xmrig | efa962a3b355657bd615fb9300aa5360071aad53e85796d9387d4f358873118d

Analysis

max time kernel
150s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
26-04-2024 12:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
Size

2.0MB
MD5

00ba87785479fb980cff6c071decd6a8
SHA1

53d18acc1324a2aee68983c6499f659f64f85faa
SHA256

efa962a3b355657bd615fb9300aa5360071aad53e85796d9387d4f358873118d
SHA512

41f93cb52250e283c3a81013ad000debf5f3cffd3ef18559a7fb0842a4983ae50b04f14663bfa9d790ca6110c60f904b4b09626725e582df2e9e15f62d4b24a9
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U6:NABV

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 40 IoCs

miner

resource	yara_rule
behavioral2/memory/4548-183-0x00007FF794520000-0x00007FF794912000-memory.dmp	xmrig
behavioral2/memory/60-146-0x00007FF7936D0000-0x00007FF793AC2000-memory.dmp	xmrig
behavioral2/memory/1400-106-0x00007FF7949A0000-0x00007FF794D92000-memory.dmp	xmrig
behavioral2/memory/1228-111-0x00007FF7060D0000-0x00007FF7064C2000-memory.dmp	xmrig
behavioral2/memory/2260-69-0x00007FF642860000-0x00007FF642C52000-memory.dmp	xmrig
behavioral2/memory/2744-200-0x00007FF7B2A40000-0x00007FF7B2E32000-memory.dmp	xmrig
behavioral2/memory/1408-237-0x00007FF611F50000-0x00007FF612342000-memory.dmp	xmrig
behavioral2/memory/2720-254-0x00007FF7F6AE0000-0x00007FF7F6ED2000-memory.dmp	xmrig
behavioral2/memory/828-255-0x00007FF6A0920000-0x00007FF6A0D12000-memory.dmp	xmrig
behavioral2/memory/968-256-0x00007FF60A7D0000-0x00007FF60ABC2000-memory.dmp	xmrig
behavioral2/memory/4440-257-0x00007FF7E8530000-0x00007FF7E8922000-memory.dmp	xmrig
behavioral2/memory/3424-258-0x00007FF6C6610000-0x00007FF6C6A02000-memory.dmp	xmrig
behavioral2/memory/4768-259-0x00007FF7A7800000-0x00007FF7A7BF2000-memory.dmp	xmrig
behavioral2/memory/4444-393-0x00007FF70BE30000-0x00007FF70C222000-memory.dmp	xmrig
behavioral2/memory/4816-1015-0x00007FF6B31C0000-0x00007FF6B35B2000-memory.dmp	xmrig
behavioral2/memory/2244-1012-0x00007FF6F3C60000-0x00007FF6F4052000-memory.dmp	xmrig
behavioral2/memory/2276-921-0x00007FF675B40000-0x00007FF675F32000-memory.dmp	xmrig
behavioral2/memory/3544-919-0x00007FF66BD00000-0x00007FF66C0F2000-memory.dmp	xmrig
behavioral2/memory/3256-480-0x00007FF7DF2F0000-0x00007FF7DF6E2000-memory.dmp	xmrig
behavioral2/memory/772-357-0x00007FF768200000-0x00007FF7685F2000-memory.dmp	xmrig
behavioral2/memory/4640-323-0x00007FF77B000000-0x00007FF77B3F2000-memory.dmp	xmrig
behavioral2/memory/2244-4875-0x00007FF6F3C60000-0x00007FF6F4052000-memory.dmp	xmrig
behavioral2/memory/1228-4877-0x00007FF7060D0000-0x00007FF7064C2000-memory.dmp	xmrig
behavioral2/memory/4548-4882-0x00007FF794520000-0x00007FF794912000-memory.dmp	xmrig
behavioral2/memory/1408-4905-0x00007FF611F50000-0x00007FF612342000-memory.dmp	xmrig
behavioral2/memory/2720-4916-0x00007FF7F6AE0000-0x00007FF7F6ED2000-memory.dmp	xmrig
behavioral2/memory/4440-4908-0x00007FF7E8530000-0x00007FF7E8922000-memory.dmp	xmrig
behavioral2/memory/2744-4897-0x00007FF7B2A40000-0x00007FF7B2E32000-memory.dmp	xmrig
behavioral2/memory/60-4885-0x00007FF7936D0000-0x00007FF793AC2000-memory.dmp	xmrig
behavioral2/memory/4640-5079-0x00007FF77B000000-0x00007FF77B3F2000-memory.dmp	xmrig
behavioral2/memory/4444-5072-0x00007FF70BE30000-0x00007FF70C222000-memory.dmp	xmrig
behavioral2/memory/828-5075-0x00007FF6A0920000-0x00007FF6A0D12000-memory.dmp	xmrig
behavioral2/memory/3544-5008-0x00007FF66BD00000-0x00007FF66C0F2000-memory.dmp	xmrig
behavioral2/memory/772-4951-0x00007FF768200000-0x00007FF7685F2000-memory.dmp	xmrig
behavioral2/memory/968-4947-0x00007FF60A7D0000-0x00007FF60ABC2000-memory.dmp	xmrig
behavioral2/memory/3256-4957-0x00007FF7DF2F0000-0x00007FF7DF6E2000-memory.dmp	xmrig
behavioral2/memory/3424-4934-0x00007FF6C6610000-0x00007FF6C6A02000-memory.dmp	xmrig
behavioral2/memory/4816-4929-0x00007FF6B31C0000-0x00007FF6B35B2000-memory.dmp	xmrig
behavioral2/memory/4768-4911-0x00007FF7A7800000-0x00007FF7A7BF2000-memory.dmp	xmrig
behavioral2/memory/2504-6024-0x00007FF7A05E0000-0x00007FF7A09D2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2260	pxSKPzT.exe
2276	DjeHhgx.exe
1400	NIjXWpC.exe
1228	FxwFtwe.exe
60	fgmGXVe.exe
4548	TXtXSmz.exe
2744	KRCjsDD.exe
1408	jdCFhnR.exe
2244	BDXhnON.exe
2720	HjMNIwN.exe
828	TZdthAS.exe
968	hRmETvu.exe
4440	jDoUxEn.exe
4816	eHOFFaB.exe
3424	WIkchYS.exe
4768	idQPpaq.exe
4640	oXFAoak.exe
772	VVMcNAc.exe
4444	FZZWVOi.exe
3256	eafQYaQ.exe
3544	CqThQZj.exe
2760	pPdFGID.exe
4108	qDDlvRF.exe
4936	ApqgiwN.exe
4216	PReOMbE.exe
2200	ElbkluL.exe
2976	zwmmdIo.exe
1988	NpMVAmo.exe
1596	hNThDQl.exe
3872	uCeexpe.exe
1956	BYSStGQ.exe
636	wnutenw.exe
1820	JesAGBr.exe
1512	yUNgiHm.exe
4124	KgONQkV.exe
840	vWBXFjQ.exe
3712	UBEUupQ.exe
1412	HcTwvpm.exe
3112	wnPpCpe.exe
4892	KiSxluw.exe
1976	PcdNqSR.exe
2992	vBPWDvs.exe
1752	XjvheaX.exe
428	pjyNrDM.exe
2088	SgHRQGc.exe
2884	CqolFWh.exe
2216	NOeHciL.exe
2664	JlPvojw.exe
4804	qyLoviG.exe
4740	hKqVNwE.exe
2556	ZPCZSRJ.exe
2272	bhcEwHm.exe
808	mbrcSmW.exe
1680	fMqNJdi.exe
4844	tFVMnSP.exe
2628	SWZTqEa.exe
1356	dGDclxg.exe
1920	friegPR.exe
2068	PEVVaxI.exe
4320	uyxmuaj.exe
4456	OXXOiMW.exe
4596	WnDqXgj.exe
3252	NAndpvk.exe
1452	OKWuLQA.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2504-0-0x00007FF7A05E0000-0x00007FF7A09D2000-memory.dmp	upx
behavioral2/files/0x000c000000023b58-5.dat	upx
behavioral2/files/0x000a000000023bb9-7.dat	upx
behavioral2/files/0x000b000000023bb8-22.dat	upx
behavioral2/files/0x000a000000023bc7-86.dat	upx
behavioral2/files/0x0031000000023bbe-82.dat	upx
behavioral2/files/0x000a000000023bce-126.dat	upx
behavioral2/files/0x000a000000023bd7-150.dat	upx
behavioral2/files/0x000a000000023bdc-189.dat	upx
behavioral2/files/0x000a000000023bd2-176.dat	upx
behavioral2/files/0x000a000000023bdb-175.dat	upx
behavioral2/files/0x000a000000023bcb-173.dat	upx
behavioral2/files/0x000a000000023bda-172.dat	upx
behavioral2/files/0x000a000000023bc9-169.dat	upx
behavioral2/files/0x000a000000023bd0-167.dat	upx
behavioral2/files/0x000a000000023bc3-164.dat	upx
behavioral2/files/0x000a000000023bd9-160.dat	upx
behavioral2/files/0x000a000000023bc8-156.dat	upx
behavioral2/files/0x000a000000023bcf-154.dat	upx
behavioral2/files/0x000a000000023bd8-153.dat	upx
behavioral2/files/0x000a000000023bcd-151.dat	upx
behavioral2/files/0x000a000000023bd6-149.dat	upx
behavioral2/files/0x000a000000023bd5-148.dat	upx
behavioral2/files/0x000a000000023bd4-147.dat	upx
behavioral2/files/0x000a000000023bcc-185.dat	upx
behavioral2/memory/4548-183-0x00007FF794520000-0x00007FF794912000-memory.dmp	upx
behavioral2/memory/60-146-0x00007FF7936D0000-0x00007FF793AC2000-memory.dmp	upx
behavioral2/files/0x000a000000023bd1-141.dat	upx
behavioral2/files/0x000a000000023bca-140.dat	upx
behavioral2/files/0x000a000000023bbf-135.dat	upx
behavioral2/files/0x000a000000023bc2-133.dat	upx
behavioral2/files/0x000a000000023bc6-118.dat	upx
behavioral2/files/0x000a000000023bc5-115.dat	upx
behavioral2/files/0x000a000000023bd3-144.dat	upx
behavioral2/memory/1400-106-0x00007FF7949A0000-0x00007FF794D92000-memory.dmp	upx
behavioral2/files/0x000a000000023bc1-98.dat	upx
behavioral2/files/0x000a000000023bbb-79.dat	upx
behavioral2/memory/1228-111-0x00007FF7060D0000-0x00007FF7064C2000-memory.dmp	upx
behavioral2/files/0x000a000000023bc4-74.dat	upx
behavioral2/memory/2260-69-0x00007FF642860000-0x00007FF642C52000-memory.dmp	upx
behavioral2/files/0x0031000000023bbd-54.dat	upx
behavioral2/files/0x000a000000023bba-52.dat	upx
behavioral2/files/0x000a000000023bc0-45.dat	upx
behavioral2/files/0x0031000000023bbc-63.dat	upx
behavioral2/memory/2744-200-0x00007FF7B2A40000-0x00007FF7B2E32000-memory.dmp	upx
behavioral2/memory/1408-237-0x00007FF611F50000-0x00007FF612342000-memory.dmp	upx
behavioral2/memory/2720-254-0x00007FF7F6AE0000-0x00007FF7F6ED2000-memory.dmp	upx
behavioral2/memory/828-255-0x00007FF6A0920000-0x00007FF6A0D12000-memory.dmp	upx
behavioral2/memory/968-256-0x00007FF60A7D0000-0x00007FF60ABC2000-memory.dmp	upx
behavioral2/memory/4440-257-0x00007FF7E8530000-0x00007FF7E8922000-memory.dmp	upx
behavioral2/memory/3424-258-0x00007FF6C6610000-0x00007FF6C6A02000-memory.dmp	upx
behavioral2/memory/4768-259-0x00007FF7A7800000-0x00007FF7A7BF2000-memory.dmp	upx
behavioral2/memory/4444-393-0x00007FF70BE30000-0x00007FF70C222000-memory.dmp	upx
behavioral2/memory/4816-1015-0x00007FF6B31C0000-0x00007FF6B35B2000-memory.dmp	upx
behavioral2/memory/2244-1012-0x00007FF6F3C60000-0x00007FF6F4052000-memory.dmp	upx
behavioral2/memory/2276-921-0x00007FF675B40000-0x00007FF675F32000-memory.dmp	upx
behavioral2/memory/3544-919-0x00007FF66BD00000-0x00007FF66C0F2000-memory.dmp	upx
behavioral2/memory/3256-480-0x00007FF7DF2F0000-0x00007FF7DF6E2000-memory.dmp	upx
behavioral2/memory/772-357-0x00007FF768200000-0x00007FF7685F2000-memory.dmp	upx
behavioral2/memory/4640-323-0x00007FF77B000000-0x00007FF77B3F2000-memory.dmp	upx
behavioral2/memory/2244-4875-0x00007FF6F3C60000-0x00007FF6F4052000-memory.dmp	upx
behavioral2/memory/1228-4877-0x00007FF7060D0000-0x00007FF7064C2000-memory.dmp	upx
behavioral2/memory/4548-4882-0x00007FF794520000-0x00007FF794912000-memory.dmp	upx
behavioral2/memory/1408-4905-0x00007FF611F50000-0x00007FF612342000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\bjbYUXQ.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\ASyFWGA.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\UzAgSwm.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\gxeLCet.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\PYVgQwx.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\XkNWbRZ.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\hkduUvQ.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\BzKzOTw.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\gMsdtxa.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\nidzfwq.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\EfmqkLK.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\GaEJEwF.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\uwaCvFu.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\qNKYvAs.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\aHfqbaL.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\MYzAdrF.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\GhJoqLv.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\jhHNlLx.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\tXlNmnP.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\ZTSzbYl.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\DxzeGJU.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\yfmdtjQ.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\iEMMNOw.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\jeEFHwV.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\yoziKJE.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\tqfTtyF.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\qydzSoJ.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\CVJqsEc.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\TTFQEdC.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\Xovplki.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\qWVgeTr.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\YRMuajS.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\FoXwjkY.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\HbunjIs.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\IztcMSb.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\uVDeUNV.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\GRAcFvi.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\mvrnNVE.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\cxDlsIm.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\OfFIezO.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\HcEmKov.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\IXdZYcK.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\SpMXEzI.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\mlCaTzX.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\WFRnSLm.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\UBEUupQ.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\KLRnTJR.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\PrACKIP.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\jfpCkBU.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\HLmYzKp.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\BLjYtTt.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\BPRCuXI.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\TuEeFtq.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\GCtwRKI.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\tZHKZrS.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\uQGmCjX.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\XpKTfti.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\BoeRqsi.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\fySgSuc.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\EObnoCw.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\sHfnIHA.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\WjAhcDl.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\uGYZpYt.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
File created	C:\Windows\System\OKEcIZm.exe	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2484	powershell.exe
2484	powershell.exe
2484	powershell.exe
2484	powershell.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
5680	Process not Found
11232	Process not Found
12088	Process not Found
7212	Process not Found
1388	Process not Found
7092	Process not Found
5720	Process not Found
8132	Process not Found
2160	Process not Found
6120	Process not Found
7176	Process not Found
6872	Process not Found
7224	Process not Found
6764	Process not Found
7396	Process not Found
7464	Process not Found
8488	Process not Found
6484	Process not Found
6932	Process not Found
8228	Process not Found
8252	Process not Found
2692	Process not Found
6788	Process not Found
6508	Process not Found
7696	Process not Found
7980	Process not Found
5448	Process not Found
8744	Process not Found
9592	Process not Found
9244	Process not Found
8876	Process not Found
9268	Process not Found
11084	Process not Found
10544	Process not Found
9280	Process not Found
10116	Process not Found
11520	Process not Found
10148	Process not Found
12304	Process not Found
10496	Process not Found
4592	Process not Found
7516	Process not Found
11412	Process not Found
11540	Process not Found
10584	Process not Found
10868	Process not Found
10356	Process not Found
11324	Process not Found
11004	Process not Found
10648	Process not Found
7504	Process not Found
11716	Process not Found
9332	Process not Found
12908	Process not Found
12036	Process not Found
9032	Process not Found
2680	Process not Found
12764	Process not Found
14208	Process not Found
14196	Process not Found
12252	Process not Found
14328	Process not Found
544	Process not Found
14176	Process not Found

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
Token: SeDebugPrivilege	2484	powershell.exe
Token: SeLockMemoryPrivilege	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	3808	dwm.exe
Token: SeChangeNotifyPrivilege	3808	dwm.exe
Token: 33	3808	dwm.exe
Token: SeIncBasePriorityPrivilege	3808	dwm.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
13416	sihost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2484	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	83
PID 2504 wrote to memory of 2484	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	83
PID 2504 wrote to memory of 2260	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	84
PID 2504 wrote to memory of 2260	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	84
PID 2504 wrote to memory of 2276	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	85
PID 2504 wrote to memory of 2276	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	85
PID 2504 wrote to memory of 1400	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	86
PID 2504 wrote to memory of 1400	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	86
PID 2504 wrote to memory of 1228	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	87
PID 2504 wrote to memory of 1228	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	87
PID 2504 wrote to memory of 2744	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	88
PID 2504 wrote to memory of 2744	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	88
PID 2504 wrote to memory of 60	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	89
PID 2504 wrote to memory of 60	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	89
PID 2504 wrote to memory of 4548	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	90
PID 2504 wrote to memory of 4548	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	90
PID 2504 wrote to memory of 1408	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	91
PID 2504 wrote to memory of 1408	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	91
PID 2504 wrote to memory of 968	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	92
PID 2504 wrote to memory of 968	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	92
PID 2504 wrote to memory of 2244	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	93
PID 2504 wrote to memory of 2244	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	93
PID 2504 wrote to memory of 2720	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	94
PID 2504 wrote to memory of 2720	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	94
PID 2504 wrote to memory of 772	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	95
PID 2504 wrote to memory of 772	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	95
PID 2504 wrote to memory of 828	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	96
PID 2504 wrote to memory of 828	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	96
PID 2504 wrote to memory of 4440	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	97
PID 2504 wrote to memory of 4440	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	97
PID 2504 wrote to memory of 4816	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	98
PID 2504 wrote to memory of 4816	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	98
PID 2504 wrote to memory of 3424	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	99
PID 2504 wrote to memory of 3424	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	99
PID 2504 wrote to memory of 4768	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	100
PID 2504 wrote to memory of 4768	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	100
PID 2504 wrote to memory of 4640	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	101
PID 2504 wrote to memory of 4640	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	101
PID 2504 wrote to memory of 4444	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	102
PID 2504 wrote to memory of 4444	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	102
PID 2504 wrote to memory of 3256	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	103
PID 2504 wrote to memory of 3256	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	103
PID 2504 wrote to memory of 3544	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	104
PID 2504 wrote to memory of 3544	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	104
PID 2504 wrote to memory of 2760	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	105
PID 2504 wrote to memory of 2760	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	105
PID 2504 wrote to memory of 4108	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	106
PID 2504 wrote to memory of 4108	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	106
PID 2504 wrote to memory of 4936	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	107
PID 2504 wrote to memory of 4936	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	107
PID 2504 wrote to memory of 4216	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	108
PID 2504 wrote to memory of 4216	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	108
PID 2504 wrote to memory of 4124	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	109
PID 2504 wrote to memory of 4124	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	109
PID 2504 wrote to memory of 2200	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	110
PID 2504 wrote to memory of 2200	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	110
PID 2504 wrote to memory of 2976	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	111
PID 2504 wrote to memory of 2976	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	111
PID 2504 wrote to memory of 1988	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	112
PID 2504 wrote to memory of 1988	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	112
PID 2504 wrote to memory of 1596	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	113
PID 2504 wrote to memory of 1596	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	113
PID 2504 wrote to memory of 3872	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	114
PID 2504 wrote to memory of 3872	2504	00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe	114

