xmrig | 6fc4f5169c24e03fef270ca545f7a0648c278312bd5ef5a90034d832ec9b9d28

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2024, 23:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
Size

1.8MB
MD5

02f4fae01b12eb37197a3de8c023ca87
SHA1

7106b67f44cdc7ff0179b2fd8cc3a0ae52454478
SHA256

6fc4f5169c24e03fef270ca545f7a0648c278312bd5ef5a90034d832ec9b9d28
SHA512

a76c1c5d8882447727411185fca5152643ac351c0f8011639137c20963dbd122a13b68fd47f40e1d22978ef9b43256a2666ab83f4446ba63a41e37d402a57dbe
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p1HzDgUf:NABf

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 39 IoCs

miner

resource	yara_rule
behavioral2/memory/4428-53-0x00007FF620560000-0x00007FF620952000-memory.dmp	xmrig
behavioral2/memory/3492-508-0x00007FF757320000-0x00007FF757712000-memory.dmp	xmrig
behavioral2/memory/4920-1488-0x00007FF65FDA0000-0x00007FF660192000-memory.dmp	xmrig
behavioral2/memory/732-1526-0x00007FF692F30000-0x00007FF693322000-memory.dmp	xmrig
behavioral2/memory/3432-1485-0x00007FF707390000-0x00007FF707782000-memory.dmp	xmrig
behavioral2/memory/4368-1349-0x00007FF7D9E20000-0x00007FF7DA212000-memory.dmp	xmrig
behavioral2/memory/1860-1251-0x00007FF658890000-0x00007FF658C82000-memory.dmp	xmrig
behavioral2/memory/1124-1077-0x00007FF67DED0000-0x00007FF67E2C2000-memory.dmp	xmrig
behavioral2/memory/540-1074-0x00007FF706B60000-0x00007FF706F52000-memory.dmp	xmrig
behavioral2/memory/2312-878-0x00007FF733C00000-0x00007FF733FF2000-memory.dmp	xmrig
behavioral2/memory/4936-733-0x00007FF695EC0000-0x00007FF6962B2000-memory.dmp	xmrig
behavioral2/memory/1712-660-0x00007FF662DA0000-0x00007FF663192000-memory.dmp	xmrig
behavioral2/memory/2196-655-0x00007FF71DC10000-0x00007FF71E002000-memory.dmp	xmrig
behavioral2/memory/1196-426-0x00007FF6365D0000-0x00007FF6369C2000-memory.dmp	xmrig
behavioral2/memory/220-333-0x00007FF601FA0000-0x00007FF602392000-memory.dmp	xmrig
behavioral2/memory/4980-248-0x00007FF600290000-0x00007FF600682000-memory.dmp	xmrig
behavioral2/memory/628-205-0x00007FF66F750000-0x00007FF66FB42000-memory.dmp	xmrig
behavioral2/memory/4484-22-0x00007FF743A70000-0x00007FF743E62000-memory.dmp	xmrig
behavioral2/memory/732-5289-0x00007FF692F30000-0x00007FF693322000-memory.dmp	xmrig
behavioral2/memory/4428-5296-0x00007FF620560000-0x00007FF620952000-memory.dmp	xmrig
behavioral2/memory/628-5429-0x00007FF66F750000-0x00007FF66FB42000-memory.dmp	xmrig
behavioral2/memory/4980-5431-0x00007FF600290000-0x00007FF600682000-memory.dmp	xmrig
behavioral2/memory/2592-5434-0x00007FF76F2C0000-0x00007FF76F6B2000-memory.dmp	xmrig
behavioral2/memory/1712-5444-0x00007FF662DA0000-0x00007FF663192000-memory.dmp	xmrig
behavioral2/memory/3688-5449-0x00007FF6A9FC0000-0x00007FF6AA3B2000-memory.dmp	xmrig
behavioral2/memory/2196-5452-0x00007FF71DC10000-0x00007FF71E002000-memory.dmp	xmrig
behavioral2/memory/4936-5461-0x00007FF695EC0000-0x00007FF6962B2000-memory.dmp	xmrig
behavioral2/memory/1196-5465-0x00007FF6365D0000-0x00007FF6369C2000-memory.dmp	xmrig
behavioral2/memory/2312-5468-0x00007FF733C00000-0x00007FF733FF2000-memory.dmp	xmrig
behavioral2/memory/1620-5460-0x00007FF6BA9F0000-0x00007FF6BADE2000-memory.dmp	xmrig
behavioral2/memory/4568-5442-0x00007FF79F770000-0x00007FF79FB62000-memory.dmp	xmrig
behavioral2/memory/4920-5440-0x00007FF65FDA0000-0x00007FF660192000-memory.dmp	xmrig
behavioral2/memory/4368-5484-0x00007FF7D9E20000-0x00007FF7DA212000-memory.dmp	xmrig
behavioral2/memory/1860-5486-0x00007FF658890000-0x00007FF658C82000-memory.dmp	xmrig
behavioral2/memory/3432-5488-0x00007FF707390000-0x00007FF707782000-memory.dmp	xmrig
behavioral2/memory/1124-5479-0x00007FF67DED0000-0x00007FF67E2C2000-memory.dmp	xmrig
behavioral2/memory/3492-5473-0x00007FF757320000-0x00007FF757712000-memory.dmp	xmrig
behavioral2/memory/540-5532-0x00007FF706B60000-0x00007FF706F52000-memory.dmp	xmrig
behavioral2/memory/672-5739-0x00007FF7E7960000-0x00007FF7E7D52000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1180	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4484	emjmTuI.exe
4428	fWRQCga.exe
4920	jMiIehR.exe
732	lzYLGio.exe
2592	ZhlhbmR.exe
4568	YygnWLu.exe
3688	yjQgTCR.exe
628	SygECzS.exe
4980	RvznImz.exe
220	mkdHoDr.exe
1620	HGdIhJe.exe
1196	PiTjWiV.exe
2504	oXXwJnA.exe
3492	AgltKAe.exe
2196	IEBcLyM.exe
1712	UyFnEIX.exe
4936	YZsUpwV.exe
2312	QZoFCNz.exe
1840	iJmQEal.exe
540	XXgurPA.exe
1124	KUQaEoi.exe
1860	SWksSIL.exe
4368	OImoULV.exe
3432	IEtpamx.exe
3872	FGCGdqo.exe
1420	lgvKTUg.exe
4908	bjDjcwC.exe
2492	cDbOtFm.exe
968	NIxrqWr.exe
2056	bXKOEia.exe
4276	oXlhvMc.exe
3704	BscaWtg.exe
3016	DMHIfHR.exe
1456	EyyBvfm.exe
3960	nWTzwVC.exe
4996	OTfqwQK.exe
3108	FLrmZfI.exe
640	AFdyzwL.exe
2656	ZFiiZEQ.exe
4952	prNrGXH.exe
1416	LRbMGPp.exe
2432	rmiJXkI.exe
5052	fTigAmo.exe
4392	OSzlLcw.exe
3652	budSOYC.exe
2728	kozqTKw.exe
4020	accUCwR.exe
2420	FqBfxwn.exe
1140	TjyseCu.exe
2524	odCpbDE.exe
3884	dBhPmnk.exe
3080	hMdtXAr.exe
5056	dlTarxb.exe
1868	unFyDyC.exe
804	MSuQuEE.exe
3620	ziqXpjH.exe
4336	ICqEVEM.exe
5088	JPIOPIY.exe
1700	YwsbdeE.exe
832	HAmLNGG.exe
3356	TaaGrZI.exe
1756	aYIGXoc.exe
1464	HkNONXt.exe
1812	JeYUJzO.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/672-0-0x00007FF7E7960000-0x00007FF7E7D52000-memory.dmp	upx
behavioral2/files/0x0007000000023489-32.dat	upx
behavioral2/files/0x0007000000023488-29.dat	upx
behavioral2/memory/4428-53-0x00007FF620560000-0x00007FF620952000-memory.dmp	upx
behavioral2/files/0x000700000002348d-52.dat	upx
behavioral2/files/0x000700000002348c-48.dat	upx
behavioral2/files/0x000700000002348b-45.dat	upx
behavioral2/files/0x000700000002348a-44.dat	upx
behavioral2/files/0x0008000000023482-38.dat	upx
behavioral2/files/0x0007000000023487-26.dat	upx
behavioral2/files/0x000700000002348e-57.dat	upx
behavioral2/files/0x0007000000023496-86.dat	upx
behavioral2/memory/3492-508-0x00007FF757320000-0x00007FF757712000-memory.dmp	upx
behavioral2/memory/4920-1488-0x00007FF65FDA0000-0x00007FF660192000-memory.dmp	upx
behavioral2/memory/732-1526-0x00007FF692F30000-0x00007FF693322000-memory.dmp	upx
behavioral2/memory/3432-1485-0x00007FF707390000-0x00007FF707782000-memory.dmp	upx
behavioral2/memory/4368-1349-0x00007FF7D9E20000-0x00007FF7DA212000-memory.dmp	upx
behavioral2/memory/1860-1251-0x00007FF658890000-0x00007FF658C82000-memory.dmp	upx
behavioral2/memory/1124-1077-0x00007FF67DED0000-0x00007FF67E2C2000-memory.dmp	upx
behavioral2/memory/540-1074-0x00007FF706B60000-0x00007FF706F52000-memory.dmp	upx
behavioral2/memory/2312-878-0x00007FF733C00000-0x00007FF733FF2000-memory.dmp	upx
behavioral2/memory/4936-733-0x00007FF695EC0000-0x00007FF6962B2000-memory.dmp	upx
behavioral2/memory/1712-660-0x00007FF662DA0000-0x00007FF663192000-memory.dmp	upx
behavioral2/memory/2196-655-0x00007FF71DC10000-0x00007FF71E002000-memory.dmp	upx
behavioral2/memory/1196-426-0x00007FF6365D0000-0x00007FF6369C2000-memory.dmp	upx
behavioral2/memory/220-333-0x00007FF601FA0000-0x00007FF602392000-memory.dmp	upx
behavioral2/memory/4980-248-0x00007FF600290000-0x00007FF600682000-memory.dmp	upx
behavioral2/memory/628-205-0x00007FF66F750000-0x00007FF66FB42000-memory.dmp	upx
behavioral2/files/0x00070000000234ad-204.dat	upx
behavioral2/files/0x00070000000234ac-203.dat	upx
behavioral2/files/0x00070000000234ab-202.dat	upx
behavioral2/files/0x00070000000234a9-195.dat	upx
behavioral2/files/0x0007000000023491-191.dat	upx
behavioral2/files/0x0007000000023497-185.dat	upx
behavioral2/files/0x0007000000023495-176.dat	upx
behavioral2/files/0x0007000000023490-175.dat	upx
behavioral2/files/0x00070000000234a8-170.dat	upx
behavioral2/files/0x00070000000234a6-161.dat	upx
behavioral2/files/0x00070000000234a7-160.dat	upx
behavioral2/files/0x000700000002349a-156.dat	upx
behavioral2/files/0x00070000000234a5-155.dat	upx
behavioral2/memory/3688-147-0x00007FF6A9FC0000-0x00007FF6AA3B2000-memory.dmp	upx
behavioral2/files/0x00070000000234a4-146.dat	upx
behavioral2/files/0x00070000000234a3-145.dat	upx
behavioral2/files/0x00070000000234a2-141.dat	upx
behavioral2/files/0x00070000000234a1-140.dat	upx
behavioral2/files/0x00070000000234a0-199.dat	upx
behavioral2/files/0x000700000002349f-133.dat	upx
behavioral2/files/0x0007000000023492-184.dat	upx
behavioral2/files/0x000700000002349e-180.dat	upx
behavioral2/files/0x000700000002349c-159.dat	upx
behavioral2/files/0x000700000002349b-122.dat	upx
behavioral2/files/0x0007000000023494-121.dat	upx
behavioral2/files/0x0007000000023498-106.dat	upx
behavioral2/memory/4568-102-0x00007FF79F770000-0x00007FF79FB62000-memory.dmp	upx
behavioral2/files/0x0007000000023493-136.dat	upx
behavioral2/files/0x000700000002349d-127.dat	upx
behavioral2/files/0x000700000002348f-77.dat	upx
behavioral2/files/0x0007000000023499-113.dat	upx
behavioral2/files/0x0007000000023486-69.dat	upx
behavioral2/memory/2592-62-0x00007FF76F2C0000-0x00007FF76F6B2000-memory.dmp	upx
behavioral2/memory/4484-22-0x00007FF743A70000-0x00007FF743E62000-memory.dmp	upx
behavioral2/files/0x000800000002347f-11.dat	upx
behavioral2/memory/732-5289-0x00007FF692F30000-0x00007FF693322000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\VFtICYQ.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\FsiGbYt.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\lwrPcEn.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\WfGCoXz.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\BvNhPOC.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\jGhXwBf.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\BohYvSO.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\yCzluEq.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\RWXpink.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\YHNMpeV.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\IfbfIcJ.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\mLXGpRU.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\mquDfQP.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\QqJPEeB.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\TnMiqxs.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\NNepctg.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\yoUoOve.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\IGsLQPP.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\QgQyRCk.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\OpXCsah.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\VSJzARr.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\OQhynUH.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\BTZIROD.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\oLDtlsF.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\LCUDodS.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\YfRPuyq.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\twjmthp.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\QUNlNeT.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\WccNlJC.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\KRTfDkK.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\HbyxzXB.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\CmMWgXz.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\pRvtuCu.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\LAXTIFW.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\rrUvpXo.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\jYUXHUJ.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\Trlojgq.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\imHUXDW.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\VjWOqOt.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\aNgLyuS.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\fRtOGrv.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\QBPOgMi.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\ybOqFDt.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\OBNIYCC.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\iFzVRRS.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\NQMWmTD.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\QjyNNUk.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\KXklhBr.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\aEYLXyc.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\VhVIRPd.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\HjsuwMi.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\lEJNmyO.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\CuDNViZ.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\HhUFLYS.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\acWuHsg.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\RYDwAmF.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\ZEeZVOm.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\jJXkfVR.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\SEeQLtx.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\NQUuZYZ.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\FhFhnKX.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\YGRMYfA.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\ZMWVfbz.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\qojGUkU.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1180	powershell.exe
1180	powershell.exe
1180	powershell.exe
1180	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
Token: SeDebugPrivilege	1180	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 672 wrote to memory of 1180	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	86
PID 672 wrote to memory of 1180	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	86
PID 672 wrote to memory of 4484	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	87
PID 672 wrote to memory of 4484	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	87
PID 672 wrote to memory of 4428	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	88
PID 672 wrote to memory of 4428	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	88
PID 672 wrote to memory of 4920	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	89
PID 672 wrote to memory of 4920	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	89
PID 672 wrote to memory of 732	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	90
PID 672 wrote to memory of 732	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	90
PID 672 wrote to memory of 2592	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	91
PID 672 wrote to memory of 2592	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	91
PID 672 wrote to memory of 4568	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	92
PID 672 wrote to memory of 4568	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	92
PID 672 wrote to memory of 3688	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	93
PID 672 wrote to memory of 3688	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	93
PID 672 wrote to memory of 628	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	94
PID 672 wrote to memory of 628	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	94
PID 672 wrote to memory of 4980	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	95
PID 672 wrote to memory of 4980	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	95
PID 672 wrote to memory of 220	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	96
PID 672 wrote to memory of 220	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	96
PID 672 wrote to memory of 1620	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	97
PID 672 wrote to memory of 1620	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	97
PID 672 wrote to memory of 1712	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	98
PID 672 wrote to memory of 1712	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	98
PID 672 wrote to memory of 1196	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	99
PID 672 wrote to memory of 1196	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	99
PID 672 wrote to memory of 2504	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	100
PID 672 wrote to memory of 2504	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	100
PID 672 wrote to memory of 3492	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	101
PID 672 wrote to memory of 3492	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	101
PID 672 wrote to memory of 2196	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	102
PID 672 wrote to memory of 2196	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	102
PID 672 wrote to memory of 1860	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	103
PID 672 wrote to memory of 1860	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	103
PID 672 wrote to memory of 3872	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	104
PID 672 wrote to memory of 3872	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	104
PID 672 wrote to memory of 4936	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	105
PID 672 wrote to memory of 4936	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	105
PID 672 wrote to memory of 2312	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	106
PID 672 wrote to memory of 2312	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	106
PID 672 wrote to memory of 1840	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	107
PID 672 wrote to memory of 1840	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	107
PID 672 wrote to memory of 540	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	108
PID 672 wrote to memory of 540	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	108
PID 672 wrote to memory of 1124	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	109
PID 672 wrote to memory of 1124	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	109
PID 672 wrote to memory of 4368	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	110
PID 672 wrote to memory of 4368	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	110
PID 672 wrote to memory of 3016	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	111
PID 672 wrote to memory of 3016	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	111
PID 672 wrote to memory of 3432	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	112
PID 672 wrote to memory of 3432	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	112
PID 672 wrote to memory of 1420	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	113
PID 672 wrote to memory of 1420	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	113
PID 672 wrote to memory of 4908	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	114
PID 672 wrote to memory of 4908	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	114
PID 672 wrote to memory of 640	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	115
PID 672 wrote to memory of 640	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	115
PID 672 wrote to memory of 2492	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	116
PID 672 wrote to memory of 2492	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	116
PID 672 wrote to memory of 968	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	117
PID 672 wrote to memory of 968	672	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	117

