xmrig | b22f05912ee290b6283675f2b94e9defbbb15f889e32108f18053beb97a2201d

Analysis

max time kernel
150s
max time network
147s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
27-07-2024 22:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
Size

2.3MB
MD5

014b97e09d26c7be9be9988d89aba96c
SHA1

7460dd6a8950b07a7ea16b2962cc6bbed3441aaa
SHA256

b22f05912ee290b6283675f2b94e9defbbb15f889e32108f18053beb97a2201d
SHA512

61b91097ede7bd7e9f6620711c28cb2dc4283e749ab34b3dd3c360c8bdddac48127e2e5a61b17c5adabac83d185406eae74c4131715455dfa7e82466b9899bb5
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9JpWac:NABp

Score

10^/10

xmrig discovery execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 19 IoCs

miner

resource	yara_rule
behavioral1/memory/2832-3347-0x000000013FE80000-0x0000000140272000-memory.dmp	xmrig
behavioral1/memory/1092-3346-0x000000013FD30000-0x0000000140122000-memory.dmp	xmrig
behavioral1/memory/1980-3345-0x000000013F940000-0x000000013FD32000-memory.dmp	xmrig
behavioral1/memory/2112-3349-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	xmrig
behavioral1/memory/2984-3622-0x000000013FCC0000-0x00000001400B2000-memory.dmp	xmrig
behavioral1/memory/2996-4264-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	xmrig
behavioral1/memory/2992-3353-0x000000013F240000-0x000000013F632000-memory.dmp	xmrig
behavioral1/memory/2284-3352-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	xmrig
behavioral1/memory/2640-3351-0x000000013F140000-0x000000013F532000-memory.dmp	xmrig
behavioral1/memory/284-247-0x000000013F8F0000-0x000000013FCE2000-memory.dmp	xmrig
behavioral1/memory/2996-213-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	xmrig
behavioral1/memory/2640-244-0x000000013F140000-0x000000013F532000-memory.dmp	xmrig
behavioral1/memory/2984-220-0x000000013FCC0000-0x00000001400B2000-memory.dmp	xmrig
behavioral1/memory/1980-136-0x000000013F940000-0x000000013FD32000-memory.dmp	xmrig
behavioral1/memory/2832-149-0x000000013FE80000-0x0000000140272000-memory.dmp	xmrig
behavioral1/memory/2992-120-0x000000013F240000-0x000000013F632000-memory.dmp	xmrig
behavioral1/memory/1092-53-0x000000013FD30000-0x0000000140122000-memory.dmp	xmrig
behavioral1/memory/2284-58-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	xmrig
behavioral1/memory/2112-35-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2928	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2112	VrEtTCp.exe
1092	MtlafVr.exe
2284	yjBUGLc.exe
2992	yJTrQjc.exe
1980	qpSorIO.exe
2832	CphbAZF.exe
2996	nJzDFBE.exe
2984	JEqCJnR.exe
2640	yyTRYaZ.exe
284	GZoHWNt.exe
912	rDDaDIo.exe
2564	SfGDdbU.exe
2368	ADDkZKk.exe
2488	uzcHqak.exe
2948	xIhZtoI.exe
1808	FKTftVt.exe
1728	swONdEf.exe
1996	MoyXQNG.exe
2376	zqUPZLQ.exe
2028	foFLxuS.exe
1736	mIxwJaA.exe
2676	TNzjMJc.exe
2224	WiOKnoX.exe
1400	tiHtkzR.exe
2200	pfkzwuj.exe
1692	jvKnRNU.exe
1148	gRfBfzO.exe
1820	bCqESmk.exe
1864	LkaYCTV.exe
1700	qBCOphW.exe
1876	qKTdXxv.exe
1668	UvKOzQw.exe
2852	IsfihbD.exe
2812	rXjakJF.exe
3012	kkYhGuY.exe
1476	QzcrpiP.exe
1752	pRqzNDZ.exe
1484	BoCEEKq.exe
2196	CDuXsLG.exe
2700	WmCKvmA.exe
2760	qPlwzhF.exe
1988	cLrSZGe.exe
1064	wOTmjFW.exe
1008	tmlPQHf.exe
1256	RHBwgpL.exe
1780	UVhyRic.exe
2104	niySPGp.exe
2772	FEsjFZu.exe
2328	JCWaLJB.exe
3068	ZOlkMmk.exe
2340	fkyLECZ.exe
2976	yRTpMAd.exe
1528	TdUofyn.exe
236	sBPDIiB.exe
2160	zuhdTLG.exe
1236	BQZwZSI.exe
1920	jzuawor.exe
2540	WupbrDF.exe
1916	vmsrvoZ.exe
2168	wVcyggV.exe
3036	QjgiDES.exe
2248	owaXcdP.exe
1884	PLFlUOs.exe
1880	PMORZRs.exe

Loads dropped DLL 64 IoCs

pid	Process
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe

UPX packed file 60 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2832-3347-0x000000013FE80000-0x0000000140272000-memory.dmp	upx
behavioral1/memory/1092-3346-0x000000013FD30000-0x0000000140122000-memory.dmp	upx
behavioral1/memory/1980-3345-0x000000013F940000-0x000000013FD32000-memory.dmp	upx
behavioral1/memory/2112-3349-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	upx
behavioral1/memory/2984-3622-0x000000013FCC0000-0x00000001400B2000-memory.dmp	upx
behavioral1/memory/2996-4264-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	upx
behavioral1/memory/2992-3353-0x000000013F240000-0x000000013F632000-memory.dmp	upx
behavioral1/memory/2284-3352-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	upx
behavioral1/memory/2640-3351-0x000000013F140000-0x000000013F532000-memory.dmp	upx
behavioral1/memory/284-247-0x000000013F8F0000-0x000000013FCE2000-memory.dmp	upx
behavioral1/memory/2996-213-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	upx
behavioral1/memory/2640-244-0x000000013F140000-0x000000013F532000-memory.dmp	upx
behavioral1/memory/2984-220-0x000000013FCC0000-0x00000001400B2000-memory.dmp	upx
behavioral1/files/0x0005000000019505-178.dat	upx
behavioral1/files/0x00050000000194cd-172.dat	upx
behavioral1/files/0x0005000000019473-166.dat	upx
behavioral1/files/0x0005000000019532-181.dat	upx
behavioral1/files/0x00050000000194e5-175.dat	upx
behavioral1/files/0x00050000000194b4-169.dat	upx
behavioral1/files/0x000500000001946f-163.dat	upx
behavioral1/files/0x000500000001945e-157.dat	upx
behavioral1/files/0x0005000000019448-150.dat	upx
behavioral1/files/0x0005000000019297-142.dat	upx
behavioral1/files/0x000500000001926a-138.dat	upx
behavioral1/memory/1980-136-0x000000013F940000-0x000000013FD32000-memory.dmp	upx
behavioral1/files/0x000500000001942a-135.dat	upx
behavioral1/files/0x000500000001939d-134.dat	upx
behavioral1/files/0x0005000000019372-133.dat	upx
behavioral1/files/0x0005000000019358-132.dat	upx
behavioral1/files/0x000500000001928e-131.dat	upx
behavioral1/files/0x0005000000019267-130.dat	upx
behavioral1/files/0x000500000001942d-127.dat	upx
behavioral1/files/0x00050000000193ab-121.dat	upx
behavioral1/files/0x0005000000019386-110.dat	upx
behavioral1/files/0x0005000000019462-160.dat	upx
behavioral1/files/0x0005000000019453-154.dat	upx
behavioral1/memory/2832-149-0x000000013FE80000-0x0000000140272000-memory.dmp	upx
behavioral1/files/0x000500000001943e-146.dat	upx
behavioral1/files/0x0005000000019248-106.dat	upx
behavioral1/files/0x000500000001935b-103.dat	upx
behavioral1/memory/2992-120-0x000000013F240000-0x000000013F632000-memory.dmp	upx
behavioral1/files/0x000500000001925d-119.dat	upx
behavioral1/files/0x000500000001925a-85.dat	upx
behavioral1/files/0x0005000000019230-84.dat	upx
behavioral1/files/0x0005000000019207-89.dat	upx
behavioral1/files/0x00070000000190e5-82.dat	upx
behavioral1/files/0x0007000000004e74-63.dat	upx
behavioral1/memory/1092-53-0x000000013FD30000-0x0000000140122000-memory.dmp	upx
behavioral1/files/0x00050000000191da-50.dat	upx
behavioral1/memory/2284-58-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	upx
behavioral1/files/0x0008000000017073-49.dat	upx
behavioral1/memory/2112-35-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	upx
behavioral1/files/0x0007000000016dc7-17.dat	upx
behavioral1/files/0x0008000000016db0-16.dat	upx
behavioral1/files/0x0007000000016ddb-27.dat	upx
behavioral1/files/0x0007000000016ddf-26.dat	upx
behavioral1/files/0x0007000000016eb4-22.dat	upx
behavioral1/files/0x0009000000016ed2-31.dat	upx
behavioral1/files/0x000d000000012283-9.dat	upx
behavioral1/memory/2092-2-0x000000013F5E0000-0x000000013F9D2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\njxluVb.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\NztHQtb.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\HnltqqG.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\CTiMSJW.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\lMAJzvP.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\kKIYpBI.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\JTWgnFJ.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\dLOgsqn.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\ZcXptOn.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\YPbppgd.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\TzddCig.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\GnSdowl.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\UACVEIC.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\doeUMhf.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\NnTBNzg.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\tskYHpY.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\wYlllCD.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\GegBrpE.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\cvJPUPu.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\PmUdtPe.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\EPTqEcy.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\lqBMuYL.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\HmJNLDH.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\tZgtyRB.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\bGoSkBm.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\XlSTVoe.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\LEocTwB.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\qdbnfYO.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\CeoHTUm.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\vZexDeB.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\RxRrOyN.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\VuZrQfr.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\eqbmFKb.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\WiOKnoX.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\smbdpZQ.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\IMMEZdS.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\ovlYypu.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\FjnmiFK.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\vsgTeVQ.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\fLvYFqG.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\ZnkINZe.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\HeLqNLq.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\hraKMaj.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\RhAOBks.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\YOTxWeo.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\HpUKpzQ.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\nbiXAhi.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\mIxwJaA.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\fRvodfL.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\otKmfNM.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\dwuAvVU.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\tmlPQHf.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\LkaYCTV.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\IsfihbD.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\yyugAMt.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\aLqBgpf.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\lRChDxe.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\LQgmRwp.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\NLWLbhF.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\thBeDSY.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\XSopuIQ.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\eRBaXSR.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\VqHzKBR.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\wyYFghq.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
19896	Process not Found

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2928	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
Token: SeDebugPrivilege	2928	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2928	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	31
PID 2092 wrote to memory of 2928	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	31
PID 2092 wrote to memory of 2928	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	31
PID 2092 wrote to memory of 2112	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	32
PID 2092 wrote to memory of 2112	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	32
PID 2092 wrote to memory of 2112	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	32
PID 2092 wrote to memory of 1092	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	33
PID 2092 wrote to memory of 1092	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	33
PID 2092 wrote to memory of 1092	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	33
PID 2092 wrote to memory of 2284	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	34
PID 2092 wrote to memory of 2284	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	34
PID 2092 wrote to memory of 2284	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	34
PID 2092 wrote to memory of 1980	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	35
PID 2092 wrote to memory of 1980	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	35
PID 2092 wrote to memory of 1980	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	35
PID 2092 wrote to memory of 2992	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	36
PID 2092 wrote to memory of 2992	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	36
PID 2092 wrote to memory of 2992	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	36
PID 2092 wrote to memory of 2996	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	37
PID 2092 wrote to memory of 2996	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	37
PID 2092 wrote to memory of 2996	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	37
PID 2092 wrote to memory of 2832	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	38
PID 2092 wrote to memory of 2832	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	38
PID 2092 wrote to memory of 2832	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	38
PID 2092 wrote to memory of 2984	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	39
PID 2092 wrote to memory of 2984	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	39
PID 2092 wrote to memory of 2984	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	39
PID 2092 wrote to memory of 2640	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	40
PID 2092 wrote to memory of 2640	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	40
PID 2092 wrote to memory of 2640	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	40
PID 2092 wrote to memory of 284	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	41
PID 2092 wrote to memory of 284	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	41
PID 2092 wrote to memory of 284	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	41
PID 2092 wrote to memory of 912	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	42
PID 2092 wrote to memory of 912	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	42
PID 2092 wrote to memory of 912	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	42
PID 2092 wrote to memory of 2488	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	43
PID 2092 wrote to memory of 2488	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	43
PID 2092 wrote to memory of 2488	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	43
PID 2092 wrote to memory of 2564	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	44
PID 2092 wrote to memory of 2564	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	44
PID 2092 wrote to memory of 2564	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	44
PID 2092 wrote to memory of 2948	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	45
PID 2092 wrote to memory of 2948	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	45
PID 2092 wrote to memory of 2948	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	45
PID 2092 wrote to memory of 2368	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	46
PID 2092 wrote to memory of 2368	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	46
PID 2092 wrote to memory of 2368	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	46
PID 2092 wrote to memory of 1808	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	47
PID 2092 wrote to memory of 1808	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	47
PID 2092 wrote to memory of 1808	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	47
PID 2092 wrote to memory of 1728	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	48
PID 2092 wrote to memory of 1728	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	48
PID 2092 wrote to memory of 1728	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	48
PID 2092 wrote to memory of 2224	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	49
PID 2092 wrote to memory of 2224	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	49
PID 2092 wrote to memory of 2224	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	49
PID 2092 wrote to memory of 1996	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	50
PID 2092 wrote to memory of 1996	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	50
PID 2092 wrote to memory of 1996	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	50
PID 2092 wrote to memory of 1400	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	51
PID 2092 wrote to memory of 1400	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	51
PID 2092 wrote to memory of 1400	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	51
PID 2092 wrote to memory of 2376	2092	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	52

