xmrig | 47da19e0c769d17c67201e12bbccc679bad9a764477ca0232226adff5e379c2a

Analysis

max time kernel
151s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 09:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
Size

2.0MB
MD5

45885b3a7a7a7142dd5973d7df6e7021
SHA1

4fe30c2f88e9264a13c53dfbe6da6fe0c858df45
SHA256

47da19e0c769d17c67201e12bbccc679bad9a764477ca0232226adff5e379c2a
SHA512

ebacb8ca4ff98f51d5e000f9880845a7a484214e9a161610c258615e984b3113047cf587fdab6427b00b985f4024d1ee568c624a124e3ae50888faa38ec9861d
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMo:NABQ

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 46 IoCs

miner

resource	yara_rule
behavioral2/memory/2204-60-0x00007FF7118C0000-0x00007FF711CB2000-memory.dmp	xmrig
behavioral2/memory/5028-61-0x00007FF643B20000-0x00007FF643F12000-memory.dmp	xmrig
behavioral2/memory/2072-74-0x00007FF711CC0000-0x00007FF7120B2000-memory.dmp	xmrig
behavioral2/memory/2316-75-0x00007FF7D0110000-0x00007FF7D0502000-memory.dmp	xmrig
behavioral2/memory/3076-93-0x00007FF7500E0000-0x00007FF7504D2000-memory.dmp	xmrig
behavioral2/memory/3076-255-0x00007FF7500E0000-0x00007FF7504D2000-memory.dmp	xmrig
behavioral2/memory/5040-246-0x00007FF7DDB70000-0x00007FF7DDF62000-memory.dmp	xmrig
behavioral2/memory/4988-231-0x00007FF655340000-0x00007FF655732000-memory.dmp	xmrig
behavioral2/memory/2388-214-0x00007FF783A60000-0x00007FF783E52000-memory.dmp	xmrig
behavioral2/memory/3260-152-0x00007FF775670000-0x00007FF775A62000-memory.dmp	xmrig
behavioral2/memory/5104-150-0x00007FF6A5760000-0x00007FF6A5B52000-memory.dmp	xmrig
behavioral2/memory/2912-141-0x00007FF608E30000-0x00007FF609222000-memory.dmp	xmrig
behavioral2/memory/4736-135-0x00007FF739D20000-0x00007FF73A112000-memory.dmp	xmrig
behavioral2/memory/3732-127-0x00007FF747940000-0x00007FF747D32000-memory.dmp	xmrig
behavioral2/memory/4908-111-0x00007FF6C4620000-0x00007FF6C4A12000-memory.dmp	xmrig
behavioral2/memory/1188-106-0x00007FF645A30000-0x00007FF645E22000-memory.dmp	xmrig
behavioral2/memory/2816-102-0x00007FF710AC0000-0x00007FF710EB2000-memory.dmp	xmrig
behavioral2/memory/4028-97-0x00007FF718400000-0x00007FF7187F2000-memory.dmp	xmrig
behavioral2/memory/3076-283-0x00007FF7500E0000-0x00007FF7504D2000-memory.dmp	xmrig
behavioral2/memory/3316-325-0x00007FF7DA310000-0x00007FF7DA702000-memory.dmp	xmrig
behavioral2/memory/948-327-0x00007FF69BDF0000-0x00007FF69C1E2000-memory.dmp	xmrig
behavioral2/memory/4996-355-0x00007FF7AAAF0000-0x00007FF7AAEE2000-memory.dmp	xmrig
behavioral2/memory/4736-1308-0x00007FF739D20000-0x00007FF73A112000-memory.dmp	xmrig
behavioral2/memory/1188-1319-0x00007FF645A30000-0x00007FF645E22000-memory.dmp	xmrig
behavioral2/memory/3316-1322-0x00007FF7DA310000-0x00007FF7DA702000-memory.dmp	xmrig
behavioral2/memory/2912-1304-0x00007FF608E30000-0x00007FF609222000-memory.dmp	xmrig
behavioral2/memory/2204-1325-0x00007FF7118C0000-0x00007FF711CB2000-memory.dmp	xmrig
behavioral2/memory/5028-1326-0x00007FF643B20000-0x00007FF643F12000-memory.dmp	xmrig
behavioral2/memory/4996-1471-0x00007FF7AAAF0000-0x00007FF7AAEE2000-memory.dmp	xmrig
behavioral2/memory/948-1474-0x00007FF69BDF0000-0x00007FF69C1E2000-memory.dmp	xmrig
behavioral2/memory/2316-1487-0x00007FF7D0110000-0x00007FF7D0502000-memory.dmp	xmrig
behavioral2/memory/2072-1479-0x00007FF711CC0000-0x00007FF7120B2000-memory.dmp	xmrig
behavioral2/memory/5104-1609-0x00007FF6A5760000-0x00007FF6A5B52000-memory.dmp	xmrig
behavioral2/memory/2344-1625-0x00007FF7A21A0000-0x00007FF7A2592000-memory.dmp	xmrig
behavioral2/memory/2388-1637-0x00007FF783A60000-0x00007FF783E52000-memory.dmp	xmrig
behavioral2/memory/2028-1668-0x00007FF7C31F0000-0x00007FF7C35E2000-memory.dmp	xmrig
behavioral2/memory/5040-1660-0x00007FF7DDB70000-0x00007FF7DDF62000-memory.dmp	xmrig
behavioral2/memory/2524-1657-0x00007FF6718F0000-0x00007FF671CE2000-memory.dmp	xmrig
behavioral2/memory/2732-1647-0x00007FF691530000-0x00007FF691922000-memory.dmp	xmrig
behavioral2/memory/4988-1641-0x00007FF655340000-0x00007FF655732000-memory.dmp	xmrig
behavioral2/memory/3732-1624-0x00007FF747940000-0x00007FF747D32000-memory.dmp	xmrig
behavioral2/memory/4908-1629-0x00007FF6C4620000-0x00007FF6C4A12000-memory.dmp	xmrig
behavioral2/memory/3260-1611-0x00007FF775670000-0x00007FF775A62000-memory.dmp	xmrig
behavioral2/memory/2816-1607-0x00007FF710AC0000-0x00007FF710EB2000-memory.dmp	xmrig
behavioral2/memory/4028-1589-0x00007FF718400000-0x00007FF7187F2000-memory.dmp	xmrig
behavioral2/memory/3704-1549-0x00007FF6C08C0000-0x00007FF6C0CB2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
5	1448	powershell.exe
10	1448	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1448	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1188	QWmNKso.exe
4736	IrZLcrR.exe
2912	AWtWwmA.exe
3316	cLXuGKo.exe
2204	SJyBRpc.exe
5028	bQkAOoX.exe
4996	jYUlrpR.exe
948	BxxVdeV.exe
2072	xOsLYci.exe
2316	IBwjqbR.exe
3704	JRuwABq.exe
4028	TJhuNSY.exe
2816	IerlkkM.exe
4908	jAVaLcg.exe
2344	gjEFULn.exe
3732	beohMci.exe
5104	YXTkKjj.exe
3260	MVExQWB.exe
2388	UrgAfJf.exe
2524	TZWymCv.exe
2732	AeXGzIr.exe
4988	QGiXZRg.exe
5040	zpQytmh.exe
2028	TIZpxKK.exe
264	yIFAvOb.exe
4380	Peeksut.exe
3092	oVoXPhx.exe
4420	pUvCAWm.exe
4516	THRGIdx.exe
2960	pmtQNfY.exe
208	ifPUveZ.exe
644	ENXpjVf.exe
1620	WZKoxGX.exe
3912	qBltSwl.exe
1668	iYWYvSK.exe
4864	vdPxrfG.exe
2292	eeQhEKP.exe
4276	AfnJtJI.exe
1432	ENBDmJB.exe
4396	mmhRKGz.exe
4260	XDcpLyQ.exe
4464	qiAfKli.exe
2332	oyLauFV.exe
3248	AXRIMvR.exe
3864	SRlPOPo.exe
3016	nxEVgxO.exe
2236	AjOMJFo.exe
2424	wjctYJC.exe
3536	mAPMUYC.exe
332	BuofMfd.exe
5004	uAmUwyW.exe
5144	MBbvfoy.exe
5168	BVfuZwr.exe
5200	ivduwYF.exe
5480	fkXeqFD.exe
5516	TgtKnOs.exe
5544	hUUSiVV.exe
5592	MlFvtPK.exe
5716	PTQIqkY.exe
5772	EKDAPED.exe
5820	xYjRIgS.exe
5848	RAqpAnE.exe
5876	PRRJart.exe
5908	hcMNeJl.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3076-0-0x00007FF7500E0000-0x00007FF7504D2000-memory.dmp	upx
behavioral2/files/0x0008000000023268-5.dat	upx
behavioral2/memory/1188-10-0x00007FF645A30000-0x00007FF645E22000-memory.dmp	upx
behavioral2/files/0x000800000002326b-11.dat	upx
behavioral2/files/0x000800000002326e-8.dat	upx
behavioral2/memory/4736-12-0x00007FF739D20000-0x00007FF73A112000-memory.dmp	upx
behavioral2/memory/2912-19-0x00007FF608E30000-0x00007FF609222000-memory.dmp	upx
behavioral2/files/0x0008000000023270-24.dat	upx
behavioral2/files/0x000800000002326c-29.dat	upx
behavioral2/memory/3316-30-0x00007FF7DA310000-0x00007FF7DA702000-memory.dmp	upx
behavioral2/files/0x0007000000023271-40.dat	upx
behavioral2/files/0x0007000000023274-50.dat	upx
behavioral2/files/0x0008000000023273-53.dat	upx
behavioral2/memory/4996-58-0x00007FF7AAAF0000-0x00007FF7AAEE2000-memory.dmp	upx
behavioral2/memory/2204-60-0x00007FF7118C0000-0x00007FF711CB2000-memory.dmp	upx
behavioral2/memory/5028-61-0x00007FF643B20000-0x00007FF643F12000-memory.dmp	upx
behavioral2/memory/948-59-0x00007FF69BDF0000-0x00007FF69C1E2000-memory.dmp	upx
behavioral2/files/0x0008000000023272-62.dat	upx
behavioral2/files/0x0007000000023275-70.dat	upx
behavioral2/memory/2072-74-0x00007FF711CC0000-0x00007FF7120B2000-memory.dmp	upx
behavioral2/memory/2316-75-0x00007FF7D0110000-0x00007FF7D0502000-memory.dmp	upx
behavioral2/files/0x0007000000023276-78.dat	upx
behavioral2/memory/3704-81-0x00007FF6C08C0000-0x00007FF6C0CB2000-memory.dmp	upx
behavioral2/files/0x0007000000023278-87.dat	upx
behavioral2/memory/3076-93-0x00007FF7500E0000-0x00007FF7504D2000-memory.dmp	upx
behavioral2/files/0x0007000000023279-95.dat	upx
behavioral2/files/0x000700000002327c-103.dat	upx
behavioral2/files/0x000700000002327b-119.dat	upx
behavioral2/files/0x0007000000023280-131.dat	upx
behavioral2/files/0x0007000000023282-136.dat	upx
behavioral2/files/0x0007000000023285-151.dat	upx
behavioral2/files/0x0007000000023286-157.dat	upx
behavioral2/memory/3076-255-0x00007FF7500E0000-0x00007FF7504D2000-memory.dmp	upx
behavioral2/memory/5040-246-0x00007FF7DDB70000-0x00007FF7DDF62000-memory.dmp	upx
behavioral2/memory/4988-231-0x00007FF655340000-0x00007FF655732000-memory.dmp	upx
behavioral2/memory/2388-214-0x00007FF783A60000-0x00007FF783E52000-memory.dmp	upx
behavioral2/memory/2028-211-0x00007FF7C31F0000-0x00007FF7C35E2000-memory.dmp	upx
behavioral2/files/0x0007000000023287-205.dat	upx
behavioral2/files/0x000700000002328f-204.dat	upx
behavioral2/files/0x000700000002328b-202.dat	upx
behavioral2/files/0x000700000002328a-198.dat	upx
behavioral2/files/0x0007000000023284-196.dat	upx
behavioral2/files/0x000700000002328e-194.dat	upx
behavioral2/files/0x0007000000023283-191.dat	upx
behavioral2/files/0x000700000002328d-189.dat	upx
behavioral2/files/0x0007000000023288-208.dat	upx
behavioral2/memory/2732-172-0x00007FF691530000-0x00007FF691922000-memory.dmp	upx
behavioral2/files/0x000700000002328c-182.dat	upx
behavioral2/files/0x0007000000023289-165.dat	upx
behavioral2/memory/2524-162-0x00007FF6718F0000-0x00007FF671CE2000-memory.dmp	upx
behavioral2/memory/3260-152-0x00007FF775670000-0x00007FF775A62000-memory.dmp	upx
behavioral2/memory/5104-150-0x00007FF6A5760000-0x00007FF6A5B52000-memory.dmp	upx
behavioral2/files/0x0007000000023281-148.dat	upx
behavioral2/memory/2912-141-0x00007FF608E30000-0x00007FF609222000-memory.dmp	upx
behavioral2/files/0x000700000002327f-139.dat	upx
behavioral2/memory/4736-135-0x00007FF739D20000-0x00007FF73A112000-memory.dmp	upx
behavioral2/memory/3732-127-0x00007FF747940000-0x00007FF747D32000-memory.dmp	upx
behavioral2/files/0x000700000002327d-123.dat	upx
behavioral2/files/0x000700000002327e-117.dat	upx
behavioral2/memory/2344-114-0x00007FF7A21A0000-0x00007FF7A2592000-memory.dmp	upx
behavioral2/memory/4908-111-0x00007FF6C4620000-0x00007FF6C4A12000-memory.dmp	upx
behavioral2/memory/1188-106-0x00007FF645A30000-0x00007FF645E22000-memory.dmp	upx
behavioral2/memory/2816-102-0x00007FF710AC0000-0x00007FF710EB2000-memory.dmp	upx
behavioral2/memory/4028-97-0x00007FF718400000-0x00007FF7187F2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com
5	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\rWdsNxY.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\GeDERGS.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\dsBSydf.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\GCmRJyj.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\FKdfrhP.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\YXGiaIU.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\pfeqpxN.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\jsfcqmA.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\nlsbplF.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\FotHALe.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\MtbQhuR.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\jRrQMIO.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\aAPvZKc.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\GjcwuZE.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\AXofYta.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\kuYKvnF.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\sdnljUD.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\xaLmYYW.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\EgDVrca.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\rlQeERg.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\jeJEnFo.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\EtKsoSB.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\dUUdSCE.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\nxEVgxO.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\PwcRhgN.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\iwBxbuu.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\CyYfCPD.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\CkJXAJH.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\zpQytmh.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\OvTJgKZ.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\BBXBAGc.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\fsNImfg.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\sunJuVz.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\SibESlK.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\WLvKZQW.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\dyWOIAz.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\FOnxfjY.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\wLQrhsh.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\cLXuGKo.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\hJbbuul.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\HOvZwyd.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\ZGoMKZi.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\kcAXORR.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\JqgLqrw.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\EKDAPED.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\osuZsDD.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\YsUsqhs.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\vKYUrlZ.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\BuofMfd.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\hUUSiVV.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\gjEFULn.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\mbppgFL.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\CLcqFgl.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\LAhwXBQ.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\eRFBvJP.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\cihMlPD.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\VcFTrYZ.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\ovJykQm.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\IDMpwmO.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\nGJyvFZ.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\DwcjJaR.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\fJPXpQM.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\yXFbSRv.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
File created	C:\Windows\System\kHHOPpp.exe	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
Token: SeDebugPrivilege	1448	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3076 wrote to memory of 1448	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	92
PID 3076 wrote to memory of 1448	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	92
PID 3076 wrote to memory of 1188	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	93
PID 3076 wrote to memory of 1188	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	93
PID 3076 wrote to memory of 4736	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	94
PID 3076 wrote to memory of 4736	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	94
PID 3076 wrote to memory of 2912	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	95
PID 3076 wrote to memory of 2912	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	95
PID 3076 wrote to memory of 3316	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	96
PID 3076 wrote to memory of 3316	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	96
PID 3076 wrote to memory of 2204	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	97
PID 3076 wrote to memory of 2204	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	97
PID 3076 wrote to memory of 5028	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	98
PID 3076 wrote to memory of 5028	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	98
PID 3076 wrote to memory of 4996	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	99
PID 3076 wrote to memory of 4996	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	99
PID 3076 wrote to memory of 948	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	100
PID 3076 wrote to memory of 948	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	100
PID 3076 wrote to memory of 2072	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	101
PID 3076 wrote to memory of 2072	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	101
PID 3076 wrote to memory of 2316	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	102
PID 3076 wrote to memory of 2316	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	102
PID 3076 wrote to memory of 3704	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	103
PID 3076 wrote to memory of 3704	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	103
PID 3076 wrote to memory of 4028	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	104
PID 3076 wrote to memory of 4028	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	104
PID 3076 wrote to memory of 2816	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	105
PID 3076 wrote to memory of 2816	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	105
PID 3076 wrote to memory of 4908	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	106
PID 3076 wrote to memory of 4908	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	106
PID 3076 wrote to memory of 2344	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	107
PID 3076 wrote to memory of 2344	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	107
PID 3076 wrote to memory of 3732	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	108
PID 3076 wrote to memory of 3732	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	108
PID 3076 wrote to memory of 5104	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	109
PID 3076 wrote to memory of 5104	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	109
PID 3076 wrote to memory of 3260	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	110
PID 3076 wrote to memory of 3260	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	110
PID 3076 wrote to memory of 2388	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	111
PID 3076 wrote to memory of 2388	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	111
PID 3076 wrote to memory of 2524	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	112
PID 3076 wrote to memory of 2524	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	112
PID 3076 wrote to memory of 2732	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	113
PID 3076 wrote to memory of 2732	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	113
PID 3076 wrote to memory of 4988	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	114
PID 3076 wrote to memory of 4988	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	114
PID 3076 wrote to memory of 5040	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	115
PID 3076 wrote to memory of 5040	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	115
PID 3076 wrote to memory of 2028	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	116
PID 3076 wrote to memory of 2028	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	116
PID 3076 wrote to memory of 264	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	117
PID 3076 wrote to memory of 264	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	117
PID 3076 wrote to memory of 4380	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	118
PID 3076 wrote to memory of 4380	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	118
PID 3076 wrote to memory of 3092	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	119
PID 3076 wrote to memory of 3092	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	119
PID 3076 wrote to memory of 4420	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	120
PID 3076 wrote to memory of 4420	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	120
PID 3076 wrote to memory of 4516	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	121
PID 3076 wrote to memory of 4516	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	121
PID 3076 wrote to memory of 2960	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	122
PID 3076 wrote to memory of 2960	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	122
PID 3076 wrote to memory of 208	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	123
PID 3076 wrote to memory of 208	3076	45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe	123