C:\Users\Admin\AppData\Local\Temp\02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1180
- C:\Windows\System\emjmTuI.exe
  C:\Windows\System\emjmTuI.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\fWRQCga.exe
  C:\Windows\System\fWRQCga.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\jMiIehR.exe
  C:\Windows\System\jMiIehR.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\lzYLGio.exe
  C:\Windows\System\lzYLGio.exe
  2⤵
  - Executes dropped EXE
  PID:732
- C:\Windows\System\ZhlhbmR.exe
  C:\Windows\System\ZhlhbmR.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\YygnWLu.exe
  C:\Windows\System\YygnWLu.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\yjQgTCR.exe
  C:\Windows\System\yjQgTCR.exe
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Windows\System\SygECzS.exe
  C:\Windows\System\SygECzS.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\RvznImz.exe
  C:\Windows\System\RvznImz.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\mkdHoDr.exe
  C:\Windows\System\mkdHoDr.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\HGdIhJe.exe
  C:\Windows\System\HGdIhJe.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\UyFnEIX.exe
  C:\Windows\System\UyFnEIX.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\PiTjWiV.exe
  C:\Windows\System\PiTjWiV.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\oXXwJnA.exe
  C:\Windows\System\oXXwJnA.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\AgltKAe.exe
  C:\Windows\System\AgltKAe.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\IEBcLyM.exe
  C:\Windows\System\IEBcLyM.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\SWksSIL.exe
  C:\Windows\System\SWksSIL.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\FGCGdqo.exe
  C:\Windows\System\FGCGdqo.exe
  2⤵
  - Executes dropped EXE
  PID:3872
- C:\Windows\System\YZsUpwV.exe
  C:\Windows\System\YZsUpwV.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\QZoFCNz.exe
  C:\Windows\System\QZoFCNz.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\iJmQEal.exe
  C:\Windows\System\iJmQEal.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\XXgurPA.exe
  C:\Windows\System\XXgurPA.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\KUQaEoi.exe
  C:\Windows\System\KUQaEoi.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\OImoULV.exe
  C:\Windows\System\OImoULV.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\DMHIfHR.exe
  C:\Windows\System\DMHIfHR.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\IEtpamx.exe
  C:\Windows\System\IEtpamx.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\lgvKTUg.exe
  C:\Windows\System\lgvKTUg.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\bjDjcwC.exe
  C:\Windows\System\bjDjcwC.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\AFdyzwL.exe
  C:\Windows\System\AFdyzwL.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\cDbOtFm.exe
  C:\Windows\System\cDbOtFm.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\NIxrqWr.exe
  C:\Windows\System\NIxrqWr.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\bXKOEia.exe
  C:\Windows\System\bXKOEia.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\oXlhvMc.exe
  C:\Windows\System\oXlhvMc.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\BscaWtg.exe
  C:\Windows\System\BscaWtg.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\rmiJXkI.exe
  C:\Windows\System\rmiJXkI.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\nWTzwVC.exe
  C:\Windows\System\nWTzwVC.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\EyyBvfm.exe
  C:\Windows\System\EyyBvfm.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\OTfqwQK.exe
  C:\Windows\System\OTfqwQK.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\FLrmZfI.exe
  C:\Windows\System\FLrmZfI.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\hMdtXAr.exe
  C:\Windows\System\hMdtXAr.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\ZFiiZEQ.exe
  C:\Windows\System\ZFiiZEQ.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\prNrGXH.exe
  C:\Windows\System\prNrGXH.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\LRbMGPp.exe
  C:\Windows\System\LRbMGPp.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\MSuQuEE.exe
  C:\Windows\System\MSuQuEE.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\YwsbdeE.exe
  C:\Windows\System\YwsbdeE.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\fTigAmo.exe
  C:\Windows\System\fTigAmo.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\OSzlLcw.exe
  C:\Windows\System\OSzlLcw.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\HkNONXt.exe
  C:\Windows\System\HkNONXt.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\budSOYC.exe
  C:\Windows\System\budSOYC.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\kozqTKw.exe
  C:\Windows\System\kozqTKw.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\WHQPscj.exe
  C:\Windows\System\WHQPscj.exe
  2⤵
  PID:5080
- C:\Windows\System\accUCwR.exe
  C:\Windows\System\accUCwR.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\FqBfxwn.exe
  C:\Windows\System\FqBfxwn.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\TjyseCu.exe
  C:\Windows\System\TjyseCu.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\odCpbDE.exe
  C:\Windows\System\odCpbDE.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\dBhPmnk.exe
  C:\Windows\System\dBhPmnk.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System\dlTarxb.exe
  C:\Windows\System\dlTarxb.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\unFyDyC.exe
  C:\Windows\System\unFyDyC.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\ziqXpjH.exe
  C:\Windows\System\ziqXpjH.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\ICqEVEM.exe
  C:\Windows\System\ICqEVEM.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\JPIOPIY.exe
  C:\Windows\System\JPIOPIY.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\HAmLNGG.exe
  C:\Windows\System\HAmLNGG.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\TaaGrZI.exe
  C:\Windows\System\TaaGrZI.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\aYIGXoc.exe
  C:\Windows\System\aYIGXoc.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\EPxzoEW.exe
  C:\Windows\System\EPxzoEW.exe
  2⤵
  PID:5020
- C:\Windows\System\JeYUJzO.exe
  C:\Windows\System\JeYUJzO.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\ZMAsQcg.exe
  C:\Windows\System\ZMAsQcg.exe
  2⤵
  PID:1652
- C:\Windows\System\lItJcEf.exe
  C:\Windows\System\lItJcEf.exe
  2⤵
  PID:1740
- C:\Windows\System\nWPYuPe.exe
  C:\Windows\System\nWPYuPe.exe
  2⤵
  PID:5072
- C:\Windows\System\aLVwhQs.exe
  C:\Windows\System\aLVwhQs.exe
  2⤵
  PID:3388
- C:\Windows\System\tRzGozE.exe
  C:\Windows\System\tRzGozE.exe
  2⤵
  PID:2884
- C:\Windows\System\gDeMije.exe
  C:\Windows\System\gDeMije.exe
  2⤵
  PID:3360
- C:\Windows\System\kzNgELA.exe
  C:\Windows\System\kzNgELA.exe
  2⤵
  PID:1212
- C:\Windows\System\zDjCYEF.exe
  C:\Windows\System\zDjCYEF.exe
  2⤵
  PID:4140
- C:\Windows\System\YGClztH.exe
  C:\Windows\System\YGClztH.exe
  2⤵
  PID:3516
- C:\Windows\System\NnanRSx.exe
  C:\Windows\System\NnanRSx.exe
  2⤵
  PID:4452
- C:\Windows\System\DKTpYqH.exe
  C:\Windows\System\DKTpYqH.exe
  2⤵
  PID:4812
- C:\Windows\System\yyGYOBM.exe
  C:\Windows\System\yyGYOBM.exe
  2⤵
  PID:3392
- C:\Windows\System\CeyhEKu.exe
  C:\Windows\System\CeyhEKu.exe
  2⤵
  PID:4212
- C:\Windows\System\dEsWMQQ.exe
  C:\Windows\System\dEsWMQQ.exe
  2⤵
  PID:868
- C:\Windows\System\ArmJmaQ.exe
  C:\Windows\System\ArmJmaQ.exe
  2⤵
  PID:2172
- C:\Windows\System\azYyGtC.exe
  C:\Windows\System\azYyGtC.exe
  2⤵
  PID:2452
- C:\Windows\System\HHvmGeb.exe
  C:\Windows\System\HHvmGeb.exe
  2⤵
  PID:4456
- C:\Windows\System\yscMWhj.exe
  C:\Windows\System\yscMWhj.exe
  2⤵
  PID:1332
- C:\Windows\System\GBzFzLK.exe
  C:\Windows\System\GBzFzLK.exe
  2⤵
  PID:3840
- C:\Windows\System\IghycYx.exe
  C:\Windows\System\IghycYx.exe
  2⤵
  PID:5140
- C:\Windows\System\uCgDJOl.exe
  C:\Windows\System\uCgDJOl.exe
  2⤵
  PID:5156
- C:\Windows\System\iKmcgXb.exe
  C:\Windows\System\iKmcgXb.exe
  2⤵
  PID:5184
- C:\Windows\System\oZOqPuC.exe
  C:\Windows\System\oZOqPuC.exe
  2⤵
  PID:5212
- C:\Windows\System\ExjEIRa.exe
  C:\Windows\System\ExjEIRa.exe
  2⤵
  PID:5232
- C:\Windows\System\RxXgcqL.exe
  C:\Windows\System\RxXgcqL.exe
  2⤵
  PID:5256
- C:\Windows\System\KJhbNsQ.exe
  C:\Windows\System\KJhbNsQ.exe
  2⤵
  PID:5276
- C:\Windows\System\iqkcCKT.exe
  C:\Windows\System\iqkcCKT.exe
  2⤵
  PID:5296
- C:\Windows\System\PiYGetq.exe
  C:\Windows\System\PiYGetq.exe
  2⤵
  PID:5320
- C:\Windows\System\LqSimki.exe
  C:\Windows\System\LqSimki.exe
  2⤵
  PID:5348
- C:\Windows\System\aHartcq.exe
  C:\Windows\System\aHartcq.exe
  2⤵
  PID:5368
- C:\Windows\System\UqJSHhJ.exe
  C:\Windows\System\UqJSHhJ.exe
  2⤵
  PID:5388
- C:\Windows\System\WbmDVIk.exe
  C:\Windows\System\WbmDVIk.exe
  2⤵
  PID:5412
- C:\Windows\System\EpwTlHQ.exe
  C:\Windows\System\EpwTlHQ.exe
  2⤵
  PID:5436
- C:\Windows\System\BoXpuNN.exe
  C:\Windows\System\BoXpuNN.exe
  2⤵
  PID:5452
- C:\Windows\System\HoOkYqy.exe
  C:\Windows\System\HoOkYqy.exe
  2⤵
  PID:5476
- C:\Windows\System\pCCvunb.exe
  C:\Windows\System\pCCvunb.exe
  2⤵
  PID:5496
- C:\Windows\System\ohqCDJA.exe
  C:\Windows\System\ohqCDJA.exe
  2⤵
  PID:5520
- C:\Windows\System\CgrLygk.exe
  C:\Windows\System\CgrLygk.exe
  2⤵
  PID:5536
- C:\Windows\System\oxQqWer.exe
  C:\Windows\System\oxQqWer.exe
  2⤵
  PID:5556
- C:\Windows\System\XLlMjvs.exe
  C:\Windows\System\XLlMjvs.exe
  2⤵
  PID:5576
- C:\Windows\System\JyJAepg.exe
  C:\Windows\System\JyJAepg.exe
  2⤵
  PID:5596
- C:\Windows\System\ZWLCQWH.exe
  C:\Windows\System\ZWLCQWH.exe
  2⤵
  PID:5616
- C:\Windows\System\XbcizfO.exe
  C:\Windows\System\XbcizfO.exe
  2⤵
  PID:5636
- C:\Windows\System\ptKKiNy.exe
  C:\Windows\System\ptKKiNy.exe
  2⤵
  PID:5652
- C:\Windows\System\njWRkEM.exe
  C:\Windows\System\njWRkEM.exe
  2⤵
  PID:5676
- C:\Windows\System\ydtfcvo.exe
  C:\Windows\System\ydtfcvo.exe
  2⤵
  PID:5692
- C:\Windows\System\nFBnZOa.exe
  C:\Windows\System\nFBnZOa.exe
  2⤵
  PID:5716
- C:\Windows\System\jnsLkua.exe
  C:\Windows\System\jnsLkua.exe
  2⤵
  PID:5740
- C:\Windows\System\YYKXyWm.exe
  C:\Windows\System\YYKXyWm.exe
  2⤵
  PID:5756
- C:\Windows\System\boqjlLB.exe
  C:\Windows\System\boqjlLB.exe
  2⤵
  PID:5780
- C:\Windows\System\BbDkCnL.exe
  C:\Windows\System\BbDkCnL.exe
  2⤵
  PID:5800
- C:\Windows\System\nSlYeqX.exe
  C:\Windows\System\nSlYeqX.exe
  2⤵
  PID:5820
- C:\Windows\System\EMDBQac.exe
  C:\Windows\System\EMDBQac.exe
  2⤵
  PID:5872
- C:\Windows\System\QidMuUO.exe
  C:\Windows\System\QidMuUO.exe
  2⤵
  PID:5892
- C:\Windows\System\SeTeohi.exe
  C:\Windows\System\SeTeohi.exe
  2⤵
  PID:5928
- C:\Windows\System\LNdMLLx.exe
  C:\Windows\System\LNdMLLx.exe
  2⤵
  PID:5944
- C:\Windows\System\xZsojyV.exe
  C:\Windows\System\xZsojyV.exe
  2⤵
  PID:5964
- C:\Windows\System\rEwKTsX.exe
  C:\Windows\System\rEwKTsX.exe
  2⤵
  PID:5988
- C:\Windows\System\SavmyGQ.exe
  C:\Windows\System\SavmyGQ.exe
  2⤵
  PID:6012
- C:\Windows\System\GHIdnHD.exe
  C:\Windows\System\GHIdnHD.exe
  2⤵
  PID:6040
- C:\Windows\System\LeVRymi.exe
  C:\Windows\System\LeVRymi.exe
  2⤵
  PID:6060
- C:\Windows\System\DcByaMT.exe
  C:\Windows\System\DcByaMT.exe
  2⤵
  PID:6088
- C:\Windows\System\abYkwgT.exe
  C:\Windows\System\abYkwgT.exe
  2⤵
  PID:6104
- C:\Windows\System\dAGqlpv.exe
  C:\Windows\System\dAGqlpv.exe
  2⤵
  PID:6132
- C:\Windows\System\tBtgDmM.exe
  C:\Windows\System\tBtgDmM.exe
  2⤵
  PID:3880
- C:\Windows\System\twQztbl.exe
  C:\Windows\System\twQztbl.exe
  2⤵
  PID:3232
- C:\Windows\System\XgdaKUE.exe
  C:\Windows\System\XgdaKUE.exe
  2⤵
  PID:4476
- C:\Windows\System\nsGEmSV.exe
  C:\Windows\System\nsGEmSV.exe
  2⤵
  PID:228
- C:\Windows\System\kqAHnFm.exe
  C:\Windows\System\kqAHnFm.exe
  2⤵
  PID:5044
- C:\Windows\System\HnXiNir.exe
  C:\Windows\System\HnXiNir.exe
  2⤵
  PID:3304
- C:\Windows\System\MCPCXxs.exe
  C:\Windows\System\MCPCXxs.exe
  2⤵
  PID:1548
- C:\Windows\System\mopPcaZ.exe
  C:\Windows\System\mopPcaZ.exe
  2⤵
  PID:4080
- C:\Windows\System\bYOktUt.exe
  C:\Windows\System\bYOktUt.exe
  2⤵
  PID:1584
- C:\Windows\System\bgrXkly.exe
  C:\Windows\System\bgrXkly.exe
  2⤵
  PID:5228
- C:\Windows\System\kceeSrm.exe
  C:\Windows\System\kceeSrm.exe
  2⤵
  PID:4052
- C:\Windows\System\UEDYJyr.exe
  C:\Windows\System\UEDYJyr.exe
  2⤵
  PID:5292
- C:\Windows\System\JYAZDFp.exe
  C:\Windows\System\JYAZDFp.exe
  2⤵
  PID:4956
- C:\Windows\System\FihrJiJ.exe
  C:\Windows\System\FihrJiJ.exe
  2⤵
  PID:5408
- C:\Windows\System\eomdUHM.exe
  C:\Windows\System\eomdUHM.exe
  2⤵
  PID:4356
- C:\Windows\System\IxRErAc.exe
  C:\Windows\System\IxRErAc.exe
  2⤵
  PID:5584
- C:\Windows\System\MqlbojX.exe
  C:\Windows\System\MqlbojX.exe
  2⤵
  PID:6148
- C:\Windows\System\kutbXue.exe
  C:\Windows\System\kutbXue.exe
  2⤵
  PID:6180
- C:\Windows\System\TCiKePd.exe
  C:\Windows\System\TCiKePd.exe
  2⤵
  PID:6208
- C:\Windows\System\GIzecGA.exe
  C:\Windows\System\GIzecGA.exe
  2⤵
  PID:6224
- C:\Windows\System\iJOJPOj.exe
  C:\Windows\System\iJOJPOj.exe
  2⤵
  PID:6248
- C:\Windows\System\YquygYB.exe
  C:\Windows\System\YquygYB.exe
  2⤵
  PID:6276
- C:\Windows\System\tFCYxCK.exe
  C:\Windows\System\tFCYxCK.exe
  2⤵
  PID:6300
- C:\Windows\System\PvAuCgs.exe
  C:\Windows\System\PvAuCgs.exe
  2⤵
  PID:6320
- C:\Windows\System\TkHgwns.exe
  C:\Windows\System\TkHgwns.exe
  2⤵
  PID:6376
- C:\Windows\System\sDwDMFE.exe
  C:\Windows\System\sDwDMFE.exe
  2⤵
  PID:6396
- C:\Windows\System\ugSklDD.exe
  C:\Windows\System\ugSklDD.exe
  2⤵
  PID:6420
- C:\Windows\System\PeOycXh.exe
  C:\Windows\System\PeOycXh.exe
  2⤵
  PID:6452
- C:\Windows\System\Ghgqsco.exe
  C:\Windows\System\Ghgqsco.exe
  2⤵
  PID:6472
- C:\Windows\System\vAOCyuc.exe
  C:\Windows\System\vAOCyuc.exe
  2⤵
  PID:6492
- C:\Windows\System\kMTMOHe.exe
  C:\Windows\System\kMTMOHe.exe
  2⤵
  PID:6528
- C:\Windows\System\JIUvNWy.exe
  C:\Windows\System\JIUvNWy.exe
  2⤵
  PID:6560
- C:\Windows\System\gZIHYWF.exe
  C:\Windows\System\gZIHYWF.exe
  2⤵
  PID:6580
- C:\Windows\System\ALQIyfH.exe
  C:\Windows\System\ALQIyfH.exe
  2⤵
  PID:6608
- C:\Windows\System\gntxiBC.exe
  C:\Windows\System\gntxiBC.exe
  2⤵
  PID:6632
- C:\Windows\System\ZsKcTwU.exe
  C:\Windows\System\ZsKcTwU.exe
  2⤵
  PID:6664
- C:\Windows\System\PaDCbsU.exe
  C:\Windows\System\PaDCbsU.exe
  2⤵
  PID:6688
- C:\Windows\System\szLLObu.exe
  C:\Windows\System\szLLObu.exe
  2⤵
  PID:6704
- C:\Windows\System\IorqqNA.exe
  C:\Windows\System\IorqqNA.exe
  2⤵
  PID:6724
- C:\Windows\System\fVINiGK.exe
  C:\Windows\System\fVINiGK.exe
  2⤵
  PID:6740
- C:\Windows\System\JMDPPiN.exe
  C:\Windows\System\JMDPPiN.exe
  2⤵
  PID:6760
- C:\Windows\System\LjWhRbK.exe
  C:\Windows\System\LjWhRbK.exe
  2⤵
  PID:6776
- C:\Windows\System\zgPApfe.exe
  C:\Windows\System\zgPApfe.exe
  2⤵
  PID:6796
- C:\Windows\System\jDjVfif.exe
  C:\Windows\System\jDjVfif.exe
  2⤵
  PID:6812
- C:\Windows\System\MLHaXGT.exe
  C:\Windows\System\MLHaXGT.exe
  2⤵
  PID:6836
- C:\Windows\System\nDQLbPo.exe
  C:\Windows\System\nDQLbPo.exe
  2⤵
  PID:6852
- C:\Windows\System\jXHMCtl.exe
  C:\Windows\System\jXHMCtl.exe
  2⤵
  PID:6876
- C:\Windows\System\NkBGMol.exe
  C:\Windows\System\NkBGMol.exe
  2⤵
  PID:6892
- C:\Windows\System\ASzhove.exe
  C:\Windows\System\ASzhove.exe
  2⤵
  PID:6916
- C:\Windows\System\PIlzBHz.exe
  C:\Windows\System\PIlzBHz.exe
  2⤵
  PID:6932
- C:\Windows\System\sCoXnhM.exe
  C:\Windows\System\sCoXnhM.exe
  2⤵
  PID:6956
- C:\Windows\System\iISctIq.exe
  C:\Windows\System\iISctIq.exe
  2⤵
  PID:6972
- C:\Windows\System\kGRxgqs.exe
  C:\Windows\System\kGRxgqs.exe
  2⤵
  PID:6992
- C:\Windows\System\ZZUDvId.exe
  C:\Windows\System\ZZUDvId.exe
  2⤵
  PID:7016
- C:\Windows\System\iWgHbOj.exe
  C:\Windows\System\iWgHbOj.exe
  2⤵
  PID:7032
- C:\Windows\System\rzkuQkJ.exe
  C:\Windows\System\rzkuQkJ.exe
  2⤵
  PID:7064
- C:\Windows\System\osFjapI.exe
  C:\Windows\System\osFjapI.exe
  2⤵
  PID:7080
- C:\Windows\System\qZkYDqF.exe
  C:\Windows\System\qZkYDqF.exe
  2⤵
  PID:7100
- C:\Windows\System\STEHNDx.exe
  C:\Windows\System\STEHNDx.exe
  2⤵
  PID:7124
- C:\Windows\System\daywepT.exe
  C:\Windows\System\daywepT.exe
  2⤵
  PID:7144
- C:\Windows\System\QqOBcgz.exe
  C:\Windows\System\QqOBcgz.exe
  2⤵
  PID:7164
- C:\Windows\System\pXyVKoP.exe
  C:\Windows\System\pXyVKoP.exe
  2⤵
  PID:3500
- C:\Windows\System\EnQPiiT.exe
  C:\Windows\System\EnQPiiT.exe
  2⤵
  PID:5752
- C:\Windows\System\zDojFLZ.exe
  C:\Windows\System\zDojFLZ.exe
  2⤵
  PID:5816
- C:\Windows\System\ckVKVdN.exe
