xmrig | 2c2912b8abd2b5aa2bbe0992381e3a81177bd29c36bd7a44b7769a67f1e79a72

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 18:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
Size

1.9MB
MD5

05d1b4a137a2c5b590576a4632506abd
SHA1

179e2056dfdc86125fd016af68bcffadde1306fe
SHA256

2c2912b8abd2b5aa2bbe0992381e3a81177bd29c36bd7a44b7769a67f1e79a72
SHA512

1903a60ee9ea16ae75e13989193323d6d93e36c406919eca26b1eee256e3e3c2ee3cc98aa71adf9db72cf9ddba0129fe02f7ddb3ced6e43b288b96e901ccb283
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U0:NABV

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 29 IoCs

miner

resource	yara_rule
behavioral2/memory/588-54-0x00007FF74B670000-0x00007FF74BA62000-memory.dmp	xmrig
behavioral2/memory/2168-76-0x00007FF732F50000-0x00007FF733342000-memory.dmp	xmrig
behavioral2/memory/452-515-0x00007FF67B760000-0x00007FF67BB52000-memory.dmp	xmrig
behavioral2/memory/3780-537-0x00007FF7F3C60000-0x00007FF7F4052000-memory.dmp	xmrig
behavioral2/memory/2512-544-0x00007FF683510000-0x00007FF683902000-memory.dmp	xmrig
behavioral2/memory/2020-548-0x00007FF663C70000-0x00007FF664062000-memory.dmp	xmrig
behavioral2/memory/4412-552-0x00007FF7FA4E0000-0x00007FF7FA8D2000-memory.dmp	xmrig
behavioral2/memory/768-559-0x00007FF701AD0000-0x00007FF701EC2000-memory.dmp	xmrig
behavioral2/memory/512-551-0x00007FF73EC20000-0x00007FF73F012000-memory.dmp	xmrig
behavioral2/memory/3996-528-0x00007FF7478B0000-0x00007FF747CA2000-memory.dmp	xmrig
behavioral2/memory/728-522-0x00007FF621550000-0x00007FF621942000-memory.dmp	xmrig
behavioral2/memory/3384-518-0x00007FF77F3B0000-0x00007FF77F7A2000-memory.dmp	xmrig
behavioral2/memory/4332-57-0x00007FF662DF0000-0x00007FF6631E2000-memory.dmp	xmrig
behavioral2/memory/3388-52-0x00007FF638F90000-0x00007FF639382000-memory.dmp	xmrig
behavioral2/memory/4844-35-0x00007FF723DE0000-0x00007FF7241D2000-memory.dmp	xmrig
behavioral2/memory/4620-32-0x00007FF7F0B40000-0x00007FF7F0F32000-memory.dmp	xmrig
behavioral2/memory/2544-3373-0x00007FF76B700000-0x00007FF76BAF2000-memory.dmp	xmrig
behavioral2/memory/3184-3722-0x00007FF7F5DF0000-0x00007FF7F61E2000-memory.dmp	xmrig
behavioral2/memory/3388-4599-0x00007FF638F90000-0x00007FF639382000-memory.dmp	xmrig
behavioral2/memory/3956-4641-0x00007FF779430000-0x00007FF779822000-memory.dmp	xmrig
behavioral2/memory/2168-4646-0x00007FF732F50000-0x00007FF733342000-memory.dmp	xmrig
behavioral2/memory/3384-4664-0x00007FF77F3B0000-0x00007FF77F7A2000-memory.dmp	xmrig
behavioral2/memory/728-4669-0x00007FF621550000-0x00007FF621942000-memory.dmp	xmrig
behavioral2/memory/3780-4679-0x00007FF7F3C60000-0x00007FF7F4052000-memory.dmp	xmrig
behavioral2/memory/512-4694-0x00007FF73EC20000-0x00007FF73F012000-memory.dmp	xmrig
behavioral2/memory/2020-4687-0x00007FF663C70000-0x00007FF664062000-memory.dmp	xmrig
behavioral2/memory/452-4659-0x00007FF67B760000-0x00007FF67BB52000-memory.dmp	xmrig
behavioral2/memory/2544-4653-0x00007FF76B700000-0x00007FF76BAF2000-memory.dmp	xmrig
behavioral2/memory/3184-4645-0x00007FF7F5DF0000-0x00007FF7F61E2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1304	yHXugnd.exe
588	BiIzRPW.exe
4620	IfscfzF.exe
4844	oJImRuL.exe
3388	yAHkwsI.exe
4332	vKDphqi.exe
3956	aKzZEJa.exe
2168	ZzXclfI.exe
3184	BsIJcrT.exe
2544	PKYqglJ.exe
3680	rFXJdoH.exe
452	oMEmMRa.exe
3384	BybhGDb.exe
728	feefLAM.exe
3996	yHMJWIK.exe
3780	lGwvYtS.exe
2512	rsobxsa.exe
2020	sAydVbu.exe
512	bpCQtxG.exe
4412	rYvxRoB.exe
768	VMjzcow.exe
3776	iaGSybD.exe
3832	tUdbCfW.exe
4720	yhLXzaL.exe
1040	bIncvgA.exe
3672	ufodKwj.exe
384	tONqWPO.exe
1588	joDmXjE.exe
1268	LmwUBqm.exe
3940	nsBmRqB.exe
4628	IBSbAFM.exe
4524	VJwrJJF.exe
2708	krmUKwt.exe
3504	lQlPQPW.exe
3392	ktAHznM.exe
3012	YArTzQn.exe
3028	yFVLawQ.exe
2380	qqldiBN.exe
2824	KGspJOK.exe
3988	TvolqUv.exe
5004	rcYZyjU.exe
4704	PPwoaUs.exe
2524	quvXHuW.exe
4296	rrxjpji.exe
3976	GKTogDM.exe
1412	pUJGQvK.exe
1572	bGkBpKA.exe
4516	wZuEhSI.exe
3652	SnnNuMC.exe
3256	ulmksPp.exe
1492	vfRqKhE.exe
2332	hbjQQjV.exe
3120	ENjeNFd.exe
4796	XAYuacl.exe
4432	CROmCVi.exe
1012	fPqVdKS.exe
4080	dAPtHrp.exe
4228	gfuWPQr.exe
1440	CzvQCda.exe
3972	GjOMani.exe
2132	cZLVvNK.exe
532	bMRJtqG.exe
2904	TTaQGCx.exe
552	upEQBOk.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4244-0-0x00007FF6275F0000-0x00007FF6279E2000-memory.dmp	upx
behavioral2/files/0x000b000000023b7f-5.dat	upx
behavioral2/files/0x000a000000023b84-7.dat	upx
behavioral2/files/0x000a000000023b83-11.dat	upx
behavioral2/files/0x000a000000023b85-25.dat	upx
behavioral2/files/0x000a000000023b88-47.dat	upx
behavioral2/files/0x000a000000023b87-48.dat	upx
behavioral2/memory/588-54-0x00007FF74B670000-0x00007FF74BA62000-memory.dmp	upx
behavioral2/files/0x000a000000023b8c-62.dat	upx
behavioral2/memory/3956-63-0x00007FF779430000-0x00007FF779822000-memory.dmp	upx
behavioral2/memory/2544-69-0x00007FF76B700000-0x00007FF76BAF2000-memory.dmp	upx
behavioral2/memory/2168-76-0x00007FF732F50000-0x00007FF733342000-memory.dmp	upx
behavioral2/files/0x000a000000023b8e-82.dat	upx
behavioral2/files/0x000b000000023b8a-93.dat	upx
behavioral2/files/0x000a000000023b90-100.dat	upx
behavioral2/files/0x000a000000023b96-139.dat	upx
behavioral2/files/0x000a000000023b99-154.dat	upx
behavioral2/files/0x000a000000023b9c-169.dat	upx
behavioral2/files/0x000a000000023ba0-181.dat	upx
behavioral2/memory/452-515-0x00007FF67B760000-0x00007FF67BB52000-memory.dmp	upx
behavioral2/memory/3780-537-0x00007FF7F3C60000-0x00007FF7F4052000-memory.dmp	upx
behavioral2/memory/2512-544-0x00007FF683510000-0x00007FF683902000-memory.dmp	upx
behavioral2/memory/2020-548-0x00007FF663C70000-0x00007FF664062000-memory.dmp	upx
behavioral2/memory/4412-552-0x00007FF7FA4E0000-0x00007FF7FA8D2000-memory.dmp	upx
behavioral2/memory/768-559-0x00007FF701AD0000-0x00007FF701EC2000-memory.dmp	upx
behavioral2/memory/512-551-0x00007FF73EC20000-0x00007FF73F012000-memory.dmp	upx
behavioral2/memory/3996-528-0x00007FF7478B0000-0x00007FF747CA2000-memory.dmp	upx
behavioral2/memory/728-522-0x00007FF621550000-0x00007FF621942000-memory.dmp	upx
behavioral2/memory/3384-518-0x00007FF77F3B0000-0x00007FF77F7A2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba1-186.dat	upx
behavioral2/files/0x000a000000023b9f-184.dat	upx
behavioral2/files/0x000a000000023b9e-179.dat	upx
behavioral2/files/0x000a000000023b9d-174.dat	upx
behavioral2/files/0x000a000000023b9b-164.dat	upx
behavioral2/files/0x000a000000023b9a-159.dat	upx
behavioral2/files/0x000a000000023b98-149.dat	upx
behavioral2/files/0x000a000000023b97-144.dat	upx
behavioral2/files/0x000a000000023b95-134.dat	upx
behavioral2/files/0x000a000000023b94-129.dat	upx
behavioral2/files/0x000a000000023b93-124.dat	upx
behavioral2/files/0x000a000000023b92-119.dat	upx
behavioral2/files/0x000a000000023b91-113.dat	upx
behavioral2/files/0x000a000000023b8f-103.dat	upx
behavioral2/files/0x000b000000023b80-98.dat	upx
behavioral2/memory/3680-81-0x00007FF6D95C0000-0x00007FF6D99B2000-memory.dmp	upx
behavioral2/files/0x000a000000023b8d-79.dat	upx
behavioral2/files/0x000a000000023b89-70.dat	upx
behavioral2/memory/3184-68-0x00007FF7F5DF0000-0x00007FF7F61E2000-memory.dmp	upx
behavioral2/files/0x000b000000023b8b-65.dat	upx
behavioral2/memory/4332-57-0x00007FF662DF0000-0x00007FF6631E2000-memory.dmp	upx
behavioral2/memory/3388-52-0x00007FF638F90000-0x00007FF639382000-memory.dmp	upx
behavioral2/memory/4844-35-0x00007FF723DE0000-0x00007FF7241D2000-memory.dmp	upx
behavioral2/memory/4620-32-0x00007FF7F0B40000-0x00007FF7F0F32000-memory.dmp	upx
behavioral2/files/0x000a000000023b86-29.dat	upx
behavioral2/memory/1304-10-0x00007FF685EF0000-0x00007FF6862E2000-memory.dmp	upx
behavioral2/memory/2544-3373-0x00007FF76B700000-0x00007FF76BAF2000-memory.dmp	upx
behavioral2/memory/3184-3722-0x00007FF7F5DF0000-0x00007FF7F61E2000-memory.dmp	upx
behavioral2/memory/3388-4599-0x00007FF638F90000-0x00007FF639382000-memory.dmp	upx
behavioral2/memory/3956-4641-0x00007FF779430000-0x00007FF779822000-memory.dmp	upx
behavioral2/memory/2168-4646-0x00007FF732F50000-0x00007FF733342000-memory.dmp	upx
behavioral2/memory/3384-4664-0x00007FF77F3B0000-0x00007FF77F7A2000-memory.dmp	upx
behavioral2/memory/728-4669-0x00007FF621550000-0x00007FF621942000-memory.dmp	upx
behavioral2/memory/3780-4679-0x00007FF7F3C60000-0x00007FF7F4052000-memory.dmp	upx
behavioral2/memory/512-4694-0x00007FF73EC20000-0x00007FF73F012000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\WDalisd.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\pfdbQjB.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\ixdqyZg.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\nnrVSLm.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\zgGQjiX.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\Qfgicld.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\CfTaxXz.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\hjVkOTa.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\dRJzDYe.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\HHquCQd.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\UVAgkyy.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\yUCEQCr.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\ktAHznM.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\BpijNNU.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\KWEMeQg.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\jvOFvdf.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\txbhcuo.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\zWWvxrx.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\biofGQd.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\jplggSL.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\ueOsvzk.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\yybPtSi.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\BuSnKXq.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\jLyPOCy.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\sGBkQhN.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\xciszVK.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\bRTbIEr.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\AHapKbO.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\VmzllBz.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\FsssaIh.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\LaczlMF.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\dFHawWW.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\UvbFZdK.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\TrmZPvC.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\JicIvBC.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\JtAKwAo.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\XweNqaQ.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\VvknvGQ.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\NkquDEC.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\IjIYwjD.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\qfYVtqo.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\uqjuMbR.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\RYLLFbi.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\lTkkHmo.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\xbmbFgF.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\AmSEXHN.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\gAJcqQa.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\YFtcApa.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\FTvnile.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\vcmyVXa.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\NLDxBZM.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\ABVNyBk.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\IXvnveI.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\KsPmyzG.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\usfCkSu.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\mHxdwqI.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\ubWMBMz.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\lUsBQcw.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\KoDwTos.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\hjkNCFs.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\ZWeraNk.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\mpaMBXE.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\ssWympv.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\WTtzzmO.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe

Modifies data under HKEY_USERS 34 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "1"	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\TrustCenter\Experimentation	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	Process not Found
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	Process not Found
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 50,1329 10,1329 15,1329 100,1329 6"	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	Process not Found
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Process not Found
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "2"	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	Process not Found