C:\Users\Admin\AppData\Local\Temp\45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\45885b3a7a7a7142dd5973d7df6e7021_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1448
- C:\Windows\System\QWmNKso.exe
  C:\Windows\System\QWmNKso.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\IrZLcrR.exe
  C:\Windows\System\IrZLcrR.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\AWtWwmA.exe
  C:\Windows\System\AWtWwmA.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\cLXuGKo.exe
  C:\Windows\System\cLXuGKo.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System\SJyBRpc.exe
  C:\Windows\System\SJyBRpc.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\bQkAOoX.exe
  C:\Windows\System\bQkAOoX.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\jYUlrpR.exe
  C:\Windows\System\jYUlrpR.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\BxxVdeV.exe
  C:\Windows\System\BxxVdeV.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\xOsLYci.exe
  C:\Windows\System\xOsLYci.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\IBwjqbR.exe
  C:\Windows\System\IBwjqbR.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\JRuwABq.exe
  C:\Windows\System\JRuwABq.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\TJhuNSY.exe
  C:\Windows\System\TJhuNSY.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\IerlkkM.exe
  C:\Windows\System\IerlkkM.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\jAVaLcg.exe
  C:\Windows\System\jAVaLcg.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\gjEFULn.exe
  C:\Windows\System\gjEFULn.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\beohMci.exe
  C:\Windows\System\beohMci.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\YXTkKjj.exe
  C:\Windows\System\YXTkKjj.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\MVExQWB.exe
  C:\Windows\System\MVExQWB.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\UrgAfJf.exe
  C:\Windows\System\UrgAfJf.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\TZWymCv.exe
  C:\Windows\System\TZWymCv.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\AeXGzIr.exe
  C:\Windows\System\AeXGzIr.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\QGiXZRg.exe
  C:\Windows\System\QGiXZRg.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\zpQytmh.exe
  C:\Windows\System\zpQytmh.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\TIZpxKK.exe
  C:\Windows\System\TIZpxKK.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\yIFAvOb.exe
  C:\Windows\System\yIFAvOb.exe
  2⤵
  - Executes dropped EXE
  PID:264
- C:\Windows\System\Peeksut.exe
  C:\Windows\System\Peeksut.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\oVoXPhx.exe
  C:\Windows\System\oVoXPhx.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\pUvCAWm.exe
  C:\Windows\System\pUvCAWm.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\THRGIdx.exe
  C:\Windows\System\THRGIdx.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\pmtQNfY.exe
  C:\Windows\System\pmtQNfY.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\ifPUveZ.exe
  C:\Windows\System\ifPUveZ.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\ENXpjVf.exe
  C:\Windows\System\ENXpjVf.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\WZKoxGX.exe
  C:\Windows\System\WZKoxGX.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\qBltSwl.exe
  C:\Windows\System\qBltSwl.exe
  2⤵
  - Executes dropped EXE
  PID:3912
- C:\Windows\System\iYWYvSK.exe
  C:\Windows\System\iYWYvSK.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\vdPxrfG.exe
  C:\Windows\System\vdPxrfG.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\eeQhEKP.exe
  C:\Windows\System\eeQhEKP.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\AfnJtJI.exe
  C:\Windows\System\AfnJtJI.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\ENBDmJB.exe
  C:\Windows\System\ENBDmJB.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\mmhRKGz.exe
  C:\Windows\System\mmhRKGz.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\XDcpLyQ.exe
  C:\Windows\System\XDcpLyQ.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\qiAfKli.exe
  C:\Windows\System\qiAfKli.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\oyLauFV.exe
  C:\Windows\System\oyLauFV.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\AXRIMvR.exe
  C:\Windows\System\AXRIMvR.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\SRlPOPo.exe
  C:\Windows\System\SRlPOPo.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System\nxEVgxO.exe
  C:\Windows\System\nxEVgxO.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\AjOMJFo.exe
  C:\Windows\System\AjOMJFo.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\wjctYJC.exe
  C:\Windows\System\wjctYJC.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\mAPMUYC.exe
  C:\Windows\System\mAPMUYC.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\BuofMfd.exe
  C:\Windows\System\BuofMfd.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\uAmUwyW.exe
  C:\Windows\System\uAmUwyW.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\MBbvfoy.exe
  C:\Windows\System\MBbvfoy.exe
  2⤵
  - Executes dropped EXE
  PID:5144
- C:\Windows\System\BVfuZwr.exe
  C:\Windows\System\BVfuZwr.exe
  2⤵
  - Executes dropped EXE
  PID:5168
- C:\Windows\System\ivduwYF.exe
  C:\Windows\System\ivduwYF.exe
  2⤵
  - Executes dropped EXE
  PID:5200
- C:\Windows\System\fkXeqFD.exe
  C:\Windows\System\fkXeqFD.exe
  2⤵
  - Executes dropped EXE
  PID:5480
- C:\Windows\System\TgtKnOs.exe
  C:\Windows\System\TgtKnOs.exe
  2⤵
  - Executes dropped EXE
  PID:5516
- C:\Windows\System\hUUSiVV.exe
  C:\Windows\System\hUUSiVV.exe
  2⤵
  - Executes dropped EXE
  PID:5544
- C:\Windows\System\MlFvtPK.exe
  C:\Windows\System\MlFvtPK.exe
  2⤵
  - Executes dropped EXE
  PID:5592
- C:\Windows\System\PTQIqkY.exe
  C:\Windows\System\PTQIqkY.exe
  2⤵
  - Executes dropped EXE
  PID:5716
- C:\Windows\System\EKDAPED.exe
  C:\Windows\System\EKDAPED.exe
  2⤵
  - Executes dropped EXE
  PID:5772
- C:\Windows\System\xYjRIgS.exe
  C:\Windows\System\xYjRIgS.exe
  2⤵
  - Executes dropped EXE
  PID:5820
- C:\Windows\System\RAqpAnE.exe
  C:\Windows\System\RAqpAnE.exe
  2⤵
  - Executes dropped EXE
  PID:5848
- C:\Windows\System\PRRJart.exe
  C:\Windows\System\PRRJart.exe
  2⤵
  - Executes dropped EXE
  PID:5876
- C:\Windows\System\hcMNeJl.exe
  C:\Windows\System\hcMNeJl.exe
  2⤵
  - Executes dropped EXE
  PID:5908
- C:\Windows\System\NsfjbDK.exe
  C:\Windows\System\NsfjbDK.exe
  2⤵
  PID:5940
- C:\Windows\System\wtRFUzW.exe
  C:\Windows\System\wtRFUzW.exe
  2⤵
  PID:5968
- C:\Windows\System\PwcRhgN.exe
  C:\Windows\System\PwcRhgN.exe
  2⤵
  PID:5992
- C:\Windows\System\YHnLYTJ.exe
  C:\Windows\System\YHnLYTJ.exe
  2⤵
  PID:6052
- C:\Windows\System\lNKLyvd.exe
  C:\Windows\System\lNKLyvd.exe
  2⤵
  PID:6088
- C:\Windows\System\NnlWYhq.exe
  C:\Windows\System\NnlWYhq.exe
  2⤵
  PID:6112
- C:\Windows\System\bdawrfc.exe
  C:\Windows\System\bdawrfc.exe
  2⤵
  PID:2156
- C:\Windows\System\RzoictY.exe
  C:\Windows\System\RzoictY.exe
  2⤵
  PID:1104
- C:\Windows\System\olckiQg.exe
  C:\Windows\System\olckiQg.exe
  2⤵
  PID:2668
- C:\Windows\System\sYAWVWN.exe
  C:\Windows\System\sYAWVWN.exe
  2⤵
  PID:4448
- C:\Windows\System\egOZmRg.exe
  C:\Windows\System\egOZmRg.exe
  2⤵
  PID:4400
- C:\Windows\System\CtniidC.exe
  C:\Windows\System\CtniidC.exe
  2⤵
  PID:5192
- C:\Windows\System\saXvsHW.exe
  C:\Windows\System\saXvsHW.exe
  2⤵
  PID:5332
- C:\Windows\System\GygShZt.exe
  C:\Windows\System\GygShZt.exe
  2⤵
  PID:4664
- C:\Windows\System\sdnljUD.exe
  C:\Windows\System\sdnljUD.exe
  2⤵
  PID:2468
- C:\Windows\System\gkOZdYB.exe
  C:\Windows\System\gkOZdYB.exe
  2⤵
  PID:1932
- C:\Windows\System\FKdfrhP.exe
  C:\Windows\System\FKdfrhP.exe
  2⤵
  PID:1692
- C:\Windows\System\QPqilMn.exe
  C:\Windows\System\QPqilMn.exe
  2⤵
  PID:4860
- C:\Windows\System\tTiBDjU.exe
  C:\Windows\System\tTiBDjU.exe
  2⤵
  PID:2216
- C:\Windows\System\BEOauRU.exe
  C:\Windows\System\BEOauRU.exe
  2⤵
  PID:2828
- C:\Windows\System\eUkKgrO.exe
  C:\Windows\System\eUkKgrO.exe
  2⤵
  PID:3220
- C:\Windows\System\lCdnThI.exe
  C:\Windows\System\lCdnThI.exe
  2⤵
  PID:5108
- C:\Windows\System\EwUHCoe.exe
  C:\Windows\System\EwUHCoe.exe
  2⤵
  PID:1360
- C:\Windows\System\vqBWtLz.exe
  C:\Windows\System\vqBWtLz.exe
  2⤵
  PID:5448
- C:\Windows\System\mQPveKH.exe
  C:\Windows\System\mQPveKH.exe
  2⤵
  PID:5468
- C:\Windows\System\QqwAJUk.exe
  C:\Windows\System\QqwAJUk.exe
  2⤵
  PID:2556
- C:\Windows\System\TtaoCYa.exe
  C:\Windows\System\TtaoCYa.exe
  2⤵
  PID:4652
- C:\Windows\System\SibESlK.exe
  C:\Windows\System\SibESlK.exe
  2⤵
  PID:4372
- C:\Windows\System\MtbQhuR.exe
  C:\Windows\System\MtbQhuR.exe
  2⤵
  PID:1092
- C:\Windows\System\NJLiplY.exe
  C:\Windows\System\NJLiplY.exe
  2⤵
  PID:1144
- C:\Windows\System\KqfxVqu.exe
  C:\Windows\System\KqfxVqu.exe
  2⤵
  PID:5492
- C:\Windows\System\oIRQANO.exe
  C:\Windows\System\oIRQANO.exe
  2⤵
  PID:5540
- C:\Windows\System\AvraAeG.exe
  C:\Windows\System\AvraAeG.exe
  2⤵
  PID:5620
- C:\Windows\System\YsuEFbI.exe
  C:\Windows\System\YsuEFbI.exe
  2⤵
  PID:5624
- C:\Windows\System\LzGhriB.exe
  C:\Windows\System\LzGhriB.exe
  2⤵
  PID:5648
- C:\Windows\System\EuYCXqk.exe
  C:\Windows\System\EuYCXqk.exe
  2⤵
  PID:5676
- C:\Windows\System\qcwHnfI.exe
  C:\Windows\System\qcwHnfI.exe
  2⤵
  PID:5704
- C:\Windows\System\LaQceXs.exe
  C:\Windows\System\LaQceXs.exe
  2⤵
  PID:5728
- C:\Windows\System\QfVdGpK.exe
  C:\Windows\System\QfVdGpK.exe
  2⤵
  PID:5784
- C:\Windows\System\xJYXwAB.exe
  C:\Windows\System\xJYXwAB.exe
  2⤵
  PID:5788
- C:\Windows\System\KrmYJJV.exe
  C:\Windows\System\KrmYJJV.exe
  2⤵
  PID:5844
- C:\Windows\System\ShWyWcm.exe
  C:\Windows\System\ShWyWcm.exe
  2⤵
  PID:5884
- C:\Windows\System\eshellX.exe
  C:\Windows\System\eshellX.exe
  2⤵
  PID:5920
- C:\Windows\System\vNwWxge.exe
  C:\Windows\System\vNwWxge.exe
  2⤵
  PID:5976
- C:\Windows\System\Fxmqeko.exe
  C:\Windows\System\Fxmqeko.exe
  2⤵
  PID:5808
- C:\Windows\System\OZyPWZq.exe
  C:\Windows\System\OZyPWZq.exe
  2⤵
  PID:5924
- C:\Windows\System\pupAObZ.exe
  C:\Windows\System\pupAObZ.exe
  2⤵
  PID:5800
- C:\Windows\System\tIccfUV.exe
  C:\Windows\System\tIccfUV.exe
  2⤵
  PID:6124
- C:\Windows\System\kLYgLHq.exe
  C:\Windows\System\kLYgLHq.exe
  2⤵
  PID:1068
- C:\Windows\System\bonuQsV.exe
  C:\Windows\System\bonuQsV.exe
  2⤵
  PID:4572
- C:\Windows\System\WBpjzSF.exe
  C:\Windows\System\WBpjzSF.exe
  2⤵
  PID:3232
- C:\Windows\System\qYvwywY.exe
  C:\Windows\System\qYvwywY.exe
  2⤵
  PID:3080
- C:\Windows\System\ECzevri.exe
  C:\Windows\System\ECzevri.exe
  2⤵
  PID:4180
- C:\Windows\System\lXDSAma.exe
  C:\Windows\System\lXDSAma.exe
  2⤵
  PID:5576
- C:\Windows\System\gYVOjyH.exe
  C:\Windows\System\gYVOjyH.exe
  2⤵
  PID:5816
- C:\Windows\System\SPdQaJs.exe
  C:\Windows\System\SPdQaJs.exe
  2⤵
  PID:6000
- C:\Windows\System\RfgHFxg.exe
  C:\Windows\System\RfgHFxg.exe
  2⤵
  PID:5752
- C:\Windows\System\GAaXfVJ.exe
  C:\Windows\System\GAaXfVJ.exe
  2⤵
  PID:2356
- C:\Windows\System\yiywrXB.exe
  C:\Windows\System\yiywrXB.exe
  2⤵
  PID:2224
- C:\Windows\System\LuokJOP.exe
  C:\Windows\System\LuokJOP.exe
  2⤵
  PID:1636
- C:\Windows\System\coyAYvb.exe
  C:\Windows\System\coyAYvb.exe
  2⤵
  PID:6128
- C:\Windows\System\gqmmHAP.exe
  C:\Windows\System\gqmmHAP.exe
  2⤵
  PID:6084
- C:\Windows\System\ZUhrLAv.exe
  C:\Windows\System\ZUhrLAv.exe
  2⤵
  PID:5296
- C:\Windows\System\VzQUQKk.exe
  C:\Windows\System\VzQUQKk.exe
  2⤵
  PID:3164
- C:\Windows\System\xaLmYYW.exe
  C:\Windows\System\xaLmYYW.exe
  2⤵
  PID:2300
- C:\Windows\System\cpnCyYK.exe
  C:\Windows\System\cpnCyYK.exe
  2⤵
  PID:5496
- C:\Windows\System\fBVPRah.exe
  C:\Windows\System\fBVPRah.exe
  2⤵
  PID:2596
- C:\Windows\System\mQkyKzc.exe
  C:\Windows\System\mQkyKzc.exe
  2⤵
  PID:2504
- C:\Windows\System\NeBMiYD.exe
  C:\Windows\System\NeBMiYD.exe
  2⤵
  PID:6036
- C:\Windows\System\tRjWrkH.exe
  C:\Windows\System\tRjWrkH.exe
  2⤵
  PID:3868
- C:\Windows\System\GZbJzaw.exe
  C:\Windows\System\GZbJzaw.exe
  2⤵
  PID:2032
- C:\Windows\System\OwbuOVc.exe
  C:\Windows\System\OwbuOVc.exe
  2⤵
  PID:5112
- C:\Windows\System\yXohser.exe
  C:\Windows\System\yXohser.exe
  2⤵
  PID:3516
- C:\Windows\System\ZhqprlN.exe
  C:\Windows\System\ZhqprlN.exe
  2⤵
  PID:1164
- C:\Windows\System\ZGoMKZi.exe
  C:\Windows\System\ZGoMKZi.exe
  2⤵
  PID:6160
- C:\Windows\System\ZBESWVe.exe
  C:\Windows\System\ZBESWVe.exe
  2⤵
  PID:6184
- C:\Windows\System\ZziggOn.exe
  C:\Windows\System\ZziggOn.exe
  2⤵
  PID:6200
- C:\Windows\System\cUYvspY.exe
  C:\Windows\System\cUYvspY.exe
  2⤵
  PID:6220
- C:\Windows\System\DAxKWzt.exe
  C:\Windows\System\DAxKWzt.exe
  2⤵
  PID:6244
- C:\Windows\System\pHcQJrX.exe
  C:\Windows\System\pHcQJrX.exe
  2⤵
  PID:6264
- C:\Windows\System\cdSsERI.exe
  C:\Windows\System\cdSsERI.exe
  2⤵
  PID:6296
- C:\Windows\System\gemTwHO.exe
  C:\Windows\System\gemTwHO.exe
  2⤵
  PID:6316
- C:\Windows\System\oxyBpZg.exe
  C:\Windows\System\oxyBpZg.exe
  2⤵
  PID:6344
- C:\Windows\System\NThYbeq.exe
  C:\Windows\System\NThYbeq.exe
  2⤵
  PID:6364
- C:\Windows\System\ZnHyjSA.exe
  C:\Windows\System\ZnHyjSA.exe
  2⤵
  PID:6384
- C:\Windows\System\FhrHKLW.exe
  C:\Windows\System\FhrHKLW.exe
  2⤵
  PID:6412
- C:\Windows\System\fybCEIR.exe
  C:\Windows\System\fybCEIR.exe
  2⤵
  PID:6432
- C:\Windows\System\guSODoR.exe
  C:\Windows\System\guSODoR.exe
  2⤵
  PID:6448
- C:\Windows\System\BkQrxpx.exe
  C:\Windows\System\BkQrxpx.exe
  2⤵
  PID:6472
- C:\Windows\System\mYsEkOb.exe
  C:\Windows\System\mYsEkOb.exe
  2⤵
  PID:6496
- C:\Windows\System\izCYcUW.exe
  C:\Windows\System\izCYcUW.exe
  2⤵
  PID:6520
- C:\Windows\System\BsWikml.exe
  C:\Windows\System\BsWikml.exe
  2⤵
  PID:6540
- C:\Windows\System\VuHtBrg.exe
  C:\Windows\System\VuHtBrg.exe
  2⤵
  PID:6564
- C:\Windows\System\AlkJgFW.exe
  C:\Windows\System\AlkJgFW.exe
  2⤵
  PID:6580
- C:\Windows\System\ZGWcpdZ.exe
  C:\Windows\System\ZGWcpdZ.exe
  2⤵
  PID:6604
- C:\Windows\System\UbwCQmu.exe
  C:\Windows\System\UbwCQmu.exe
  2⤵
  PID:6624
- C:\Windows\System\tNXWrQz.exe
  C:\Windows\System\tNXWrQz.exe
  2⤵
  PID:6652
- C:\Windows\System\SMpjPNa.exe
  C:\Windows\System\SMpjPNa.exe
  2⤵
  PID:6672
- C:\Windows\System\eJIteGn.exe
  C:\Windows\System\eJIteGn.exe
  2⤵
  PID:6688
- C:\Windows\System\ragBMyA.exe
  C:\Windows\System\ragBMyA.exe
  2⤵
  PID:6712
- C:\Windows\System\yNpzHRF.exe
  C:\Windows\System\yNpzHRF.exe
  2⤵
  PID:6732
- C:\Windows\System\BlVEbvp.exe
  C:\Windows\System\BlVEbvp.exe
  2⤵
  PID:6752
- C:\Windows\System\aGAozcZ.exe
  C:\Windows\System\aGAozcZ.exe
  2⤵
  PID:6776
- C:\Windows\System\kbJlxti.exe
  C:\Windows\System\kbJlxti.exe
  2⤵
  PID:6796
- C:\Windows\System\bszcnnv.exe
  C:\Windows\System\bszcnnv.exe
  2⤵
  PID:6816
- C:\Windows\System\jRrQMIO.exe
  C:\Windows\System\jRrQMIO.exe
  2⤵
  PID:6836
- C:\Windows\System\ZtuVyFM.exe
  C:\Windows\System\ZtuVyFM.exe
  2⤵
  PID:6860
- C:\Windows\System\BLDRqUB.exe
  C:\Windows\System\BLDRqUB.exe
  2⤵
  PID:6880
- C:\Windows\System\QwyVhFD.exe
  C:\Windows\System\QwyVhFD.exe
  2⤵
  PID:6900
- C:\Windows\System\fJPXpQM.exe
  C:\Windows\System\fJPXpQM.exe
  2⤵
  PID:6924
- C:\Windows\System\mYnyDLL.exe
  C:\Windows\System\mYnyDLL.exe
  2⤵
  PID:6940
- C:\Windows\System\SyGnwgw.exe
  C:\Windows\System\SyGnwgw.exe
  2⤵
  PID:6968
- C:\Windows\System\BmyhbUt.exe
  C:\Windows\System\BmyhbUt.exe
  2⤵
  PID:6984
- C:\Windows\System\mMHVWsx.exe
  C:\Windows\System\mMHVWsx.exe
  2⤵
  PID:7004
- C:\Windows\System\ixGAZKf.exe
  C:\Windows\System\ixGAZKf.exe
  2⤵
  PID:7024
- C:\Windows\System\EMCiZmv.exe
  C:\Windows\System\EMCiZmv.exe
  2⤵
  PID:7048
- C:\Windows\System\DtZqICY.exe
  C:\Windows\System\DtZqICY.exe
  2⤵
  PID:7072
- C:\Windows\System\umxzSlh.exe
  C:\Windows\System\umxzSlh.exe
  2⤵
  PID:7092
- C:\Windows\System\WJOwFBM.exe
  C:\Windows\System\WJOwFBM.exe
  2⤵
  PID:7116
- C:\Windows\System\GYDOPFn.exe
  C:\Windows\System\GYDOPFn.exe
  2⤵
  PID:7140
- C:\Windows\System\flLNMLt.exe
  C:\Windows\System\flLNMLt.exe
  2⤵
  PID:7164
- C:\Windows\System\gNFGXLk.exe
  C:\Windows\System\gNFGXLk.exe
  2⤵
  PID:5164
- C:\Windows\System\avQYCuG.exe
  C:\Windows\System\avQYCuG.exe
  2⤵
  PID:6168
- C:\Windows\System\ijdBvqw.exe
  C:\Windows\System\ijdBvqw.exe
  2⤵
  PID:6236
- C:\Windows\System\cRLTDik.exe
  C:\Windows\System\cRLTDik.exe
  2⤵
  PID:5444
- C:\Windows\System\akZvgfP.exe
  C:\Windows\System\akZvgfP.exe
  2⤵
  PID:6336
- C:\Windows\System\RIYVpIj.exe
  C:\Windows\System\RIYVpIj.exe
  2⤵
  PID:6424
- C:\Windows\System\yYqxJeg.exe
  C:\Windows\System\yYqxJeg.exe
  2⤵
  PID:6464
- C:\Windows\System\XYTWyrc.exe
  C:\Windows\System\XYTWyrc.exe
  2⤵
  PID:6260
- C:\Windows\System\UDbqHcy.exe
