd.exe
  C:\Windows\System\mKTkKqd.exe
  2⤵
  PID:3680
- C:\Windows\System\MshJTdF.exe
  C:\Windows\System\MshJTdF.exe
  2⤵
  PID:3824
- C:\Windows\System\GhVXasr.exe
  C:\Windows\System\GhVXasr.exe
  2⤵
  PID:2948
- C:\Windows\System\pliSIWL.exe
  C:\Windows\System\pliSIWL.exe
  2⤵
  PID:1312
- C:\Windows\System\FILaXDI.exe
  C:\Windows\System\FILaXDI.exe
  2⤵
  PID:2396
- C:\Windows\System\JVNUQMA.exe
  C:\Windows\System\JVNUQMA.exe
  2⤵
  PID:3976
- C:\Windows\System\uiGmNjv.exe
  C:\Windows\System\uiGmNjv.exe
  2⤵
  PID:3748
- C:\Windows\System\AFbAhgw.exe
  C:\Windows\System\AFbAhgw.exe
  2⤵
  PID:3284
- C:\Windows\System\oZvofjq.exe
  C:\Windows\System\oZvofjq.exe
  2⤵
  PID:3092
- C:\Windows\System\YjJbRtn.exe
  C:\Windows\System\YjJbRtn.exe
  2⤵
  PID:4060
- C:\Windows\System\EOryQRb.exe
  C:\Windows\System\EOryQRb.exe
  2⤵
  PID:3992
- C:\Windows\System\lvzbMdn.exe
  C:\Windows\System\lvzbMdn.exe
  2⤵
  PID:3872
- C:\Windows\System\MzETXfh.exe
  C:\Windows\System\MzETXfh.exe
  2⤵
  PID:3800
- C:\Windows\System\AjSbrTP.exe
  C:\Windows\System\AjSbrTP.exe
  2⤵
  PID:3728
- C:\Windows\System\mGijKas.exe
  C:\Windows\System\mGijKas.exe
  2⤵
  PID:3628
- C:\Windows\System\VChioJl.exe
  C:\Windows\System\VChioJl.exe
  2⤵
  PID:3548
- C:\Windows\System\kTdcTMy.exe
  C:\Windows\System\kTdcTMy.exe
  2⤵
  PID:3448
- C:\Windows\System\VnWVqRL.exe
  C:\Windows\System\VnWVqRL.exe
  2⤵
  PID:3368
- C:\Windows\System\pImThZx.exe
  C:\Windows\System\pImThZx.exe
  2⤵
  PID:3296
- C:\Windows\System\zgiKdAY.exe
  C:\Windows\System\zgiKdAY.exe
  2⤵
  PID:3156
- C:\Windows\System\lBUFKdb.exe
  C:\Windows\System\lBUFKdb.exe
  2⤵
  PID:2744
- C:\Windows\System\XGgCxht.exe
  C:\Windows\System\XGgCxht.exe
  2⤵
  PID:2976
- C:\Windows\System\ZYAjuVO.exe
  C:\Windows\System\ZYAjuVO.exe
  2⤵
  PID:316
- C:\Windows\System\GqpfDWl.exe
  C:\Windows\System\GqpfDWl.exe
  2⤵
  PID:2240
- C:\Windows\System\dlZCEoX.exe
  C:\Windows\System\dlZCEoX.exe
  2⤵
  PID:3024
- C:\Windows\System\ZktOzvb.exe
  C:\Windows\System\ZktOzvb.exe
  2⤵
  PID:1916
- C:\Windows\System\KkuMDgG.exe
  C:\Windows\System\KkuMDgG.exe
  2⤵
  PID:1244
- C:\Windows\System\fUWzQmZ.exe
  C:\Windows\System\fUWzQmZ.exe
  2⤵
  PID:2192
- C:\Windows\System\NVGjifn.exe
  C:\Windows\System\NVGjifn.exe
  2⤵
  PID:2016
- C:\Windows\System\NHAdTBB.exe
  C:\Windows\System\NHAdTBB.exe
  2⤵
  PID:3304
- C:\Windows\System\yAyupfK.exe
  C:\Windows\System\yAyupfK.exe
  2⤵
  PID:3484
- C:\Windows\System\ioVNGUG.exe
  C:\Windows\System\ioVNGUG.exe
  2⤵
  PID:3552
- C:\Windows\System\TQRDGcr.exe
  C:\Windows\System\TQRDGcr.exe
  2⤵
  PID:3320
- C:\Windows\System\pGLWCuA.exe
  C:\Windows\System\pGLWCuA.exe
  2⤵
  PID:3536
- C:\Windows\System\lRKylOD.exe
  C:\Windows\System\lRKylOD.exe
  2⤵
  PID:2100
- C:\Windows\System\TZRyzKJ.exe
  C:\Windows\System\TZRyzKJ.exe
  2⤵
  PID:536
- C:\Windows\System\bczeONJ.exe
  C:\Windows\System\bczeONJ.exe
  2⤵
  PID:3816
- C:\Windows\System\dHsPzAk.exe
  C:\Windows\System\dHsPzAk.exe
  2⤵
  PID:3476
- C:\Windows\System\vBqzlAG.exe
  C:\Windows\System\vBqzlAG.exe
  2⤵
  PID:3840
- C:\Windows\System\rRphPfr.exe
  C:\Windows\System\rRphPfr.exe
  2⤵
  PID:3640
- C:\Windows\System\jKOJDfl.exe
  C:\Windows\System\jKOJDfl.exe
  2⤵
  PID:1972
- C:\Windows\System\xXoMHnu.exe
  C:\Windows\System\xXoMHnu.exe
  2⤵
  PID:3948
- C:\Windows\System\vzvcyvm.exe
  C:\Windows\System\vzvcyvm.exe
  2⤵
  PID:3080
- C:\Windows\System\PwrRmie.exe
  C:\Windows\System\PwrRmie.exe
  2⤵
  PID:3732
- C:\Windows\System\BivFuHX.exe
  C:\Windows\System\BivFuHX.exe
  2⤵
  PID:880
- C:\Windows\System\PgkCLKv.exe
  C:\Windows\System\PgkCLKv.exe
  2⤵
  PID:3220
- C:\Windows\System\vHbfczM.exe
  C:\Windows\System\vHbfczM.exe
  2⤵
  PID:1412
- C:\Windows\System\gZiQXlj.exe
  C:\Windows\System\gZiQXlj.exe
  2⤵
  PID:2560
- C:\Windows\System\OEjVZcQ.exe
  C:\Windows\System\OEjVZcQ.exe
  2⤵
  PID:2196
- C:\Windows\System\fCjRfQV.exe
  C:\Windows\System\fCjRfQV.exe
  2⤵
  PID:3148
- C:\Windows\System\OKxLwhn.exe
  C:\Windows\System\OKxLwhn.exe
  2⤵
  PID:3168
- C:\Windows\System\PZGrbNb.exe
  C:\Windows\System\PZGrbNb.exe
  2⤵
  PID:1276
- C:\Windows\System\LaaDCcu.exe
  C:\Windows\System\LaaDCcu.exe
  2⤵
  PID:3812
- C:\Windows\System\IvERndi.exe
  C:\Windows\System\IvERndi.exe
  2⤵
  PID:4024
- C:\Windows\System\mdmcsXA.exe
  C:\Windows\System\mdmcsXA.exe
  2⤵
  PID:836
- C:\Windows\System\gMJQtzM.exe
  C:\Windows\System\gMJQtzM.exe
  2⤵
  PID:816
- C:\Windows\System\gyEaGkh.exe
  C:\Windows\System\gyEaGkh.exe
  2⤵
  PID:1732
- C:\Windows\System\IyqzKEy.exe
  C:\Windows\System\IyqzKEy.exe
  2⤵
  PID:4032
- C:\Windows\System\VfPobFF.exe
  C:\Windows\System\VfPobFF.exe
  2⤵
  PID:3208
- C:\Windows\System\IZwJqwB.exe
  C:\Windows\System\IZwJqwB.exe
  2⤵
  PID:3696
- C:\Windows\System\IkFLrTb.exe
  C:\Windows\System\IkFLrTb.exe
  2⤵
  PID:992
- C:\Windows\System\eytKHaj.exe
  C:\Windows\System\eytKHaj.exe
  2⤵
  PID:2652
- C:\Windows\System\MeEsRwU.exe
  C:\Windows\System\MeEsRwU.exe
  2⤵
  PID:3308
- C:\Windows\System\wbfFcjs.exe
  C:\Windows\System\wbfFcjs.exe
  2⤵
  PID:676
- C:\Windows\System\RGfGxqw.exe
  C:\Windows\System\RGfGxqw.exe
  2⤵
  PID:3952
- C:\Windows\System\oxLPJNR.exe
  C:\Windows\System\oxLPJNR.exe
  2⤵
  PID:2800
- C:\Windows\System\xyxJEpX.exe
  C:\Windows\System\xyxJEpX.exe
  2⤵
  PID:3464
- C:\Windows\System\rhVjDzj.exe
  C:\Windows\System\rhVjDzj.exe
  2⤵
  PID:2820
- C:\Windows\System\sIitSYk.exe
  C:\Windows\System\sIitSYk.exe
  2⤵
  PID:2236
- C:\Windows\System\FJHqZJr.exe
  C:\Windows\System\FJHqZJr.exe
  2⤵
  PID:2280
- C:\Windows\System\tdMAKGO.exe
  C:\Windows\System\tdMAKGO.exe
  2⤵
  PID:1208
- C:\Windows\System\ngicFWx.exe
  C:\Windows\System\ngicFWx.exe
  2⤵
  PID:4100
- C:\Windows\System\aNQfivh.exe
  C:\Windows\System\aNQfivh.exe
  2⤵
  PID:4116
- C:\Windows\System\cBXOUXy.exe
  C:\Windows\System\cBXOUXy.exe
  2⤵
  PID:4132
- C:\Windows\System\rlWnAQV.exe
  C:\Windows\System\rlWnAQV.exe
  2⤵
  PID:4148
- C:\Windows\System\FcnTDbT.exe
  C:\Windows\System\FcnTDbT.exe
  2⤵
  PID:4164
- C:\Windows\System\cMQbQiJ.exe
  C:\Windows\System\cMQbQiJ.exe
  2⤵
  PID:4184
- C:\Windows\System\ntcKYOr.exe
  C:\Windows\System\ntcKYOr.exe
  2⤵
  PID:4244
- C:\Windows\System\UOhhvqe.exe
  C:\Windows\System\UOhhvqe.exe
  2⤵
  PID:4268
- C:\Windows\System\DywLMUB.exe
  C:\Windows\System\DywLMUB.exe
  2⤵
  PID:4284
- C:\Windows\System\emUkgLT.exe
  C:\Windows\System\emUkgLT.exe
  2⤵
  PID:4300
- C:\Windows\System\BNcbGHB.exe
  C:\Windows\System\BNcbGHB.exe
  2⤵
  PID:4324
- C:\Windows\System\GbgqYJG.exe
  C:\Windows\System\GbgqYJG.exe
  2⤵
  PID:4360
- C:\Windows\System\BUNuSyH.exe
  C:\Windows\System\BUNuSyH.exe
  2⤵
  PID:4376
- C:\Windows\System\NYZqdGb.exe
  C:\Windows\System\NYZqdGb.exe
  2⤵
  PID:4392
- C:\Windows\System\jjuBRbT.exe
  C:\Windows\System\jjuBRbT.exe
  2⤵
  PID:4408
- C:\Windows\System\gBdadpI.exe
  C:\Windows\System\gBdadpI.exe
  2⤵
  PID:4424
- C:\Windows\System\dPRlyWp.exe
  C:\Windows\System\dPRlyWp.exe
  2⤵
  PID:4448
- C:\Windows\System\lLgmUez.exe
  C:\Windows\System\lLgmUez.exe
  2⤵
  PID:4464
- C:\Windows\System\hwYylgt.exe
  C:\Windows\System\hwYylgt.exe
  2⤵
  PID:4480
- C:\Windows\System\RdMzWSK.exe
  C:\Windows\System\RdMzWSK.exe
  2⤵
  PID:4496
- C:\Windows\System\SgxQIJf.exe
  C:\Windows\System\SgxQIJf.exe
  2⤵
  PID:4512
- C:\Windows\System\KYgsytW.exe
  C:\Windows\System\KYgsytW.exe
  2⤵
  PID:4528
- C:\Windows\System\WLpBxLy.exe
  C:\Windows\System\WLpBxLy.exe
  2⤵
  PID:4544
- C:\Windows\System\EzfCddT.exe
  C:\Windows\System\EzfCddT.exe
  2⤵
  PID:4564
- C:\Windows\System\AOwYgQo.exe
  C:\Windows\System\AOwYgQo.exe
  2⤵
  PID:4580
- C:\Windows\System\XoBnyUE.exe
  C:\Windows\System\XoBnyUE.exe
  2⤵
  PID:4596
- C:\Windows\System\OwbUKtn.exe
  C:\Windows\System\OwbUKtn.exe
  2⤵
  PID:4612
- C:\Windows\System\iAtYjir.exe
  C:\Windows\System\iAtYjir.exe
  2⤵
  PID:4632
- C:\Windows\System\ffLXCiB.exe
  C:\Windows\System\ffLXCiB.exe
  2⤵
  PID:4648
- C:\Windows\System\XZcUHkH.exe
  C:\Windows\System\XZcUHkH.exe
  2⤵
  PID:4728
- C:\Windows\System\BWOAZhN.exe
  C:\Windows\System\BWOAZhN.exe
  2⤵
  PID:4744
- C:\Windows\System\DBYVQJA.exe
  C:\Windows\System\DBYVQJA.exe
  2⤵
  PID:4760
- C:\Windows\System\Ujwjakc.exe
  C:\Windows\System\Ujwjakc.exe
  2⤵
  PID:4776
- C:\Windows\System\vHSsmyE.exe
  C:\Windows\System\vHSsmyE.exe
  2⤵
  PID:4792
- C:\Windows\System\osWdutx.exe
  C:\Windows\System\osWdutx.exe
  2⤵
  PID:4808
- C:\Windows\System\GqaXsbd.exe
  C:\Windows\System\GqaXsbd.exe
  2⤵
  PID:4824
- C:\Windows\System\jhvbWRz.exe
  C:\Windows\System\jhvbWRz.exe
  2⤵
  PID:4840
- C:\Windows\System\xevmrBz.exe
  C:\Windows\System\xevmrBz.exe
  2⤵
  PID:4856
- C:\Windows\System\gkpBwga.exe
  C:\Windows\System\gkpBwga.exe
  2⤵
  PID:4908
- C:\Windows\System\oOnrMqW.exe
  C:\Windows\System\oOnrMqW.exe
  2⤵
  PID:4924
- C:\Windows\System\byzFhJq.exe
  C:\Windows\System\byzFhJq.exe
  2⤵
  PID:4940
- C:\Windows\System\oyTfvpP.exe
  C:\Windows\System\oyTfvpP.exe
  2⤵
  PID:4956
- C:\Windows\System\sFXXlIl.exe
  C:\Windows\System\sFXXlIl.exe
  2⤵
  PID:4972
- C:\Windows\System\djqyugD.exe
  C:\Windows\System\djqyugD.exe
  2⤵
  PID:5008
- C:\Windows\System\bbUrkSh.exe
  C:\Windows\System\bbUrkSh.exe
  2⤵
  PID:5032
- C:\Windows\System\oWdkfTo.exe
  C:\Windows\System\oWdkfTo.exe
  2⤵
  PID:5048
- C:\Windows\System\pYHmEkm.exe
  C:\Windows\System\pYHmEkm.exe
  2⤵
  PID:5072
- C:\Windows\System\mjEqdyI.exe
  C:\Windows\System\mjEqdyI.exe
  2⤵
  PID:5096
- C:\Windows\System\eodbgTh.exe
  C:\Windows\System\eodbgTh.exe
  2⤵
  PID:5112
- C:\Windows\System\WZmqVOF.exe
  C:\Windows\System\WZmqVOF.exe
  2⤵
  PID:1800
- C:\Windows\System\IydRURV.exe
  C:\Windows\System\IydRURV.exe
  2⤵
  PID:1232
- C:\Windows\System\EMZVDkO.exe
  C:\Windows\System\EMZVDkO.exe
  2⤵
  PID:4140
- C:\Windows\System\DxIVLvd.exe
  C:\Windows\System\DxIVLvd.exe
  2⤵
  PID:4180
- C:\Windows\System\cqSOvYT.exe
  C:\Windows\System\cqSOvYT.exe
  2⤵
  PID:1348
- C:\Windows\System\xnguwXu.exe
  C:\Windows\System\xnguwXu.exe
  2⤵
  PID:2532
- C:\Windows\System\OncFRmu.exe
  C:\Windows\System\OncFRmu.exe
  2⤵
  PID:2792
- C:\Windows\System\eaPaMap.exe
  C:\Windows\System\eaPaMap.exe
  2⤵
  PID:3404
- C:\Windows\System\IJAYyDi.exe
  C:\Windows\System\IJAYyDi.exe
  2⤵
  PID:3352
- C:\Windows\System\XrhYARe.exe
  C:\Windows\System\XrhYARe.exe
  2⤵
  PID:3584
- C:\Windows\System\kXajpcG.exe
  C:\Windows\System\kXajpcG.exe
  2⤵
  PID:4128
- C:\Windows\System\RlxMoCv.exe
  C:\Windows\System\RlxMoCv.exe
  2⤵
  PID:4204
- C:\Windows\System\VqJbhlc.exe
  C:\Windows\System\VqJbhlc.exe
  2⤵
  PID:4220
- C:\Windows\System\BQlqszV.exe
  C:\Windows\System\BQlqszV.exe
  2⤵
  PID:4232
- C:\Windows\System\HewlvcT.exe
  C:\Windows\System\HewlvcT.exe
  2⤵
  PID:4280
- C:\Windows\System\TlgzgGj.exe
  C:\Windows\System\TlgzgGj.exe
  2⤵
  PID:4312
- C:\Windows\System\EQKrfpA.exe
  C:\Windows\System\EQKrfpA.exe
  2⤵
  PID:4340
- C:\Windows\System\zohcTla.exe
  C:\Windows\System\zohcTla.exe
  2⤵
  PID:4384
- C:\Windows\System\LoeUDpS.exe
  C:\Windows\System\LoeUDpS.exe
  2⤵
  PID:4416
- C:\Windows\System\CewTHYG.exe
  C:\Windows\System\CewTHYG.exe
  2⤵
  PID:4404
- C:\Windows\System\yjIlpki.exe
  C:\Windows\System\yjIlpki.exe
  2⤵
  PID:2920
- C:\Windows\System\CfsdbrJ.exe
  C:\Windows\System\CfsdbrJ.exe