C:\Windows\System32\vlmvdx.exe
"C:\Windows\System32\vlmvdx.exe"
1⤵
PID:1564

C:\Users\Admin\AppData\Local\Temp\014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2928
- C:\Windows\System\VrEtTCp.exe
  C:\Windows\System\VrEtTCp.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\MtlafVr.exe
  C:\Windows\System\MtlafVr.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\yjBUGLc.exe
  C:\Windows\System\yjBUGLc.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\qpSorIO.exe
  C:\Windows\System\qpSorIO.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\yJTrQjc.exe
  C:\Windows\System\yJTrQjc.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\nJzDFBE.exe
  C:\Windows\System\nJzDFBE.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\CphbAZF.exe
  C:\Windows\System\CphbAZF.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\JEqCJnR.exe
  C:\Windows\System\JEqCJnR.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\yyTRYaZ.exe
  C:\Windows\System\yyTRYaZ.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\GZoHWNt.exe
  C:\Windows\System\GZoHWNt.exe
  2⤵
  - Executes dropped EXE
  PID:284
- C:\Windows\System\rDDaDIo.exe
  C:\Windows\System\rDDaDIo.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\uzcHqak.exe
  C:\Windows\System\uzcHqak.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\SfGDdbU.exe
  C:\Windows\System\SfGDdbU.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\xIhZtoI.exe
  C:\Windows\System\xIhZtoI.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\ADDkZKk.exe
  C:\Windows\System\ADDkZKk.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\FKTftVt.exe
  C:\Windows\System\FKTftVt.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\swONdEf.exe
  C:\Windows\System\swONdEf.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\WiOKnoX.exe
  C:\Windows\System\WiOKnoX.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\MoyXQNG.exe
  C:\Windows\System\MoyXQNG.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\tiHtkzR.exe
  C:\Windows\System\tiHtkzR.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\zqUPZLQ.exe
  C:\Windows\System\zqUPZLQ.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\pfkzwuj.exe
  C:\Windows\System\pfkzwuj.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\foFLxuS.exe
  C:\Windows\System\foFLxuS.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\jvKnRNU.exe
  C:\Windows\System\jvKnRNU.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\mIxwJaA.exe
  C:\Windows\System\mIxwJaA.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\qPlwzhF.exe
  C:\Windows\System\qPlwzhF.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\TNzjMJc.exe
  C:\Windows\System\TNzjMJc.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\cLrSZGe.exe
  C:\Windows\System\cLrSZGe.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\gRfBfzO.exe
  C:\Windows\System\gRfBfzO.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\wOTmjFW.exe
  C:\Windows\System\wOTmjFW.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\bCqESmk.exe
  C:\Windows\System\bCqESmk.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\tmlPQHf.exe
  C:\Windows\System\tmlPQHf.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\LkaYCTV.exe
  C:\Windows\System\LkaYCTV.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\RHBwgpL.exe
  C:\Windows\System\RHBwgpL.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\qBCOphW.exe
  C:\Windows\System\qBCOphW.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\UVhyRic.exe
  C:\Windows\System\UVhyRic.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\qKTdXxv.exe
  C:\Windows\System\qKTdXxv.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\niySPGp.exe
  C:\Windows\System\niySPGp.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\UvKOzQw.exe
  C:\Windows\System\UvKOzQw.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\FEsjFZu.exe
  C:\Windows\System\FEsjFZu.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\IsfihbD.exe
  C:\Windows\System\IsfihbD.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\JCWaLJB.exe
  C:\Windows\System\JCWaLJB.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\rXjakJF.exe
  C:\Windows\System\rXjakJF.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\ZOlkMmk.exe
  C:\Windows\System\ZOlkMmk.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\kkYhGuY.exe
  C:\Windows\System\kkYhGuY.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\yRTpMAd.exe
  C:\Windows\System\yRTpMAd.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\QzcrpiP.exe
  C:\Windows\System\QzcrpiP.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\TdUofyn.exe
  C:\Windows\System\TdUofyn.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\pRqzNDZ.exe
  C:\Windows\System\pRqzNDZ.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\sBPDIiB.exe
  C:\Windows\System\sBPDIiB.exe
  2⤵
  - Executes dropped EXE
  PID:236
- C:\Windows\System\BoCEEKq.exe
  C:\Windows\System\BoCEEKq.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\zuhdTLG.exe
  C:\Windows\System\zuhdTLG.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\CDuXsLG.exe
  C:\Windows\System\CDuXsLG.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\QjgiDES.exe
  C:\Windows\System\QjgiDES.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\WmCKvmA.exe
  C:\Windows\System\WmCKvmA.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\owaXcdP.exe
  C:\Windows\System\owaXcdP.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\fkyLECZ.exe
  C:\Windows\System\fkyLECZ.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\PLFlUOs.exe
  C:\Windows\System\PLFlUOs.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\BQZwZSI.exe
  C:\Windows\System\BQZwZSI.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\PMORZRs.exe
  C:\Windows\System\PMORZRs.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\jzuawor.exe
  C:\Windows\System\jzuawor.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\LvFKhqD.exe
  C:\Windows\System\LvFKhqD.exe
  2⤵
  PID:2756
- C:\Windows\System\WupbrDF.exe
  C:\Windows\System\WupbrDF.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\eRBaXSR.exe
  C:\Windows\System\eRBaXSR.exe
  2⤵
  PID:1612
- C:\Windows\System\vmsrvoZ.exe
  C:\Windows\System\vmsrvoZ.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\hDSNpag.exe
  C:\Windows\System\hDSNpag.exe
  2⤵
  PID:1672
- C:\Windows\System\wVcyggV.exe
  C:\Windows\System\wVcyggV.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\ppEdBia.exe
  C:\Windows\System\ppEdBia.exe
  2⤵
  PID:1468
- C:\Windows\System\pkmwcbW.exe
  C:\Windows\System\pkmwcbW.exe
  2⤵
  PID:2060
- C:\Windows\System\VzsxweH.exe
  C:\Windows\System\VzsxweH.exe
  2⤵
  PID:3040
- C:\Windows\System\UACVEIC.exe
  C:\Windows\System\UACVEIC.exe
  2⤵
  PID:1620
- C:\Windows\System\rZVlnJu.exe
  C:\Windows\System\rZVlnJu.exe
  2⤵
  PID:1812
- C:\Windows\System\pGUkTjn.exe
  C:\Windows\System\pGUkTjn.exe
  2⤵
  PID:524
- C:\Windows\System\JmJRZHM.exe
  C:\Windows\System\JmJRZHM.exe
  2⤵
  PID:2980
- C:\Windows\System\doeUMhf.exe
  C:\Windows\System\doeUMhf.exe
  2⤵
  PID:2568
- C:\Windows\System\SNFsUbr.exe
  C:\Windows\System\SNFsUbr.exe
  2⤵
  PID:2152
- C:\Windows\System\FATGHaN.exe
  C:\Windows\System\FATGHaN.exe
  2⤵
  PID:1172
- C:\Windows\System\rLqOCnf.exe
  C:\Windows\System\rLqOCnf.exe
  2⤵
  PID:1872
- C:\Windows\System\YOTxWeo.exe
  C:\Windows\System\YOTxWeo.exe
  2⤵
  PID:2900
- C:\Windows\System\hsPFTyP.exe
  C:\Windows\System\hsPFTyP.exe
  2⤵
  PID:3080
- C:\Windows\System\mXfcCOt.exe
  C:\Windows\System\mXfcCOt.exe
  2⤵
  PID:3096
- C:\Windows\System\TbrRCHW.exe
  C:\Windows\System\TbrRCHW.exe
  2⤵
  PID:3112
- C:\Windows\System\MElzZmW.exe
  C:\Windows\System\MElzZmW.exe
  2⤵
  PID:3128
- C:\Windows\System\WVoycXU.exe
  C:\Windows\System\WVoycXU.exe
  2⤵
  PID:3144
- C:\Windows\System\VLGTYkz.exe
  C:\Windows\System\VLGTYkz.exe
  2⤵
  PID:3160
- C:\Windows\System\LVSWjub.exe
  C:\Windows\System\LVSWjub.exe
  2⤵
  PID:3176
- C:\Windows\System\JtMjSxl.exe
  C:\Windows\System\JtMjSxl.exe
  2⤵
  PID:3196
- C:\Windows\System\ljSLryT.exe
  C:\Windows\System\ljSLryT.exe
  2⤵
  PID:3212
- C:\Windows\System\tHvBdUQ.exe
  C:\Windows\System\tHvBdUQ.exe
  2⤵
  PID:3228
- C:\Windows\System\ycdPMGf.exe
  C:\Windows\System\ycdPMGf.exe
  2⤵
  PID:3244
- C:\Windows\System\DfoVadG.exe
  C:\Windows\System\DfoVadG.exe
  2⤵
  PID:3260
- C:\Windows\System\BzGWNob.exe
  C:\Windows\System\BzGWNob.exe
  2⤵
  PID:3276
- C:\Windows\System\vFNDGkU.exe
  C:\Windows\System\vFNDGkU.exe
  2⤵
  PID:3292
- C:\Windows\System\rTatFZo.exe
  C:\Windows\System\rTatFZo.exe
  2⤵
  PID:3312
- C:\Windows\System\DSvKnmu.exe
  C:\Windows\System\DSvKnmu.exe
  2⤵
  PID:3328
- C:\Windows\System\VWZuBFO.exe
  C:\Windows\System\VWZuBFO.exe
  2⤵
  PID:3344
- C:\Windows\System\urROJXe.exe
  C:\Windows\System\urROJXe.exe
  2⤵
  PID:3360
- C:\Windows\System\MCOkxYe.exe
  C:\Windows\System\MCOkxYe.exe
  2⤵
  PID:3376
- C:\Windows\System\OAqmfQE.exe
  C:\Windows\System\OAqmfQE.exe
  2⤵
  PID:3396
- C:\Windows\System\sdTENVk.exe
  C:\Windows\System\sdTENVk.exe
  2⤵
  PID:3412
- C:\Windows\System\SoghNFt.exe
  C:\Windows\System\SoghNFt.exe
  2⤵
  PID:3428
- C:\Windows\System\aUyQZYF.exe
  C:\Windows\System\aUyQZYF.exe
  2⤵
  PID:3444
- C:\Windows\System\hUJbkOM.exe
  C:\Windows\System\hUJbkOM.exe
  2⤵
  PID:3696
- C:\Windows\System\uysxqhV.exe
  C:\Windows\System\uysxqhV.exe
  2⤵
  PID:3712
- C:\Windows\System\CCKvBss.exe
  C:\Windows\System\CCKvBss.exe
  2⤵
  PID:3728
- C:\Windows\System\RCGIAMg.exe
  C:\Windows\System\RCGIAMg.exe
  2⤵
  PID:3744
- C:\Windows\System\mnEACeg.exe
  C:\Windows\System\mnEACeg.exe
  2⤵
  PID:3760
- C:\Windows\System\RKvfXyl.exe
  C:\Windows\System\RKvfXyl.exe
  2⤵
  PID:3776
- C:\Windows\System\tGplDwa.exe
  C:\Windows\System\tGplDwa.exe
  2⤵
  PID:3792
- C:\Windows\System\jOmhxeP.exe
  C:\Windows\System\jOmhxeP.exe
  2⤵
  PID:3808
- C:\Windows\System\ZbYsNTs.exe
  C:\Windows\System\ZbYsNTs.exe
  2⤵
  PID:3824
- C:\Windows\System\YOTVnbd.exe
  C:\Windows\System\YOTVnbd.exe
  2⤵
  PID:3840
- C:\Windows\System\oQuDRGT.exe
  C:\Windows\System\oQuDRGT.exe
  2⤵
  PID:3856
- C:\Windows\System\bnKzSXf.exe
  C:\Windows\System\bnKzSXf.exe
  2⤵
  PID:3960
- C:\Windows\System\IxaiINE.exe
  C:\Windows\System\IxaiINE.exe
  2⤵
  PID:3980
- C:\Windows\System\RJKydTO.exe
  C:\Windows\System\RJKydTO.exe
  2⤵
  PID:3996
- C:\Windows\System\oTYiRsB.exe
  C:\Windows\System\oTYiRsB.exe
  2⤵
  PID:4012
- C:\Windows\System\rahVBRf.exe
  C:\Windows\System\rahVBRf.exe
  2⤵
  PID:4028
- C:\Windows\System\MdHFBUK.exe
  C:\Windows\System\MdHFBUK.exe
  2⤵
  PID:4044
- C:\Windows\System\RxKBqsc.exe
  C:\Windows\System\RxKBqsc.exe
  2⤵
  PID:4060
- C:\Windows\System\JVjmhbz.exe
  C:\Windows\System\JVjmhbz.exe
  2⤵
  PID:4076
- C:\Windows\System\QzErjPC.exe
  C:\Windows\System\QzErjPC.exe
  2⤵
  PID:2348
- C:\Windows\System\pFkaBem.exe
  C:\Windows\System\pFkaBem.exe
  2⤵
  PID:1660
- C:\Windows\System\HGSfwWs.exe
  C:\Windows\System\HGSfwWs.exe
  2⤵
  PID:1284
- C:\Windows\System\EgZyxrE.exe
  C:\Windows\System\EgZyxrE.exe
  2⤵
  PID:1032
- C:\Windows\System\geeUMBY.exe
  C:\Windows\System\geeUMBY.exe
  2⤵
  PID:1396
- C:\Windows\System\LOZZrsU.exe
  C:\Windows\System\LOZZrsU.exe
  2⤵
  PID:716
- C:\Windows\System\uhUBqEU.exe
  C:\Windows\System\uhUBqEU.exe
  2⤵
  PID:2188
- C:\Windows\System\YIbSZYD.exe
  C:\Windows\System\YIbSZYD.exe
  2⤵
  PID:1076
- C:\Windows\System\GXIaNEZ.exe
  C:\Windows\System\GXIaNEZ.exe
  2⤵
  PID:2360
- C:\Windows\System\bWdwKBY.exe
  C:\Windows\System\bWdwKBY.exe
  2⤵
  PID:3120
- C:\Windows\System\qBibcen.exe
  C:\Windows\System\qBibcen.exe
  2⤵
  PID:3156
- C:\Windows\System\hpaUzXg.exe
  C:\Windows\System\hpaUzXg.exe
  2⤵
  PID:3256
- C:\Windows\System\KlgQklb.exe
  C:\Windows\System\KlgQklb.exe
  2⤵
  PID:3356
- C:\Windows\System\AsyYJWl.exe
  C:\Windows\System\AsyYJWl.exe
  2⤵
  PID:3420
- C:\Windows\System\mctFTAL.exe
  C:\Windows\System\mctFTAL.exe
  2⤵
  PID:3472
- C:\Windows\System\iPpbzrq.exe
  C:\Windows\System\iPpbzrq.exe
  2⤵
  PID:3484
- C:\Windows\System\pFxSnKb.exe
  C:\Windows\System\pFxSnKb.exe
  2⤵
  PID:3560
- C:\Windows\System\wsCBHGa.exe
  C:\Windows\System\wsCBHGa.exe
  2⤵
  PID:3580
- C:\Windows\System\Biluffj.exe
  C:\Windows\System\Biluffj.exe
  2⤵
  PID:3600
- C:\Windows\System\QDZAPeJ.exe
  C:\Windows\System\QDZAPeJ.exe
  2⤵
  PID:3628
- C:\Windows\System\jqmlshM.exe
  C:\Windows\System\jqmlshM.exe
  2⤵
  PID:3640
- C:\Windows\System\PGvKUtC.exe
  C:\Windows\System\PGvKUtC.exe
  2⤵
  PID:3320
- C:\Windows\System\eQUpkjF.exe
  C:\Windows\System\eQUpkjF.exe
  2⤵
  PID:1540
- C:\Windows\System\ivTssuk.exe
  C:\Windows\System\ivTssuk.exe
  2⤵
  PID:3140
- C:\Windows\System\EvXenKV.exe
  C:\Windows\System\EvXenKV.exe
  2⤵
  PID:3236
- C:\Windows\System\BqJClXK.exe
  C:\Windows\System\BqJClXK.exe
  2⤵
  PID:3304
- C:\Windows\System\MgdUUkZ.exe
  C:\Windows\System\MgdUUkZ.exe
  2⤵
  PID:3368
- C:\Windows\System\ErzdfdF.exe
  C:\Windows\System\ErzdfdF.exe
  2⤵
  PID:3436
- C:\Windows\System\nQfjcZh.exe
  C:\Windows\System\nQfjcZh.exe
  2⤵
  PID:3804
- C:\Windows\System\KmrhorO.exe
  C:\Windows\System\KmrhorO.exe
  2⤵
  PID:3872
- C:\Windows\System\gurKoTB.exe
  C:\Windows\System\gurKoTB.exe
  2⤵
  PID:3892
- C:\Windows\System\vqtnHEu.exe
  C:\Windows\System\vqtnHEu.exe
  2⤵
  PID:3924
- C:\Windows\System\wYzhwoF.exe
  C:\Windows\System\wYzhwoF.exe
  2⤵
  PID:3736
- C:\Windows\System\zDivIto.exe
  C:\Windows\System\zDivIto.exe
  2⤵
  PID:3944
- C:\Windows\System\FuUSQQC.exe
  C:\Windows\System\FuUSQQC.exe
  2⤵
  PID:3816
- C:\Windows\System\qAIJTyy.exe
  C:\Windows\System\qAIJTyy.exe
  2⤵
  PID:3968
- C:\Windows\System\vcQqkjr.exe
  C:\Windows\System\vcQqkjr.exe
  2⤵
  PID:4008
- C:\Windows\System\WbAtBAx.exe
  C:\Windows\System\WbAtBAx.exe
  2⤵
  PID:816
- C:\Windows\System\VBqBGrJ.exe
  C:\Windows\System\VBqBGrJ.exe
  2⤵
  PID:4020
- C:\Windows\System\sVwiAgF.exe
  C:\Windows\System\sVwiAgF.exe
  2⤵
  PID:4084
- C:\Windows\System\zfZXxAl.exe
  C:\Windows\System\zfZXxAl.exe
  2⤵
  PID:1016
- C:\Windows\System\XyoFYvy.exe
  C:\Windows\System\XyoFYvy.exe
  2⤵
  PID:2956
- C:\Windows\System\upJbVKW.exe
  C:\Windows\System\upJbVKW.exe
  2⤵
  PID:3324
- C:\Windows\System\GDLNNNr.exe
  C:\Windows\System\GDLNNNr.exe
  2⤵
  PID:3496
- C:\Windows\System\MCmIjgO.exe
  C:\Windows\System\MCmIjgO.exe
  2⤵
  PID:3188
- C:\Windows\System\BCHxpDJ.exe
  C:\Windows\System\BCHxpDJ.exe
  2⤵
  PID:3392
- C:\Windows\System\nmpRKKz.exe
  C:\Windows\System\nmpRKKz.exe
  2⤵
  PID:3288
- C:\Windows\System\yZEhCyG.exe
  C:\Windows\System\yZEhCyG.exe
  2⤵
  PID:3492
- C:\Windows\System\JIFMTiD.exe
  C:\Windows\System\JIFMTiD.exe
  2⤵
  PID:3604
- C:\Windows\System\NaXkTvL.exe
  C:\Windows\System\NaXkTvL.exe
  2⤵
  PID:2336
- C:\Windows\System\UiGAOgI.exe
  C:\Windows\System\UiGAOgI.exe
  2⤵
  PID:2728
- C:\Windows\System\GegBrpE.exe
  C:\Windows\System\GegBrpE.exe
  2⤵
  PID:1928
- C:\Windows\System\GDsSIvm.exe
  C:\Windows\System\GDsSIvm.exe
  2⤵
  PID:592
- C:\Windows\System\KzIKxHK.exe
  C:\Windows\System\KzIKxHK.exe
  2⤵
  PID:2660
- C:\Windows\System\xVvJBxv.exe
  C:\Windows\System\xVvJBxv.exe
  2⤵
  PID:2480
- C:\Windows\System\RAegUTP.exe
  C:\Windows\System\RAegUTP.exe
  2⤵
  PID:3104
- C:\Windows\System\qDyyStz.exe
  C:\Windows\System\qDyyStz.exe
  2⤵
  PID:3208
- C:\Windows\System\jYTbnom.exe
  C:\Windows\System\jYTbnom.exe
  2⤵
  PID:3408
- C:\Windows\System\BYqQEyr.exe
  C:\Windows\System\BYqQEyr.exe
  2⤵
  PID:3908
- C:\Windows\System\kKIYpBI.exe
  C:\Windows\System\kKIYpBI.exe
  2⤵
  PID:3848
- C:\Windows\System\gBaijRK.exe
  C:\Windows\System\gBaijRK.exe
  2⤵
  PID:1676
- C:\Windows\System\EcbJgVi.exe
  C:\Windows\System\EcbJgVi.exe
  2⤵
  PID:3092
- C:\Windows\System\OdFBKrk.exe
  C:\Windows\System\OdFBKrk.exe
  2⤵
  PID:3752
- C:\Windows\System\aiPezDI.exe
  C:\Windows\System\aiPezDI.exe
  2⤵
  PID:2792
- C:\Windows\System\xGpNnEf.exe
  C:\Windows\System\xGpNnEf.exe
  2⤵
  PID:3740
- C:\Windows\System\JgdYXDc.exe
  C:\Windows\System\JgdYXDc.exe
  2⤵
  PID:3880
- C:\Windows\System\XAbWNtx.exe
  C:\Windows\System\XAbWNtx.exe
  2⤵
  PID:3784
- C:\Windows\System\NsuRSDj.exe
  C:\Windows\System\NsuRSDj.exe
  2⤵
  PID:3648
- C:\Windows\System\oxerLeO.exe
  C:\Windows\System\oxerLeO.exe
  2⤵
  PID:3680
- C:\Windows\System\HnGhrzQ.exe
  C:\Windows\System\HnGhrzQ.exe
  2⤵
  PID:2056
- C:\Windows\System\ifEAsaW.exe
  C:\Windows\System\ifEAsaW.exe
  2⤵
  PID:3676
- C:\Windows\System\DTqKTuO.exe
  C:\Windows\System\DTqKTuO.exe
  2⤵
  PID:3940
- C:\Windows\System\AJXTxJO.exe
  C:\Windows\System\AJXTxJO.exe