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1436	powershell.exe
1436	powershell.exe
1436	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
Token: SeDebugPrivilege	1436	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
10976	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 1436	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	84
PID 4244 wrote to memory of 1436	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	84
PID 4244 wrote to memory of 1304	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	85
PID 4244 wrote to memory of 1304	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	85
PID 4244 wrote to memory of 588	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	86
PID 4244 wrote to memory of 588	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	86
PID 4244 wrote to memory of 4620	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	87
PID 4244 wrote to memory of 4620	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	87
PID 4244 wrote to memory of 4844	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	88
PID 4244 wrote to memory of 4844	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	88
PID 4244 wrote to memory of 3388	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	89
PID 4244 wrote to memory of 3388	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	89
PID 4244 wrote to memory of 4332	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	90
PID 4244 wrote to memory of 4332	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	90
PID 4244 wrote to memory of 3956	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	91
PID 4244 wrote to memory of 3956	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	91
PID 4244 wrote to memory of 3184	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	92
PID 4244 wrote to memory of 3184	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	92
PID 4244 wrote to memory of 2168	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	93
PID 4244 wrote to memory of 2168	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	93
PID 4244 wrote to memory of 2544	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	94
PID 4244 wrote to memory of 2544	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	94
PID 4244 wrote to memory of 3680	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	95
PID 4244 wrote to memory of 3680	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	95
PID 4244 wrote to memory of 452	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	96
PID 4244 wrote to memory of 452	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	96
PID 4244 wrote to memory of 3384	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	97
PID 4244 wrote to memory of 3384	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	97
PID 4244 wrote to memory of 728	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	98
PID 4244 wrote to memory of 728	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	98
PID 4244 wrote to memory of 3996	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	99
PID 4244 wrote to memory of 3996	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	99
PID 4244 wrote to memory of 3780	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	100
PID 4244 wrote to memory of 3780	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	100
PID 4244 wrote to memory of 2512	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	101
PID 4244 wrote to memory of 2512	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	101
PID 4244 wrote to memory of 2020	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	102
PID 4244 wrote to memory of 2020	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	102
PID 4244 wrote to memory of 512	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	103
PID 4244 wrote to memory of 512	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	103
PID 4244 wrote to memory of 4412	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	104
PID 4244 wrote to memory of 4412	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	104
PID 4244 wrote to memory of 768	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	105
PID 4244 wrote to memory of 768	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	105
PID 4244 wrote to memory of 3776	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	106
PID 4244 wrote to memory of 3776	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	106
PID 4244 wrote to memory of 3832	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	107
PID 4244 wrote to memory of 3832	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	107
PID 4244 wrote to memory of 4720	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	108
PID 4244 wrote to memory of 4720	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	108
PID 4244 wrote to memory of 1040	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	109
PID 4244 wrote to memory of 1040	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	109
PID 4244 wrote to memory of 3672	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	110
PID 4244 wrote to memory of 3672	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	110
PID 4244 wrote to memory of 384	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	111
PID 4244 wrote to memory of 384	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	111
PID 4244 wrote to memory of 1588	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	112
PID 4244 wrote to memory of 1588	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	112
PID 4244 wrote to memory of 1268	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	113
PID 4244 wrote to memory of 1268	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	113
PID 4244 wrote to memory of 3940	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	114
PID 4244 wrote to memory of 3940	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	114
PID 4244 wrote to memory of 4628	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	115
PID 4244 wrote to memory of 4628	4244	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1436
- C:\Windows\System\yHXugnd.exe
  C:\Windows\System\yHXugnd.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\BiIzRPW.exe
  C:\Windows\System\BiIzRPW.exe
  2⤵
  - Executes dropped EXE
  PID:588
- C:\Windows\System\IfscfzF.exe
  C:\Windows\System\IfscfzF.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\oJImRuL.exe
  C:\Windows\System\oJImRuL.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\yAHkwsI.exe
  C:\Windows\System\yAHkwsI.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\vKDphqi.exe
  C:\Windows\System\vKDphqi.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\aKzZEJa.exe
  C:\Windows\System\aKzZEJa.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\BsIJcrT.exe
  C:\Windows\System\BsIJcrT.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\ZzXclfI.exe
  C:\Windows\System\ZzXclfI.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\PKYqglJ.exe
  C:\Windows\System\PKYqglJ.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\rFXJdoH.exe
  C:\Windows\System\rFXJdoH.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System\oMEmMRa.exe
  C:\Windows\System\oMEmMRa.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\BybhGDb.exe
  C:\Windows\System\BybhGDb.exe
  2⤵
  - Executes dropped EXE
  PID:3384
- C:\Windows\System\feefLAM.exe
  C:\Windows\System\feefLAM.exe
  2⤵
  - Executes dropped EXE
  PID:728
- C:\Windows\System\yHMJWIK.exe
  C:\Windows\System\yHMJWIK.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\lGwvYtS.exe
  C:\Windows\System\lGwvYtS.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System\rsobxsa.exe
  C:\Windows\System\rsobxsa.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\sAydVbu.exe
  C:\Windows\System\sAydVbu.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\bpCQtxG.exe
  C:\Windows\System\bpCQtxG.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\rYvxRoB.exe
  C:\Windows\System\rYvxRoB.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\VMjzcow.exe
  C:\Windows\System\VMjzcow.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\iaGSybD.exe
  C:\Windows\System\iaGSybD.exe
  2⤵
  - Executes dropped EXE
  PID:3776
- C:\Windows\System\tUdbCfW.exe
  C:\Windows\System\tUdbCfW.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System\yhLXzaL.exe
  C:\Windows\System\yhLXzaL.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\bIncvgA.exe
  C:\Windows\System\bIncvgA.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\ufodKwj.exe
  C:\Windows\System\ufodKwj.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\tONqWPO.exe
  C:\Windows\System\tONqWPO.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\joDmXjE.exe
  C:\Windows\System\joDmXjE.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\LmwUBqm.exe
  C:\Windows\System\LmwUBqm.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\nsBmRqB.exe
  C:\Windows\System\nsBmRqB.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\IBSbAFM.exe
  C:\Windows\System\IBSbAFM.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\VJwrJJF.exe
  C:\Windows\System\VJwrJJF.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\krmUKwt.exe
  C:\Windows\System\krmUKwt.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\lQlPQPW.exe
  C:\Windows\System\lQlPQPW.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\ktAHznM.exe
  C:\Windows\System\ktAHznM.exe
  2⤵
  - Executes dropped EXE
  PID:3392
- C:\Windows\System\YArTzQn.exe
  C:\Windows\System\YArTzQn.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\yFVLawQ.exe
  C:\Windows\System\yFVLawQ.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\qqldiBN.exe
  C:\Windows\System\qqldiBN.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\KGspJOK.exe
  C:\Windows\System\KGspJOK.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\TvolqUv.exe
  C:\Windows\System\TvolqUv.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\rcYZyjU.exe
  C:\Windows\System\rcYZyjU.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\PPwoaUs.exe
  C:\Windows\System\PPwoaUs.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\quvXHuW.exe
  C:\Windows\System\quvXHuW.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\rrxjpji.exe
  C:\Windows\System\rrxjpji.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\GKTogDM.exe
  C:\Windows\System\GKTogDM.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\pUJGQvK.exe
  C:\Windows\System\pUJGQvK.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\bGkBpKA.exe
  C:\Windows\System\bGkBpKA.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\wZuEhSI.exe
  C:\Windows\System\wZuEhSI.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\SnnNuMC.exe
  C:\Windows\System\SnnNuMC.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\ulmksPp.exe
  C:\Windows\System\ulmksPp.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\vfRqKhE.exe
  C:\Windows\System\vfRqKhE.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\hbjQQjV.exe
  C:\Windows\System\hbjQQjV.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\ENjeNFd.exe
  C:\Windows\System\ENjeNFd.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\XAYuacl.exe
  C:\Windows\System\XAYuacl.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\CROmCVi.exe
  C:\Windows\System\CROmCVi.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\fPqVdKS.exe
  C:\Windows\System\fPqVdKS.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\dAPtHrp.exe
  C:\Windows\System\dAPtHrp.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\gfuWPQr.exe
  C:\Windows\System\gfuWPQr.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\CzvQCda.exe
  C:\Windows\System\CzvQCda.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\GjOMani.exe
  C:\Windows\System\GjOMani.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\cZLVvNK.exe
  C:\Windows\System\cZLVvNK.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\bMRJtqG.exe
  C:\Windows\System\bMRJtqG.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\TTaQGCx.exe
  C:\Windows\System\TTaQGCx.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\upEQBOk.exe
  C:\Windows\System\upEQBOk.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\qSGfyox.exe
  C:\Windows\System\qSGfyox.exe
  2⤵
  PID:5064
- C:\Windows\System\QNlugvf.exe
  C:\Windows\System\QNlugvf.exe
  2⤵
  PID:1760
- C:\Windows\System\wWmsgmV.exe
  C:\Windows\System\wWmsgmV.exe
  2⤵
  PID:5072
- C:\Windows\System\JeGqRKS.exe
  C:\Windows\System\JeGqRKS.exe
  2⤵
  PID:1640
- C:\Windows\System\gAsjwbw.exe
  C:\Windows\System\gAsjwbw.exe
  2⤵
  PID:3852
- C:\Windows\System\xoNaiiX.exe
  C:\Windows\System\xoNaiiX.exe
  2⤵
  PID:4728
- C:\Windows\System\hcElEQB.exe
  C:\Windows\System\hcElEQB.exe
  2⤵
  PID:4656
- C:\Windows\System\jcmRwro.exe
  C:\Windows\System\jcmRwro.exe
  2⤵
  PID:4320
- C:\Windows\System\OELfIbg.exe
  C:\Windows\System\OELfIbg.exe
  2⤵
  PID:2376
- C:\Windows\System\LHVdiMS.exe
  C:\Windows\System\LHVdiMS.exe
  2⤵
  PID:5140
- C:\Windows\System\cxhapvN.exe
  C:\Windows\System\cxhapvN.exe
  2⤵
  PID:5168
- C:\Windows\System\IwytFWI.exe
  C:\Windows\System\IwytFWI.exe
  2⤵
  PID:5196
- C:\Windows\System\jFflMGc.exe
  C:\Windows\System\jFflMGc.exe
  2⤵
  PID:5224
- C:\Windows\System\RabxAdw.exe
  C:\Windows\System\RabxAdw.exe
  2⤵
  PID:5252
- C:\Windows\System\PSjRxIf.exe
  C:\Windows\System\PSjRxIf.exe
  2⤵
  PID:5280
- C:\Windows\System\qBQrovs.exe
  C:\Windows\System\qBQrovs.exe
  2⤵
  PID:5316
- C:\Windows\System\kzlXTBD.exe
  C:\Windows\System\kzlXTBD.exe
  2⤵
  PID:5340
- C:\Windows\System\SmvDmwn.exe
  C:\Windows\System\SmvDmwn.exe
  2⤵
  PID:5364
- C:\Windows\System\JCydXSe.exe
  C:\Windows\System\JCydXSe.exe
  2⤵
  PID:5392
- C:\Windows\System\uutOXDi.exe
  C:\Windows\System\uutOXDi.exe
  2⤵
  PID:5420
- C:\Windows\System\WvfYtSl.exe
  C:\Windows\System\WvfYtSl.exe
  2⤵
  PID:5448
- C:\Windows\System\eTFizrM.exe
  C:\Windows\System\eTFizrM.exe
  2⤵
  PID:5476
- C:\Windows\System\iLAHHnC.exe
  C:\Windows\System\iLAHHnC.exe
  2⤵
  PID:5504
- C:\Windows\System\gJJiUeP.exe
  C:\Windows\System\gJJiUeP.exe
  2⤵
  PID:5536
- C:\Windows\System\aiGzYgB.exe
  C:\Windows\System\aiGzYgB.exe
  2⤵
  PID:5560
- C:\Windows\System\sBONkJg.exe
  C:\Windows\System\sBONkJg.exe
  2⤵
  PID:5588
- C:\Windows\System\PTcUhbY.exe
  C:\Windows\System\PTcUhbY.exe
  2⤵
  PID:5616
- C:\Windows\System\OVUtCsD.exe
  C:\Windows\System\OVUtCsD.exe
  2⤵
  PID:5644
- C:\Windows\System\ytEbtFp.exe
  C:\Windows\System\ytEbtFp.exe
  2⤵
  PID:5672
- C:\Windows\System\LQpAwkC.exe
  C:\Windows\System\LQpAwkC.exe
  2⤵
  PID:5700
- C:\Windows\System\jjHKchK.exe
  C:\Windows\System\jjHKchK.exe
  2⤵
  PID:5728
- C:\Windows\System\pLGtimc.exe
  C:\Windows\System\pLGtimc.exe
  2⤵
  PID:5756
- C:\Windows\System\pDbYunN.exe
  C:\Windows\System\pDbYunN.exe
  2⤵
  PID:5780
- C:\Windows\System\GElviTb.exe
  C:\Windows\System\GElviTb.exe
  2⤵
  PID:5816
- C:\Windows\System\mOorbsE.exe
  C:\Windows\System\mOorbsE.exe
  2⤵
  PID:5840
- C:\Windows\System\KCuCmLE.exe
  C:\Windows\System\KCuCmLE.exe
  2⤵
  PID:5868
- C:\Windows\System\wFegbIN.exe
  C:\Windows\System\wFegbIN.exe
  2⤵
  PID:5896
- C:\Windows\System\ZBFZhOw.exe
  C:\Windows\System\ZBFZhOw.exe
  2⤵
  PID:5924
- C:\Windows\System\nAQvpNe.exe
  C:\Windows\System\nAQvpNe.exe
  2⤵
  PID:5952
- C:\Windows\System\zaUxVuA.exe
  C:\Windows\System\zaUxVuA.exe
  2⤵
  PID:5980
- C:\Windows\System\SkMdOvd.exe
  C:\Windows\System\SkMdOvd.exe
  2⤵
  PID:6008
- C:\Windows\System\DbdxBdm.exe
  C:\Windows\System\DbdxBdm.exe
  2⤵
  PID:6036
- C:\Windows\System\PKdjzmm.exe
  C:\Windows\System\PKdjzmm.exe
  2⤵
  PID:6064
- C:\Windows\System\iavcbjk.exe
  C:\Windows\System\iavcbjk.exe
  2⤵
  PID:6092
- C:\Windows\System\fzVIRoB.exe
  C:\Windows\System\fzVIRoB.exe
  2⤵
  PID:4672
- C:\Windows\System\OfWmFEG.exe
  C:\Windows\System\OfWmFEG.exe
  2⤵
  PID:1032
- C:\Windows\System\haFFfbz.exe
  C:\Windows\System\haFFfbz.exe
  2⤵
  PID:3420
- C:\Windows\System\hAayqhn.exe
  C:\Windows\System\hAayqhn.exe
  2⤵
  PID:1020
- C:\Windows\System\ZPFISfG.exe
  C:\Windows\System\ZPFISfG.exe
  2⤵
  PID:1916
- C:\Windows\System\DZqWYLs.exe
  C:\Windows\System\DZqWYLs.exe
  2⤵
  PID:2252
- C:\Windows\System\LacUTZs.exe
  C:\Windows\System\LacUTZs.exe
  2⤵
  PID:336
- C:\Windows\System\SCyEwns.exe
  C:\Windows\System\SCyEwns.exe
  2⤵
  PID:5188
- C:\Windows\System\lUsBQcw.exe
  C:\Windows\System\lUsBQcw.exe
  2⤵
  PID:5264
- C:\Windows\System\EOltZqI.exe
  C:\Windows\System\EOltZqI.exe
  2⤵
  PID:5312
- C:\Windows\System\rnxTHdm.exe
  C:\Windows\System\rnxTHdm.exe
  2⤵
  PID:5384
- C:\Windows\System\rSTFOtx.exe
  C:\Windows\System\rSTFOtx.exe
  2⤵
  PID:5460
- C:\Windows\System\nZVhHsQ.exe
  C:\Windows\System\nZVhHsQ.exe
  2⤵
  PID:1920
- C:\Windows\System\ZhkYpWB.exe
  C:\Windows\System\ZhkYpWB.exe
  2⤵
  PID:5572
- C:\Windows\System\wPOgrey.exe
  C:\Windows\System\wPOgrey.exe
  2⤵
  PID:436
- C:\Windows\System\EurEldl.exe
  C:\Windows\System\EurEldl.exe
  2⤵
  PID:5688
- C:\Windows\System\xCioyDV.exe
  C:\Windows\System\xCioyDV.exe
  2⤵
  PID:5744
- C:\Windows\System\nOlgIog.exe
  C:\Windows\System\nOlgIog.exe
  2⤵
  PID:5804
- C:\Windows\System\jSsuUTB.exe
  C:\Windows\System\jSsuUTB.exe
  2⤵
  PID:5856
- C:\Windows\System\KbTMkQd.exe
  C:\Windows\System\KbTMkQd.exe
  2⤵
  PID:5912
- C:\Windows\System\onkjUJb.exe
  C:\Windows\System\onkjUJb.exe
  2⤵
  PID:5972
- C:\Windows\System\mSzBRaM.exe
  C:\Windows\System\mSzBRaM.exe
  2⤵
  PID:6048
- C:\Windows\System\opugvKM.exe
  C:\Windows\System\opugvKM.exe
  2⤵
  PID:6108
- C:\Windows\System\jgTMWCR.exe
  C:\Windows\System\jgTMWCR.exe
  2⤵
  PID:4024
- C:\Windows\System\zsDvWry.exe
  C:\Windows\System\zsDvWry.exe
  2⤵
  PID:112
- C:\Windows\System\qURGPBI.exe
  C:\Windows\System\qURGPBI.exe
  2⤵
  PID:5124
- C:\Windows\System\tAAgQTZ.exe
