xmrig | 21ecc77c13901145132c5841d5d642a722ac5bf972adbaf3d69495f9b53918cb

Analysis

max time kernel
139s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 08:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
Size

2.1MB
MD5

04be6914d9ec062b59d6f6b6b4f82da2
SHA1

a36bbf3c01178a7137821eb00cb1205f4a14d842
SHA256

21ecc77c13901145132c5841d5d642a722ac5bf972adbaf3d69495f9b53918cb
SHA512

252cbccd1035ecb29c6c0280fad777e6244cd5bad59a7d6d29b97310c6815edb583a890fe0ec21826e473cfeac49aaa3c392326fa8fbd831d3a1377b4499072b
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafM4h:NABc

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 31 IoCs

miner

resource	yara_rule
behavioral2/memory/5072-60-0x00007FF6FA2C0000-0x00007FF6FA6B2000-memory.dmp	xmrig
behavioral2/memory/2160-61-0x00007FF693720000-0x00007FF693B12000-memory.dmp	xmrig
behavioral2/memory/2788-567-0x00007FF70B330000-0x00007FF70B722000-memory.dmp	xmrig
behavioral2/memory/4068-579-0x00007FF781290000-0x00007FF781682000-memory.dmp	xmrig
behavioral2/memory/4976-591-0x00007FF622C60000-0x00007FF623052000-memory.dmp	xmrig
behavioral2/memory/4600-597-0x00007FF6928A0000-0x00007FF692C92000-memory.dmp	xmrig
behavioral2/memory/2984-588-0x00007FF61E420000-0x00007FF61E812000-memory.dmp	xmrig
behavioral2/memory/4716-578-0x00007FF6E0340000-0x00007FF6E0732000-memory.dmp	xmrig
behavioral2/memory/4396-570-0x00007FF70A3B0000-0x00007FF70A7A2000-memory.dmp	xmrig
behavioral2/memory/5064-563-0x00007FF7545D0000-0x00007FF7549C2000-memory.dmp	xmrig
behavioral2/memory/3464-560-0x00007FF6E5600000-0x00007FF6E59F2000-memory.dmp	xmrig
behavioral2/memory/116-551-0x00007FF7891E0000-0x00007FF7895D2000-memory.dmp	xmrig
behavioral2/memory/2772-545-0x00007FF670320000-0x00007FF670712000-memory.dmp	xmrig
behavioral2/memory/2432-539-0x00007FF6DD530000-0x00007FF6DD922000-memory.dmp	xmrig
behavioral2/memory/4336-56-0x00007FF6ACD80000-0x00007FF6AD172000-memory.dmp	xmrig
behavioral2/memory/4288-32-0x00007FF7296D0000-0x00007FF729AC2000-memory.dmp	xmrig
behavioral2/memory/4544-25-0x00007FF7AFF50000-0x00007FF7B0342000-memory.dmp	xmrig
behavioral2/memory/5068-4787-0x00007FF6CA220000-0x00007FF6CA612000-memory.dmp	xmrig
behavioral2/memory/400-4774-0x00007FF638E30000-0x00007FF639222000-memory.dmp	xmrig
behavioral2/memory/3296-4818-0x00007FF7BD940000-0x00007FF7BDD32000-memory.dmp	xmrig
behavioral2/memory/2432-4827-0x00007FF6DD530000-0x00007FF6DD922000-memory.dmp	xmrig
behavioral2/memory/2888-4823-0x00007FF73EAD0000-0x00007FF73EEC2000-memory.dmp	xmrig
behavioral2/memory/3464-4847-0x00007FF6E5600000-0x00007FF6E59F2000-memory.dmp	xmrig
behavioral2/memory/5064-4853-0x00007FF7545D0000-0x00007FF7549C2000-memory.dmp	xmrig
behavioral2/memory/2788-4858-0x00007FF70B330000-0x00007FF70B722000-memory.dmp	xmrig
behavioral2/memory/4716-4863-0x00007FF6E0340000-0x00007FF6E0732000-memory.dmp	xmrig
behavioral2/memory/4396-4870-0x00007FF70A3B0000-0x00007FF70A7A2000-memory.dmp	xmrig
behavioral2/memory/4600-4876-0x00007FF6928A0000-0x00007FF692C92000-memory.dmp	xmrig
behavioral2/memory/2984-4869-0x00007FF61E420000-0x00007FF61E812000-memory.dmp	xmrig
behavioral2/memory/116-4839-0x00007FF7891E0000-0x00007FF7895D2000-memory.dmp	xmrig
behavioral2/memory/2772-4833-0x00007FF670320000-0x00007FF670712000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4336	UoQSVCg.exe
4544	goEhKVx.exe
4288	HDZOjpV.exe
5072	MUZkQxT.exe
400	TwvWXYR.exe
2160	UHfkyie.exe
5068	uHqhamD.exe
3296	umjHkDw.exe
2888	VIPSVAb.exe
2432	eHUnPFG.exe
2772	QZjgsIF.exe
116	DOgIZwT.exe
3464	BRtCmvP.exe
5064	cETBRBX.exe
2788	GKGXDiP.exe
4396	ugPWyHX.exe
4716	bNILLld.exe
4068	stkNcRk.exe
2984	MaSkXIP.exe
4976	clmMMhW.exe
4600	byaWsUH.exe
3580	OniYIyt.exe
3064	hYjJtnr.exe
4072	zFLuZIc.exe
4464	fZsKFPe.exe
1660	RnNTaNF.exe
4064	JlcfeDH.exe
1288	dyfkQom.exe
4424	jnPvoSG.exe
5020	cVwlEaQ.exe
2784	rjOShQj.exe
3028	sbvuWGD.exe
1392	vqGiXDB.exe
2688	vbakymL.exe
3276	oCzwMsc.exe
3184	wmObyLa.exe
2592	mCRCQCR.exe
4540	JiPqQeo.exe
2352	Qucpbet.exe
2816	kbpAyYr.exe
5104	bwqPBLV.exe
4372	gwjdXXR.exe
2572	ycpItci.exe
4724	AAcTwgu.exe
1892	ZwvqTwu.exe
5116	hRmxjLk.exe
732	nZDjMet.exe
2544	DpZuJFK.exe
3588	gofkiDw.exe
3236	dYssuCb.exe
4772	XzLzKMk.exe
1532	OahHUoh.exe
2044	cXxlkZK.exe
1236	knTtPqF.exe
3056	WVkfmkO.exe
4488	HSbHFEE.exe
1492	KUIxfEj.exe
3688	IHUOMtZ.exe
4124	dCphdJd.exe
4144	ozvsGIY.exe
2260	YfvemTL.exe
4776	HQZMtlG.exe
4232	xfvHzMX.exe
4248	rQRMxUQ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1936-0-0x00007FF6EA150000-0x00007FF6EA542000-memory.dmp	upx
behavioral2/files/0x000c000000023b40-6.dat	upx
behavioral2/files/0x000a000000023b9e-23.dat	upx
behavioral2/files/0x000a000000023ba0-31.dat	upx
behavioral2/files/0x000a000000023ba1-35.dat	upx
behavioral2/memory/400-36-0x00007FF638E30000-0x00007FF639222000-memory.dmp	upx
behavioral2/memory/5072-60-0x00007FF6FA2C0000-0x00007FF6FA6B2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba3-62.dat	upx
behavioral2/memory/2888-64-0x00007FF73EAD0000-0x00007FF73EEC2000-memory.dmp	upx
behavioral2/memory/3296-63-0x00007FF7BD940000-0x00007FF7BDD32000-memory.dmp	upx
behavioral2/memory/2160-61-0x00007FF693720000-0x00007FF693B12000-memory.dmp	upx
behavioral2/files/0x000a000000023ba2-65.dat	upx
behavioral2/files/0x000c000000023b92-81.dat	upx
behavioral2/files/0x000a000000023ba7-91.dat	upx
behavioral2/files/0x000a000000023baa-112.dat	upx
behavioral2/files/0x000a000000023bb0-134.dat	upx
behavioral2/files/0x000a000000023bb1-147.dat	upx
behavioral2/files/0x000a000000023bb5-159.dat	upx
behavioral2/files/0x000a000000023bb7-177.dat	upx
behavioral2/memory/2788-567-0x00007FF70B330000-0x00007FF70B722000-memory.dmp	upx
behavioral2/memory/4068-579-0x00007FF781290000-0x00007FF781682000-memory.dmp	upx
behavioral2/memory/4976-591-0x00007FF622C60000-0x00007FF623052000-memory.dmp	upx
behavioral2/memory/4600-597-0x00007FF6928A0000-0x00007FF692C92000-memory.dmp	upx
behavioral2/memory/2984-588-0x00007FF61E420000-0x00007FF61E812000-memory.dmp	upx
behavioral2/memory/4716-578-0x00007FF6E0340000-0x00007FF6E0732000-memory.dmp	upx
behavioral2/memory/4396-570-0x00007FF70A3B0000-0x00007FF70A7A2000-memory.dmp	upx
behavioral2/memory/5064-563-0x00007FF7545D0000-0x00007FF7549C2000-memory.dmp	upx
behavioral2/memory/3464-560-0x00007FF6E5600000-0x00007FF6E59F2000-memory.dmp	upx
behavioral2/memory/116-551-0x00007FF7891E0000-0x00007FF7895D2000-memory.dmp	upx
behavioral2/memory/2772-545-0x00007FF670320000-0x00007FF670712000-memory.dmp	upx
behavioral2/memory/2432-539-0x00007FF6DD530000-0x00007FF6DD922000-memory.dmp	upx
behavioral2/files/0x000a000000023bba-184.dat	upx
behavioral2/files/0x000a000000023bb8-182.dat	upx
behavioral2/files/0x000a000000023bb9-179.dat	upx
behavioral2/files/0x000a000000023bb6-172.dat	upx
behavioral2/files/0x000a000000023bb4-162.dat	upx
behavioral2/files/0x000a000000023bb3-157.dat	upx
behavioral2/files/0x000a000000023bb2-152.dat	upx
behavioral2/files/0x000a000000023baf-137.dat	upx
behavioral2/files/0x000a000000023bae-132.dat	upx
behavioral2/files/0x000a000000023bad-127.dat	upx
behavioral2/files/0x000a000000023bac-122.dat	upx
behavioral2/files/0x000a000000023bab-117.dat	upx
behavioral2/files/0x000a000000023ba9-107.dat	upx
behavioral2/files/0x000a000000023ba8-99.dat	upx
behavioral2/files/0x000a000000023ba6-89.dat	upx
behavioral2/files/0x000b000000023ba4-77.dat	upx
behavioral2/files/0x000b000000023ba5-72.dat	upx
behavioral2/memory/4336-56-0x00007FF6ACD80000-0x00007FF6AD172000-memory.dmp	upx
behavioral2/memory/5068-38-0x00007FF6CA220000-0x00007FF6CA612000-memory.dmp	upx
behavioral2/files/0x000a000000023b9f-37.dat	upx
behavioral2/memory/4288-32-0x00007FF7296D0000-0x00007FF729AC2000-memory.dmp	upx
behavioral2/memory/4544-25-0x00007FF7AFF50000-0x00007FF7B0342000-memory.dmp	upx
behavioral2/files/0x000a000000023b9d-20.dat	upx
behavioral2/files/0x000c000000023b90-13.dat	upx
behavioral2/memory/5068-4787-0x00007FF6CA220000-0x00007FF6CA612000-memory.dmp	upx
behavioral2/memory/400-4774-0x00007FF638E30000-0x00007FF639222000-memory.dmp	upx
behavioral2/memory/3296-4818-0x00007FF7BD940000-0x00007FF7BDD32000-memory.dmp	upx
behavioral2/memory/2432-4827-0x00007FF6DD530000-0x00007FF6DD922000-memory.dmp	upx
behavioral2/memory/2888-4823-0x00007FF73EAD0000-0x00007FF73EEC2000-memory.dmp	upx
behavioral2/memory/3464-4847-0x00007FF6E5600000-0x00007FF6E59F2000-memory.dmp	upx
behavioral2/memory/5064-4853-0x00007FF7545D0000-0x00007FF7549C2000-memory.dmp	upx
behavioral2/memory/2788-4858-0x00007FF70B330000-0x00007FF70B722000-memory.dmp	upx
behavioral2/memory/4716-4863-0x00007FF6E0340000-0x00007FF6E0732000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\cGpxsaK.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\hMczXWs.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\bpGGRxG.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\phOMSjm.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\rkWtGLy.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\RnOehUx.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\LMcvCaE.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\CZiiiCD.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\uCGwzZL.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\LrVVFlj.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\INxUXfR.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\BbETUMq.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\lcdSgef.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\ZSlRLCN.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\jUUUYha.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\eopHOlj.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\NqmRsAG.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\GZJnjaw.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\okVLmgJ.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\scGxQCp.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\DKVoYXE.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\ohaxJSc.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\lLlxUIa.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\aNdXqFN.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\ryqQvXF.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\VSoPPiE.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\KaGgCDz.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\QPjpBTG.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\WfhBZAc.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\ZHedoaP.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\dBfWxJa.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\ATtorih.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\YhORpJz.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\fLRMEbY.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\pgyczeH.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\DKQtidz.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\NcFATzh.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\WPlztvy.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\yDhQwhE.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\uQmJNvR.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\cLLWkZK.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\ZGOEojV.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\fPyBZor.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\aNOXFTF.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\irMsbXu.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\eKlayHa.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\ScPBTCc.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\JhUAYPd.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\dKjzOTb.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\tbFQTqf.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\knQyeWu.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\alTrExF.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\XEYeUZE.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\RfYsXOr.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\UsVQyug.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\OmYiPpt.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\WqgJuPq.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\deplTaM.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\msKjTIo.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\zZiyfFG.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\zoELQwA.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\zYlxRSu.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\RqXxqIR.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\uONJyKF.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1448	powershell.exe
1448	powershell.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
Token: SeDebugPrivilege	1448	powershell.exe
Token: SeLockMemoryPrivilege	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	12732	dwm.exe
Token: SeChangeNotifyPrivilege	12732	dwm.exe
Token: 33	12732	dwm.exe
Token: SeIncBasePriorityPrivilege	12732	dwm.exe
Token: SeCreateGlobalPrivilege	5944	dwm.exe
Token: SeChangeNotifyPrivilege	5944	dwm.exe
Token: 33	5944	dwm.exe
Token: SeIncBasePriorityPrivilege	5944	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 1448	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	85
PID 1936 wrote to memory of 1448	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	85
PID 1936 wrote to memory of 4336	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	86
PID 1936 wrote to memory of 4336	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	86
PID 1936 wrote to memory of 4544	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	87
PID 1936 wrote to memory of 4544	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	87
PID 1936 wrote to memory of 4288	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	88
PID 1936 wrote to memory of 4288	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	88
PID 1936 wrote to memory of 5072	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	89
PID 1936 wrote to memory of 5072	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	89
PID 1936 wrote to memory of 400	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	90
PID 1936 wrote to memory of 400	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	90
PID 1936 wrote to memory of 2160	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	91
PID 1936 wrote to memory of 2160	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	91
PID 1936 wrote to memory of 5068	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	92
PID 1936 wrote to memory of 5068	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	92
PID 1936 wrote to memory of 3296	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	93
PID 1936 wrote to memory of 3296	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	93
PID 1936 wrote to memory of 2888	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	94
PID 1936 wrote to memory of 2888	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	94
PID 1936 wrote to memory of 2432	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	95
PID 1936 wrote to memory of 2432	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	95
PID 1936 wrote to memory of 2772	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	96
PID 1936 wrote to memory of 2772	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	96
PID 1936 wrote to memory of 116	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	97
PID 1936 wrote to memory of 116	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	97
PID 1936 wrote to memory of 3464	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	98
PID 1936 wrote to memory of 3464	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	98
PID 1936 wrote to memory of 5064	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	99
PID 1936 wrote to memory of 5064	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	99
PID 1936 wrote to memory of 2788	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	100
PID 1936 wrote to memory of 2788	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	100
PID 1936 wrote to memory of 4396	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	101
PID 1936 wrote to memory of 4396	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	101
PID 1936 wrote to memory of 4716	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	102
PID 1936 wrote to memory of 4716	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	102
PID 1936 wrote to memory of 4068	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	103
PID 1936 wrote to memory of 4068	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	103
PID 1936 wrote to memory of 2984	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	104
PID 1936 wrote to memory of 2984	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	104
PID 1936 wrote to memory of 4976	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	105
PID 1936 wrote to memory of 4976	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	105
PID 1936 wrote to memory of 4600	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	106