  2⤵
  PID:3616
- C:\Windows\System\qJEJduU.exe
  C:\Windows\System\qJEJduU.exe
  2⤵
  PID:3772
- C:\Windows\System\qdbnfYO.exe
  C:\Windows\System\qdbnfYO.exe
  2⤵
  PID:616
- C:\Windows\System\CgkbVzJ.exe
  C:\Windows\System\CgkbVzJ.exe
  2⤵
  PID:3596
- C:\Windows\System\tbwcReh.exe
  C:\Windows\System\tbwcReh.exe
  2⤵
  PID:4004
- C:\Windows\System\bTqYLNF.exe
  C:\Windows\System\bTqYLNF.exe
  2⤵
  PID:3992
- C:\Windows\System\dRrvKTL.exe
  C:\Windows\System\dRrvKTL.exe
  2⤵
  PID:2144
- C:\Windows\System\icVIopP.exe
  C:\Windows\System\icVIopP.exe
  2⤵
  PID:4112
- C:\Windows\System\GXyfnoh.exe
  C:\Windows\System\GXyfnoh.exe
  2⤵
  PID:4140
- C:\Windows\System\UtDBWoQ.exe
  C:\Windows\System\UtDBWoQ.exe
  2⤵
  PID:4196
- C:\Windows\System\fktVrcx.exe
  C:\Windows\System\fktVrcx.exe
  2⤵
  PID:4212
- C:\Windows\System\swMVyRs.exe
  C:\Windows\System\swMVyRs.exe
  2⤵
  PID:4228
- C:\Windows\System\uRipDMS.exe
  C:\Windows\System\uRipDMS.exe
  2⤵
  PID:4244
- C:\Windows\System\puuhLyF.exe
  C:\Windows\System\puuhLyF.exe
  2⤵
  PID:4260
- C:\Windows\System\MmbQPMv.exe
  C:\Windows\System\MmbQPMv.exe
  2⤵
  PID:4300
- C:\Windows\System\BOPWuIx.exe
  C:\Windows\System\BOPWuIx.exe
  2⤵
  PID:4324
- C:\Windows\System\OwYDviA.exe
  C:\Windows\System\OwYDviA.exe
  2⤵
  PID:4340
- C:\Windows\System\qbrFXcJ.exe
  C:\Windows\System\qbrFXcJ.exe
  2⤵
  PID:4356
- C:\Windows\System\GTdmukH.exe
  C:\Windows\System\GTdmukH.exe
  2⤵
  PID:4372
- C:\Windows\System\AYJfMXs.exe
  C:\Windows\System\AYJfMXs.exe
  2⤵
  PID:4388
- C:\Windows\System\evnwxmt.exe
  C:\Windows\System\evnwxmt.exe
  2⤵
  PID:4404
- C:\Windows\System\eMprbfM.exe
  C:\Windows\System\eMprbfM.exe
  2⤵
  PID:4420
- C:\Windows\System\UbCEAUE.exe
  C:\Windows\System\UbCEAUE.exe
  2⤵
  PID:4436
- C:\Windows\System\klndZzp.exe
  C:\Windows\System\klndZzp.exe
  2⤵
  PID:4452
- C:\Windows\System\pmWGype.exe
  C:\Windows\System\pmWGype.exe
  2⤵
  PID:4468
- C:\Windows\System\YVqcIim.exe
  C:\Windows\System\YVqcIim.exe
  2⤵
  PID:4492
- C:\Windows\System\cWaQVhm.exe
  C:\Windows\System\cWaQVhm.exe
  2⤵
  PID:4508
- C:\Windows\System\iUJSOPQ.exe
  C:\Windows\System\iUJSOPQ.exe
  2⤵
  PID:4524
- C:\Windows\System\DNaUoHA.exe
  C:\Windows\System\DNaUoHA.exe
  2⤵
  PID:4540
- C:\Windows\System\ffAFwVe.exe
  C:\Windows\System\ffAFwVe.exe
  2⤵
  PID:4556
- C:\Windows\System\OCVUxlk.exe
  C:\Windows\System\OCVUxlk.exe
  2⤵
  PID:4572
- C:\Windows\System\hgXvBLN.exe
  C:\Windows\System\hgXvBLN.exe
  2⤵
  PID:4588
- C:\Windows\System\veiFYMw.exe
  C:\Windows\System\veiFYMw.exe
  2⤵
  PID:4604
- C:\Windows\System\NifIvqf.exe
  C:\Windows\System\NifIvqf.exe
  2⤵
  PID:4660
- C:\Windows\System\zxqDLhG.exe
  C:\Windows\System\zxqDLhG.exe
  2⤵
  PID:4680
- C:\Windows\System\HFQTvKM.exe
  C:\Windows\System\HFQTvKM.exe
  2⤵
  PID:4720
- C:\Windows\System\AwBNieJ.exe
  C:\Windows\System\AwBNieJ.exe
  2⤵
  PID:4736
- C:\Windows\System\bfNTTdY.exe
  C:\Windows\System\bfNTTdY.exe
  2⤵
  PID:4752
- C:\Windows\System\FcLpUgt.exe
  C:\Windows\System\FcLpUgt.exe
  2⤵
  PID:4768
- C:\Windows\System\BwGEjLF.exe
  C:\Windows\System\BwGEjLF.exe
  2⤵
  PID:4784
- C:\Windows\System\yRUolQx.exe
  C:\Windows\System\yRUolQx.exe
  2⤵
  PID:4804
- C:\Windows\System\xSzAfgW.exe
  C:\Windows\System\xSzAfgW.exe
  2⤵
  PID:4820
- C:\Windows\System\ZZXGSVR.exe
  C:\Windows\System\ZZXGSVR.exe
  2⤵
  PID:4836
- C:\Windows\System\AIpUNXm.exe
  C:\Windows\System\AIpUNXm.exe
  2⤵
  PID:4852
- C:\Windows\System\dwuAvVU.exe
  C:\Windows\System\dwuAvVU.exe
  2⤵
  PID:4868
- C:\Windows\System\JWrmqlv.exe
  C:\Windows\System\JWrmqlv.exe
  2⤵
  PID:4884
- C:\Windows\System\LrAEmys.exe
  C:\Windows\System\LrAEmys.exe
  2⤵
  PID:4900
- C:\Windows\System\qrJuFeF.exe
  C:\Windows\System\qrJuFeF.exe
  2⤵
  PID:4916
- C:\Windows\System\fOkMxGk.exe
  C:\Windows\System\fOkMxGk.exe
  2⤵
  PID:4936
- C:\Windows\System\zVKAVPr.exe
  C:\Windows\System\zVKAVPr.exe
  2⤵
  PID:4952
- C:\Windows\System\MzCfczS.exe
  C:\Windows\System\MzCfczS.exe
  2⤵
  PID:4972
- C:\Windows\System\MChyrGm.exe
  C:\Windows\System\MChyrGm.exe
  2⤵
  PID:4992
- C:\Windows\System\QQKYnbK.exe
  C:\Windows\System\QQKYnbK.exe
  2⤵
  PID:5008
- C:\Windows\System\rALyXQX.exe
  C:\Windows\System\rALyXQX.exe
  2⤵
  PID:5024
- C:\Windows\System\QrxZJGo.exe
  C:\Windows\System\QrxZJGo.exe
  2⤵
  PID:5040
- C:\Windows\System\OTnsFQq.exe
  C:\Windows\System\OTnsFQq.exe
  2⤵
  PID:5056
- C:\Windows\System\PTHCnCp.exe
  C:\Windows\System\PTHCnCp.exe
  2⤵
  PID:5072
- C:\Windows\System\etkgxXR.exe
  C:\Windows\System\etkgxXR.exe
  2⤵
  PID:5092
- C:\Windows\System\ouWDKCU.exe
  C:\Windows\System\ouWDKCU.exe
  2⤵
  PID:5108
- C:\Windows\System\cxYcxzf.exe
  C:\Windows\System\cxYcxzf.exe
  2⤵
  PID:2260
- C:\Windows\System\vIFgLuK.exe
  C:\Windows\System\vIFgLuK.exe
  2⤵
  PID:3864
- C:\Windows\System\GIWhAVJ.exe
  C:\Windows\System\GIWhAVJ.exe
  2⤵
  PID:3936
- C:\Windows\System\DmiZIgx.exe
  C:\Windows\System\DmiZIgx.exe
  2⤵
  PID:3708
- C:\Windows\System\ZpojSTH.exe
  C:\Windows\System\ZpojSTH.exe
  2⤵
  PID:4100
- C:\Windows\System\mZoHvnO.exe
  C:\Windows\System\mZoHvnO.exe
  2⤵
  PID:4040
- C:\Windows\System\mtYZwrz.exe
  C:\Windows\System\mtYZwrz.exe
  2⤵
  PID:1896
- C:\Windows\System\QdUHyhy.exe
  C:\Windows\System\QdUHyhy.exe
  2⤵
  PID:3252
- C:\Windows\System\fBXdxci.exe
  C:\Windows\System\fBXdxci.exe
  2⤵
  PID:4184
- C:\Windows\System\zJjyHJF.exe
  C:\Windows\System\zJjyHJF.exe
  2⤵
  PID:3672
- C:\Windows\System\tnaClLW.exe
  C:\Windows\System\tnaClLW.exe
  2⤵
  PID:4192
- C:\Windows\System\VwKkPfH.exe
  C:\Windows\System\VwKkPfH.exe
  2⤵
  PID:4220
- C:\Windows\System\tZgtyRB.exe
  C:\Windows\System\tZgtyRB.exe
  2⤵
  PID:4276
- C:\Windows\System\zmFGCKP.exe
  C:\Windows\System\zmFGCKP.exe
  2⤵
  PID:4296
- C:\Windows\System\EpuwrBH.exe
  C:\Windows\System\EpuwrBH.exe
  2⤵
  PID:4320
- C:\Windows\System\cudGLTc.exe
  C:\Windows\System\cudGLTc.exe
  2⤵
  PID:4384
- C:\Windows\System\wvmpYdY.exe
  C:\Windows\System\wvmpYdY.exe
  2⤵
  PID:4400
- C:\Windows\System\vsyRCyO.exe
  C:\Windows\System\vsyRCyO.exe
  2⤵
  PID:4504
- C:\Windows\System\ZxVtSpO.exe
  C:\Windows\System\ZxVtSpO.exe
  2⤵
  PID:4564
- C:\Windows\System\uHHvRqk.exe
  C:\Windows\System\uHHvRqk.exe
  2⤵
  PID:4676
- C:\Windows\System\baWsVUH.exe
  C:\Windows\System\baWsVUH.exe
  2⤵
  PID:4792
- C:\Windows\System\pMaaaiG.exe
  C:\Windows\System\pMaaaiG.exe
  2⤵
  PID:4648
- C:\Windows\System\YdTztpw.exe
  C:\Windows\System\YdTztpw.exe
  2⤵
  PID:4688
- C:\Windows\System\eiFanyv.exe
  C:\Windows\System\eiFanyv.exe
  2⤵
  PID:4708
- C:\Windows\System\kMdocEa.exe
  C:\Windows\System\kMdocEa.exe
  2⤵
  PID:4864
- C:\Windows\System\TCsnWYC.exe
  C:\Windows\System\TCsnWYC.exe
  2⤵
  PID:4924
- C:\Windows\System\UZSLjdc.exe
  C:\Windows\System\UZSLjdc.exe
  2⤵
  PID:4964
- C:\Windows\System\MezJeiR.exe
  C:\Windows\System\MezJeiR.exe
  2⤵
  PID:4624
- C:\Windows\System\nIRxzjy.exe
  C:\Windows\System\nIRxzjy.exe
  2⤵
  PID:4640
- C:\Windows\System\YifnOvP.exe
  C:\Windows\System\YifnOvP.exe
  2⤵
  PID:5004
- C:\Windows\System\plforur.exe
  C:\Windows\System\plforur.exe
  2⤵
  PID:5064
- C:\Windows\System\xOAHKFP.exe
  C:\Windows\System\xOAHKFP.exe
  2⤵
  PID:4712
- C:\Windows\System\HboGApJ.exe
  C:\Windows\System\HboGApJ.exe
  2⤵
  PID:4848
- C:\Windows\System\tGQnsKX.exe
  C:\Windows\System\tGQnsKX.exe
  2⤵
  PID:4908
- C:\Windows\System\rocuPUB.exe
  C:\Windows\System\rocuPUB.exe
  2⤵
  PID:4980
- C:\Windows\System\vtyVbMS.exe
  C:\Windows\System\vtyVbMS.exe
  2⤵
  PID:5020
- C:\Windows\System\ovlYypu.exe
  C:\Windows\System\ovlYypu.exe
  2⤵
  PID:5084
- C:\Windows\System\ILMbRXy.exe
  C:\Windows\System\ILMbRXy.exe
  2⤵
  PID:3720
- C:\Windows\System\nQwRZRI.exe
  C:\Windows\System\nQwRZRI.exe
  2⤵
  PID:860
- C:\Windows\System\fRvodfL.exe
  C:\Windows\System\fRvodfL.exe
  2⤵
  PID:4148
- C:\Windows\System\hlCpxKd.exe
  C:\Windows\System\hlCpxKd.exe
  2⤵
  PID:4108
- C:\Windows\System\zmZDqnZ.exe
  C:\Windows\System\zmZDqnZ.exe
  2⤵
  PID:3572
- C:\Windows\System\gxajWyg.exe
  C:\Windows\System\gxajWyg.exe
  2⤵
  PID:3976
- C:\Windows\System\bVXQkBf.exe
  C:\Windows\System\bVXQkBf.exe
  2⤵
  PID:3660
- C:\Windows\System\fLvYFqG.exe
  C:\Windows\System\fLvYFqG.exe
  2⤵
  PID:3664
- C:\Windows\System\gEaXVTL.exe
  C:\Windows\System\gEaXVTL.exe
  2⤵
  PID:4092
- C:\Windows\System\mZdKJKU.exe
  C:\Windows\System\mZdKJKU.exe
  2⤵
  PID:4120
- C:\Windows\System\NhptuTf.exe
  C:\Windows\System\NhptuTf.exe
  2⤵
  PID:4208
- C:\Windows\System\PMntOJD.exe
  C:\Windows\System\PMntOJD.exe
  2⤵
  PID:4268
- C:\Windows\System\RRzcCOL.exe
  C:\Windows\System\RRzcCOL.exe
  2⤵
  PID:4352
- C:\Windows\System\WKlirOJ.exe
  C:\Windows\System\WKlirOJ.exe
  2⤵
  PID:4460
- C:\Windows\System\uiPmdcN.exe
  C:\Windows\System\uiPmdcN.exe
  2⤵
  PID:4500
- C:\Windows\System\wbcZGPk.exe
  C:\Windows\System\wbcZGPk.exe
  2⤵
  PID:4448
- C:\Windows\System\cHDNLQk.exe
  C:\Windows\System\cHDNLQk.exe
  2⤵
  PID:4516
- C:\Windows\System\vhCXKyE.exe
  C:\Windows\System\vhCXKyE.exe
  2⤵
  PID:4532
- C:\Windows\System\dLOgsqn.exe
  C:\Windows\System\dLOgsqn.exe
  2⤵
  PID:4596
- C:\Windows\System\ARvGgsg.exe
  C:\Windows\System\ARvGgsg.exe
  2⤵
  PID:4416
- C:\Windows\System\nXvszfc.exe
  C:\Windows\System\nXvszfc.exe
  2⤵
  PID:4760
- C:\Windows\System\dsKpLCq.exe
  C:\Windows\System\dsKpLCq.exe
  2⤵
  PID:4124
- C:\Windows\System\bzqHmig.exe
  C:\Windows\System\bzqHmig.exe
  2⤵
  PID:4700
- C:\Windows\System\ZkauQcZ.exe
  C:\Windows\System\ZkauQcZ.exe
  2⤵
  PID:4896
- C:\Windows\System\GXPpNzJ.exe
  C:\Windows\System\GXPpNzJ.exe
  2⤵
  PID:4620
- C:\Windows\System\MlgLRES.exe
  C:\Windows\System\MlgLRES.exe
  2⤵
  PID:5036
- C:\Windows\System\NAuUrkY.exe
  C:\Windows\System\NAuUrkY.exe
  2⤵
  PID:5068
- C:\Windows\System\rFXFiSW.exe
  C:\Windows\System\rFXFiSW.exe
  2⤵
  PID:4876
- C:\Windows\System\sMZNMjD.exe
  C:\Windows\System\sMZNMjD.exe
  2⤵
  PID:4988
- C:\Windows\System\bdtzWtR.exe
  C:\Windows\System\bdtzWtR.exe
  2⤵
  PID:5052
- C:\Windows\System\hQWivzr.exe
  C:\Windows\System\hQWivzr.exe
  2⤵
  PID:3088
- C:\Windows\System\qkCGRaC.exe
  C:\Windows\System\qkCGRaC.exe
  2⤵
  PID:3172
- C:\Windows\System\ZXzSvZC.exe
  C:\Windows\System\ZXzSvZC.exe
  2⤵
  PID:2452
- C:\Windows\System\TgmcdwB.exe
  C:\Windows\System\TgmcdwB.exe
  2⤵
  PID:4180
- C:\Windows\System\tyRZjXI.exe
  C:\Windows\System\tyRZjXI.exe
  2⤵
  PID:3592
- C:\Windows\System\YsNrHon.exe
  C:\Windows\System\YsNrHon.exe
  2⤵
  PID:4252
- C:\Windows\System\PXKcBXi.exe
  C:\Windows\System\PXKcBXi.exe
  2⤵
  PID:4188
- C:\Windows\System\RixUsKe.exe
  C:\Windows\System\RixUsKe.exe
  2⤵
  PID:4332
- C:\Windows\System\OOvxPiq.exe
  C:\Windows\System\OOvxPiq.exe
  2⤵
  PID:4488
- C:\Windows\System\yuDAwzF.exe
  C:\Windows\System\yuDAwzF.exe
  2⤵
  PID:4628
- C:\Windows\System\FghxcpF.exe
  C:\Windows\System\FghxcpF.exe
  2⤵
  PID:4632
- C:\Windows\System\hrrGjTQ.exe
  C:\Windows\System\hrrGjTQ.exe
  2⤵
  PID:4696
- C:\Windows\System\XEQPvhh.exe
  C:\Windows\System\XEQPvhh.exe
  2⤵
  PID:4744
- C:\Windows\System\RIhdwdX.exe
  C:\Windows\System\RIhdwdX.exe
  2⤵
  PID:5100
- C:\Windows\System\zctHOWI.exe
  C:\Windows\System\zctHOWI.exe
  2⤵
  PID:4948
- C:\Windows\System\kVciKnJ.exe
  C:\Windows\System\kVciKnJ.exe
  2⤵
  PID:4748
- C:\Windows\System\xJdsCvt.exe
  C:\Windows\System\xJdsCvt.exe
  2⤵
  PID:4152
- C:\Windows\System\zWxEEiD.exe
  C:\Windows\System\zWxEEiD.exe
  2⤵
  PID:1444
- C:\Windows\System\YmrxTqM.exe
  C:\Windows\System\YmrxTqM.exe
  2⤵
  PID:4204
- C:\Windows\System\Dpgwcmu.exe
  C:\Windows\System\Dpgwcmu.exe
  2⤵
  PID:4432
- C:\Windows\System\RxRrOyN.exe
  C:\Windows\System\RxRrOyN.exe
  2⤵
  PID:4580
- C:\Windows\System\FZfoaaQ.exe
  C:\Windows\System\FZfoaaQ.exe
  2⤵
  PID:4272
- C:\Windows\System\ANzrINI.exe
  C:\Windows\System\ANzrINI.exe
  2⤵
  PID:4704
- C:\Windows\System\NHXsbWG.exe
  C:\Windows\System\NHXsbWG.exe
  2⤵
  PID:2804
- C:\Windows\System\xDydznH.exe
  C:\Windows\System\xDydznH.exe
  2⤵
  PID:4136
- C:\Windows\System\VjOeTeM.exe
  C:\Windows\System\VjOeTeM.exe
  2⤵
  PID:4520
- C:\Windows\System\vtaWSEw.exe
  C:\Windows\System\vtaWSEw.exe
  2⤵
  PID:1296
- C:\Windows\System\XEmnkLA.exe
  C:\Windows\System\XEmnkLA.exe
  2⤵
  PID:4892
- C:\Windows\System\VuZrQfr.exe
  C:\Windows\System\VuZrQfr.exe
  2⤵
  PID:4732
- C:\Windows\System\IXVZVDa.exe
  C:\Windows\System\IXVZVDa.exe
  2⤵
  PID:5148
- C:\Windows\System\mkZTFCb.exe
  C:\Windows\System\mkZTFCb.exe
  2⤵
  PID:5168
- C:\Windows\System\NJvcfUh.exe
  C:\Windows\System\NJvcfUh.exe
  2⤵
  PID:5212
- C:\Windows\System\ZuhhzGz.exe
  C:\Windows\System\ZuhhzGz.exe
  2⤵
  PID:5360
- C:\Windows\System\eyPbDhy.exe
  C:\Windows\System\eyPbDhy.exe
  2⤵
  PID:5384
- C:\Windows\System\KuvLVXs.exe
  C:\Windows\System\KuvLVXs.exe
  2⤵
  PID:5400
- C:\Windows\System\uPHCNQs.exe
  C:\Windows\System\uPHCNQs.exe
  2⤵
  PID:5420
- C:\Windows\System\SarGgym.exe
  C:\Windows\System\SarGgym.exe
  2⤵
  PID:5436
- C:\Windows\System\TgSClft.exe
  C:\Windows\System\TgSClft.exe
  2⤵
  PID:5452
- C:\Windows\System\xAjumtL.exe
  C:\Windows\System\xAjumtL.exe
  2⤵
  PID:5472
- C:\Windows\System\sfnQlhC.exe
  C:\Windows\System\sfnQlhC.exe
  2⤵
  PID:5492
- C:\Windows\System\KHZyMOB.exe
  C:\Windows\System\KHZyMOB.exe
  2⤵
  PID:5512
- C:\Windows\System\UiEtvgJ.exe
  C:\Windows\System\UiEtvgJ.exe
  2⤵
  PID:5536
- C:\Windows\System\ewJSMVQ.exe
  C:\Windows\System\ewJSMVQ.exe
  2⤵
  PID:5552
- C:\Windows\System\HCYQGcJ.exe
  C:\Windows\System\HCYQGcJ.exe
  2⤵
  PID:5572
- C:\Windows\System\HiuBHML.exe
  C:\Windows\System\HiuBHML.exe
  2⤵
  PID:5592
- C:\Windows\System\XCPKaXj.exe
  C:\Windows\System\XCPKaXj.exe
  2⤵
  PID:5616
- C:\Windows\System\VXgwidj.exe
  C:\Windows\System\VXgwidj.exe
  2⤵
  PID:5636
- C:\Windows\System\mqggpYU.exe
  C:\Windows\System\mqggpYU.exe
  2⤵
  PID:5656
- C:\Windows\System\FgcrnNy.exe
  C:\Windows\System\FgcrnNy.exe
  2⤵
  PID:5672
- C:\Windows\System\GLnJIOd.exe
  C:\Windows\System\GLnJIOd.exe
  2⤵
  PID:5688
- C:\Windows\System\ZtAWoWY.exe
  C:\Windows\System\ZtAWoWY.exe
  2⤵
  PID:5704
- C:\Windows\System\UOYqRGc.exe
  C:\Windows\System\UOYqRGc.exe
  2⤵
  PID:5720
- C:\Windows\System\FKFRdHJ.exe
  C:\Windows\System\FKFRdHJ.exe
  2⤵
  PID:5740
- C:\Windows\System\WFXmAWx.exe
  C:\Windows\System\WFXmAWx.exe
  2⤵
  PID:5764
- C:\Windows\System\tyeovZb.exe
  C:\Windows\System\tyeovZb.exe
  2⤵
  PID:5780
- C:\Windows\System\FHJEbBL.exe
  C:\Windows\System\FHJEbBL.exe
  2⤵
  PID:5796
- C:\Windows\System\CZNdilz.exe
  C:\Windows\System\CZNdilz.exe
  2⤵
  PID:5824
- C:\Windows\System\eNFiUNz.exe
  C:\Windows\System\eNFiUNz.exe
  2⤵
  PID:5844
- C:\Windows\System\KkcUtNC.exe
  C:\Windows\System\KkcUtNC.exe
  2⤵
  PID:5860
- C:\Windows\System\amyKfUv.exe
  C:\Windows\System\amyKfUv.exe
  2⤵
  PID:5876
- C:\Windows\System\ECZKtOL.exe
  C:\Windows\System\ECZKtOL.exe
  2⤵
  PID:5896
- C:\Windows\System\mWkqiGU.exe
  C:\Windows\System\mWkqiGU.exe
  2⤵
  PID:5932
- C:\Windows\System\sjkYlGW.exe
  C:\Windows\System\sjkYlGW.exe
  2⤵
  PID:5956
- C:\Windows\System\rWFGMLC.exe
  C:\Windows\System\rWFGMLC.exe
  2⤵
  PID:5972
- C:\Windows\System\gkbOZWI.exe
  C:\Windows\System\gkbOZWI.exe
  2⤵
  PID:5988
- C:\Windows\System\Fngptym.exe
  C:\Windows\System\Fngptym.exe
  2⤵
  PID:6004
- C:\Windows\System\VwAUmTC.exe
  C:\Windows\System\VwAUmTC.exe
  2⤵
  PID:6024
- C:\Windows\System\QFpmpmM.exe
  C:\Windows\System\QFpmpmM.exe
  2⤵
  PID:6044
- C:\Windows\System\ZmZcMEU.exe
  C:\Windows\System\ZmZcMEU.exe
  2⤵
  PID:6064
- C:\Windows\System\vxHTxpw.exe
  C:\Windows\System\vxHTxpw.exe
  2⤵
  PID:6084
- C:\Windows\System\uBFMziF.exe
  C:\Windows\System\uBFMziF.exe
  2⤵
  PID:6116
- C:\Windows\System\sSEUAMf.exe
  C:\Windows\System\sSEUAMf.exe
  2⤵
  PID:4944
- C:\Windows\System\PFiIKtO.exe
  C:\Windows\System\PFiIKtO.exe
  2⤵
  PID:5140
- C:\Windows\System\xDeUbUP.exe
  C:\Windows\System\xDeUbUP.exe
  2⤵
  PID:5164
- C:\Windows\System\YkPCQQu.exe
  C:\Windows\System\YkPCQQu.exe
  2⤵
  PID:5200
- C:\Windows\System\vjFMNQi.exe
  C:\Windows\System\vjFMNQi.exe
  2⤵
  PID:5232
- C:\Windows\System\FinadIE.exe
  C:\Windows\System\FinadIE.exe
  2⤵
  PID:5236
- C:\Windows\System\vjirPxd.exe
  C:\Windows\System\vjirPxd.exe
  2⤵
  PID:5256
- C:\Windows\System\ODQyPYs.exe
  C:\Windows\System\ODQyPYs.exe
  2⤵
  PID:5276
- C:\Windows\System\peKUCap.exe
  C:\Windows\System\peKUCap.exe
  2⤵
  PID:5296
- C:\Windows\System\BWAFZFR.exe
  C:\Windows\System\BWAFZFR.exe
  2⤵
  PID:5324
- C:\Windows\System\Cqzlwql.exe
  C:\Windows\System\Cqzlwql.exe