  C:\Windows\System\ckVKVdN.exe
  2⤵
  PID:3632
- C:\Windows\System\WIjSkHP.exe
  C:\Windows\System\WIjSkHP.exe
  2⤵
  PID:4712
- C:\Windows\System\qsauFMw.exe
  C:\Windows\System\qsauFMw.exe
  2⤵
  PID:6048
- C:\Windows\System\RcJuBOx.exe
  C:\Windows\System\RcJuBOx.exe
  2⤵
  PID:5340
- C:\Windows\System\DoteMBD.exe
  C:\Windows\System\DoteMBD.exe
  2⤵
  PID:5092
- C:\Windows\System\MILYRRK.exe
  C:\Windows\System\MILYRRK.exe
  2⤵
  PID:4340
- C:\Windows\System\gJTRQOH.exe
  C:\Windows\System\gJTRQOH.exe
  2⤵
  PID:5272
- C:\Windows\System\fuVLQXN.exe
  C:\Windows\System\fuVLQXN.exe
  2⤵
  PID:1016
- C:\Windows\System\grpCEnU.exe
  C:\Windows\System\grpCEnU.exe
  2⤵
  PID:5664
- C:\Windows\System\FkWneXW.exe
  C:\Windows\System\FkWneXW.exe
  2⤵
  PID:3084
- C:\Windows\System\ErdpIzK.exe
  C:\Windows\System\ErdpIzK.exe
  2⤵
  PID:6268
- C:\Windows\System\PeEVSPh.exe
  C:\Windows\System\PeEVSPh.exe
  2⤵
  PID:2304
- C:\Windows\System\UiTqRdU.exe
  C:\Windows\System\UiTqRdU.exe
  2⤵
  PID:1068
- C:\Windows\System\PpyvzMk.exe
  C:\Windows\System\PpyvzMk.exe
  2⤵
  PID:5148
- C:\Windows\System\sgqHUwP.exe
  C:\Windows\System\sgqHUwP.exe
  2⤵
  PID:5196
- C:\Windows\System\FYRdYTQ.exe
  C:\Windows\System\FYRdYTQ.exe
  2⤵
  PID:6464
- C:\Windows\System\rbOfFtD.exe
  C:\Windows\System\rbOfFtD.exe
  2⤵
  PID:6536
- C:\Windows\System\jIrfCVA.exe
  C:\Windows\System\jIrfCVA.exe
  2⤵
  PID:6620
- C:\Windows\System\PiNxVkc.exe
  C:\Windows\System\PiNxVkc.exe
  2⤵
  PID:5428
- C:\Windows\System\wNiaZmv.exe
  C:\Windows\System\wNiaZmv.exe
  2⤵
  PID:7188
- C:\Windows\System\ynAgfbL.exe
  C:\Windows\System\ynAgfbL.exe
  2⤵
  PID:7216
- C:\Windows\System\IIdDVAN.exe
  C:\Windows\System\IIdDVAN.exe
  2⤵
  PID:7232
- C:\Windows\System\OJPrlMV.exe
  C:\Windows\System\OJPrlMV.exe
  2⤵
  PID:7256
- C:\Windows\System\oqobwfS.exe
  C:\Windows\System\oqobwfS.exe
  2⤵
  PID:7280
- C:\Windows\System\UBJCgMR.exe
  C:\Windows\System\UBJCgMR.exe
  2⤵
  PID:7300
- C:\Windows\System\zUQgYrQ.exe
  C:\Windows\System\zUQgYrQ.exe
  2⤵
  PID:7324
- C:\Windows\System\dAvzEMV.exe
  C:\Windows\System\dAvzEMV.exe
  2⤵
  PID:7344
- C:\Windows\System\uZsDNCb.exe
  C:\Windows\System\uZsDNCb.exe
  2⤵
  PID:7360
- C:\Windows\System\peEyVZN.exe
  C:\Windows\System\peEyVZN.exe
  2⤵
  PID:7376
- C:\Windows\System\TjgxQUS.exe
  C:\Windows\System\TjgxQUS.exe
  2⤵
  PID:7396
- C:\Windows\System\wyBjjXm.exe
  C:\Windows\System\wyBjjXm.exe
  2⤵
  PID:7412
- C:\Windows\System\GWJCpHV.exe
  C:\Windows\System\GWJCpHV.exe
  2⤵
  PID:7436
- C:\Windows\System\eiMCTIL.exe
  C:\Windows\System\eiMCTIL.exe
  2⤵
  PID:7452
- C:\Windows\System\SsOLYXg.exe
  C:\Windows\System\SsOLYXg.exe
  2⤵
  PID:7476
- C:\Windows\System\nsHJvvU.exe
  C:\Windows\System\nsHJvvU.exe
  2⤵
  PID:7500
- C:\Windows\System\lbHmhjU.exe
  C:\Windows\System\lbHmhjU.exe
  2⤵
  PID:7520
- C:\Windows\System\ibBLNoj.exe
  C:\Windows\System\ibBLNoj.exe
  2⤵
  PID:7536
- C:\Windows\System\EbDtNul.exe
  C:\Windows\System\EbDtNul.exe
  2⤵
  PID:7564
- C:\Windows\System\sSELAbJ.exe
  C:\Windows\System\sSELAbJ.exe
  2⤵
  PID:7584
- C:\Windows\System\VgusYRR.exe
  C:\Windows\System\VgusYRR.exe
  2⤵
  PID:7608
- C:\Windows\System\gsfAPXT.exe
  C:\Windows\System\gsfAPXT.exe
  2⤵
  PID:7632
- C:\Windows\System\BblUnNj.exe
  C:\Windows\System\BblUnNj.exe
  2⤵
  PID:7656
- C:\Windows\System\CWFVTnD.exe
  C:\Windows\System\CWFVTnD.exe
  2⤵
  PID:7672
- C:\Windows\System\KhBAJlb.exe
  C:\Windows\System\KhBAJlb.exe
  2⤵
  PID:7700
- C:\Windows\System\ZShrHGI.exe
  C:\Windows\System\ZShrHGI.exe
  2⤵
  PID:7724
- C:\Windows\System\KMGGLuJ.exe
  C:\Windows\System\KMGGLuJ.exe
  2⤵
  PID:7744
- C:\Windows\System\bhKumdw.exe
  C:\Windows\System\bhKumdw.exe
  2⤵
  PID:7768
- C:\Windows\System\kGtkBvB.exe
  C:\Windows\System\kGtkBvB.exe
  2⤵
  PID:7788
- C:\Windows\System\eaUSBkP.exe
  C:\Windows\System\eaUSBkP.exe
  2⤵
  PID:7812
- C:\Windows\System\IYRnghR.exe
  C:\Windows\System\IYRnghR.exe
  2⤵
  PID:7836
- C:\Windows\System\xuAitfS.exe
  C:\Windows\System\xuAitfS.exe
  2⤵
  PID:7856
- C:\Windows\System\CqjNafY.exe
  C:\Windows\System\CqjNafY.exe
  2⤵
  PID:7876
- C:\Windows\System\EAsqRwa.exe
  C:\Windows\System\EAsqRwa.exe
  2⤵
  PID:7896
- C:\Windows\System\gJrWnXO.exe
  C:\Windows\System\gJrWnXO.exe
  2⤵
  PID:7932
- C:\Windows\System\zRRocEE.exe
  C:\Windows\System\zRRocEE.exe
  2⤵
  PID:7956
- C:\Windows\System\VISBUFP.exe
  C:\Windows\System\VISBUFP.exe
  2⤵
  PID:7992
- C:\Windows\System\GOldYAw.exe
  C:\Windows\System\GOldYAw.exe
  2⤵
  PID:8008
- C:\Windows\System\xuNzhJW.exe
  C:\Windows\System\xuNzhJW.exe
  2⤵
  PID:8024
- C:\Windows\System\vOdQwjj.exe
  C:\Windows\System\vOdQwjj.exe
  2⤵
  PID:1472
- C:\Windows\System\ltRzkZz.exe
  C:\Windows\System\ltRzkZz.exe
  2⤵
  PID:5124
- C:\Windows\System\NBcxXoY.exe
  C:\Windows\System\NBcxXoY.exe
  2⤵
  PID:6448
- C:\Windows\System\KLqGBrR.exe
  C:\Windows\System\KLqGBrR.exe
  2⤵
  PID:6112
- C:\Windows\System\GjpWtti.exe
  C:\Windows\System\GjpWtti.exe
  2⤵
  PID:5024
- C:\Windows\System\XAwLVYw.exe
  C:\Windows\System\XAwLVYw.exe
  2⤵
  PID:760
- C:\Windows\System\ZgdeQDA.exe
  C:\Windows\System\ZgdeQDA.exe
  2⤵
  PID:4888
- C:\Windows\System\aEgWVCX.exe
  C:\Windows\System\aEgWVCX.exe
  2⤵
  PID:4088
- C:\Windows\System\mJCJJwM.exe
  C:\Windows\System\mJCJJwM.exe
  2⤵
  PID:7336
- C:\Windows\System\LsxsKrY.exe
  C:\Windows\System\LsxsKrY.exe
  2⤵
  PID:5360
- C:\Windows\System\jEHBvuP.exe
  C:\Windows\System\jEHBvuP.exe
  2⤵
  PID:5424
- C:\Windows\System\cDKMwsa.exe
  C:\Windows\System\cDKMwsa.exe
  2⤵
  PID:4808
- C:\Windows\System\QckwjQC.exe
  C:\Windows\System\QckwjQC.exe
  2⤵
  PID:6988
- C:\Windows\System\OGJhxrj.exe
  C:\Windows\System\OGJhxrj.exe
  2⤵
  PID:6236
- C:\Windows\System\LMaHamV.exe
  C:\Windows\System\LMaHamV.exe
  2⤵
  PID:7864
- C:\Windows\System\PIeNxZh.exe
  C:\Windows\System\PIeNxZh.exe
  2⤵
  PID:1960
- C:\Windows\System\ScCvWnA.exe
  C:\Windows\System\ScCvWnA.exe
  2⤵
  PID:6096
- C:\Windows\System\pwTaijH.exe
  C:\Windows\System\pwTaijH.exe
  2⤵
  PID:4868
- C:\Windows\System\brMwxIV.exe
  C:\Windows\System\brMwxIV.exe
  2⤵
  PID:6432
- C:\Windows\System\PzmhcBn.exe
  C:\Windows\System\PzmhcBn.exe
  2⤵
  PID:6520
- C:\Windows\System\jzPFngp.exe
  C:\Windows\System\jzPFngp.exe
  2⤵
  PID:6596
- C:\Windows\System\YKcYFdk.exe
  C:\Windows\System\YKcYFdk.exe
  2⤵
  PID:8216
- C:\Windows\System\xSOtXVd.exe
  C:\Windows\System\xSOtXVd.exe
  2⤵
  PID:8240
- C:\Windows\System\ythEwiO.exe
  C:\Windows\System\ythEwiO.exe
  2⤵
  PID:8260
- C:\Windows\System\FbaGBnJ.exe
  C:\Windows\System\FbaGBnJ.exe
  2⤵
  PID:8284
- C:\Windows\System\ekaPZMZ.exe
  C:\Windows\System\ekaPZMZ.exe
  2⤵
  PID:8316
- C:\Windows\System\GQYfGqE.exe
  C:\Windows\System\GQYfGqE.exe
  2⤵
  PID:8332
- C:\Windows\System\KjvDGDO.exe
  C:\Windows\System\KjvDGDO.exe
  2⤵
  PID:8372
- C:\Windows\System\zgaOEzf.exe
  C:\Windows\System\zgaOEzf.exe
  2⤵
  PID:8392
- C:\Windows\System\ysYemKi.exe
  C:\Windows\System\ysYemKi.exe
  2⤵
  PID:8412
- C:\Windows\System\vzrAhRw.exe
  C:\Windows\System\vzrAhRw.exe
  2⤵
  PID:8440
- C:\Windows\System\aQuSgvD.exe
  C:\Windows\System\aQuSgvD.exe
  2⤵
  PID:8460
- C:\Windows\System\hVTZXlU.exe
  C:\Windows\System\hVTZXlU.exe
  2⤵
  PID:8480
- C:\Windows\System\unYdEXc.exe
  C:\Windows\System\unYdEXc.exe
  2⤵
  PID:8500
- C:\Windows\System\oLAWHLt.exe
  C:\Windows\System\oLAWHLt.exe
  2⤵
  PID:8520
- C:\Windows\System\BwiVZlu.exe
  C:\Windows\System\BwiVZlu.exe
  2⤵
  PID:8544
- C:\Windows\System\AQxiSxE.exe
  C:\Windows\System\AQxiSxE.exe
  2⤵
  PID:8560
- C:\Windows\System\yKhXtBV.exe
  C:\Windows\System\yKhXtBV.exe
  2⤵
  PID:8580
- C:\Windows\System\xdvYmSe.exe
  C:\Windows\System\xdvYmSe.exe
  2⤵
  PID:8604
- C:\Windows\System\tmxPYUE.exe
  C:\Windows\System\tmxPYUE.exe
  2⤵
  PID:8624
- C:\Windows\System\RGVvBVw.exe
  C:\Windows\System\RGVvBVw.exe
  2⤵
  PID:8652
- C:\Windows\System\UUuMxTf.exe
  C:\Windows\System\UUuMxTf.exe
  2⤵
  PID:8672
- C:\Windows\System\VbogdPF.exe
  C:\Windows\System\VbogdPF.exe
  2⤵
  PID:8696
- C:\Windows\System\zwOHNcd.exe
  C:\Windows\System\zwOHNcd.exe
  2⤵
  PID:8724
- C:\Windows\System\klZkgph.exe
  C:\Windows\System\klZkgph.exe
  2⤵
  PID:8744
- C:\Windows\System\iIzmWzC.exe
  C:\Windows\System\iIzmWzC.exe
  2⤵
  PID:8772
- C:\Windows\System\QebEsPq.exe
  C:\Windows\System\QebEsPq.exe
  2⤵
  PID:8792
- C:\Windows\System\XKSfwMU.exe
  C:\Windows\System\XKSfwMU.exe
  2⤵
  PID:8816
- C:\Windows\System\byuppyt.exe
  C:\Windows\System\byuppyt.exe
  2⤵
  PID:8836
- C:\Windows\System\hHhzlBS.exe
  C:\Windows\System\hHhzlBS.exe
  2⤵
  PID:8852
- C:\Windows\System\qZMJvzx.exe
  C:\Windows\System\qZMJvzx.exe
  2⤵
  PID:8872
- C:\Windows\System\XiIjyxj.exe
  C:\Windows\System\XiIjyxj.exe
  2⤵
  PID:8896
- C:\Windows\System\nKKUnoS.exe
  C:\Windows\System\nKKUnoS.exe
  2⤵
  PID:8928
- C:\Windows\System\aTApDpu.exe
  C:\Windows\System\aTApDpu.exe
  2⤵
  PID:8948
- C:\Windows\System\uwwtHxx.exe
  C:\Windows\System\uwwtHxx.exe
  2⤵
  PID:8972
- C:\Windows\System\ZvfwUBG.exe
  C:\Windows\System\ZvfwUBG.exe
  2⤵
  PID:8992
- C:\Windows\System\kwLLiVC.exe
  C:\Windows\System\kwLLiVC.exe
  2⤵
  PID:9012
- C:\Windows\System\yYCqlzy.exe
  C:\Windows\System\yYCqlzy.exe
  2⤵
  PID:9044
- C:\Windows\System\xZYQxQU.exe
  C:\Windows\System\xZYQxQU.exe
  2⤵
  PID:9060
- C:\Windows\System\FHQPgzz.exe
  C:\Windows\System\FHQPgzz.exe
  2⤵
  PID:9084
- C:\Windows\System\UYgWwVw.exe
  C:\Windows\System\UYgWwVw.exe
  2⤵
  PID:9108
- C:\Windows\System\QivIctV.exe
  C:\Windows\System\QivIctV.exe
  2⤵
  PID:9132
- C:\Windows\System\eNEqnnZ.exe
  C:\Windows\System\eNEqnnZ.exe
  2⤵
  PID:9152
- C:\Windows\System\sPvfZyL.exe
  C:\Windows\System\sPvfZyL.exe
  2⤵
  PID:9172
- C:\Windows\System\yeNfYQK.exe
  C:\Windows\System\yeNfYQK.exe
  2⤵
  PID:9204
- C:\Windows\System\BjmTUHa.exe
  C:\Windows\System\BjmTUHa.exe
  2⤵
  PID:6652
- C:\Windows\System\KwAyRiE.exe
  C:\Windows\System\KwAyRiE.exe
  2⤵
  PID:6696
- C:\Windows\System\commAir.exe
  C:\Windows\System\commAir.exe
  2⤵
  PID:7248
- C:\Windows\System\NjANHJR.exe
  C:\Windows\System\NjANHJR.exe
  2⤵
  PID:7372
- C:\Windows\System\yLkKtVx.exe
  C:\Windows\System\yLkKtVx.exe
  2⤵
  PID:7460
- C:\Windows\System\POvVzcs.exe
  C:\Windows\System\POvVzcs.exe
  2⤵
  PID:6828
- C:\Windows\System\bzeqoyD.exe
  C:\Windows\System\bzeqoyD.exe
  2⤵
  PID:6900
- C:\Windows\System\sJkGEIW.exe
  C:\Windows\System\sJkGEIW.exe
  2⤵
  PID:7008
- C:\Windows\System\FrOGaaz.exe
  C:\Windows\System\FrOGaaz.exe
  2⤵
  PID:7696
- C:\Windows\System\WVzBItH.exe
  C:\Windows\System\WVzBItH.exe
  2⤵
  PID:7108
- C:\Windows\System\avpqMiq.exe
  C:\Windows\System\avpqMiq.exe
  2⤵
  PID:5764
- C:\Windows\System\sqLEXHr.exe
  C:\Windows\System\sqLEXHr.exe
  2⤵
  PID:4764
- C:\Windows\System\XvEORLa.exe
  C:\Windows\System\XvEORLa.exe
  2⤵
  PID:5976
- C:\Windows\System\FCwWlsG.exe
  C:\Windows\System\FCwWlsG.exe
  2⤵
  PID:5112
- C:\Windows\System\tLQPfOw.exe
  C:\Windows\System\tLQPfOw.exe
  2⤵
  PID:7308
- C:\Windows\System\uXXQxmi.exe
  C:\Windows\System\uXXQxmi.exe
  2⤵
  PID:6316
- C:\Windows\System\ElTMHMn.exe
  C:\Windows\System\ElTMHMn.exe
  2⤵
  PID:9220
- C:\Windows\System\KwlmHcW.exe
  C:\Windows\System\KwlmHcW.exe
  2⤵
  PID:9244
- C:\Windows\System\pqhxRuM.exe
  C:\Windows\System\pqhxRuM.exe
  2⤵
  PID:9264
- C:\Windows\System\pfaQLVm.exe
  C:\Windows\System\pfaQLVm.exe
  2⤵
  PID:9280
- C:\Windows\System\INHfGPi.exe
  C:\Windows\System\INHfGPi.exe
  2⤵
  PID:9296
- C:\Windows\System\UbZuxyA.exe
  C:\Windows\System\UbZuxyA.exe
  2⤵
  PID:9312
- C:\Windows\System\UKGBApC.exe
  C:\Windows\System\UKGBApC.exe
  2⤵
  PID:9336
- C:\Windows\System\RZfDpLT.exe
  C:\Windows\System\RZfDpLT.exe
  2⤵
  PID:9360
- C:\Windows\System\YkHVHET.exe
  C:\Windows\System\YkHVHET.exe
  2⤵
  PID:9384
- C:\Windows\System\TeBXneT.exe
  C:\Windows\System\TeBXneT.exe
  2⤵
  PID:9404
- C:\Windows\System\CgIVuaM.exe
  C:\Windows\System\CgIVuaM.exe
  2⤵
  PID:9428
- C:\Windows\System\YPRGkcV.exe
  C:\Windows\System\YPRGkcV.exe
  2⤵
  PID:9448
- C:\Windows\System\zbLDtkM.exe
  C:\Windows\System\zbLDtkM.exe
  2⤵
  PID:9476
- C:\Windows\System\EfwHqtw.exe
  C:\Windows\System\EfwHqtw.exe
  2⤵
  PID:9496
- C:\Windows\System\tVsQRVV.exe
  C:\Windows\System\tVsQRVV.exe
  2⤵
  PID:9516
- C:\Windows\System\joOpexf.exe
  C:\Windows\System\joOpexf.exe
  2⤵
  PID:9536
- C:\Windows\System\exqTNlw.exe
  C:\Windows\System\exqTNlw.exe
  2⤵
  PID:9552
- C:\Windows\System\jciQMAY.exe
  C:\Windows\System\jciQMAY.exe
  2⤵
  PID:9576
- C:\Windows\System\QWCFHCb.exe
  C:\Windows\System\QWCFHCb.exe
  2⤵
  PID:9604
- C:\Windows\System\tFmijNb.exe
  C:\Windows\System\tFmijNb.exe
  2⤵
  PID:9620
- C:\Windows\System\zjVzWZe.exe
  C:\Windows\System\zjVzWZe.exe
  2⤵
  PID:9636
- C:\Windows\System\rKZRBHS.exe
  C:\Windows\System\rKZRBHS.exe
  2⤵
  PID:9664
- C:\Windows\System\EvyriDP.exe
  C:\Windows\System\EvyriDP.exe
  2⤵
  PID:9688
- C:\Windows\System\EWtYHGA.exe
  C:\Windows\System\EWtYHGA.exe
  2⤵
  PID:9712
- C:\Windows\System\lmNvEtc.exe
  C:\Windows\System\lmNvEtc.exe
  2⤵
  PID:9728
- C:\Windows\System\JEkHXaZ.exe
  C:\Windows\System\JEkHXaZ.exe
  2⤵
  PID:9756
- C:\Windows\System\oUjXtOm.exe
  C:\Windows\System\oUjXtOm.exe
  2⤵
  PID:9780
- C:\Windows\System\gvgnuGU.exe
  C:\Windows\System\gvgnuGU.exe
  2⤵
  PID:9804
- C:\Windows\System\EzTmhJn.exe
  C:\Windows\System\EzTmhJn.exe
  2⤵
  PID:9824
- C:\Windows\System\ONlWZIS.exe
  C:\Windows\System\ONlWZIS.exe
  2⤵
  PID:9844
- C:\Windows\System\pGULSaQ.exe
  C:\Windows\System\pGULSaQ.exe
  2⤵
  PID:9864
- C:\Windows\System\uvqPAtw.exe
  C:\Windows\System\uvqPAtw.exe
  2⤵
  PID:9888
- C:\Windows\System\MwJAMvA.exe
  C:\Windows\System\MwJAMvA.exe
  2⤵
  PID:9908
- C:\Windows\System\nkErQua.exe
  C:\Windows\System\nkErQua.exe
  2⤵
  PID:9932
- C:\Windows\System\ueojqcG.exe
  C:\Windows\System\ueojqcG.exe
  2⤵
  PID:9956
- C:\Windows\System\QgHXXkC.exe
  C:\Windows\System\QgHXXkC.exe
  2⤵
  PID:9984
- C:\Windows\System\ewmNMXs.exe
  C:\Windows\System\ewmNMXs.exe
  2⤵
  PID:10004
- C:\Windows\System\VzuTZBV.exe
  C:\Windows\System\VzuTZBV.exe
  2⤵
  PID:10024
- C:\Windows\System\tumuryG.exe
  C:\Windows\System\tumuryG.exe
  2⤵
  PID:10048
- C:\Windows\System\ZPhqgyS.exe
  C:\Windows\System\ZPhqgyS.exe
  2⤵
  PID:10068
- C:\Windows\System\WhCESeb.exe
  C:\Windows\System\WhCESeb.exe
  2⤵
  PID:10084
- C:\Windows\System\hCaKXlo.exe
  C:\Windows\System\hCaKXlo.exe
  2⤵
  PID:10108
- C:\Windows\System\IrdCZCG.exe
  C:\Windows\System\IrdCZCG.exe
  2⤵
  PID:10124
- C:\Windows\System\KrMYpCj.exe
  C:\Windows\System\KrMYpCj.exe
  2⤵
  PID:10148
- C:\Windows\System\uSzNRVV.exe
  C:\Windows\System\uSzNRVV.exe
  2⤵
  PID:10172
- C:\Windows\System\cyPpSVI.exe
  C:\Windows\System\cyPpSVI.exe
  2⤵
  PID:10192
- C:\Windows\System\DDazfRT.exe
  C:\Windows\System\DDazfRT.exe
  2⤵
  PID:10212
- C:\Windows\System\IwccfcL.exe
  C:\Windows\System\IwccfcL.exe
  2⤵
  PID:10232
- C:\Windows\System\RVMXSao.exe
  C:\Windows\System\RVMXSao.exe
  2⤵
  PID:5192
- C:\Windows\System\cLUjtlv.exe
  C:\Windows\System\cLUjtlv.exe
  2⤵
  PID:5240
- C:\Windows\System\BzEdUZj.exe
  C:\Windows\System\BzEdUZj.exe
  2⤵
  PID:6588
- C:\Windows\System\PuLNLwO.exe
  C:\Windows\System\PuLNLwO.exe
  2⤵
  PID:8256
- C:\Windows\System\yXTbKGD.exe
  C:\Windows\System\yXTbKGD.exe
  2⤵
  PID:8124
- C:\Windows\System\EChbGys.exe
  C:\Windows\System\EChbGys.exe
  2⤵
  PID:8384
- C:\Windows\System\QutGuvW.exe
  C:\Windows\System\QutGuvW.exe
  2⤵
  PID:5508
- C:\Windows\System\NRHDwnJ.exe
  C:\Windows\System\NRHDwnJ.exe
  2⤵
  PID:8528
- C:\Windows\System\nDYybnU.exe
  C:\Windows\System\nDYybnU.exe
  2⤵
  PID:7408
- C:\Windows\System\FIAJXyN.exe
  C:\Windows\System\FIAJXyN.exe
  2⤵
  PID:8712
- C:\Windows\System\NNOQAUc.exe
  C:\Windows\System\NNOQAUc.exe
  2⤵
  PID:7544
- C:\Windows\System\VDqIjVc.exe
  C:\Windows\System\VDqIjVc.exe
  2⤵
  PID:7572
- C:\Windows\System\HzqiWTC.exe
  C:\Windows\System\HzqiWTC.exe
  2⤵
  PID:8884
- C:\Windows\System\wWskkmJ.exe
  C:\Windows\System\wWskkmJ.exe
  2⤵
  PID:8980
- C:\Windows\System\bieBbEt.exe
  C:\Windows\System\bieBbEt.exe
  2⤵
  PID:7720
- C:\Windows\System\cvLMnRq.exe
  C:\Windows\System\cvLMnRq.exe
  2⤵
  PID:7760
- C:\Windows\System\LGQbfen.exe
  C:\Windows\System\LGQbfen.exe
  2⤵
  PID:9056
- C:\Windows\System\uJgMwxV.exe
  C:\Windows\System\uJgMwxV.exe
  2⤵
  PID:9164
- C:\Windows\System\aiHZHPm.exe
  C:\Windows\System\aiHZHPm.exe
  2⤵
  PID:7444
- C:\Windows\System\gxGnqMy.exe
  C:\Windows\System\gxGnqMy.exe
  2⤵
  PID:6964
- C:\Windows\System\HFwbUQR.exe
  C:\Windows\System\HFwbUQR.exe