  C:\Windows\System\UDbqHcy.exe
  2⤵
  PID:6288
- C:\Windows\System\TojJzAS.exe
  C:\Windows\System\TojJzAS.exe
  2⤵
  PID:6352
- C:\Windows\System\jMghhko.exe
  C:\Windows\System\jMghhko.exe
  2⤵
  PID:6400
- C:\Windows\System\lxNAsOf.exe
  C:\Windows\System\lxNAsOf.exe
  2⤵
  PID:6444
- C:\Windows\System\kcAXORR.exe
  C:\Windows\System\kcAXORR.exe
  2⤵
  PID:6700
- C:\Windows\System\TmcHwwS.exe
  C:\Windows\System\TmcHwwS.exe
  2⤵
  PID:6792
- C:\Windows\System\UStVCkj.exe
  C:\Windows\System\UStVCkj.exe
  2⤵
  PID:6392
- C:\Windows\System\LVXUXvl.exe
  C:\Windows\System\LVXUXvl.exe
  2⤵
  PID:6956
- C:\Windows\System\yFJzLEB.exe
  C:\Windows\System\yFJzLEB.exe
  2⤵
  PID:3068
- C:\Windows\System\UdLrFar.exe
  C:\Windows\System\UdLrFar.exe
  2⤵
  PID:7044
- C:\Windows\System\udRPUwH.exe
  C:\Windows\System\udRPUwH.exe
  2⤵
  PID:7108
- C:\Windows\System\DHCBdZo.exe
  C:\Windows\System\DHCBdZo.exe
  2⤵
  PID:6768
- C:\Windows\System\BWzhPmV.exe
  C:\Windows\System\BWzhPmV.exe
  2⤵
  PID:6852
- C:\Windows\System\tLTYqYo.exe
  C:\Windows\System\tLTYqYo.exe
  2⤵
  PID:7176
- C:\Windows\System\zJFyYDe.exe
  C:\Windows\System\zJFyYDe.exe
  2⤵
  PID:7200
- C:\Windows\System\SwbJisL.exe
  C:\Windows\System\SwbJisL.exe
  2⤵
  PID:7220
- C:\Windows\System\EHXHVZf.exe
  C:\Windows\System\EHXHVZf.exe
  2⤵
  PID:7240
- C:\Windows\System\qFMxSvA.exe
  C:\Windows\System\qFMxSvA.exe
  2⤵
  PID:7260
- C:\Windows\System\bnkeQmO.exe
  C:\Windows\System\bnkeQmO.exe
  2⤵
  PID:7280
- C:\Windows\System\dtstFEB.exe
  C:\Windows\System\dtstFEB.exe
  2⤵
  PID:7372
- C:\Windows\System\vZhhGgy.exe
  C:\Windows\System\vZhhGgy.exe
  2⤵
  PID:7396
- C:\Windows\System\BByLWCV.exe
  C:\Windows\System\BByLWCV.exe
  2⤵
  PID:7416
- C:\Windows\System\iwBxbuu.exe
  C:\Windows\System\iwBxbuu.exe
  2⤵
  PID:7436
- C:\Windows\System\ylKflWM.exe
  C:\Windows\System\ylKflWM.exe
  2⤵
  PID:7460
- C:\Windows\System\gUmmxIx.exe
  C:\Windows\System\gUmmxIx.exe
  2⤵
  PID:7480
- C:\Windows\System\SLgoYbD.exe
  C:\Windows\System\SLgoYbD.exe
  2⤵
  PID:7500
- C:\Windows\System\aCsOrJM.exe
  C:\Windows\System\aCsOrJM.exe
  2⤵
  PID:7520
- C:\Windows\System\vZBlfMz.exe
  C:\Windows\System\vZBlfMz.exe
  2⤵
  PID:7540
- C:\Windows\System\dClpFHJ.exe
  C:\Windows\System\dClpFHJ.exe
  2⤵
  PID:7568
- C:\Windows\System\PaBLxNy.exe
  C:\Windows\System\PaBLxNy.exe
  2⤵
  PID:7588
- C:\Windows\System\aThfqPx.exe
  C:\Windows\System\aThfqPx.exe
  2⤵
  PID:7608
- C:\Windows\System\YbHrLgV.exe
  C:\Windows\System\YbHrLgV.exe
  2⤵
  PID:7632
- C:\Windows\System\VjtUjkT.exe
  C:\Windows\System\VjtUjkT.exe
  2⤵
  PID:7648
- C:\Windows\System\IxnMnOJ.exe
  C:\Windows\System\IxnMnOJ.exe
  2⤵
  PID:7676
- C:\Windows\System\mXMpKJB.exe
  C:\Windows\System\mXMpKJB.exe
  2⤵
  PID:7696
- C:\Windows\System\fPwznXG.exe
  C:\Windows\System\fPwznXG.exe
  2⤵
  PID:7720
- C:\Windows\System\JQiVRBk.exe
  C:\Windows\System\JQiVRBk.exe
  2⤵
  PID:7736
- C:\Windows\System\bYPZUde.exe
  C:\Windows\System\bYPZUde.exe
  2⤵
  PID:7760
- C:\Windows\System\UPfWAPz.exe
  C:\Windows\System\UPfWAPz.exe
  2⤵
  PID:7780
- C:\Windows\System\XsoNOaT.exe
  C:\Windows\System\XsoNOaT.exe
  2⤵
  PID:7800
- C:\Windows\System\RMRqaDh.exe
  C:\Windows\System\RMRqaDh.exe
  2⤵
  PID:7824
- C:\Windows\System\EAUbqmm.exe
  C:\Windows\System\EAUbqmm.exe
  2⤵
  PID:7844
- C:\Windows\System\lSVpcZJ.exe
  C:\Windows\System\lSVpcZJ.exe
  2⤵
  PID:7868
- C:\Windows\System\cMDrymS.exe
  C:\Windows\System\cMDrymS.exe
  2⤵
  PID:7888
- C:\Windows\System\KtMMZob.exe
  C:\Windows\System\KtMMZob.exe
  2⤵
  PID:7908
- C:\Windows\System\JnlxpJk.exe
  C:\Windows\System\JnlxpJk.exe
  2⤵
  PID:7932
- C:\Windows\System\gjVlosy.exe
  C:\Windows\System\gjVlosy.exe
  2⤵
  PID:7960
- C:\Windows\System\wdqLzcg.exe
  C:\Windows\System\wdqLzcg.exe
  2⤵
  PID:7984
- C:\Windows\System\Nzxmnlt.exe
  C:\Windows\System\Nzxmnlt.exe
  2⤵
  PID:8008
- C:\Windows\System\bGplBqx.exe
  C:\Windows\System\bGplBqx.exe
  2⤵
  PID:8044
- C:\Windows\System\UAQBQSL.exe
  C:\Windows\System\UAQBQSL.exe
  2⤵
  PID:8072
- C:\Windows\System\vKYUrlZ.exe
  C:\Windows\System\vKYUrlZ.exe
  2⤵
  PID:8096
- C:\Windows\System\qqLqXTV.exe
  C:\Windows\System\qqLqXTV.exe
  2⤵
  PID:8124
- C:\Windows\System\LKaPHSE.exe
  C:\Windows\System\LKaPHSE.exe
  2⤵
  PID:8140
- C:\Windows\System\iXPOvIV.exe
  C:\Windows\System\iXPOvIV.exe
  2⤵
  PID:8160
- C:\Windows\System\osuZsDD.exe
  C:\Windows\System\osuZsDD.exe
  2⤵
  PID:8184
- C:\Windows\System\ncekqxD.exe
  C:\Windows\System\ncekqxD.exe
  2⤵
  PID:6440
- C:\Windows\System\bOdLrmG.exe
  C:\Windows\System\bOdLrmG.exe
  2⤵
  PID:6508
- C:\Windows\System\brJLyAP.exe
  C:\Windows\System\brJLyAP.exe
  2⤵
  PID:6640
- C:\Windows\System\gOZwhtJ.exe
  C:\Windows\System\gOZwhtJ.exe
  2⤵
  PID:6668
- C:\Windows\System\muoSAVp.exe
  C:\Windows\System\muoSAVp.exe
  2⤵
  PID:7368
- C:\Windows\System\gADKzVF.exe
  C:\Windows\System\gADKzVF.exe
  2⤵
  PID:7512
- C:\Windows\System\LfemNHL.exe
  C:\Windows\System\LfemNHL.exe
  2⤵
  PID:7156
- C:\Windows\System\AmnLcAf.exe
  C:\Windows\System\AmnLcAf.exe
  2⤵
  PID:7604
- C:\Windows\System\lHweXJG.exe
  C:\Windows\System\lHweXJG.exe
  2⤵
  PID:7656
- C:\Windows\System\xMHVIKF.exe
  C:\Windows\System\xMHVIKF.exe
  2⤵
  PID:6312
- C:\Windows\System\vNYKFIC.exe
  C:\Windows\System\vNYKFIC.exe
  2⤵
  PID:7916
- C:\Windows\System\eHfrVQo.exe
  C:\Windows\System\eHfrVQo.exe
  2⤵
  PID:6576
- C:\Windows\System\NTAFqst.exe
  C:\Windows\System\NTAFqst.exe
  2⤵
  PID:8136
- C:\Windows\System\jaEGiXh.exe
  C:\Windows\System\jaEGiXh.exe
  2⤵
  PID:7040
- C:\Windows\System\KPsrMQd.exe
  C:\Windows\System\KPsrMQd.exe
  2⤵
  PID:6812
- C:\Windows\System\aYOveBb.exe
  C:\Windows\System\aYOveBb.exe
  2⤵
  PID:7728
- C:\Windows\System\EaOodUI.exe
  C:\Windows\System\EaOodUI.exe
  2⤵
  PID:7768
- C:\Windows\System\znMVWOg.exe
  C:\Windows\System\znMVWOg.exe
  2⤵
  PID:8216
- C:\Windows\System\allxmdW.exe
  C:\Windows\System\allxmdW.exe
  2⤵
  PID:8232
- C:\Windows\System\JAcgSIJ.exe
  C:\Windows\System\JAcgSIJ.exe
  2⤵
  PID:8252
- C:\Windows\System\AweYLir.exe
  C:\Windows\System\AweYLir.exe
  2⤵
  PID:8268
- C:\Windows\System\GONbWbd.exe
  C:\Windows\System\GONbWbd.exe
  2⤵
  PID:8292
- C:\Windows\System\atLwVDz.exe
  C:\Windows\System\atLwVDz.exe
  2⤵
  PID:8316
- C:\Windows\System\OUYUNIg.exe
  C:\Windows\System\OUYUNIg.exe
  2⤵
  PID:8344
- C:\Windows\System\CXuGGQF.exe
  C:\Windows\System\CXuGGQF.exe
  2⤵
  PID:8360
- C:\Windows\System\GjMflJg.exe
  C:\Windows\System\GjMflJg.exe
  2⤵
  PID:8380
- C:\Windows\System\RKXSOfL.exe
  C:\Windows\System\RKXSOfL.exe
  2⤵
  PID:8396
- C:\Windows\System\RKaHtIj.exe
  C:\Windows\System\RKaHtIj.exe
  2⤵
  PID:8416
- C:\Windows\System\NBjcaXf.exe
  C:\Windows\System\NBjcaXf.exe
  2⤵
  PID:8436
- C:\Windows\System\KPMMpyL.exe
  C:\Windows\System\KPMMpyL.exe
  2⤵
  PID:8456
- C:\Windows\System\kQZHbTG.exe
  C:\Windows\System\kQZHbTG.exe
  2⤵
  PID:8472
- C:\Windows\System\SZGNuVG.exe
  C:\Windows\System\SZGNuVG.exe
  2⤵
  PID:8488
- C:\Windows\System\fWtsanI.exe
  C:\Windows\System\fWtsanI.exe
  2⤵
  PID:8524
- C:\Windows\System\HxjuDnv.exe
  C:\Windows\System\HxjuDnv.exe
  2⤵
  PID:8544
- C:\Windows\System\zhfCyTe.exe
  C:\Windows\System\zhfCyTe.exe
  2⤵
  PID:8560
- C:\Windows\System\yiAssyC.exe
  C:\Windows\System\yiAssyC.exe
  2⤵
  PID:8600
- C:\Windows\System\xuSHGXx.exe
  C:\Windows\System\xuSHGXx.exe
  2⤵
  PID:8620
- C:\Windows\System\zyAUJUA.exe
  C:\Windows\System\zyAUJUA.exe
  2⤵
  PID:8640
- C:\Windows\System\XRfzPoY.exe
  C:\Windows\System\XRfzPoY.exe
  2⤵
  PID:8664
- C:\Windows\System\OurlIml.exe
  C:\Windows\System\OurlIml.exe
  2⤵
  PID:8680
- C:\Windows\System\twchmHZ.exe
  C:\Windows\System\twchmHZ.exe
  2⤵
  PID:8700
- C:\Windows\System\ArYCAXr.exe
  C:\Windows\System\ArYCAXr.exe
  2⤵
  PID:8732
- C:\Windows\System\ffrmEew.exe
  C:\Windows\System\ffrmEew.exe
  2⤵
  PID:8752
- C:\Windows\System\EYRapJS.exe
  C:\Windows\System\EYRapJS.exe
  2⤵
  PID:8772
- C:\Windows\System\UnSYvGx.exe
  C:\Windows\System\UnSYvGx.exe
  2⤵
  PID:8796
- C:\Windows\System\WLNuiDg.exe
  C:\Windows\System\WLNuiDg.exe
  2⤵
  PID:8812
- C:\Windows\System\FcLqWgH.exe
  C:\Windows\System\FcLqWgH.exe
  2⤵
  PID:8832
- C:\Windows\System\qNZbGUZ.exe
  C:\Windows\System\qNZbGUZ.exe
  2⤵
  PID:8864
- C:\Windows\System\HUliSWk.exe
  C:\Windows\System\HUliSWk.exe
  2⤵
  PID:9180
- C:\Windows\System\AcEkhiG.exe
  C:\Windows\System\AcEkhiG.exe
  2⤵
  PID:9204
- C:\Windows\System\ccvSftz.exe
  C:\Windows\System\ccvSftz.exe
  2⤵
  PID:7236
- C:\Windows\System\FDBwhIo.exe
  C:\Windows\System\FDBwhIo.exe
  2⤵
  PID:7864
- C:\Windows\System\pFxxJjk.exe
  C:\Windows\System\pFxxJjk.exe
  2⤵
  PID:7944
- C:\Windows\System\HOvZwyd.exe
  C:\Windows\System\HOvZwyd.exe
  2⤵
  PID:8000
- C:\Windows\System\vCSOWEr.exe
  C:\Windows\System\vCSOWEr.exe
  2⤵
  PID:7296
- C:\Windows\System\yMTqoGG.exe
  C:\Windows\System\yMTqoGG.exe
  2⤵
  PID:7556
- C:\Windows\System\cgpviag.exe
  C:\Windows\System\cgpviag.exe
  2⤵
  PID:7576
- C:\Windows\System\xtFhMDi.exe
  C:\Windows\System\xtFhMDi.exe
  2⤵
  PID:7584
- C:\Windows\System\WLvKZQW.exe
  C:\Windows\System\WLvKZQW.exe
  2⤵
  PID:7668
- C:\Windows\System\XJxGFQO.exe
  C:\Windows\System\XJxGFQO.exe
  2⤵
  PID:4624
- C:\Windows\System\AKsNGPH.exe
  C:\Windows\System\AKsNGPH.exe
  2⤵
  PID:7744
- C:\Windows\System\DGPeaxc.exe
  C:\Windows\System\DGPeaxc.exe
  2⤵
  PID:7756
- C:\Windows\System\CUoSSEY.exe
  C:\Windows\System\CUoSSEY.exe
  2⤵
  PID:8276
- C:\Windows\System\naVBRFL.exe
  C:\Windows\System\naVBRFL.exe
  2⤵
  PID:8368
- C:\Windows\System\uhkSMAR.exe
  C:\Windows\System\uhkSMAR.exe
  2⤵
  PID:8448
- C:\Windows\System\gEHdQlx.exe
  C:\Windows\System\gEHdQlx.exe
  2⤵
  PID:8516
- C:\Windows\System\yXFbSRv.exe
  C:\Windows\System\yXFbSRv.exe
  2⤵
  PID:8112
- C:\Windows\System\kQlBhVl.exe
  C:\Windows\System\kQlBhVl.exe
  2⤵
  PID:8632
- C:\Windows\System\ZBvuuEB.exe
  C:\Windows\System\ZBvuuEB.exe
  2⤵
  PID:8676
- C:\Windows\System\ZwBjKhY.exe
  C:\Windows\System\ZwBjKhY.exe
  2⤵
  PID:8724
- C:\Windows\System\lJnijwN.exe
  C:\Windows\System\lJnijwN.exe
  2⤵
  PID:8768
- C:\Windows\System\XNmyDnY.exe
  C:\Windows\System\XNmyDnY.exe
  2⤵
  PID:8840
- C:\Windows\System\PFfcllp.exe
  C:\Windows\System\PFfcllp.exe
  2⤵
  PID:8900
- C:\Windows\System\PzlJTQN.exe
  C:\Windows\System\PzlJTQN.exe
  2⤵
  PID:1736
- C:\Windows\System\BejraCW.exe
  C:\Windows\System\BejraCW.exe
  2⤵
  PID:8152
- C:\Windows\System\sXaScmo.exe
  C:\Windows\System\sXaScmo.exe
  2⤵
  PID:8968
- C:\Windows\System\luIXDGa.exe
  C:\Windows\System\luIXDGa.exe
  2⤵
  PID:8208
- C:\Windows\System\SDUOgVT.exe
  C:\Windows\System\SDUOgVT.exe
  2⤵
  PID:8248
- C:\Windows\System\JSBBqgM.exe
  C:\Windows\System\JSBBqgM.exe
  2⤵
  PID:8312
- C:\Windows\System\IqxMGCg.exe
  C:\Windows\System\IqxMGCg.exe
  2⤵
  PID:8424
- C:\Windows\System\PKhADfD.exe
  C:\Windows\System\PKhADfD.exe
  2⤵
  PID:8592
- C:\Windows\System\zjTRenZ.exe
  C:\Windows\System\zjTRenZ.exe
  2⤵
  PID:8716
- C:\Windows\System\YOBZtsX.exe
  C:\Windows\System\YOBZtsX.exe
  2⤵
  PID:8888
- C:\Windows\System\YcTWJkd.exe
  C:\Windows\System\YcTWJkd.exe
  2⤵
  PID:9236
- C:\Windows\System\GzAgEoX.exe
  C:\Windows\System\GzAgEoX.exe
  2⤵
  PID:9256
- C:\Windows\System\VJGcrUk.exe
  C:\Windows\System\VJGcrUk.exe
  2⤵
  PID:9276
- C:\Windows\System\Bfqklvx.exe
  C:\Windows\System\Bfqklvx.exe
  2⤵
  PID:9296
- C:\Windows\System\FXUngLe.exe
  C:\Windows\System\FXUngLe.exe
  2⤵
  PID:9320
- C:\Windows\System\EFKhRLK.exe
  C:\Windows\System\EFKhRLK.exe
  2⤵
  PID:9336
- C:\Windows\System\qkRsPrs.exe
  C:\Windows\System\qkRsPrs.exe
  2⤵
  PID:9352
- C:\Windows\System\BqpbBqS.exe
  C:\Windows\System\BqpbBqS.exe
  2⤵
  PID:9372
- C:\Windows\System\OUxwAnc.exe
  C:\Windows\System\OUxwAnc.exe
  2⤵
  PID:9392
- C:\Windows\System\odwhDIu.exe
  C:\Windows\System\odwhDIu.exe
  2⤵
  PID:9416
- C:\Windows\System\dyWOIAz.exe
  C:\Windows\System\dyWOIAz.exe
  2⤵
  PID:9432
- C:\Windows\System\brEIpVS.exe
  C:\Windows\System\brEIpVS.exe
  2⤵
  PID:9452
- C:\Windows\System\FOnxfjY.exe
  C:\Windows\System\FOnxfjY.exe
  2⤵
  PID:9480
- C:\Windows\System\zuCJtdV.exe
  C:\Windows\System\zuCJtdV.exe
  2⤵
  PID:9504
- C:\Windows\System\UuYAVqq.exe
  C:\Windows\System\UuYAVqq.exe
  2⤵
  PID:9524
- C:\Windows\System\mjQQiaB.exe
  C:\Windows\System\mjQQiaB.exe
  2⤵
  PID:9552
- C:\Windows\System\ZGkDsrU.exe
  C:\Windows\System\ZGkDsrU.exe
  2⤵
  PID:9576
- C:\Windows\System\jCCtcaQ.exe
  C:\Windows\System\jCCtcaQ.exe
  2⤵
  PID:9596
- C:\Windows\System\mWWWGBI.exe
  C:\Windows\System\mWWWGBI.exe
  2⤵
  PID:9620
- C:\Windows\System\WuXiWRW.exe
  C:\Windows\System\WuXiWRW.exe
  2⤵
  PID:9640
- C:\Windows\System\vkKMSin.exe
  C:\Windows\System\vkKMSin.exe
  2⤵
  PID:9660
- C:\Windows\System\ZUwpEtm.exe
  C:\Windows\System\ZUwpEtm.exe
  2⤵
  PID:9680
- C:\Windows\System\MTKXuLs.exe
  C:\Windows\System\MTKXuLs.exe
  2⤵
  PID:9700
- C:\Windows\System\OcShzFg.exe
  C:\Windows\System\OcShzFg.exe
  2⤵
  PID:9724
- C:\Windows\System\eDnsigu.exe
  C:\Windows\System\eDnsigu.exe
  2⤵
  PID:9748
- C:\Windows\System\dKqPukL.exe
  C:\Windows\System\dKqPukL.exe
  2⤵
  PID:9772
- C:\Windows\System\wqDttAs.exe
  C:\Windows\System\wqDttAs.exe
  2⤵
  PID:9788
- C:\Windows\System\GUZBfOz.exe
  C:\Windows\System\GUZBfOz.exe
  2⤵
  PID:9808
- C:\Windows\System\bJRHaMU.exe
  C:\Windows\System\bJRHaMU.exe
  2⤵
  PID:9832
- C:\Windows\System\iTqageL.exe
  C:\Windows\System\iTqageL.exe
  2⤵
  PID:9856
- C:\Windows\System\dQxwOjn.exe
  C:\Windows\System\dQxwOjn.exe
  2⤵
  PID:9884
- C:\Windows\System\irlEebW.exe
  C:\Windows\System\irlEebW.exe
  2⤵
  PID:9904
- C:\Windows\System\OLRAkVq.exe
  C:\Windows\System\OLRAkVq.exe
  2⤵
  PID:9924
- C:\Windows\System\qixEisf.exe
  C:\Windows\System\qixEisf.exe
  2⤵
  PID:9952
- C:\Windows\System\sxcKLQV.exe
  C:\Windows\System\sxcKLQV.exe
  2⤵
  PID:9972
- C:\Windows\System\bXkSAQd.exe
  C:\Windows\System\bXkSAQd.exe
  2⤵
  PID:10000
- C:\Windows\System\yYnvaNN.exe
  C:\Windows\System\yYnvaNN.exe
  2⤵
  PID:10020
- C:\Windows\System\EKKXluf.exe
  C:\Windows\System\EKKXluf.exe
  2⤵
  PID:10036
- C:\Windows\System\DLrAdjw.exe
  C:\Windows\System\DLrAdjw.exe
  2⤵
  PID:10056
- C:\Windows\System\kPxDepC.exe
  C:\Windows\System\kPxDepC.exe
  2⤵
  PID:10080
- C:\Windows\System\EavaBbT.exe
  C:\Windows\System\EavaBbT.exe
  2⤵
  PID:10100
- C:\Windows\System\xbVWdRP.exe
  C:\Windows\System\xbVWdRP.exe
  2⤵
  PID:10120
- C:\Windows\System\Grmzyjv.exe
  C:\Windows\System\Grmzyjv.exe
  2⤵
  PID:10144
- C:\Windows\System\EgDVrca.exe
  C:\Windows\System\EgDVrca.exe
  2⤵
  PID:9628
- C:\Windows\System\hJbbuul.exe
  C:\Windows\System\hJbbuul.exe
  2⤵
  PID:8940
- C:\Windows\System\eVjWwii.exe
  C:\Windows\System\eVjWwii.exe
  2⤵
  PID:8372
- C:\Windows\System\NMvWThJ.exe
  C:\Windows\System\NMvWThJ.exe
  2⤵
  PID:9916
- C:\Windows\System\ZAtzGXt.exe
  C:\Windows\System\ZAtzGXt.exe
  2⤵
  PID:6240
- C:\Windows\System\OUeJMgF.exe
  C:\Windows\System\OUeJMgF.exe
  2⤵
  PID:9824
- C:\Windows\System\DDVQcda.exe
  C:\Windows\System\DDVQcda.exe
  2⤵
  PID:9876
- C:\Windows\System\VEPteLV.exe
  C:\Windows\System\VEPteLV.exe
  2⤵
  PID:10116
- C:\Windows\System\cYytQlX.exe
  C:\Windows\System\cYytQlX.exe
  2⤵
  PID:8692
- C:\Windows\System\hjNpTQq.exe
  C:\Windows\System\hjNpTQq.exe
  2⤵
  PID:6724
- C:\Windows\System\BhUhKmE.exe
  C:\Windows\System\BhUhKmE.exe
  2⤵
  PID:9784
- C:\Windows\System\dAkIJDU.exe
  C:\Windows\System\dAkIJDU.exe
  2⤵
  PID:6532
- C:\Windows\System\eTySvaP.exe
  C:\Windows\System\eTySvaP.exe
  2⤵
  PID:9672
- C:\Windows\System\egvbKlo.exe
  C:\Windows\System\egvbKlo.exe
  2⤵
  PID:9192
- C:\Windows\System\QmgDcRd.exe
  C:\Windows\System\QmgDcRd.exe
  2⤵
  PID:3788
- C:\Windows\System\ncMjTJR.exe
  C:\Windows\System\ncMjTJR.exe
  2⤵
  PID:8616
- C:\Windows\System\QLvNJsq.exe
  C:\Windows\System\QLvNJsq.exe
  2⤵
  PID:9412
- C:\Windows\System\pBvCyNu.exe
  C:\Windows\System\pBvCyNu.exe
  2⤵
  PID:9652
- C:\Windows\System\CoVTTbt.exe
  C:\Windows\System\CoVTTbt.exe
  2⤵
  PID:10248
- C:\Windows\System\YlvdNQd.exe
  C:\Windows\System\YlvdNQd.exe
  2⤵
  PID:10264
- C:\Windows\System\hOFmpNh.exe
  C:\Windows\System\hOFmpNh.exe
  2⤵
  PID:10280
- C:\Windows\System\oSMcGHN.exe
  C:\Windows\System\oSMcGHN.exe
  2⤵
  PID:10296
- C:\Windows\System\alCixsN.exe
  C:\Windows\System\alCixsN.exe
  2⤵
  PID:10316
- C:\Windows\System\HoDypcg.exe
  C:\Windows\System\HoDypcg.exe
  2⤵
  PID:10332
- C:\Windows\System\RzAQfLy.exe
  C:\Windows\System\RzAQfLy.exe
  2⤵
  PID:10348
- C:\Windows\System\vfwwMkS.exe
  C:\Windows\System\vfwwMkS.exe
  2⤵
  PID:10428
- C:\Windows\System\aAQWihD.exe
  C:\Windows\System\aAQWihD.exe
  2⤵
  PID:10668