  2⤵
  PID:5340
- C:\Windows\System\kiUDDKO.exe
  C:\Windows\System\kiUDDKO.exe
  2⤵
  PID:5368
- C:\Windows\System\GcHkTgI.exe
  C:\Windows\System\GcHkTgI.exe
  2⤵
  PID:5372
- C:\Windows\System\ipYBpEA.exe
  C:\Windows\System\ipYBpEA.exe
  2⤵
  PID:5432
- C:\Windows\System\jRmfbIZ.exe
  C:\Windows\System\jRmfbIZ.exe
  2⤵
  PID:5408
- C:\Windows\System\yBDwvkp.exe
  C:\Windows\System\yBDwvkp.exe
  2⤵
  PID:5508
- C:\Windows\System\FpkerMB.exe
  C:\Windows\System\FpkerMB.exe
  2⤵
  PID:5580
- C:\Windows\System\iqmUCAU.exe
  C:\Windows\System\iqmUCAU.exe
  2⤵
  PID:5564
- C:\Windows\System\NOPxHjA.exe
  C:\Windows\System\NOPxHjA.exe
  2⤵
  PID:5484
- C:\Windows\System\bFSonqU.exe
  C:\Windows\System\bFSonqU.exe
  2⤵
  PID:5560
- C:\Windows\System\OQPBoEE.exe
  C:\Windows\System\OQPBoEE.exe
  2⤵
  PID:5664
- C:\Windows\System\nayMTzo.exe
  C:\Windows\System\nayMTzo.exe
  2⤵
  PID:5728
- C:\Windows\System\CWHUdRy.exe
  C:\Windows\System\CWHUdRy.exe
  2⤵
  PID:5716
- C:\Windows\System\xuVYXph.exe
  C:\Windows\System\xuVYXph.exe
  2⤵
  PID:5680
- C:\Windows\System\ivmHUHj.exe
  C:\Windows\System\ivmHUHj.exe
  2⤵
  PID:5996
- C:\Windows\System\sBBNOBN.exe
  C:\Windows\System\sBBNOBN.exe
  2⤵
  PID:5944
- C:\Windows\System\bNhcJrD.exe
  C:\Windows\System\bNhcJrD.exe
  2⤵
  PID:5984
- C:\Windows\System\sYJzTPR.exe
  C:\Windows\System\sYJzTPR.exe
  2⤵
  PID:6052
- C:\Windows\System\FibKIks.exe
  C:\Windows\System\FibKIks.exe
  2⤵
  PID:1088
- C:\Windows\System\fmHCLIm.exe
  C:\Windows\System\fmHCLIm.exe
  2⤵
  PID:6092
- C:\Windows\System\hQgerke.exe
  C:\Windows\System\hQgerke.exe
  2⤵
  PID:6136
- C:\Windows\System\uviqbGv.exe
  C:\Windows\System\uviqbGv.exe
  2⤵
  PID:5136
- C:\Windows\System\qBkLxiO.exe
  C:\Windows\System\qBkLxiO.exe
  2⤵
  PID:5128
- C:\Windows\System\agNPmUW.exe
  C:\Windows\System\agNPmUW.exe
  2⤵
  PID:5220
- C:\Windows\System\rxBcKji.exe
  C:\Windows\System\rxBcKji.exe
  2⤵
  PID:5196
- C:\Windows\System\pvefVcC.exe
  C:\Windows\System\pvefVcC.exe
  2⤵
  PID:5252
- C:\Windows\System\FNmdCBz.exe
  C:\Windows\System\FNmdCBz.exe
  2⤵
  PID:2068
- C:\Windows\System\cGTaEGQ.exe
  C:\Windows\System\cGTaEGQ.exe
  2⤵
  PID:2264
- C:\Windows\System\HKQHwlc.exe
  C:\Windows\System\HKQHwlc.exe
  2⤵
  PID:5380
- C:\Windows\System\PRZKPCZ.exe
  C:\Windows\System\PRZKPCZ.exe
  2⤵
  PID:5352
- C:\Windows\System\hTWGUEh.exe
  C:\Windows\System\hTWGUEh.exe
  2⤵
  PID:5396
- C:\Windows\System\VDqrnfm.exe
  C:\Windows\System\VDqrnfm.exe
  2⤵
  PID:5548
- C:\Windows\System\uHGminb.exe
  C:\Windows\System\uHGminb.exe
  2⤵
  PID:5444
- C:\Windows\System\reDNLob.exe
  C:\Windows\System\reDNLob.exe
  2⤵
  PID:5804
- C:\Windows\System\qqEbCZw.exe
  C:\Windows\System\qqEbCZw.exe
  2⤵
  PID:5776
- C:\Windows\System\wyUoSmR.exe
  C:\Windows\System\wyUoSmR.exe
  2⤵
  PID:5756
- C:\Windows\System\kgBReEC.exe
  C:\Windows\System\kgBReEC.exe
  2⤵
  PID:5872
- C:\Windows\System\tlGlQpE.exe
  C:\Windows\System\tlGlQpE.exe
  2⤵
  PID:5652
- C:\Windows\System\ovAhgyt.exe
  C:\Windows\System\ovAhgyt.exe
  2⤵
  PID:5884
- C:\Windows\System\tVGStpa.exe
  C:\Windows\System\tVGStpa.exe
  2⤵
  PID:6040
- C:\Windows\System\KeYTUNN.exe
  C:\Windows\System\KeYTUNN.exe
  2⤵
  PID:5916
- C:\Windows\System\OfwewXi.exe
  C:\Windows\System\OfwewXi.exe
  2⤵
  PID:6056
- C:\Windows\System\JCqcJRT.exe
  C:\Windows\System\JCqcJRT.exe
  2⤵
  PID:6104
- C:\Windows\System\GwvOAtb.exe
  C:\Windows\System\GwvOAtb.exe
  2⤵
  PID:6140
- C:\Windows\System\eqbmFKb.exe
  C:\Windows\System\eqbmFKb.exe
  2⤵
  PID:5268
- C:\Windows\System\PzmcDob.exe
  C:\Windows\System\PzmcDob.exe
  2⤵
  PID:5320
- C:\Windows\System\dnUNLjQ.exe
  C:\Windows\System\dnUNLjQ.exe
  2⤵
  PID:5500
- C:\Windows\System\rrmtpIh.exe
  C:\Windows\System\rrmtpIh.exe
  2⤵
  PID:2120
- C:\Windows\System\DKtmhdM.exe
  C:\Windows\System\DKtmhdM.exe
  2⤵
  PID:5248
- C:\Windows\System\ZuqdsNJ.exe
  C:\Windows\System\ZuqdsNJ.exe
  2⤵
  PID:5300
- C:\Windows\System\KgSkfLt.exe
  C:\Windows\System\KgSkfLt.exe
  2⤵
  PID:5464
- C:\Windows\System\XaBoNPl.exe
  C:\Windows\System\XaBoNPl.exe
  2⤵
  PID:5632
- C:\Windows\System\yckvgiY.exe
  C:\Windows\System\yckvgiY.exe
  2⤵
  PID:5304
- C:\Windows\System\EIjwSAt.exe
  C:\Windows\System\EIjwSAt.exe
  2⤵
  PID:5792
- C:\Windows\System\OyTdQAl.exe
  C:\Windows\System\OyTdQAl.exe
  2⤵
  PID:5732
- C:\Windows\System\NLWLbhF.exe
  C:\Windows\System\NLWLbhF.exe
  2⤵
  PID:5912
- C:\Windows\System\IpdJKuO.exe
  C:\Windows\System\IpdJKuO.exe
  2⤵
  PID:5332
- C:\Windows\System\XSKLXHj.exe
  C:\Windows\System\XSKLXHj.exe
  2⤵
  PID:6016
- C:\Windows\System\BJdwmGT.exe
  C:\Windows\System\BJdwmGT.exe
  2⤵
  PID:5868
- C:\Windows\System\thBeDSY.exe
  C:\Windows\System\thBeDSY.exe
  2⤵
  PID:5160
- C:\Windows\System\BYMBRtT.exe
  C:\Windows\System\BYMBRtT.exe
  2⤵
  PID:5644
- C:\Windows\System\jTSCEgR.exe
  C:\Windows\System\jTSCEgR.exe
  2⤵
  PID:5852
- C:\Windows\System\hWHfrbP.exe
  C:\Windows\System\hWHfrbP.exe
  2⤵
  PID:5820
- C:\Windows\System\Vkmhrvp.exe
  C:\Windows\System\Vkmhrvp.exe
  2⤵
  PID:5836
- C:\Windows\System\XaaTVxg.exe
  C:\Windows\System\XaaTVxg.exe
  2⤵
  PID:6096
- C:\Windows\System\IkoYFSL.exe
  C:\Windows\System\IkoYFSL.exe
  2⤵
  PID:5176
- C:\Windows\System\WlfzYdu.exe
  C:\Windows\System\WlfzYdu.exe
  2⤵
  PID:4548
- C:\Windows\System\uoPFZZc.exe
  C:\Windows\System\uoPFZZc.exe
  2⤵
  PID:5980
- C:\Windows\System\pzmSKJe.exe
  C:\Windows\System\pzmSKJe.exe
  2⤵
  PID:5504
- C:\Windows\System\AYmSzGG.exe
  C:\Windows\System\AYmSzGG.exe
  2⤵
  PID:5240
- C:\Windows\System\LHlVhQe.exe
  C:\Windows\System\LHlVhQe.exe
  2⤵
  PID:5684
- C:\Windows\System\gLvXACl.exe
  C:\Windows\System\gLvXACl.exe
  2⤵
  PID:5700
- C:\Windows\System\MRzsDKS.exe
  C:\Windows\System\MRzsDKS.exe
  2⤵
  PID:5480
- C:\Windows\System\HwQaAsM.exe
  C:\Windows\System\HwQaAsM.exe
  2⤵
  PID:5524
- C:\Windows\System\VfqCmkk.exe
  C:\Windows\System\VfqCmkk.exe
  2⤵
  PID:5736
- C:\Windows\System\sPqmeuz.exe
  C:\Windows\System\sPqmeuz.exe
  2⤵
  PID:5604
- C:\Windows\System\YDSpfDO.exe
  C:\Windows\System\YDSpfDO.exe
  2⤵
  PID:6160
- C:\Windows\System\fzuPtVQ.exe
  C:\Windows\System\fzuPtVQ.exe
  2⤵
  PID:6176
- C:\Windows\System\CURwxUC.exe
  C:\Windows\System\CURwxUC.exe
  2⤵
  PID:6192
- C:\Windows\System\oaKXrUe.exe
  C:\Windows\System\oaKXrUe.exe
  2⤵
  PID:6208
- C:\Windows\System\aAeJAat.exe
  C:\Windows\System\aAeJAat.exe
  2⤵
  PID:6224
- C:\Windows\System\yDwyhTy.exe
  C:\Windows\System\yDwyhTy.exe
  2⤵
  PID:6240
- C:\Windows\System\BihNeTg.exe
  C:\Windows\System\BihNeTg.exe
  2⤵
  PID:6256
- C:\Windows\System\uHzyHoA.exe
  C:\Windows\System\uHzyHoA.exe
  2⤵
  PID:6272
- C:\Windows\System\laDhIgZ.exe
  C:\Windows\System\laDhIgZ.exe
  2⤵
  PID:6292
- C:\Windows\System\ddADRBo.exe
  C:\Windows\System\ddADRBo.exe
  2⤵
  PID:6312
- C:\Windows\System\fjtGtRD.exe
  C:\Windows\System\fjtGtRD.exe
  2⤵
  PID:6328
- C:\Windows\System\CTiMSJW.exe
  C:\Windows\System\CTiMSJW.exe
  2⤵
  PID:6348
- C:\Windows\System\VNxEakA.exe
  C:\Windows\System\VNxEakA.exe
  2⤵
  PID:6364
- C:\Windows\System\tQIvuHK.exe
  C:\Windows\System\tQIvuHK.exe
  2⤵
  PID:6380
- C:\Windows\System\jDYVoTb.exe
  C:\Windows\System\jDYVoTb.exe
  2⤵
  PID:6396
- C:\Windows\System\AODpnvf.exe
  C:\Windows\System\AODpnvf.exe
  2⤵
  PID:6412
- C:\Windows\System\HpUKpzQ.exe
  C:\Windows\System\HpUKpzQ.exe
  2⤵
  PID:6428
- C:\Windows\System\XCVosmR.exe
  C:\Windows\System\XCVosmR.exe
  2⤵
  PID:6444
- C:\Windows\System\vPDKLnA.exe
  C:\Windows\System\vPDKLnA.exe
  2⤵
  PID:6460
- C:\Windows\System\WdiOXBK.exe
  C:\Windows\System\WdiOXBK.exe
  2⤵
  PID:6476
- C:\Windows\System\VPgZxDr.exe
  C:\Windows\System\VPgZxDr.exe
  2⤵
  PID:6492
- C:\Windows\System\ydjEBiK.exe
  C:\Windows\System\ydjEBiK.exe
  2⤵
  PID:6508
- C:\Windows\System\EsNIPRs.exe
  C:\Windows\System\EsNIPRs.exe
  2⤵
  PID:6532
- C:\Windows\System\BNjEEXO.exe
  C:\Windows\System\BNjEEXO.exe
  2⤵
  PID:6548
- C:\Windows\System\qhlbrdz.exe
  C:\Windows\System\qhlbrdz.exe
  2⤵
  PID:6564
- C:\Windows\System\TJJgWbb.exe
  C:\Windows\System\TJJgWbb.exe
  2⤵
  PID:6584
- C:\Windows\System\NTSiyGx.exe
  C:\Windows\System\NTSiyGx.exe
  2⤵
  PID:6600
- C:\Windows\System\yMdeCAV.exe
  C:\Windows\System\yMdeCAV.exe
  2⤵
  PID:6616
- C:\Windows\System\kYCYtDu.exe
  C:\Windows\System\kYCYtDu.exe
  2⤵
  PID:6636
- C:\Windows\System\aZcQCRF.exe
  C:\Windows\System\aZcQCRF.exe
  2⤵
  PID:6652
- C:\Windows\System\ZcXptOn.exe
  C:\Windows\System\ZcXptOn.exe
  2⤵
  PID:6668
- C:\Windows\System\aKWvjeI.exe
  C:\Windows\System\aKWvjeI.exe
  2⤵
  PID:6684
- C:\Windows\System\fEUZmDZ.exe
  C:\Windows\System\fEUZmDZ.exe
  2⤵
  PID:6700
- C:\Windows\System\EPQpuct.exe
  C:\Windows\System\EPQpuct.exe
  2⤵
  PID:6720
- C:\Windows\System\CpuiSJJ.exe
  C:\Windows\System\CpuiSJJ.exe
  2⤵
  PID:6736
- C:\Windows\System\PfOTAny.exe
  C:\Windows\System\PfOTAny.exe
  2⤵
  PID:6752
- C:\Windows\System\zlOoyqT.exe
  C:\Windows\System\zlOoyqT.exe
  2⤵
  PID:6768
- C:\Windows\System\erCttLo.exe
  C:\Windows\System\erCttLo.exe
  2⤵
  PID:6784
- C:\Windows\System\gaBcAVL.exe
  C:\Windows\System\gaBcAVL.exe
  2⤵
  PID:6804
- C:\Windows\System\srAhbLQ.exe
  C:\Windows\System\srAhbLQ.exe
  2⤵
  PID:6820
- C:\Windows\System\iKVRnfX.exe
  C:\Windows\System\iKVRnfX.exe
  2⤵
  PID:6836
- C:\Windows\System\MWxSGcY.exe
  C:\Windows\System\MWxSGcY.exe
  2⤵
  PID:6852
- C:\Windows\System\KidbleJ.exe
  C:\Windows\System\KidbleJ.exe
  2⤵
  PID:6868
- C:\Windows\System\oLUZDFv.exe
  C:\Windows\System\oLUZDFv.exe
  2⤵
  PID:6884
- C:\Windows\System\RmnvObf.exe
  C:\Windows\System\RmnvObf.exe
  2⤵
  PID:6900
- C:\Windows\System\nGfvdiI.exe
  C:\Windows\System\nGfvdiI.exe
  2⤵
  PID:6920
- C:\Windows\System\zqPoxoo.exe
  C:\Windows\System\zqPoxoo.exe
  2⤵
  PID:6936
- C:\Windows\System\gfcDpee.exe
  C:\Windows\System\gfcDpee.exe
  2⤵
  PID:6952
- C:\Windows\System\YUIqtRV.exe
  C:\Windows\System\YUIqtRV.exe
  2⤵
  PID:6968
- C:\Windows\System\DDYEtjX.exe
  C:\Windows\System\DDYEtjX.exe
  2⤵
  PID:7048
- C:\Windows\System\QmJPlrT.exe
  C:\Windows\System\QmJPlrT.exe
  2⤵
  PID:7064
- C:\Windows\System\aNVMXlN.exe
  C:\Windows\System\aNVMXlN.exe
  2⤵
  PID:7080
- C:\Windows\System\HiDaydl.exe
  C:\Windows\System\HiDaydl.exe
  2⤵
  PID:7096
- C:\Windows\System\FkRQCik.exe
  C:\Windows\System\FkRQCik.exe
  2⤵
  PID:7140
- C:\Windows\System\LvxZjnY.exe
  C:\Windows\System\LvxZjnY.exe
  2⤵
  PID:7156
- C:\Windows\System\xQZtZLj.exe
  C:\Windows\System\xQZtZLj.exe
  2⤵
  PID:6156
- C:\Windows\System\cvJPUPu.exe
  C:\Windows\System\cvJPUPu.exe
  2⤵
  PID:6220
- C:\Windows\System\AIlJzBu.exe
  C:\Windows\System\AIlJzBu.exe
  2⤵
  PID:6284
- C:\Windows\System\cVNpjjd.exe
  C:\Windows\System\cVNpjjd.exe
  2⤵
  PID:5840
- C:\Windows\System\nHTtYsx.exe
  C:\Windows\System\nHTtYsx.exe
  2⤵
  PID:6124
- C:\Windows\System\ulLkYzN.exe
  C:\Windows\System\ulLkYzN.exe
  2⤵
  PID:2820
- C:\Windows\System\IsQzLWv.exe
  C:\Windows\System\IsQzLWv.exe
  2⤵
  PID:6232
- C:\Windows\System\dMCXrhU.exe
  C:\Windows\System\dMCXrhU.exe
  2⤵
  PID:6300
- C:\Windows\System\sPGBJqj.exe
  C:\Windows\System\sPGBJqj.exe
  2⤵
  PID:6356
- C:\Windows\System\bGoSkBm.exe
  C:\Windows\System\bGoSkBm.exe
  2⤵
  PID:6420
- C:\Windows\System\HBaaIgh.exe
  C:\Windows\System\HBaaIgh.exe
  2⤵
  PID:6456
- C:\Windows\System\BxbNToj.exe
  C:\Windows\System\BxbNToj.exe
  2⤵
  PID:6520
- C:\Windows\System\kGNNsTK.exe
  C:\Windows\System\kGNNsTK.exe
  2⤵
  PID:6440
- C:\Windows\System\nbiXAhi.exe
  C:\Windows\System\nbiXAhi.exe
  2⤵
  PID:6556
- C:\Windows\System\ehocckT.exe
  C:\Windows\System\ehocckT.exe
  2⤵
  PID:6560
- C:\Windows\System\WoJnGvP.exe
  C:\Windows\System\WoJnGvP.exe
  2⤵
  PID:6592
- C:\Windows\System\UsaEHuk.exe
  C:\Windows\System\UsaEHuk.exe
  2⤵
  PID:6580
- C:\Windows\System\hPsbMGh.exe
  C:\Windows\System\hPsbMGh.exe
  2⤵
  PID:6628
- C:\Windows\System\SUeSTZT.exe
  C:\Windows\System\SUeSTZT.exe
  2⤵
  PID:6692
- C:\Windows\System\axxDeKa.exe
  C:\Windows\System\axxDeKa.exe
  2⤵
  PID:6644
- C:\Windows\System\HocHSLH.exe
  C:\Windows\System\HocHSLH.exe
  2⤵
  PID:6716
- C:\Windows\System\toJUSYM.exe
  C:\Windows\System\toJUSYM.exe
  2⤵
  PID:6748
- C:\Windows\System\xMobMCf.exe
  C:\Windows\System\xMobMCf.exe
  2⤵
  PID:6816
- C:\Windows\System\ayNIRlc.exe
  C:\Windows\System\ayNIRlc.exe
  2⤵
  PID:6880
- C:\Windows\System\SfDQumI.exe
  C:\Windows\System\SfDQumI.exe
  2⤵
  PID:6976
- C:\Windows\System\NeYskdj.exe
  C:\Windows\System\NeYskdj.exe
  2⤵
  PID:6760
- C:\Windows\System\GQNgnPL.exe
  C:\Windows\System\GQNgnPL.exe
  2⤵
  PID:6996
- C:\Windows\System\nXszbAN.exe
  C:\Windows\System\nXszbAN.exe
  2⤵
  PID:6860
- C:\Windows\System\fhwRIje.exe
  C:\Windows\System\fhwRIje.exe
  2⤵
  PID:6864
- C:\Windows\System\qgRlxMx.exe
  C:\Windows\System\qgRlxMx.exe
  2⤵
  PID:6960
- C:\Windows\System\OjNlZRk.exe
  C:\Windows\System\OjNlZRk.exe
  2⤵
  PID:7008
- C:\Windows\System\PwYwqAb.exe
  C:\Windows\System\PwYwqAb.exe
  2⤵
  PID:7024
- C:\Windows\System\NFdxjfJ.exe
  C:\Windows\System\NFdxjfJ.exe
  2⤵
  PID:7060
- C:\Windows\System\hMCAfIr.exe
  C:\Windows\System\hMCAfIr.exe
  2⤵
  PID:7072
- C:\Windows\System\ZZPkcfz.exe
  C:\Windows\System\ZZPkcfz.exe
  2⤵
  PID:7040
- C:\Windows\System\toYtooK.exe
  C:\Windows\System\toYtooK.exe
  2⤵
  PID:7124
- C:\Windows\System\DUBmecb.exe
  C:\Windows\System\DUBmecb.exe
  2⤵
  PID:7148
- C:\Windows\System\ZNcvqrg.exe
  C:\Windows\System\ZNcvqrg.exe
  2⤵
  PID:5184
- C:\Windows\System\kNzULfN.exe
  C:\Windows\System\kNzULfN.exe
  2⤵
  PID:6280
- C:\Windows\System\lMqlDvy.exe
  C:\Windows\System\lMqlDvy.exe
  2⤵
  PID:6076
- C:\Windows\System\lJQtbmz.exe
  C:\Windows\System\lJQtbmz.exe
  2⤵
  PID:6200
- C:\Windows\System\dwKzDXu.exe
  C:\Windows\System\dwKzDXu.exe
  2⤵
  PID:6388
- C:\Windows\System\ozWPNmV.exe
  C:\Windows\System\ozWPNmV.exe
  2⤵
  PID:6516
- C:\Windows\System\KOgRGVe.exe
  C:\Windows\System\KOgRGVe.exe
  2⤵
  PID:6540
- C:\Windows\System\vycBqWW.exe
  C:\Windows\System\vycBqWW.exe
  2⤵
  PID:2544
- C:\Windows\System\KpHvIBw.exe
  C:\Windows\System\KpHvIBw.exe
  2⤵
  PID:6408
- C:\Windows\System\URLVwJf.exe
  C:\Windows\System\URLVwJf.exe
  2⤵
  PID:6612
- C:\Windows\System\DZZckvc.exe
  C:\Windows\System\DZZckvc.exe
  2⤵
  PID:6624
- C:\Windows\System\oQDXqaA.exe
  C:\Windows\System\oQDXqaA.exe
  2⤵
  PID:6876
- C:\Windows\System\iOZTcUO.exe
  C:\Windows\System\iOZTcUO.exe
  2⤵
  PID:6792
- C:\Windows\System\DtKJnmH.exe
  C:\Windows\System\DtKJnmH.exe
  2⤵
  PID:6664
- C:\Windows\System\ZTHuKPv.exe
  C:\Windows\System\ZTHuKPv.exe
  2⤵
  PID:6928
- C:\Windows\System\jVPqiYF.exe
  C:\Windows\System\jVPqiYF.exe
  2⤵
  PID:6944
- C:\Windows\System\lcRfjZB.exe
  C:\Windows\System\lcRfjZB.exe
  2⤵
  PID:6988
- C:\Windows\System\XAiqdBQ.exe
  C:\Windows\System\XAiqdBQ.exe
  2⤵
  PID:7004
- C:\Windows\System\LQqTDeM.exe
  C:\Windows\System\LQqTDeM.exe
  2⤵
  PID:7036
- C:\Windows\System\SORBowG.exe
  C:\Windows\System\SORBowG.exe
  2⤵
  PID:7120
- C:\Windows\System\MqJVPib.exe
  C:\Windows\System\MqJVPib.exe
  2⤵
  PID:6320
- C:\Windows\System\JreCkff.exe
  C:\Windows\System\JreCkff.exe
  2⤵
  PID:1564
- C:\Windows\System\iHmxXxI.exe
  C:\Windows\System\iHmxXxI.exe
  2⤵
  PID:5924
- C:\Windows\System\UQReWfI.exe
  C:\Windows\System\UQReWfI.exe
  2⤵
  PID:6340
- C:\Windows\System\GjVOIIH.exe
  C:\Windows\System\GjVOIIH.exe
  2⤵
  PID:5920
- C:\Windows\System\fOQPyWc.exe
  C:\Windows\System\fOQPyWc.exe
  2⤵
  PID:6576
- C:\Windows\System\EsBrtxV.exe
  C:\Windows\System\EsBrtxV.exe
  2⤵
  PID:6848
- C:\Windows\System\KMnLWXL.exe
  C:\Windows\System\KMnLWXL.exe
  2⤵
  PID:6680
- C:\Windows\System\bRlwZie.exe
  C:\Windows\System\bRlwZie.exe
  2⤵
  PID:6712
- C:\Windows\System\arjFfSz.exe
  C:\Windows\System\arjFfSz.exe
  2⤵
  PID:7044
- C:\Windows\System\nDhiRUV.exe
  C:\Windows\System\nDhiRUV.exe
  2⤵
  PID:7016
- C:\Windows\System\SwgpQVp.exe
  C:\Windows\System\SwgpQVp.exe
  2⤵
  PID:7020
- C:\Windows\System\eIjieqG.exe
  C:\Windows\System\eIjieqG.exe
  2⤵
  PID:6152
- C:\Windows\System\pDBjdwy.exe
  C:\Windows\System\pDBjdwy.exe
  2⤵
  PID:7184
- C:\Windows\System\dHTOfmP.exe
  C:\Windows\System\dHTOfmP.exe
  2⤵
  PID:7200
- C:\Windows\System\icCZCdZ.exe
  C:\Windows\System\icCZCdZ.exe
  2⤵
  PID:7216
- C:\Windows\System\jTjlncx.exe
  C:\Windows\System\jTjlncx.exe
  2⤵
  PID:7232
- C:\Windows\System\LvBXsZs.exe
  C:\Windows\System\LvBXsZs.exe
  2⤵
  PID:7248
- C:\Windows\System\ybhQxha.exe
  C:\Windows\System\ybhQxha.exe
  2⤵
  PID:7264
- C:\Windows\System\YfCeKOa.exe
  C:\Windows\System\YfCeKOa.exe
  2⤵
  PID:7280