  2⤵
  PID:7948
- C:\Windows\System\pFbVbSg.exe
  C:\Windows\System\pFbVbSg.exe
  2⤵
  PID:7024
- C:\Windows\System\fzHHiJS.exe
  C:\Windows\System\fzHHiJS.exe
  2⤵
  PID:10256
- C:\Windows\System\LJHOMSa.exe
  C:\Windows\System\LJHOMSa.exe
  2⤵
  PID:10276
- C:\Windows\System\SfaMAlr.exe
  C:\Windows\System\SfaMAlr.exe
  2⤵
  PID:10296
- C:\Windows\System\nuLcFod.exe
  C:\Windows\System\nuLcFod.exe
  2⤵
  PID:10320
- C:\Windows\System\suQWfhE.exe
  C:\Windows\System\suQWfhE.exe
  2⤵
  PID:10348
- C:\Windows\System\VeizLTV.exe
  C:\Windows\System\VeizLTV.exe
  2⤵
  PID:10376
- C:\Windows\System\mHMIAeO.exe
  C:\Windows\System\mHMIAeO.exe
  2⤵
  PID:10396
- C:\Windows\System\DhQWnZR.exe
  C:\Windows\System\DhQWnZR.exe
  2⤵
  PID:10416
- C:\Windows\System\slAWMYj.exe
  C:\Windows\System\slAWMYj.exe
  2⤵
  PID:10440
- C:\Windows\System\URZoqdg.exe
  C:\Windows\System\URZoqdg.exe
  2⤵
  PID:10460
- C:\Windows\System\aXsZEZU.exe
  C:\Windows\System\aXsZEZU.exe
  2⤵
  PID:10488
- C:\Windows\System\rxFJTiv.exe
  C:\Windows\System\rxFJTiv.exe
  2⤵
  PID:10508
- C:\Windows\System\Gumasyt.exe
  C:\Windows\System\Gumasyt.exe
  2⤵
  PID:10528
- C:\Windows\System\NekHaaA.exe
  C:\Windows\System\NekHaaA.exe
  2⤵
  PID:10552
- C:\Windows\System\zCnJuyE.exe
  C:\Windows\System\zCnJuyE.exe
  2⤵
  PID:10568
- C:\Windows\System\rBassUb.exe
  C:\Windows\System\rBassUb.exe
  2⤵
  PID:10592
- C:\Windows\System\fAXMrzK.exe
  C:\Windows\System\fAXMrzK.exe
  2⤵
  PID:10612
- C:\Windows\System\yXdzkPp.exe
  C:\Windows\System\yXdzkPp.exe
  2⤵
  PID:10636
- C:\Windows\System\ZnuDZMy.exe
  C:\Windows\System\ZnuDZMy.exe
  2⤵
  PID:10652
- C:\Windows\System\MTRxXQm.exe
  C:\Windows\System\MTRxXQm.exe
  2⤵
  PID:10672
- C:\Windows\System\rQoxVAZ.exe
  C:\Windows\System\rQoxVAZ.exe
  2⤵
  PID:10696
- C:\Windows\System\ZAYhGcn.exe
  C:\Windows\System\ZAYhGcn.exe
  2⤵
  PID:10712
- C:\Windows\System\ELLNPvi.exe
  C:\Windows\System\ELLNPvi.exe
  2⤵
  PID:10744
- C:\Windows\System\zKrkazz.exe
  C:\Windows\System\zKrkazz.exe
  2⤵
  PID:10764
- C:\Windows\System\PMmYLMv.exe
  C:\Windows\System\PMmYLMv.exe
  2⤵
  PID:10784
- C:\Windows\System\nuRvmIM.exe
  C:\Windows\System\nuRvmIM.exe
  2⤵
  PID:10808
- C:\Windows\System\KUrdpaV.exe
  C:\Windows\System\KUrdpaV.exe
  2⤵
  PID:10848
- C:\Windows\System\VDVKDOl.exe
  C:\Windows\System\VDVKDOl.exe
  2⤵
  PID:10868
- C:\Windows\System\MvkOqLn.exe
  C:\Windows\System\MvkOqLn.exe
  2⤵
  PID:10888
- C:\Windows\System\QsCbQhi.exe
  C:\Windows\System\QsCbQhi.exe
  2⤵
  PID:10912
- C:\Windows\System\IAHnRwc.exe
  C:\Windows\System\IAHnRwc.exe
  2⤵
  PID:10928
- C:\Windows\System\lcgkLNR.exe
  C:\Windows\System\lcgkLNR.exe
  2⤵
  PID:10948
- C:\Windows\System\OVJQcdV.exe
  C:\Windows\System\OVJQcdV.exe
  2⤵
  PID:10972
- C:\Windows\System\MgfdubQ.exe
  C:\Windows\System\MgfdubQ.exe
  2⤵
  PID:10996
- C:\Windows\System\iSnzFtz.exe
  C:\Windows\System\iSnzFtz.exe
  2⤵
  PID:11024
- C:\Windows\System\iPABvQg.exe
  C:\Windows\System\iPABvQg.exe
  2⤵
  PID:11044
- C:\Windows\System\ukBQKMG.exe
  C:\Windows\System\ukBQKMG.exe
  2⤵
  PID:11068
- C:\Windows\System\HCyXFGx.exe
  C:\Windows\System\HCyXFGx.exe
  2⤵
  PID:11092
- C:\Windows\System\OrWgdta.exe
  C:\Windows\System\OrWgdta.exe
  2⤵
  PID:11112
- C:\Windows\System\coYXtGX.exe
  C:\Windows\System\coYXtGX.exe
  2⤵
  PID:11132
- C:\Windows\System\CrKYEBR.exe
  C:\Windows\System\CrKYEBR.exe
  2⤵
  PID:11152
- C:\Windows\System\wYKhTYM.exe
  C:\Windows\System\wYKhTYM.exe
  2⤵
  PID:11176
- C:\Windows\System\tLmdrTZ.exe
  C:\Windows\System\tLmdrTZ.exe
  2⤵
  PID:11200
- C:\Windows\System\BOdyWOt.exe
  C:\Windows\System\BOdyWOt.exe
  2⤵
  PID:11232
- C:\Windows\System\YUBqkzf.exe
  C:\Windows\System\YUBqkzf.exe
  2⤵
  PID:11256
- C:\Windows\System\SYoKSoX.exe
  C:\Windows\System\SYoKSoX.exe
  2⤵
  PID:8592
- C:\Windows\System\VppaaGJ.exe
  C:\Windows\System\VppaaGJ.exe
  2⤵
  PID:8612
- C:\Windows\System\oLxvuPS.exe
  C:\Windows\System\oLxvuPS.exe
  2⤵
  PID:9900
- C:\Windows\System\xspwtOv.exe
  C:\Windows\System\xspwtOv.exe
  2⤵
  PID:8688
- C:\Windows\System\UIAawaV.exe
  C:\Windows\System\UIAawaV.exe
  2⤵
  PID:10020
- C:\Windows\System\ZVXSrBh.exe
  C:\Windows\System\ZVXSrBh.exe
  2⤵
  PID:6868
- C:\Windows\System\VkFmEIz.exe
  C:\Windows\System\VkFmEIz.exe
  2⤵
  PID:8892
- C:\Windows\System\HhvPMOP.exe
  C:\Windows\System\HhvPMOP.exe
  2⤵
  PID:8916
- C:\Windows\System\RpHBgEI.exe
  C:\Windows\System\RpHBgEI.exe
  2⤵
  PID:8448
- C:\Windows\System\MnzYmjj.exe
  C:\Windows\System\MnzYmjj.exe
  2⤵
  PID:9052
- C:\Windows\System\GITlXYN.exe
  C:\Windows\System\GITlXYN.exe
  2⤵
  PID:8616
- C:\Windows\System\JRNERvK.exe
  C:\Windows\System\JRNERvK.exe
  2⤵
  PID:6680
- C:\Windows\System\cRNpivj.exe
  C:\Windows\System\cRNpivj.exe
  2⤵
  PID:7268
- C:\Windows\System\qfGilvS.exe
  C:\Windows\System\qfGilvS.exe
  2⤵
  PID:8960
- C:\Windows\System\VhrUyhU.exe
  C:\Windows\System\VhrUyhU.exe
  2⤵
  PID:4976
- C:\Windows\System\gwgvFzp.exe
  C:\Windows\System\gwgvFzp.exe
  2⤵
  PID:9148
- C:\Windows\System\esHnyEa.exe
  C:\Windows\System\esHnyEa.exe
  2⤵
  PID:6332
- C:\Windows\System\wgBLtKd.exe
  C:\Windows\System\wgBLtKd.exe
  2⤵
  PID:4464
- C:\Windows\System\FApkGKV.exe
  C:\Windows\System\FApkGKV.exe
  2⤵
  PID:6504
- C:\Windows\System\WHZxKWA.exe
  C:\Windows\System\WHZxKWA.exe
  2⤵
  PID:7200
- C:\Windows\System\bDyjIZT.exe
  C:\Windows\System\bDyjIZT.exe
  2⤵
  PID:7368
- C:\Windows\System\UypLePO.exe
  C:\Windows\System\UypLePO.exe
  2⤵
  PID:3208
- C:\Windows\System\YjuduMe.exe
  C:\Windows\System\YjuduMe.exe
  2⤵
  PID:9512
- C:\Windows\System\piPaoLQ.exe
  C:\Windows\System\piPaoLQ.exe
  2⤵
  PID:10664
- C:\Windows\System\PMQYzHN.exe
  C:\Windows\System\PMQYzHN.exe
  2⤵
  PID:980
- C:\Windows\System\LiJrOrt.exe
  C:\Windows\System\LiJrOrt.exe
  2⤵
  PID:6412
- C:\Windows\System\ogDvElb.exe
  C:\Windows\System\ogDvElb.exe
  2⤵
  PID:8956
- C:\Windows\System\YcMWuOn.exe
  C:\Windows\System\YcMWuOn.exe
  2⤵
  PID:8428
- C:\Windows\System\znuieEL.exe
  C:\Windows\System\znuieEL.exe
  2⤵
  PID:9120
- C:\Windows\System\eYLdVjm.exe
  C:\Windows\System\eYLdVjm.exe
  2⤵
  PID:7224
- C:\Windows\System\mxJkQyY.exe
  C:\Windows\System\mxJkQyY.exe
  2⤵
  PID:7712
- C:\Windows\System\eQxLyOA.exe
  C:\Windows\System\eQxLyOA.exe
  2⤵
  PID:9212
- C:\Windows\System\ySHQnxU.exe
  C:\Windows\System\ySHQnxU.exe
  2⤵
  PID:7028
- C:\Windows\System\svwuyWX.exe
  C:\Windows\System\svwuyWX.exe
  2⤵
  PID:7076
- C:\Windows\System\pBCyfFm.exe
  C:\Windows\System\pBCyfFm.exe
  2⤵
  PID:5244
- C:\Windows\System\aAempNb.exe
  C:\Windows\System\aAempNb.exe
  2⤵
  PID:6240
- C:\Windows\System\GrUWmQA.exe
  C:\Windows\System\GrUWmQA.exe
  2⤵
  PID:9308
- C:\Windows\System\ZbTbbBy.exe
  C:\Windows\System\ZbTbbBy.exe
  2⤵
  PID:9424
- C:\Windows\System\QzAhSjd.exe
  C:\Windows\System\QzAhSjd.exe
  2⤵
  PID:9616
- C:\Windows\System\ETdeJFY.exe
  C:\Windows\System\ETdeJFY.exe
  2⤵
  PID:9684
- C:\Windows\System\lBlZcIc.exe
  C:\Windows\System\lBlZcIc.exe
  2⤵
  PID:9796
- C:\Windows\System\bYCrGEp.exe
  C:\Windows\System\bYCrGEp.exe
  2⤵
  PID:9884
- C:\Windows\System\RwkQvfl.exe
  C:\Windows\System\RwkQvfl.exe
  2⤵
  PID:9952
- C:\Windows\System\FfKKexB.exe
  C:\Windows\System\FfKKexB.exe
  2⤵
  PID:10064
- C:\Windows\System\ebQWFbO.exe
  C:\Windows\System\ebQWFbO.exe
  2⤵
  PID:10120
- C:\Windows\System\mhJGHHV.exe
  C:\Windows\System\mhJGHHV.exe
  2⤵
  PID:10168
- C:\Windows\System\CRPWlQz.exe
  C:\Windows\System\CRPWlQz.exe
  2⤵
  PID:9292
- C:\Windows\System\zqzHZNc.exe
  C:\Windows\System\zqzHZNc.exe
  2⤵
  PID:6616
- C:\Windows\System\VhtDEQN.exe
  C:\Windows\System\VhtDEQN.exe
  2⤵
  PID:7388
- C:\Windows\System\wZXrnNc.exe
  C:\Windows\System\wZXrnNc.exe
  2⤵
  PID:9068
- C:\Windows\System\oSJsaVj.exe
  C:\Windows\System\oSJsaVj.exe
  2⤵
  PID:11280
- C:\Windows\System\rfuDbNX.exe
  C:\Windows\System\rfuDbNX.exe
  2⤵
  PID:11296
- C:\Windows\System\JrHZggH.exe
  C:\Windows\System\JrHZggH.exe
  2⤵
  PID:11312
- C:\Windows\System\fqlvuHy.exe
  C:\Windows\System\fqlvuHy.exe
  2⤵
  PID:11340
- C:\Windows\System\iLwUpcr.exe
  C:\Windows\System\iLwUpcr.exe
  2⤵
  PID:11360
- C:\Windows\System\ZbEVHSC.exe
  C:\Windows\System\ZbEVHSC.exe
  2⤵
  PID:11384
- C:\Windows\System\NAkSjLu.exe
  C:\Windows\System\NAkSjLu.exe
  2⤵
  PID:11412
- C:\Windows\System\dqhqmgY.exe
  C:\Windows\System\dqhqmgY.exe
  2⤵
  PID:11432
- C:\Windows\System\esRrcsQ.exe
  C:\Windows\System\esRrcsQ.exe
  2⤵
  PID:11452
- C:\Windows\System\JmbGWrv.exe
  C:\Windows\System\JmbGWrv.exe
  2⤵
  PID:11472
- C:\Windows\System\dNHsDHz.exe
  C:\Windows\System\dNHsDHz.exe
  2⤵
  PID:11496
- C:\Windows\System\NMGmFJx.exe
  C:\Windows\System\NMGmFJx.exe
  2⤵
  PID:11520
- C:\Windows\System\GoEwjYa.exe
  C:\Windows\System\GoEwjYa.exe
  2⤵
  PID:11544
- C:\Windows\System\BmimYRR.exe
  C:\Windows\System\BmimYRR.exe
  2⤵
  PID:11568
- C:\Windows\System\hjxXqpf.exe
  C:\Windows\System\hjxXqpf.exe
  2⤵
  PID:11588
- C:\Windows\System\RkKxPCB.exe
  C:\Windows\System\RkKxPCB.exe
  2⤵
  PID:11612
- C:\Windows\System\BuhfVHR.exe
  C:\Windows\System\BuhfVHR.exe
  2⤵
  PID:11632
- C:\Windows\System\OqauHrM.exe
  C:\Windows\System\OqauHrM.exe
  2⤵
  PID:11648
- C:\Windows\System\cEYbQti.exe
  C:\Windows\System\cEYbQti.exe
  2⤵
  PID:11672
- C:\Windows\System\AArKFRw.exe
  C:\Windows\System\AArKFRw.exe
  2⤵
  PID:11688
- C:\Windows\System\dPcsQQM.exe
  C:\Windows\System\dPcsQQM.exe
  2⤵
  PID:11716
- C:\Windows\System\sCaiMrg.exe
  C:\Windows\System\sCaiMrg.exe
  2⤵
  PID:11732
- C:\Windows\System\hiobHkb.exe
  C:\Windows\System\hiobHkb.exe
  2⤵
  PID:11748
- C:\Windows\System\USvxPWh.exe
  C:\Windows\System\USvxPWh.exe
  2⤵
  PID:11764
- C:\Windows\System\qDywehu.exe
  C:\Windows\System\qDywehu.exe
  2⤵
  PID:11780
- C:\Windows\System\DvKEdRR.exe
  C:\Windows\System\DvKEdRR.exe
  2⤵
  PID:11796
- C:\Windows\System\WtvKNqN.exe
  C:\Windows\System\WtvKNqN.exe
  2⤵
  PID:11812
- C:\Windows\System\tHxWBAb.exe
  C:\Windows\System\tHxWBAb.exe
  2⤵
  PID:11828
- C:\Windows\System\UxEcDpO.exe
  C:\Windows\System\UxEcDpO.exe
  2⤵
  PID:11852
- C:\Windows\System\tYUnbbt.exe
  C:\Windows\System\tYUnbbt.exe
  2⤵
  PID:11872
- C:\Windows\System\NONLVKB.exe
  C:\Windows\System\NONLVKB.exe
  2⤵
  PID:11944
- C:\Windows\System\UMJpTuy.exe
  C:\Windows\System\UMJpTuy.exe
  2⤵
  PID:11964
- C:\Windows\System\LCaYcBD.exe
  C:\Windows\System\LCaYcBD.exe
  2⤵
  PID:11996
- C:\Windows\System\SPpEIlW.exe
  C:\Windows\System\SPpEIlW.exe
  2⤵
  PID:12020
- C:\Windows\System\ajcfwTQ.exe
  C:\Windows\System\ajcfwTQ.exe
  2⤵
  PID:12036
- C:\Windows\System\OgeGSIF.exe
  C:\Windows\System\OgeGSIF.exe
  2⤵
  PID:12056
- C:\Windows\System\JHqnhlj.exe
  C:\Windows\System\JHqnhlj.exe
  2⤵
  PID:12084
- C:\Windows\System\boiMOZl.exe
  C:\Windows\System\boiMOZl.exe
  2⤵
  PID:12116
- C:\Windows\System\AeqyKNw.exe
  C:\Windows\System\AeqyKNw.exe
  2⤵
  PID:12144
- C:\Windows\System\OJJwBwS.exe
  C:\Windows\System\OJJwBwS.exe
  2⤵
  PID:12200
- C:\Windows\System\XQJjBQq.exe
  C:\Windows\System\XQJjBQq.exe
  2⤵
  PID:12216
- C:\Windows\System\XESGFkG.exe
  C:\Windows\System\XESGFkG.exe
  2⤵
  PID:12232
- C:\Windows\System\sTTCmne.exe
  C:\Windows\System\sTTCmne.exe
  2⤵
  PID:12252
- C:\Windows\System\ypUNZmY.exe
  C:\Windows\System\ypUNZmY.exe
  2⤵
  PID:4284
- C:\Windows\System\CperbHx.exe
  C:\Windows\System\CperbHx.exe
  2⤵
  PID:6952
- C:\Windows\System\UPfaoaF.exe
  C:\Windows\System\UPfaoaF.exe
  2⤵
  PID:7968
- C:\Windows\System\POTVGZL.exe
  C:\Windows\System\POTVGZL.exe
  2⤵
  PID:10272
- C:\Windows\System\IxtavGQ.exe
  C:\Windows\System\IxtavGQ.exe
  2⤵
  PID:10336
- C:\Windows\System\WSWWzhl.exe
  C:\Windows\System\WSWWzhl.exe
  2⤵
  PID:10388
- C:\Windows\System\VIZICZo.exe
  C:\Windows\System\VIZICZo.exe
  2⤵
  PID:10432
- C:\Windows\System\QIBiUYP.exe
  C:\Windows\System\QIBiUYP.exe
  2⤵
  PID:10504
- C:\Windows\System\BrOYQQJ.exe
  C:\Windows\System\BrOYQQJ.exe
  2⤵
  PID:10800
- C:\Windows\System\IyrpqIf.exe
  C:\Windows\System\IyrpqIf.exe
  2⤵
  PID:10828
- C:\Windows\System\fvAOBWp.exe
  C:\Windows\System\fvAOBWp.exe
  2⤵
  PID:11172
- C:\Windows\System\CSnhtpR.exe
  C:\Windows\System\CSnhtpR.exe
  2⤵
  PID:11124
- C:\Windows\System\UgnrNdi.exe
  C:\Windows\System\UgnrNdi.exe
  2⤵
  PID:11080
- C:\Windows\System\ehMmoqJ.exe
  C:\Windows\System\ehMmoqJ.exe
  2⤵
  PID:11036
- C:\Windows\System\ANMEYni.exe
  C:\Windows\System\ANMEYni.exe
  2⤵
  PID:10964
- C:\Windows\System\cJBYUEA.exe
  C:\Windows\System\cJBYUEA.exe
  2⤵
  PID:10924
- C:\Windows\System\RlJEIiB.exe
  C:\Windows\System\RlJEIiB.exe
  2⤵
  PID:10880
- C:\Windows\System\UeXukIJ.exe
  C:\Windows\System\UeXukIJ.exe
  2⤵
  PID:10056
- C:\Windows\System\FGJLxiX.exe
  C:\Windows\System\FGJLxiX.exe
  2⤵
  PID:11252
- C:\Windows\System\mVuIyxI.exe
  C:\Windows\System\mVuIyxI.exe
  2⤵
  PID:8040
- C:\Windows\System\vMbvQKW.exe
  C:\Windows\System\vMbvQKW.exe
  2⤵
  PID:7356
- C:\Windows\System\NWSaEYe.exe
  C:\Windows\System\NWSaEYe.exe
  2⤵
  PID:8096
- C:\Windows\System\hdImkvB.exe
  C:\Windows\System\hdImkvB.exe
  2⤵
  PID:7740
- C:\Windows\System\FPXJqcb.exe
  C:\Windows\System\FPXJqcb.exe
  2⤵
  PID:11304
- C:\Windows\System\jegnCeo.exe
  C:\Windows\System\jegnCeo.exe
  2⤵
  PID:11356
- C:\Windows\System\LHFdFnx.exe
  C:\Windows\System\LHFdFnx.exe
  2⤵
  PID:11620
- C:\Windows\System\vsmlIoE.exe
  C:\Windows\System\vsmlIoE.exe
  2⤵
  PID:2284
- C:\Windows\System\GNfzGKy.exe
  C:\Windows\System\GNfzGKy.exe
  2⤵
  PID:9584
- C:\Windows\System\pXSrPbz.exe
  C:\Windows\System\pXSrPbz.exe
  2⤵
  PID:8568
- C:\Windows\System\yNxuXdC.exe
  C:\Windows\System\yNxuXdC.exe
  2⤵
  PID:9860
- C:\Windows\System\ZJCknOM.exe
  C:\Windows\System\ZJCknOM.exe
  2⤵
  PID:6864
- C:\Windows\System\NTzNyWL.exe
  C:\Windows\System\NTzNyWL.exe
  2⤵
  PID:8936
- C:\Windows\System\ZZLRJlY.exe
  C:\Windows\System\ZZLRJlY.exe
  2⤵
  PID:9128
- C:\Windows\System\EhTQVRi.exe
  C:\Windows\System\EhTQVRi.exe
  2⤵
  PID:7528
- C:\Windows\System\MSiQYqQ.exe
  C:\Windows\System\MSiQYqQ.exe
  2⤵
  PID:7708
- C:\Windows\System\owEdsYK.exe
  C:\Windows\System\owEdsYK.exe
  2⤵
  PID:6328
- C:\Windows\System\gVCGXde.exe
  C:\Windows\System\gVCGXde.exe
  2⤵
  PID:6116
- C:\Windows\System\ImkMoDd.exe
  C:\Windows\System\ImkMoDd.exe
  2⤵
  PID:7316
- C:\Windows\System\ngAkSuN.exe
  C:\Windows\System\ngAkSuN.exe
  2⤵
  PID:6948
- C:\Windows\System\TuoPsDc.exe
  C:\Windows\System\TuoPsDc.exe
  2⤵
  PID:9488
- C:\Windows\System\aeRLpyH.exe
  C:\Windows\System\aeRLpyH.exe
  2⤵
  PID:1492
- C:\Windows\System\RGsmuqn.exe
  C:\Windows\System\RGsmuqn.exe
  2⤵
  PID:12152
- C:\Windows\System\apBnsvh.exe
  C:\Windows\System\apBnsvh.exe
  2⤵
  PID:12292
- C:\Windows\System\OubeVuZ.exe
  C:\Windows\System\OubeVuZ.exe
  2⤵
  PID:12308
- C:\Windows\System\qCGQUBx.exe
  C:\Windows\System\qCGQUBx.exe
  2⤵
  PID:12332
- C:\Windows\System\PEfaJCc.exe
  C:\Windows\System\PEfaJCc.exe
  2⤵
  PID:12348
- C:\Windows\System\itwNbos.exe
  C:\Windows\System\itwNbos.exe
  2⤵
  PID:12364
- C:\Windows\System\PiwJHro.exe
  C:\Windows\System\PiwJHro.exe
  2⤵
  PID:12380
- C:\Windows\System\gmZazEQ.exe
  C:\Windows\System\gmZazEQ.exe
  2⤵
  PID:12396
- C:\Windows\System\gBuYpcj.exe
  C:\Windows\System\gBuYpcj.exe
  2⤵
  PID:12412
- C:\Windows\System\ItUSdyK.exe
  C:\Windows\System\ItUSdyK.exe
  2⤵
  PID:12432
- C:\Windows\System\YoAdWau.exe
  C:\Windows\System\YoAdWau.exe
  2⤵
  PID:12448
- C:\Windows\System\hRwtozI.exe
  C:\Windows\System\hRwtozI.exe
  2⤵
  PID:12468
- C:\Windows\System\HEFUSsb.exe
  C:\Windows\System\HEFUSsb.exe
  2⤵
  PID:12488
- C:\Windows\System\lPRsceP.exe
  C:\Windows\System\lPRsceP.exe
  2⤵
  PID:12512
- C:\Windows\System\uMVuRdj.exe
  C:\Windows\System\uMVuRdj.exe
  2⤵
  PID:12536
- C:\Windows\System\ZarXZWG.exe
  C:\Windows\System\ZarXZWG.exe
  2⤵
  PID:12552
- C:\Windows\System\NMirMZF.exe
  C:\Windows\System\NMirMZF.exe
  2⤵
  PID:11600
- C:\Windows\System\vWKYtJx.exe
  C:\Windows\System\vWKYtJx.exe
  2⤵
  PID:10780
- C:\Windows\System\kEJxOZY.exe
  C:\Windows\System\kEJxOZY.exe
  2⤵
  PID:12588
- C:\Windows\System\oUcHzih.exe
  C:\Windows\System\oUcHzih.exe
  2⤵
  PID:11744
- C:\Windows\System\EcQXiMR.exe
  C:\Windows\System\EcQXiMR.exe
  2⤵
  PID:11792
- C:\Windows\System\QWOYgCm.exe
  C:\Windows\System\QWOYgCm.exe
  2⤵
  PID:11824
- C:\Windows\System\ASaMfMF.exe
  C:\Windows\System\ASaMfMF.exe
  2⤵
  PID:11904
- C:\Windows\System\NAjPINW.exe
  C:\Windows\System\NAjPINW.exe
  2⤵
  PID:11992
- C:\Windows\System\JOeTczJ.exe
  C:\Windows\System\JOeTczJ.exe
  2⤵
  PID:12048
- C:\Windows\System\NoehbDf.exe