C:\Users\Admin\AppData\Local\Temp\00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\00ba87785479fb980cff6c071decd6a8_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2484
- C:\Windows\System\pxSKPzT.exe
  C:\Windows\System\pxSKPzT.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\DjeHhgx.exe
  C:\Windows\System\DjeHhgx.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\NIjXWpC.exe
  C:\Windows\System\NIjXWpC.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\FxwFtwe.exe
  C:\Windows\System\FxwFtwe.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\KRCjsDD.exe
  C:\Windows\System\KRCjsDD.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\fgmGXVe.exe
  C:\Windows\System\fgmGXVe.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\TXtXSmz.exe
  C:\Windows\System\TXtXSmz.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\jdCFhnR.exe
  C:\Windows\System\jdCFhnR.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\hRmETvu.exe
  C:\Windows\System\hRmETvu.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\BDXhnON.exe
  C:\Windows\System\BDXhnON.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\HjMNIwN.exe
  C:\Windows\System\HjMNIwN.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\VVMcNAc.exe
  C:\Windows\System\VVMcNAc.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\TZdthAS.exe
  C:\Windows\System\TZdthAS.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\jDoUxEn.exe
  C:\Windows\System\jDoUxEn.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\eHOFFaB.exe
  C:\Windows\System\eHOFFaB.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\WIkchYS.exe
  C:\Windows\System\WIkchYS.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System\idQPpaq.exe
  C:\Windows\System\idQPpaq.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\oXFAoak.exe
  C:\Windows\System\oXFAoak.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\FZZWVOi.exe
  C:\Windows\System\FZZWVOi.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\eafQYaQ.exe
  C:\Windows\System\eafQYaQ.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\CqThQZj.exe
  C:\Windows\System\CqThQZj.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\pPdFGID.exe
  C:\Windows\System\pPdFGID.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\qDDlvRF.exe
  C:\Windows\System\qDDlvRF.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\ApqgiwN.exe
  C:\Windows\System\ApqgiwN.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\PReOMbE.exe
  C:\Windows\System\PReOMbE.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System\KgONQkV.exe
  C:\Windows\System\KgONQkV.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\ElbkluL.exe
  C:\Windows\System\ElbkluL.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\zwmmdIo.exe
  C:\Windows\System\zwmmdIo.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\NpMVAmo.exe
  C:\Windows\System\NpMVAmo.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\hNThDQl.exe
  C:\Windows\System\hNThDQl.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\uCeexpe.exe
  C:\Windows\System\uCeexpe.exe
  2⤵
  - Executes dropped EXE
  PID:3872
- C:\Windows\System\BYSStGQ.exe
  C:\Windows\System\BYSStGQ.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\wnutenw.exe
  C:\Windows\System\wnutenw.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\JesAGBr.exe
  C:\Windows\System\JesAGBr.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\yUNgiHm.exe
  C:\Windows\System\yUNgiHm.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\vWBXFjQ.exe
  C:\Windows\System\vWBXFjQ.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\UBEUupQ.exe
  C:\Windows\System\UBEUupQ.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\HcTwvpm.exe
  C:\Windows\System\HcTwvpm.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\wnPpCpe.exe
  C:\Windows\System\wnPpCpe.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\KiSxluw.exe
  C:\Windows\System\KiSxluw.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\PcdNqSR.exe
  C:\Windows\System\PcdNqSR.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\vBPWDvs.exe
  C:\Windows\System\vBPWDvs.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\XjvheaX.exe
  C:\Windows\System\XjvheaX.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\pjyNrDM.exe
  C:\Windows\System\pjyNrDM.exe
  2⤵
  - Executes dropped EXE
  PID:428
- C:\Windows\System\SgHRQGc.exe
  C:\Windows\System\SgHRQGc.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\CqolFWh.exe
  C:\Windows\System\CqolFWh.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\NOeHciL.exe
  C:\Windows\System\NOeHciL.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\JlPvojw.exe
  C:\Windows\System\JlPvojw.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\qyLoviG.exe
  C:\Windows\System\qyLoviG.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\hKqVNwE.exe
  C:\Windows\System\hKqVNwE.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\ZPCZSRJ.exe
  C:\Windows\System\ZPCZSRJ.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\bhcEwHm.exe
  C:\Windows\System\bhcEwHm.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\mbrcSmW.exe
  C:\Windows\System\mbrcSmW.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\fMqNJdi.exe
  C:\Windows\System\fMqNJdi.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\tFVMnSP.exe
  C:\Windows\System\tFVMnSP.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\SWZTqEa.exe
  C:\Windows\System\SWZTqEa.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\NAndpvk.exe
  C:\Windows\System\NAndpvk.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\System\xreHvyE.exe
  C:\Windows\System\xreHvyE.exe
  2⤵
  PID:3116
- C:\Windows\System\dGDclxg.exe
  C:\Windows\System\dGDclxg.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\friegPR.exe
  C:\Windows\System\friegPR.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\PEVVaxI.exe
  C:\Windows\System\PEVVaxI.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\OXXOiMW.exe
  C:\Windows\System\OXXOiMW.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\uyxmuaj.exe
  C:\Windows\System\uyxmuaj.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\WnDqXgj.exe
  C:\Windows\System\WnDqXgj.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\OKWuLQA.exe
  C:\Windows\System\OKWuLQA.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\pWoSEwu.exe
  C:\Windows\System\pWoSEwu.exe
  2⤵
  PID:2080
- C:\Windows\System\BzwCnPG.exe
  C:\Windows\System\BzwCnPG.exe
  2⤵
  PID:2868
- C:\Windows\System\VMlNrco.exe
  C:\Windows\System\VMlNrco.exe
  2⤵
  PID:4660
- C:\Windows\System\zhMykoi.exe
  C:\Windows\System\zhMykoi.exe
  2⤵
  PID:1372
- C:\Windows\System\DmBzhTd.exe
  C:\Windows\System\DmBzhTd.exe
  2⤵
  PID:3224
- C:\Windows\System\wUwonAi.exe
  C:\Windows\System\wUwonAi.exe
  2⤵
  PID:4744
- C:\Windows\System\xTrDnxB.exe
  C:\Windows\System\xTrDnxB.exe
  2⤵
  PID:3600
- C:\Windows\System\ZBxbQsC.exe
  C:\Windows\System\ZBxbQsC.exe
  2⤵
  PID:4080
- C:\Windows\System\MuReEPd.exe
  C:\Windows\System\MuReEPd.exe
  2⤵
  PID:804
- C:\Windows\System\UfzwrVQ.exe
  C:\Windows\System\UfzwrVQ.exe
  2⤵
  PID:4888
- C:\Windows\System\wmemHaR.exe
  C:\Windows\System\wmemHaR.exe
  2⤵
  PID:3788
- C:\Windows\System\YRMuajS.exe
  C:\Windows\System\YRMuajS.exe
  2⤵
  PID:5080
- C:\Windows\System\GTtscKu.exe
  C:\Windows\System\GTtscKu.exe
  2⤵
  PID:3276
- C:\Windows\System\dlXUCaF.exe
  C:\Windows\System\dlXUCaF.exe
  2⤵
  PID:4504
- C:\Windows\System\TOGbIGb.exe
  C:\Windows\System\TOGbIGb.exe
  2⤵
  PID:2676
- C:\Windows\System\zEpIEuC.exe
  C:\Windows\System\zEpIEuC.exe
  2⤵
  PID:2880
- C:\Windows\System\KVDdgKG.exe
  C:\Windows\System\KVDdgKG.exe
  2⤵
  PID:2920
- C:\Windows\System\SRHuCua.exe
  C:\Windows\System\SRHuCua.exe
  2⤵
  PID:3472
- C:\Windows\System\oibYTHQ.exe
  C:\Windows\System\oibYTHQ.exe
  2⤵
  PID:2224
- C:\Windows\System\JjDFxxX.exe
  C:\Windows\System\JjDFxxX.exe
  2⤵
  PID:4392
- C:\Windows\System\ePxgQuW.exe
  C:\Windows\System\ePxgQuW.exe
  2⤵
  PID:3620
- C:\Windows\System\NawUBKp.exe
  C:\Windows\System\NawUBKp.exe
  2⤵
  PID:2292
- C:\Windows\System\eOagSaI.exe
  C:\Windows\System\eOagSaI.exe
  2⤵
  PID:4340
- C:\Windows\System\xQPAWQt.exe
  C:\Windows\System\xQPAWQt.exe
  2⤵
  PID:1584
- C:\Windows\System\lwYVQCn.exe
  C:\Windows\System\lwYVQCn.exe
  2⤵
  PID:3268
- C:\Windows\System\NxTqHzc.exe
  C:\Windows\System\NxTqHzc.exe
  2⤵
  PID:392
- C:\Windows\System\bslTrGp.exe
  C:\Windows\System\bslTrGp.exe
  2⤵
  PID:3868
- C:\Windows\System\RovgrYm.exe
  C:\Windows\System\RovgrYm.exe
  2⤵
  PID:432
- C:\Windows\System\iVyExps.exe
  C:\Windows\System\iVyExps.exe
  2⤵
  PID:1052
- C:\Windows\System\RTILtQu.exe
  C:\Windows\System\RTILtQu.exe
  2⤵
  PID:3040
- C:\Windows\System\IMueMfi.exe
  C:\Windows\System\IMueMfi.exe
  2⤵
  PID:4372
- C:\Windows\System\jKxPWYy.exe
  C:\Windows\System\jKxPWYy.exe
  2⤵
  PID:3420
- C:\Windows\System\vRXVSvC.exe
  C:\Windows\System\vRXVSvC.exe
  2⤵
  PID:1552
- C:\Windows\System\qjmeVaA.exe
  C:\Windows\System\qjmeVaA.exe
  2⤵
  PID:4388
- C:\Windows\System\GkKVHvn.exe
  C:\Windows\System\GkKVHvn.exe
  2⤵
  PID:3220
- C:\Windows\System\TWwLaJL.exe
  C:\Windows\System\TWwLaJL.exe
  2⤵
  PID:4400
- C:\Windows\System\mVirmUL.exe
  C:\Windows\System\mVirmUL.exe
  2⤵
  PID:2908
- C:\Windows\System\ylESOcI.exe
  C:\Windows\System\ylESOcI.exe
  2⤵
  PID:424
- C:\Windows\System\RYsdkdC.exe
  C:\Windows\System\RYsdkdC.exe
  2⤵
  PID:4880
- C:\Windows\System\xBOXaZr.exe
  C:\Windows\System\xBOXaZr.exe
  2⤵
  PID:5132
- C:\Windows\System\cSPvPbr.exe
  C:\Windows\System\cSPvPbr.exe
  2⤵
  PID:5152
- C:\Windows\System\GBVoUqB.exe
  C:\Windows\System\GBVoUqB.exe
  2⤵
  PID:5176
- C:\Windows\System\tdYSEvg.exe
  C:\Windows\System\tdYSEvg.exe
  2⤵
  PID:5196
- C:\Windows\System\jRDcSKO.exe
  C:\Windows\System\jRDcSKO.exe
  2⤵
  PID:5220
- C:\Windows\System\mzopVde.exe
  C:\Windows\System\mzopVde.exe
  2⤵
  PID:5236
- C:\Windows\System\nHSPRdg.exe
  C:\Windows\System\nHSPRdg.exe
  2⤵
  PID:5260
- C:\Windows\System\xZESlsk.exe
  C:\Windows\System\xZESlsk.exe
  2⤵
  PID:5280
- C:\Windows\System\WMbvGiv.exe
  C:\Windows\System\WMbvGiv.exe
  2⤵
  PID:5300
- C:\Windows\System\mAwoepM.exe
  C:\Windows\System\mAwoepM.exe
  2⤵
  PID:5316
- C:\Windows\System\WqlvsaO.exe
  C:\Windows\System\WqlvsaO.exe
  2⤵
  PID:5340
- C:\Windows\System\gbIiKEe.exe
  C:\Windows\System\gbIiKEe.exe
  2⤵
  PID:5356
- C:\Windows\System\bKapaFx.exe
  C:\Windows\System\bKapaFx.exe
  2⤵
  PID:5384
- C:\Windows\System\yWteGWu.exe
  C:\Windows\System\yWteGWu.exe
  2⤵
  PID:5400
- C:\Windows\System\VSTfGZF.exe
  C:\Windows\System\VSTfGZF.exe
  2⤵
  PID:5432
- C:\Windows\System\bTCtnqi.exe
  C:\Windows\System\bTCtnqi.exe
  2⤵
  PID:5456
- C:\Windows\System\YlKPECD.exe
  C:\Windows\System\YlKPECD.exe
  2⤵
  PID:5472
- C:\Windows\System\KpPfSfm.exe
  C:\Windows\System\KpPfSfm.exe
  2⤵
  PID:5492
- C:\Windows\System\LoeDatd.exe
  C:\Windows\System\LoeDatd.exe
  2⤵
  PID:5516
- C:\Windows\System\kImFtfV.exe
  C:\Windows\System\kImFtfV.exe
  2⤵
  PID:5536
- C:\Windows\System\KwEDmEP.exe
  C:\Windows\System\KwEDmEP.exe
  2⤵
  PID:5560
- C:\Windows\System\czwByrv.exe
  C:\Windows\System\czwByrv.exe
  2⤵
  PID:5580
- C:\Windows\System\cqTsSJM.exe
  C:\Windows\System\cqTsSJM.exe
  2⤵
  PID:5600
- C:\Windows\System\HdSitjw.exe
  C:\Windows\System\HdSitjw.exe
  2⤵
  PID:5628
- C:\Windows\System\IgkkwJa.exe
  C:\Windows\System\IgkkwJa.exe
  2⤵
  PID:5648
- C:\Windows\System\XNLNdPe.exe
  C:\Windows\System\XNLNdPe.exe
  2⤵
  PID:5672
- C:\Windows\System\hpafPce.exe
  C:\Windows\System\hpafPce.exe
  2⤵
  PID:5688
- C:\Windows\System\exaVtow.exe
  C:\Windows\System\exaVtow.exe
  2⤵
  PID:5712
- C:\Windows\System\AcGlrgI.exe
  C:\Windows\System\AcGlrgI.exe
  2⤵
  PID:5728
- C:\Windows\System\tpWssOS.exe
  C:\Windows\System\tpWssOS.exe
  2⤵
  PID:5756
- C:\Windows\System\qyjHddH.exe
  C:\Windows\System\qyjHddH.exe
  2⤵
  PID:5776
- C:\Windows\System\EZBhAxR.exe
  C:\Windows\System\EZBhAxR.exe
  2⤵
  PID:5796
- C:\Windows\System\ALUZaFs.exe
  C:\Windows\System\ALUZaFs.exe
  2⤵
  PID:5820
- C:\Windows\System\IJoHoWz.exe
  C:\Windows\System\IJoHoWz.exe
  2⤵
  PID:5840
- C:\Windows\System\VLggpXl.exe
  C:\Windows\System\VLggpXl.exe
  2⤵
  PID:5856
- C:\Windows\System\hsyOSMQ.exe
  C:\Windows\System\hsyOSMQ.exe
  2⤵
  PID:5876
- C:\Windows\System\hBQwWTK.exe
  C:\Windows\System\hBQwWTK.exe
  2⤵
  PID:5892
- C:\Windows\System\HmCHyQF.exe
  C:\Windows\System\HmCHyQF.exe
  2⤵
  PID:5916
- C:\Windows\System\atkZndn.exe
  C:\Windows\System\atkZndn.exe
  2⤵
  PID:5940
- C:\Windows\System\xzdHcKr.exe
  C:\Windows\System\xzdHcKr.exe
  2⤵
  PID:5956
- C:\Windows\System\rkslcJr.exe
  C:\Windows\System\rkslcJr.exe
  2⤵
  PID:5980
- C:\Windows\System\TXVDDYo.exe
  C:\Windows\System\TXVDDYo.exe
  2⤵
  PID:6008
- C:\Windows\System\DgCDJUZ.exe
  C:\Windows\System\DgCDJUZ.exe
  2⤵
  PID:6024
- C:\Windows\System\gEznKIo.exe
  C:\Windows\System\gEznKIo.exe
  2⤵
  PID:6048
- C:\Windows\System\MAMWMnq.exe
  C:\Windows\System\MAMWMnq.exe
  2⤵
  PID:6072
- C:\Windows\System\QhXONnq.exe
  C:\Windows\System\QhXONnq.exe
  2⤵
  PID:6100
- C:\Windows\System\BEsnPUJ.exe
  C:\Windows\System\BEsnPUJ.exe
  2⤵
  PID:6124
- C:\Windows\System\jmIEEtB.exe
  C:\Windows\System\jmIEEtB.exe
  2⤵
  PID:1460
- C:\Windows\System\WiklsRW.exe
  C:\Windows\System\WiklsRW.exe
  2⤵
  PID:4368
- C:\Windows\System\NiDVutg.exe
  C:\Windows\System\NiDVutg.exe
  2⤵
  PID:4360
- C:\Windows\System\BxcRbmw.exe
  C:\Windows\System\BxcRbmw.exe
  2⤵
  PID:4036
- C:\Windows\System\CeMJubw.exe
  C:\Windows\System\CeMJubw.exe
  2⤵
  PID:3716
- C:\Windows\System\UDWAEkr.exe
  C:\Windows\System\UDWAEkr.exe
  2⤵
  PID:3596
- C:\Windows\System\oSlRMaT.exe
  C:\Windows\System\oSlRMaT.exe
  2⤵
  PID:364
- C:\Windows\System\atNtNnX.exe
  C:\Windows\System\atNtNnX.exe
  2⤵
  PID:4872
- C:\Windows\System\rPIrtVy.exe
  C:\Windows\System\rPIrtVy.exe
  2⤵
  PID:5108
- C:\Windows\System\pbzPvxo.exe
  C:\Windows\System\pbzPvxo.exe
  2⤵
  PID:3552
- C:\Windows\System\dLrPUKv.exe
  C:\Windows\System\dLrPUKv.exe
  2⤵
  PID:5128
- C:\Windows\System\WxplJst.exe
  C:\Windows\System\WxplJst.exe
  2⤵
  PID:5204
- C:\Windows\System\GMmFZzD.exe
  C:\Windows\System\GMmFZzD.exe
  2⤵
  PID:5244
- C:\Windows\System\OHpjTQp.exe
  C:\Windows\System\OHpjTQp.exe
  2⤵
  PID:4604
- C:\Windows\System\nTrpMWA.exe
  C:\Windows\System\nTrpMWA.exe
  2⤵
  PID:5420
- C:\Windows\System\eLAAlrT.exe
  C:\Windows\System\eLAAlrT.exe
  2⤵
  PID:5484
- C:\Windows\System\XunlaWv.exe
  C:\Windows\System\XunlaWv.exe
  2⤵
  PID:5524
- C:\Windows\System\UTfdusj.exe
  C:\Windows\System\UTfdusj.exe
  2⤵
  PID:5160
- C:\Windows\System\qfAxSNJ.exe
  C:\Windows\System\qfAxSNJ.exe
  2⤵
  PID:5596
- C:\Windows\System\VntUJrW.exe
  C:\Windows\System\VntUJrW.exe
  2⤵
  PID:5744
- C:\Windows\System\jkmJlql.exe
  C:\Windows\System\jkmJlql.exe
  2⤵
  PID:5872
- C:\Windows\System\YwkMWLr.exe
  C:\Windows\System\YwkMWLr.exe
  2⤵
  PID:6148
- C:\Windows\System\QSyfSBw.exe
  C:\Windows\System\QSyfSBw.exe
  2⤵
  PID:6176
- C:\Windows\System\PeaFOJC.exe
  C:\Windows\System\PeaFOJC.exe
  2⤵
  PID:6196
- C:\Windows\System\kgeGVLA.exe
  C:\Windows\System\kgeGVLA.exe
  2⤵
  PID:6220
- C:\Windows\System\JTOpGBQ.exe
  C:\Windows\System\JTOpGBQ.exe
  2⤵
  PID:6236
- C:\Windows\System\IRbQKfD.exe
  C:\Windows\System\IRbQKfD.exe
  2⤵
  PID:6260
- C:\Windows\System\wZhCkNL.exe
  C:\Windows\System\wZhCkNL.exe
  2⤵
  PID:6284
- C:\Windows\System\HfHeFBn.exe
  C:\Windows\System\HfHeFBn.exe
  2⤵
  PID:6304
- C:\Windows\System\sJFFklE.exe
  C:\Windows\System\sJFFklE.exe
  2⤵
  PID:6320
- C:\Windows\System\kTDhUfL.exe
  C:\Windows\System\kTDhUfL.exe
  2⤵
  PID:6352
- C:\Windows\System\uIpwmZw.exe
  C:\Windows\System\uIpwmZw.exe
  2⤵
  PID:6380
- C:\Windows\System\RngceCp.exe
  C:\Windows\System\RngceCp.exe
  2⤵
  PID:6408
- C:\Windows\System\GbMXwdb.exe
  C:\Windows\System\GbMXwdb.exe
  2⤵
  PID:6428
- C:\Windows\System\IJoQfBv.exe
  C:\Windows\System\IJoQfBv.exe
  2⤵
  PID:6448
- C:\Windows\System\ONOCVfF.exe
  C:\Windows\System\ONOCVfF.exe
  2⤵
  PID:6468
- C:\Windows\System\ErKziOe.exe
  C:\Windows\System\ErKziOe.exe
  2⤵
  PID:6492
- C:\Windows\System\mOApcge.exe
  C:\Windows\System\mOApcge.exe
  2⤵
  PID:6512
- C:\Windows\System\gKYKbOl.exe
  C:\Windows\System\gKYKbOl.exe
  2⤵
  PID:6528
- C:\Windows\System\AbQESHd.exe
  C:\Windows\System\AbQESHd.exe
  2⤵
  PID:6552
- C:\Windows\System\dmSYJAo.exe
  C:\Windows\System\dmSYJAo.exe
  2⤵
  PID:6588
- C:\Windows\System\dDWyQax.exe
  C:\Windows\System\dDWyQax.exe
  2⤵
  PID:6612
- C:\Windows\System\WjAhcDl.exe
  C:\Windows\System\WjAhcDl.exe