  C:\Windows\System\tAAgQTZ.exe
  2⤵
  PID:5240
- C:\Windows\System\FoNVJoM.exe
  C:\Windows\System\FoNVJoM.exe
  2⤵
  PID:5356
- C:\Windows\System\EnOJsOa.exe
  C:\Windows\System\EnOJsOa.exe
  2⤵
  PID:980
- C:\Windows\System\LcCduyV.exe
  C:\Windows\System\LcCduyV.exe
  2⤵
  PID:5600
- C:\Windows\System\FAnwjgP.exe
  C:\Windows\System\FAnwjgP.exe
  2⤵
  PID:1712
- C:\Windows\System\fKHHbSb.exe
  C:\Windows\System\fKHHbSb.exe
  2⤵
  PID:5776
- C:\Windows\System\WbThrWE.exe
  C:\Windows\System\WbThrWE.exe
  2⤵
  PID:5836
- C:\Windows\System\tTHhCKF.exe
  C:\Windows\System\tTHhCKF.exe
  2⤵
  PID:5944
- C:\Windows\System\yfycRwV.exe
  C:\Windows\System\yfycRwV.exe
  2⤵
  PID:6088
- C:\Windows\System\vPQAKPN.exe
  C:\Windows\System\vPQAKPN.exe
  2⤵
  PID:752
- C:\Windows\System\YjVZhCh.exe
  C:\Windows\System\YjVZhCh.exe
  2⤵
  PID:5184
- C:\Windows\System\hISWCvy.exe
  C:\Windows\System\hISWCvy.exe
  2⤵
  PID:5412
- C:\Windows\System\rrwinxS.exe
  C:\Windows\System\rrwinxS.exe
  2⤵
  PID:4828
- C:\Windows\System\AqCJiRU.exe
  C:\Windows\System\AqCJiRU.exe
  2⤵
  PID:3440
- C:\Windows\System\MBdypWJ.exe
  C:\Windows\System\MBdypWJ.exe
  2⤵
  PID:1720
- C:\Windows\System\EicoQeS.exe
  C:\Windows\System\EicoQeS.exe
  2⤵
  PID:1592
- C:\Windows\System\RDjOkPL.exe
  C:\Windows\System\RDjOkPL.exe
  2⤵
  PID:644
- C:\Windows\System\dJUSMPh.exe
  C:\Windows\System\dJUSMPh.exe
  2⤵
  PID:6024
- C:\Windows\System\DSHIFVM.exe
  C:\Windows\System\DSHIFVM.exe
  2⤵
  PID:744
- C:\Windows\System\hCdlgwf.exe
  C:\Windows\System\hCdlgwf.exe
  2⤵
  PID:2012
- C:\Windows\System\FzUObmC.exe
  C:\Windows\System\FzUObmC.exe
  2⤵
  PID:4300
- C:\Windows\System\bDEuxxI.exe
  C:\Windows\System\bDEuxxI.exe
  2⤵
  PID:3268
- C:\Windows\System\tMJSLWU.exe
  C:\Windows\System\tMJSLWU.exe
  2⤵
  PID:1852
- C:\Windows\System\SmcECSk.exe
  C:\Windows\System\SmcECSk.exe
  2⤵
  PID:5048
- C:\Windows\System\kTfnDEk.exe
  C:\Windows\System\kTfnDEk.exe
  2⤵
  PID:2220
- C:\Windows\System\dgOsSZf.exe
  C:\Windows\System\dgOsSZf.exe
  2⤵
  PID:4852
- C:\Windows\System\ABXvNlV.exe
  C:\Windows\System\ABXvNlV.exe
  2⤵
  PID:4688
- C:\Windows\System\iwNqeYz.exe
  C:\Windows\System\iwNqeYz.exe
  2⤵
  PID:4360
- C:\Windows\System\sraslAW.exe
  C:\Windows\System\sraslAW.exe
  2⤵
  PID:6152
- C:\Windows\System\phtwwce.exe
  C:\Windows\System\phtwwce.exe
  2⤵
  PID:6172
- C:\Windows\System\HEFGGxR.exe
  C:\Windows\System\HEFGGxR.exe
  2⤵
  PID:6192
- C:\Windows\System\jVPIDzc.exe
  C:\Windows\System\jVPIDzc.exe
  2⤵
  PID:6220
- C:\Windows\System\vjPnRfe.exe
  C:\Windows\System\vjPnRfe.exe
  2⤵
  PID:6252
- C:\Windows\System\fsKSNWs.exe
  C:\Windows\System\fsKSNWs.exe
  2⤵
  PID:6272
- C:\Windows\System\sWKkSKT.exe
  C:\Windows\System\sWKkSKT.exe
  2⤵
  PID:6328
- C:\Windows\System\nsQHaXb.exe
  C:\Windows\System\nsQHaXb.exe
  2⤵
  PID:6344
- C:\Windows\System\YlQDiod.exe
  C:\Windows\System\YlQDiod.exe
  2⤵
  PID:6364
- C:\Windows\System\fvYnBro.exe
  C:\Windows\System\fvYnBro.exe
  2⤵
  PID:6384
- C:\Windows\System\EjlJXnV.exe
  C:\Windows\System\EjlJXnV.exe
  2⤵
  PID:6440
- C:\Windows\System\VfeozcP.exe
  C:\Windows\System\VfeozcP.exe
  2⤵
  PID:6464
- C:\Windows\System\tcZnopI.exe
  C:\Windows\System\tcZnopI.exe
  2⤵
  PID:6500
- C:\Windows\System\qmaltZt.exe
  C:\Windows\System\qmaltZt.exe
  2⤵
  PID:6524
- C:\Windows\System\lzfqmiC.exe
  C:\Windows\System\lzfqmiC.exe
  2⤵
  PID:6568
- C:\Windows\System\DcvhzoX.exe
  C:\Windows\System\DcvhzoX.exe
  2⤵
  PID:6588
- C:\Windows\System\DZhxSHw.exe
  C:\Windows\System\DZhxSHw.exe
  2⤵
  PID:6608
- C:\Windows\System\xWwWlDY.exe
  C:\Windows\System\xWwWlDY.exe
  2⤵
  PID:6632
- C:\Windows\System\aeexwVO.exe
  C:\Windows\System\aeexwVO.exe
  2⤵
  PID:6652
- C:\Windows\System\jmdqAfZ.exe
  C:\Windows\System\jmdqAfZ.exe
  2⤵
  PID:6676
- C:\Windows\System\JHPTAkE.exe
  C:\Windows\System\JHPTAkE.exe
  2⤵
  PID:6692
- C:\Windows\System\LoAhJpM.exe
  C:\Windows\System\LoAhJpM.exe
  2⤵
  PID:6712
- C:\Windows\System\vEaQcgL.exe
  C:\Windows\System\vEaQcgL.exe
  2⤵
  PID:6728
- C:\Windows\System\vyYuKlC.exe
  C:\Windows\System\vyYuKlC.exe
  2⤵
  PID:6752
- C:\Windows\System\KDrIxJl.exe
  C:\Windows\System\KDrIxJl.exe
  2⤵
  PID:6768
- C:\Windows\System\EMmLUuq.exe
  C:\Windows\System\EMmLUuq.exe
  2⤵
  PID:6808
- C:\Windows\System\lGJYPGf.exe
  C:\Windows\System\lGJYPGf.exe
  2⤵
  PID:6836
- C:\Windows\System\VKXBemi.exe
  C:\Windows\System\VKXBemi.exe
  2⤵
  PID:6860
- C:\Windows\System\pDOHmQq.exe
  C:\Windows\System\pDOHmQq.exe
  2⤵
  PID:6876
- C:\Windows\System\SgDREAd.exe
  C:\Windows\System\SgDREAd.exe
  2⤵
  PID:6928
- C:\Windows\System\Yxqlela.exe
  C:\Windows\System\Yxqlela.exe
  2⤵
  PID:6952
- C:\Windows\System\pkKWhCv.exe
  C:\Windows\System\pkKWhCv.exe
  2⤵
  PID:6980
- C:\Windows\System\XEullcq.exe
  C:\Windows\System\XEullcq.exe
  2⤵
  PID:7036
- C:\Windows\System\YkHRSai.exe
  C:\Windows\System\YkHRSai.exe
  2⤵
  PID:7056
- C:\Windows\System\ZjKjyug.exe
  C:\Windows\System\ZjKjyug.exe
  2⤵
  PID:7124
- C:\Windows\System\kZxYDwr.exe
  C:\Windows\System\kZxYDwr.exe
  2⤵
  PID:7144
- C:\Windows\System\MyfCohi.exe
  C:\Windows\System\MyfCohi.exe
  2⤵
  PID:6148
- C:\Windows\System\mQBjhSr.exe
  C:\Windows\System\mQBjhSr.exe
  2⤵
  PID:6228
- C:\Windows\System\NMgxUOh.exe
  C:\Windows\System\NMgxUOh.exe
  2⤵
  PID:6236
- C:\Windows\System\nMtxAVo.exe
  C:\Windows\System\nMtxAVo.exe
  2⤵
  PID:6320
- C:\Windows\System\CjvHvrg.exe
  C:\Windows\System\CjvHvrg.exe
  2⤵
  PID:6356
- C:\Windows\System\IqYTNWz.exe
  C:\Windows\System\IqYTNWz.exe
  2⤵
  PID:6376
- C:\Windows\System\smdiFfn.exe
  C:\Windows\System\smdiFfn.exe
  2⤵
  PID:6536
- C:\Windows\System\vGzpsjC.exe
  C:\Windows\System\vGzpsjC.exe
  2⤵
  PID:6624
- C:\Windows\System\XpMONbc.exe
  C:\Windows\System\XpMONbc.exe
  2⤵
  PID:6688
- C:\Windows\System\MNZJWAY.exe
  C:\Windows\System\MNZJWAY.exe
  2⤵
  PID:6740
- C:\Windows\System\lpIefut.exe
  C:\Windows\System\lpIefut.exe
  2⤵
  PID:6800
- C:\Windows\System\DdpFEDc.exe
  C:\Windows\System\DdpFEDc.exe
  2⤵
  PID:6896
- C:\Windows\System\VoDltWF.exe
  C:\Windows\System\VoDltWF.exe
  2⤵
  PID:6916
- C:\Windows\System\UnuSZSG.exe
  C:\Windows\System\UnuSZSG.exe
  2⤵
  PID:7072
- C:\Windows\System\BzogWsx.exe
  C:\Windows\System\BzogWsx.exe
  2⤵
  PID:7092
- C:\Windows\System\tfVttdB.exe
  C:\Windows\System\tfVttdB.exe
  2⤵
  PID:6160
- C:\Windows\System\WtNrBmi.exe
  C:\Windows\System\WtNrBmi.exe
  2⤵
  PID:6216
- C:\Windows\System\PdIGqST.exe
  C:\Windows\System\PdIGqST.exe
  2⤵
  PID:6520
- C:\Windows\System\KTUYJpd.exe
  C:\Windows\System\KTUYJpd.exe
  2⤵
  PID:6684
- C:\Windows\System\qXltdYR.exe
  C:\Windows\System\qXltdYR.exe
  2⤵
  PID:6852
- C:\Windows\System\bXJhSeC.exe
  C:\Windows\System\bXJhSeC.exe
  2⤵
  PID:6936
- C:\Windows\System\aQrCjWF.exe
  C:\Windows\System\aQrCjWF.exe
  2⤵
  PID:7096
- C:\Windows\System\jeDSrEa.exe
  C:\Windows\System\jeDSrEa.exe
  2⤵
  PID:6492
- C:\Windows\System\DxizBgb.exe
  C:\Windows\System\DxizBgb.exe
  2⤵
  PID:6664
- C:\Windows\System\zNeozjv.exe
  C:\Windows\System\zNeozjv.exe
  2⤵
  PID:6868
- C:\Windows\System\BxbjLWw.exe
  C:\Windows\System\BxbjLWw.exe
  2⤵
  PID:7000
- C:\Windows\System\JseciMv.exe
  C:\Windows\System\JseciMv.exe
  2⤵
  PID:7172
- C:\Windows\System\frbvxfO.exe
  C:\Windows\System\frbvxfO.exe
  2⤵
  PID:7196
- C:\Windows\System\SvlBOtc.exe
  C:\Windows\System\SvlBOtc.exe
  2⤵
  PID:7220
- C:\Windows\System\jlnczCV.exe
  C:\Windows\System\jlnczCV.exe
  2⤵
  PID:7248
- C:\Windows\System\xndhzsM.exe
  C:\Windows\System\xndhzsM.exe
  2⤵
  PID:7276
- C:\Windows\System\PDQVWQx.exe
  C:\Windows\System\PDQVWQx.exe
  2⤵
  PID:7292
- C:\Windows\System\FbOuReE.exe
  C:\Windows\System\FbOuReE.exe
  2⤵
  PID:7316
- C:\Windows\System\jttsYoO.exe
  C:\Windows\System\jttsYoO.exe
  2⤵
  PID:7364
- C:\Windows\System\vWcRmpX.exe
  C:\Windows\System\vWcRmpX.exe
  2⤵
  PID:7384
- C:\Windows\System\UQXWdDj.exe
  C:\Windows\System\UQXWdDj.exe
  2⤵
  PID:7412
- C:\Windows\System\CnhEvsv.exe
  C:\Windows\System\CnhEvsv.exe
  2⤵
  PID:7460
- C:\Windows\System\LWohHrw.exe
  C:\Windows\System\LWohHrw.exe
  2⤵
  PID:7480
- C:\Windows\System\sfJeUrH.exe
  C:\Windows\System\sfJeUrH.exe
  2⤵
  PID:7508
- C:\Windows\System\aQZcIRO.exe
  C:\Windows\System\aQZcIRO.exe
  2⤵
  PID:7536
- C:\Windows\System\MTlMqmt.exe
  C:\Windows\System\MTlMqmt.exe
  2⤵
  PID:7556
- C:\Windows\System\PkxIKIH.exe
  C:\Windows\System\PkxIKIH.exe
  2⤵
  PID:7580
- C:\Windows\System\kGQKSkY.exe
  C:\Windows\System\kGQKSkY.exe
  2⤵
  PID:7604
- C:\Windows\System\wbtFsjN.exe
  C:\Windows\System\wbtFsjN.exe
  2⤵
  PID:7624
- C:\Windows\System\vECYLKa.exe
  C:\Windows\System\vECYLKa.exe
  2⤵
  PID:7664
- C:\Windows\System\CMqHxOu.exe
  C:\Windows\System\CMqHxOu.exe
  2⤵
  PID:7688
- C:\Windows\System\wIeyHjD.exe
  C:\Windows\System\wIeyHjD.exe
  2⤵
  PID:7732
- C:\Windows\System\hkEzDDr.exe
  C:\Windows\System\hkEzDDr.exe
  2⤵
  PID:7768
- C:\Windows\System\hUspZIf.exe
  C:\Windows\System\hUspZIf.exe
  2⤵
  PID:7788
- C:\Windows\System\bxfaivd.exe
  C:\Windows\System\bxfaivd.exe
  2⤵
  PID:7816
- C:\Windows\System\ZkqdFcM.exe
  C:\Windows\System\ZkqdFcM.exe
  2⤵
  PID:7840
- C:\Windows\System\kvxtJaC.exe
  C:\Windows\System\kvxtJaC.exe
  2⤵
  PID:7884
- C:\Windows\System\MjgKmiP.exe
  C:\Windows\System\MjgKmiP.exe
  2⤵
  PID:7912
- C:\Windows\System\izVYXKQ.exe
  C:\Windows\System\izVYXKQ.exe
  2⤵
  PID:7936
- C:\Windows\System\GiCxyfF.exe
  C:\Windows\System\GiCxyfF.exe
  2⤵
  PID:7976
- C:\Windows\System\kAVpBnl.exe
  C:\Windows\System\kAVpBnl.exe
  2⤵
  PID:7996
- C:\Windows\System\RtrmQFA.exe
  C:\Windows\System\RtrmQFA.exe
  2⤵
  PID:8032
- C:\Windows\System\PJEzLao.exe
  C:\Windows\System\PJEzLao.exe
  2⤵
  PID:8056
- C:\Windows\System\GpepItO.exe
  C:\Windows\System\GpepItO.exe
  2⤵
  PID:8076
- C:\Windows\System\wVzuaLy.exe
  C:\Windows\System\wVzuaLy.exe
  2⤵
  PID:8096
- C:\Windows\System\cyETkAn.exe
  C:\Windows\System\cyETkAn.exe
  2⤵
  PID:8120
- C:\Windows\System\WlrlHJQ.exe
  C:\Windows\System\WlrlHJQ.exe
  2⤵
  PID:8172
- C:\Windows\System\odzUoSM.exe
  C:\Windows\System\odzUoSM.exe
  2⤵
  PID:6600
- C:\Windows\System\VMQlYLP.exe
  C:\Windows\System\VMQlYLP.exe
  2⤵
  PID:7192
- C:\Windows\System\NiJCkQx.exe
  C:\Windows\System\NiJCkQx.exe
  2⤵
  PID:7232
- C:\Windows\System\EvGtGfd.exe
  C:\Windows\System\EvGtGfd.exe
  2⤵
  PID:7284
- C:\Windows\System\bHFUkUl.exe
  C:\Windows\System\bHFUkUl.exe
  2⤵
  PID:7336
- C:\Windows\System\AkumtdG.exe
  C:\Windows\System\AkumtdG.exe
  2⤵
  PID:7376
- C:\Windows\System\bqMThTs.exe
  C:\Windows\System\bqMThTs.exe
  2⤵
  PID:7444
- C:\Windows\System\GnDfjBk.exe
  C:\Windows\System\GnDfjBk.exe
  2⤵
  PID:7636
- C:\Windows\System\PzoUhnK.exe
  C:\Windows\System\PzoUhnK.exe
  2⤵
  PID:7576
- C:\Windows\System\jKJnJbN.exe
  C:\Windows\System\jKJnJbN.exe
  2⤵
  PID:7676
- C:\Windows\System\HJUSZmk.exe
  C:\Windows\System\HJUSZmk.exe
  2⤵
  PID:7784
- C:\Windows\System\mXgbkfH.exe
  C:\Windows\System\mXgbkfH.exe
  2⤵
  PID:7892
- C:\Windows\System\JkypNaZ.exe
  C:\Windows\System\JkypNaZ.exe
  2⤵
  PID:7908
- C:\Windows\System\CKWVXxK.exe
  C:\Windows\System\CKWVXxK.exe
  2⤵
  PID:7960
- C:\Windows\System\PkyfBwD.exe
  C:\Windows\System\PkyfBwD.exe
  2⤵
  PID:8028
- C:\Windows\System\TWNbjvb.exe
  C:\Windows\System\TWNbjvb.exe
  2⤵
  PID:8092
- C:\Windows\System\Tocranb.exe
  C:\Windows\System\Tocranb.exe
  2⤵
  PID:8116
- C:\Windows\System\rdmAODl.exe
  C:\Windows\System\rdmAODl.exe
  2⤵
  PID:8152
- C:\Windows\System\yVmHqRx.exe
  C:\Windows\System\yVmHqRx.exe
  2⤵
  PID:7344
- C:\Windows\System\BICQzDJ.exe
  C:\Windows\System\BICQzDJ.exe
  2⤵
  PID:7448
- C:\Windows\System\jOEuClO.exe
  C:\Windows\System\jOEuClO.exe
  2⤵
  PID:7656
- C:\Windows\System\cULqhmn.exe
  C:\Windows\System\cULqhmn.exe
  2⤵
  PID:7876
- C:\Windows\System\yiMpkji.exe
  C:\Windows\System\yiMpkji.exe
  2⤵
  PID:7212
- C:\Windows\System\nBtJTys.exe
  C:\Windows\System\nBtJTys.exe
  2⤵
  PID:8112
- C:\Windows\System\azibtYv.exe
  C:\Windows\System\azibtYv.exe
  2⤵
  PID:6584
- C:\Windows\System\uFkhwxD.exe
  C:\Windows\System\uFkhwxD.exe
  2⤵
  PID:7856
- C:\Windows\System\UYhjLqc.exe
  C:\Windows\System\UYhjLqc.exe
  2⤵
  PID:8024
- C:\Windows\System\uiVTHAJ.exe
  C:\Windows\System\uiVTHAJ.exe
  2⤵
  PID:7660
- C:\Windows\System\MxQsyaZ.exe
  C:\Windows\System\MxQsyaZ.exe
  2⤵
  PID:8212
- C:\Windows\System\ouuARbM.exe
  C:\Windows\System\ouuARbM.exe
  2⤵
  PID:8244
- C:\Windows\System\kzKXsnt.exe
  C:\Windows\System\kzKXsnt.exe
  2⤵
  PID:8272
- C:\Windows\System\XDcnCLm.exe
  C:\Windows\System\XDcnCLm.exe
  2⤵
  PID:8320
- C:\Windows\System\oVPYaVu.exe
  C:\Windows\System\oVPYaVu.exe
  2⤵
  PID:8344
- C:\Windows\System\hLgSpoQ.exe
  C:\Windows\System\hLgSpoQ.exe
  2⤵
  PID:8392
- C:\Windows\System\xacXdTj.exe
  C:\Windows\System\xacXdTj.exe
  2⤵
  PID:8416
- C:\Windows\System\jrAuwHo.exe
  C:\Windows\System\jrAuwHo.exe
  2⤵
  PID:8440
- C:\Windows\System\NTwyKIb.exe
  C:\Windows\System\NTwyKIb.exe
  2⤵
  PID:8464
- C:\Windows\System\kDUtHAT.exe
  C:\Windows\System\kDUtHAT.exe
  2⤵
  PID:8484
- C:\Windows\System\HuaCyxd.exe
  C:\Windows\System\HuaCyxd.exe
  2⤵
  PID:8516
- C:\Windows\System\xqrJxuq.exe
  C:\Windows\System\xqrJxuq.exe
  2⤵
  PID:8548
- C:\Windows\System\VjysTKh.exe
  C:\Windows\System\VjysTKh.exe
  2⤵
  PID:8584
- C:\Windows\System\OLXIOdt.exe
  C:\Windows\System\OLXIOdt.exe
  2⤵
  PID:8620
- C:\Windows\System\wHXkMGs.exe
  C:\Windows\System\wHXkMGs.exe
  2⤵
  PID:8652
- C:\Windows\System\EBAoRDb.exe
  C:\Windows\System\EBAoRDb.exe
  2⤵
  PID:8672
- C:\Windows\System\BCgxieP.exe
  C:\Windows\System\BCgxieP.exe
  2⤵
  PID:8696
- C:\Windows\System\lyExPQi.exe
  C:\Windows\System\lyExPQi.exe
  2⤵
  PID:8712
- C:\Windows\System\LOYrKbc.exe
  C:\Windows\System\LOYrKbc.exe
  2⤵
  PID:8760
- C:\Windows\System\SkbGepV.exe
  C:\Windows\System\SkbGepV.exe
  2⤵
  PID:8780
- C:\Windows\System\OZeDncv.exe
  C:\Windows\System\OZeDncv.exe
  2⤵
  PID:8800
- C:\Windows\System\MfidesN.exe
  C:\Windows\System\MfidesN.exe
  2⤵
  PID:8844
- C:\Windows\System\gyxCGus.exe
  C:\Windows\System\gyxCGus.exe
  2⤵
  PID:8860
- C:\Windows\System\beDTRfG.exe
  C:\Windows\System\beDTRfG.exe
  2⤵
  PID:8896
- C:\Windows\System\dRudiUm.exe
  C:\Windows\System\dRudiUm.exe
  2⤵
  PID:8932
- C:\Windows\System\CjHVKZl.exe
  C:\Windows\System\CjHVKZl.exe
  2⤵
  PID:8972
- C:\Windows\System\vmrwIxo.exe
  C:\Windows\System\vmrwIxo.exe
  2⤵
  PID:8992
- C:\Windows\System\iTDkCeD.exe
  C:\Windows\System\iTDkCeD.exe
  2⤵
  PID:9020
- C:\Windows\System\vCUmkaG.exe
  C:\Windows\System\vCUmkaG.exe
  2⤵
  PID:9040
- C:\Windows\System\OAWUMwC.exe
  C:\Windows\System\OAWUMwC.exe
  2⤵
  PID:9076
- C:\Windows\System\jePoaGv.exe
  C:\Windows\System\jePoaGv.exe
  2⤵
  PID:9104
- C:\Windows\System\nVHFglD.exe
  C:\Windows\System\nVHFglD.exe
  2⤵
  PID:9124
- C:\Windows\System\DrShiJv.exe
  C:\Windows\System\DrShiJv.exe
  2⤵
  PID:9164
- C:\Windows\System\vCoQlvo.exe
  C:\Windows\System\vCoQlvo.exe
  2⤵
  PID:9196
- C:\Windows\System\kMHFueU.exe
  C:\Windows\System\kMHFueU.exe
  2⤵
  PID:7860
- C:\Windows\System\XQBfUMX.exe
  C:\Windows\System\XQBfUMX.exe
  2⤵
  PID:8284
- C:\Windows\System\qfdFdvI.exe
  C:\Windows\System\qfdFdvI.exe
  2⤵
  PID:8264
- C:\Windows\System\goyUhtA.exe
  C:\Windows\System\goyUhtA.exe
  2⤵
  PID:8304
- C:\Windows\System\IHaZkhs.exe
  C:\Windows\System\IHaZkhs.exe
  2⤵
  PID:8412
- C:\Windows\System\XHUripL.exe
  C:\Windows\System\XHUripL.exe
  2⤵
  PID:8460
- C:\Windows\System\Mfeygby.exe
  C:\Windows\System\Mfeygby.exe
  2⤵
  PID:8540
- C:\Windows\System\BnXonrf.exe
  C:\Windows\System\BnXonrf.exe
  2⤵
  PID:8616
- C:\Windows\System\tIOjRJb.exe
  C:\Windows\System\tIOjRJb.exe
  2⤵
  PID:8608
- C:\Windows\System\zOaUVou.exe
  C:\Windows\System\zOaUVou.exe
  2⤵
  PID:8664
- C:\Windows\System\SVEieMj.exe
  C:\Windows\System\SVEieMj.exe
  2⤵
  PID:8756
- C:\Windows\System\aMTPjbF.exe
  C:\Windows\System\aMTPjbF.exe
  2⤵
  PID:8792
- C:\Windows\System\VikNhQN.exe
  C:\Windows\System\VikNhQN.exe
  2⤵
  PID:8908
- C:\Windows\System\zwMtMcJ.exe
  C:\Windows\System\zwMtMcJ.exe
  2⤵
  PID:8968
- C:\Windows\System\PtQkkSO.exe
  C:\Windows\System\PtQkkSO.exe
  2⤵
  PID:9052
- C:\Windows\System\dvTyVBi.exe
  C:\Windows\System\dvTyVBi.exe
  2⤵
  PID:9100
- C:\Windows\System\ZEQPncU.exe
  C:\Windows\System\ZEQPncU.exe
  2⤵
  PID:9188
- C:\Windows\System\rWPySkk.exe
  C:\Windows\System\rWPySkk.exe
  2⤵
  PID:8208
- C:\Windows\System\ZlxCAgV.exe
  C:\Windows\System\ZlxCAgV.exe
  2⤵
  PID:8328
- C:\Windows\System\AZOSTVT.exe
  C:\Windows\System\AZOSTVT.exe
  2⤵
  PID:8512
- C:\Windows\System\EzONHIe.exe
  C:\Windows\System\EzONHIe.exe
  2⤵
  PID:8732
- C:\Windows\System\MjIplmZ.exe
  C:\Windows\System\MjIplmZ.exe
  2⤵
  PID:8808
- C:\Windows\System\LqXnnoI.exe
  C:\Windows\System\LqXnnoI.exe
  2⤵
  PID:9072
- C:\Windows\System\GYlgveY.exe
  C:\Windows\System\GYlgveY.exe
  2⤵
  PID:9148
- C:\Windows\System\cpjJnXt.exe
  C:\Windows\System\cpjJnXt.exe
  2⤵
  PID:8280
- C:\Windows\System\DVePKqj.exe
  C:\Windows\System\DVePKqj.exe
  2⤵
  PID:9232
- C:\Windows\System\NtSxixQ.exe
  C:\Windows\System\NtSxixQ.exe
  2⤵
  PID:9256
- C:\Windows\System\TcwdTBg.exe
  C:\Windows\System\TcwdTBg.exe
  2⤵
  PID:9276
- C:\Windows\System\PlLcDkB.exe
  C:\Windows\System\PlLcDkB.exe
  2⤵
  PID:9292
- C:\Windows\System\GKEIpId.exe
  C:\Windows\System\GKEIpId.exe
  2⤵
  PID:9312
- C:\Windows\System\eblXSjl.exe
  C:\Windows\System\eblXSjl.exe
  2⤵
  PID:9348
- C:\Windows\System\JoyyTZx.exe
  C:\Windows\System\JoyyTZx.exe
  2⤵
  PID:9368
- C:\Windows\System\qPLZpLw.exe
  C:\Windows\System\qPLZpLw.exe
  2⤵
  PID:9388
- C:\Windows\System\QrEsBjL.exe
  C:\Windows\System\QrEsBjL.exe
  2⤵
  PID:9412
- C:\Windows\System\rDtHDvr.exe
  C:\Windows\System\rDtHDvr.exe
  2⤵