  2⤵
  PID:4520
- C:\Windows\System\sjsKYBV.exe
  C:\Windows\System\sjsKYBV.exe
  2⤵
  PID:4608
- C:\Windows\System\PNSEYaq.exe
  C:\Windows\System\PNSEYaq.exe
  2⤵
  PID:4668
- C:\Windows\System\UkNomEE.exe
  C:\Windows\System\UkNomEE.exe
  2⤵
  PID:4676
- C:\Windows\System\kEuNLxp.exe
  C:\Windows\System\kEuNLxp.exe
  2⤵
  PID:308
- C:\Windows\System\XSQlCWa.exe
  C:\Windows\System\XSQlCWa.exe
  2⤵
  PID:4692
- C:\Windows\System\IcaumNp.exe
  C:\Windows\System\IcaumNp.exe
  2⤵
  PID:4700
- C:\Windows\System\YhhDMfg.exe
  C:\Windows\System\YhhDMfg.exe
  2⤵
  PID:1936
- C:\Windows\System\wHqYHrN.exe
  C:\Windows\System\wHqYHrN.exe
  2⤵
  PID:4704
- C:\Windows\System\tbpXIND.exe
  C:\Windows\System\tbpXIND.exe
  2⤵
  PID:2464
- C:\Windows\System\OqwKsmK.exe
  C:\Windows\System\OqwKsmK.exe
  2⤵
  PID:4716
- C:\Windows\System\tsBmWmu.exe
  C:\Windows\System\tsBmWmu.exe
  2⤵
  PID:4724
- C:\Windows\System\oybuHNd.exe
  C:\Windows\System\oybuHNd.exe
  2⤵
  PID:4756
- C:\Windows\System\Hrzfebx.exe
  C:\Windows\System\Hrzfebx.exe
  2⤵
  PID:4772
- C:\Windows\System\CkJKWss.exe
  C:\Windows\System\CkJKWss.exe
  2⤵
  PID:4820
- C:\Windows\System\lZkkaKu.exe
  C:\Windows\System\lZkkaKu.exe
  2⤵
  PID:4852
- C:\Windows\System\LHfdQqN.exe
  C:\Windows\System\LHfdQqN.exe
  2⤵
  PID:5000
- C:\Windows\System\FzSkVXt.exe
  C:\Windows\System\FzSkVXt.exe
  2⤵
  PID:4980
- C:\Windows\System\TCqQCJn.exe
  C:\Windows\System\TCqQCJn.exe
  2⤵
  PID:5028
- C:\Windows\System\SXDwtvM.exe
  C:\Windows\System\SXDwtvM.exe
  2⤵
  PID:5060
- C:\Windows\System\uPesOuW.exe
  C:\Windows\System\uPesOuW.exe
  2⤵
  PID:1548
- C:\Windows\System\XnoWnYl.exe
  C:\Windows\System\XnoWnYl.exe
  2⤵
  PID:5088
- C:\Windows\System\ztGFSgk.exe
  C:\Windows\System\ztGFSgk.exe
  2⤵
  PID:3244
- C:\Windows\System\hnBRgLz.exe
  C:\Windows\System\hnBRgLz.exe
  2⤵
  PID:2768
- C:\Windows\System\JhRatkY.exe
  C:\Windows\System\JhRatkY.exe
  2⤵
  PID:2864
- C:\Windows\System\JPmtfBv.exe
  C:\Windows\System\JPmtfBv.exe
  2⤵
  PID:2636
- C:\Windows\System\EXePJxX.exe
  C:\Windows\System\EXePJxX.exe
  2⤵
  PID:4124
- C:\Windows\System\nAWkaaW.exe
  C:\Windows\System\nAWkaaW.exe
  2⤵
  PID:1448
- C:\Windows\System\ZGLMlnl.exe
  C:\Windows\System\ZGLMlnl.exe
  2⤵
  PID:3568
- C:\Windows\System\GUrbkBE.exe
  C:\Windows\System\GUrbkBE.exe
  2⤵
  PID:4160
- C:\Windows\System\ICMNfrE.exe
  C:\Windows\System\ICMNfrE.exe
  2⤵
  PID:4256
- C:\Windows\System\WTvOAjh.exe
  C:\Windows\System\WTvOAjh.exe
  2⤵
  PID:4228
- C:\Windows\System\tvwwmTU.exe
  C:\Windows\System\tvwwmTU.exe
  2⤵
  PID:4352
- C:\Windows\System\zeZVlRZ.exe
  C:\Windows\System\zeZVlRZ.exe
  2⤵
  PID:4436
- C:\Windows\System\cpLkXGl.exe
  C:\Windows\System\cpLkXGl.exe
  2⤵
  PID:4444
- C:\Windows\System\nhkibmp.exe
  C:\Windows\System\nhkibmp.exe
  2⤵
  PID:4556
- C:\Windows\System\IiOsvgP.exe
  C:\Windows\System\IiOsvgP.exe
  2⤵
  PID:4508
- C:\Windows\System\UkQGTAe.exe
  C:\Windows\System\UkQGTAe.exe
  2⤵
  PID:4576
- C:\Windows\System\rQzAmMz.exe
  C:\Windows\System\rQzAmMz.exe
  2⤵
  PID:4628
- C:\Windows\System\EwnDMKv.exe
  C:\Windows\System\EwnDMKv.exe
  2⤵
  PID:4644
- C:\Windows\System\dwDYvwh.exe
  C:\Windows\System\dwDYvwh.exe
  2⤵
  PID:4684
- C:\Windows\System\wamXKYi.exe
  C:\Windows\System\wamXKYi.exe
  2⤵
  PID:4688
- C:\Windows\System\WmYhGOf.exe
  C:\Windows\System\WmYhGOf.exe
  2⤵
  PID:856
- C:\Windows\System\JAJnOoI.exe
  C:\Windows\System\JAJnOoI.exe
  2⤵
  PID:1796
- C:\Windows\System\OmbaGxs.exe
  C:\Windows\System\OmbaGxs.exe
  2⤵
  PID:4768
- C:\Windows\System\ntlXEZP.exe
  C:\Windows\System\ntlXEZP.exe
  2⤵
  PID:4864
- C:\Windows\System\TNtJmQT.exe
  C:\Windows\System\TNtJmQT.exe
  2⤵
  PID:4868
- C:\Windows\System\xCKrftM.exe
  C:\Windows\System\xCKrftM.exe
  2⤵
  PID:4708
- C:\Windows\System\cRVTbQi.exe
  C:\Windows\System\cRVTbQi.exe
  2⤵
  PID:4900
- C:\Windows\System\uyHFRoA.exe
  C:\Windows\System\uyHFRoA.exe
  2⤵
  PID:4932
- C:\Windows\System\zWTycUv.exe
  C:\Windows\System\zWTycUv.exe
  2⤵
  PID:4540
- C:\Windows\System\MIuuaLM.exe
  C:\Windows\System\MIuuaLM.exe
  2⤵
  PID:2108
- C:\Windows\System\MzygSQY.exe
  C:\Windows\System\MzygSQY.exe
  2⤵
  PID:5064
- C:\Windows\System\frkOApI.exe
  C:\Windows\System\frkOApI.exe
  2⤵
  PID:2984
- C:\Windows\System\bRbpHLu.exe
  C:\Windows\System\bRbpHLu.exe
  2⤵
  PID:3956
- C:\Windows\System\UdrrQWm.exe
  C:\Windows\System\UdrrQWm.exe
  2⤵
  PID:2512
- C:\Windows\System\NbltFfO.exe
  C:\Windows\System\NbltFfO.exe
  2⤵
  PID:1636
- C:\Windows\System\zlnYAGd.exe
  C:\Windows\System\zlnYAGd.exe
  2⤵
  PID:3664
- C:\Windows\System\aruhrDz.exe
  C:\Windows\System\aruhrDz.exe
  2⤵
  PID:2564
- C:\Windows\System\GjdjTAy.exe
  C:\Windows\System\GjdjTAy.exe
  2⤵
  PID:3764
- C:\Windows\System\naFxCyv.exe
  C:\Windows\System\naFxCyv.exe
  2⤵
  PID:2376
- C:\Windows\System\zebnUfe.exe
  C:\Windows\System\zebnUfe.exe
  2⤵
  PID:4560
- C:\Windows\System\yLufWSh.exe
  C:\Windows\System\yLufWSh.exe
  2⤵
  PID:4604
- C:\Windows\System\fvbFPio.exe
  C:\Windows\System\fvbFPio.exe
  2⤵
  PID:4832
- C:\Windows\System\hchkFxb.exe
  C:\Windows\System\hchkFxb.exe
  2⤵
  PID:2432
- C:\Windows\System\OKmlZDc.exe
  C:\Windows\System\OKmlZDc.exe
  2⤵
  PID:4720
- C:\Windows\System\CQoCcok.exe
  C:\Windows\System\CQoCcok.exe
  2⤵
  PID:4172
- C:\Windows\System\nyehfnz.exe
  C:\Windows\System\nyehfnz.exe
  2⤵
  PID:4984
- C:\Windows\System\IlfVjSF.exe
  C:\Windows\System\IlfVjSF.exe
  2⤵
  PID:5056
- C:\Windows\System\AwshdhB.exe
  C:\Windows\System\AwshdhB.exe
  2⤵
  PID:5092
- C:\Windows\System\agIfYar.exe
  C:\Windows\System\agIfYar.exe
  2⤵
  PID:4456
- C:\Windows\System\FEhKDcy.exe
  C:\Windows\System\FEhKDcy.exe
  2⤵
  PID:4624
- C:\Windows\System\RDnUgsu.exe
  C:\Windows\System\RDnUgsu.exe
  2⤵
  PID:1876
- C:\Windows\System\oQsHDZo.exe
  C:\Windows\System\oQsHDZo.exe
  2⤵
  PID:3408
- C:\Windows\System\lHrhCRN.exe
  C:\Windows\System\lHrhCRN.exe
  2⤵
  PID:1952
- C:\Windows\System\BYOfesB.exe
  C:\Windows\System\BYOfesB.exe
  2⤵
  PID:4952
- C:\Windows\System\ZSUMJRp.exe
  C:\Windows\System\ZSUMJRp.exe
  2⤵
  PID:2476
- C:\Windows\System\CgEftoT.exe
  C:\Windows\System\CgEftoT.exe
  2⤵
  PID:3656
- C:\Windows\System\VYCBvSI.exe
  C:\Windows\System\VYCBvSI.exe
  2⤵
  PID:4620
- C:\Windows\System\iMgzimE.exe
  C:\Windows\System\iMgzimE.exe
  2⤵
  PID:4276
- C:\Windows\System\wGmWyac.exe
  C:\Windows\System\wGmWyac.exe
  2⤵
  PID:4216
- C:\Windows\System\kYRFJIE.exe
  C:\Windows\System\kYRFJIE.exe
  2⤵
  PID:4292
- C:\Windows\System\FrXUMlc.exe
  C:\Windows\System\FrXUMlc.exe
  2⤵
  PID:2980
- C:\Windows\System\KKeZdjz.exe
  C:\Windows\System\KKeZdjz.exe
  2⤵
  PID:4904
- C:\Windows\System\ALVPfbT.exe
  C:\Windows\System\ALVPfbT.exe
  2⤵
  PID:4200
- C:\Windows\System\MJtBpnD.exe
  C:\Windows\System\MJtBpnD.exe
  2⤵
  PID:4816
- C:\Windows\System\AiCbgDL.exe
  C:\Windows\System\AiCbgDL.exe
  2⤵
  PID:2524
- C:\Windows\System\ybMJJtz.exe
  C:\Windows\System\ybMJJtz.exe
  2⤵
  PID:3768
- C:\Windows\System\VUlgHpf.exe
  C:\Windows\System\VUlgHpf.exe
  2⤵
  PID:5124
- C:\Windows\System\Gnbgysw.exe
  C:\Windows\System\Gnbgysw.exe
  2⤵
  PID:5140
- C:\Windows\System\ywTippn.exe
  C:\Windows\System\ywTippn.exe
  2⤵
  PID:5156
- C:\Windows\System\kgoQNJP.exe
  C:\Windows\System\kgoQNJP.exe
  2⤵
  PID:5176
- C:\Windows\System\NmLuYUj.exe
  C:\Windows\System\NmLuYUj.exe
  2⤵
  PID:5192
- C:\Windows\System\yexbSsy.exe
  C:\Windows\System\yexbSsy.exe
  2⤵
  PID:5208
- C:\Windows\System\QvvcHeE.exe
  C:\Windows\System\QvvcHeE.exe
  2⤵
  PID:5224
- C:\Windows\System\teFYRBr.exe
  C:\Windows\System\teFYRBr.exe
  2⤵
  PID:5240
- C:\Windows\System\qGbMzIK.exe
  C:\Windows\System\qGbMzIK.exe
  2⤵
  PID:5256
- C:\Windows\System\IwvGyLC.exe
  C:\Windows\System\IwvGyLC.exe
  2⤵
  PID:5272
- C:\Windows\System\XqxedeK.exe
  C:\Windows\System\XqxedeK.exe
  2⤵
  PID:5288
- C:\Windows\System\lqeJJqy.exe
  C:\Windows\System\lqeJJqy.exe
  2⤵
  PID:5352
- C:\Windows\System\FIFfibC.exe
  C:\Windows\System\FIFfibC.exe
  2⤵
  PID:5368
- C:\Windows\System\vsfCFNx.exe
  C:\Windows\System\vsfCFNx.exe
  2⤵
  PID:5396
- C:\Windows\System\ISgVPMg.exe
  C:\Windows\System\ISgVPMg.exe
  2⤵
  PID:5412
- C:\Windows\System\OToFFIA.exe
  C:\Windows\System\OToFFIA.exe
  2⤵
  PID:5428
- C:\Windows\System\mENOZmk.exe
  C:\Windows\System\mENOZmk.exe
  2⤵
  PID:5444
- C:\Windows\System\wHnunZl.exe
  C:\Windows\System\wHnunZl.exe
  2⤵
  PID:5460
- C:\Windows\System\EJOaEqa.exe
  C:\Windows\System\EJOaEqa.exe
  2⤵
  PID:5476
- C:\Windows\System\zSdcZxG.exe
  C:\Windows\System\zSdcZxG.exe
  2⤵
  PID:5492
- C:\Windows\System\uZEdUBx.exe
  C:\Windows\System\uZEdUBx.exe
  2⤵
  PID:5512
- C:\Windows\System\SSOiooC.exe
  C:\Windows\System\SSOiooC.exe
  2⤵
  PID:5528
- C:\Windows\System\ypzSMOh.exe
  C:\Windows\System\ypzSMOh.exe
  2⤵
  PID:5544
- C:\Windows\System\VvazUGe.exe
  C:\Windows\System\VvazUGe.exe
  2⤵
  PID:5560
- C:\Windows\System\bKfksMI.exe
  C:\Windows\System\bKfksMI.exe
  2⤵
  PID:5576
- C:\Windows\System\bKxwtdk.exe
  C:\Windows\System\bKxwtdk.exe
  2⤵
  PID:5592
- C:\Windows\System\GIVBFaS.exe
  C:\Windows\System\GIVBFaS.exe
  2⤵
  PID:5608
- C:\Windows\System\DHlOXAJ.exe
  C:\Windows\System\DHlOXAJ.exe
  2⤵
  PID:5624
- C:\Windows\System\noOycTP.exe
  C:\Windows\System\noOycTP.exe
  2⤵
  PID:5640
- C:\Windows\System\KDTFWPW.exe
  C:\Windows\System\KDTFWPW.exe
  2⤵
  PID:5664
- C:\Windows\System\hsWARBH.exe
  C:\Windows\System\hsWARBH.exe
  2⤵
  PID:5680
- C:\Windows\System\KGMijWl.exe
  C:\Windows\System\KGMijWl.exe
  2⤵
  PID:5696
- C:\Windows\System\ZRVqwoT.exe
  C:\Windows\System\ZRVqwoT.exe
  2⤵
  PID:5712
- C:\Windows\System\QhKjJIM.exe
  C:\Windows\System\QhKjJIM.exe
  2⤵
  PID:5728
- C:\Windows\System\zXLtvDz.exe
  C:\Windows\System\zXLtvDz.exe
  2⤵
  PID:5744
- C:\Windows\System\EpePcdb.exe
  C:\Windows\System\EpePcdb.exe
  2⤵
  PID:5760
- C:\Windows\System\qMpUxfV.exe
  C:\Windows\System\qMpUxfV.exe
  2⤵
  PID:5776
- C:\Windows\System\vcRhfPW.exe
  C:\Windows\System\vcRhfPW.exe
  2⤵
  PID:5792
- C:\Windows\System\TvtAzyW.exe
  C:\Windows\System\TvtAzyW.exe
  2⤵
  PID:5808
- C:\Windows\System\FdhRYbv.exe
  C:\Windows\System\FdhRYbv.exe
  2⤵
  PID:5824
- C:\Windows\System\QdnxENo.exe
  C:\Windows\System\QdnxENo.exe
  2⤵
  PID:5840
- C:\Windows\System\ujvLiVt.exe
  C:\Windows\System\ujvLiVt.exe
  2⤵
  PID:5856
- C:\Windows\System\uOkYpGo.exe
  C:\Windows\System\uOkYpGo.exe
  2⤵
  PID:5872
- C:\Windows\System\GkxGenx.exe
  C:\Windows\System\GkxGenx.exe
  2⤵
  PID:5888
- C:\Windows\System\fQbQfHK.exe
  C:\Windows\System\fQbQfHK.exe
  2⤵
  PID:5904
- C:\Windows\System\ZKaNXhr.exe
  C:\Windows\System\ZKaNXhr.exe
  2⤵
  PID:5920
- C:\Windows\System\cDjNslH.exe
  C:\Windows\System\cDjNslH.exe
  2⤵
  PID:5936
- C:\Windows\System\AsDDSkx.exe
  C:\Windows\System\AsDDSkx.exe
  2⤵
  PID:5952
- C:\Windows\System\mWlhyTG.exe
  C:\Windows\System\mWlhyTG.exe
  2⤵
  PID:5968
- C:\Windows\System\ptmKDIh.exe
  C:\Windows\System\ptmKDIh.exe
  2⤵
  PID:5984
- C:\Windows\System\fZUfpEN.exe
  C:\Windows\System\fZUfpEN.exe
  2⤵
  PID:6004
- C:\Windows\System\KxVFszr.exe
  C:\Windows\System\KxVFszr.exe
  2⤵
  PID:6020
- C:\Windows\System\wjpNjxq.exe
  C:\Windows\System\wjpNjxq.exe
  2⤵
  PID:6036
- C:\Windows\System\NQJshMk.exe
  C:\Windows\System\NQJshMk.exe
  2⤵
  PID:6052