PID 1936 wrote to memory of 4600	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	106
PID 1936 wrote to memory of 3580	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	107
PID 1936 wrote to memory of 3580	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	107
PID 1936 wrote to memory of 3064	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	108
PID 1936 wrote to memory of 3064	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	108
PID 1936 wrote to memory of 4072	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	109
PID 1936 wrote to memory of 4072	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	109
PID 1936 wrote to memory of 4464	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	110
PID 1936 wrote to memory of 4464	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	110
PID 1936 wrote to memory of 1660	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	111
PID 1936 wrote to memory of 1660	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	111
PID 1936 wrote to memory of 4064	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	112
PID 1936 wrote to memory of 4064	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	112
PID 1936 wrote to memory of 1288	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	113
PID 1936 wrote to memory of 1288	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	113
PID 1936 wrote to memory of 4424	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	114
PID 1936 wrote to memory of 4424	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	114
PID 1936 wrote to memory of 5020	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	115
PID 1936 wrote to memory of 5020	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	115
PID 1936 wrote to memory of 2784	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	116
PID 1936 wrote to memory of 2784	1936	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1448
- C:\Windows\System\UoQSVCg.exe
  C:\Windows\System\UoQSVCg.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\goEhKVx.exe
  C:\Windows\System\goEhKVx.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\HDZOjpV.exe
  C:\Windows\System\HDZOjpV.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\MUZkQxT.exe
  C:\Windows\System\MUZkQxT.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\TwvWXYR.exe
  C:\Windows\System\TwvWXYR.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\UHfkyie.exe
  C:\Windows\System\UHfkyie.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\uHqhamD.exe
  C:\Windows\System\uHqhamD.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\umjHkDw.exe
  C:\Windows\System\umjHkDw.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\VIPSVAb.exe
  C:\Windows\System\VIPSVAb.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\eHUnPFG.exe
  C:\Windows\System\eHUnPFG.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\QZjgsIF.exe
  C:\Windows\System\QZjgsIF.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\DOgIZwT.exe
  C:\Windows\System\DOgIZwT.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\BRtCmvP.exe
  C:\Windows\System\BRtCmvP.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\cETBRBX.exe
  C:\Windows\System\cETBRBX.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\GKGXDiP.exe
  C:\Windows\System\GKGXDiP.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\ugPWyHX.exe
  C:\Windows\System\ugPWyHX.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\bNILLld.exe
  C:\Windows\System\bNILLld.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\stkNcRk.exe
  C:\Windows\System\stkNcRk.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\MaSkXIP.exe
  C:\Windows\System\MaSkXIP.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\clmMMhW.exe
  C:\Windows\System\clmMMhW.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\byaWsUH.exe
  C:\Windows\System\byaWsUH.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\OniYIyt.exe
  C:\Windows\System\OniYIyt.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\hYjJtnr.exe
  C:\Windows\System\hYjJtnr.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\zFLuZIc.exe
  C:\Windows\System\zFLuZIc.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\fZsKFPe.exe
  C:\Windows\System\fZsKFPe.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\RnNTaNF.exe
  C:\Windows\System\RnNTaNF.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\JlcfeDH.exe
  C:\Windows\System\JlcfeDH.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\dyfkQom.exe
  C:\Windows\System\dyfkQom.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\jnPvoSG.exe
  C:\Windows\System\jnPvoSG.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\cVwlEaQ.exe
  C:\Windows\System\cVwlEaQ.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\rjOShQj.exe
  C:\Windows\System\rjOShQj.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\sbvuWGD.exe
  C:\Windows\System\sbvuWGD.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\vqGiXDB.exe
  C:\Windows\System\vqGiXDB.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\vbakymL.exe
  C:\Windows\System\vbakymL.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\oCzwMsc.exe
  C:\Windows\System\oCzwMsc.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\wmObyLa.exe
  C:\Windows\System\wmObyLa.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\mCRCQCR.exe
  C:\Windows\System\mCRCQCR.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\JiPqQeo.exe
  C:\Windows\System\JiPqQeo.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\Qucpbet.exe
  C:\Windows\System\Qucpbet.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\kbpAyYr.exe
  C:\Windows\System\kbpAyYr.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\bwqPBLV.exe
  C:\Windows\System\bwqPBLV.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\gwjdXXR.exe
  C:\Windows\System\gwjdXXR.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\ycpItci.exe
  C:\Windows\System\ycpItci.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\AAcTwgu.exe
  C:\Windows\System\AAcTwgu.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\ZwvqTwu.exe
  C:\Windows\System\ZwvqTwu.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\hRmxjLk.exe
  C:\Windows\System\hRmxjLk.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\nZDjMet.exe
  C:\Windows\System\nZDjMet.exe
  2⤵
  - Executes dropped EXE
  PID:732
- C:\Windows\System\DpZuJFK.exe
  C:\Windows\System\DpZuJFK.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\gofkiDw.exe
  C:\Windows\System\gofkiDw.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\dYssuCb.exe
  C:\Windows\System\dYssuCb.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\XzLzKMk.exe
  C:\Windows\System\XzLzKMk.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\OahHUoh.exe
  C:\Windows\System\OahHUoh.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\cXxlkZK.exe
  C:\Windows\System\cXxlkZK.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\knTtPqF.exe
  C:\Windows\System\knTtPqF.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\WVkfmkO.exe
  C:\Windows\System\WVkfmkO.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\HSbHFEE.exe
  C:\Windows\System\HSbHFEE.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\KUIxfEj.exe
  C:\Windows\System\KUIxfEj.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\IHUOMtZ.exe
  C:\Windows\System\IHUOMtZ.exe
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Windows\System\dCphdJd.exe
  C:\Windows\System\dCphdJd.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\ozvsGIY.exe
  C:\Windows\System\ozvsGIY.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\YfvemTL.exe
  C:\Windows\System\YfvemTL.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\HQZMtlG.exe
  C:\Windows\System\HQZMtlG.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\xfvHzMX.exe
  C:\Windows\System\xfvHzMX.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\rQRMxUQ.exe
  C:\Windows\System\rQRMxUQ.exe
  2⤵
  - Executes dropped EXE
  PID:4248
- C:\Windows\System\iLjTFBj.exe
  C:\Windows\System\iLjTFBj.exe
  2⤵
  PID:4532
- C:\Windows\System\KYGDWUI.exe
  C:\Windows\System\KYGDWUI.exe
  2⤵
  PID:4620
- C:\Windows\System\QocWBQR.exe
  C:\Windows\System\QocWBQR.exe
  2⤵
  PID:1756
- C:\Windows\System\IsNjbag.exe
  C:\Windows\System\IsNjbag.exe
  2⤵
  PID:3988
- C:\Windows\System\ucRpQAk.exe
  C:\Windows\System\ucRpQAk.exe
  2⤵
  PID:208
- C:\Windows\System\tpOWVAo.exe
  C:\Windows\System\tpOWVAo.exe
  2⤵
  PID:4164
- C:\Windows\System\vPHBCyB.exe
  C:\Windows\System\vPHBCyB.exe
  2⤵
  PID:1728
- C:\Windows\System\oUXLmrz.exe
  C:\Windows\System\oUXLmrz.exe
  2⤵
  PID:5148
- C:\Windows\System\EhovyAn.exe
  C:\Windows\System\EhovyAn.exe
  2⤵
  PID:5176
- C:\Windows\System\ZsqHlxv.exe
  C:\Windows\System\ZsqHlxv.exe
  2⤵
  PID:5204
- C:\Windows\System\LPIucgW.exe
  C:\Windows\System\LPIucgW.exe
  2⤵
  PID:5232
- C:\Windows\System\wIgzCOP.exe
  C:\Windows\System\wIgzCOP.exe
  2⤵
  PID:5260
- C:\Windows\System\VNEqkGM.exe
  C:\Windows\System\VNEqkGM.exe
  2⤵
  PID:5288
- C:\Windows\System\RvbbwgR.exe
  C:\Windows\System\RvbbwgR.exe
  2⤵
  PID:5316
- C:\Windows\System\RxfmeOM.exe
  C:\Windows\System\RxfmeOM.exe
  2⤵
  PID:5344
- C:\Windows\System\AxqbRoF.exe
  C:\Windows\System\AxqbRoF.exe
  2⤵
  PID:5372
- C:\Windows\System\NIFODEk.exe
  C:\Windows\System\NIFODEk.exe
  2⤵
  PID:5400
- C:\Windows\System\DnRcFaf.exe
  C:\Windows\System\DnRcFaf.exe
  2⤵
  PID:5428
- C:\Windows\System\IkaEXHW.exe
  C:\Windows\System\IkaEXHW.exe
  2⤵
  PID:5456
- C:\Windows\System\iUEEGrV.exe
  C:\Windows\System\iUEEGrV.exe
  2⤵
  PID:5484
- C:\Windows\System\pwPJUkw.exe
  C:\Windows\System\pwPJUkw.exe
  2⤵
  PID:5512
- C:\Windows\System\TpkZrTC.exe
  C:\Windows\System\TpkZrTC.exe
  2⤵
  PID:5544
- C:\Windows\System\eRAQzzN.exe
  C:\Windows\System\eRAQzzN.exe
  2⤵
  PID:5568
- C:\Windows\System\auOcFFD.exe
  C:\Windows\System\auOcFFD.exe
  2⤵
  PID:5596
- C:\Windows\System\jqZwUHO.exe
  C:\Windows\System\jqZwUHO.exe
  2⤵
  PID:5624
- C:\Windows\System\ikANFkD.exe
  C:\Windows\System\ikANFkD.exe
  2⤵
  PID:5652
- C:\Windows\System\WeRkFAE.exe
  C:\Windows\System\WeRkFAE.exe
  2⤵
  PID:5680
- C:\Windows\System\zBLLUeS.exe
  C:\Windows\System\zBLLUeS.exe
  2⤵
  PID:5708
- C:\Windows\System\nuxkPeE.exe
  C:\Windows\System\nuxkPeE.exe
  2⤵
  PID:5736
- C:\Windows\System\VhUDssq.exe
  C:\Windows\System\VhUDssq.exe
  2⤵
  PID:5764
- C:\Windows\System\CzGfUWb.exe
  C:\Windows\System\CzGfUWb.exe
  2⤵
  PID:5792
- C:\Windows\System\xWJeWYP.exe
  C:\Windows\System\xWJeWYP.exe
  2⤵
  PID:5844
- C:\Windows\System\HvFuDet.exe
  C:\Windows\System\HvFuDet.exe
  2⤵
  PID:5868
- C:\Windows\System\BjdCWLw.exe
  C:\Windows\System\BjdCWLw.exe
  2⤵
  PID:5888
- C:\Windows\System\YXvYiAS.exe
  C:\Windows\System\YXvYiAS.exe
  2⤵
  PID:5904
- C:\Windows\System\mxiFYbN.exe
  C:\Windows\System\mxiFYbN.exe
  2⤵
  PID:5928
- C:\Windows\System\dcKvmRA.exe
  C:\Windows\System\dcKvmRA.exe
  2⤵
  PID:5956
- C:\Windows\System\jjrwKQT.exe
  C:\Windows\System\jjrwKQT.exe
  2⤵
  PID:5984
- C:\Windows\System\MebBYAb.exe
  C:\Windows\System\MebBYAb.exe
  2⤵
  PID:6012
- C:\Windows\System\RBJhIMg.exe
  C:\Windows\System\RBJhIMg.exe
  2⤵
  PID:6044
- C:\Windows\System\Fahujds.exe
  C:\Windows\System\Fahujds.exe
  2⤵
  PID:6072
- C:\Windows\System\UXVrGlu.exe
  C:\Windows\System\UXVrGlu.exe
  2⤵
  PID:6100
- C:\Windows\System\bLxcnSn.exe
  C:\Windows\System\bLxcnSn.exe
  2⤵
  PID:6128
- C:\Windows\System\uyuwPkR.exe
  C:\Windows\System\uyuwPkR.exe
  2⤵
  PID:3088
- C:\Windows\System\sIziYMS.exe
  C:\Windows\System\sIziYMS.exe
  2⤵
  PID:1268
- C:\Windows\System\xxckGIZ.exe
  C:\Windows\System\xxckGIZ.exe
  2⤵
  PID:5080
- C:\Windows\System\AiAcaNj.exe
  C:\Windows\System\AiAcaNj.exe
  2⤵
  PID:4044
- C:\Windows\System\WoYhCxI.exe
  C:\Windows\System\WoYhCxI.exe
  2⤵
  PID:4636
- C:\Windows\System\TlVPqRp.exe
  C:\Windows\System\TlVPqRp.exe
  2⤵
  PID:5188
- C:\Windows\System\KWXHSnE.exe
  C:\Windows\System\KWXHSnE.exe
  2⤵
  PID:5244
- C:\Windows\System\attWmoR.exe
  C:\Windows\System\attWmoR.exe
  2⤵
  PID:5304
- C:\Windows\System\aLCaZmS.exe
  C:\Windows\System\aLCaZmS.exe
  2⤵
  PID:5364
- C:\Windows\System\jvwmSAP.exe
  C:\Windows\System\jvwmSAP.exe
  2⤵
  PID:5440
- C:\Windows\System\eYCttfM.exe
  C:\Windows\System\eYCttfM.exe
  2⤵
  PID:5476
- C:\Windows\System\HKjHoBY.exe
  C:\Windows\System\HKjHoBY.exe
  2⤵
  PID:5552
- C:\Windows\System\UrAtZOZ.exe
  C:\Windows\System\UrAtZOZ.exe
  2⤵
  PID:5612
- C:\Windows\System\dbbTrPT.exe
  C:\Windows\System\dbbTrPT.exe
  2⤵
  PID:5668
- C:\Windows\System\qBeOdKY.exe
  C:\Windows\System\qBeOdKY.exe
  2⤵
  PID:5704
- C:\Windows\System\XxVbpJn.exe
  C:\Windows\System\XxVbpJn.exe
  2⤵
  PID:5776
- C:\Windows\System\vDSJWzM.exe
  C:\Windows\System\vDSJWzM.exe
  2⤵
  PID:5836
- C:\Windows\System\glLYFUf.exe
  C:\Windows\System\glLYFUf.exe
  2⤵
  PID:5896
- C:\Windows\System\QpMmOtP.exe
  C:\Windows\System\QpMmOtP.exe
  2⤵
  PID:5952
- C:\Windows\System\WVXjBRJ.exe
  C:\Windows\System\WVXjBRJ.exe
  2⤵
  PID:6008
- C:\Windows\System\uUejqsN.exe
  C:\Windows\System\uUejqsN.exe
  2⤵
  PID:2744
- C:\Windows\System\HKOSbAh.exe
  C:\Windows\System\HKOSbAh.exe
  2⤵
  PID:6120
- C:\Windows\System\CfzdyFL.exe
  C:\Windows\System\CfzdyFL.exe
  2⤵
  PID:1388
- C:\Windows\System\DUluihu.exe
  C:\Windows\System\DUluihu.exe
  2⤵
  PID:3412
- C:\Windows\System\zGyNwHA.exe
  C:\Windows\System\zGyNwHA.exe
  2⤵
  PID:5216
- C:\Windows\System\DYJxTxf.exe
  C:\Windows\System\DYJxTxf.exe
  2⤵
  PID:5336
- C:\Windows\System\dYyriCt.exe
  C:\Windows\System\dYyriCt.exe
  2⤵
  PID:2400
- C:\Windows\System\rnUSQCm.exe
  C:\Windows\System\rnUSQCm.exe
  2⤵
  PID:5592
- C:\Windows\System\LBZllrO.exe
  C:\Windows\System\LBZllrO.exe
  2⤵
  PID:5728
- C:\Windows\System\SeqLRNR.exe
  C:\Windows\System\SeqLRNR.exe
  2⤵
  PID:5880
- C:\Windows\System\rIvIhqZ.exe
  C:\Windows\System\rIvIhqZ.exe
  2⤵
  PID:6000
- C:\Windows\System\AYIdgUX.exe
  C:\Windows\System\AYIdgUX.exe
  2⤵
  PID:2528
- C:\Windows\System\mvhFGjd.exe
  C:\Windows\System\mvhFGjd.exe
  2⤵
  PID:3260
- C:\Windows\System\vAZnZuD.exe
  C:\Windows\System\vAZnZuD.exe
  2⤵
  PID:4088
- C:\Windows\System\ELxIpat.exe
  C:\Windows\System\ELxIpat.exe
  2⤵
  PID:1952
- C:\Windows\System\slAaHwb.exe
  C:\Windows\System\slAaHwb.exe
  2⤵
  PID:2760
- C:\Windows\System\gtZscHv.exe
  C:\Windows\System\gtZscHv.exe
  2⤵
  PID:3252
- C:\Windows\System\iwwrGVu.exe
  C:\Windows\System\iwwrGVu.exe
  2⤵
  PID:6112
- C:\Windows\System\vtaDCUC.exe
  C:\Windows\System\vtaDCUC.exe
  2⤵
  PID:6172
- C:\Windows\System\NFJnbrR.exe
  C:\Windows\System\NFJnbrR.exe
  2⤵
  PID:6204
- C:\Windows\System\LUtKddn.exe
  C:\Windows\System\LUtKddn.exe
  2⤵
  PID:6228
- C:\Windows\System\FhGVwSf.exe
  C:\Windows\System\FhGVwSf.exe
  2⤵
  PID:6256
- C:\Windows\System\zhzoEXK.exe
  C:\Windows\System\zhzoEXK.exe
  2⤵
  PID:6284
- C:\Windows\System\LnBFaCz.exe
  C:\Windows\System\LnBFaCz.exe
  2⤵
  PID:6312
- C:\Windows\System\mpoCIjz.exe
  C:\Windows\System\mpoCIjz.exe
  2⤵
  PID:6340
- C:\Windows\System\mRrnsnx.exe
  C:\Windows\System\mRrnsnx.exe
  2⤵
  PID:6384
- C:\Windows\System\wcmDLrq.exe
  C:\Windows\System\wcmDLrq.exe
  2⤵
  PID:6424
- C:\Windows\System\czhwqHf.exe
  C:\Windows\System\czhwqHf.exe
  2⤵
  PID:6444
- C:\Windows\System\ydYZJTF.exe
  C:\Windows\System\ydYZJTF.exe
  2⤵
  PID:6472
- C:\Windows\System\GoqBtwj.exe
  C:\Windows\System\GoqBtwj.exe
  2⤵
  PID:6536
- C:\Windows\System\SDCPiui.exe
  C:\Windows\System\SDCPiui.exe
  2⤵
  PID:6564
- C:\Windows\System\RzfaZjx.exe
  C:\Windows\System\RzfaZjx.exe
  2⤵
  PID:6584
- C:\Windows\System\lPazprd.exe
  C:\Windows\System\lPazprd.exe
  2⤵
  PID:6616
- C:\Windows\System\HRpYzYs.exe
  C:\Windows\System\HRpYzYs.exe
  2⤵
  PID:6640
- C:\Windows\System\ERHIVQN.exe
  C:\Windows\System\ERHIVQN.exe
  2⤵
  PID:6664
- C:\Windows\System\NvWcDxJ.exe
  C:\Windows\System\NvWcDxJ.exe
  2⤵
  PID:6688
- C:\Windows\System\nyvOEzy.exe
  C:\Windows\System\nyvOEzy.exe
  2⤵
  PID:6704
- C:\Windows\System\SxuBMJE.exe
  C:\Windows\System\SxuBMJE.exe
  2⤵
  PID:6740
- C:\Windows\System\dITbJqR.exe
  C:\Windows\System\dITbJqR.exe
  2⤵
  PID:6768
- C:\Windows\System\MPSUexy.exe
  C:\Windows\System\MPSUexy.exe
  2⤵
  PID:6784
- C:\Windows\System\nFlmPRm.exe
  C:\Windows\System\nFlmPRm.exe
  2⤵
  PID:6808
- C:\Windows\System\vcRjPLS.exe
  C:\Windows\System\vcRjPLS.exe
  2⤵
  PID:6852
- C:\Windows\System\igdtZxF.exe
  C:\Windows\System\igdtZxF.exe
  2⤵
  PID:6916
- C:\Windows\System\ISkkFVs.exe
  C:\Windows\System\ISkkFVs.exe
  2⤵
  PID:6936
- C:\Windows\System\zadDnvW.exe
  C:\Windows\System\zadDnvW.exe
  2⤵
  PID:6976
- C:\Windows\System\RqSLuwv.exe
  C:\Windows\System\RqSLuwv.exe
  2⤵
  PID:7000
- C:\Windows\System\giIucTY.exe
  C:\Windows\System\giIucTY.exe
  2⤵
  PID:7020
- C:\Windows\System\RBtQJLc.exe
  C:\Windows\System\RBtQJLc.exe
  2⤵
  PID:7044
- C:\Windows\System\jZBgHOa.exe
  C:\Windows\System\jZBgHOa.exe
  2⤵
  PID:7068
- C:\Windows\System\yMjzjqf.exe