  PID:9432
- C:\Windows\System\VwAgxkM.exe
  C:\Windows\System\VwAgxkM.exe
  2⤵
  PID:9476
- C:\Windows\System\HyArZFH.exe
  C:\Windows\System\HyArZFH.exe
  2⤵
  PID:9496
- C:\Windows\System\XvBBfMV.exe
  C:\Windows\System\XvBBfMV.exe
  2⤵
  PID:9608
- C:\Windows\System\JCEQiyp.exe
  C:\Windows\System\JCEQiyp.exe
  2⤵
  PID:9676
- C:\Windows\System\pKaFmrZ.exe
  C:\Windows\System\pKaFmrZ.exe
  2⤵
  PID:9696
- C:\Windows\System\cMRxcPV.exe
  C:\Windows\System\cMRxcPV.exe
  2⤵
  PID:9716
- C:\Windows\System\tEBQHRl.exe
  C:\Windows\System\tEBQHRl.exe
  2⤵
  PID:9736
- C:\Windows\System\KqlKgNa.exe
  C:\Windows\System\KqlKgNa.exe
  2⤵
  PID:9792
- C:\Windows\System\DoElQNV.exe
  C:\Windows\System\DoElQNV.exe
  2⤵
  PID:9808
- C:\Windows\System\nuICWmE.exe
  C:\Windows\System\nuICWmE.exe
  2⤵
  PID:9828
- C:\Windows\System\ujURScb.exe
  C:\Windows\System\ujURScb.exe
  2⤵
  PID:9844
- C:\Windows\System\AofaKbr.exe
  C:\Windows\System\AofaKbr.exe
  2⤵
  PID:9864
- C:\Windows\System\aZsScLG.exe
  C:\Windows\System\aZsScLG.exe
  2⤵
  PID:9884
- C:\Windows\System\EzsrQmA.exe
  C:\Windows\System\EzsrQmA.exe
  2⤵
  PID:9960
- C:\Windows\System\XxyoPwg.exe
  C:\Windows\System\XxyoPwg.exe
  2⤵
  PID:9984
- C:\Windows\System\kyIpqty.exe
  C:\Windows\System\kyIpqty.exe
  2⤵
  PID:10004
- C:\Windows\System\qHQLRDt.exe
  C:\Windows\System\qHQLRDt.exe
  2⤵
  PID:10028
- C:\Windows\System\VTseMFx.exe
  C:\Windows\System\VTseMFx.exe
  2⤵
  PID:10048
- C:\Windows\System\rrxJHMx.exe
  C:\Windows\System\rrxJHMx.exe
  2⤵
  PID:10084
- C:\Windows\System\YkpnrXN.exe
  C:\Windows\System\YkpnrXN.exe
  2⤵
  PID:10140
- C:\Windows\System\kfOJdhX.exe
  C:\Windows\System\kfOJdhX.exe
  2⤵
  PID:10180
- C:\Windows\System\RxzeJBg.exe
  C:\Windows\System\RxzeJBg.exe
  2⤵
  PID:10204
- C:\Windows\System\JhwLdGX.exe
  C:\Windows\System\JhwLdGX.exe
  2⤵
  PID:10224
- C:\Windows\System\ApHnLmi.exe
  C:\Windows\System\ApHnLmi.exe
  2⤵
  PID:9152
- C:\Windows\System\HtaurJs.exe
  C:\Windows\System\HtaurJs.exe
  2⤵
  PID:9328
- C:\Windows\System\DDTxkez.exe
  C:\Windows\System\DDTxkez.exe
  2⤵
  PID:9324
- C:\Windows\System\rRykzVI.exe
  C:\Windows\System\rRykzVI.exe
  2⤵
  PID:9380
- C:\Windows\System\RSxDNUa.exe
  C:\Windows\System\RSxDNUa.exe
  2⤵
  PID:9460
- C:\Windows\System\yejaLHV.exe
  C:\Windows\System\yejaLHV.exe
  2⤵
  PID:9516
- C:\Windows\System\wtqIWtD.exe
  C:\Windows\System\wtqIWtD.exe
  2⤵
  PID:9580
- C:\Windows\System\WtjUhun.exe
  C:\Windows\System\WtjUhun.exe
  2⤵
  PID:9528
- C:\Windows\System\xZHrTCH.exe
  C:\Windows\System\xZHrTCH.exe
  2⤵
  PID:9592
- C:\Windows\System\lPDizXm.exe
  C:\Windows\System\lPDizXm.exe
  2⤵
  PID:9704
- C:\Windows\System\ySjqoiV.exe
  C:\Windows\System\ySjqoiV.exe
  2⤵
  PID:9600
- C:\Windows\System\hZwGotn.exe
  C:\Windows\System\hZwGotn.exe
  2⤵
  PID:9724
- C:\Windows\System\HAdCMhE.exe
  C:\Windows\System\HAdCMhE.exe
  2⤵
  PID:9804
- C:\Windows\System\mmRmYLT.exe
  C:\Windows\System\mmRmYLT.exe
  2⤵
  PID:9840
- C:\Windows\System\qWGQfYJ.exe
  C:\Windows\System\qWGQfYJ.exe
  2⤵
  PID:9952
- C:\Windows\System\uXntbzW.exe
  C:\Windows\System\uXntbzW.exe
  2⤵
  PID:10020
- C:\Windows\System\KuplyeA.exe
  C:\Windows\System\KuplyeA.exe
  2⤵
  PID:8928
- C:\Windows\System\bcIqBWq.exe
  C:\Windows\System\bcIqBWq.exe
  2⤵
  PID:10076
- C:\Windows\System\MCbKdms.exe
  C:\Windows\System\MCbKdms.exe
  2⤵
  PID:10172
- C:\Windows\System\xBYIPef.exe
  C:\Windows\System\xBYIPef.exe
  2⤵
  PID:8452
- C:\Windows\System\PQAcSNV.exe
  C:\Windows\System\PQAcSNV.exe
  2⤵
  PID:9248
- C:\Windows\System\MnufhSO.exe
  C:\Windows\System\MnufhSO.exe
  2⤵
  PID:9408
- C:\Windows\System\zPmTvVE.exe
  C:\Windows\System\zPmTvVE.exe
  2⤵
  PID:9620
- C:\Windows\System\GgcPxwO.exe
  C:\Windows\System\GgcPxwO.exe
  2⤵
  PID:9656
- C:\Windows\System\XWrfgby.exe
  C:\Windows\System\XWrfgby.exe
  2⤵
  PID:9692
- C:\Windows\System\SWFrUvZ.exe
  C:\Windows\System\SWFrUvZ.exe
  2⤵
  PID:9820
- C:\Windows\System\jKhuByo.exe
  C:\Windows\System\jKhuByo.exe
  2⤵
  PID:9856
- C:\Windows\System\aWgsmOA.exe
  C:\Windows\System\aWgsmOA.exe
  2⤵
  PID:10044
- C:\Windows\System\UgujQzU.exe
  C:\Windows\System\UgujQzU.exe
  2⤵
  PID:10188
- C:\Windows\System\QUBnTnA.exe
  C:\Windows\System\QUBnTnA.exe
  2⤵
  PID:9120
- C:\Windows\System\nooadzW.exe
  C:\Windows\System\nooadzW.exe
  2⤵
  PID:9604
- C:\Windows\System\gyTzFWU.exe
  C:\Windows\System\gyTzFWU.exe
  2⤵
  PID:9636
- C:\Windows\System\cKgTAUz.exe
  C:\Windows\System\cKgTAUz.exe
  2⤵
  PID:9428
- C:\Windows\System\Ogcsimq.exe
  C:\Windows\System\Ogcsimq.exe
  2⤵
  PID:10252
- C:\Windows\System\YsnkLWQ.exe
  C:\Windows\System\YsnkLWQ.exe
  2⤵
  PID:10280
- C:\Windows\System\PqgFlFM.exe
  C:\Windows\System\PqgFlFM.exe
  2⤵
  PID:10308
- C:\Windows\System\xnuUGhK.exe
  C:\Windows\System\xnuUGhK.exe
  2⤵
  PID:10332
- C:\Windows\System\OHDYQNK.exe
  C:\Windows\System\OHDYQNK.exe
  2⤵
  PID:10368
- C:\Windows\System\xzZVcdz.exe
  C:\Windows\System\xzZVcdz.exe
  2⤵
  PID:10384
- C:\Windows\System\YVLgMgC.exe
  C:\Windows\System\YVLgMgC.exe
  2⤵
  PID:10412
- C:\Windows\System\KpAgnbs.exe
  C:\Windows\System\KpAgnbs.exe
  2⤵
  PID:10452
- C:\Windows\System\TPbmsQo.exe
  C:\Windows\System\TPbmsQo.exe
  2⤵
  PID:10496
- C:\Windows\System\YTEKqak.exe
  C:\Windows\System\YTEKqak.exe
  2⤵
  PID:10524
- C:\Windows\System\QIDYEup.exe
  C:\Windows\System\QIDYEup.exe
  2⤵
  PID:10544
- C:\Windows\System\DOjamgk.exe
  C:\Windows\System\DOjamgk.exe
  2⤵
  PID:10564
- C:\Windows\System\udFKUIz.exe
  C:\Windows\System\udFKUIz.exe
  2⤵
  PID:10588
- C:\Windows\System\KtdofwR.exe
  C:\Windows\System\KtdofwR.exe
  2⤵
  PID:10604
- C:\Windows\System\PfaGazN.exe
  C:\Windows\System\PfaGazN.exe
  2⤵
  PID:10648
- C:\Windows\System\UVFBDzr.exe
  C:\Windows\System\UVFBDzr.exe
  2⤵
  PID:10676
- C:\Windows\System\LGhuqwj.exe
  C:\Windows\System\LGhuqwj.exe
  2⤵
  PID:10700
- C:\Windows\System\sypGlCt.exe
  C:\Windows\System\sypGlCt.exe
  2⤵
  PID:10716
- C:\Windows\System\TTBCSTR.exe
  C:\Windows\System\TTBCSTR.exe
  2⤵
  PID:10736
- C:\Windows\System\xIJOnAU.exe
  C:\Windows\System\xIJOnAU.exe
  2⤵
  PID:10760
- C:\Windows\System\rPZQXPZ.exe
  C:\Windows\System\rPZQXPZ.exe
  2⤵
  PID:10780
- C:\Windows\System\kExvbSY.exe
  C:\Windows\System\kExvbSY.exe
  2⤵
  PID:10824
- C:\Windows\System\nspFkit.exe
  C:\Windows\System\nspFkit.exe
  2⤵
  PID:10876
- C:\Windows\System\KXWnjps.exe
  C:\Windows\System\KXWnjps.exe
  2⤵
  PID:10908
- C:\Windows\System\VaAPIDK.exe
  C:\Windows\System\VaAPIDK.exe
  2⤵
  PID:10932
- C:\Windows\System\sJjpFfD.exe
  C:\Windows\System\sJjpFfD.exe
  2⤵
  PID:10960
- C:\Windows\System\EHjcqHw.exe
  C:\Windows\System\EHjcqHw.exe
  2⤵
  PID:10984
- C:\Windows\System\wtewsGt.exe
  C:\Windows\System\wtewsGt.exe
  2⤵
  PID:11012
- C:\Windows\System\evOCSTV.exe
  C:\Windows\System\evOCSTV.exe
  2⤵
  PID:11056
- C:\Windows\System\IPQpkSb.exe
  C:\Windows\System\IPQpkSb.exe
  2⤵
  PID:11084
- C:\Windows\System\JFUhlxB.exe
  C:\Windows\System\JFUhlxB.exe
  2⤵
  PID:11104
- C:\Windows\System\uwXahEo.exe
  C:\Windows\System\uwXahEo.exe
  2⤵
  PID:11124
- C:\Windows\System\pYdOaFr.exe
  C:\Windows\System\pYdOaFr.exe
  2⤵
  PID:11152
- C:\Windows\System\qHddmOY.exe
  C:\Windows\System\qHddmOY.exe
  2⤵
  PID:11184
- C:\Windows\System\sxrHAQx.exe
  C:\Windows\System\sxrHAQx.exe
  2⤵
  PID:11204
- C:\Windows\System\qbbMHQp.exe
  C:\Windows\System\qbbMHQp.exe
  2⤵
  PID:11240
- C:\Windows\System\FOekLyB.exe
  C:\Windows\System\FOekLyB.exe
  2⤵
  PID:10012
- C:\Windows\System\kDfXUte.exe
  C:\Windows\System\kDfXUte.exe
  2⤵
  PID:10304
- C:\Windows\System\nnbvKEw.exe
  C:\Windows\System\nnbvKEw.exe
  2⤵
  PID:10364
- C:\Windows\System\ALLOYTZ.exe
  C:\Windows\System\ALLOYTZ.exe
  2⤵
  PID:10392
- C:\Windows\System\hWfXUwe.exe
  C:\Windows\System\hWfXUwe.exe
  2⤵
  PID:10476
- C:\Windows\System\hKSeRDK.exe
  C:\Windows\System\hKSeRDK.exe
  2⤵
  PID:10512
- C:\Windows\System\jAMiQmj.exe
  C:\Windows\System\jAMiQmj.exe
  2⤵
  PID:10560
- C:\Windows\System\oQolwTI.exe
  C:\Windows\System\oQolwTI.exe
  2⤵
  PID:10656
- C:\Windows\System\rtdhuZi.exe
  C:\Windows\System\rtdhuZi.exe
  2⤵
  PID:10744
- C:\Windows\System\YLKJstW.exe
  C:\Windows\System\YLKJstW.exe
  2⤵
  PID:10732
- C:\Windows\System\zFUESRS.exe
  C:\Windows\System\zFUESRS.exe
  2⤵
  PID:10900
- C:\Windows\System\xXIYwrj.exe
  C:\Windows\System\xXIYwrj.exe
  2⤵
  PID:10980
- C:\Windows\System\pVDYHJU.exe
  C:\Windows\System\pVDYHJU.exe
  2⤵
  PID:10996
- C:\Windows\System\iCliZov.exe
  C:\Windows\System\iCliZov.exe
  2⤵
  PID:11048
- C:\Windows\System\KlmcgZP.exe
  C:\Windows\System\KlmcgZP.exe
  2⤵
  PID:11120
- C:\Windows\System\hcwUsQZ.exe
  C:\Windows\System\hcwUsQZ.exe
  2⤵
  PID:11164
- C:\Windows\System\bXeQAFl.exe
  C:\Windows\System\bXeQAFl.exe
  2⤵
  PID:11212
- C:\Windows\System\eiZPGgM.exe
  C:\Windows\System\eiZPGgM.exe
  2⤵
  PID:10328
- C:\Windows\System\qktPcMW.exe
  C:\Windows\System\qktPcMW.exe
  2⤵
  PID:10380
- C:\Windows\System\JHGrCbS.exe
  C:\Windows\System\JHGrCbS.exe
  2⤵
  PID:10448
- C:\Windows\System\rRnOGch.exe
  C:\Windows\System\rRnOGch.exe
  2⤵
  PID:10672
- C:\Windows\System\dLvqWsD.exe
  C:\Windows\System\dLvqWsD.exe
  2⤵
  PID:10852
- C:\Windows\System\YQVHUnD.exe
  C:\Windows\System\YQVHUnD.exe
  2⤵
  PID:11076
- C:\Windows\System\gEzmqWE.exe
  C:\Windows\System\gEzmqWE.exe
  2⤵
  PID:3524
- C:\Windows\System\agCyJin.exe
  C:\Windows\System\agCyJin.exe
  2⤵
  PID:10320
- C:\Windows\System\JGNoduH.exe
  C:\Windows\System\JGNoduH.exe
  2⤵
  PID:9760
- C:\Windows\System\EgrJAhy.exe
  C:\Windows\System\EgrJAhy.exe
  2⤵
  PID:10808
- C:\Windows\System\AGrpxpi.exe
  C:\Windows\System\AGrpxpi.exe
  2⤵
  PID:4356
- C:\Windows\System\fRWdJme.exe
  C:\Windows\System\fRWdJme.exe
  2⤵
  PID:10536
- C:\Windows\System\EkbvgEQ.exe
  C:\Windows\System\EkbvgEQ.exe
  2⤵
  PID:11288
- C:\Windows\System\DVtLPcW.exe
  C:\Windows\System\DVtLPcW.exe
  2⤵
  PID:11304
- C:\Windows\System\nZdMXFs.exe
  C:\Windows\System\nZdMXFs.exe
  2⤵
  PID:11336
- C:\Windows\System\rYlnjCy.exe
  C:\Windows\System\rYlnjCy.exe
  2⤵
  PID:11368
- C:\Windows\System\vypEJBq.exe
  C:\Windows\System\vypEJBq.exe
  2⤵
  PID:11388
- C:\Windows\System\zchrPMd.exe
  C:\Windows\System\zchrPMd.exe
  2⤵
  PID:11416
- C:\Windows\System\piJJhZA.exe
  C:\Windows\System\piJJhZA.exe
  2⤵
  PID:11444
- C:\Windows\System\PElaTfK.exe
  C:\Windows\System\PElaTfK.exe
  2⤵
  PID:11484
- C:\Windows\System\ayXXebD.exe
  C:\Windows\System\ayXXebD.exe
  2⤵
  PID:11504
- C:\Windows\System\wAikzPc.exe
  C:\Windows\System\wAikzPc.exe
  2⤵
  PID:11548
- C:\Windows\System\DoGaalU.exe
  C:\Windows\System\DoGaalU.exe
  2⤵
  PID:11568
- C:\Windows\System\jolXLCk.exe
  C:\Windows\System\jolXLCk.exe
  2⤵
  PID:11612
- C:\Windows\System\IqSbhuc.exe
  C:\Windows\System\IqSbhuc.exe
  2⤵
  PID:11636
- C:\Windows\System\XYSycNe.exe
  C:\Windows\System\XYSycNe.exe
  2⤵
  PID:11664
- C:\Windows\System\xXeZgum.exe
  C:\Windows\System\xXeZgum.exe
  2⤵
  PID:11680
- C:\Windows\System\BmYZVXO.exe
  C:\Windows\System\BmYZVXO.exe
  2⤵
  PID:11716
- C:\Windows\System\nTFevaz.exe
  C:\Windows\System\nTFevaz.exe
  2⤵
  PID:11760
- C:\Windows\System\FAgIEEf.exe
  C:\Windows\System\FAgIEEf.exe
  2⤵
  PID:11784
- C:\Windows\System\sNGhTtf.exe
  C:\Windows\System\sNGhTtf.exe
  2⤵
  PID:11800
- C:\Windows\System\lkEGIoQ.exe
  C:\Windows\System\lkEGIoQ.exe
  2⤵
  PID:11824
- C:\Windows\System\FRPchkj.exe
  C:\Windows\System\FRPchkj.exe
  2⤵
  PID:11848
- C:\Windows\System\UYvxiMH.exe
  C:\Windows\System\UYvxiMH.exe
  2⤵
  PID:11868
- C:\Windows\System\gLyODiG.exe
  C:\Windows\System\gLyODiG.exe
  2⤵
  PID:11912
- C:\Windows\System\zScygiF.exe
  C:\Windows\System\zScygiF.exe
  2⤵
  PID:11940
- C:\Windows\System\RUhpzMj.exe
  C:\Windows\System\RUhpzMj.exe
  2⤵
  PID:11960
- C:\Windows\System\UXqHsXy.exe
  C:\Windows\System\UXqHsXy.exe
  2⤵
  PID:11984
- C:\Windows\System\PIDQZgy.exe
  C:\Windows\System\PIDQZgy.exe
  2⤵
  PID:12000
- C:\Windows\System\EPPTxbl.exe
  C:\Windows\System\EPPTxbl.exe
  2⤵
  PID:12060
- C:\Windows\System\HJPpNqm.exe
  C:\Windows\System\HJPpNqm.exe
  2⤵
  PID:12080
- C:\Windows\System\YHDJUoz.exe
  C:\Windows\System\YHDJUoz.exe
  2⤵
  PID:12100
- C:\Windows\System\PCwRsvT.exe
  C:\Windows\System\PCwRsvT.exe
  2⤵
  PID:12116
- C:\Windows\System\tYbhJZP.exe
  C:\Windows\System\tYbhJZP.exe
  2⤵
  PID:12140
- C:\Windows\System\uUTHoFX.exe
  C:\Windows\System\uUTHoFX.exe
  2⤵
  PID:12172
- C:\Windows\System\VARbvEs.exe
  C:\Windows\System\VARbvEs.exe
  2⤵
  PID:12188
- C:\Windows\System\klovaWm.exe
  C:\Windows\System\klovaWm.exe
  2⤵
  PID:12216
- C:\Windows\System\syjfkGQ.exe
  C:\Windows\System\syjfkGQ.exe
  2⤵
  PID:12244
- C:\Windows\System\xfuwkwL.exe
  C:\Windows\System\xfuwkwL.exe
  2⤵
  PID:12284
- C:\Windows\System\KPLZXqy.exe
  C:\Windows\System\KPLZXqy.exe
  2⤵
  PID:11092
- C:\Windows\System\zwUZexz.exe
  C:\Windows\System\zwUZexz.exe
  2⤵
  PID:11284
- C:\Windows\System\KMbmmVK.exe
  C:\Windows\System\KMbmmVK.exe
  2⤵
  PID:11476
- C:\Windows\System\PINVGkl.exe
  C:\Windows\System\PINVGkl.exe
  2⤵
  PID:11528
- C:\Windows\System\eVGPqFi.exe
  C:\Windows\System\eVGPqFi.exe
  2⤵
  PID:11648
- C:\Windows\System\vhVGQAM.exe
  C:\Windows\System\vhVGQAM.exe
  2⤵
  PID:11632
- C:\Windows\System\QPpkXQU.exe
  C:\Windows\System\QPpkXQU.exe
  2⤵
  PID:11676
- C:\Windows\System\aowDWoG.exe
  C:\Windows\System\aowDWoG.exe
  2⤵
  PID:11776
- C:\Windows\System\OxgugXw.exe
  C:\Windows\System\OxgugXw.exe
  2⤵
  PID:11796
- C:\Windows\System\gnzwJtS.exe
  C:\Windows\System\gnzwJtS.exe
  2⤵
  PID:11844
- C:\Windows\System\GsaZiMs.exe
  C:\Windows\System\GsaZiMs.exe
  2⤵
  PID:11948
- C:\Windows\System\mRntmdE.exe
  C:\Windows\System\mRntmdE.exe
  2⤵
  PID:12024
- C:\Windows\System\EqCkGzy.exe
  C:\Windows\System\EqCkGzy.exe
  2⤵
  PID:12112
- C:\Windows\System\FKnGDXi.exe
  C:\Windows\System\FKnGDXi.exe
  2⤵
  PID:12156
- C:\Windows\System\rfXHwRv.exe
  C:\Windows\System\rfXHwRv.exe
  2⤵
  PID:12212
- C:\Windows\System\AVBlzlW.exe
  C:\Windows\System\AVBlzlW.exe
  2⤵
  PID:4460
- C:\Windows\System\hVwSIgG.exe
  C:\Windows\System\hVwSIgG.exe
  2⤵
  PID:208
- C:\Windows\System\fvitSRh.exe
  C:\Windows\System\fvitSRh.exe
  2⤵
  PID:11320
- C:\Windows\System\mqgIbZO.exe
  C:\Windows\System\mqgIbZO.exe
  2⤵
  PID:11468
- C:\Windows\System\dRgsQVP.exe
  C:\Windows\System\dRgsQVP.exe
  2⤵
  PID:11564
- C:\Windows\System\HGHaVvk.exe
  C:\Windows\System\HGHaVvk.exe
  2⤵
  PID:11652
- C:\Windows\System\RNAHvkW.exe
  C:\Windows\System\RNAHvkW.exe
  2⤵
  PID:11968
- C:\Windows\System\wbQeiLJ.exe
  C:\Windows\System\wbQeiLJ.exe
  2⤵
  PID:12076
- C:\Windows\System\woIqDqr.exe
  C:\Windows\System\woIqDqr.exe
  2⤵
  PID:10688
- C:\Windows\System\SBJHcsl.exe
  C:\Windows\System\SBJHcsl.exe
  2⤵
  PID:11424
- C:\Windows\System\DHGoXnf.exe
  C:\Windows\System\DHGoXnf.exe
  2⤵
  PID:11728
- C:\Windows\System\vVARcly.exe
  C:\Windows\System\vVARcly.exe
  2⤵
  PID:12068
- C:\Windows\System\ZieQkNt.exe
  C:\Windows\System\ZieQkNt.exe
  2⤵
  PID:11708
- C:\Windows\System\kIfBDZz.exe
  C:\Windows\System\kIfBDZz.exe
  2⤵
  PID:12296
- C:\Windows\System\OoUjYmP.exe
  C:\Windows\System\OoUjYmP.exe
  2⤵
  PID:12340
- C:\Windows\System\NycKgJQ.exe
  C:\Windows\System\NycKgJQ.exe
  2⤵
  PID:12368
- C:\Windows\System\eMlRwWv.exe
  C:\Windows\System\eMlRwWv.exe
  2⤵
  PID:12384
- C:\Windows\System\rNuJCfS.exe
  C:\Windows\System\rNuJCfS.exe
  2⤵
  PID:12416
- C:\Windows\System\ULCaYsu.exe
  C:\Windows\System\ULCaYsu.exe
  2⤵
  PID:12432
- C:\Windows\System\muOwzaR.exe
  C:\Windows\System\muOwzaR.exe
  2⤵
  PID:12484
- C:\Windows\System\zDGXHvu.exe
  C:\Windows\System\zDGXHvu.exe
  2⤵
  PID:12536
- C:\Windows\System\RwbdhIz.exe
  C:\Windows\System\RwbdhIz.exe
  2⤵
  PID:12580
- C:\Windows\System\FYfJzHt.exe
  C:\Windows\System\FYfJzHt.exe
  2⤵
  PID:12604
- C:\Windows\System\gaCZtqI.exe
  C:\Windows\System\gaCZtqI.exe
  2⤵
  PID:12688
- C:\Windows\System\WrMoEdx.exe
  C:\Windows\System\WrMoEdx.exe
  2⤵
  PID:12704
- C:\Windows\System\BrGtvnA.exe
  C:\Windows\System\BrGtvnA.exe
  2⤵
  PID:12720
- C:\Windows\System\uysWDTY.exe
  C:\Windows\System\uysWDTY.exe
  2⤵
  PID:12736
- C:\Windows\System\VYPPbRC.exe
  C:\Windows\System\VYPPbRC.exe
  2⤵
  PID:12756
- C:\Windows\System\wTnEVNi.exe
  C:\Windows\System\wTnEVNi.exe
  2⤵
  PID:12772
- C:\Windows\System\XEfHXuM.exe
  C:\Windows\System\XEfHXuM.exe
  2⤵
  PID:12788
- C:\Windows\System\JTLmcSW.exe
  C:\Windows\System\JTLmcSW.exe
  2⤵
  PID:12804
- C:\Windows\System\WqTQHYJ.exe
  C:\Windows\System\WqTQHYJ.exe
  2⤵
  PID:12836
- C:\Windows\System\NONSMHx.exe
  C:\Windows\System\NONSMHx.exe
  2⤵
  PID:12852
- C:\Windows\System\wWYvXVe.exe
  C:\Windows\System\wWYvXVe.exe
  2⤵
  PID:12884
- C:\Windows\System\yvvuIQa.exe
  C:\Windows\System\yvvuIQa.exe
  2⤵
  PID:12908
- C:\Windows\System\bTjPHtA.exe
  C:\Windows\System\bTjPHtA.exe
  2⤵
  PID:12936
- C:\Windows\System\QJOlpeP.exe
  C:\Windows\System\QJOlpeP.exe
  2⤵
  PID:12952
- C:\Windows\System\NzbLUNo.exe
  C:\Windows\System\NzbLUNo.exe
  2⤵
  PID:12976
- C:\Windows\System\sUPWbOQ.exe
  C:\Windows\System\sUPWbOQ.exe
  2⤵
  PID:13052
- C:\Windows\System\miutvIh.exe
  C:\Windows\System\miutvIh.exe
  2⤵
  PID:13072
- C:\Windows\System\qnOKsjs.exe
  C:\Windows\System\qnOKsjs.exe
  2⤵
  PID:13168
- C:\Windows\System\lyBDQTX.exe
  C:\Windows\System\lyBDQTX.exe
  2⤵
  PID:13188
- C:\Windows\System\UgGgiEA.exe
  C:\Windows\System\UgGgiEA.exe
  2⤵
  PID:13220
- C:\Windows\System\kWpyhgU.exe
  C:\Windows\System\kWpyhgU.exe
  2⤵
  PID:13244
- C:\Windows\System\FGDHfAm.exe
  C:\Windows\System\FGDHfAm.exe
  2⤵
  PID:13268
- C:\Windows\System\qHkAEBH.exe
  C:\Windows\System\qHkAEBH.exe
  2⤵
  PID:13300
- C:\Windows\System\VtMBNsn.exe
  C:\Windows\System\VtMBNsn.exe
  2⤵
  PID:1960