- C:\Windows\System\surDwtI.exe
  C:\Windows\System\surDwtI.exe
  2⤵
  PID:7296
- C:\Windows\System\SxSpbMn.exe
  C:\Windows\System\SxSpbMn.exe
  2⤵
  PID:7312
- C:\Windows\System\HFSEdzS.exe
  C:\Windows\System\HFSEdzS.exe
  2⤵
  PID:7332
- C:\Windows\System\NoprYyt.exe
  C:\Windows\System\NoprYyt.exe
  2⤵
  PID:7348
- C:\Windows\System\lKGZbzo.exe
  C:\Windows\System\lKGZbzo.exe
  2⤵
  PID:7364
- C:\Windows\System\nibZako.exe
  C:\Windows\System\nibZako.exe
  2⤵
  PID:7380
- C:\Windows\System\YfIUkRr.exe
  C:\Windows\System\YfIUkRr.exe
  2⤵
  PID:7396
- C:\Windows\System\YbhJoJu.exe
  C:\Windows\System\YbhJoJu.exe
  2⤵
  PID:7412
- C:\Windows\System\gklyDSt.exe
  C:\Windows\System\gklyDSt.exe
  2⤵
  PID:7428
- C:\Windows\System\RdmuOFv.exe
  C:\Windows\System\RdmuOFv.exe
  2⤵
  PID:7448
- C:\Windows\System\SzLvkbg.exe
  C:\Windows\System\SzLvkbg.exe
  2⤵
  PID:7464
- C:\Windows\System\vHrdNrW.exe
  C:\Windows\System\vHrdNrW.exe
  2⤵
  PID:7480
- C:\Windows\System\zsfaaHz.exe
  C:\Windows\System\zsfaaHz.exe
  2⤵
  PID:7496
- C:\Windows\System\QychNKa.exe
  C:\Windows\System\QychNKa.exe
  2⤵
  PID:7512
- C:\Windows\System\ZwdpwmP.exe
  C:\Windows\System\ZwdpwmP.exe
  2⤵
  PID:7528
- C:\Windows\System\ZbDvNtV.exe
  C:\Windows\System\ZbDvNtV.exe
  2⤵
  PID:7544
- C:\Windows\System\uoClRYA.exe
  C:\Windows\System\uoClRYA.exe
  2⤵
  PID:7560
- C:\Windows\System\iaNWEjD.exe
  C:\Windows\System\iaNWEjD.exe
  2⤵
  PID:7576
- C:\Windows\System\CeoHTUm.exe
  C:\Windows\System\CeoHTUm.exe
  2⤵
  PID:7592
- C:\Windows\System\LxLTelu.exe
  C:\Windows\System\LxLTelu.exe
  2⤵
  PID:7608
- C:\Windows\System\VuBohWP.exe
  C:\Windows\System\VuBohWP.exe
  2⤵
  PID:7624
- C:\Windows\System\YIBhnyx.exe
  C:\Windows\System\YIBhnyx.exe
  2⤵
  PID:7640
- C:\Windows\System\AEuFvwx.exe
  C:\Windows\System\AEuFvwx.exe
  2⤵
  PID:7656
- C:\Windows\System\lLnsFUt.exe
  C:\Windows\System\lLnsFUt.exe
  2⤵
  PID:7672
- C:\Windows\System\dHRQMyo.exe
  C:\Windows\System\dHRQMyo.exe
  2⤵
  PID:7688
- C:\Windows\System\pHTLehA.exe
  C:\Windows\System\pHTLehA.exe
  2⤵
  PID:7704
- C:\Windows\System\yyugAMt.exe
  C:\Windows\System\yyugAMt.exe
  2⤵
  PID:7720
- C:\Windows\System\bclYYvM.exe
  C:\Windows\System\bclYYvM.exe
  2⤵
  PID:7736
- C:\Windows\System\nvScJbT.exe
  C:\Windows\System\nvScJbT.exe
  2⤵
  PID:7752
- C:\Windows\System\brQWRCK.exe
  C:\Windows\System\brQWRCK.exe
  2⤵
  PID:7768
- C:\Windows\System\AEmEDDO.exe
  C:\Windows\System\AEmEDDO.exe
  2⤵
  PID:7784
- C:\Windows\System\QacNyOy.exe
  C:\Windows\System\QacNyOy.exe
  2⤵
  PID:7800
- C:\Windows\System\YEjjPPD.exe
  C:\Windows\System\YEjjPPD.exe
  2⤵
  PID:7816
- C:\Windows\System\WyyoRUR.exe
  C:\Windows\System\WyyoRUR.exe
  2⤵
  PID:7832
- C:\Windows\System\jrDXSop.exe
  C:\Windows\System\jrDXSop.exe
  2⤵
  PID:7848
- C:\Windows\System\mRCSqjn.exe
  C:\Windows\System\mRCSqjn.exe
  2⤵
  PID:7864
- C:\Windows\System\vzSQIph.exe
  C:\Windows\System\vzSQIph.exe
  2⤵
  PID:7880
- C:\Windows\System\hsHdQex.exe
  C:\Windows\System\hsHdQex.exe
  2⤵
  PID:7896
- C:\Windows\System\erMmchj.exe
  C:\Windows\System\erMmchj.exe
  2⤵
  PID:7912
- C:\Windows\System\LNNyHYL.exe
  C:\Windows\System\LNNyHYL.exe
  2⤵
  PID:7928
- C:\Windows\System\jtiXEiW.exe
  C:\Windows\System\jtiXEiW.exe
  2⤵
  PID:7944
- C:\Windows\System\wRPJwUE.exe
  C:\Windows\System\wRPJwUE.exe
  2⤵
  PID:7960
- C:\Windows\System\bhDtoIg.exe
  C:\Windows\System\bhDtoIg.exe
  2⤵
  PID:7976
- C:\Windows\System\iUXQkEz.exe
  C:\Windows\System\iUXQkEz.exe
  2⤵
  PID:7992
- C:\Windows\System\AdsVVKI.exe
  C:\Windows\System\AdsVVKI.exe
  2⤵
  PID:8008
- C:\Windows\System\nfIVHqZ.exe
  C:\Windows\System\nfIVHqZ.exe
  2⤵
  PID:8024
- C:\Windows\System\VfHHmZT.exe
  C:\Windows\System\VfHHmZT.exe
  2⤵
  PID:8040
- C:\Windows\System\KOjPwpP.exe
  C:\Windows\System\KOjPwpP.exe
  2⤵
  PID:8056
- C:\Windows\System\vHCrLVf.exe
  C:\Windows\System\vHCrLVf.exe
  2⤵
  PID:8072
- C:\Windows\System\tCMSMHE.exe
  C:\Windows\System\tCMSMHE.exe
  2⤵
  PID:8088
- C:\Windows\System\GTOzmTh.exe
  C:\Windows\System\GTOzmTh.exe
  2⤵
  PID:8104
- C:\Windows\System\Swthcqk.exe
  C:\Windows\System\Swthcqk.exe
  2⤵
  PID:8120
- C:\Windows\System\XlSTVoe.exe
  C:\Windows\System\XlSTVoe.exe
  2⤵
  PID:8136
- C:\Windows\System\XjlihWq.exe
  C:\Windows\System\XjlihWq.exe
  2⤵
  PID:8152
- C:\Windows\System\hGApUDX.exe
  C:\Windows\System\hGApUDX.exe
  2⤵
  PID:8176
- C:\Windows\System\qkqNKnN.exe
  C:\Windows\System\qkqNKnN.exe
  2⤵
  PID:7164
- C:\Windows\System\hcypwbJ.exe
  C:\Windows\System\hcypwbJ.exe
  2⤵
  PID:7136
- C:\Windows\System\IsMmJSd.exe
  C:\Windows\System\IsMmJSd.exe
  2⤵
  PID:2556
- C:\Windows\System\ycHxOIG.exe
  C:\Windows\System\ycHxOIG.exe
  2⤵
  PID:7244
- C:\Windows\System\LhxTfBc.exe
  C:\Windows\System\LhxTfBc.exe
  2⤵
  PID:7132
- C:\Windows\System\oHLMVCs.exe
  C:\Windows\System\oHLMVCs.exe
  2⤵
  PID:7276
- C:\Windows\System\oFxNsIs.exe
  C:\Windows\System\oFxNsIs.exe
  2⤵
  PID:7308
- C:\Windows\System\hALMgUy.exe
  C:\Windows\System\hALMgUy.exe
  2⤵
  PID:7304
- C:\Windows\System\CndOAxa.exe
  C:\Windows\System\CndOAxa.exe
  2⤵
  PID:7196
- C:\Windows\System\vynjtHL.exe
  C:\Windows\System\vynjtHL.exe
  2⤵
  PID:7260
- C:\Windows\System\aLqBgpf.exe
  C:\Windows\System\aLqBgpf.exe
  2⤵
  PID:7324
- C:\Windows\System\pzscanJ.exe
  C:\Windows\System\pzscanJ.exe
  2⤵
  PID:6544
- C:\Windows\System\VhXKqoo.exe
  C:\Windows\System\VhXKqoo.exe
  2⤵
  PID:7388
- C:\Windows\System\aHiJQMa.exe
  C:\Windows\System\aHiJQMa.exe
  2⤵
  PID:2580
- C:\Windows\System\FlkGRRK.exe
  C:\Windows\System\FlkGRRK.exe
  2⤵
  PID:7376
- C:\Windows\System\hywnPCZ.exe
  C:\Windows\System\hywnPCZ.exe
  2⤵
  PID:7436
- C:\Windows\System\ikDDgXe.exe
  C:\Windows\System\ikDDgXe.exe
  2⤵
  PID:7492
- C:\Windows\System\ZoQVFyk.exe
  C:\Windows\System\ZoQVFyk.exe
  2⤵
  PID:7504
- C:\Windows\System\TsljOFe.exe
  C:\Windows\System\TsljOFe.exe
  2⤵
  PID:7556
- C:\Windows\System\qPPkXVQ.exe
  C:\Windows\System\qPPkXVQ.exe
  2⤵
  PID:7536
- C:\Windows\System\PEajNKW.exe
  C:\Windows\System\PEajNKW.exe
  2⤵
  PID:7572
- C:\Windows\System\lVbODea.exe
  C:\Windows\System\lVbODea.exe
  2⤵
  PID:7680
- C:\Windows\System\VYsjooe.exe
  C:\Windows\System\VYsjooe.exe
  2⤵
  PID:7604
- C:\Windows\System\SRKsRne.exe
  C:\Windows\System\SRKsRne.exe
  2⤵
  PID:7696
- C:\Windows\System\zHkQsXr.exe
  C:\Windows\System\zHkQsXr.exe
  2⤵
  PID:7744
- C:\Windows\System\lsfjSax.exe
  C:\Windows\System\lsfjSax.exe
  2⤵
  PID:7808
- C:\Windows\System\KPWGimQ.exe
  C:\Windows\System\KPWGimQ.exe
  2⤵
  PID:7728
- C:\Windows\System\HiTZXoM.exe
  C:\Windows\System\HiTZXoM.exe
  2⤵
  PID:7876
- C:\Windows\System\lJAeSEh.exe
  C:\Windows\System\lJAeSEh.exe
  2⤵
  PID:7908
- C:\Windows\System\dJpDlAT.exe
  C:\Windows\System\dJpDlAT.exe
  2⤵
  PID:7828
- C:\Windows\System\XQnPDPN.exe
  C:\Windows\System\XQnPDPN.exe
  2⤵
  PID:7892
- C:\Windows\System\qsbyOqS.exe
  C:\Windows\System\qsbyOqS.exe
  2⤵
  PID:7956
- C:\Windows\System\XzyxeUW.exe
  C:\Windows\System\XzyxeUW.exe
  2⤵
  PID:7972
- C:\Windows\System\vZexDeB.exe
  C:\Windows\System\vZexDeB.exe
  2⤵
  PID:8032
- C:\Windows\System\IrwOAnu.exe
  C:\Windows\System\IrwOAnu.exe
  2⤵
  PID:8036
- C:\Windows\System\jKgKwlM.exe
  C:\Windows\System\jKgKwlM.exe
  2⤵
  PID:8048
- C:\Windows\System\POmkBHa.exe
  C:\Windows\System\POmkBHa.exe
  2⤵
  PID:8100
- C:\Windows\System\VTbpLoQ.exe
  C:\Windows\System\VTbpLoQ.exe
  2⤵
  PID:8132
- C:\Windows\System\sHhfJUR.exe
  C:\Windows\System\sHhfJUR.exe
  2⤵
  PID:8164
- C:\Windows\System\VdnkYwf.exe
  C:\Windows\System\VdnkYwf.exe
  2⤵
  PID:8172
- C:\Windows\System\BBdRwJS.exe
  C:\Windows\System\BBdRwJS.exe
  2⤵
  PID:8184
- C:\Windows\System\IwqomCf.exe
  C:\Windows\System\IwqomCf.exe
  2⤵
  PID:6660
- C:\Windows\System\VxixGiD.exe
  C:\Windows\System\VxixGiD.exe
  2⤵
  PID:7212
- C:\Windows\System\fCGdbPF.exe
  C:\Windows\System\fCGdbPF.exe
  2⤵
  PID:7228
- C:\Windows\System\fCITSbO.exe
  C:\Windows\System\fCITSbO.exe
  2⤵
  PID:7420
- C:\Windows\System\kHFsmXc.exe
  C:\Windows\System\kHFsmXc.exe
  2⤵
  PID:7292
- C:\Windows\System\ZHgPGYs.exe
  C:\Windows\System\ZHgPGYs.exe
  2⤵
  PID:7584
- C:\Windows\System\enCXHBE.exe
  C:\Windows\System\enCXHBE.exe
  2⤵
  PID:7456
- C:\Windows\System\znfhHYE.exe
  C:\Windows\System\znfhHYE.exe
  2⤵
  PID:7460
- C:\Windows\System\MDbJuFP.exe
  C:\Windows\System\MDbJuFP.exe
  2⤵
  PID:7360
- C:\Windows\System\OzRexTf.exe
  C:\Windows\System\OzRexTf.exe
  2⤵
  PID:7776
- C:\Windows\System\XXViofA.exe
  C:\Windows\System\XXViofA.exe
  2⤵
  PID:7508
- C:\Windows\System\JTcdYKx.exe
  C:\Windows\System\JTcdYKx.exe
  2⤵
  PID:7716
- C:\Windows\System\dnBbBHE.exe
  C:\Windows\System\dnBbBHE.exe
  2⤵
  PID:7872
- C:\Windows\System\CPgqCaZ.exe
  C:\Windows\System\CPgqCaZ.exe
  2⤵
  PID:7856
- C:\Windows\System\AMzzZfM.exe
  C:\Windows\System\AMzzZfM.exe
  2⤵
  PID:7952
- C:\Windows\System\gJbopDm.exe
  C:\Windows\System\gJbopDm.exe
  2⤵
  PID:8068
- C:\Windows\System\zkfaGgB.exe
  C:\Windows\System\zkfaGgB.exe
  2⤵
  PID:7968
- C:\Windows\System\sNenxjs.exe
  C:\Windows\System\sNenxjs.exe
  2⤵
  PID:8084
- C:\Windows\System\oZdjiNu.exe
  C:\Windows\System\oZdjiNu.exe
  2⤵
  PID:8188
- C:\Windows\System\EUqlCPD.exe
  C:\Windows\System\EUqlCPD.exe
  2⤵
  PID:2636
- C:\Windows\System\UUmyHSy.exe
  C:\Windows\System\UUmyHSy.exe
  2⤵
  PID:6528
- C:\Windows\System\LLTRHoO.exe
  C:\Windows\System\LLTRHoO.exe
  2⤵
  PID:6488
- C:\Windows\System\mojIwki.exe
  C:\Windows\System\mojIwki.exe
  2⤵
  PID:7356
- C:\Windows\System\LiecemE.exe
  C:\Windows\System\LiecemE.exe
  2⤵
  PID:7372
- C:\Windows\System\aYVwDfd.exe
  C:\Windows\System\aYVwDfd.exe
  2⤵
  PID:7632
- C:\Windows\System\WHQcoBv.exe
  C:\Windows\System\WHQcoBv.exe
  2⤵
  PID:7588
- C:\Windows\System\IzrPvhk.exe
  C:\Windows\System\IzrPvhk.exe
  2⤵
  PID:8004
- C:\Windows\System\vdwmQsx.exe
  C:\Windows\System\vdwmQsx.exe
  2⤵
  PID:6916
- C:\Windows\System\BAheilr.exe
  C:\Windows\System\BAheilr.exe
  2⤵
  PID:6948
- C:\Windows\System\ZnkINZe.exe
  C:\Windows\System\ZnkINZe.exe
  2⤵
  PID:7760
- C:\Windows\System\HeUFEas.exe
  C:\Windows\System\HeUFEas.exe
  2⤵
  PID:8196
- C:\Windows\System\ztNxwdS.exe
  C:\Windows\System\ztNxwdS.exe
  2⤵
  PID:8212
- C:\Windows\System\MhOlSkM.exe
  C:\Windows\System\MhOlSkM.exe
  2⤵
  PID:8228
- C:\Windows\System\vfvonFj.exe
  C:\Windows\System\vfvonFj.exe
  2⤵
  PID:8244
- C:\Windows\System\MQhsWrT.exe
  C:\Windows\System\MQhsWrT.exe
  2⤵
  PID:8260
- C:\Windows\System\vDiLJgN.exe
  C:\Windows\System\vDiLJgN.exe
  2⤵
  PID:8276
- C:\Windows\System\wBclzFV.exe
  C:\Windows\System\wBclzFV.exe
  2⤵
  PID:8292
- C:\Windows\System\fwoslRW.exe
  C:\Windows\System\fwoslRW.exe
  2⤵
  PID:8308
- C:\Windows\System\YkGnaSN.exe
  C:\Windows\System\YkGnaSN.exe
  2⤵
  PID:8324
- C:\Windows\System\JTWgnFJ.exe
  C:\Windows\System\JTWgnFJ.exe
  2⤵
  PID:8340
- C:\Windows\System\aAvtTUk.exe
  C:\Windows\System\aAvtTUk.exe
  2⤵
  PID:8356
- C:\Windows\System\BGmQlou.exe
  C:\Windows\System\BGmQlou.exe
  2⤵
  PID:8372
- C:\Windows\System\TxgdLwv.exe
  C:\Windows\System\TxgdLwv.exe
  2⤵
  PID:8388
- C:\Windows\System\dBJqeoE.exe
  C:\Windows\System\dBJqeoE.exe
  2⤵
  PID:8404
- C:\Windows\System\wcIOidQ.exe
  C:\Windows\System\wcIOidQ.exe
  2⤵
  PID:8420
- C:\Windows\System\MXSeYkB.exe
  C:\Windows\System\MXSeYkB.exe
  2⤵
  PID:8436
- C:\Windows\System\KZSUvmo.exe
  C:\Windows\System\KZSUvmo.exe
  2⤵
  PID:8452
- C:\Windows\System\OevPaWu.exe
  C:\Windows\System\OevPaWu.exe
  2⤵
  PID:8468
- C:\Windows\System\qxUeYSs.exe
  C:\Windows\System\qxUeYSs.exe
  2⤵
  PID:8484
- C:\Windows\System\AHFRSQS.exe
  C:\Windows\System\AHFRSQS.exe
  2⤵
  PID:8500
- C:\Windows\System\zgyaioa.exe
  C:\Windows\System\zgyaioa.exe
  2⤵
  PID:8516
- C:\Windows\System\odtGTyt.exe
  C:\Windows\System\odtGTyt.exe
  2⤵
  PID:8532
- C:\Windows\System\qeHJViS.exe
  C:\Windows\System\qeHJViS.exe
  2⤵
  PID:8548
- C:\Windows\System\MwVGLFu.exe
  C:\Windows\System\MwVGLFu.exe
  2⤵
  PID:8564
- C:\Windows\System\BRwwuKk.exe
  C:\Windows\System\BRwwuKk.exe
  2⤵
  PID:8580
- C:\Windows\System\umTqeUX.exe
  C:\Windows\System\umTqeUX.exe
  2⤵
  PID:8596
- C:\Windows\System\gzXXChI.exe
  C:\Windows\System\gzXXChI.exe
  2⤵
  PID:8612
- C:\Windows\System\XRckgWs.exe
  C:\Windows\System\XRckgWs.exe
  2⤵
  PID:8628
- C:\Windows\System\JkULuHe.exe
  C:\Windows\System\JkULuHe.exe
  2⤵
  PID:8644
- C:\Windows\System\mhzlvBG.exe
  C:\Windows\System\mhzlvBG.exe
  2⤵
  PID:8660
- C:\Windows\System\humkmJx.exe
  C:\Windows\System\humkmJx.exe
  2⤵
  PID:8680
- C:\Windows\System\gXhEaEW.exe
  C:\Windows\System\gXhEaEW.exe
  2⤵
  PID:8696
- C:\Windows\System\MjcGuyO.exe
  C:\Windows\System\MjcGuyO.exe
  2⤵
  PID:8712
- C:\Windows\System\YiEMWEx.exe
  C:\Windows\System\YiEMWEx.exe
  2⤵
  PID:8728
- C:\Windows\System\jjeetwZ.exe
  C:\Windows\System\jjeetwZ.exe
  2⤵
  PID:8744
- C:\Windows\System\dORSNJA.exe
  C:\Windows\System\dORSNJA.exe
  2⤵
  PID:8760
- C:\Windows\System\sIkOeVN.exe
  C:\Windows\System\sIkOeVN.exe
  2⤵
  PID:8776
- C:\Windows\System\iTSgXMQ.exe
  C:\Windows\System\iTSgXMQ.exe
  2⤵
  PID:8796
- C:\Windows\System\ephHLoW.exe
  C:\Windows\System\ephHLoW.exe
  2⤵
  PID:8812
- C:\Windows\System\ceZFUAs.exe
  C:\Windows\System\ceZFUAs.exe
  2⤵
  PID:8828
- C:\Windows\System\xkiBmou.exe
  C:\Windows\System\xkiBmou.exe
  2⤵
  PID:8848
- C:\Windows\System\sMMfFdR.exe
  C:\Windows\System\sMMfFdR.exe
  2⤵
  PID:8864
- C:\Windows\System\TJczMSX.exe
  C:\Windows\System\TJczMSX.exe
  2⤵
  PID:8884
- C:\Windows\System\UocnFLa.exe
  C:\Windows\System\UocnFLa.exe
  2⤵
  PID:8900
- C:\Windows\System\VoKieNv.exe
  C:\Windows\System\VoKieNv.exe
  2⤵
  PID:8916
- C:\Windows\System\HilGlru.exe
  C:\Windows\System\HilGlru.exe
  2⤵
  PID:8932
- C:\Windows\System\DvkIzAd.exe
  C:\Windows\System\DvkIzAd.exe
  2⤵
  PID:8948
- C:\Windows\System\hfRgDlq.exe
  C:\Windows\System\hfRgDlq.exe
  2⤵
  PID:8964
- C:\Windows\System\BhHQxre.exe
  C:\Windows\System\BhHQxre.exe
  2⤵
  PID:8980
- C:\Windows\System\giEXESs.exe
  C:\Windows\System\giEXESs.exe
  2⤵
  PID:9008
- C:\Windows\System\ypDpKlA.exe
  C:\Windows\System\ypDpKlA.exe
  2⤵
  PID:9028
- C:\Windows\System\QVuEtIz.exe
  C:\Windows\System\QVuEtIz.exe
  2⤵
  PID:9044
- C:\Windows\System\TouqsXe.exe
  C:\Windows\System\TouqsXe.exe
  2⤵
  PID:9060
- C:\Windows\System\JEPypKQ.exe
  C:\Windows\System\JEPypKQ.exe
  2⤵
  PID:9100
- C:\Windows\System\FwWUTxd.exe
  C:\Windows\System\FwWUTxd.exe
  2⤵
  PID:9116
- C:\Windows\System\ybkVtfR.exe
  C:\Windows\System\ybkVtfR.exe
  2⤵
  PID:9132
- C:\Windows\System\ZjZZVbL.exe
  C:\Windows\System\ZjZZVbL.exe
  2⤵
  PID:9148
- C:\Windows\System\stsmhAD.exe
  C:\Windows\System\stsmhAD.exe
  2⤵
  PID:9164
- C:\Windows\System\zQktXUr.exe
  C:\Windows\System\zQktXUr.exe
  2⤵
  PID:9180
- C:\Windows\System\mIulabt.exe
  C:\Windows\System\mIulabt.exe
  2⤵
  PID:9196
- C:\Windows\System\jgKQeGG.exe
  C:\Windows\System\jgKQeGG.exe
  2⤵
  PID:9212
- C:\Windows\System\liPhOpo.exe
  C:\Windows\System\liPhOpo.exe
  2⤵
  PID:8148
- C:\Windows\System\uAJflkd.exe
  C:\Windows\System\uAJflkd.exe
  2⤵
  PID:7860
- C:\Windows\System\AqWEaVZ.exe
  C:\Windows\System\AqWEaVZ.exe
  2⤵
  PID:8364
- C:\Windows\System\gYdbMpQ.exe
  C:\Windows\System\gYdbMpQ.exe
  2⤵
  PID:8236
- C:\Windows\System\KcDAaoh.exe
  C:\Windows\System\KcDAaoh.exe
  2⤵
  PID:8224
- C:\Windows\System\hpJsEGr.exe
  C:\Windows\System\hpJsEGr.exe
  2⤵
  PID:7552
- C:\Windows\System\ZpKHBmO.exe
  C:\Windows\System\ZpKHBmO.exe
  2⤵
  PID:6216
- C:\Windows\System\fLDSpzB.exe
  C:\Windows\System\fLDSpzB.exe
  2⤵
  PID:8380
- C:\Windows\System\IkfuAzr.exe
  C:\Windows\System\IkfuAzr.exe
  2⤵
  PID:8240
- C:\Windows\System\XzznaPz.exe
  C:\Windows\System\XzznaPz.exe
  2⤵
  PID:8336
- C:\Windows\System\PvZvGOb.exe
  C:\Windows\System\PvZvGOb.exe
  2⤵
  PID:8220
- C:\Windows\System\qnBQNQX.exe
  C:\Windows\System\qnBQNQX.exe
  2⤵
  PID:8432
- C:\Windows\System\kpzEpbQ.exe
  C:\Windows\System\kpzEpbQ.exe
  2⤵
  PID:8496
- C:\Windows\System\wARqOwX.exe
  C:\Windows\System\wARqOwX.exe
  2⤵
  PID:8448
- C:\Windows\System\zhAMuUE.exe
  C:\Windows\System\zhAMuUE.exe
  2⤵
  PID:8560
- C:\Windows\System\IdztXWq.exe
  C:\Windows\System\IdztXWq.exe
  2⤵
  PID:8512
- C:\Windows\System\yyfqTTP.exe
  C:\Windows\System\yyfqTTP.exe
  2⤵
  PID:8588
- C:\Windows\System\YNnZgny.exe
  C:\Windows\System\YNnZgny.exe
  2⤵
  PID:8604
- C:\Windows\System\VFRjVut.exe
  C:\Windows\System\VFRjVut.exe
  2⤵
  PID:1952
- C:\Windows\System\FqmxdoH.exe
  C:\Windows\System\FqmxdoH.exe
  2⤵
  PID:8676