- C:\Windows\System\qvzRQWP.exe
  C:\Windows\System\qvzRQWP.exe
  2⤵
  PID:10696
- C:\Windows\System\jGbNIUD.exe
  C:\Windows\System\jGbNIUD.exe
  2⤵
  PID:10716
- C:\Windows\System\bgjROqs.exe
  C:\Windows\System\bgjROqs.exe
  2⤵
  PID:10736
- C:\Windows\System\fSwqlHu.exe
  C:\Windows\System\fSwqlHu.exe
  2⤵
  PID:10764
- C:\Windows\System\rlQeERg.exe
  C:\Windows\System\rlQeERg.exe
  2⤵
  PID:10788
- C:\Windows\System\XsjMhLq.exe
  C:\Windows\System\XsjMhLq.exe
  2⤵
  PID:10804
- C:\Windows\System\OvTJgKZ.exe
  C:\Windows\System\OvTJgKZ.exe
  2⤵
  PID:10832
- C:\Windows\System\ccMlGEP.exe
  C:\Windows\System\ccMlGEP.exe
  2⤵
  PID:10848
- C:\Windows\System\ilHhVqJ.exe
  C:\Windows\System\ilHhVqJ.exe
  2⤵
  PID:10864
- C:\Windows\System\jmeDDgW.exe
  C:\Windows\System\jmeDDgW.exe
  2⤵
  PID:10884
- C:\Windows\System\QjfQiNW.exe
  C:\Windows\System\QjfQiNW.exe
  2⤵
  PID:10904
- C:\Windows\System\ovCdWqQ.exe
  C:\Windows\System\ovCdWqQ.exe
  2⤵
  PID:10920
- C:\Windows\System\DKgpgMq.exe
  C:\Windows\System\DKgpgMq.exe
  2⤵
  PID:10940
- C:\Windows\System\dQhZwaY.exe
  C:\Windows\System\dQhZwaY.exe
  2⤵
  PID:10956
- C:\Windows\System\uPpEURu.exe
  C:\Windows\System\uPpEURu.exe
  2⤵
  PID:10976
- C:\Windows\System\RdVQQsS.exe
  C:\Windows\System\RdVQQsS.exe
  2⤵
  PID:11000
- C:\Windows\System\llaToUp.exe
  C:\Windows\System\llaToUp.exe
  2⤵
  PID:11028
- C:\Windows\System\MlNUGef.exe
  C:\Windows\System\MlNUGef.exe
  2⤵
  PID:11048
- C:\Windows\System\UczNRip.exe
  C:\Windows\System\UczNRip.exe
  2⤵
  PID:11064
- C:\Windows\System\OtuwuVn.exe
  C:\Windows\System\OtuwuVn.exe
  2⤵
  PID:11088
- C:\Windows\System\oVANATG.exe
  C:\Windows\System\oVANATG.exe
  2⤵
  PID:11148
- C:\Windows\System\ACQHeYP.exe
  C:\Windows\System\ACQHeYP.exe
  2⤵
  PID:11236
- C:\Windows\System\TCprHqd.exe
  C:\Windows\System\TCprHqd.exe
  2⤵
  PID:11252
- C:\Windows\System\GANgCGB.exe
  C:\Windows\System\GANgCGB.exe
  2⤵
  PID:9560
- C:\Windows\System\CJooGoH.exe
  C:\Windows\System\CJooGoH.exe
  2⤵
  PID:6708
- C:\Windows\System\axbnmDU.exe
  C:\Windows\System\axbnmDU.exe
  2⤵
  PID:9648
- C:\Windows\System\YODnxXM.exe
  C:\Windows\System\YODnxXM.exe
  2⤵
  PID:3544
- C:\Windows\System\SaNUYHn.exe
  C:\Windows\System\SaNUYHn.exe
  2⤵
  PID:1272
- C:\Windows\System\zwlkjcW.exe
  C:\Windows\System\zwlkjcW.exe
  2⤵
  PID:10156
- C:\Windows\System\HSApTUB.exe
  C:\Windows\System\HSApTUB.exe
  2⤵
  PID:10076
- C:\Windows\System\dYvwELq.exe
  C:\Windows\System\dYvwELq.exe
  2⤵
  PID:10328
- C:\Windows\System\JbRWFXp.exe
  C:\Windows\System\JbRWFXp.exe
  2⤵
  PID:9568
- C:\Windows\System\iDyWZgQ.exe
  C:\Windows\System\iDyWZgQ.exe
  2⤵
  PID:10032
- C:\Windows\System\XTaijkz.exe
  C:\Windows\System\XTaijkz.exe
  2⤵
  PID:9044
- C:\Windows\System\WKsuUTT.exe
  C:\Windows\System\WKsuUTT.exe
  2⤵
  PID:10424
- C:\Windows\System\tvWMFlQ.exe
  C:\Windows\System\tvWMFlQ.exe
  2⤵
  PID:10356
- C:\Windows\System\PkmJaWC.exe
  C:\Windows\System\PkmJaWC.exe
  2⤵
  PID:4756
- C:\Windows\System\mqIyXcn.exe
  C:\Windows\System\mqIyXcn.exe
  2⤵
  PID:3648
- C:\Windows\System\xMhmUkY.exe
  C:\Windows\System\xMhmUkY.exe
  2⤵
  PID:10488
- C:\Windows\System\DSJKPxz.exe
  C:\Windows\System\DSJKPxz.exe
  2⤵
  PID:10492
- C:\Windows\System\gpQXMVE.exe
  C:\Windows\System\gpQXMVE.exe
  2⤵
  PID:10548
- C:\Windows\System\ONUcLAo.exe
  C:\Windows\System\ONUcLAo.exe
  2⤵
  PID:10644
- C:\Windows\System\IGGUyUt.exe
  C:\Windows\System\IGGUyUt.exe
  2⤵
  PID:10596
- C:\Windows\System\zmGaKJJ.exe
  C:\Windows\System\zmGaKJJ.exe
  2⤵
  PID:10800
- C:\Windows\System\EUBpSfT.exe
  C:\Windows\System\EUBpSfT.exe
  2⤵
  PID:10880
- C:\Windows\System\XyXfLXR.exe
  C:\Windows\System\XyXfLXR.exe
  2⤵
  PID:10912
- C:\Windows\System\CqAWTIf.exe
  C:\Windows\System\CqAWTIf.exe
  2⤵
  PID:10968
- C:\Windows\System\kHmSNLq.exe
  C:\Windows\System\kHmSNLq.exe
  2⤵
  PID:10840
- C:\Windows\System\goJGyeT.exe
  C:\Windows\System\goJGyeT.exe
  2⤵
  PID:2988
- C:\Windows\System\GkMqBoS.exe
  C:\Windows\System\GkMqBoS.exe
  2⤵
  PID:10972
- C:\Windows\System\NkesLvL.exe
  C:\Windows\System\NkesLvL.exe
  2⤵
  PID:11036
- C:\Windows\System\uBMpuzK.exe
  C:\Windows\System\uBMpuzK.exe
  2⤵
  PID:11080
- C:\Windows\System\nhkVLTy.exe
  C:\Windows\System\nhkVLTy.exe
  2⤵
  PID:3024
- C:\Windows\System\AurVowL.exe
  C:\Windows\System\AurVowL.exe
  2⤵
  PID:11160
- C:\Windows\System\wkZJwmN.exe
  C:\Windows\System\wkZJwmN.exe
  2⤵
  PID:10364
- C:\Windows\System\qIiRJvz.exe
  C:\Windows\System\qIiRJvz.exe
  2⤵
  PID:1184
- C:\Windows\System\paFEqgR.exe
  C:\Windows\System\paFEqgR.exe
  2⤵
  PID:10760
- C:\Windows\System\wLQrhsh.exe
  C:\Windows\System\wLQrhsh.exe
  2⤵
  PID:9980
- C:\Windows\System\sSHhjXQ.exe
  C:\Windows\System\sSHhjXQ.exe
  2⤵
  PID:11268
- C:\Windows\System\hIIkbCg.exe
  C:\Windows\System\hIIkbCg.exe
  2⤵
  PID:11732
- C:\Windows\System\nzAcTpq.exe
  C:\Windows\System\nzAcTpq.exe
  2⤵
  PID:11804
- C:\Windows\System\JpfPMDn.exe
  C:\Windows\System\JpfPMDn.exe
  2⤵
  PID:11908
- C:\Windows\System\LCDCRvw.exe
  C:\Windows\System\LCDCRvw.exe
  2⤵
  PID:11968
- C:\Windows\System\ZeEOWtP.exe
  C:\Windows\System\ZeEOWtP.exe
  2⤵
  PID:12020
- C:\Windows\System\IvQRPdZ.exe
  C:\Windows\System\IvQRPdZ.exe
  2⤵
  PID:12096
- C:\Windows\System\ICQIwQi.exe
  C:\Windows\System\ICQIwQi.exe
  2⤵
  PID:12120
- C:\Windows\System\RXWsyNs.exe
  C:\Windows\System\RXWsyNs.exe
  2⤵
  PID:12136
- C:\Windows\System\UWNgzIJ.exe
  C:\Windows\System\UWNgzIJ.exe
  2⤵
  PID:12152
- C:\Windows\System\zgFKdnv.exe
  C:\Windows\System\zgFKdnv.exe
  2⤵
  PID:12176
- C:\Windows\System\PylsQpW.exe
  C:\Windows\System\PylsQpW.exe
  2⤵
  PID:12204
- C:\Windows\System\uYLqDnr.exe
  C:\Windows\System\uYLqDnr.exe
  2⤵
  PID:12236
- C:\Windows\System\NRUQjnU.exe
  C:\Windows\System\NRUQjnU.exe
  2⤵
  PID:12256
- C:\Windows\System\BBXBAGc.exe
  C:\Windows\System\BBXBAGc.exe
  2⤵
  PID:12272
- C:\Windows\System\wxzzIfA.exe
  C:\Windows\System\wxzzIfA.exe
  2⤵
  PID:5460
- C:\Windows\System\BCDxXmj.exe
  C:\Windows\System\BCDxXmj.exe
  2⤵
  PID:10936
- C:\Windows\System\IjiSJRJ.exe
  C:\Windows\System\IjiSJRJ.exe
  2⤵
  PID:10532
- C:\Windows\System\jWRpzRJ.exe
  C:\Windows\System\jWRpzRJ.exe
  2⤵
  PID:7536
- C:\Windows\System\EFkedHi.exe
  C:\Windows\System\EFkedHi.exe
  2⤵
  PID:3124
- C:\Windows\System\wdTFmVf.exe
  C:\Windows\System\wdTFmVf.exe
  2⤵
  PID:10728
- C:\Windows\System\nQsLPPr.exe
  C:\Windows\System\nQsLPPr.exe
  2⤵
  PID:10340
- C:\Windows\System\WZsnwIZ.exe
  C:\Windows\System\WZsnwIZ.exe
  2⤵
  PID:10784
- C:\Windows\System\diToahy.exe
  C:\Windows\System\diToahy.exe
  2⤵
  PID:11156
- C:\Windows\System\XDUlrMY.exe
  C:\Windows\System\XDUlrMY.exe
  2⤵
  PID:11008
- C:\Windows\System\oNtCKrp.exe
  C:\Windows\System\oNtCKrp.exe
  2⤵
  PID:4592
- C:\Windows\System\TEiZssh.exe
  C:\Windows\System\TEiZssh.exe
  2⤵
  PID:11380
- C:\Windows\System\qHMAsyq.exe
  C:\Windows\System\qHMAsyq.exe
  2⤵
  PID:5536
- C:\Windows\System\ljdNYaD.exe
  C:\Windows\System\ljdNYaD.exe
  2⤵
  PID:11524
- C:\Windows\System\uPdOWWn.exe
  C:\Windows\System\uPdOWWn.exe
  2⤵
  PID:11580
- C:\Windows\System\ncNPcpH.exe
  C:\Windows\System\ncNPcpH.exe
  2⤵
  PID:3792
- C:\Windows\System\lgcPOae.exe
  C:\Windows\System\lgcPOae.exe
  2⤵
  PID:4724
- C:\Windows\System\XvHRQYN.exe
  C:\Windows\System\XvHRQYN.exe
  2⤵
  PID:11704
- C:\Windows\System\sDMFust.exe
  C:\Windows\System\sDMFust.exe
  2⤵
  PID:11616
- C:\Windows\System\gERDMDA.exe
  C:\Windows\System\gERDMDA.exe
  2⤵
  PID:11816
- C:\Windows\System\sjyEmkC.exe
  C:\Windows\System\sjyEmkC.exe
  2⤵
  PID:884
- C:\Windows\System\SvWDnzg.exe
  C:\Windows\System\SvWDnzg.exe
  2⤵
  PID:5792
- C:\Windows\System\rWdsNxY.exe
  C:\Windows\System\rWdsNxY.exe
  2⤵
  PID:1648
- C:\Windows\System\mYzgAcB.exe
  C:\Windows\System\mYzgAcB.exe
  2⤵
  PID:5188
- C:\Windows\System\yrMVKse.exe
  C:\Windows\System\yrMVKse.exe
  2⤵
  PID:380
- C:\Windows\System\ovihSqf.exe
  C:\Windows\System\ovihSqf.exe
  2⤵
  PID:1108
- C:\Windows\System\DvejpvL.exe
  C:\Windows\System\DvejpvL.exe
  2⤵
  PID:11848
- C:\Windows\System\PRNoXcE.exe
  C:\Windows\System\PRNoXcE.exe
  2⤵
  PID:11892
- C:\Windows\System\UFizJQh.exe
  C:\Windows\System\UFizJQh.exe
  2⤵
  PID:11852
- C:\Windows\System\kHHOPpp.exe
  C:\Windows\System\kHHOPpp.exe
  2⤵
  PID:11920
- C:\Windows\System\AxMgVoQ.exe
  C:\Windows\System\AxMgVoQ.exe
  2⤵
  PID:11900
- C:\Windows\System\qJvyclS.exe
  C:\Windows\System\qJvyclS.exe
  2⤵
  PID:5280
- C:\Windows\System\dCPHRLR.exe
  C:\Windows\System\dCPHRLR.exe
  2⤵
  PID:11940
- C:\Windows\System\PHWemwA.exe
  C:\Windows\System\PHWemwA.exe
  2⤵
  PID:12032
- C:\Windows\System\ugYlCXF.exe
  C:\Windows\System\ugYlCXF.exe
  2⤵
  PID:12088
- C:\Windows\System\FZyRbZT.exe
  C:\Windows\System\FZyRbZT.exe
  2⤵
  PID:12128
- C:\Windows\System\XiNMlcT.exe
  C:\Windows\System\XiNMlcT.exe
  2⤵
  PID:12160
- C:\Windows\System\lJaksZw.exe
  C:\Windows\System\lJaksZw.exe
  2⤵
  PID:12184
- C:\Windows\System\wMKCIhE.exe
  C:\Windows\System\wMKCIhE.exe
  2⤵
  PID:12228
- C:\Windows\System\QlzThYZ.exe
  C:\Windows\System\QlzThYZ.exe
  2⤵
  PID:12268
- C:\Windows\System\oFyjjRf.exe
  C:\Windows\System\oFyjjRf.exe
  2⤵
  PID:6136
- C:\Windows\System\IHSAGKe.exe
  C:\Windows\System\IHSAGKe.exe
  2⤵
  PID:8092
- C:\Windows\System\aAPvZKc.exe
  C:\Windows\System\aAPvZKc.exe
  2⤵
  PID:10160
- C:\Windows\System\VejJjfY.exe
  C:\Windows\System\VejJjfY.exe
  2⤵
  PID:9348
- C:\Windows\System\tUUYhwU.exe
  C:\Windows\System\tUUYhwU.exe
  2⤵
  PID:5476
- C:\Windows\System\ibuCRZu.exe
  C:\Windows\System\ibuCRZu.exe
  2⤵
  PID:640
- C:\Windows\System\meODCHV.exe
  C:\Windows\System\meODCHV.exe
  2⤵
  PID:10528
- C:\Windows\System\LQMniBY.exe
  C:\Windows\System\LQMniBY.exe
  2⤵
  PID:11116
- C:\Windows\System\HAPaJpr.exe
  C:\Windows\System\HAPaJpr.exe
  2⤵
  PID:11552
- C:\Windows\System\RkjpSbP.exe
  C:\Windows\System\RkjpSbP.exe
  2⤵
  PID:5176
- C:\Windows\System\STNEtuF.exe
  C:\Windows\System\STNEtuF.exe
  2⤵
  PID:11788
- C:\Windows\System\SHAkClV.exe
  C:\Windows\System\SHAkClV.exe
  2⤵
  PID:11840
- C:\Windows\System\GFXhogn.exe
  C:\Windows\System\GFXhogn.exe
  2⤵
  PID:5284
- C:\Windows\System\uOuVWkz.exe
  C:\Windows\System\uOuVWkz.exe
  2⤵
  PID:11728
- C:\Windows\System\JaFChUP.exe
  C:\Windows\System\JaFChUP.exe
  2⤵
  PID:5000
- C:\Windows\System\VOlUJTf.exe
  C:\Windows\System\VOlUJTf.exe
  2⤵
  PID:11812
- C:\Windows\System\gGlxtNO.exe
  C:\Windows\System\gGlxtNO.exe
  2⤵
  PID:11312
- C:\Windows\System\gjzeFtU.exe
  C:\Windows\System\gjzeFtU.exe
  2⤵
  PID:11876
- C:\Windows\System\nrNoprg.exe
  C:\Windows\System\nrNoprg.exe
  2⤵
  PID:11884
- C:\Windows\System\eAWsaMD.exe
  C:\Windows\System\eAWsaMD.exe
  2⤵
  PID:5236
- C:\Windows\System\IXkmmTJ.exe
  C:\Windows\System\IXkmmTJ.exe
  2⤵
  PID:6072
- C:\Windows\System\xRKNODO.exe
  C:\Windows\System\xRKNODO.exe
  2⤵
  PID:12072
- C:\Windows\System\eoKuNKo.exe
  C:\Windows\System\eoKuNKo.exe
  2⤵
  PID:12052
- C:\Windows\System\UQdYxOr.exe
  C:\Windows\System\UQdYxOr.exe
  2⤵
  PID:10324
- C:\Windows\System\GjcwuZE.exe
  C:\Windows\System\GjcwuZE.exe
  2⤵
  PID:11144
- C:\Windows\System\igQgfsI.exe
  C:\Windows\System\igQgfsI.exe
  2⤵
  PID:6132
- C:\Windows\System\aAZkcSs.exe
  C:\Windows\System\aAZkcSs.exe
  2⤵
  PID:12284
- C:\Windows\System\iDDSusi.exe
  C:\Windows\System\iDDSusi.exe
  2⤵
  PID:1300
- C:\Windows\System\YEBTQpL.exe
  C:\Windows\System\YEBTQpL.exe
  2⤵
  PID:11948
- C:\Windows\System\lkxzpsu.exe
  C:\Windows\System\lkxzpsu.exe
  2⤵
  PID:3192
- C:\Windows\System\ZWJkYnT.exe
  C:\Windows\System\ZWJkYnT.exe
  2⤵
  PID:12144
- C:\Windows\System\EffGKVJ.exe
  C:\Windows\System\EffGKVJ.exe
  2⤵
  PID:5128
- C:\Windows\System\ZjhWzrA.exe
  C:\Windows\System\ZjhWzrA.exe
  2⤵
  PID:8468
- C:\Windows\System\bwjYwHD.exe
  C:\Windows\System\bwjYwHD.exe
  2⤵
  PID:1496
- C:\Windows\System\igYNPUU.exe
  C:\Windows\System\igYNPUU.exe
  2⤵
  PID:11964
- C:\Windows\System\RvqTETi.exe
  C:\Windows\System\RvqTETi.exe
  2⤵
  PID:12292
- C:\Windows\System\BdzUosh.exe
  C:\Windows\System\BdzUosh.exe
  2⤵
  PID:12312
- C:\Windows\System\GQkAior.exe
  C:\Windows\System\GQkAior.exe
  2⤵
  PID:12328
- C:\Windows\System\LswTsup.exe
  C:\Windows\System\LswTsup.exe
  2⤵
  PID:12352
- C:\Windows\System\mVzYqui.exe
  C:\Windows\System\mVzYqui.exe
  2⤵
  PID:12376
- C:\Windows\System\aPwhDGT.exe
  C:\Windows\System\aPwhDGT.exe
  2⤵
  PID:12396
- C:\Windows\System\SbUHPyW.exe
  C:\Windows\System\SbUHPyW.exe
  2⤵
  PID:12416
- C:\Windows\System\NMfgQgZ.exe
  C:\Windows\System\NMfgQgZ.exe
  2⤵
  PID:12436
- C:\Windows\System\BXZkdwN.exe
  C:\Windows\System\BXZkdwN.exe
  2⤵
  PID:12460
- C:\Windows\System\FDCtXxW.exe
  C:\Windows\System\FDCtXxW.exe
  2⤵
  PID:12484
- C:\Windows\System\XfZOaaw.exe
  C:\Windows\System\XfZOaaw.exe
  2⤵
  PID:12512
- C:\Windows\System\JvDdTid.exe
  C:\Windows\System\JvDdTid.exe
  2⤵
  PID:12532
- C:\Windows\System\mAeENth.exe
  C:\Windows\System\mAeENth.exe
  2⤵
  PID:12552
- C:\Windows\System\PTFKpTL.exe
  C:\Windows\System\PTFKpTL.exe
  2⤵
  PID:12572
- C:\Windows\System\TLlDGWP.exe
  C:\Windows\System\TLlDGWP.exe
  2⤵
  PID:12600
- C:\Windows\System\QQGXbDQ.exe
  C:\Windows\System\QQGXbDQ.exe
  2⤵
  PID:12624
- C:\Windows\System\dDstJsf.exe
  C:\Windows\System\dDstJsf.exe
  2⤵
  PID:12644
- C:\Windows\System\jvSceMy.exe
  C:\Windows\System\jvSceMy.exe
  2⤵
  PID:12664
- C:\Windows\System\CyYfCPD.exe
  C:\Windows\System\CyYfCPD.exe
  2⤵
  PID:12688
- C:\Windows\System\CzAeJDF.exe
  C:\Windows\System\CzAeJDF.exe
  2⤵
  PID:12704
- C:\Windows\System\CbAdDdt.exe
  C:\Windows\System\CbAdDdt.exe
  2⤵
  PID:12728
- C:\Windows\System\LOOLPjg.exe
  C:\Windows\System\LOOLPjg.exe
  2⤵
  PID:12748
- C:\Windows\System\WuZDtYL.exe
  C:\Windows\System\WuZDtYL.exe
  2⤵
  PID:12768
- C:\Windows\System\rDFixWT.exe
  C:\Windows\System\rDFixWT.exe
  2⤵
  PID:12788
- C:\Windows\System\lJXPIed.exe
  C:\Windows\System\lJXPIed.exe
  2⤵
  PID:12808
- C:\Windows\System\YsUsqhs.exe
  C:\Windows\System\YsUsqhs.exe
  2⤵
  PID:12828
- C:\Windows\System\fEsrCZk.exe
  C:\Windows\System\fEsrCZk.exe
  2⤵
  PID:12848
- C:\Windows\System\IDMpwmO.exe
  C:\Windows\System\IDMpwmO.exe
  2⤵
  PID:12868
- C:\Windows\System\IwvfPTX.exe
  C:\Windows\System\IwvfPTX.exe
  2⤵
  PID:12892
- C:\Windows\System\AiIdSnp.exe
  C:\Windows\System\AiIdSnp.exe
  2⤵
  PID:12912
- C:\Windows\System\MfwWcUw.exe
  C:\Windows\System\MfwWcUw.exe
  2⤵
  PID:12936
- C:\Windows\System\kQJmQMo.exe
  C:\Windows\System\kQJmQMo.exe
  2⤵
  PID:12956
- C:\Windows\System\mbppgFL.exe
  C:\Windows\System\mbppgFL.exe
  2⤵
  PID:12976
- C:\Windows\System\CLcqFgl.exe
  C:\Windows\System\CLcqFgl.exe
  2⤵
  PID:13000
- C:\Windows\System\GiLzwOJ.exe
  C:\Windows\System\GiLzwOJ.exe
  2⤵
  PID:13020
- C:\Windows\System\rCHTSDu.exe
  C:\Windows\System\rCHTSDu.exe
  2⤵
  PID:13036
- C:\Windows\System\aUNIkyQ.exe
  C:\Windows\System\aUNIkyQ.exe
  2⤵
  PID:13056
- C:\Windows\System\nhZOLJW.exe
  C:\Windows\System\nhZOLJW.exe
  2⤵
  PID:13100
- C:\Windows\System\SQRcLzu.exe
  C:\Windows\System\SQRcLzu.exe
  2⤵
  PID:13068
- C:\Windows\System\HqadcJL.exe
  C:\Windows\System\HqadcJL.exe
  2⤵
  PID:12432
- C:\Windows\System\EukxmXW.exe
  C:\Windows\System\EukxmXW.exe
  2⤵
  PID:12476
- C:\Windows\System\UwtGGgf.exe
  C:\Windows\System\UwtGGgf.exe
  2⤵
  PID:12524
- C:\Windows\System\USJuTLg.exe
  C:\Windows\System\USJuTLg.exe
  2⤵
  PID:12640
- C:\Windows\System\WNEFPvb.exe
  C:\Windows\System\WNEFPvb.exe
  2⤵
  PID:12820
- C:\Windows\System\QjBeCGl.exe
  C:\Windows\System\QjBeCGl.exe
  2⤵
  PID:12920
- C:\Windows\System\jqCCqVz.exe
  C:\Windows\System\jqCCqVz.exe
  2⤵
  PID:12968
- C:\Windows\System\jeJEnFo.exe
  C:\Windows\System\jeJEnFo.exe
  2⤵
  PID:11432
- C:\Windows\System\GLQdFcS.exe
  C:\Windows\System\GLQdFcS.exe
  2⤵
  PID:13048
- C:\Windows\System\YjCjoTV.exe
  C:\Windows\System\YjCjoTV.exe
  2⤵
  PID:11292
- C:\Windows\System\SWooKKD.exe
  C:\Windows\System\SWooKKD.exe
  2⤵
  PID:13176
- C:\Windows\System\COhsFtI.exe
  C:\Windows\System\COhsFtI.exe
  2⤵
  PID:12200
- C:\Windows\System\ccywzFh.exe
  C:\Windows\System\ccywzFh.exe
  2⤵
  PID:11832
- C:\Windows\System\IxEqCel.exe
  C:\Windows\System\IxEqCel.exe
  2⤵
  PID:1384
- C:\Windows\System\AXofYta.exe
  C:\Windows\System\AXofYta.exe
  2⤵
  PID:12764
- C:\Windows\System\DwcjJaR.exe
  C:\Windows\System\DwcjJaR.exe
  2⤵
  PID:11608
- C:\Windows\System\nlsbplF.exe
  C:\Windows\System\nlsbplF.exe
  2⤵
  PID:5664
- C:\Windows\System\jsfcqmA.exe
  C:\Windows\System\jsfcqmA.exe
  2⤵
  PID:5796
- C:\Windows\System\ldnzmiI.exe
  C:\Windows\System\ldnzmiI.exe
  2⤵
  PID:460
- C:\Windows\System\sXLPptG.exe
  C:\Windows\System\sXLPptG.exe
  2⤵
  PID:13064
- C:\Windows\System\zKLUsCO.exe