- C:\Windows\System\AVhXkIS.exe
  C:\Windows\System\AVhXkIS.exe
  2⤵
  PID:12356
- C:\Windows\System\VwFmpfu.exe
  C:\Windows\System\VwFmpfu.exe
  2⤵
  PID:12728
- C:\Windows\System\atqAVcS.exe
  C:\Windows\System\atqAVcS.exe
  2⤵
  PID:12784
- C:\Windows\System\hZpUQIs.exe
  C:\Windows\System\hZpUQIs.exe
  2⤵
  PID:13264
- C:\Windows\System\lsrJeuV.exe
  C:\Windows\System\lsrJeuV.exe
  2⤵
  PID:11500
- C:\Windows\System\KcvoYYD.exe
  C:\Windows\System\KcvoYYD.exe
  2⤵
  PID:12764
- C:\Windows\System\kAaajfE.exe
  C:\Windows\System\kAaajfE.exe
  2⤵
  PID:12832
- C:\Windows\System\NdWhKre.exe
  C:\Windows\System\NdWhKre.exe
  2⤵
  PID:12872
- C:\Windows\System\fwQWlZp.exe
  C:\Windows\System\fwQWlZp.exe
  2⤵
  PID:12928
- C:\Windows\System\HdigtaB.exe
  C:\Windows\System\HdigtaB.exe
  2⤵
  PID:13228
- C:\Windows\System\oBLJyib.exe
  C:\Windows\System\oBLJyib.exe
  2⤵
  PID:13096
- C:\Windows\System\hWoYdzT.exe
  C:\Windows\System\hWoYdzT.exe
  2⤵
  PID:12992
- C:\Windows\System\IKVksYu.exe
  C:\Windows\System\IKVksYu.exe
  2⤵
  PID:13068
- C:\Windows\System\DFRJyJv.exe
  C:\Windows\System\DFRJyJv.exe
  2⤵
  PID:13180
- C:\Windows\System\vWktigd.exe
  C:\Windows\System\vWktigd.exe
  2⤵
  PID:13212
- C:\Windows\System\aKPzbey.exe
  C:\Windows\System\aKPzbey.exe
  2⤵
  PID:536
- C:\Windows\System\jhQJxyj.exe
  C:\Windows\System\jhQJxyj.exe
  2⤵
  PID:12352
- C:\Windows\System\APEGpAW.exe
  C:\Windows\System\APEGpAW.exe
  2⤵
  PID:12404
- C:\Windows\System\AscnIJe.exe
  C:\Windows\System\AscnIJe.exe
  2⤵
  PID:12528
- C:\Windows\System\BxjKNrO.exe
  C:\Windows\System\BxjKNrO.exe
  2⤵
  PID:12668
- C:\Windows\System\LTuhQty.exe
  C:\Windows\System\LTuhQty.exe
  2⤵
  PID:12648
- C:\Windows\System\kdEBONv.exe
  C:\Windows\System\kdEBONv.exe
  2⤵
  PID:2528
- C:\Windows\System\RgSvaIp.exe
  C:\Windows\System\RgSvaIp.exe
  2⤵
  PID:4428
- C:\Windows\System\wxtrQiD.exe
  C:\Windows\System\wxtrQiD.exe
  2⤵
  PID:12012
- C:\Windows\System\EBBMYQb.exe
  C:\Windows\System\EBBMYQb.exe
  2⤵
  PID:1820
- C:\Windows\System\Zqttqhj.exe
  C:\Windows\System\Zqttqhj.exe
  2⤵
  PID:12504
- C:\Windows\System\YYxogXB.exe
  C:\Windows\System\YYxogXB.exe
  2⤵
  PID:12492
- C:\Windows\System\tgiInIf.exe
  C:\Windows\System\tgiInIf.exe
  2⤵
  PID:2768
- C:\Windows\System\ShlavJd.exe
  C:\Windows\System\ShlavJd.exe
  2⤵
  PID:2440
- C:\Windows\System\FjnRfCn.exe
  C:\Windows\System\FjnRfCn.exe
  2⤵
  PID:5656
- C:\Windows\System\LShKkgB.exe
  C:\Windows\System\LShKkgB.exe
  2⤵
  PID:12596
- C:\Windows\System\CVaSlqT.exe
  C:\Windows\System\CVaSlqT.exe
  2⤵
  PID:3928
- C:\Windows\System\NdDglpn.exe
  C:\Windows\System\NdDglpn.exe
  2⤵
  PID:4864
- C:\Windows\System\YhMJAKZ.exe
  C:\Windows\System\YhMJAKZ.exe
  2⤵
  PID:4144
- C:\Windows\System\fWrlTZq.exe
  C:\Windows\System\fWrlTZq.exe
  2⤵
  PID:4180
- C:\Windows\System\RjdWpfR.exe
  C:\Windows\System\RjdWpfR.exe
  2⤵
  PID:13016
- C:\Windows\System\PTZldJK.exe
  C:\Windows\System\PTZldJK.exe
  2⤵
  PID:1392
- C:\Windows\System\qIYqEFn.exe
  C:\Windows\System\qIYqEFn.exe
  2⤵
  PID:4008
- C:\Windows\System\QHmhbQy.exe
  C:\Windows\System\QHmhbQy.exe
  2⤵
  PID:1144
- C:\Windows\System\LRGEcLI.exe
  C:\Windows\System\LRGEcLI.exe
  2⤵
  PID:3876
- C:\Windows\System\ZERpKJB.exe
  C:\Windows\System\ZERpKJB.exe
  2⤵
  PID:2784
- C:\Windows\System\uIrljCf.exe
  C:\Windows\System\uIrljCf.exe
  2⤵
  PID:2940
- C:\Windows\System\nhmSmkF.exe
  C:\Windows\System\nhmSmkF.exe
  2⤵
  PID:2600
- C:\Windows\System\sTyIPLm.exe
  C:\Windows\System\sTyIPLm.exe
  2⤵
  PID:772
- C:\Windows\System\ZfBpaez.exe
  C:\Windows\System\ZfBpaez.exe
  2⤵
  PID:2196
- C:\Windows\System\WjfsniV.exe
  C:\Windows\System\WjfsniV.exe
  2⤵
  PID:3984
- C:\Windows\System\PQSWjDl.exe
  C:\Windows\System\PQSWjDl.exe
  2⤵
  PID:6996
- C:\Windows\System\DiXdGhR.exe
  C:\Windows\System\DiXdGhR.exe
  2⤵
  PID:7132
- C:\Windows\System\ZtHrEuM.exe
  C:\Windows\System\ZtHrEuM.exe
  2⤵
  PID:4052
- C:\Windows\System\hZagytH.exe
  C:\Windows\System\hZagytH.exe
  2⤵
  PID:6456
- C:\Windows\System\dDhTLGT.exe
  C:\Windows\System\dDhTLGT.exe
  2⤵
  PID:3456
- C:\Windows\System\cicUxDT.exe
  C:\Windows\System\cicUxDT.exe
  2⤵
  PID:1600
- C:\Windows\System\zMhZChx.exe
  C:\Windows\System\zMhZChx.exe
  2⤵
  PID:6124
- C:\Windows\System\iZZeAmj.exe
  C:\Windows\System\iZZeAmj.exe
  2⤵
  PID:424
- C:\Windows\System\zxghetk.exe
  C:\Windows\System\zxghetk.exe
  2⤵
  PID:4888
- C:\Windows\System\vpQuOcq.exe
  C:\Windows\System\vpQuOcq.exe
  2⤵
  PID:4548
- C:\Windows\System\WhosknP.exe
  C:\Windows\System\WhosknP.exe
  2⤵
  PID:3732
- C:\Windows\System\NrypsSo.exe
  C:\Windows\System\NrypsSo.exe
  2⤵
  PID:7044
- C:\Windows\System\dOrxGvl.exe
  C:\Windows\System\dOrxGvl.exe
  2⤵
  PID:4036
- C:\Windows\System\yqcPzfD.exe
  C:\Windows\System\yqcPzfD.exe
  2⤵
  PID:4488
- C:\Windows\System\ZFwEsRr.exe
  C:\Windows\System\ZFwEsRr.exe
  2⤵
  PID:6264
- C:\Windows\System\vcSlXtc.exe
  C:\Windows\System\vcSlXtc.exe
  2⤵
  PID:3360
- C:\Windows\System\jOvaPWO.exe
  C:\Windows\System\jOvaPWO.exe
  2⤵
  PID:5608
- C:\Windows\System\JQOWMgD.exe
  C:\Windows\System\JQOWMgD.exe
  2⤵
  PID:7348
- C:\Windows\System\xNnDMdF.exe
  C:\Windows\System\xNnDMdF.exe
  2⤵
  PID:2744
- C:\Windows\System\fdasGXO.exe
  C:\Windows\System\fdasGXO.exe
  2⤵
  PID:4232
- C:\Windows\System\KucbpwH.exe
  C:\Windows\System\KucbpwH.exe
  2⤵
  PID:4068
- C:\Windows\System\aHRkszg.exe
  C:\Windows\System\aHRkszg.exe
  2⤵
  PID:2200
- C:\Windows\System\qYuiBOO.exe
  C:\Windows\System\qYuiBOO.exe
  2⤵
  PID:6640
- C:\Windows\System\TIDYtzF.exe
  C:\Windows\System\TIDYtzF.exe
  2⤵
  PID:4028
- C:\Windows\System\lopdvQJ.exe
  C:\Windows\System\lopdvQJ.exe
  2⤵
  PID:7568
- C:\Windows\System\kORqcNk.exe
  C:\Windows\System\kORqcNk.exe
  2⤵
  PID:7652
- C:\Windows\System\vdCKJcf.exe
  C:\Windows\System\vdCKJcf.exe
  2⤵
  PID:7728
- C:\Windows\System\YpFqCoX.exe
  C:\Windows\System\YpFqCoX.exe
  2⤵
  PID:7804
- C:\Windows\System\KhECSWK.exe
  C:\Windows\System\KhECSWK.exe
  2⤵
  PID:7932
- C:\Windows\System\CQByFDO.exe
  C:\Windows\System\CQByFDO.exe
  2⤵
  PID:7948
- C:\Windows\System\mRtiKaH.exe
  C:\Windows\System\mRtiKaH.exe
  2⤵
  PID:8084
- C:\Windows\System\IlXXwqY.exe
  C:\Windows\System\IlXXwqY.exe
  2⤵
  PID:7216
- C:\Windows\System\ZhDVEzm.exe
  C:\Windows\System\ZhDVEzm.exe
  2⤵
  PID:7420
- C:\Windows\System\okjlTvc.exe
  C:\Windows\System\okjlTvc.exe
  2⤵
  PID:8072
- C:\Windows\System\lVCjyKp.exe
  C:\Windows\System\lVCjyKp.exe
  2⤵
  PID:7952
- C:\Windows\System\jUhRQJs.exe
  C:\Windows\System\jUhRQJs.exe
  2⤵
  PID:3904
- C:\Windows\System\uHxNVMS.exe
  C:\Windows\System\uHxNVMS.exe
  2⤵
  PID:2436
- C:\Windows\System\qyHMmmk.exe
  C:\Windows\System\qyHMmmk.exe
  2⤵
  PID:1140
- C:\Windows\System\CRZOiWW.exe
  C:\Windows\System\CRZOiWW.exe
  2⤵
  PID:8200
- C:\Windows\System\BgwMISA.exe
  C:\Windows\System\BgwMISA.exe
  2⤵
  PID:4312
- C:\Windows\System\CnOepcd.exe
  C:\Windows\System\CnOepcd.exe
  2⤵
  PID:2248
- C:\Windows\System\VVhvRFm.exe
  C:\Windows\System\VVhvRFm.exe
  2⤵
  PID:6596
- C:\Windows\System\TjcGOgR.exe
  C:\Windows\System\TjcGOgR.exe
  2⤵
  PID:3592
- C:\Windows\System\nDOgwEQ.exe
  C:\Windows\System\nDOgwEQ.exe
  2⤵
  PID:740
- C:\Windows\System\iYSIMol.exe
  C:\Windows\System\iYSIMol.exe
  2⤵
  PID:1164
- C:\Windows\System\QJNTHQH.exe
  C:\Windows\System\QJNTHQH.exe
  2⤵
  PID:2336
- C:\Windows\System\ClhafVc.exe
  C:\Windows\System\ClhafVc.exe
  2⤵
  PID:1424
- C:\Windows\System\UtXAgpX.exe
  C:\Windows\System\UtXAgpX.exe
  2⤵
  PID:8492
- C:\Windows\System\nSqQWbs.exe
  C:\Windows\System\nSqQWbs.exe
  2⤵
  PID:3888
- C:\Windows\System\wbjpJdp.exe
  C:\Windows\System\wbjpJdp.exe
  2⤵
  PID:548
- C:\Windows\System\hnEvNNd.exe
  C:\Windows\System\hnEvNNd.exe
  2⤵
  PID:8724
- C:\Windows\System\vJMkicy.exe
  C:\Windows\System\vJMkicy.exe
  2⤵
  PID:3260
- C:\Windows\System\XHkVQBf.exe
  C:\Windows\System\XHkVQBf.exe
  2⤵
  PID:2148
- C:\Windows\System\xXLYIjm.exe
  C:\Windows\System\xXLYIjm.exe
  2⤵
  PID:4040
- C:\Windows\System\JSuJroF.exe
  C:\Windows\System\JSuJroF.exe
  2⤵
  PID:3136
- C:\Windows\System\jPQlYvV.exe
  C:\Windows\System\jPQlYvV.exe
  2⤵
  PID:7400
- C:\Windows\System\TlEmfYo.exe
  C:\Windows\System\TlEmfYo.exe
  2⤵
  PID:2556
- C:\Windows\System\EWGjwTr.exe
  C:\Windows\System\EWGjwTr.exe
  2⤵
  PID:12572
- C:\Windows\System\Axtxxgw.exe
  C:\Windows\System\Axtxxgw.exe
  2⤵
  PID:7648
- C:\Windows\System\IggmvKb.exe
  C:\Windows\System\IggmvKb.exe
  2⤵
  PID:9144
- C:\Windows\System\iqqpqTT.exe
  C:\Windows\System\iqqpqTT.exe
  2⤵
  PID:7776
- C:\Windows\System\xxanNXD.exe
  C:\Windows\System\xxanNXD.exe
  2⤵
  PID:7880
- C:\Windows\System\dSJGPkc.exe
  C:\Windows\System\dSJGPkc.exe
  2⤵
  PID:7852
- C:\Windows\System\EiBymnN.exe
  C:\Windows\System\EiBymnN.exe
  2⤵
  PID:800
- C:\Windows\System\RIsCdDH.exe
  C:\Windows\System\RIsCdDH.exe
  2⤵
  PID:2392
- C:\Windows\System\XXWiyRf.exe
  C:\Windows\System\XXWiyRf.exe
  2⤵
  PID:7264
- C:\Windows\System\ibULSUl.exe
  C:\Windows\System\ibULSUl.exe
  2⤵
  PID:8840
- C:\Windows\System\DpPYxRA.exe
  C:\Windows\System\DpPYxRA.exe
  2⤵
  PID:1364
- C:\Windows\System\GoFlxnG.exe
  C:\Windows\System\GoFlxnG.exe
  2⤵
  PID:9004
- C:\Windows\System\xZAIBWV.exe
  C:\Windows\System\xZAIBWV.exe
  2⤵
  PID:4944
- C:\Windows\System\eIfHgGT.exe
  C:\Windows\System\eIfHgGT.exe
  2⤵
  PID:8536
- C:\Windows\System\xvhWavl.exe
  C:\Windows\System\xvhWavl.exe
  2⤵
  PID:3488
- C:\Windows\System\TnmZNkM.exe
  C:\Windows\System\TnmZNkM.exe
  2⤵
  PID:2360
- C:\Windows\System\HxZBtcE.exe
  C:\Windows\System\HxZBtcE.exe
  2⤵
  PID:6556
- C:\Windows\System\JFLwqcj.exe
  C:\Windows\System\JFLwqcj.exe
  2⤵
  PID:4916
- C:\Windows\System\jqCNjbZ.exe
  C:\Windows\System\jqCNjbZ.exe
  2⤵
  PID:8892
- C:\Windows\System\gKnHoAw.exe
  C:\Windows\System\gKnHoAw.exe
  2⤵
  PID:1008
- C:\Windows\System\PegOwdO.exe
  C:\Windows\System\PegOwdO.exe
  2⤵
  PID:4456
- C:\Windows\System\duSNZZJ.exe
  C:\Windows\System\duSNZZJ.exe
  2⤵
  PID:9356
- C:\Windows\System\zHcINYH.exe
  C:\Windows\System\zHcINYH.exe
  2⤵
  PID:2664
- C:\Windows\System\HcoDiQk.exe
  C:\Windows\System\HcoDiQk.exe
  2⤵
  PID:5484
- C:\Windows\System\QPRGBFZ.exe
  C:\Windows\System\QPRGBFZ.exe
  2⤵
  PID:2088
- C:\Windows\System\IAjKNLJ.exe
  C:\Windows\System\IAjKNLJ.exe
  2⤵
  PID:8836
- C:\Windows\System\DKjnSLp.exe
  C:\Windows\System\DKjnSLp.exe
  2⤵
  PID:4956
- C:\Windows\System\pKfYGLr.exe
  C:\Windows\System\pKfYGLr.exe
  2⤵
  PID:992
- C:\Windows\System\UbPOuzz.exe
  C:\Windows\System\UbPOuzz.exe
  2⤵
  PID:5040
- C:\Windows\System\XROhWGq.exe
  C:\Windows\System\XROhWGq.exe
  2⤵
  PID:2884
- C:\Windows\System\puWLzIM.exe
  C:\Windows\System\puWLzIM.exe
  2⤵
  PID:9900
- C:\Windows\System\CSeLGNo.exe
  C:\Windows\System\CSeLGNo.exe
  2⤵
  PID:5708
- C:\Windows\System\PMVjqeh.exe
  C:\Windows\System\PMVjqeh.exe
  2⤵
  PID:5792
- C:\Windows\System\jTEGyOV.exe
  C:\Windows\System\jTEGyOV.exe
  2⤵
  PID:6580
- C:\Windows\System\yGRSeGt.exe
  C:\Windows\System\yGRSeGt.exe
  2⤵
  PID:9036
- C:\Windows\System\XifluaQ.exe
  C:\Windows\System\XifluaQ.exe
  2⤵
  PID:9228
- C:\Windows\System\omrFZHm.exe
  C:\Windows\System\omrFZHm.exe
  2⤵
  PID:392
- C:\Windows\System\JrdZDps.exe
  C:\Windows\System\JrdZDps.exe
  2⤵
  PID:6704
- C:\Windows\System\qyyAJYx.exe
  C:\Windows\System\qyyAJYx.exe
  2⤵
  PID:9548
- C:\Windows\System\rsYQvHe.exe
  C:\Windows\System\rsYQvHe.exe
  2⤵
  PID:5960
- C:\Windows\System\CuySFrw.exe
  C:\Windows\System\CuySFrw.exe
  2⤵
  PID:9852
- C:\Windows\System\UltnVum.exe
  C:\Windows\System\UltnVum.exe
  2⤵
  PID:1524
- C:\Windows\System\JybwOAs.exe
  C:\Windows\System\JybwOAs.exe
  2⤵
  PID:10132
- C:\Windows\System\YQwZgpN.exe
  C:\Windows\System\YQwZgpN.exe
  2⤵
  PID:6060
- C:\Windows\System\ETYZwlZ.exe
  C:\Windows\System\ETYZwlZ.exe
  2⤵
  PID:6128
- C:\Windows\System\PdDzRQg.exe
  C:\Windows\System\PdDzRQg.exe
  2⤵
  PID:5532
- C:\Windows\System\fmXHTod.exe
  C:\Windows\System\fmXHTod.exe
  2⤵
  PID:4260
- C:\Windows\System\QDpBqjn.exe
  C:\Windows\System\QDpBqjn.exe
  2⤵
  PID:8188
- C:\Windows\System\VHEqaYi.exe
  C:\Windows\System\VHEqaYi.exe
  2⤵
  PID:3872
- C:\Windows\System\orfgndo.exe
  C:\Windows\System\orfgndo.exe
  2⤵
  PID:5192
- C:\Windows\System\Wyxwdgs.exe
  C:\Windows\System\Wyxwdgs.exe
  2⤵
  PID:5516
- C:\Windows\System\zzxAXeL.exe
  C:\Windows\System\zzxAXeL.exe
  2⤵
  PID:5524
- C:\Windows\System\GsreBmZ.exe
  C:\Windows\System\GsreBmZ.exe
  2⤵
  PID:556
- C:\Windows\System\sdcRtXd.exe
  C:\Windows\System\sdcRtXd.exe
  2⤵
  PID:5372
- C:\Windows\System\GCSlYQn.exe
  C:\Windows\System\GCSlYQn.exe
  2⤵
  PID:3024
- C:\Windows\System\JCWkijE.exe
  C:\Windows\System\JCWkijE.exe
  2⤵
  PID:9464
- C:\Windows\System\BODyGqr.exe
  C:\Windows\System\BODyGqr.exe
  2⤵
  PID:5624
- C:\Windows\System\vdQzuEZ.exe
  C:\Windows\System\vdQzuEZ.exe
  2⤵
  PID:5596
- C:\Windows\System\NNPYOJn.exe
  C:\Windows\System\NNPYOJn.exe
  2⤵
  PID:7708
- C:\Windows\System\UkWElFy.exe
  C:\Windows\System\UkWElFy.exe
  2⤵
  PID:5724
- C:\Windows\System\sEcSfOG.exe
  C:\Windows\System\sEcSfOG.exe
  2⤵
  PID:8140
- C:\Windows\System\xJBtuBE.exe
  C:\Windows\System\xJBtuBE.exe
  2⤵
  PID:7992
- C:\Windows\System\cKhGqMs.exe
  C:\Windows\System\cKhGqMs.exe
  2⤵
  PID:10888
- C:\Windows\System\WWkcZXX.exe
  C:\Windows\System\WWkcZXX.exe
  2⤵
  PID:10128
- C:\Windows\System\tBDdYWH.exe
  C:\Windows\System\tBDdYWH.exe
  2⤵
  PID:11100
- C:\Windows\System\vjBvSdn.exe
  C:\Windows\System\vjBvSdn.exe
  2⤵
  PID:5380
- C:\Windows\System\zrNpyQB.exe
  C:\Windows\System\zrNpyQB.exe
  2⤵
  PID:860
- C:\Windows\System\HdWjYWA.exe
  C:\Windows\System\HdWjYWA.exe
  2⤵
  PID:5408
- C:\Windows\System\TmCHNFr.exe
  C:\Windows\System\TmCHNFr.exe
  2⤵
  PID:5892
- C:\Windows\System\gNpPwPJ.exe
  C:\Windows\System\gNpPwPJ.exe
  2⤵
  PID:10812
- C:\Windows\System\wQSnzOM.exe
  C:\Windows\System\wQSnzOM.exe
  2⤵
  PID:12324
- C:\Windows\System\euXxVWf.exe
  C:\Windows\System\euXxVWf.exe
  2⤵
  PID:1296
- C:\Windows\System\dNVBUSz.exe
  C:\Windows\System\dNVBUSz.exe
  2⤵
  PID:9440
- C:\Windows\System\PlnPJWV.exe
  C:\Windows\System\PlnPJWV.exe
  2⤵
  PID:6016
- C:\Windows\System\HyRTJZv.exe
  C:\Windows\System\HyRTJZv.exe
  2⤵
  PID:5988
- C:\Windows\System\EGmJUqT.exe
  C:\Windows\System\EGmJUqT.exe
  2⤵
  PID:12460
- C:\Windows\System\VbCHhRw.exe
  C:\Windows\System\VbCHhRw.exe
  2⤵
  PID:9572
- C:\Windows\System\PgrLJLu.exe
  C:\Windows\System\PgrLJLu.exe
  2⤵
  PID:9756
- C:\Windows\System\NdbSZew.exe
  C:\Windows\System\NdbSZew.exe
  2⤵
  PID:11400
- C:\Windows\System\xPPGaME.exe
  C:\Windows\System\xPPGaME.exe
  2⤵
  PID:4316
- C:\Windows\System\JlGWuaN.exe
  C:\Windows\System\JlGWuaN.exe
  2⤵
  PID:3896
- C:\Windows\System\CoIGPXt.exe
  C:\Windows\System\CoIGPXt.exe
  2⤵
  PID:3952
- C:\Windows\System\mCQaIbU.exe
  C:\Windows\System\mCQaIbU.exe
  2⤵
  PID:2028
- C:\Windows\System\FuaaBwo.exe
  C:\Windows\System\FuaaBwo.exe
  2⤵
  PID:2552
- C:\Windows\System\QqXtTty.exe
  C:\Windows\System\QqXtTty.exe
  2⤵
  PID:10472
- C:\Windows\System\XBkHAzq.exe
  C:\Windows\System\XBkHAzq.exe
  2⤵
  PID:3696
- C:\Windows\System\OrFxKZe.exe
  C:\Windows\System\OrFxKZe.exe
  2⤵
  PID:5292
- C:\Windows\System\SvhClzQ.exe
  C:\Windows\System\SvhClzQ.exe
  2⤵
  PID:13208
- C:\Windows\System\jhCdxPm.exe
  C:\Windows\System\jhCdxPm.exe
  2⤵
  PID:3252
- C:\Windows\System\AdwYjge.exe
  C:\Windows\System\AdwYjge.exe
  2⤵
  PID:5720
- C:\Windows\System\ntTERyE.exe
  C:\Windows\System\ntTERyE.exe
  2⤵
  PID:10884
- C:\Windows\System\qaVEtSR.exe
  C:\Windows\System\qaVEtSR.exe
  2⤵
  PID:11080
- C:\Windows\System\VCAaTPU.exe
  C:\Windows\System\VCAaTPU.exe
  2⤵
  PID:5876
- C:\Windows\System\XbnVIHn.exe
  C:\Windows\System\XbnVIHn.exe
  2⤵
  PID:9560
- C:\Windows\System\WRheyYd.exe
  C:\Windows\System\WRheyYd.exe
  2⤵
  PID:6244
- C:\Windows\System\pFYWNBc.exe
  C:\Windows\System\pFYWNBc.exe
  2⤵
  PID:11072
- C:\Windows\System\vOTJMxi.exe
  C:\Windows\System\vOTJMxi.exe
  2⤵
  PID:11132
- C:\Windows\System\UPJrkAS.exe
  C:\Windows\System\UPJrkAS.exe
  2⤵
  PID:11432
- C:\Windows\System\HSjQZap.exe
  C:\Windows\System\HSjQZap.exe
  2⤵
  PID:11456
- C:\Windows\System\ZoHKpJY.exe
  C:\Windows\System\ZoHKpJY.exe
  2⤵
  PID:3900
- C:\Windows\System\scglBqX.exe
  C:\Windows\System\scglBqX.exe
  2⤵
  PID:6820
- C:\Windows\System\XlDSMXa.exe
  C:\Windows\System\XlDSMXa.exe
  2⤵
  PID:5544
- C:\Windows\System\feBDpep.exe
  C:\Windows\System\feBDpep.exe
  2⤵
  PID:6972
- C:\Windows\System\oIrbFRN.exe
  C:\Windows\System\oIrbFRN.exe
  2⤵
  PID:3092
- C:\Windows\System\xTVotVo.exe
  C:\Windows\System\xTVotVo.exe
  2⤵
  PID:10424
- C:\Windows\System\tNdcQVw.exe
  C:\Windows\System\tNdcQVw.exe
  2⤵
  PID:10396
- C:\Windows\System\PtqPYJs.exe
  C:\Windows\System\PtqPYJs.exe
  2⤵
  PID:10772
- C:\Windows\System\qqkoZzh.exe
  C:\Windows\System\qqkoZzh.exe
  2⤵
  PID:10164
- C:\Windows\System\lJkDjFG.exe
  C:\Windows\System\lJkDjFG.exe
  2⤵
  PID:5832
- C:\Windows\System\cbjzEoR.exe
  C:\Windows\System\cbjzEoR.exe
  2⤵
  PID:7084
- C:\Windows\System\IbLYJfh.exe
  C:\Windows\System\IbLYJfh.exe
  2⤵
  PID:7112
- C:\Windows\System\RiSqxog.exe
  C:\Windows\System\RiSqxog.exe
  2⤵
  PID:13084
- C:\Windows\System\xBBCGDH.exe
  C:\Windows\System\xBBCGDH.exe
  2⤵
  PID:13252
- C:\Windows\System\gTeDTnD.exe
  C:\Windows\System\gTeDTnD.exe
  2⤵
  PID:13308
- C:\Windows\System\pWkYAxO.exe
  C:\Windows\System\pWkYAxO.exe
  2⤵
  PID:6184
- C:\Windows\System\jHsvVtg.exe
  C:\Windows\System\jHsvVtg.exe
  2⤵
  PID:10916
- C:\Windows\System\uXajMAt.exe
  C:\Windows\System\uXajMAt.exe
  2⤵
  PID:6392
- C:\Windows\System\XZkCiwP.exe
  C:\Windows\System\XZkCiwP.exe
  2⤵
  PID:5800
- C:\Windows\System\lDUMTgT.exe
  C:\Windows\System\lDUMTgT.exe