  C:\Windows\System\yMjzjqf.exe
  2⤵
  PID:7120
- C:\Windows\System\Colyvuu.exe
  C:\Windows\System\Colyvuu.exe
  2⤵
  PID:7156
- C:\Windows\System\WxuSyMq.exe
  C:\Windows\System\WxuSyMq.exe
  2⤵
  PID:2500
- C:\Windows\System\FClnnjp.exe
  C:\Windows\System\FClnnjp.exe
  2⤵
  PID:6156
- C:\Windows\System\rCbEDkG.exe
  C:\Windows\System\rCbEDkG.exe
  2⤵
  PID:1684
- C:\Windows\System\IKRvRnN.exe
  C:\Windows\System\IKRvRnN.exe
  2⤵
  PID:3384
- C:\Windows\System\scGxQCp.exe
  C:\Windows\System\scGxQCp.exe
  2⤵
  PID:6220
- C:\Windows\System\rWfTcYM.exe
  C:\Windows\System\rWfTcYM.exe
  2⤵
  PID:6248
- C:\Windows\System\Iyvwswd.exe
  C:\Windows\System\Iyvwswd.exe
  2⤵
  PID:4412
- C:\Windows\System\RbHbJgn.exe
  C:\Windows\System\RbHbJgn.exe
  2⤵
  PID:4980
- C:\Windows\System\GMVFhWK.exe
  C:\Windows\System\GMVFhWK.exe
  2⤵
  PID:3396
- C:\Windows\System\pQlEkZy.exe
  C:\Windows\System\pQlEkZy.exe
  2⤵
  PID:6436
- C:\Windows\System\deplTaM.exe
  C:\Windows\System\deplTaM.exe
  2⤵
  PID:6372
- C:\Windows\System\xvcvJMH.exe
  C:\Windows\System\xvcvJMH.exe
  2⤵
  PID:6464
- C:\Windows\System\ftAKNWJ.exe
  C:\Windows\System\ftAKNWJ.exe
  2⤵
  PID:6556
- C:\Windows\System\GDbKyJe.exe
  C:\Windows\System\GDbKyJe.exe
  2⤵
  PID:6600
- C:\Windows\System\BHuvrGS.exe
  C:\Windows\System\BHuvrGS.exe
  2⤵
  PID:6652
- C:\Windows\System\UNeTRbW.exe
  C:\Windows\System\UNeTRbW.exe
  2⤵
  PID:2828
- C:\Windows\System\PApbTCo.exe
  C:\Windows\System\PApbTCo.exe
  2⤵
  PID:6748
- C:\Windows\System\eBXEjSv.exe
  C:\Windows\System\eBXEjSv.exe
  2⤵
  PID:6796
- C:\Windows\System\dSEUbDq.exe
  C:\Windows\System\dSEUbDq.exe
  2⤵
  PID:6844
- C:\Windows\System\EEKRczI.exe
  C:\Windows\System\EEKRczI.exe
  2⤵
  PID:6908
- C:\Windows\System\axZezcp.exe
  C:\Windows\System\axZezcp.exe
  2⤵
  PID:6968
- C:\Windows\System\opGaKJz.exe
  C:\Windows\System\opGaKJz.exe
  2⤵
  PID:7016
- C:\Windows\System\ktkNNoe.exe
  C:\Windows\System\ktkNNoe.exe
  2⤵
  PID:7096
- C:\Windows\System\BvTUyZU.exe
  C:\Windows\System\BvTUyZU.exe
  2⤵
  PID:7148
- C:\Windows\System\Toufcac.exe
  C:\Windows\System\Toufcac.exe
  2⤵
  PID:3476
- C:\Windows\System\LvuGfXq.exe
  C:\Windows\System\LvuGfXq.exe
  2⤵
  PID:6624
- C:\Windows\System\OihvuXy.exe
  C:\Windows\System\OihvuXy.exe
  2⤵
  PID:6792
- C:\Windows\System\EkyuXjr.exe
  C:\Windows\System\EkyuXjr.exe
  2⤵
  PID:5976
- C:\Windows\System\WDyVheV.exe
  C:\Windows\System\WDyVheV.exe
  2⤵
  PID:6244
- C:\Windows\System\iUFhTqN.exe
  C:\Windows\System\iUFhTqN.exe
  2⤵
  PID:6576
- C:\Windows\System\rRLvxqe.exe
  C:\Windows\System\rRLvxqe.exe
  2⤵
  PID:6840
- C:\Windows\System\WKEKuvW.exe
  C:\Windows\System\WKEKuvW.exe
  2⤵
  PID:6676
- C:\Windows\System\kVLbvwI.exe
  C:\Windows\System\kVLbvwI.exe
  2⤵
  PID:7132
- C:\Windows\System\ERoeyJr.exe
  C:\Windows\System\ERoeyJr.exe
  2⤵
  PID:7008
- C:\Windows\System\WpHQXEh.exe
  C:\Windows\System\WpHQXEh.exe
  2⤵
  PID:6432
- C:\Windows\System\KxndPvZ.exe
  C:\Windows\System\KxndPvZ.exe
  2⤵
  PID:4264
- C:\Windows\System\wSfIHZS.exe
  C:\Windows\System\wSfIHZS.exe
  2⤵
  PID:2420
- C:\Windows\System\LkocHKn.exe
  C:\Windows\System\LkocHKn.exe
  2⤵
  PID:6928
- C:\Windows\System\VxFRqqr.exe
  C:\Windows\System\VxFRqqr.exe
  2⤵
  PID:1828
- C:\Windows\System\dHeKmAK.exe
  C:\Windows\System\dHeKmAK.exe
  2⤵
  PID:4680
- C:\Windows\System\BjsEwLt.exe
  C:\Windows\System\BjsEwLt.exe
  2⤵
  PID:6876
- C:\Windows\System\kDptPXC.exe
  C:\Windows\System\kDptPXC.exe
  2⤵
  PID:7176
- C:\Windows\System\ZpKbzyO.exe
  C:\Windows\System\ZpKbzyO.exe
  2⤵
  PID:7204
- C:\Windows\System\yFzVavy.exe
  C:\Windows\System\yFzVavy.exe
  2⤵
  PID:7244
- C:\Windows\System\DBInAPf.exe
  C:\Windows\System\DBInAPf.exe
  2⤵
  PID:7292
- C:\Windows\System\yIxQHLq.exe
  C:\Windows\System\yIxQHLq.exe
  2⤵
  PID:7308
- C:\Windows\System\iZNcGqe.exe
  C:\Windows\System\iZNcGqe.exe
  2⤵
  PID:7332
- C:\Windows\System\QPDqUiD.exe
  C:\Windows\System\QPDqUiD.exe
  2⤵
  PID:7368
- C:\Windows\System\gKLxkPd.exe
  C:\Windows\System\gKLxkPd.exe
  2⤵
  PID:7400
- C:\Windows\System\YnJUJvO.exe
  C:\Windows\System\YnJUJvO.exe
  2⤵
  PID:7416
- C:\Windows\System\pZAjNNo.exe
  C:\Windows\System\pZAjNNo.exe
  2⤵
  PID:7436
- C:\Windows\System\XDbZeKN.exe
  C:\Windows\System\XDbZeKN.exe
  2⤵
  PID:7456
- C:\Windows\System\TNWdWpd.exe
  C:\Windows\System\TNWdWpd.exe
  2⤵
  PID:7492
- C:\Windows\System\HxXLwjB.exe
  C:\Windows\System\HxXLwjB.exe
  2⤵
  PID:7512
- C:\Windows\System\lPOqwLS.exe
  C:\Windows\System\lPOqwLS.exe
  2⤵
  PID:7532
- C:\Windows\System\ZdAofmj.exe
  C:\Windows\System\ZdAofmj.exe
  2⤵
  PID:7576
- C:\Windows\System\EgdoGNP.exe
  C:\Windows\System\EgdoGNP.exe
  2⤵
  PID:7596
- C:\Windows\System\EvAUlMi.exe
  C:\Windows\System\EvAUlMi.exe
  2⤵
  PID:7616
- C:\Windows\System\DYXbbyg.exe
  C:\Windows\System\DYXbbyg.exe
  2⤵
  PID:7648
- C:\Windows\System\zLUNXmO.exe
  C:\Windows\System\zLUNXmO.exe
  2⤵
  PID:7672
- C:\Windows\System\RlkqGgj.exe
  C:\Windows\System\RlkqGgj.exe
  2⤵
  PID:7696
- C:\Windows\System\JZlzfkd.exe
  C:\Windows\System\JZlzfkd.exe
  2⤵
  PID:7752
- C:\Windows\System\VbTKNSV.exe
  C:\Windows\System\VbTKNSV.exe
  2⤵
  PID:7776
- C:\Windows\System\fYhFbyY.exe
  C:\Windows\System\fYhFbyY.exe
  2⤵
  PID:7824
- C:\Windows\System\DRclONI.exe
  C:\Windows\System\DRclONI.exe
  2⤵
  PID:7848
- C:\Windows\System\TWbOnDm.exe
  C:\Windows\System\TWbOnDm.exe
  2⤵
  PID:7868
- C:\Windows\System\CMcKEhh.exe
  C:\Windows\System\CMcKEhh.exe
  2⤵
  PID:7892
- C:\Windows\System\uhBDWeh.exe
  C:\Windows\System\uhBDWeh.exe
  2⤵
  PID:7916
- C:\Windows\System\AQSeCOs.exe
  C:\Windows\System\AQSeCOs.exe
  2⤵
  PID:7944
- C:\Windows\System\DBRNCUO.exe
  C:\Windows\System\DBRNCUO.exe
  2⤵
  PID:7996
- C:\Windows\System\nvgGWBa.exe
  C:\Windows\System\nvgGWBa.exe
  2⤵
  PID:8012
- C:\Windows\System\uTbTJbH.exe
  C:\Windows\System\uTbTJbH.exe
  2⤵
  PID:8056
- C:\Windows\System\zFPswVB.exe
  C:\Windows\System\zFPswVB.exe
  2⤵
  PID:8076
- C:\Windows\System\DykUHrD.exe
  C:\Windows\System\DykUHrD.exe
  2⤵
  PID:8108
- C:\Windows\System\Yvurtlp.exe
  C:\Windows\System\Yvurtlp.exe
  2⤵
  PID:8128
- C:\Windows\System\lasadOO.exe
  C:\Windows\System\lasadOO.exe
  2⤵
  PID:8164
- C:\Windows\System\rltKjir.exe
  C:\Windows\System\rltKjir.exe
  2⤵
  PID:8184
- C:\Windows\System\UJdpfIw.exe
  C:\Windows\System\UJdpfIw.exe
  2⤵
  PID:7232
- C:\Windows\System\xlSWMbp.exe
  C:\Windows\System\xlSWMbp.exe
  2⤵
  PID:4592
- C:\Windows\System\ImjRwub.exe
  C:\Windows\System\ImjRwub.exe
  2⤵
  PID:7304
- C:\Windows\System\tSMXkhK.exe
  C:\Windows\System\tSMXkhK.exe
  2⤵
  PID:7408
- C:\Windows\System\QkZOPVI.exe
  C:\Windows\System\QkZOPVI.exe
  2⤵
  PID:7504
- C:\Windows\System\MAaMeTb.exe
  C:\Windows\System\MAaMeTb.exe
  2⤵
  PID:7528
- C:\Windows\System\gCrSYrd.exe
  C:\Windows\System\gCrSYrd.exe
  2⤵
  PID:7612
- C:\Windows\System\GHPcYKL.exe
  C:\Windows\System\GHPcYKL.exe
  2⤵
  PID:7684
- C:\Windows\System\zRBjoAY.exe
  C:\Windows\System\zRBjoAY.exe
  2⤵
  PID:7764
- C:\Windows\System\WhnizyO.exe
  C:\Windows\System\WhnizyO.exe
  2⤵
  PID:7760
- C:\Windows\System\qitxGEz.exe
  C:\Windows\System\qitxGEz.exe
  2⤵
  PID:7812
- C:\Windows\System\nceJLcT.exe
  C:\Windows\System\nceJLcT.exe
  2⤵
  PID:7924
- C:\Windows\System\cAvMKGZ.exe
  C:\Windows\System\cAvMKGZ.exe
  2⤵
  PID:7940
- C:\Windows\System\fsgMPdl.exe
  C:\Windows\System\fsgMPdl.exe
  2⤵
  PID:8064
- C:\Windows\System\jTpPHrN.exe
  C:\Windows\System\jTpPHrN.exe
  2⤵
  PID:8136
- C:\Windows\System\cVByBel.exe
  C:\Windows\System\cVByBel.exe
  2⤵
  PID:8152
- C:\Windows\System\xmpGlfZ.exe
  C:\Windows\System\xmpGlfZ.exe
  2⤵
  PID:7300
- C:\Windows\System\wfuEPCQ.exe
  C:\Windows\System\wfuEPCQ.exe
  2⤵
  PID:7388
- C:\Windows\System\JmCqNDH.exe
  C:\Windows\System\JmCqNDH.exe
  2⤵
  PID:7488
- C:\Windows\System\sNzunyo.exe
  C:\Windows\System\sNzunyo.exe
  2⤵
  PID:7592
- C:\Windows\System\QbrRNEa.exe
  C:\Windows\System\QbrRNEa.exe
  2⤵
  PID:7728
- C:\Windows\System\xZvIqYR.exe
  C:\Windows\System\xZvIqYR.exe
  2⤵
  PID:7888
- C:\Windows\System\aXnwzGa.exe
  C:\Windows\System\aXnwzGa.exe
  2⤵
  PID:8092
- C:\Windows\System\gCZiJWF.exe
  C:\Windows\System\gCZiJWF.exe
  2⤵
  PID:8032
- C:\Windows\System\qvoaxKM.exe
  C:\Windows\System\qvoaxKM.exe
  2⤵
  PID:7288
- C:\Windows\System\PnkIpAz.exe
  C:\Windows\System\PnkIpAz.exe
  2⤵
  PID:7624
- C:\Windows\System\qllYceW.exe
  C:\Windows\System\qllYceW.exe
  2⤵
  PID:7984
- C:\Windows\System\CiFExsV.exe
  C:\Windows\System\CiFExsV.exe
  2⤵
  PID:8204
- C:\Windows\System\ZxjCnyP.exe
  C:\Windows\System\ZxjCnyP.exe
  2⤵
  PID:8228
- C:\Windows\System\HpEhdWy.exe
  C:\Windows\System\HpEhdWy.exe
  2⤵
  PID:8292
- C:\Windows\System\WBupvis.exe
  C:\Windows\System\WBupvis.exe
  2⤵
  PID:8368
- C:\Windows\System\RkpWAbX.exe
  C:\Windows\System\RkpWAbX.exe
  2⤵
  PID:8384
- C:\Windows\System\IUbRdcZ.exe
  C:\Windows\System\IUbRdcZ.exe
  2⤵
  PID:8400
- C:\Windows\System\stKuRTe.exe
  C:\Windows\System\stKuRTe.exe
  2⤵
  PID:8420
- C:\Windows\System\fcKwfGC.exe
  C:\Windows\System\fcKwfGC.exe
  2⤵
  PID:8444
- C:\Windows\System\pgHKUTt.exe
  C:\Windows\System\pgHKUTt.exe
  2⤵
  PID:8468
- C:\Windows\System\QBDhRlF.exe
  C:\Windows\System\QBDhRlF.exe
  2⤵
  PID:8488
- C:\Windows\System\usVRKvI.exe
  C:\Windows\System\usVRKvI.exe
  2⤵
  PID:8512
- C:\Windows\System\YDtAtVs.exe
  C:\Windows\System\YDtAtVs.exe
  2⤵
  PID:8548
- C:\Windows\System\ecCIUwK.exe
  C:\Windows\System\ecCIUwK.exe
  2⤵
  PID:8576
- C:\Windows\System\coAByjk.exe
  C:\Windows\System\coAByjk.exe
  2⤵
  PID:8600
- C:\Windows\System\uczbvzh.exe
  C:\Windows\System\uczbvzh.exe
  2⤵
  PID:8616
- C:\Windows\System\vFGmZwz.exe
  C:\Windows\System\vFGmZwz.exe
  2⤵
  PID:8656
- C:\Windows\System\RwRVXbV.exe
  C:\Windows\System\RwRVXbV.exe
  2⤵
  PID:8708
- C:\Windows\System\tgsEFVp.exe
  C:\Windows\System\tgsEFVp.exe
  2⤵
  PID:8728
- C:\Windows\System\LJjUfBq.exe
  C:\Windows\System\LJjUfBq.exe
  2⤵
  PID:8752
- C:\Windows\System\SmkHDLr.exe
  C:\Windows\System\SmkHDLr.exe
  2⤵
  PID:8776
- C:\Windows\System\xLKtBxs.exe
  C:\Windows\System\xLKtBxs.exe
  2⤵
  PID:8800
- C:\Windows\System\xNIWXnE.exe
  C:\Windows\System\xNIWXnE.exe
  2⤵
  PID:8824
- C:\Windows\System\QkiDiOZ.exe
  C:\Windows\System\QkiDiOZ.exe
  2⤵
  PID:8844
- C:\Windows\System\twnYWvv.exe
  C:\Windows\System\twnYWvv.exe
  2⤵
  PID:8900
- C:\Windows\System\uYiBlsS.exe
  C:\Windows\System\uYiBlsS.exe
  2⤵
  PID:8948
- C:\Windows\System\KiXroKz.exe
  C:\Windows\System\KiXroKz.exe
  2⤵
  PID:8964
- C:\Windows\System\txbERAt.exe
  C:\Windows\System\txbERAt.exe
  2⤵
  PID:8984
- C:\Windows\System\jyNFJBg.exe
  C:\Windows\System\jyNFJBg.exe
  2⤵
  PID:9012
- C:\Windows\System\AoXQxRu.exe
  C:\Windows\System\AoXQxRu.exe
  2⤵
  PID:9036
- C:\Windows\System\RaVkwMK.exe
  C:\Windows\System\RaVkwMK.exe
  2⤵
  PID:9080
- C:\Windows\System\ZtVbnom.exe
  C:\Windows\System\ZtVbnom.exe
  2⤵
  PID:9112
- C:\Windows\System\xPlstfw.exe
  C:\Windows\System\xPlstfw.exe
  2⤵
  PID:9136
- C:\Windows\System\OSvyzMp.exe
  C:\Windows\System\OSvyzMp.exe
  2⤵
  PID:9164
- C:\Windows\System\IdIfMQm.exe
  C:\Windows\System\IdIfMQm.exe
  2⤵
  PID:9188
- C:\Windows\System\gHqEzNn.exe
  C:\Windows\System\gHqEzNn.exe
  2⤵
  PID:9208
- C:\Windows\System\ludjzwD.exe
  C:\Windows\System\ludjzwD.exe
  2⤵
  PID:7656
- C:\Windows\System\CuzQyhJ.exe
  C:\Windows\System\CuzQyhJ.exe
  2⤵
  PID:8252
- C:\Windows\System\XTvQjjX.exe
  C:\Windows\System\XTvQjjX.exe
  2⤵
  PID:8216
- C:\Windows\System\WALbboW.exe
  C:\Windows\System\WALbboW.exe
  2⤵
  PID:8364
- C:\Windows\System\dvoXGGI.exe
  C:\Windows\System\dvoXGGI.exe
  2⤵
  PID:8380
- C:\Windows\System\dIZAopA.exe
  C:\Windows\System\dIZAopA.exe
  2⤵
  PID:8476
- C:\Windows\System\HlTKtjw.exe
  C:\Windows\System\HlTKtjw.exe
  2⤵
  PID:8540
- C:\Windows\System\xpysAnU.exe
  C:\Windows\System\xpysAnU.exe
  2⤵
  PID:8592
- C:\Windows\System\PkMghGG.exe
  C:\Windows\System\PkMghGG.exe
  2⤵
  PID:8640
- C:\Windows\System\ZbuEXjP.exe
  C:\Windows\System\ZbuEXjP.exe
  2⤵
  PID:8644
- C:\Windows\System\HPHsFcZ.exe
  C:\Windows\System\HPHsFcZ.exe
  2⤵
  PID:8724
- C:\Windows\System\nOmEnfQ.exe
  C:\Windows\System\nOmEnfQ.exe
  2⤵
  PID:8816
- C:\Windows\System\YHqZhJr.exe
  C:\Windows\System\YHqZhJr.exe
  2⤵
  PID:8872
- C:\Windows\System\uWiESQi.exe
  C:\Windows\System\uWiESQi.exe
  2⤵
  PID:9028
- C:\Windows\System\MPegeVr.exe
  C:\Windows\System\MPegeVr.exe
  2⤵
  PID:9068
- C:\Windows\System\eotYDRa.exe
  C:\Windows\System\eotYDRa.exe
  2⤵
  PID:9120
- C:\Windows\System\GSPVMmt.exe
  C:\Windows\System\GSPVMmt.exe
  2⤵
  PID:9184
- C:\Windows\System\qNQNKic.exe
  C:\Windows\System\qNQNKic.exe
  2⤵
  PID:8260
- C:\Windows\System\aXbvrpU.exe
  C:\Windows\System\aXbvrpU.exe
  2⤵
  PID:8336
- C:\Windows\System\hTbEuBS.exe
  C:\Windows\System\hTbEuBS.exe
  2⤵
  PID:8312
- C:\Windows\System\vliBtdU.exe
  C:\Windows\System\vliBtdU.exe
  2⤵
  PID:8524
- C:\Windows\System\OvKOOdJ.exe
  C:\Windows\System\OvKOOdJ.exe
  2⤵
  PID:8740
- C:\Windows\System\syXVtjE.exe
  C:\Windows\System\syXVtjE.exe
  2⤵
  PID:8944
- C:\Windows\System\eDaQpNF.exe
  C:\Windows\System\eDaQpNF.exe
  2⤵
  PID:9024
- C:\Windows\System\gWvJNbO.exe
  C:\Windows\System\gWvJNbO.exe
  2⤵
  PID:9172
- C:\Windows\System\wjEhRSO.exe
  C:\Windows\System\wjEhRSO.exe
  2⤵
  PID:7636
- C:\Windows\System\jolNzra.exe
  C:\Windows\System\jolNzra.exe
  2⤵
  PID:8544
- C:\Windows\System\xRgeeVO.exe
  C:\Windows\System\xRgeeVO.exe
  2⤵
  PID:8840
- C:\Windows\System\qKHDRYD.exe
  C:\Windows\System\qKHDRYD.exe
  2⤵
  PID:8768
- C:\Windows\System\GYpBueF.exe
  C:\Windows\System\GYpBueF.exe
  2⤵
  PID:9240
- C:\Windows\System\TlROxEh.exe
  C:\Windows\System\TlROxEh.exe
  2⤵
  PID:9280
- C:\Windows\System\ustSiua.exe
  C:\Windows\System\ustSiua.exe
  2⤵
  PID:9304
- C:\Windows\System\BKdLupU.exe
  C:\Windows\System\BKdLupU.exe
  2⤵
  PID:9324
- C:\Windows\System\vUkAqRx.exe
  C:\Windows\System\vUkAqRx.exe
  2⤵
  PID:9344
- C:\Windows\System\wzMHfiQ.exe
  C:\Windows\System\wzMHfiQ.exe
  2⤵
  PID:9376
- C:\Windows\System\GvvqzDN.exe
  C:\Windows\System\GvvqzDN.exe
  2⤵
  PID:9396
- C:\Windows\System\qooeJTt.exe
  C:\Windows\System\qooeJTt.exe
  2⤵
  PID:9424
- C:\Windows\System\EmOrEja.exe
  C:\Windows\System\EmOrEja.exe
  2⤵
  PID:9440
- C:\Windows\System\UZiMxeG.exe
  C:\Windows\System\UZiMxeG.exe
  2⤵
  PID:9484
- C:\Windows\System\oOZrmTd.exe
  C:\Windows\System\oOZrmTd.exe
  2⤵
  PID:9504
- C:\Windows\System\htreZke.exe
  C:\Windows\System\htreZke.exe
  2⤵
  PID:9540
- C:\Windows\System\pdnZsaC.exe
  C:\Windows\System\pdnZsaC.exe
  2⤵
  PID:9568
- C:\Windows\System\UmneLDE.exe
  C:\Windows\System\UmneLDE.exe
  2⤵
  PID:9592
- C:\Windows\System\jtQHnyn.exe
  C:\Windows\System\jtQHnyn.exe
  2⤵
  PID:9608
- C:\Windows\System\pwWZDfP.exe
  C:\Windows\System\pwWZDfP.exe
  2⤵
  PID:9632
- C:\Windows\System\goUKYRU.exe
  C:\Windows\System\goUKYRU.exe
  2⤵
  PID:9672
- C:\Windows\System\dHJVCxS.exe
  C:\Windows\System\dHJVCxS.exe
  2⤵
  PID:9716
- C:\Windows\System\sZWVHJR.exe
  C:\Windows\System\sZWVHJR.exe
  2⤵
  PID:9744
- C:\Windows\System\BfiKaoe.exe
  C:\Windows\System\BfiKaoe.exe
  2⤵
  PID:9848
- C:\Windows\System\IxWslEA.exe
  C:\Windows\System\IxWslEA.exe
  2⤵
  PID:9876
- C:\Windows\System\PAKxzEJ.exe
  C:\Windows\System\PAKxzEJ.exe
  2⤵
  PID:9900
- C:\Windows\System\WKPhwon.exe
  C:\Windows\System\WKPhwon.exe
  2⤵
  PID:9940
- C:\Windows\System\yDpQRtO.exe
  C:\Windows\System\yDpQRtO.exe
  2⤵
  PID:9960
- C:\Windows\System\HSaJkUF.exe
  C:\Windows\System\HSaJkUF.exe
  2⤵
  PID:9980
- C:\Windows\System\wwPrzMS.exe
  C:\Windows\System\wwPrzMS.exe
  2⤵
  PID:10000
- C:\Windows\System\Pxpuxrl.exe
  C:\Windows\System\Pxpuxrl.exe
  2⤵
  PID:10016
- C:\Windows\System\zfSdCeZ.exe
  C:\Windows\System\zfSdCeZ.exe
  2⤵
  PID:10032
- C:\Windows\System\zmUhCTK.exe
  C:\Windows\System\zmUhCTK.exe
  2⤵
  PID:10048
- C:\Windows\System\knQyeWu.exe
  C:\Windows\System\knQyeWu.exe
  2⤵
  PID:10064
- C:\Windows\System\vrLCRfw.exe
  C:\Windows\System\vrLCRfw.exe
  2⤵
  PID:10080
- C:\Windows\System\JqWNgJV.exe
  C:\Windows\System\JqWNgJV.exe
  2⤵
  PID:10100
- C:\Windows\System\uOjBaZR.exe
  C:\Windows\System\uOjBaZR.exe
  2⤵
  PID:10120
- C:\Windows\System\ZRFwGwA.exe
  C:\Windows\System\ZRFwGwA.exe
  2⤵
  PID:10180
- C:\Windows\System\GhkioOW.exe
  C:\Windows\System\GhkioOW.exe
  2⤵
  PID:10204
- C:\Windows\System\IbirzUz.exe
  C:\Windows\System\IbirzUz.exe
  2⤵
  PID:9320
- C:\Windows\System\KpatqfN.exe
  C:\Windows\System\KpatqfN.exe
  2⤵
  PID:9388
- C:\Windows\System\oHvoiMT.exe
  C:\Windows\System\oHvoiMT.exe
  2⤵
  PID:9548
- C:\Windows\System\KlFXrrD.exe
  C:\Windows\System\KlFXrrD.exe
  2⤵
  PID:9600
- C:\Windows\System\nyfSkUt.exe
  C:\Windows\System\nyfSkUt.exe
  2⤵
  PID:9708
- C:\Windows\System\uZJVASA.exe
  C:\Windows\System\uZJVASA.exe
  2⤵
  PID:9776
- C:\Windows\System\AojgVUj.exe
  C:\Windows\System\AojgVUj.exe
  2⤵
  PID:9788
- C:\Windows\System\gBVInxR.exe