  2⤵
  PID:6632
- C:\Windows\System\qjJIECk.exe
  C:\Windows\System\qjJIECk.exe
  2⤵
  PID:6656
- C:\Windows\System\akWPrkh.exe
  C:\Windows\System\akWPrkh.exe
  2⤵
  PID:6676
- C:\Windows\System\NDRxTFp.exe
  C:\Windows\System\NDRxTFp.exe
  2⤵
  PID:6692
- C:\Windows\System\paDLmbV.exe
  C:\Windows\System\paDLmbV.exe
  2⤵
  PID:6720
- C:\Windows\System\ziUJXCk.exe
  C:\Windows\System\ziUJXCk.exe
  2⤵
  PID:6744
- C:\Windows\System\PWVkaHs.exe
  C:\Windows\System\PWVkaHs.exe
  2⤵
  PID:6772
- C:\Windows\System\NqWGoSO.exe
  C:\Windows\System\NqWGoSO.exe
  2⤵
  PID:6792
- C:\Windows\System\XUcVNnh.exe
  C:\Windows\System\XUcVNnh.exe
  2⤵
  PID:6812
- C:\Windows\System\yTqUkTy.exe
  C:\Windows\System\yTqUkTy.exe
  2⤵
  PID:6832
- C:\Windows\System\gwypdhD.exe
  C:\Windows\System\gwypdhD.exe
  2⤵
  PID:6852
- C:\Windows\System\StGqfZU.exe
  C:\Windows\System\StGqfZU.exe
  2⤵
  PID:6876
- C:\Windows\System\mdmptdW.exe
  C:\Windows\System\mdmptdW.exe
  2⤵
  PID:6892
- C:\Windows\System\FTLVcwu.exe
  C:\Windows\System\FTLVcwu.exe
  2⤵
  PID:6916
- C:\Windows\System\ewiDrAS.exe
  C:\Windows\System\ewiDrAS.exe
  2⤵
  PID:6940
- C:\Windows\System\IOqAAtu.exe
  C:\Windows\System\IOqAAtu.exe
  2⤵
  PID:6960
- C:\Windows\System\sgtxnTZ.exe
  C:\Windows\System\sgtxnTZ.exe
  2⤵
  PID:6984
- C:\Windows\System\QKXYKrQ.exe
  C:\Windows\System\QKXYKrQ.exe
  2⤵
  PID:7008
- C:\Windows\System\XWyMRle.exe
  C:\Windows\System\XWyMRle.exe
  2⤵
  PID:7028
- C:\Windows\System\jJRTtzc.exe
  C:\Windows\System\jJRTtzc.exe
  2⤵
  PID:7052
- C:\Windows\System\RklPXvc.exe
  C:\Windows\System\RklPXvc.exe
  2⤵
  PID:7072
- C:\Windows\System\vjnjpJn.exe
  C:\Windows\System\vjnjpJn.exe
  2⤵
  PID:7096
- C:\Windows\System\xPnRgGO.exe
  C:\Windows\System\xPnRgGO.exe
  2⤵
  PID:7116
- C:\Windows\System\ExYBqyh.exe
  C:\Windows\System\ExYBqyh.exe
  2⤵
  PID:7136
- C:\Windows\System\kRjirqt.exe
  C:\Windows\System\kRjirqt.exe
  2⤵
  PID:7156
- C:\Windows\System\qMqZByE.exe
  C:\Windows\System\qMqZByE.exe
  2⤵
  PID:5964
- C:\Windows\System\jytntMg.exe
  C:\Windows\System\jytntMg.exe
  2⤵
  PID:3780
- C:\Windows\System\gKTVblU.exe
  C:\Windows\System\gKTVblU.exe
  2⤵
  PID:6016
- C:\Windows\System\lurGvHQ.exe
  C:\Windows\System\lurGvHQ.exe
  2⤵
  PID:6088
- C:\Windows\System\KZWzlZd.exe
  C:\Windows\System\KZWzlZd.exe
  2⤵
  PID:5396
- C:\Windows\System\bOOQAVK.exe
  C:\Windows\System\bOOQAVK.exe
  2⤵
  PID:6136
- C:\Windows\System\FhQFcBw.exe
  C:\Windows\System\FhQFcBw.exe
  2⤵
  PID:1428
- C:\Windows\System\gdcVkrk.exe
  C:\Windows\System\gdcVkrk.exe
  2⤵
  PID:5660
- C:\Windows\System\vmwocuZ.exe
  C:\Windows\System\vmwocuZ.exe
  2⤵
  PID:5696
- C:\Windows\System\RJCMPuc.exe
  C:\Windows\System\RJCMPuc.exe
  2⤵
  PID:5248
- C:\Windows\System\BEnbzry.exe
  C:\Windows\System\BEnbzry.exe
  2⤵
  PID:5768
- C:\Windows\System\aDnpDjT.exe
  C:\Windows\System\aDnpDjT.exe
  2⤵
  PID:5772
- C:\Windows\System\gYzixuf.exe
  C:\Windows\System\gYzixuf.exe
  2⤵
  PID:4244
- C:\Windows\System\qnLPZUg.exe
  C:\Windows\System\qnLPZUg.exe
  2⤵
  PID:5144
- C:\Windows\System\nIWtaHE.exe
  C:\Windows\System\nIWtaHE.exe
  2⤵
  PID:5912
- C:\Windows\System\kXujfQD.exe
  C:\Windows\System\kXujfQD.exe
  2⤵
  PID:6204
- C:\Windows\System\MgRhbZa.exe
  C:\Windows\System\MgRhbZa.exe
  2⤵
  PID:5364
- C:\Windows\System\vlgUFpn.exe
  C:\Windows\System\vlgUFpn.exe
  2⤵
  PID:6044
- C:\Windows\System\BgeZBij.exe
  C:\Windows\System\BgeZBij.exe
  2⤵
  PID:6400
- C:\Windows\System\MTzgbrf.exe
  C:\Windows\System\MTzgbrf.exe
  2⤵
  PID:5480
- C:\Windows\System\FfqCPAd.exe
  C:\Windows\System\FfqCPAd.exe
  2⤵
  PID:4652
- C:\Windows\System\IbtrLvO.exe
  C:\Windows\System\IbtrLvO.exe
  2⤵
  PID:7192
- C:\Windows\System\dUcJSYn.exe
  C:\Windows\System\dUcJSYn.exe
  2⤵
  PID:7228
- C:\Windows\System\hmbBDAO.exe
  C:\Windows\System\hmbBDAO.exe
  2⤵
  PID:7248
- C:\Windows\System\NoKFWZD.exe
  C:\Windows\System\NoKFWZD.exe
  2⤵
  PID:7268
- C:\Windows\System\gNeBIVW.exe
  C:\Windows\System\gNeBIVW.exe
  2⤵
  PID:7288
- C:\Windows\System\ZcdvYIG.exe
  C:\Windows\System\ZcdvYIG.exe
  2⤵
  PID:7312
- C:\Windows\System\IpczRvN.exe
  C:\Windows\System\IpczRvN.exe
  2⤵
  PID:7336
- C:\Windows\System\BQmsabh.exe
  C:\Windows\System\BQmsabh.exe
  2⤵
  PID:7356
- C:\Windows\System\rPfcHwv.exe
  C:\Windows\System\rPfcHwv.exe
  2⤵
  PID:7376
- C:\Windows\System\Rbeasrs.exe
  C:\Windows\System\Rbeasrs.exe
  2⤵
  PID:7400
- C:\Windows\System\utLVKRj.exe
  C:\Windows\System\utLVKRj.exe
  2⤵
  PID:7424
- C:\Windows\System\OTCiius.exe
  C:\Windows\System\OTCiius.exe
  2⤵
  PID:7444
- C:\Windows\System\SnJwLtF.exe
  C:\Windows\System\SnJwLtF.exe
  2⤵
  PID:7476
- C:\Windows\System\utOQYOE.exe
  C:\Windows\System\utOQYOE.exe
  2⤵
  PID:7496
- C:\Windows\System\xGYNQhg.exe
  C:\Windows\System\xGYNQhg.exe
  2⤵
  PID:7520
- C:\Windows\System\vyUfeJg.exe
  C:\Windows\System\vyUfeJg.exe
  2⤵
  PID:7544
- C:\Windows\System\uHklvXU.exe
  C:\Windows\System\uHklvXU.exe
  2⤵
  PID:7560
- C:\Windows\System\tZjOVmd.exe
  C:\Windows\System\tZjOVmd.exe
  2⤵
  PID:7588
- C:\Windows\System\kZliZlD.exe
  C:\Windows\System\kZliZlD.exe
  2⤵
  PID:7608
- C:\Windows\System\igWpcRa.exe
  C:\Windows\System\igWpcRa.exe
  2⤵
  PID:7628
- C:\Windows\System\nIxHtfK.exe
  C:\Windows\System\nIxHtfK.exe
  2⤵
  PID:7648
- C:\Windows\System\eCmmaEK.exe
  C:\Windows\System\eCmmaEK.exe
  2⤵
  PID:7668
- C:\Windows\System\zcrMlZw.exe
  C:\Windows\System\zcrMlZw.exe
  2⤵
  PID:7688
- C:\Windows\System\CvBeZnH.exe
  C:\Windows\System\CvBeZnH.exe
  2⤵
  PID:7708
- C:\Windows\System\xbZoPyG.exe
  C:\Windows\System\xbZoPyG.exe
  2⤵
  PID:7728
- C:\Windows\System\MIPeCGZ.exe
  C:\Windows\System\MIPeCGZ.exe
  2⤵
  PID:7756
- C:\Windows\System\nuNnJxG.exe
  C:\Windows\System\nuNnJxG.exe
  2⤵
  PID:7772
- C:\Windows\System\PKahmli.exe
  C:\Windows\System\PKahmli.exe
  2⤵
  PID:7792
- C:\Windows\System\RSEajeo.exe
  C:\Windows\System\RSEajeo.exe
  2⤵
  PID:7808
- C:\Windows\System\LtUBftu.exe
  C:\Windows\System\LtUBftu.exe
  2⤵
  PID:7824
- C:\Windows\System\jLVRUpH.exe
  C:\Windows\System\jLVRUpH.exe
  2⤵
  PID:7840
- C:\Windows\System\eGCDiPu.exe
  C:\Windows\System\eGCDiPu.exe
  2⤵
  PID:7860
- C:\Windows\System\wBvsAHc.exe
  C:\Windows\System\wBvsAHc.exe
  2⤵
  PID:7876
- C:\Windows\System\wCUtDUl.exe
  C:\Windows\System\wCUtDUl.exe
  2⤵
  PID:7900
- C:\Windows\System\qVywmJh.exe
  C:\Windows\System\qVywmJh.exe
  2⤵
  PID:7940
- C:\Windows\System\udJiVsR.exe
  C:\Windows\System\udJiVsR.exe
  2⤵
  PID:7964
- C:\Windows\System\zzvAwRd.exe
  C:\Windows\System\zzvAwRd.exe
  2⤵
  PID:7984
- C:\Windows\System\DyYFcAZ.exe
  C:\Windows\System\DyYFcAZ.exe
  2⤵
  PID:8004
- C:\Windows\System\IROqIEK.exe
  C:\Windows\System\IROqIEK.exe
  2⤵
  PID:8028
- C:\Windows\System\cwtnHBW.exe
  C:\Windows\System\cwtnHBW.exe
  2⤵
  PID:8056
- C:\Windows\System\HmCDLhC.exe
  C:\Windows\System\HmCDLhC.exe
  2⤵
  PID:8076
- C:\Windows\System\tJOzMGZ.exe
  C:\Windows\System\tJOzMGZ.exe
  2⤵
  PID:8100
- C:\Windows\System\cXsEllt.exe
  C:\Windows\System\cXsEllt.exe
  2⤵
  PID:8120
- C:\Windows\System\gfiphwC.exe
  C:\Windows\System\gfiphwC.exe
  2⤵
  PID:8144
- C:\Windows\System\KLRnTJR.exe
  C:\Windows\System\KLRnTJR.exe
  2⤵
  PID:8168
- C:\Windows\System\AAtmYgD.exe
  C:\Windows\System\AAtmYgD.exe
  2⤵
  PID:5592
- C:\Windows\System\cKLUKAy.exe
  C:\Windows\System\cKLUKAy.exe
  2⤵
  PID:6524
- C:\Windows\System\zrZXmfY.exe
  C:\Windows\System\zrZXmfY.exe
  2⤵
  PID:6560
- C:\Windows\System\aEiuKmd.exe
  C:\Windows\System\aEiuKmd.exe
  2⤵
  PID:6620
- C:\Windows\System\rZxuhZA.exe
  C:\Windows\System\rZxuhZA.exe
  2⤵
  PID:6648
- C:\Windows\System\OPywnZI.exe
  C:\Windows\System\OPywnZI.exe
  2⤵
  PID:5736
- C:\Windows\System\XMVscLc.exe
  C:\Windows\System\XMVscLc.exe
  2⤵
  PID:6732
- C:\Windows\System\mUIWJtT.exe
  C:\Windows\System\mUIWJtT.exe
  2⤵
  PID:6760
- C:\Windows\System\lZqwsxm.exe
  C:\Windows\System\lZqwsxm.exe
  2⤵
  PID:5532
- C:\Windows\System\kELQKIL.exe
  C:\Windows\System\kELQKIL.exe
  2⤵
  PID:6908
- C:\Windows\System\YupitNA.exe
  C:\Windows\System\YupitNA.exe
  2⤵
  PID:5948
- C:\Windows\System\pUIIPsH.exe
  C:\Windows\System\pUIIPsH.exe
  2⤵
  PID:7016
- C:\Windows\System\nGRAiVq.exe
  C:\Windows\System\nGRAiVq.exe
  2⤵
  PID:6232
- C:\Windows\System\ijyyRBb.exe
  C:\Windows\System\ijyyRBb.exe
  2⤵
  PID:7132
- C:\Windows\System\HhXaISt.exe
  C:\Windows\System\HhXaISt.exe
  2⤵
  PID:6064
- C:\Windows\System\CvQhGkW.exe
  C:\Windows\System\CvQhGkW.exe
  2⤵
  PID:6068
- C:\Windows\System\GzJKGmu.exe
  C:\Windows\System\GzJKGmu.exe
  2⤵
  PID:6376
- C:\Windows\System\ThYMYiz.exe
  C:\Windows\System\ThYMYiz.exe
  2⤵
  PID:4416
- C:\Windows\System\xtsicfu.exe
  C:\Windows\System\xtsicfu.exe
  2⤵
  PID:5276
- C:\Windows\System\bJpgHBM.exe
  C:\Windows\System\bJpgHBM.exe
  2⤵
  PID:5928
- C:\Windows\System\wuOAlnf.exe
  C:\Windows\System\wuOAlnf.exe
  2⤵
  PID:6112
- C:\Windows\System\PHpCjmn.exe
  C:\Windows\System\PHpCjmn.exe
  2⤵
  PID:8568
- C:\Windows\System\WWQRKnK.exe
  C:\Windows\System\WWQRKnK.exe
  2⤵
  PID:8588
- C:\Windows\System\TkrWQdp.exe
  C:\Windows\System\TkrWQdp.exe
  2⤵
  PID:8608
- C:\Windows\System\TrnFSfG.exe
  C:\Windows\System\TrnFSfG.exe
  2⤵
  PID:8632
- C:\Windows\System\CJxEvEo.exe
  C:\Windows\System\CJxEvEo.exe
  2⤵
  PID:8652
- C:\Windows\System\LmuneCK.exe
  C:\Windows\System\LmuneCK.exe
  2⤵
  PID:8688
- C:\Windows\System\hjQEGvZ.exe
  C:\Windows\System\hjQEGvZ.exe
  2⤵
  PID:8704
- C:\Windows\System\TomrgCq.exe
  C:\Windows\System\TomrgCq.exe
  2⤵
  PID:8732
- C:\Windows\System\IhbDzau.exe
  C:\Windows\System\IhbDzau.exe
  2⤵
  PID:8760
- C:\Windows\System\BTZCiHS.exe
  C:\Windows\System\BTZCiHS.exe
  2⤵
  PID:8784
- C:\Windows\System\mpbgzQg.exe
  C:\Windows\System\mpbgzQg.exe
  2⤵
  PID:8816
- C:\Windows\System\jrELmuh.exe
  C:\Windows\System\jrELmuh.exe
  2⤵
  PID:8836
- C:\Windows\System\FkGDFcZ.exe
  C:\Windows\System\FkGDFcZ.exe
  2⤵
  PID:8860
- C:\Windows\System\UijYHiX.exe
  C:\Windows\System\UijYHiX.exe
  2⤵
  PID:8888
- C:\Windows\System\cfKUsXK.exe
  C:\Windows\System\cfKUsXK.exe
  2⤵
  PID:8912
- C:\Windows\System\qzTsyWG.exe
  C:\Windows\System\qzTsyWG.exe
  2⤵
  PID:8936
- C:\Windows\System\PnUwRQV.exe
  C:\Windows\System\PnUwRQV.exe
  2⤵
  PID:8956
- C:\Windows\System\aNvIBrL.exe
  C:\Windows\System\aNvIBrL.exe
  2⤵
  PID:8972
- C:\Windows\System\vmLaTyp.exe
  C:\Windows\System\vmLaTyp.exe
  2⤵
  PID:8988
- C:\Windows\System\AEYHDkl.exe
  C:\Windows\System\AEYHDkl.exe
  2⤵
  PID:9004
- C:\Windows\System\ARmBUOQ.exe
  C:\Windows\System\ARmBUOQ.exe
  2⤵
  PID:9024
- C:\Windows\System\AmgyXPS.exe
  C:\Windows\System\AmgyXPS.exe
  2⤵
  PID:9048
- C:\Windows\System\IMnYCvP.exe
  C:\Windows\System\IMnYCvP.exe
  2⤵
  PID:9072
- C:\Windows\System\emvoIKS.exe
  C:\Windows\System\emvoIKS.exe
  2⤵
  PID:9088
- C:\Windows\System\TcXrnpO.exe
  C:\Windows\System\TcXrnpO.exe
  2⤵
  PID:9104
- C:\Windows\System\EFqfqYB.exe
  C:\Windows\System\EFqfqYB.exe
  2⤵
  PID:9128
- C:\Windows\System\lBCqGPm.exe
  C:\Windows\System\lBCqGPm.exe
  2⤵
  PID:9156
- C:\Windows\System\kvYJpiD.exe
  C:\Windows\System\kvYJpiD.exe
  2⤵
  PID:9180
- C:\Windows\System\vOQAnle.exe
  C:\Windows\System\vOQAnle.exe
  2⤵
  PID:9200
- C:\Windows\System\FfAIHKn.exe
  C:\Windows\System\FfAIHKn.exe
  2⤵
  PID:5976
- C:\Windows\System\qRiGPjJ.exe
  C:\Windows\System\qRiGPjJ.exe
  2⤵
  PID:7720
- C:\Windows\System\qnthzHu.exe
  C:\Windows\System\qnthzHu.exe
  2⤵
  PID:5576
- C:\Windows\System\LdYrnXk.exe
  C:\Windows\System\LdYrnXk.exe
  2⤵
  PID:880
- C:\Windows\System\fLvkiTK.exe
  C:\Windows\System\fLvkiTK.exe
  2⤵
  PID:7912
- C:\Windows\System\xRAnvhO.exe
  C:\Windows\System\xRAnvhO.exe
  2⤵
  PID:6424
- C:\Windows\System\KawzRqp.exe
  C:\Windows\System\KawzRqp.exe
  2⤵
  PID:5640
- C:\Windows\System\NoqYqoC.exe
  C:\Windows\System\NoqYqoC.exe
  2⤵
  PID:7208
- C:\Windows\System\XuLBJNG.exe
  C:\Windows\System\XuLBJNG.exe
  2⤵
  PID:7296
- C:\Windows\System\tWgRPpV.exe
  C:\Windows\System\tWgRPpV.exe
  2⤵
  PID:6644
- C:\Windows\System\PDssOii.exe
  C:\Windows\System\PDssOii.exe
  2⤵
  PID:6800
- C:\Windows\System\QRTfxlT.exe
  C:\Windows\System\QRTfxlT.exe
  2⤵
  PID:6824
- C:\Windows\System\VGWCPQI.exe
  C:\Windows\System\VGWCPQI.exe
  2⤵
  PID:6936
- C:\Windows\System\XFxCeOL.exe
  C:\Windows\System\XFxCeOL.exe
  2⤵
  PID:7044
- C:\Windows\System\dyHDDZm.exe
  C:\Windows\System\dyHDDZm.exe
  2⤵
  PID:7108
- C:\Windows\System\dxnGBYF.exe
  C:\Windows\System\dxnGBYF.exe
  2⤵
  PID:7660
- C:\Windows\System\faYSykd.exe
  C:\Windows\System\faYSykd.exe
  2⤵
  PID:7868
- C:\Windows\System\OHHVJuL.exe
  C:\Windows\System\OHHVJuL.exe
  2⤵
  PID:8036
- C:\Windows\System\AvkyWwy.exe
  C:\Windows\System\AvkyWwy.exe
  2⤵
  PID:8184
- C:\Windows\System\pxlQvxP.exe
  C:\Windows\System\pxlQvxP.exe
  2⤵
  PID:6728
- C:\Windows\System\YoTUbxy.exe
  C:\Windows\System\YoTUbxy.exe
  2⤵
  PID:7024
- C:\Windows\System\dZKHPcy.exe
  C:\Windows\System\dZKHPcy.exe
  2⤵
  PID:7656
- C:\Windows\System\wJvyIEd.exe
  C:\Windows\System\wJvyIEd.exe
  2⤵
  PID:5488
- C:\Windows\System\jfpCkBU.exe
  C:\Windows\System\jfpCkBU.exe
  2⤵
  PID:2144
- C:\Windows\System\eiytZzm.exe
  C:\Windows\System\eiytZzm.exe
  2⤵
  PID:7920
- C:\Windows\System\QcerjiG.exe
  C:\Windows\System\QcerjiG.exe
  2⤵
  PID:876
- C:\Windows\System\Rtulezp.exe
  C:\Windows\System\Rtulezp.exe
  2⤵
  PID:5992
- C:\Windows\System\XrnpWgD.exe
  C:\Windows\System\XrnpWgD.exe
  2⤵
  PID:8336
- C:\Windows\System\qNKYvAs.exe
  C:\Windows\System\qNKYvAs.exe
  2⤵
  PID:1608
- C:\Windows\System\mrbQzOj.exe
  C:\Windows\System\mrbQzOj.exe
  2⤵
  PID:2384
- C:\Windows\System\vitwQkI.exe
  C:\Windows\System\vitwQkI.exe
  2⤵
  PID:6084
- C:\Windows\System\vBouNUM.exe
  C:\Windows\System\vBouNUM.exe
  2⤵
  PID:7388
- C:\Windows\System\zwJheRr.exe
  C:\Windows\System\zwJheRr.exe
  2⤵
  PID:7532
- C:\Windows\System\vEWulhZ.exe
  C:\Windows\System\vEWulhZ.exe
  2⤵
  PID:9248
- C:\Windows\System\RiihNCc.exe
  C:\Windows\System\RiihNCc.exe
  2⤵
  PID:9272
- C:\Windows\System\YvjoZZs.exe
  C:\Windows\System\YvjoZZs.exe
  2⤵
  PID:9296
- C:\Windows\System\MXHGYjY.exe
  C:\Windows\System\MXHGYjY.exe
  2⤵
  PID:9320
- C:\Windows\System\hxzWftu.exe
  C:\Windows\System\hxzWftu.exe
  2⤵
  PID:9344
- C:\Windows\System\EsFsmVq.exe
  C:\Windows\System\EsFsmVq.exe
  2⤵
  PID:9368
- C:\Windows\System\aqAHFfA.exe
  C:\Windows\System\aqAHFfA.exe
  2⤵
  PID:9388
- C:\Windows\System\fJNZiMo.exe
  C:\Windows\System\fJNZiMo.exe
  2⤵
  PID:9408
- C:\Windows\System\TShEMEB.exe
  C:\Windows\System\TShEMEB.exe
  2⤵
  PID:9432
- C:\Windows\System\vPNsRHS.exe
  C:\Windows\System\vPNsRHS.exe
  2⤵
  PID:9452
- C:\Windows\System\SZoynZw.exe
  C:\Windows\System\SZoynZw.exe
  2⤵
  PID:9476
- C:\Windows\System\IEMLbhj.exe
  C:\Windows\System\IEMLbhj.exe
  2⤵
  PID:9496
- C:\Windows\System\kQUaNmN.exe
  C:\Windows\System\kQUaNmN.exe
  2⤵
  PID:9516
- C:\Windows\System\DobrfMl.exe
  C:\Windows\System\DobrfMl.exe
  2⤵
  PID:9544
- C:\Windows\System\PbQMaly.exe
  C:\Windows\System\PbQMaly.exe
  2⤵
  PID:9564
- C:\Windows\System\qQVUHEg.exe
  C:\Windows\System\qQVUHEg.exe
  2⤵
  PID:9604
- C:\Windows\System\enRnapU.exe
  C:\Windows\System\enRnapU.exe
  2⤵
  PID:9632
- C:\Windows\System\pYOFjhc.exe
  C:\Windows\System\pYOFjhc.exe
  2⤵
  PID:9656
- C:\Windows\System\yowmOJx.exe
  C:\Windows\System\yowmOJx.exe
  2⤵
  PID:9676
- C:\Windows\System\HOmqBte.exe
  C:\Windows\System\HOmqBte.exe
  2⤵
  PID:9700
- C:\Windows\System\dJMMpcV.exe
  C:\Windows\System\dJMMpcV.exe
  2⤵
  PID:9720
- C:\Windows\System\BGDttmM.exe
  C:\Windows\System\BGDttmM.exe
  2⤵
  PID:9752
- C:\Windows\System\WCYbfvW.exe
  C:\Windows\System\WCYbfvW.exe
  2⤵
  PID:9772
- C:\Windows\System\vevUBbv.exe
  C:\Windows\System\vevUBbv.exe
  2⤵
  PID:9792
- C:\Windows\System\AQWpXtf.exe
  C:\Windows\System\AQWpXtf.exe
  2⤵
  PID:9812
- C:\Windows\System\FjipfeM.exe
  C:\Windows\System\FjipfeM.exe
  2⤵
  PID:9840
- C:\Windows\System\bVCabqZ.exe
  C:\Windows\System\bVCabqZ.exe
  2⤵
  PID:9856
- C:\Windows\System\CLfJblP.exe
  C:\Windows\System\CLfJblP.exe
  2⤵
  PID:9872
- C:\Windows\System\eGDdhbV.exe
  C:\Windows\System\eGDdhbV.exe
  2⤵
  PID:9888
- C:\Windows\System\NqphNZL.exe
  C:\Windows\System\NqphNZL.exe
  2⤵
  PID:9904
- C:\Windows\System\MfpJuBG.exe
  C:\Windows\System\MfpJuBG.exe
  2⤵
  PID:9924
- C:\Windows\System\qVtQAsR.exe
  C:\Windows\System\qVtQAsR.exe
  2⤵
  PID:9948
- C:\Windows\System\sNOQkCW.exe
  C:\Windows\System\sNOQkCW.exe
  2⤵
  PID:9972
- C:\Windows\System\dexwTBX.exe
  C:\Windows\System\dexwTBX.exe
  2⤵
  PID:9996