- C:\Windows\System\SevfiYY.exe
  C:\Windows\System\SevfiYY.exe
  2⤵
  PID:8636
- C:\Windows\System\KiAGqQU.exe
  C:\Windows\System\KiAGqQU.exe
  2⤵
  PID:8756
- C:\Windows\System\ilBvtvv.exe
  C:\Windows\System\ilBvtvv.exe
  2⤵
  PID:8792
- C:\Windows\System\NEgSPhQ.exe
  C:\Windows\System\NEgSPhQ.exe
  2⤵
  PID:8804
- C:\Windows\System\PBycoKW.exe
  C:\Windows\System\PBycoKW.exe
  2⤵
  PID:2008
- C:\Windows\System\UernvlJ.exe
  C:\Windows\System\UernvlJ.exe
  2⤵
  PID:8840
- C:\Windows\System\gsSuMKd.exe
  C:\Windows\System\gsSuMKd.exe
  2⤵
  PID:8876
- C:\Windows\System\sacTDos.exe
  C:\Windows\System\sacTDos.exe
  2⤵
  PID:8928
- C:\Windows\System\BXyOkEc.exe
  C:\Windows\System\BXyOkEc.exe
  2⤵
  PID:8944
- C:\Windows\System\XtzjeFh.exe
  C:\Windows\System\XtzjeFh.exe
  2⤵
  PID:2228
- C:\Windows\System\rFxtzUy.exe
  C:\Windows\System\rFxtzUy.exe
  2⤵
  PID:8996
- C:\Windows\System\gkxIjkU.exe
  C:\Windows\System\gkxIjkU.exe
  2⤵
  PID:9004
- C:\Windows\System\jgnbOpQ.exe
  C:\Windows\System\jgnbOpQ.exe
  2⤵
  PID:9072
- C:\Windows\System\dSfvpud.exe
  C:\Windows\System\dSfvpud.exe
  2⤵
  PID:9020
- C:\Windows\System\KjWLMHM.exe
  C:\Windows\System\KjWLMHM.exe
  2⤵
  PID:9056
- C:\Windows\System\zVpURva.exe
  C:\Windows\System\zVpURva.exe
  2⤵
  PID:9112
- C:\Windows\System\uBJBaow.exe
  C:\Windows\System\uBJBaow.exe
  2⤵
  PID:9172
- C:\Windows\System\BTpSCvB.exe
  C:\Windows\System\BTpSCvB.exe
  2⤵
  PID:1868
- C:\Windows\System\NOJeecp.exe
  C:\Windows\System\NOJeecp.exe
  2⤵
  PID:8300
- C:\Windows\System\NYqawzp.exe
  C:\Windows\System\NYqawzp.exe
  2⤵
  PID:8332
- C:\Windows\System\kggrsID.exe
  C:\Windows\System\kggrsID.exe
  2⤵
  PID:8400
- C:\Windows\System\xtsNDOM.exe
  C:\Windows\System\xtsNDOM.exe
  2⤵
  PID:7328
- C:\Windows\System\JBFdHSr.exe
  C:\Windows\System\JBFdHSr.exe
  2⤵
  PID:7988
- C:\Windows\System\eNHhmlf.exe
  C:\Windows\System\eNHhmlf.exe
  2⤵
  PID:8320
- C:\Windows\System\SSGFepW.exe
  C:\Windows\System\SSGFepW.exe
  2⤵
  PID:8428
- C:\Windows\System\BbwznJI.exe
  C:\Windows\System\BbwznJI.exe
  2⤵
  PID:8528
- C:\Windows\System\DTKCcWZ.exe
  C:\Windows\System\DTKCcWZ.exe
  2⤵
  PID:8656
- C:\Windows\System\XXntWsW.exe
  C:\Windows\System\XXntWsW.exe
  2⤵
  PID:8508
- C:\Windows\System\TJNxrVA.exe
  C:\Windows\System\TJNxrVA.exe
  2⤵
  PID:8556
- C:\Windows\System\RFgooIp.exe
  C:\Windows\System\RFgooIp.exe
  2⤵
  PID:8652
- C:\Windows\System\ioNDbyd.exe
  C:\Windows\System\ioNDbyd.exe
  2⤵
  PID:8724
- C:\Windows\System\tqmhWFa.exe
  C:\Windows\System\tqmhWFa.exe
  2⤵
  PID:8752
- C:\Windows\System\oqvOxUq.exe
  C:\Windows\System\oqvOxUq.exe
  2⤵
  PID:9000
- C:\Windows\System\vtrmuIx.exe
  C:\Windows\System\vtrmuIx.exe
  2⤵
  PID:3692
- C:\Windows\System\AMXknVu.exe
  C:\Windows\System\AMXknVu.exe
  2⤵
  PID:8836
- C:\Windows\System\bBoMBNN.exe
  C:\Windows\System\bBoMBNN.exe
  2⤵
  PID:824
- C:\Windows\System\NJLYELH.exe
  C:\Windows\System\NJLYELH.exe
  2⤵
  PID:8940
- C:\Windows\System\Hjtxnnv.exe
  C:\Windows\System\Hjtxnnv.exe
  2⤵
  PID:8908
- C:\Windows\System\LDhxgFU.exe
  C:\Windows\System\LDhxgFU.exe
  2⤵
  PID:8784
- C:\Windows\System\HygDmIG.exe
  C:\Windows\System\HygDmIG.exe
  2⤵
  PID:8736
- C:\Windows\System\WPrQnyl.exe
  C:\Windows\System\WPrQnyl.exe
  2⤵
  PID:9208
- C:\Windows\System\NUeHbUS.exe
  C:\Windows\System\NUeHbUS.exe
  2⤵
  PID:9128
- C:\Windows\System\aXCWeyb.exe
  C:\Windows\System\aXCWeyb.exe
  2⤵
  PID:9040
- C:\Windows\System\eYeoNsM.exe
  C:\Windows\System\eYeoNsM.exe
  2⤵
  PID:9052
- C:\Windows\System\hXtCdAt.exe
  C:\Windows\System\hXtCdAt.exe
  2⤵
  PID:8396
- C:\Windows\System\lVLcLrL.exe
  C:\Windows\System\lVLcLrL.exe
  2⤵
  PID:8352
- C:\Windows\System\qAYtkia.exe
  C:\Windows\System\qAYtkia.exe
  2⤵
  PID:8252
- C:\Windows\System\QeVSZTx.exe
  C:\Windows\System\QeVSZTx.exe
  2⤵
  PID:1544
- C:\Windows\System\trKBcQX.exe
  C:\Windows\System\trKBcQX.exe
  2⤵
  PID:8160
- C:\Windows\System\QlgAbrH.exe
  C:\Windows\System\QlgAbrH.exe
  2⤵
  PID:8476
- C:\Windows\System\XdPcCTR.exe
  C:\Windows\System\XdPcCTR.exe
  2⤵
  PID:8640
- C:\Windows\System\XAmknoO.exe
  C:\Windows\System\XAmknoO.exe
  2⤵
  PID:1744
- C:\Windows\System\zBFlvrX.exe
  C:\Windows\System\zBFlvrX.exe
  2⤵
  PID:8956
- C:\Windows\System\mWIhHBE.exe
  C:\Windows\System\mWIhHBE.exe
  2⤵
  PID:2656
- C:\Windows\System\KGIrEly.exe
  C:\Windows\System\KGIrEly.exe
  2⤵
  PID:2524
- C:\Windows\System\HeLqNLq.exe
  C:\Windows\System\HeLqNLq.exe
  2⤵
  PID:7824
- C:\Windows\System\IUqHJiu.exe
  C:\Windows\System\IUqHJiu.exe
  2⤵
  PID:3032
- C:\Windows\System\mIjVRaq.exe
  C:\Windows\System\mIjVRaq.exe
  2⤵
  PID:7192
- C:\Windows\System\XDkYyfP.exe
  C:\Windows\System\XDkYyfP.exe
  2⤵
  PID:8576
- C:\Windows\System\brDbhxt.exe
  C:\Windows\System\brDbhxt.exe
  2⤵
  PID:8860
- C:\Windows\System\hbpjxpg.exe
  C:\Windows\System\hbpjxpg.exe
  2⤵
  PID:9204
- C:\Windows\System\lsQjhes.exe
  C:\Windows\System\lsQjhes.exe
  2⤵
  PID:8720
- C:\Windows\System\qjzkOSC.exe
  C:\Windows\System\qjzkOSC.exe
  2⤵
  PID:8976
- C:\Windows\System\eDpsAfH.exe
  C:\Windows\System\eDpsAfH.exe
  2⤵
  PID:9096
- C:\Windows\System\ONlphPh.exe
  C:\Windows\System\ONlphPh.exe
  2⤵
  PID:7904
- C:\Windows\System\tboIYEN.exe
  C:\Windows\System\tboIYEN.exe
  2⤵
  PID:8464
- C:\Windows\System\oQnRLWU.exe
  C:\Windows\System\oQnRLWU.exe
  2⤵
  PID:8960
- C:\Windows\System\DPvKTVh.exe
  C:\Windows\System\DPvKTVh.exe
  2⤵
  PID:1228
- C:\Windows\System\wuqmmse.exe
  C:\Windows\System\wuqmmse.exe
  2⤵
  PID:1640
- C:\Windows\System\CQcozYf.exe
  C:\Windows\System\CQcozYf.exe
  2⤵
  PID:9232
- C:\Windows\System\OtTrmdG.exe
  C:\Windows\System\OtTrmdG.exe
  2⤵
  PID:9248
- C:\Windows\System\tTgcpMh.exe
  C:\Windows\System\tTgcpMh.exe
  2⤵
  PID:9264
- C:\Windows\System\FySwVlk.exe
  C:\Windows\System\FySwVlk.exe
  2⤵
  PID:9280
- C:\Windows\System\prHvboP.exe
  C:\Windows\System\prHvboP.exe
  2⤵
  PID:9296
- C:\Windows\System\zfHlhvk.exe
  C:\Windows\System\zfHlhvk.exe
  2⤵
  PID:9312
- C:\Windows\System\XXkkbyu.exe
  C:\Windows\System\XXkkbyu.exe
  2⤵
  PID:9328
- C:\Windows\System\fAHrtLr.exe
  C:\Windows\System\fAHrtLr.exe
  2⤵
  PID:9344
- C:\Windows\System\BtlxmnI.exe
  C:\Windows\System\BtlxmnI.exe
  2⤵
  PID:9360
- C:\Windows\System\HIKvmfM.exe
  C:\Windows\System\HIKvmfM.exe
  2⤵
  PID:9376
- C:\Windows\System\HPlUsik.exe
  C:\Windows\System\HPlUsik.exe
  2⤵
  PID:9396
- C:\Windows\System\iOLWorz.exe
  C:\Windows\System\iOLWorz.exe
  2⤵
  PID:9416
- C:\Windows\System\hLMWjxK.exe
  C:\Windows\System\hLMWjxK.exe
  2⤵
  PID:9432
- C:\Windows\System\NjCpqjZ.exe
  C:\Windows\System\NjCpqjZ.exe
  2⤵
  PID:9448
- C:\Windows\System\smbdpZQ.exe
  C:\Windows\System\smbdpZQ.exe
  2⤵
  PID:9464
- C:\Windows\System\pWRbSJI.exe
  C:\Windows\System\pWRbSJI.exe
  2⤵
  PID:9484
- C:\Windows\System\xsjLNLJ.exe
  C:\Windows\System\xsjLNLJ.exe
  2⤵
  PID:9500
- C:\Windows\System\lMAJzvP.exe
  C:\Windows\System\lMAJzvP.exe
  2⤵
  PID:9516
- C:\Windows\System\qWGmPEY.exe
  C:\Windows\System\qWGmPEY.exe
  2⤵
  PID:9532
- C:\Windows\System\MzBmaNW.exe
  C:\Windows\System\MzBmaNW.exe
  2⤵
  PID:9548
- C:\Windows\System\yJoMDqG.exe
  C:\Windows\System\yJoMDqG.exe
  2⤵
  PID:9564
- C:\Windows\System\KfJNVeP.exe
  C:\Windows\System\KfJNVeP.exe
  2⤵
  PID:9580
- C:\Windows\System\pUPAtag.exe
  C:\Windows\System\pUPAtag.exe
  2⤵
  PID:9596
- C:\Windows\System\lUthRmn.exe
  C:\Windows\System\lUthRmn.exe
  2⤵
  PID:9612
- C:\Windows\System\HOVokJE.exe
  C:\Windows\System\HOVokJE.exe
  2⤵
  PID:9628
- C:\Windows\System\RclHxZp.exe
  C:\Windows\System\RclHxZp.exe
  2⤵
  PID:9644
- C:\Windows\System\kPhRYlL.exe
  C:\Windows\System\kPhRYlL.exe
  2⤵
  PID:9660
- C:\Windows\System\oDAbdjn.exe
  C:\Windows\System\oDAbdjn.exe
  2⤵
  PID:9676
- C:\Windows\System\LyasYtM.exe
  C:\Windows\System\LyasYtM.exe
  2⤵
  PID:9692
- C:\Windows\System\VRamcOU.exe
  C:\Windows\System\VRamcOU.exe
  2⤵
  PID:9708
- C:\Windows\System\LpExwQE.exe
  C:\Windows\System\LpExwQE.exe
  2⤵
  PID:9724
- C:\Windows\System\TpffViX.exe
  C:\Windows\System\TpffViX.exe
  2⤵
  PID:9740
- C:\Windows\System\CgdulKh.exe
  C:\Windows\System\CgdulKh.exe
  2⤵
  PID:9756
- C:\Windows\System\rEOLkVW.exe
  C:\Windows\System\rEOLkVW.exe
  2⤵
  PID:9772
- C:\Windows\System\HseavoK.exe
  C:\Windows\System\HseavoK.exe
  2⤵
  PID:9788
- C:\Windows\System\AkEIzZY.exe
  C:\Windows\System\AkEIzZY.exe
  2⤵
  PID:9804
- C:\Windows\System\vwbjEqH.exe
  C:\Windows\System\vwbjEqH.exe
  2⤵
  PID:9820
- C:\Windows\System\jBDJtlc.exe
  C:\Windows\System\jBDJtlc.exe
  2⤵
  PID:9836
- C:\Windows\System\FVcPSqx.exe
  C:\Windows\System\FVcPSqx.exe
  2⤵
  PID:9852
- C:\Windows\System\ZFfcJFn.exe
  C:\Windows\System\ZFfcJFn.exe
  2⤵
  PID:9868
- C:\Windows\System\TNubXGM.exe
  C:\Windows\System\TNubXGM.exe
  2⤵
  PID:9884
- C:\Windows\System\GTaTzqx.exe
  C:\Windows\System\GTaTzqx.exe
  2⤵
  PID:9900
- C:\Windows\System\uMBWWHg.exe
  C:\Windows\System\uMBWWHg.exe
  2⤵
  PID:9916
- C:\Windows\System\hHDOIju.exe
  C:\Windows\System\hHDOIju.exe
  2⤵
  PID:9932
- C:\Windows\System\hxXVGid.exe
  C:\Windows\System\hxXVGid.exe
  2⤵
  PID:9948
- C:\Windows\System\CbdtesL.exe
  C:\Windows\System\CbdtesL.exe
  2⤵
  PID:9964
- C:\Windows\System\nnwlXkL.exe
  C:\Windows\System\nnwlXkL.exe
  2⤵
  PID:9980
- C:\Windows\System\lHWdIid.exe
  C:\Windows\System\lHWdIid.exe
  2⤵
  PID:9996
- C:\Windows\System\KPuKGaR.exe
  C:\Windows\System\KPuKGaR.exe
  2⤵
  PID:10012
- C:\Windows\System\vGUgmvb.exe
  C:\Windows\System\vGUgmvb.exe
  2⤵
  PID:10028
- C:\Windows\System\ylhxOVb.exe
  C:\Windows\System\ylhxOVb.exe
  2⤵
  PID:10044
- C:\Windows\System\BOvdgUI.exe
  C:\Windows\System\BOvdgUI.exe
  2⤵
  PID:10060
- C:\Windows\System\yMtYdGA.exe
  C:\Windows\System\yMtYdGA.exe
  2⤵
  PID:10076
- C:\Windows\System\eXWKoXZ.exe
  C:\Windows\System\eXWKoXZ.exe
  2⤵
  PID:10092
- C:\Windows\System\dXaBtoP.exe
  C:\Windows\System\dXaBtoP.exe
  2⤵
  PID:10108
- C:\Windows\System\XEPFEUm.exe
  C:\Windows\System\XEPFEUm.exe
  2⤵
  PID:10124
- C:\Windows\System\WKjcQNF.exe
  C:\Windows\System\WKjcQNF.exe
  2⤵
  PID:10140
- C:\Windows\System\BaMnIMh.exe
  C:\Windows\System\BaMnIMh.exe
  2⤵
  PID:10160
- C:\Windows\System\mFwLIEh.exe
  C:\Windows\System\mFwLIEh.exe
  2⤵
  PID:10176
- C:\Windows\System\LlYerWr.exe
  C:\Windows\System\LlYerWr.exe
  2⤵
  PID:10192
- C:\Windows\System\eMvKcHV.exe
  C:\Windows\System\eMvKcHV.exe
  2⤵
  PID:10208
- C:\Windows\System\rOLtfxU.exe
  C:\Windows\System\rOLtfxU.exe
  2⤵
  PID:10224
- C:\Windows\System\lnTNKyy.exe
  C:\Windows\System\lnTNKyy.exe
  2⤵
  PID:9224
- C:\Windows\System\ICiGIgu.exe
  C:\Windows\System\ICiGIgu.exe
  2⤵
  PID:1332
- C:\Windows\System\hozrTCZ.exe
  C:\Windows\System\hozrTCZ.exe
  2⤵
  PID:9256
- C:\Windows\System\rdTKwmw.exe
  C:\Windows\System\rdTKwmw.exe
  2⤵
  PID:9260
- C:\Windows\System\prgVDLF.exe
  C:\Windows\System\prgVDLF.exe
  2⤵
  PID:9272
- C:\Windows\System\uzQKxxY.exe
  C:\Windows\System\uzQKxxY.exe
  2⤵
  PID:9384
- C:\Windows\System\aRfJsJD.exe
  C:\Windows\System\aRfJsJD.exe
  2⤵
  PID:9428
- C:\Windows\System\YUfUxiN.exe
  C:\Windows\System\YUfUxiN.exe
  2⤵
  PID:9492
- C:\Windows\System\bDxudwT.exe
  C:\Windows\System\bDxudwT.exe
  2⤵
  PID:9340
- C:\Windows\System\OfvXRbA.exe
  C:\Windows\System\OfvXRbA.exe
  2⤵
  PID:9412
- C:\Windows\System\riROKgT.exe
  C:\Windows\System\riROKgT.exe
  2⤵
  PID:9476
- C:\Windows\System\bVtDpGm.exe
  C:\Windows\System\bVtDpGm.exe
  2⤵
  PID:9524
- C:\Windows\System\LNlFQbo.exe
  C:\Windows\System\LNlFQbo.exe
  2⤵
  PID:9560
- C:\Windows\System\qVDKqfB.exe
  C:\Windows\System\qVDKqfB.exe
  2⤵
  PID:9604
- C:\Windows\System\AvSoMVF.exe
  C:\Windows\System\AvSoMVF.exe
  2⤵
  PID:9624
- C:\Windows\System\rWtjRae.exe
  C:\Windows\System\rWtjRae.exe
  2⤵
  PID:9656
- C:\Windows\System\yCdHEAT.exe
  C:\Windows\System\yCdHEAT.exe
  2⤵
  PID:9704
- C:\Windows\System\IfOUYpW.exe
  C:\Windows\System\IfOUYpW.exe
  2⤵
  PID:9700
- C:\Windows\System\dQRDKpi.exe
  C:\Windows\System\dQRDKpi.exe
  2⤵
  PID:9780
- C:\Windows\System\cMXPveo.exe
  C:\Windows\System\cMXPveo.exe
  2⤵
  PID:9812
- C:\Windows\System\EnSTgZk.exe
  C:\Windows\System\EnSTgZk.exe
  2⤵
  PID:9768
- C:\Windows\System\TGvNYmC.exe
  C:\Windows\System\TGvNYmC.exe
  2⤵
  PID:9828
- C:\Windows\System\lsTibuz.exe
  C:\Windows\System\lsTibuz.exe
  2⤵
  PID:9860
- C:\Windows\System\PiVDVyB.exe
  C:\Windows\System\PiVDVyB.exe
  2⤵
  PID:9940
- C:\Windows\System\cbkxrBO.exe
  C:\Windows\System\cbkxrBO.exe
  2⤵
  PID:9896
- C:\Windows\System\TwoxMxh.exe
  C:\Windows\System\TwoxMxh.exe
  2⤵
  PID:9960
- C:\Windows\System\zYgzfGP.exe
  C:\Windows\System\zYgzfGP.exe
  2⤵
  PID:2968
- C:\Windows\System\cxNILeP.exe
  C:\Windows\System\cxNILeP.exe
  2⤵
  PID:10040
- C:\Windows\System\dcsxuMq.exe
  C:\Windows\System\dcsxuMq.exe
  2⤵
  PID:10100
- C:\Windows\System\eLiIsiQ.exe
  C:\Windows\System\eLiIsiQ.exe
  2⤵
  PID:10120
- C:\Windows\System\lberFVQ.exe
  C:\Windows\System\lberFVQ.exe
  2⤵
  PID:10056
- C:\Windows\System\HICMTDX.exe
  C:\Windows\System\HICMTDX.exe
  2⤵
  PID:10148
- C:\Windows\System\ofBtqSH.exe
  C:\Windows\System\ofBtqSH.exe
  2⤵
  PID:10172
- C:\Windows\System\EiXHZnd.exe
  C:\Windows\System\EiXHZnd.exe
  2⤵
  PID:10188
- C:\Windows\System\dnbJpJL.exe
  C:\Windows\System\dnbJpJL.exe
  2⤵
  PID:10216
- C:\Windows\System\lEKuBYk.exe
  C:\Windows\System\lEKuBYk.exe
  2⤵
  PID:9228
- C:\Windows\System\XPDCulA.exe
  C:\Windows\System\XPDCulA.exe
  2⤵
  PID:976
- C:\Windows\System\DinHSXV.exe
  C:\Windows\System\DinHSXV.exe
  2⤵
  PID:9244
- C:\Windows\System\DNFTiaK.exe
  C:\Windows\System\DNFTiaK.exe
  2⤵
  PID:9544
- C:\Windows\System\kAKoffd.exe
  C:\Windows\System\kAKoffd.exe
  2⤵
  PID:9668
- C:\Windows\System\BdzlxAq.exe
  C:\Windows\System\BdzlxAq.exe
  2⤵
  PID:9732
- C:\Windows\System\rywvFEK.exe
  C:\Windows\System\rywvFEK.exe
  2⤵
  PID:9892
- C:\Windows\System\jLiRiFV.exe
  C:\Windows\System\jLiRiFV.exe
  2⤵
  PID:9880
- C:\Windows\System\FFjvODG.exe
  C:\Windows\System\FFjvODG.exe
  2⤵
  PID:10156
- C:\Windows\System\XyxgRpg.exe
  C:\Windows\System\XyxgRpg.exe
  2⤵
  PID:9320
- C:\Windows\System\ZRitmPw.exe
  C:\Windows\System\ZRitmPw.exe
  2⤵
  PID:9460
- C:\Windows\System\hFVHyHJ.exe
  C:\Windows\System\hFVHyHJ.exe
  2⤵
  PID:10008
- C:\Windows\System\KMJJExt.exe
  C:\Windows\System\KMJJExt.exe
  2⤵
  PID:9508
- C:\Windows\System\xcuptpk.exe
  C:\Windows\System\xcuptpk.exe
  2⤵
  PID:9992
- C:\Windows\System\GIqjUrk.exe
  C:\Windows\System\GIqjUrk.exe
  2⤵
  PID:9928
- C:\Windows\System\ynyessa.exe
  C:\Windows\System\ynyessa.exe
  2⤵
  PID:10084
- C:\Windows\System\XZDWIPZ.exe
  C:\Windows\System\XZDWIPZ.exe
  2⤵
  PID:9444
- C:\Windows\System\gkmJApd.exe
  C:\Windows\System\gkmJApd.exe
  2⤵
  PID:9308
- C:\Windows\System\GCFKKbq.exe
  C:\Windows\System\GCFKKbq.exe
  2⤵
  PID:2504
- C:\Windows\System\RZmtWdz.exe
  C:\Windows\System\RZmtWdz.exe
  2⤵
  PID:9976
- C:\Windows\System\PJJTKTf.exe
  C:\Windows\System\PJJTKTf.exe
  2⤵
  PID:9636
- C:\Windows\System\BdhvMjp.exe
  C:\Windows\System\BdhvMjp.exe
  2⤵
  PID:10052
- C:\Windows\System\AOspHiO.exe
  C:\Windows\System\AOspHiO.exe
  2⤵
  PID:10168
- C:\Windows\System\fFXkFBK.exe
  C:\Windows\System\fFXkFBK.exe
  2⤵
  PID:9404
- C:\Windows\System\OFuKWIe.exe
  C:\Windows\System\OFuKWIe.exe
  2⤵
  PID:10136
- C:\Windows\System\gWGIcgp.exe
  C:\Windows\System\gWGIcgp.exe
  2⤵
  PID:9988
- C:\Windows\System\RoZGHMj.exe
  C:\Windows\System\RoZGHMj.exe
  2⤵
  PID:9912
- C:\Windows\System\GRShcji.exe
  C:\Windows\System\GRShcji.exe
  2⤵
  PID:10024
- C:\Windows\System\XSopuIQ.exe
  C:\Windows\System\XSopuIQ.exe
  2⤵
  PID:10184
- C:\Windows\System\xKaOfeH.exe
  C:\Windows\System\xKaOfeH.exe
  2⤵
  PID:9372
- C:\Windows\System\eTaXPPd.exe
  C:\Windows\System\eTaXPPd.exe
  2⤵
  PID:10036
- C:\Windows\System\lyIacRT.exe
  C:\Windows\System\lyIacRT.exe
  2⤵
  PID:9592
- C:\Windows\System\bpHxWac.exe
  C:\Windows\System\bpHxWac.exe
  2⤵
  PID:10248
- C:\Windows\System\EdPIVjV.exe
  C:\Windows\System\EdPIVjV.exe
  2⤵
  PID:10264
- C:\Windows\System\jTDbTmI.exe
  C:\Windows\System\jTDbTmI.exe
  2⤵
  PID:10280
- C:\Windows\System\tMuISoc.exe
  C:\Windows\System\tMuISoc.exe
  2⤵
  PID:10296
- C:\Windows\System\yatOYZp.exe
  C:\Windows\System\yatOYZp.exe
  2⤵
  PID:10316
- C:\Windows\System\suvUuew.exe
  C:\Windows\System\suvUuew.exe
  2⤵
  PID:10332
- C:\Windows\System\fCaxtlK.exe
  C:\Windows\System\fCaxtlK.exe
  2⤵
  PID:10348
- C:\Windows\System\cJGOYBW.exe
  C:\Windows\System\cJGOYBW.exe
  2⤵
  PID:10364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ADDkZKk.exe

