xmrig | 6b5497980e74e4f91680ef25c24951b708ced3d7c3c6fa438a63aee3ec6ebdb1

Analysis

max time kernel
150s
max time network
144s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
27/07/2024, 23:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
Size

1.7MB
MD5

0257a63158035ec4623f257cf62b0e6c
SHA1

c314c5c2482eed4ac47c7261508124766398f23a
SHA256

6b5497980e74e4f91680ef25c24951b708ced3d7c3c6fa438a63aee3ec6ebdb1
SHA512

bdd4f107fdff36b512318b0ba461c1f705a3661de60f3167207d3c6d33bf9d30454eae4c6ed01bfc3dce3227c3a1874cf3f2b821e6874d9fa840cbe07245dbd8
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXeuq2:NABL

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 20 IoCs

miner

resource	yara_rule
behavioral1/memory/2700-46-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	xmrig
behavioral1/memory/2720-50-0x000000013FAE0000-0x000000013FED2000-memory.dmp	xmrig
behavioral1/memory/2900-52-0x000000013F5A0000-0x000000013F992000-memory.dmp	xmrig
behavioral1/memory/2816-55-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	xmrig
behavioral1/memory/2764-54-0x000000013F870000-0x000000013FC62000-memory.dmp	xmrig
behavioral1/memory/2716-47-0x000000013F370000-0x000000013F762000-memory.dmp	xmrig
behavioral1/memory/2352-22-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	xmrig
behavioral1/memory/2648-126-0x000000013FCE0000-0x00000001400D2000-memory.dmp	xmrig
behavioral1/memory/2332-120-0x000000013F240000-0x000000013F632000-memory.dmp	xmrig
behavioral1/memory/2900-5218-0x000000013F5A0000-0x000000013F992000-memory.dmp	xmrig
behavioral1/memory/2816-5223-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	xmrig
behavioral1/memory/2700-5230-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	xmrig
behavioral1/memory/2720-5249-0x000000013FAE0000-0x000000013FED2000-memory.dmp	xmrig
behavioral1/memory/2352-5251-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	xmrig
behavioral1/memory/2716-5247-0x000000013F370000-0x000000013F762000-memory.dmp	xmrig
behavioral1/memory/2764-5217-0x000000013F870000-0x000000013FC62000-memory.dmp	xmrig
behavioral1/memory/2724-5291-0x000000013FC60000-0x0000000140052000-memory.dmp	xmrig
behavioral1/memory/2648-5298-0x000000013FCE0000-0x00000001400D2000-memory.dmp	xmrig
behavioral1/memory/2332-5297-0x000000013F240000-0x000000013F632000-memory.dmp	xmrig
behavioral1/memory/2536-5653-0x000000013F240000-0x000000013F632000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2412	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2352	SlgMAFM.exe
2900	LtAOjrN.exe
2700	yFasrHy.exe
2716	Ooppkhd.exe
2764	qUvpVsh.exe
2720	YQZtpgc.exe
2816	gLTyGHH.exe
2724	PySxMFr.exe
2648	UDJDEFi.exe
2332	tEXyPJl.exe
344	RNZGxvk.exe
2100	OMiRCJS.exe
2028	PsDLoSX.exe
2676	nIZoaTb.exe
1584	JLOFxLj.exe
2732	QdbvECd.exe
2060	hUyPSHW.exe
2160	JthvlPN.exe
1304	IIMJzGy.exe
2092	BvrdPJa.exe
1372	RcaeGJM.exe
1032	qLxWGnW.exe
1292	xfRVbxJ.exe
1908	FZFIAcZ.exe
2156	PXWOhNq.exe
920	uurYXKW.exe
2968	HHjNnew.exe
1000	VIuEfWf.exe
2260	MWrzBFw.exe
2088	ZzxzpWW.exe
376	KYDHGWU.exe
2448	BWXfJXz.exe
1796	GGgHAEZ.exe
868	RDTJgmE.exe
1520	cpRZxGQ.exe
1256	AimMgLJ.exe
2896	OlglLqo.exe
2744	mlbHcAt.exe
2344	iLhmRDe.exe
2796	WfuCIZZ.exe
2496	WCKArEa.exe
1468	IXlgTsm.exe
1628	qzEEFSz.exe
3020	SVDuMjN.exe
1676	JEpOcYk.exe
268	ArJGZfb.exe
1236	xBIJhOq.exe
2880	YbTGcxN.exe
2892	GfbJTmQ.exe
1948	nJozWLr.exe
3080	dsoARCY.exe
1224	WHNGrsE.exe
2960	JgRfWjX.exe
2384	XtaBgkB.exe
2964	alxXhLA.exe
3064	qbWYrCs.exe
2228	wgPVLMd.exe
2064	qxxBMim.exe
1084	gBdzMFF.exe
448	YZfwDWY.exe
716	xmfayep.exe
948	ovDZiHT.exe
1476	ACQQdOj.exe
2040	MoUFBaX.exe

Loads dropped DLL 64 IoCs

pid	Process
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe

UPX packed file 61 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2536-0-0x000000013F240000-0x000000013F632000-memory.dmp	upx
behavioral1/files/0x00070000000120fd-5.dat	upx
behavioral1/files/0x0006000000019249-16.dat	upx
behavioral1/files/0x000600000001925b-23.dat	upx
behavioral1/memory/2700-46-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	upx
behavioral1/memory/2720-50-0x000000013FAE0000-0x000000013FED2000-memory.dmp	upx
behavioral1/memory/2900-52-0x000000013F5A0000-0x000000013F992000-memory.dmp	upx
behavioral1/memory/2816-55-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	upx
behavioral1/files/0x0007000000019346-57.dat	upx
behavioral1/memory/2536-58-0x000000013FC60000-0x0000000140052000-memory.dmp	upx
behavioral1/files/0x0007000000019253-26.dat	upx
behavioral1/files/0x0007000000019246-25.dat	upx
behavioral1/memory/2764-54-0x000000013F870000-0x000000013FC62000-memory.dmp	upx
behavioral1/files/0x00080000000191fe-12.dat	upx
behavioral1/memory/2716-47-0x000000013F370000-0x000000013F762000-memory.dmp	upx
behavioral1/files/0x0006000000019272-40.dat	upx
behavioral1/memory/2352-22-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	upx
behavioral1/files/0x0015000000003717-63.dat	upx
behavioral1/files/0x000700000001994b-66.dat	upx
behavioral1/files/0x000500000001a4a3-109.dat	upx
behavioral1/files/0x000500000001a49c-99.dat	upx
behavioral1/files/0x000500000001a4c3-167.dat	upx
behavioral1/files/0x000500000001a4cd-183.dat	upx
behavioral1/files/0x000500000001a4c9-176.dat	upx
behavioral1/files/0x000500000001a4c5-169.dat	upx
behavioral1/files/0x000500000001a4c1-162.dat	upx
behavioral1/files/0x000500000001a4bc-155.dat	upx
behavioral1/files/0x000500000001a4b4-148.dat	upx
behavioral1/files/0x000500000001a4b1-141.dat	upx
behavioral1/files/0x000500000001a4a9-134.dat	upx
behavioral1/files/0x000500000001a487-129.dat	upx
behavioral1/memory/2648-126-0x000000013FCE0000-0x00000001400D2000-memory.dmp	upx
behavioral1/memory/2332-120-0x000000013F240000-0x000000013F632000-memory.dmp	upx
behavioral1/files/0x000500000001a4a5-112.dat	upx
behavioral1/files/0x000500000001a494-105.dat	upx
behavioral1/files/0x000500000001a48d-104.dat	upx
behavioral1/files/0x000500000001a489-103.dat	upx
behavioral1/files/0x000500000001a4a0-102.dat	upx
behavioral1/files/0x000500000001a498-96.dat	upx
behavioral1/files/0x000500000001a48f-88.dat	upx
behavioral1/files/0x000500000001a48a-82.dat	upx
behavioral1/files/0x000500000001a481-74.dat	upx
behavioral1/files/0x000500000001a4cf-186.dat	upx
behavioral1/files/0x000500000001a4cb-181.dat	upx
behavioral1/files/0x000500000001a4c7-174.dat	upx
behavioral1/files/0x000500000001a4be-160.dat	upx
behavioral1/files/0x000500000001a4ba-153.dat	upx
behavioral1/files/0x000500000001a4b2-146.dat	upx
behavioral1/files/0x000500000001a4af-139.dat	upx
behavioral1/files/0x000500000001a4a7-132.dat	upx
behavioral1/memory/2900-5218-0x000000013F5A0000-0x000000013F992000-memory.dmp	upx
behavioral1/memory/2816-5223-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	upx
behavioral1/memory/2700-5230-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	upx
behavioral1/memory/2720-5249-0x000000013FAE0000-0x000000013FED2000-memory.dmp	upx
behavioral1/memory/2352-5251-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	upx
behavioral1/memory/2716-5247-0x000000013F370000-0x000000013F762000-memory.dmp	upx
behavioral1/memory/2764-5217-0x000000013F870000-0x000000013FC62000-memory.dmp	upx
behavioral1/memory/2724-5291-0x000000013FC60000-0x0000000140052000-memory.dmp	upx
behavioral1/memory/2648-5298-0x000000013FCE0000-0x00000001400D2000-memory.dmp	upx
behavioral1/memory/2332-5297-0x000000013F240000-0x000000013F632000-memory.dmp	upx
behavioral1/memory/2536-5653-0x000000013F240000-0x000000013F632000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\aUlOnSb.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\SIqXcsu.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\ZezFuuN.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\hlNoeIk.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\StBNzrt.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\aOtjwGw.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\VLCCxoR.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\WWzxUpq.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\agFGcCz.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\yDKFjAS.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\kcJePMa.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\uTcUxvm.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\yuEnGvO.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\yyHbUqu.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\HwWhYwi.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\NoMsQrF.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\kFxAkpy.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\tjjfgJE.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\yobgZcI.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\YLUatjz.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\QuCFnse.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\rfrbxMN.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\mDVDwNr.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\JkaaPtQ.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\RKnmPSj.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\cugqbRR.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\tXEQpHl.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\AiWvHWM.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\AgzkagU.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\RYuGXqZ.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\NaSBJQW.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\qmGWqLw.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\DwqkGiV.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\nGGaOuT.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\GZIcYJk.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\pYWrSnC.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\NynHlGy.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\GvOcpzZ.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\pLWGTCy.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\eFTdmkP.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\gwHZJGK.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\lvRhhGt.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\bZEJsmY.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\DUIPPRS.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\sCxaIhZ.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\ezuedgy.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\dFhaceU.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\JHIXqjh.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\fnUoDdX.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\hvtFSzn.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\EjlvOvU.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\GAQbfff.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\tYNJMRP.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\qJeTDMx.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\BhCWvCl.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\OjwnzDp.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\gUmbnnN.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\SyjcQDi.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\sfXYngK.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\lqPTdfU.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\weXPDsy.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\tczMnup.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\aTMMRQD.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\GygrQTw.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2412	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
Token: SeDebugPrivilege	2412	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2412	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	31
PID 2536 wrote to memory of 2412	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	31
PID 2536 wrote to memory of 2412	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	31
PID 2536 wrote to memory of 2352	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	32
PID 2536 wrote to memory of 2352	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	32
PID 2536 wrote to memory of 2352	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	32
PID 2536 wrote to memory of 2900	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	33
PID 2536 wrote to memory of 2900	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	33
PID 2536 wrote to memory of 2900	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	33
PID 2536 wrote to memory of 2700	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	34
PID 2536 wrote to memory of 2700	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	34
PID 2536 wrote to memory of 2700	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	34
PID 2536 wrote to memory of 2720	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	35
PID 2536 wrote to memory of 2720	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	35
PID 2536 wrote to memory of 2720	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	35
PID 2536 wrote to memory of 2716	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	36
PID 2536 wrote to memory of 2716	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	36
PID 2536 wrote to memory of 2716	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	36
PID 2536 wrote to memory of 2816	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	37
PID 2536 wrote to memory of 2816	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	37
PID 2536 wrote to memory of 2816	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	37
PID 2536 wrote to memory of 2764	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	38
PID 2536 wrote to memory of 2764	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	38
PID 2536 wrote to memory of 2764	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	38
PID 2536 wrote to memory of 2724	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	39
PID 2536 wrote to memory of 2724	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	39
PID 2536 wrote to memory of 2724	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	39
PID 2536 wrote to memory of 2648	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	40
PID 2536 wrote to memory of 2648	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	40
PID 2536 wrote to memory of 2648	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	40
PID 2536 wrote to memory of 2732	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	41
PID 2536 wrote to memory of 2732	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	41
PID 2536 wrote to memory of 2732	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	41
PID 2536 wrote to memory of 2332	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	42
PID 2536 wrote to memory of 2332	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	42
PID 2536 wrote to memory of 2332	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	42
PID 2536 wrote to memory of 2060	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	43
PID 2536 wrote to memory of 2060	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	43
PID 2536 wrote to memory of 2060	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	43
PID 2536 wrote to memory of 344	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	44
PID 2536 wrote to memory of 344	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	44
PID 2536 wrote to memory of 344	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	44
PID 2536 wrote to memory of 1224	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	45
PID 2536 wrote to memory of 1224	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	45
PID 2536 wrote to memory of 1224	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	45
PID 2536 wrote to memory of 2100	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	46
PID 2536 wrote to memory of 2100	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	46
PID 2536 wrote to memory of 2100	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	46
PID 2536 wrote to memory of 2960	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	47
PID 2536 wrote to memory of 2960	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	47
PID 2536 wrote to memory of 2960	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	47
PID 2536 wrote to memory of 2028	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	48
PID 2536 wrote to memory of 2028	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	48
PID 2536 wrote to memory of 2028	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	48
PID 2536 wrote to memory of 2384	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	49
PID 2536 wrote to memory of 2384	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	49
PID 2536 wrote to memory of 2384	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	49
PID 2536 wrote to memory of 2676	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	50
PID 2536 wrote to memory of 2676	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	50
PID 2536 wrote to memory of 2676	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	50
PID 2536 wrote to memory of 2964	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	51
PID 2536 wrote to memory of 2964	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	51
PID 2536 wrote to memory of 2964	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	51
PID 2536 wrote to memory of 1584	2536	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	52