- C:\Windows\System\BNTjeQH.exe
  C:\Windows\System\BNTjeQH.exe
  2⤵
  PID:10028
- C:\Windows\System\JgnrtLt.exe
  C:\Windows\System\JgnrtLt.exe
  2⤵
  PID:10056
- C:\Windows\System\GhEgXwL.exe
  C:\Windows\System\GhEgXwL.exe
  2⤵
  PID:10076
- C:\Windows\System\GKpOhXB.exe
  C:\Windows\System\GKpOhXB.exe
  2⤵
  PID:10100
- C:\Windows\System\McZEIjX.exe
  C:\Windows\System\McZEIjX.exe
  2⤵
  PID:10136
- C:\Windows\System\sCvmPBb.exe
  C:\Windows\System\sCvmPBb.exe
  2⤵
  PID:10164
- C:\Windows\System\nZCoqnT.exe
  C:\Windows\System\nZCoqnT.exe
  2⤵
  PID:10180
- C:\Windows\System\cbdPkNs.exe
  C:\Windows\System\cbdPkNs.exe
  2⤵
  PID:10204
- C:\Windows\System\UCyGELd.exe
  C:\Windows\System\UCyGELd.exe
  2⤵
  PID:10236
- C:\Windows\System\qcUPEtN.exe
  C:\Windows\System\qcUPEtN.exe
  2⤵
  PID:5644
- C:\Windows\System\uiMMqSW.exe
  C:\Windows\System\uiMMqSW.exe
  2⤵
  PID:8616
- C:\Windows\System\xjMyhHn.exe
  C:\Windows\System\xjMyhHn.exe
  2⤵
  PID:8664
- C:\Windows\System\olXeMUp.exe
  C:\Windows\System\olXeMUp.exe
  2⤵
  PID:8696
- C:\Windows\System\VHGPSlK.exe
  C:\Windows\System\VHGPSlK.exe
  2⤵
  PID:8844
- C:\Windows\System\qwFoTCc.exe
  C:\Windows\System\qwFoTCc.exe
  2⤵
  PID:7804
- C:\Windows\System\aWXhvol.exe
  C:\Windows\System\aWXhvol.exe
  2⤵
  PID:8928
- C:\Windows\System\IeZcWfZ.exe
  C:\Windows\System\IeZcWfZ.exe
  2⤵
  PID:7976
- C:\Windows\System\MNyCQRE.exe
  C:\Windows\System\MNyCQRE.exe
  2⤵
  PID:8084
- C:\Windows\System\avTmymv.exe
  C:\Windows\System\avTmymv.exe
  2⤵
  PID:9100
- C:\Windows\System\YQkcetP.exe
  C:\Windows\System\YQkcetP.exe
  2⤵
  PID:8116
- C:\Windows\System\FLfWTOu.exe
  C:\Windows\System\FLfWTOu.exe
  2⤵
  PID:3992
- C:\Windows\System\qvvuqZN.exe
  C:\Windows\System\qvvuqZN.exe
  2⤵
  PID:5724
- C:\Windows\System\XYOGVxM.exe
  C:\Windows\System\XYOGVxM.exe
  2⤵
  PID:5812
- C:\Windows\System\hzbdOsS.exe
  C:\Windows\System\hzbdOsS.exe
  2⤵
  PID:6672
- C:\Windows\System\aKkCpwp.exe
  C:\Windows\System\aKkCpwp.exe
  2⤵
  PID:7436
- C:\Windows\System\eByKwsF.exe
  C:\Windows\System\eByKwsF.exe
  2⤵
  PID:8408
- C:\Windows\System\RNaedks.exe
  C:\Windows\System\RNaedks.exe
  2⤵
  PID:5124
- C:\Windows\System\tIyDZEm.exe
  C:\Windows\System\tIyDZEm.exe
  2⤵
  PID:5908
- C:\Windows\System\aHfqbaL.exe
  C:\Windows\System\aHfqbaL.exe
  2⤵
  PID:8000
- C:\Windows\System\nKSaHXu.exe
  C:\Windows\System\nKSaHXu.exe
  2⤵
  PID:8376
- C:\Windows\System\bxRcRON.exe
  C:\Windows\System\bxRcRON.exe
  2⤵
  PID:6952
- C:\Windows\System\EEBqesa.exe
  C:\Windows\System\EEBqesa.exe
  2⤵
  PID:8460
- C:\Windows\System\KbPCtTU.exe
  C:\Windows\System\KbPCtTU.exe
  2⤵
  PID:9284
- C:\Windows\System\uhjbJgB.exe
  C:\Windows\System\uhjbJgB.exe
  2⤵
  PID:9328
- C:\Windows\System\UsjVqEE.exe
  C:\Windows\System\UsjVqEE.exe
  2⤵
  PID:10264
- C:\Windows\System\eiJrdsN.exe
  C:\Windows\System\eiJrdsN.exe
  2⤵
  PID:10284
- C:\Windows\System\kBHJXDi.exe
  C:\Windows\System\kBHJXDi.exe
  2⤵
  PID:10300
- C:\Windows\System\ByzFjRI.exe
  C:\Windows\System\ByzFjRI.exe
  2⤵
  PID:10320
- C:\Windows\System\RxgmQLl.exe
  C:\Windows\System\RxgmQLl.exe
  2⤵
  PID:10340
- C:\Windows\System\BocadEn.exe
  C:\Windows\System\BocadEn.exe
  2⤵
  PID:10368
- C:\Windows\System\gAyxwqu.exe
  C:\Windows\System\gAyxwqu.exe
  2⤵
  PID:10388
- C:\Windows\System\QIgJOZY.exe
  C:\Windows\System\QIgJOZY.exe
  2⤵
  PID:10408
- C:\Windows\System\AFYDOsu.exe
  C:\Windows\System\AFYDOsu.exe
  2⤵
  PID:10428
- C:\Windows\System\fSkAxDs.exe
  C:\Windows\System\fSkAxDs.exe
  2⤵
  PID:10452
- C:\Windows\System\AEQzUzd.exe
  C:\Windows\System\AEQzUzd.exe
  2⤵
  PID:10472
- C:\Windows\System\HIOPYJG.exe
  C:\Windows\System\HIOPYJG.exe
  2⤵
  PID:10500
- C:\Windows\System\MbiajlN.exe
  C:\Windows\System\MbiajlN.exe
  2⤵
  PID:10520
- C:\Windows\System\zqQlAsY.exe
  C:\Windows\System\zqQlAsY.exe
  2⤵
  PID:10548
- C:\Windows\System\gpFwKEN.exe
  C:\Windows\System\gpFwKEN.exe
  2⤵
  PID:10568
- C:\Windows\System\oOZWjWh.exe
  C:\Windows\System\oOZWjWh.exe
  2⤵
  PID:10588
- C:\Windows\System\qatoEWC.exe
  C:\Windows\System\qatoEWC.exe
  2⤵
  PID:10608
- C:\Windows\System\TcbgaFG.exe
  C:\Windows\System\TcbgaFG.exe
  2⤵
  PID:10628
- C:\Windows\System\vGitubc.exe
  C:\Windows\System\vGitubc.exe
  2⤵
  PID:10656
- C:\Windows\System\kZdJvfZ.exe
  C:\Windows\System\kZdJvfZ.exe
  2⤵
  PID:10684
- C:\Windows\System\TYiWSNT.exe
  C:\Windows\System\TYiWSNT.exe
  2⤵
  PID:10708
- C:\Windows\System\WVtABpr.exe
  C:\Windows\System\WVtABpr.exe
  2⤵
  PID:10724
- C:\Windows\System\XainBZT.exe
  C:\Windows\System\XainBZT.exe
  2⤵
  PID:10752
- C:\Windows\System\nRqIXPg.exe
  C:\Windows\System\nRqIXPg.exe
  2⤵
  PID:10768
- C:\Windows\System\uAjDJzZ.exe
  C:\Windows\System\uAjDJzZ.exe
  2⤵
  PID:10788
- C:\Windows\System\nULavFe.exe
  C:\Windows\System\nULavFe.exe
  2⤵
  PID:10804
- C:\Windows\System\wZdpqVH.exe
  C:\Windows\System\wZdpqVH.exe
  2⤵
  PID:10820
- C:\Windows\System\quFuGSM.exe
  C:\Windows\System\quFuGSM.exe
  2⤵
  PID:10836
- C:\Windows\System\mEvjXmB.exe
  C:\Windows\System\mEvjXmB.exe
  2⤵
  PID:10852
- C:\Windows\System\fmQaYTq.exe
  C:\Windows\System\fmQaYTq.exe
  2⤵
  PID:10880
- C:\Windows\System\HVLcXKA.exe
  C:\Windows\System\HVLcXKA.exe
  2⤵
  PID:10904
- C:\Windows\System\vtsrzhg.exe
  C:\Windows\System\vtsrzhg.exe
  2⤵
  PID:10924
- C:\Windows\System\JGzoWXx.exe
  C:\Windows\System\JGzoWXx.exe
  2⤵
  PID:10940
- C:\Windows\System\BFwyihQ.exe
  C:\Windows\System\BFwyihQ.exe
  2⤵
  PID:10960
- C:\Windows\System\hefPaKF.exe
  C:\Windows\System\hefPaKF.exe
  2⤵
  PID:10988
- C:\Windows\System\TsPZFRZ.exe
  C:\Windows\System\TsPZFRZ.exe
  2⤵
  PID:11012
- C:\Windows\System\FIdECqc.exe
  C:\Windows\System\FIdECqc.exe
  2⤵
  PID:11032
- C:\Windows\System\zVaZLUf.exe
  C:\Windows\System\zVaZLUf.exe
  2⤵
  PID:11052
- C:\Windows\System\ovTNoSq.exe
  C:\Windows\System\ovTNoSq.exe
  2⤵
  PID:11076
- C:\Windows\System\oqjZSQd.exe
  C:\Windows\System\oqjZSQd.exe
  2⤵
  PID:11100
- C:\Windows\System\TTJMtiy.exe
  C:\Windows\System\TTJMtiy.exe
  2⤵
  PID:11128
- C:\Windows\System\tMtpsfI.exe
  C:\Windows\System\tMtpsfI.exe
  2⤵
  PID:11148
- C:\Windows\System\FHdVkHf.exe
  C:\Windows\System\FHdVkHf.exe
  2⤵
  PID:11168
- C:\Windows\System\luKLjWt.exe
  C:\Windows\System\luKLjWt.exe
  2⤵
  PID:11196
- C:\Windows\System\yiEYTJd.exe
  C:\Windows\System\yiEYTJd.exe
  2⤵
  PID:11216
- C:\Windows\System\DjlGAat.exe
  C:\Windows\System\DjlGAat.exe
  2⤵
  PID:11236
- C:\Windows\System\LOrxODi.exe
  C:\Windows\System\LOrxODi.exe
  2⤵
  PID:11260
- C:\Windows\System\xlHTric.exe
  C:\Windows\System\xlHTric.exe
  2⤵
  PID:6500
- C:\Windows\System\RbPfAAQ.exe
  C:\Windows\System\RbPfAAQ.exe
  2⤵
  PID:7736
- C:\Windows\System\nErrijV.exe
  C:\Windows\System\nErrijV.exe
  2⤵
  PID:9440
- C:\Windows\System\pqQlLuB.exe
  C:\Windows\System\pqQlLuB.exe
  2⤵
  PID:7832
- C:\Windows\System\taCeWaq.exe
  C:\Windows\System\taCeWaq.exe
  2⤵
  PID:9512
- C:\Windows\System\yMeypCx.exe
  C:\Windows\System\yMeypCx.exe
  2⤵
  PID:9596
- C:\Windows\System\oZbEjxD.exe
  C:\Windows\System\oZbEjxD.exe
  2⤵
  PID:7820
- C:\Windows\System\AJHCbCr.exe
  C:\Windows\System\AJHCbCr.exe
  2⤵
  PID:9672
- C:\Windows\System\llTWjZm.exe
  C:\Windows\System\llTWjZm.exe
  2⤵
  PID:8264
- C:\Windows\System\KQfneyn.exe
  C:\Windows\System\KQfneyn.exe
  2⤵
  PID:8996
- C:\Windows\System\qudagRy.exe
  C:\Windows\System\qudagRy.exe
  2⤵
  PID:9864
- C:\Windows\System\Pipmwfi.exe
  C:\Windows\System\Pipmwfi.exe
  2⤵
  PID:9988
- C:\Windows\System\KJRhlsi.exe
  C:\Windows\System\KJRhlsi.exe
  2⤵
  PID:5684
- C:\Windows\System\XDEnjps.exe
  C:\Windows\System\XDEnjps.exe
  2⤵
  PID:7368
- C:\Windows\System\pbYoaOm.exe
  C:\Windows\System\pbYoaOm.exe
  2⤵
  PID:7080
- C:\Windows\System\oTYNEtf.exe
  C:\Windows\System\oTYNEtf.exe
  2⤵
  PID:5848
- C:\Windows\System\fqlJTCZ.exe
  C:\Windows\System\fqlJTCZ.exe
  2⤵
  PID:11272
- C:\Windows\System\uQGmCjX.exe
  C:\Windows\System\uQGmCjX.exe
  2⤵
  PID:11292
- C:\Windows\System\ArOzJlI.exe
  C:\Windows\System\ArOzJlI.exe
  2⤵
  PID:11316
- C:\Windows\System\kysdlik.exe
  C:\Windows\System\kysdlik.exe
  2⤵
  PID:11340
- C:\Windows\System\lcAfDHd.exe
  C:\Windows\System\lcAfDHd.exe
  2⤵
  PID:11364
- C:\Windows\System\scIMlHD.exe
  C:\Windows\System\scIMlHD.exe
  2⤵
  PID:11380
- C:\Windows\System\FyqIORo.exe
  C:\Windows\System\FyqIORo.exe
  2⤵
  PID:11400
- C:\Windows\System\ifZlgMf.exe
  C:\Windows\System\ifZlgMf.exe
  2⤵
  PID:11420
- C:\Windows\System\jUFXkrb.exe
  C:\Windows\System\jUFXkrb.exe
  2⤵
  PID:11444
- C:\Windows\System\qIXKrmh.exe
  C:\Windows\System\qIXKrmh.exe
  2⤵
  PID:11464
- C:\Windows\System\AvKhuQr.exe
  C:\Windows\System\AvKhuQr.exe
  2⤵
  PID:11488
- C:\Windows\System\uGYZpYt.exe
  C:\Windows\System\uGYZpYt.exe
  2⤵
  PID:11508
- C:\Windows\System\idfkYdN.exe
  C:\Windows\System\idfkYdN.exe
  2⤵
  PID:11532
- C:\Windows\System\OyYnGWI.exe
  C:\Windows\System\OyYnGWI.exe
  2⤵
  PID:11552
- C:\Windows\System\mqFHKnZ.exe
  C:\Windows\System\mqFHKnZ.exe
  2⤵
  PID:11572
- C:\Windows\System\bqDjvAY.exe
  C:\Windows\System\bqDjvAY.exe
  2⤵
  PID:11596
- C:\Windows\System\xSuOvAo.exe
  C:\Windows\System\xSuOvAo.exe
  2⤵
  PID:11620
- C:\Windows\System\wxwfLYV.exe
  C:\Windows\System\wxwfLYV.exe
  2⤵
  PID:11644
- C:\Windows\System\dlEHaCv.exe
  C:\Windows\System\dlEHaCv.exe
  2⤵
  PID:11664
- C:\Windows\System\yfmdtjQ.exe
  C:\Windows\System\yfmdtjQ.exe
  2⤵
  PID:11692
- C:\Windows\System\MMCcWac.exe
  C:\Windows\System\MMCcWac.exe
  2⤵
  PID:11708
- C:\Windows\System\uwbBrfJ.exe
  C:\Windows\System\uwbBrfJ.exe
  2⤵
  PID:11724
- C:\Windows\System\iYmWooj.exe
  C:\Windows\System\iYmWooj.exe
  2⤵
  PID:11740
- C:\Windows\System\rPAAtKp.exe
  C:\Windows\System\rPAAtKp.exe
  2⤵
  PID:11760
- C:\Windows\System\lPmXWss.exe
  C:\Windows\System\lPmXWss.exe
  2⤵
  PID:11776
- C:\Windows\System\QEivQSG.exe
  C:\Windows\System\QEivQSG.exe
  2⤵
  PID:11792
- C:\Windows\System\YKKLrnY.exe
  C:\Windows\System\YKKLrnY.exe
  2⤵
  PID:11820
- C:\Windows\System\mppMREJ.exe
  C:\Windows\System\mppMREJ.exe
  2⤵
  PID:11840
- C:\Windows\System\cPMLUnU.exe
  C:\Windows\System\cPMLUnU.exe
  2⤵
  PID:11864
- C:\Windows\System\YAZOovk.exe
  C:\Windows\System\YAZOovk.exe
  2⤵
  PID:11888
- C:\Windows\System\cIaeMsC.exe
  C:\Windows\System\cIaeMsC.exe
  2⤵
  PID:11912
- C:\Windows\System\xdpOKJV.exe
  C:\Windows\System\xdpOKJV.exe
  2⤵
  PID:11928
- C:\Windows\System\MGCnbIS.exe
  C:\Windows\System\MGCnbIS.exe
  2⤵
  PID:11948
- C:\Windows\System\NeePOWl.exe
  C:\Windows\System\NeePOWl.exe
  2⤵
  PID:11972
- C:\Windows\System\REDuKQB.exe
  C:\Windows\System\REDuKQB.exe
  2⤵
  PID:11992
- C:\Windows\System\UxMZNdQ.exe
  C:\Windows\System\UxMZNdQ.exe
  2⤵
  PID:12016
- C:\Windows\System\knOjYIQ.exe
  C:\Windows\System\knOjYIQ.exe
  2⤵
  PID:12040
- C:\Windows\System\MSpYhvo.exe
  C:\Windows\System\MSpYhvo.exe
  2⤵
  PID:12068
- C:\Windows\System\pkJuVbH.exe
  C:\Windows\System\pkJuVbH.exe
  2⤵
  PID:12092
- C:\Windows\System\FbYZjLD.exe
  C:\Windows\System\FbYZjLD.exe
  2⤵
  PID:12116
- C:\Windows\System\iMPMzFU.exe
  C:\Windows\System\iMPMzFU.exe
  2⤵
  PID:12136
- C:\Windows\System\CvSyMxs.exe
  C:\Windows\System\CvSyMxs.exe
  2⤵
  PID:12160
- C:\Windows\System\mBDYuBc.exe
  C:\Windows\System\mBDYuBc.exe
  2⤵
  PID:12180
- C:\Windows\System\JaCWzOR.exe
  C:\Windows\System\JaCWzOR.exe
  2⤵
  PID:12200
- C:\Windows\System\bKGWgGs.exe
  C:\Windows\System\bKGWgGs.exe
  2⤵
  PID:12220
- C:\Windows\System\ufJBMNA.exe
  C:\Windows\System\ufJBMNA.exe
  2⤵
  PID:12240
- C:\Windows\System\NyKqlRm.exe
  C:\Windows\System\NyKqlRm.exe
  2⤵
  PID:12260
- C:\Windows\System\ezSLpUi.exe
  C:\Windows\System\ezSLpUi.exe
  2⤵
  PID:12280
- C:\Windows\System\StYeslg.exe
  C:\Windows\System\StYeslg.exe
  2⤵
  PID:5804
- C:\Windows\System\uUmYnyv.exe
  C:\Windows\System\uUmYnyv.exe
  2⤵
  PID:9148
- C:\Windows\System\HbySoDF.exe
  C:\Windows\System\HbySoDF.exe
  2⤵
  PID:7184
- C:\Windows\System\HZwKeWm.exe
  C:\Windows\System\HZwKeWm.exe
  2⤵
  PID:6184
- C:\Windows\System\BXtVGzn.exe
  C:\Windows\System\BXtVGzn.exe
  2⤵
  PID:6372
- C:\Windows\System\aHQOYAp.exe
  C:\Windows\System\aHQOYAp.exe
  2⤵
  PID:8548
- C:\Windows\System\dmqNnCW.exe
  C:\Windows\System\dmqNnCW.exe
  2⤵
  PID:9400
- C:\Windows\System\ODXkqiM.exe
  C:\Windows\System\ODXkqiM.exe
  2⤵
  PID:464
- C:\Windows\System\JNlFEsC.exe
  C:\Windows\System\JNlFEsC.exe
  2⤵
  PID:8644
- C:\Windows\System\JBgenrO.exe
  C:\Windows\System\JBgenrO.exe
  2⤵
  PID:8700
- C:\Windows\System\EAgymoa.exe
  C:\Windows\System\EAgymoa.exe
  2⤵
  PID:8752
- C:\Windows\System\SXislAb.exe
  C:\Windows\System\SXislAb.exe
  2⤵
  PID:8792
- C:\Windows\System\fxgHziL.exe
  C:\Windows\System\fxgHziL.exe
  2⤵
  PID:10508
- C:\Windows\System\HgNDbZS.exe
  C:\Windows\System\HgNDbZS.exe
  2⤵
  PID:8932
- C:\Windows\System\gQGminG.exe
  C:\Windows\System\gQGminG.exe
  2⤵
  PID:10636
- C:\Windows\System\iOmFwSx.exe
  C:\Windows\System\iOmFwSx.exe
  2⤵
  PID:9688
- C:\Windows\System\NGcQoLh.exe
  C:\Windows\System\NGcQoLh.exe
  2⤵
  PID:9732
- C:\Windows\System\qGgmWtb.exe
  C:\Windows\System\qGgmWtb.exe
  2⤵
  PID:4088
- C:\Windows\System\yYggULp.exe
  C:\Windows\System\yYggULp.exe
  2⤵
  PID:10816
- C:\Windows\System\WYJsUgY.exe
  C:\Windows\System\WYJsUgY.exe
  2⤵
  PID:10900
- C:\Windows\System\HcMpLcT.exe
  C:\Windows\System\HcMpLcT.exe
  2⤵
  PID:10952
- C:\Windows\System\KaxittF.exe
  C:\Windows\System\KaxittF.exe
  2⤵
  PID:11064
- C:\Windows\System\DSPMmCf.exe
  C:\Windows\System\DSPMmCf.exe
  2⤵
  PID:7704
- C:\Windows\System\MlFaaQm.exe
  C:\Windows\System\MlFaaQm.exe
  2⤵
  PID:10048
- C:\Windows\System\jPwCAeG.exe
  C:\Windows\System\jPwCAeG.exe
  2⤵
  PID:10072
- C:\Windows\System\vAugwrN.exe
  C:\Windows\System\vAugwrN.exe
  2⤵
  PID:5288
- C:\Windows\System\gzxLIqc.exe
  C:\Windows\System\gzxLIqc.exe
  2⤵
  PID:10124
- C:\Windows\System\SqHOThq.exe
  C:\Windows\System\SqHOThq.exe
  2⤵
  PID:12292
- C:\Windows\System\voqERti.exe
  C:\Windows\System\voqERti.exe
  2⤵
  PID:12320
- C:\Windows\System\gprvfFn.exe
  C:\Windows\System\gprvfFn.exe
  2⤵
  PID:12340
- C:\Windows\System\EHykrlK.exe
  C:\Windows\System\EHykrlK.exe
  2⤵
  PID:12360
- C:\Windows\System\beujDWe.exe
  C:\Windows\System\beujDWe.exe
  2⤵
  PID:12388
- C:\Windows\System\axYjyod.exe
  C:\Windows\System\axYjyod.exe
  2⤵
  PID:12408
- C:\Windows\System\IVHxFRQ.exe
  C:\Windows\System\IVHxFRQ.exe
  2⤵
  PID:12432
- C:\Windows\System\jxeWbVj.exe
  C:\Windows\System\jxeWbVj.exe
  2⤵
  PID:12448
- C:\Windows\System\bNGUlKh.exe
  C:\Windows\System\bNGUlKh.exe
  2⤵
  PID:12464
- C:\Windows\System\ueGakxc.exe
  C:\Windows\System\ueGakxc.exe
  2⤵
  PID:12480
- C:\Windows\System\arBzPCL.exe
  C:\Windows\System\arBzPCL.exe
  2⤵
  PID:12496
- C:\Windows\System\MOXTCis.exe
  C:\Windows\System\MOXTCis.exe
  2⤵
  PID:12512
- C:\Windows\System\IfOmUEN.exe
  C:\Windows\System\IfOmUEN.exe
  2⤵
  PID:12528
- C:\Windows\System\OISjWJn.exe
  C:\Windows\System\OISjWJn.exe
  2⤵
  PID:12552
- C:\Windows\System\YKMtzFA.exe
  C:\Windows\System\YKMtzFA.exe
  2⤵
  PID:12572
- C:\Windows\System\WcGJhPx.exe
  C:\Windows\System\WcGJhPx.exe
  2⤵
  PID:12596
- C:\Windows\System\iTMpxXU.exe
  C:\Windows\System\iTMpxXU.exe
  2⤵
  PID:12620
- C:\Windows\System\HriiFAu.exe
  C:\Windows\System\HriiFAu.exe
  2⤵
  PID:12644
- C:\Windows\System\meAOwDu.exe
  C:\Windows\System\meAOwDu.exe
  2⤵
  PID:12668
- C:\Windows\System\OIvsoVn.exe
  C:\Windows\System\OIvsoVn.exe
  2⤵
  PID:12692
- C:\Windows\System\PYTEczQ.exe
  C:\Windows\System\PYTEczQ.exe
  2⤵
  PID:12716
- C:\Windows\System\ePVMIeD.exe
  C:\Windows\System\ePVMIeD.exe
  2⤵
  PID:12732
- C:\Windows\System\wObwlAd.exe
  C:\Windows\System\wObwlAd.exe
  2⤵
  PID:12752
- C:\Windows\System\dPwzYmu.exe
  C:\Windows\System\dPwzYmu.exe
  2⤵
  PID:12776
- C:\Windows\System\qmQGXsc.exe
  C:\Windows\System\qmQGXsc.exe
  2⤵
  PID:12800
- C:\Windows\System\LwUYKKo.exe
  C:\Windows\System\LwUYKKo.exe
  2⤵
  PID:12816
- C:\Windows\System\GwbVmGb.exe
  C:\Windows\System\GwbVmGb.exe
  2⤵
  PID:12840
- C:\Windows\System\sITNsKB.exe
  C:\Windows\System\sITNsKB.exe
  2⤵
  PID:12864
- C:\Windows\System\hEDWUie.exe
  C:\Windows\System\hEDWUie.exe
  2⤵
  PID:12884
- C:\Windows\System\gbbalOE.exe
  C:\Windows\System\gbbalOE.exe
  2⤵
  PID:11924
- C:\Windows\System\aZLfUlQ.exe
  C:\Windows\System\aZLfUlQ.exe
  2⤵
  PID:6544
- C:\Windows\System\SuiOyrR.exe
  C:\Windows\System\SuiOyrR.exe
  2⤵
  PID:8880
- C:\Windows\System\Zmnzrkm.exe
  C:\Windows\System\Zmnzrkm.exe
  2⤵
  PID:12488
- C:\Windows\System\oxsORAi.exe
  C:\Windows\System\oxsORAi.exe
  2⤵