- C:\Windows\System\lTlMxNX.exe
  C:\Windows\System\lTlMxNX.exe
  2⤵
  PID:6068
- C:\Windows\System\hkLEXDq.exe
  C:\Windows\System\hkLEXDq.exe
  2⤵
  PID:6084
- C:\Windows\System\ecPUeZp.exe
  C:\Windows\System\ecPUeZp.exe
  2⤵
  PID:6100
- C:\Windows\System\MnXtxJA.exe
  C:\Windows\System\MnXtxJA.exe
  2⤵
  PID:6116
- C:\Windows\System\tmzyOUd.exe
  C:\Windows\System\tmzyOUd.exe
  2⤵
  PID:6136
- C:\Windows\System\NYyeQhV.exe
  C:\Windows\System\NYyeQhV.exe
  2⤵
  PID:4572
- C:\Windows\System\EGjknQB.exe
  C:\Windows\System\EGjknQB.exe
  2⤵
  PID:4660
- C:\Windows\System\pHLNZkc.exe
  C:\Windows\System\pHLNZkc.exe
  2⤵
  PID:4800
- C:\Windows\System\EXLRZwQ.exe
  C:\Windows\System\EXLRZwQ.exe
  2⤵
  PID:2988
- C:\Windows\System\ZZmrmPQ.exe
  C:\Windows\System\ZZmrmPQ.exe
  2⤵
  PID:5188
- C:\Windows\System\hfSDbPp.exe
  C:\Windows\System\hfSDbPp.exe
  2⤵
  PID:5252
- C:\Windows\System\hYTBKUC.exe
  C:\Windows\System\hYTBKUC.exe
  2⤵
  PID:4888
- C:\Windows\System\ZWUMsZI.exe
  C:\Windows\System\ZWUMsZI.exe
  2⤵
  PID:4320
- C:\Windows\System\YNDlJAA.exe
  C:\Windows\System\YNDlJAA.exe
  2⤵
  PID:5084
- C:\Windows\System\mMbeEAF.exe
  C:\Windows\System\mMbeEAF.exe
  2⤵
  PID:5132
- C:\Windows\System\mrXEitH.exe
  C:\Windows\System\mrXEitH.exe
  2⤵
  PID:5172
- C:\Windows\System\pvrMJaX.exe
  C:\Windows\System\pvrMJaX.exe
  2⤵
  PID:5236
- C:\Windows\System\fPfxvmv.exe
  C:\Windows\System\fPfxvmv.exe
  2⤵
  PID:5300
- C:\Windows\System\vpAxRPG.exe
  C:\Windows\System\vpAxRPG.exe
  2⤵
  PID:5308
- C:\Windows\System\YIDRcBj.exe
  C:\Windows\System\YIDRcBj.exe
  2⤵
  PID:2764
- C:\Windows\System\NkzjDhQ.exe
  C:\Windows\System\NkzjDhQ.exe
  2⤵
  PID:4552
- C:\Windows\System\UwJZFbu.exe
  C:\Windows\System\UwJZFbu.exe
  2⤵
  PID:5408
- C:\Windows\System\FPiNwqm.exe
  C:\Windows\System\FPiNwqm.exe
  2⤵
  PID:5500
- C:\Windows\System\CbDXypy.exe
  C:\Windows\System\CbDXypy.exe
  2⤵
  PID:5540
- C:\Windows\System\QTJHOVI.exe
  C:\Windows\System\QTJHOVI.exe
  2⤵
  PID:5604
- C:\Windows\System\fcgeyim.exe
  C:\Windows\System\fcgeyim.exe
  2⤵
  PID:5676
- C:\Windows\System\LHfpsCV.exe
  C:\Windows\System\LHfpsCV.exe
  2⤵
  PID:5740
- C:\Windows\System\KarAxmU.exe
  C:\Windows\System\KarAxmU.exe
  2⤵
  PID:5804
- C:\Windows\System\BmrRXcu.exe
  C:\Windows\System\BmrRXcu.exe
  2⤵
  PID:5868
- C:\Windows\System\lAOaqLv.exe
  C:\Windows\System\lAOaqLv.exe
  2⤵
  PID:5932
- C:\Windows\System\QlwLOQb.exe
  C:\Windows\System\QlwLOQb.exe
  2⤵
  PID:5996
- C:\Windows\System\BXshFwV.exe
  C:\Windows\System\BXshFwV.exe
  2⤵
  PID:6096
- C:\Windows\System\GMZoPmm.exe
  C:\Windows\System\GMZoPmm.exe
  2⤵
  PID:6124
- C:\Windows\System\AKgNMmd.exe
  C:\Windows\System\AKgNMmd.exe
  2⤵
  PID:4588
- C:\Windows\System\DCiCzNl.exe
  C:\Windows\System\DCiCzNl.exe
  2⤵
  PID:5280
- C:\Windows\System\ToLFlql.exe
  C:\Windows\System\ToLFlql.exe
  2⤵
  PID:4212
- C:\Windows\System\jMrelfu.exe
  C:\Windows\System\jMrelfu.exe
  2⤵
  PID:5472
- C:\Windows\System\LaSSvip.exe
  C:\Windows\System\LaSSvip.exe
  2⤵
  PID:5736
- C:\Windows\System\kfauHij.exe
  C:\Windows\System\kfauHij.exe
  2⤵
  PID:5992
- C:\Windows\System\ZnwBRme.exe
  C:\Windows\System\ZnwBRme.exe
  2⤵
  PID:5232
- C:\Windows\System\cTiXwpo.exe
  C:\Windows\System\cTiXwpo.exe
  2⤵
  PID:5440
- C:\Windows\System\ykAzmyh.exe
  C:\Windows\System\ykAzmyh.exe
  2⤵
  PID:2716
- C:\Windows\System\BMLfdLS.exe
  C:\Windows\System\BMLfdLS.exe
  2⤵
  PID:5424
- C:\Windows\System\UTjXzhU.exe
  C:\Windows\System\UTjXzhU.exe
  2⤵
  PID:5692
- C:\Windows\System\CtHACqh.exe
  C:\Windows\System\CtHACqh.exe
  2⤵
  PID:5820
- C:\Windows\System\PfntYnX.exe
  C:\Windows\System\PfntYnX.exe
  2⤵
  PID:5980
- C:\Windows\System\GJYyMjE.exe
  C:\Windows\System\GJYyMjE.exe
  2⤵
  PID:6112
- C:\Windows\System\jJshFdA.exe
  C:\Windows\System\jJshFdA.exe
  2⤵
  PID:5296
- C:\Windows\System\AnBiCjD.exe
  C:\Windows\System\AnBiCjD.exe
  2⤵
  PID:5404
- C:\Windows\System\mIWfOAI.exe
  C:\Windows\System\mIWfOAI.exe
  2⤵
  PID:6028
- C:\Windows\System\TNiyeXo.exe
  C:\Windows\System\TNiyeXo.exe
  2⤵
  PID:5348
- C:\Windows\System\pqHgDzL.exe
  C:\Windows\System\pqHgDzL.exe
  2⤵
  PID:5420
- C:\Windows\System\UdXktPE.exe
  C:\Windows\System\UdXktPE.exe
  2⤵
  PID:5520
- C:\Windows\System\EZhsExH.exe
  C:\Windows\System\EZhsExH.exe
  2⤵
  PID:5660
- C:\Windows\System\vFSlIsd.exe
  C:\Windows\System\vFSlIsd.exe
  2⤵
  PID:5816
- C:\Windows\System\uQEzLDo.exe
  C:\Windows\System\uQEzLDo.exe
  2⤵
  PID:5948
- C:\Windows\System\LWnXWJn.exe
  C:\Windows\System\LWnXWJn.exe
  2⤵
  PID:6076
- C:\Windows\System\RmlzZwe.exe
  C:\Windows\System\RmlzZwe.exe
  2⤵
  PID:2772
- C:\Windows\System\PdwyrPl.exe
  C:\Windows\System\PdwyrPl.exe
  2⤵
  PID:1500
- C:\Windows\System\MVMvOjv.exe
  C:\Windows\System\MVMvOjv.exe
  2⤵
  PID:5928
- C:\Windows\System\qJZUjry.exe
  C:\Windows\System\qJZUjry.exe
  2⤵
  PID:5164
- C:\Windows\System\KBsUYsz.exe
  C:\Windows\System\KBsUYsz.exe
  2⤵
  PID:5336
- C:\Windows\System\NOFoyEl.exe
  C:\Windows\System\NOFoyEl.exe
  2⤵
  PID:5784
- C:\Windows\System\EFIuIdl.exe
  C:\Windows\System\EFIuIdl.exe
  2⤵
  PID:5324
- C:\Windows\System\ZqIEyil.exe
  C:\Windows\System\ZqIEyil.exe
  2⤵
  PID:5484
- C:\Windows\System\KeBbvvC.exe
  C:\Windows\System\KeBbvvC.exe
  2⤵
  PID:5756
- C:\Windows\System\PnMWJRK.exe
  C:\Windows\System\PnMWJRK.exe
  2⤵
  PID:5912
- C:\Windows\System\LscvBWq.exe
  C:\Windows\System\LscvBWq.exe
  2⤵
  PID:5392
- C:\Windows\System\DumzFko.exe
  C:\Windows\System\DumzFko.exe
  2⤵
  PID:4920
- C:\Windows\System\BnLEsIL.exe
  C:\Windows\System\BnLEsIL.exe
  2⤵
  PID:5556
- C:\Windows\System\ueUswlj.exe
  C:\Windows\System\ueUswlj.exe
  2⤵
  PID:5880
- C:\Windows\System\SUayQKE.exe
  C:\Windows\System\SUayQKE.exe
  2⤵
  PID:5672
- C:\Windows\System\JIpBjLw.exe
  C:\Windows\System\JIpBjLw.exe
  2⤵
  PID:5964
- C:\Windows\System\lEMTXZH.exe
  C:\Windows\System\lEMTXZH.exe
  2⤵
  PID:5724
- C:\Windows\System\ZxwWlvW.exe
  C:\Windows\System\ZxwWlvW.exe
  2⤵
  PID:5284
- C:\Windows\System\SvGBxvM.exe
  C:\Windows\System\SvGBxvM.exe
  2⤵
  PID:6156
- C:\Windows\System\sXPkggK.exe
  C:\Windows\System\sXPkggK.exe
  2⤵
  PID:6172
- C:\Windows\System\FZbmAmn.exe
  C:\Windows\System\FZbmAmn.exe
  2⤵
  PID:6192
- C:\Windows\System\OrtlbUB.exe
  C:\Windows\System\OrtlbUB.exe
  2⤵
  PID:6208
- C:\Windows\System\GdLacbb.exe
  C:\Windows\System\GdLacbb.exe
  2⤵
  PID:6228
- C:\Windows\System\qzHIhwJ.exe
  C:\Windows\System\qzHIhwJ.exe
  2⤵
  PID:6244
- C:\Windows\System\zpQEADA.exe
  C:\Windows\System\zpQEADA.exe
  2⤵
  PID:6264
- C:\Windows\System\oTSmqLi.exe
  C:\Windows\System\oTSmqLi.exe
  2⤵
  PID:6280
- C:\Windows\System\FpLbJfG.exe
  C:\Windows\System\FpLbJfG.exe
  2⤵
  PID:6296
- C:\Windows\System\gssiWEf.exe
  C:\Windows\System\gssiWEf.exe
  2⤵
  PID:6316
- C:\Windows\System\zpOxjud.exe
  C:\Windows\System\zpOxjud.exe
  2⤵
  PID:6332
- C:\Windows\System\OJDaDwP.exe
  C:\Windows\System\OJDaDwP.exe
  2⤵
  PID:6348
- C:\Windows\System\JTxdxuL.exe
  C:\Windows\System\JTxdxuL.exe
  2⤵
  PID:6364
- C:\Windows\System\ZTQpvwg.exe
  C:\Windows\System\ZTQpvwg.exe
  2⤵
  PID:6380
- C:\Windows\System\lfTKcYh.exe
  C:\Windows\System\lfTKcYh.exe
  2⤵
  PID:6396
- C:\Windows\System\pSLcyvG.exe
  C:\Windows\System\pSLcyvG.exe
  2⤵
  PID:6424
- C:\Windows\System\nKppSfd.exe
  C:\Windows\System\nKppSfd.exe
  2⤵
  PID:6444
- C:\Windows\System\DBrrqPv.exe
  C:\Windows\System\DBrrqPv.exe
  2⤵
  PID:6460
- C:\Windows\System\MWAZVTk.exe
  C:\Windows\System\MWAZVTk.exe
  2⤵
  PID:6488
- C:\Windows\System\QLHYFbm.exe
  C:\Windows\System\QLHYFbm.exe
  2⤵
  PID:6504
- C:\Windows\System\grklBOv.exe
  C:\Windows\System\grklBOv.exe
  2⤵
  PID:6520
- C:\Windows\System\ijyOdMG.exe
  C:\Windows\System\ijyOdMG.exe
  2⤵
  PID:6536
- C:\Windows\System\sLySJKZ.exe
  C:\Windows\System\sLySJKZ.exe
  2⤵
  PID:6552
- C:\Windows\System\GKWUkMN.exe
  C:\Windows\System\GKWUkMN.exe
  2⤵
  PID:6568
- C:\Windows\System\ZkvNtKf.exe
  C:\Windows\System\ZkvNtKf.exe
  2⤵
  PID:6584
- C:\Windows\System\ORkCptn.exe
  C:\Windows\System\ORkCptn.exe
  2⤵
  PID:6600
- C:\Windows\System\DDMehuQ.exe
  C:\Windows\System\DDMehuQ.exe
  2⤵
  PID:6616
- C:\Windows\System\bowVGVR.exe
  C:\Windows\System\bowVGVR.exe
  2⤵
  PID:6632
- C:\Windows\System\YiFmCQy.exe
  C:\Windows\System\YiFmCQy.exe
  2⤵
  PID:6648
- C:\Windows\System\TOHGemg.exe
  C:\Windows\System\TOHGemg.exe
  2⤵
  PID:6664
- C:\Windows\System\DonXixi.exe
  C:\Windows\System\DonXixi.exe
  2⤵
  PID:6680
- C:\Windows\System\NiGFkol.exe
  C:\Windows\System\NiGFkol.exe
  2⤵
  PID:6696
- C:\Windows\System\uXQnBWa.exe
  C:\Windows\System\uXQnBWa.exe
  2⤵
  PID:6712
- C:\Windows\System\PEByKCr.exe
  C:\Windows\System\PEByKCr.exe
  2⤵
  PID:6728
- C:\Windows\System\BRWHujW.exe
  C:\Windows\System\BRWHujW.exe
  2⤵
  PID:6744
- C:\Windows\System\RPKSIbs.exe
  C:\Windows\System\RPKSIbs.exe
  2⤵
  PID:6760
- C:\Windows\System\jepFkgW.exe
  C:\Windows\System\jepFkgW.exe
  2⤵
  PID:6776
- C:\Windows\System\UDSBnGq.exe
  C:\Windows\System\UDSBnGq.exe
  2⤵
  PID:6792
- C:\Windows\System\dprXTBl.exe
  C:\Windows\System\dprXTBl.exe
  2⤵
  PID:6808
- C:\Windows\System\PNTrKKP.exe
  C:\Windows\System\PNTrKKP.exe
  2⤵
  PID:6824
- C:\Windows\System\xGHnJFL.exe
  C:\Windows\System\xGHnJFL.exe
  2⤵
  PID:6840
- C:\Windows\System\xpiTBMi.exe
  C:\Windows\System\xpiTBMi.exe
  2⤵
  PID:6856
- C:\Windows\System\zGBzPZM.exe
  C:\Windows\System\zGBzPZM.exe
  2⤵
  PID:6872
- C:\Windows\System\izwdFkx.exe
  C:\Windows\System\izwdFkx.exe
  2⤵
  PID:6888
- C:\Windows\System\ktQBAno.exe
  C:\Windows\System\ktQBAno.exe
  2⤵
  PID:6908
- C:\Windows\System\eAYOWfS.exe
  C:\Windows\System\eAYOWfS.exe
  2⤵
  PID:6924
- C:\Windows\System\hOuWZDD.exe
  C:\Windows\System\hOuWZDD.exe
  2⤵
  PID:6940
- C:\Windows\System\cUwAWJU.exe
  C:\Windows\System\cUwAWJU.exe
  2⤵
  PID:6956
- C:\Windows\System\SGUvGWn.exe
  C:\Windows\System\SGUvGWn.exe
  2⤵
  PID:6972
- C:\Windows\System\IHVbKFX.exe
  C:\Windows\System\IHVbKFX.exe
  2⤵
  PID:6988
- C:\Windows\System\vQBryzr.exe
  C:\Windows\System\vQBryzr.exe
  2⤵
  PID:7004
- C:\Windows\System\JjTGcfc.exe
  C:\Windows\System\JjTGcfc.exe
  2⤵
  PID:7020
- C:\Windows\System\cBowNUc.exe
  C:\Windows\System\cBowNUc.exe
  2⤵
  PID:7036
- C:\Windows\System\dNRBwID.exe
  C:\Windows\System\dNRBwID.exe
  2⤵
  PID:7052
- C:\Windows\System\hiGiEmr.exe
  C:\Windows\System\hiGiEmr.exe
  2⤵
  PID:7068
- C:\Windows\System\otbEVie.exe
  C:\Windows\System\otbEVie.exe
  2⤵
  PID:7084
- C:\Windows\System\ovgUVCw.exe
  C:\Windows\System\ovgUVCw.exe
  2⤵
  PID:7100
- C:\Windows\System\rwImLmc.exe
  C:\Windows\System\rwImLmc.exe
  2⤵
  PID:7116
- C:\Windows\System\xENvzNz.exe
  C:\Windows\System\xENvzNz.exe
  2⤵
  PID:7132
- C:\Windows\System\XvEzdlL.exe
  C:\Windows\System\XvEzdlL.exe
  2⤵
  PID:7148
- C:\Windows\System\YZOzsWH.exe
  C:\Windows\System\YZOzsWH.exe
  2⤵
  PID:7164
- C:\Windows\System\aEFsILo.exe
  C:\Windows\System\aEFsILo.exe
  2⤵
  PID:4176
- C:\Windows\System\QpNrFqP.exe
  C:\Windows\System\QpNrFqP.exe
  2⤵
  PID:6152
- C:\Windows\System\BGEKqZC.exe
  C:\Windows\System\BGEKqZC.exe
  2⤵
  PID:6216
- C:\Windows\System\proAFFA.exe
  C:\Windows\System\proAFFA.exe
  2⤵
  PID:6256
- C:\Windows\System\MhijUjJ.exe
  C:\Windows\System\MhijUjJ.exe
  2⤵
  PID:6324
- C:\Windows\System\lsUBFIm.exe