  C:\Windows\System\zKLUsCO.exe
  2⤵
  PID:12412
- C:\Windows\System\LIwHnGl.exe
  C:\Windows\System\LIwHnGl.exe
  2⤵
  PID:12520
- C:\Windows\System\btjxIuH.exe
  C:\Windows\System\btjxIuH.exe
  2⤵
  PID:12908
- C:\Windows\System\grsDTid.exe
  C:\Windows\System\grsDTid.exe
  2⤵
  PID:13032
- C:\Windows\System\lMbRBPh.exe
  C:\Windows\System\lMbRBPh.exe
  2⤵
  PID:13012
- C:\Windows\System\tvDzRFc.exe
  C:\Windows\System\tvDzRFc.exe
  2⤵
  PID:1960
- C:\Windows\System\Zybsfvo.exe
  C:\Windows\System\Zybsfvo.exe
  2⤵
  PID:11024
- C:\Windows\System\uhzUpsB.exe
  C:\Windows\System\uhzUpsB.exe
  2⤵
  PID:6040
- C:\Windows\System\AXrDJSe.exe
  C:\Windows\System\AXrDJSe.exe
  2⤵
  PID:11708
- C:\Windows\System\xpbBpHt.exe
  C:\Windows\System\xpbBpHt.exe
  2⤵
  PID:732
- C:\Windows\System\eStLdZV.exe
  C:\Windows\System\eStLdZV.exe
  2⤵
  PID:12448
- C:\Windows\System\ugizbsf.exe
  C:\Windows\System\ugizbsf.exe
  2⤵
  PID:12616
- C:\Windows\System\UJeDopq.exe
  C:\Windows\System\UJeDopq.exe
  2⤵
  PID:13316
- C:\Windows\System\ELpNzfK.exe
  C:\Windows\System\ELpNzfK.exe
  2⤵
  PID:13336
- C:\Windows\System\nwSaOZm.exe
  C:\Windows\System\nwSaOZm.exe
  2⤵
  PID:13356
- C:\Windows\System\JnPvKei.exe
  C:\Windows\System\JnPvKei.exe
  2⤵
  PID:13376
- C:\Windows\System\EHnZEzD.exe
  C:\Windows\System\EHnZEzD.exe
  2⤵
  PID:13396
- C:\Windows\System\bSKYNCl.exe
  C:\Windows\System\bSKYNCl.exe
  2⤵
  PID:13444
- C:\Windows\System\PEZIggG.exe
  C:\Windows\System\PEZIggG.exe
  2⤵
  PID:13460
- C:\Windows\System\PZexpmi.exe
  C:\Windows\System\PZexpmi.exe
  2⤵
  PID:13476
- C:\Windows\System\gdFAYWG.exe
  C:\Windows\System\gdFAYWG.exe
  2⤵
  PID:13496
- C:\Windows\System\yMKSzNM.exe
  C:\Windows\System\yMKSzNM.exe
  2⤵
  PID:13524
- C:\Windows\System\vDfLmcC.exe
  C:\Windows\System\vDfLmcC.exe
  2⤵
  PID:13548
- C:\Windows\System\flZJmQj.exe
  C:\Windows\System\flZJmQj.exe
  2⤵
  PID:13580
- C:\Windows\System\VDWPUaB.exe
  C:\Windows\System\VDWPUaB.exe
  2⤵
  PID:13600
- C:\Windows\System\GzaKVFz.exe
  C:\Windows\System\GzaKVFz.exe
  2⤵
  PID:13624
- C:\Windows\System\UUUcWKN.exe
  C:\Windows\System\UUUcWKN.exe
  2⤵
  PID:13640
- C:\Windows\System\OjJInUd.exe
  C:\Windows\System\OjJInUd.exe
  2⤵
  PID:13656
- C:\Windows\System\AeFPygf.exe
  C:\Windows\System\AeFPygf.exe
  2⤵
  PID:13676
- C:\Windows\System\MmfSiIM.exe
  C:\Windows\System\MmfSiIM.exe
  2⤵
  PID:13696
- C:\Windows\System\dUuslDs.exe
  C:\Windows\System\dUuslDs.exe
  2⤵
  PID:14096
- C:\Windows\System\bvtjgLp.exe
  C:\Windows\System\bvtjgLp.exe
  2⤵
  PID:14140
- C:\Windows\System\lrnncnH.exe
  C:\Windows\System\lrnncnH.exe
  2⤵
  PID:14168
- C:\Windows\System\dyhmziU.exe
  C:\Windows\System\dyhmziU.exe
  2⤵
  PID:14188
- C:\Windows\System\YnuoqMN.exe
  C:\Windows\System\YnuoqMN.exe
  2⤵
  PID:14204
- C:\Windows\System\NNYMpnz.exe
  C:\Windows\System\NNYMpnz.exe
  2⤵
  PID:14220
- C:\Windows\System\VMwbgku.exe
  C:\Windows\System\VMwbgku.exe
  2⤵
  PID:14236
- C:\Windows\System\KZcfNGI.exe
  C:\Windows\System\KZcfNGI.exe
  2⤵
  PID:14252
- C:\Windows\System\EFYXHwS.exe
  C:\Windows\System\EFYXHwS.exe
  2⤵
  PID:14284
- C:\Windows\System\Saodjxm.exe
  C:\Windows\System\Saodjxm.exe
  2⤵
  PID:13108
- C:\Windows\System\NcxnZTX.exe
  C:\Windows\System\NcxnZTX.exe
  2⤵
  PID:492
- C:\Windows\System\lzIxJMS.exe
  C:\Windows\System\lzIxJMS.exe
  2⤵
  PID:3520
- C:\Windows\System\TuzANqf.exe
  C:\Windows\System\TuzANqf.exe
  2⤵
  PID:13324
- C:\Windows\System\kuYKvnF.exe
  C:\Windows\System\kuYKvnF.exe
  2⤵
  PID:13440
- C:\Windows\System\JZLTQBL.exe
  C:\Windows\System\JZLTQBL.exe
  2⤵
  PID:13516
- C:\Windows\System\AazPeXt.exe
  C:\Windows\System\AazPeXt.exe
  2⤵
  PID:13556
- C:\Windows\System\WIhmvNL.exe
  C:\Windows\System\WIhmvNL.exe
  2⤵
  PID:13632
- C:\Windows\System\QOvfidy.exe
  C:\Windows\System\QOvfidy.exe
  2⤵
  PID:13772
- C:\Windows\System\DFRCbuK.exe
  C:\Windows\System\DFRCbuK.exe
  2⤵
  PID:13888
- C:\Windows\System\HyCTptH.exe
  C:\Windows\System\HyCTptH.exe
  2⤵
  PID:13836
- C:\Windows\System\wTmJMjv.exe
  C:\Windows\System\wTmJMjv.exe
  2⤵
  PID:13868
- C:\Windows\System\nrdpLcP.exe
  C:\Windows\System\nrdpLcP.exe
  2⤵
  PID:13944
- C:\Windows\System\vcTXhcF.exe
  C:\Windows\System\vcTXhcF.exe
  2⤵
  PID:14016
- C:\Windows\System\cmPHOkl.exe
  C:\Windows\System\cmPHOkl.exe
  2⤵
  PID:4452
- C:\Windows\System\sjGJGgW.exe
  C:\Windows\System\sjGJGgW.exe
  2⤵
  PID:2364
- C:\Windows\System\hrnBlNG.exe
  C:\Windows\System\hrnBlNG.exe
  2⤵
  PID:14052
- C:\Windows\System\zHLwfst.exe
  C:\Windows\System\zHLwfst.exe
  2⤵
  PID:4216
- C:\Windows\System\oIdHUaa.exe
  C:\Windows\System\oIdHUaa.exe
  2⤵
  PID:4896
- C:\Windows\System\IygaHXh.exe
  C:\Windows\System\IygaHXh.exe
  2⤵
  PID:13824
- C:\Windows\System\xCsJSwh.exe
  C:\Windows\System\xCsJSwh.exe
  2⤵
  PID:5700
- C:\Windows\System\WuKvaSk.exe
  C:\Windows\System\WuKvaSk.exe
  2⤵
  PID:14088
- C:\Windows\System\jgYDaVY.exe
  C:\Windows\System\jgYDaVY.exe
  2⤵
  PID:14112
- C:\Windows\System\TUwSvQR.exe
  C:\Windows\System\TUwSvQR.exe
  2⤵
  PID:14104
- C:\Windows\System\GaoMmMo.exe
  C:\Windows\System\GaoMmMo.exe
  2⤵
  PID:2252
- C:\Windows\System\WAnYHhJ.exe
  C:\Windows\System\WAnYHhJ.exe
  2⤵
  PID:14200
- C:\Windows\System\KzDQfnl.exe
  C:\Windows\System\KzDQfnl.exe
  2⤵
  PID:6020
- C:\Windows\System\bKQZGok.exe
  C:\Windows\System\bKQZGok.exe
  2⤵
  PID:14028
- C:\Windows\System\xxKUBUn.exe
  C:\Windows\System\xxKUBUn.exe
  2⤵
  PID:1936
- C:\Windows\System\UIdSjkH.exe
  C:\Windows\System\UIdSjkH.exe
  2⤵
  PID:6044
- C:\Windows\System\IWDzzcE.exe
  C:\Windows\System\IWDzzcE.exe
  2⤵
  PID:12948
- C:\Windows\System\FogGptK.exe
  C:\Windows\System\FogGptK.exe
  2⤵
  PID:13352
- C:\Windows\System\JPOdNCs.exe
  C:\Windows\System\JPOdNCs.exe
  2⤵
  PID:3928
- C:\Windows\System\KgZDRGL.exe
  C:\Windows\System\KgZDRGL.exe
  2⤵
  PID:4336
- C:\Windows\System\MXIJgIU.exe
  C:\Windows\System\MXIJgIU.exe
  2⤵
  PID:13456
- C:\Windows\System\ZNFbvtw.exe
  C:\Windows\System\ZNFbvtw.exe
  2⤵
  PID:13540
- C:\Windows\System\iPOHPmL.exe
  C:\Windows\System\iPOHPmL.exe
  2⤵
  PID:4492
- C:\Windows\System\KeUoQJx.exe
  C:\Windows\System\KeUoQJx.exe
  2⤵
  PID:13780
- C:\Windows\System\BbsMKYq.exe
  C:\Windows\System\BbsMKYq.exe
  2⤵
  PID:3216
- C:\Windows\System\CgBCteN.exe
  C:\Windows\System\CgBCteN.exe
  2⤵
  PID:1628
- C:\Windows\System\nHaRPkZ.exe
  C:\Windows\System\nHaRPkZ.exe
  2⤵
  PID:13980
- C:\Windows\System\LAhwXBQ.exe
  C:\Windows\System\LAhwXBQ.exe
  2⤵
  PID:14048
- C:\Windows\System\wrEmjTk.exe
  C:\Windows\System\wrEmjTk.exe
  2⤵
  PID:5524
- C:\Windows\System\FotHALe.exe
  C:\Windows\System\FotHALe.exe
  2⤵
  PID:13576
- C:\Windows\System\bNVdaFV.exe
  C:\Windows\System\bNVdaFV.exe
  2⤵
  PID:5736
- C:\Windows\System\uJoPDmq.exe
  C:\Windows\System\uJoPDmq.exe
  2⤵
  PID:14164
- C:\Windows\System\iikFOlf.exe
  C:\Windows\System\iikFOlf.exe
  2⤵
  PID:14056
- C:\Windows\System\gxiNhZi.exe
  C:\Windows\System\gxiNhZi.exe
  2⤵
  PID:14176
- C:\Windows\System\eYdAnbh.exe
  C:\Windows\System\eYdAnbh.exe
  2⤵
  PID:6120
- C:\Windows\System\AtSnpyU.exe
  C:\Windows\System\AtSnpyU.exe
  2⤵
  PID:5872
- C:\Windows\System\vJuLtNU.exe
  C:\Windows\System\vJuLtNU.exe
  2⤵
  PID:14292
- C:\Windows\System\UxGeZwL.exe
  C:\Windows\System\UxGeZwL.exe
  2⤵
  PID:3244
- C:\Windows\System\ShDzXYb.exe
  C:\Windows\System\ShDzXYb.exe
  2⤵
  PID:416
- C:\Windows\System\exuOjkc.exe
  C:\Windows\System\exuOjkc.exe
  2⤵
  PID:6180
- C:\Windows\System\tvYKFcp.exe
  C:\Windows\System\tvYKFcp.exe
  2⤵
  PID:4068
- C:\Windows\System\nGJyvFZ.exe
  C:\Windows\System\nGJyvFZ.exe
  2⤵
  PID:13968
- C:\Windows\System\KaPQnTb.exe
  C:\Windows\System\KaPQnTb.exe
  2⤵
  PID:14316
- C:\Windows\System\niMwmxE.exe
  C:\Windows\System\niMwmxE.exe
  2⤵
  PID:6396
- C:\Windows\System\LioNaBe.exe
  C:\Windows\System\LioNaBe.exe
  2⤵
  PID:6456
- C:\Windows\System\aBfxqSr.exe
  C:\Windows\System\aBfxqSr.exe
  2⤵
  PID:13192
- C:\Windows\System\aqlmMqU.exe
  C:\Windows\System\aqlmMqU.exe
  2⤵
  PID:6696
- C:\Windows\System\tIuZdmN.exe
  C:\Windows\System\tIuZdmN.exe
  2⤵
  PID:12388
- C:\Windows\System\giRSPoL.exe
  C:\Windows\System\giRSPoL.exe
  2⤵
  PID:14320
- C:\Windows\System\vMDXkJO.exe
  C:\Windows\System\vMDXkJO.exe
  2⤵
  PID:6408
- C:\Windows\System\LJolSHA.exe
  C:\Windows\System\LJolSHA.exe
  2⤵
  PID:14340
- C:\Windows\System\jcKqizk.exe
  C:\Windows\System\jcKqizk.exe
  2⤵
  PID:14356
- C:\Windows\System\hwcoBRZ.exe
  C:\Windows\System\hwcoBRZ.exe
  2⤵
  PID:14372
- C:\Windows\System\xoBmzaR.exe
  C:\Windows\System\xoBmzaR.exe
  2⤵
  PID:14392
- C:\Windows\System\XDhPGzj.exe
  C:\Windows\System\XDhPGzj.exe
  2⤵
  PID:14412
- C:\Windows\System\zgbuUQJ.exe
  C:\Windows\System\zgbuUQJ.exe
  2⤵
  PID:14428
- C:\Windows\System\jWKKTxV.exe
  C:\Windows\System\jWKKTxV.exe
  2⤵
  PID:14456
- C:\Windows\System\NryFHpy.exe
  C:\Windows\System\NryFHpy.exe
  2⤵
  PID:14472
- C:\Windows\System\nqZGdAC.exe
  C:\Windows\System\nqZGdAC.exe
  2⤵
  PID:14504
- C:\Windows\System\WvjwOws.exe
  C:\Windows\System\WvjwOws.exe
  2⤵
  PID:14608
- C:\Windows\System\uwordPl.exe
  C:\Windows\System\uwordPl.exe
  2⤵
  PID:14656
- C:\Windows\System\dooNbqz.exe
  C:\Windows\System\dooNbqz.exe
  2⤵
  PID:14672
- C:\Windows\System\JyzFRqm.exe
  C:\Windows\System\JyzFRqm.exe
  2⤵
  PID:14688
- C:\Windows\System\rpcsSUW.exe
  C:\Windows\System\rpcsSUW.exe
  2⤵
  PID:14704
- C:\Windows\System\PhIGBpD.exe
  C:\Windows\System\PhIGBpD.exe
  2⤵
  PID:14740
- C:\Windows\System\TTGZwSG.exe
  C:\Windows\System\TTGZwSG.exe
  2⤵
  PID:14756
- C:\Windows\System\pwzUCfl.exe
  C:\Windows\System\pwzUCfl.exe
  2⤵
  PID:14856
- C:\Windows\System\dsBSydf.exe
  C:\Windows\System\dsBSydf.exe
  2⤵
  PID:14876
- C:\Windows\System\SSOdEyj.exe
  C:\Windows\System\SSOdEyj.exe
  2⤵
  PID:14896
- C:\Windows\System\DWmvEcL.exe
  C:\Windows\System\DWmvEcL.exe
  2⤵
  PID:14916
- C:\Windows\System\zioERVl.exe
  C:\Windows\System\zioERVl.exe
  2⤵
  PID:14944
- C:\Windows\System\wnAWOWb.exe
  C:\Windows\System\wnAWOWb.exe
  2⤵
  PID:15000
- C:\Windows\System\bWLfYZd.exe
  C:\Windows\System\bWLfYZd.exe
  2⤵
  PID:15016
- C:\Windows\System\wnDqkej.exe
  C:\Windows\System\wnDqkej.exe
  2⤵
  PID:15172
- C:\Windows\System\bDZYKlj.exe
  C:\Windows\System\bDZYKlj.exe
  2⤵
  PID:5672
- C:\Windows\System\onLNhYE.exe
  C:\Windows\System\onLNhYE.exe
  2⤵
  PID:14724
- C:\Windows\System\ZLBlNJt.exe
  C:\Windows\System\ZLBlNJt.exe
  2⤵
  PID:15212
- C:\Windows\System\yhvNvdQ.exe
  C:\Windows\System\yhvNvdQ.exe
  2⤵
  PID:15248
- C:\Windows\System\hlvVqps.exe
  C:\Windows\System\hlvVqps.exe
  2⤵
  PID:7672
- C:\Windows\System\HcCLnBc.exe
  C:\Windows\System\HcCLnBc.exe
  2⤵
  PID:15332
- C:\Windows\System\nyLIVis.exe
  C:\Windows\System\nyLIVis.exe
  2⤵
  PID:15352
- C:\Windows\System\yFrEsNc.exe
  C:\Windows\System\yFrEsNc.exe
  2⤵
  PID:4552
- C:\Windows\System\CJCMCtE.exe
  C:\Windows\System\CJCMCtE.exe
  2⤵
  PID:15120
- C:\Windows\System\zxMBwpk.exe
  C:\Windows\System\zxMBwpk.exe
  2⤵
  PID:14968
- C:\Windows\System\uDhBKUo.exe
  C:\Windows\System\uDhBKUo.exe
  2⤵
  PID:1968
- C:\Windows\System\zvlMvcw.exe
  C:\Windows\System\zvlMvcw.exe
  2⤵
  PID:15220
- C:\Windows\System\PUddcgH.exe
  C:\Windows\System\PUddcgH.exe
  2⤵
  PID:15264
- C:\Windows\System\dUUdSCE.exe
  C:\Windows\System\dUUdSCE.exe
  2⤵
  PID:15280
- C:\Windows\System\GaboMSS.exe
  C:\Windows\System\GaboMSS.exe
  2⤵
  PID:15348
- C:\Windows\System\bCbgRDB.exe
  C:\Windows\System\bCbgRDB.exe
  2⤵
  PID:7516
- C:\Windows\System\hbkqEEy.exe
  C:\Windows\System\hbkqEEy.exe
  2⤵
  PID:8068
- C:\Windows\System\OqXeOaj.exe
  C:\Windows\System\OqXeOaj.exe
  2⤵
  PID:8920
- C:\Windows\System\WBayYqV.exe
  C:\Windows\System\WBayYqV.exe
  2⤵
  PID:8240
- C:\Windows\System\tdRlxQr.exe
  C:\Windows\System\tdRlxQr.exe
  2⤵
  PID:7712
- C:\Windows\System\QFNYOGj.exe
  C:\Windows\System\QFNYOGj.exe
  2⤵
  PID:8040
- C:\Windows\System\cihMlPD.exe
  C:\Windows\System\cihMlPD.exe
  2⤵
  PID:7212
- C:\Windows\System\LFcKFKV.exe
  C:\Windows\System\LFcKFKV.exe
  2⤵
  PID:14984
- C:\Windows\System\oxRoJVr.exe
  C:\Windows\System\oxRoJVr.exe
  2⤵
  PID:15200
- C:\Windows\System\NQUJBuI.exe
  C:\Windows\System\NQUJBuI.exe
  2⤵
  PID:14788
- C:\Windows\System\UjaOLbt.exe
  C:\Windows\System\UjaOLbt.exe
  2⤵
  PID:7808
- C:\Windows\System\TTZhagp.exe
  C:\Windows\System\TTZhagp.exe
  2⤵
  PID:9068
- C:\Windows\System\hBFqICD.exe
  C:\Windows\System\hBFqICD.exe
  2⤵
  PID:7016
- C:\Windows\System\fuoNZkI.exe
  C:\Windows\System\fuoNZkI.exe
  2⤵
  PID:6848
- C:\Windows\System\dwAvLpI.exe
  C:\Windows\System\dwAvLpI.exe
  2⤵
  PID:684
- C:\Windows\System\huRoHPg.exe
  C:\Windows\System\huRoHPg.exe
  2⤵
  PID:8880
- C:\Windows\System\DOPGTGM.exe
  C:\Windows\System\DOPGTGM.exe
  2⤵
  PID:6824
- C:\Windows\System\VlyjypI.exe
  C:\Windows\System\VlyjypI.exe
  2⤵
  PID:15128
- C:\Windows\System\dnXPBNA.exe
  C:\Windows\System\dnXPBNA.exe
  2⤵
  PID:15252
- C:\Windows\System\zrVkvLh.exe
  C:\Windows\System\zrVkvLh.exe
  2⤵
  PID:15068
- C:\Windows\System\lZfRDGA.exe
  C:\Windows\System\lZfRDGA.exe
  2⤵
  PID:14580
- C:\Windows\System\YuItmjj.exe
  C:\Windows\System\YuItmjj.exe
  2⤵
  PID:6588
- C:\Windows\System\pfYiMEB.exe
  C:\Windows\System\pfYiMEB.exe
  2⤵
  PID:6284
- C:\Windows\System\PMLqMbf.exe
  C:\Windows\System\PMLqMbf.exe
  2⤵
  PID:9060
- C:\Windows\System\XZifiPU.exe
  C:\Windows\System\XZifiPU.exe
  2⤵
  PID:14488
- C:\Windows\System\VekJdjb.exe
  C:\Windows\System\VekJdjb.exe
  2⤵
  PID:7904
- C:\Windows\System\hijrEOR.exe
  C:\Windows\System\hijrEOR.exe
  2⤵
  PID:5660
- C:\Windows\System\YWJlSQf.exe
  C:\Windows\System\YWJlSQf.exe
  2⤵
  PID:14404
- C:\Windows\System\nMylegc.exe
  C:\Windows\System\nMylegc.exe
  2⤵
  PID:9756
- C:\Windows\System\YXGiaIU.exe
  C:\Windows\System\YXGiaIU.exe
  2⤵
  PID:3692
- C:\Windows\System\KfXOhzx.exe
  C:\Windows\System\KfXOhzx.exe
  2⤵
  PID:8828
- C:\Windows\System\nRAPAoa.exe
  C:\Windows\System\nRAPAoa.exe
  2⤵
  PID:9632
- C:\Windows\System\PZyxdFd.exe
  C:\Windows\System\PZyxdFd.exe
  2⤵
  PID:10220
- C:\Windows\System\lbiaySk.exe
  C:\Windows\System\lbiaySk.exe
  2⤵
  PID:1700
- C:\Windows\System\CkJXAJH.exe
  C:\Windows\System\CkJXAJH.exe
  2⤵
  PID:9548
- C:\Windows\System\ZoEorbV.exe
  C:\Windows\System\ZoEorbV.exe
  2⤵
  PID:15232
- C:\Windows\System\ESqUhWD.exe
  C:\Windows\System\ESqUhWD.exe
  2⤵
  PID:8916
- C:\Windows\System\dqDYFHl.exe
  C:\Windows\System\dqDYFHl.exe
  2⤵
  PID:8280
- C:\Windows\System\EJLGGpb.exe
  C:\Windows\System\EJLGGpb.exe
  2⤵
  PID:14736
- C:\Windows\System\OuvcLhS.exe
  C:\Windows\System\OuvcLhS.exe
  2⤵
  PID:9796
- C:\Windows\System\FRkdrfU.exe
  C:\Windows\System\FRkdrfU.exe
  2⤵
  PID:8176
- C:\Windows\System\YKnuYAG.exe
  C:\Windows\System\YKnuYAG.exe
  2⤵
  PID:8912
- C:\Windows\System\jLtEszJ.exe
  C:\Windows\System\jLtEszJ.exe
  2⤵
  PID:14904
- C:\Windows\System\UnOYurO.exe
  C:\Windows\System\UnOYurO.exe
  2⤵
  PID:7956
- C:\Windows\System\qzFXxdN.exe
  C:\Windows\System\qzFXxdN.exe
  2⤵
  PID:7472
- C:\Windows\System\jNwynOG.exe
  C:\Windows\System\jNwynOG.exe
  2⤵
  PID:6980
- C:\Windows\System\FVIVxAQ.exe
  C:\Windows\System\FVIVxAQ.exe
  2⤵
  PID:2552
- C:\Windows\System\xjZxyWW.exe
  C:\Windows\System\xjZxyWW.exe
  2⤵
  PID:10028
- C:\Windows\System\KTcCTFR.exe
  C:\Windows\System\KTcCTFR.exe
  2⤵
  PID:9944
- C:\Windows\System\pfxAjNB.exe
  C:\Windows\System\pfxAjNB.exe
  2⤵
  PID:9968
- C:\Windows\System\YgvAWBt.exe
  C:\Windows\System\YgvAWBt.exe
  2⤵
  PID:9212
- C:\Windows\System\zqWxUsK.exe
  C:\Windows\System\zqWxUsK.exe
  2⤵
  PID:9424
- C:\Windows\System\PGNwWTf.exe
  C:\Windows\System\PGNwWTf.exe
  2⤵
  PID:9000
- C:\Windows\System\GCmRJyj.exe
  C:\Windows\System\GCmRJyj.exe
  2⤵
  PID:10208
- C:\Windows\System\ZvlwpXk.exe
  C:\Windows\System\ZvlwpXk.exe
  2⤵
  PID:7508
- C:\Windows\System\StqBOue.exe
  C:\Windows\System\StqBOue.exe
  2⤵
  PID:9160
- C:\Windows\System\rAbkTbS.exe
  C:\Windows\System\rAbkTbS.exe
  2⤵
  PID:13116
- C:\Windows\System\HIPlrws.exe
  C:\Windows\System\HIPlrws.exe
  2⤵
  PID:14268
- C:\Windows\System\tdsLHRM.exe
  C:\Windows\System\tdsLHRM.exe
  2⤵
  PID:7624
- C:\Windows\System\cnzcqXU.exe
  C:\Windows\System\cnzcqXU.exe
  2⤵
  PID:6380
- C:\Windows\System\VSjAkvq.exe
  C:\Windows\System\VSjAkvq.exe
  2⤵
  PID:9024
- C:\Windows\System\rBYrSsp.exe
  C:\Windows\System\rBYrSsp.exe
  2⤵
  PID:3328
- C:\Windows\System\VcFTrYZ.exe
  C:\Windows\System\VcFTrYZ.exe
  2⤵
  PID:8952
- C:\Windows\System\EVngQlm.exe
  C:\Windows\System\EVngQlm.exe
  2⤵
  PID:14440
- C:\Windows\System\ovJykQm.exe
  C:\Windows\System\ovJykQm.exe
  2⤵
  PID:8580
- C:\Windows\System\GKQpyej.exe
  C:\Windows\System\GKQpyej.exe