  C:\Windows\System\NoehbDf.exe
  2⤵
  PID:12104
- C:\Windows\System\EmcACbs.exe
  C:\Windows\System\EmcACbs.exe
  2⤵
  PID:1932
- C:\Windows\System\fusBuvq.exe
  C:\Windows\System\fusBuvq.exe
  2⤵
  PID:10944
- C:\Windows\System\ygHRmor.exe
  C:\Windows\System\ygHRmor.exe
  2⤵
  PID:5812
- C:\Windows\System\qrmEYfS.exe
  C:\Windows\System\qrmEYfS.exe
  2⤵
  PID:11372
- C:\Windows\System\lbYyEqe.exe
  C:\Windows\System\lbYyEqe.exe
  2⤵
  PID:3424
- C:\Windows\System\hAhHcuu.exe
  C:\Windows\System\hAhHcuu.exe
  2⤵
  PID:9968
- C:\Windows\System\pCjPknO.exe
  C:\Windows\System\pCjPknO.exe
  2⤵
  PID:8512
- C:\Windows\System\WbDtFDJ.exe
  C:\Windows\System\WbDtFDJ.exe
  2⤵
  PID:12704
- C:\Windows\System\QCkxypl.exe
  C:\Windows\System\QCkxypl.exe
  2⤵
  PID:12544
- C:\Windows\System\rRFanDU.exe
  C:\Windows\System\rRFanDU.exe
  2⤵
  PID:12816
- C:\Windows\System\SvHggVz.exe
  C:\Windows\System\SvHggVz.exe
  2⤵
  PID:2352
- C:\Windows\System\yevibzo.exe
  C:\Windows\System\yevibzo.exe
  2⤵
  PID:9704
- C:\Windows\System\ayBWDJh.exe
  C:\Windows\System\ayBWDJh.exe
  2⤵
  PID:11488
- C:\Windows\System\nXagGeQ.exe
  C:\Windows\System\nXagGeQ.exe
  2⤵
  PID:8224
- C:\Windows\System\dMVpFDL.exe
  C:\Windows\System\dMVpFDL.exe
  2⤵
  PID:9228
- C:\Windows\System\BNwCCoU.exe
  C:\Windows\System\BNwCCoU.exe
  2⤵
  PID:10856
- C:\Windows\System\fguVnfl.exe
  C:\Windows\System\fguVnfl.exe
  2⤵
  PID:12968
- C:\Windows\System\TSEbJZM.exe
  C:\Windows\System\TSEbJZM.exe
  2⤵
  PID:11084
- C:\Windows\System\EmxuxSL.exe
  C:\Windows\System\EmxuxSL.exe
  2⤵
  PID:11128
- C:\Windows\System\vJyaupw.exe
  C:\Windows\System\vJyaupw.exe
  2⤵
  PID:6024
- C:\Windows\System\DXDiCJG.exe
  C:\Windows\System\DXDiCJG.exe
  2⤵
  PID:5180
- C:\Windows\System\NWuEHnm.exe
  C:\Windows\System\NWuEHnm.exe
  2⤵
  PID:11952
- C:\Windows\System\LLTLasj.exe
  C:\Windows\System\LLTLasj.exe
  2⤵
  PID:11860
- C:\Windows\System\wFlCoUO.exe
  C:\Windows\System\wFlCoUO.exe
  2⤵
  PID:12076
- C:\Windows\System\rPVtmZx.exe
  C:\Windows\System\rPVtmZx.exe
  2⤵
  PID:4720
- C:\Windows\System\zPfnlEX.exe
  C:\Windows\System\zPfnlEX.exe
  2⤵
  PID:12428
- C:\Windows\System\rsKYUYz.exe
  C:\Windows\System\rsKYUYz.exe
  2⤵
  PID:12260
- C:\Windows\System\QyNCxVv.exe
  C:\Windows\System\QyNCxVv.exe
  2⤵
  PID:12728
- C:\Windows\System\VVarGli.exe
  C:\Windows\System\VVarGli.exe
  2⤵
  PID:12824
- C:\Windows\System\HhbroBa.exe
  C:\Windows\System\HhbroBa.exe
  2⤵
  PID:12868
- C:\Windows\System\BOfHpxD.exe
  C:\Windows\System\BOfHpxD.exe
  2⤵
  PID:13012
- C:\Windows\System\lrDxgkK.exe
  C:\Windows\System\lrDxgkK.exe
  2⤵
  PID:4048
- C:\Windows\System\pcIAUHW.exe
  C:\Windows\System\pcIAUHW.exe
  2⤵
  PID:12212
- C:\Windows\System\ahcFnVl.exe
  C:\Windows\System\ahcFnVl.exe
  2⤵
  PID:13268
- C:\Windows\System\AcflHyI.exe
  C:\Windows\System\AcflHyI.exe
  2⤵
  PID:9644
- C:\Windows\System\GwBdkWI.exe
  C:\Windows\System\GwBdkWI.exe
  2⤵
  PID:13252
- C:\Windows\System\QxxHxrL.exe
  C:\Windows\System\QxxHxrL.exe
  2⤵
  PID:12948
- C:\Windows\System\ZAOTwAa.exe
  C:\Windows\System\ZAOTwAa.exe
  2⤵
  PID:10500
- C:\Windows\System\bzeSDvJ.exe
  C:\Windows\System\bzeSDvJ.exe
  2⤵
  PID:10752
- C:\Windows\System\VQdbVqY.exe
  C:\Windows\System\VQdbVqY.exe
  2⤵
  PID:7892
- C:\Windows\System\BHpZasU.exe
  C:\Windows\System\BHpZasU.exe
  2⤵
  PID:12340
- C:\Windows\System\TiccbCy.exe
  C:\Windows\System\TiccbCy.exe
  2⤵
  PID:13096
- C:\Windows\System\AcRGEAf.exe
  C:\Windows\System\AcRGEAf.exe
  2⤵
  PID:12504
- C:\Windows\System\XsYQEnB.exe
  C:\Windows\System\XsYQEnB.exe
  2⤵
  PID:3172
- C:\Windows\System\ksrPhrz.exe
  C:\Windows\System\ksrPhrz.exe
  2⤵
  PID:9744
- C:\Windows\System\EdFsPvP.exe
  C:\Windows\System\EdFsPvP.exe
  2⤵
  PID:3992
- C:\Windows\System\UNkskrX.exe
  C:\Windows\System\UNkskrX.exe
  2⤵
  PID:12244
- C:\Windows\System\qWuWtRT.exe
  C:\Windows\System\qWuWtRT.exe
  2⤵
  PID:12604
- C:\Windows\System\gJdirtd.exe
  C:\Windows\System\gJdirtd.exe
  2⤵
  PID:11320
- C:\Windows\System\uqSqFng.exe
  C:\Windows\System\uqSqFng.exe
  2⤵
  PID:2068
- C:\Windows\System\ilbHXvy.exe
  C:\Windows\System\ilbHXvy.exe
  2⤵
  PID:12616
- C:\Windows\System\ByhOfRM.exe
  C:\Windows\System\ByhOfRM.exe
  2⤵
  PID:7184
- C:\Windows\System\QJemuAt.exe
  C:\Windows\System\QJemuAt.exe
  2⤵
  PID:11936
- C:\Windows\System\iZxshwW.exe
  C:\Windows\System\iZxshwW.exe
  2⤵
  PID:11988
- C:\Windows\System\XJBkdll.exe
  C:\Windows\System\XJBkdll.exe
  2⤵
  PID:12484
- C:\Windows\System\iCbXiJx.exe
  C:\Windows\System\iCbXiJx.exe
  2⤵
  PID:12716
- C:\Windows\System\eFlfzNu.exe
  C:\Windows\System\eFlfzNu.exe
  2⤵
  PID:1184
- C:\Windows\System\TrvsyqP.exe
  C:\Windows\System\TrvsyqP.exe
  2⤵
  PID:12280
- C:\Windows\System\KxrPFcC.exe
  C:\Windows\System\KxrPFcC.exe
  2⤵
  PID:12660
- C:\Windows\System\WbdFxPp.exe
  C:\Windows\System\WbdFxPp.exe
  2⤵
  PID:11580
- C:\Windows\System\VwbdnPO.exe
  C:\Windows\System\VwbdnPO.exe
  2⤵
  PID:13228
- C:\Windows\System\bqFsOoK.exe
  C:\Windows\System\bqFsOoK.exe
  2⤵
  PID:3104
- C:\Windows\System\dtdJGpX.exe
  C:\Windows\System\dtdJGpX.exe
  2⤵
  PID:11680
- C:\Windows\System\OMUYlhj.exe
  C:\Windows\System\OMUYlhj.exe
  2⤵
  PID:12896
- C:\Windows\System\AfIpIVI.exe
  C:\Windows\System\AfIpIVI.exe
  2⤵
  PID:12576
- C:\Windows\System\sLbbXFV.exe
  C:\Windows\System\sLbbXFV.exe
  2⤵
  PID:11052
- C:\Windows\System\kUPcoGU.exe
  C:\Windows\System\kUPcoGU.exe
  2⤵
  PID:12748
- C:\Windows\System\RmOalAR.exe
  C:\Windows\System\RmOalAR.exe
  2⤵
  PID:13140
- C:\Windows\System\UjJeBTR.exe
  C:\Windows\System\UjJeBTR.exe
  2⤵
  PID:12456
- C:\Windows\System\oTPKAYA.exe
  C:\Windows\System\oTPKAYA.exe
  2⤵
  PID:13328
- C:\Windows\System\rvzuunz.exe
  C:\Windows\System\rvzuunz.exe
  2⤵
  PID:13580
- C:\Windows\System\pjMGROk.exe
  C:\Windows\System\pjMGROk.exe
  2⤵
  PID:13596
- C:\Windows\System\XOfMuFM.exe
  C:\Windows\System\XOfMuFM.exe
  2⤵
  PID:13620
- C:\Windows\System\vRVaOLK.exe
  C:\Windows\System\vRVaOLK.exe
  2⤵
  PID:13640
- C:\Windows\System\vmkDQAY.exe
  C:\Windows\System\vmkDQAY.exe
  2⤵
  PID:13656
- C:\Windows\System\jkifTvW.exe
  C:\Windows\System\jkifTvW.exe
  2⤵
  PID:13680
- C:\Windows\System\vKAlPeP.exe
  C:\Windows\System\vKAlPeP.exe
  2⤵
  PID:13700
- C:\Windows\System\yFBBUqY.exe
  C:\Windows\System\yFBBUqY.exe
  2⤵
  PID:13720
- C:\Windows\System\lifRvZI.exe
  C:\Windows\System\lifRvZI.exe
  2⤵
  PID:13756
- C:\Windows\System\dxqqIwQ.exe
  C:\Windows\System\dxqqIwQ.exe
  2⤵
  PID:13772
- C:\Windows\System\VJLyGTm.exe
  C:\Windows\System\VJLyGTm.exe
  2⤵
  PID:13796
- C:\Windows\System\NoUuIAQ.exe
  C:\Windows\System\NoUuIAQ.exe
  2⤵
  PID:13832
- C:\Windows\System\shrvxCV.exe
  C:\Windows\System\shrvxCV.exe
  2⤵
  PID:13856
- C:\Windows\System\IjxdTmF.exe
  C:\Windows\System\IjxdTmF.exe
  2⤵
  PID:13876
- C:\Windows\System\SathiNy.exe
  C:\Windows\System\SathiNy.exe
  2⤵
  PID:13896
- C:\Windows\System\sTjnrwI.exe
  C:\Windows\System\sTjnrwI.exe
  2⤵
  PID:13912
- C:\Windows\System\nTLJqdj.exe
  C:\Windows\System\nTLJqdj.exe
  2⤵
  PID:13928
- C:\Windows\System\RjqXThv.exe
  C:\Windows\System\RjqXThv.exe
  2⤵
  PID:13952
- C:\Windows\System\uewSAdP.exe
  C:\Windows\System\uewSAdP.exe
  2⤵
  PID:13980
- C:\Windows\System\QeXaGIx.exe
  C:\Windows\System\QeXaGIx.exe
  2⤵
  PID:14000
- C:\Windows\System\qsPqmZI.exe
  C:\Windows\System\qsPqmZI.exe
  2⤵
  PID:14024
- C:\Windows\System\UfMLywn.exe
  C:\Windows\System\UfMLywn.exe
  2⤵
  PID:14044
- C:\Windows\System\jOWZBHz.exe
  C:\Windows\System\jOWZBHz.exe
  2⤵
  PID:14068
- C:\Windows\System\BqlaAWI.exe
  C:\Windows\System\BqlaAWI.exe
  2⤵
  PID:14092
- C:\Windows\System\LIskCvd.exe
  C:\Windows\System\LIskCvd.exe
  2⤵
  PID:14112
- C:\Windows\System\QwldTGu.exe
  C:\Windows\System\QwldTGu.exe
  2⤵
  PID:14136
- C:\Windows\System\HYowmlC.exe
  C:\Windows\System\HYowmlC.exe
  2⤵
  PID:14248
- C:\Windows\System\EvflMYU.exe
  C:\Windows\System\EvflMYU.exe
  2⤵
  PID:14272
- C:\Windows\System\CZLqQRe.exe
  C:\Windows\System\CZLqQRe.exe
  2⤵
  PID:14288
- C:\Windows\System\jRvcsPM.exe
  C:\Windows\System\jRvcsPM.exe
  2⤵
  PID:14312
- C:\Windows\System\hSeSeqi.exe
  C:\Windows\System\hSeSeqi.exe
  2⤵
  PID:13120
- C:\Windows\System\AxphRdJ.exe
  C:\Windows\System\AxphRdJ.exe
  2⤵
  PID:12740
- C:\Windows\System\nxCNJUK.exe
  C:\Windows\System\nxCNJUK.exe
  2⤵
  PID:12860
- C:\Windows\System\iQcbvPj.exe
  C:\Windows\System\iQcbvPj.exe
  2⤵
  PID:232
- C:\Windows\System\DgoJDfz.exe
  C:\Windows\System\DgoJDfz.exe
  2⤵
  PID:7640
- C:\Windows\System\GaZuspk.exe
  C:\Windows\System\GaZuspk.exe
  2⤵
  PID:12648
- C:\Windows\System\NyLboPO.exe
  C:\Windows\System\NyLboPO.exe
  2⤵
  PID:13788
- C:\Windows\System\JckTpGe.exe
  C:\Windows\System\JckTpGe.exe
  2⤵
  PID:14124
- C:\Windows\System\oBbtDkQ.exe
  C:\Windows\System\oBbtDkQ.exe
  2⤵
  PID:14304
- C:\Windows\System\YmhIpyY.exe
  C:\Windows\System\YmhIpyY.exe
  2⤵
  PID:13336
- C:\Windows\System\peElAEy.exe
  C:\Windows\System\peElAEy.exe
  2⤵
  PID:14104
- C:\Windows\System\oryvmbA.exe
  C:\Windows\System\oryvmbA.exe
  2⤵
  PID:14108
- C:\Windows\System\aoMyIgM.exe
  C:\Windows\System\aoMyIgM.exe
  2⤵
  PID:4860
- C:\Windows\System\YjGeDrY.exe
  C:\Windows\System\YjGeDrY.exe
  2⤵
  PID:9180
- C:\Windows\System\xROSFRo.exe
  C:\Windows\System\xROSFRo.exe
  2⤵
  PID:1684
- C:\Windows\System\XECdoYH.exe
  C:\Windows\System\XECdoYH.exe
  2⤵
  PID:13612
- C:\Windows\System\HwfRvkS.exe
  C:\Windows\System\HwfRvkS.exe
  2⤵
  PID:10844
- C:\Windows\System\UZJMlBt.exe
  C:\Windows\System\UZJMlBt.exe
  2⤵
  PID:13708
- C:\Windows\System\IaFBomz.exe
  C:\Windows\System\IaFBomz.exe
  2⤵
  PID:2756
- C:\Windows\System\xQFmzEd.exe
  C:\Windows\System\xQFmzEd.exe
  2⤵
  PID:11224
- C:\Windows\System\TPUdzET.exe
  C:\Windows\System\TPUdzET.exe
  2⤵
  PID:13852
- C:\Windows\System\rPbpMKA.exe
  C:\Windows\System\rPbpMKA.exe
  2⤵
  PID:13924
- C:\Windows\System\RNJWRry.exe
  C:\Windows\System\RNJWRry.exe
  2⤵
  PID:2952
- C:\Windows\System\LKOIgyt.exe
  C:\Windows\System\LKOIgyt.exe
  2⤵
  PID:14188
- C:\Windows\System\BDKMMag.exe
  C:\Windows\System\BDKMMag.exe
  2⤵
  PID:9880
- C:\Windows\System\oQqpcpj.exe
  C:\Windows\System\oQqpcpj.exe
  2⤵
  PID:8864
- C:\Windows\System\dXjlWSN.exe
  C:\Windows\System\dXjlWSN.exe
  2⤵
  PID:14144
- C:\Windows\System\neKoyaV.exe
  C:\Windows\System\neKoyaV.exe
  2⤵
  PID:10476
- C:\Windows\System\BHZrIgN.exe
  C:\Windows\System\BHZrIgN.exe
  2⤵
  PID:10180
- C:\Windows\System\kGNVAqu.exe
  C:\Windows\System\kGNVAqu.exe
  2⤵
  PID:14172
- C:\Windows\System\AHnfUNw.exe
  C:\Windows\System\AHnfUNw.exe
  2⤵
  PID:13536
- C:\Windows\System\fqHWAtU.exe
  C:\Windows\System\fqHWAtU.exe
  2⤵
  PID:3256
- C:\Windows\System\vnsqFIy.exe
  C:\Windows\System\vnsqFIy.exe
  2⤵
  PID:3292
- C:\Windows\System\OhJDTSE.exe
  C:\Windows\System\OhJDTSE.exe
  2⤵
  PID:13360
- C:\Windows\System\lRVccAn.exe
  C:\Windows\System\lRVccAn.exe
  2⤵
  PID:4540
- C:\Windows\System\XtFXNWh.exe
  C:\Windows\System\XtFXNWh.exe
  2⤵
  PID:2964
- C:\Windows\System\HrBHYqq.exe
  C:\Windows\System\HrBHYqq.exe
  2⤵
  PID:13992
- C:\Windows\System\DlvDcPO.exe
  C:\Windows\System\DlvDcPO.exe
  2⤵
  PID:14032
- C:\Windows\System\rvthgFg.exe
  C:\Windows\System\rvthgFg.exe
  2⤵
  PID:10608
- C:\Windows\System\lJQbnJg.exe
  C:\Windows\System\lJQbnJg.exe
  2⤵
  PID:4856
- C:\Windows\System\ysDqwGK.exe
  C:\Windows\System\ysDqwGK.exe
  2⤵
  PID:14332
- C:\Windows\System\TiBqgVb.exe
  C:\Windows\System\TiBqgVb.exe
  2⤵
  PID:5064
- C:\Windows\System\kmcIUKC.exe
  C:\Windows\System\kmcIUKC.exe
  2⤵
  PID:4160
- C:\Windows\System\zAXRRpd.exe
  C:\Windows\System\zAXRRpd.exe
  2⤵
  PID:3316
- C:\Windows\System\oyRnLoR.exe
  C:\Windows\System\oyRnLoR.exe
  2⤵
  PID:4488
- C:\Windows\System\QUPOlHi.exe
  C:\Windows\System\QUPOlHi.exe
  2⤵
  PID:2948
- C:\Windows\System\lHzLTRO.exe
  C:\Windows\System\lHzLTRO.exe
  2⤵
  PID:4108
- C:\Windows\System\BEYvQJp.exe
  C:\Windows\System\BEYvQJp.exe
  2⤵
  PID:12856
- C:\Windows\System\jAehZEg.exe
  C:\Windows\System\jAehZEg.exe
  2⤵
  PID:4400
- C:\Windows\System\IwacaHi.exe
  C:\Windows\System\IwacaHi.exe
  2⤵
  PID:5068
- C:\Windows\System\uYiwAxR.exe
  C:\Windows\System\uYiwAxR.exe
  2⤵
  PID:3000
- C:\Windows\System\sxKaDrj.exe
  C:\Windows\System\sxKaDrj.exe
  2⤵
  PID:4076
- C:\Windows\System\VNHseyu.exe
  C:\Windows\System\VNHseyu.exe
  2⤵
  PID:1636
- C:\Windows\System\kOHttTH.exe
  C:\Windows\System\kOHttTH.exe
  2⤵
  PID:1888
- C:\Windows\System\IbYABRb.exe
  C:\Windows\System\IbYABRb.exe
  2⤵
  PID:13412
- C:\Windows\System\pyChOMt.exe
  C:\Windows\System\pyChOMt.exe
  2⤵
  PID:1004
- C:\Windows\System\KycTaGW.exe
  C:\Windows\System\KycTaGW.exe
  2⤵
  PID:14040
- C:\Windows\System\nJUdPQC.exe
  C:\Windows\System\nJUdPQC.exe
  2⤵
  PID:8404
- C:\Windows\System\kOnkUkK.exe
  C:\Windows\System\kOnkUkK.exe
  2⤵
  PID:6824
- C:\Windows\System\ATEwVKu.exe
  C:\Windows\System\ATEwVKu.exe
  2⤵
  PID:4656
- C:\Windows\System\rBdShxy.exe
  C:\Windows\System\rBdShxy.exe
  2⤵
  PID:1300
- C:\Windows\System\VSctuJM.exe
  C:\Windows\System\VSctuJM.exe
  2⤵
  PID:1432
- C:\Windows\System\ebORpST.exe
  C:\Windows\System\ebORpST.exe
  2⤵
  PID:1532
- C:\Windows\System\OpxSQXM.exe
  C:\Windows\System\OpxSQXM.exe
  2⤵
  PID:2296
- C:\Windows\System\dfGGbRI.exe
  C:\Windows\System\dfGGbRI.exe
  2⤵
  PID:13908
- C:\Windows\System\dgDnMSQ.exe
  C:\Windows\System\dgDnMSQ.exe
  2⤵
  PID:11596
- C:\Windows\System\lJymFCD.exe
  C:\Windows\System\lJymFCD.exe
  2⤵
  PID:2760
- C:\Windows\System\fYJksth.exe
  C:\Windows\System\fYJksth.exe
  2⤵
  PID:6056
- C:\Windows\System\RgvCtAu.exe
  C:\Windows\System\RgvCtAu.exe
  2⤵
  PID:772
- C:\Windows\System\kSwiAkN.exe
  C:\Windows\System\kSwiAkN.exe
  2⤵
  PID:13848
- C:\Windows\System\NpiMInA.exe
  C:\Windows\System\NpiMInA.exe
  2⤵
  PID:13888
- C:\Windows\System\UjqmPlc.exe
  C:\Windows\System\UjqmPlc.exe
  2⤵
  PID:5512
- C:\Windows\System\FwbZWzt.exe
  C:\Windows\System\FwbZWzt.exe
  2⤵
  PID:4552
- C:\Windows\System\QLmkZNF.exe
  C:\Windows\System\QLmkZNF.exe
  2⤵
  PID:7784
- C:\Windows\System\cTfYTzw.exe
  C:\Windows\System\cTfYTzw.exe
  2⤵
  PID:5768
- C:\Windows\System\bPAhYXx.exe
  C:\Windows\System\bPAhYXx.exe
  2⤵
  PID:8236
- C:\Windows\System\NMcOnEq.exe
  C:\Windows\System\NMcOnEq.exe
  2⤵
  PID:13944
- C:\Windows\System\gAsOppA.exe
  C:\Windows\System\gAsOppA.exe
  2⤵
  PID:4240
- C:\Windows\System\KZznDUi.exe
  C:\Windows\System\KZznDUi.exe
  2⤵
  PID:6140
- C:\Windows\System\PjSqQqs.exe
  C:\Windows\System\PjSqQqs.exe
  2⤵
  PID:6644
- C:\Windows\System\YbbLhca.exe
  C:\Windows\System\YbbLhca.exe
  2⤵
  PID:14212
- C:\Windows\System\wmmDxOc.exe
  C:\Windows\System\wmmDxOc.exe
  2⤵
  PID:14036
- C:\Windows\System\VWEWJyY.exe
  C:\Windows\System\VWEWJyY.exe
  2⤵
  PID:3548
- C:\Windows\System\YLjuRVM.exe
  C:\Windows\System\YLjuRVM.exe
  2⤵
  PID:6352
- C:\Windows\System\OlKvbiQ.exe
  C:\Windows\System\OlKvbiQ.exe
  2⤵
  PID:5840
- C:\Windows\System\kTbGPhm.exe
  C:\Windows\System\kTbGPhm.exe
  2⤵
  PID:9468
- C:\Windows\System\ouAwzbI.exe
  C:\Windows\System\ouAwzbI.exe
  2⤵
  PID:6168
- C:\Windows\System\NLQjeSK.exe
  C:\Windows\System\NLQjeSK.exe
  2⤵
  PID:6272
- C:\Windows\System\jeAFgye.exe
  C:\Windows\System\jeAFgye.exe
  2⤵
  PID:5464
- C:\Windows\System\OPbNmoZ.exe
  C:\Windows\System\OPbNmoZ.exe
  2⤵
  PID:1948
- C:\Windows\System\GfgfZzz.exe
  C:\Windows\System\GfgfZzz.exe
  2⤵
  PID:5380
- C:\Windows\System\wWLcvyV.exe
  C:\Windows\System\wWLcvyV.exe
  2⤵
  PID:1552
- C:\Windows\System\kMovIIW.exe
  C:\Windows\System\kMovIIW.exe
  2⤵
  PID:5356
- C:\Windows\System\zPHskjE.exe
  C:\Windows\System\zPHskjE.exe
  2⤵
  PID:8180
- C:\Windows\System\VbgcNGK.exe
  C:\Windows\System\VbgcNGK.exe
  2⤵
  PID:7312
- C:\Windows\System\NlSoQyi.exe
  C:\Windows\System\NlSoQyi.exe
  2⤵
  PID:4960
- C:\Windows\System\FZkqiuV.exe
  C:\Windows\System\FZkqiuV.exe
  2⤵
  PID:7012
- C:\Windows\System\wLXkSAk.exe
  C:\Windows\System\wLXkSAk.exe
  2⤵
  PID:5712
- C:\Windows\System\joScZjm.exe
  C:\Windows\System\joScZjm.exe
  2⤵
  PID:1564
- C:\Windows\System\wgoSSPt.exe
  C:\Windows\System\wgoSSPt.exe
  2⤵
  PID:14224
- C:\Windows\System\inexQcp.exe
  C:\Windows\System\inexQcp.exe
  2⤵
  PID:7048
- C:\Windows\System\SeIrcrq.exe
  C:\Windows\System\SeIrcrq.exe
  2⤵
  PID:5468
- C:\Windows\System\UHfEAKW.exe
  C:\Windows\System\UHfEAKW.exe
  2⤵
  PID:7832
- C:\Windows\System\miyvJmY.exe
  C:\Windows\System\miyvJmY.exe
  2⤵
  PID:7800
- C:\Windows\System\OSzgjIS.exe
  C:\Windows\System\OSzgjIS.exe
  2⤵
  PID:7884
- C:\Windows\System\RtPhJAK.exe