  C:\Windows\System\lsUBFIm.exe
  2⤵
  PID:6092
- C:\Windows\System\wsvHPUO.exe
  C:\Windows\System\wsvHPUO.exe
  2⤵
  PID:5656
- C:\Windows\System\itQUhLq.exe
  C:\Windows\System\itQUhLq.exe
  2⤵
  PID:5916
- C:\Windows\System\nTxtQgK.exe
  C:\Windows\System\nTxtQgK.exe
  2⤵
  PID:5220
- C:\Windows\System\BxreufG.exe
  C:\Windows\System\BxreufG.exe
  2⤵
  PID:5376
- C:\Windows\System\mxhwxBt.exe
  C:\Windows\System\mxhwxBt.exe
  2⤵
  PID:6240
- C:\Windows\System\JUmECIm.exe
  C:\Windows\System\JUmECIm.exe
  2⤵
  PID:6388
- C:\Windows\System\KpNYITL.exe
  C:\Windows\System\KpNYITL.exe
  2⤵
  PID:6432
- C:\Windows\System\CVTaHaw.exe
  C:\Windows\System\CVTaHaw.exe
  2⤵
  PID:6312
- C:\Windows\System\CTWZemB.exe
  C:\Windows\System\CTWZemB.exe
  2⤵
  PID:6372
- C:\Windows\System\dWDfCYP.exe
  C:\Windows\System\dWDfCYP.exe
  2⤵
  PID:6412
- C:\Windows\System\qIUgDdC.exe
  C:\Windows\System\qIUgDdC.exe
  2⤵
  PID:6436
- C:\Windows\System\dDugVtN.exe
  C:\Windows\System\dDugVtN.exe
  2⤵
  PID:5620
- C:\Windows\System\SAkZWCu.exe
  C:\Windows\System\SAkZWCu.exe
  2⤵
  PID:6484
- C:\Windows\System\hssgQYU.exe
  C:\Windows\System\hssgQYU.exe
  2⤵
  PID:6548
- C:\Windows\System\QqCoBpe.exe
  C:\Windows\System\QqCoBpe.exe
  2⤵
  PID:6612
- C:\Windows\System\LrzsnIL.exe
  C:\Windows\System\LrzsnIL.exe
  2⤵
  PID:6532
- C:\Windows\System\DWFnQSe.exe
  C:\Windows\System\DWFnQSe.exe
  2⤵
  PID:6592
- C:\Windows\System\vzUSHuA.exe
  C:\Windows\System\vzUSHuA.exe
  2⤵
  PID:6672
- C:\Windows\System\ehrdFbF.exe
  C:\Windows\System\ehrdFbF.exe
  2⤵
  PID:6704
- C:\Windows\System\WRueBZT.exe
  C:\Windows\System\WRueBZT.exe
  2⤵
  PID:6624
- C:\Windows\System\WOnjXAp.exe
  C:\Windows\System\WOnjXAp.exe
  2⤵
  PID:6688
- C:\Windows\System\ZFLDCGC.exe
  C:\Windows\System\ZFLDCGC.exe
  2⤵
  PID:6788
- C:\Windows\System\DkItiVa.exe
  C:\Windows\System\DkItiVa.exe
  2⤵
  PID:6852
- C:\Windows\System\zJmANce.exe
  C:\Windows\System\zJmANce.exe
  2⤵
  PID:6920
- C:\Windows\System\pyartLj.exe
  C:\Windows\System\pyartLj.exe
  2⤵
  PID:6984
- C:\Windows\System\MFELabs.exe
  C:\Windows\System\MFELabs.exe
  2⤵
  PID:7028
- C:\Windows\System\dApjyBc.exe
  C:\Windows\System\dApjyBc.exe
  2⤵
  PID:6768
- C:\Windows\System\TKxypEY.exe
  C:\Windows\System\TKxypEY.exe
  2⤵
  PID:6832
- C:\Windows\System\JjKneWi.exe
  C:\Windows\System\JjKneWi.exe
  2⤵
  PID:6900
- C:\Windows\System\akQsWKA.exe
  C:\Windows\System\akQsWKA.exe
  2⤵
  PID:6996
- C:\Windows\System\mFEeSNH.exe
  C:\Windows\System\mFEeSNH.exe
  2⤵
  PID:7080
- C:\Windows\System\YihJpFo.exe
  C:\Windows\System\YihJpFo.exe
  2⤵
  PID:7144
- C:\Windows\System\GbfVrry.exe
  C:\Windows\System\GbfVrry.exe
  2⤵
  PID:6184
- C:\Windows\System\LXuNOJP.exe
  C:\Windows\System\LXuNOJP.exe
  2⤵
  PID:7060
- C:\Windows\System\GWpsHql.exe
  C:\Windows\System\GWpsHql.exe
  2⤵
  PID:5616
- C:\Windows\System\iweXNBk.exe
  C:\Windows\System\iweXNBk.exe
  2⤵
  PID:6392
- C:\Windows\System\apItbiC.exe
  C:\Windows\System\apItbiC.exe
  2⤵
  PID:6456
- C:\Windows\System\orVWyKn.exe
  C:\Windows\System\orVWyKn.exe
  2⤵
  PID:6580
- C:\Windows\System\AAEcWdY.exe
  C:\Windows\System\AAEcWdY.exe
  2⤵
  PID:1572
- C:\Windows\System\GHQbgyc.exe
  C:\Windows\System\GHQbgyc.exe
  2⤵
  PID:6740
- C:\Windows\System\fHiLWAy.exe
  C:\Windows\System\fHiLWAy.exe
  2⤵
  PID:6224
- C:\Windows\System\hmFfZIQ.exe
  C:\Windows\System\hmFfZIQ.exe
  2⤵
  PID:6356
- C:\Windows\System\RCHRtOA.exe
  C:\Windows\System\RCHRtOA.exe
  2⤵
  PID:7124
- C:\Windows\System\SrCfcmp.exe
  C:\Windows\System\SrCfcmp.exe
  2⤵
  PID:6148
- C:\Windows\System\KjqWTtt.exe
  C:\Windows\System\KjqWTtt.exe
  2⤵
  PID:5384
- C:\Windows\System\KsgCqoQ.exe
  C:\Windows\System\KsgCqoQ.exe
  2⤵
  PID:6848
- C:\Windows\System\IantdXP.exe
  C:\Windows\System\IantdXP.exe
  2⤵
  PID:6200
- C:\Windows\System\kLbaXze.exe
  C:\Windows\System\kLbaXze.exe
  2⤵
  PID:7140
- C:\Windows\System\ypBnndF.exe
  C:\Windows\System\ypBnndF.exe
  2⤵
  PID:5648
- C:\Windows\System\TwQbwUX.exe
  C:\Windows\System\TwQbwUX.exe
  2⤵
  PID:6724
- C:\Windows\System\FnrqJUb.exe
  C:\Windows\System\FnrqJUb.exe
  2⤵
  PID:5720
- C:\Windows\System\LTmWlFV.exe
  C:\Windows\System\LTmWlFV.exe
  2⤵
  PID:6308
- C:\Windows\System\uiiArtF.exe
  C:\Windows\System\uiiArtF.exe
  2⤵
  PID:6472
- C:\Windows\System\PnAMSiY.exe
  C:\Windows\System\PnAMSiY.exe
  2⤵
  PID:6640
- C:\Windows\System\aISACdV.exe
  C:\Windows\System\aISACdV.exe
  2⤵
  PID:6756
- C:\Windows\System\JmErYwP.exe
  C:\Windows\System\JmErYwP.exe
  2⤵
  PID:7000
- C:\Windows\System\hiPgJdx.exe
  C:\Windows\System\hiPgJdx.exe
  2⤵
  PID:7016
- C:\Windows\System\peXATsV.exe
  C:\Windows\System\peXATsV.exe
  2⤵
  PID:6236
- C:\Windows\System\usStXpT.exe
  C:\Windows\System\usStXpT.exe
  2⤵
  PID:6304
- C:\Windows\System\xzlBavn.exe
  C:\Windows\System\xzlBavn.exe
  2⤵
  PID:6916
- C:\Windows\System\dIRvQgl.exe
  C:\Windows\System\dIRvQgl.exe
  2⤵
  PID:6864
- C:\Windows\System\atqdxjV.exe
  C:\Windows\System\atqdxjV.exe
  2⤵
  PID:5800
- C:\Windows\System\WInkIGl.exe
  C:\Windows\System\WInkIGl.exe
  2⤵
  PID:7092
- C:\Windows\System\iTeskxs.exe
  C:\Windows\System\iTeskxs.exe
  2⤵
  PID:6804
- C:\Windows\System\sHcrCcA.exe
  C:\Windows\System\sHcrCcA.exe
  2⤵
  PID:6564
- C:\Windows\System\yKTDHxU.exe
  C:\Windows\System\yKTDHxU.exe
  2⤵
  PID:6628
- C:\Windows\System\gaYCkVX.exe
  C:\Windows\System\gaYCkVX.exe
  2⤵
  PID:6528
- C:\Windows\System\hjyWUbV.exe
  C:\Windows\System\hjyWUbV.exe
  2⤵
  PID:6936
- C:\Windows\System\EeBHWxn.exe
  C:\Windows\System\EeBHWxn.exe
  2⤵
  PID:7176
- C:\Windows\System\yIgHkFq.exe
  C:\Windows\System\yIgHkFq.exe
  2⤵
  PID:7196
- C:\Windows\System\OoQhjVI.exe
  C:\Windows\System\OoQhjVI.exe
  2⤵
  PID:7212
- C:\Windows\System\hWGoesh.exe
  C:\Windows\System\hWGoesh.exe
  2⤵
  PID:7228
- C:\Windows\System\UgdzhQV.exe
  C:\Windows\System\UgdzhQV.exe
  2⤵
  PID:7244
- C:\Windows\System\ZtXiJkS.exe
  C:\Windows\System\ZtXiJkS.exe
  2⤵
  PID:7260
- C:\Windows\System\SLpwkPM.exe
  C:\Windows\System\SLpwkPM.exe
  2⤵
  PID:7276
- C:\Windows\System\ABDIPOq.exe
  C:\Windows\System\ABDIPOq.exe
  2⤵
  PID:7292
- C:\Windows\System\THyRIOl.exe
  C:\Windows\System\THyRIOl.exe
  2⤵
  PID:7308
- C:\Windows\System\KndqSMH.exe
  C:\Windows\System\KndqSMH.exe
  2⤵
  PID:7324
- C:\Windows\System\LMFjACp.exe
  C:\Windows\System\LMFjACp.exe
  2⤵
  PID:7340
- C:\Windows\System\BQwMGHC.exe
  C:\Windows\System\BQwMGHC.exe
  2⤵
  PID:7356
- C:\Windows\System\zvvlCVw.exe
  C:\Windows\System\zvvlCVw.exe
  2⤵
  PID:7372
- C:\Windows\System\TOprrfI.exe
  C:\Windows\System\TOprrfI.exe
  2⤵
  PID:7388
- C:\Windows\System\SvdBWIv.exe
  C:\Windows\System\SvdBWIv.exe
  2⤵
  PID:7404
- C:\Windows\System\nhScaIB.exe
  C:\Windows\System\nhScaIB.exe
  2⤵
  PID:7420
- C:\Windows\System\ZCJbBKw.exe
  C:\Windows\System\ZCJbBKw.exe
  2⤵
  PID:7436
- C:\Windows\System\rkWkGiC.exe
  C:\Windows\System\rkWkGiC.exe
  2⤵
  PID:7452
- C:\Windows\System\ucLmXOx.exe
  C:\Windows\System\ucLmXOx.exe
  2⤵
  PID:7468
- C:\Windows\System\vOKZLDj.exe
  C:\Windows\System\vOKZLDj.exe
  2⤵
  PID:7484
- C:\Windows\System\oWawTEP.exe
  C:\Windows\System\oWawTEP.exe
  2⤵
  PID:7500
- C:\Windows\System\ccEtDTa.exe
  C:\Windows\System\ccEtDTa.exe
  2⤵
  PID:7516
- C:\Windows\System\ExQEYme.exe
  C:\Windows\System\ExQEYme.exe
  2⤵
  PID:7532
- C:\Windows\System\xJfnRvo.exe
  C:\Windows\System\xJfnRvo.exe
  2⤵
  PID:7548
- C:\Windows\System\SkXSFqb.exe
  C:\Windows\System\SkXSFqb.exe
  2⤵
  PID:7564
- C:\Windows\System\ILTVgqH.exe
  C:\Windows\System\ILTVgqH.exe
  2⤵
  PID:7580
- C:\Windows\System\nvlxSzM.exe
  C:\Windows\System\nvlxSzM.exe
  2⤵
  PID:7596
- C:\Windows\System\nfWcUsR.exe
  C:\Windows\System\nfWcUsR.exe
  2⤵
  PID:7612
- C:\Windows\System\FQIebis.exe
  C:\Windows\System\FQIebis.exe
  2⤵
  PID:7628
- C:\Windows\System\gThbVrX.exe
  C:\Windows\System\gThbVrX.exe
  2⤵
  PID:7644
- C:\Windows\System\PBEXohr.exe
  C:\Windows\System\PBEXohr.exe
  2⤵
  PID:7660
- C:\Windows\System\xEJtPVA.exe
  C:\Windows\System\xEJtPVA.exe
  2⤵
  PID:7676
- C:\Windows\System\CUfEEJH.exe
  C:\Windows\System\CUfEEJH.exe
  2⤵
  PID:7692
- C:\Windows\System\RjPOceE.exe
  C:\Windows\System\RjPOceE.exe
  2⤵
  PID:7712
- C:\Windows\System\VnFELdA.exe
  C:\Windows\System\VnFELdA.exe
  2⤵
  PID:7728
- C:\Windows\System\hvLDkJH.exe
  C:\Windows\System\hvLDkJH.exe
  2⤵
  PID:7748
- C:\Windows\System\OECcnnn.exe
  C:\Windows\System\OECcnnn.exe
  2⤵
  PID:7764
- C:\Windows\System\rSoqTbC.exe
  C:\Windows\System\rSoqTbC.exe
  2⤵
  PID:7780
- C:\Windows\System\fceNBQB.exe
  C:\Windows\System\fceNBQB.exe
  2⤵
  PID:7796
- C:\Windows\System\OuRnUVJ.exe
  C:\Windows\System\OuRnUVJ.exe
  2⤵
  PID:7812
- C:\Windows\System\vxwSOSe.exe
  C:\Windows\System\vxwSOSe.exe
  2⤵
  PID:7828
- C:\Windows\System\ntvfZiJ.exe
  C:\Windows\System\ntvfZiJ.exe
  2⤵
  PID:7844
- C:\Windows\System\JvZqkEX.exe
  C:\Windows\System\JvZqkEX.exe
  2⤵
  PID:7860
- C:\Windows\System\MOWfNRd.exe
  C:\Windows\System\MOWfNRd.exe
  2⤵
  PID:7876
- C:\Windows\System\uFGeyQP.exe
  C:\Windows\System\uFGeyQP.exe
  2⤵
  PID:7892
- C:\Windows\System\inSexmY.exe
  C:\Windows\System\inSexmY.exe
  2⤵
  PID:7908
- C:\Windows\System\BRagQiP.exe
  C:\Windows\System\BRagQiP.exe
  2⤵
  PID:7924
- C:\Windows\System\CFGGSMU.exe
  C:\Windows\System\CFGGSMU.exe
  2⤵
  PID:7944
- C:\Windows\System\QUXQsaA.exe
  C:\Windows\System\QUXQsaA.exe
  2⤵
  PID:7960
- C:\Windows\System\VNOOPWg.exe
  C:\Windows\System\VNOOPWg.exe
  2⤵
  PID:7976
- C:\Windows\System\yljYRHj.exe
  C:\Windows\System\yljYRHj.exe
  2⤵
  PID:7992
- C:\Windows\System\tjRTXoe.exe
  C:\Windows\System\tjRTXoe.exe
  2⤵
  PID:8008
- C:\Windows\System\SXVYOAT.exe
  C:\Windows\System\SXVYOAT.exe
  2⤵
  PID:8024
- C:\Windows\System\jKCPLQz.exe
  C:\Windows\System\jKCPLQz.exe
  2⤵
  PID:8040
- C:\Windows\System\bYrSUNJ.exe
  C:\Windows\System\bYrSUNJ.exe
  2⤵
  PID:8056
- C:\Windows\System\goHdYwN.exe
  C:\Windows\System\goHdYwN.exe
  2⤵
  PID:8072
- C:\Windows\System\mpyQBws.exe
  C:\Windows\System\mpyQBws.exe
  2⤵
  PID:8088
- C:\Windows\System\pBOppRT.exe
  C:\Windows\System\pBOppRT.exe
  2⤵
  PID:8104
- C:\Windows\System\OuMgIcD.exe
  C:\Windows\System\OuMgIcD.exe
  2⤵
  PID:8124
- C:\Windows\System\nuZvlTx.exe
  C:\Windows\System\nuZvlTx.exe
  2⤵
  PID:8140
- C:\Windows\System\yvwWGXf.exe
  C:\Windows\System\yvwWGXf.exe
  2⤵
  PID:8156
- C:\Windows\System\bKSToEC.exe
  C:\Windows\System\bKSToEC.exe
  2⤵
  PID:8172
- C:\Windows\System\VwlEbwe.exe
  C:\Windows\System\VwlEbwe.exe
  2⤵
  PID:6408
- C:\Windows\System\beYqWLe.exe
  C:\Windows\System\beYqWLe.exe
  2⤵
  PID:7032
- C:\Windows\System\hPOeZiU.exe
  C:\Windows\System\hPOeZiU.exe
  2⤵
  PID:7076
- C:\Windows\System\mSRZJic.exe
  C:\Windows\System\mSRZJic.exe
  2⤵
  PID:7220
- C:\Windows\System\ktaoObL.exe
  C:\Windows\System\ktaoObL.exe
  2⤵
  PID:7240
- C:\Windows\System\kWCGuIS.exe
  C:\Windows\System\kWCGuIS.exe
  2⤵
  PID:7320
- C:\Windows\System\EGnoYWt.exe
  C:\Windows\System\EGnoYWt.exe
  2⤵
  PID:7332
- C:\Windows\System\EnjpWKo.exe
  C:\Windows\System\EnjpWKo.exe
  2⤵
  PID:7336
- C:\Windows\System\DDzQQXI.exe
  C:\Windows\System\DDzQQXI.exe
  2⤵
  PID:7348
- C:\Windows\System\QhIAImc.exe
  C:\Windows\System\QhIAImc.exe
  2⤵
  PID:7416
- C:\Windows\System\JZRjYUj.exe