  2⤵
  PID:1212
- C:\Windows\System\YNFSpxm.exe
  C:\Windows\System\YNFSpxm.exe
  2⤵
  PID:7492
- C:\Windows\System\KsVauUp.exe
  C:\Windows\System\KsVauUp.exe
  2⤵
  PID:9920
- C:\Windows\System\sunJuVz.exe
  C:\Windows\System\sunJuVz.exe
  2⤵
  PID:8080
- C:\Windows\System\qXwbLHz.exe
  C:\Windows\System\qXwbLHz.exe
  2⤵
  PID:7184
- C:\Windows\System\ZuysXFe.exe
  C:\Windows\System\ZuysXFe.exe
  2⤵
  PID:9384
- C:\Windows\System\RpqeLED.exe
  C:\Windows\System\RpqeLED.exe
  2⤵
  PID:7364
- C:\Windows\System\ntuFCAG.exe
  C:\Windows\System\ntuFCAG.exe
  2⤵
  PID:15064
- C:\Windows\System\AaipkfA.exe
  C:\Windows\System\AaipkfA.exe
  2⤵
  PID:8300
- C:\Windows\System\JPhxuJg.exe
  C:\Windows\System\JPhxuJg.exe
  2⤵
  PID:8720
- C:\Windows\System\hlyACMo.exe
  C:\Windows\System\hlyACMo.exe
  2⤵
  PID:10460
- C:\Windows\System\vSEjiWS.exe
  C:\Windows\System\vSEjiWS.exe
  2⤵
  PID:10448
- C:\Windows\System\CrGOQjO.exe
  C:\Windows\System\CrGOQjO.exe
  2⤵
  PID:10400
- C:\Windows\System\WScFtoN.exe
  C:\Windows\System\WScFtoN.exe
  2⤵
  PID:10512
- C:\Windows\System\fftYUeZ.exe
  C:\Windows\System\fftYUeZ.exe
  2⤵
  PID:10588
- C:\Windows\System\pVVsDGy.exe
  C:\Windows\System\pVVsDGy.exe
  2⤵
  PID:10540
- C:\Windows\System\zXSGclV.exe
  C:\Windows\System\zXSGclV.exe
  2⤵
  PID:15048
- C:\Windows\System\nKrRpqD.exe
  C:\Windows\System\nKrRpqD.exe
  2⤵
  PID:7596
- C:\Windows\System\spwVaOV.exe
  C:\Windows\System\spwVaOV.exe
  2⤵
  PID:10688
- C:\Windows\System\bUxuIPw.exe
  C:\Windows\System\bUxuIPw.exe
  2⤵
  PID:10692
- C:\Windows\System\RwlNvdZ.exe
  C:\Windows\System\RwlNvdZ.exe
  2⤵
  PID:14928
- C:\Windows\System\vHiAYlh.exe
  C:\Windows\System\vHiAYlh.exe
  2⤵
  PID:15208
- C:\Windows\System\LGbOYin.exe
  C:\Windows\System\LGbOYin.exe
  2⤵
  PID:10684
- C:\Windows\System\eqeSvNe.exe
  C:\Windows\System\eqeSvNe.exe
  2⤵
  PID:15204
- C:\Windows\System\crUscpi.exe
  C:\Windows\System\crUscpi.exe
  2⤵
  PID:15304
- C:\Windows\System\YPCPhpl.exe
  C:\Windows\System\YPCPhpl.exe
  2⤵
  PID:15112
- C:\Windows\System\PwyOgRj.exe
  C:\Windows\System\PwyOgRj.exe
  2⤵
  PID:14196
- C:\Windows\System\ITGmrQs.exe
  C:\Windows\System\ITGmrQs.exe
  2⤵
  PID:7684
- C:\Windows\System\qTmPjcD.exe
  C:\Windows\System\qTmPjcD.exe
  2⤵
  PID:15100
- C:\Windows\System\ZaZgBZs.exe
  C:\Windows\System\ZaZgBZs.exe
  2⤵
  PID:3144
- C:\Windows\System\AZGIxxK.exe
  C:\Windows\System\AZGIxxK.exe
  2⤵
  PID:9072
- C:\Windows\System\UIWIpvp.exe
  C:\Windows\System\UIWIpvp.exe
  2⤵
  PID:10228
- C:\Windows\System\pGHBAVT.exe
  C:\Windows\System\pGHBAVT.exe
  2⤵
  PID:9244
- C:\Windows\System\NJXeGjk.exe
  C:\Windows\System\NJXeGjk.exe
  2⤵
  PID:11168
- C:\Windows\System\XnYMthL.exe
  C:\Windows\System\XnYMthL.exe
  2⤵
  PID:9936
- C:\Windows\System\odwLcdU.exe
  C:\Windows\System\odwLcdU.exe
  2⤵
  PID:8992
- C:\Windows\System\aVksulg.exe
  C:\Windows\System\aVksulg.exe
  2⤵
  PID:11112
- C:\Windows\System\aawsuiO.exe
  C:\Windows\System\aawsuiO.exe
  2⤵
  PID:10132
- C:\Windows\System\uFaDcPB.exe
  C:\Windows\System\uFaDcPB.exe
  2⤵
  PID:11200
- C:\Windows\System\dIRwKxw.exe
  C:\Windows\System\dIRwKxw.exe
  2⤵
  PID:7856
- C:\Windows\System\YqkYtgX.exe
  C:\Windows\System\YqkYtgX.exe
  2⤵
  PID:7788
- C:\Windows\System\UnHFhvr.exe
  C:\Windows\System\UnHFhvr.exe
  2⤵
  PID:9220
- C:\Windows\System\vWZtEZC.exe
  C:\Windows\System\vWZtEZC.exe
  2⤵
  PID:9676
- C:\Windows\System\UYpwuSR.exe
  C:\Windows\System\UYpwuSR.exe
  2⤵
  PID:7496
- C:\Windows\System\spemgtk.exe
  C:\Windows\System\spemgtk.exe
  2⤵
  PID:8652
- C:\Windows\System\gfZQjnf.exe
  C:\Windows\System\gfZQjnf.exe
  2⤵
  PID:9136
- C:\Windows\System\HxfOlvv.exe
  C:\Windows\System\HxfOlvv.exe
  2⤵
  PID:8200
- C:\Windows\System\cPBJrKa.exe
  C:\Windows\System\cPBJrKa.exe
  2⤵
  PID:8324
- C:\Windows\System\VhGslWc.exe
  C:\Windows\System\VhGslWc.exe
  2⤵
  PID:6648
- C:\Windows\System\btAipGO.exe
  C:\Windows\System\btAipGO.exe
  2⤵
  PID:10624
- C:\Windows\System\OsCKyck.exe
  C:\Windows\System\OsCKyck.exe
  2⤵
  PID:14960
- C:\Windows\System\JPmypLz.exe
  C:\Windows\System\JPmypLz.exe
  2⤵
  PID:11308
- C:\Windows\System\eMpCKhl.exe
  C:\Windows\System\eMpCKhl.exe
  2⤵
  PID:10916
- C:\Windows\System\swuYeKN.exe
  C:\Windows\System\swuYeKN.exe
  2⤵
  PID:11400
- C:\Windows\System\oOCRlwD.exe
  C:\Windows\System\oOCRlwD.exe
  2⤵
  PID:9760
- C:\Windows\System\njoiesC.exe
  C:\Windows\System\njoiesC.exe
  2⤵
  PID:6024
- C:\Windows\System\mmXLMZD.exe
  C:\Windows\System\mmXLMZD.exe
  2⤵
  PID:9896
- C:\Windows\System\wjmvBJP.exe
  C:\Windows\System\wjmvBJP.exe
  2⤵
  PID:9736
- C:\Windows\System\QyDPpXp.exe
  C:\Windows\System\QyDPpXp.exe
  2⤵
  PID:14828
- C:\Windows\System\RXlBsrI.exe
  C:\Windows\System\RXlBsrI.exe
  2⤵
  PID:1208
- C:\Windows\System\mKEbyfx.exe
  C:\Windows\System\mKEbyfx.exe
  2⤵
  PID:9616
- C:\Windows\System\nuENkje.exe
  C:\Windows\System\nuENkje.exe
  2⤵
  PID:11504
- C:\Windows\System\FZLrKzu.exe
  C:\Windows\System\FZLrKzu.exe
  2⤵
  PID:11500
- C:\Windows\System\BKAvYDO.exe
  C:\Windows\System\BKAvYDO.exe
  2⤵
  PID:980
- C:\Windows\System\JJfrDix.exe
  C:\Windows\System\JJfrDix.exe
  2⤵
  PID:11440
- C:\Windows\System\CNjrumh.exe
  C:\Windows\System\CNjrumh.exe
  2⤵
  PID:8904
- C:\Windows\System\QnueIDF.exe
  C:\Windows\System\QnueIDF.exe
  2⤵
  PID:9488
- C:\Windows\System\wvFanOs.exe
  C:\Windows\System\wvFanOs.exe
  2⤵
  PID:14776
- C:\Windows\System\XnXQyrq.exe
  C:\Windows\System\XnXQyrq.exe
  2⤵
  PID:7920
- C:\Windows\System\AemBBdz.exe
  C:\Windows\System\AemBBdz.exe
  2⤵
  PID:14952
- C:\Windows\System\EmFIqeD.exe
  C:\Windows\System\EmFIqeD.exe
  2⤵
  PID:7796
- C:\Windows\System\xLYsgWg.exe
  C:\Windows\System\xLYsgWg.exe
  2⤵
  PID:9304
- C:\Windows\System\lcekLWx.exe
  C:\Windows\System\lcekLWx.exe
  2⤵
  PID:10576
- C:\Windows\System\DocLbnu.exe
  C:\Windows\System\DocLbnu.exe
  2⤵
  PID:11548
- C:\Windows\System\pqcnygw.exe
  C:\Windows\System\pqcnygw.exe
  2⤵
  PID:7084
- C:\Windows\System\fLxlbzc.exe
  C:\Windows\System\fLxlbzc.exe
  2⤵
  PID:7288
- C:\Windows\System\tqhhIMO.exe
  C:\Windows\System\tqhhIMO.exe
  2⤵
  PID:11124
- C:\Windows\System\MbPJGlP.exe
  C:\Windows\System\MbPJGlP.exe
  2⤵
  PID:8872
- C:\Windows\System\ZkSqHUF.exe
  C:\Windows\System\ZkSqHUF.exe
  2⤵
  PID:14824
- C:\Windows\System\bdsphVb.exe
  C:\Windows\System\bdsphVb.exe
  2⤵
  PID:10536
- C:\Windows\System\XIhCWmb.exe
  C:\Windows\System\XIhCWmb.exe
  2⤵
  PID:11204
- C:\Windows\System\hCZumGd.exe
  C:\Windows\System\hCZumGd.exe
  2⤵
  PID:10272
- C:\Windows\System\aPAmxDF.exe
  C:\Windows\System\aPAmxDF.exe
  2⤵
  PID:1452
- C:\Windows\System\eCJmVhs.exe
  C:\Windows\System\eCJmVhs.exe
  2⤵
  PID:8452
- C:\Windows\System\FyqQBPW.exe
  C:\Windows\System\FyqQBPW.exe
  2⤵
  PID:9140
- C:\Windows\System\YefncDO.exe
  C:\Windows\System\YefncDO.exe
  2⤵
  PID:8464
- C:\Windows\System\rZjFOtd.exe
  C:\Windows\System\rZjFOtd.exe
  2⤵
  PID:8996
- C:\Windows\System\wToIRhY.exe
  C:\Windows\System\wToIRhY.exe
  2⤵
  PID:8332
- C:\Windows\System\gDnQLEP.exe
  C:\Windows\System\gDnQLEP.exe
  2⤵
  PID:7432
- C:\Windows\System\mJmsvyb.exe
  C:\Windows\System\mJmsvyb.exe
  2⤵
  PID:11056
- C:\Windows\System\YBmfCgU.exe
  C:\Windows\System\YBmfCgU.exe
  2⤵
  PID:6100
- C:\Windows\System\HkUOvEF.exe
  C:\Windows\System\HkUOvEF.exe
  2⤵
  PID:2164
- C:\Windows\System\rHezGyE.exe
  C:\Windows\System\rHezGyE.exe
  2⤵
  PID:14732
- C:\Windows\System\icOOuJL.exe
  C:\Windows\System\icOOuJL.exe
  2⤵
  PID:8308
- C:\Windows\System\NiAUPNR.exe
  C:\Windows\System\NiAUPNR.exe
  2⤵
  PID:6704
- C:\Windows\System\cbjaCYl.exe
  C:\Windows\System\cbjaCYl.exe
  2⤵
  PID:6212
- C:\Windows\System\nzEUJyD.exe
  C:\Windows\System\nzEUJyD.exe
  2⤵
  PID:7528
- C:\Windows\System\VEdHSUk.exe
  C:\Windows\System\VEdHSUk.exe
  2⤵
  PID:12068
- C:\Windows\System\opaoelC.exe
  C:\Windows\System\opaoelC.exe
  2⤵
  PID:14636
- C:\Windows\System\UjBlnpF.exe
  C:\Windows\System\UjBlnpF.exe
  2⤵
  PID:12224
- C:\Windows\System\IlWuGTm.exe
  C:\Windows\System\IlWuGTm.exe
  2⤵
  PID:11164
- C:\Windows\System\CLkeVsn.exe
  C:\Windows\System\CLkeVsn.exe
  2⤵
  PID:10632
- C:\Windows\System\qsNcyNS.exe
  C:\Windows\System\qsNcyNS.exe
  2⤵
  PID:9032
- C:\Windows\System\eoDWIyf.exe
  C:\Windows\System\eoDWIyf.exe
  2⤵
  PID:7128
- C:\Windows\System\ldHumBg.exe
  C:\Windows\System\ldHumBg.exe
  2⤵
  PID:10812
- C:\Windows\System\NdZASqA.exe
  C:\Windows\System\NdZASqA.exe
  2⤵
  PID:10612
- C:\Windows\System\TVvaBUG.exe
  C:\Windows\System\TVvaBUG.exe
  2⤵
  PID:12952
- C:\Windows\System\uwPWnge.exe
  C:\Windows\System\uwPWnge.exe
  2⤵
  PID:11932
- C:\Windows\System\RiCUYCy.exe
  C:\Windows\System\RiCUYCy.exe
  2⤵
  PID:12884
- C:\Windows\System\aomXgob.exe
  C:\Windows\System\aomXgob.exe
  2⤵
  PID:10748
- C:\Windows\System\hHOaZiK.exe
  C:\Windows\System\hHOaZiK.exe
  2⤵
  PID:9360
- C:\Windows\System\yDazmDD.exe
  C:\Windows\System\yDazmDD.exe
  2⤵
  PID:9912
- C:\Windows\System\wFKwbbY.exe
  C:\Windows\System\wFKwbbY.exe
  2⤵
  PID:7900
- C:\Windows\System\vEaFZWx.exe
  C:\Windows\System\vEaFZWx.exe
  2⤵
  PID:10856
- C:\Windows\System\TpgnBsz.exe
  C:\Windows\System\TpgnBsz.exe
  2⤵
  PID:9872
- C:\Windows\System\CPBRYTj.exe
  C:\Windows\System\CPBRYTj.exe
  2⤵
  PID:9100
- C:\Windows\System\WjRClwh.exe
  C:\Windows\System\WjRClwh.exe
  2⤵
  PID:8340
- C:\Windows\System\eVywkKe.exe
  C:\Windows\System\eVywkKe.exe
  2⤵
  PID:14696
- C:\Windows\System\uTaDWTa.exe
  C:\Windows\System\uTaDWTa.exe
  2⤵
  PID:10468
- C:\Windows\System\bfNTgos.exe
  C:\Windows\System\bfNTgos.exe
  2⤵
  PID:7020
- C:\Windows\System\nAoMhCE.exe
  C:\Windows\System\nAoMhCE.exe
  2⤵
  PID:7148
- C:\Windows\System\NmAGwkF.exe
  C:\Windows\System\NmAGwkF.exe
  2⤵
  PID:9572
- C:\Windows\System\GwieBAC.exe
  C:\Windows\System\GwieBAC.exe
  2⤵
  PID:11756
- C:\Windows\System\uQISAgz.exe
  C:\Windows\System\uQISAgz.exe
  2⤵
  PID:11952
- C:\Windows\System\hWEmARo.exe
  C:\Windows\System\hWEmARo.exe
  2⤵
  PID:10016
- C:\Windows\System\fHWLIrY.exe
  C:\Windows\System\fHWLIrY.exe
  2⤵
  PID:11476
- C:\Windows\System\xPYrNJr.exe
  C:\Windows\System\xPYrNJr.exe
  2⤵
  PID:11996
- C:\Windows\System\xynmOid.exe
  C:\Windows\System\xynmOid.exe
  2⤵
  PID:14420
- C:\Windows\System\maJOgfv.exe
  C:\Windows\System\maJOgfv.exe
  2⤵
  PID:7252
- C:\Windows\System\HWCvNnF.exe
  C:\Windows\System\HWCvNnF.exe
  2⤵
  PID:3920
- C:\Windows\System\TxtONXi.exe
  C:\Windows\System\TxtONXi.exe
  2⤵
  PID:11276
- C:\Windows\System\Zudakhm.exe
  C:\Windows\System\Zudakhm.exe
  2⤵
  PID:4956
- C:\Windows\System\EbrbuRX.exe
  C:\Windows\System\EbrbuRX.exe
  2⤵
  PID:4872
- C:\Windows\System\xotBexz.exe
  C:\Windows\System\xotBexz.exe
  2⤵
  PID:9512
- C:\Windows\System\JspcXvi.exe
  C:\Windows\System\JspcXvi.exe
  2⤵
  PID:6504
- C:\Windows\System\TKPgwaY.exe
  C:\Windows\System\TKPgwaY.exe
  2⤵
  PID:11724
- C:\Windows\System\XlUUyaX.exe
  C:\Windows\System\XlUUyaX.exe
  2⤵
  PID:4964
- C:\Windows\System\nKEbGwO.exe
  C:\Windows\System\nKEbGwO.exe
  2⤵
  PID:4304
- C:\Windows\System\aOSeVaR.exe
  C:\Windows\System\aOSeVaR.exe
  2⤵
  PID:11760
- C:\Windows\System\dnYHAFI.exe
  C:\Windows\System\dnYHAFI.exe
  2⤵
  PID:9612
- C:\Windows\System\ItUmjdo.exe
  C:\Windows\System\ItUmjdo.exe
  2⤵
  PID:15376
- C:\Windows\System\MktYbyN.exe
  C:\Windows\System\MktYbyN.exe
  2⤵
  PID:15392
- C:\Windows\System\eDTyUNs.exe
  C:\Windows\System\eDTyUNs.exe
  2⤵
  PID:15428
- C:\Windows\System\sezXYYG.exe
  C:\Windows\System\sezXYYG.exe
  2⤵
  PID:15448
- C:\Windows\System\YgiqIxV.exe
  C:\Windows\System\YgiqIxV.exe
  2⤵
  PID:15468
- C:\Windows\System\ewPMlRR.exe
  C:\Windows\System\ewPMlRR.exe
  2⤵
  PID:15496
- C:\Windows\System\hDIjjES.exe
  C:\Windows\System\hDIjjES.exe
  2⤵
  PID:15520
- C:\Windows\System\vUXXOhN.exe
  C:\Windows\System\vUXXOhN.exe
  2⤵
  PID:15544
- C:\Windows\System\NuhsMrC.exe
  C:\Windows\System\NuhsMrC.exe
  2⤵
  PID:15700
- C:\Windows\System\OhnxnBQ.exe
  C:\Windows\System\OhnxnBQ.exe
  2⤵
  PID:15724
- C:\Windows\System\HJQmdaC.exe
  C:\Windows\System\HJQmdaC.exe
  2⤵
  PID:15748
- C:\Windows\System\myBLWlA.exe
  C:\Windows\System\myBLWlA.exe
  2⤵
  PID:15772
- C:\Windows\System\NVQMuor.exe
  C:\Windows\System\NVQMuor.exe
  2⤵
  PID:15804
- C:\Windows\System\TNCUfvc.exe
  C:\Windows\System\TNCUfvc.exe
  2⤵
  PID:15824
- C:\Windows\System\zRkZXMC.exe
  C:\Windows\System\zRkZXMC.exe
  2⤵
  PID:15844
- C:\Windows\System\PIdrKaX.exe
  C:\Windows\System\PIdrKaX.exe
  2⤵
  PID:15868
- C:\Windows\System\zxmJjkF.exe
  C:\Windows\System\zxmJjkF.exe
  2⤵
  PID:15892
- C:\Windows\System\QNRoWOL.exe
  C:\Windows\System\QNRoWOL.exe
  2⤵
  PID:15916
- C:\Windows\System\qwXyEzi.exe
  C:\Windows\System\qwXyEzi.exe
  2⤵
  PID:15936
- C:\Windows\System\kTEKVcL.exe
  C:\Windows\System\kTEKVcL.exe
  2⤵
  PID:15952
- C:\Windows\System\XUCXVnY.exe
  C:\Windows\System\XUCXVnY.exe
  2⤵
  PID:15980
- C:\Windows\System\EcNKnwO.exe
  C:\Windows\System\EcNKnwO.exe
  2⤵
  PID:16004
- C:\Windows\System\WHjofmJ.exe
  C:\Windows\System\WHjofmJ.exe
  2⤵
  PID:16020
- C:\Windows\System\XMoUlPL.exe
  C:\Windows\System\XMoUlPL.exe
  2⤵
  PID:16040
- C:\Windows\System\VOAzXHv.exe
  C:\Windows\System\VOAzXHv.exe
  2⤵
  PID:16064
- C:\Windows\System\oAqVwss.exe
  C:\Windows\System\oAqVwss.exe
  2⤵
  PID:16080
- C:\Windows\System\ykNEONj.exe
  C:\Windows\System\ykNEONj.exe
  2⤵
  PID:16096
- C:\Windows\System\BtyyuiR.exe
  C:\Windows\System\BtyyuiR.exe
  2⤵
  PID:16120
- C:\Windows\System\skVnuoW.exe
  C:\Windows\System\skVnuoW.exe
  2⤵
  PID:15488
- C:\Windows\System\WgTFKgA.exe
  C:\Windows\System\WgTFKgA.exe
  2⤵
  PID:15692
- C:\Windows\System\lKEsCxP.exe
  C:\Windows\System\lKEsCxP.exe
  2⤵
  PID:15564
- C:\Windows\System\vHEAcfw.exe
  C:\Windows\System\vHEAcfw.exe
  2⤵
  PID:15768
- C:\Windows\System\aHtwxeF.exe
  C:\Windows\System\aHtwxeF.exe
  2⤵
  PID:15820
- C:\Windows\System\VzFmRaP.exe
  C:\Windows\System\VzFmRaP.exe
  2⤵
  PID:11416
- C:\Windows\System\iqBruds.exe
  C:\Windows\System\iqBruds.exe
  2⤵
  PID:11364
- C:\Windows\System\fNAKuvJ.exe
  C:\Windows\System\fNAKuvJ.exe
  2⤵
  PID:15992
- C:\Windows\System\wZQAZGd.exe
  C:\Windows\System\wZQAZGd.exe
  2⤵
  PID:15424
- C:\Windows\System\pMQPfVa.exe
  C:\Windows\System\pMQPfVa.exe
  2⤵
  PID:15720
- C:\Windows\System\xVlBuvy.exe
  C:\Windows\System\xVlBuvy.exe
  2⤵
  PID:15608
- C:\Windows\System\DmfgmZk.exe
  C:\Windows\System\DmfgmZk.exe
  2⤵
  PID:15628
- C:\Windows\System\azxzuTs.exe
  C:\Windows\System\azxzuTs.exe
  2⤵
  PID:15948
- C:\Windows\System\gVBdJEw.exe
  C:\Windows\System\gVBdJEw.exe
  2⤵
  PID:16052
- C:\Windows\System\rikqUMA.exe
  C:\Windows\System\rikqUMA.exe
  2⤵
  PID:16372
- C:\Windows\System\btTBrjW.exe
  C:\Windows\System\btTBrjW.exe
  2⤵
  PID:16112
- C:\Windows\System\SIhGFlJ.exe
  C:\Windows\System\SIhGFlJ.exe
  2⤵
  PID:11928
- C:\Windows\System\vWmqdil.exe
  C:\Windows\System\vWmqdil.exe
  2⤵
  PID:11404
- C:\Windows\System\mCHqsrR.exe
  C:\Windows\System\mCHqsrR.exe
  2⤵
  PID:11196
- C:\Windows\System\dIjfHaD.exe
  C:\Windows\System\dIjfHaD.exe
  2⤵
  PID:9004
- C:\Windows\System\HadbLmK.exe
  C:\Windows\System\HadbLmK.exe
  2⤵
  PID:6512
- C:\Windows\System\gsrirUa.exe
  C:\Windows\System\gsrirUa.exe
  2⤵
  PID:5260
- C:\Windows\System\KWaKytc.exe
  C:\Windows\System\KWaKytc.exe
  2⤵
  PID:14816
- C:\Windows\System\BzfLaDD.exe
  C:\Windows\System\BzfLaDD.exe
  2⤵
  PID:11612
- C:\Windows\System\UWpRkqC.exe
  C:\Windows\System\UWpRkqC.exe
  2⤵
  PID:13076
- C:\Windows\System\rJdlZbN.exe
  C:\Windows\System\rJdlZbN.exe
  2⤵
  PID:12496
- C:\Windows\System\UiMrlRD.exe
  C:\Windows\System\UiMrlRD.exe
  2⤵
  PID:13072
- C:\Windows\System\pRXfkys.exe
  C:\Windows\System\pRXfkys.exe
  2⤵
  PID:16056
- C:\Windows\System\VxgckPO.exe
  C:\Windows\System\VxgckPO.exe
  2⤵
  PID:9312
- C:\Windows\System\DWuNXnt.exe
  C:\Windows\System\DWuNXnt.exe
  2⤵
  PID:4948
- C:\Windows\System\nfiHmLo.exe
  C:\Windows\System\nfiHmLo.exe
  2⤵
  PID:12560
- C:\Windows\System\dFWbuqb.exe
  C:\Windows\System\dFWbuqb.exe
  2⤵
  PID:13080
- C:\Windows\System\rtqokLd.exe
  C:\Windows\System\rtqokLd.exe
  2⤵
  PID:11096
- C:\Windows\System\sJZRGPF.exe
  C:\Windows\System\sJZRGPF.exe
  2⤵
  PID:11520
- C:\Windows\System\pVqCMle.exe
  C:\Windows\System\pVqCMle.exe
  2⤵
  PID:11692
- C:\Windows\System\YBaJYVA.exe
  C:\Windows\System\YBaJYVA.exe
  2⤵
  PID:15676
- C:\Windows\System\HlcZeBx.exe
  C:\Windows\System\HlcZeBx.exe
  2⤵
  PID:15716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3952 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
1⤵
PID:10992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wbwn2jkq.iip.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AWtWwmA.exe