  C:\Windows\System\RtPhJAK.exe
  2⤵
  PID:7944
- C:\Windows\System\izrxgtC.exe
  C:\Windows\System\izrxgtC.exe
  2⤵
  PID:6788
- C:\Windows\System\kLiqGeL.exe
  C:\Windows\System\kLiqGeL.exe
  2⤵
  PID:6872
- C:\Windows\System\NffTNlb.exe
  C:\Windows\System\NffTNlb.exe
  2⤵
  PID:7984
- C:\Windows\System\khXrMNq.exe
  C:\Windows\System\khXrMNq.exe
  2⤵
  PID:1904
- C:\Windows\System\yEMGLVV.exe
  C:\Windows\System\yEMGLVV.exe
  2⤵
  PID:7852
- C:\Windows\System\HonUlIw.exe
  C:\Windows\System\HonUlIw.exe
  2⤵
  PID:7908
- C:\Windows\System\FvmYldp.exe
  C:\Windows\System\FvmYldp.exe
  2⤵
  PID:8648
- C:\Windows\System\SZKkqWB.exe
  C:\Windows\System\SZKkqWB.exe
  2⤵
  PID:6928
- C:\Windows\System\AULhEEb.exe
  C:\Windows\System\AULhEEb.exe
  2⤵
  PID:6260
- C:\Windows\System\XmuAJxc.exe
  C:\Windows\System\XmuAJxc.exe
  2⤵
  PID:6524
- C:\Windows\System\ROUzPGg.exe
  C:\Windows\System\ROUzPGg.exe
  2⤵
  PID:5168
- C:\Windows\System\vTvTnUU.exe
  C:\Windows\System\vTvTnUU.exe
  2⤵
  PID:4796
- C:\Windows\System\fEytCkA.exe
  C:\Windows\System\fEytCkA.exe
  2⤵
  PID:9376
- C:\Windows\System\HgnFjzC.exe
  C:\Windows\System\HgnFjzC.exe
  2⤵
  PID:5288
- C:\Windows\System\zSjYonz.exe
  C:\Windows\System\zSjYonz.exe
  2⤵
  PID:5264
- C:\Windows\System\fBOflEZ.exe
  C:\Windows\System\fBOflEZ.exe
  2⤵
  PID:8176
- C:\Windows\System\FpwUmdS.exe
  C:\Windows\System\FpwUmdS.exe
  2⤵
  PID:5488
- C:\Windows\System\cHPXDds.exe
  C:\Windows\System\cHPXDds.exe
  2⤵
  PID:2320
- C:\Windows\System\JWysenW.exe
  C:\Windows\System\JWysenW.exe
  2⤵
  PID:3524
- C:\Windows\System\UulHjAf.exe
  C:\Windows\System\UulHjAf.exe
  2⤵
  PID:9800
- C:\Windows\System\LCEjDNa.exe
  C:\Windows\System\LCEjDNa.exe
  2⤵
  PID:9964
- C:\Windows\System\ugEvaRw.exe
  C:\Windows\System\ugEvaRw.exe
  2⤵
  PID:13080
- C:\Windows\System\cSUriva.exe
  C:\Windows\System\cSUriva.exe
  2⤵
  PID:6912
- C:\Windows\System\QJjFzpO.exe
  C:\Windows\System\QJjFzpO.exe
  2⤵
  PID:5684
- C:\Windows\System\YWedUwT.exe
  C:\Windows\System\YWedUwT.exe
  2⤵
  PID:2448
- C:\Windows\System\pwatIia.exe
  C:\Windows\System\pwatIia.exe
  2⤵
  PID:2784
- C:\Windows\System\eQuvpnJ.exe
  C:\Windows\System\eQuvpnJ.exe
  2⤵
  PID:7492
- C:\Windows\System\laMISYA.exe
  C:\Windows\System\laMISYA.exe
  2⤵
  PID:2528
- C:\Windows\System\oJTVclu.exe
  C:\Windows\System\oJTVclu.exe
  2⤵
  PID:4084
- C:\Windows\System\VBTbNgJ.exe
  C:\Windows\System\VBTbNgJ.exe
  2⤵
  PID:7000
- C:\Windows\System\ZEHDJcq.exe
  C:\Windows\System\ZEHDJcq.exe
  2⤵
  PID:7844
- C:\Windows\System\dSnOiBs.exe
  C:\Windows\System\dSnOiBs.exe
  2⤵
  PID:1940
- C:\Windows\System\PYAPiDz.exe
  C:\Windows\System\PYAPiDz.exe
  2⤵
  PID:6984
- C:\Windows\System\uWuMMys.exe
  C:\Windows\System\uWuMMys.exe
  2⤵
  PID:9392
- C:\Windows\System\HHPTrYK.exe
  C:\Windows\System\HHPTrYK.exe
  2⤵
  PID:8432
- C:\Windows\System\AikDJOk.exe
  C:\Windows\System\AikDJOk.exe
  2⤵
  PID:10736
- C:\Windows\System\ZcdrFkb.exe
  C:\Windows\System\ZcdrFkb.exe
  2⤵
  PID:8152
- C:\Windows\System\HXTUcZx.exe
  C:\Windows\System\HXTUcZx.exe
  2⤵
  PID:5404
- C:\Windows\System\AFhcYxC.exe
  C:\Windows\System\AFhcYxC.exe
  2⤵
  PID:5432
- C:\Windows\System\epTgrsq.exe
  C:\Windows\System\epTgrsq.exe
  2⤵
  PID:6968
- C:\Windows\System\zHFqxHv.exe
  C:\Windows\System\zHFqxHv.exe
  2⤵
  PID:5728
- C:\Windows\System\wWgAZuX.exe
  C:\Windows\System\wWgAZuX.exe
  2⤵
  PID:992
- C:\Windows\System\FLeBnHO.exe
  C:\Windows\System\FLeBnHO.exe
  2⤵
  PID:8044
- C:\Windows\System\JPwhPjV.exe
  C:\Windows\System\JPwhPjV.exe
  2⤵
  PID:4756
- C:\Windows\System\pUVIfzt.exe
  C:\Windows\System\pUVIfzt.exe
  2⤵
  PID:11228
- C:\Windows\System\TTFHrXl.exe
  C:\Windows\System\TTFHrXl.exe
  2⤵
  PID:556
- C:\Windows\System\nIcuChN.exe
  C:\Windows\System\nIcuChN.exe
  2⤵
  PID:9344
- C:\Windows\System\lTVmXBE.exe
  C:\Windows\System\lTVmXBE.exe
  2⤵
  PID:3520
- C:\Windows\System\NBvAGUq.exe
  C:\Windows\System\NBvAGUq.exe
  2⤵
  PID:10308
- C:\Windows\System\SONeZWi.exe
  C:\Windows\System\SONeZWi.exe
  2⤵
  PID:9560
- C:\Windows\System\zsHGjxc.exe
  C:\Windows\System\zsHGjxc.exe
  2⤵
  PID:4640
- C:\Windows\System\epQGGIo.exe
  C:\Windows\System\epQGGIo.exe
  2⤵
  PID:8508
- C:\Windows\System\eIQDtkL.exe
  C:\Windows\System\eIQDtkL.exe
  2⤵
  PID:10760
- C:\Windows\System\uXTnkYO.exe
  C:\Windows\System\uXTnkYO.exe
  2⤵
  PID:656
- C:\Windows\System\BgYwDAu.exe
  C:\Windows\System\BgYwDAu.exe
  2⤵
  PID:8252
- C:\Windows\System\cKUKTOg.exe
  C:\Windows\System\cKUKTOg.exe
  2⤵
  PID:7732
- C:\Windows\System\ajKHkvD.exe
  C:\Windows\System\ajKHkvD.exe
  2⤵
  PID:9040
- C:\Windows\System\yenAMUo.exe
  C:\Windows\System\yenAMUo.exe
  2⤵
  PID:9140
- C:\Windows\System\ZAkEEBE.exe
  C:\Windows\System\ZAkEEBE.exe
  2⤵
  PID:9192
- C:\Windows\System\oVibEDs.exe
  C:\Windows\System\oVibEDs.exe
  2⤵
  PID:5628
- C:\Windows\System\avGoods.exe
  C:\Windows\System\avGoods.exe
  2⤵
  PID:7432
- C:\Windows\System\fBTQrwi.exe
  C:\Windows\System\fBTQrwi.exe
  2⤵
  PID:6192
- C:\Windows\System\JgDCHMR.exe
  C:\Windows\System\JgDCHMR.exe
  2⤵
  PID:7920
- C:\Windows\System\Mdcmdda.exe
  C:\Windows\System\Mdcmdda.exe
  2⤵
  PID:8380
- C:\Windows\System\mgqaNdj.exe
  C:\Windows\System\mgqaNdj.exe
  2⤵
  PID:9232
- C:\Windows\System\uavIPaG.exe
  C:\Windows\System\uavIPaG.exe
  2⤵
  PID:14228
- C:\Windows\System\PEjOWJB.exe
  C:\Windows\System\PEjOWJB.exe
  2⤵
  PID:10684
- C:\Windows\System\HpnMRBT.exe
  C:\Windows\System\HpnMRBT.exe
  2⤵
  PID:7272
- C:\Windows\System\tJDyHcU.exe
  C:\Windows\System\tJDyHcU.exe
  2⤵
  PID:7916
- C:\Windows\System\sbWAaUI.exe
  C:\Windows\System\sbWAaUI.exe
  2⤵
  PID:8904
- C:\Windows\System\TwWCfHN.exe
  C:\Windows\System\TwWCfHN.exe
  2⤵
  PID:11696
- C:\Windows\System\kjJiEvJ.exe
  C:\Windows\System\kjJiEvJ.exe
  2⤵
  PID:1296
- C:\Windows\System\uDgtkUY.exe
  C:\Windows\System\uDgtkUY.exe
  2⤵
  PID:11880
- C:\Windows\System\DcAHTuV.exe
  C:\Windows\System\DcAHTuV.exe
  2⤵
  PID:8000
- C:\Windows\System\bgbtfMK.exe
  C:\Windows\System\bgbtfMK.exe
  2⤵
  PID:2384
- C:\Windows\System\xTPxZNG.exe
  C:\Windows\System\xTPxZNG.exe
  2⤵
  PID:8016
- C:\Windows\System\TdSfPRW.exe
  C:\Windows\System\TdSfPRW.exe
  2⤵
  PID:2704
- C:\Windows\System\FtPAoLO.exe
  C:\Windows\System\FtPAoLO.exe
  2⤵
  PID:14256
- C:\Windows\System\rhWlTZM.exe
  C:\Windows\System\rhWlTZM.exe
  2⤵
  PID:1956
- C:\Windows\System\xCjKabE.exe
  C:\Windows\System\xCjKabE.exe
  2⤵
  PID:11912
- C:\Windows\System\eGNjRxM.exe
  C:\Windows\System\eGNjRxM.exe
  2⤵
  PID:9792
- C:\Windows\System\APBAwrV.exe
  C:\Windows\System\APBAwrV.exe
  2⤵
  PID:10284
- C:\Windows\System\QsKsfnO.exe
  C:\Windows\System\QsKsfnO.exe
  2⤵
  PID:8232
- C:\Windows\System\OaWZJvw.exe
  C:\Windows\System\OaWZJvw.exe
  2⤵
  PID:12096
- C:\Windows\System\mKZTxXC.exe
  C:\Windows\System\mKZTxXC.exe
  2⤵
  PID:11392
- C:\Windows\System\VhTbYQv.exe
  C:\Windows\System\VhTbYQv.exe
  2⤵
  PID:9568
- C:\Windows\System\FFyfqiS.exe
  C:\Windows\System\FFyfqiS.exe
  2⤵
  PID:9740
- C:\Windows\System\oTJQWbH.exe
  C:\Windows\System\oTJQWbH.exe
  2⤵
  PID:8532
- C:\Windows\System\eieMcWJ.exe
  C:\Windows\System\eieMcWJ.exe
  2⤵
  PID:8164
- C:\Windows\System\okmTTlb.exe
  C:\Windows\System\okmTTlb.exe
  2⤵
  PID:3308
- C:\Windows\System\bZswstA.exe
  C:\Windows\System\bZswstA.exe
  2⤵
  PID:11900
- C:\Windows\System\kdYlJFV.exe
  C:\Windows\System\kdYlJFV.exe
  2⤵
  PID:10984
- C:\Windows\System\NZxgcqp.exe
  C:\Windows\System\NZxgcqp.exe
  2⤵
  PID:8572
- C:\Windows\System\ZphbQsQ.exe
  C:\Windows\System\ZphbQsQ.exe
  2⤵
  PID:11576
- C:\Windows\System\zekwdGG.exe
  C:\Windows\System\zekwdGG.exe
  2⤵
  PID:10628
- C:\Windows\System\nSCGtAA.exe
  C:\Windows\System\nSCGtAA.exe
  2⤵
  PID:8576
- C:\Windows\System\BEJWRLb.exe
  C:\Windows\System\BEJWRLb.exe
  2⤵
  PID:8120
- C:\Windows\System\PWmBMfT.exe
  C:\Windows\System\PWmBMfT.exe
  2⤵
  PID:10908
- C:\Windows\System\djofxjK.exe
  C:\Windows\System\djofxjK.exe
  2⤵
  PID:9400
- C:\Windows\System\OIIHfMb.exe
  C:\Windows\System\OIIHfMb.exe
  2⤵
  PID:6940
- C:\Windows\System\cEuAqeM.exe
  C:\Windows\System\cEuAqeM.exe
  2⤵
  PID:6500
- C:\Windows\System\hRwLYFh.exe
  C:\Windows\System\hRwLYFh.exe
  2⤵
  PID:8764
- C:\Windows\System\bWzMhXh.exe
  C:\Windows\System\bWzMhXh.exe
  2⤵
  PID:5592
- C:\Windows\System\hBTKnQn.exe
  C:\Windows\System\hBTKnQn.exe
  2⤵
  PID:2488
- C:\Windows\System\kTlBSaF.exe
  C:\Windows\System\kTlBSaF.exe
  2⤵
  PID:5848
- C:\Windows\System\geXZRen.exe
  C:\Windows\System\geXZRen.exe
  2⤵
  PID:6768
- C:\Windows\System\JpYyfyM.exe
  C:\Windows\System\JpYyfyM.exe
  2⤵
  PID:12528
- C:\Windows\System\QaeFVkP.exe
  C:\Windows\System\QaeFVkP.exe
  2⤵
  PID:11916
- C:\Windows\System\sxwinuG.exe
  C:\Windows\System\sxwinuG.exe
  2⤵
  PID:12960
- C:\Windows\System\EliKOuV.exe
  C:\Windows\System\EliKOuV.exe
  2⤵
  PID:8140
- C:\Windows\System\KgfGSxG.exe
  C:\Windows\System\KgfGSxG.exe
  2⤵
  PID:12112
- C:\Windows\System\xhUcshr.exe
  C:\Windows\System\xhUcshr.exe
  2⤵
  PID:9724
- C:\Windows\System\HdKlgVn.exe
  C:\Windows\System\HdKlgVn.exe
  2⤵
  PID:13188
- C:\Windows\System\lniBOms.exe
  C:\Windows\System\lniBOms.exe
  2⤵
  PID:1736
- C:\Windows\System\mUgmOJu.exe
  C:\Windows\System\mUgmOJu.exe
  2⤵
  PID:13232
- C:\Windows\System\XBpUMum.exe
  C:\Windows\System\XBpUMum.exe
  2⤵
  PID:9460
- C:\Windows\System\tKGbcFp.exe
  C:\Windows\System\tKGbcFp.exe
  2⤵
  PID:11908
- C:\Windows\System\iAUxlvs.exe
  C:\Windows\System\iAUxlvs.exe
  2⤵
  PID:12100
- C:\Windows\System\UFAaWrB.exe
  C:\Windows\System\UFAaWrB.exe
  2⤵
  PID:9464
- C:\Windows\System\ozICnYA.exe
  C:\Windows\System\ozICnYA.exe
  2⤵
  PID:9924
- C:\Windows\System\rgudxQm.exe
  C:\Windows\System\rgudxQm.exe
  2⤵
  PID:12752
- C:\Windows\System\CULDBaL.exe
  C:\Windows\System\CULDBaL.exe
  2⤵
  PID:12808
- C:\Windows\System\RZtEaAE.exe
  C:\Windows\System\RZtEaAE.exe
  2⤵
  PID:7848
- C:\Windows\System\ZfoOdEM.exe
  C:\Windows\System\ZfoOdEM.exe
  2⤵
  PID:12880
- C:\Windows\System\VoYSDLj.exe
  C:\Windows\System\VoYSDLj.exe
  2⤵
  PID:11840
- C:\Windows\System\vXRgHWy.exe
  C:\Windows\System\vXRgHWy.exe
  2⤵
  PID:12996
- C:\Windows\System\PQUrEcV.exe
  C:\Windows\System\PQUrEcV.exe
  2⤵
  PID:12564
- C:\Windows\System\QKuNIxC.exe
  C:\Windows\System\QKuNIxC.exe
  2⤵
  PID:3448
- C:\Windows\System\WLlPfNH.exe
  C:\Windows\System\WLlPfNH.exe
  2⤵
  PID:10408
- C:\Windows\System\JqKMWJR.exe
  C:\Windows\System\JqKMWJR.exe
  2⤵
  PID:10404
- C:\Windows\System\BaZqWjn.exe
  C:\Windows\System\BaZqWjn.exe
  2⤵
  PID:9940
- C:\Windows\System\OTDRLQX.exe
  C:\Windows\System\OTDRLQX.exe
  2⤵
  PID:10692
- C:\Windows\System\JEhAeSw.exe
  C:\Windows\System\JEhAeSw.exe
  2⤵
  PID:3220
- C:\Windows\System\UsBQKIb.exe
  C:\Windows\System\UsBQKIb.exe
  2⤵
  PID:10224
- C:\Windows\System\cdWcydv.exe
  C:\Windows\System\cdWcydv.exe
  2⤵
  PID:13048
- C:\Windows\System\sFeFCzR.exe
  C:\Windows\System\sFeFCzR.exe
  2⤵
  PID:7264
- C:\Windows\System\usBQKhy.exe
  C:\Windows\System\usBQKhy.exe
  2⤵
  PID:1824
- C:\Windows\System\QuUMbhf.exe
  C:\Windows\System\QuUMbhf.exe
  2⤵
  PID:5200
- C:\Windows\System\ZCosGBY.exe
  C:\Windows\System\ZCosGBY.exe
  2⤵
  PID:13152
- C:\Windows\System\uhHChYL.exe
  C:\Windows\System\uhHChYL.exe
  2⤵
  PID:9116
- C:\Windows\System\VkIgWZf.exe
  C:\Windows\System\VkIgWZf.exe
  2⤵
  PID:9328
- C:\Windows\System\BEsTfsb.exe
  C:\Windows\System\BEsTfsb.exe
  2⤵
  PID:11540
- C:\Windows\System\avmhTHa.exe
  C:\Windows\System\avmhTHa.exe
  2⤵
  PID:8664
- C:\Windows\System\zrGXWsb.exe
  C:\Windows\System\zrGXWsb.exe
  2⤵
  PID:688
- C:\Windows\System\ZOmiGHI.exe
  C:\Windows\System\ZOmiGHI.exe
  2⤵
  PID:13164
- C:\Windows\System\tZJatjA.exe
  C:\Windows\System\tZJatjA.exe
  2⤵
  PID:9260
- C:\Windows\System\UmIpXeO.exe
  C:\Windows\System\UmIpXeO.exe
  2⤵
  PID:3616
- C:\Windows\System\LQwWEbv.exe
  C:\Windows\System\LQwWEbv.exe
  2⤵
  PID:2280
- C:\Windows\System\pWIwift.exe
  C:\Windows\System\pWIwift.exe
  2⤵
  PID:13060
- C:\Windows\System\WVqHHnt.exe
  C:\Windows\System\WVqHHnt.exe
  2⤵
  PID:12444
- C:\Windows\System\qRkjLps.exe
  C:\Windows\System\qRkjLps.exe
  2⤵
  PID:8360
- C:\Windows\System\tVlQDcJ.exe
  C:\Windows\System\tVlQDcJ.exe
  2⤵
  PID:12248
- C:\Windows\System\vZOeeFV.exe
  C:\Windows\System\vZOeeFV.exe
  2⤵
  PID:6084
- C:\Windows\System\EYvAGfU.exe
  C:\Windows\System\EYvAGfU.exe
  2⤵
  PID:3508
- C:\Windows\System\WzfcWhX.exe
  C:\Windows\System\WzfcWhX.exe
  2⤵
  PID:13256
- C:\Windows\System\fysaVaV.exe
  C:\Windows\System\fysaVaV.exe
  2⤵
  PID:11772
- C:\Windows\System\TbWxqRH.exe
  C:\Windows\System\TbWxqRH.exe
  2⤵
  PID:12460
- C:\Windows\System\AtDucBx.exe
  C:\Windows\System\AtDucBx.exe
  2⤵
  PID:11164
- C:\Windows\System\dYMZTsr.exe
  C:\Windows\System\dYMZTsr.exe
  2⤵
  PID:10988
- C:\Windows\System\dLLIMZt.exe
  C:\Windows\System\dLLIMZt.exe
  2⤵
  PID:12392
- C:\Windows\System\aOTpOza.exe
  C:\Windows\System\aOTpOza.exe
  2⤵
  PID:9196
- C:\Windows\System\MbJAMMW.exe
  C:\Windows\System\MbJAMMW.exe
  2⤵
  PID:11704
- C:\Windows\System\IHfcDVq.exe
  C:\Windows\System\IHfcDVq.exe
  2⤵
  PID:2484
- C:\Windows\System\wLQUdSk.exe
  C:\Windows\System\wLQUdSk.exe
  2⤵
  PID:13124
- C:\Windows\System\JtpDPDW.exe
  C:\Windows\System\JtpDPDW.exe
  2⤵
  PID:9852
- C:\Windows\System\LqaFOau.exe
  C:\Windows\System\LqaFOau.exe
  2⤵
  PID:13292
- C:\Windows\System\pdFfmpG.exe
  C:\Windows\System\pdFfmpG.exe
  2⤵
  PID:9820
- C:\Windows\System\dudSSgV.exe
  C:\Windows\System\dudSSgV.exe
  2⤵
  PID:13264
- C:\Windows\System\YJCRBFc.exe
  C:\Windows\System\YJCRBFc.exe
  2⤵
  PID:168
- C:\Windows\System\iPlKjpC.exe
  C:\Windows\System\iPlKjpC.exe
  2⤵
  PID:6264
- C:\Windows\System\OkswakW.exe
  C:\Windows\System\OkswakW.exe
  2⤵
  PID:13560
- C:\Windows\System\jQtMzLP.exe
  C:\Windows\System\jQtMzLP.exe
  2⤵
  PID:11212
- C:\Windows\System\oMVdzfH.exe
  C:\Windows\System\oMVdzfH.exe
  2⤵
  PID:12980
- C:\Windows\System\kiXUdBk.exe
  C:\Windows\System\kiXUdBk.exe
  2⤵
  PID:13440
- C:\Windows\System\dvyCeNa.exe
  C:\Windows\System\dvyCeNa.exe
  2⤵
  PID:11740
- C:\Windows\System\GCqcrIq.exe
  C:\Windows\System\GCqcrIq.exe
  2⤵
  PID:13476
- C:\Windows\System\YIRhPHm.exe
  C:\Windows\System\YIRhPHm.exe
  2⤵
  PID:13488
- C:\Windows\System\lhxPVvn.exe
  C:\Windows\System\lhxPVvn.exe
  2⤵
  PID:13812
- C:\Windows\System\zcOJnfI.exe
  C:\Windows\System\zcOJnfI.exe
  2⤵
  PID:13044
- C:\Windows\System\ANeFkMq.exe
  C:\Windows\System\ANeFkMq.exe
  2⤵
  PID:14196
- C:\Windows\System\VxyZeNX.exe
  C:\Windows\System\VxyZeNX.exe
  2⤵
  PID:12892
- C:\Windows\System\RjBDvjM.exe
  C:\Windows\System\RjBDvjM.exe
  2⤵
  PID:13516
- C:\Windows\System\WdVEJnr.exe
  C:\Windows\System\WdVEJnr.exe
  2⤵
  PID:13960
- C:\Windows\System\mDNryQU.exe
  C:\Windows\System\mDNryQU.exe
  2⤵
  PID:14012
- C:\Windows\System\gpKDPJz.exe
  C:\Windows\System\gpKDPJz.exe
  2⤵
  PID:13220
- C:\Windows\System\zzOotkm.exe
  C:\Windows\System\zzOotkm.exe
  2⤵
  PID:13224
- C:\Windows\System\DLTbQZT.exe
  C:\Windows\System\DLTbQZT.exe
  2⤵
  PID:10140
- C:\Windows\System\eLXdoqj.exe
  C:\Windows\System\eLXdoqj.exe
  2⤵
  PID:11240
- C:\Windows\System\eODqlIV.exe
  C:\Windows\System\eODqlIV.exe
  2⤵
  PID:9772
- C:\Windows\System\yXHjAFg.exe
  C:\Windows\System\yXHjAFg.exe
  2⤵
  PID:12524
- C:\Windows\System\lqwoqQM.exe
  C:\Windows\System\lqwoqQM.exe
  2⤵
  PID:11148
- C:\Windows\System\SzyCuPv.exe
  C:\Windows\System\SzyCuPv.exe
  2⤵
  PID:13428
- C:\Windows\System\VJhMaSE.exe
  C:\Windows\System\VJhMaSE.exe
  2⤵
  PID:13904
- C:\Windows\System\BTDmhbA.exe
  C:\Windows\System\BTDmhbA.exe
  2⤵
  PID:13452
- C:\Windows\System\dlKUFsp.exe
  C:\Windows\System\dlKUFsp.exe
  2⤵
  PID:10220
- C:\Windows\System\vIwJeZd.exe
  C:\Windows\System\vIwJeZd.exe
  2⤵
  PID:4332
- C:\Windows\System\vrRbsCn.exe
  C:\Windows\System\vrRbsCn.exe
  2⤵
  PID:12004
- C:\Windows\System\jIlIiBz.exe
  C:\Windows\System\jIlIiBz.exe
  2⤵
  PID:13808
- C:\Windows\System\Mvbutou.exe
  C:\Windows\System\Mvbutou.exe
  2⤵
  PID:14244
- C:\Windows\System\xARqDax.exe
  C:\Windows\System\xARqDax.exe
  2⤵
  PID:10624
- C:\Windows\System\aUGHpyf.exe
  C:\Windows\System\aUGHpyf.exe
  2⤵
  PID:8848
- C:\Windows\System\epGnfrE.exe
  C:\Windows\System\epGnfrE.exe
  2⤵
  PID:13520
- C:\Windows\System\VFblFcb.exe
  C:\Windows\System\VFblFcb.exe
  2⤵
  PID:14200
- C:\Windows\System\WyzLqHa.exe
  C:\Windows\System\WyzLqHa.exe
  2⤵
  PID:12480
- C:\Windows\System\PGkqBzY.exe
  C:\Windows\System\PGkqBzY.exe
  2⤵
  PID:7940
- C:\Windows\System\BLlOLRX.exe
  C:\Windows\System\BLlOLRX.exe
  2⤵
  PID:5208