  PID:12524
- C:\Windows\System\ldILmyf.exe
  C:\Windows\System\ldILmyf.exe
  2⤵
  PID:12580
- C:\Windows\System\QkLruAE.exe
  C:\Windows\System\QkLruAE.exe
  2⤵
  PID:12616
- C:\Windows\System\lTfhkUm.exe
  C:\Windows\System\lTfhkUm.exe
  2⤵
  PID:9804
- C:\Windows\System\czHHOZZ.exe
  C:\Windows\System\czHHOZZ.exe
  2⤵
  PID:6996
- C:\Windows\System\SSJGNNv.exe
  C:\Windows\System\SSJGNNv.exe
  2⤵
  PID:11372
- C:\Windows\System\BpGAecs.exe
  C:\Windows\System\BpGAecs.exe
  2⤵
  PID:7528
- C:\Windows\System\oLEcPKa.exe
  C:\Windows\System\oLEcPKa.exe
  2⤵
  PID:13080
- C:\Windows\System\CKbUUnq.exe
  C:\Windows\System\CKbUUnq.exe
  2⤵
  PID:11984
- C:\Windows\System\EXDqHzy.exe
  C:\Windows\System\EXDqHzy.exe
  2⤵
  PID:13152
- C:\Windows\System\cdgcuYg.exe
  C:\Windows\System\cdgcuYg.exe
  2⤵
  PID:12064
- C:\Windows\System\aVVZFEs.exe
  C:\Windows\System\aVVZFEs.exe
  2⤵
  PID:13196
- C:\Windows\System\PLkZipA.exe
  C:\Windows\System\PLkZipA.exe
  2⤵
  PID:10800
- C:\Windows\System\ZIuzSge.exe
  C:\Windows\System\ZIuzSge.exe
  2⤵
  PID:8128
- C:\Windows\System\GwzjGkV.exe
  C:\Windows\System\GwzjGkV.exe
  2⤵
  PID:8552
- C:\Windows\System\nJFOwQg.exe
  C:\Windows\System\nJFOwQg.exe
  2⤵
  PID:10348
- C:\Windows\System\rmPbpKo.exe
  C:\Windows\System\rmPbpKo.exe
  2⤵
  PID:8492
- C:\Windows\System\TblqFdp.exe
  C:\Windows\System\TblqFdp.exe
  2⤵
  PID:8604
- C:\Windows\System\kPfVAQk.exe
  C:\Windows\System\kPfVAQk.exe
  2⤵
  PID:9552
- C:\Windows\System\SpMXEzI.exe
  C:\Windows\System\SpMXEzI.exe
  2⤵
  PID:10484
- C:\Windows\System\RtfjoPQ.exe
  C:\Windows\System\RtfjoPQ.exe
  2⤵
  PID:10620
- C:\Windows\System\VMeJDMC.exe
  C:\Windows\System\VMeJDMC.exe
  2⤵
  PID:11120
- C:\Windows\System\CkfOuCk.exe
  C:\Windows\System\CkfOuCk.exe
  2⤵
  PID:12308
- C:\Windows\System\UamlyzY.exe
  C:\Windows\System\UamlyzY.exe
  2⤵
  PID:12404
- C:\Windows\System\PkFYHTl.exe
  C:\Windows\System\PkFYHTl.exe
  2⤵
  PID:12540
- C:\Windows\System\IVUYkMt.exe
  C:\Windows\System\IVUYkMt.exe
  2⤵
  PID:12676
- C:\Windows\System\GjJchDX.exe
  C:\Windows\System\GjJchDX.exe
  2⤵
  PID:12724
- C:\Windows\System\uwJoJmd.exe
  C:\Windows\System\uwJoJmd.exe
  2⤵
  PID:12784
- C:\Windows\System\ZxGAKoa.exe
  C:\Windows\System\ZxGAKoa.exe
  2⤵
  PID:12832
- C:\Windows\System\xrIMObm.exe
  C:\Windows\System\xrIMObm.exe
  2⤵
  PID:12924
- C:\Windows\System\vmnSFNM.exe
  C:\Windows\System\vmnSFNM.exe
  2⤵
  PID:12964
- C:\Windows\System\xTciZUI.exe
  C:\Windows\System\xTciZUI.exe
  2⤵
  PID:13136
- C:\Windows\System\nRapFpm.exe
  C:\Windows\System\nRapFpm.exe
  2⤵
  PID:13048
- C:\Windows\System\RiOFVmH.exe
  C:\Windows\System\RiOFVmH.exe
  2⤵
  PID:13008
- C:\Windows\System\RYzeAIm.exe
  C:\Windows\System\RYzeAIm.exe
  2⤵
  PID:1336
- C:\Windows\System\bbLuVuc.exe
  C:\Windows\System\bbLuVuc.exe
  2⤵
  PID:1416
- C:\Windows\System\aDIaVld.exe
  C:\Windows\System\aDIaVld.exe
  2⤵
  PID:8360
- C:\Windows\System\RJtqfOz.exe
  C:\Windows\System\RJtqfOz.exe
  2⤵
  PID:7784
- C:\Windows\System\DZBfmJq.exe
  C:\Windows\System\DZBfmJq.exe
  2⤵
  PID:3476
- C:\Windows\System\lCNYPfD.exe
  C:\Windows\System\lCNYPfD.exe
  2⤵
  PID:11388
- C:\Windows\System\TgXSqPc.exe
  C:\Windows\System\TgXSqPc.exe
  2⤵
  PID:11700
- C:\Windows\System\ZFdxJuU.exe
  C:\Windows\System\ZFdxJuU.exe
  2⤵
  PID:11496
- C:\Windows\System\Exufqly.exe
  C:\Windows\System\Exufqly.exe
  2⤵
  PID:10424
- C:\Windows\System\oyjPJkw.exe
  C:\Windows\System\oyjPJkw.exe
  2⤵
  PID:11560
- C:\Windows\System\SdPAsLe.exe
  C:\Windows\System\SdPAsLe.exe
  2⤵
  PID:9396
- C:\Windows\System\SZupGsa.exe
  C:\Windows\System\SZupGsa.exe
  2⤵
  PID:5044
- C:\Windows\System\FKSIdGN.exe
  C:\Windows\System\FKSIdGN.exe
  2⤵
  PID:8984
- C:\Windows\System\THMbRWW.exe
  C:\Windows\System\THMbRWW.exe
  2⤵
  PID:7344
- C:\Windows\System\xShjfhQ.exe
  C:\Windows\System\xShjfhQ.exe
  2⤵
  PID:11456
- C:\Windows\System\OgizPDg.exe
  C:\Windows\System\OgizPDg.exe
  2⤵
  PID:11768
- C:\Windows\System\XRGqPIj.exe
  C:\Windows\System\XRGqPIj.exe
  2⤵
  PID:11548
- C:\Windows\System\DAsYbOM.exe
  C:\Windows\System\DAsYbOM.exe
  2⤵
  PID:10864
- C:\Windows\System\fyfdeCp.exe
  C:\Windows\System\fyfdeCp.exe
  2⤵
  PID:10672
- C:\Windows\System\paRGWyv.exe
  C:\Windows\System\paRGWyv.exe
  2⤵
  PID:11804
- C:\Windows\System\nvkPlkR.exe
  C:\Windows\System\nvkPlkR.exe
  2⤵
  PID:10760
- C:\Windows\System\EPGZtEl.exe
  C:\Windows\System\EPGZtEl.exe
  2⤵
  PID:11144
- C:\Windows\System\uQgFujj.exe
  C:\Windows\System\uQgFujj.exe
  2⤵
  PID:9572
- C:\Windows\System\AmzBwtx.exe
  C:\Windows\System\AmzBwtx.exe
  2⤵
  PID:11900
- C:\Windows\System\qAAeuMg.exe
  C:\Windows\System\qAAeuMg.exe
  2⤵
  PID:12508
- C:\Windows\System\EmENtOo.exe
  C:\Windows\System\EmENtOo.exe
  2⤵
  PID:11680
- C:\Windows\System\KWPaFbN.exe
  C:\Windows\System\KWPaFbN.exe
  2⤵
  PID:13064
- C:\Windows\System\YqfszqM.exe
  C:\Windows\System\YqfszqM.exe
  2⤵
  PID:7768
- C:\Windows\System\yFwXrCg.exe
  C:\Windows\System\yFwXrCg.exe
  2⤵
  PID:12236
- C:\Windows\System\joBJAnN.exe
  C:\Windows\System\joBJAnN.exe
  2⤵
  PID:11028
- C:\Windows\System\ysAQnNe.exe
  C:\Windows\System\ysAQnNe.exe
  2⤵
  PID:9080
- C:\Windows\System\xPRtTuC.exe
  C:\Windows\System\xPRtTuC.exe
  2⤵
  PID:11096
- C:\Windows\System\LUGOelL.exe
  C:\Windows\System\LUGOelL.exe
  2⤵
  PID:10732
- C:\Windows\System\STvmGtg.exe
  C:\Windows\System\STvmGtg.exe
  2⤵
  PID:9020
- C:\Windows\System\aTyWNKt.exe
  C:\Windows\System\aTyWNKt.exe
  2⤵
  PID:11252
- C:\Windows\System\MckvoiM.exe
  C:\Windows\System\MckvoiM.exe
  2⤵
  PID:12300
- C:\Windows\System\IRevgRs.exe
  C:\Windows\System\IRevgRs.exe
  2⤵
  PID:9984
- C:\Windows\System\bdrrTfg.exe
  C:\Windows\System\bdrrTfg.exe
  2⤵
  PID:12108
- C:\Windows\System\zwZkRWh.exe
  C:\Windows\System\zwZkRWh.exe
  2⤵
  PID:7960
- C:\Windows\System\fHNuLyD.exe
  C:\Windows\System\fHNuLyD.exe
  2⤵
  PID:10468
- C:\Windows\System\CxkkQHy.exe
  C:\Windows\System\CxkkQHy.exe
  2⤵
  PID:7716
- C:\Windows\System\iinpNYN.exe
  C:\Windows\System\iinpNYN.exe
  2⤵
  PID:12332
- C:\Windows\System\QSHLbrC.exe
  C:\Windows\System\QSHLbrC.exe
  2⤵
  PID:12352
- C:\Windows\System\EmyTxvx.exe
  C:\Windows\System\EmyTxvx.exe
  2⤵
  PID:12640
- C:\Windows\System\MwzHOUd.exe
  C:\Windows\System\MwzHOUd.exe
  2⤵
  PID:12748
- C:\Windows\System\DKmwGKK.exe
  C:\Windows\System\DKmwGKK.exe
  2⤵
  PID:12564
- C:\Windows\System\RLwsuiP.exe
  C:\Windows\System\RLwsuiP.exe
  2⤵
  PID:12604
- C:\Windows\System\fUTIVsz.exe
  C:\Windows\System\fUTIVsz.exe
  2⤵
  PID:12932
- C:\Windows\System\xoCubTH.exe
  C:\Windows\System\xoCubTH.exe
  2⤵
  PID:12812
- C:\Windows\System\gicgmKi.exe
  C:\Windows\System\gicgmKi.exe
  2⤵
  PID:10316
- C:\Windows\System\hggfLBg.exe
  C:\Windows\System\hggfLBg.exe
  2⤵
  PID:9304
- C:\Windows\System\ENMCeaL.exe
  C:\Windows\System\ENMCeaL.exe
  2⤵
  PID:11580
- C:\Windows\System\fzbKUXT.exe
  C:\Windows\System\fzbKUXT.exe
  2⤵
  PID:8088
- C:\Windows\System\BKpPXxn.exe
  C:\Windows\System\BKpPXxn.exe
  2⤵
  PID:12664
- C:\Windows\System\HlyotRh.exe
  C:\Windows\System\HlyotRh.exe
  2⤵
  PID:11964
- C:\Windows\System\cXUYeVS.exe
  C:\Windows\System\cXUYeVS.exe
  2⤵
  PID:9832
- C:\Windows\System\jFBBGYF.exe
  C:\Windows\System\jFBBGYF.exe
  2⤵
  PID:11904
- C:\Windows\System\GOUHjkh.exe
  C:\Windows\System\GOUHjkh.exe
  2⤵
  PID:13120
- C:\Windows\System\GcbuTou.exe
  C:\Windows\System\GcbuTou.exe
  2⤵
  PID:13348
- C:\Windows\System\oZyYfnz.exe
  C:\Windows\System\oZyYfnz.exe
  2⤵
  PID:13424
- C:\Windows\System\hZYMQje.exe
  C:\Windows\System\hZYMQje.exe
  2⤵
  PID:13532
- C:\Windows\System\GISoUWm.exe
  C:\Windows\System\GISoUWm.exe
  2⤵
  PID:13844
- C:\Windows\System\fsPepbD.exe
  C:\Windows\System\fsPepbD.exe
  2⤵
  PID:13908
- C:\Windows\System\fyyRrWl.exe
  C:\Windows\System\fyyRrWl.exe
  2⤵
  PID:13944
- C:\Windows\System\VPOQxoT.exe
  C:\Windows\System\VPOQxoT.exe
  2⤵
  PID:13960
- C:\Windows\System\JFbDeee.exe
  C:\Windows\System\JFbDeee.exe
  2⤵
  PID:13992
- C:\Windows\System\EXGufLW.exe
  C:\Windows\System\EXGufLW.exe
  2⤵
  PID:14016
- C:\Windows\System\BlSTgeR.exe
  C:\Windows\System\BlSTgeR.exe
  2⤵
  PID:14040
- C:\Windows\System\uducDyr.exe
  C:\Windows\System\uducDyr.exe
  2⤵
  PID:14064
- C:\Windows\System\qmYySDp.exe
  C:\Windows\System\qmYySDp.exe
  2⤵
  PID:14088
- C:\Windows\System\tKRilyi.exe
  C:\Windows\System\tKRilyi.exe
  2⤵
  PID:14112
- C:\Windows\System\LjdpDNO.exe
  C:\Windows\System\LjdpDNO.exe
  2⤵
  PID:14224
- C:\Windows\System\pkRTUxI.exe
  C:\Windows\System\pkRTUxI.exe
  2⤵
  PID:14260
- C:\Windows\System\buLpAfT.exe
  C:\Windows\System\buLpAfT.exe
  2⤵
  PID:14280
- C:\Windows\System\usOGvDm.exe
  C:\Windows\System\usOGvDm.exe
  2⤵
  PID:14296
- C:\Windows\System\TQHBxkS.exe
  C:\Windows\System\TQHBxkS.exe
  2⤵
  PID:14316
- C:\Windows\System\eTewcuK.exe
  C:\Windows\System\eTewcuK.exe
  2⤵
  PID:13096
- C:\Windows\System\qjKkEya.exe
  C:\Windows\System\qjKkEya.exe
  2⤵
  PID:7492
- C:\Windows\System\CHNevIq.exe
  C:\Windows\System\CHNevIq.exe
  2⤵
  PID:4900
- C:\Windows\System\TwjlAyi.exe
  C:\Windows\System\TwjlAyi.exe
  2⤵
  PID:11164
- C:\Windows\System\VfzUdHq.exe
  C:\Windows\System\VfzUdHq.exe
  2⤵
  PID:12444
- C:\Windows\System\LiGnXkD.exe
  C:\Windows\System\LiGnXkD.exe
  2⤵
  PID:11832
- C:\Windows\System\mlCaTzX.exe
  C:\Windows\System\mlCaTzX.exe
  2⤵
  PID:9124
- C:\Windows\System\URDHgBI.exe
  C:\Windows\System\URDHgBI.exe
  2⤵
  PID:8728
- C:\Windows\System\IMQJqPl.exe
  C:\Windows\System\IMQJqPl.exe
  2⤵
  PID:4316
- C:\Windows\System\HYLqNLW.exe
  C:\Windows\System\HYLqNLW.exe
  2⤵
  PID:12948
- C:\Windows\System\lihBXti.exe
  C:\Windows\System\lihBXti.exe
  2⤵
  PID:11612
- C:\Windows\System\ngrmKlO.exe
  C:\Windows\System\ngrmKlO.exe
  2⤵
  PID:10084
- C:\Windows\System\BTbPqny.exe
  C:\Windows\System\BTbPqny.exe
  2⤵
  PID:13644
- C:\Windows\System\JeLkicL.exe
  C:\Windows\System\JeLkicL.exe
  2⤵
  PID:13476
- C:\Windows\System\axCEQDz.exe
  C:\Windows\System\axCEQDz.exe
  2⤵
  PID:13660
- C:\Windows\System\ZKrpLGm.exe
  C:\Windows\System\ZKrpLGm.exe
  2⤵
  PID:13864
- C:\Windows\System\ikbMbUL.exe
  C:\Windows\System\ikbMbUL.exe
  2⤵
  PID:13672
- C:\Windows\System\MjCdhfP.exe
  C:\Windows\System\MjCdhfP.exe
  2⤵
  PID:13552
- C:\Windows\System\ftnoTJA.exe
  C:\Windows\System\ftnoTJA.exe
  2⤵
  PID:13608
- C:\Windows\System\ddFzAMH.exe
  C:\Windows\System\ddFzAMH.exe
  2⤵
  PID:10528
- C:\Windows\System\rLQpvki.exe
  C:\Windows\System\rLQpvki.exe
  2⤵
  PID:14248
- C:\Windows\System\CnawxCX.exe
  C:\Windows\System\CnawxCX.exe
  2⤵
  PID:10336
- C:\Windows\System\mfQHejb.exe
  C:\Windows\System\mfQHejb.exe
  2⤵
  PID:10676
- C:\Windows\System\XNeRnfx.exe
  C:\Windows\System\XNeRnfx.exe
  2⤵
  PID:8808
- C:\Windows\System\aHGWCet.exe
  C:\Windows\System\aHGWCet.exe
  2⤵
  PID:13724
- C:\Windows\System\czFJwdd.exe
  C:\Windows\System\czFJwdd.exe
  2⤵
  PID:13716
- C:\Windows\System\lYOYvRo.exe
  C:\Windows\System\lYOYvRo.exe
  2⤵
  PID:13620
- C:\Windows\System\SHTpUNu.exe
  C:\Windows\System\SHTpUNu.exe
  2⤵
  PID:12080
- C:\Windows\System\QcQuHBq.exe
  C:\Windows\System\QcQuHBq.exe
  2⤵
  PID:13744
- C:\Windows\System\yJvCjQv.exe
  C:\Windows\System\yJvCjQv.exe
  2⤵
  PID:13976
- C:\Windows\System\EvZYuZU.exe
  C:\Windows\System\EvZYuZU.exe
  2⤵
  PID:13764
- C:\Windows\System\gIRYzJq.exe
  C:\Windows\System\gIRYzJq.exe
  2⤵
  PID:13368
- C:\Windows\System\eKFZXmF.exe
  C:\Windows\System\eKFZXmF.exe
  2⤵
  PID:13732
- C:\Windows\System\dWmUNGb.exe
  C:\Windows\System\dWmUNGb.exe
  2⤵
  PID:14152
- C:\Windows\System\VfQTMqq.exe
  C:\Windows\System\VfQTMqq.exe
  2⤵
  PID:13556
- C:\Windows\System\GMrTZSf.exe
  C:\Windows\System\GMrTZSf.exe
  2⤵
  PID:13896
- C:\Windows\System\paOEDvK.exe
  C:\Windows\System\paOEDvK.exe
  2⤵
  PID:14304
- C:\Windows\System\kWnKsKX.exe
  C:\Windows\System\kWnKsKX.exe
  2⤵
  PID:13076
- C:\Windows\System\cPmaeob.exe
  C:\Windows\System\cPmaeob.exe
  2⤵
  PID:14188
- C:\Windows\System\vdLFNyJ.exe
  C:\Windows\System\vdLFNyJ.exe
  2⤵
  PID:13968
- C:\Windows\System\SMdOVwF.exe
  C:\Windows\System\SMdOVwF.exe
  2⤵
  PID:14036
- C:\Windows\System\wVzLNeX.exe
  C:\Windows\System\wVzLNeX.exe
  2⤵
  PID:13892
- C:\Windows\System\woWdbkO.exe
  C:\Windows\System\woWdbkO.exe
  2⤵
  PID:10848
- C:\Windows\System\zpGKynK.exe
  C:\Windows\System\zpGKynK.exe
  2⤵
  PID:14236
- C:\Windows\System\tPwpGMx.exe
  C:\Windows\System\tPwpGMx.exe
  2⤵
  PID:10812
- C:\Windows\System\FbxZqGK.exe
  C:\Windows\System\FbxZqGK.exe
  2⤵
  PID:13384
- C:\Windows\System\zWGuUro.exe
  C:\Windows\System\zWGuUro.exe
  2⤵
  PID:11528
- C:\Windows\System\LYvWKsy.exe
  C:\Windows\System\LYvWKsy.exe
  2⤵
  PID:11544
- C:\Windows\System\YoInaHc.exe
  C:\Windows\System\YoInaHc.exe
  2⤵
  PID:10280
- C:\Windows\System\ZxuYHeW.exe
  C:\Windows\System\ZxuYHeW.exe
  2⤵
  PID:13628
- C:\Windows\System\mIrzdUL.exe
  C:\Windows\System\mIrzdUL.exe
  2⤵
  PID:13656
- C:\Windows\System\hRpIOJq.exe
  C:\Windows\System\hRpIOJq.exe
  2⤵
  PID:13396
- C:\Windows\System\hEqmUqO.exe
  C:\Windows\System\hEqmUqO.exe
  2⤵
  PID:14232
- C:\Windows\System\bvoRplR.exe
  C:\Windows\System\bvoRplR.exe
  2⤵
  PID:8600
- C:\Windows\System\UskxETs.exe
  C:\Windows\System\UskxETs.exe
  2⤵
  PID:12836
- C:\Windows\System\YZdOffE.exe
  C:\Windows\System\YZdOffE.exe
  2⤵
  PID:14184
- C:\Windows\System\HSzPqsI.exe
  C:\Windows\System\HSzPqsI.exe
  2⤵
  PID:9920
- C:\Windows\System\TsbyeMv.exe
  C:\Windows\System\TsbyeMv.exe
  2⤵
  PID:14080
- C:\Windows\System\WSpbHAQ.exe
  C:\Windows\System\WSpbHAQ.exe
  2⤵
  PID:13796
- C:\Windows\System\knavmAD.exe
  C:\Windows\System\knavmAD.exe
  2⤵
  PID:11720
- C:\Windows\System\zmYYulZ.exe
  C:\Windows\System\zmYYulZ.exe
  2⤵
  PID:14256
- C:\Windows\System\dbfbrzC.exe
  C:\Windows\System\dbfbrzC.exe
  2⤵
  PID:12232
- C:\Windows\System\OUXGbIA.exe
  C:\Windows\System\OUXGbIA.exe
  2⤵
  PID:9172
- C:\Windows\System\OXzMnEZ.exe
  C:\Windows\System\OXzMnEZ.exe
  2⤵
  PID:8292
- C:\Windows\System\LLqkECS.exe
  C:\Windows\System\LLqkECS.exe
  2⤵
  PID:13760
- C:\Windows\System\koBDTZD.exe
  C:\Windows\System\koBDTZD.exe
  2⤵
  PID:14032
- C:\Windows\System\HtsEKgi.exe
  C:\Windows\System\HtsEKgi.exe
  2⤵
  PID:8388
- C:\Windows\System\VBTxiZi.exe
  C:\Windows\System\VBTxiZi.exe
  2⤵
  PID:14120
- C:\Windows\System\BfTbLQt.exe
  C:\Windows\System\BfTbLQt.exe
  2⤵
  PID:12636
- C:\Windows\System\VFpPUvN.exe
  C:\Windows\System\VFpPUvN.exe
  2⤵
  PID:11212
- C:\Windows\System\ILAGiDR.exe
  C:\Windows\System\ILAGiDR.exe
  2⤵
  PID:13412
- C:\Windows\System\oGOGEAe.exe
  C:\Windows\System\oGOGEAe.exe
  2⤵
  PID:1364
- C:\Windows\System\GpRYpDC.exe
  C:\Windows\System\GpRYpDC.exe
  2⤵
  PID:2008
- C:\Windows\System\fflXMoA.exe
  C:\Windows\System\fflXMoA.exe
  2⤵
  PID:4924
- C:\Windows\System\BiRkpru.exe
  C:\Windows\System\BiRkpru.exe
  2⤵
  PID:7468
- C:\Windows\System\YckdGUc.exe
  C:\Windows\System\YckdGUc.exe
  2⤵
  PID:1040
- C:\Windows\System\ihuHfkJ.exe
  C:\Windows\System\ihuHfkJ.exe
  2⤵
  PID:13972
- C:\Windows\System\axJXngD.exe
  C:\Windows\System\axJXngD.exe
  2⤵
  PID:2952
- C:\Windows\System\qaZQBEh.exe
  C:\Windows\System\qaZQBEh.exe
  2⤵
  PID:4180
- C:\Windows\System\AnudFxz.exe
  C:\Windows\System\AnudFxz.exe
  2⤵
  PID:1580
- C:\Windows\System\JfqRlDt.exe
  C:\Windows\System\JfqRlDt.exe
  2⤵
  PID:4820
- C:\Windows\System\chqnsXt.exe
  C:\Windows\System\chqnsXt.exe
  2⤵
  PID:316
- C:\Windows\System\pPhITBr.exe
  C:\Windows\System\pPhITBr.exe
  2⤵
  PID:13564
- C:\Windows\System\hLeXcIS.exe
  C:\Windows\System\hLeXcIS.exe
  2⤵
  PID:400
- C:\Windows\System\AKszpzo.exe
  C:\Windows\System\AKszpzo.exe
  2⤵
  PID:3840
- C:\Windows\System\bhBkTVa.exe
  C:\Windows\System\bhBkTVa.exe
  2⤵
  PID:2896
- C:\Windows\System\RrpYmPS.exe
  C:\Windows\System\RrpYmPS.exe
  2⤵
  PID:2532
- C:\Windows\System\QtisEnj.exe
  C:\Windows\System\QtisEnj.exe
  2⤵
  PID:12904
- C:\Windows\System\BGoawoG.exe
  C:\Windows\System\BGoawoG.exe
  2⤵
  PID:3972
- C:\Windows\System\UUTMIgC.exe
  C:\Windows\System\UUTMIgC.exe
  2⤵
  PID:4020
- C:\Windows\System\LfYojcq.exe
  C:\Windows\System\LfYojcq.exe
  2⤵
  PID:3672
- C:\Windows\System\QtnZqeL.exe
  C:\Windows\System\QtnZqeL.exe
  2⤵
  PID:3632
- C:\Windows\System\UtxAqph.exe
  C:\Windows\System\UtxAqph.exe
  2⤵
  PID:13100
- C:\Windows\System\ZfTyCAj.exe
  C:\Windows\System\ZfTyCAj.exe
  2⤵
  PID:13416
- C:\Windows\System\apZNQNa.exe
  C:\Windows\System\apZNQNa.exe
  2⤵
  PID:1592
- C:\Windows\System\XTyLSsx.exe
  C:\Windows\System\XTyLSsx.exe
  2⤵
  PID:7128
- C:\Windows\System\iZyoRth.exe
  C:\Windows\System\iZyoRth.exe