  C:\Windows\System\JZRjYUj.exe
  2⤵
  PID:7476
- C:\Windows\System\VUJGkPn.exe
  C:\Windows\System\VUJGkPn.exe
  2⤵
  PID:7400
- C:\Windows\System\onKJbki.exe
  C:\Windows\System\onKJbki.exe
  2⤵
  PID:7460
- C:\Windows\System\MBeRUQD.exe
  C:\Windows\System\MBeRUQD.exe
  2⤵
  PID:7492
- C:\Windows\System\GmgWpjO.exe
  C:\Windows\System\GmgWpjO.exe
  2⤵
  PID:7560
- C:\Windows\System\ilQAGJn.exe
  C:\Windows\System\ilQAGJn.exe
  2⤵
  PID:7624
- C:\Windows\System\mtdJXWY.exe
  C:\Windows\System\mtdJXWY.exe
  2⤵
  PID:7604
- C:\Windows\System\GXdRHjR.exe
  C:\Windows\System\GXdRHjR.exe
  2⤵
  PID:7684
- C:\Windows\System\JtdfldJ.exe
  C:\Windows\System\JtdfldJ.exe
  2⤵
  PID:7756
- C:\Windows\System\YAocPKb.exe
  C:\Windows\System\YAocPKb.exe
  2⤵
  PID:7820
- C:\Windows\System\UOhScWO.exe
  C:\Windows\System\UOhScWO.exe
  2⤵
  PID:7984
- C:\Windows\System\vPrkHNf.exe
  C:\Windows\System\vPrkHNf.exe
  2⤵
  PID:8048
- C:\Windows\System\WoGXPVI.exe
  C:\Windows\System\WoGXPVI.exe
  2⤵
  PID:8084
- C:\Windows\System\vyREXFz.exe
  C:\Windows\System\vyREXFz.exe
  2⤵
  PID:7972
- C:\Windows\System\zfMRElv.exe
  C:\Windows\System\zfMRElv.exe
  2⤵
  PID:8036
- C:\Windows\System\aSrbgRc.exe
  C:\Windows\System\aSrbgRc.exe
  2⤵
  PID:7968
- C:\Windows\System\qVaGbHb.exe
  C:\Windows\System\qVaGbHb.exe
  2⤵
  PID:7776
- C:\Windows\System\tbpMSZQ.exe
  C:\Windows\System\tbpMSZQ.exe
  2⤵
  PID:7840
- C:\Windows\System\HDdmiRO.exe
  C:\Windows\System\HDdmiRO.exe
  2⤵
  PID:7904
- C:\Windows\System\WPkoopG.exe
  C:\Windows\System\WPkoopG.exe
  2⤵
  PID:8112
- C:\Windows\System\ajXjfZQ.exe
  C:\Windows\System\ajXjfZQ.exe
  2⤵
  PID:8132
- C:\Windows\System\wfVhvIe.exe
  C:\Windows\System\wfVhvIe.exe
  2⤵
  PID:7384
- C:\Windows\System\MYxYgEE.exe
  C:\Windows\System\MYxYgEE.exe
  2⤵
  PID:7576
- C:\Windows\System\CqCJxlE.exe
  C:\Windows\System\CqCJxlE.exe
  2⤵
  PID:7640
- C:\Windows\System\CvqkWpY.exe
  C:\Windows\System\CvqkWpY.exe
  2⤵
  PID:8148
- C:\Windows\System\vTMZhPn.exe
  C:\Windows\System\vTMZhPn.exe
  2⤵
  PID:7444
- C:\Windows\System\cFdKYtB.exe
  C:\Windows\System\cFdKYtB.exe
  2⤵
  PID:7524
- C:\Windows\System\VmvLmpt.exe
  C:\Windows\System\VmvLmpt.exe
  2⤵
  PID:7608
- C:\Windows\System\rfScgLj.exe
  C:\Windows\System\rfScgLj.exe
  2⤵
  PID:7544
- C:\Windows\System\pGHWvYE.exe
  C:\Windows\System\pGHWvYE.exe
  2⤵
  PID:7916
- C:\Windows\System\XVDSUyF.exe
  C:\Windows\System\XVDSUyF.exe
  2⤵
  PID:7192
- C:\Windows\System\jWoWEfG.exe
  C:\Windows\System\jWoWEfG.exe
  2⤵
  PID:7208
- C:\Windows\System\pKwJXNp.exe
  C:\Windows\System\pKwJXNp.exe
  2⤵
  PID:8164
- C:\Windows\System\faMXlIg.exe
  C:\Windows\System\faMXlIg.exe
  2⤵
  PID:7316
- C:\Windows\System\tRHtvdE.exe
  C:\Windows\System\tRHtvdE.exe
  2⤵
  PID:7224
- C:\Windows\System\pRmwKEa.exe
  C:\Windows\System\pRmwKEa.exe
  2⤵
  PID:7872
- C:\Windows\System\EOPAsqW.exe
  C:\Windows\System\EOPAsqW.exe
  2⤵
  PID:8120
- C:\Windows\System\GuqKNph.exe
  C:\Windows\System\GuqKNph.exe
  2⤵
  PID:7432
- C:\Windows\System\GDWuVle.exe
  C:\Windows\System\GDWuVle.exe
  2⤵
  PID:6800
- C:\Windows\System\MGAYfXk.exe
  C:\Windows\System\MGAYfXk.exe
  2⤵
  PID:7556
- C:\Windows\System\WcVszUN.exe
  C:\Windows\System\WcVszUN.exe
  2⤵
  PID:8064
- C:\Windows\System\MokHTRG.exe
  C:\Windows\System\MokHTRG.exe
  2⤵
  PID:7592
- C:\Windows\System\AoGEMZa.exe
  C:\Windows\System\AoGEMZa.exe
  2⤵
  PID:7656
- C:\Windows\System\tvawdmw.exe
  C:\Windows\System\tvawdmw.exe
  2⤵
  PID:8020
- C:\Windows\System\tdiqMLS.exe
  C:\Windows\System\tdiqMLS.exe
  2⤵
  PID:7772
- C:\Windows\System\lSdhOFf.exe
  C:\Windows\System\lSdhOFf.exe
  2⤵
  PID:8004
- C:\Windows\System\cTuAHGS.exe
  C:\Windows\System\cTuAHGS.exe
  2⤵
  PID:7112
- C:\Windows\System\tNiNKUQ.exe
  C:\Windows\System\tNiNKUQ.exe
  2⤵
  PID:7792
- C:\Windows\System\rpFKHjR.exe
  C:\Windows\System\rpFKHjR.exe
  2⤵
  PID:8180
- C:\Windows\System\juWzRXu.exe
  C:\Windows\System\juWzRXu.exe
  2⤵
  PID:7304
- C:\Windows\System\ZQAzsqO.exe
  C:\Windows\System\ZQAzsqO.exe
  2⤵
  PID:7172
- C:\Windows\System\kQWHMrx.exe
  C:\Windows\System\kQWHMrx.exe
  2⤵
  PID:7940
- C:\Windows\System\yZjAmOn.exe
  C:\Windows\System\yZjAmOn.exe
  2⤵
  PID:7288
- C:\Windows\System\cGaXjZe.exe
  C:\Windows\System\cGaXjZe.exe
  2⤵
  PID:7736
- C:\Windows\System\DTKLDtJ.exe
  C:\Windows\System\DTKLDtJ.exe
  2⤵
  PID:8196
- C:\Windows\System\naSnsOH.exe
  C:\Windows\System\naSnsOH.exe
  2⤵
  PID:8212
- C:\Windows\System\XEwKiJY.exe
  C:\Windows\System\XEwKiJY.exe
  2⤵
  PID:8228
- C:\Windows\System\kKSGjus.exe
  C:\Windows\System\kKSGjus.exe
  2⤵
  PID:8244
- C:\Windows\System\EXwyxtO.exe
  C:\Windows\System\EXwyxtO.exe
  2⤵
  PID:8260
- C:\Windows\System\XpXhBxN.exe
  C:\Windows\System\XpXhBxN.exe
  2⤵
  PID:8276
- C:\Windows\System\HaJTvmf.exe
  C:\Windows\System\HaJTvmf.exe
  2⤵
  PID:8292
- C:\Windows\System\IxdxBxZ.exe
  C:\Windows\System\IxdxBxZ.exe
  2⤵
  PID:8308
- C:\Windows\System\hKiFhtM.exe
  C:\Windows\System\hKiFhtM.exe
  2⤵
  PID:8324
- C:\Windows\System\LWMZeeT.exe
  C:\Windows\System\LWMZeeT.exe
  2⤵
  PID:8340
- C:\Windows\System\LqdtykR.exe
  C:\Windows\System\LqdtykR.exe
  2⤵
  PID:8356
- C:\Windows\System\aDpdaPZ.exe
  C:\Windows\System\aDpdaPZ.exe
  2⤵
  PID:8372
- C:\Windows\System\TdvZesc.exe
  C:\Windows\System\TdvZesc.exe
  2⤵
  PID:8388
- C:\Windows\System\LpQqciU.exe
  C:\Windows\System\LpQqciU.exe
  2⤵
  PID:8404
- C:\Windows\System\vKjlEkK.exe
  C:\Windows\System\vKjlEkK.exe
  2⤵
  PID:8420
- C:\Windows\System\SjcDqam.exe
  C:\Windows\System\SjcDqam.exe
  2⤵
  PID:8436
- C:\Windows\System\HytFNmE.exe
  C:\Windows\System\HytFNmE.exe
  2⤵
  PID:8452
- C:\Windows\System\KWHAgJy.exe
  C:\Windows\System\KWHAgJy.exe
  2⤵
  PID:8468
- C:\Windows\System\tXpQqDS.exe
  C:\Windows\System\tXpQqDS.exe
  2⤵
  PID:8484
- C:\Windows\System\evReMhy.exe
  C:\Windows\System\evReMhy.exe
  2⤵
  PID:8500
- C:\Windows\System\QaSNdlL.exe
  C:\Windows\System\QaSNdlL.exe
  2⤵
  PID:8516
- C:\Windows\System\wgZXRzr.exe
  C:\Windows\System\wgZXRzr.exe
  2⤵
  PID:8532
- C:\Windows\System\CzxxWGy.exe
  C:\Windows\System\CzxxWGy.exe
  2⤵
  PID:8548
- C:\Windows\System\DsjTZdP.exe
  C:\Windows\System\DsjTZdP.exe
  2⤵
  PID:8564
- C:\Windows\System\HkCHedc.exe
  C:\Windows\System\HkCHedc.exe
  2⤵
  PID:8580
- C:\Windows\System\otjOMLC.exe
  C:\Windows\System\otjOMLC.exe
  2⤵
  PID:8596
- C:\Windows\System\PxJWnai.exe
  C:\Windows\System\PxJWnai.exe
  2⤵
  PID:8612
- C:\Windows\System\PluqExK.exe
  C:\Windows\System\PluqExK.exe
  2⤵
  PID:8628
- C:\Windows\System\BVtPCTl.exe
  C:\Windows\System\BVtPCTl.exe
  2⤵
  PID:8644
- C:\Windows\System\RsPYywS.exe
  C:\Windows\System\RsPYywS.exe
  2⤵
  PID:8660
- C:\Windows\System\isadHIp.exe
  C:\Windows\System\isadHIp.exe
  2⤵
  PID:8676
- C:\Windows\System\NmWrzdI.exe
  C:\Windows\System\NmWrzdI.exe
  2⤵
  PID:8692
- C:\Windows\System\tGflJuY.exe
  C:\Windows\System\tGflJuY.exe
  2⤵
  PID:8708
- C:\Windows\System\tergXwC.exe
  C:\Windows\System\tergXwC.exe
  2⤵
  PID:8724
- C:\Windows\System\KqvQWmr.exe
  C:\Windows\System\KqvQWmr.exe
  2⤵
  PID:8740
- C:\Windows\System\EKAfPXn.exe
  C:\Windows\System\EKAfPXn.exe
  2⤵
  PID:8756
- C:\Windows\System\JkQfhov.exe
  C:\Windows\System\JkQfhov.exe
  2⤵
  PID:8772
- C:\Windows\System\UyAcRDy.exe
  C:\Windows\System\UyAcRDy.exe
  2⤵
  PID:8788
- C:\Windows\System\iHgjpFz.exe
  C:\Windows\System\iHgjpFz.exe
  2⤵
  PID:8804
- C:\Windows\System\TaHSpuR.exe
  C:\Windows\System\TaHSpuR.exe
  2⤵
  PID:8820
- C:\Windows\System\uaBLIDI.exe
  C:\Windows\System\uaBLIDI.exe
  2⤵
  PID:8836
- C:\Windows\System\TAZDANs.exe
  C:\Windows\System\TAZDANs.exe
  2⤵
  PID:8852
- C:\Windows\System\KYAyaaw.exe
  C:\Windows\System\KYAyaaw.exe
  2⤵
  PID:8868
- C:\Windows\System\xuNVmJk.exe
  C:\Windows\System\xuNVmJk.exe
  2⤵
  PID:8884
- C:\Windows\System\MFLOvir.exe
  C:\Windows\System\MFLOvir.exe
  2⤵
  PID:8900
- C:\Windows\System\XjkVRRe.exe
  C:\Windows\System\XjkVRRe.exe
  2⤵
  PID:8916
- C:\Windows\System\XNWcszW.exe
  C:\Windows\System\XNWcszW.exe
  2⤵
  PID:8932
- C:\Windows\System\GNGPunh.exe
  C:\Windows\System\GNGPunh.exe
  2⤵
  PID:8948
- C:\Windows\System\ugTyBGY.exe
  C:\Windows\System\ugTyBGY.exe
  2⤵
  PID:8964
- C:\Windows\System\YcSJkVp.exe
  C:\Windows\System\YcSJkVp.exe
  2⤵
  PID:8980
- C:\Windows\System\gBkOQIx.exe
  C:\Windows\System\gBkOQIx.exe
  2⤵
  PID:8996
- C:\Windows\System\SBgTkUF.exe
  C:\Windows\System\SBgTkUF.exe
  2⤵
  PID:9012
- C:\Windows\System\hRlBrOy.exe
  C:\Windows\System\hRlBrOy.exe
  2⤵
  PID:9028
- C:\Windows\System\uwNxwth.exe
  C:\Windows\System\uwNxwth.exe
  2⤵
  PID:9044
- C:\Windows\System\ltHPJef.exe
  C:\Windows\System\ltHPJef.exe
  2⤵
  PID:9060
- C:\Windows\System\zGytjfr.exe
  C:\Windows\System\zGytjfr.exe
  2⤵
  PID:9076
- C:\Windows\System\CWCiYNO.exe
  C:\Windows\System\CWCiYNO.exe
  2⤵
  PID:9092
- C:\Windows\System\lRrOIEZ.exe
  C:\Windows\System\lRrOIEZ.exe
  2⤵
  PID:9108
- C:\Windows\System\HlBpQTW.exe
  C:\Windows\System\HlBpQTW.exe
  2⤵
  PID:9124
- C:\Windows\System\SZpMJMj.exe
  C:\Windows\System\SZpMJMj.exe
  2⤵
  PID:9140
- C:\Windows\System\iBPZUMJ.exe
  C:\Windows\System\iBPZUMJ.exe
  2⤵
  PID:9156
- C:\Windows\System\ZWfAJkM.exe
  C:\Windows\System\ZWfAJkM.exe
  2⤵
  PID:9172
- C:\Windows\System\oAxYKkB.exe
  C:\Windows\System\oAxYKkB.exe
  2⤵
  PID:9188
- C:\Windows\System\MRoIAEe.exe
  C:\Windows\System\MRoIAEe.exe
  2⤵
  PID:9204
- C:\Windows\System\QJAaqbq.exe
  C:\Windows\System\QJAaqbq.exe
  2⤵
  PID:7700
- C:\Windows\System\ddKEGtG.exe
  C:\Windows\System\ddKEGtG.exe
  2⤵
  PID:8080
- C:\Windows\System\hVnWBFn.exe
  C:\Windows\System\hVnWBFn.exe
  2⤵
  PID:7364
- C:\Windows\System\IXBxBlw.exe
  C:\Windows\System\IXBxBlw.exe
  2⤵
  PID:8224
- C:\Windows\System\CHZqwuD.exe
  C:\Windows\System\CHZqwuD.exe
  2⤵
  PID:8288
- C:\Windows\System\TEVpeMA.exe
  C:\Windows\System\TEVpeMA.exe
  2⤵
  PID:8240
- C:\Windows\System\HnpIKre.exe
  C:\Windows\System\HnpIKre.exe
  2⤵
  PID:2860
- C:\Windows\System\oCYerXq.exe
  C:\Windows\System\oCYerXq.exe
  2⤵
  PID:8304
- C:\Windows\System\mpKfpsL.exe
  C:\Windows\System\mpKfpsL.exe
  2⤵
  PID:8380
- C:\Windows\System\shTmcaU.exe
  C:\Windows\System\shTmcaU.exe
  2⤵
  PID:8444
- C:\Windows\System\ozaUzWV.exe
  C:\Windows\System\ozaUzWV.exe
  2⤵
  PID:8268
- C:\Windows\System\NfLnYGr.exe
  C:\Windows\System\NfLnYGr.exe
  2⤵
  PID:8540
- C:\Windows\System\YPDwVdP.exe
  C:\Windows\System\YPDwVdP.exe
  2⤵
  PID:8368
- C:\Windows\System\nNgQVig.exe
  C:\Windows\System\nNgQVig.exe
  2⤵
  PID:8432
- C:\Windows\System\eAKzLWK.exe
  C:\Windows\System\eAKzLWK.exe
  2⤵
  PID:8428
- C:\Windows\System\FCgqdIT.exe
  C:\Windows\System\FCgqdIT.exe
  2⤵
  PID:8560
- C:\Windows\System\vPjvpEI.exe
  C:\Windows\System\vPjvpEI.exe
  2⤵
  PID:8556
- C:\Windows\System\JjIWtLX.exe
  C:\Windows\System\JjIWtLX.exe
  2⤵
  PID:8636
- C:\Windows\System\pxfNaZq.exe
  C:\Windows\System\pxfNaZq.exe
  2⤵
  PID:8624
- C:\Windows\System\LexvBDt.exe
  C:\Windows\System\LexvBDt.exe
  2⤵
  PID:8688
- C:\Windows\System\tYfGqcm.exe
  C:\Windows\System\tYfGqcm.exe
  2⤵
  PID:8732
- C:\Windows\System\swVHhzu.exe
  C:\Windows\System\swVHhzu.exe
  2⤵
  PID:8796
- C:\Windows\System\MQjVdLN.exe
  C:\Windows\System\MQjVdLN.exe
  2⤵
  PID:8860
- C:\Windows\System\XlyrhbG.exe
  C:\Windows\System\XlyrhbG.exe