  2⤵
  PID:6424
- C:\Windows\System\iHHmsYy.exe
  C:\Windows\System\iHHmsYy.exe
  2⤵
  PID:11112
- C:\Windows\System\gQTAJzd.exe
  C:\Windows\System\gQTAJzd.exe
  2⤵
  PID:11144
- C:\Windows\System\PGuQIps.exe
  C:\Windows\System\PGuQIps.exe
  2⤵
  PID:9588
- C:\Windows\System\zTsYUsF.exe
  C:\Windows\System\zTsYUsF.exe
  2⤵
  PID:6428
- C:\Windows\System\JcLiuLC.exe
  C:\Windows\System\JcLiuLC.exe
  2⤵
  PID:11452
- C:\Windows\System\VDYbRWq.exe
  C:\Windows\System\VDYbRWq.exe
  2⤵
  PID:12904
- C:\Windows\System\vYbngiO.exe
  C:\Windows\System\vYbngiO.exe
  2⤵
  PID:13216
- C:\Windows\System\KxQmPUU.exe
  C:\Windows\System\KxQmPUU.exe
  2⤵
  PID:7008
- C:\Windows\System\hFCzugV.exe
  C:\Windows\System\hFCzugV.exe
  2⤵
  PID:9112
- C:\Windows\System\rVwzATF.exe
  C:\Windows\System\rVwzATF.exe
  2⤵
  PID:9376
- C:\Windows\System\pEPrlex.exe
  C:\Windows\System\pEPrlex.exe
  2⤵
  PID:11560
- C:\Windows\System\XnjWTJz.exe
  C:\Windows\System\XnjWTJz.exe
  2⤵
  PID:7272
- C:\Windows\System\pkiXzCf.exe
  C:\Windows\System\pkiXzCf.exe
  2⤵
  PID:11700
- C:\Windows\System\oLRsFti.exe
  C:\Windows\System\oLRsFti.exe
  2⤵
  PID:12028
- C:\Windows\System\vghKTtO.exe
  C:\Windows\System\vghKTtO.exe
  2⤵
  PID:7016
- C:\Windows\System\tbIMJPJ.exe
  C:\Windows\System\tbIMJPJ.exe
  2⤵
  PID:7100
- C:\Windows\System\HuigwBh.exe
  C:\Windows\System\HuigwBh.exe
  2⤵
  PID:10920
- C:\Windows\System\dpUjbMv.exe
  C:\Windows\System\dpUjbMv.exe
  2⤵
  PID:12932
- C:\Windows\System\dltWFmV.exe
  C:\Windows\System\dltWFmV.exe
  2⤵
  PID:6496
- C:\Windows\System\EvcEOBK.exe
  C:\Windows\System\EvcEOBK.exe
  2⤵
  PID:11376
- C:\Windows\System\yElmCao.exe
  C:\Windows\System\yElmCao.exe
  2⤵
  PID:7228
- C:\Windows\System\zOdXFag.exe
  C:\Windows\System\zOdXFag.exe
  2⤵
  PID:12844
- C:\Windows\System\CojqPoc.exe
  C:\Windows\System\CojqPoc.exe
  2⤵
  PID:11000
- C:\Windows\System\npmzbrK.exe
  C:\Windows\System\npmzbrK.exe
  2⤵
  PID:7332
- C:\Windows\System\KUcqtdQ.exe
  C:\Windows\System\KUcqtdQ.exe
  2⤵
  PID:5456
- C:\Windows\System\EMwgnxF.exe
  C:\Windows\System\EMwgnxF.exe
  2⤵
  PID:5888
- C:\Windows\System\JUgePdJ.exe
  C:\Windows\System\JUgePdJ.exe
  2⤵
  PID:7164
- C:\Windows\System\SjyfaPK.exe
  C:\Windows\System\SjyfaPK.exe
  2⤵
  PID:12208
- C:\Windows\System\eDnWtMJ.exe
  C:\Windows\System\eDnWtMJ.exe
  2⤵
  PID:1156
- C:\Windows\System\DZxmzIb.exe
  C:\Windows\System\DZxmzIb.exe
  2⤵
  PID:7184
- C:\Windows\System\FpbByhS.exe
  C:\Windows\System\FpbByhS.exe
  2⤵
  PID:9564
- C:\Windows\System\aMouyZV.exe
  C:\Windows\System\aMouyZV.exe
  2⤵
  PID:7424
- C:\Windows\System\vFYHdYT.exe
  C:\Windows\System\vFYHdYT.exe
  2⤵
  PID:11924
- C:\Windows\System\yICRXTY.exe
  C:\Windows\System\yICRXTY.exe
  2⤵
  PID:11688
- C:\Windows\System\lQUdtRL.exe
  C:\Windows\System\lQUdtRL.exe
  2⤵
  PID:7064
- C:\Windows\System\RquSxYU.exe
  C:\Windows\System\RquSxYU.exe
  2⤵
  PID:8224
- C:\Windows\System\lNCPaPj.exe
  C:\Windows\System\lNCPaPj.exe
  2⤵
  PID:6472
- C:\Windows\System\ScwExuq.exe
  C:\Windows\System\ScwExuq.exe
  2⤵
  PID:6660
- C:\Windows\System\sTKQDYw.exe
  C:\Windows\System\sTKQDYw.exe
  2⤵
  PID:8332
- C:\Windows\System\yRsNJJJ.exe
  C:\Windows\System\yRsNJJJ.exe
  2⤵
  PID:7360
- C:\Windows\System\OyecqiW.exe
  C:\Windows\System\OyecqiW.exe
  2⤵
  PID:6432
- C:\Windows\System\UjxHDZz.exe
  C:\Windows\System\UjxHDZz.exe
  2⤵
  PID:10968
- C:\Windows\System\ILEWTXM.exe
  C:\Windows\System\ILEWTXM.exe
  2⤵
  PID:8052
- C:\Windows\System\BrVwAud.exe
  C:\Windows\System\BrVwAud.exe
  2⤵
  PID:8456
- C:\Windows\System\xqJHYDD.exe
  C:\Windows\System\xqJHYDD.exe
  2⤵
  PID:3964
- C:\Windows\System\dYUjftS.exe
  C:\Windows\System\dYUjftS.exe
  2⤵
  PID:2040
- C:\Windows\System\QBNfbeO.exe
  C:\Windows\System\QBNfbeO.exe
  2⤵
  PID:8532
- C:\Windows\System\NdbHgrt.exe
  C:\Windows\System\NdbHgrt.exe
  2⤵
  PID:8740
- C:\Windows\System\BqaflVR.exe
  C:\Windows\System\BqaflVR.exe
  2⤵
  PID:8376
- C:\Windows\System\LVmSzBe.exe
  C:\Windows\System\LVmSzBe.exe
  2⤵
  PID:8384
- C:\Windows\System\AHMnOHO.exe
  C:\Windows\System\AHMnOHO.exe
  2⤵
  PID:6324
- C:\Windows\System\rTqEiAC.exe
  C:\Windows\System\rTqEiAC.exe
  2⤵
  PID:8872
- C:\Windows\System\eScwPxD.exe
  C:\Windows\System\eScwPxD.exe
  2⤵
  PID:8220
- C:\Windows\System\iGSxSZU.exe
  C:\Windows\System\iGSxSZU.exe
  2⤵
  PID:8380
- C:\Windows\System\UvXCTWh.exe
  C:\Windows\System\UvXCTWh.exe
  2⤵
  PID:13320
- C:\Windows\System\WpUtagW.exe
  C:\Windows\System\WpUtagW.exe
  2⤵
  PID:13340
- C:\Windows\System\iqRcPHE.exe
  C:\Windows\System\iqRcPHE.exe
  2⤵
  PID:13368
- C:\Windows\System\YlaFBZS.exe
  C:\Windows\System\YlaFBZS.exe
  2⤵
  PID:13388
- C:\Windows\System\PKoXMuC.exe
  C:\Windows\System\PKoXMuC.exe
  2⤵
  PID:13408
- C:\Windows\System\ODAFwyn.exe
  C:\Windows\System\ODAFwyn.exe
  2⤵
  PID:13440
- C:\Windows\System\vZHfiYc.exe
  C:\Windows\System\vZHfiYc.exe
  2⤵
  PID:13468
- C:\Windows\System\gHKGjeU.exe
  C:\Windows\System\gHKGjeU.exe
  2⤵
  PID:13492
- C:\Windows\System\ewpOIBe.exe
  C:\Windows\System\ewpOIBe.exe
  2⤵
  PID:13508
- C:\Windows\System\KMSIXkP.exe
  C:\Windows\System\KMSIXkP.exe
  2⤵
  PID:13536
- C:\Windows\System\kouuLqS.exe
  C:\Windows\System\kouuLqS.exe
  2⤵
  PID:13560
- C:\Windows\System\rEwszJT.exe
  C:\Windows\System\rEwszJT.exe
  2⤵
  PID:13600
- C:\Windows\System\KdfZNxX.exe
  C:\Windows\System\KdfZNxX.exe
  2⤵
  PID:13620
- C:\Windows\System\soFfyWz.exe
  C:\Windows\System\soFfyWz.exe
  2⤵
  PID:13652
- C:\Windows\System\FoiBdMm.exe
  C:\Windows\System\FoiBdMm.exe
  2⤵
  PID:13672
- C:\Windows\System\UsvIWLJ.exe
  C:\Windows\System\UsvIWLJ.exe
  2⤵
  PID:13696
- C:\Windows\System\JcyjtGb.exe
  C:\Windows\System\JcyjtGb.exe
  2⤵
  PID:13728
- C:\Windows\System\ziJspRK.exe
  C:\Windows\System\ziJspRK.exe
  2⤵
  PID:13744
- C:\Windows\System\YKsvyGH.exe
  C:\Windows\System\YKsvyGH.exe
  2⤵
  PID:13760
- C:\Windows\System\aZbxbga.exe
  C:\Windows\System\aZbxbga.exe
  2⤵
  PID:13784
- C:\Windows\System\vVydBbP.exe
  C:\Windows\System\vVydBbP.exe
  2⤵
  PID:13812
- C:\Windows\System\ZfadyVY.exe
  C:\Windows\System\ZfadyVY.exe
  2⤵
  PID:13840
- C:\Windows\System\kfgruhj.exe
  C:\Windows\System\kfgruhj.exe
  2⤵
  PID:13864
- C:\Windows\System\RiCMheh.exe
  C:\Windows\System\RiCMheh.exe
  2⤵
  PID:13892
- C:\Windows\System\JWUBjUe.exe
  C:\Windows\System\JWUBjUe.exe
  2⤵
  PID:13920
- C:\Windows\System\VDcQaaS.exe
  C:\Windows\System\VDcQaaS.exe
  2⤵
  PID:13952
- C:\Windows\System\PnumMbb.exe
  C:\Windows\System\PnumMbb.exe
  2⤵
  PID:13984
- C:\Windows\System\OouVFGW.exe
  C:\Windows\System\OouVFGW.exe
  2⤵
  PID:14040
- C:\Windows\System\CUlaEHF.exe
  C:\Windows\System\CUlaEHF.exe
  2⤵
  PID:14064
- C:\Windows\System\BQEyzSj.exe
  C:\Windows\System\BQEyzSj.exe
  2⤵
  PID:14104
- C:\Windows\System\KRQBpGo.exe
  C:\Windows\System\KRQBpGo.exe
  2⤵
  PID:14124
- C:\Windows\System\gJIhSMw.exe
  C:\Windows\System\gJIhSMw.exe
  2⤵
  PID:14152
- C:\Windows\System\bsffUNo.exe
  C:\Windows\System\bsffUNo.exe
  2⤵
  PID:14176
- C:\Windows\System\KkgLwdQ.exe
  C:\Windows\System\KkgLwdQ.exe
  2⤵
  PID:8428
- C:\Windows\System\aLYoSWn.exe
  C:\Windows\System\aLYoSWn.exe
  2⤵
  PID:9204
- C:\Windows\System\YozkkJO.exe
  C:\Windows\System\YozkkJO.exe
  2⤵
  PID:9008
- C:\Windows\System\bmWkmQC.exe
  C:\Windows\System\bmWkmQC.exe
  2⤵
  PID:13916
- C:\Windows\System\iactPnq.exe
  C:\Windows\System\iactPnq.exe
  2⤵
  PID:13968
- C:\Windows\System\OhaNEKO.exe
  C:\Windows\System\OhaNEKO.exe
  2⤵
  PID:13996
- C:\Windows\System\KoAwKVw.exe
  C:\Windows\System\KoAwKVw.exe
  2⤵
  PID:14020
- C:\Windows\System\AVqHtup.exe
  C:\Windows\System\AVqHtup.exe
  2⤵
  PID:13548
- C:\Windows\System\nRIfkMN.exe
  C:\Windows\System\nRIfkMN.exe
  2⤵
  PID:13804
- C:\Windows\System\WjLiDyf.exe
  C:\Windows\System\WjLiDyf.exe
  2⤵
  PID:13632
- C:\Windows\System\jnZaZXa.exe
  C:\Windows\System\jnZaZXa.exe
  2⤵
  PID:13668
- C:\Windows\System\FHXUfGB.exe
  C:\Windows\System\FHXUfGB.exe
  2⤵
  PID:13692
- C:\Windows\System\sGuggvq.exe
  C:\Windows\System\sGuggvq.exe
  2⤵
  PID:9776
- C:\Windows\System\kxHjjED.exe
  C:\Windows\System\kxHjjED.exe
  2⤵
  PID:9940
- C:\Windows\System\vVvztvG.exe
  C:\Windows\System\vVvztvG.exe
  2⤵
  PID:14008
- C:\Windows\System\FfoFLmf.exe
  C:\Windows\System\FfoFLmf.exe
  2⤵
  PID:14072
- C:\Windows\System\zQwYpcB.exe
  C:\Windows\System\zQwYpcB.exe
  2⤵
  PID:14300
- C:\Windows\System\VsWJpKZ.exe
  C:\Windows\System\VsWJpKZ.exe
  2⤵
  PID:14316
- C:\Windows\System\DSBLsrI.exe
  C:\Windows\System\DSBLsrI.exe
  2⤵
  PID:14332
- C:\Windows\System\tgsGNwd.exe
  C:\Windows\System\tgsGNwd.exe
  2⤵
  PID:8596
- C:\Windows\System\bSFRvYk.exe
  C:\Windows\System\bSFRvYk.exe
  2⤵
  PID:14204
- C:\Windows\System\nedlGiz.exe
  C:\Windows\System\nedlGiz.exe
  2⤵
  PID:10056
- C:\Windows\System\mCInmyz.exe
  C:\Windows\System\mCInmyz.exe
  2⤵
  PID:14076
- C:\Windows\System\EJOSScd.exe
  C:\Windows\System\EJOSScd.exe
  2⤵
  PID:8292
- C:\Windows\System\SSDnqXs.exe
  C:\Windows\System\SSDnqXs.exe
  2⤵
  PID:9932
- C:\Windows\System\TdJkWnp.exe
  C:\Windows\System\TdJkWnp.exe
  2⤵
  PID:14312
- C:\Windows\System\eBbetDC.exe
  C:\Windows\System\eBbetDC.exe
  2⤵
  PID:8600
- C:\Windows\System\KLzWVKb.exe
  C:\Windows\System\KLzWVKb.exe
  2⤵
  PID:13592
- C:\Windows\System\tIkAMfQ.exe
  C:\Windows\System\tIkAMfQ.exe
  2⤵
  PID:13356
- C:\Windows\System\BdxrIBw.exe
  C:\Windows\System\BdxrIBw.exe
  2⤵
  PID:13680
- C:\Windows\System\nGqGknU.exe
  C:\Windows\System\nGqGknU.exe
  2⤵
  PID:9504
- C:\Windows\System\gNcbmTz.exe
  C:\Windows\System\gNcbmTz.exe
  2⤵
  PID:10232
- C:\Windows\System\oyDUqdH.exe
  C:\Windows\System\oyDUqdH.exe
  2⤵
  PID:11032
- C:\Windows\System\DbKvbXD.exe
  C:\Windows\System\DbKvbXD.exe
  2⤵
  PID:13768
- C:\Windows\System\giMINxQ.exe
  C:\Windows\System\giMINxQ.exe
  2⤵
  PID:8572
- C:\Windows\System\pnZQIiW.exe
  C:\Windows\System\pnZQIiW.exe
  2⤵
  PID:9712
- C:\Windows\System\yfAYPJd.exe
  C:\Windows\System\yfAYPJd.exe
  2⤵
  PID:9688
- C:\Windows\System\NlSedUY.exe
  C:\Windows\System\NlSedUY.exe
  2⤵
  PID:13836
- C:\Windows\System\THLFQOg.exe
  C:\Windows\System\THLFQOg.exe
  2⤵
  PID:9860
- C:\Windows\System\XttthYV.exe
  C:\Windows\System\XttthYV.exe
  2⤵
  PID:10136
- C:\Windows\System\rGuBYWV.exe
  C:\Windows\System\rGuBYWV.exe
  2⤵
  PID:8592
- C:\Windows\System\awhVKZy.exe
  C:\Windows\System\awhVKZy.exe
  2⤵
  PID:9536
- C:\Windows\System\ZxjnFDF.exe
  C:\Windows\System\ZxjnFDF.exe
  2⤵
  PID:10160
- C:\Windows\System\ApmTXUj.exe
  C:\Windows\System\ApmTXUj.exe
  2⤵
  PID:13936
- C:\Windows\System\VQrpAcW.exe
  C:\Windows\System\VQrpAcW.exe
  2⤵
  PID:10316
- C:\Windows\System\MjAXzTI.exe
  C:\Windows\System\MjAXzTI.exe
  2⤵
  PID:14096
- C:\Windows\System\ISAbKiX.exe
  C:\Windows\System\ISAbKiX.exe
  2⤵
  PID:5096
- C:\Windows\System\XYoMSRV.exe
  C:\Windows\System\XYoMSRV.exe
  2⤵
  PID:14184
- C:\Windows\System\tzlRAHh.exe
  C:\Windows\System\tzlRAHh.exe
  2⤵
  PID:8748
- C:\Windows\System\iipoDnm.exe
  C:\Windows\System\iipoDnm.exe
  2⤵
  PID:14052
- C:\Windows\System\ntnFMLD.exe
  C:\Windows\System\ntnFMLD.exe
  2⤵
  PID:14272
- C:\Windows\System\AZulqsR.exe
  C:\Windows\System\AZulqsR.exe
  2⤵
  PID:10104
- C:\Windows\System\pnZlQNw.exe
  C:\Windows\System\pnZlQNw.exe
  2⤵
  PID:10460
- C:\Windows\System\oMWPcsn.exe
  C:\Windows\System\oMWPcsn.exe
  2⤵
  PID:10432
- C:\Windows\System\ZFNpFWw.exe
  C:\Windows\System\ZFNpFWw.exe
  2⤵
  PID:13352
- C:\Windows\System\cGQuzAl.exe
  C:\Windows\System\cGQuzAl.exe
  2⤵
  PID:13532
- C:\Windows\System\jSuarZy.exe
  C:\Windows\System\jSuarZy.exe
  2⤵
  PID:9468
- C:\Windows\System\aKrDzot.exe
  C:\Windows\System\aKrDzot.exe
  2⤵
  PID:10788
- C:\Windows\System\XQHpIee.exe
  C:\Windows\System\XQHpIee.exe
  2⤵
  PID:10120
- C:\Windows\System\IPwiXcy.exe
  C:\Windows\System\IPwiXcy.exe
  2⤵
  PID:10064
- C:\Windows\System\xwgQxsQ.exe
  C:\Windows\System\xwgQxsQ.exe
  2⤵
  PID:10492
- C:\Windows\System\yVhtcWe.exe
  C:\Windows\System\yVhtcWe.exe
  2⤵
  PID:4608
- C:\Windows\System\DIlQwyr.exe
  C:\Windows\System\DIlQwyr.exe
  2⤵
  PID:10692
- C:\Windows\System\aCgWnNe.exe
  C:\Windows\System\aCgWnNe.exe
  2⤵
  PID:13484
- C:\Windows\System\WjiuwQv.exe
  C:\Windows\System\WjiuwQv.exe
  2⤵
  PID:11236
- C:\Windows\System\fwBVLVh.exe
  C:\Windows\System\fwBVLVh.exe
  2⤵
  PID:10800
- C:\Windows\System\sIunEGP.exe
  C:\Windows\System\sIunEGP.exe
  2⤵
  PID:13552
- C:\Windows\System\TvoVErW.exe
  C:\Windows\System\TvoVErW.exe
  2⤵
  PID:10624
- C:\Windows\System\GyTLtPB.exe
  C:\Windows\System\GyTLtPB.exe
  2⤵
  PID:13928
- C:\Windows\System\gSJCxPz.exe
  C:\Windows\System\gSJCxPz.exe
  2⤵
  PID:11224
- C:\Windows\System\UUnqMlJ.exe
  C:\Windows\System\UUnqMlJ.exe
  2⤵
  PID:13524
- C:\Windows\System\DurBQuD.exe
  C:\Windows\System\DurBQuD.exe
  2⤵
  PID:11276
- C:\Windows\System\mbdbgAA.exe
  C:\Windows\System\mbdbgAA.exe
  2⤵
  PID:14360
- C:\Windows\System\VzEfWdT.exe
  C:\Windows\System\VzEfWdT.exe
  2⤵
  PID:14404
- C:\Windows\System\rtzSABr.exe
  C:\Windows\System\rtzSABr.exe
  2⤵
  PID:14428
- C:\Windows\System\gZdyHVJ.exe
  C:\Windows\System\gZdyHVJ.exe
  2⤵
  PID:14612
- C:\Windows\System\xktOCHS.exe
  C:\Windows\System\xktOCHS.exe
  2⤵
  PID:14640
- C:\Windows\System\efQzHJQ.exe
  C:\Windows\System\efQzHJQ.exe
  2⤵
  PID:14676
- C:\Windows\System\BSwEOaN.exe
  C:\Windows\System\BSwEOaN.exe
  2⤵
  PID:14704
- C:\Windows\System\mNbGAsw.exe
  C:\Windows\System\mNbGAsw.exe
  2⤵
  PID:14736
- C:\Windows\System\tJZDvBx.exe
  C:\Windows\System\tJZDvBx.exe
  2⤵
  PID:14756
- C:\Windows\System\tWGDXeP.exe
  C:\Windows\System\tWGDXeP.exe
  2⤵
  PID:14784
- C:\Windows\System\ZnlLAjQ.exe
  C:\Windows\System\ZnlLAjQ.exe
  2⤵
  PID:14820
- C:\Windows\System\kISLnGL.exe
  C:\Windows\System\kISLnGL.exe
  2⤵
  PID:14840
- C:\Windows\System\yllznrj.exe
  C:\Windows\System\yllznrj.exe
  2⤵
  PID:14856
- C:\Windows\System\fhsirqr.exe
  C:\Windows\System\fhsirqr.exe
  2⤵
  PID:14884
- C:\Windows\System\kppVfee.exe
  C:\Windows\System\kppVfee.exe
  2⤵
  PID:14912
- C:\Windows\System\XBfsBat.exe
  C:\Windows\System\XBfsBat.exe
  2⤵
  PID:14932
- C:\Windows\System\yHrnPKB.exe
  C:\Windows\System\yHrnPKB.exe
  2⤵
  PID:14956
- C:\Windows\System\yjvcjUG.exe
  C:\Windows\System\yjvcjUG.exe
  2⤵
  PID:14984
- C:\Windows\System\TqduwBR.exe
  C:\Windows\System\TqduwBR.exe
  2⤵
  PID:15008
- C:\Windows\System\dPrcIPJ.exe
  C:\Windows\System\dPrcIPJ.exe
  2⤵
  PID:15044
- C:\Windows\System\RvfArtz.exe
  C:\Windows\System\RvfArtz.exe
  2⤵
  PID:15068
- C:\Windows\System\eDCwZHx.exe
  C:\Windows\System\eDCwZHx.exe
  2⤵
  PID:15096
- C:\Windows\System\JXTVhbU.exe
  C:\Windows\System\JXTVhbU.exe
  2⤵
  PID:15132
- C:\Windows\System\NVsLRkM.exe
  C:\Windows\System\NVsLRkM.exe
  2⤵
  PID:15156
- C:\Windows\System\bMziEQI.exe
  C:\Windows\System\bMziEQI.exe
  2⤵
  PID:15180
- C:\Windows\System\rRpdMPZ.exe
  C:\Windows\System\rRpdMPZ.exe
  2⤵
  PID:15216
- C:\Windows\System\gHixJpI.exe
  C:\Windows\System\gHixJpI.exe
  2⤵
  PID:15244
- C:\Windows\System\IfByFNp.exe
  C:\Windows\System\IfByFNp.exe
  2⤵
  PID:15268
- C:\Windows\System\nVAPCxi.exe
  C:\Windows\System\nVAPCxi.exe
  2⤵
  PID:10436
- C:\Windows\System\ZUrFMhY.exe
  C:\Windows\System\ZUrFMhY.exe
  2⤵
  PID:11148
- C:\Windows\System\vzICVXO.exe
  C:\Windows\System\vzICVXO.exe
  2⤵
  PID:10924
- C:\Windows\System\guBqQEY.exe
  C:\Windows\System\guBqQEY.exe
  2⤵
  PID:7208
- C:\Windows\System\fYZOfiu.exe
  C:\Windows\System\fYZOfiu.exe
  2⤵
  PID:11252
- C:\Windows\System\erLrarU.exe
  C:\Windows\System\erLrarU.exe
  2⤵
  PID:10896
- C:\Windows\System\SDyReCR.exe
  C:\Windows\System\SDyReCR.exe
  2⤵
  PID:14256
- C:\Windows\System\aFbGTVI.exe
  C:\Windows\System\aFbGTVI.exe
  2⤵
  PID:10668
- C:\Windows\System\VGAKNBC.exe
  C:\Windows\System\VGAKNBC.exe
  2⤵
  PID:13780
- C:\Windows\System\KSErUue.exe
  C:\Windows\System\KSErUue.exe
  2⤵
  PID:14372
- C:\Windows\System\aFvVVBH.exe
  C:\Windows\System\aFvVVBH.exe
  2⤵
  PID:8480
- C:\Windows\System\SQUSBXh.exe
  C:\Windows\System\SQUSBXh.exe
  2⤵
  PID:11656
- C:\Windows\System\eVWYHzy.exe
  C:\Windows\System\eVWYHzy.exe
  2⤵
  PID:14288
- C:\Windows\System\wxIthQX.exe
  C:\Windows\System\wxIthQX.exe
  2⤵
  PID:10696
- C:\Windows\System\srrRMxM.exe
  C:\Windows\System\srrRMxM.exe
  2⤵
  PID:11892
- C:\Windows\System\oMyLoTq.exe
  C:\Windows\System\oMyLoTq.exe
  2⤵
  PID:13660
- C:\Windows\System\uEmXuLh.exe
  C:\Windows\System\uEmXuLh.exe
  2⤵
  PID:14352
- C:\Windows\System\pyzSwEz.exe
  C:\Windows\System\pyzSwEz.exe
  2⤵
  PID:14464
- C:\Windows\System\VlpCVTv.exe
  C:\Windows\System\VlpCVTv.exe
  2⤵
  PID:15024
- C:\Windows\System\qebvRQt.exe
  C:\Windows\System\qebvRQt.exe
  2⤵
  PID:14508
- C:\Windows\System\BeoPKdq.exe
  C:\Windows\System\BeoPKdq.exe
  2⤵
  PID:12256
- C:\Windows\System\RXOgdJw.exe
  C:\Windows\System\RXOgdJw.exe
  2⤵
  PID:14804
- C:\Windows\System\yUHDNcw.exe
  C:\Windows\System\yUHDNcw.exe
  2⤵
  PID:12168
- C:\Windows\System\jAwIjrN.exe
  C:\Windows\System\jAwIjrN.exe
  2⤵
  PID:14908
- C:\Windows\System\nLSrorE.exe
  C:\Windows\System\nLSrorE.exe
  2⤵
  PID:15200
- C:\Windows\System\TdipSVD.exe
  C:\Windows\System\TdipSVD.exe
  2⤵
  PID:15208
- C:\Windows\System\evHPeFF.exe
  C:\Windows\System\evHPeFF.exe
  2⤵
  PID:15252
- C:\Windows\System\XANfUJu.exe
  C:\Windows\System\XANfUJu.exe
  2⤵
  PID:11580
- C:\Windows\System\raCQTCa.exe
  C:\Windows\System\raCQTCa.exe
  2⤵
  PID:14748
- C:\Windows\System\iuLCYlc.exe
  C:\Windows\System\iuLCYlc.exe
  2⤵
  PID:11696
- C:\Windows\System\ousIpUR.exe
  C:\Windows\System\ousIpUR.exe
  2⤵
  PID:11008
- C:\Windows\System\XTqtcLf.exe
  C:\Windows\System\XTqtcLf.exe
  2⤵
  PID:3720
- C:\Windows\System\sPMnGiE.exe
  C:\Windows\System\sPMnGiE.exe
  2⤵
  PID:15188