  C:\Windows\System\gBVInxR.exe
  2⤵
  PID:9832
- C:\Windows\System\FUzhQYt.exe
  C:\Windows\System\FUzhQYt.exe
  2⤵
  PID:10096
- C:\Windows\System\PAqqzOu.exe
  C:\Windows\System\PAqqzOu.exe
  2⤵
  PID:9992
- C:\Windows\System\lJEiuhb.exe
  C:\Windows\System\lJEiuhb.exe
  2⤵
  PID:9888
- C:\Windows\System\XYuIsYd.exe
  C:\Windows\System\XYuIsYd.exe
  2⤵
  PID:10056
- C:\Windows\System\Dkemtyz.exe
  C:\Windows\System\Dkemtyz.exe
  2⤵
  PID:9952
- C:\Windows\System\tTkStRJ.exe
  C:\Windows\System\tTkStRJ.exe
  2⤵
  PID:10112
- C:\Windows\System\MGRbcjM.exe
  C:\Windows\System\MGRbcjM.exe
  2⤵
  PID:10176
- C:\Windows\System\KQFVDtr.exe
  C:\Windows\System\KQFVDtr.exe
  2⤵
  PID:10152
- C:\Windows\System\gXTWbsT.exe
  C:\Windows\System\gXTWbsT.exe
  2⤵
  PID:9384
- C:\Windows\System\TaMmixW.exe
  C:\Windows\System\TaMmixW.exe
  2⤵
  PID:9512
- C:\Windows\System\ofYwUQd.exe
  C:\Windows\System\ofYwUQd.exe
  2⤵
  PID:9804
- C:\Windows\System\RbwSbTq.exe
  C:\Windows\System\RbwSbTq.exe
  2⤵
  PID:9844
- C:\Windows\System\CQkRkXF.exe
  C:\Windows\System\CQkRkXF.exe
  2⤵
  PID:9932
- C:\Windows\System\CxDiZBv.exe
  C:\Windows\System\CxDiZBv.exe
  2⤵
  PID:10108
- C:\Windows\System\UHHYLtI.exe
  C:\Windows\System\UHHYLtI.exe
  2⤵
  PID:9640
- C:\Windows\System\cRwkHja.exe
  C:\Windows\System\cRwkHja.exe
  2⤵
  PID:9808
- C:\Windows\System\vadkYQN.exe
  C:\Windows\System\vadkYQN.exe
  2⤵
  PID:10044
- C:\Windows\System\npsLXmW.exe
  C:\Windows\System\npsLXmW.exe
  2⤵
  PID:9144
- C:\Windows\System\dotvhRQ.exe
  C:\Windows\System\dotvhRQ.exe
  2⤵
  PID:9752
- C:\Windows\System\nIAyZms.exe
  C:\Windows\System\nIAyZms.exe
  2⤵
  PID:9292
- C:\Windows\System\bPbFmsB.exe
  C:\Windows\System\bPbFmsB.exe
  2⤵
  PID:10260
- C:\Windows\System\zCIuape.exe
  C:\Windows\System\zCIuape.exe
  2⤵
  PID:10280
- C:\Windows\System\kaAEIqH.exe
  C:\Windows\System\kaAEIqH.exe
  2⤵
  PID:10308
- C:\Windows\System\naAArof.exe
  C:\Windows\System\naAArof.exe
  2⤵
  PID:10328
- C:\Windows\System\pYhzrIP.exe
  C:\Windows\System\pYhzrIP.exe
  2⤵
  PID:10348
- C:\Windows\System\sZjAavT.exe
  C:\Windows\System\sZjAavT.exe
  2⤵
  PID:10376
- C:\Windows\System\CJzYxBX.exe
  C:\Windows\System\CJzYxBX.exe
  2⤵
  PID:10404
- C:\Windows\System\kidhCZv.exe
  C:\Windows\System\kidhCZv.exe
  2⤵
  PID:10452
- C:\Windows\System\kfgZTBN.exe
  C:\Windows\System\kfgZTBN.exe
  2⤵
  PID:10476
- C:\Windows\System\UOHAQJk.exe
  C:\Windows\System\UOHAQJk.exe
  2⤵
  PID:10500
- C:\Windows\System\giJJEbm.exe
  C:\Windows\System\giJJEbm.exe
  2⤵
  PID:10520
- C:\Windows\System\bQjZefT.exe
  C:\Windows\System\bQjZefT.exe
  2⤵
  PID:10556
- C:\Windows\System\hnxCXea.exe
  C:\Windows\System\hnxCXea.exe
  2⤵
  PID:10596
- C:\Windows\System\XWNMBrA.exe
  C:\Windows\System\XWNMBrA.exe
  2⤵
  PID:10624
- C:\Windows\System\InFkbxI.exe
  C:\Windows\System\InFkbxI.exe
  2⤵
  PID:10660
- C:\Windows\System\konUmEL.exe
  C:\Windows\System\konUmEL.exe
  2⤵
  PID:10676
- C:\Windows\System\eqJIIbo.exe
  C:\Windows\System\eqJIIbo.exe
  2⤵
  PID:10704
- C:\Windows\System\tjZiANY.exe
  C:\Windows\System\tjZiANY.exe
  2⤵
  PID:10736
- C:\Windows\System\pPixxNu.exe
  C:\Windows\System\pPixxNu.exe
  2⤵
  PID:10752
- C:\Windows\System\wszaPiU.exe
  C:\Windows\System\wszaPiU.exe
  2⤵
  PID:10772
- C:\Windows\System\rwcUhIg.exe
  C:\Windows\System\rwcUhIg.exe
  2⤵
  PID:10800
- C:\Windows\System\XIiAnWX.exe
  C:\Windows\System\XIiAnWX.exe
  2⤵
  PID:10832
- C:\Windows\System\aBaUWlR.exe
  C:\Windows\System\aBaUWlR.exe
  2⤵
  PID:10860
- C:\Windows\System\YxMqDuR.exe
  C:\Windows\System\YxMqDuR.exe
  2⤵
  PID:10880
- C:\Windows\System\ssFfIsy.exe
  C:\Windows\System\ssFfIsy.exe
  2⤵
  PID:10924
- C:\Windows\System\FwVNbhF.exe
  C:\Windows\System\FwVNbhF.exe
  2⤵
  PID:10944
- C:\Windows\System\RDnMYJT.exe
  C:\Windows\System\RDnMYJT.exe
  2⤵
  PID:10976
- C:\Windows\System\qciohki.exe
  C:\Windows\System\qciohki.exe
  2⤵
  PID:10996
- C:\Windows\System\IKAzIjJ.exe
  C:\Windows\System\IKAzIjJ.exe
  2⤵
  PID:11024
- C:\Windows\System\bFyfkoB.exe
  C:\Windows\System\bFyfkoB.exe
  2⤵
  PID:11048
- C:\Windows\System\STCNAda.exe
  C:\Windows\System\STCNAda.exe
  2⤵
  PID:11068
- C:\Windows\System\ZveTEll.exe
  C:\Windows\System\ZveTEll.exe
  2⤵
  PID:11092
- C:\Windows\System\nkiJHLX.exe
  C:\Windows\System\nkiJHLX.exe
  2⤵
  PID:11108
- C:\Windows\System\MMxswvK.exe
  C:\Windows\System\MMxswvK.exe
  2⤵
  PID:11136
- C:\Windows\System\yTHjDTB.exe
  C:\Windows\System\yTHjDTB.exe
  2⤵
  PID:11220
- C:\Windows\System\JfpkwNR.exe
  C:\Windows\System\JfpkwNR.exe
  2⤵
  PID:11240
- C:\Windows\System\zaMsUMN.exe
  C:\Windows\System\zaMsUMN.exe
  2⤵
  PID:10276
- C:\Windows\System\txBExhv.exe
  C:\Windows\System\txBExhv.exe
  2⤵
  PID:10364
- C:\Windows\System\nrSryen.exe
  C:\Windows\System\nrSryen.exe
  2⤵
  PID:10440
- C:\Windows\System\SeHYdOC.exe
  C:\Windows\System\SeHYdOC.exe
  2⤵
  PID:10468
- C:\Windows\System\INQgCuc.exe
  C:\Windows\System\INQgCuc.exe
  2⤵
  PID:10460
- C:\Windows\System\RxPujAj.exe
  C:\Windows\System\RxPujAj.exe
  2⤵
  PID:10568
- C:\Windows\System\STmweYY.exe
  C:\Windows\System\STmweYY.exe
  2⤵
  PID:10616
- C:\Windows\System\BwOUlUb.exe
  C:\Windows\System\BwOUlUb.exe
  2⤵
  PID:10672
- C:\Windows\System\ndGwlha.exe
  C:\Windows\System\ndGwlha.exe
  2⤵
  PID:10748
- C:\Windows\System\FiiSRRA.exe
  C:\Windows\System\FiiSRRA.exe
  2⤵
  PID:10848
- C:\Windows\System\hajsmDy.exe
  C:\Windows\System\hajsmDy.exe
  2⤵
  PID:10876
- C:\Windows\System\swfPzQd.exe
  C:\Windows\System\swfPzQd.exe
  2⤵
  PID:11016
- C:\Windows\System\FsUHIRc.exe
  C:\Windows\System\FsUHIRc.exe
  2⤵
  PID:10984
- C:\Windows\System\ykolHzW.exe
  C:\Windows\System\ykolHzW.exe
  2⤵
  PID:11156
- C:\Windows\System\AfofUfb.exe
  C:\Windows\System\AfofUfb.exe
  2⤵
  PID:11172
- C:\Windows\System\waMavPY.exe
  C:\Windows\System\waMavPY.exe
  2⤵
  PID:10248
- C:\Windows\System\ylDJEew.exe
  C:\Windows\System\ylDJEew.exe
  2⤵
  PID:10344
- C:\Windows\System\kcgNqvy.exe
  C:\Windows\System\kcgNqvy.exe
  2⤵
  PID:10436
- C:\Windows\System\cXbqdkW.exe
  C:\Windows\System\cXbqdkW.exe
  2⤵
  PID:10612
- C:\Windows\System\IlVWtts.exe
  C:\Windows\System\IlVWtts.exe
  2⤵
  PID:10536
- C:\Windows\System\HZSgOvc.exe
  C:\Windows\System\HZSgOvc.exe
  2⤵
  PID:10608
- C:\Windows\System\rGsazXx.exe
  C:\Windows\System\rGsazXx.exe
  2⤵
  PID:10912
- C:\Windows\System\PkMISur.exe
  C:\Windows\System\PkMISur.exe
  2⤵
  PID:11012
- C:\Windows\System\MiINFCn.exe
  C:\Windows\System\MiINFCn.exe
  2⤵
  PID:11088
- C:\Windows\System\pffWeVq.exe
  C:\Windows\System\pffWeVq.exe
  2⤵
  PID:10448
- C:\Windows\System\etAKCxA.exe
  C:\Windows\System\etAKCxA.exe
  2⤵
  PID:10872
- C:\Windows\System\FsAaCtb.exe
  C:\Windows\System\FsAaCtb.exe
  2⤵
  PID:10464
- C:\Windows\System\IlhQtlI.exe
  C:\Windows\System\IlhQtlI.exe
  2⤵
  PID:11272
- C:\Windows\System\lieszlj.exe
  C:\Windows\System\lieszlj.exe
  2⤵
  PID:11316
- C:\Windows\System\ialTqqP.exe
  C:\Windows\System\ialTqqP.exe
  2⤵
  PID:11336
- C:\Windows\System\oQcFtyK.exe
  C:\Windows\System\oQcFtyK.exe
  2⤵
  PID:11360
- C:\Windows\System\JkTmwDR.exe
  C:\Windows\System\JkTmwDR.exe
  2⤵
  PID:11388
- C:\Windows\System\brZiFFJ.exe
  C:\Windows\System\brZiFFJ.exe
  2⤵
  PID:11420
- C:\Windows\System\oAepDkH.exe
  C:\Windows\System\oAepDkH.exe
  2⤵
  PID:11440
- C:\Windows\System\CaWheSQ.exe
  C:\Windows\System\CaWheSQ.exe
  2⤵
  PID:11492
- C:\Windows\System\mKMJXQj.exe
  C:\Windows\System\mKMJXQj.exe
  2⤵
  PID:11548
- C:\Windows\System\rRrotcd.exe
  C:\Windows\System\rRrotcd.exe
  2⤵
  PID:11564
- C:\Windows\System\derRjIS.exe
  C:\Windows\System\derRjIS.exe
  2⤵
  PID:11584
- C:\Windows\System\HLZMDjF.exe
  C:\Windows\System\HLZMDjF.exe
  2⤵
  PID:11616
- C:\Windows\System\FsHHKsi.exe
  C:\Windows\System\FsHHKsi.exe
  2⤵
  PID:11636
- C:\Windows\System\pSMEeDF.exe
  C:\Windows\System\pSMEeDF.exe
  2⤵
  PID:11660
- C:\Windows\System\JhwJzkx.exe
  C:\Windows\System\JhwJzkx.exe
  2⤵
  PID:11680
- C:\Windows\System\DkSirgZ.exe
  C:\Windows\System\DkSirgZ.exe
  2⤵
  PID:11708
- C:\Windows\System\gsCINGK.exe
  C:\Windows\System\gsCINGK.exe
  2⤵
  PID:11728
- C:\Windows\System\IMeDUld.exe
  C:\Windows\System\IMeDUld.exe
  2⤵
  PID:11752
- C:\Windows\System\fmVTYtJ.exe
  C:\Windows\System\fmVTYtJ.exe
  2⤵
  PID:11768
- C:\Windows\System\cVIGljV.exe
  C:\Windows\System\cVIGljV.exe
  2⤵
  PID:11808
- C:\Windows\System\wiTHTMX.exe
  C:\Windows\System\wiTHTMX.exe
  2⤵
  PID:11836
- C:\Windows\System\puWIfng.exe
  C:\Windows\System\puWIfng.exe
  2⤵
  PID:11856
- C:\Windows\System\ydfCjcN.exe
  C:\Windows\System\ydfCjcN.exe
  2⤵
  PID:11884
- C:\Windows\System\rOkAlQz.exe
  C:\Windows\System\rOkAlQz.exe
  2⤵
  PID:11908
- C:\Windows\System\ZOyhhzV.exe
  C:\Windows\System\ZOyhhzV.exe
  2⤵
  PID:11964
- C:\Windows\System\PJvLfgX.exe
  C:\Windows\System\PJvLfgX.exe
  2⤵
  PID:11984
- C:\Windows\System\uEbpVnB.exe
  C:\Windows\System\uEbpVnB.exe
  2⤵
  PID:12004
- C:\Windows\System\OLRIGCL.exe
  C:\Windows\System\OLRIGCL.exe
  2⤵
  PID:12028
- C:\Windows\System\zaRWthk.exe
  C:\Windows\System\zaRWthk.exe
  2⤵
  PID:12056
- C:\Windows\System\XGiIMOc.exe
  C:\Windows\System\XGiIMOc.exe
  2⤵
  PID:12088
- C:\Windows\System\GNBQoYK.exe
  C:\Windows\System\GNBQoYK.exe
  2⤵
  PID:12112
- C:\Windows\System\ECGMJJo.exe
  C:\Windows\System\ECGMJJo.exe
  2⤵
  PID:12132
- C:\Windows\System\qxRORSV.exe
  C:\Windows\System\qxRORSV.exe
  2⤵
  PID:12160
- C:\Windows\System\KxomaPR.exe
  C:\Windows\System\KxomaPR.exe
  2⤵
  PID:12204
- C:\Windows\System\oSxfaig.exe
  C:\Windows\System\oSxfaig.exe
  2⤵
  PID:12224
- C:\Windows\System\CdZowpc.exe
  C:\Windows\System\CdZowpc.exe
  2⤵
  PID:12244
- C:\Windows\System\aElKpAV.exe
  C:\Windows\System\aElKpAV.exe
  2⤵
  PID:12276
- C:\Windows\System\ySXwHPC.exe
  C:\Windows\System\ySXwHPC.exe
  2⤵
  PID:11292
- C:\Windows\System\ridtddw.exe
  C:\Windows\System\ridtddw.exe
  2⤵
  PID:3508
- C:\Windows\System\vqTngBX.exe
  C:\Windows\System\vqTngBX.exe
  2⤵
  PID:11464
- C:\Windows\System\VlecYPf.exe
  C:\Windows\System\VlecYPf.exe
  2⤵
  PID:11528
- C:\Windows\System\eDVjntC.exe
  C:\Windows\System\eDVjntC.exe
  2⤵
  PID:11592
- C:\Windows\System\NkBzWsA.exe
  C:\Windows\System\NkBzWsA.exe
  2⤵
  PID:11608
- C:\Windows\System\LvXehrU.exe
  C:\Windows\System\LvXehrU.exe
  2⤵
  PID:11720
- C:\Windows\System\TaGJWgq.exe
  C:\Windows\System\TaGJWgq.exe
  2⤵
  PID:11748
- C:\Windows\System\NjRVfej.exe
  C:\Windows\System\NjRVfej.exe
  2⤵
  PID:11788
- C:\Windows\System\fCrNUvI.exe
  C:\Windows\System\fCrNUvI.exe
  2⤵
  PID:11828
- C:\Windows\System\yVBmWju.exe
  C:\Windows\System\yVBmWju.exe
  2⤵
  PID:11892
- C:\Windows\System\Yssncmn.exe
  C:\Windows\System\Yssncmn.exe
  2⤵
  PID:12020
- C:\Windows\System\PjRAiNe.exe
  C:\Windows\System\PjRAiNe.exe
  2⤵
  PID:11760
- C:\Windows\System\RUbkxfi.exe
  C:\Windows\System\RUbkxfi.exe
  2⤵
  PID:11820
- C:\Windows\System\vhBqhHJ.exe
  C:\Windows\System\vhBqhHJ.exe
  2⤵
  PID:11944
- C:\Windows\System\MMJLKWm.exe
  C:\Windows\System\MMJLKWm.exe
  2⤵
  PID:12068
- C:\Windows\System\DkoeqXU.exe
  C:\Windows\System\DkoeqXU.exe
  2⤵
  PID:1984
- C:\Windows\System\ovVCRRl.exe
  C:\Windows\System\ovVCRRl.exe
  2⤵
  PID:12156
- C:\Windows\System\utRzqlA.exe
  C:\Windows\System\utRzqlA.exe
  2⤵
  PID:12268
- C:\Windows\System\HMPgBpO.exe
  C:\Windows\System\HMPgBpO.exe
  2⤵
  PID:4492
- C:\Windows\System\JpuYZoH.exe
  C:\Windows\System\JpuYZoH.exe
  2⤵
  PID:2660
- C:\Windows\System\GuWeptT.exe
  C:\Windows\System\GuWeptT.exe
  2⤵
  PID:12124
- C:\Windows\System\SjJPgSY.exe
  C:\Windows\System\SjJPgSY.exe
  2⤵
  PID:11572
- C:\Windows\System\aaHlKeh.exe
  C:\Windows\System\aaHlKeh.exe
  2⤵
  PID:11804
- C:\Windows\System\PVCGgAe.exe
  C:\Windows\System\PVCGgAe.exe
  2⤵
  PID:3768
- C:\Windows\System\tZtQjbl.exe
  C:\Windows\System\tZtQjbl.exe
  2⤵
  PID:11268
- C:\Windows\System\rqylTCb.exe
  C:\Windows\System\rqylTCb.exe
  2⤵
  PID:532
- C:\Windows\System\BfOkzwr.exe
  C:\Windows\System\BfOkzwr.exe
  2⤵
  PID:11844
- C:\Windows\System\OFzTjki.exe
  C:\Windows\System\OFzTjki.exe
  2⤵
  PID:4352
- C:\Windows\System\CWlLWXl.exe
  C:\Windows\System\CWlLWXl.exe
  2⤵
  PID:12152
- C:\Windows\System\EzNHIOp.exe
  C:\Windows\System\EzNHIOp.exe
  2⤵
  PID:1900
- C:\Windows\System\xwfMMHX.exe
  C:\Windows\System\xwfMMHX.exe
  2⤵
  PID:1620
- C:\Windows\System\ODmqwxu.exe
  C:\Windows\System\ODmqwxu.exe
  2⤵
  PID:12320
- C:\Windows\System\JLyBOoR.exe
  C:\Windows\System\JLyBOoR.exe
  2⤵
  PID:12344
- C:\Windows\System\fuKXWnh.exe
  C:\Windows\System\fuKXWnh.exe
  2⤵
  PID:12368
- C:\Windows\System\vXjwpxa.exe
  C:\Windows\System\vXjwpxa.exe
  2⤵
  PID:12408
- C:\Windows\System\gahmmQD.exe
  C:\Windows\System\gahmmQD.exe
  2⤵
  PID:12432
- C:\Windows\System\cQVemId.exe
  C:\Windows\System\cQVemId.exe
  2⤵
  PID:12456
- C:\Windows\System\iGWOdlq.exe
  C:\Windows\System\iGWOdlq.exe
  2⤵
  PID:12484
- C:\Windows\System\AIXZRrB.exe
  C:\Windows\System\AIXZRrB.exe
  2⤵
  PID:12508
- C:\Windows\System\RfEAMPX.exe
  C:\Windows\System\RfEAMPX.exe
  2⤵
  PID:12560
- C:\Windows\System\XZfpkIR.exe
  C:\Windows\System\XZfpkIR.exe
  2⤵
  PID:12584
- C:\Windows\System\bHhEDIT.exe
  C:\Windows\System\bHhEDIT.exe
  2⤵
  PID:12604
- C:\Windows\System\sNFJDSz.exe
  C:\Windows\System\sNFJDSz.exe
  2⤵
  PID:12628
- C:\Windows\System\oknGRTL.exe
  C:\Windows\System\oknGRTL.exe
  2⤵
  PID:12648
- C:\Windows\System\WbvYkrm.exe
  C:\Windows\System\WbvYkrm.exe
  2⤵
  PID:12672
- C:\Windows\System\LPiCrYS.exe
  C:\Windows\System\LPiCrYS.exe
  2⤵
  PID:12696
- C:\Windows\System\DMhYOHc.exe
  C:\Windows\System\DMhYOHc.exe
  2⤵
  PID:12720
- C:\Windows\System\eGhCyVb.exe
  C:\Windows\System\eGhCyVb.exe
  2⤵
  PID:12752
- C:\Windows\System\srcecVN.exe
  C:\Windows\System\srcecVN.exe
  2⤵
  PID:12804
- C:\Windows\System\ZuGgsgJ.exe
  C:\Windows\System\ZuGgsgJ.exe
  2⤵
  PID:12880
- C:\Windows\System\ynMjTXz.exe
  C:\Windows\System\ynMjTXz.exe
  2⤵
  PID:12900
- C:\Windows\System\AhZnFio.exe
  C:\Windows\System\AhZnFio.exe
  2⤵
  PID:12924
- C:\Windows\System\fjjxrWG.exe
  C:\Windows\System\fjjxrWG.exe
  2⤵
  PID:12980
- C:\Windows\System\PEWuqhq.exe
  C:\Windows\System\PEWuqhq.exe
  2⤵
  PID:13000
- C:\Windows\System\pcflcwC.exe
  C:\Windows\System\pcflcwC.exe
  2⤵
  PID:13016
- C:\Windows\System\DmlveBZ.exe
  C:\Windows\System\DmlveBZ.exe
  2⤵
  PID:13040
- C:\Windows\System\ICIviYr.exe
  C:\Windows\System\ICIviYr.exe
  2⤵
  PID:13084
- C:\Windows\System\dEJumel.exe
  C:\Windows\System\dEJumel.exe
  2⤵
  PID:13120
- C:\Windows\System\OrYrgWL.exe
  C:\Windows\System\OrYrgWL.exe
  2⤵
  PID:13140
- C:\Windows\System\jNhPckw.exe
  C:\Windows\System\jNhPckw.exe
  2⤵
  PID:13156
- C:\Windows\System\dgoCTWH.exe
  C:\Windows\System\dgoCTWH.exe
  2⤵
  PID:13180
- C:\Windows\System\eBMUomi.exe
  C:\Windows\System\eBMUomi.exe
  2⤵
  PID:13228
- C:\Windows\System\xMfsZJq.exe
  C:\Windows\System\xMfsZJq.exe
  2⤵
  PID:13256
- C:\Windows\System\AWmdosW.exe
  C:\Windows\System\AWmdosW.exe
  2⤵
  PID:13280
- C:\Windows\System\dMWjDlk.exe
  C:\Windows\System\dMWjDlk.exe
  2⤵
  PID:13300
- C:\Windows\System\NLbKTJQ.exe
  C:\Windows\System\NLbKTJQ.exe
  2⤵
  PID:12292
- C:\Windows\System\MAyZCgD.exe
  C:\Windows\System\MAyZCgD.exe
  2⤵
  PID:12312
- C:\Windows\System\FQACoSq.exe
  C:\Windows\System\FQACoSq.exe
  2⤵
  PID:12332
- C:\Windows\System\IegGsnc.exe
  C:\Windows\System\IegGsnc.exe
  2⤵
  PID:13224
- C:\Windows\System\DPjrhHk.exe
  C:\Windows\System\DPjrhHk.exe
  2⤵
  PID:12520
- C:\Windows\System\iyKcOMi.exe
  C:\Windows\System\iyKcOMi.exe
  2⤵
  PID:12476
- C:\Windows\System\GozreBQ.exe
  C:\Windows\System\GozreBQ.exe
  2⤵
  PID:13012
- C:\Windows\System\oKMzQda.exe
  C:\Windows\System\oKMzQda.exe
  2⤵
  PID:12592
- C:\Windows\System\wSTheKi.exe
  C:\Windows\System\wSTheKi.exe
  2⤵
  PID:13152
- C:\Windows\System\JTGGAFp.exe
  C:\Windows\System\JTGGAFp.exe
  2⤵
  PID:13236
- C:\Windows\System\ScPBTCc.exe
  C:\Windows\System\ScPBTCc.exe
  2⤵
  PID:13308
- C:\Windows\System\nhgIRLr.exe
  C:\Windows\System\nhgIRLr.exe
  2⤵
  PID:11604
- C:\Windows\System\OYnWWnN.exe
  C:\Windows\System\OYnWWnN.exe
  2⤵
  PID:12392
- C:\Windows\System\BdCArNe.exe
  C:\Windows\System\BdCArNe.exe
  2⤵
  PID:12492
- C:\Windows\System\fdQHGta.exe
  C:\Windows\System\fdQHGta.exe
  2⤵
  PID:12664
- C:\Windows\System\MBueLNV.exe
  C:\Windows\System\MBueLNV.exe
  2⤵
  PID:12576
- C:\Windows\System\nTEGMzu.exe
  C:\Windows\System\nTEGMzu.exe
  2⤵
  PID:4708
- C:\Windows\System\InFWaEj.exe
  C:\Windows\System\InFWaEj.exe
  2⤵
  PID:12888
- C:\Windows\System\TSMOOfN.exe
  C:\Windows\System\TSMOOfN.exe
  2⤵
  PID:12960
- C:\Windows\System\QtopmVE.exe
  C:\Windows\System\QtopmVE.exe
  2⤵
  PID:13024
- C:\Windows\System\mPBWYPu.exe
  C:\Windows\System\mPBWYPu.exe
  2⤵
  PID:12424
- C:\Windows\System\EfVZdQp.exe
  C:\Windows\System\EfVZdQp.exe
  2⤵
  PID:12952
- C:\Windows\System\TXDWLrx.exe
  C:\Windows\System\TXDWLrx.exe