C:\Users\Admin\AppData\Local\Temp\0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2412
- C:\Windows\System\SlgMAFM.exe
  C:\Windows\System\SlgMAFM.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\LtAOjrN.exe
  C:\Windows\System\LtAOjrN.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\yFasrHy.exe
  C:\Windows\System\yFasrHy.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\YQZtpgc.exe
  C:\Windows\System\YQZtpgc.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\Ooppkhd.exe
  C:\Windows\System\Ooppkhd.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\gLTyGHH.exe
  C:\Windows\System\gLTyGHH.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\qUvpVsh.exe
  C:\Windows\System\qUvpVsh.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\PySxMFr.exe
  C:\Windows\System\PySxMFr.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\UDJDEFi.exe
  C:\Windows\System\UDJDEFi.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\QdbvECd.exe
  C:\Windows\System\QdbvECd.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\tEXyPJl.exe
  C:\Windows\System\tEXyPJl.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\hUyPSHW.exe
  C:\Windows\System\hUyPSHW.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\RNZGxvk.exe
  C:\Windows\System\RNZGxvk.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System\WHNGrsE.exe
  C:\Windows\System\WHNGrsE.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\OMiRCJS.exe
  C:\Windows\System\OMiRCJS.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\JgRfWjX.exe
  C:\Windows\System\JgRfWjX.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\PsDLoSX.exe
  C:\Windows\System\PsDLoSX.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\XtaBgkB.exe
  C:\Windows\System\XtaBgkB.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\nIZoaTb.exe
  C:\Windows\System\nIZoaTb.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\alxXhLA.exe
  C:\Windows\System\alxXhLA.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\JLOFxLj.exe
  C:\Windows\System\JLOFxLj.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\qbWYrCs.exe
  C:\Windows\System\qbWYrCs.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\JthvlPN.exe
  C:\Windows\System\JthvlPN.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\wgPVLMd.exe
  C:\Windows\System\wgPVLMd.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\IIMJzGy.exe
  C:\Windows\System\IIMJzGy.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\qxxBMim.exe
  C:\Windows\System\qxxBMim.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\BvrdPJa.exe
  C:\Windows\System\BvrdPJa.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\gBdzMFF.exe
  C:\Windows\System\gBdzMFF.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\RcaeGJM.exe
  C:\Windows\System\RcaeGJM.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\YZfwDWY.exe
  C:\Windows\System\YZfwDWY.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\qLxWGnW.exe
  C:\Windows\System\qLxWGnW.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\xmfayep.exe
  C:\Windows\System\xmfayep.exe
  2⤵
  - Executes dropped EXE
  PID:716
- C:\Windows\System\xfRVbxJ.exe
  C:\Windows\System\xfRVbxJ.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\ovDZiHT.exe
  C:\Windows\System\ovDZiHT.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\FZFIAcZ.exe
  C:\Windows\System\FZFIAcZ.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\ACQQdOj.exe
  C:\Windows\System\ACQQdOj.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\PXWOhNq.exe
  C:\Windows\System\PXWOhNq.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\MoUFBaX.exe
  C:\Windows\System\MoUFBaX.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\uurYXKW.exe
  C:\Windows\System\uurYXKW.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\TJZCiKU.exe
  C:\Windows\System\TJZCiKU.exe
  2⤵
  PID:1496
- C:\Windows\System\HHjNnew.exe
  C:\Windows\System\HHjNnew.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\gUmbnnN.exe
  C:\Windows\System\gUmbnnN.exe
  2⤵
  PID:1068
- C:\Windows\System\VIuEfWf.exe
  C:\Windows\System\VIuEfWf.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\LElofVm.exe
  C:\Windows\System\LElofVm.exe
  2⤵
  PID:1896
- C:\Windows\System\MWrzBFw.exe
  C:\Windows\System\MWrzBFw.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\RaQNwnP.exe
  C:\Windows\System\RaQNwnP.exe
  2⤵
  PID:2988
- C:\Windows\System\ZzxzpWW.exe
  C:\Windows\System\ZzxzpWW.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\TMtXndc.exe
  C:\Windows\System\TMtXndc.exe
  2⤵
  PID:596
- C:\Windows\System\KYDHGWU.exe
  C:\Windows\System\KYDHGWU.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\mMoGniW.exe
  C:\Windows\System\mMoGniW.exe
  2⤵
  PID:2016
- C:\Windows\System\BWXfJXz.exe
  C:\Windows\System\BWXfJXz.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\rYIeMys.exe
  C:\Windows\System\rYIeMys.exe
  2⤵
  PID:912
- C:\Windows\System\GGgHAEZ.exe
  C:\Windows\System\GGgHAEZ.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\DzquIhs.exe
  C:\Windows\System\DzquIhs.exe
  2⤵
  PID:1576
- C:\Windows\System\RDTJgmE.exe
  C:\Windows\System\RDTJgmE.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\OrAYBjp.exe
  C:\Windows\System\OrAYBjp.exe
  2⤵
  PID:1232
- C:\Windows\System\cpRZxGQ.exe
  C:\Windows\System\cpRZxGQ.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\RfAydXC.exe
  C:\Windows\System\RfAydXC.exe
  2⤵
  PID:1532
- C:\Windows\System\AimMgLJ.exe
  C:\Windows\System\AimMgLJ.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\ffgxBuM.exe
  C:\Windows\System\ffgxBuM.exe
  2⤵
  PID:892
- C:\Windows\System\OlglLqo.exe
  C:\Windows\System\OlglLqo.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\dsrnViJ.exe
  C:\Windows\System\dsrnViJ.exe
  2⤵
  PID:2752
- C:\Windows\System\mlbHcAt.exe
  C:\Windows\System\mlbHcAt.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\TtEwZtL.exe
  C:\Windows\System\TtEwZtL.exe
  2⤵
  PID:388
- C:\Windows\System\iLhmRDe.exe
  C:\Windows\System\iLhmRDe.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\vvQafak.exe
  C:\Windows\System\vvQafak.exe
  2⤵
  PID:2800
- C:\Windows\System\WfuCIZZ.exe
  C:\Windows\System\WfuCIZZ.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\RYuGXqZ.exe
  C:\Windows\System\RYuGXqZ.exe
  2⤵
  PID:2684
- C:\Windows\System\WCKArEa.exe
  C:\Windows\System\WCKArEa.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\PMIzqyf.exe
  C:\Windows\System\PMIzqyf.exe
  2⤵
  PID:1632
- C:\Windows\System\IXlgTsm.exe
  C:\Windows\System\IXlgTsm.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\nHEHoor.exe
  C:\Windows\System\nHEHoor.exe
  2⤵
  PID:776
- C:\Windows\System\qzEEFSz.exe
  C:\Windows\System\qzEEFSz.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\oKmCCGj.exe
  C:\Windows\System\oKmCCGj.exe
  2⤵
  PID:1028
- C:\Windows\System\SVDuMjN.exe
  C:\Windows\System\SVDuMjN.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\VRunaQU.exe
  C:\Windows\System\VRunaQU.exe
  2⤵
  PID:1804
- C:\Windows\System\JEpOcYk.exe
  C:\Windows\System\JEpOcYk.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\WxgpLNi.exe
  C:\Windows\System\WxgpLNi.exe
  2⤵
  PID:2292
- C:\Windows\System\ArJGZfb.exe
  C:\Windows\System\ArJGZfb.exe
  2⤵
  - Executes dropped EXE
  PID:268
- C:\Windows\System\YOKGgIR.exe
  C:\Windows\System\YOKGgIR.exe
  2⤵
  PID:3032
- C:\Windows\System\xBIJhOq.exe
  C:\Windows\System\xBIJhOq.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\NmbrkFg.exe
  C:\Windows\System\NmbrkFg.exe
  2⤵
  PID:3040
- C:\Windows\System\YbTGcxN.exe
  C:\Windows\System\YbTGcxN.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\AvovoKo.exe
  C:\Windows\System\AvovoKo.exe
  2⤵
  PID:2680
- C:\Windows\System\GfbJTmQ.exe
  C:\Windows\System\GfbJTmQ.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\UpTdScd.exe
  C:\Windows\System\UpTdScd.exe
  2⤵
  PID:1668
- C:\Windows\System\nJozWLr.exe
  C:\Windows\System\nJozWLr.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\XExFeJd.exe
  C:\Windows\System\XExFeJd.exe
  2⤵
  PID:2624
- C:\Windows\System\dsoARCY.exe
  C:\Windows\System\dsoARCY.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\qJeTDMx.exe
  C:\Windows\System\qJeTDMx.exe
  2⤵
  PID:3612
- C:\Windows\System\OYkqMBI.exe
  C:\Windows\System\OYkqMBI.exe
  2⤵
  PID:3636
- C:\Windows\System\IUjdoik.exe
  C:\Windows\System\IUjdoik.exe
  2⤵
  PID:3652
- C:\Windows\System\sWzJMUi.exe
  C:\Windows\System\sWzJMUi.exe
  2⤵
  PID:3668
- C:\Windows\System\cRahPiY.exe
  C:\Windows\System\cRahPiY.exe
  2⤵
  PID:3684
- C:\Windows\System\DWjEMTk.exe
  C:\Windows\System\DWjEMTk.exe
  2⤵
  PID:3700
- C:\Windows\System\qtLuybf.exe
  C:\Windows\System\qtLuybf.exe
  2⤵
  PID:3716
- C:\Windows\System\oXwicme.exe
  C:\Windows\System\oXwicme.exe
  2⤵
  PID:3732
- C:\Windows\System\cwdUbmh.exe
  C:\Windows\System\cwdUbmh.exe
  2⤵
  PID:3748
- C:\Windows\System\RejtGaQ.exe
  C:\Windows\System\RejtGaQ.exe
  2⤵
  PID:3764
- C:\Windows\System\gdrEPsn.exe
  C:\Windows\System\gdrEPsn.exe
  2⤵
  PID:3788
- C:\Windows\System\hakiLqR.exe
  C:\Windows\System\hakiLqR.exe
  2⤵
  PID:3804
- C:\Windows\System\jTLYBEP.exe
  C:\Windows\System\jTLYBEP.exe
  2⤵
  PID:3820
- C:\Windows\System\FpJzfjz.exe
  C:\Windows\System\FpJzfjz.exe
  2⤵
  PID:3836
- C:\Windows\System\rZRArtw.exe
  C:\Windows\System\rZRArtw.exe
  2⤵
  PID:3852
- C:\Windows\System\SDGUPsG.exe
  C:\Windows\System\SDGUPsG.exe
  2⤵
  PID:3880
- C:\Windows\System\iOiXlxl.exe
  C:\Windows\System\iOiXlxl.exe
  2⤵
  PID:3896
- C:\Windows\System\FGHiDGl.exe
  C:\Windows\System\FGHiDGl.exe
  2⤵
  PID:3912
- C:\Windows\System\BZmltnl.exe
  C:\Windows\System\BZmltnl.exe
  2⤵
  PID:3928
- C:\Windows\System\QguXhzd.exe
  C:\Windows\System\QguXhzd.exe
  2⤵
  PID:3944
- C:\Windows\System\eMXZltq.exe
  C:\Windows\System\eMXZltq.exe
  2⤵
  PID:3960
- C:\Windows\System\qEliZfq.exe
  C:\Windows\System\qEliZfq.exe
  2⤵
  PID:3976
- C:\Windows\System\kPfTkcY.exe
  C:\Windows\System\kPfTkcY.exe
  2⤵
  PID:3992
- C:\Windows\System\MQBMfRB.exe
  C:\Windows\System\MQBMfRB.exe
  2⤵
  PID:4008
- C:\Windows\System\RjfscDd.exe
  C:\Windows\System\RjfscDd.exe
  2⤵
  PID:4024
- C:\Windows\System\KQsVQld.exe
  C:\Windows\System\KQsVQld.exe
  2⤵
  PID:4040
- C:\Windows\System\oMhMDVS.exe
  C:\Windows\System\oMhMDVS.exe
  2⤵
  PID:4056
- C:\Windows\System\qGlhBur.exe
  C:\Windows\System\qGlhBur.exe
  2⤵
  PID:4072
- C:\Windows\System\dzIVQWA.exe
  C:\Windows\System\dzIVQWA.exe
  2⤵
  PID:1248
- C:\Windows\System\LvVaUTf.exe
  C:\Windows\System\LvVaUTf.exe
  2⤵
  PID:1744
- C:\Windows\System\hiFkufp.exe
  C:\Windows\System\hiFkufp.exe
  2⤵
  PID:1152
- C:\Windows\System\zqNdxPX.exe
  C:\Windows\System\zqNdxPX.exe
  2⤵
  PID:1972
- C:\Windows\System\LMyNjfj.exe
  C:\Windows\System\LMyNjfj.exe
  2⤵
  PID:2004
- C:\Windows\System\ocEWwtg.exe
  C:\Windows\System\ocEWwtg.exe
  2⤵
  PID:2296
- C:\Windows\System\MBtYTsU.exe
  C:\Windows\System\MBtYTsU.exe
  2⤵
  PID:2096
- C:\Windows\System\COXUSly.exe
  C:\Windows\System\COXUSly.exe
  2⤵
  PID:980
- C:\Windows\System\TzDRTjF.exe
  C:\Windows\System\TzDRTjF.exe
  2⤵
  PID:784
- C:\Windows\System\uufHfsy.exe
  C:\Windows\System\uufHfsy.exe
  2⤵
  PID:1444
- C:\Windows\System\TlwSFIb.exe
  C:\Windows\System\TlwSFIb.exe
  2⤵
  PID:2120
- C:\Windows\System\Apudemq.exe
  C:\Windows\System\Apudemq.exe
  2⤵
  PID:2660
- C:\Windows\System\zvOgieO.exe
  C:\Windows\System\zvOgieO.exe
  2⤵
  PID:3016
- C:\Windows\System\ervHHAk.exe
  C:\Windows\System\ervHHAk.exe
  2⤵
  PID:3112
- C:\Windows\System\ZoXoVvI.exe
  C:\Windows\System\ZoXoVvI.exe
  2⤵
  PID:3152
- C:\Windows\System\OucFFXj.exe
  C:\Windows\System\OucFFXj.exe
  2⤵
  PID:3164
- C:\Windows\System\tqkIHru.exe
  C:\Windows\System\tqkIHru.exe
  2⤵
  PID:3180
- C:\Windows\System\Ieulhns.exe
  C:\Windows\System\Ieulhns.exe
  2⤵
  PID:3196
- C:\Windows\System\jfEgTYa.exe
  C:\Windows\System\jfEgTYa.exe
  2⤵
  PID:3236
- C:\Windows\System\uKsHHAG.exe
  C:\Windows\System\uKsHHAG.exe
  2⤵
  PID:3252
- C:\Windows\System\EJzTYus.exe
  C:\Windows\System\EJzTYus.exe
  2⤵
  PID:3268
- C:\Windows\System\UYtaLtQ.exe
  C:\Windows\System\UYtaLtQ.exe
  2⤵
  PID:3284
- C:\Windows\System\ZrXNGnw.exe
  C:\Windows\System\ZrXNGnw.exe
  2⤵
  PID:3300
- C:\Windows\System\eGneMuN.exe
  C:\Windows\System\eGneMuN.exe
  2⤵
  PID:3316
- C:\Windows\System\xAOqTgW.exe
  C:\Windows\System\xAOqTgW.exe
  2⤵
  PID:3340
- C:\Windows\System\MiPwhPy.exe
  C:\Windows\System\MiPwhPy.exe
  2⤵
  PID:3356
- C:\Windows\System\UCYjxtv.exe
  C:\Windows\System\UCYjxtv.exe
  2⤵
  PID:3380
- C:\Windows\System\CPgIZYG.exe
  C:\Windows\System\CPgIZYG.exe
  2⤵
  PID:2544
- C:\Windows\System\UAJQayr.exe
  C:\Windows\System\UAJQayr.exe
  2⤵
  PID:2392
- C:\Windows\System\xYGIpzi.exe
  C:\Windows\System\xYGIpzi.exe
  2⤵
  PID:2736
- C:\Windows\System\saGHHzG.exe
  C:\Windows\System\saGHHzG.exe
  2⤵
  PID:2032
- C:\Windows\System\NEoEjyk.exe
  C:\Windows\System\NEoEjyk.exe
  2⤵
  PID:1768
- C:\Windows\System\RWLLuPI.exe
  C:\Windows\System\RWLLuPI.exe
  2⤵
  PID:1148
- C:\Windows\System\nlKhZJe.exe
  C:\Windows\System\nlKhZJe.exe
  2⤵
  PID:1552
- C:\Windows\System\SpttVte.exe
  C:\Windows\System\SpttVte.exe
  2⤵
  PID:1508
- C:\Windows\System\VFMUXMF.exe
  C:\Windows\System\VFMUXMF.exe
  2⤵
  PID:1868
- C:\Windows\System\WksAtSV.exe
  C:\Windows\System\WksAtSV.exe
  2⤵
  PID:3676
- C:\Windows\System\gmjFcOC.exe
  C:\Windows\System\gmjFcOC.exe
  2⤵
  PID:2052
- C:\Windows\System\DvsoopJ.exe
  C:\Windows\System\DvsoopJ.exe
  2⤵
  PID:2668
- C:\Windows\System\UCNTVTT.exe
  C:\Windows\System\UCNTVTT.exe
  2⤵
  PID:3632
- C:\Windows\System\KcNPHJx.exe
  C:\Windows\System\KcNPHJx.exe
  2⤵
  PID:3696
- C:\Windows\System\OdNyQCv.exe
  C:\Windows\System\OdNyQCv.exe
  2⤵
  PID:3760
- C:\Windows\System\ImcqOwl.exe
  C:\Windows\System\ImcqOwl.exe
  2⤵
  PID:3844
- C:\Windows\System\lrOjScZ.exe
  C:\Windows\System\lrOjScZ.exe
  2⤵
  PID:3796
- C:\Windows\System\cXuqPKX.exe
  C:\Windows\System\cXuqPKX.exe
  2⤵
  PID:3860
- C:\Windows\System\RyHqfFb.exe
  C:\Windows\System\RyHqfFb.exe
  2⤵
  PID:3952
- C:\Windows\System\nvpVSsJ.exe
  C:\Windows\System\nvpVSsJ.exe
  2⤵
  PID:3908
- C:\Windows\System\DHjdkPM.exe
  C:\Windows\System\DHjdkPM.exe
  2⤵
  PID:3968
- C:\Windows\System\MPtgKYU.exe
  C:\Windows\System\MPtgKYU.exe
  2⤵
  PID:4000
- C:\Windows\System\LcisDDS.exe
  C:\Windows\System\LcisDDS.exe
  2⤵
  PID:4052
- C:\Windows\System\zcsgPZX.exe
  C:\Windows\System\zcsgPZX.exe
  2⤵
  PID:4036
- C:\Windows\System\AKVPPbC.exe
  C:\Windows\System\AKVPPbC.exe
  2⤵
  PID:1952
- C:\Windows\System\xqEmCcY.exe
  C:\Windows\System\xqEmCcY.exe
  2⤵
  PID:2152
- C:\Windows\System\hOdbhLC.exe
  C:\Windows\System\hOdbhLC.exe
  2⤵
  PID:2696
- C:\Windows\System\dbefgAp.exe
  C:\Windows\System\dbefgAp.exe
  2⤵
  PID:2208
- C:\Windows\System\OlPuTml.exe
  C:\Windows\System\OlPuTml.exe
  2⤵
  PID:2300
- C:\Windows\System\HrxeYdv.exe
  C:\Windows\System\HrxeYdv.exe
  2⤵
  PID:2456
- C:\Windows\System\qRVjKCE.exe
  C:\Windows\System\qRVjKCE.exe
  2⤵
  PID:1920
- C:\Windows\System\nQRSdTs.exe
  C:\Windows\System\nQRSdTs.exe
  2⤵
  PID:1140
- C:\Windows\System\MAcCgfA.exe
  C:\Windows\System\MAcCgfA.exe
  2⤵
  PID:3160
- C:\Windows\System\wBEMgrQ.exe
  C:\Windows\System\wBEMgrQ.exe
  2⤵
  PID:1696
- C:\Windows\System\ckiDOqW.exe
  C:\Windows\System\ckiDOqW.exe
  2⤵
  PID:3176
- C:\Windows\System\QoNYbhL.exe
  C:\Windows\System\QoNYbhL.exe
  2⤵
  PID:3276
- C:\Windows\System\jJIKRPy.exe
  C:\Windows\System\jJIKRPy.exe
  2⤵
  PID:3308
- C:\Windows\System\cbDucYF.exe
  C:\Windows\System\cbDucYF.exe
  2⤵
  PID:3348
- C:\Windows\System\BTUQgab.exe
  C:\Windows\System\BTUQgab.exe
  2⤵
  PID:896
- C:\Windows\System\xDEoOTi.exe
  C:\Windows\System\xDEoOTi.exe
  2⤵
  PID:2524
- C:\Windows\System\wTtFKeM.exe
  C:\Windows\System\wTtFKeM.exe
  2⤵
  PID:2452
- C:\Windows\System\WYBQozF.exe
  C:\Windows\System\WYBQozF.exe
  2⤵
  PID:1924
- C:\Windows\System\ofcDQgQ.exe
  C:\Windows\System\ofcDQgQ.exe
  2⤵
  PID:2248
- C:\Windows\System\RwTkZkW.exe
  C:\Windows\System\RwTkZkW.exe
  2⤵
  PID:3644
- C:\Windows\System\fpYdMMb.exe
  C:\Windows\System\fpYdMMb.exe
  2⤵
  PID:572
- C:\Windows\System\fnKbFDc.exe
  C:\Windows\System\fnKbFDc.exe
  2⤵
  PID:3712
- C:\Windows\System\wPLIXFM.exe
  C:\Windows\System\wPLIXFM.exe
  2⤵
  PID:3692
- C:\Windows\System\LoHDwDe.exe
  C:\Windows\System\LoHDwDe.exe
  2⤵
  PID:3888
- C:\Windows\System\BjqhZIL.exe
  C:\Windows\System\BjqhZIL.exe
  2⤵
  PID:3924
- C:\Windows\System\zFthviI.exe
  C:\Windows\System\zFthviI.exe
  2⤵
  PID:2216
- C:\Windows\System\mSSrdWK.exe
  C:\Windows\System\mSSrdWK.exe