Filesize
2.0MB

MD5
1773327ff29805c7f7c5b62e55d5ceb8

SHA1
a883d7008c7e11e58aa9be94df837d86751ea445

SHA256
f41a81dd70620084174a6892ab33fbd1bb7d4ff75ce7cf8efed920a8b1f00166

SHA512
431531e70e38c4134117a30a71661e29305b3b54e9495ec4fe622bec5d8d0c7fa2ee1482669be0605c6fb44ad27942adfaac5057c07037e9016f701145c53d98

Download Submit
C:\Windows\System\AeXGzIr.exe

Filesize
2.0MB

MD5
c9900611f1774551c3b4303cfba3f31f

SHA1
ca962756b83db897909fa41b7c2709137287aa44

SHA256
e339a6631a062b402184986c5a8a384b06f629834f115a26bb271e44e98658e5

SHA512
cab56953a62ab22966cb0ab6c3e5906580a556f15caba50e5c0d4922508e1c4bc40da98cbdf0f941cadccc97d0af1c6673d62d8389dfc90644eb27cd1091bb02

Download Submit
C:\Windows\System\BxxVdeV.exe

Filesize
2.0MB

MD5
a3fbfdb0f19d53bc31d78f2e2ade34c3

SHA1
b7c53e61fa17d4b5ba1aa123f8f240be38d91230

SHA256
4f5a22e7324d61ebe6dcb262a5686a08a910e58233c7806e0ab0782af1a50224

SHA512
c29a3d3ca20c576f5007718e3965622c3a0ee4df0d784d1345b42beb21653183e00648babb711458691a3d95391e535c382cd89dda84cda411b50f954adb28da

Download Submit
C:\Windows\System\ENXpjVf.exe

Filesize
2.0MB

MD5
35f73d59d55f0dd8a9dbfd37fca9580b

SHA1
ac47697c9973408ad095bc98c039f3089f70b093

SHA256
cea3cd3610a7f115f7cef62315bb6158a87aa8fcf26dc97379bed59fd3c4f9ae

SHA512
74252ab2de39bfcea97788793c19b078828b9041fc370888f68be71772225f6d10a36e5571747d7a8e4b3f2d57acafe47232ac334e0553f9fe67a6091a66c7fb

Download Submit
C:\Windows\System\IBwjqbR.exe

Filesize
2.0MB

MD5
854d8d22164a3792e5fa774c9ab7fa4d

SHA1
e580c58616667280975ee0a288f0053583670498

SHA256
5b03eeb4aecb21905597c5c8416f95caaeae800df99a431781c265cd504160c8

SHA512
00287a69a510f98e665a999db976ca328319c9519a2ba54480e1c46dc2c75b71af6306a8e0f84e8071d7019a37c61cd4e32b52834f683837647513e25ecc5b24

Download Submit
C:\Windows\System\IerlkkM.exe

Filesize
2.0MB

MD5
07f9dc7869e20d48b85b5963faf6bea8

SHA1
496cf4d269144d382a62a7ed5e31c4bce967b7bc

SHA256
d19942690a0fe64bf1b5277129225491b61f63f99d01fb23ba315378d92e97c1

SHA512
63cb93e2389f6fa3c65df8c0e549da804e83d97a4fea5072267f353fb47d6cd8c105b2860ea8afc1f5f1785388b34ca731b2146cec1d1ff145f7f3c897ea9245

Download Submit
C:\Windows\System\IrZLcrR.exe

Filesize
2.0MB

MD5
3ebd3f8ba088f2d376d9c07a6e54341e

SHA1
8f2e5d49bdfae4c731617ce6e2075dafec42c75a

SHA256
60f14da63aebaf31d2ab5cd800f7506d3e7005345ee01165ac944584236f8dc8

SHA512
f7def1ada376654a327a0bc0e1bdebe8bd2988207e70d1940262a8bb08cf957a5fdbba93731fccec1f6b5dfd1aed6ef3717406fea37cb51c842f4ad110903c50

Download Submit
C:\Windows\System\JRuwABq.exe

Filesize
2.0MB

MD5
117fbbac33cea36161cefdfbc809965b

SHA1
d21a1012f64bc8d605e60cac4bd2d5dad9b7d13d

SHA256
30df692282703181dceed36e726e6ba0296db30d5a8252b9da7d25e8ad343f0a

SHA512
fd724cb406809d378a169e79686c3f3a8b106f4ea9865b16a248f8924bf600a71d9944117a2c8e1320a63a146b2ea9fa2a97e00c6a8d7fb1cd7ce838b86fce53

Download Submit
C:\Windows\System\MVExQWB.exe

Filesize
2.0MB

MD5
feac4668b1f54bddf29261d3933fb01e

SHA1
5b916600a93df52b4362d0dc4ae32ce2a08b4e88

SHA256
7ab8df591ec35b6ae5fbd1cc0ded83b2bb6611bc1d743f4127d47ceefa8b616d

SHA512
836a6c1564f73b4363363b74a739ba6415d8795cca0989ecc5f45d7b465b6fde230035558f794b2fc5000bc3814df58156647f5a92dd84d3f274d35ded12b0b9

Download Submit
C:\Windows\System\Peeksut.exe

Filesize
2.0MB

MD5
7bf882914d1164b50faccedd0d751759

SHA1
9ba85fff36f43a1104b85df8d35bdf7904f50fbd

SHA256
0bc2163cd1311220154d2c768b2b9ac60ec3d59a7768221f473dc06caba6dc02

SHA512
59517c9f75f3414955c5bc1a7d5be5cd1d6f6279e32986e6ccce418163a5edc887968020a54cb947c0b836d0961d2a55d0e8fcba6f590ea386c2b93589aaaf97

Download Submit
C:\Windows\System\QGiXZRg.exe

Filesize
2.0MB

MD5
551a34d55dce61bf9c319bf7c8b2cefb

SHA1
5233e3e7bb0a819780b6ff6b2cf26cc2ce2adaf6

SHA256
ab0b2dfefecd0ff6bbc4bb884b200dac895379b1ac047d20d0fc53faadfe4981

SHA512
31a49098cc673e9a423bac40e27d90e23181fa89747d72c241a88fbd74d5bc49f106623840196091b26ce4fffa0fedee56d8a40ed23a1c8534fbca94d427a1b6