  2⤵
  PID:14240
- C:\Windows\System\wCkFUzn.exe
  C:\Windows\System\wCkFUzn.exe
  2⤵
  PID:3200
- C:\Windows\System\OCjOMNv.exe
  C:\Windows\System\OCjOMNv.exe
  2⤵
  PID:1104
- C:\Windows\System\tDjcmUs.exe
  C:\Windows\System\tDjcmUs.exe
  2⤵
  PID:1168
- C:\Windows\System\uKDqYKt.exe
  C:\Windows\System\uKDqYKt.exe
  2⤵
  PID:1540
- C:\Windows\System\ElVisJf.exe
  C:\Windows\System\ElVisJf.exe
  2⤵
  PID:3684
- C:\Windows\System\HcEmKov.exe
  C:\Windows\System\HcEmKov.exe
  2⤵
  PID:1588
- C:\Windows\System\FhjzCKB.exe
  C:\Windows\System\FhjzCKB.exe
  2⤵
  PID:13784
- C:\Windows\System\LHrxxdM.exe
  C:\Windows\System\LHrxxdM.exe
  2⤵
  PID:2584
- C:\Windows\System\WUIFveX.exe
  C:\Windows\System\WUIFveX.exe
  2⤵
  PID:4224
- C:\Windows\System\slXYwhw.exe
  C:\Windows\System\slXYwhw.exe
  2⤵
  PID:4188
- C:\Windows\System\wnyOoQd.exe
  C:\Windows\System\wnyOoQd.exe
  2⤵
  PID:14024
- C:\Windows\System\OHTmtyE.exe
  C:\Windows\System\OHTmtyE.exe
  2⤵
  PID:1868
- C:\Windows\System\OdZYyoo.exe
  C:\Windows\System\OdZYyoo.exe
  2⤵
  PID:856
- C:\Windows\System\EpLmypZ.exe
  C:\Windows\System\EpLmypZ.exe
  2⤵
  PID:3428
- C:\Windows\System\AUTVftF.exe
  C:\Windows\System\AUTVftF.exe
  2⤵
  PID:3408
- C:\Windows\System\KiefEFb.exe
  C:\Windows\System\KiefEFb.exe
  2⤵
  PID:1496
- C:\Windows\System\OevcnJS.exe
  C:\Windows\System\OevcnJS.exe
  2⤵
  PID:3568
- C:\Windows\System\hLKWDyT.exe
  C:\Windows\System\hLKWDyT.exe
  2⤵
  PID:3464
- C:\Windows\System\BLPSCWQ.exe
  C:\Windows\System\BLPSCWQ.exe
  2⤵
  PID:3856
- C:\Windows\System\NuqkxoF.exe
  C:\Windows\System\NuqkxoF.exe
  2⤵
  PID:5012
- C:\Windows\System\tnxkJpc.exe
  C:\Windows\System\tnxkJpc.exe
  2⤵
  PID:3820
- C:\Windows\System\oweVqmL.exe
  C:\Windows\System\oweVqmL.exe
  2⤵
  PID:14192
- C:\Windows\System\VETiKLA.exe
  C:\Windows\System\VETiKLA.exe
  2⤵
  PID:1012
- C:\Windows\System\nCTNpZr.exe
  C:\Windows\System\nCTNpZr.exe
  2⤵
  PID:4312
- C:\Windows\System\gntUfoO.exe
  C:\Windows\System\gntUfoO.exe
  2⤵
  PID:1928
- C:\Windows\System\rbJSTHS.exe
  C:\Windows\System\rbJSTHS.exe
  2⤵
  PID:3984
- C:\Windows\System\fXayYNT.exe
  C:\Windows\System\fXayYNT.exe
  2⤵
  PID:13692
- C:\Windows\System\YKLwOzW.exe
  C:\Windows\System\YKLwOzW.exe
  2⤵
  PID:380
- C:\Windows\System\WppOBkW.exe
  C:\Windows\System\WppOBkW.exe
  2⤵
  PID:4268
- C:\Windows\System\MxblSRp.exe
  C:\Windows\System\MxblSRp.exe
  2⤵
  PID:844
- C:\Windows\System\cmHcBSe.exe
  C:\Windows\System\cmHcBSe.exe
  2⤵
  PID:2148
- C:\Windows\System\vtFgcCL.exe
  C:\Windows\System\vtFgcCL.exe
  2⤵
  PID:10292
- C:\Windows\System\eKnXsyV.exe
  C:\Windows\System\eKnXsyV.exe
  2⤵
  PID:3876
- C:\Windows\System\BkGzqsu.exe
  C:\Windows\System\BkGzqsu.exe
  2⤵
  PID:3768
- C:\Windows\System\wMgQvuC.exe
  C:\Windows\System\wMgQvuC.exe
  2⤵
  PID:3488
- C:\Windows\System\SSKjJLf.exe
  C:\Windows\System\SSKjJLf.exe
  2⤵
  PID:5016
- C:\Windows\System\aeEuzSA.exe
  C:\Windows\System\aeEuzSA.exe
  2⤵
  PID:3044
- C:\Windows\System\eQsfsOX.exe
  C:\Windows\System\eQsfsOX.exe
  2⤵
  PID:1164
- C:\Windows\System\uZiTeMU.exe
  C:\Windows\System\uZiTeMU.exe
  2⤵
  PID:4680
- C:\Windows\System\KJJubNY.exe
  C:\Windows\System\KJJubNY.exe
  2⤵
  PID:932
- C:\Windows\System\nHwbJKt.exe
  C:\Windows\System\nHwbJKt.exe
  2⤵
  PID:3956
- C:\Windows\System\WMwdkpl.exe
  C:\Windows\System\WMwdkpl.exe
  2⤵
  PID:3240
- C:\Windows\System\OspwpRa.exe
  C:\Windows\System\OspwpRa.exe
  2⤵
  PID:624
- C:\Windows\System\SqCeEkI.exe
  C:\Windows\System\SqCeEkI.exe
  2⤵
  PID:2824
- C:\Windows\System\pUbIWMZ.exe
  C:\Windows\System\pUbIWMZ.exe
  2⤵
  PID:1292
- C:\Windows\System\JwdoaNA.exe
  C:\Windows\System\JwdoaNA.exe
  2⤵
  PID:3588
- C:\Windows\System\mZfjgZK.exe
  C:\Windows\System\mZfjgZK.exe
  2⤵
  PID:10232
- C:\Windows\System\CHarLld.exe
  C:\Windows\System\CHarLld.exe
  2⤵
  PID:720
- C:\Windows\System\OSfOTVJ.exe
  C:\Windows\System\OSfOTVJ.exe
  2⤵
  PID:384
- C:\Windows\System\eDGelpJ.exe
  C:\Windows\System\eDGelpJ.exe
  2⤵
  PID:3232
- C:\Windows\System\cuQhWoA.exe
  C:\Windows\System\cuQhWoA.exe
  2⤵
  PID:2140
- C:\Windows\System\mSJREGL.exe
  C:\Windows\System\mSJREGL.exe
  2⤵
  PID:4824
- C:\Windows\System\JLQTaOz.exe
  C:\Windows\System\JLQTaOz.exe
  2⤵
  PID:13372
- C:\Windows\System\rHFTjmi.exe
  C:\Windows\System\rHFTjmi.exe
  2⤵
  PID:540
- C:\Windows\System\nmPjMwZ.exe
  C:\Windows\System\nmPjMwZ.exe
  2⤵
  PID:3480
- C:\Windows\System\wGoCFCk.exe
  C:\Windows\System\wGoCFCk.exe
  2⤵
  PID:1816
- C:\Windows\System\PZRAfma.exe
  C:\Windows\System\PZRAfma.exe
  2⤵
  PID:5000
- C:\Windows\System\CzhQcTE.exe
  C:\Windows\System\CzhQcTE.exe
  2⤵
  PID:3212
- C:\Windows\System\izAWqPJ.exe
  C:\Windows\System\izAWqPJ.exe
  2⤵
  PID:3692
- C:\Windows\System\XCLjnkk.exe
  C:\Windows\System\XCLjnkk.exe
  2⤵
  PID:4696
- C:\Windows\System\mKAcIyK.exe
  C:\Windows\System\mKAcIyK.exe
  2⤵
  PID:1108
- C:\Windows\System\huCnHYL.exe
  C:\Windows\System\huCnHYL.exe
  2⤵
  PID:3372
- C:\Windows\System\HDGczpj.exe
  C:\Windows\System\HDGczpj.exe
  2⤵
  PID:5040
- C:\Windows\System\RPJGvvC.exe
  C:\Windows\System\RPJGvvC.exe
  2⤵
  PID:744
- C:\Windows\System\udihjln.exe
  C:\Windows\System\udihjln.exe
  2⤵
  PID:3648
- C:\Windows\System\lPttCSK.exe
  C:\Windows\System\lPttCSK.exe
  2⤵
  PID:4196
- C:\Windows\System\AZUbGfE.exe
  C:\Windows\System\AZUbGfE.exe
  2⤵
  PID:1784
- C:\Windows\System\yToaXJV.exe
  C:\Windows\System\yToaXJV.exe
  2⤵
  PID:2944
- C:\Windows\System\CNidPlL.exe
  C:\Windows\System\CNidPlL.exe
  2⤵
  PID:3800
- C:\Windows\System\WKkGhtm.exe
  C:\Windows\System\WKkGhtm.exe
  2⤵
  PID:4240
- C:\Windows\System\cRxFVNc.exe
  C:\Windows\System\cRxFVNc.exe
  2⤵
  PID:2572
- C:\Windows\System\fWaZEKc.exe
  C:\Windows\System\fWaZEKc.exe
  2⤵
  PID:4092
- C:\Windows\System\hXbHQHn.exe
  C:\Windows\System\hXbHQHn.exe
  2⤵
  PID:1176
- C:\Windows\System\SJfApPz.exe
  C:\Windows\System\SJfApPz.exe
  2⤵
  PID:3700
- C:\Windows\System\HRcYxxs.exe
  C:\Windows\System\HRcYxxs.exe
  2⤵
  PID:2956
- C:\Windows\System\mKYiMiA.exe
  C:\Windows\System\mKYiMiA.exe
  2⤵
  PID:11356
- C:\Windows\System\OcTMAUd.exe
  C:\Windows\System\OcTMAUd.exe
  2⤵
  PID:3888
- C:\Windows\System\zkcsYsZ.exe
  C:\Windows\System\zkcsYsZ.exe
  2⤵
  PID:3520
- C:\Windows\System\ZagzVIS.exe
  C:\Windows\System\ZagzVIS.exe
  2⤵
  PID:3916
- C:\Windows\System\HKOZsGI.exe
  C:\Windows\System\HKOZsGI.exe
  2⤵
  PID:792
- C:\Windows\System\BBhhxrC.exe
  C:\Windows\System\BBhhxrC.exe
  2⤵
  PID:3912
- C:\Windows\System\WofhQbi.exe
  C:\Windows\System\WofhQbi.exe
  2⤵
  PID:3492
- C:\Windows\System\RmzmhBu.exe
  C:\Windows\System\RmzmhBu.exe
  2⤵
  PID:3248
- C:\Windows\System\WaQGUFy.exe
  C:\Windows\System\WaQGUFy.exe
  2⤵
  PID:3748
- C:\Windows\System\sBeTXxm.exe
  C:\Windows\System\sBeTXxm.exe
  2⤵
  PID:3808
- C:\Windows\System\cftXrjs.exe
  C:\Windows\System\cftXrjs.exe
  2⤵
  PID:4028
- C:\Windows\System\LowXPJD.exe
  C:\Windows\System\LowXPJD.exe
  2⤵
  PID:2656
- C:\Windows\System\rGGwijI.exe
  C:\Windows\System\rGGwijI.exe
  2⤵
  PID:3852
- C:\Windows\System\kiCdPdF.exe
  C:\Windows\System\kiCdPdF.exe
  2⤵
  PID:3496
- C:\Windows\System\YezKGgZ.exe
  C:\Windows\System\YezKGgZ.exe
  2⤵
  PID:1368
- C:\Windows\System\ZJMzepo.exe
  C:\Windows\System\ZJMzepo.exe
  2⤵
  PID:4644
- C:\Windows\System\ksuHlRW.exe
  C:\Windows\System\ksuHlRW.exe
  2⤵
  PID:12048
- C:\Windows\System\qRYCXQV.exe
  C:\Windows\System\qRYCXQV.exe
  2⤵
  PID:852
- C:\Windows\System\LVIWQcb.exe
  C:\Windows\System\LVIWQcb.exe
  2⤵
  PID:976
- C:\Windows\System\OhUTTRD.exe
  C:\Windows\System\OhUTTRD.exe
  2⤵
  PID:4084
- C:\Windows\System\zhIYvEs.exe
  C:\Windows\System\zhIYvEs.exe
  2⤵
  PID:13016
- C:\Windows\System\FsXFHVi.exe
  C:\Windows\System\FsXFHVi.exe
  2⤵
  PID:3500
- C:\Windows\System\lpKWjSc.exe
  C:\Windows\System\lpKWjSc.exe
  2⤵
  PID:1240
- C:\Windows\System\jcJQWJZ.exe
  C:\Windows\System\jcJQWJZ.exe
  2⤵
  PID:5072
- C:\Windows\System\PENWyrb.exe
  C:\Windows\System\PENWyrb.exe
  2⤵
  PID:8064
- C:\Windows\System\cMTBjvF.exe
  C:\Windows\System\cMTBjvF.exe
  2⤵
  PID:14060
- C:\Windows\System\aKbLzYH.exe
  C:\Windows\System\aKbLzYH.exe
  2⤵
  PID:7620
- C:\Windows\System\HbZwdPJ.exe
  C:\Windows\System\HbZwdPJ.exe
  2⤵
  PID:4796
- C:\Windows\System\xRBrmDK.exe
  C:\Windows\System\xRBrmDK.exe
  2⤵
  PID:14352
- C:\Windows\System\IQUsDDy.exe
  C:\Windows\System\IQUsDDy.exe
  2⤵
  PID:14372
- C:\Windows\System\KZqpOGm.exe
  C:\Windows\System\KZqpOGm.exe
  2⤵
  PID:14396
- C:\Windows\System\ZpiDOGN.exe
  C:\Windows\System\ZpiDOGN.exe
  2⤵
  PID:14424
- C:\Windows\System\dvBgivw.exe
  C:\Windows\System\dvBgivw.exe
  2⤵
  PID:14456
- C:\Windows\System\QrezyCz.exe
  C:\Windows\System\QrezyCz.exe
  2⤵
  PID:14480
- C:\Windows\System\sdXASrf.exe
  C:\Windows\System\sdXASrf.exe
  2⤵
  PID:14508
- C:\Windows\System\xILNcTk.exe
  C:\Windows\System\xILNcTk.exe
  2⤵
  PID:14528
- C:\Windows\System\fMVCPkq.exe
  C:\Windows\System\fMVCPkq.exe
  2⤵
  PID:14548
- C:\Windows\System\GkDJegX.exe
  C:\Windows\System\GkDJegX.exe
  2⤵
  PID:14568
- C:\Windows\System\wSnsddo.exe
  C:\Windows\System\wSnsddo.exe
  2⤵
  PID:14588
- C:\Windows\System\RlbgnMx.exe
  C:\Windows\System\RlbgnMx.exe
  2⤵
  PID:14612
- C:\Windows\System\INsyguG.exe
  C:\Windows\System\INsyguG.exe
  2⤵
  PID:14636
- C:\Windows\System\HZVeXJa.exe
  C:\Windows\System\HZVeXJa.exe
  2⤵
  PID:14660
- C:\Windows\System\TywASLP.exe
  C:\Windows\System\TywASLP.exe
  2⤵
  PID:14676
- C:\Windows\System\pRJFROB.exe
  C:\Windows\System\pRJFROB.exe
  2⤵
  PID:14696
- C:\Windows\System\QSTGmFV.exe
  C:\Windows\System\QSTGmFV.exe
  2⤵
  PID:14720
- C:\Windows\System\nydNAVI.exe
  C:\Windows\System\nydNAVI.exe
  2⤵
  PID:14756
- C:\Windows\System\jhHNlLx.exe
  C:\Windows\System\jhHNlLx.exe
  2⤵
  PID:14788
- C:\Windows\System\PIQRGbM.exe
  C:\Windows\System\PIQRGbM.exe
  2⤵
  PID:14820
- C:\Windows\System\USLPQIZ.exe
  C:\Windows\System\USLPQIZ.exe
  2⤵
  PID:14844
- C:\Windows\System\NrHuQxI.exe
  C:\Windows\System\NrHuQxI.exe
  2⤵
  PID:14864
- C:\Windows\System\XDMYjdb.exe
  C:\Windows\System\XDMYjdb.exe
  2⤵
  PID:14884
- C:\Windows\System\cIGIKTV.exe
  C:\Windows\System\cIGIKTV.exe
  2⤵
  PID:14900
- C:\Windows\System\MwLCqUH.exe
  C:\Windows\System\MwLCqUH.exe
  2⤵
  PID:14920
- C:\Windows\System\QyhgEFI.exe
  C:\Windows\System\QyhgEFI.exe
  2⤵
  PID:14940
- C:\Windows\System\peMAQYw.exe
  C:\Windows\System\peMAQYw.exe
  2⤵
  PID:14956
- C:\Windows\System\UtYLjvL.exe
  C:\Windows\System\UtYLjvL.exe
  2⤵
  PID:14988
- C:\Windows\System\tagurzX.exe
  C:\Windows\System\tagurzX.exe
  2⤵
  PID:15024
- C:\Windows\System\XoiWunS.exe
  C:\Windows\System\XoiWunS.exe
  2⤵
  PID:15056
- C:\Windows\System\EUbSrcO.exe
  C:\Windows\System\EUbSrcO.exe
  2⤵
  PID:15160
- C:\Windows\System\xGzuaYw.exe
  C:\Windows\System\xGzuaYw.exe
  2⤵
  PID:15240
- C:\Windows\System\PnReqAS.exe
  C:\Windows\System\PnReqAS.exe
  2⤵
  PID:15256
- C:\Windows\System\ieRWiiX.exe
  C:\Windows\System\ieRWiiX.exe
  2⤵
  PID:15348
- C:\Windows\System\szKpjpG.exe
  C:\Windows\System\szKpjpG.exe
  2⤵
  PID:2704
- C:\Windows\System\xUadixh.exe
  C:\Windows\System\xUadixh.exe
  2⤵
  PID:3732
- C:\Windows\System\FVmbaBQ.exe
  C:\Windows\System\FVmbaBQ.exe
  2⤵
  PID:4364
- C:\Windows\System\KJdLdNL.exe
  C:\Windows\System\KJdLdNL.exe
  2⤵
  PID:14348
- C:\Windows\System\djMrhdP.exe
  C:\Windows\System\djMrhdP.exe
  2⤵
  PID:3332
- C:\Windows\System\urNHQMG.exe
  C:\Windows\System\urNHQMG.exe
  2⤵
  PID:2512
- C:\Windows\System\URzSBkU.exe
  C:\Windows\System\URzSBkU.exe
  2⤵
  PID:14360
- C:\Windows\System\DTlObLd.exe
  C:\Windows\System\DTlObLd.exe
  2⤵
  PID:14540
- C:\Windows\System\pCSCROx.exe
  C:\Windows\System\pCSCROx.exe
  2⤵
  PID:14472
- C:\Windows\System\vsOqVKN.exe
  C:\Windows\System\vsOqVKN.exe
  2⤵
  PID:14420
- C:\Windows\System\SLAIHPP.exe
  C:\Windows\System\SLAIHPP.exe
  2⤵
  PID:14520
- C:\Windows\System\ZUjYriP.exe
  C:\Windows\System\ZUjYriP.exe
  2⤵
  PID:14608
- C:\Windows\System\xmMwxau.exe
  C:\Windows\System\xmMwxau.exe
  2⤵
  PID:14584
- C:\Windows\System\NidFBvL.exe
  C:\Windows\System\NidFBvL.exe
  2⤵
  PID:14652
- C:\Windows\System\oyARuWW.exe
  C:\Windows\System\oyARuWW.exe
  2⤵
  PID:14768
- C:\Windows\System\oBAsEri.exe
  C:\Windows\System\oBAsEri.exe
  2⤵
  PID:14808
- C:\Windows\System\IRepaOD.exe
  C:\Windows\System\IRepaOD.exe
  2⤵
  PID:14856
- C:\Windows\System\BoeRqsi.exe
  C:\Windows\System\BoeRqsi.exe
  2⤵
  PID:14880
- C:\Windows\System\ZKBXcJj.exe
  C:\Windows\System\ZKBXcJj.exe
  2⤵
  PID:14964
- C:\Windows\System\VZeofqD.exe
  C:\Windows\System\VZeofqD.exe
  2⤵
  PID:14916
- C:\Windows\System\ZIUJoLq.exe
  C:\Windows\System\ZIUJoLq.exe
  2⤵
  PID:14852
- C:\Windows\System\WCRtIdn.exe
  C:\Windows\System\WCRtIdn.exe
  2⤵
  PID:15032
- C:\Windows\System\dsMVuMU.exe
  C:\Windows\System\dsMVuMU.exe
  2⤵
  PID:14972
- C:\Windows\System\FRmpCCU.exe
  C:\Windows\System\FRmpCCU.exe
  2⤵
  PID:15080
- C:\Windows\System\BLkZdRW.exe
  C:\Windows\System\BLkZdRW.exe
  2⤵
  PID:15092
- C:\Windows\System\NDdFuqZ.exe
  C:\Windows\System\NDdFuqZ.exe
  2⤵
  PID:15064
- C:\Windows\System\QcNHOaK.exe
  C:\Windows\System\QcNHOaK.exe
  2⤵
  PID:15136
- C:\Windows\System\vxToqzi.exe
  C:\Windows\System\vxToqzi.exe
  2⤵
  PID:15188
- C:\Windows\System\ZYZfHkE.exe
  C:\Windows\System\ZYZfHkE.exe
  2⤵
  PID:15144
- C:\Windows\System\IwLovvS.exe
  C:\Windows\System\IwLovvS.exe
  2⤵
  PID:15216
- C:\Windows\System\aOAIqCd.exe
  C:\Windows\System\aOAIqCd.exe
  2⤵
  PID:15284
- C:\Windows\System\UhQlFZJ.exe
  C:\Windows\System\UhQlFZJ.exe
  2⤵
  PID:15156
- C:\Windows\System\GYmUruS.exe
  C:\Windows\System\GYmUruS.exe
  2⤵
  PID:15276
- C:\Windows\System\CWWzMJx.exe
  C:\Windows\System\CWWzMJx.exe
  2⤵
  PID:9176
- C:\Windows\System\oKScars.exe
  C:\Windows\System\oKScars.exe
  2⤵
  PID:2360
- C:\Windows\System\MrmSEPg.exe
  C:\Windows\System\MrmSEPg.exe
  2⤵
  PID:14496
- C:\Windows\System\eihGzjV.exe
  C:\Windows\System\eihGzjV.exe
  2⤵
  PID:15320
- C:\Windows\System\MyuqmEe.exe
  C:\Windows\System\MyuqmEe.exe
  2⤵
  PID:14468
- C:\Windows\System\mtTWAld.exe
  C:\Windows\System\mtTWAld.exe
  2⤵
  PID:14504
- C:\Windows\System\OWbaGFP.exe
  C:\Windows\System\OWbaGFP.exe
  2⤵
  PID:3080
- C:\Windows\System\IXdZYcK.exe
  C:\Windows\System\IXdZYcK.exe
  2⤵
  PID:14644
- C:\Windows\System\QHtIlyl.exe
  C:\Windows\System\QHtIlyl.exe
  2⤵
  PID:14368
- C:\Windows\System\UrQJTJt.exe
  C:\Windows\System\UrQJTJt.exe
  2⤵
  PID:14560
- C:\Windows\System\CWXFibl.exe
  C:\Windows\System\CWXFibl.exe
  2⤵
  PID:14908
- C:\Windows\System\qqICabR.exe
  C:\Windows\System\qqICabR.exe
  2⤵
  PID:14748
- C:\Windows\System\LNxiAEN.exe
  C:\Windows\System\LNxiAEN.exe
  2⤵
  PID:15004
- C:\Windows\System\zuBTwGz.exe
  C:\Windows\System\zuBTwGz.exe
  2⤵
  PID:14832
- C:\Windows\System\SjpCtKc.exe
  C:\Windows\System\SjpCtKc.exe
  2⤵
  PID:14728
- C:\Windows\System\SirGVcJ.exe
  C:\Windows\System\SirGVcJ.exe
  2⤵
  PID:15044
- C:\Windows\System\DNwmrtF.exe
  C:\Windows\System\DNwmrtF.exe
  2⤵
  PID:15000
- C:\Windows\System\STITMZS.exe
  C:\Windows\System\STITMZS.exe
  2⤵
  PID:15088
- C:\Windows\System\ceosywa.exe
  C:\Windows\System\ceosywa.exe
  2⤵
  PID:1924
- C:\Windows\System\QdaRHEg.exe
  C:\Windows\System\QdaRHEg.exe
  2⤵
  PID:15184
- C:\Windows\System\GLQzrkL.exe
  C:\Windows\System\GLQzrkL.exe
  2⤵
  PID:15236
- C:\Windows\System\qJaaCIe.exe
  C:\Windows\System\qJaaCIe.exe
  2⤵
  PID:3548
- C:\Windows\System\yHcEeMb.exe
  C:\Windows\System\yHcEeMb.exe
  2⤵
  PID:4184
- C:\Windows\System\tsxpYLi.exe
  C:\Windows\System\tsxpYLi.exe
  2⤵
  PID:1640
- C:\Windows\System\bEDtWlE.exe
  C:\Windows\System\bEDtWlE.exe
  2⤵
  PID:3892
- C:\Windows\System\snVazoY.exe
  C:\Windows\System\snVazoY.exe
  2⤵
  PID:2632
- C:\Windows\System\wKDCsql.exe
  C:\Windows\System\wKDCsql.exe
  2⤵
  PID:15296
- C:\Windows\System\cOFPthI.exe
  C:\Windows\System\cOFPthI.exe
  2⤵
  PID:14752
- C:\Windows\System\vdEOZTp.exe
  C:\Windows\System\vdEOZTp.exe
  2⤵
  PID:14388
- C:\Windows\System\NEsFYhS.exe
  C:\Windows\System\NEsFYhS.exe
  2⤵
  PID:15356
- C:\Windows\System\ddLicAF.exe
  C:\Windows\System\ddLicAF.exe
  2⤵
  PID:14448
- C:\Windows\System\DDPVbsU.exe
  C:\Windows\System\DDPVbsU.exe
  2⤵
  PID:14564
- C:\Windows\System\NWoYwvE.exe
  C:\Windows\System\NWoYwvE.exe
  2⤵
  PID:14688
- C:\Windows\System\UPWrUgE.exe
  C:\Windows\System\UPWrUgE.exe
  2⤵
  PID:14948
- C:\Windows\System\OBpZgDc.exe
  C:\Windows\System\OBpZgDc.exe
  2⤵
  PID:14744
- C:\Windows\System\jaETuAP.exe
  C:\Windows\System\jaETuAP.exe
  2⤵
  PID:15068