  2⤵
  PID:8924
- C:\Windows\System\aMISOGT.exe
  C:\Windows\System\aMISOGT.exe
  2⤵
  PID:8960
- C:\Windows\System\IxGPEVp.exe
  C:\Windows\System\IxGPEVp.exe
  2⤵
  PID:7368
- C:\Windows\System\kpqfMfc.exe
  C:\Windows\System\kpqfMfc.exe
  2⤵
  PID:8748
- C:\Windows\System\clWiCUN.exe
  C:\Windows\System\clWiCUN.exe
  2⤵
  PID:8876
- C:\Windows\System\oIzNnYq.exe
  C:\Windows\System\oIzNnYq.exe
  2⤵
  PID:9056
- C:\Windows\System\QzrpaIA.exe
  C:\Windows\System\QzrpaIA.exe
  2⤵
  PID:9120
- C:\Windows\System\nOfzbmn.exe
  C:\Windows\System\nOfzbmn.exe
  2⤵
  PID:8912
- C:\Windows\System\GlAmBRZ.exe
  C:\Windows\System\GlAmBRZ.exe
  2⤵
  PID:8784
- C:\Windows\System\XoqitxU.exe
  C:\Windows\System\XoqitxU.exe
  2⤵
  PID:9212
- C:\Windows\System\nDbGhLC.exe
  C:\Windows\System\nDbGhLC.exe
  2⤵
  PID:9132
- C:\Windows\System\ScBokea.exe
  C:\Windows\System\ScBokea.exe
  2⤵
  PID:9068
- C:\Windows\System\DuHoluT.exe
  C:\Windows\System\DuHoluT.exe
  2⤵
  PID:9136
- C:\Windows\System\ItqvuHK.exe
  C:\Windows\System\ItqvuHK.exe
  2⤵
  PID:9196
- C:\Windows\System\HJDOHXz.exe
  C:\Windows\System\HJDOHXz.exe
  2⤵
  PID:8256
- C:\Windows\System\EGyAKIU.exe
  C:\Windows\System\EGyAKIU.exe
  2⤵
  PID:8348
- C:\Windows\System\BdNLuyR.exe
  C:\Windows\System\BdNLuyR.exe
  2⤵
  PID:8320
- C:\Windows\System\leftfVr.exe
  C:\Windows\System\leftfVr.exe
  2⤵
  PID:8236
- C:\Windows\System\BMSzoqH.exe
  C:\Windows\System\BMSzoqH.exe
  2⤵
  PID:8480
- C:\Windows\System\cYivgYq.exe
  C:\Windows\System\cYivgYq.exe
  2⤵
  PID:8400
- C:\Windows\System\pvCDqSe.exe
  C:\Windows\System\pvCDqSe.exe
  2⤵
  PID:8620
- C:\Windows\System\YvuPWeu.exe
  C:\Windows\System\YvuPWeu.exe
  2⤵
  PID:8832
- C:\Windows\System\cMybOMW.exe
  C:\Windows\System\cMybOMW.exe
  2⤵
  PID:8508
- C:\Windows\System\taIbPYH.exe
  C:\Windows\System\taIbPYH.exe
  2⤵
  PID:8592
- C:\Windows\System\NDzoehU.exe
  C:\Windows\System\NDzoehU.exe
  2⤵
  PID:8608
- C:\Windows\System\DgJhqYN.exe
  C:\Windows\System\DgJhqYN.exe
  2⤵
  PID:8896
- C:\Windows\System\ibuMNaI.exe
  C:\Windows\System\ibuMNaI.exe
  2⤵
  PID:8816
- C:\Windows\System\OxdrCWp.exe
  C:\Windows\System\OxdrCWp.exe
  2⤵
  PID:9152
- C:\Windows\System\hTEVJXB.exe
  C:\Windows\System\hTEVJXB.exe
  2⤵
  PID:9180
- C:\Windows\System\MDvqKDI.exe
  C:\Windows\System\MDvqKDI.exe
  2⤵
  PID:9184
- C:\Windows\System\uopflKZ.exe
  C:\Windows\System\uopflKZ.exe
  2⤵
  PID:9168
- C:\Windows\System\UHmzCIY.exe
  C:\Windows\System\UHmzCIY.exe
  2⤵
  PID:8908
- C:\Windows\System\lRcZCPJ.exe
  C:\Windows\System\lRcZCPJ.exe
  2⤵
  PID:8188
- C:\Windows\System\LgfJQBt.exe
  C:\Windows\System\LgfJQBt.exe
  2⤵
  PID:8364
- C:\Windows\System\CufLmHq.exe
  C:\Windows\System\CufLmHq.exe
  2⤵
  PID:8272
- C:\Windows\System\kxiYHke.exe
  C:\Windows\System\kxiYHke.exe
  2⤵
  PID:8892
- C:\Windows\System\YijMpEI.exe
  C:\Windows\System\YijMpEI.exe
  2⤵
  PID:8528
- C:\Windows\System\wbFJBpq.exe
  C:\Windows\System\wbFJBpq.exe
  2⤵
  PID:8768
- C:\Windows\System\LYCRJrO.exe
  C:\Windows\System\LYCRJrO.exe
  2⤵
  PID:8848
- C:\Windows\System\pdmreaf.exe
  C:\Windows\System\pdmreaf.exe
  2⤵
  PID:9100
- C:\Windows\System\hwzKjcp.exe
  C:\Windows\System\hwzKjcp.exe
  2⤵
  PID:8812
- C:\Windows\System\eLQKbHr.exe
  C:\Windows\System\eLQKbHr.exe
  2⤵
  PID:8668
- C:\Windows\System\mhCfgse.exe
  C:\Windows\System\mhCfgse.exe
  2⤵
  PID:2588
- C:\Windows\System\gJAjjLh.exe
  C:\Windows\System\gJAjjLh.exe
  2⤵
  PID:8396
- C:\Windows\System\qKgbzxJ.exe
  C:\Windows\System\qKgbzxJ.exe
  2⤵
  PID:9164
- C:\Windows\System\OtAOzXF.exe
  C:\Windows\System\OtAOzXF.exe
  2⤵
  PID:8204
- C:\Windows\System\KXEdJBq.exe
  C:\Windows\System\KXEdJBq.exe
  2⤵
  PID:8524
- C:\Windows\System\hOwZmHy.exe
  C:\Windows\System\hOwZmHy.exe
  2⤵
  PID:9220
- C:\Windows\System\QnwfHBN.exe
  C:\Windows\System\QnwfHBN.exe
  2⤵
  PID:9236
- C:\Windows\System\zvMFnhV.exe
  C:\Windows\System\zvMFnhV.exe
  2⤵
  PID:9252
- C:\Windows\System\XVBNqVR.exe
  C:\Windows\System\XVBNqVR.exe
  2⤵
  PID:9268
- C:\Windows\System\mUwDZNY.exe
  C:\Windows\System\mUwDZNY.exe
  2⤵
  PID:9284
- C:\Windows\System\aJhcycr.exe
  C:\Windows\System\aJhcycr.exe
  2⤵
  PID:9300
- C:\Windows\System\LQGehhD.exe
  C:\Windows\System\LQGehhD.exe
  2⤵
  PID:9316
- C:\Windows\System\SZtrlbj.exe
  C:\Windows\System\SZtrlbj.exe
  2⤵
  PID:9332
- C:\Windows\System\fbgrezk.exe
  C:\Windows\System\fbgrezk.exe
  2⤵
  PID:9348
- C:\Windows\System\lbqpFTM.exe
  C:\Windows\System\lbqpFTM.exe
  2⤵
  PID:9364
- C:\Windows\System\MIipjjf.exe
  C:\Windows\System\MIipjjf.exe
  2⤵
  PID:9380
- C:\Windows\System\GhEnfsC.exe
  C:\Windows\System\GhEnfsC.exe
  2⤵
  PID:9396
- C:\Windows\System\BruYged.exe
  C:\Windows\System\BruYged.exe
  2⤵
  PID:9412
- C:\Windows\System\tghKyGi.exe
  C:\Windows\System\tghKyGi.exe
  2⤵
  PID:9428
- C:\Windows\System\ZfLCjnC.exe
  C:\Windows\System\ZfLCjnC.exe
  2⤵
  PID:9444
- C:\Windows\System\JLxLcxL.exe
  C:\Windows\System\JLxLcxL.exe
  2⤵
  PID:9460
- C:\Windows\System\sSQkFTN.exe
  C:\Windows\System\sSQkFTN.exe
  2⤵
  PID:9476
- C:\Windows\System\LuHbrqU.exe
  C:\Windows\System\LuHbrqU.exe
  2⤵
  PID:9492
- C:\Windows\System\VRkhtlu.exe
  C:\Windows\System\VRkhtlu.exe
  2⤵
  PID:9508
- C:\Windows\System\HbrTIit.exe
  C:\Windows\System\HbrTIit.exe
  2⤵
  PID:9524
- C:\Windows\System\NtDQweS.exe
  C:\Windows\System\NtDQweS.exe
  2⤵
  PID:9540
- C:\Windows\System\vmqNRmp.exe
  C:\Windows\System\vmqNRmp.exe
  2⤵
  PID:9556
- C:\Windows\System\SBxzHFf.exe
  C:\Windows\System\SBxzHFf.exe
  2⤵
  PID:9572
- C:\Windows\System\oXkzNeK.exe
  C:\Windows\System\oXkzNeK.exe
  2⤵
  PID:9588
- C:\Windows\System\iywXTAa.exe
  C:\Windows\System\iywXTAa.exe
  2⤵
  PID:9604
- C:\Windows\System\jszOJuy.exe
  C:\Windows\System\jszOJuy.exe
  2⤵
  PID:9620
- C:\Windows\System\RZWAHye.exe
  C:\Windows\System\RZWAHye.exe
  2⤵
  PID:9636
- C:\Windows\System\OqOiYha.exe
  C:\Windows\System\OqOiYha.exe
  2⤵
  PID:9652
- C:\Windows\System\SSwSpWY.exe
  C:\Windows\System\SSwSpWY.exe
  2⤵
  PID:9668
- C:\Windows\System\BcBDjJd.exe
  C:\Windows\System\BcBDjJd.exe
  2⤵
  PID:9684
- C:\Windows\System\JzHiXOm.exe
  C:\Windows\System\JzHiXOm.exe
  2⤵
  PID:9704
- C:\Windows\System\bnrBnMi.exe
  C:\Windows\System\bnrBnMi.exe
  2⤵
  PID:9720
- C:\Windows\System\juPnQCL.exe
  C:\Windows\System\juPnQCL.exe
  2⤵
  PID:9736
- C:\Windows\System\LQHhpYg.exe
  C:\Windows\System\LQHhpYg.exe
  2⤵
  PID:9752
- C:\Windows\System\gDvPcwx.exe
  C:\Windows\System\gDvPcwx.exe
  2⤵
  PID:9768
- C:\Windows\System\VxlFwHf.exe
  C:\Windows\System\VxlFwHf.exe
  2⤵
  PID:9784
- C:\Windows\System\WJxgnsT.exe
  C:\Windows\System\WJxgnsT.exe
  2⤵
  PID:9800
- C:\Windows\System\IiZSqOE.exe
  C:\Windows\System\IiZSqOE.exe
  2⤵
  PID:9816
- C:\Windows\System\KmhiFGT.exe
  C:\Windows\System\KmhiFGT.exe
  2⤵
  PID:9832
- C:\Windows\System\tGaGhYl.exe
  C:\Windows\System\tGaGhYl.exe
  2⤵
  PID:9848
- C:\Windows\System\xAyNGNJ.exe
  C:\Windows\System\xAyNGNJ.exe
  2⤵
  PID:9864
- C:\Windows\System\lgaGXKT.exe
  C:\Windows\System\lgaGXKT.exe
  2⤵
  PID:9880
- C:\Windows\System\vpMGxQR.exe
  C:\Windows\System\vpMGxQR.exe
  2⤵
  PID:9896
- C:\Windows\System\KkGiCML.exe
  C:\Windows\System\KkGiCML.exe
  2⤵
  PID:9912
- C:\Windows\System\QxOeANc.exe
  C:\Windows\System\QxOeANc.exe
  2⤵
  PID:9928
- C:\Windows\System\PwLiyRi.exe
  C:\Windows\System\PwLiyRi.exe
  2⤵
  PID:9944
- C:\Windows\System\ljgpZMe.exe
  C:\Windows\System\ljgpZMe.exe
  2⤵
  PID:9960
- C:\Windows\System\PbWGxdY.exe
  C:\Windows\System\PbWGxdY.exe
  2⤵
  PID:9976
- C:\Windows\System\xilxsqL.exe
  C:\Windows\System\xilxsqL.exe
  2⤵
  PID:9992
- C:\Windows\System\fwzOYxH.exe
  C:\Windows\System\fwzOYxH.exe
  2⤵
  PID:10008
- C:\Windows\System\QaKpBHH.exe
  C:\Windows\System\QaKpBHH.exe
  2⤵
  PID:10024
- C:\Windows\System\udvCwWs.exe
  C:\Windows\System\udvCwWs.exe
  2⤵
  PID:10040
- C:\Windows\System\ZpkkcPk.exe
  C:\Windows\System\ZpkkcPk.exe
  2⤵
  PID:10056
- C:\Windows\System\IUEulFH.exe
  C:\Windows\System\IUEulFH.exe
  2⤵
  PID:10072
- C:\Windows\System\JLGnRKo.exe
  C:\Windows\System\JLGnRKo.exe
  2⤵
  PID:10092
- C:\Windows\System\kFiDrco.exe
  C:\Windows\System\kFiDrco.exe
  2⤵
  PID:10108
- C:\Windows\System\gEKoesn.exe
  C:\Windows\System\gEKoesn.exe
  2⤵
  PID:10128
- C:\Windows\System\myiUoaT.exe
  C:\Windows\System\myiUoaT.exe
  2⤵
  PID:10144
- C:\Windows\System\kwwCWBX.exe
  C:\Windows\System\kwwCWBX.exe
  2⤵
  PID:10160
- C:\Windows\System\RWsBHiu.exe
  C:\Windows\System\RWsBHiu.exe
  2⤵
  PID:10180
- C:\Windows\System\KYNJjff.exe
  C:\Windows\System\KYNJjff.exe
  2⤵
  PID:10196
- C:\Windows\System\nvxXRIg.exe
  C:\Windows\System\nvxXRIg.exe
  2⤵
  PID:10216
- C:\Windows\System\tEbPykc.exe
  C:\Windows\System\tEbPykc.exe
  2⤵
  PID:10232
- C:\Windows\System\eCMuGDb.exe
  C:\Windows\System\eCMuGDb.exe
  2⤵
  PID:9248
- C:\Windows\System\GbzoVrP.exe
  C:\Windows\System\GbzoVrP.exe
  2⤵
  PID:9232
- C:\Windows\System\pkGRcBg.exe
  C:\Windows\System\pkGRcBg.exe
  2⤵
  PID:9276
- C:\Windows\System\tlmYDbC.exe
  C:\Windows\System\tlmYDbC.exe
  2⤵
  PID:7672
- C:\Windows\System\IvyTcws.exe
  C:\Windows\System\IvyTcws.exe
  2⤵
  PID:9372
- C:\Windows\System\EQMXatz.exe
  C:\Windows\System\EQMXatz.exe
  2⤵
  PID:9328
- C:\Windows\System\pZaTJDo.exe
  C:\Windows\System\pZaTJDo.exe
  2⤵
  PID:9392
- C:\Windows\System\tOcOUFh.exe
  C:\Windows\System\tOcOUFh.exe
  2⤵
  PID:9436
- C:\Windows\System\ZcLuAKC.exe
  C:\Windows\System\ZcLuAKC.exe
  2⤵
  PID:9452
- C:\Windows\System\CEVuKDf.exe
  C:\Windows\System\CEVuKDf.exe
  2⤵
  PID:9504
- C:\Windows\System\pJJukhU.exe
  C:\Windows\System\pJJukhU.exe
  2⤵
  PID:9516
- C:\Windows\System\VYuUgMA.exe
  C:\Windows\System\VYuUgMA.exe
  2⤵
  PID:9520
- C:\Windows\System\JJcWUxP.exe
  C:\Windows\System\JJcWUxP.exe
  2⤵
  PID:9632
- C:\Windows\System\qlBGQgA.exe
  C:\Windows\System\qlBGQgA.exe
  2⤵
  PID:9584
- C:\Windows\System\ivjcvUf.exe
  C:\Windows\System\ivjcvUf.exe
  2⤵
  PID:9648
- C:\Windows\System\XrRUwmI.exe
  C:\Windows\System\XrRUwmI.exe
  2⤵
  PID:9728
- C:\Windows\System\RHLAlBU.exe
  C:\Windows\System\RHLAlBU.exe
  2⤵
  PID:9792
- C:\Windows\System\iOteITa.exe
  C:\Windows\System\iOteITa.exe
  2⤵
  PID:9776
- C:\Windows\System\gfQUzuW.exe
  C:\Windows\System\gfQUzuW.exe
  2⤵
  PID:9748
- C:\Windows\System\hRtVVuE.exe
  C:\Windows\System\hRtVVuE.exe
  2⤵
  PID:9824
- C:\Windows\System\DXclgPq.exe
  C:\Windows\System\DXclgPq.exe
  2⤵
  PID:9888
- C:\Windows\System\mMyqPCS.exe
  C:\Windows\System\mMyqPCS.exe
  2⤵
  PID:9844
- C:\Windows\System\LVVrTMm.exe
  C:\Windows\System\LVVrTMm.exe
  2⤵
  PID:9924
- C:\Windows\System\KwCTUSi.exe
  C:\Windows\System\KwCTUSi.exe
  2⤵
  PID:9956
- C:\Windows\System\vKTFmOf.exe
  C:\Windows\System\vKTFmOf.exe
  2⤵
  PID:9968
- C:\Windows\System\QYQWEpK.exe
  C:\Windows\System\QYQWEpK.exe
  2⤵
  PID:10000
- C:\Windows\System\EvYensZ.exe
  C:\Windows\System\EvYensZ.exe
  2⤵
  PID:10052
- C:\Windows\System\aeznHkL.exe
  C:\Windows\System\aeznHkL.exe
  2⤵
  PID:10116
- C:\Windows\System\QWENCjn.exe
  C:\Windows\System\QWENCjn.exe
  2⤵
  PID:10036
- C:\Windows\System\XXYwshZ.exe
  C:\Windows\System\XXYwshZ.exe
  2⤵
  PID:10104
- C:\Windows\System\oXiZaQM.exe
  C:\Windows\System\oXiZaQM.exe
  2⤵
  PID:10172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BDGaGuk.exe