  2⤵
  PID:3336
- C:\Windows\System\yvKzDia.exe
  C:\Windows\System\yvKzDia.exe
  2⤵
  PID:4344
- C:\Windows\System\VOxneTi.exe
  C:\Windows\System\VOxneTi.exe
  2⤵
  PID:12620
- C:\Windows\System\IHAVjxg.exe
  C:\Windows\System\IHAVjxg.exe
  2⤵
  PID:4252
- C:\Windows\System\IIFARqG.exe
  C:\Windows\System\IIFARqG.exe
  2⤵
  PID:440
- C:\Windows\System\twACgjN.exe
  C:\Windows\System\twACgjN.exe
  2⤵
  PID:3992
- C:\Windows\System\RChLUKV.exe
  C:\Windows\System\RChLUKV.exe
  2⤵
  PID:12308
- C:\Windows\System\WlkNbQF.exe
  C:\Windows\System\WlkNbQF.exe
  2⤵
  PID:452
- C:\Windows\System\UhskWbI.exe
  C:\Windows\System\UhskWbI.exe
  2⤵
  PID:1696
- C:\Windows\System\uMTFIGw.exe
  C:\Windows\System\uMTFIGw.exe
  2⤵
  PID:3104
- C:\Windows\System\ZJHdDVU.exe
  C:\Windows\System\ZJHdDVU.exe
  2⤵
  PID:7056
- C:\Windows\System\sWQRaki.exe
  C:\Windows\System\sWQRaki.exe
  2⤵
  PID:12464
- C:\Windows\System\qjZZeFr.exe
  C:\Windows\System\qjZZeFr.exe
  2⤵
  PID:4744
- C:\Windows\System\GbymxSa.exe
  C:\Windows\System\GbymxSa.exe
  2⤵
  PID:4884
- C:\Windows\System\tYzvgBp.exe
  C:\Windows\System\tYzvgBp.exe
  2⤵
  PID:13296
- C:\Windows\System\BWozLEH.exe
  C:\Windows\System\BWozLEH.exe
  2⤵
  PID:3956
- C:\Windows\System\LtqdzWa.exe
  C:\Windows\System\LtqdzWa.exe
  2⤵
  PID:4856
- C:\Windows\System\YgkrZcZ.exe
  C:\Windows\System\YgkrZcZ.exe
  2⤵
  PID:7092
- C:\Windows\System\AuznkaT.exe
  C:\Windows\System\AuznkaT.exe
  2⤵
  PID:4648
- C:\Windows\System\rDQNpny.exe
  C:\Windows\System\rDQNpny.exe
  2⤵
  PID:7224
- C:\Windows\System\yksUuED.exe
  C:\Windows\System\yksUuED.exe
  2⤵
  PID:3432
- C:\Windows\System\fWcSipg.exe
  C:\Windows\System\fWcSipg.exe
  2⤵
  PID:4748
- C:\Windows\System\GAOjseA.exe
  C:\Windows\System\GAOjseA.exe
  2⤵
  PID:2296
- C:\Windows\System\pOIVJaZ.exe
  C:\Windows\System\pOIVJaZ.exe
  2⤵
  PID:3996
- C:\Windows\System\TuIBqUp.exe
  C:\Windows\System\TuIBqUp.exe
  2⤵
  PID:8020
- C:\Windows\System\DIVcSiE.exe
  C:\Windows\System\DIVcSiE.exe
  2⤵
  PID:8052
- C:\Windows\System\XPUKkdp.exe
  C:\Windows\System\XPUKkdp.exe
  2⤵
  PID:8140
- C:\Windows\System\AcrJaDj.exe
  C:\Windows\System\AcrJaDj.exe
  2⤵
  PID:6160
- C:\Windows\System\FqmfzyP.exe
  C:\Windows\System\FqmfzyP.exe
  2⤵
  PID:7256
- C:\Windows\System\elRTJaV.exe
  C:\Windows\System\elRTJaV.exe
  2⤵
  PID:7360
- C:\Windows\System\lumwHNe.exe
  C:\Windows\System\lumwHNe.exe
  2⤵
  PID:7448
- C:\Windows\System\ocGhEvk.exe
  C:\Windows\System\ocGhEvk.exe
  2⤵
  PID:7844
- C:\Windows\System\RevvPMY.exe
  C:\Windows\System\RevvPMY.exe
  2⤵
  PID:8044
- C:\Windows\System\hYzquNV.exe
  C:\Windows\System\hYzquNV.exe
  2⤵
  PID:8224
- C:\Windows\System\dkSPodG.exe
  C:\Windows\System\dkSPodG.exe
  2⤵
  PID:8276
- C:\Windows\System\LPRmodL.exe
  C:\Windows\System\LPRmodL.exe
  2⤵
  PID:8432
- C:\Windows\System\HsWbVEs.exe
  C:\Windows\System\HsWbVEs.exe
  2⤵
  PID:8508
- C:\Windows\System\Iqcciis.exe
  C:\Windows\System\Iqcciis.exe
  2⤵
  PID:8564
- C:\Windows\System\YfNvcuh.exe
  C:\Windows\System\YfNvcuh.exe
  2⤵
  PID:4828
- C:\Windows\System\ZhMHdGh.exe
  C:\Windows\System\ZhMHdGh.exe
  2⤵
  PID:4920
- C:\Windows\System\SbBBpTc.exe
  C:\Windows\System\SbBBpTc.exe
  2⤵
  PID:8880
- C:\Windows\System\zrxsmCT.exe
  C:\Windows\System\zrxsmCT.exe
  2⤵
  PID:1380
- C:\Windows\System\uuJZBMI.exe
  C:\Windows\System\uuJZBMI.exe
  2⤵
  PID:4852
- C:\Windows\System\NfzXGyx.exe
  C:\Windows\System\NfzXGyx.exe
  2⤵
  PID:4664
- C:\Windows\System\UCwugiE.exe
  C:\Windows\System\UCwugiE.exe
  2⤵
  PID:812
- C:\Windows\System\UHgTBRu.exe
  C:\Windows\System\UHgTBRu.exe
  2⤵
  PID:3320
- C:\Windows\System\QScdaEr.exe
  C:\Windows\System\QScdaEr.exe
  2⤵
  PID:9064
- C:\Windows\System\MHTlozs.exe
  C:\Windows\System\MHTlozs.exe
  2⤵
  PID:4444
- C:\Windows\System\CzeshGI.exe
  C:\Windows\System\CzeshGI.exe
  2⤵
  PID:2240
- C:\Windows\System\UPwWiBi.exe
  C:\Windows\System\UPwWiBi.exe
  2⤵
  PID:1868
- C:\Windows\System\gEFFoTO.exe
  C:\Windows\System\gEFFoTO.exe
  2⤵
  PID:7484
- C:\Windows\System\pOTefGg.exe
  C:\Windows\System\pOTefGg.exe
  2⤵
  PID:7796
- C:\Windows\System\xMHfcZt.exe
  C:\Windows\System\xMHfcZt.exe
  2⤵
  PID:7968
- C:\Windows\System\axVmrpt.exe
  C:\Windows\System\axVmrpt.exe
  2⤵
  PID:4316
- C:\Windows\System\KcnCepO.exe
  C:\Windows\System\KcnCepO.exe
  2⤵
  PID:7960
- C:\Windows\System\TcKkKwD.exe
  C:\Windows\System\TcKkKwD.exe
  2⤵
  PID:7956
- C:\Windows\System\ZyGtaQK.exe
  C:\Windows\System\ZyGtaQK.exe
  2⤵
  PID:8696
- C:\Windows\System\hmMwXks.exe
  C:\Windows\System\hmMwXks.exe
  2⤵
  PID:7640
- C:\Windows\System\YpSBxUG.exe
  C:\Windows\System\YpSBxUG.exe
  2⤵
  PID:8340
- C:\Windows\System\GJvOoSM.exe
  C:\Windows\System\GJvOoSM.exe
  2⤵
  PID:4572
- C:\Windows\System\XsDoain.exe
  C:\Windows\System\XsDoain.exe
  2⤵
  PID:7380
- C:\Windows\System\VCChHHV.exe
  C:\Windows\System\VCChHHV.exe
  2⤵
  PID:3076
- C:\Windows\System\yaAbyWz.exe
  C:\Windows\System\yaAbyWz.exe
  2⤵
  PID:3864
- C:\Windows\System\qbDPfZB.exe
  C:\Windows\System\qbDPfZB.exe
  2⤵
  PID:740
- C:\Windows\System\cYJeLvz.exe
  C:\Windows\System\cYJeLvz.exe
  2⤵
  PID:1928
- C:\Windows\System\qxkUZKr.exe
  C:\Windows\System\qxkUZKr.exe
  2⤵
  PID:1652
- C:\Windows\System\FSYcwlD.exe
  C:\Windows\System\FSYcwlD.exe
  2⤵
  PID:5144
- C:\Windows\System\kXUGWNo.exe
  C:\Windows\System\kXUGWNo.exe
  2⤵
  PID:4324
- C:\Windows\System\mbgkirF.exe
  C:\Windows\System\mbgkirF.exe
  2⤵
  PID:3712
- C:\Windows\System\FiJiyvt.exe
  C:\Windows\System\FiJiyvt.exe
  2⤵
  PID:5268
- C:\Windows\System\kQfJCCI.exe
  C:\Windows\System\kQfJCCI.exe
  2⤵
  PID:9332
- C:\Windows\System\zlOdHjT.exe
  C:\Windows\System\zlOdHjT.exe
  2⤵
  PID:1896
- C:\Windows\System\bXQHFmt.exe
  C:\Windows\System\bXQHFmt.exe
  2⤵
  PID:4612
- C:\Windows\System\VlkXgYT.exe
  C:\Windows\System\VlkXgYT.exe
  2⤵
  PID:5396
- C:\Windows\System\AIgZVox.exe
  C:\Windows\System\AIgZVox.exe
  2⤵
  PID:5408
- C:\Windows\System\GZRztrP.exe
  C:\Windows\System\GZRztrP.exe
  2⤵
  PID:5436
- C:\Windows\System\GGclkMG.exe
  C:\Windows\System\GGclkMG.exe
  2⤵
  PID:4936
- C:\Windows\System\TcfWPiN.exe
  C:\Windows\System\TcfWPiN.exe
  2⤵
  PID:9692
- C:\Windows\System\ENwPCGR.exe
  C:\Windows\System\ENwPCGR.exe
  2⤵
  PID:7876
- C:\Windows\System\iWsbUxs.exe
  C:\Windows\System\iWsbUxs.exe
  2⤵
  PID:7952
- C:\Windows\System\TZElPyW.exe
  C:\Windows\System\TZElPyW.exe
  2⤵
  PID:4092
- C:\Windows\System\kVgfgnG.exe
  C:\Windows\System\kVgfgnG.exe
  2⤵
  PID:7588
- C:\Windows\System\ObujbQV.exe
  C:\Windows\System\ObujbQV.exe
  2⤵
  PID:8980
- C:\Windows\System\zDpYoDk.exe
  C:\Windows\System\zDpYoDk.exe
  2⤵
  PID:4268
- C:\Windows\System\IiZsXhV.exe
  C:\Windows\System\IiZsXhV.exe
  2⤵
  PID:8240
- C:\Windows\System\vTktLlr.exe
  C:\Windows\System\vTktLlr.exe
  2⤵
  PID:5816
- C:\Windows\System\IJiSckh.exe
  C:\Windows\System\IJiSckh.exe
  2⤵
  PID:5580
- C:\Windows\System\kiEbVqR.exe
  C:\Windows\System\kiEbVqR.exe
  2⤵
  PID:8596
- C:\Windows\System\JYXxshY.exe
  C:\Windows\System\JYXxshY.exe
  2⤵
  PID:5876
- C:\Windows\System\oUxncjB.exe
  C:\Windows\System\oUxncjB.exe
  2⤵
  PID:9816
- C:\Windows\System\hvJdaJW.exe
  C:\Windows\System\hvJdaJW.exe
  2⤵
  PID:5200
- C:\Windows\System\aLKfEHq.exe
  C:\Windows\System\aLKfEHq.exe
  2⤵
  PID:216
- C:\Windows\System\aLwAcrh.exe
  C:\Windows\System\aLwAcrh.exe
  2⤵
  PID:5940
- C:\Windows\System\AgrHJgi.exe
  C:\Windows\System\AgrHJgi.exe
  2⤵
  PID:9096
- C:\Windows\System\QSQxySE.exe
  C:\Windows\System\QSQxySE.exe
  2⤵
  PID:4524
- C:\Windows\System\qQLQPPv.exe
  C:\Windows\System\qQLQPPv.exe
  2⤵
  PID:6020
- C:\Windows\System\gHUjIIc.exe
  C:\Windows\System\gHUjIIc.exe
  2⤵
  PID:6024
- C:\Windows\System\JEEnoJm.exe
  C:\Windows\System\JEEnoJm.exe
  2⤵
  PID:7324
- C:\Windows\System\CdfVOWb.exe
  C:\Windows\System\CdfVOWb.exe
  2⤵
  PID:7980
- C:\Windows\System\aDxdYSi.exe
  C:\Windows\System\aDxdYSi.exe
  2⤵
  PID:9696
- C:\Windows\System\dmXColF.exe
  C:\Windows\System\dmXColF.exe
  2⤵
  PID:7432
- C:\Windows\System\uISqcPt.exe
  C:\Windows\System\uISqcPt.exe
  2⤵
  PID:5620
- C:\Windows\System\zAegEIj.exe
  C:\Windows\System\zAegEIj.exe
  2⤵
  PID:6136
- C:\Windows\System\zwDDFGa.exe
  C:\Windows\System\zwDDFGa.exe
  2⤵
  PID:4840
- C:\Windows\System\QaAXJRV.exe
  C:\Windows\System\QaAXJRV.exe
  2⤵
  PID:5788
- C:\Windows\System\vSsAQSR.exe
  C:\Windows\System\vSsAQSR.exe
  2⤵
  PID:4428
- C:\Windows\System\kaivmYA.exe
  C:\Windows\System\kaivmYA.exe
  2⤵
  PID:2696
- C:\Windows\System\gdXIbfg.exe
  C:\Windows\System\gdXIbfg.exe
  2⤵
  PID:4632
- C:\Windows\System\uYbEYsq.exe
  C:\Windows\System\uYbEYsq.exe
  2⤵
  PID:3964
- C:\Windows\System\yfSXXms.exe
  C:\Windows\System\yfSXXms.exe
  2⤵
  PID:5992
- C:\Windows\System\cknfknV.exe
  C:\Windows\System\cknfknV.exe
  2⤵
  PID:5388
- C:\Windows\System\JFORIhk.exe
  C:\Windows\System\JFORIhk.exe
  2⤵
  PID:10136
- C:\Windows\System\CjYBtxk.exe
  C:\Windows\System\CjYBtxk.exe
  2⤵
  PID:6068
- C:\Windows\System\EKZgRVM.exe
  C:\Windows\System\EKZgRVM.exe
  2⤵
  PID:5604
- C:\Windows\System\DIGBjAI.exe
  C:\Windows\System\DIGBjAI.exe
  2⤵
  PID:5664
- C:\Windows\System\dRXyeDS.exe
  C:\Windows\System\dRXyeDS.exe
  2⤵
  PID:544
- C:\Windows\System\VPCfzwf.exe
  C:\Windows\System\VPCfzwf.exe
  2⤵
  PID:5820
- C:\Windows\System\GlEabVR.exe
  C:\Windows\System\GlEabVR.exe
  2⤵
  PID:9792
- C:\Windows\System\IXRhUte.exe
  C:\Windows\System\IXRhUte.exe
  2⤵
  PID:5948
- C:\Windows\System\WbGkqBI.exe
  C:\Windows\System\WbGkqBI.exe
  2⤵
  PID:5884
- C:\Windows\System\Dxnxuew.exe
  C:\Windows\System\Dxnxuew.exe
  2⤵
  PID:5224
- C:\Windows\System\FkYjUTh.exe
  C:\Windows\System\FkYjUTh.exe
  2⤵
  PID:10576
- C:\Windows\System\MaWBnPC.exe
  C:\Windows\System\MaWBnPC.exe
  2⤵
  PID:10788
- C:\Windows\System\plPLYMd.exe
  C:\Windows\System\plPLYMd.exe
  2⤵
  PID:6040
- C:\Windows\System\wpVcoMn.exe
  C:\Windows\System\wpVcoMn.exe
  2⤵
  PID:10968
- C:\Windows\System\UiGcEbQ.exe
  C:\Windows\System\UiGcEbQ.exe
  2⤵
  PID:10268
- C:\Windows\System\oQWJGqG.exe
  C:\Windows\System\oQWJGqG.exe
  2⤵
  PID:536
- C:\Windows\System\qEOOZEc.exe
  C:\Windows\System\qEOOZEc.exe
  2⤵
  PID:5332
- C:\Windows\System\KqUiybQ.exe
  C:\Windows\System\KqUiybQ.exe
  2⤵
  PID:5584
- C:\Windows\System\BXIUoSx.exe
  C:\Windows\System\BXIUoSx.exe
  2⤵
  PID:5420
- C:\Windows\System\fGaDtuo.exe
  C:\Windows\System\fGaDtuo.exe
  2⤵
  PID:6088
- C:\Windows\System\sVVucKe.exe
  C:\Windows\System\sVVucKe.exe
  2⤵
  PID:404
- C:\Windows\System\pVsGYMd.exe
  C:\Windows\System\pVsGYMd.exe
  2⤵
  PID:5056
- C:\Windows\System\SSUEMPB.exe
  C:\Windows\System\SSUEMPB.exe
  2⤵
  PID:5608
- C:\Windows\System\JAtgcee.exe
  C:\Windows\System\JAtgcee.exe
  2⤵
  PID:6252
- C:\Windows\System\KfNxqRZ.exe
  C:\Windows\System\KfNxqRZ.exe
  2⤵
  PID:6200
- C:\Windows\System\MWLxEZL.exe
  C:\Windows\System\MWLxEZL.exe
  2⤵
  PID:5760
- C:\Windows\System\cElDccD.exe
  C:\Windows\System\cElDccD.exe
  2⤵
  PID:6216
- C:\Windows\System\cBbovzq.exe
  C:\Windows\System\cBbovzq.exe
  2⤵
  PID:6320
- C:\Windows\System\nxqjlrD.exe
  C:\Windows\System\nxqjlrD.exe
  2⤵
  PID:6868
- C:\Windows\System\lznOaSs.exe
  C:\Windows\System\lznOaSs.exe
  2⤵
  PID:7352
- C:\Windows\System\wJmsUnN.exe
  C:\Windows\System\wJmsUnN.exe
  2⤵
  PID:10828
- C:\Windows\System\IRXeNKr.exe
  C:\Windows\System\IRXeNKr.exe
  2⤵
  PID:4504
- C:\Windows\System\RLOqiiy.exe
  C:\Windows\System\RLOqiiy.exe
  2⤵
  PID:6660
- C:\Windows\System\YJWmvlv.exe
  C:\Windows\System\YJWmvlv.exe
  2⤵
  PID:6192
- C:\Windows\System\UheGDMS.exe
  C:\Windows\System\UheGDMS.exe
  2⤵
  PID:6032
- C:\Windows\System\itAiCDT.exe
  C:\Windows\System\itAiCDT.exe
  2⤵
  PID:6280
- C:\Windows\System\dcvZmYG.exe
  C:\Windows\System\dcvZmYG.exe
  2⤵
  PID:5356
- C:\Windows\System\zPAqEQB.exe
  C:\Windows\System\zPAqEQB.exe
  2⤵
  PID:11504
- C:\Windows\System\NbdOHnp.exe
  C:\Windows\System\NbdOHnp.exe
  2⤵
  PID:5520
- C:\Windows\System\RVNhigM.exe
  C:\Windows\System\RVNhigM.exe
  2⤵
  PID:5240
- C:\Windows\System\CyVJyVq.exe
  C:\Windows\System\CyVJyVq.exe
  2⤵
  PID:11880
- C:\Windows\System\dvUoOPc.exe
  C:\Windows\System\dvUoOPc.exe
  2⤵
  PID:11980
- C:\Windows\System\eKbxPXh.exe
  C:\Windows\System\eKbxPXh.exe
  2⤵
  PID:964
- C:\Windows\System\dCmlIkG.exe
  C:\Windows\System\dCmlIkG.exe
  2⤵
  PID:6180
- C:\Windows\System\DGBinzZ.exe
  C:\Windows\System\DGBinzZ.exe
  2⤵
  PID:6684
- C:\Windows\System\nhwHIqE.exe
  C:\Windows\System\nhwHIqE.exe
  2⤵
  PID:12380
- C:\Windows\System\RHsHxnx.exe
  C:\Windows\System\RHsHxnx.exe
  2⤵
  PID:11508
- C:\Windows\System\Ypcqagu.exe
  C:\Windows\System\Ypcqagu.exe
  2⤵
  PID:12516
- C:\Windows\System\mEzlxKf.exe
  C:\Windows\System\mEzlxKf.exe
  2⤵
  PID:13200
- C:\Windows\System\SMzBcFz.exe
  C:\Windows\System\SMzBcFz.exe
  2⤵
  PID:11628
- C:\Windows\System\rfQQIfc.exe
  C:\Windows\System\rfQQIfc.exe
  2⤵
  PID:6272
- C:\Windows\System\mfARNjj.exe
  C:\Windows\System\mfARNjj.exe
  2⤵
  PID:6300
- C:\Windows\System\IfgxYQv.exe
  C:\Windows\System\IfgxYQv.exe
  2⤵
  PID:6304
- C:\Windows\System\WSXILWi.exe
  C:\Windows\System\WSXILWi.exe
  2⤵
  PID:6828
- C:\Windows\System\CEPVUAT.exe
  C:\Windows\System\CEPVUAT.exe
  2⤵
  PID:6528
- C:\Windows\System\ttqpRkC.exe
  C:\Windows\System\ttqpRkC.exe
  2⤵
  PID:6524
- C:\Windows\System\mAkXpWo.exe
  C:\Windows\System\mAkXpWo.exe
  2⤵
  PID:6632
- C:\Windows\System\WdjPxtT.exe
  C:\Windows\System\WdjPxtT.exe
  2⤵
  PID:6900
- C:\Windows\System\gsgSUcM.exe
  C:\Windows\System\gsgSUcM.exe
  2⤵
  PID:6944
- C:\Windows\System\DlJkqOy.exe
  C:\Windows\System\DlJkqOy.exe
  2⤵
  PID:12000
- C:\Windows\System\mWoiznb.exe
  C:\Windows\System\mWoiznb.exe
  2⤵
  PID:3576
- C:\Windows\System\sSEFiRI.exe
  C:\Windows\System\sSEFiRI.exe
  2⤵
  PID:2812
- C:\Windows\System\pIKZJWU.exe
  C:\Windows\System\pIKZJWU.exe
  2⤵
  PID:6292
- C:\Windows\System\dRijjwm.exe
  C:\Windows\System\dRijjwm.exe
  2⤵
  PID:6752
- C:\Windows\System\LwQMXNm.exe
  C:\Windows\System\LwQMXNm.exe
  2⤵
  PID:3220
- C:\Windows\System\YcamHMq.exe
  C:\Windows\System\YcamHMq.exe
  2⤵
  PID:3604
- C:\Windows\System\fhfgjrn.exe
  C:\Windows\System\fhfgjrn.exe
  2⤵
  PID:9060
- C:\Windows\System\ASXsZBB.exe
  C:\Windows\System\ASXsZBB.exe
  2⤵
  PID:6560
- C:\Windows\System\eeHCYrg.exe
  C:\Windows\System\eeHCYrg.exe
  2⤵
  PID:11936
- C:\Windows\System\JktlrQU.exe
  C:\Windows\System\JktlrQU.exe
  2⤵
  PID:5920
- C:\Windows\System\RUszwaq.exe
  C:\Windows\System\RUszwaq.exe
  2⤵
  PID:7188
- C:\Windows\System\hzzDfok.exe
  C:\Windows\System\hzzDfok.exe
  2⤵
  PID:11308
- C:\Windows\System\VpDDCfN.exe
  C:\Windows\System\VpDDCfN.exe
  2⤵
  PID:5164
- C:\Windows\System\KTloVoP.exe
  C:\Windows\System\KTloVoP.exe
  2⤵
  PID:13248
- C:\Windows\System\bshZnyG.exe
  C:\Windows\System\bshZnyG.exe
  2⤵
  PID:7344
- C:\Windows\System\nwVUtSO.exe
  C:\Windows\System\nwVUtSO.exe
  2⤵
  PID:6196
- C:\Windows\System\jXwXNme.exe
  C:\Windows\System\jXwXNme.exe
  2⤵
  PID:6460
- C:\Windows\System\CmVSeLM.exe
  C:\Windows\System\CmVSeLM.exe
  2⤵
  PID:4368
- C:\Windows\System\gXYXoPD.exe
  C:\Windows\System\gXYXoPD.exe
  2⤵
  PID:5980
- C:\Windows\System\nAAXHbT.exe
  C:\Windows\System\nAAXHbT.exe
  2⤵
  PID:6324
- C:\Windows\System\KZqNrhE.exe
  C:\Windows\System\KZqNrhE.exe
  2⤵
  PID:12896
- C:\Windows\System\wavtXeX.exe
  C:\Windows\System\wavtXeX.exe
  2⤵
  PID:6296
- C:\Windows\System\GJsOPDW.exe
  C:\Windows\System\GJsOPDW.exe
  2⤵
  PID:6308
- C:\Windows\System\otclRFD.exe
  C:\Windows\System\otclRFD.exe
  2⤵
  PID:3740
- C:\Windows\System\fCwXDMK.exe
  C:\Windows\System\fCwXDMK.exe
  2⤵
  PID:7264
- C:\Windows\System\mEucHZQ.exe
  C:\Windows\System\mEucHZQ.exe
  2⤵
  PID:7772
- C:\Windows\System\VPjrugU.exe
  C:\Windows\System\VPjrugU.exe
  2⤵
  PID:7424
- C:\Windows\System\hmDiPEZ.exe
  C:\Windows\System\hmDiPEZ.exe
  2⤵
  PID:12668
- C:\Windows\System\iZTwCWz.exe
  C:\Windows\System\iZTwCWz.exe
  2⤵
  PID:3608
- C:\Windows\System\zZgRRoQ.exe
  C:\Windows\System\zZgRRoQ.exe
  2⤵
  PID:7064
- C:\Windows\System\HpKspze.exe
  C:\Windows\System\HpKspze.exe
  2⤵
  PID:7644
- C:\Windows\System\MBHzCaB.exe
  C:\Windows\System\MBHzCaB.exe
  2⤵
  PID:768
- C:\Windows\System\eZIcdbE.exe
  C:\Windows\System\eZIcdbE.exe
  2⤵
  PID:13404
- C:\Windows\System\RRAGtyK.exe
  C:\Windows\System\RRAGtyK.exe
  2⤵
  PID:13508
- C:\Windows\System\kWkMddk.exe
  C:\Windows\System\kWkMddk.exe
  2⤵
  PID:13580
- C:\Windows\System\HghbyTX.exe
  C:\Windows\System\HghbyTX.exe
  2⤵
  PID:13600
- C:\Windows\System\HpzHlZH.exe
  C:\Windows\System\HpzHlZH.exe
  2⤵
  PID:13620
- C:\Windows\System\WsRTZEi.exe
  C:\Windows\System\WsRTZEi.exe
  2⤵
  PID:13640
- C:\Windows\System\xzdZAgy.exe
  C:\Windows\System\xzdZAgy.exe
  2⤵
  PID:13716
- C:\Windows\System\cEZokCq.exe
  C:\Windows\System\cEZokCq.exe
  2⤵
  PID:13752
- C:\Windows\System\lpfUAEd.exe
  C:\Windows\System\lpfUAEd.exe
  2⤵
  PID:13776
- C:\Windows\System\pLqZOia.exe