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:11192

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:5608

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_52h11zuv.ubk.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AwkHvxA.exe

Filesize
18B

MD5
5db3df0964e5c695675f39e99d1f288b

SHA1
84b597ea47f1f6b13b223cbb576a55e47a79cfaa

SHA256
15f5f6f9d4846d3bfaf7f8740e9c849aebfecfea6fc86fee82eb18d6ec03fd9f

SHA512
f71b3480e977c4ca4affaaec3f3bd31e3598fdd986ea7bafee42b5d6a8676e69449256bbab19fc0cc61412a454871e6b79cebb0c5e3610b9e98c4f089888aa18

Download Submit
C:\Windows\System\BiIzRPW.exe

Filesize
1.9MB

MD5
37c3560bcbd298544b7635c8e0493e13

SHA1
8a0214aca4c373e67ce167c4653ed65446ab7c16

SHA256
bb31fa6c40f5efc946877b5a97dc3626f1756ca55a372d8a06a8a0aa2a260b2f

SHA512
2fd9fb285246aa3e73eb6f8335a3c8d4298fb9fbf5bfeb1daaf17fc51e100b5ce48bfcc0edb9efc0cdc9adf6127eebb07a66b1814dc78f350510cc324f18873d

Download Submit
C:\Windows\System\BsIJcrT.exe

Filesize
1.9MB

MD5
2f4e2359a2c576b70e2e3e09213aba54

SHA1
3678b5a0f4924838e96939f00e2ebbc95953f5a4

SHA256
ddcf24b018d2874ddab52b1b387c91a541e480ede8dce9845ecef70f33c85cc4

SHA512
016567df4cc4af5ae6e7e8ae45284fe7734bf5eb0be99013e8fe367944bcb54803c66757288dcc0e48cbf168b48f752f8f8b66bf470394ab6b9a7587a7178464

Download Submit
C:\Windows\System\BybhGDb.exe

Filesize
1.9MB

MD5
8e5a636c8bf71001e40ca169f8aed547

SHA1
99adc03ce871fddc51c6bbebbb919262336a16f1

SHA256
e48cacd5f7e8dfff7f19510bc41729a9acca90c28ff8ae6cbbec6efe0781d457

SHA512
15740a761a3416e3af1e22d7be7eae56b27fc959332e9d191cb9344eeb8df531a3aca89012be67f1fbc489c715e2bc06a93de11a1a8ef4023563db70750b7b7a

Download Submit
C:\Windows\System\IBSbAFM.exe

Filesize
1.9MB

MD5
6abd7b431184fb90fb02216ec303ddce

SHA1
bf13f68aec7b31d2de65be9b20e695a1c44e1ada

SHA256
ae5443fff16965388c33217c01713477751ecb758c7c6eb819cc037c945d8583

SHA512
d6a6d30df5b11ba8ba5973ff05db9acd795e01dd02bb4e3c451aee184860d3a7020a6aa5d072ceab1ce7b4cf17f3f5ddb15e1ebd9b9a848a7e120acf4b871fee

Download Submit
C:\Windows\System\IfscfzF.exe

Filesize
1.9MB

MD5
964ecae46c9391481ba640831d0330ee

SHA1
e317b8aeb9ad476490d978d2adf1a1461b76f1ea

SHA256
909e39fb5c3b19d75a8eac260e27ee4134035bbf521c519751a2298e2887bf3f

SHA512
1d4de8fcb7bab91a5e52422a7bdbb488642447ab967505130a3c168eceb840997b6b98eef44b54563f348cd79c2e00784a44b742c3205fcd73cab0b247622037