  2⤵
  PID:4020
- C:\Windows\System\jhHQkaV.exe
  C:\Windows\System\jhHQkaV.exe
  2⤵
  PID:692
- C:\Windows\System\KUgyJfH.exe
  C:\Windows\System\KUgyJfH.exe
  2⤵
  PID:2952
- C:\Windows\System\NcJnsCl.exe
  C:\Windows\System\NcJnsCl.exe
  2⤵
  PID:1996
- C:\Windows\System\PNTmvIP.exe
  C:\Windows\System\PNTmvIP.exe
  2⤵
  PID:4108
- C:\Windows\System\vwZwwDl.exe
  C:\Windows\System\vwZwwDl.exe
  2⤵
  PID:4124
- C:\Windows\System\RWDPqRa.exe
  C:\Windows\System\RWDPqRa.exe
  2⤵
  PID:4140
- C:\Windows\System\xeJQzSF.exe
  C:\Windows\System\xeJQzSF.exe
  2⤵
  PID:4156
- C:\Windows\System\rlEhRUv.exe
  C:\Windows\System\rlEhRUv.exe
  2⤵
  PID:4172
- C:\Windows\System\rpvMytp.exe
  C:\Windows\System\rpvMytp.exe
  2⤵
  PID:4188
- C:\Windows\System\ACCAAlZ.exe
  C:\Windows\System\ACCAAlZ.exe
  2⤵
  PID:4204
- C:\Windows\System\zikzMdQ.exe
  C:\Windows\System\zikzMdQ.exe
  2⤵
  PID:4220
- C:\Windows\System\ksdHuNj.exe
  C:\Windows\System\ksdHuNj.exe
  2⤵
  PID:4236
- C:\Windows\System\JojAceV.exe
  C:\Windows\System\JojAceV.exe
  2⤵
  PID:4252
- C:\Windows\System\COkZzII.exe
  C:\Windows\System\COkZzII.exe
  2⤵
  PID:4268
- C:\Windows\System\AlxAXvy.exe
  C:\Windows\System\AlxAXvy.exe
  2⤵
  PID:4284
- C:\Windows\System\fDfJpsI.exe
  C:\Windows\System\fDfJpsI.exe
  2⤵
  PID:4300
- C:\Windows\System\DYMFfbN.exe
  C:\Windows\System\DYMFfbN.exe
  2⤵
  PID:4316
- C:\Windows\System\MMIrOdN.exe
  C:\Windows\System\MMIrOdN.exe
  2⤵
  PID:4332
- C:\Windows\System\QEXGKJc.exe
  C:\Windows\System\QEXGKJc.exe
  2⤵
  PID:4348
- C:\Windows\System\CxYPPiQ.exe
  C:\Windows\System\CxYPPiQ.exe
  2⤵
  PID:4364
- C:\Windows\System\elCUSaF.exe
  C:\Windows\System\elCUSaF.exe
  2⤵
  PID:4380
- C:\Windows\System\oyAhmUO.exe
  C:\Windows\System\oyAhmUO.exe
  2⤵
  PID:4396
- C:\Windows\System\PggRVYD.exe
  C:\Windows\System\PggRVYD.exe
  2⤵
  PID:4412
- C:\Windows\System\zzwIfyH.exe
  C:\Windows\System\zzwIfyH.exe
  2⤵
  PID:4428
- C:\Windows\System\ZltQVKs.exe
  C:\Windows\System\ZltQVKs.exe
  2⤵
  PID:4444
- C:\Windows\System\pUZUQuE.exe
  C:\Windows\System\pUZUQuE.exe
  2⤵
  PID:4460
- C:\Windows\System\AUcxses.exe
  C:\Windows\System\AUcxses.exe
  2⤵
  PID:4476
- C:\Windows\System\YoTyAWw.exe
  C:\Windows\System\YoTyAWw.exe
  2⤵
  PID:4492
- C:\Windows\System\TiLUsdb.exe
  C:\Windows\System\TiLUsdb.exe
  2⤵
  PID:4508
- C:\Windows\System\JXYOZhB.exe
  C:\Windows\System\JXYOZhB.exe
  2⤵
  PID:4524
- C:\Windows\System\JIMfGaV.exe
  C:\Windows\System\JIMfGaV.exe
  2⤵
  PID:4540
- C:\Windows\System\OnwiiIt.exe
  C:\Windows\System\OnwiiIt.exe
  2⤵
  PID:4556
- C:\Windows\System\NijLdWY.exe
  C:\Windows\System\NijLdWY.exe
  2⤵
  PID:4572
- C:\Windows\System\LeXTEtq.exe
  C:\Windows\System\LeXTEtq.exe
  2⤵
  PID:4588
- C:\Windows\System\gvvhcim.exe
  C:\Windows\System\gvvhcim.exe
  2⤵
  PID:4604
- C:\Windows\System\cPziYlj.exe
  C:\Windows\System\cPziYlj.exe
  2⤵
  PID:4620
- C:\Windows\System\ssEguoy.exe
  C:\Windows\System\ssEguoy.exe
  2⤵
  PID:4636
- C:\Windows\System\oqAPQRL.exe
  C:\Windows\System\oqAPQRL.exe
  2⤵
  PID:4652
- C:\Windows\System\UILMdGn.exe
  C:\Windows\System\UILMdGn.exe
  2⤵
  PID:4668
- C:\Windows\System\qAtQPnr.exe
  C:\Windows\System\qAtQPnr.exe
  2⤵
  PID:4684
- C:\Windows\System\QpWzHaT.exe
  C:\Windows\System\QpWzHaT.exe
  2⤵
  PID:4700
- C:\Windows\System\UQFYgEt.exe
  C:\Windows\System\UQFYgEt.exe
  2⤵
  PID:4716
- C:\Windows\System\aRbgTnR.exe
  C:\Windows\System\aRbgTnR.exe
  2⤵
  PID:4732
- C:\Windows\System\RZNdrXQ.exe
  C:\Windows\System\RZNdrXQ.exe
  2⤵
  PID:4748
- C:\Windows\System\SXehHuH.exe
  C:\Windows\System\SXehHuH.exe
  2⤵
  PID:4764
- C:\Windows\System\fglleyp.exe
  C:\Windows\System\fglleyp.exe
  2⤵
  PID:4780
- C:\Windows\System\UMfMysy.exe
  C:\Windows\System\UMfMysy.exe
  2⤵
  PID:4796
- C:\Windows\System\OOOjTkH.exe
  C:\Windows\System\OOOjTkH.exe
  2⤵
  PID:4812
- C:\Windows\System\SdAgDIJ.exe
  C:\Windows\System\SdAgDIJ.exe
  2⤵
  PID:4828
- C:\Windows\System\AigKrMs.exe
  C:\Windows\System\AigKrMs.exe
  2⤵
  PID:4844
- C:\Windows\System\bzhzJJI.exe
  C:\Windows\System\bzhzJJI.exe
  2⤵
  PID:4860
- C:\Windows\System\FotPNUp.exe
  C:\Windows\System\FotPNUp.exe
  2⤵
  PID:4876
- C:\Windows\System\pWQaoIV.exe
  C:\Windows\System\pWQaoIV.exe
  2⤵
  PID:4892
- C:\Windows\System\YEFLPHv.exe
  C:\Windows\System\YEFLPHv.exe
  2⤵
  PID:4908
- C:\Windows\System\ZatOAUx.exe
  C:\Windows\System\ZatOAUx.exe
  2⤵
  PID:4924
- C:\Windows\System\tJdzWim.exe
  C:\Windows\System\tJdzWim.exe
  2⤵
  PID:4940
- C:\Windows\System\rzUwYeV.exe
  C:\Windows\System\rzUwYeV.exe
  2⤵
  PID:4956
- C:\Windows\System\QvDOQPX.exe
  C:\Windows\System\QvDOQPX.exe
  2⤵
  PID:4972
- C:\Windows\System\JStaABU.exe
  C:\Windows\System\JStaABU.exe
  2⤵
  PID:4988
- C:\Windows\System\JkaaPtQ.exe
  C:\Windows\System\JkaaPtQ.exe
  2⤵
  PID:5004
- C:\Windows\System\womfhXm.exe
  C:\Windows\System\womfhXm.exe
  2⤵
  PID:5020
- C:\Windows\System\ICGmTMa.exe
  C:\Windows\System\ICGmTMa.exe
  2⤵
  PID:5036
- C:\Windows\System\YRmOPqV.exe
  C:\Windows\System\YRmOPqV.exe
  2⤵
  PID:5052
- C:\Windows\System\oPeKWNM.exe
  C:\Windows\System\oPeKWNM.exe
  2⤵
  PID:5068
- C:\Windows\System\QKChQXn.exe
  C:\Windows\System\QKChQXn.exe
  2⤵
  PID:5084
- C:\Windows\System\ghZawKz.exe
  C:\Windows\System\ghZawKz.exe
  2⤵
  PID:5100
- C:\Windows\System\RthHSIf.exe
  C:\Windows\System\RthHSIf.exe
  2⤵
  PID:5116
- C:\Windows\System\FQoUqDN.exe
  C:\Windows\System\FQoUqDN.exe
  2⤵
  PID:2252
- C:\Windows\System\dgwjEDQ.exe
  C:\Windows\System\dgwjEDQ.exe
  2⤵
  PID:3156
- C:\Windows\System\iyJoVQI.exe
  C:\Windows\System\iyJoVQI.exe
  2⤵
  PID:3232
- C:\Windows\System\mpBXaqR.exe
  C:\Windows\System\mpBXaqR.exe
  2⤵
  PID:1888
- C:\Windows\System\igBDiWi.exe
  C:\Windows\System\igBDiWi.exe
  2⤵
  PID:3352
- C:\Windows\System\bbXsQYU.exe
  C:\Windows\System\bbXsQYU.exe
  2⤵
  PID:3324
- C:\Windows\System\WrXtOrt.exe
  C:\Windows\System\WrXtOrt.exe
  2⤵
  PID:1180
- C:\Windows\System\DNqatgn.exe
  C:\Windows\System\DNqatgn.exe
  2⤵
  PID:864
- C:\Windows\System\JsKEctJ.exe
  C:\Windows\System\JsKEctJ.exe
  2⤵
  PID:3744
- C:\Windows\System\mQhAWEi.exe
  C:\Windows\System\mQhAWEi.exe
  2⤵
  PID:3828
- C:\Windows\System\cEkWZTf.exe
  C:\Windows\System\cEkWZTf.exe
  2⤵
  PID:3940
- C:\Windows\System\wzeAWsY.exe
  C:\Windows\System\wzeAWsY.exe
  2⤵
  PID:2944
- C:\Windows\System\FImtneV.exe
  C:\Windows\System\FImtneV.exe
  2⤵
  PID:4104
- C:\Windows\System\pnSsMgq.exe
  C:\Windows\System\pnSsMgq.exe
  2⤵
  PID:4120
- C:\Windows\System\jeRYEFA.exe
  C:\Windows\System\jeRYEFA.exe
  2⤵
  PID:2704
- C:\Windows\System\GefWINS.exe
  C:\Windows\System\GefWINS.exe
  2⤵
  PID:4152
- C:\Windows\System\LCevXIf.exe
  C:\Windows\System\LCevXIf.exe
  2⤵
  PID:4180
- C:\Windows\System\eIGqhSd.exe
  C:\Windows\System\eIGqhSd.exe
  2⤵
  PID:4232
- C:\Windows\System\JzbftXe.exe
  C:\Windows\System\JzbftXe.exe
  2⤵
  PID:4248
- C:\Windows\System\JXRokiC.exe
  C:\Windows\System\JXRokiC.exe
  2⤵
  PID:4296
- C:\Windows\System\GmamMHb.exe
  C:\Windows\System\GmamMHb.exe
  2⤵
  PID:4276
- C:\Windows\System\VUCNzhU.exe
  C:\Windows\System\VUCNzhU.exe
  2⤵
  PID:4312
- C:\Windows\System\mBekRmh.exe
  C:\Windows\System\mBekRmh.exe
  2⤵
  PID:4344
- C:\Windows\System\MvDdWMN.exe
  C:\Windows\System\MvDdWMN.exe
  2⤵
  PID:4372
- C:\Windows\System\UPAqgBX.exe
  C:\Windows\System\UPAqgBX.exe
  2⤵
  PID:324
- C:\Windows\System\mvQupTs.exe
  C:\Windows\System\mvQupTs.exe
  2⤵
  PID:2044
- C:\Windows\System\AvySgQP.exe
  C:\Windows\System\AvySgQP.exe
  2⤵
  PID:4408
- C:\Windows\System\yooHjaC.exe
  C:\Windows\System\yooHjaC.exe
  2⤵
  PID:4484
- C:\Windows\System\IXIQsbL.exe
  C:\Windows\System\IXIQsbL.exe
  2⤵
  PID:4516
- C:\Windows\System\dkYqNal.exe
  C:\Windows\System\dkYqNal.exe
  2⤵
  PID:4552
- C:\Windows\System\eYGNeXM.exe
  C:\Windows\System\eYGNeXM.exe
  2⤵
  PID:4532
- C:\Windows\System\zztbyDn.exe
  C:\Windows\System\zztbyDn.exe
  2⤵
  PID:4616
- C:\Windows\System\jfrZeNF.exe
  C:\Windows\System\jfrZeNF.exe
  2⤵
  PID:4628
- C:\Windows\System\mHBDjUY.exe
  C:\Windows\System\mHBDjUY.exe
  2⤵
  PID:4660
- C:\Windows\System\beuNJdy.exe
  C:\Windows\System\beuNJdy.exe
  2⤵
  PID:4708
- C:\Windows\System\QEMRyAJ.exe
  C:\Windows\System\QEMRyAJ.exe
  2⤵
  PID:4740
- C:\Windows\System\TBHTDsM.exe
  C:\Windows\System\TBHTDsM.exe
  2⤵
  PID:4744
- C:\Windows\System\KjGgmLv.exe
  C:\Windows\System\KjGgmLv.exe
  2⤵
  PID:4776
- C:\Windows\System\SZBVXWg.exe
  C:\Windows\System\SZBVXWg.exe
  2⤵
  PID:4804
- C:\Windows\System\XgcAHMe.exe
  C:\Windows\System\XgcAHMe.exe
  2⤵
  PID:2860
- C:\Windows\System\qvggxKp.exe
  C:\Windows\System\qvggxKp.exe
  2⤵
  PID:4824
- C:\Windows\System\BMgSJyW.exe
  C:\Windows\System\BMgSJyW.exe
  2⤵
  PID:4884
- C:\Windows\System\Qxrdsrn.exe
  C:\Windows\System\Qxrdsrn.exe
  2⤵
  PID:2364
- C:\Windows\System\cyfvXWE.exe
  C:\Windows\System\cyfvXWE.exe
  2⤵
  PID:2936
- C:\Windows\System\FmsLnWA.exe
  C:\Windows\System\FmsLnWA.exe
  2⤵
  PID:2220
- C:\Windows\System\nGoioIk.exe
  C:\Windows\System\nGoioIk.exe
  2⤵
  PID:2976
- C:\Windows\System\aoqFICG.exe
  C:\Windows\System\aoqFICG.exe
  2⤵
  PID:1588
- C:\Windows\System\MrmSOYd.exe
  C:\Windows\System\MrmSOYd.exe
  2⤵
  PID:2672
- C:\Windows\System\YobfHPJ.exe
  C:\Windows\System\YobfHPJ.exe
  2⤵
  PID:4116
- C:\Windows\System\qPikVNN.exe
  C:\Windows\System\qPikVNN.exe
  2⤵
  PID:4216
- C:\Windows\System\PBMysLf.exe
  C:\Windows\System\PBMysLf.exe
  2⤵
  PID:1516
- C:\Windows\System\pJvDqAC.exe
  C:\Windows\System\pJvDqAC.exe
  2⤵
  PID:4388
- C:\Windows\System\uJkDaBd.exe
  C:\Windows\System\uJkDaBd.exe
  2⤵
  PID:4424
- C:\Windows\System\FyEaAui.exe
  C:\Windows\System\FyEaAui.exe
  2⤵
  PID:4520
- C:\Windows\System\VqvOPSE.exe
  C:\Windows\System\VqvOPSE.exe
  2⤵
  PID:2808
- C:\Windows\System\zGjfAdt.exe
  C:\Windows\System\zGjfAdt.exe
  2⤵
  PID:4632
- C:\Windows\System\BNJNkmq.exe
  C:\Windows\System\BNJNkmq.exe
  2⤵
  PID:2780
- C:\Windows\System\unsWtyR.exe
  C:\Windows\System\unsWtyR.exe
  2⤵
  PID:1556
- C:\Windows\System\SgtgnaP.exe
  C:\Windows\System\SgtgnaP.exe
  2⤵
  PID:1940
- C:\Windows\System\aodmtGC.exe
  C:\Windows\System\aodmtGC.exe
  2⤵
  PID:1376
- C:\Windows\System\iVMJRIi.exe
  C:\Windows\System\iVMJRIi.exe
  2⤵
  PID:4100
- C:\Windows\System\wqhDkuj.exe
  C:\Windows\System\wqhDkuj.exe
  2⤵
  PID:4212
- C:\Windows\System\aTdNqaD.exe
  C:\Windows\System\aTdNqaD.exe
  2⤵
  PID:2992
- C:\Windows\System\HLYQpjO.exe
  C:\Windows\System\HLYQpjO.exe
  2⤵
  PID:548
- C:\Windows\System\ljkkuUA.exe
  C:\Windows\System\ljkkuUA.exe
  2⤵
  PID:4500
- C:\Windows\System\TxAGbDm.exe
  C:\Windows\System\TxAGbDm.exe
  2⤵
  PID:4600
- C:\Windows\System\KaviJtQ.exe
  C:\Windows\System\KaviJtQ.exe
  2⤵
  PID:4728
- C:\Windows\System\AiHyzDW.exe
  C:\Windows\System\AiHyzDW.exe
  2⤵
  PID:4900
- C:\Windows\System\OGDUxVM.exe
  C:\Windows\System\OGDUxVM.exe
  2⤵
  PID:4936
- C:\Windows\System\ShGFGaU.exe
  C:\Windows\System\ShGFGaU.exe
  2⤵
  PID:4952
- C:\Windows\System\dLmuXRQ.exe
  C:\Windows\System\dLmuXRQ.exe
  2⤵
  PID:5032
- C:\Windows\System\CgvynCE.exe
  C:\Windows\System\CgvynCE.exe
  2⤵
  PID:4984
- C:\Windows\System\qjXdaDB.exe
  C:\Windows\System\qjXdaDB.exe
  2⤵
  PID:5044
- C:\Windows\System\DawLbFj.exe
  C:\Windows\System\DawLbFj.exe
  2⤵
  PID:2236
- C:\Windows\System\oKfBrzA.exe
  C:\Windows\System\oKfBrzA.exe
  2⤵
  PID:2336
- C:\Windows\System\BgxeERS.exe
  C:\Windows\System\BgxeERS.exe
  2⤵
  PID:2904
- C:\Windows\System\covtwwR.exe
  C:\Windows\System\covtwwR.exe
  2⤵
  PID:2688
- C:\Windows\System\xKvgFow.exe
  C:\Windows\System\xKvgFow.exe
  2⤵
  PID:5108
- C:\Windows\System\DKXtMEs.exe
  C:\Windows\System\DKXtMEs.exe
  2⤵
  PID:848
- C:\Windows\System\GgrfBzJ.exe
  C:\Windows\System\GgrfBzJ.exe
  2⤵
  PID:2488
- C:\Windows\System\ravkCFL.exe
  C:\Windows\System\ravkCFL.exe
  2⤵
  PID:2748
- C:\Windows\System\TcGTMPE.exe
  C:\Windows\System\TcGTMPE.exe
  2⤵
  PID:644
- C:\Windows\System\JMGfBvT.exe
  C:\Windows\System\JMGfBvT.exe
  2⤵
  PID:4756
- C:\Windows\System\LMMTKRY.exe
  C:\Windows\System\LMMTKRY.exe
  2⤵
  PID:4856
- C:\Windows\System\iPOHUYv.exe
  C:\Windows\System\iPOHUYv.exe
  2⤵
  PID:1244
- C:\Windows\System\gvKcNyu.exe
  C:\Windows\System\gvKcNyu.exe
  2⤵
  PID:1620
- C:\Windows\System\AvBUiZh.exe
  C:\Windows\System\AvBUiZh.exe
  2⤵
  PID:4468
- C:\Windows\System\GPBHMVE.exe
  C:\Windows\System\GPBHMVE.exe
  2⤵
  PID:4080
- C:\Windows\System\vulQWNk.exe
  C:\Windows\System\vulQWNk.exe
  2⤵
  PID:4420
- C:\Windows\System\erCrMol.exe
  C:\Windows\System\erCrMol.exe
  2⤵
  PID:2972
- C:\Windows\System\SYXKUhK.exe
  C:\Windows\System\SYXKUhK.exe
  2⤵
  PID:2204
- C:\Windows\System\stlKyyz.exe
  C:\Windows\System\stlKyyz.exe
  2⤵
  PID:4472
- C:\Windows\System\aRYqNys.exe
  C:\Windows\System\aRYqNys.exe
  2⤵
  PID:4996
- C:\Windows\System\YfFqRwE.exe
  C:\Windows\System\YfFqRwE.exe
  2⤵
  PID:5064
- C:\Windows\System\PrKdTIl.exe
  C:\Windows\System\PrKdTIl.exe
  2⤵
  PID:3068
- C:\Windows\System\kzyPtVw.exe
  C:\Windows\System\kzyPtVw.exe
  2⤵
  PID:4596
- C:\Windows\System\QCnVcbx.exe
  C:\Windows\System\QCnVcbx.exe
  2⤵
  PID:1144
- C:\Windows\System\UYdpXom.exe
  C:\Windows\System\UYdpXom.exe
  2⤵
  PID:4164
- C:\Windows\System\kfQQDfO.exe
  C:\Windows\System\kfQQDfO.exe
  2⤵
  PID:4868
- C:\Windows\System\ILKyHHj.exe
  C:\Windows\System\ILKyHHj.exe
  2⤵
  PID:5076
- C:\Windows\System\pXmGlRY.exe
  C:\Windows\System\pXmGlRY.exe
  2⤵
  PID:5080
- C:\Windows\System\fpVtSCE.exe
  C:\Windows\System\fpVtSCE.exe
  2⤵
  PID:1912
- C:\Windows\System\VcCNJln.exe
  C:\Windows\System\VcCNJln.exe
  2⤵
  PID:2180
- C:\Windows\System\Ubdcjiv.exe
  C:\Windows\System\Ubdcjiv.exe
  2⤵
  PID:2312
- C:\Windows\System\qEnIHfA.exe
  C:\Windows\System\qEnIHfA.exe
  2⤵
  PID:2612
- C:\Windows\System\dbkmNpx.exe
  C:\Windows\System\dbkmNpx.exe
  2⤵
  PID:2652
- C:\Windows\System\cdYeXjz.exe
  C:\Windows\System\cdYeXjz.exe
  2⤵
  PID:2124
- C:\Windows\System\GGZFuzi.exe
  C:\Windows\System\GGZFuzi.exe
  2⤵
  PID:1636
- C:\Windows\System\wVfetcM.exe
  C:\Windows\System\wVfetcM.exe
  2⤵
  PID:4308
- C:\Windows\System\KffgmjR.exe
  C:\Windows\System\KffgmjR.exe
  2⤵
  PID:3876
- C:\Windows\System\wFBgIIj.exe
  C:\Windows\System\wFBgIIj.exe
  2⤵
  PID:3172
- C:\Windows\System\ATEWdRz.exe
  C:\Windows\System\ATEWdRz.exe
  2⤵
  PID:5060
- C:\Windows\System\JgEdBxy.exe
  C:\Windows\System\JgEdBxy.exe
  2⤵
  PID:2956
- C:\Windows\System\DmOklKQ.exe
  C:\Windows\System\DmOklKQ.exe
  2⤵
  PID:5000
- C:\Windows\System\MSHOPwJ.exe
  C:\Windows\System\MSHOPwJ.exe
  2⤵
  PID:2644
- C:\Windows\System\ubjXLNN.exe
  C:\Windows\System\ubjXLNN.exe
  2⤵
  PID:2140
- C:\Windows\System\VjVtqsz.exe
  C:\Windows\System\VjVtqsz.exe
  2⤵
  PID:4456
- C:\Windows\System\JVcFwYt.exe
  C:\Windows\System\JVcFwYt.exe
  2⤵
  PID:1720
- C:\Windows\System\MkJxdCs.exe
  C:\Windows\System\MkJxdCs.exe
  2⤵
  PID:4788
- C:\Windows\System\vCxkJbg.exe
  C:\Windows\System\vCxkJbg.exe
  2⤵
  PID:4964
- C:\Windows\System\nKoKmWB.exe
  C:\Windows\System\nKoKmWB.exe
  2⤵
  PID:5136
- C:\Windows\System\cAHwwCY.exe
  C:\Windows\System\cAHwwCY.exe
  2⤵
  PID:5152
- C:\Windows\System\PXsgveJ.exe
  C:\Windows\System\PXsgveJ.exe
  2⤵
  PID:5168
- C:\Windows\System\QsxIOfr.exe
  C:\Windows\System\QsxIOfr.exe
  2⤵
  PID:5184
- C:\Windows\System\oSkWHbj.exe
  C:\Windows\System\oSkWHbj.exe
  2⤵
  PID:5204
- C:\Windows\System\STotoMR.exe
  C:\Windows\System\STotoMR.exe
  2⤵
  PID:5220
- C:\Windows\System\sMZHWCS.exe
  C:\Windows\System\sMZHWCS.exe
  2⤵
  PID:5236
- C:\Windows\System\DiLWMxK.exe
  C:\Windows\System\DiLWMxK.exe
  2⤵
  PID:5256
- C:\Windows\System\UHoVmLd.exe
  C:\Windows\System\UHoVmLd.exe
  2⤵
  PID:5292
- C:\Windows\System\tNObgTo.exe
  C:\Windows\System\tNObgTo.exe
  2⤵
  PID:5308
- C:\Windows\System\dLJeZsd.exe
  C:\Windows\System\dLJeZsd.exe
  2⤵
  PID:5324
- C:\Windows\System\HSKUqPp.exe
  C:\Windows\System\HSKUqPp.exe
  2⤵
  PID:5340
- C:\Windows\System\aVLQrAG.exe
  C:\Windows\System\aVLQrAG.exe
  2⤵
  PID:5356
- C:\Windows\System\kHmIMyy.exe
  C:\Windows\System\kHmIMyy.exe
  2⤵
  PID:5372
- C:\Windows\System\sdyKmQn.exe
  C:\Windows\System\sdyKmQn.exe
  2⤵
  PID:5388
- C:\Windows\System\sqYXydv.exe
  C:\Windows\System\sqYXydv.exe
  2⤵
  PID:5404
- C:\Windows\System\diUkpzX.exe
  C:\Windows\System\diUkpzX.exe
  2⤵
  PID:5420
- C:\Windows\System\evoxWzo.exe
  C:\Windows\System\evoxWzo.exe
  2⤵
  PID:5436
- C:\Windows\System\AJyNvez.exe
  C:\Windows\System\AJyNvez.exe
  2⤵
  PID:5452
- C:\Windows\System\qrGYZKE.exe
  C:\Windows\System\qrGYZKE.exe
  2⤵