Filesize
2.3MB

MD5
7f36ed11ed644cd932e470ff0353e43a

SHA1
31d07fef782cd410485763c4f20080bb7833a121

SHA256
05fb837e09889da5f4a7a8ab26859c8798164f1f6eb64c5007563f480bfd1e08

SHA512
953fb58887d665985e550131a686ccb84c60c8e4ba5fe59dbecf42115c9efdc1c4c4737f54dc28cd46f3c2ad3b732a60e16d7158fef955c5e053c37ce00830a0

Download Submit
C:\Windows\system\CphbAZF.exe

Filesize
2.3MB

MD5
c61200cc9d65a86bf330aa9cc3b6d86e

SHA1
2bf62cd6ec9cde264b954b1d8aa8d5d31c4416a7

SHA256
8ccab11bf613b1e3e18e898bb2a55939e2dab163ebd2ebddcd75c8038443f58c

SHA512
466d4351b7e3f7d81ac1ee83e67cf67656066d947625018abfb304a155ad180f12961b5517824c4d08174b73c901a17bb15d4632e172cebf688b54e1051905ce

Download Submit
C:\Windows\system\FKTftVt.exe

Filesize
2.3MB

MD5
9fd89cdb1e5d7d869a057542fcfa269f

SHA1
bf5ae7ae77911922495c4a51bd38766e4fe5088c

SHA256
627611fa4cfba1fae6b6e96a75a602542e7ec05d41073e06240596c3b4b53a46

SHA512
8e9d34784b4b1c5ae9c440daebc33babf9e9fbcee0119222e66f785baf71659f8a3ecf3045ba0dfd2f1e963136fa31bfb5028dfebe5830dcf5e7736c9b0ad2db

Download Submit
C:\Windows\system\GZoHWNt.exe

Filesize
2.3MB

MD5
347c54beffb7e2680a4c942ac0209909

SHA1
dfed5610e2c0f69001c2e3eb27945de161321337

SHA256
c2aa52f7a1540c783d7a50b0deca911eddfcef4567653143912111a1e1f03b25

SHA512
b939fd58f056b027a41b1c77a1a686c04c58c47933192ea85b908c425ea4fce255a8561c21f88fb62ec201a44b46ee0e72d2f0b7995d489bde8cd6dda8cb3928

Download Submit
C:\Windows\system\JEqCJnR.exe

Filesize
2.3MB

MD5
6e0b52c6c158a82337529d62c0f78b7f

SHA1
ffdee54a12981a089422ee46ef0befc8653312ce

SHA256
49b6b10dd0d1285ae9a242baa0c9de4c3bd3fcd68043defd6f93cbe3e980491b

SHA512
c1e596715d91f01021b03e8f0754f8f8702e10b4657bc30297b802d22d066cbac6c44d42e42d9f9546f3dc970f4676b5b5e0bc0da48f307a0498c58415d93b24

Download Submit
C:\Windows\system\MoyXQNG.exe

Filesize
2.3MB

MD5
be7bf160c923bc46a7f5c117b68675fe

SHA1
9e829efc2a4103386d2cb3ceed96560b6ad347bf

SHA256
0b8ee9d2f4b8bb45727758765983cfd49f47fbbf1f8e825a0864393d3c78b5c4

SHA512
cd644f602dd0646248cc652458a22363af63f3bf44290b06b33767c9e5e9840a9991d3be2e81e3e3fbcfbf072a1da4e900d8fd739057b91796022c69634042cc

Download Submit
C:\Windows\system\MtlafVr.exe

Filesize
2.3MB

MD5
6f9052c364903724b388d16eb5309ca8

SHA1
40a5170bf8da2a3f721174bfe47de77448dd09ce

SHA256
fbcc9d10b7f36afb475d28952988ef258941bddd7286e814a3bcb6aca62fb33c

SHA512
a29f0cb16b2132d6de36b26938df1071800619a4339ec58032fdec0f5f950e92abc8b2c422cdf449eb0a68b0edd87d2efe8282cab795a351cac979d90530c15a

Download Submit
C:\Windows\system\SUiExTL.exe

Filesize
18B

MD5
ef758e56e906b9892f08e5e0fd0f13b2

SHA1
5d91983aa1bb61c5754ee9a01242f0bb098e7d43

SHA256
55949f339b372645d839eaa0847f4e244396f7e39c4586ddc776fb793deda110

SHA512
efd8bb7ef71cf583c97f5d0eac4e2fae239c80d85643b80c586971498ace127bb0c9565e46052e55211bb3dead5ae54145b84fc68e9ff4a6be2a5f6b0f086760

Download Submit
C:\Windows\system\SfGDdbU.exe

Filesize
2.3MB

MD5
04c1aa456b1741a0776465cf933b4514

SHA1
e5d531ad85ac02401d1a9b9d37388bb9aba30818

SHA256
a155e9bb302ca6363648963c7071217513541b1739f851b40fcb5ea2941e373b

SHA512
496a8edb326c7298c1d8d50aab16e69b05af0ca1181e7e09f19bbdfa4c1243bd9ceb2a757fa03ed6889990fe7ffa670e3c6c312acd6f43dc3fcbf1ed7e205e57

Download Submit
C:\Windows\system\TNzjMJc.exe

Filesize
2.3MB

MD5
820c35e46ca2b9860f406627eb878f49

SHA1
ae47d580c01a9e7c29e2c43cca3d182ceb5573f0

SHA256
b5a1efd1ce6fb0e773e1bc3c043b0f6cab5107c146a39b4bd4c787c9e9203bef

SHA512
71413d53c2a226f1afe674fcc90513c245fdfb792d747e6bdc059ffd78b9bdab5dccfb65f1bb4aa8c7275ab950ab73f51c9ce8035e2e188649c43f1c96f0e31a