  C:\Windows\System\pLqZOia.exe
  2⤵
  PID:13820
- C:\Windows\System\MjkUWVi.exe
  C:\Windows\System\MjkUWVi.exe
  2⤵
  PID:13836
- C:\Windows\System\zFvGtXd.exe
  C:\Windows\System\zFvGtXd.exe
  2⤵
  PID:13860
- C:\Windows\System\wlwQAmc.exe
  C:\Windows\System\wlwQAmc.exe
  2⤵
  PID:13888
- C:\Windows\System\fbRFzKq.exe
  C:\Windows\System\fbRFzKq.exe
  2⤵
  PID:13904
- C:\Windows\System\ReYniZr.exe
  C:\Windows\System\ReYniZr.exe
  2⤵
  PID:13928
- C:\Windows\System\kcCWRqi.exe
  C:\Windows\System\kcCWRqi.exe
  2⤵
  PID:13948
- C:\Windows\System\EslxcIf.exe
  C:\Windows\System\EslxcIf.exe
  2⤵
  PID:13964
- C:\Windows\System\yFHsiRF.exe
  C:\Windows\System\yFHsiRF.exe
  2⤵
  PID:13988
- C:\Windows\System\gNvCvaN.exe
  C:\Windows\System\gNvCvaN.exe
  2⤵
  PID:14096
- C:\Windows\System\FoKqYMc.exe
  C:\Windows\System\FoKqYMc.exe
  2⤵
  PID:14124
- C:\Windows\System\NTWxXfH.exe
  C:\Windows\System\NTWxXfH.exe
  2⤵
  PID:14152
- C:\Windows\System\omIfril.exe
  C:\Windows\System\omIfril.exe
  2⤵
  PID:14172
- C:\Windows\System\FtFNWzN.exe
  C:\Windows\System\FtFNWzN.exe
  2⤵
  PID:14200
- C:\Windows\System\NCJOBSj.exe
  C:\Windows\System\NCJOBSj.exe
  2⤵
  PID:14228
- C:\Windows\System\pCzXonU.exe
  C:\Windows\System\pCzXonU.exe
  2⤵
  PID:14248
- C:\Windows\System\WBtSnse.exe
  C:\Windows\System\WBtSnse.exe
  2⤵
  PID:14284
- C:\Windows\System\qvVgMDW.exe
  C:\Windows\System\qvVgMDW.exe
  2⤵
  PID:14312
- C:\Windows\System\vGTpPzR.exe
  C:\Windows\System\vGTpPzR.exe
  2⤵
  PID:7688
- C:\Windows\System\fkcXBgk.exe
  C:\Windows\System\fkcXBgk.exe
  2⤵
  PID:6572
- C:\Windows\System\SdoCWcl.exe
  C:\Windows\System\SdoCWcl.exe
  2⤵
  PID:7500
- C:\Windows\System\jsKRHMx.exe
  C:\Windows\System\jsKRHMx.exe
  2⤵
  PID:6636
- C:\Windows\System\guCofXq.exe
  C:\Windows\System\guCofXq.exe
  2⤵
  PID:13368
- C:\Windows\System\PlfDXPi.exe
  C:\Windows\System\PlfDXPi.exe
  2⤵
  PID:4496
- C:\Windows\System\OzmTtaG.exe
  C:\Windows\System\OzmTtaG.exe
  2⤵
  PID:6776
- C:\Windows\System\cfoJbeC.exe
  C:\Windows\System\cfoJbeC.exe
  2⤵
  PID:13484
- C:\Windows\System\noKPtVL.exe
  C:\Windows\System\noKPtVL.exe
  2⤵
  PID:13356
- C:\Windows\System\cBxOpVs.exe
  C:\Windows\System\cBxOpVs.exe
  2⤵
  PID:6992
- C:\Windows\System\dNZOvmN.exe
  C:\Windows\System\dNZOvmN.exe
  2⤵
  PID:13548
- C:\Windows\System\HSnweNz.exe
  C:\Windows\System\HSnweNz.exe
  2⤵
  PID:13424
- C:\Windows\System\XqEGDbA.exe
  C:\Windows\System\XqEGDbA.exe
  2⤵
  PID:13576
- C:\Windows\System\kWZGxLh.exe
  C:\Windows\System\kWZGxLh.exe
  2⤵
  PID:13532
- C:\Windows\System\DPqGmeF.exe
  C:\Windows\System\DPqGmeF.exe
  2⤵
  PID:13692
- C:\Windows\System\abYDCGk.exe
  C:\Windows\System\abYDCGk.exe
  2⤵
  PID:13772
- C:\Windows\System\BKOujAL.exe
  C:\Windows\System\BKOujAL.exe
  2⤵
  PID:13736
- C:\Windows\System\koWpnWj.exe
  C:\Windows\System\koWpnWj.exe
  2⤵
  PID:13868
- C:\Windows\System\UDSDrKq.exe
  C:\Windows\System\UDSDrKq.exe
  2⤵
  PID:13760
- C:\Windows\System\UfKbeYw.exe
  C:\Windows\System\UfKbeYw.exe
  2⤵
  PID:13744
- C:\Windows\System\XTZZPCg.exe
  C:\Windows\System\XTZZPCg.exe
  2⤵
  PID:14040
- C:\Windows\System\KkLBcNh.exe
  C:\Windows\System\KkLBcNh.exe
  2⤵
  PID:8812
- C:\Windows\System\HUJiKSX.exe
  C:\Windows\System\HUJiKSX.exe
  2⤵
  PID:14088
- C:\Windows\System\mBupzgs.exe
  C:\Windows\System\mBupzgs.exe
  2⤵
  PID:14024
- C:\Windows\System\bHOCazt.exe
  C:\Windows\System\bHOCazt.exe
  2⤵
  PID:14060
- C:\Windows\System\iOSXjVk.exe
  C:\Windows\System\iOSXjVk.exe
  2⤵
  PID:14268
- C:\Windows\System\aLpgOvC.exe
  C:\Windows\System\aLpgOvC.exe
  2⤵
  PID:14036
- C:\Windows\System\hCjwCkQ.exe
  C:\Windows\System\hCjwCkQ.exe
  2⤵
  PID:14052
- C:\Windows\System\XJpTcrg.exe
  C:\Windows\System\XJpTcrg.exe
  2⤵
  PID:14072
- C:\Windows\System\CPJSntU.exe
  C:\Windows\System\CPJSntU.exe
  2⤵
  PID:4596
- C:\Windows\System\drTsoFS.exe
  C:\Windows\System\drTsoFS.exe
  2⤵
  PID:13364
- C:\Windows\System\FnxiOsP.exe
  C:\Windows\System\FnxiOsP.exe
  2⤵
  PID:9148
- C:\Windows\System\xTVilvZ.exe
  C:\Windows\System\xTVilvZ.exe
  2⤵
  PID:13472
- C:\Windows\System\afHgBhz.exe
  C:\Windows\System\afHgBhz.exe
  2⤵
  PID:13336
- C:\Windows\System\BJQytbi.exe
  C:\Windows\System\BJQytbi.exe
  2⤵
  PID:14324
- C:\Windows\System\nGuCFga.exe
  C:\Windows\System\nGuCFga.exe
  2⤵
  PID:8440
- C:\Windows\System\dmAjvaN.exe
  C:\Windows\System\dmAjvaN.exe
  2⤵
  PID:13444
- C:\Windows\System\vQUPaCE.exe
  C:\Windows\System\vQUPaCE.exe
  2⤵
  PID:13528
- C:\Windows\System\YucZzSN.exe
  C:\Windows\System\YucZzSN.exe
  2⤵
  PID:13832
- C:\Windows\System\rLwdVjA.exe
  C:\Windows\System\rLwdVjA.exe
  2⤵
  PID:7816
- C:\Windows\System\RYdmPdu.exe
  C:\Windows\System\RYdmPdu.exe
  2⤵
  PID:13332
- C:\Windows\System\RWKGVFY.exe
  C:\Windows\System\RWKGVFY.exe
  2⤵
  PID:14008
- C:\Windows\System\YbueHjU.exe
  C:\Windows\System\YbueHjU.exe
  2⤵
  PID:8912
- C:\Windows\System\nVZwWQx.exe
  C:\Windows\System\nVZwWQx.exe
  2⤵
  PID:8720
- C:\Windows\System\FWWgOjb.exe
  C:\Windows\System\FWWgOjb.exe
  2⤵
  PID:7548
- C:\Windows\System\aGiHkrg.exe
  C:\Windows\System\aGiHkrg.exe
  2⤵
  PID:7172
- C:\Windows\System\XElajWn.exe
  C:\Windows\System\XElajWn.exe
  2⤵
  PID:14116
- C:\Windows\System\LdDFpiE.exe
  C:\Windows\System\LdDFpiE.exe
  2⤵
  PID:13980
- C:\Windows\System\koAjPTs.exe
  C:\Windows\System\koAjPTs.exe
  2⤵
  PID:9520
- C:\Windows\System\QXhfyva.exe
  C:\Windows\System\QXhfyva.exe
  2⤵
  PID:13560
- C:\Windows\System\oEbLkyk.exe
  C:\Windows\System\oEbLkyk.exe
  2⤵
  PID:9564
- C:\Windows\System\QshXpIZ.exe
  C:\Windows\System\QshXpIZ.exe
  2⤵
  PID:8148
- C:\Windows\System\etzoLnj.exe
  C:\Windows\System\etzoLnj.exe
  2⤵
  PID:14332
- C:\Windows\System\PEjshKB.exe
  C:\Windows\System\PEjshKB.exe
  2⤵
  PID:9360
- C:\Windows\System\wEHsxVZ.exe
  C:\Windows\System\wEHsxVZ.exe
  2⤵
  PID:13712
- C:\Windows\System\RfxtUoU.exe
  C:\Windows\System\RfxtUoU.exe
  2⤵
  PID:13552
- C:\Windows\System\yNpzlPf.exe
  C:\Windows\System\yNpzlPf.exe
  2⤵
  PID:14396
- C:\Windows\System\nOdVggG.exe
  C:\Windows\System\nOdVggG.exe
  2⤵
  PID:14952
- C:\Windows\System\SMixTXw.exe
  C:\Windows\System\SMixTXw.exe
  2⤵
  PID:14988
- C:\Windows\System\xygVlty.exe
  C:\Windows\System\xygVlty.exe
  2⤵
  PID:15016
- C:\Windows\System\uSZqMLl.exe
  C:\Windows\System\uSZqMLl.exe
  2⤵
  PID:15060
- C:\Windows\System\VpZZyCF.exe
  C:\Windows\System\VpZZyCF.exe
  2⤵
  PID:15104
- C:\Windows\System\xwkoMNh.exe
  C:\Windows\System\xwkoMNh.exe
  2⤵
  PID:15132
- C:\Windows\System\ZONZZAl.exe
  C:\Windows\System\ZONZZAl.exe
  2⤵
  PID:15156
- C:\Windows\System\kCmfoWc.exe
  C:\Windows\System\kCmfoWc.exe
  2⤵
  PID:15204
- C:\Windows\System\KaHQSop.exe
  C:\Windows\System\KaHQSop.exe
  2⤵
  PID:15236
- C:\Windows\System\rCQqukU.exe
  C:\Windows\System\rCQqukU.exe
  2⤵
  PID:15260
- C:\Windows\System\fQUfINk.exe
  C:\Windows\System\fQUfINk.exe
  2⤵
  PID:15284
- C:\Windows\System\eVdlYnl.exe
  C:\Windows\System\eVdlYnl.exe
  2⤵
  PID:15308
- C:\Windows\System\JNyQrtH.exe
  C:\Windows\System\JNyQrtH.exe
  2⤵
  PID:15328
- C:\Windows\System\LbhOfah.exe
  C:\Windows\System\LbhOfah.exe
  2⤵
  PID:15352
- C:\Windows\System\kUanekf.exe
  C:\Windows\System\kUanekf.exe
  2⤵
  PID:8920
- C:\Windows\System\cUQBrXy.exe
  C:\Windows\System\cUQBrXy.exe
  2⤵
  PID:14132
- C:\Windows\System\lvelrkI.exe
  C:\Windows\System\lvelrkI.exe
  2⤵
  PID:13924
- C:\Windows\System\pUUoVyy.exe
  C:\Windows\System\pUUoVyy.exe
  2⤵
  PID:9616
- C:\Windows\System\EGhXsow.exe
  C:\Windows\System\EGhXsow.exe
  2⤵
  PID:8864
- C:\Windows\System\tibxHNY.exe
  C:\Windows\System\tibxHNY.exe
  2⤵
  PID:13392
- C:\Windows\System\QrdzSje.exe
  C:\Windows\System\QrdzSje.exe
  2⤵
  PID:13812
- C:\Windows\System\QErXfiR.exe
  C:\Windows\System\QErXfiR.exe
  2⤵
  PID:9956
- C:\Windows\System\sMvygEm.exe
  C:\Windows\System\sMvygEm.exe
  2⤵
  PID:13936
- C:\Windows\System\OjNWVLI.exe
  C:\Windows\System\OjNWVLI.exe
  2⤵
  PID:7088
- C:\Windows\System\uItuhEP.exe
  C:\Windows\System\uItuhEP.exe
  2⤵
  PID:13416
- C:\Windows\System\gpJIfco.exe
  C:\Windows\System\gpJIfco.exe
  2⤵
  PID:14416
- C:\Windows\System\dZPUxgL.exe
  C:\Windows\System\dZPUxgL.exe
  2⤵
  PID:14444
- C:\Windows\System\YIxDsdC.exe
  C:\Windows\System\YIxDsdC.exe
  2⤵
  PID:14464
- C:\Windows\System\XawHSuB.exe
  C:\Windows\System\XawHSuB.exe
  2⤵
  PID:14340
- C:\Windows\System\VNKvyKV.exe
  C:\Windows\System\VNKvyKV.exe
  2⤵
  PID:14388
- C:\Windows\System\fzPSryu.exe
  C:\Windows\System\fzPSryu.exe
  2⤵
  PID:14504
- C:\Windows\System\dSuEFYn.exe
  C:\Windows\System\dSuEFYn.exe
  2⤵
  PID:14632
- C:\Windows\System\nNRRvQS.exe
  C:\Windows\System\nNRRvQS.exe
  2⤵
  PID:14532
- C:\Windows\System\IzkrkWO.exe
  C:\Windows\System\IzkrkWO.exe
  2⤵
  PID:14700
- C:\Windows\System\cXzjkAJ.exe
  C:\Windows\System\cXzjkAJ.exe
  2⤵
  PID:10544
- C:\Windows\System\byWcPHY.exe
  C:\Windows\System\byWcPHY.exe
  2⤵
  PID:10212
- C:\Windows\System\BPMchMT.exe
  C:\Windows\System\BPMchMT.exe
  2⤵
  PID:14796
- C:\Windows\System\QuyzrFq.exe
  C:\Windows\System\QuyzrFq.exe
  2⤵
  PID:10688
- C:\Windows\System\BMeOPLl.exe
  C:\Windows\System\BMeOPLl.exe
  2⤵
  PID:10472
- C:\Windows\System\BCpzSAb.exe
  C:\Windows\System\BCpzSAb.exe
  2⤵
  PID:10396
- C:\Windows\System\mRcnOFh.exe
  C:\Windows\System\mRcnOFh.exe
  2⤵
  PID:14756
- C:\Windows\System\pfqyivE.exe
  C:\Windows\System\pfqyivE.exe
  2⤵
  PID:9416
- C:\Windows\System\hCFosmQ.exe
  C:\Windows\System\hCFosmQ.exe
  2⤵
  PID:14784
- C:\Windows\System\jHFOtpi.exe
  C:\Windows\System\jHFOtpi.exe
  2⤵
  PID:10604
- C:\Windows\System\kQkYGNA.exe
  C:\Windows\System\kQkYGNA.exe
  2⤵
  PID:14744
- C:\Windows\System\BtPOLMp.exe
  C:\Windows\System\BtPOLMp.exe
  2⤵
  PID:10724
- C:\Windows\System\djNqmAe.exe
  C:\Windows\System\djNqmAe.exe
  2⤵
  PID:9972
- C:\Windows\System\WWZdeQM.exe
  C:\Windows\System\WWZdeQM.exe
  2⤵
  PID:10216
- C:\Windows\System\RMjGVyb.exe
  C:\Windows\System\RMjGVyb.exe
  2⤵
  PID:14944
- C:\Windows\System\oStWmPn.exe
  C:\Windows\System\oStWmPn.exe
  2⤵
  PID:10920
- C:\Windows\System\jhSaTwk.exe
  C:\Windows\System\jhSaTwk.exe
  2⤵
  PID:11008
- C:\Windows\System\zRnFdzo.exe
  C:\Windows\System\zRnFdzo.exe
  2⤵
  PID:15000
- C:\Windows\System\JUqTuxO.exe
  C:\Windows\System\JUqTuxO.exe
  2⤵
  PID:11184
- C:\Windows\System\YrJbUAx.exe
  C:\Windows\System\YrJbUAx.exe
  2⤵
  PID:15072
- C:\Windows\System\IlojblF.exe
  C:\Windows\System\IlojblF.exe
  2⤵
  PID:14996
- C:\Windows\System\GFPeaPJ.exe
  C:\Windows\System\GFPeaPJ.exe
  2⤵
  PID:11160
- C:\Windows\System\NlUJujA.exe
  C:\Windows\System\NlUJujA.exe
  2⤵
  PID:10340
- C:\Windows\System\HnPaoEe.exe
  C:\Windows\System\HnPaoEe.exe
  2⤵
  PID:10516
- C:\Windows\System\pPGpHYI.exe
  C:\Windows\System\pPGpHYI.exe
  2⤵
  PID:15220
- C:\Windows\System\dbfDKft.exe
  C:\Windows\System\dbfDKft.exe
  2⤵
  PID:15252
- C:\Windows\System\rrXptel.exe
  C:\Windows\System\rrXptel.exe
  2⤵
  PID:15292
- C:\Windows\System\jhuwHGi.exe
  C:\Windows\System\jhuwHGi.exe
  2⤵
  PID:10256
- C:\Windows\System\jwcuqAq.exe
  C:\Windows\System\jwcuqAq.exe
  2⤵
  PID:15324
- C:\Windows\System\UPkPNmB.exe
  C:\Windows\System\UPkPNmB.exe
  2⤵
  PID:15212
- C:\Windows\System\xTnfPvX.exe
  C:\Windows\System\xTnfPvX.exe
  2⤵
  PID:15344
- C:\Windows\System\XkKVjRS.exe
  C:\Windows\System\XkKVjRS.exe
  2⤵
  PID:13568
- C:\Windows\System\tlEshqH.exe
  C:\Windows\System\tlEshqH.exe
  2⤵
  PID:10484
- C:\Windows\System\yjkKmdF.exe
  C:\Windows\System\yjkKmdF.exe
  2⤵
  PID:10668
- C:\Windows\System\WPxrjEW.exe
  C:\Windows\System\WPxrjEW.exe
  2⤵
  PID:10092
- C:\Windows\System\DrpdXcB.exe
  C:\Windows\System\DrpdXcB.exe
  2⤵
  PID:8832
- C:\Windows\System\zlUXQoj.exe
  C:\Windows\System\zlUXQoj.exe
  2⤵
  PID:11288
- C:\Windows\System\nDwtpWH.exe
  C:\Windows\System\nDwtpWH.exe
  2⤵
  PID:14412
- C:\Windows\System\ZqNeOgM.exe
  C:\Windows\System\ZqNeOgM.exe
  2⤵
  PID:11396
- C:\Windows\System\lGqUNlm.exe
  C:\Windows\System\lGqUNlm.exe
  2⤵
  PID:14472
- C:\Windows\System\DudeEHD.exe
  C:\Windows\System\DudeEHD.exe
  2⤵
  PID:10368
- C:\Windows\System\gAOpUWd.exe
  C:\Windows\System\gAOpUWd.exe
  2⤵
  PID:9588
- C:\Windows\System\odOYONp.exe
  C:\Windows\System\odOYONp.exe
  2⤵
  PID:11596
- C:\Windows\System\xUSxbej.exe
  C:\Windows\System\xUSxbej.exe
  2⤵
  PID:9756
- C:\Windows\System\RteHYRI.exe
  C:\Windows\System\RteHYRI.exe
  2⤵
  PID:14788
- C:\Windows\System\dpicqsP.exe
  C:\Windows\System\dpicqsP.exe
  2⤵
  PID:14820
- C:\Windows\System\EDXsjMK.exe
  C:\Windows\System\EDXsjMK.exe
  2⤵
  PID:9688
- C:\Windows\System\eIeqYyz.exe
  C:\Windows\System\eIeqYyz.exe
  2⤵
  PID:9968
- C:\Windows\System\rznuMlQ.exe
  C:\Windows\System\rznuMlQ.exe
  2⤵
  PID:10572
- C:\Windows\System\GnjHHKd.exe
  C:\Windows\System\GnjHHKd.exe
  2⤵
  PID:11960
- C:\Windows\System\CSeVYJa.exe
  C:\Windows\System\CSeVYJa.exe
  2⤵
  PID:11952
- C:\Windows\System\YomLVpT.exe
  C:\Windows\System\YomLVpT.exe
  2⤵
  PID:14976
- C:\Windows\System\kCQmeRb.exe
  C:\Windows\System\kCQmeRb.exe
  2⤵
  PID:10852
- C:\Windows\System\pvrrqhj.exe
  C:\Windows\System\pvrrqhj.exe
  2⤵
  PID:12148
- C:\Windows\System\IWhANNq.exe
  C:\Windows\System\IWhANNq.exe
  2⤵
  PID:11180
- C:\Windows\System\GCipzwa.exe
  C:\Windows\System\GCipzwa.exe
  2⤵
  PID:10972
- C:\Windows\System\CVLkSfu.exe
  C:\Windows\System\CVLkSfu.exe
  2⤵
  PID:15088
- C:\Windows\System\KTFDBOa.exe
  C:\Windows\System\KTFDBOa.exe
  2⤵
  PID:15228
- C:\Windows\System\FPXRBUT.exe
  C:\Windows\System\FPXRBUT.exe
  2⤵
  PID:15128
- C:\Windows\System\zniuyrH.exe
  C:\Windows\System\zniuyrH.exe
  2⤵
  PID:14292
- C:\Windows\System\gXmFCSX.exe
  C:\Windows\System\gXmFCSX.exe
  2⤵
  PID:15280
- C:\Windows\System\NqeMDOT.exe
  C:\Windows\System\NqeMDOT.exe
  2⤵
  PID:10132
- C:\Windows\System\YaUPdgq.exe
  C:\Windows\System\YaUPdgq.exe
  2⤵
  PID:9204
- C:\Windows\System\dQKMIuQ.exe
  C:\Windows\System\dQKMIuQ.exe
  2⤵
  PID:12084
- C:\Windows\System\lknslvL.exe
  C:\Windows\System\lknslvL.exe
  2⤵
  PID:5112
- C:\Windows\System\YJQbnAY.exe
  C:\Windows\System\YJQbnAY.exe
  2⤵
  PID:10744
- C:\Windows\System\lxHbLIe.exe
  C:\Windows\System\lxHbLIe.exe
  2⤵
  PID:11452
- C:\Windows\System\kQhsaZM.exe
  C:\Windows\System\kQhsaZM.exe
  2⤵
  PID:12128
- C:\Windows\System\GHQhDBq.exe
  C:\Windows\System\GHQhDBq.exe
  2⤵
  PID:9460
- C:\Windows\System\qFvUVbc.exe
  C:\Windows\System\qFvUVbc.exe
  2⤵
  PID:14656
- C:\Windows\System\xKhHDJc.exe
  C:\Windows\System\xKhHDJc.exe
  2⤵
  PID:11644
- C:\Windows\System\AdREgQg.exe
  C:\Windows\System\AdREgQg.exe
  2⤵
  PID:13544
- C:\Windows\System\BTrbwlB.exe
  C:\Windows\System\BTrbwlB.exe
  2⤵
  PID:14688
- C:\Windows\System\HlbepFI.exe
  C:\Windows\System\HlbepFI.exe
  2⤵
  PID:5824
- C:\Windows\System\ofwbjsD.exe
  C:\Windows\System\ofwbjsD.exe
  2⤵
  PID:9272
- C:\Windows\System\QjAYRXI.exe
  C:\Windows\System\QjAYRXI.exe
  2⤵
  PID:11696
- C:\Windows\System\kWttTtZ.exe
  C:\Windows\System\kWttTtZ.exe
  2⤵
  PID:12524
- C:\Windows\System\PUhVVGh.exe
  C:\Windows\System\PUhVVGh.exe
  2⤵
  PID:11704
- C:\Windows\System\uEiuBnb.exe
  C:\Windows\System\uEiuBnb.exe
  2⤵
  PID:12360
- C:\Windows\System\sOecStf.exe
  C:\Windows\System\sOecStf.exe
  2⤵
  PID:12624
- C:\Windows\System\MwYXlTh.exe
  C:\Windows\System\MwYXlTh.exe
  2⤵
  PID:12768
- C:\Windows\System\RESVzKW.exe
  C:\Windows\System\RESVzKW.exe
  2⤵
  PID:12468
- C:\Windows\System\WcVNtge.exe
  C:\Windows\System\WcVNtge.exe
  2⤵
  PID:11176
- C:\Windows\System\jrSXqzl.exe
  C:\Windows\System\jrSXqzl.exe
  2⤵
  PID:12932
- C:\Windows\System\NXwIuMR.exe
  C:\Windows\System\NXwIuMR.exe
  2⤵
  PID:12064
- C:\Windows\System\WYJmNdp.exe
  C:\Windows\System\WYJmNdp.exe
  2⤵
  PID:13036
- C:\Windows\System\IkIFDSj.exe
  C:\Windows\System\IkIFDSj.exe
  2⤵
  PID:10808
- C:\Windows\System\GGNWTry.exe
  C:\Windows\System\GGNWTry.exe
  2⤵
  PID:14908
- C:\Windows\System\xHbFwEK.exe
  C:\Windows\System\xHbFwEK.exe
  2⤵
  PID:11992
- C:\Windows\System\KYFYPFX.exe
  C:\Windows\System\KYFYPFX.exe
  2⤵
  PID:13052
- C:\Windows\System\jquujsL.exe
  C:\Windows\System\jquujsL.exe
  2⤵
  PID:11368
- C:\Windows\System\WBGVltA.exe
  C:\Windows\System\WBGVltA.exe
  2⤵
  PID:15120
- C:\Windows\System\CEwXzIt.exe
  C:\Windows\System\CEwXzIt.exe
  2⤵
  PID:13092
- C:\Windows\System\koKJUSY.exe
  C:\Windows\System\koKJUSY.exe
  2⤵
  PID:11904
- C:\Windows\System\ZkvlCDN.exe
  C:\Windows\System\ZkvlCDN.exe
  2⤵
  PID:14440
- C:\Windows\System\EOXTUjw.exe
  C:\Windows\System\EOXTUjw.exe
  2⤵
  PID:14432
- C:\Windows\System\nPjQNTB.exe
  C:\Windows\System\nPjQNTB.exe
  2⤵
  PID:11632
- C:\Windows\System\YQyqspi.exe
  C:\Windows\System\YQyqspi.exe
  2⤵
  PID:12232
- C:\Windows\System\eqyHtwF.exe
  C:\Windows\System\eqyHtwF.exe
  2⤵
  PID:14364
- C:\Windows\System\DtZKWRF.exe
  C:\Windows\System\DtZKWRF.exe
  2⤵
  PID:9336
- C:\Windows\System\oggUYzb.exe
  C:\Windows\System\oggUYzb.exe
  2⤵
  PID:10220