  PID:5468
- C:\Windows\System\QhtnbKp.exe
  C:\Windows\System\QhtnbKp.exe
  2⤵
  PID:5484
- C:\Windows\System\YtQBXqk.exe
  C:\Windows\System\YtQBXqk.exe
  2⤵
  PID:5500
- C:\Windows\System\wgjFHgn.exe
  C:\Windows\System\wgjFHgn.exe
  2⤵
  PID:5516
- C:\Windows\System\xiilMLS.exe
  C:\Windows\System\xiilMLS.exe
  2⤵
  PID:5532
- C:\Windows\System\KPAKToh.exe
  C:\Windows\System\KPAKToh.exe
  2⤵
  PID:5548
- C:\Windows\System\RuJnwIz.exe
  C:\Windows\System\RuJnwIz.exe
  2⤵
  PID:5564
- C:\Windows\System\vqtIiOx.exe
  C:\Windows\System\vqtIiOx.exe
  2⤵
  PID:5580
- C:\Windows\System\evpRCzG.exe
  C:\Windows\System\evpRCzG.exe
  2⤵
  PID:5596
- C:\Windows\System\KyAmPlv.exe
  C:\Windows\System\KyAmPlv.exe
  2⤵
  PID:5612
- C:\Windows\System\JLOLPZp.exe
  C:\Windows\System\JLOLPZp.exe
  2⤵
  PID:5628
- C:\Windows\System\XQaeFZl.exe
  C:\Windows\System\XQaeFZl.exe
  2⤵
  PID:5644
- C:\Windows\System\HvzZrVU.exe
  C:\Windows\System\HvzZrVU.exe
  2⤵
  PID:5660
- C:\Windows\System\hlSrccS.exe
  C:\Windows\System\hlSrccS.exe
  2⤵
  PID:5676
- C:\Windows\System\rdWySOl.exe
  C:\Windows\System\rdWySOl.exe
  2⤵
  PID:5692
- C:\Windows\System\pcYhUgX.exe
  C:\Windows\System\pcYhUgX.exe
  2⤵
  PID:5708
- C:\Windows\System\LwEotjX.exe
  C:\Windows\System\LwEotjX.exe
  2⤵
  PID:5724
- C:\Windows\System\JprAoNZ.exe
  C:\Windows\System\JprAoNZ.exe
  2⤵
  PID:5740
- C:\Windows\System\RqSUmZd.exe
  C:\Windows\System\RqSUmZd.exe
  2⤵
  PID:5756
- C:\Windows\System\oRrBnaK.exe
  C:\Windows\System\oRrBnaK.exe
  2⤵
  PID:5772
- C:\Windows\System\wXPURKA.exe
  C:\Windows\System\wXPURKA.exe
  2⤵
  PID:5788
- C:\Windows\System\NyPGWwD.exe
  C:\Windows\System\NyPGWwD.exe
  2⤵
  PID:5804
- C:\Windows\System\DCFemEk.exe
  C:\Windows\System\DCFemEk.exe
  2⤵
  PID:5820
- C:\Windows\System\MjSIWvc.exe
  C:\Windows\System\MjSIWvc.exe
  2⤵
  PID:5836
- C:\Windows\System\xLGFWBV.exe
  C:\Windows\System\xLGFWBV.exe
  2⤵
  PID:5852
- C:\Windows\System\soXjmCE.exe
  C:\Windows\System\soXjmCE.exe
  2⤵
  PID:5868
- C:\Windows\System\mDgUTXX.exe
  C:\Windows\System\mDgUTXX.exe
  2⤵
  PID:5884
- C:\Windows\System\BVpEarq.exe
  C:\Windows\System\BVpEarq.exe
  2⤵
  PID:5900
- C:\Windows\System\miqVUPr.exe
  C:\Windows\System\miqVUPr.exe
  2⤵
  PID:5916
- C:\Windows\System\oFlNajU.exe
  C:\Windows\System\oFlNajU.exe
  2⤵
  PID:5932
- C:\Windows\System\GkBijFL.exe
  C:\Windows\System\GkBijFL.exe
  2⤵
  PID:5948
- C:\Windows\System\DqZgjkp.exe
  C:\Windows\System\DqZgjkp.exe
  2⤵
  PID:5964
- C:\Windows\System\nwUKAon.exe
  C:\Windows\System\nwUKAon.exe
  2⤵
  PID:5980
- C:\Windows\System\AJUgOKQ.exe
  C:\Windows\System\AJUgOKQ.exe
  2⤵
  PID:5996
- C:\Windows\System\BUpAowQ.exe
  C:\Windows\System\BUpAowQ.exe
  2⤵
  PID:6012
- C:\Windows\System\fdmlKmw.exe
  C:\Windows\System\fdmlKmw.exe
  2⤵
  PID:6028
- C:\Windows\System\WrZXDYr.exe
  C:\Windows\System\WrZXDYr.exe
  2⤵
  PID:6044
- C:\Windows\System\pxkvgtp.exe
  C:\Windows\System\pxkvgtp.exe
  2⤵
  PID:6060
- C:\Windows\System\xQnAzHC.exe
  C:\Windows\System\xQnAzHC.exe
  2⤵
  PID:6076
- C:\Windows\System\nHlneEA.exe
  C:\Windows\System\nHlneEA.exe
  2⤵
  PID:6092
- C:\Windows\System\bzoXbNN.exe
  C:\Windows\System\bzoXbNN.exe
  2⤵
  PID:6108
- C:\Windows\System\nLvnbvt.exe
  C:\Windows\System\nLvnbvt.exe
  2⤵
  PID:6124
- C:\Windows\System\IosmtVF.exe
  C:\Windows\System\IosmtVF.exe
  2⤵
  PID:6140
- C:\Windows\System\vXYDdir.exe
  C:\Windows\System\vXYDdir.exe
  2⤵
  PID:5148
- C:\Windows\System\RSyLGHd.exe
  C:\Windows\System\RSyLGHd.exe
  2⤵
  PID:2840
- C:\Windows\System\JfqrgQW.exe
  C:\Windows\System\JfqrgQW.exe
  2⤵
  PID:1732
- C:\Windows\System\vbQGJSy.exe
  C:\Windows\System\vbQGJSy.exe
  2⤵
  PID:5164
- C:\Windows\System\SNfAgsB.exe
  C:\Windows\System\SNfAgsB.exe
  2⤵
  PID:5244
- C:\Windows\System\HbPWGLn.exe
  C:\Windows\System\HbPWGLn.exe
  2⤵
  PID:5228
- C:\Windows\System\zRFbziI.exe
  C:\Windows\System\zRFbziI.exe
  2⤵
  PID:5288
- C:\Windows\System\Dwrdynw.exe
  C:\Windows\System\Dwrdynw.exe
  2⤵
  PID:5336
- C:\Windows\System\oGgUBtJ.exe
  C:\Windows\System\oGgUBtJ.exe
  2⤵
  PID:5320
- C:\Windows\System\CIiVApt.exe
  C:\Windows\System\CIiVApt.exe
  2⤵
  PID:5352
- C:\Windows\System\OLQGgNv.exe
  C:\Windows\System\OLQGgNv.exe
  2⤵
  PID:5432
- C:\Windows\System\gjGQsfh.exe
  C:\Windows\System\gjGQsfh.exe
  2⤵
  PID:5496
- C:\Windows\System\iXWWCto.exe
  C:\Windows\System\iXWWCto.exe
  2⤵
  PID:5560
- C:\Windows\System\CPbRlwt.exe
  C:\Windows\System\CPbRlwt.exe
  2⤵
  PID:5480
- C:\Windows\System\fLVwDrk.exe
  C:\Windows\System\fLVwDrk.exe
  2⤵
  PID:5444
- C:\Windows\System\UhUrHYW.exe
  C:\Windows\System\UhUrHYW.exe
  2⤵
  PID:5540
- C:\Windows\System\omAJgaJ.exe
  C:\Windows\System\omAJgaJ.exe
  2⤵
  PID:5624
- C:\Windows\System\QpYBhnD.exe
  C:\Windows\System\QpYBhnD.exe
  2⤵
  PID:5688
- C:\Windows\System\DZMTQKy.exe
  C:\Windows\System\DZMTQKy.exe
  2⤵
  PID:5752
- C:\Windows\System\RJmusRA.exe
  C:\Windows\System\RJmusRA.exe
  2⤵
  PID:5816
- C:\Windows\System\SfcpXDb.exe
  C:\Windows\System\SfcpXDb.exe
  2⤵
  PID:5672
- C:\Windows\System\BsYtwYJ.exe
  C:\Windows\System\BsYtwYJ.exe
  2⤵
  PID:5880
- C:\Windows\System\QNAERxN.exe
  C:\Windows\System\QNAERxN.exe
  2⤵
  PID:5908
- C:\Windows\System\tAwAVmK.exe
  C:\Windows\System\tAwAVmK.exe
  2⤵
  PID:5972
- C:\Windows\System\CoxcBwS.exe
  C:\Windows\System\CoxcBwS.exe
  2⤵
  PID:5732
- C:\Windows\System\jIglLJJ.exe
  C:\Windows\System\jIglLJJ.exe
  2⤵
  PID:5976
- C:\Windows\System\bTFdcRJ.exe
  C:\Windows\System\bTFdcRJ.exe
  2⤵
  PID:5828
- C:\Windows\System\vbNuQpt.exe
  C:\Windows\System\vbNuQpt.exe
  2⤵
  PID:6036
- C:\Windows\System\IXbFjDK.exe
  C:\Windows\System\IXbFjDK.exe
  2⤵
  PID:5992
- C:\Windows\System\dYnWxyb.exe
  C:\Windows\System\dYnWxyb.exe
  2⤵
  PID:6040
- C:\Windows\System\ETTqQaT.exe
  C:\Windows\System\ETTqQaT.exe
  2⤵
  PID:6136
- C:\Windows\System\JGWEzfy.exe
  C:\Windows\System\JGWEzfy.exe
  2⤵
  PID:4840
- C:\Windows\System\mCUEKAM.exe
  C:\Windows\System\mCUEKAM.exe
  2⤵
  PID:5176
- C:\Windows\System\vjsMyuR.exe
  C:\Windows\System\vjsMyuR.exe
  2⤵
  PID:5160
- C:\Windows\System\yZGvKpR.exe
  C:\Windows\System\yZGvKpR.exe
  2⤵
  PID:5332
- C:\Windows\System\UxYBKQx.exe
  C:\Windows\System\UxYBKQx.exe
  2⤵
  PID:6116
- C:\Windows\System\QFIgeBe.exe
  C:\Windows\System\QFIgeBe.exe
  2⤵
  PID:3004
- C:\Windows\System\yKhWern.exe
  C:\Windows\System\yKhWern.exe
  2⤵
  PID:5412
- C:\Windows\System\cLnoZYO.exe
  C:\Windows\System\cLnoZYO.exe
  2⤵
  PID:5212
- C:\Windows\System\WlCqszv.exe
  C:\Windows\System\WlCqszv.exe
  2⤵
  PID:5508
- C:\Windows\System\tUTspYL.exe
  C:\Windows\System\tUTspYL.exe
  2⤵
  PID:5384
- C:\Windows\System\ePElVht.exe
  C:\Windows\System\ePElVht.exe
  2⤵
  PID:5656
- C:\Windows\System\staxiKG.exe
  C:\Windows\System\staxiKG.exe
  2⤵
  PID:5812
- C:\Windows\System\qHYqvgd.exe
  C:\Windows\System\qHYqvgd.exe
  2⤵
  PID:5912
- C:\Windows\System\vPjZaNc.exe
  C:\Windows\System\vPjZaNc.exe
  2⤵
  PID:5636
- C:\Windows\System\riwQTEO.exe
  C:\Windows\System\riwQTEO.exe
  2⤵
  PID:5720
- C:\Windows\System\juSEufP.exe
  C:\Windows\System\juSEufP.exe
  2⤵
  PID:5928
- C:\Windows\System\opmMJaX.exe
  C:\Windows\System\opmMJaX.exe
  2⤵
  PID:5956
- C:\Windows\System\tMuXRWg.exe
  C:\Windows\System\tMuXRWg.exe
  2⤵
  PID:5896
- C:\Windows\System\oZaEluI.exe
  C:\Windows\System\oZaEluI.exe
  2⤵
  PID:3296
- C:\Windows\System\hHPHigy.exe
  C:\Windows\System\hHPHigy.exe
  2⤵
  PID:6024
- C:\Windows\System\LQQBANV.exe
  C:\Windows\System\LQQBANV.exe
  2⤵
  PID:5556
- C:\Windows\System\wOdcroI.exe
  C:\Windows\System\wOdcroI.exe
  2⤵
  PID:5576
- C:\Windows\System\uwVHRCE.exe
  C:\Windows\System\uwVHRCE.exe
  2⤵
  PID:5400
- C:\Windows\System\NsOlNVs.exe
  C:\Windows\System\NsOlNVs.exe
  2⤵
  PID:6008
- C:\Windows\System\pZDlDXw.exe
  C:\Windows\System\pZDlDXw.exe
  2⤵
  PID:5784
- C:\Windows\System\DSBafoc.exe
  C:\Windows\System\DSBafoc.exe
  2⤵
  PID:6020
- C:\Windows\System\TPRpbqJ.exe
  C:\Windows\System\TPRpbqJ.exe
  2⤵
  PID:5704
- C:\Windows\System\MWtvMTp.exe
  C:\Windows\System\MWtvMTp.exe
  2⤵
  PID:5748
- C:\Windows\System\YfmrsgM.exe
  C:\Windows\System\YfmrsgM.exe
  2⤵
  PID:6132
- C:\Windows\System\iFXSViW.exe
  C:\Windows\System\iFXSViW.exe
  2⤵
  PID:6160
- C:\Windows\System\FJvNNKE.exe
  C:\Windows\System\FJvNNKE.exe
  2⤵
  PID:6176
- C:\Windows\System\bFLjgye.exe
  C:\Windows\System\bFLjgye.exe
  2⤵
  PID:6192
- C:\Windows\System\dQrLPjz.exe
  C:\Windows\System\dQrLPjz.exe
  2⤵
  PID:6208
- C:\Windows\System\SFWsIRP.exe
  C:\Windows\System\SFWsIRP.exe
  2⤵
  PID:6224
- C:\Windows\System\uaojnlQ.exe
  C:\Windows\System\uaojnlQ.exe
  2⤵
  PID:6240
- C:\Windows\System\MhsKHsA.exe
  C:\Windows\System\MhsKHsA.exe
  2⤵
  PID:6256
- C:\Windows\System\SAyCdxs.exe
  C:\Windows\System\SAyCdxs.exe
  2⤵
  PID:6272
- C:\Windows\System\sYZONoX.exe
  C:\Windows\System\sYZONoX.exe
  2⤵
  PID:6288
- C:\Windows\System\nrnvsQP.exe
  C:\Windows\System\nrnvsQP.exe
  2⤵
  PID:6304
- C:\Windows\System\jTcvmus.exe
  C:\Windows\System\jTcvmus.exe
  2⤵
  PID:6320
- C:\Windows\System\qJNHwVV.exe
  C:\Windows\System\qJNHwVV.exe
  2⤵
  PID:6336
- C:\Windows\System\cLcQrFP.exe
  C:\Windows\System\cLcQrFP.exe
  2⤵
  PID:6352
- C:\Windows\System\IeIBsWF.exe
  C:\Windows\System\IeIBsWF.exe
  2⤵
  PID:6368
- C:\Windows\System\yWXVpIf.exe
  C:\Windows\System\yWXVpIf.exe
  2⤵
  PID:6384
- C:\Windows\System\MLbHCXn.exe
  C:\Windows\System\MLbHCXn.exe
  2⤵
  PID:6400
- C:\Windows\System\mMjsIYh.exe
  C:\Windows\System\mMjsIYh.exe
  2⤵
  PID:6416
- C:\Windows\System\qfRNCpE.exe
  C:\Windows\System\qfRNCpE.exe
  2⤵
  PID:6432
- C:\Windows\System\EihqzCF.exe
  C:\Windows\System\EihqzCF.exe
  2⤵
  PID:6448
- C:\Windows\System\fcTknUr.exe
  C:\Windows\System\fcTknUr.exe
  2⤵
  PID:6464
- C:\Windows\System\tgjjYdH.exe
  C:\Windows\System\tgjjYdH.exe
  2⤵
  PID:6480
- C:\Windows\System\LNMcVXt.exe
  C:\Windows\System\LNMcVXt.exe
  2⤵
  PID:6496
- C:\Windows\System\HFYAYmb.exe
  C:\Windows\System\HFYAYmb.exe
  2⤵
  PID:6512
- C:\Windows\System\IOiKROY.exe
  C:\Windows\System\IOiKROY.exe
  2⤵
  PID:6528
- C:\Windows\System\qeLrvxB.exe
  C:\Windows\System\qeLrvxB.exe
  2⤵
  PID:6544
- C:\Windows\System\jcYMKty.exe
  C:\Windows\System\jcYMKty.exe
  2⤵
  PID:6560
- C:\Windows\System\ZzqxGLV.exe
  C:\Windows\System\ZzqxGLV.exe
  2⤵
  PID:6576
- C:\Windows\System\BTwrIMN.exe
  C:\Windows\System\BTwrIMN.exe
  2⤵
  PID:6592
- C:\Windows\System\AeRyBEc.exe
  C:\Windows\System\AeRyBEc.exe
  2⤵
  PID:6608
- C:\Windows\System\nTXevax.exe
  C:\Windows\System\nTXevax.exe
  2⤵
  PID:6624
- C:\Windows\System\HYdxKcy.exe
  C:\Windows\System\HYdxKcy.exe
  2⤵
  PID:6640
- C:\Windows\System\GFTpGmH.exe
  C:\Windows\System\GFTpGmH.exe
  2⤵
  PID:6656
- C:\Windows\System\kFdIJNY.exe
  C:\Windows\System\kFdIJNY.exe
  2⤵
  PID:6672
- C:\Windows\System\JfXavlY.exe
  C:\Windows\System\JfXavlY.exe
  2⤵
  PID:6688
- C:\Windows\System\dmAYwDe.exe
  C:\Windows\System\dmAYwDe.exe
  2⤵
  PID:6704
- C:\Windows\System\gdpurmR.exe
  C:\Windows\System\gdpurmR.exe
  2⤵
  PID:6720
- C:\Windows\System\qDIsXEX.exe
  C:\Windows\System\qDIsXEX.exe
  2⤵
  PID:6736
- C:\Windows\System\eDtBaNt.exe
  C:\Windows\System\eDtBaNt.exe
  2⤵
  PID:6752
- C:\Windows\System\ZoWkFQn.exe
  C:\Windows\System\ZoWkFQn.exe
  2⤵
  PID:6768
- C:\Windows\System\OznfWCZ.exe
  C:\Windows\System\OznfWCZ.exe
  2⤵
  PID:6784
- C:\Windows\System\NOlYPtS.exe
  C:\Windows\System\NOlYPtS.exe
  2⤵
  PID:6800
- C:\Windows\System\uuDDpQj.exe
  C:\Windows\System\uuDDpQj.exe
  2⤵
  PID:6816
- C:\Windows\System\AYBfKYW.exe
  C:\Windows\System\AYBfKYW.exe
  2⤵
  PID:6832
- C:\Windows\System\sgWOigm.exe
  C:\Windows\System\sgWOigm.exe
  2⤵
  PID:6848
- C:\Windows\System\jSceOCv.exe
  C:\Windows\System\jSceOCv.exe
  2⤵
  PID:6864
- C:\Windows\System\jsEMeyw.exe
  C:\Windows\System\jsEMeyw.exe
  2⤵
  PID:6880
- C:\Windows\System\dlxQGbG.exe
  C:\Windows\System\dlxQGbG.exe
  2⤵
  PID:6896
- C:\Windows\System\ybsNnkC.exe
  C:\Windows\System\ybsNnkC.exe
  2⤵
  PID:6912
- C:\Windows\System\cAHraqF.exe
  C:\Windows\System\cAHraqF.exe
  2⤵
  PID:6928
- C:\Windows\System\xjzSTfH.exe
  C:\Windows\System\xjzSTfH.exe
  2⤵
  PID:6944
- C:\Windows\System\nDCcZga.exe
  C:\Windows\System\nDCcZga.exe
  2⤵
  PID:6960
- C:\Windows\System\IodtDTN.exe
  C:\Windows\System\IodtDTN.exe
  2⤵
  PID:6976
- C:\Windows\System\aRUoXNC.exe
  C:\Windows\System\aRUoXNC.exe
  2⤵
  PID:6992
- C:\Windows\System\YkeQEPL.exe
  C:\Windows\System\YkeQEPL.exe
  2⤵
  PID:7008
- C:\Windows\System\lINTSEu.exe
  C:\Windows\System\lINTSEu.exe
  2⤵
  PID:7024
- C:\Windows\System\hmkLARj.exe
  C:\Windows\System\hmkLARj.exe
  2⤵
  PID:7040
- C:\Windows\System\czZIQGs.exe
  C:\Windows\System\czZIQGs.exe
  2⤵
  PID:7060
- C:\Windows\System\lOcKMfl.exe
  C:\Windows\System\lOcKMfl.exe
  2⤵
  PID:7076
- C:\Windows\System\mxyhbLH.exe
  C:\Windows\System\mxyhbLH.exe
  2⤵
  PID:7092
- C:\Windows\System\hqpDmIK.exe
  C:\Windows\System\hqpDmIK.exe
  2⤵
  PID:7108
- C:\Windows\System\bFNFqeV.exe
  C:\Windows\System\bFNFqeV.exe
  2⤵
  PID:7128
- C:\Windows\System\PoBILZE.exe
  C:\Windows\System\PoBILZE.exe
  2⤵
  PID:7144
- C:\Windows\System\BflMUXP.exe
  C:\Windows\System\BflMUXP.exe
  2⤵
  PID:7160
- C:\Windows\System\XtnZTRe.exe
  C:\Windows\System\XtnZTRe.exe
  2⤵
  PID:2708
- C:\Windows\System\ryJRVOM.exe
  C:\Windows\System\ryJRVOM.exe
  2⤵
  PID:5876
- C:\Windows\System\bicrejn.exe
  C:\Windows\System\bicrejn.exe
  2⤵
  PID:6268
- C:\Windows\System\fRNPzlr.exe
  C:\Windows\System\fRNPzlr.exe
  2⤵
  PID:5492
- C:\Windows\System\VPvNVoT.exe
  C:\Windows\System\VPvNVoT.exe
  2⤵
  PID:6328
- C:\Windows\System\SFcYmFC.exe
  C:\Windows\System\SFcYmFC.exe
  2⤵
  PID:6392
- C:\Windows\System\iqYwOGA.exe
  C:\Windows\System\iqYwOGA.exe
  2⤵
  PID:6252
- C:\Windows\System\CjyNSCw.exe
  C:\Windows\System\CjyNSCw.exe
  2⤵
  PID:5572
- C:\Windows\System\qXmeUFd.exe
  C:\Windows\System\qXmeUFd.exe
  2⤵
  PID:6428
- C:\Windows\System\UbPdbPS.exe
  C:\Windows\System\UbPdbPS.exe
  2⤵
  PID:6520
- C:\Windows\System\vicvFoy.exe
  C:\Windows\System\vicvFoy.exe
  2⤵
  PID:5768
- C:\Windows\System\DGBCwpQ.exe
  C:\Windows\System\DGBCwpQ.exe
  2⤵
  PID:6188
- C:\Windows\System\snLdSQv.exe
  C:\Windows\System\snLdSQv.exe
  2⤵
  PID:6344
- C:\Windows\System\QyCQHqy.exe
  C:\Windows\System\QyCQHqy.exe
  2⤵
  PID:6408
- C:\Windows\System\ABKraqS.exe
  C:\Windows\System\ABKraqS.exe
  2⤵
  PID:6444
- C:\Windows\System\hOShLWQ.exe
  C:\Windows\System\hOShLWQ.exe
  2⤵
  PID:6556
- C:\Windows\System\ltGyfTD.exe
  C:\Windows\System\ltGyfTD.exe
  2⤵
  PID:6620
- C:\Windows\System\ZQsPGyn.exe
  C:\Windows\System\ZQsPGyn.exe
  2⤵
  PID:6652
- C:\Windows\System\TRpVlSr.exe
  C:\Windows\System\TRpVlSr.exe
  2⤵
  PID:6712
- C:\Windows\System\DMKkAte.exe
  C:\Windows\System\DMKkAte.exe
  2⤵
  PID:6664
- C:\Windows\System\xOcdASy.exe
  C:\Windows\System\xOcdASy.exe
  2⤵
  PID:6696
- C:\Windows\System\uoRwsEF.exe
  C:\Windows\System\uoRwsEF.exe
  2⤵
  PID:6780
- C:\Windows\System\ocgIFpJ.exe
  C:\Windows\System\ocgIFpJ.exe
  2⤵
  PID:6700
- C:\Windows\System\OxHWBxK.exe
  C:\Windows\System\OxHWBxK.exe
  2⤵
  PID:6764
- C:\Windows\System\xsryQBb.exe
  C:\Windows\System\xsryQBb.exe
  2⤵
  PID:6840
- C:\Windows\System\BVYWsWV.exe
  C:\Windows\System\BVYWsWV.exe
  2⤵
  PID:6904
- C:\Windows\System\LRZXPLa.exe
  C:\Windows\System\LRZXPLa.exe
  2⤵
  PID:6968
- C:\Windows\System\fbRhpRM.exe
  C:\Windows\System\fbRhpRM.exe
  2⤵
  PID:6824
- C:\Windows\System\ESgIIQm.exe
  C:\Windows\System\ESgIIQm.exe
  2⤵
  PID:7000
- C:\Windows\System\SrSnrIe.exe
  C:\Windows\System\SrSnrIe.exe
  2⤵
  PID:6924
- C:\Windows\System\qJJzPQj.exe
  C:\Windows\System\qJJzPQj.exe
  2⤵
  PID:7016
- C:\Windows\System\xZQPYZZ.exe
  C:\Windows\System\xZQPYZZ.exe
  2⤵
  PID:7020
- C:\Windows\System\SqyvTkB.exe
  C:\Windows\System\SqyvTkB.exe
  2⤵
  PID:7048
- C:\Windows\System\mSLczWL.exe
  C:\Windows\System\mSLczWL.exe
  2⤵
  PID:7084
- C:\Windows\System\OxYNfAJ.exe
  C:\Windows\System\OxYNfAJ.exe
  2⤵
  PID:5796
- C:\Windows\System\snOdSwp.exe
  C:\Windows\System\snOdSwp.exe
  2⤵
  PID:6104
- C:\Windows\System\hFIFPAh.exe
  C:\Windows\System\hFIFPAh.exe
  2⤵
  PID:5608
- C:\Windows\System\rmqUpsa.exe
  C:\Windows\System\rmqUpsa.exe
  2⤵
  PID:7152
- C:\Windows\System\vnyKfrN.exe
  C:\Windows\System\vnyKfrN.exe
  2⤵
  PID:6284
- C:\Windows\System\GMRaBxp.exe
  C:\Windows\System\GMRaBxp.exe
  2⤵
  PID:6588
- C:\Windows\System\sDvhzgA.exe
  C:\Windows\System\sDvhzgA.exe
  2⤵
  PID:6200
- C:\Windows\System\RzQReWw.exe
  C:\Windows\System\RzQReWw.exe
  2⤵
  PID:6236