Download Submit
C:\Windows\system\VrEtTCp.exe

Filesize
2.3MB

MD5
6d5f11d8bbba6833e81f7535afb3c490

SHA1
ad24bd1080fb7b248bc9f37adaac8bb731e39342

SHA256
00ad278926e881c3c5c28fb30c089b40981ed30182022b33ae7608d93cab1397

SHA512
0541d2fda8a0dc696705aec4e3180914bd2e4ba0a1629583428cfc8b1eedad00724a505621b0e19cd8844c1d83603f0ae2a305cd495811b5b570b12757d032d9

Download Submit
C:\Windows\system\WiOKnoX.exe

Filesize
2.3MB

MD5
24768df088f006af2a1acd98ff94dc71

SHA1
acd112337e433b7eceb32cdf85eb5c11925634f2

SHA256
0dfda41e29d2466a3119c17bec03a6ff310d15ed4c55b74ff15fe9ca29fd9a08

SHA512
e02acc67c1e4ceba121e6b3ba7ea9a5ebcebe2c48922d3c0a54d404809ec007787c2425c5a5557058f04322df11b48bd1e2a18245e8cfd44672da01ce6b2f369

Download Submit
C:\Windows\system\foFLxuS.exe

Filesize
2.3MB

MD5
2bbb06b49e5a61a5091a10f07298be28

SHA1
25922b75ea22e3d92c6da21b70aa51b7d50aee20

SHA256
cdbd41e43635b06e0b575369b4673df2bffcc325fa6a1af4c3badfe4585ea771

SHA512
4880df97a7fa8b217f48ede43befba5f2d1b3d64dbfc1e8d79a8817915d202cff487ac912d8b4b53495013a113ffac51656df175f68dfd92f57817c2c8ce4f93

Download Submit
C:\Windows\system\mIxwJaA.exe

Filesize
2.3MB

MD5
df211d62b5b28184fcc1f5e134d26990

SHA1
0eeaac5459b8cab4a3896c0484cb517514e13405

SHA256
52ebe853bb93bc940584d09dcf6c2563216bbcb57c0d4747e904221ded5503a9

SHA512
b1502a09d4732445ac9d0fbdb434f7377725f02f5a2c1c14993ab09899d0f3891f01b52271202b4f0628272e3c574b5e280345c096e28af030fff6d050523ebb

Download Submit
C:\Windows\system\qpSorIO.exe

Filesize
2.3MB

MD5
c05341affafd7d3a7e48ad7536ec4b55

SHA1
058b2158ae4d5fad72187ec5354bb617aa632f88

SHA256
5d0f00a41ea1d4134ee197a79d3f960e8cd10cc5a1c58084b1f028897f48f2d6

SHA512
363a094ed34965aa259f76df6aee785a3c0462ff41deb30aca8ae278e48eee408794a6f81db2009eff899f7c9a737cc51a8d2e999dfb3fa42666d38e0adc600e

Download Submit
C:\Windows\system\rDDaDIo.exe

Filesize
2.3MB

MD5
bed96f42f070fd3b426c996c96227843

SHA1
6ce296e844a069fb548718161b786a3f222931a4

SHA256
d3d35806df681b9c0b03624264671f9ca586bd58e46a932aa775e9632076f5e5

SHA512
ecea9db3a2cfe9a28c4bd526005a80b9259c1feaff5e40ac376e9ef19cceb8d85f20255741b0fcdd54f97767c859bada9be3d18cf683f34de599b12944e9326d

Download Submit
C:\Windows\system\swONdEf.exe

Filesize
2.3MB

MD5
a7e918b9d8c2d63b1a8f7d81ff9a1d42

SHA1
056ffeaa2c0d2bdd09089261f0ec000342bc6fac

SHA256
cdd81b941b7d328c60930e4431d49e9c5af4892296e0e58619e921574a464999

SHA512
33e32f6733296240dec7766ea6cfe049c7d86933b8fef238bf7cf789c1bbbe74441ba6fbdf8bf7bd1cbca69d8326e884b8cc6021e7e0441906399e0984f9a996

Download Submit
C:\Windows\system\tiHtkzR.exe

Filesize
2.3MB

MD5
e0bc67eedbd0b04e3b0d5bc8ed7158a5

SHA1
eacbb7596fca1a48f0902fdf5083283e0d5eda70

SHA256
afc3578fe88fb6e3206ebaa29ba06212feedd12249ec17861f1bc414756fbbb1

SHA512
1cb13c849c5ac0bba4fde2a64f7295243f55a952bef81d376c8816503206a5246eea1dff6b3f11998b648af5d79647fbfd57755b1b9a012864a5b118f4bee361

Download Submit
C:\Windows\system\uzcHqak.exe

Filesize
2.3MB

MD5
5083e9d7b311962386c94495408d7d4a

SHA1
addf987a8bc89e5eb3366afe21070b5639148a4d

SHA256
f9b06b8b4f79a9a08d85e6159594c7b27de17c080063f53cc1e2ce795f14adb7

SHA512
ce605094fc4d21e8ec5b390e4afa48779824d5c477138796169ee736685625093fb1d3029acd4950f91e61f97436bd9f126c12fab832cd08446b1ac535e4a0a8

Download Submit
C:\Windows\system\xIhZtoI.exe

Filesize
2.3MB

MD5
507a49934929669b5e2c0ebbf07d1868

SHA1
757adf60ac3d0163245d6f94458ee422ca3ec910

SHA256
76a8f64a402b02cb2ecc1aec8ea5daf0ca2f784837b898f713d43499eccf8b5c

SHA512
75e5c50e7ee8cfd773dfc78d0e60d0ff7a212bec76b06b1a630ff40ee3fd5d4d4a952c1da2ff346fdb85900437c66d569736a0c60a3261141b81ab2101fad485

Download Submit
C:\Windows\system\yJTrQjc.exe

Filesize
2.3MB

MD5
ef266749170708aa30ee6209b670b3ba

SHA1
5f93a284576ef7b3748cfd707e00a053e404b9ed

SHA256
4b51ec80ac985979f2d857def944df74f8f1933dafde59a4390a2b19ee2d828a

SHA512
5c0c7dbb952def759d4bfd36aeaa1067d407edf076a984e80a64a335ed62e748c3168ec6a8b64b65f7d772b947e572a1bf2a4c31e90165d9f917f61d26115d3b

Download Submit
C:\Windows\system\yjBUGLc.exe

Filesize
2.3MB

MD5
582dfb20d3c86b178d93032a728b49b2

SHA1
be2da1a261ba3fa46af4b2e039f6c96fbf472ca0

SHA256
c9343d52efe760a1702722c12dece31f3b45ca78daaf0346d31c524e24c2d777

SHA512
14e15a5b75d7a1dc3ed3de120333f00d8a54adb9e445525b19ec12aff2df752d0b3d9eaa09073c7dc6ae6197de9597033635beaf6861db0e5c0c9e4942c76cae

Download Submit
C:\Windows\system\zqUPZLQ.exe

Filesize
2.3MB

MD5
a9e36b21e57f55851aae803d15a7c369

SHA1
60f2e9c49889ab1569e52b122eba89cbc5ad68d0

SHA256
121a5fd01dc5f7bfcc839e6cca2062dce2c7e424a941d23305ab95915711efb7

SHA512
c633b54cef84e448d2f65e919b2b3ca4a093722577cdfe43a8689c0f684e84ce5be5b2492a090f0546c201d009e349c04c052389cb92b071e655b0bbea6fac17

Download Submit
\Windows\system\FEsjFZu.exe

Filesize
2.4MB

MD5
487ca65e3433ae0e0d4f4d20604b4939

SHA1
49ba82ad60ecd84fe2b5dcdf92ee3f976cf4034e

SHA256
7fad71963461edcfdf0afc488ebc88535a2ea85b144f6d47021ab733794311d4

SHA512
5b3d6b5156540791d41f9b9aad9c9a2c8e337bfd5de5678b78dd9d71773ee5001a3be4668585a623c35b7a436b520e0fc8479f35b932f952d8cd42d38653f653

Download Submit
\Windows\system\LkaYCTV.exe

Filesize
2.4MB

MD5
a41ac2555fb5f7d6f4ade69cc5b3ce4a

SHA1
674bdd114278e0f322e4c4f4252f81c9cc91c2c3

SHA256
a0a941553efe456f95292b0650b4b9c7d869c3ee7f905b10d853ef253027b719

SHA512
50c7ed7c7d3d539e833e9f933612c901b4ef75bf7b4e5f2912c2ca246648af1e089fc362dadc3dce649beb0e5b3531ea755c22361b1d35f1e3c945dba6ee132f

Download Submit
\Windows\system\RHBwgpL.exe

Filesize
2.4MB

MD5
66324608d968c9de9fe72c1a4a8f2492

SHA1
e3ee071e9ffc0656f213cb80eb8026a43eef19af

SHA256
6e735d7f154716a5114573aa7c7bd67a38ab91a040effef24236f51792667ce3

SHA512
5fa5f7f88e15328760e2d57e7480e3d97fa123a50acc8dc6e84b9b5ee295af47e319ca38bd282eaeee2217108eb14c922afc198a924a4759890286c232c523bd

Download Submit
\Windows\system\UVhyRic.exe

Filesize
2.4MB

MD5
1e78ce7d69b6fa709876d279858358b6

SHA1
2a8563b54d2f85cc9f25dab4bbbddcb6526056df

SHA256
53daaae1de8a82032b603a1cfabd4b958720c8e7d3239a90070e6b1b96e19f73

SHA512
b397fe6fa935104cf5f5ebfc4f9982ce200c64599462dea10e4523c72073892f5270c2cb673f3b938deb31862c36b95c244b1d544aa9e7ba985c033813541cdb

Download Submit
\Windows\system\UvKOzQw.exe

Filesize
2.4MB

MD5
37e17fceb975b53ad351808a919a9712

SHA1
56762894d5a7a36322695c07c12620deddab4b27

SHA256
1c5c9afaf703ac7754400842dccf61c6a3b29db506287552ac6eac6b69885231

SHA512
e26e73957726228c186a46c31949458db438f1ea12d5efa0edcc2691c689ab21f31006d4c7148c307c5d3760a00706482ac50b5777b7d2ad7c102af5c37c3550

Download Submit
\Windows\system\bCqESmk.exe

Filesize
2.4MB

MD5
ab7ea645d024ff49b7bcac07de4fb8d9

SHA1
d5d5e0a65be12184c24aed8157960c52386b3fb4

SHA256
23d01307ed8dd5d8ace996a70647cb41e5685c1f0346e8d7d158fdb2a346540d

SHA512
35d437fcaf5d93ab5635da8b536f43a488989173af7fe003f6a486f9db5a52f873a89af32037c3a51e1700957cd23de8b6869afe51b498226f770fc93a67dcf8

Download Submit
\Windows\system\cLrSZGe.exe

Filesize
2.3MB

MD5
235fc6e5a34451e29fb0c1d6d5985124

SHA1
ac69d2c9923ddad143452981cccbf5897fd04888

SHA256
d0b142b71d3dd7ccc0fdad4782bcf8fdce8fd9581b940edf9d0bc3baa53f216c

SHA512
91718e21ee8033cd95884ae465184cef4e3d91befef40b4ab3580d9c6358513b16c4e17f0f41b4753e6173c319eccc1371878b9bef5561ae76c0e562d42bc529

Download Submit
\Windows\system\gRfBfzO.exe

Filesize
2.3MB

MD5
6dfa664248292206ec22a451148045b4

SHA1
71fb82b6aba4b1c2376a8d23e7555ed80085eeb1

SHA256
a57b57b37a016b2da45c7afccc0126e46ad0bff135a4ef96f0af4a75f1987444

SHA512
d47d93deccdf8e57025a394ef4f7cf4486e9140d438b08012bb61e5267db6b8b240052820306578c5834aafdf18acf4c6e9d552ace9cfc0398243788948cfd47

Download Submit
\Windows\system\jvKnRNU.exe

Filesize
2.3MB

MD5
dd9f39b9b6ad77185e70f59207c88ad6

SHA1
63d9ca673f1388aada1b45deadaa503e9a675270

SHA256
047cbc6aa7033e46b1051f110a824984660dac1c2be0322d478c5c4be9e8f777

SHA512
ce63a6f7934ec18623b88299bc4dcd3522e6eab9c866c096afd9d8709412452aa91eb550a6baf6c9c8beeeca659495416fb942fcf978946a6d923fe1e2b664c5

Download Submit
\Windows\system\nJzDFBE.exe

Filesize
2.3MB

MD5
200c63ea5381d45327bf944d434be9a8

SHA1
ea7068d1fd40de9bc0871aa4296080e8b4ef114d

SHA256
7fabfebea901665536ba22dc8d35bcc4fbd372e9ec5609db996a7150048eb648

SHA512
eaf6cf29b5971fd834609ce0ea4ab338a04aaf3b7e278877c03a9801ad081e5973467850ca3e412ad0f977c6c3e9e38a7304dc3396e69c909f7f8861f8830023

Download Submit
\Windows\system\niySPGp.exe

Filesize
2.4MB

MD5
7ee14467d811fc640882b07882c9b7b0

SHA1
d746e65b5025cc81d141ea25391b0c4321800509

SHA256
d7cda55834b9591923d6c24854cf980fa69c660a74dcf8716bf202a988f8e8be

SHA512
430a695e97a88e2b05c67ed56c43ce34e83994a1eb85d139a08c6f3779c09453d2d0f63df1b13073bc0b98249f90fa9e8eb7627c57b8dc470316a9f42716738f

Download Submit
\Windows\system\pfkzwuj.exe

Filesize
2.3MB

MD5
6c11dedfcc5a120a2fc023f3cd656aaa

SHA1
7c21eef88b8673d0e008be7531545b2a3c2f9fe9

SHA256
2379c0b1987ee6bd33da7f4ea048c08ad30ee3c91e28f1fe0f4c6106444751db

SHA512
25dcfd18ddf11a44ea82d8523face9ff78884a406be797613e7860e70f2fa562f30a0ade234d05e044b21f47a50c0b2c1368859ade9fd66f8141a209b58a8a76

Download Submit
\Windows\system\qBCOphW.exe

Filesize
2.4MB

MD5
412ed1b4146bff81323dae113cfd72a5

SHA1
3c06324a0516903e9f45ff18f0dc7930b7e22950

SHA256
abdaca552bdb43c30d109cc9092ff8498b0dca3235957d26ed89d4375cd77643

SHA512
6a2d7a4398a88dc4583d3f2743159701bba2404737d29e54e316d3b2b27577e41d0d3a5aa35a012dffdd3c169dbda596e13269ca282b2b175479d361d31a53e6

Download Submit
\Windows\system\qKTdXxv.exe

Filesize
2.4MB

MD5
e9f7fd8a295d305deeaeb207f6c893c3

SHA1
93d1c6773565d0be8b3053179f256cbc5a967f99

SHA256
fcc7ce8b5398d82df917908942f02e110b1ca17d3a89d8e5362d2cb0f9da1cd5

SHA512
266fc71f4b4f642790e974e47bf830639af7e6b46febb78a8114e43fd668eb1b9cac1521f05c19372f94085f7d9711a25794eb844d3702fa930d82f2fef37c62

Download Submit
\Windows\system\qPlwzhF.exe

Filesize
2.3MB

MD5
044341a9b828bf6155337a91b5bf7c35

SHA1
75dbbf30e0550f3a05645ba8349bf0a70d7083c1

SHA256
2e09013d42ae32d81fd7a3b3382c2bc468dfda3ef0fd531224495be29ce73a9c

SHA512
2aac5ff2df7a69daf1345b739e956e0a6ca3e9ca1b19086247d918790ee91e2eb77da3fda90cafdfc2bebfdc633fd9433a7e29703ef05cf384074097ddb4d766

Download Submit
\Windows\system\tmlPQHf.exe

Filesize
2.4MB

MD5
803cc021e62a95ff96b15fc7e69ba192

SHA1
bdacb758c8161917f04396318816af5165952964

SHA256
3137ba88ed1ef97265412bd65fc385bb78e49f9d94335138612c12f418972560

SHA512
a5e09fe8fbb6cf6f38ce8f87dc90a93f0aa0bd1a506f93483294fe16af6099669fb63a8c9d2c7c566d078128f7919d4f17a4ad7f1712fe6640e5cc1ab9826dd5

Download Submit
\Windows\system\wOTmjFW.exe

Filesize
2.3MB

MD5
ace4b0f082782215e11caed73c87249b

SHA1
4509dd61508a9af2356d34863cdb31a6042ca2da

SHA256
09aee2a8e58771a678da3b47e6a56cfb941085b88907bc00868474f8d14c2bfe

SHA512
436f5e06da1503e14453f2a704df7b3093ec0be31677d15cb5b89019f4412520c02788530fd2235da037aa66deceb6c5c408ec42968f639838fd91b7bcb401e8

Download Submit
\Windows\system\yyTRYaZ.exe

Filesize
2.3MB

MD5
e7b158192062abef02d253e0178ecd5c

SHA1
5e5e8b085dbcdbb71b13f8c23b8b81c5ce47573d

SHA256
4e88e37a092711633f206a2f9868451290fe77579a0ac990cdebc32cfd2ffbb9

SHA512
9a522a9e7dcfbafe99e5a9d0e9dea25e7d7db1e6cbe1589f37690907f71655a756120407bbd6c7b1cdf895ecf0143ec7511c62b5546e4c84109d4a032ba94a2c

Download Submit
memory/284-247-0x000000013F8F0000-0x000000013FCE2000-memory.dmp

Filesize
3.9MB

Download
memory/1092-53-0x000000013FD30000-0x0000000140122000-memory.dmp

Filesize
3.9MB

Download
memory/1092-3346-0x000000013FD30000-0x0000000140122000-memory.dmp

Filesize
3.9MB

Download
memory/1980-136-0x000000013F940000-0x000000013FD32000-memory.dmp

Filesize
3.9MB

Download
memory/1980-3345-0x000000013F940000-0x000000013FD32000-memory.dmp

Filesize
3.9MB

Download
memory/2092-68-0x0000000003040000-0x0000000003432000-memory.dmp

Filesize
3.9MB

Download
memory/2092-396-0x000000013FB40000-0x000000013FF32000-memory.dmp

Filesize
3.9MB

Download
memory/2092-221-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download
memory/2092-255-0x0000000003040000-0x0000000003432000-memory.dmp

Filesize
3.9MB

Download
memory/2092-0-0x0000000001B20000-0x0000000001B30000-memory.dmp

Filesize
64KB

Download
memory/2092-144-0x000000013FE80000-0x0000000140272000-memory.dmp

Filesize
3.9MB

Download
memory/2092-395-0x0000000003040000-0x0000000003432000-memory.dmp

Filesize
3.9MB

Download
memory/2092-422-0x000000013FEA0000-0x0000000140292000-memory.dmp

Filesize
3.9MB

Download
memory/2092-39-0x0000000003040000-0x0000000003432000-memory.dmp

Filesize
3.9MB

Download
memory/2092-276-0x000000013FD30000-0x0000000140122000-memory.dmp

Filesize
3.9MB

Download
memory/2092-363-0x000000013FCC0000-0x00000001400B2000-memory.dmp

Filesize
3.9MB

Download
memory/2092-246-0x0000000003040000-0x0000000003432000-memory.dmp

Filesize
3.9MB

Download
memory/2092-2-0x000000013F5E0000-0x000000013F9D2000-memory.dmp

Filesize
3.9MB

Download
memory/2092-36-0x0000000003040000-0x0000000003432000-memory.dmp

Filesize
3.9MB

Download
memory/2092-34-0x000000013FBB0000-0x000000013FFA2000-memory.dmp

Filesize
3.9MB

Download
memory/2112-3349-0x000000013FBB0000-0x000000013FFA2000-memory.dmp

Filesize
3.9MB

Download
memory/2112-35-0x000000013FBB0000-0x000000013FFA2000-memory.dmp

Filesize
3.9MB

Download
memory/2284-3352-0x000000013F5F0000-0x000000013F9E2000-memory.dmp

Filesize
3.9MB

Download
memory/2284-58-0x000000013F5F0000-0x000000013F9E2000-memory.dmp

Filesize
3.9MB

Download
memory/2640-3351-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download
memory/2640-244-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download
memory/2832-149-0x000000013FE80000-0x0000000140272000-memory.dmp

Filesize
3.9MB

Download
memory/2832-3347-0x000000013FE80000-0x0000000140272000-memory.dmp

Filesize
3.9MB

Download
memory/2928-153-0x0000000001D90000-0x0000000001D98000-memory.dmp

Filesize
32KB

Download
memory/2928-141-0x000000001B840000-0x000000001BB22000-memory.dmp

Filesize
2.9MB

Download
memory/2984-3622-0x000000013FCC0000-0x00000001400B2000-memory.dmp

Filesize
3.9MB

Download
memory/2984-220-0x000000013FCC0000-0x00000001400B2000-memory.dmp

Filesize
3.9MB

Download
memory/2992-3353-0x000000013F240000-0x000000013F632000-memory.dmp

Filesize
3.9MB

Download
memory/2992-120-0x000000013F240000-0x000000013F632000-memory.dmp

Filesize
3.9MB

Download
memory/2996-4264-0x000000013FBF0000-0x000000013FFE2000-memory.dmp

Filesize
3.9MB

Download
memory/2996-213-0x000000013FBF0000-0x000000013FFE2000-memory.dmp

Filesize
3.9MB

Download