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 420 -p 3172 -ip 3172
1⤵
PID:13336

C:\Windows\system32\WerFaultSecure.exe
"C:\Windows\system32\WerFaultSecure.exe" -protectedcrash -p 4540 -i 4540 -h 416 -j 444 -s 184 -d 10360
1⤵
PID:8800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_t3lezm0q.sj0.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AFdyzwL.exe

Filesize
1.8MB

MD5
f878e32bb38cd5e20642d61575cbf186

SHA1
47a378ba5aa4ed2f4f5c62d55d9271093fdcf2f2

SHA256
c9c457ba43b81f3dbe994c2ffc93e98e0b18ce4d938b6b6c61a2e45cc243718c

SHA512
deca3f8c483b39441d6f45abab2c7b8e2a82252be5d9a0e0b518242cb2c1d96f8c493055eb8bf9241bde1eea7446a4aeab0d15c4a209a06baa9ac7b2998b7425

Download Submit
C:\Windows\System\AXSMUHy.exe

Filesize
18B

MD5
22152ecc1df3a96b28053bf455c90507

SHA1
d8bf6eba4d9bed5a98fae18923f65b1588f8e10f

SHA256
c0c034a9c894ca053c6684fc78523c77b7a09b3a91b01db48b68c2cf921966e1

SHA512
409b6155423769334cf3f9aff8477dcab133fc0d80c40beb2174d23bcee6b144df61cf63175ebd37324ea7b3b35780a1df5ee7f9cf384a4564fb3ff119afedb6

Download Submit
C:\Windows\System\AgltKAe.exe

Filesize
1.8MB

MD5
51e76fa977efc453968e7f3d1d02ea59

SHA1
7be7b5d24fded7b2049c6b9c7e0cce3744c489cb

SHA256
a3e52e1c37d000de6a022d79a608e7d24ddeb4d80cc7580d5ae1ccc7e2642b73

SHA512
33c0448256f3f7d453097a1a6dc229fa317d79ddde17d18328b8cfb8cdf246dcc899e2aff0743cb9313254523d65321a62f26bf34c2f768e38cb13c6ce41ea2a

Download Submit
C:\Windows\System\BscaWtg.exe

Filesize
1.8MB

MD5
66cde62497e2aee4393bea589d3fe9b6

SHA1
199c96d72257f7625cb025a2cde5ecdc2320caf8

SHA256
e08493d31c958704b0c38bec804baf09f59cce252e139797d17e54bf1971d0b4

SHA512
2db649c1ad477d15b9eeae8b6f14bb976403006973bfd578302978c695c4b65217e94227857a3dda85d18d92208f51f5bc57a774b05d7799963f97ed08fd6be8

Download Submit
C:\Windows\System\CwXEbuE.exe

Filesize
8B

MD5
1855a32bc20d82a1da2b5edf8967f4e6

SHA1
25928e56f89ec28b56047592b93000c1d36e2a23

SHA256
197265335822dae03e837ac88a16d32bf68b201da4bc921af00edba259c1267c

SHA512
6ba43273aa11ef21001bd21641b2cb12d306e904aaff29ff56a8c7b3eadaaec0f04afabf47cd7eb2a1a7b9c79f098b4d11d9a442d2048486e96355d7914a5e67

Download Submit
C:\Windows\System\DMHIfHR.exe

Filesize
1.8MB

MD5
bd1908b782c81e1f491bbaf780923405

SHA1
bd44a136217a4e2752a8f704f5898bf016d268aa

SHA256
683c28cff218d74d091f6f6bc5889b6fb20ce958b42877aeed9e0efdddd277b8

SHA512
7cac47cb2115229eaef7546bd9d824cdb29a06f1d69ee832779e1a0368dc89fee63fc429f0fa3976191b4db8443d4b288e490fc0e13d51b25dd80f627ff63ba8

Download Submit
C:\Windows\System\EyyBvfm.exe

Filesize
1.8MB

MD5
74fc8f2724cfcdd7a893253d7705e5da

SHA1
48b96f8c25e50698e300930153e1eaa13d7e8c99

SHA256
b5711c8f420b282db7c355bbfa0794fded219f2cfebe2249907d308d17f4b4ef

SHA512
099ec2f87dc2e68d9def0c688278f3c4edbbfc41c180a60e602e78f8f7b2d23604c596538ffb803aba97df1b338ef876c471fed848a70694dbd5c748ac63975e

Download Submit
C:\Windows\System\FGCGdqo.exe

Filesize
1.8MB

MD5
249ce30825364b151552478a40920ab2

SHA1
7c7134648fe6925813dc95d3b03f96a613c5fe96

SHA256
cd77ce9ceae4c6d3528f5a91a174b9be8d3501024a87fd623e7ab6dcfb7cecd1

SHA512
c4cf715d5a971a47907f8825b0b0b897d1671d4afed0b401aead8527ca6c8272a676cb9204f951b352b799e42758f5c2075358f5afa0979c9b20ea1a781eddb8

Download Submit
C:\Windows\System\FLrmZfI.exe

Filesize
1.8MB

MD5
6e558b00b03a557d770bc43d0705714f

SHA1
e4de6e3d97dcce679587f9d0d804dd56a10bd903

SHA256
c2f00401af835048fbdbdeafc56d2f1f29d1ebd1b56e2a946aa64f6cd25a5dc5

SHA512
cc7e0feb4bbe47c0cdd5e61ffef22951f5aed6a3d0a1665d3dfc0b8a62cf45f5d477bded3263032af530320dace58c4fa3c812c4e11018ebebdf9fd028cd0ddb

Download Submit
C:\Windows\System\HGdIhJe.exe

Filesize
1.8MB

MD5
ca29b07b78e54b999d976f2ba95d013e

SHA1
f0ad0d03e421198c1807f614e053f65238772984

SHA256
7c5385cc673c90c41c553a1504eb3b998a69ca131a9e52e1a3175108a89e263f

SHA512
9199925c4baf4ca9f720b81247dd22de87bc17a635a76214c89473fa0a705b892777777827b3fa25b84c2a6d4532b96f00b13941b29b9424f72a28bbe69b05ac

Download Submit
C:\Windows\System\IEBcLyM.exe

Filesize
1.8MB

MD5
7f890ddf34c362e26634504e407e211a

SHA1
ce07cedf935db9ef6458577e86d968818531c7d1

SHA256
92181c88234f4e2ee41e5fa410aacc732441036d84a9032c3ad5f96d36807844

SHA512
85c30595a6bc02b1fbf626322f99372e6a75438f6a22041b81b8a79309650d8e8bc27297983c82269f6d256eed1cb90911118b4aec6fd4d46ccdea628d32ddeb

Download Submit
C:\Windows\System\IEtpamx.exe

Filesize
1.8MB

MD5
68366349e3a7f81b9e16bc4414aab31a

SHA1
23c8a4b02a0ad8601f3d940b5b217d010797778c

SHA256
d2a5595e2bffed466c153315ba1c04c63b5a81e0e1a3bd31e56f60099cf1f8ac

SHA512
f3c657ca9aeeca7587c8b44c7248d1f8a5ca124793b92a02f7ee71e0eb0353409c40c64d4dd2ae00e3abe77870d9341adc6c20502debd7488f014c58a544fbf5

Download Submit
C:\Windows\System\KUQaEoi.exe

Filesize
1.8MB

MD5
5664ff46543e48ee4aac5a95698580b4

SHA1
48dd92bceb4a84ed46e23d2a305fd1fbfff49191

SHA256
b36d1afdffb587f5448111889b809f61b2bff46b7e43df1f0e865e769003bb85

SHA512
2ea146b55dd576fc33bc3b55d964dedb2384020786b91feb8915faf9c147b4c3a9db360e9efbe38314fdae2ac055502e88ae23c58fe1ecabfd1606af9bb64f64