- C:\Windows\System\mszioxS.exe
  C:\Windows\System\mszioxS.exe
  2⤵
  PID:6492
- C:\Windows\System\xakShDG.exe
  C:\Windows\System\xakShDG.exe
  2⤵
  PID:6540
- C:\Windows\System\ygWXRDD.exe
  C:\Windows\System\ygWXRDD.exe
  2⤵
  PID:6508
- C:\Windows\System\yqWzBMf.exe
  C:\Windows\System\yqWzBMf.exe
  2⤵
  PID:6796
- C:\Windows\System\jEEoLZw.exe
  C:\Windows\System\jEEoLZw.exe
  2⤵
  PID:6760
- C:\Windows\System\ZxMtSOZ.exe
  C:\Windows\System\ZxMtSOZ.exe
  2⤵
  PID:6744
- C:\Windows\System\TwqrFAX.exe
  C:\Windows\System\TwqrFAX.exe
  2⤵
  PID:6604
- C:\Windows\System\sVUeyYw.exe
  C:\Windows\System\sVUeyYw.exe
  2⤵
  PID:7088
- C:\Windows\System\AuMraCX.exe
  C:\Windows\System\AuMraCX.exe
  2⤵
  PID:6988
- C:\Windows\System\EqYcqJR.exe
  C:\Windows\System\EqYcqJR.exe
  2⤵
  PID:6424
- C:\Windows\System\TyywCiF.exe
  C:\Windows\System\TyywCiF.exe
  2⤵
  PID:6472
- C:\Windows\System\MBIZbos.exe
  C:\Windows\System\MBIZbos.exe
  2⤵
  PID:6172
- C:\Windows\System\DEyZmCb.exe
  C:\Windows\System\DEyZmCb.exe
  2⤵
  PID:6376
- C:\Windows\System\vGavvJP.exe
  C:\Windows\System\vGavvJP.exe
  2⤵
  PID:6504
- C:\Windows\System\stiIHVE.exe
  C:\Windows\System\stiIHVE.exe
  2⤵
  PID:6936
- C:\Windows\System\ecFeRWj.exe
  C:\Windows\System\ecFeRWj.exe
  2⤵
  PID:6184
- C:\Windows\System\hPUpyRJ.exe
  C:\Windows\System\hPUpyRJ.exe
  2⤵
  PID:6952
- C:\Windows\System\wIEcgWi.exe
  C:\Windows\System\wIEcgWi.exe
  2⤵
  PID:6860
- C:\Windows\System\nDPiefK.exe
  C:\Windows\System\nDPiefK.exe
  2⤵
  PID:7104
- C:\Windows\System\YvzYokE.exe
  C:\Windows\System\YvzYokE.exe
  2⤵
  PID:7068
- C:\Windows\System\twxAzLh.exe
  C:\Windows\System\twxAzLh.exe
  2⤵
  PID:6440
- C:\Windows\System\ZEweEZP.exe
  C:\Windows\System\ZEweEZP.exe
  2⤵
  PID:7140
- C:\Windows\System\zlRCZaQ.exe
  C:\Windows\System\zlRCZaQ.exe
  2⤵
  PID:6888
- C:\Windows\System\qYGKSgJ.exe
  C:\Windows\System\qYGKSgJ.exe
  2⤵
  PID:6460
- C:\Windows\System\WomHuoB.exe
  C:\Windows\System\WomHuoB.exe
  2⤵
  PID:7176
- C:\Windows\System\UkASNcb.exe
  C:\Windows\System\UkASNcb.exe
  2⤵
  PID:7192
- C:\Windows\System\sjFFobY.exe
  C:\Windows\System\sjFFobY.exe
  2⤵
  PID:7208
- C:\Windows\System\nXVACFM.exe
  C:\Windows\System\nXVACFM.exe
  2⤵
  PID:7224
- C:\Windows\System\ETFWlcW.exe
  C:\Windows\System\ETFWlcW.exe
  2⤵
  PID:7240
- C:\Windows\System\zwTqeWC.exe
  C:\Windows\System\zwTqeWC.exe
  2⤵
  PID:7256
- C:\Windows\System\HUbhJtK.exe
  C:\Windows\System\HUbhJtK.exe
  2⤵
  PID:7272
- C:\Windows\System\oyklGjX.exe
  C:\Windows\System\oyklGjX.exe
  2⤵
  PID:7288
- C:\Windows\System\UriXBty.exe
  C:\Windows\System\UriXBty.exe
  2⤵
  PID:7304
- C:\Windows\System\cvXAMpI.exe
  C:\Windows\System\cvXAMpI.exe
  2⤵
  PID:7320
- C:\Windows\System\VQwkCGz.exe
  C:\Windows\System\VQwkCGz.exe
  2⤵
  PID:7336
- C:\Windows\System\RjZKheb.exe
  C:\Windows\System\RjZKheb.exe
  2⤵
  PID:7352
- C:\Windows\System\bnkZrhR.exe
  C:\Windows\System\bnkZrhR.exe
  2⤵
  PID:7368
- C:\Windows\System\emIHuan.exe
  C:\Windows\System\emIHuan.exe
  2⤵
  PID:7384
- C:\Windows\System\eCToXvo.exe
  C:\Windows\System\eCToXvo.exe
  2⤵
  PID:7400
- C:\Windows\System\ClcCBlG.exe
  C:\Windows\System\ClcCBlG.exe
  2⤵
  PID:7416
- C:\Windows\System\YJrHPDx.exe
  C:\Windows\System\YJrHPDx.exe
  2⤵
  PID:7432
- C:\Windows\System\WcEwRUy.exe
  C:\Windows\System\WcEwRUy.exe
  2⤵
  PID:7448
- C:\Windows\System\RNGktmz.exe
  C:\Windows\System\RNGktmz.exe
  2⤵
  PID:7464
- C:\Windows\System\IHjYKbj.exe
  C:\Windows\System\IHjYKbj.exe
  2⤵
  PID:7480
- C:\Windows\System\wXfKjNy.exe
  C:\Windows\System\wXfKjNy.exe
  2⤵
  PID:7496
- C:\Windows\System\jsmxaSu.exe
  C:\Windows\System\jsmxaSu.exe
  2⤵
  PID:7512
- C:\Windows\System\elCIpba.exe
  C:\Windows\System\elCIpba.exe
  2⤵
  PID:7528
- C:\Windows\System\LAOXity.exe
  C:\Windows\System\LAOXity.exe
  2⤵
  PID:7544
- C:\Windows\System\zkslqtG.exe
  C:\Windows\System\zkslqtG.exe
  2⤵
  PID:7560
- C:\Windows\System\NtdQrQG.exe
  C:\Windows\System\NtdQrQG.exe
  2⤵
  PID:7576
- C:\Windows\System\hFnOhCE.exe
  C:\Windows\System\hFnOhCE.exe
  2⤵
  PID:7592
- C:\Windows\System\SVAMdhs.exe
  C:\Windows\System\SVAMdhs.exe
  2⤵
  PID:7608
- C:\Windows\System\IEKWYlL.exe
  C:\Windows\System\IEKWYlL.exe
  2⤵
  PID:7624
- C:\Windows\System\quYZsAW.exe
  C:\Windows\System\quYZsAW.exe
  2⤵
  PID:7640
- C:\Windows\System\aRrfuli.exe
  C:\Windows\System\aRrfuli.exe
  2⤵
  PID:7656
- C:\Windows\System\zsUhGGY.exe
  C:\Windows\System\zsUhGGY.exe
  2⤵
  PID:7672
- C:\Windows\System\bEjPeDN.exe
  C:\Windows\System\bEjPeDN.exe
  2⤵
  PID:7688
- C:\Windows\System\DHaKLFX.exe
  C:\Windows\System\DHaKLFX.exe
  2⤵
  PID:7704
- C:\Windows\System\dAWRIUn.exe
  C:\Windows\System\dAWRIUn.exe
  2⤵
  PID:7720
- C:\Windows\System\gHdLjQc.exe
  C:\Windows\System\gHdLjQc.exe
  2⤵
  PID:7736
- C:\Windows\System\WsCBofs.exe
  C:\Windows\System\WsCBofs.exe
  2⤵
  PID:7752
- C:\Windows\System\KEMOhZO.exe
  C:\Windows\System\KEMOhZO.exe
  2⤵
  PID:7768
- C:\Windows\System\DCalICj.exe
  C:\Windows\System\DCalICj.exe
  2⤵
  PID:7784
- C:\Windows\System\cwoEVWA.exe
  C:\Windows\System\cwoEVWA.exe
  2⤵
  PID:7800
- C:\Windows\System\QUpFtJd.exe
  C:\Windows\System\QUpFtJd.exe
  2⤵
  PID:7816
- C:\Windows\System\WOVDGfG.exe
  C:\Windows\System\WOVDGfG.exe
  2⤵
  PID:7832
- C:\Windows\System\KbtJQXy.exe
  C:\Windows\System\KbtJQXy.exe
  2⤵
  PID:7848
- C:\Windows\System\egefnfu.exe
  C:\Windows\System\egefnfu.exe
  2⤵
  PID:7864
- C:\Windows\System\dpzRKmG.exe
  C:\Windows\System\dpzRKmG.exe
  2⤵
  PID:7880
- C:\Windows\System\oxmzUSd.exe
  C:\Windows\System\oxmzUSd.exe
  2⤵
  PID:7896
- C:\Windows\System\EHRJadD.exe
  C:\Windows\System\EHRJadD.exe
  2⤵
  PID:7912
- C:\Windows\System\zVkPUpp.exe
  C:\Windows\System\zVkPUpp.exe
  2⤵
  PID:7928
- C:\Windows\System\jvuHsBw.exe
  C:\Windows\System\jvuHsBw.exe
  2⤵
  PID:7944
- C:\Windows\System\hPfCBHP.exe
  C:\Windows\System\hPfCBHP.exe
  2⤵
  PID:7960
- C:\Windows\System\pBUrJDu.exe
  C:\Windows\System\pBUrJDu.exe
  2⤵
  PID:7976
- C:\Windows\System\SHmtiXx.exe
  C:\Windows\System\SHmtiXx.exe
  2⤵
  PID:7992
- C:\Windows\System\ETdPinN.exe
  C:\Windows\System\ETdPinN.exe
  2⤵
  PID:8008
- C:\Windows\System\wYLFxBm.exe
  C:\Windows\System\wYLFxBm.exe
  2⤵
  PID:8024
- C:\Windows\System\LzGEwVV.exe
  C:\Windows\System\LzGEwVV.exe
  2⤵
  PID:8040
- C:\Windows\System\UJMhnQX.exe
  C:\Windows\System\UJMhnQX.exe
  2⤵
  PID:8056
- C:\Windows\System\dtqqvzx.exe
  C:\Windows\System\dtqqvzx.exe
  2⤵
  PID:8072
- C:\Windows\System\mpArDcM.exe
  C:\Windows\System\mpArDcM.exe
  2⤵
  PID:8088
- C:\Windows\System\HRciHNT.exe
  C:\Windows\System\HRciHNT.exe
  2⤵
  PID:8104
- C:\Windows\System\WDSGdGM.exe
  C:\Windows\System\WDSGdGM.exe
  2⤵
  PID:8120
- C:\Windows\System\WdIZlKv.exe
  C:\Windows\System\WdIZlKv.exe
  2⤵
  PID:8136
- C:\Windows\System\HlrVeGo.exe
  C:\Windows\System\HlrVeGo.exe
  2⤵
  PID:8152
- C:\Windows\System\cvgSict.exe
  C:\Windows\System\cvgSict.exe
  2⤵
  PID:8172
- C:\Windows\System\huvLQsb.exe
  C:\Windows\System\huvLQsb.exe
  2⤵
  PID:8188
- C:\Windows\System\eVqnktn.exe
  C:\Windows\System\eVqnktn.exe
  2⤵
  PID:7204
- C:\Windows\System\hUNURoD.exe
  C:\Windows\System\hUNURoD.exe
  2⤵
  PID:7116
- C:\Windows\System\pWXVEEm.exe
  C:\Windows\System\pWXVEEm.exe
  2⤵
  PID:6876
- C:\Windows\System\pPzmxJK.exe
  C:\Windows\System\pPzmxJK.exe
  2⤵
  PID:7328
- C:\Windows\System\FLByghV.exe
  C:\Windows\System\FLByghV.exe
  2⤵
  PID:7052
- C:\Windows\System\jeIgDhJ.exe
  C:\Windows\System\jeIgDhJ.exe
  2⤵
  PID:7220
- C:\Windows\System\sUDmJCr.exe
  C:\Windows\System\sUDmJCr.exe
  2⤵
  PID:7316
- C:\Windows\System\JxOmZmp.exe
  C:\Windows\System\JxOmZmp.exe
  2⤵
  PID:7348
- C:\Windows\System\piLlfOw.exe
  C:\Windows\System\piLlfOw.exe
  2⤵
  PID:7396
- C:\Windows\System\CrTlTNf.exe
  C:\Windows\System\CrTlTNf.exe
  2⤵
  PID:7408
- C:\Windows\System\YJRNVid.exe
  C:\Windows\System\YJRNVid.exe
  2⤵
  PID:7488
- C:\Windows\System\DaWUXSJ.exe
  C:\Windows\System\DaWUXSJ.exe
  2⤵
  PID:7444
- C:\Windows\System\BqNJGVu.exe
  C:\Windows\System\BqNJGVu.exe
  2⤵
  PID:7556
- C:\Windows\System\jSeBeoQ.exe
  C:\Windows\System\jSeBeoQ.exe
  2⤵
  PID:7620
- C:\Windows\System\XkZJNEg.exe
  C:\Windows\System\XkZJNEg.exe
  2⤵
  PID:7652
- C:\Windows\System\mKgXFDg.exe
  C:\Windows\System\mKgXFDg.exe
  2⤵
  PID:7712
- C:\Windows\System\uPWhUsj.exe
  C:\Windows\System\uPWhUsj.exe
  2⤵
  PID:7540
- C:\Windows\System\VqYIEgK.exe
  C:\Windows\System\VqYIEgK.exe
  2⤵
  PID:7776
- C:\Windows\System\sgfguVN.exe
  C:\Windows\System\sgfguVN.exe
  2⤵
  PID:7840
- C:\Windows\System\bgADKCE.exe
  C:\Windows\System\bgADKCE.exe
  2⤵
  PID:7600
- C:\Windows\System\XHmUQDg.exe
  C:\Windows\System\XHmUQDg.exe
  2⤵
  PID:7696
- C:\Windows\System\swltwRM.exe
  C:\Windows\System\swltwRM.exe
  2⤵
  PID:7796
- C:\Windows\System\TETmChd.exe
  C:\Windows\System\TETmChd.exe
  2⤵
  PID:7876
- C:\Windows\System\gbnERXx.exe
  C:\Windows\System\gbnERXx.exe
  2⤵
  PID:7940
- C:\Windows\System\fWpzgbm.exe
  C:\Windows\System\fWpzgbm.exe
  2⤵
  PID:7924
- C:\Windows\System\MJXmsvM.exe
  C:\Windows\System\MJXmsvM.exe
  2⤵
  PID:7920
- C:\Windows\System\htOYqPo.exe
  C:\Windows\System\htOYqPo.exe
  2⤵
  PID:8004
- C:\Windows\System\WiZfhVZ.exe
  C:\Windows\System\WiZfhVZ.exe
  2⤵
  PID:8020
- C:\Windows\System\UXXiGYU.exe
  C:\Windows\System\UXXiGYU.exe
  2⤵
  PID:8068
- C:\Windows\System\aTnNrag.exe
  C:\Windows\System\aTnNrag.exe
  2⤵
  PID:8100
- C:\Windows\System\fCRTQSv.exe
  C:\Windows\System\fCRTQSv.exe
  2⤵
  PID:8160
- C:\Windows\System\XuUjmbf.exe
  C:\Windows\System\XuUjmbf.exe
  2⤵
  PID:8112
- C:\Windows\System\hGkwTep.exe
  C:\Windows\System\hGkwTep.exe
  2⤵
  PID:7332
- C:\Windows\System\uIwprvZ.exe
  C:\Windows\System\uIwprvZ.exe
  2⤵
  PID:7392
- C:\Windows\System\YAImKqC.exe
  C:\Windows\System\YAImKqC.exe
  2⤵
  PID:8144
- C:\Windows\System\yDKFjAS.exe
  C:\Windows\System\yDKFjAS.exe
  2⤵
  PID:7236
- C:\Windows\System\hYmpSoo.exe
  C:\Windows\System\hYmpSoo.exe
  2⤵
  PID:7184
- C:\Windows\System\pknueao.exe
  C:\Windows\System\pknueao.exe
  2⤵
  PID:7552
- C:\Windows\System\vGCpjIq.exe
  C:\Windows\System\vGCpjIq.exe
  2⤵
  PID:7456
- C:\Windows\System\RluTUPJ.exe
  C:\Windows\System\RluTUPJ.exe
  2⤵
  PID:7504
- C:\Windows\System\lyEHsqs.exe
  C:\Windows\System\lyEHsqs.exe
  2⤵
  PID:7812
- C:\Windows\System\cVEMXqV.exe
  C:\Windows\System\cVEMXqV.exe
  2⤵
  PID:7508
- C:\Windows\System\oPYQlCv.exe
  C:\Windows\System\oPYQlCv.exe
  2⤵
  PID:7572
- C:\Windows\System\mFkmExC.exe
  C:\Windows\System\mFkmExC.exe
  2⤵
  PID:7872
- C:\Windows\System\ieGMkxy.exe
  C:\Windows\System\ieGMkxy.exe
  2⤵
  PID:7972
- C:\Windows\System\SxwKtpu.exe
  C:\Windows\System\SxwKtpu.exe
  2⤵
  PID:7860
- C:\Windows\System\epmJeBq.exe
  C:\Windows\System\epmJeBq.exe
  2⤵
  PID:8128
- C:\Windows\System\kKokuUj.exe
  C:\Windows\System\kKokuUj.exe
  2⤵
  PID:7936
- C:\Windows\System\jyWSQwz.exe
  C:\Windows\System\jyWSQwz.exe
  2⤵
  PID:7988
- C:\Windows\System\OiUXAAd.exe
  C:\Windows\System\OiUXAAd.exe
  2⤵
  PID:7268
- C:\Windows\System\hYRvdbh.exe
  C:\Windows\System\hYRvdbh.exe
  2⤵
  PID:7460
- C:\Windows\System\xalAgOO.exe
  C:\Windows\System\xalAgOO.exe
  2⤵
  PID:7300
- C:\Windows\System\YzAmqeg.exe
  C:\Windows\System\YzAmqeg.exe
  2⤵
  PID:7524
- C:\Windows\System\rKIrPrC.exe
  C:\Windows\System\rKIrPrC.exe
  2⤵
  PID:7744
- C:\Windows\System\HzQXoWS.exe
  C:\Windows\System\HzQXoWS.exe
  2⤵
  PID:7728
- C:\Windows\System\TSrdehN.exe
  C:\Windows\System\TSrdehN.exe
  2⤵
  PID:7472
- C:\Windows\System\eyWnyRU.exe
  C:\Windows\System\eyWnyRU.exe
  2⤵
  PID:7216
- C:\Windows\System\RQJUNXS.exe
  C:\Windows\System\RQJUNXS.exe
  2⤵
  PID:7684
- C:\Windows\System\zqxUgYu.exe
  C:\Windows\System\zqxUgYu.exe
  2⤵
  PID:8184
- C:\Windows\System\gYsrINL.exe
  C:\Windows\System\gYsrINL.exe
  2⤵
  PID:7568
- C:\Windows\System\uOfAvoL.exe
  C:\Windows\System\uOfAvoL.exe
  2⤵
  PID:7908
- C:\Windows\System\ACGJAQf.exe
  C:\Windows\System\ACGJAQf.exe
  2⤵
  PID:8048
- C:\Windows\System\pnqKNpd.exe
  C:\Windows\System\pnqKNpd.exe
  2⤵
  PID:8248
- C:\Windows\System\NoUWGaW.exe
  C:\Windows\System\NoUWGaW.exe
  2⤵
  PID:8264
- C:\Windows\System\ezsWcyl.exe
  C:\Windows\System\ezsWcyl.exe
  2⤵
  PID:8280
- C:\Windows\System\PjbpcrL.exe
  C:\Windows\System\PjbpcrL.exe
  2⤵
  PID:8296
- C:\Windows\System\JShPYzT.exe
  C:\Windows\System\JShPYzT.exe
  2⤵
  PID:8312
- C:\Windows\System\TaeIyus.exe
  C:\Windows\System\TaeIyus.exe
  2⤵
  PID:8328
- C:\Windows\System\lEFepcW.exe
  C:\Windows\System\lEFepcW.exe
  2⤵
  PID:8344
- C:\Windows\System\hYwLYhC.exe
  C:\Windows\System\hYwLYhC.exe
  2⤵
  PID:8360
- C:\Windows\System\upsTbiA.exe
  C:\Windows\System\upsTbiA.exe
  2⤵
  PID:8376
- C:\Windows\System\SUuQdPJ.exe
  C:\Windows\System\SUuQdPJ.exe
  2⤵
  PID:8392
- C:\Windows\System\QvlTAjn.exe
  C:\Windows\System\QvlTAjn.exe
  2⤵
  PID:8408
- C:\Windows\System\gpchdQy.exe
  C:\Windows\System\gpchdQy.exe
  2⤵
  PID:8424
- C:\Windows\System\KfWvuUo.exe
  C:\Windows\System\KfWvuUo.exe
  2⤵
  PID:8444
- C:\Windows\System\hQINzfu.exe
  C:\Windows\System\hQINzfu.exe
  2⤵
  PID:8476
- C:\Windows\System\NFSaxnB.exe
  C:\Windows\System\NFSaxnB.exe
  2⤵
  PID:8492
- C:\Windows\System\BnYEGIL.exe
  C:\Windows\System\BnYEGIL.exe
  2⤵
  PID:8508
- C:\Windows\System\qNsVmcj.exe
  C:\Windows\System\qNsVmcj.exe
  2⤵
  PID:8528
- C:\Windows\System\ZHXhBnj.exe
  C:\Windows\System\ZHXhBnj.exe
  2⤵
  PID:8544
- C:\Windows\System\EHTWLVl.exe
  C:\Windows\System\EHTWLVl.exe
  2⤵
  PID:8560
- C:\Windows\System\ZvubFbG.exe
  C:\Windows\System\ZvubFbG.exe
  2⤵
  PID:8576
- C:\Windows\System\KGwddlk.exe
  C:\Windows\System\KGwddlk.exe
  2⤵
  PID:8596
- C:\Windows\System\uPaeNyk.exe
  C:\Windows\System\uPaeNyk.exe
  2⤵
  PID:8620
- C:\Windows\System\wqlQbAt.exe
  C:\Windows\System\wqlQbAt.exe
  2⤵
  PID:8648
- C:\Windows\System\qoUXiCz.exe
  C:\Windows\System\qoUXiCz.exe
  2⤵
  PID:8664
- C:\Windows\System\BdBTFLH.exe
  C:\Windows\System\BdBTFLH.exe
  2⤵
  PID:8680
- C:\Windows\System\nfYnIKV.exe
  C:\Windows\System\nfYnIKV.exe
  2⤵
  PID:8696
- C:\Windows\System\RCInsJB.exe
  C:\Windows\System\RCInsJB.exe
  2⤵
  PID:8712
- C:\Windows\System\rTzjrua.exe
  C:\Windows\System\rTzjrua.exe
  2⤵
  PID:8732
- C:\Windows\System\YZsoTpa.exe
  C:\Windows\System\YZsoTpa.exe
  2⤵
  PID:8748
- C:\Windows\System\ORbmwyy.exe
  C:\Windows\System\ORbmwyy.exe
  2⤵
  PID:8764
- C:\Windows\System\LaInksv.exe
  C:\Windows\System\LaInksv.exe
  2⤵
  PID:8784
- C:\Windows\System\dBxNwdE.exe
  C:\Windows\System\dBxNwdE.exe
  2⤵
  PID:8800
- C:\Windows\System\JZmWxks.exe
  C:\Windows\System\JZmWxks.exe
  2⤵
  PID:8816
- C:\Windows\System\lwxvnSU.exe
  C:\Windows\System\lwxvnSU.exe
  2⤵
  PID:8836
- C:\Windows\System\AludTOg.exe
  C:\Windows\System\AludTOg.exe
  2⤵
  PID:8852
- C:\Windows\System\TgTMppn.exe
  C:\Windows\System\TgTMppn.exe
  2⤵
  PID:8872
- C:\Windows\System\VEmZxGI.exe
  C:\Windows\System\VEmZxGI.exe
  2⤵
  PID:8940
- C:\Windows\System\YckzGxs.exe
  C:\Windows\System\YckzGxs.exe
  2⤵
  PID:9008
- C:\Windows\System\KpZSMIC.exe
  C:\Windows\System\KpZSMIC.exe
  2⤵
  PID:9124
- C:\Windows\System\XMpEEmE.exe
  C:\Windows\System\XMpEEmE.exe
  2⤵
  PID:9152
- C:\Windows\System\DtcrljQ.exe
  C:\Windows\System\DtcrljQ.exe
  2⤵
  PID:9172
- C:\Windows\System\gCdMYzE.exe
  C:\Windows\System\gCdMYzE.exe
  2⤵
  PID:9188
- C:\Windows\System\gapUyEy.exe
  C:\Windows\System\gapUyEy.exe
  2⤵
  PID:8592
- C:\Windows\System\DOssVqY.exe
  C:\Windows\System\DOssVqY.exe
  2⤵
  PID:8388
- C:\Windows\System\OmiMlcJ.exe
  C:\Windows\System\OmiMlcJ.exe
  2⤵
  PID:8808
- C:\Windows\System\SvLoHsM.exe
  C:\Windows\System\SvLoHsM.exe
  2⤵
  PID:8604
- C:\Windows\System\RPFDYXL.exe
  C:\Windows\System\RPFDYXL.exe
  2⤵
  PID:8656
- C:\Windows\System\KeeSsXl.exe
  C:\Windows\System\KeeSsXl.exe
  2⤵
  PID:8824
- C:\Windows\System\lQgdYGq.exe
  C:\Windows\System\lQgdYGq.exe
  2⤵
  PID:8864
- C:\Windows\System\EzTLUxX.exe
  C:\Windows\System\EzTLUxX.exe
  2⤵
  PID:8912
- C:\Windows\System\UvwwrIv.exe
  C:\Windows\System\UvwwrIv.exe
  2⤵
  PID:8964
- C:\Windows\System\trjMtOS.exe
  C:\Windows\System\trjMtOS.exe
  2⤵
  PID:8984
- C:\Windows\System\wvVJeVu.exe
  C:\Windows\System\wvVJeVu.exe
  2⤵
  PID:9028
- C:\Windows\System\xQeuNdr.exe
  C:\Windows\System\xQeuNdr.exe
  2⤵
  PID:9072
- C:\Windows\System\vWmyHwa.exe
  C:\Windows\System\vWmyHwa.exe
  2⤵
  PID:9108
- C:\Windows\System\lcYLmPh.exe
  C:\Windows\System\lcYLmPh.exe
  2⤵
  PID:9164
- C:\Windows\System\fifSiuu.exe
  C:\Windows\System\fifSiuu.exe
  2⤵
  PID:9184
- C:\Windows\System\aYtONbs.exe