Filesize
2.0MB

MD5
504b3d73e7c0866551b033539eb7764a

SHA1
0fe6ee5db5712c966ac049033b3f251794b0a289

SHA256
8cf2deac60f3e94a980d5e6668e30cc40bcb68d7abfb20d850631cdf6b432fec

SHA512
74384af2a883a0f0a8668632215ec720e624809611b24fad6438863fc217b8a16fde20e9ebe3304b0d059651a1006b54c6802ae18d2d120d4c1afd64287c6e9d

Download Submit
C:\Windows\system\FWbGHDU.exe

Filesize
2.0MB

MD5
610ab6d9dd2f38812ed24e7a4193de3d

SHA1
1c4bbac0a9b1b2a4d6540ea4c6ef6cb0c381a24f

SHA256
7c54f77caeaeb22b2f28bbc596939fa275d082a38f48fe04137cab57bbce1c18

SHA512
40c8667e74db032a152754812df081c793a57de00057c695c56dd7852a9a756cb64bf32b36c8931d2876432fb699347391ab9660fb7bbc15e3f25e1b2115ddc2

Download Submit
C:\Windows\system\KEQWQlu.exe

Filesize
2.0MB

MD5
2325b2711c86b1639c4f6063f358364a

SHA1
e2a53df9bf28c1f5aacced23e802b333dbcefd66

SHA256
49a2f253c8b2e5f76ba4ca13fdb0b19b6a2f80d73841b4e2de74aa53859a798f

SHA512
8685af1222b2d165b6a35a066b9eed9d57388331592d1534d74f6ee55f20a3b49394c88fb2a24e893b3145a9efe84e9ba981dcfd1530c255a8f38577b623356a

Download Submit
C:\Windows\system\LudYjqO.exe

Filesize
2.0MB

MD5
35974967b204a9fad4ed86a7c41781fc

SHA1
6af81caf3aaa007f9799daa10209ce8f34f397ad

SHA256
0f08e3eaafe31e43422d07d629c740b21c7cd60ec654eb453e58b01ebf2e3e88

SHA512
8b72ed838eefbe76a4b81d948cba643e5a74eb1ea39613533eb787bd1ead0230b11dfb9ff6776feeb93174b318021eb2a5e508c5432cabe977f10752961c446c

Download Submit
C:\Windows\system\MMXyfdC.exe

Filesize
18B

MD5
ef758e56e906b9892f08e5e0fd0f13b2

SHA1
5d91983aa1bb61c5754ee9a01242f0bb098e7d43

SHA256
55949f339b372645d839eaa0847f4e244396f7e39c4586ddc776fb793deda110

SHA512
efd8bb7ef71cf583c97f5d0eac4e2fae239c80d85643b80c586971498ace127bb0c9565e46052e55211bb3dead5ae54145b84fc68e9ff4a6be2a5f6b0f086760

Download Submit
C:\Windows\system\PIKrKFh.exe

Filesize
2.0MB

MD5
adca29049596652c4d5633f37c8b39cd

SHA1
92b7fd55f9364725d92708f35f03f07bd04999b4

SHA256
15b07f14c8292164cbe37cb3faf55f498876070cc05f6e9fe01e423df7d3032a

SHA512
a3e4428a1d9828774311b13e35cbd47d69c3d507f60da1069ba1c0eff3888180094673e74aa8b40943b7e2dee6beb3a403aef0086f45afa2237722b729a424c3

Download Submit
C:\Windows\system\QOFjboz.exe

Filesize
2.0MB

MD5
d7f1bb9f9c93ee2a6789404a885add18

SHA1
302a5ac3547411acc0c0197e2ee46cda7163ba65

SHA256
6192fce69ce4d8012fe2e272f3ccba8ec44be79fe482d7f7e656a0414accbf54

SHA512
c83dbdf117d2d6bd1db50998eab8760f996f66f041a486ec9cbda797c2f4ef4038f7dc9c6a37a41abf0365a80d48cd025bc8bf09443925c5243496c51a88bed1

Download Submit
C:\Windows\system\TMGEufw.exe

Filesize
2.0MB

MD5
7950e76a4e7312ac98a17240363e1a01

SHA1
8051ed148061e5331d240a84d17a3ff8126e52ad

SHA256
b917a75b3a691c2abf48be9dca06af168c2800c6776a3a5cc3b12a42e9ee2854

SHA512
7104ff634f87d346fe1cefeb49caf2b38680d2f77e85a9a059d7a3192d380ad1d42d28787b8505eae850283c2e8ef40be5c5083f7bd84e3d8f01d0227fe59257

Download Submit
C:\Windows\system\YIBPZWu.exe

Filesize
2.0MB

MD5
4cd8d56ff2d6e35426da0fe646f7ae6f

SHA1
482018c4726d6d712a2ef49e8e5ff6e0183d5e11

SHA256
e0e69ac53d48d526f277df190cab6595586d6fc43b0c8ce1b30814cb7dcea425

SHA512
2f6aa74195083ba486c95ed648eeb5ed570537cefdfd8b4933bff4d6cfe3ee301108c9aadecdf97a2695bc66b73fefdd59c647e06d253fdf2a118dba72877110

Download Submit
C:\Windows\system\bkirtee.exe

Filesize
2.0MB

MD5
4e081eeeb0b96d47aa20c705ea60181a

SHA1
c909ebda035426614c8bdf0f2b9cdefca8970897

SHA256
74838f2304760b64640e09640be1d6140ee059f21daea5f55fe38c524a63ea43

SHA512
c002541fbbd5d0f98fa0e7b72acd52e20439e72957c134a5261dd515266ce55c3cedc7784cc9489b034b5dee9c5da55b2c9a27061e989cea1fd46e8847f1a4e5

Download Submit
C:\Windows\system\cdZzvVk.exe

Filesize
2.0MB

MD5
d409997e5b51c32df21e8bf1587a634e

SHA1
16e3255137d0eb303b08076b239a0e4bf6063d87

SHA256
795891471f275a7064e9f790f7aec2fa26e51be8a14e296855ed6205a24e3dcc

SHA512
73259ffa1f568bb3184eb2c52d2c84b3e2f78deebe6cc8ef2fe504bfca90705448499aafeb2e3f3e1ff36840944e20b99a3e9b56a34111ab6eaf32120a772998

Download Submit
C:\Windows\system\jxiITvX.exe

Filesize
2.0MB

MD5
6f7460864a982cfe0c2969c93f457191

SHA1
cdafacccd9d753a5f30dd58fd8602b00137cca5c

SHA256
9045c16b16a914696d8c63eca0bc05b26905c001cf5160f4cbdc46a9647d017f

SHA512
ea5810d8a0c4761d7c768068a4cf48d4b8bb01c2b95ac88f4727dd7114f4a9c0e49adcff973fee57051b016831586c3c5243a5ff53677b4d6bf53e977909166c

Download Submit
C:\Windows\system\qjfNOkS.exe

Filesize
2.0MB

MD5
31858902992f9268046798533c32c0c8

SHA1
8acc45bf9346cabc729e034a47958ab2ad8a0779

SHA256
db9a7a38bf2d6f59a7040eebd28f4faacbff16f8d328cbb51ff905365ed6b934

SHA512
d64c70a755b688854b1d06b4d259374acd104298307eebce71bae41ad08423d8a2f5df494146a06581d7b20cb29af69fc97844bdf5434486bbd3d5ea325a6694

Download Submit
C:\Windows\system\rZzHiqN.exe

Filesize
2.0MB

MD5
07af90b93ed17c251c9d9020005899e0

SHA1
a0529771dbba35d95f42dc1b9feb7e8cd3294cb2

SHA256
edfbc3462ad875749e908a789287ab27fdb5169e06f5912513e15521a2281d26

SHA512
ddf5b17c3022a55b9f74db0f6bc58e591caa50e2b8b7c11ce14c9c61b7262115809e23c2a45cba6d30f48e0540eeac9ada72420e7b387f0a05922d6e7a8c29de

Download Submit
C:\Windows\system\rbPVakn.exe

Filesize
2.0MB

MD5
b53a3c953b7b04f95f3a792780dcdd15

SHA1
094e51fae7389175fb7cf622a0260eb856eabe63

SHA256
49201de2b820594914e410657b92bd3eb09a9dea08be354c90230cc68b621196

SHA512
a27bc9f47731967ffc5139989b647eb17da9586c17d7b1aadff6e03514b6f63ba4ff9ef74e9d3772b96ff9c6dfcff3c2159dafd33f621c34a91a57e46b9d6515