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
PID:13416

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:1592

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fha2abxn.0wn.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ApqgiwN.exe

Filesize
2.0MB

MD5
c0d753844abc76ce8f1d904f7a6030a0

SHA1
e85a78f46a8a19f12114515cb2aff870628e9dac

SHA256
cc01a2f951c98a8777e815db388bd86490a95d6c15f32231d762fbb4b4a4db7c

SHA512
e12b979b39d4e130f8ec5da830f03ebc32010a2a8f184c08a632e1081d7f3caa015d897c85fd901e0362fc295e88f8edf4e4c7ee07cf01111d1f27e8234badde

Download Submit
C:\Windows\System\BDXhnON.exe

Filesize
2.0MB

MD5
b2b9a9914194920f3ca786bd92a8da75

SHA1
86bdd6e99b27052aaf74270bbbb60f2d5cad608a

SHA256
62f62f0ee39647f2b6bc966f8742e44aba9c77dc4cb2e3e987b8c04a3dd74d87

SHA512
0cfa0878174c4ef5c385f6b243ffde44c8b0eed8af64d37a1a1a8655df3f576c7655465b73bb868711b1adcb28c2b4dd75a3d81d1c9e8361b090f6f93c1a4f8f

Download Submit
C:\Windows\System\BYSStGQ.exe

Filesize
2.0MB

MD5
6c4bed2d5d48dcf991b3e5e3737c7ec4

SHA1
61946abfcca63ad889a58286d6faabc38b9e7b73

SHA256
8777f2044b5bd4eb5e084ff28a3f5ec59bfd85d22499cf3b831a1b96d0ba7739

SHA512
d72cdc1c2e9d9954b7394b7891822f92c82004606c80ddce6d161c8e0c18926ad30478a9c5932336160c0fa1255c84ac3626f2a0fe78615da25ea468624fa0cb

Download Submit
C:\Windows\System\CqThQZj.exe

Filesize
2.0MB

MD5
321d5366041ab7ccae6f5b6a2e424862

SHA1
4bc9f7c77a73a7eb40f9764cb375b93aea514bdd

SHA256
091997d2fa7adb04820ecdb5c33af989a75a72f55573321288826953a70d4ef4

SHA512
98d1450b05ddb9e883f260ddb8d6db1f5823155502aa45a373557885835103615f391e4368818dbf4987e96749e9a02eb3869a30e6521c5222bd5d440f5fc061

Download Submit
C:\Windows\System\DjeHhgx.exe

Filesize
2.0MB

MD5
c6cc752cfb9060a1a4a2d6c988f1d866

SHA1
1e44178c8ea5ef3b8ccf34ab3a0b1bb659abcdf1

SHA256
11b45d2db999e170410ecb318320c1c466ba4b99961b91df92e8ca0539934367

SHA512
32d52a073dbe281fa4121ae6a92c6dd47bf8e398e4e55390b9538eedba8f89593b3b1abbd7e4dc3f19c4818c1ef41d340c2378e8b41459a55d8334f8a17833f2

Download Submit
C:\Windows\System\ElbkluL.exe

Filesize
2.0MB

MD5
ba29f33641254884d5ee5e8a27b5cbc2

SHA1
0439a34d1a71e38a45400ba5a139bbfec4a11c98

SHA256
32cb6bea138ce48a0a779be9d21fa1daa8eef24588cb6f41250480ea6150c23b

SHA512
2d08f326c5d83896ad4499da4130a4e59124882019e4320c78069ba8deb1b3afb0281104f1f9dca638fe712fa30f9033860982ea94b781d28a41db302eafb727

Download Submit
C:\Windows\System\FZZWVOi.exe

Filesize
2.0MB

MD5
8d7ba66709418e46e4e791bdd715eac7

SHA1
b658d9b26cae213735bff566b141afa8dd1541c8

SHA256
66a39df5cda6fb7f96f16eee225b5b30b35e4d0c2793b757530e4b3f0a7a9692

SHA512
ea442d35cdeb619c060008acf9a7e2e9a46b77fe5b43556072bcceaf44eb5790266ca8a52c0e63a8d5d805a2a7f5b1326ed752abd4d041a7f457f08b6857f494

Download Submit
C:\Windows\System\FxwFtwe.exe

Filesize
2.0MB

MD5
36db54122efe341f5d9699233e85fb78

SHA1
ea7cd39aa0e85dbb0d39af042455e100758452e8

SHA256
65e4b0e55072b115c97373a8266195817a7a3dc6574bd02130f72a6ed285bbee

SHA512
d472b55ec3d30829a194689dfce5fafbc0e45234788f2b4cf5228a6811e9368ccdfb3ea58c54b257a29df9f0ae3c6c184bbe22b67fcef2e1f931d0356c7d2bde

Download Submit
C:\Windows\System\HcTwvpm.exe

Filesize
2.0MB

MD5
ea64c5079f9b3baece748c2c622a5abd

SHA1
e25f72db559981b1594a04d26d03f0dd84eabf20

SHA256
3fdbc048e483020329a45148df5ba856a28ba7e7f9d5524a5081f495cc67e62a

SHA512
2986a0eede314349d32b868070c9b27d54fcce49ef1978e0548df4d0e7b6e4237ab12914c879e159a9287a3caf373c06863957eab6b72e9b21d96c5cde7dc776

Download Submit
C:\Windows\System\HjMNIwN.exe

Filesize
2.0MB

MD5
140972fa5063ed140143f8a519de3549

SHA1
3bcae6b2ade62e8aef434d4dfe7d61ce7aee910f

SHA256
a1ab9f521f80a4f8f92fede92a88a4143a22acf501724a984041b8c86b78b547

SHA512
ed0ee6aff3802b996ad2f0d94e4c02e1e3c16ff39ae681eb1a25b580fb41a5b91fdc5bf49d98081dbba4823bac2360aee86952ca96d05dd56bbbbd9c2b8f890c