  C:\Windows\System\aYtONbs.exe
  2⤵
  PID:8304
- C:\Windows\System\QVXHwfz.exe
  C:\Windows\System\QVXHwfz.exe
  2⤵
  PID:7760
- C:\Windows\System\JhzdWWc.exe
  C:\Windows\System\JhzdWWc.exe
  2⤵
  PID:8400
- C:\Windows\System\dIxaCer.exe
  C:\Windows\System\dIxaCer.exe
  2⤵
  PID:8628
- C:\Windows\System\rISzGfe.exe
  C:\Windows\System\rISzGfe.exe
  2⤵
  PID:8524
- C:\Windows\System\sXKYdgZ.exe
  C:\Windows\System\sXKYdgZ.exe
  2⤵
  PID:8516
- C:\Windows\System\QrIGqhQ.exe
  C:\Windows\System\QrIGqhQ.exe
  2⤵
  PID:8584
- C:\Windows\System\yBxMLDC.exe
  C:\Windows\System\yBxMLDC.exe
  2⤵
  PID:8460
- C:\Windows\System\RGwyYnP.exe
  C:\Windows\System\RGwyYnP.exe
  2⤵
  PID:8468
- C:\Windows\System\vQjgkwO.exe
  C:\Windows\System\vQjgkwO.exe
  2⤵
  PID:8288
- C:\Windows\System\FkPuKjL.exe
  C:\Windows\System\FkPuKjL.exe
  2⤵
  PID:8352
- C:\Windows\System\TGfqlcd.exe
  C:\Windows\System\TGfqlcd.exe
  2⤵
  PID:8644
- C:\Windows\System\ZezFuuN.exe
  C:\Windows\System\ZezFuuN.exe
  2⤵
  PID:8640
- C:\Windows\System\rosslJI.exe
  C:\Windows\System\rosslJI.exe
  2⤵
  PID:8776
- C:\Windows\System\KSpPuIB.exe
  C:\Windows\System\KSpPuIB.exe
  2⤵
  PID:8708
- C:\Windows\System\lBSMMTs.exe
  C:\Windows\System\lBSMMTs.exe
  2⤵
  PID:8888
- C:\Windows\System\VPPAOyf.exe
  C:\Windows\System\VPPAOyf.exe
  2⤵
  PID:8904
- C:\Windows\System\SqwjLkR.exe
  C:\Windows\System\SqwjLkR.exe
  2⤵
  PID:8688
- C:\Windows\System\vRTBtAZ.exe
  C:\Windows\System\vRTBtAZ.exe
  2⤵
  PID:8756
- C:\Windows\System\TteJjsZ.exe
  C:\Windows\System\TteJjsZ.exe
  2⤵
  PID:8760
- C:\Windows\System\ZvtlNfO.exe
  C:\Windows\System\ZvtlNfO.exe
  2⤵
  PID:8948
- C:\Windows\System\MUXMdAx.exe
  C:\Windows\System\MUXMdAx.exe
  2⤵
  PID:8980
- C:\Windows\System\LLRlzGT.exe
  C:\Windows\System\LLRlzGT.exe
  2⤵
  PID:8956
- C:\Windows\System\lDiFilS.exe
  C:\Windows\System\lDiFilS.exe
  2⤵
  PID:9040
- C:\Windows\System\aAqZqpv.exe
  C:\Windows\System\aAqZqpv.exe
  2⤵
  PID:9068
- C:\Windows\System\TRStNHq.exe
  C:\Windows\System\TRStNHq.exe
  2⤵
  PID:9076
- C:\Windows\System\mRaNefJ.exe
  C:\Windows\System\mRaNefJ.exe
  2⤵
  PID:9092
- C:\Windows\System\ixcXgUa.exe
  C:\Windows\System\ixcXgUa.exe
  2⤵
  PID:9132
- C:\Windows\System\mgJzzVV.exe
  C:\Windows\System\mgJzzVV.exe
  2⤵
  PID:9144
- C:\Windows\System\ImDBaSL.exe
  C:\Windows\System\ImDBaSL.exe
  2⤵
  PID:9196
- C:\Windows\System\oUCllZo.exe
  C:\Windows\System\oUCllZo.exe
  2⤵
  PID:8308
- C:\Windows\System\oMtjryp.exe
  C:\Windows\System\oMtjryp.exe
  2⤵
  PID:8224
- C:\Windows\System\wuYKvAs.exe
  C:\Windows\System\wuYKvAs.exe
  2⤵
  PID:7632
- C:\Windows\System\nLkvMHw.exe
  C:\Windows\System\nLkvMHw.exe
  2⤵
  PID:8440
- C:\Windows\System\TTpHNxo.exe
  C:\Windows\System\TTpHNxo.exe
  2⤵
  PID:8244
- C:\Windows\System\pACBZWJ.exe
  C:\Windows\System\pACBZWJ.exe
  2⤵
  PID:8256
- C:\Windows\System\PWCsZmu.exe
  C:\Windows\System\PWCsZmu.exe
  2⤵
  PID:8320
- C:\Windows\System\xdoNnPP.exe
  C:\Windows\System\xdoNnPP.exe
  2⤵
  PID:8500
- C:\Windows\System\mOjrQbJ.exe
  C:\Windows\System\mOjrQbJ.exe
  2⤵
  PID:8636
- C:\Windows\System\zKXogaE.exe
  C:\Windows\System\zKXogaE.exe
  2⤵
  PID:8772
- C:\Windows\System\OixDUEy.exe
  C:\Windows\System\OixDUEy.exe
  2⤵
  PID:8420
- C:\Windows\System\zfuMqtH.exe
  C:\Windows\System\zfuMqtH.exe
  2⤵
  PID:8720
- C:\Windows\System\zWEmeGQ.exe
  C:\Windows\System\zWEmeGQ.exe
  2⤵
  PID:8276
- C:\Windows\System\FYosMoC.exe
  C:\Windows\System\FYosMoC.exe
  2⤵
  PID:8976
- C:\Windows\System\rDgzTRd.exe
  C:\Windows\System\rDgzTRd.exe
  2⤵
  PID:9056
- C:\Windows\System\xuoooeZ.exe
  C:\Windows\System\xuoooeZ.exe
  2⤵
  PID:9080
- C:\Windows\System\LcPqecZ.exe
  C:\Windows\System\LcPqecZ.exe
  2⤵
  PID:9136
- C:\Windows\System\YaXhhNO.exe
  C:\Windows\System\YaXhhNO.exe
  2⤵
  PID:8228
- C:\Windows\System\jMDCtpx.exe
  C:\Windows\System\jMDCtpx.exe
  2⤵
  PID:9212
- C:\Windows\System\HUDMrRQ.exe
  C:\Windows\System\HUDMrRQ.exe
  2⤵
  PID:8372
- C:\Windows\System\mlaHjOG.exe
  C:\Windows\System\mlaHjOG.exe
  2⤵
  PID:8488
- C:\Windows\System\CSwaLHl.exe
  C:\Windows\System\CSwaLHl.exe
  2⤵
  PID:8340
- C:\Windows\System\IEouZab.exe
  C:\Windows\System\IEouZab.exe
  2⤵
  PID:8504
- C:\Windows\System\wIDvMCa.exe
  C:\Windows\System\wIDvMCa.exe
  2⤵
  PID:8452
- C:\Windows\System\wSPnLKy.exe
  C:\Windows\System\wSPnLKy.exe
  2⤵
  PID:8536
- C:\Windows\System\cuxclDd.exe
  C:\Windows\System\cuxclDd.exe
  2⤵
  PID:9004
- C:\Windows\System\KhGnHgs.exe
  C:\Windows\System\KhGnHgs.exe
  2⤵
  PID:8744
- C:\Windows\System\KWbVArq.exe
  C:\Windows\System\KWbVArq.exe
  2⤵
  PID:8920
- C:\Windows\System\EDDjYcr.exe
  C:\Windows\System\EDDjYcr.exe
  2⤵
  PID:9032
- C:\Windows\System\peaoDAk.exe
  C:\Windows\System\peaoDAk.exe
  2⤵
  PID:9096
- C:\Windows\System\RoUfwRX.exe
  C:\Windows\System\RoUfwRX.exe
  2⤵
  PID:9220
- C:\Windows\System\suMEQzw.exe
  C:\Windows\System\suMEQzw.exe
  2⤵
  PID:9236
- C:\Windows\System\ayQgZGI.exe
  C:\Windows\System\ayQgZGI.exe
  2⤵
  PID:9252
- C:\Windows\System\oePnnXK.exe
  C:\Windows\System\oePnnXK.exe
  2⤵
  PID:9268
- C:\Windows\System\HZDABkF.exe
  C:\Windows\System\HZDABkF.exe
  2⤵
  PID:9284
- C:\Windows\System\imSKsZq.exe
  C:\Windows\System\imSKsZq.exe
  2⤵
  PID:9300
- C:\Windows\System\dBPlppq.exe
  C:\Windows\System\dBPlppq.exe
  2⤵
  PID:9316
- C:\Windows\System\pelKlaF.exe
  C:\Windows\System\pelKlaF.exe
  2⤵
  PID:9332
- C:\Windows\System\fWzDLeA.exe
  C:\Windows\System\fWzDLeA.exe
  2⤵
  PID:9348
- C:\Windows\System\pYAsgyI.exe
  C:\Windows\System\pYAsgyI.exe
  2⤵
  PID:9364
- C:\Windows\System\uNqpCsW.exe
  C:\Windows\System\uNqpCsW.exe
  2⤵
  PID:9380
- C:\Windows\System\tlpyIVi.exe
  C:\Windows\System\tlpyIVi.exe
  2⤵
  PID:9396
- C:\Windows\System\vQQrkhC.exe
  C:\Windows\System\vQQrkhC.exe
  2⤵
  PID:9412
- C:\Windows\System\tPMlSRn.exe
  C:\Windows\System\tPMlSRn.exe
  2⤵
  PID:9428
- C:\Windows\System\lXxpmbS.exe
  C:\Windows\System\lXxpmbS.exe
  2⤵
  PID:9444
- C:\Windows\System\NSgKmbM.exe
  C:\Windows\System\NSgKmbM.exe
  2⤵
  PID:9460
- C:\Windows\System\lUWRtmW.exe
  C:\Windows\System\lUWRtmW.exe
  2⤵
  PID:9476
- C:\Windows\System\AFjWDgZ.exe
  C:\Windows\System\AFjWDgZ.exe
  2⤵
  PID:9492
- C:\Windows\System\VJIBBxp.exe
  C:\Windows\System\VJIBBxp.exe
  2⤵
  PID:9508
- C:\Windows\System\czCPUXb.exe
  C:\Windows\System\czCPUXb.exe
  2⤵
  PID:9524
- C:\Windows\System\bfXYzXG.exe
  C:\Windows\System\bfXYzXG.exe
  2⤵
  PID:9540
- C:\Windows\System\GoOnppi.exe
  C:\Windows\System\GoOnppi.exe
  2⤵
  PID:9556
- C:\Windows\System\zWIDkMH.exe
  C:\Windows\System\zWIDkMH.exe
  2⤵
  PID:9572
- C:\Windows\System\mvCZFLg.exe
  C:\Windows\System\mvCZFLg.exe
  2⤵
  PID:9588
- C:\Windows\System\IReYTAm.exe
  C:\Windows\System\IReYTAm.exe
  2⤵
  PID:9604
- C:\Windows\System\VTjvFiS.exe
  C:\Windows\System\VTjvFiS.exe
  2⤵
  PID:9620
- C:\Windows\System\LAmHcuI.exe
  C:\Windows\System\LAmHcuI.exe
  2⤵
  PID:9636
- C:\Windows\System\cMtXIyJ.exe
  C:\Windows\System\cMtXIyJ.exe
  2⤵
  PID:9652
- C:\Windows\System\KJdxoFu.exe
  C:\Windows\System\KJdxoFu.exe
  2⤵
  PID:9668
- C:\Windows\System\LGiIOYb.exe
  C:\Windows\System\LGiIOYb.exe
  2⤵
  PID:9684
- C:\Windows\System\XdTytfo.exe
  C:\Windows\System\XdTytfo.exe
  2⤵
  PID:9700
- C:\Windows\System\VttbzZJ.exe
  C:\Windows\System\VttbzZJ.exe
  2⤵
  PID:9716
- C:\Windows\System\uTTAbFJ.exe
  C:\Windows\System\uTTAbFJ.exe
  2⤵
  PID:9732
- C:\Windows\System\OmBzdjC.exe
  C:\Windows\System\OmBzdjC.exe
  2⤵
  PID:9756
- C:\Windows\System\YBrdBmm.exe
  C:\Windows\System\YBrdBmm.exe
  2⤵
  PID:9772
- C:\Windows\System\vWCKnMf.exe
  C:\Windows\System\vWCKnMf.exe
  2⤵
  PID:9788
- C:\Windows\System\hKEbcfn.exe
  C:\Windows\System\hKEbcfn.exe
  2⤵
  PID:9808
- C:\Windows\System\ZHVtdaq.exe
  C:\Windows\System\ZHVtdaq.exe
  2⤵
  PID:9824
- C:\Windows\System\AuUKFoh.exe
  C:\Windows\System\AuUKFoh.exe
  2⤵
  PID:9840
- C:\Windows\System\hIgUgZO.exe
  C:\Windows\System\hIgUgZO.exe
  2⤵
  PID:9856
- C:\Windows\System\FVYgFDT.exe
  C:\Windows\System\FVYgFDT.exe
  2⤵
  PID:9876
- C:\Windows\System\VQVJudG.exe
  C:\Windows\System\VQVJudG.exe
  2⤵
  PID:9972
- C:\Windows\System\NANWKvY.exe
  C:\Windows\System\NANWKvY.exe
  2⤵
  PID:9992
- C:\Windows\System\ZFThWsH.exe
  C:\Windows\System\ZFThWsH.exe
  2⤵
  PID:10012
- C:\Windows\System\RssFtTd.exe
  C:\Windows\System\RssFtTd.exe
  2⤵
  PID:10032
- C:\Windows\System\zLgPftm.exe
  C:\Windows\System\zLgPftm.exe
  2⤵
  PID:10052
- C:\Windows\System\RyevCIl.exe
  C:\Windows\System\RyevCIl.exe
  2⤵
  PID:10068
- C:\Windows\System\jIUlEZH.exe
  C:\Windows\System\jIUlEZH.exe
  2⤵
  PID:10084
- C:\Windows\System\PNmbTeK.exe
  C:\Windows\System\PNmbTeK.exe
  2⤵
  PID:10100
- C:\Windows\System\XLDrTmy.exe
  C:\Windows\System\XLDrTmy.exe
  2⤵
  PID:10116
- C:\Windows\System\hsUOJLY.exe
  C:\Windows\System\hsUOJLY.exe
  2⤵
  PID:10136
- C:\Windows\System\NoUCUQM.exe
  C:\Windows\System\NoUCUQM.exe
  2⤵
  PID:10152
- C:\Windows\System\sRBRPhH.exe
  C:\Windows\System\sRBRPhH.exe
  2⤵
  PID:10168
- C:\Windows\System\XJzEKWJ.exe
  C:\Windows\System\XJzEKWJ.exe
  2⤵
  PID:10184
- C:\Windows\System\SmBtvnk.exe
  C:\Windows\System\SmBtvnk.exe
  2⤵
  PID:10200
- C:\Windows\System\kiiQJce.exe
  C:\Windows\System\kiiQJce.exe
  2⤵
  PID:10216
- C:\Windows\System\yGHHKRJ.exe
  C:\Windows\System\yGHHKRJ.exe
  2⤵
  PID:10232
- C:\Windows\System\YxJRcIG.exe
  C:\Windows\System\YxJRcIG.exe
  2⤵
  PID:8896
- C:\Windows\System\ObbZzLl.exe
  C:\Windows\System\ObbZzLl.exe
  2⤵
  PID:9168
- C:\Windows\System\AqTiEUU.exe
  C:\Windows\System\AqTiEUU.exe
  2⤵
  PID:8880
- C:\Windows\System\DmcwrhL.exe
  C:\Windows\System\DmcwrhL.exe
  2⤵
  PID:9296
- C:\Windows\System\QAQSQHo.exe
  C:\Windows\System\QAQSQHo.exe
  2⤵
  PID:8616
- C:\Windows\System\IUFKKmo.exe
  C:\Windows\System\IUFKKmo.exe
  2⤵
  PID:9308
- C:\Windows\System\tpFkZeM.exe
  C:\Windows\System\tpFkZeM.exe
  2⤵
  PID:9388
- C:\Windows\System\iekrVMW.exe
  C:\Windows\System\iekrVMW.exe
  2⤵
  PID:8932
- C:\Windows\System\ciqGqhZ.exe
  C:\Windows\System\ciqGqhZ.exe
  2⤵
  PID:9452
- C:\Windows\System\NgjDBSu.exe
  C:\Windows\System\NgjDBSu.exe
  2⤵
  PID:9436
- C:\Windows\System\eUeoybl.exe
  C:\Windows\System\eUeoybl.exe
  2⤵
  PID:9484
- C:\Windows\System\yTpbqyj.exe
  C:\Windows\System\yTpbqyj.exe
  2⤵
  PID:9472
- C:\Windows\System\NVKULsl.exe
  C:\Windows\System\NVKULsl.exe
  2⤵
  PID:9532
- C:\Windows\System\iORMXga.exe
  C:\Windows\System\iORMXga.exe
  2⤵
  PID:9536
- C:\Windows\System\EMoHUUd.exe
  C:\Windows\System\EMoHUUd.exe
  2⤵
  PID:9596
- C:\Windows\System\fmNVuVG.exe
  C:\Windows\System\fmNVuVG.exe
  2⤵
  PID:9568
- C:\Windows\System\shKuoWd.exe
  C:\Windows\System\shKuoWd.exe
  2⤵
  PID:9660
- C:\Windows\System\brQkOMa.exe
  C:\Windows\System\brQkOMa.exe
  2⤵
  PID:9712
- C:\Windows\System\IzUDfnx.exe
  C:\Windows\System\IzUDfnx.exe
  2⤵
  PID:9740
- C:\Windows\System\MDbdcKj.exe
  C:\Windows\System\MDbdcKj.exe
  2⤵
  PID:9780
- C:\Windows\System\XQuiOPc.exe
  C:\Windows\System\XQuiOPc.exe
  2⤵
  PID:9848
- C:\Windows\System\UcogBvs.exe
  C:\Windows\System\UcogBvs.exe
  2⤵
  PID:9764
- C:\Windows\System\MXVLwNO.exe
  C:\Windows\System\MXVLwNO.exe
  2⤵
  PID:9728
- C:\Windows\System\hRPMejv.exe
  C:\Windows\System\hRPMejv.exe
  2⤵
  PID:9888
- C:\Windows\System\ASpitlS.exe
  C:\Windows\System\ASpitlS.exe
  2⤵
  PID:9904
- C:\Windows\System\PPcjQQP.exe
  C:\Windows\System\PPcjQQP.exe
  2⤵
  PID:9920
- C:\Windows\System\gnkxekz.exe
  C:\Windows\System\gnkxekz.exe
  2⤵
  PID:9936
- C:\Windows\System\XHqytur.exe
  C:\Windows\System\XHqytur.exe
  2⤵
  PID:9940
- C:\Windows\System\efYaWTc.exe
  C:\Windows\System\efYaWTc.exe
  2⤵
  PID:9988
- C:\Windows\System\zHOFppl.exe
  C:\Windows\System\zHOFppl.exe
  2⤵
  PID:10000
- C:\Windows\System\stpuzzY.exe
  C:\Windows\System\stpuzzY.exe
  2⤵
  PID:10040
- C:\Windows\System\soWqvpS.exe
  C:\Windows\System\soWqvpS.exe
  2⤵
  PID:10060
- C:\Windows\System\hWDviba.exe
  C:\Windows\System\hWDviba.exe
  2⤵
  PID:10064
- C:\Windows\System\NADROBU.exe
  C:\Windows\System\NADROBU.exe
  2⤵
  PID:10112
- C:\Windows\System\QHGhxrg.exe
  C:\Windows\System\QHGhxrg.exe
  2⤵
  PID:10176
- C:\Windows\System\crLmqLa.exe
  C:\Windows\System\crLmqLa.exe
  2⤵
  PID:10160
- C:\Windows\System\fAsWlmX.exe
  C:\Windows\System\fAsWlmX.exe
  2⤵
  PID:10196
- C:\Windows\System\FURHinj.exe
  C:\Windows\System\FURHinj.exe
  2⤵
  PID:8860
- C:\Windows\System\KMwTLUi.exe
  C:\Windows\System\KMwTLUi.exe
  2⤵
  PID:9356
- C:\Windows\System\XASoGIo.exe
  C:\Windows\System\XASoGIo.exe
  2⤵
  PID:9456
- C:\Windows\System\wizCiuQ.exe
  C:\Windows\System\wizCiuQ.exe
  2⤵
  PID:9616
- C:\Windows\System\fVhyVdL.exe
  C:\Windows\System\fVhyVdL.exe
  2⤵
  PID:9980
- C:\Windows\System\PlRUiXc.exe
  C:\Windows\System\PlRUiXc.exe
  2⤵
  PID:10192
- C:\Windows\System\odzpllN.exe
  C:\Windows\System\odzpllN.exe
  2⤵
  PID:9276
- C:\Windows\System\AxprWQR.exe
  C:\Windows\System\AxprWQR.exe
  2⤵
  PID:8456
- C:\Windows\System\teEpUTy.exe
  C:\Windows\System\teEpUTy.exe
  2⤵
  PID:10128
- C:\Windows\System\gcWLsiR.exe
  C:\Windows\System\gcWLsiR.exe
  2⤵
  PID:9580
- C:\Windows\System\bGWcXwu.exe
  C:\Windows\System\bGWcXwu.exe
  2⤵
  PID:9752
- C:\Windows\System\gzQZKwV.exe
  C:\Windows\System\gzQZKwV.exe
  2⤵
  PID:9872
- C:\Windows\System\QVPWoRZ.exe
  C:\Windows\System\QVPWoRZ.exe
  2⤵
  PID:9948
- C:\Windows\System\Nfceaav.exe
  C:\Windows\System\Nfceaav.exe
  2⤵
  PID:10020
- C:\Windows\System\fnUoDdX.exe
  C:\Windows\System\fnUoDdX.exe
  2⤵
  PID:10132
- C:\Windows\System\EBLNrQZ.exe
  C:\Windows\System\EBLNrQZ.exe
  2⤵
  PID:9328
- C:\Windows\System\nEivgmd.exe
  C:\Windows\System\nEivgmd.exe
  2⤵
  PID:10044
- C:\Windows\System\IxtmMbR.exe
  C:\Windows\System\IxtmMbR.exe
  2⤵
  PID:10124
- C:\Windows\System\HdRFOKu.exe
  C:\Windows\System\HdRFOKu.exe
  2⤵
  PID:9408
- C:\Windows\System\cwaMMFJ.exe
  C:\Windows\System\cwaMMFJ.exe
  2⤵
  PID:9768
- C:\Windows\System\LZCDlhJ.exe
  C:\Windows\System\LZCDlhJ.exe
  2⤵
  PID:10228
- C:\Windows\System\QFWiyTJ.exe
  C:\Windows\System\QFWiyTJ.exe
  2⤵
  PID:9724
- C:\Windows\System\PrrJtcz.exe
  C:\Windows\System\PrrJtcz.exe
  2⤵
  PID:9664
- C:\Windows\System\TzVKski.exe
  C:\Windows\System\TzVKski.exe
  2⤵
  PID:9228
- C:\Windows\System\ShuuObW.exe
  C:\Windows\System\ShuuObW.exe
  2⤵
  PID:9892
- C:\Windows\System\dyDwEMp.exe
  C:\Windows\System\dyDwEMp.exe
  2⤵
  PID:8936
- C:\Windows\System\UnrKNcb.exe
  C:\Windows\System\UnrKNcb.exe
  2⤵
  PID:9680
- C:\Windows\System\ISnIBMU.exe
  C:\Windows\System\ISnIBMU.exe
  2⤵
  PID:10108
- C:\Windows\System\isYInbl.exe
  C:\Windows\System\isYInbl.exe
  2⤵
  PID:9404
- C:\Windows\System\pEebKJO.exe
  C:\Windows\System\pEebKJO.exe
  2⤵
  PID:9424
- C:\Windows\System\rzuaPIc.exe
  C:\Windows\System\rzuaPIc.exe
  2⤵
  PID:9932
- C:\Windows\System\ibruKqj.exe
  C:\Windows\System\ibruKqj.exe
  2⤵
  PID:9260
- C:\Windows\System\gIEcnct.exe
  C:\Windows\System\gIEcnct.exe
  2⤵
  PID:9916
- C:\Windows\System\EZlZPOB.exe
  C:\Windows\System\EZlZPOB.exe
  2⤵
  PID:9820
- C:\Windows\System\rPCCdQe.exe
  C:\Windows\System\rPCCdQe.exe
  2⤵
  PID:9468
- C:\Windows\System\OiXSIlD.exe
  C:\Windows\System\OiXSIlD.exe
  2⤵
  PID:10248
- C:\Windows\System\PvfqeAB.exe
  C:\Windows\System\PvfqeAB.exe
  2⤵
  PID:10264
- C:\Windows\System\gVKLFYk.exe
  C:\Windows\System\gVKLFYk.exe
  2⤵
  PID:10280
- C:\Windows\System\tFCoPfv.exe
  C:\Windows\System\tFCoPfv.exe
  2⤵
  PID:10296
- C:\Windows\System\MuQVhGv.exe
  C:\Windows\System\MuQVhGv.exe
  2⤵
  PID:10312
- C:\Windows\System\QOxGHQj.exe
  C:\Windows\System\QOxGHQj.exe
  2⤵
  PID:10328
- C:\Windows\System\ySgJAAm.exe
  C:\Windows\System\ySgJAAm.exe
  2⤵
  PID:10344
- C:\Windows\System\HpQvkIT.exe
  C:\Windows\System\HpQvkIT.exe
  2⤵
  PID:10360
- C:\Windows\System\iijZwtz.exe
  C:\Windows\System\iijZwtz.exe
  2⤵
  PID:10376
- C:\Windows\System\DYBBuLw.exe
  C:\Windows\System\DYBBuLw.exe
  2⤵
  PID:10392
- C:\Windows\System\UADbhdo.exe
  C:\Windows\System\UADbhdo.exe
  2⤵
  PID:10408
- C:\Windows\System\HNytEBt.exe
  C:\Windows\System\HNytEBt.exe
  2⤵
  PID:10424
- C:\Windows\System\yTeJmBo.exe
  C:\Windows\System\yTeJmBo.exe
  2⤵
  PID:10440
- C:\Windows\System\hvtFSzn.exe
  C:\Windows\System\hvtFSzn.exe
  2⤵
  PID:10456
- C:\Windows\System\bjBizIZ.exe
  C:\Windows\System\bjBizIZ.exe
  2⤵
  PID:10472
- C:\Windows\System\lwdOqwP.exe
  C:\Windows\System\lwdOqwP.exe
  2⤵
  PID:10492
- C:\Windows\System\KvQHYJK.exe
  C:\Windows\System\KvQHYJK.exe
  2⤵
  PID:10508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BvrdPJa.exe