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:12732

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5944

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:4260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_of0u20ha.y1a.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BJLIjdb.exe

Filesize
18B

MD5
bdb60bd93c09286d92fee75873d90482

SHA1
3b9209eb300e600c89b6bdd90cdcdd1ebbdc6f8f

SHA256
cde9626dea0f5fea46e58fc393d798225ae2a62c635207a80d6d2b3e72aa1e14

SHA512
d97e0db61378ed98d959231114f4252cc90db179c7aedf2ba42033bb324841bd8c9626b8633aff8efe6f010e8c4405bf8da473288d5f329b9af7de9768cef3b7

Download Submit
C:\Windows\System\BRtCmvP.exe

Filesize
2.1MB

MD5
4ebef068db483da93b1fa11c78d0af9d

SHA1
5a6a5ac3156122180380e35c4449a28220d0f5a9

SHA256
8bcc621af8bb01e260ef8195396770e08c4b287446c1b4dbe6cded60871343c8

SHA512
45550cc00de9645d407cebb2dc1c6c6e825db799f9c8e9ac5c9a219e5474c450b665507ac56e34a7cd2edd2e1439f89640f2a7efe98e399441b1b5f3b34a9674

Download Submit
C:\Windows\System\DOgIZwT.exe

Filesize
2.1MB

MD5
a95b147eb742d5d4ef4e7913b37422b5

SHA1
1b0207e6439c5b134526b4a154fbad9977d993fc

SHA256
126bbd7de070d1f11938a230d8bbe58c2015a1d8d221793b3b84c14e64e67ff7

SHA512
ed54500690c0c84c7f8bf56e639f51b6d653e28a31861895d43e82738d5a9480f59eafbb24f5e0032ab2610303bb15c782fea6acbb77450985b2a14ab25af6bb

Download Submit
C:\Windows\System\GKGXDiP.exe

Filesize
2.1MB

MD5
2246768ce6064791b82a829a6245da20

SHA1
6586e19484a460f53b55ba221518335c16c62ff0

SHA256
d6bd25187e3f928d594f3b7c6a1f67060ee891d712a81167764bc5b0c159a0e7

SHA512
df77489924674aa8d1dbe6004b5b33636fe0aca4a992107e313a3ae641fb302b92164e7a6f137b7447288fdf10de563f19a0b595dc5c7a656ba2d93f9043c474

Download Submit
C:\Windows\System\HDZOjpV.exe

Filesize
2.1MB

MD5
2a2eb48549adf495310f2e87c92e4da8

SHA1
547a522b2f552def1e1223d48a3466008878ef6c

SHA256
9c85138f9412c31a5123aee7c3859e3476bccd35b68aef2bbf4d80028b42d1a7

SHA512
b5752b14a3473c0d432242bc60424ca494148533fae3203b7731d571306bd976e76fbb44620ee1afe9b7ab0a40ce896ff6f49ceea4f76cc35919f7c4bb421306

Download Submit
C:\Windows\System\IDTXdvo.exe

Filesize
8B

MD5
56dfc2f514c29abc0f7637c9a955b7d2

SHA1
ae4f9772e45bb1dee2f545529ca3e5d6bdd4dd65

SHA256
d458636957a00bb0d8a9759a3052bcc3b71650d32d60b24077d53884f0b19279

SHA512
cb24ecc705f756ecdc58fd78c8b8a6aa84beaf9becae76712e53e91e62d5881964bb4ebaee88647166240726139e4de421aa46f8ca7ebc7aaa10589a7d82f3d7