Download Submit
C:\Windows\System\LmwUBqm.exe

Filesize
1.9MB

MD5
8321e36ed61c427dbfc652bb2d944444

SHA1
09c05a7d9e90d5050c543db00b9dbe461d9c43dd

SHA256
f7ba80de92051fc877557bf3a8a7189347f6365c3369d795f86ca030d01e75d8

SHA512
d8b06af7a3b903ecf447068c03396bc749354a3dc5d9e5554a2d4908037f0734813b812e62143f8c83231eb2527eaa47db70ba32649a9fe89f492c4ca922d88c

Download Submit
C:\Windows\System\PKYqglJ.exe

Filesize
1.9MB

MD5
2164118c277dcfeba85db760a3d5ee92

SHA1
1d4f04d77a8909a661285896b6be1f1eea4e10c4

SHA256
e0355f8fef21b3a2a78d76149751894f3e415d6b50f55df2bad7966cd19ec378

SHA512
1b5d5865d6fc54380163418bffc10c16598ffbb2bf10b53c2516ef51bd02b1f764042f72934fcf8d2c934e9c7aa7da5e35c77bf112fab44d2556f6257ef4a4cf

Download Submit
C:\Windows\System\VJwrJJF.exe

Filesize
1.9MB

MD5
8f002f84d8d30c284e0cf9eb66e93308

SHA1
3863d26da8d2107ef7e2e44cc869852c9ece9e00

SHA256
a9d910cd9159d1a194654d57ce0384e8ebce6ec5e86d6ac8f5793ff2bf725963

SHA512
ab0881711fb04fb00b88d0266034a1d8aadba0bc143c3f76652b01232f9167066ff2a45633ed8063efcd9576ad2f1b3cb2f164d997ce51a1383afa4bcac25883

Download Submit
C:\Windows\System\VMjzcow.exe

Filesize
1.9MB

MD5
b7ea8819ca3602a65bf1ca6c95d865e5

SHA1
cd8270f446fba4471c83006811c33ae9ea5690bf

SHA256
f5aae8d77a5c8d8a14c9f8a7579614012740685813ecfb3fcc7d32194b3fa068

SHA512
2ae0f269c924da5cf2f677f696a692bba6b8f055a4d19b135f5d1dee250fe9235de7178765f7707c2dcc6ee158d1c9710b84b446743494d5ca59c3785abf6c46

Download Submit
C:\Windows\System\ZzXclfI.exe

Filesize
1.9MB

MD5
736f6d9934b88afdc54a0fbcfd30ea8d

SHA1
d7b8be56a46c2a74748e7f6a919343adb1d19abe

SHA256
04c3141ee5c468ab3760fb8d8d25de9870384c9df2b2f716f7b0ba8608856cd1

SHA512
5f60cc242b71d1bb9bbac3c2d31280a243353ca6d3e6b78edd199971c3f42c239216ad3e652bb2926745e8fe176a564c8a8cf22a33de7443d0fa343d8cd3b562

Download Submit
C:\Windows\System\aKzZEJa.exe

Filesize
1.9MB

MD5
9b94736616be247f8340672b8217e163

SHA1
44aa5a43e19be85d9e7ddb1e481da34b04e986e6

SHA256
a74e1033d7dd0272a8e1d4592ff710202ee77dc3e1f9aa587e91721bc1513da5

SHA512
64e7bef3bf8befba6557c06928c5c1535e1fed834fb3ad57def40ad4ffcea5f29620d4eb3d9de79140cb8de65c4b5bddf74a0259f658162dbc1c29178473716b

Download Submit
C:\Windows\System\bIncvgA.exe

Filesize
1.9MB

MD5
118db156d0ec14d631b490c32f6564b8

SHA1
249a3e1c851b1100b418c58f37d154da7d724962

SHA256
ebc04cd5f8370b3150864814a400032271a290abdb156d3b77edf8594bbdc9b3

SHA512
2c7c16a5bb446add59dbb2b75978f4080459294610704a3fbfe32975d4fe49dbca68c7216ea1549748da744cf1a3ed95b3f360d7c9e48f864edcebe4ecd72eb5

Download Submit
C:\Windows\System\bpCQtxG.exe

Filesize
1.9MB

MD5
18328f46eecc08189cef7fe07bb5b7d7

SHA1
553b2110feb7c6139bb02ca246612ae8eae21b1b

SHA256
118c664c8e323114c46eec3fa96d2d9e1f52aa606c8f51bc2b6d790adb5e8ee0

SHA512
78e18b1df20e1926bc2dc030749e4d57f39d57ad8337cec9e3c20d65825e5ed65eac7735c3bc5fba06fec49269d4f263017c60d59d0d10a1f55895d7665b719f

Download Submit
C:\Windows\System\chKzkOe.exe

Filesize
8B

MD5
a8f2921c80c15a3d426e5fdff8a56196

SHA1
4dc21bf95e22427a9dafcd4930e81b62e77d5fda

SHA256
7e9bbeeba45dae16f8c444596ee4180d7313e899e46fa6263fde6904f32d92a1

SHA512
996666f646b1878ee129a778184f9520541ee458797b8bfaefed6e1f152a5436e0ff19d28744463b706ffe3e24e429f5af102aa1e7733dbeeb6210754c828802

Download Submit
C:\Windows\System\feefLAM.exe

Filesize
1.9MB

MD5
7a60c07e3028c0442c3ac4e7faa9d852

SHA1
8c838e01030e3656867b19f5fb5d0499200763fa

SHA256
15d775914e9036cb79e1ab44e37183beb17c0eee95f257e197360fa45c4ed71f

SHA512
ad796d35fd9f12bb9fcb75b3736aab2438788ab1ed9d7510738074b1c4a01956f26402f91f69b98318719517cea2e67e59e519b2db6ee9651f8e66fe2bc9dfd7

Download Submit
C:\Windows\System\iaGSybD.exe

Filesize
1.9MB

MD5
8f8ea2f4714cdcaae6a73d3789e05c56

SHA1
6a07525a310cb14b9ffcc3856ee7df74dde9d360

SHA256
0117088b0c6054146793c0721329a832d068be0edff6dda18ccb199dc052ce4f

SHA512
7e7c06f5857cea7134965aa33362ba05fd31a97a4cbe942da3695bbbab360ee64873231e6f46d87e259f5f5b3ed3d0eb23b93ffa50d44e458b0edf7e7ca5d39c

Download Submit
C:\Windows\System\joDmXjE.exe

Filesize
1.9MB

MD5
652d93e68c443076d7cd2cc09413491e

SHA1
53258f85e7ba1048f708bf7ffe2c0f60f9ec6be8

SHA256
99c5c0ead253142ce3d8b23a0db4fcd78eff366ba38546c4ae0f0b892b26a345

SHA512
556d3d2e8f91e4ff9a13fe42065acce05da834d951e59a1546fbbddb80d8a27576946255cec339357bfaecc50057027f8d52c218ef5c946f61b6b0407a345aae

Download Submit
C:\Windows\System\krmUKwt.exe

Filesize
1.9MB

MD5
69ba2475f2ec217b484efc1013aeefdd

SHA1
a7d6d18fc69494f9461d9a6ff67f639602964e0b

SHA256
6f3ae6d3beec45c23009f8ea58dbb56bd404a16528062fb156a52348cf9a8447

SHA512
eeba40a8bfd7f7af1dded7d6572d6ec560aa9366f46ca9d3ac47ec6185177d31e2f59c6a5558936b0e89a9798a5fd5a4332d565d9a22e39ff28149ab6ca609a0

Download Submit
C:\Windows\System\lGwvYtS.exe

Filesize
1.9MB

MD5
d2519991e38fdf47d148a811f8755bfd

SHA1
da5006e16d337fe587f5e0ad0211b9fb30c8b6b7

SHA256
faf02f98b26d159568f4898abfbcfe6484f8eacc0e390ab3c476120f18a52fe6

SHA512
1b66cb1c80dbd6c331073c76392f622f957580c3b586c9e55bccfcd1289a3aa1f655adfbb3d16e687f23567fd534fb4ea827df96e1812ec43363ac8c8fec6cf7

Download Submit
C:\Windows\System\nsBmRqB.exe

Filesize
1.9MB

MD5
6fbef5ea82900b585cfe1daa00886a0e

SHA1
f589d67a2120e2d0616c9ea70a3f381b6f19ef39

SHA256
90d6dd492a9ef45a9af0e0fae2392e0dc68f9355a868cc8c2ff9de7409d453d2

SHA512
253df082ecbec9e4f8cb7c76999e80135f1606a406b05b7e4aad3ba68272e6834143063b099fb5fc274a7e708a42264f8e24b9dad4637db1f00b68eb754fe10b

Download Submit
C:\Windows\System\oJImRuL.exe

Filesize
1.9MB

MD5
2b8dc8c7edef82435c88f0ff43e66259

SHA1
d7a97ca47b501a75573bed7a49095f62cd906cbc

SHA256
33ca2ad97fb86fc5342dc7835c057e6d29fb85c4568c551adc7510994ec48f98

SHA512
fe31cc205ab91f62e241ed65c2a1021fa8cb0d9e57e9c62c0af90d230ca07f0e958ba43565d9fdff406ba51ff6627a963552355f8b86453547bc0c7fc1dd89fd

Download Submit
C:\Windows\System\oMEmMRa.exe

Filesize
1.9MB

MD5
7c3a70e25375ce2288c33ba28f618f85

SHA1
de1784e75a3fa23355d61d27e0573e8ecf63060d

SHA256
7577ec7560729c3eed5578d3d3a24c075ecb9102afdfb8dfbd8408551e6d2eb1

SHA512
c7ba24838a6fb883de8dfdce94e867a6af35f6d99356f807ca9e24df28698b5d2f99af436d3cf750d5638ffc8d8c5da08939eb12aaa54a6ad9ab11d56c0bb614

Download Submit
C:\Windows\System\rFXJdoH.exe

Filesize
1.9MB

MD5
3b957cb822599bbeee31d9d4f8e69923

SHA1
3a93d797730cfd0296919d8af75aff6090adfe59

SHA256
61828217825934a72f548ef09176a999e550e12fd80910c3c3157a52402d2bc1

SHA512
ce1f35db4e1e5b0c4d7c7e2c6cfc31d0413fb2bd317fecf3d7435d35321b6ba31df31ad270a43cd39550bab87d3b15f3f5b40e78cedd0d3aa1578f3f4dbc9566

Download Submit
C:\Windows\System\rYvxRoB.exe

Filesize
1.9MB

MD5
c715e488a41649d3fd8defe0f9335e76

SHA1
a4b26eca1b503603447486d68b1451de0763a1de

SHA256
a718991ec519cd33ae268904e49ec0e4dc84f1ee6d1f4f3297ad3c1d407832bf

SHA512
a24e6976ac27254be7a1de36cb8ffd6da8585c2c1a98b020be63c5e88f501536bbf051f54b2122488f3d0316f1fb41ec752dcec18f62a223fd270df19e8feb6b

Download Submit
C:\Windows\System\rsobxsa.exe

Filesize
1.9MB

MD5
c1569997ea44040ee8915349c47239a7

SHA1
c092cfebd489de3b6bae185ceb579af9f1a0dfde

SHA256
d50fd910d3c91cfb12ceb62ac4923494115ebcf63e76f787e290943ce7b4d403

SHA512
df8d66fd3a90f7f29f05639926cb231abe2dce3c0094b86767cd42c398a702efa09aff7cbcac6c0227d142bc3ade99bd097123a4b22eec1b5773ac60a5311197

Download Submit
C:\Windows\System\sAydVbu.exe

Filesize
1.9MB

MD5
72e81ce57f6552d652eb650cb3831c12

SHA1
655bcb77f50bd3328c9e241e149713980d694980

SHA256
8d15a94c26f873d292c229aef4bf17b6b77c34fa87bec89ce7fb0dda42c7fbb6

SHA512
a2262d60ac64e34f987a1915c068f8fdafd7159dadce74a48edde78976ffea1dd4df7f8064ba59dc7bc22bad76696095b2338ab00fec9696798a3adf7e30bc65

Download Submit
C:\Windows\System\tONqWPO.exe

Filesize
1.9MB

MD5
5e32e0d235498ca9e8ac350a88ef93e5

SHA1
0c93260cbc90184b35cebe555f6855c0e89e77a7

SHA256
8b8b44f788dea84392c9fa710dd34241da3f1de687aa31f44ba183d4dfcb30e1

SHA512
1d6df493cc5f0232e87919976335d1c03d9794c6863a1a2c8f61c3f034d21f87b89cafc88e618b75a41fc668ba843d1f9b9831932297102d2df46f3ead5b58b8

Download Submit
C:\Windows\System\tUdbCfW.exe

Filesize
1.9MB

MD5
aab6de20c30a48cfb2694fbc9d77977a

SHA1
dad770a41458b4f6d6b3c0b10e2610da2ae10e89

SHA256
666234c9432961ff9b95120146c3f1755cd40a29a9e69f91aa215bef406980ca

SHA512
2fa74504bee22f4eba28b131cdf6fbb547a8fc47eb622014e6bc95bb6cc2234389de20e856533d40133edce99d638483fafeca5ee5fa06f4d73976f27674e9e5

Download Submit
C:\Windows\System\ufodKwj.exe

Filesize
1.9MB

MD5
ba67899436945feb9fa45fdf007f9220

SHA1
cd7e411902e15a254b1c33d33b59e828bbf03b9d

SHA256
2e1fe1c01e806da5dc5b0462fdc96c6006d7a9b587b366162a05437c79c463d8

SHA512
c78ae9756b90ff8a023d5c4ba41d3b871e9bae6280c0caed89933c92da94805e41fcdad96d2e4ce53d9a0487fed25e9d3320dfa92243c63f904a436bfafbcb65

Download Submit
C:\Windows\System\vKDphqi.exe

Filesize
1.9MB

MD5
54f5e0903eaed92f2884b3fdff960125

SHA1
5d5f3cf1d6a0e2440badced835269344fd9525c5

SHA256
b13292b5beb93f03003fb6e2e67024f53a976a9274d7b3a07c6ed37b828ba5d3

SHA512
a234547e18e23b7675fa4586a5a80c7b9e6cda962d6c6f0fd1166c10b68c8a7b23c149de3f53f47303b7057c4ed3634e6e4a552c31e8d1c79b21636178d74ab0

Download Submit
C:\Windows\System\yAHkwsI.exe

Filesize
1.9MB

MD5
a54886541e5118c0c4dccd43743b5e01

SHA1
68f93a59ae1a417ab2a6547b63bad574ff27be5f

SHA256
5f8944728a6a71d487afd4d61e2710102c5f530d1e702b61d8a9a8873ade636f

SHA512
889b981654c3036a4abfcfd5df4a3e24ab661d5f70d7bf02c9bb4827ade0371c5908947cd8051787eda482f39f6b3647bdaaea0366b33aaa4b938a03f2159bab

Download Submit
C:\Windows\System\yHMJWIK.exe

Filesize
1.9MB

MD5
eea1ea9773b1718c0942fabf6da6904c

SHA1
0744634e65aa59fa4eb89e339fffcbe53e3d0fd4

SHA256
e4d2a79565a4fec057f891aaa1dd7d981ed23ca681b6a1059ebc353889496d80

SHA512
d70eecc2273f396a645fcc11e529853c38e45c4bc1dc93c2907be0124132dc99d94fc6435f4f3ad120cea0dff42c7bb61b8ec81857766a43d0977d3eafcc135d

Download Submit
C:\Windows\System\yHXugnd.exe

Filesize
1.9MB

MD5
3b4ee50382ceef71306681fad7e4c295

SHA1
b5164248d706a81a10aac5d0ef26bbe6cb71bc5e

SHA256
08c5af3c97289a75fb1188c0db61e279548b07b31a7d6e97926073494f59a74c

SHA512
93343ea51a3f5daeeaad4310fc2660ac4fbac95075127f9cb1e0c2b8295feb08f3b55eef9d45374cad81ef04b5a049379e6e24f09970b432d14b89db8830246b

Download Submit
C:\Windows\System\yhLXzaL.exe

Filesize
1.9MB

MD5
d58ece5e08fbe6ab1feed43ef74f98ca

SHA1
ca1c3b12e7e61803ae9669b6fd5f19e732fcde34

SHA256
d42b87f70a569a111e58c05dcecb9c92bf961582a753f703731f151044378c43

SHA512
b7a9768d5a2ea5ed7a5a8d1478f0235d4be8e6ed2966af6f1e9742383e1f76d6715de428075fe7aff41bc00eea91f4c7fc76f3dfec833ad35d59618998de0866

Download Submit
memory/452-515-0x00007FF67B760000-0x00007FF67BB52000-memory.dmp

Filesize
3.9MB

Download
memory/452-4659-0x00007FF67B760000-0x00007FF67BB52000-memory.dmp

Filesize
3.9MB

Download
memory/512-4694-0x00007FF73EC20000-0x00007FF73F012000-memory.dmp

Filesize
3.9MB

Download
memory/512-551-0x00007FF73EC20000-0x00007FF73F012000-memory.dmp

Filesize
3.9MB

Download
memory/588-54-0x00007FF74B670000-0x00007FF74BA62000-memory.dmp

Filesize
3.9MB

Download
memory/728-522-0x00007FF621550000-0x00007FF621942000-memory.dmp

Filesize
3.9MB

Download
memory/728-4669-0x00007FF621550000-0x00007FF621942000-memory.dmp

Filesize
3.9MB

Download
memory/768-559-0x00007FF701AD0000-0x00007FF701EC2000-memory.dmp

Filesize
3.9MB

Download
memory/1304-10-0x00007FF685EF0000-0x00007FF6862E2000-memory.dmp

Filesize
3.9MB

Download
memory/1436-115-0x0000020C55D20000-0x0000020C55D42000-memory.dmp

Filesize
136KB

Download
memory/1436-26-0x00007FFC1B380000-0x00007FFC1BE41000-memory.dmp

Filesize
10.8MB

Download
memory/1436-28-0x0000020C6E280000-0x0000020C6E290000-memory.dmp

Filesize
64KB

Download
memory/1436-53-0x0000020C6E280000-0x0000020C6E290000-memory.dmp

Filesize
64KB

Download
memory/2020-4687-0x00007FF663C70000-0x00007FF664062000-memory.dmp

Filesize
3.9MB

Download
memory/2020-548-0x00007FF663C70000-0x00007FF664062000-memory.dmp

Filesize
3.9MB

Download
memory/2168-4646-0x00007FF732F50000-0x00007FF733342000-memory.dmp

Filesize
3.9MB

Download
memory/2168-76-0x00007FF732F50000-0x00007FF733342000-memory.dmp

Filesize
3.9MB

Download
memory/2512-544-0x00007FF683510000-0x00007FF683902000-memory.dmp

Filesize
3.9MB

Download
memory/2544-3373-0x00007FF76B700000-0x00007FF76BAF2000-memory.dmp

Filesize
3.9MB

Download
memory/2544-69-0x00007FF76B700000-0x00007FF76BAF2000-memory.dmp

Filesize
3.9MB

Download
memory/2544-4653-0x00007FF76B700000-0x00007FF76BAF2000-memory.dmp

Filesize
3.9MB

Download
memory/3184-68-0x00007FF7F5DF0000-0x00007FF7F61E2000-memory.dmp

Filesize
3.9MB

Download
memory/3184-4645-0x00007FF7F5DF0000-0x00007FF7F61E2000-memory.dmp

Filesize
3.9MB

Download
memory/3184-3722-0x00007FF7F5DF0000-0x00007FF7F61E2000-memory.dmp

Filesize
3.9MB

Download
memory/3384-518-0x00007FF77F3B0000-0x00007FF77F7A2000-memory.dmp

Filesize
3.9MB

Download
memory/3384-4664-0x00007FF77F3B0000-0x00007FF77F7A2000-memory.dmp

Filesize
3.9MB

Download
memory/3388-52-0x00007FF638F90000-0x00007FF639382000-memory.dmp

Filesize
3.9MB

Download
memory/3388-4599-0x00007FF638F90000-0x00007FF639382000-memory.dmp

Filesize
3.9MB

Download
memory/3680-81-0x00007FF6D95C0000-0x00007FF6D99B2000-memory.dmp

Filesize
3.9MB

Download
memory/3780-537-0x00007FF7F3C60000-0x00007FF7F4052000-memory.dmp

Filesize
3.9MB

Download
memory/3780-4679-0x00007FF7F3C60000-0x00007FF7F4052000-memory.dmp

Filesize
3.9MB

Download
memory/3956-4641-0x00007FF779430000-0x00007FF779822000-memory.dmp

Filesize
3.9MB

Download
memory/3956-63-0x00007FF779430000-0x00007FF779822000-memory.dmp

Filesize
3.9MB

Download
memory/3996-528-0x00007FF7478B0000-0x00007FF747CA2000-memory.dmp

Filesize
3.9MB

Download
memory/4244-0-0x00007FF6275F0000-0x00007FF6279E2000-memory.dmp

Filesize
3.9MB

Download
memory/4244-1-0x0000021D1C660000-0x0000021D1C670000-memory.dmp

Filesize
64KB

Download
memory/4332-57-0x00007FF662DF0000-0x00007FF6631E2000-memory.dmp

Filesize
3.9MB

Download
memory/4412-552-0x00007FF7FA4E0000-0x00007FF7FA8D2000-memory.dmp

Filesize
3.9MB

Download
memory/4620-32-0x00007FF7F0B40000-0x00007FF7F0F32000-memory.dmp

Filesize
3.9MB

Download
memory/4844-35-0x00007FF723DE0000-0x00007FF7241D2000-memory.dmp

Filesize
3.9MB

Download