Download Submit
C:\Windows\System\JesAGBr.exe

Filesize
2.0MB

MD5
e3716fc332f0962f22c0230e136855fb

SHA1
a44eb216ff053d07039730848d3f7e81066b8c58

SHA256
b738219d9e59b19337b94deddfaf387d24e43c45e5df4286deb0e2c0aa8fd65d

SHA512
c8acc8bdfe2b3f031af0a110caf524def7c71681253dec35010ace4b0852f1437bb04288b0767ecb1b0939f227eeba6a0abe72e30338f49cb40688164deffc4a

Download Submit
C:\Windows\System\KRCjsDD.exe

Filesize
2.0MB

MD5
e9dc93c38f05e6bd9f8c0b8905f7ae9b

SHA1
51204be97db311d68a4396d1e681907e581706b0

SHA256
53f8bc525a0899cb54c367d606aff16115a515d6316be1524e887d0219a5c34b

SHA512
f6da3623d0cdf5ca2db33a524a3e76ed10098310d8fdcb41520683556ddbfc68b45f2bcd45c82400ab4324c303ca60bdda40f7404a5b9b9b2842d1beee5b7a4a

Download Submit
C:\Windows\System\KgONQkV.exe

Filesize
2.0MB

MD5
911205b3cbdd085b4fbf2025f09aa894

SHA1
9e308eb97172ac080b41306d26357655e9ca4031

SHA256
a0af1c91dcac666be3f7c11e9065f682cddee27b8632e81eb6487c8915526fb5

SHA512
db94af3836f5343f7e96c1c3553b777db7379e98d565b82922ec329f50306112b0e65a096d0f0d34d9bb1d58ba44ce356c8ae3b4df48ab034d4219b40c4a5211

Download Submit
C:\Windows\System\NIjXWpC.exe

Filesize
2.0MB

MD5
ca6e34d1b65f4d236adf3c1bd848132b

SHA1
338d4b42b20c661ed392f756c4a6ad7f3e40e7f5

SHA256
d53b31ceb28207807d95ea4eb87d51de00177fa649ec66cd26b6b8c73da769b1

SHA512
d32c8eccd4baac02e2e6e2a0a68e778e0cf27ba921b4486e33048909e9b3f0ea552b41ed2ea85efb3c3c0b2bdc02ff8728853c9a592ce0ec2431d3e1f0241ca2

Download Submit
C:\Windows\System\NpMVAmo.exe

Filesize
2.0MB

MD5
4ca9b7dc02bcf7b59e1dfc33f75e9735

SHA1
45571d86b4720b5a0a83e2b7b5a9b85a6478328c

SHA256
1db1f87f06070a0b01973032fd753ad657f401c60b708acf790c1c1f8b0f5491

SHA512
aabe2526b893e48dedb34d9e1be9e7e045cf59a60130c393df317fd2fec7b14f4bf3703e05425b53b706860ecb6aff31e5f9362e33987e436e525b6d5afcf96b

Download Submit
C:\Windows\System\PReOMbE.exe

Filesize
2.0MB

MD5
c7dd071d7457dca7113f01b7e0b84237

SHA1
6e2eac4815b4cd4cc8d312b31ecc4b007b57a843

SHA256
ec63081df603e9589a060d07ce39cff61d376d9cce3fd599d0c448f29428a6fa

SHA512
59933a7714103ef1cac472c613f8da4bbe27d2c0d1348c1e9fda4ba72a32c5a388efa5f95daae39a3f89394bf43def35daad9bbb138c648f800f1146b5e18c4e

Download Submit
C:\Windows\System\TXtXSmz.exe

Filesize
2.0MB

MD5
67cd28a840602eee7cb368ce892f853a

SHA1
6d47d2598ecae18ea3bd63def88be8eec4ec0b19

SHA256
147167f62c590862a71f26026d424b09b1e673d0529688928c6d1aa05f25b0a9

SHA512
5dd72a7505d026a015d0169da99840f8c2612fb7ac9f79b400cfce50cc54e41ee4a053a26d3e8eacaf824752bffb37e4a69ddc7ed1df06c5cc23e47996279c14

Download Submit
C:\Windows\System\TZdthAS.exe

Filesize
2.0MB

MD5
93a8f526928ec19933d21a720d9e19a9

SHA1
75210c51c68db7c63718afafdc3482ad85fccdf9

SHA256
7d71445e16526336c271e167788cb651a46ccb87ab9ec64233ff04701dbdd921

SHA512
538f745ee69f2017533b22afe967253637af41df8f0c6711b4d8ac006d010cc0bb1f43da20ed056a6ea7713371e243a56f13b03fa1814f8cc1d5d4eab5e9a1be

Download Submit
C:\Windows\System\UBEUupQ.exe

Filesize
2.0MB

MD5
eca11e91a6a562878d66c6d5adf9fd1d

SHA1
aef0cde9b279885ce568a86225d7f380580d553f

SHA256
29972f0b7fdda2248df385cdd41272ff98cb62cf675843ca092a84784c16f749

SHA512
673d19f7b76feb8d81ebaf142b2ea997725ad5cec0d4aa61297efaac144aece1f61ee52f204c1c6b7d42b3af13faa6a86fa30796ce2dc34aad0d53c47db37c7d

Download Submit
C:\Windows\System\VVMcNAc.exe

Filesize
2.0MB

MD5
f65f63a6c31fcba9c0bd489180071e37

SHA1
214addfe696838173944529a6c8700b44f1a5c71

SHA256
079c47b97a90fbb4a1174a96b3e41ec3ce971c9582303438b07b43362f733a9e

SHA512
2fc241cbab650cbd5531c6cef23c8a22a1ce13661b0dc9d51a347bb0186ca170c7048e1bb0924ec7088f6a41784f22cab476e6ff4ab2e05c6e9254c993c08b54

Download Submit
C:\Windows\System\WIkchYS.exe

Filesize
2.0MB

MD5
f521da13c6bfc8092f0a33a548310f7d

SHA1
097ee0b24275adaf3b273e80b51d9a47da8db784

SHA256
abfcd4f4d26fdf89e009d43afff2eee4390246591da0b5a6dd37a1da50df3ac1

SHA512
b62d391d7d5002642f3246ec2be8c65b61b654e3c621c3eb9d9389f41d5c5ff2c04a4c07f8660ccb08491223c764babdf3c04f1a61ade513aaf59d3bf50a1432

Download Submit
C:\Windows\System\bLwQOzV.exe

Filesize
8B

MD5
a8f2921c80c15a3d426e5fdff8a56196

SHA1
4dc21bf95e22427a9dafcd4930e81b62e77d5fda

SHA256
7e9bbeeba45dae16f8c444596ee4180d7313e899e46fa6263fde6904f32d92a1

SHA512
996666f646b1878ee129a778184f9520541ee458797b8bfaefed6e1f152a5436e0ff19d28744463b706ffe3e24e429f5af102aa1e7733dbeeb6210754c828802

Download Submit
C:\Windows\System\eHOFFaB.exe

Filesize
2.0MB

MD5
5e5e9f87dc5f5cd2d2f3aa49efc0e465

SHA1
6a3797ed7321906a5c1ecfc0c14dcb3e373d21ce

SHA256
a43f2ea2953355132f022e927175ad123193e7dd89923563664cc7e9350eb5fe

SHA512
2ebc661e2951bcfb97f76b6e621c64a1517289f34f7f5991dd341c84bec473960c09e3dde0d0c619d489e56c7aa3aeb63763bacf366ec0308330c04de9131c0e

Download Submit
C:\Windows\System\eafQYaQ.exe

Filesize
2.0MB

MD5
fd9d3f141924340a480e632d2cccfc39

SHA1
b7d6a0250e3cf99ff145e3312dcb6205f93f0e14

SHA256
ae63fec80e37fe945ad84a8b9b0f198c4bc8aa15bcc1298ee598c19eb7234fa3

SHA512
4102f65760390db4da9d641b9d6f8823342cf99f4ae3d8d8ae3a36fa94cc521cfe40e8ee48c8ee5491db51ba01ed21becd1d2bbf4dcb0814c9ed6530dc054121

Download Submit
C:\Windows\System\fgmGXVe.exe

Filesize
2.0MB

MD5
280ecd708a2c4958637260d9ff520acf

SHA1
b6cba9f04eec546a3128d2d3f6dbab9fd76afc45

SHA256
ae4eb469152fd4c9db1a03b59570ad5c3fd1385dcdb9762e5512e9386ac27c36

SHA512
9c032978729c62d0afe6da13e8285e968bed05ac269c6badfbffd1d041ece9970102ad0c1908a859d6c11d1198d38b2e7be4e263e6eefaec6ddc288380b7ffbf

Download Submit
C:\Windows\System\hNThDQl.exe

Filesize
2.0MB

MD5
4061e52b9e25e96820c23fc82774dca6

SHA1
2b5a33551d6d1400ed4854544648f6153f682ae8

SHA256
d7fc4e82535eb86dc8b16f6b0eee7ac23df90e0ea3f41b7e00f81f939be455d5

SHA512
66cf2ac8a60a0774739ce89f504b07780a240d7111d962fd994538d7de297644b399a5829d8dfb64707267089333a9ff2cd171380fe75f88835e414470c0c3af

Download Submit
C:\Windows\System\hRmETvu.exe

Filesize
2.0MB

MD5
b34f9153c9de47b6491001d300ced12f

SHA1
190625f0a9c3059c342896134395cc2c2cf084c0

SHA256
6601eb04ed880cab8641e35e2a6e4cd93914c13a325e7f4a9f7f094f12bc1cfd

SHA512
ec2d8535c4dc144efdf89be464387914aaf26015de1eb825b8d99f551537c83f044e8c05664595ad5b0892d915697dee26b155530e9007972543300fe8df6dd0

Download Submit
C:\Windows\System\idQPpaq.exe

Filesize
2.0MB

MD5
fdf30cfc6131b916121127812072d910

SHA1
1533f3fd23c2fb66eb05d5e9e7de204c5114cd4c

SHA256
224fcf1d1fa1e19aef0f8a7962697351a0a7eb12c4c3d1cb851ed8ad86591478

SHA512
33fc5a3efde57190f280a7d373fcee8a6fac0314f69224dd1acc3c75151cc7143abab4abbbc699feb263653ec58104aa169f0abe8c4ece556799eaabe8507209

Download Submit
C:\Windows\System\jDoUxEn.exe

Filesize
2.0MB

MD5
b16b2aca9a1237b4965c44012aaf9a3a

SHA1
f52d560ae17327b198f6efab87f028ccac5b428b

SHA256
e2c2308f8a353bbc4f87ed926aa203437fa7b65d0bc74cf921ae6420b2a64117

SHA512
0e2fefb3e452ca84687befb581cda0665c51e22568efc01be9b8aa17f067d121a4c4656cc36f44e46ea0d6ed2a2d1bc18ce9478ec91619ddb60d08afa7b171f5

Download Submit
C:\Windows\System\jdCFhnR.exe

Filesize
2.0MB

MD5
fb90c4a98ffbcdfe7ba60690819d0b33

SHA1
a152ed8beeec4c7fb694353f7329b8b08c209737

SHA256
a952cab309ee14b24005d053a097868d5f3d72d0beb291533f3c3d9f56bde573

SHA512
393852d63f2551ef9e8cc35b210c16a2164d209c38e4b7696734bdee3c6a84a39ac199d223f537635aec14b1a19331ad33e135b62cf72a837d9be05bc3ff0fcd

Download Submit
C:\Windows\System\oXFAoak.exe

Filesize
2.0MB

MD5
a4a7624f6dbc6cd2351c2c27d61af5a3

SHA1
5ed2e3a565257caf7e257a10386721fc77d4b5e0

SHA256
d2e22c53e0868615044681e5646cffd595971a39dbfdfa33e591ffef932c9bde

SHA512
3de87982f64640382c7afb3df66b4320584f6056bdd8e87bfcb2911c655b3f21b2416f46cab6bef79aeab64a52e55dd1c4be6c0a5c8beebe41f847fd6cc4c3bd

Download Submit
C:\Windows\System\pPdFGID.exe

Filesize
2.0MB

MD5
009c4a4668d21ffe8c3d86d3a909c216

SHA1
9c1c9d63437a7063bde9095ee9a085cfd7aa3b25

SHA256
c6d65b443fadfa5f71a5dfc93b8e6ec75536b8c5027b12c9e9fc77165013c136

SHA512
10fda8d27ff47eb240e0415506d8b9e99d335fbcd13329d70a0886a9bf81ace31f2ec5ad06e3336b1f4745b129daea1b71ea480a5bc8d575906a8e2fba79a723

Download Submit
C:\Windows\System\pxSKPzT.exe

Filesize
2.0MB

MD5
75565f2c8a71d1bdc7a1400f82b3726a

SHA1
e5b4e2025c564d2c2000831cfd31078eada10975

SHA256
26cae4a7e07a59be347bffa7a8bd82beae9b5584a2d68ba6d89d2b1b50ddbff1

SHA512
376853dbe0d87c1fdf0e8e188708438bd8e3911a44e25da5a0cc2d90739a57a47d453ef99f6a9ea4aa73bed2d553d6d08cdc2c7d54cc133a24f9ad7b169dc235

Download Submit
C:\Windows\System\qDDlvRF.exe

Filesize
2.0MB

MD5
992b06c8c7d1225eef948d00fe758845

SHA1
11dcb0925c39a0ce9b99f51fdd65a4aa47e46c51

SHA256
3a1fe84a3d07e174fdcf217e5ef303a3e4f21a490035abc5d0e2f2113e4d1b85

SHA512
56a7bc2231a8c34eca05ff8109f9bf13a44f3af790321d67abbe218366be7d7bdcf71597bf005bd47474735e2845ed350c5a201b7d0146b6bbb167c1456fd1f6

Download Submit
C:\Windows\System\uCeexpe.exe

Filesize
2.0MB

MD5
79b0382bed76d069e1c1732692bfcb25

SHA1
24e29e8046014b700f3b8bebcffac50385be106c

SHA256
ecf73c2fcb93875cc0cd1522fcf28582cd5af38de60310b5a672f9542c2ff440

SHA512
1cc575ae0630760fde2fb0e7b31095327e08cc740d0fa22f0efa98368e6c910acc7f7d9247cd0efe458501f93bda94c82360477e26900755c2e08d8257d3118c

Download Submit
C:\Windows\System\vWBXFjQ.exe

Filesize
2.0MB

MD5
fd355a1c3ebf469f0c4887672617e827

SHA1
b3aa75e0a1c695c238538010263edbd728f0b8e8

SHA256
1a3d3fa6db3a764c4afc2d9652563cb865250bf70a609979c538ea02a5ec3083

SHA512
6e5a3ce6782592a0d6ecd293a0d1ddbe70ee7035cb5515e80175e50e89974d7ee26ee7d0c4998ff15fe17c8a2889d7b77c2926ed1c55d85135e975f49ec1f368

Download Submit
C:\Windows\System\wnutenw.exe

Filesize
2.0MB

MD5
8227767ff382a3d8a8515a9281bcae31

SHA1
480f1df0a16b97afff5d061e0904915e7c8e7f30

SHA256
149e9e2d94f46b8c115bd1a5d397bc77b55283907818016fa3b20c376dc9aa17

SHA512
203ee5585ac2d30b46c66cf7ed03ac1bfd10bac7dbcf8d2144a05e504cec694f874fafba901b4c0281442a1fe5a894d592c36a21ed718b05b7098616b50b0a31

Download Submit
C:\Windows\System\yUNgiHm.exe

Filesize
2.0MB

MD5
e0ea3aff69df8fb0d6391f5e32515c93

SHA1
ec83c735d43db885b2b40222e85d3183298cbd17

SHA256
8787faeed8d29ad90c825e066e8d116ebcd0464e9a966dd19465010cf4436815

SHA512
afc2f644c76e9ba5cf136a6227b766b3bf91d15e1cf712bb2c75d4a1c1dad6e0491d053703114863594a761053d3d3cafe912b28a0df50de45bd6544099a38ac

Download Submit
C:\Windows\System\zwmmdIo.exe

Filesize
2.0MB

MD5
bcf695db0033031a82fc58b64fb13463

SHA1
31de37cfa4308ab1e631b20e60dd523e7629f61a

SHA256
b509a485b3b36e14732a16b812eaebc2874a49fe968f2b223514ae5806369cdd

SHA512
f35828440c77d04dbc82dea6393b202ff962901ae023147ba806f7e223c93ddd7440de94aef41a7975a8c44006c01134836e6f2c3e408ef6c767eabba4c6e21e

Download Submit
memory/60-146-0x00007FF7936D0000-0x00007FF793AC2000-memory.dmp

Filesize
3.9MB

Download
memory/60-4885-0x00007FF7936D0000-0x00007FF793AC2000-memory.dmp

Filesize
3.9MB

Download
memory/772-4951-0x00007FF768200000-0x00007FF7685F2000-memory.dmp

Filesize
3.9MB

Download
memory/772-357-0x00007FF768200000-0x00007FF7685F2000-memory.dmp

Filesize
3.9MB

Download
memory/828-5075-0x00007FF6A0920000-0x00007FF6A0D12000-memory.dmp

Filesize
3.9MB

Download
memory/828-255-0x00007FF6A0920000-0x00007FF6A0D12000-memory.dmp

Filesize
3.9MB

Download
memory/968-256-0x00007FF60A7D0000-0x00007FF60ABC2000-memory.dmp

Filesize
3.9MB

Download
memory/968-4947-0x00007FF60A7D0000-0x00007FF60ABC2000-memory.dmp

Filesize
3.9MB

Download
memory/1228-111-0x00007FF7060D0000-0x00007FF7064C2000-memory.dmp

Filesize
3.9MB

Download
memory/1228-4877-0x00007FF7060D0000-0x00007FF7064C2000-memory.dmp

Filesize
3.9MB

Download
memory/1400-106-0x00007FF7949A0000-0x00007FF794D92000-memory.dmp

Filesize
3.9MB

Download
memory/1408-237-0x00007FF611F50000-0x00007FF612342000-memory.dmp

Filesize
3.9MB

Download
memory/1408-4905-0x00007FF611F50000-0x00007FF612342000-memory.dmp

Filesize
3.9MB

Download
memory/2244-4875-0x00007FF6F3C60000-0x00007FF6F4052000-memory.dmp

Filesize
3.9MB

Download
memory/2244-1012-0x00007FF6F3C60000-0x00007FF6F4052000-memory.dmp

Filesize
3.9MB

Download
memory/2260-69-0x00007FF642860000-0x00007FF642C52000-memory.dmp

Filesize
3.9MB

Download
memory/2276-921-0x00007FF675B40000-0x00007FF675F32000-memory.dmp

Filesize
3.9MB

Download
memory/2484-266-0x0000024FEDB20000-0x0000024FEDB42000-memory.dmp

Filesize
136KB

Download
memory/2484-72-0x0000024FEB950000-0x0000024FEB960000-memory.dmp

Filesize
64KB

Download
memory/2484-71-0x0000024FEB950000-0x0000024FEB960000-memory.dmp

Filesize
64KB

Download
memory/2484-39-0x00007FFF7DB90000-0x00007FFF7E651000-memory.dmp

Filesize
10.8MB

Download
memory/2504-0-0x00007FF7A05E0000-0x00007FF7A09D2000-memory.dmp

Filesize
3.9MB

Download
memory/2504-6024-0x00007FF7A05E0000-0x00007FF7A09D2000-memory.dmp

Filesize
3.9MB

Download
memory/2504-1-0x0000021F7EEF0000-0x0000021F7EF00000-memory.dmp

Filesize
64KB

Download
memory/2720-4916-0x00007FF7F6AE0000-0x00007FF7F6ED2000-memory.dmp

Filesize
3.9MB

Download
memory/2720-254-0x00007FF7F6AE0000-0x00007FF7F6ED2000-memory.dmp

Filesize
3.9MB

Download
memory/2744-200-0x00007FF7B2A40000-0x00007FF7B2E32000-memory.dmp

Filesize
3.9MB

Download
memory/2744-4897-0x00007FF7B2A40000-0x00007FF7B2E32000-memory.dmp

Filesize
3.9MB

Download
memory/3256-4957-0x00007FF7DF2F0000-0x00007FF7DF6E2000-memory.dmp

Filesize
3.9MB

Download
memory/3256-480-0x00007FF7DF2F0000-0x00007FF7DF6E2000-memory.dmp

Filesize
3.9MB

Download
memory/3424-258-0x00007FF6C6610000-0x00007FF6C6A02000-memory.dmp

Filesize
3.9MB

Download
memory/3424-4934-0x00007FF6C6610000-0x00007FF6C6A02000-memory.dmp

Filesize
3.9MB

Download
memory/3544-5008-0x00007FF66BD00000-0x00007FF66C0F2000-memory.dmp

Filesize
3.9MB

Download
memory/3544-919-0x00007FF66BD00000-0x00007FF66C0F2000-memory.dmp

Filesize
3.9MB

Download
memory/4440-4908-0x00007FF7E8530000-0x00007FF7E8922000-memory.dmp

Filesize
3.9MB

Download
memory/4440-257-0x00007FF7E8530000-0x00007FF7E8922000-memory.dmp

Filesize
3.9MB

Download
memory/4444-393-0x00007FF70BE30000-0x00007FF70C222000-memory.dmp

Filesize
3.9MB

Download
memory/4444-5072-0x00007FF70BE30000-0x00007FF70C222000-memory.dmp

Filesize
3.9MB

Download
memory/4548-183-0x00007FF794520000-0x00007FF794912000-memory.dmp

Filesize
3.9MB

Download
memory/4548-4882-0x00007FF794520000-0x00007FF794912000-memory.dmp

Filesize
3.9MB

Download
memory/4640-5079-0x00007FF77B000000-0x00007FF77B3F2000-memory.dmp

Filesize
3.9MB

Download
memory/4640-323-0x00007FF77B000000-0x00007FF77B3F2000-memory.dmp

Filesize
3.9MB

Download
memory/4768-259-0x00007FF7A7800000-0x00007FF7A7BF2000-memory.dmp

Filesize
3.9MB

Download
memory/4768-4911-0x00007FF7A7800000-0x00007FF7A7BF2000-memory.dmp

Filesize
3.9MB

Download
memory/4816-1015-0x00007FF6B31C0000-0x00007FF6B35B2000-memory.dmp

Filesize
3.9MB

Download
memory/4816-4929-0x00007FF6B31C0000-0x00007FF6B35B2000-memory.dmp

Filesize
3.9MB

Download