Download Submit
C:\Windows\System\JlcfeDH.exe

Filesize
2.1MB

MD5
8a5d642f1e390c1cb037c44ac4d9091e

SHA1
5e3d798d2ad8410803fcd98e4e162ad960e51fc9

SHA256
bdc71094e85ce208f40a7a9ac8c685f2649d88fa830d65fd5d915c112ca6f49c

SHA512
ff0fa12cb22e01c710b5c6b16b36b49b8aff08b30f3a0815cdb6ed6fd44ea5776b72bf864b71896f053b96aeac61bd9f91109024e61944b36e0bd9a1c2ce2c5f

Download Submit
C:\Windows\System\MUZkQxT.exe

Filesize
2.1MB

MD5
31de233827ddc8969cd18bd4485eef78

SHA1
cb8db684857a9b3283e85280dde5f5e97413150a

SHA256
ef090aae4b9c7da61bc8cef369ff1b56dba9597e051403cac64f5ea4b2ea8a31

SHA512
accd0bef0e67baab8f383d595fd64910f8fad845d69cc790d120061dba0197ca399dd92e183da920546db2386d1053d1115c53923495f72d4ac05a6a6687a299

Download Submit
C:\Windows\System\MaSkXIP.exe

Filesize
2.1MB

MD5
8f31c518c2b1be9557b87ba4aa0d650b

SHA1
7d6e67a67d90d85663a6c98d77fcfe138315fdb6

SHA256
395218b8e6f093fa8c9239d4d802836fa9769289e9849d00881cba793321531a

SHA512
ae767af52e1bee15e9a78d0357c9d2d2ceb966d2cefa43d9c94ef15264e04186f31d0986d1b97fa20e935d95193f3cd3cfb1201300218a27dd0743266337e1da

Download Submit
C:\Windows\System\OniYIyt.exe

Filesize
2.1MB

MD5
7c4ca94b0424fb948f68a648a5b53e67

SHA1
3567ce88f0cc5f4921492639486938df48f93b69

SHA256
9bade6fad053fb82c43a3c05325dccc004dcc5b9b91a381b4654de31705f2728

SHA512
59e238dc9bf4e7c70b47062f5e9aaa7fb37a3746b34266938205671602c3e0ed06b0f94ec1475a45269d242a345d5d1bc9a12ab4f73444b7519a39a46bd416ae

Download Submit
C:\Windows\System\QZjgsIF.exe

Filesize
2.1MB

MD5
d9eec3e2716cdfe9cedad8e2d9a83f81

SHA1
84a5d61d11b1c35308b8f9364a96a57b3b57f19b

SHA256
1f248dc86a37de3ea18ef1de983a39cf4faa06cfb510ab0832d91071d9ddd634

SHA512
670cf81f0c29f6baa157a8983146d9ceb20c56890e1fe00958815c1556c1831f62ab78f33ab79f6ef2ca01ceff0ff62983cbb974f68134f5e16a10aacabb5369

Download Submit
C:\Windows\System\RnNTaNF.exe

Filesize
2.1MB

MD5
7150aed790104785faef2ac77d32b3f9

SHA1
2ec7001c1da45642cbe916dbb1c746a587a7fe9d

SHA256
b2a9f5cb67203250cc91493b6504130b380c16a133520174c3c79c48ceab7328

SHA512
a650a04548523f0ac3716041335ca0b7b315ed7ae4fbd3737b7ed3e5c298ba85cfda3b8aab06b2d7523ed893178282ddb8efff91adff136548d01a35d4126dca

Download Submit
C:\Windows\System\TwvWXYR.exe

Filesize
2.1MB

MD5
69c581b7435ecbbde968158163b01885

SHA1
b4aff245d2d5f2b4ff18ae9b75d143f834e8f59c

SHA256
8046152875973fc4ae6d895ca4feaee5b6b17bcbb73e366bffd149ed6091529c

SHA512
ef43ddb56053ccd101c5c88ca0f6386a8ac81ddf82fb13295467ba9db28226e2f7c412c0c207c97d1a7c9d4954718b28a425f6567f5713266db0b8a90a9f0726

Download Submit
C:\Windows\System\UHfkyie.exe

Filesize
2.1MB

MD5
09b4d9eeae4f28db6bc2cca6cd86c4d5

SHA1
c28b50a0bd34fd1bb4ec5764096eaa812297e087

SHA256
3a99f10541244b9579b438c37c62693516fe68c3445c3bd452257ec2d80b535b

SHA512
40726afd2c0bd64fc96995f9ea7421679c019e41ce0729c4fbf6e0c4e9fd34a0edbaef4aeb964f95d3b14029ef7ffa3711fa785041211efcb7c3ce66cc7d9022

Download Submit
C:\Windows\System\UoQSVCg.exe

Filesize
2.1MB

MD5
22a78d1f108fe9f97037bb7b26136207

SHA1
e8c1d6fdea754e255c2bdbb203d1681ceac9ab6f

SHA256
5e43e287b43533d26ec3d2af8c5c5be9c3b21f72544861607cde6b7ca773f91f

SHA512
b89b4fe5717559f0fd1d179928e616c8c18fa95c2bad1438bd1fc1901db971c28f074ce8e50acf4cd0b969f6edd4c56a09f8f1a7ba436d70e7d0af54673a6280

Download Submit
C:\Windows\System\VIPSVAb.exe

Filesize
2.1MB

MD5
60aa196fcdeaa456ef7ef57bfd024460

SHA1
f934db6f03a4f31fc4967f723975dbb035c5b038

SHA256
b1f72a05c4c97be5be2be49dfadb0fe277eb0598dbebf2576f0f977e4f52c04b

SHA512
cb821cb4189bb3256b97d9596fade522b8c29a460981d79a16d97092044ff78c3719cf1c11b2a92405c3c60604280fde01609a46b8198410c3fea11e7de6537a

Download Submit
C:\Windows\System\bNILLld.exe

Filesize
2.1MB

MD5
034f3186f216b9abd25fa8067f55de01

SHA1
ef2e5c4c9e16a56d211fae96e4fe194ff31b8443

SHA256
48988ade0039bd179d238f8d578107077eab52612059221bd8d52890fa234093

SHA512
51f2c9b41d734329a0da0e5a2456d0d57a79f2e820461b6cc50fa78292191eb0f19681b47d1fef7ed064922e056bb0c791c593549337da65d056f76c290a0e7e

Download Submit
C:\Windows\System\byaWsUH.exe

Filesize
2.1MB

MD5
29b4027ee6fd9ee98e3733748f558ee5

SHA1
41e12697adefb337684117b22efa0af80172e8a4

SHA256
09cd24ee59c22ad2b7301a239ccb4b72e915987f35597d49c541ac435a0add55

SHA512
cfb259987895cdcd3b5f2ff23fdc16a5608db55b65b978b2a3ef8bd5a498415ca8161cc8b7dfd9c7c816564d053efe0653e3327aa94067c263a1b8e709ce49ab

Download Submit
C:\Windows\System\cETBRBX.exe

Filesize
2.1MB

MD5
d8a2fadf5de0f701b462d594dbda5703

SHA1
58bbac0c703a369d1722e34dd2f87aaee50df34b

SHA256
8daea8f8a324670561b72d03a5aabdda63024b9c57e033b15c9f2befc058456a

SHA512
9ab9b6465f5531cacff8c72bfce2a419b3cd2af16fcd126e21d027e4bfed66a5ee2eb2cd2e6e296ca537d06235bf6f82a4fb49c368e1498212a826d9403ff5ef

Download Submit
C:\Windows\System\cVwlEaQ.exe

Filesize
2.1MB

MD5
bdca536bef6bf604a4fd9d5969342f4c

SHA1
39b357cff97c905dc40466257c2e4234ec2f0886

SHA256
bd0962f1fddc83e978a702437b1a95b41ab618eb3c4adb5fbc06d66a9703ded9

SHA512
9062906dd84127e2f539ab0d8b5ee3eb4099d87dc298dfef4fbc6abdc769fdcb3ed03108729d07745fed0e96b012deadceec4fac000ac6b186940be94facf18c

Download Submit
C:\Windows\System\clmMMhW.exe

Filesize
2.1MB

MD5
e1ab7d9bbec9e39242e2b065c4c42729

SHA1
4322f2e212ade13483143cb7cd05a3f0cfc1d101

SHA256
4c17add1da498c20f1d57cb19e7b57f0c189d3947c42425607e63ef021b4231f

SHA512
a55fb02d65c17651fc4b0b49bd4223329045fcbe7bb8fe55942be54e40c28655fbfdd56fd9bf1700589de19739579a4c742cd975b43ca5468911c089311567b9

Download Submit
C:\Windows\System\dyfkQom.exe

Filesize
2.1MB

MD5
f1d56357c4bea7214a4be34f75a702b0

SHA1
36bd123aed901f7e610f1dc48585884c71295b2d

SHA256
2e89e2d38c2d80f64455357f2338fca39bb0769f8b7dde1cd03717cdb6b60e3c

SHA512
a13cb7fed726fd3da3a3118ab7cab199c38c75082a02bcf009309308e031537c3c45eaaed777e64f25843aa70bd74673feca71eb1c23b87b8e798cea760d4d34

Download Submit
C:\Windows\System\eHUnPFG.exe

Filesize
2.1MB

MD5
cd707ac52fb9df4b239a99a3dbaa0374

SHA1
fa9105383c13783c29067bb2784b2b770161af80

SHA256
64dfd87e56774350b05ec518942b924a30da49b662c02276822c2895b3aadf0f

SHA512
9b77ac40d94b36ee992f3a1098cdabaa3451d8553e763a2ce2a69401645e4a5bfa57f173125582805af8b9f8faa7b2689222601193100ad7438b0237f92427bb

Download Submit
C:\Windows\System\fZsKFPe.exe

Filesize
2.1MB

MD5
def4fe335564fb2c530a5b47bcc9c455

SHA1
806949d621f998d1896a72c311a5c3fa5ca721b5

SHA256
3f65a8423812e7bce2ceb4f1d9647b21573f985585d1f9a03cdd5d959fa5420b

SHA512
9aa2a536ab71e63154059bbde490a2d436eec453a40aa61e71f44cf47db0eb953e46308b0df419f1821181328e37337cd66884a1ce4120696d13648fa3701bb6

Download Submit
C:\Windows\System\goEhKVx.exe

Filesize
2.1MB

MD5
9bbbdfbb459a1798c8a713496be81962

SHA1
cf5ee4e0381f61e5e084f2ffdb75d43f2aa433fc

SHA256
4479e37713ed1d34e75e1e067b354d9f3193d643912f911b96c5ab1460030a44

SHA512
c0608ef78ba618cc8c9ad63ae83edd030ce6bcf4b18e339efe3287673d9b0e01709c5b0e9fd5c07d66ab1869ed0e3904a93404c597ea55659bc0431ef3a8de2a

Download Submit
C:\Windows\System\hYjJtnr.exe

Filesize
2.1MB

MD5
a6c54ebf2872b6e6971b87d4b82bc7c7

SHA1
c1ff2baf8a51fba499d5b04294d9a47a53cfa673

SHA256
561a439bcc8fa1937e57b96c7458cc8700d1665b52ea720b302156baef3ca446

SHA512
5fd5da9504e7cd174232dbd866fb2b9aac951b11ff3a4927450ddaab6584407f47259194d5df8b47566fa61254f5cdf1dfb6b728120fa266c2eb44aa9160f41e

Download Submit
C:\Windows\System\jnPvoSG.exe

Filesize
2.1MB

MD5
cc45204ccdcc418e99f673e860b3a7f4

SHA1
a0474259d0c24d76a40f400d08f2a6e60a56fa56

SHA256
931cc02778309b106e870498a30f8a329653a59d3038a712f1ea32d6b56d0c5d

SHA512
4c813065564f3065becfa831712be4181e9aaf415e430c6baf0c5ce22fb35827f4e29bb283228f92b6c1e868622544e906b3ea8ecae2e26cd6899f564698a12b

Download Submit
C:\Windows\System\rjOShQj.exe

Filesize
2.1MB

MD5
92c7d58dda7944a83e5f3930d2b0b58a

SHA1
018c79cfab691cc792682cc3564113d5cc48a06c

SHA256
601465fb9d824ed83b6d2bcedd4b6bb05c4874276740e651b3128e8654502aa7

SHA512
66f52b61ce9c5d3caa769b1f7fc7aab0eb0b2cbbec5024373a3565bb4bfc3ed64e6c1cc49d0ce2602e79ab7301263444206adcfb49dd4538727f4fc339368c6e

Download Submit
C:\Windows\System\sbvuWGD.exe

Filesize
2.1MB

MD5
2217ab4c0aab2e544c5a292d177ce376

SHA1
6225c0b2b4f80d79383f1da260bdaeb3b04885aa

SHA256
0036fb923056fb45ba68f99c58dd7aedc4c91d01c759aeef44cfbde8d2b52dbd

SHA512
d54a37a07d5ec6f61e6bf9e1bd1955f367d81a8e2f7e71b11e12ee41dba65723ec9e616f45d7baaba8de2be2efa78a9018cbcc51822392729c72a88767190f9d

Download Submit
C:\Windows\System\stkNcRk.exe

Filesize
2.1MB

MD5
6ef504052330afa433d3c324047e9874

SHA1
a1eb9f4b5d3086325ce2d09b86744a1bb6b5d66d

SHA256
b48ab26753b33be1a9d250222cae35a65ee82d8c491a937b17a4502b78fc6599

SHA512
68942173018e7ef4c86b3b1ecfd492ae648343710727b447bd496ccb0d3d05fac9f805fa32c66172fe7c2f9c70d96a9d0a03c726f8f888be828a6006289122b1

Download Submit
C:\Windows\System\uHqhamD.exe

Filesize
2.1MB

MD5
6847635253b7865b21af48b535d5bd0a

SHA1
05d04df5acebeb298e6976fd5220d3c1625296dd

SHA256
33c12a8fa54fe17fd8863f7105db345b3df2bcdfb9eb8d83781b0cccc273d95d

SHA512
980b810d61f6e41fce3d5e87098c63ab8ba36b74bb3d7390268bb39520f10bd47cf18a52131435cae958005c7522002653eb93b316462880feb0fe732e448d95

Download Submit
C:\Windows\System\ugPWyHX.exe

Filesize
2.1MB

MD5
dbe406029a67d73f1fcc13d1ce022b7d

SHA1
94f914cbee61dbe021606d74dda7913479f31154

SHA256
deb7f4e7a2cd3c96816d2402b5d898a0982816d98f860a2a26d8f3a590902543

SHA512
ee963f53c49f8981cca2b9b2298f5807feca95b58c4727ae7046b53350f4d34b07a2fff3c66ec209bb3e2d315b8094b0ca3f3896bda8a2e64426b1cecb9672a0

Download Submit
C:\Windows\System\umjHkDw.exe

Filesize
2.1MB

MD5
b2c19edfd6a286960ac9c5c4af760ecc

SHA1
b745cddcccc79dd806675b08fb938b0ca6a33f7d

SHA256
50e25f7706dd5172dc46423b3314d2c9ae4410e536f2f2fe94c74f4667f723cf

SHA512
8a2a8dfadf2d3df474a34e9f8b328e2803bd1873eaa4566f0bfdca9108c3d79e9d862c211285fae8b2cb69dca8110c7ac8a6146d56f3ac7051d029f9078a3103

Download Submit
C:\Windows\System\vqGiXDB.exe

Filesize
2.1MB

MD5
f569f0002058bf97eb3deddb9268b647

SHA1
ca021597943a23f0bb54acc38219ce428ff86e7c

SHA256
c656ece7ca793a7b92359cf60d46199a1587e1d18a6e3c7449ae38f7a49cf2a6

SHA512
9bd5fcb9b8b70b1affdf3646441f95c78e3a860f5b6375a0c3054db90fa22a2de8116fda0a84886e99f709c83895839daf45001d94d6c2957a5f4ffbe408cf61

Download Submit
C:\Windows\System\zFLuZIc.exe

Filesize
2.1MB

MD5
fe21772b3030f9f0c0acae68fab8f54b

SHA1
642798f0d510bf04770c516004417d06899d1db7

SHA256
b039d34d20ada2ce1da002ab43db6dbef97624d29d3c4ba2bb265cd6f80c8c93

SHA512
4c02d35cf9ce802a34cd80b7d5b271cda146c6c7f95adcae683e66caa6aa43e8481e7f4bd6555817c187a1ccd96f26fb9a7991e561768c883d9493d4f0b4b4a4

Download Submit
memory/116-4839-0x00007FF7891E0000-0x00007FF7895D2000-memory.dmp

Filesize
3.9MB

Download
memory/116-551-0x00007FF7891E0000-0x00007FF7895D2000-memory.dmp

Filesize
3.9MB

Download
memory/400-4774-0x00007FF638E30000-0x00007FF639222000-memory.dmp

Filesize
3.9MB

Download
memory/400-36-0x00007FF638E30000-0x00007FF639222000-memory.dmp

Filesize
3.9MB

Download
memory/1448-22-0x000001CA1CE10000-0x000001CA1CE20000-memory.dmp

Filesize
64KB

Download
memory/1448-19-0x00007FF81A1B0000-0x00007FF81AC71000-memory.dmp

Filesize
10.8MB

Download
memory/1448-50-0x000001CA371F0000-0x000001CA37212000-memory.dmp

Filesize
136KB

Download
memory/1936-0-0x00007FF6EA150000-0x00007FF6EA542000-memory.dmp

Filesize
3.9MB

Download
memory/1936-1-0x00000253024F0000-0x0000025302500000-memory.dmp

Filesize
64KB

Download
memory/2160-61-0x00007FF693720000-0x00007FF693B12000-memory.dmp

Filesize
3.9MB

Download
memory/2432-4827-0x00007FF6DD530000-0x00007FF6DD922000-memory.dmp

Filesize
3.9MB

Download
memory/2432-539-0x00007FF6DD530000-0x00007FF6DD922000-memory.dmp

Filesize
3.9MB

Download
memory/2772-545-0x00007FF670320000-0x00007FF670712000-memory.dmp

Filesize
3.9MB

Download
memory/2772-4833-0x00007FF670320000-0x00007FF670712000-memory.dmp

Filesize
3.9MB

Download
memory/2788-567-0x00007FF70B330000-0x00007FF70B722000-memory.dmp

Filesize
3.9MB

Download
memory/2788-4858-0x00007FF70B330000-0x00007FF70B722000-memory.dmp

Filesize
3.9MB

Download
memory/2888-4823-0x00007FF73EAD0000-0x00007FF73EEC2000-memory.dmp

Filesize
3.9MB

Download
memory/2888-64-0x00007FF73EAD0000-0x00007FF73EEC2000-memory.dmp

Filesize
3.9MB

Download
memory/2984-4869-0x00007FF61E420000-0x00007FF61E812000-memory.dmp

Filesize
3.9MB

Download
memory/2984-588-0x00007FF61E420000-0x00007FF61E812000-memory.dmp

Filesize
3.9MB

Download
memory/3296-4818-0x00007FF7BD940000-0x00007FF7BDD32000-memory.dmp

Filesize
3.9MB

Download
memory/3296-63-0x00007FF7BD940000-0x00007FF7BDD32000-memory.dmp

Filesize
3.9MB

Download
memory/3464-560-0x00007FF6E5600000-0x00007FF6E59F2000-memory.dmp

Filesize
3.9MB

Download
memory/3464-4847-0x00007FF6E5600000-0x00007FF6E59F2000-memory.dmp

Filesize
3.9MB

Download
memory/4068-579-0x00007FF781290000-0x00007FF781682000-memory.dmp

Filesize
3.9MB

Download
memory/4288-32-0x00007FF7296D0000-0x00007FF729AC2000-memory.dmp

Filesize
3.9MB

Download
memory/4336-56-0x00007FF6ACD80000-0x00007FF6AD172000-memory.dmp

Filesize
3.9MB

Download
memory/4396-570-0x00007FF70A3B0000-0x00007FF70A7A2000-memory.dmp

Filesize
3.9MB

Download
memory/4396-4870-0x00007FF70A3B0000-0x00007FF70A7A2000-memory.dmp

Filesize
3.9MB

Download
memory/4544-25-0x00007FF7AFF50000-0x00007FF7B0342000-memory.dmp

Filesize
3.9MB

Download
memory/4600-4876-0x00007FF6928A0000-0x00007FF692C92000-memory.dmp

Filesize
3.9MB

Download
memory/4600-597-0x00007FF6928A0000-0x00007FF692C92000-memory.dmp

Filesize
3.9MB

Download
memory/4716-4863-0x00007FF6E0340000-0x00007FF6E0732000-memory.dmp

Filesize
3.9MB

Download
memory/4716-578-0x00007FF6E0340000-0x00007FF6E0732000-memory.dmp

Filesize
3.9MB

Download
memory/4976-591-0x00007FF622C60000-0x00007FF623052000-memory.dmp

Filesize
3.9MB

Download
memory/5064-4853-0x00007FF7545D0000-0x00007FF7549C2000-memory.dmp

Filesize
3.9MB

Download
memory/5064-563-0x00007FF7545D0000-0x00007FF7549C2000-memory.dmp

Filesize
3.9MB

Download
memory/5068-4787-0x00007FF6CA220000-0x00007FF6CA612000-memory.dmp

Filesize
3.9MB

Download
memory/5068-38-0x00007FF6CA220000-0x00007FF6CA612000-memory.dmp

Filesize
3.9MB

Download
memory/5072-60-0x00007FF6FA2C0000-0x00007FF6FA6B2000-memory.dmp

Filesize
3.9MB

Download