Download Submit
C:\Windows\System\QWmNKso.exe

Filesize
2.0MB

MD5
955dce0d15c98ca30207023bce3448f1

SHA1
9f1a554b28c0e3f0c04f854fe7828e76dfbc0e8b

SHA256
614902b2da52e66e89f48ea24574a41564e3a64ecb8baeddbba3c33637695821

SHA512
24ebe00dc3b585e6fc95aed06151177379c4cd9ba2b9db1a6eb9524597e5f9baa70ad621fb80a63f6e5236c0ecbe164c305b13b6b90633d374af1eed1bef300d

Download Submit
C:\Windows\System\SJyBRpc.exe

Filesize
2.0MB

MD5
7f638dc453563ae5167803b1ea79b27f

SHA1
12bd2fe4e8b67c8663b2aba4b657efa0aace604f

SHA256
b9534e30861c22a296f8b004a14af2e78c2ac324d11bd9c6f727d0bd2152cf31

SHA512
96450911c664a3353c7e9b2bc540e2c427dd8c2135b586d0a4ebe6e3525f7a2468d5665cc2bc178ea5aa54b3f055361d78bc8c19a32fd1508f68b938afa4222d

Download Submit
C:\Windows\System\THRGIdx.exe

Filesize
2.0MB

MD5
0e693d2081acebfc661cda7a4f12302f

SHA1
2d39cfdea6711837849fe3d4c0b6509e82820905

SHA256
e97bed9fe25bfacb2602e1907d783420f2342f5df5025c807f325d2d692b56f3

SHA512
ab4659f4d781d1d4b0b293b837b928361b43542a48f7d1fb994184afcf757b13fb6f0eb3c40d48df652098fd606ca861174ce20d34d18c7e636348865e2fc6a9

Download Submit
C:\Windows\System\TIZpxKK.exe

Filesize
2.0MB

MD5
ceccffa1ee47bf12908fca57bcdb15cf

SHA1
99af6f9118245070855558ef7947124fbd14f8ca

SHA256
5bdd7d4497d82e54b3411ecc911e78f73d7067090558708435274fade2703023

SHA512
32a68c81382641992152b82a7edb330578578332246d70166a6be4a5b21f3ebd0140edb62c406d6b08df738de81adfff40f9dd7d139a3d2f97cca23ae96b0753

Download Submit
C:\Windows\System\TJhuNSY.exe

Filesize
2.0MB

MD5
8d34fbea10f426a7c5fc38d815ec0252

SHA1
9885ff76676f5b3e14b65c174f07e13cf8c997bd

SHA256
f1ea0cd26b6ca98bc1df846b05b620c64d5e2d605e7a20f920bd6ec063d410b5

SHA512
b75470801be8b59660d42b747f62ef30ad9b546f087748ddbf1a96cb395120a75b4cf14ac1a8b20f94e14e925304a14566662a6a6a737cc2834f19150fe821b7

Download Submit
C:\Windows\System\TZWymCv.exe

Filesize
2.0MB

MD5
6500cedaefc07223225bba382dc38bc4

SHA1
16adb45f6530bae22aa4a44662323d79bb45f2dc

SHA256
b9d6d2e9f22a5dfba09de60ae5b608d6e2f5ec1189e6fea0276cf74d2d1f9ee3

SHA512
6d56540953dc19b8bc71751bedb269efa29c4772aca58b4ac09baa3c48370e6a68cd1a97ea84d105135b05b0fb55e59c59250ad353a4eeab995c948010b972be

Download Submit
C:\Windows\System\UrgAfJf.exe

Filesize
2.0MB

MD5
fbda7bbd9e2a243e999ddbc964a08187

SHA1
d21adf12b3f81b1ac8ea13768a85c3069d76e30a

SHA256
605a0fd1290cdb56e4954aa0fd0d668694a0fef3cb54284dadb906b39fc136a5

SHA512
8ffe6704e8a508e4b564fb7900c13de86624b3dca0295b377bc882241bff70b4db1cb24369a49cb56c40077757df470319f8da35bfa42040d1c55097f50f0287

Download Submit
C:\Windows\System\WZKoxGX.exe

Filesize
2.0MB

MD5
69d7a2b345c8122e8b0894a7886aa7e3

SHA1
2e438ad2a815cc9297342dbbc938094948a4ec83

SHA256
2d3bd53b53b0518740e15ad6fe22042f7f170560e908ba021fce0e24ceec32d3

SHA512
b60dd23024c36c88c65a78b0ece3435d56818fe5d6feadbca80de5ea0b50b61683454af330be5b9a09281b11945b04c0e281442ef18aefc20cccddff99af3811

Download Submit
C:\Windows\System\YXTkKjj.exe

Filesize
2.0MB

MD5
230960eaff1ca79ea87b891552f504ad

SHA1
15c9e7829850cc57945610e809ec96e60755fc9a

SHA256
ba0b82205ccd4c0ac87fe77d43a8aa6dcd1c27861630fb47b42ada73e8464eb9

SHA512
4d97c170eeee4a47aeef59d282a20796ce09c521fab878e482057e54a04c6cccab0125694a04ad91ed89253c43b5f5ce758e50270ce2f686fb1a22aa7abbd476

Download Submit
C:\Windows\System\bQkAOoX.exe

Filesize
2.0MB

MD5
f475ffa08282b7edd154f2418d924a6b

SHA1
c03d1c72ee22f1d7180affa6ca16d52eb308ed79

SHA256
9891a9b31cab7a69ad3fb5483bab288358a4ac785602f3c051b451ee8ca63b7b

SHA512
f21beafa63c6b82cc43737170e2257db8e0f80d17d12fc1de033f6e503fc8ad632fe80f5ca65d54974092c82a1accf41cf445f626254edced05591c911825ce5

Download Submit
C:\Windows\System\beohMci.exe

Filesize
2.0MB

MD5
533fc21be67941cdbe6245babb0c58ac

SHA1
1926f42815f3a8c0f5ab3ddc2973c01a3f475f08

SHA256
3c0fd5bf3227c658f3cf2980ff07d25e8101fbe7b774823122aceaee359e142e

SHA512
7b707d635b278b5d1fe088ffeae1efc6e79f808d9f1f2b30c2627aec49e604a38bcd2eb38d12bd5b0bb759016a57a4d8326e49b6e0e1c94fcc5c85402e61c1f7

Download Submit
C:\Windows\System\cLXuGKo.exe

Filesize
2.0MB

MD5
f862b643598a30cbc9cd613ed7a31205

SHA1
60e17bcf0303b66d41ac5d749e8bc04af9d9cb8c

SHA256
a009125114ac05fc2ee4e5ed2e182dfe0f10ff61054fcc5c5eaf6dce3d87cd2f

SHA512
6f16ee683dffc2abd88f8b18257a1918a1c4040c47d8e193bab08a4903c156b92b66ea64fe29641da05f3661e26b7d44adecf641d8667af32cc61f5f80a59dc8

Download Submit
C:\Windows\System\gjEFULn.exe

Filesize
2.0MB

MD5
b46a89dd3bc16e634f1b6ed373af56a5

SHA1
e4e5e3a8b946de0e972c752784187d9440633947

SHA256
4dbb0abce7f3c33fe490f2e029425ca9cb76564f277a29c28c67b453007eea86

SHA512
42bf76c4da20b9d8d63ff2554947eac09b4580030ff144ec05b07fc7907edbedf5c2feecea899e3a80a4562059cef4e31d2f8ed3ec524bc35ec89ce4dc9c58fc

Download Submit
C:\Windows\System\iYWYvSK.exe

Filesize
2.0MB

MD5
cecd90b066bca977cfd8676f72c49fb7

SHA1
046f73ea7c7d7ef584cd916dc13c17b12201cee2

SHA256
375a5ac0454eb34ad32a9e3440a583865f0a3b844200a36851c5b3434a171330

SHA512
791b298f18359d3c9810be85b30b7fae973f7fed33eb71440ce4bdc48a3398476db0e9d569b0b8c848dab69d92450f33e486eceb591bb37aca444588f3d9341b

Download Submit
C:\Windows\System\ifPUveZ.exe

Filesize
2.0MB

MD5
7f756d4654092bb24d54a23242bd0954

SHA1
43de10d60d6a0b523fe40babf6d942560a02c773

SHA256
2388f49a92de5b356cf346728b0d5e740e0d22e75f659d47eea4aebc4b0de3bb

SHA512
50034ac6a7892dbb908a64f4d30e3bba6109326f647d131f2bc71e2e8e77d5b30a0bdd9eec923b88501b1970673feb55db6d58d1e938356c54896eef5f2b4bb7

Download Submit
C:\Windows\System\jAVaLcg.exe

Filesize
2.0MB

MD5
62c6be78509c4222ab7051f22eae4827

SHA1
b2c7ca1dd323d0002da45ad27e1d1a995e8dcefc

SHA256
e634938ff5c1bdb39e54d0a4952a55ac1f2c790b22c3f0b575a9f996c745038e

SHA512
b26d283dddd1f1b8552813d1d46eb2a1a062bafe02c092cd152cef812f776d0052e7ddd303b0b0dfb86d9c30f4653014ecdba4d2205e029bdc15631cd198b39c

Download Submit
C:\Windows\System\jYUlrpR.exe

Filesize
2.0MB

MD5
d8e246684aaf1e7f5a1afddf82c39253

SHA1
8be5554babd35d48f1626a04ca99f0784a5752e4

SHA256
c6d3e14ba40133e394eff3dbfc98bca42d713e9032f2e0a1cdd5ea369e83467d

SHA512
512c47b710994e0f9158e8f725fd806e0a867bdc79aa0db76da81b3d411fd1625560936deac9eb3c0da5aba709ac88849e638a8aa43b0336a3d5f4276a3c7b2d

Download Submit
C:\Windows\System\oVoXPhx.exe

Filesize
2.0MB

MD5
c8ef2e00e2308545ab0f7b42c77fa9aa

SHA1
4272c383f030b98214dc52ba7d8c21e5593e7ed0

SHA256
4695b9734726cf288412e7cea19e941d16a8496f5585be64760ca6de3a447a33

SHA512
1778ffcaf3ea0fb3d7fdcf6d61cf18f6f9e036fa4611f7137e93416b53e0a0c33e8f915b468b57ae7832d48534453d6c7afc9f3c059e25117b943da3940c026a

Download Submit
C:\Windows\System\pUvCAWm.exe

Filesize
2.0MB

MD5
3ede2e449623dd32f737a26f49e63574

SHA1
5c816c3fd5bd92f07d4156219a2394fba30b3fb0

SHA256
25e06576f634361f394c62a8bffa61f9c3a219b1bff1810252b210bbfdab8461

SHA512
63712eb5c6d205ffae16bf3ff9140ce8e7fad566f85f974f1ab61f0768868b7333e464f810d80961ab86f837d183e28ebf9c8ac10f63bbd717a9158941d11ad5

Download Submit
C:\Windows\System\pmtQNfY.exe

Filesize
2.0MB

MD5
dbcdc6e1059a017cd5c3e1f8ee137c36

SHA1
ebb2451e029a8cd4fc12f3d25455459ad5829df2

SHA256
87c3a49dba0353378fe2ced89cb0750862f4c138fce354edadebc27bc983b164

SHA512
1ad1408c6a18f22400e06853ab4b0a2b4918475ae6a8da40b1ef0141e5ed831c1d3a3a268220f0bf5666514ba2ebe4130589abf9f3dbaf130be84c2eb3720bb8

Download Submit
C:\Windows\System\qBltSwl.exe

Filesize
2.0MB

MD5
7f5860460ff523da47b4cf2945bdcc92

SHA1
5db5d153c0ffb7fc106fbd69010d980d265ebba2

SHA256
48bd5a2e727824114ef9c8ad64a12ed672d7c3f7d26881b0aaf2a7a6316970e1

SHA512
1303a54523a763aba5f1be563daedc1fd12f34bff83b2b3a1ade3553065e8e338ea354cf1355ed7c9a2d5ea01573a20dbf2b219e9e46367e0aa594143482adab

Download Submit
C:\Windows\System\xOsLYci.exe

Filesize
2.0MB

MD5
0533c7128663a0a4306b1e549d7abe6e

SHA1
ba425168364b85827e8d173ac47a21f9f7a3c695

SHA256
ea5638f46787b4403c7b50e2da2cbd2c0f82f06fee69c3303daf2dc22d0c47f0

SHA512
ee5a7fe37654246203b2f7e6d7e67c6349840cb8525c347dfe1e684d5fbfb6ed002250682424e2bf1a71af58187be03e53e6a97d45848ccd0850da0bfc329d26

Download Submit
C:\Windows\System\yIFAvOb.exe

Filesize
2.0MB

MD5
78273d310baf0eefbc8a0a1c0faae164

SHA1
4fd15b6285f9ecd9845163bc1383ceff9c216cec

SHA256
4dfa4d17cdaaf19c3cafd5cc029c03d4b8739279c81b46d7396447e4ab01441f

SHA512
1a21b728bdd973efaeba3fafe58ad456d79d8cf3b77966c0ffdfc5a7a87b15541cfec0fddcd0ea0934138ccf9189a105abe1fa9ae7127fce7fb6ea9e648effdd

Download Submit
C:\Windows\System\zpQytmh.exe

Filesize
2.0MB

MD5
5bcfd87623c3ab7c750c2e08c71b52c9

SHA1
43ccc7d96dcc169330826fe7735f5e62449cee1d

SHA256
086350aff9bf923940516d8f25ab4be68956c780b54257e6b183e7f31e89d9ca

SHA512
9c36687f5dcc20059fda2100a0015543a87b9e9de64e46b9c39ac5f9ee2c16c878d4b6f234b1959922c7b34d86d4a245d2c9c08766284a24a21c881598996ff8

Download Submit
memory/948-1474-0x00007FF69BDF0000-0x00007FF69C1E2000-memory.dmp

Filesize
3.9MB

Download
memory/948-59-0x00007FF69BDF0000-0x00007FF69C1E2000-memory.dmp

Filesize
3.9MB

Download
memory/948-327-0x00007FF69BDF0000-0x00007FF69C1E2000-memory.dmp

Filesize
3.9MB

Download
memory/1188-10-0x00007FF645A30000-0x00007FF645E22000-memory.dmp

Filesize
3.9MB

Download
memory/1188-106-0x00007FF645A30000-0x00007FF645E22000-memory.dmp

Filesize
3.9MB

Download
memory/1188-1319-0x00007FF645A30000-0x00007FF645E22000-memory.dmp

Filesize
3.9MB

Download
memory/1448-322-0x00007FF9D5CB3000-0x00007FF9D5CB5000-memory.dmp

Filesize
8KB

Download
memory/1448-56-0x00007FF9D5CB0000-0x00007FF9D6771000-memory.dmp

Filesize
10.8MB

Download
memory/1448-57-0x00007FF9D5CB0000-0x00007FF9D6771000-memory.dmp

Filesize
10.8MB

Download
memory/1448-20-0x00007FF9D5CB3000-0x00007FF9D5CB5000-memory.dmp

Filesize
8KB

Download
memory/1448-261-0x00007FF9D5CB0000-0x00007FF9D6771000-memory.dmp

Filesize
10.8MB

Download
memory/1448-271-0x000002026EB10000-0x000002026F2B6000-memory.dmp

Filesize
7.6MB

Download
memory/1448-47-0x000002026BD30000-0x000002026BD52000-memory.dmp

Filesize
136KB

Download
memory/1448-354-0x00007FF9D5CB0000-0x00007FF9D6771000-memory.dmp

Filesize
10.8MB

Download
memory/2028-1668-0x00007FF7C31F0000-0x00007FF7C35E2000-memory.dmp

Filesize
3.9MB

Download
memory/2028-211-0x00007FF7C31F0000-0x00007FF7C35E2000-memory.dmp

Filesize
3.9MB

Download
memory/2072-74-0x00007FF711CC0000-0x00007FF7120B2000-memory.dmp

Filesize
3.9MB

Download
memory/2072-1479-0x00007FF711CC0000-0x00007FF7120B2000-memory.dmp

Filesize
3.9MB

Download
memory/2204-1325-0x00007FF7118C0000-0x00007FF711CB2000-memory.dmp

Filesize
3.9MB

Download
memory/2204-60-0x00007FF7118C0000-0x00007FF711CB2000-memory.dmp

Filesize
3.9MB

Download
memory/2316-75-0x00007FF7D0110000-0x00007FF7D0502000-memory.dmp

Filesize
3.9MB

Download
memory/2316-1487-0x00007FF7D0110000-0x00007FF7D0502000-memory.dmp

Filesize
3.9MB

Download
memory/2344-114-0x00007FF7A21A0000-0x00007FF7A2592000-memory.dmp

Filesize
3.9MB

Download
memory/2344-1625-0x00007FF7A21A0000-0x00007FF7A2592000-memory.dmp

Filesize
3.9MB

Download
memory/2388-1637-0x00007FF783A60000-0x00007FF783E52000-memory.dmp

Filesize
3.9MB

Download
memory/2388-214-0x00007FF783A60000-0x00007FF783E52000-memory.dmp

Filesize
3.9MB

Download
memory/2524-162-0x00007FF6718F0000-0x00007FF671CE2000-memory.dmp

Filesize
3.9MB

Download
memory/2524-1657-0x00007FF6718F0000-0x00007FF671CE2000-memory.dmp

Filesize
3.9MB

Download
memory/2732-172-0x00007FF691530000-0x00007FF691922000-memory.dmp

Filesize
3.9MB

Download
memory/2732-1647-0x00007FF691530000-0x00007FF691922000-memory.dmp

Filesize
3.9MB

Download
memory/2816-1607-0x00007FF710AC0000-0x00007FF710EB2000-memory.dmp

Filesize
3.9MB

Download
memory/2816-102-0x00007FF710AC0000-0x00007FF710EB2000-memory.dmp

Filesize
3.9MB

Download
memory/2912-141-0x00007FF608E30000-0x00007FF609222000-memory.dmp

Filesize
3.9MB

Download
memory/2912-1304-0x00007FF608E30000-0x00007FF609222000-memory.dmp

Filesize
3.9MB

Download
memory/2912-19-0x00007FF608E30000-0x00007FF609222000-memory.dmp

Filesize
3.9MB

Download
memory/3076-283-0x00007FF7500E0000-0x00007FF7504D2000-memory.dmp

Filesize
3.9MB

Download
memory/3076-1-0x0000021B46EF0000-0x0000021B46F00000-memory.dmp

Filesize
64KB

Download
memory/3076-0-0x00007FF7500E0000-0x00007FF7504D2000-memory.dmp

Filesize
3.9MB

Download
memory/3076-93-0x00007FF7500E0000-0x00007FF7504D2000-memory.dmp

Filesize
3.9MB

Download
memory/3076-255-0x00007FF7500E0000-0x00007FF7504D2000-memory.dmp

Filesize
3.9MB

Download
memory/3260-1611-0x00007FF775670000-0x00007FF775A62000-memory.dmp

Filesize
3.9MB

Download
memory/3260-152-0x00007FF775670000-0x00007FF775A62000-memory.dmp

Filesize
3.9MB

Download
memory/3316-1322-0x00007FF7DA310000-0x00007FF7DA702000-memory.dmp

Filesize
3.9MB

Download
memory/3316-325-0x00007FF7DA310000-0x00007FF7DA702000-memory.dmp

Filesize
3.9MB

Download
memory/3316-30-0x00007FF7DA310000-0x00007FF7DA702000-memory.dmp

Filesize
3.9MB

Download
memory/3704-1549-0x00007FF6C08C0000-0x00007FF6C0CB2000-memory.dmp

Filesize
3.9MB

Download
memory/3704-81-0x00007FF6C08C0000-0x00007FF6C0CB2000-memory.dmp

Filesize
3.9MB

Download
memory/3732-127-0x00007FF747940000-0x00007FF747D32000-memory.dmp

Filesize
3.9MB

Download
memory/3732-1624-0x00007FF747940000-0x00007FF747D32000-memory.dmp

Filesize
3.9MB

Download
memory/4028-97-0x00007FF718400000-0x00007FF7187F2000-memory.dmp

Filesize
3.9MB

Download
memory/4028-1589-0x00007FF718400000-0x00007FF7187F2000-memory.dmp

Filesize
3.9MB

Download
memory/4736-1308-0x00007FF739D20000-0x00007FF73A112000-memory.dmp

Filesize
3.9MB

Download
memory/4736-12-0x00007FF739D20000-0x00007FF73A112000-memory.dmp

Filesize
3.9MB

Download
memory/4736-135-0x00007FF739D20000-0x00007FF73A112000-memory.dmp

Filesize
3.9MB

Download
memory/4908-111-0x00007FF6C4620000-0x00007FF6C4A12000-memory.dmp

Filesize
3.9MB

Download
memory/4908-1629-0x00007FF6C4620000-0x00007FF6C4A12000-memory.dmp

Filesize
3.9MB

Download
memory/4988-1641-0x00007FF655340000-0x00007FF655732000-memory.dmp

Filesize
3.9MB

Download
memory/4988-231-0x00007FF655340000-0x00007FF655732000-memory.dmp

Filesize
3.9MB

Download
memory/4996-1471-0x00007FF7AAAF0000-0x00007FF7AAEE2000-memory.dmp

Filesize
3.9MB

Download
memory/4996-58-0x00007FF7AAAF0000-0x00007FF7AAEE2000-memory.dmp

Filesize
3.9MB

Download
memory/4996-355-0x00007FF7AAAF0000-0x00007FF7AAEE2000-memory.dmp

Filesize
3.9MB

Download
memory/5028-1326-0x00007FF643B20000-0x00007FF643F12000-memory.dmp

Filesize
3.9MB

Download
memory/5028-61-0x00007FF643B20000-0x00007FF643F12000-memory.dmp

Filesize
3.9MB

Download
memory/5040-246-0x00007FF7DDB70000-0x00007FF7DDF62000-memory.dmp

Filesize
3.9MB

Download
memory/5040-1660-0x00007FF7DDB70000-0x00007FF7DDF62000-memory.dmp

Filesize
3.9MB

Download
memory/5104-150-0x00007FF6A5760000-0x00007FF6A5B52000-memory.dmp

Filesize
3.9MB

Download
memory/5104-1609-0x00007FF6A5760000-0x00007FF6A5B52000-memory.dmp

Filesize
3.9MB

Download