Download Submit
C:\Windows\System\LRbMGPp.exe

Filesize
1.8MB

MD5
2b399449e5a30c9f30cafa8faeb59676

SHA1
3b3be3979ef421b7c1b094dc5acd8f98a66a3046

SHA256
7e314d3d11de60fa4f7e0682175b179d6a59a77a4df15bf1b48726289bbdf50f

SHA512
6c25feba3657de11ad4a047e0eed2c13d8070377dc91acc6318ed2005cb5d6b1a850e672ea1558bcf9806361e3f59fd9aa266d13b0e54569db05b2bd376e94ff

Download Submit
C:\Windows\System\NIxrqWr.exe

Filesize
1.8MB

MD5
f7ef35da21fb9f0566b8a2c8d1cee6ae

SHA1
2862f3ca607c15ef4ebbea20c9489708d8543e31

SHA256
c1a76ee34369eebf624d7751b9c4811928d1a2b1b3c7a880b46da7f0e3f5b8e9

SHA512
044f1720590b808f9118740a954e41ecaee4d96d411c09e0aecb8b1eb7213bc7bd224667b947feb496722f44274be9c4ed1dbf0444cd8baaa68e401188dd3e3e

Download Submit
C:\Windows\System\OImoULV.exe

Filesize
1.8MB

MD5
c8c793ac068a84a01c5cb88cc3e20ff1

SHA1
451174d86650d730b4538b3febce1f08adb28af2

SHA256
e34109a56c17500aab06312bc61b2bb186d368c37f55f2b29e7504760465d28c

SHA512
605d10687ec7365ed528498adae54f9c3d301591bd8fbc5183e70039067d82d77b929bc3b6053af11cc54392fe11c866bbdbecbe02fe2834aa5d85940cfcd92c

Download Submit
C:\Windows\System\OTfqwQK.exe

Filesize
1.8MB

MD5
2143aa7ce1fe6c4ab631d5272a16c8fd

SHA1
9ac747668352aa7fb4eaa8c98911ade7f29afd34

SHA256
995e60b9c387464787e28ed4a7c66dfa87877f01e1012bc9606d6d0a114f44db

SHA512
4d50d65b31c5b5f954eaef2ad42722d3fc6ca56d390d4736f0f12cdbe7a0788714f03c4e535535af01ab6322bb4ffa90f97edd29240e37570f136302b0b86a4f

Download Submit
C:\Windows\System\PiTjWiV.exe

Filesize
1.8MB

MD5
a32dd2bfd87c594a3c12f8ab2cf9f6f2

SHA1
90de635412c1bddb4f263cffb34698acdf0eed7b

SHA256
347fbf97dd322efe34e181c56133c878f987f5b42708f62976799a207a791971

SHA512
cab80ba7874fa8cd22582adba7c39811d4998c32973a36d20abf621f01189ee42e2220c47993a7540c8634bb96f18a09b4d7bb0c291aad218b7483a9b00e8ed5

Download Submit
C:\Windows\System\QZoFCNz.exe

Filesize
1.8MB

MD5
bc334e5491f370673646f81293394e9d

SHA1
801a181d6b4d25e3e7046839860bf1dd212f3120

SHA256
b3011c97bbc61e76d82194dfa9561c366929f018b9ed42b75da9c9d226c2fea4

SHA512
1fc05ccfa3ad879dd1f2d2b7280fed353ffcca3b6d70e50d8166a0fab559029add4ec00467b3e66a0d8131b77a647098606bb1de3edfe9bdfb9d7a1794c1d840

Download Submit
C:\Windows\System\RvznImz.exe

Filesize
1.8MB

MD5
ed5912b48043a9f3c3848491a3500091

SHA1
d63b4d860c129fb95df98b740c6dfc02ab3999ab

SHA256
2ed5180ce1f45c2bdde8afa10c283fdfc5a5c631bcbc3ec81ddc515524a0de09

SHA512
b7c9ff5753805944330d4b2d8511cfbc2c2dd9977db6582b2592426caa217b89c70397632f5f0ec86f743959347ee1179e4c0e10faf6124c202010fbce8712df

Download Submit
C:\Windows\System\SWksSIL.exe

Filesize
1.8MB

MD5
1a68bf01239665a321878e30aac4d47e

SHA1
7a570c5940e3f2c642349f9d1eb6bbe089fa68cb

SHA256
19d26bb253bcfdff81d1bb9f221c54adde10fc3fa63e0dc94144f5bfb136f9bb

SHA512
0825eb8fc24b835320fdd5064decad41b324f2732051998fb16a3cf08fd6535e94a219623fb6f1d3a3ee8fdd0b182396965f74d5d2d0e2def9561a1e353da9e3

Download Submit
C:\Windows\System\SygECzS.exe

Filesize
1.8MB

MD5
c9dbab835f8aa6033181b4dd5485170f

SHA1
007eaabfd2625f9ebfa59ccd1c8d5c29e7e8f2c4

SHA256
49e376443949cd789c27b4a1c2cd22e7a06a9b49adc1d871ef0ef901574bdbed

SHA512
651cb9b9112ae202fcfdecc25f3a0ed9f8a4948cb555e191d90e46c4681c8387c1ea3646eddbcc61da909de0deda79746707812e8e4be0d8e45eb582982497f6

Download Submit
C:\Windows\System\UyFnEIX.exe

Filesize
1.8MB

MD5
0fd96c46d7a72243108cda8648d0bde1

SHA1
364a1e1860b6ff84be91ad50703d02298b637d41

SHA256
a835862712c02345c83eb42eb73d9e2289c1321dcff24c93b95203c5ebf79a55

SHA512
12eb5f94e429c6258fdffcb8c506b53928d5fa00daad75fb37f85f22be1f75569735643d91be732baad5443a70614401ea18b425e7ff552c2d3c39887aba71ab

Download Submit
C:\Windows\System\XXgurPA.exe

Filesize
1.8MB

MD5
319119bc70f5dae123f5ff04325d3110

SHA1
a39242c1644b506cf2179a65208aab0ce986852e

SHA256
45cf2523754338c4ffc8acaf53d2d0ba24a7ddbdf9e318d79272ac37238d9362

SHA512
c777211f85208666561bfb40bb4216354f20424375a7b18ed6709e2e8c6456a77f75f1617d5c1175b6d21f448d914cd9b48c6189510b98927c7344d0d51bfab2

Download Submit
C:\Windows\System\YZsUpwV.exe

Filesize
1.8MB

MD5
028e8c9560e5c01cd5fb3291047aba26

SHA1
494026946e552eaaf745685ffc23eb5550a5ed8a

SHA256
5516070ab6fa140ff3e45d2c67d3dfd22cd86cf66ceb74fb82771e6cf63dc239

SHA512
20320430312817186648e92d955c1c5370565552de247984bf47c713c5cdff6f5fb9d34f2c7c8f80f4fb6a0931788ba17272c5086078f24a776346ae2110d28d

Download Submit
C:\Windows\System\YygnWLu.exe

Filesize
1.8MB

MD5
42b24334b9bab8d240c7186db7eb5a47

SHA1
f2f9823b37be23f829eb5f622429bbfe83159252

SHA256
a01921dfb80a7a1121aec3356c70acb1ca17b6bc7942885d43068fe66db7addd

SHA512
8c3bf567516ff2b1aaeff67eef1d650b8cdb0814a3a416d2d7fe28a674fc3aabc22392cc1f5959e3bacacba9d9cf28256153905e4369cb8cd3ed7e3116f1c942

Download Submit
C:\Windows\System\ZFiiZEQ.exe

Filesize
1.8MB

MD5
43a8a8e8f294815560f879241d1ccc7d

SHA1
6ec13411699c388111b30544c2ad1f6885c54870

SHA256
2a2e98a2f812dc393bcf2106008a5597fa0a53941281c99132e590d8ffc3e3ab

SHA512
cd347c1379c432e5edb42d4d908b65a982cbec11a6c7f4723d46a1e44740fa00e1edff630bae0bd4326e8f27f2698446ce5745a171700b40b063d62ecc78b06b

Download Submit
C:\Windows\System\ZhlhbmR.exe

Filesize
1.8MB

MD5
6fb2c36fbab24dd1a357ba32c1387446

SHA1
0deb7d81a414a3f70b54350c5f4e172253540ee3

SHA256
15bfb759d3e340e36e62f960b53a6c817fe4016067b91f21c71d8505263f84c4

SHA512
043ab4bed38b6da4c320c1e285b13c99199a8c810c887cd314bfc6b457f9201f1fa6618d41a8eb469887a816ed971ed3e802d9397172354d48814edf42e8b34a

Download Submit
C:\Windows\System\bXKOEia.exe

Filesize
1.8MB

MD5
be61f1125dd96d46d350cff6fcf1c40f

SHA1
538d44cb8147617dd5f08c7e9eb312e830e2c8a5

SHA256
7e3865d46d02e06b65ac4cd97f2e48b3f6573033f286d81116ebee47cafac81d

SHA512
873a6c9c1498ffdf1fb930f378b5f47f38c9d2eb7035bfeca850e7500d664d051bd18c3d4e3d41d5f53d07502d15cdecb4c07e0e4c386b6d37675b3630306cdc

Download Submit
C:\Windows\System\bjDjcwC.exe

Filesize
1.8MB

MD5
2857d35761613341854e0b26738d8f3d

SHA1
07c0b42679b030aa0a23962f08ea8ee2bc4e8b27

SHA256
d54ad3d0bc9fa6d29f1dc64c61d3e6af332365cfc7f2e828b41795ec81872d51

SHA512
582376cc56d89444b70d64f639d4661dcd7018186388297d383b4259af5df5cf71b0c9f1e6c9b9b1d20ccb8178d868e622e187efcb7e082165dcf4fa2534b954

Download Submit
C:\Windows\System\cDbOtFm.exe

Filesize
1.8MB

MD5
e94d82cc5bc9d960ef4869cca4374109

SHA1
db4a000eb773829697808b60a0af6978081c1258

SHA256
a8aa8299c8c78134d1bad75df32e827c184b2d59305edde336299243e6939b5c

SHA512
7a0e59e5e28e56752ae7c9adc6ae9194c856dbd63f93883ceb0754c0baa545562e3a3e2d79928143c4a9fdb2d0162cf80b7aaf8bc42c4d714eefc07959178d8b

Download Submit
C:\Windows\System\emjmTuI.exe

Filesize
1.8MB

MD5
8e15e5f26d979d385bc3499c9e29ea42

SHA1
e40f068a179da9b482a3934e34fc618cd3eb5e40

SHA256
6e6e7325dc4648b911639f1f28f294ecc806a2c1e1bd4f3105c54f5b9d8f8b0a

SHA512
5a259a04cfaa8d959dbef7638656ab58ed1cb4fc87489c9447c6d52e19076de5e64125ce1bcd8576fb0aefb3e0f4a129f650c72b3c1ebc9c5d1d4476ef633a23

Download Submit
C:\Windows\System\fWRQCga.exe

Filesize
1.8MB

MD5
b4af8a61e26e1f2a7052864ba759e592

SHA1
df2a695238c6947a1684b6c031d7543eb8cd9e6c

SHA256
f760b76d52b035734114c69341aa70939c953fb6110f2501dc738d5786706928

SHA512
9de4842598a54cd06c37d100c4f95438e7c68ff5dcd2cf4f1d50da65f1d700334d0916aa2e9546106562dd8d11cac5167c73cea0468c6d9bbfa1fc869520a84a

Download Submit
C:\Windows\System\iJmQEal.exe

Filesize
1.8MB

MD5
3c51352e3836044d42e3c7de32dba30a

SHA1
6531d2adba162cf98474ff29e5397cf5561ed996

SHA256
f42e815cda25ef6a392acc28fb7371d6af2a842d5c980d53346652ab717c126b

SHA512
7b233e09fc823cc5931608869b160512833f9b7cc702f04773f1683043e57a3edc2ea1e93a09d8f283f218dac556724c5aca75867f67c90564998346a1fec32f

Download Submit
C:\Windows\System\jMiIehR.exe

Filesize
1.8MB

MD5
7c02adcd6d75b066adac23dd52af42bf

SHA1
a24b5f94ae4f5e2509985dc82def139a5d0f9d03

SHA256
550087835a0bb39033973aefea70e41899deed1e7547eaf017323e346ce8f439

SHA512
e67d8ce1ad2470e6a107dca7ffad54304647aca39047e39cef43d03690af49eec4b952c8c248a81688c099bcedc228099fda45db2f46798bed68c16ddd35a2d8

Download Submit
C:\Windows\System\lgvKTUg.exe

Filesize
1.8MB

MD5
33a24d041f2383a3ca9ca23b59611576

SHA1
a382922778a29056d3e07435aae2c832771a432d

SHA256
940321da0c063cbcd3a08912ffa493184135132493d08efbeb6d6ff330a7893d

SHA512
82d2ab87f89052347bbab85c963b35a189abff18a5195c1cdc3981d869b31b71da89447ee1aed39148837254b0ffaef2b31e37387b64720234bc31d6bd56e321

Download Submit
C:\Windows\System\lzYLGio.exe

Filesize
1.8MB

MD5
0f40bb6839482606756b6031f6976b34

SHA1
a517e3d8bb2c2d32d4d4a4eabb2c564d4e252940

SHA256
3db7935ac2fc6ddc53171fb9e1cf745307c300ebb8d7e853ba4d9036a31f998d

SHA512
669f8b045666a8776ee886120e8813e5e2e7094284b6ba2bd9473bf0e99efbb491053ab2469e7846ca8d2af9b44b35bf88159c95ed0a85a022bd554c8e2e9589

Download Submit
C:\Windows\System\mkdHoDr.exe

Filesize
1.8MB

MD5
fbc233911ae343bef6079e14c176cdf0

SHA1
e5a739d5a147ac984897762ae030598fb7f8949a

SHA256
081cc0935c4f2884c6c62d4ad1cbdccd1c99cf09783c8fa305be69873a123e8d

SHA512
4f569232bf6ecde11fe9914046ae637385e64609325771e414fd4832a99a0ad8e8b9fea7a2fdc8ece2433a7f2c76510f3461b2251fccab260e91182c4f9c6dd6

Download Submit
C:\Windows\System\nWTzwVC.exe

Filesize
1.8MB

MD5
e28aed634cabd172fc4bc8b9967b10a3

SHA1
57c620d7d0cf26eb20db24a85d4bd8caffa24ec7

SHA256
fc4bb4415dd47c1a7d383ba33725cb3f268d58fddd3dab1af214ecaf79e85435

SHA512
134e2d8331fd3b1184b038a4c33cfeae108c2282f69e1a2c0f7c3717891f47ca6a1151760a6a69c117fa1baec871c798d9dd1641f5d41d8e1e6321baf3729f0d

Download Submit
C:\Windows\System\oXXwJnA.exe

Filesize
1.8MB

MD5
141d5f07613c2aacb3d0957e0e607b3c

SHA1
45ccbd7680c37f50d403b815425092af12b81042

SHA256
39d3e33f726572df4db4bab067788614537c068a830a2e88b34264197789a1cf

SHA512
85608f6df1632ac6ace717aef3766a6beba60abca8db9fec00c48e034ac7824939213fa678998d880b31e3ca00533d3519146f4726ce0575f4bea14da714c423

Download Submit
C:\Windows\System\oXlhvMc.exe

Filesize
1.8MB

MD5
d6228a97d8adcabf992da3186dbb11a1

SHA1
96b2f826595eeeeaffdfcddb2f634014c72e55b9

SHA256
792f2c7827985b047b37f5c3293920da6db93210319e7450451735ffa1e26a72

SHA512
5d7adad90ce15cb723a4cee736e1bb48b79f435b5b1c7c06de912720f647bef41a615cde246af1c5fb803a7d14443aa8ea8ee21a54260314cacca7026abeee6d

Download Submit
C:\Windows\System\prNrGXH.exe

Filesize
1.8MB

MD5
73ed3fbc81a7f495adb43975c4c8df94

SHA1
14c0da2851a32b35422972973d0101f52d282520

SHA256
66c8b2f806cda66aa3faa9889162018b70cbefc7a79b815f0cdfcee98265aa24

SHA512
0366171470d6a8b37abac7024a9c6aeadec047a7b3e2927448209eda275dfca0a1721be38586ff3771ca7f7cf955141eeb67bf8acaf55822e9a1ad8ed7292c60

Download Submit
C:\Windows\System\yjQgTCR.exe

Filesize
1.8MB

MD5
f3ec25ffeae1f09d4a4deeac2c4727bf

SHA1
7d68e25a3a25690212e77543769087bd07fe3e10

SHA256
1b6fb6de44a9362323ad4f5da47f0c96e1c38a3ff9b028de025a8094238a9b84

SHA512
790a9cc1f025cd51e94fffa453f7fab0104138e06cb250771cce70d4919a513a2c75806350f77651fa039dd65843a1df70916851b3f66b145fe41e185ee7f45d

Download Submit
memory/220-333-0x00007FF601FA0000-0x00007FF602392000-memory.dmp

Filesize
3.9MB

Download
memory/540-1074-0x00007FF706B60000-0x00007FF706F52000-memory.dmp

Filesize
3.9MB

Download
memory/540-5532-0x00007FF706B60000-0x00007FF706F52000-memory.dmp

Filesize
3.9MB

Download
memory/628-205-0x00007FF66F750000-0x00007FF66FB42000-memory.dmp

Filesize
3.9MB

Download
memory/628-5429-0x00007FF66F750000-0x00007FF66FB42000-memory.dmp

Filesize
3.9MB

Download
memory/672-1-0x000001EB10840000-0x000001EB10850000-memory.dmp

Filesize
64KB

Download
memory/672-5739-0x00007FF7E7960000-0x00007FF7E7D52000-memory.dmp

Filesize
3.9MB

Download
memory/672-0-0x00007FF7E7960000-0x00007FF7E7D52000-memory.dmp

Filesize
3.9MB

Download
memory/732-1526-0x00007FF692F30000-0x00007FF693322000-memory.dmp

Filesize
3.9MB

Download
memory/732-5289-0x00007FF692F30000-0x00007FF693322000-memory.dmp

Filesize
3.9MB

Download
memory/1124-5479-0x00007FF67DED0000-0x00007FF67E2C2000-memory.dmp

Filesize
3.9MB

Download
memory/1124-1077-0x00007FF67DED0000-0x00007FF67E2C2000-memory.dmp

Filesize
3.9MB

Download
memory/1180-753-0x0000025820540000-0x0000025820562000-memory.dmp

Filesize
136KB

Download
memory/1196-5465-0x00007FF6365D0000-0x00007FF6369C2000-memory.dmp

Filesize
3.9MB

Download
memory/1196-426-0x00007FF6365D0000-0x00007FF6369C2000-memory.dmp

Filesize
3.9MB

Download
memory/1620-5460-0x00007FF6BA9F0000-0x00007FF6BADE2000-memory.dmp

Filesize
3.9MB

Download
memory/1712-5444-0x00007FF662DA0000-0x00007FF663192000-memory.dmp

Filesize
3.9MB

Download
memory/1712-660-0x00007FF662DA0000-0x00007FF663192000-memory.dmp

Filesize
3.9MB

Download
memory/1860-1251-0x00007FF658890000-0x00007FF658C82000-memory.dmp

Filesize
3.9MB

Download
memory/1860-5486-0x00007FF658890000-0x00007FF658C82000-memory.dmp

Filesize
3.9MB

Download
memory/2196-655-0x00007FF71DC10000-0x00007FF71E002000-memory.dmp

Filesize
3.9MB

Download
memory/2196-5452-0x00007FF71DC10000-0x00007FF71E002000-memory.dmp

Filesize
3.9MB

Download
memory/2312-878-0x00007FF733C00000-0x00007FF733FF2000-memory.dmp

Filesize
3.9MB

Download
memory/2312-5468-0x00007FF733C00000-0x00007FF733FF2000-memory.dmp

Filesize
3.9MB

Download
memory/2592-62-0x00007FF76F2C0000-0x00007FF76F6B2000-memory.dmp

Filesize
3.9MB

Download
memory/2592-5434-0x00007FF76F2C0000-0x00007FF76F6B2000-memory.dmp

Filesize
3.9MB

Download
memory/3432-1485-0x00007FF707390000-0x00007FF707782000-memory.dmp

Filesize
3.9MB

Download
memory/3432-5488-0x00007FF707390000-0x00007FF707782000-memory.dmp

Filesize
3.9MB

Download
memory/3492-508-0x00007FF757320000-0x00007FF757712000-memory.dmp

Filesize
3.9MB

Download
memory/3492-5473-0x00007FF757320000-0x00007FF757712000-memory.dmp

Filesize
3.9MB

Download
memory/3688-5449-0x00007FF6A9FC0000-0x00007FF6AA3B2000-memory.dmp

Filesize
3.9MB

Download
memory/3688-147-0x00007FF6A9FC0000-0x00007FF6AA3B2000-memory.dmp

Filesize
3.9MB

Download
memory/4368-5484-0x00007FF7D9E20000-0x00007FF7DA212000-memory.dmp

Filesize
3.9MB

Download
memory/4368-1349-0x00007FF7D9E20000-0x00007FF7DA212000-memory.dmp

Filesize
3.9MB

Download
memory/4428-5296-0x00007FF620560000-0x00007FF620952000-memory.dmp

Filesize
3.9MB

Download
memory/4428-53-0x00007FF620560000-0x00007FF620952000-memory.dmp

Filesize
3.9MB

Download
memory/4484-22-0x00007FF743A70000-0x00007FF743E62000-memory.dmp

Filesize
3.9MB

Download
memory/4568-5442-0x00007FF79F770000-0x00007FF79FB62000-memory.dmp

Filesize
3.9MB

Download
memory/4568-102-0x00007FF79F770000-0x00007FF79FB62000-memory.dmp

Filesize
3.9MB

Download
memory/4920-5440-0x00007FF65FDA0000-0x00007FF660192000-memory.dmp

Filesize
3.9MB

Download
memory/4920-1488-0x00007FF65FDA0000-0x00007FF660192000-memory.dmp

Filesize
3.9MB

Download
memory/4936-5461-0x00007FF695EC0000-0x00007FF6962B2000-memory.dmp

Filesize
3.9MB

Download
memory/4936-733-0x00007FF695EC0000-0x00007FF6962B2000-memory.dmp

Filesize
3.9MB

Download
memory/4980-5431-0x00007FF600290000-0x00007FF600682000-memory.dmp

Filesize
3.9MB

Download
memory/4980-248-0x00007FF600290000-0x00007FF600682000-memory.dmp

Filesize
3.9MB

Download