Filesize
1.7MB

MD5
be2293e8a590a5d07e60ed4b7670c270

SHA1
c05e4456b47d5ed2b42efe063bcbfbfe149de143

SHA256
cf37ffd930ce89d0b46cfc86f74914374ac226ddcc8c81980d74edf0437da573

SHA512
f0c13f9843b4fb392e84f0ad12230b2664adffec56e9dc4c1e0770c1b3b1d10f41ad2ae4ce8a08c7ab2f85e923960edd1f0384a8f83037d500ef435faab574a0

Download Submit
C:\Windows\system\FZFIAcZ.exe

Filesize
1.7MB

MD5
04287de3202f939f860181217d58ae0c

SHA1
6345cf531bbd33d98dab22e8ae080e5df0721606

SHA256
1c64d0500d6a1803550eb360ea5a07eb5d45c605549a46c194b09d0dcf9b80a0

SHA512
95bd746919e39d957daaf4fe5aedc8b1107374b623153d0ffa73c3f13db661cddadbd58086d743b5058379ad9d2324f847147473e49e97e4fb9649e43eb48ab3

Download Submit
C:\Windows\system\IIMJzGy.exe

Filesize
1.7MB

MD5
facc2ed8bdb80abbc5864d331b2cea2b

SHA1
b131ab73d683b04fe5dacba0afdfb4518aaae078

SHA256
fb1c1e8d032ed12df771747e554145bf5f31cc567e268f424ea965cce278223f

SHA512
0a09446df0f7987e2364ff57924236381e2b890c1dee92af1ae864d499e49fd6cb52739523a4ea520e8f49d7df386adfe9e68f18e46435bb4de8a09a1659d6ff

Download Submit
C:\Windows\system\JthvlPN.exe

Filesize
1.7MB

MD5
409ba765025d984e0b533ac55a9bad99

SHA1
9a44861fd89e49e76dad6601205e8ed7bc1e9003

SHA256
6a3f78dc2fe6a3729b89445f63235435b2489d1e0945186c482a939788d715ab

SHA512
f9f557ad554526f2adb5b459f645be56968f00c26a4bd641ffac29b64045752ffd509ebcf9487a1f8faaa6b0dccfce30110976c05b60a8757acb16b58227a5a9

Download Submit
C:\Windows\system\LtAOjrN.exe

Filesize
1.7MB

MD5
49492d332fd1846e60d35bd17f4da251

SHA1
76a9375b24b4e0a1a96109c993cbdfc1600011b5

SHA256
5d48827a0c1b29b8364dd410fac53071ecfa230db991ea0ff9a6626d677bd657

SHA512
6c3ab347b5c566b34a25a2fdbca1228aa9d32c968665c879c3a529f6c571d9fbcdd03499fe1cc5ba0993192b87d8890c4fc35cf252cee498d909912351c2f2a3

Download Submit
C:\Windows\system\OMiRCJS.exe

Filesize
1.7MB

MD5
5db2d7a8229b3b6dce6f4e3d9914a6ce

SHA1
5e43b174123745da2eaa5bd83cf02035f06a3ed7

SHA256
673b3dc3b80cfd2f2c0ba13dc3c4b4de95286decba31f92fa5ba93791c0796d8

SHA512
de9db37c2fdd443a02f4f55feac482a3de938e76f30adc5b37a9d3c1d2e8845f8919d42a2bd057e52853f4db464c334e64460aa4f71c97a8f9b1744aa85859ba

Download Submit
C:\Windows\system\Ooppkhd.exe

Filesize
1.7MB

MD5
4be4ec67176b240916aaca94c701eb37

SHA1
0a54ba1629b9ab5017391586f6ebc01e4ce9780d

SHA256
13c6cdf2cbdba6264756f181812ae2d61aafdb7ad55f8565b8efe0aee54944da

SHA512
dfef609dfa78445350b6f3fd549bd5a83ae0263e76c55fd058fd4cf80a888257a7a21fbad53be76c24ada26bffa5ed66a9ae12f65597469a3b13e75533eb2ce1

Download Submit
C:\Windows\system\PXWOhNq.exe

Filesize
1.7MB

MD5
d0dca4c0389a396cb099614f3300827a

SHA1
e76a5b496b5b8a70789054f669c288f72739f0af

SHA256
00a1cf98bffa1e504e58f4f58e13d3263ea9dbd0dbff17d61f2b08f5aa0022d1

SHA512
e9ccc78da1b8d7d38bdd14f13c12703694cac2db8ff31431ae5b584d4356a711fcd56e45d9098431f9377a0f0ef1b58cb82ee8e654c4387e8d3fc74ba64ddb7e

Download Submit
C:\Windows\system\PsDLoSX.exe

Filesize
1.7MB

MD5
68206ee96e1306380fd2e0c60bf46dc8

SHA1
0bc148239ef3c7bb437d21cda2f7ebac0761c1d5

SHA256
5bd32b45df9f81779df634a1dc0a8eba56a496113c3b9ff23fb8819ff8d4a5b4

SHA512
0f753ad41ce1b52f998961b23767f882e61e1fcf4fe50ca3f70c572638a0ea796280dc81288bf4bce1516745dd7ae097014e8d3dddf6cd60f549f450adaa72b0