Download Submit
C:\Windows\system\rlJQItA.exe

Filesize
2.0MB

MD5
ee1e7750c52192a68a6da5ca2e336ffc

SHA1
25926a3a8d0b6f367d8296161d41b8fb508f6441

SHA256
e951387bdea56b3b665ca958ad1675f2454b0494ae90b2ba6e9eac030840254b

SHA512
90ea3e55441b6ae44665a11d91120319a1b320f352eb0dfd2e49d3e4ecb51e16f0f528dfb4597b5bcd6b41c038186406b58bd51e591a56dffb2e306667fdb6e6

Download Submit
C:\Windows\system\sbfGyWm.exe

Filesize
2.0MB

MD5
0f0e4a5e6eeccd284abe433c4cd6109c

SHA1
52e5cc81db83f6b78d3dcb81f73b9bf4982e0202

SHA256
eb3d0c19fb01d7396a6f77bbd55a990b4df7b097edba4985ff03ca05a6d11f0a

SHA512
283f2588b392db9932e9ae80ecbbaeb3af65574514cdbb96146c297440d891b7fbf295f153bae52143ed3407aba6154746ac8f3be9e794c506011a952fdbbaa9

Download Submit
C:\Windows\system\zoZFczX.exe

Filesize
2.0MB

MD5
d8782badb453c73898b5f63a827d3568

SHA1
ed68d3ae4e0ced0f4b5147760e49b78b55291e04

SHA256
516cfa695b26939c710c1fb31dfa3bd4e6e799e2d6af0291dc84293fb42d049b

SHA512
e1b72353f2d74fa590b94b0f0821eca94aef13e984d140e5a5aa2d482eb989078b4f39f57f12defe0429e7590fe4198c8ed711f68ac1148ef0c057d32e8ead74

Download Submit
C:\Windows\system\zysyGnn.exe

Filesize
2.0MB

MD5
ff5a3a87f245e3561b232b89db9680ee

SHA1
f662ea57850c0e1b41e1edb032df22104e3e86ed

SHA256
f7ea63def942064c77148fccea6f771971fe78646bf76ba2327476e1f94f8d13

SHA512
e90e986bc1ad1b18ed80a095fb95e5673bd77f29db32a35b9916f409cd3589cb4e2b49992daf68c4683d4dcca447e3dc13e72b49c1190c7f6b5fd5d944b8ad46

Download Submit
\Windows\system\CYjjlfK.exe

Filesize
2.0MB

MD5
23266f11ecb9cbc885e0a766f9ee3d10

SHA1
9a13c1982846782d09517f1d4b06fb0271c6d6ef

SHA256
0ebfbd5a285ee5c5cec096fddbfe2d6590802ae6348075d432418a9d0e57eee2

SHA512
2869fbbc31723b944f79663fb54dd363ae911abe6e1af3e563cec2497606c212d89f2da3148f9c833063009a13993f48fd8c2ad52677f924034a3cd51ef93c13

Download Submit
\Windows\system\CmgrJBS.exe

Filesize
2.0MB

MD5
c26e0e41d2e6824e86fd8f84a070ae68

SHA1
076b717428b8b83ce041b787419273d0058af763

SHA256
db15f0031e4bc2852175cdce78b2378d0618df72531b358b3c512b3675e1d52e

SHA512
a73d042c093eea9f39dd28d1c8f50e52f4e3823e52bd445d7bffe795e5b572168c5a2560c133807a452fcd684bd9e68ef934cc4f1fccf450cf7f9d597980b660

Download Submit
\Windows\system\DxeGQgq.exe

Filesize
2.0MB

MD5
50e4a6e2b026139134cd1dc8dfa8821e

SHA1
2fd82558d895869dccc46d262b8d49c59acae2fe

SHA256
954b3b5ab2522f8373a4c8e8db07ada2a4b66a46670b9c3cf514694b8248be34

SHA512
58e63c16f4213dd66f9c4a5a365a7bb61ad3acb0b2b15edcba8197d293852d399c87ad422d3a9cde338aa3b52651713cb64821168b288f625ef48d9207dea55e

Download Submit
\Windows\system\IvyzWJi.exe

Filesize
2.0MB

MD5
6303340cceb172b4866ff26cbf6eb93b

SHA1
b5e678194aba2810c1d6bf6f2078d5b70d4577ce

SHA256
13aae142dc467b41d84e5aa6d26484a2e4ca0fe311849d0341d62588640288e0

SHA512
4c1b75072a1657eff769a04aff5d430a161e600ad4c57aaa0f49ee86331717907b8902576eecaeccf36ca80182d725b2eb021db2e53838c154087b40beaf2335

Download Submit
\Windows\system\JyHBJNv.exe

Filesize
2.0MB

MD5
301500452b42070db1ec7d254964d8d0

SHA1
acb1393979b6162e233eadfbd7a4c49b42ab393f

SHA256
879a4b35306f0a11a3348627620c223ccbf65abbbedbf3d6a98ebf6fb9b2d95e

SHA512
fefe594a649aed3351de3eb744fb8b64d2328e2ac3dc21ae88923d8170b7c7834f6a4b2edd88f3ad4b92a7f2a32483c8a2f63c8f6648038986595cc0774ec107

Download Submit
\Windows\system\KtmWpQt.exe

Filesize
2.0MB

MD5
c404d695cdbd573f4c060d86bd9054c9

SHA1
10951c36dfc0505f2e5a07ad68428011aff9a2bf

SHA256
da5f44bdc0f73661e969b9128377af7eb1a24168944a1b21ca9cce957f2d92d8

SHA512
c0cee9a857f2240a24fbb5aaafa6081e4a867376c20298efd1bf540d7c8ed5c36714accc07f51a1029a3570d88396aae3f52a392f83cd2e30fa6ee5c19fd43c0

Download Submit
\Windows\system\LSRMJYU.exe

Filesize
2.0MB

MD5
6cfe99d515503d44c92b84dcc16f1c94

SHA1
7b134b0081dd4e55986fbc12431e0a4573f623a0

SHA256
57f1dcde2a078136c2678dcf223ca45ac4650dda3f5b63ea62d05728ca42f343

SHA512
6e7607ac684024675a792368f1b6b71193d12a144886350a8ab4741530459267eeb7d554bbb043a0f3f34e92eb11a5cc0ed6e5e0d0c536ef05e394c59f96f784

Download Submit
\Windows\system\NKJoHUw.exe

Filesize
2.0MB

MD5
471d3345512a449f0e32caed30dd78f7

SHA1
04469821d0b6f4bb199a3ef95d4c830f5f0ff149

SHA256
5528c3c3cd55df0b6bad1e8f9b4f139b602718605cad940acbb485aa62239965

SHA512
d555450891ce46996e0c495df79344a9a90f4a5c6616447b389ca42333d440bb3cc6ee140d3a4f9a6d4674bcdc086cd60828c21248f833a91a1981061320bc06

Download Submit
\Windows\system\NxrWNdZ.exe

Filesize
2.0MB

MD5
8ff3e1451100ba6c932b4b6b9b342c4d

SHA1
42cad072860a22af6761409223ebef7b827220ca

SHA256
5c7ce6085c88dde76afe52500404c4c6fd2a5677ce214702639d3bffd808bcb9

SHA512
7006eceda9c271a9e04e3cee210368ccbd4a517fb8e6c988632cfd11af07ff6e8bbb2cc0894b9f0d25767944059c511971dd60f74f90e2c6e095b3f6cef9e287

Download Submit
\Windows\system\OZmPdsd.exe

Filesize
2.0MB

MD5
29811a9929ba3877d51be5a84129e8d2

SHA1
67d5c0a2a4281bbddec68ed116edc50c5e165a15

SHA256
7db01370995a023876492987921ab7aefc9e730089fd8ef9ac7334b782c62414

SHA512
267a0a4f67e8d00e3a3fa197c580a12a8a91c6023ec19fbcf1df0144fc02388bab3c5628621c4f1d35f8f9f980fbcafde4db24f165eb0bc8419dcee6b621388d

Download Submit
\Windows\system\YmmLRlP.exe

Filesize
2.0MB

MD5
26bd43aff11b4fb363cf8a8b605db6e6

SHA1
4061bcd413e61c1bd8c377645879cff5b38270f6

SHA256
735fccded0fb0aec830f5ff9af1766b63d642c9d4bd6a3a67a809e6fddfc0244

SHA512
d886bc1916e74f87427776612db484370f8bc1249964e01a3ed027b95431d694f00ba2686cf28ab442318c22fdd338978fd3201a53933cedaf02cd820ef18d73

Download Submit
\Windows\system\eTykyrj.exe

Filesize
2.0MB

MD5
73854359da6cf87635c0403da4f0fddb

SHA1
1ef78426f9383c6de84ff577d4fb346691f02aec

SHA256
b78539e2fada762d2da9ff468814ab11de9698c465a2d3b3468a5c1656ad80a7

SHA512
71448cb2f17617fa133b2adb2388b66a21835a87f5a4edd5bc9cac246d46b2af4b937e42bc481a698d8cb2f5bc10768077efc517c1824f72fa56ec73b603b0c3

Download Submit
\Windows\system\fHnDhBq.exe

Filesize
2.0MB

MD5
ce9c7bc81d5b4945de8301bdb4471900

SHA1
e08c732fd56e4eedf644989f6d124ceabd8e61bf

SHA256
43d94e87425bec46318e9e758b477530f832dd167534fcb9bd6c5728c4bc4248

SHA512
e53e08529decb3239930d68c398239a15e044c2209a013836494eb7e0e4034f1e438fe77c2d9401b047fed03a9ab99d18ec251cbbc2dceeb9cff2232e5cf4715

Download Submit
\Windows\system\gYgSaqM.exe

Filesize
2.0MB

MD5
39eb043f9400a63689df898af30d3855

SHA1
56aa27850462a77a91aa3b132174a932662c91d6

SHA256
d15afd6f2f268f4d4600d7ca89b4e042e836a5743cf023d3de35647b2cb6d18c

SHA512
4ad494b96b044d9fead989fb3a88d01f55496de3eab074dfbdffe4953746a7f12cf24abf03f7ca99517c00726e33f10c65efe7ad4b1ee6ca10219db320630f96

Download Submit
\Windows\system\jqhJaiF.exe

Filesize
2.0MB

MD5
bd482bfe6efc97b73c3b5dc493530012

SHA1
2beb07ff6cdedb450d7210337f702a58eca05c48

SHA256
0fa5e4e18084140b5dd967d73eefcebf025f5890331b0729678070ab482f8409

SHA512
756339ff59a5ea7cf64e3814a3dbaa59108488b3535a67d7825cabccf630b409d24281126e8438897a264481808d53b4e18ce79ef2c8df03d4a60cc9d4c41d8f

Download Submit
\Windows\system\nYKnijs.exe

Filesize
2.0MB

MD5
dedd5b428dfced1e53c602bd762bee56

SHA1
9c3966d6366fe70e2ad9d07c50b5794693d7d93b

SHA256
439cef671c295ccbefb9e9aa7909cd250e2cdf1fd05d74ffe472c98af65d11b2

SHA512
ee3ab9fb29e0acd01e20b1b19db661f28c651d26a9ef088ed6c0af9527ec4978b708e13fb8a4435ac04224ea719ae555112f7c4d2dd80bbe8da40b0555fae9af

Download Submit
\Windows\system\qnwYBJF.exe

Filesize
2.0MB

MD5
f5a89a0c66a3dea88310bcf489277f53

SHA1
7cbcb2166def2e3d389be26825d1133b7bfdcd83

SHA256
0fc3d7537d01d358ace37f8b8330ccfe86f7d95ba615a3998e20e620b2aff6b9

SHA512
bc713088a99a699787d13d42aa5e717404bca576cba4926e101156854abf2ed60e8edb2fbd467d543e667b5baf2719c7816daaa99e47eb79cb30f026521a4be1

Download Submit
\Windows\system\ttYQCTA.exe

Filesize
2.0MB

MD5
fac6998b79e9c79d1fe19a557f71ff84

SHA1
e4412b69d161fc7685c648b95140f82dab674992

SHA256
83d8ca1f6a7bbd6b4d21e18face2387579a5c37f126266be4d522124eb554a91

SHA512
3619f6e5ac93dbbb277155a40dad48863451c346506a28cf304ddf152df0290b9f53e6d38969c3cff35ec9a66ce2f85a913eb9dee1421276ae5d9bdb02737c6e

Download Submit
\Windows\system\whdPHxo.exe

Filesize
2.0MB

MD5
3bb4378f46a75a91d5f3b6a48b44ea33

SHA1
cd322678b9cd46784b120212d8423892bbfbcc9b

SHA256
2e0296c7b03aa2735ad04941869614f1681a3643d2fe7644bfdf472c4f4e1ff3

SHA512
301279e0f1df9d607d42ebb322a16f45b361606aa0d5eb4dc04c10948249a78270e7dab7965dca41924bb1d6b797d6946c86e7cfc5c20c25b7926f88f2ca0bbc

Download Submit
\Windows\system\xzceyVT.exe

Filesize
2.0MB

MD5
22123d0e1a02c1bf8dde3697d4d96cdf

SHA1
569c87519b80bfb54dc80e1f3747b1039054a8e9

SHA256
fc95b099ad97f765efb420e0a00a6f986e32d2f4d23942eb76b12d00b212c43c

SHA512
9fedd17abc3fbf8f79e7404657e4a14c71b9d0dbc32ea8dcf75dc032ebaeecda48d754c63dc41982d09b63a643800734e39d2c0bc8d0db6cd75d6e026c7e5721

Download Submit
memory/1688-31-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/1688-0-0x000000013F850000-0x000000013FC42000-memory.dmp

Filesize
3.9MB

Download
memory/1688-482-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/1688-68-0x000000013FFC0000-0x00000001403B2000-memory.dmp

Filesize
3.9MB

Download
memory/1688-91-0x000000013F850000-0x000000013FC42000-memory.dmp

Filesize
3.9MB

Download
memory/1688-9167-0x0000000003550000-0x0000000003942000-memory.dmp

Filesize
3.9MB

Download
memory/1688-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1688-66-0x0000000003550000-0x0000000003942000-memory.dmp

Filesize
3.9MB

Download
memory/1688-1168-0x0000000003550000-0x0000000003942000-memory.dmp

Filesize
3.9MB

Download
memory/1688-64-0x000000013F2A0000-0x000000013F692000-memory.dmp

Filesize
3.9MB

Download
memory/1688-50-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/1688-685-0x0000000003330000-0x0000000003722000-memory.dmp

Filesize
3.9MB

Download
memory/1688-106-0x0000000003550000-0x0000000003942000-memory.dmp

Filesize
3.9MB

Download
memory/1688-21-0x0000000003160000-0x0000000003552000-memory.dmp

Filesize
3.9MB

Download
memory/1688-41-0x0000000003330000-0x0000000003722000-memory.dmp

Filesize
3.9MB

Download
memory/1688-89-0x000000013FE80000-0x0000000140272000-memory.dmp

Filesize
3.9MB

Download
memory/1688-34-0x0000000003330000-0x0000000003722000-memory.dmp

Filesize
3.9MB

Download
memory/2004-4939-0x000000013F900000-0x000000013FCF2000-memory.dmp

Filesize
3.9MB

Download
memory/2004-37-0x000000013F900000-0x000000013FCF2000-memory.dmp

Filesize
3.9MB

Download
memory/2300-512-0x0000000002790000-0x0000000002798000-memory.dmp

Filesize
32KB

Download
memory/2300-491-0x000000001B5D0000-0x000000001B8B2000-memory.dmp

Filesize
2.9MB

Download
memory/2444-1167-0x000000013F2A0000-0x000000013F692000-memory.dmp

Filesize
3.9MB

Download
memory/2444-65-0x000000013F2A0000-0x000000013F692000-memory.dmp

Filesize
3.9MB

Download
memory/2444-5096-0x000000013F2A0000-0x000000013F692000-memory.dmp

Filesize
3.9MB

Download
memory/2648-42-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/2648-5080-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/2664-35-0x000000013F950000-0x000000013FD42000-memory.dmp

Filesize
3.9MB

Download
memory/2720-38-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/2720-5078-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/2724-39-0x000000013F6B0000-0x000000013FAA2000-memory.dmp

Filesize
3.9MB

Download
memory/2752-40-0x000000013F730000-0x000000013FB22000-memory.dmp

Filesize
3.9MB

Download
memory/2780-51-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/2780-875-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/2780-5109-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/2784-876-0x000000013FB70000-0x000000013FF62000-memory.dmp

Filesize
3.9MB

Download
memory/2784-67-0x000000013FB70000-0x000000013FF62000-memory.dmp

Filesize
3.9MB

Download
memory/2844-79-0x000000013F4E0000-0x000000013F8D2000-memory.dmp

Filesize
3.9MB

Download
memory/2844-5084-0x000000013F4E0000-0x000000013F8D2000-memory.dmp

Filesize
3.9MB

Download
memory/3020-1561-0x000000013FFC0000-0x00000001403B2000-memory.dmp

Filesize
3.9MB

Download
memory/3020-5108-0x000000013FFC0000-0x00000001403B2000-memory.dmp

Filesize
3.9MB

Download
memory/3020-75-0x000000013FFC0000-0x00000001403B2000-memory.dmp

Filesize
3.9MB

Download