Download Submit
C:\Windows\system\QJtEHgd.exe

Filesize
8B

MD5
8a9416a5ba3f4513ce86ee25fcd9ed2c

SHA1
a36f3dd1333c8cfee404b646d4c6809d7e653313

SHA256
fb7dd3a16f87fe8b7e98987069f2b605508df1550402bd2a9bfdec4856b1a59a

SHA512
c747d417c3e282ae9ec82b691c8fea9cb7d0729d1dda54d2144fa9c71dd39f2ab11cee5a6768a89cb91fd4a7ae6e579302cb4e4de8d6384014994320074580a4

Download Submit
C:\Windows\system\RNZGxvk.exe

Filesize
1.7MB

MD5
2f8b72a86d5529658050440302814486

SHA1
8e60454cad49aaf35dbe0b44df1d9b1e6c2500d8

SHA256
6d31525a5de4493f3416fb995485ff5cd0326fa3de6a0106b8fc2bab5ba5f24b

SHA512
efe10cb068c1973d6bc82f55d278b44b76c5f42b01377bf7496e4bb056c55d72f311b03cb05b9c369de1f52defa424233407fc28d0fdd2d0a50c3bcd8f57a0bd

Download Submit
C:\Windows\system\RcaeGJM.exe

Filesize
1.7MB

MD5
5b72fdf1792a279efabcbe594db9e897

SHA1
7d8eb3e5025b322f16ba16d7b45449ddfe370484

SHA256
08e224ad746d542e2f6e445a5db155d96232d07503c0d8baefb2532575742a93

SHA512
ccf9f0911b20fe6dc4aeec5681298c4f5a265c5a7dc017ad96978c34f400d4eebc5b750fc37bdda47d792305f37d7d2362a451dc0b1d4239e0a48ae4dd0cb81e

Download Submit
C:\Windows\system\SlgMAFM.exe

Filesize
1.7MB

MD5
5aa1f914ec8e6af4bdf4b73017cc9970

SHA1
bbd81fe19f51ee3dcf52a6d4b2579a9f98872909

SHA256
59c235c4282752b3a28e28ac44c2951d7ff9e03045adbb0184f45f5ca32a87df

SHA512
4bed91b17f20feba8d5f1b892706c4c9bd5229ff13430359689741763131986f4d9043be6bea0954f4069b5e0b00dc241ba856ce5672df715628b25c46dc3f42

Download Submit
C:\Windows\system\hUyPSHW.exe

Filesize
1.7MB

MD5
a1a59e51a0b2b9e8815d45492061ed01

SHA1
425654b3b94b22636f4d88a66ed47c3cf44eec01

SHA256
0214b44db3e81021b68c20b33c681cc9487b3ebe078b6217970a1b120997b05c

SHA512
4eff1bad5e16d785fc778dbf0790ced1a69a75ddcb27d0314c3177996f6f3846951f86eaa32525cec84b09b2f1a156fe08f109ac521a29f0e6f6d59611676cb7

Download Submit
C:\Windows\system\qLxWGnW.exe

Filesize
1.7MB

MD5
2b291249f6df86e3d59f17dc6449f792

SHA1
8791375f57b7c4128984cf72a59e963146feed47

SHA256
e14288a0aefc2b44db5055a68cb4322a07c30e970ac59dd84c162f6c4af6351d

SHA512
263ab22fce4f7e22b73502a982bbd18606fbf13ffa9503e574082afceec60770f6d3ecdd6cdade66591d4230ba4b04dacf9eb04442720f23bc55c3c69bb043df

Download Submit
C:\Windows\system\qUvpVsh.exe

Filesize
1.7MB

MD5
ea39a77504881de223df626d17f3af2a

SHA1
d2a84e62a3bcdee50891b01cda978047fc47b108

SHA256
d33c2d3b122d9c5e38e45a20eaff4ee1299ffc56853d8fb972c9f7e45891f5a9

SHA512
c880271f5a1fa6b2c46a3114a45bd594b13057ddb24e5b4836d4970b7401a22d0ce22530158bf65eaeb81fa8f19023b9024989107a5b995bfa74b84e71d56090

Download Submit
C:\Windows\system\tEXyPJl.exe

Filesize
1.7MB

MD5
c0e7bf560e6ac43d5d5ac3c0a2199b9a

SHA1
736c6a792035a1dbffffa570ab693da1e731b570

SHA256
e68edfe30e04667ea53f84e50f8b0a3618d1ad1becf90432a2e165da1a21a5d2

SHA512
99ff85e4ce5f28ca2ed0b69358eb9b790b7e36b8d01a21cadce7179e3bce16fb5d5bb6db6063cffead3c51909f7b3a2cab9964a17dc62d6225f11d027f218cd5

Download Submit
C:\Windows\system\xfRVbxJ.exe

Filesize
1.7MB

MD5
d7010d4b1c964b2d8ba89501b9e04d18

SHA1
cedb876c10120c5f6963101108d0abdf732a018e

SHA256
d3bb2a0df537a485e1dcc9f2a0dcccfcee537fd30c4d7b8840a6ff6406a76bc5

SHA512
6fd3d6631e164fd3e712e215ecf1e434ac4384248969c603ba4da7ce80df5358243f90e38ea1bc7a74440275407ea5116924b6a3a8a54df6461fc859192ebbd7

Download Submit
C:\Windows\system\yFasrHy.exe

Filesize
1.7MB

MD5
32f60d0e0cd1f978653a6e0fe29df064

SHA1
1d412e7a0792b6ea18a96d70b0a0c253d58624d3

SHA256
c66f9eeb1fab5b8590b4b88fdb1deb1d79279bd5d1d10037663cd6d942a0bbed

SHA512
8d2d099ba86fa238b52e1f7cdafeb20280e8b993c85eba54b4b20ea88b02773ae9c41288b913369f79e684e71793700996a2ef17c9fc5cb3aafb06682d560c58

Download Submit
\Windows\system\ACQQdOj.exe

Filesize
1.7MB

MD5
b77d8cc9741769cbb232693241621e59

SHA1
8eb7c4b2918d73e37408b2d16a59b55101114031

SHA256
a4c99c4bb00b6fe0e2981f7d41522b1c939d232dd3840a799c4a77d919be1fb0

SHA512
89a12d0fa3150e2eb1640b4a4c55c26a21d0a70656840174930e7cebdf1a464be567c2eeaf732a39e9d21dc9fa21003288930e0cfb1d02cbb6289c01ec4acee4

Download Submit
\Windows\system\JLOFxLj.exe

Filesize
1.7MB

MD5
6494a39f844137e85e951e49fdf64b8d

SHA1
7faafc961b4a389964707a0f8d795feff4e14f12

SHA256
3181323f6db6ea7eebbf00351fcfda5414e675c6772aabf1105a2dfe5822c31a

SHA512
59f3e4728e94ac599da82070599d9cf5ef5a2e47cda2caf207787b0504a16434bfecf8dd26ea16ebd914f0b1a91b4d7dc0ee2287b0d1d84d99d67322f3ca405f

Download Submit
\Windows\system\JgRfWjX.exe

Filesize
1.7MB

MD5
d9f767b49990cbb9e78d58c3d1b5e20c

SHA1
5eca48f3416c54c2059bd35e72ca3bc9b3ee2204

SHA256
03f1b1342ef988396edcdf7aaf28873ade4ab6ae24fdee1b06370caa104ef987

SHA512
6a51e1f98e89d476f6eb1b2d8569451a1448efdba6f23aafa8bbc9f198f6dc7fe4e0a353a826631569442bd3ac32084d7317d523c887b811c24472129e959c2c

Download Submit
\Windows\system\MoUFBaX.exe

Filesize
1.7MB

MD5
6c08e76cbd7a7bacd8258417ce8fce46

SHA1
0dd9f9262833de036744d2232fc4bfaabcaa825b

SHA256
db45880d3b1826a6b818e4c018c3b914c4d351a783110237fce7abe1b0e9847b

SHA512
c0bf2c921278da849c5ea29e987cb74dc3ea987070202d8860040026432101dd2f4727e00d9bd7f3cffc1d47310c0c25c70b81cb2cc3a1aa6c1fd15c5b70f962

Download Submit
\Windows\system\PySxMFr.exe

Filesize
1.7MB

MD5
070653401e39cfebfed429cb27e2aeaf

SHA1
2dbc3457e4abc6c511c7e2870e2093ba946409ad

SHA256
e679accc1a5afa4b119b2d3ba2fddbcb35ab61beb85a935247554a89c2f2287c

SHA512
4e34bb21ef92c1bd9ed5c74edfd27accd96f83796fa0b3d8c383d839e88c84b7eb4a4dd7b90d81cc6064db07e499f49200c2d73f6b48e0df3d6a32d5218aa065

Download Submit
\Windows\system\QdbvECd.exe

Filesize
1.7MB

MD5
62381be3896acefad13d80e7c8a1849e

SHA1
83aee43454dd78674d5929c436f50407389728cd

SHA256
9cc7ba290b7cad7d86c93f8cd3fab6a4fb3098466c64ef2a27710d2ea2cfbb81

SHA512
bb7a6e57a3531369782da2821f410fda0c9df199a4649f999bd359c599d7078c65fa235c81683bf0edc4b1b7fbf7775c0ba5fe17aca62609f1f1c3abfeb7c5b1

Download Submit
\Windows\system\UDJDEFi.exe

Filesize
1.7MB

MD5
f09e15bd413accee6760c2cc3357eb44

SHA1
8b340b2f88a7ca519b350de98dee132d33bd2706

SHA256
592133d9fada9f260f5f357e6bd95016bed0e142b79d8a737a09579f3da630b8

SHA512
3678d7f5dd4acca7290c0464e6caf44e6af2edcf7816b587a838839e77c0bc34f876a1171f1d9ab884bc4cabddb750fdc29fd5a0830e79291b4330835cf52f61

Download Submit
\Windows\system\WHNGrsE.exe

Filesize
1.7MB

MD5
a4bfeb8f7d29299fb1737292b0999e19

SHA1
14dc69f616cd12c37b01ccb42d28f583914923f5

SHA256
5ea2fe5320d43ea2c891c69d58f677377e1c4b95fbb24231e32b39925d91f585

SHA512
d3ef87fcebcb67860887496d0f12d9b8022fc82024c76c6216dae67913a51bb2e4ca819036e2a75ae8ed0a3348c29257af962c0ffeb671e556b154318e659f7d

Download Submit
\Windows\system\XtaBgkB.exe

Filesize
1.7MB

MD5
a1e40e1f1e4dc91a47181e26731e5698

SHA1
a7d4c6e8219f91e15230d25626f0d29f39e19f4f

SHA256
8f2341b601a9b85b7ca81718741206b1be8d8a0fd62f6821548132b3d258fbcf

SHA512
2a55a05dbbaa4c5713c778d70ad51d7c1c11f7ec84ee4b816e2ee89cb902295d1a976b79140b486a0da3ef02b757c4e76312ac94af7d5ae3984053187b3126ec

Download Submit
\Windows\system\YQZtpgc.exe

Filesize
1.7MB

MD5
dad8fd3c2a8dfb6a258a27f6f7ab4802

SHA1
5d320c77318c8f66ee7b5e902ec406d272b93ab8

SHA256
e37a10c7f414cc582b1b3a1ad3f63f5f90ec2bb5136a395302cff911df92234a

SHA512
0dbae18a86754f2a4de126a23099df0090e03f3725f90d312ca613770de33cd19c7141a65eaa60ca27599187bb3f1ebe248a5b652783fc043de597d2c3a16e63

Download Submit
\Windows\system\YZfwDWY.exe

Filesize
1.7MB

MD5
fc95c0dd93911f061284e85e999f06fd

SHA1
c30d4c6fb08f6e8d7f268fe0b17426a8dec9ddb0

SHA256
c704e3a446dff2af1727eee8d51665c30bffd7961df1ffb17cc8d7e2458d04d0

SHA512
d838cbe954c5bd7b49cfebfc62a5a32a1cb4af681546d0901738d5418b35cd7a3758c8a1a08bf12e37a5c34cf4a333fe62eb9be85d11bddd803572162c40d9bb

Download Submit
\Windows\system\alxXhLA.exe

Filesize
1.7MB

MD5
a5464e50850722791126748a127f3cc8

SHA1
69404ed1b90901d8978801b95dc771edec133dd5

SHA256
10d1a143b5cf604646b58d81e7fa1af1a5b2c15c6c12ab0dcff325986d580bfa

SHA512
18b0db85fcc9c8ecafd489b29a319f3e308087266bae7122f4a0ded97ca68dc8eec6f17b1e3a54109cfb591b995d6edeba9238cb9b71911a2c7d5a512d09efcd

Download Submit
\Windows\system\gBdzMFF.exe

Filesize
1.7MB

MD5
7f42de58890ed407e36e55804dc322f1

SHA1
5ee4beefa66ac53f32fb957dbf8ec0842e01b44c

SHA256
8b682e31adc992f75efc0cf1ccfbd24485b6ae0a4a1c30fe05c3814efa03c643

SHA512
e2dd8d3426e70dbcb1484218103753f5d32780614cf3832099f784331435de9414a983f4104b37622c29e50b089567e857346ccac819424a6a8f10dded423f6c

Download Submit
\Windows\system\gLTyGHH.exe

Filesize
1.7MB

MD5
3c25099e8decf66aa8091f47f358d3c3

SHA1
7695e69bd3283c03d98f4e286d52eba7aa897e41

SHA256
29130695954006d6510ccd3c4f96847f18844eb66fe641b670d7da9305f14b24

SHA512
1ce63be0e42901a9b0f5a483a0d76f994b3523fbe57a0d73d1466038e0b57882f2b2a50fb98a8921ad20f3580c203e6ec5ac29de5d69b3a1ea63da4d8e980d34

Download Submit
\Windows\system\nIZoaTb.exe

Filesize
1.7MB

MD5
84f1670c7b0c87ed1aa792d13859b4ad

SHA1
bef0d463f96f6b46f246c166244cb8685a3a2548

SHA256
4ec1c24f62655899610df86c7cc952abd44b1b6984680310bb601711e8bed182

SHA512
cddac32c41ffa0df2eecb1569488dcfe1db3dcc18f76eb8b44c175dd6bcd5a2ff4f8eff395b1365f838b8d2051b1ced9ec079198ac67e6aef7c5ba9f3d44576a

Download Submit
\Windows\system\ovDZiHT.exe

Filesize
1.7MB

MD5
96282e0832bc90b7cb2e00ecea273e08

SHA1
21d3db998a9c5f58f8a8e6f7e3ccba621d46de55

SHA256
a936868803279b4e83a949ef77fbf5e396c9cf26176cbec7b475cbc7a53501f1

SHA512
d8561c852b31471a54ff6075ec6478aa5b33eff1f59dab65aa8f926eff437695190846e3206ceb37346dbb37e3ae42827a2f1346325ddf4b485ef2d2c5319a70

Download Submit
\Windows\system\qbWYrCs.exe

Filesize
1.7MB

MD5
381991c6800e7ec680c78378f1c5f35f

SHA1
17c944d5fabbba20e73d3fa29e1437a1e57672ec

SHA256
135401b52b746a4866cc5498d096b6ba08057c376f9ad190712d5d26474b0fda

SHA512
215ec6d44de7be98a87f94b7b26fafb801c6a2a4d447dc908322e15aa71903062fd94b1c44ababb9b9d7333cc93b86a984c3c30f659ae22b1722c9eb0a806067

Download Submit
\Windows\system\qxxBMim.exe

Filesize
1.7MB

MD5
91895b05d084ca3733c081e8def2af31

SHA1
0a9e5522bcc980214e250dc1ffdbbe54a1a1a81c

SHA256
396f315ba81cc2467c0917e730dca780a33157d073c4f4b0e633692d05531630

SHA512
c2a3786aeee251838e17edfbe8c69cbcdf633a7f502b4afda313f0f6eee0f8550706186b6d0655294d6b42f0ffea76f821347dbbf37e4763239956541d19c3da

Download Submit
\Windows\system\uurYXKW.exe

Filesize
1.7MB

MD5
e8c7138f68ca0187d8bb26ba7077829b

SHA1
e156600075e9503922c31d39a8331032f514e6c6

SHA256
5cbb1ab8e34d4cb384bb9bbf5d0371b3cb0b5bf5ae6a6298ffe4e693dd027ead

SHA512
91eb8dd928644984c6aebaa132b49db47bdb2882c50b9de97754b789e329cd60fdb4b5e454b9c74b077f784e231b4919077693deb6c7002f9ab425713fad7150

Download Submit
\Windows\system\wgPVLMd.exe

Filesize
1.7MB

MD5
d5f1ce63b2d15449bcaae8e86166d34c

SHA1
df81f5e2250163e844011db4116725fa4b498965

SHA256
1ba1196200a9bd62e36b80e283d606e4ccffdd285a6ad20387e24df9c35990b1

SHA512
ab8552c180adbee60e94a9f9096734d44e07bb39dba9d56431e907b79f1d7b6e6e9df00a954d400c990ac78c1e22cba24b6b4a6791a4b0a987e4fc063c035557

Download Submit
\Windows\system\xmfayep.exe

Filesize
1.7MB

MD5
c4f062e83c2c11c66d29cc2676c60e56

SHA1
243fc0ae8df6a98e46ae8c0895cad2eb77f6e4a2

SHA256
9d3d7a3158cca1192deebac1e3d55000d183a379f3b3687c5a8e26c8bc4432c9

SHA512
7c9614482898bdd1cae3c365d9cbad6e4ef943c48039b67079f8669522961edbaa97adff5290ac03621871139d2168386f22f06c2c67b9cf9fe00c2740ae81f3

Download Submit
memory/2332-5297-0x000000013F240000-0x000000013F632000-memory.dmp

Filesize
3.9MB

Download
memory/2332-120-0x000000013F240000-0x000000013F632000-memory.dmp

Filesize
3.9MB

Download
memory/2352-22-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/2352-5251-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/2412-59-0x0000000002790000-0x0000000002798000-memory.dmp

Filesize
32KB

Download
memory/2412-56-0x000000001B600000-0x000000001B8E2000-memory.dmp

Filesize
2.9MB

Download
memory/2536-38-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

Filesize
3.9MB

Download
memory/2536-14909-0x0000000003240000-0x0000000003632000-memory.dmp

Filesize
3.9MB

Download
memory/2536-39-0x000000013FAE0000-0x000000013FED2000-memory.dmp

Filesize
3.9MB

Download
memory/2536-43-0x0000000003240000-0x0000000003632000-memory.dmp

Filesize
3.9MB

Download
memory/2536-45-0x000000013FBF0000-0x000000013FFE2000-memory.dmp

Filesize
3.9MB

Download
memory/2536-127-0x000000013F870000-0x000000013FC62000-memory.dmp

Filesize
3.9MB

Download
memory/2536-48-0x000000013F870000-0x000000013FC62000-memory.dmp

Filesize
3.9MB

Download
memory/2536-51-0x0000000003240000-0x0000000003632000-memory.dmp

Filesize
3.9MB

Download
memory/2536-76-0x00000000034C0000-0x00000000038B2000-memory.dmp

Filesize
3.9MB

Download
memory/2536-0-0x000000013F240000-0x000000013F632000-memory.dmp

Filesize
3.9MB

Download
memory/2536-119-0x000000013FD40000-0x0000000140132000-memory.dmp

Filesize
3.9MB

Download
memory/2536-122-0x000000013FAB0000-0x000000013FEA2000-memory.dmp

Filesize
3.9MB

Download
memory/2536-58-0x000000013FC60000-0x0000000140052000-memory.dmp

Filesize
3.9MB

Download
memory/2536-5653-0x000000013F240000-0x000000013F632000-memory.dmp

Filesize
3.9MB

Download
memory/2536-1-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/2536-12395-0x000000013FBF0000-0x000000013FFE2000-memory.dmp

Filesize
3.9MB

Download
memory/2536-125-0x000000013FCE0000-0x00000001400D2000-memory.dmp

Filesize
3.9MB

Download
memory/2536-11-0x0000000003240000-0x0000000003632000-memory.dmp

Filesize
3.9MB

Download
memory/2648-5298-0x000000013FCE0000-0x00000001400D2000-memory.dmp

Filesize
3.9MB

Download
memory/2648-126-0x000000013FCE0000-0x00000001400D2000-memory.dmp

Filesize
3.9MB

Download
memory/2700-46-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

Filesize
3.9MB

Download
memory/2700-5230-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

Filesize
3.9MB

Download
memory/2716-5247-0x000000013F370000-0x000000013F762000-memory.dmp

Filesize
3.9MB

Download
memory/2716-47-0x000000013F370000-0x000000013F762000-memory.dmp

Filesize
3.9MB

Download
memory/2720-50-0x000000013FAE0000-0x000000013FED2000-memory.dmp

Filesize
3.9MB

Download
memory/2720-5249-0x000000013FAE0000-0x000000013FED2000-memory.dmp

Filesize
3.9MB

Download
memory/2724-5291-0x000000013FC60000-0x0000000140052000-memory.dmp

Filesize
3.9MB

Download
memory/2764-54-0x000000013F870000-0x000000013FC62000-memory.dmp

Filesize
3.9MB

Download
memory/2764-5217-0x000000013F870000-0x000000013FC62000-memory.dmp

Filesize
3.9MB

Download
memory/2816-5223-0x000000013FBF0000-0x000000013FFE2000-memory.dmp

Filesize
3.9MB

Download
memory/2816-55-0x000000013FBF0000-0x000000013FFE2000-memory.dmp

Filesize
3.9MB

Download
memory/2900-5218-0x000000013F5A0000-0x000000013F992000-memory.dmp

Filesize
3.9MB

Download
memory/2900-52-0x000000013F5A0000-0x000000013F992000-memory.dmp

Filesize
3.9MB

Download