xmrig | 761a53d3e9f1b25c9d4205787a462ce59609fd00fbe5a9b3137df51d5677fd49

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
28-07-2024 00:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
Size

2.2MB
MD5

03c113b2dc2ebd2e7014fbd723bdad45
SHA1

a0524d7f3c77dd8ea6ba60f831272bd676de93b4
SHA256

761a53d3e9f1b25c9d4205787a462ce59609fd00fbe5a9b3137df51d5677fd49
SHA512

f781b4a673edc11f64446e7f56f64e89c8cd59a18dd51cd6810b195e028390d53490517c48a53806d05d3f085ba39ec44eda34f6e1c896a48539cf346b8b3ae2
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9cw+:NABF

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 46 IoCs

miner

resource	yara_rule
behavioral2/memory/2024-257-0x00007FF6036F0000-0x00007FF603AE2000-memory.dmp	xmrig
behavioral2/memory/2276-291-0x00007FF671040000-0x00007FF671432000-memory.dmp	xmrig
behavioral2/memory/2544-315-0x00007FF7B7B00000-0x00007FF7B7EF2000-memory.dmp	xmrig
behavioral2/memory/1536-324-0x00007FF679840000-0x00007FF679C32000-memory.dmp	xmrig
behavioral2/memory/5044-335-0x00007FF63C280000-0x00007FF63C672000-memory.dmp	xmrig
behavioral2/memory/4920-340-0x00007FF706680000-0x00007FF706A72000-memory.dmp	xmrig
behavioral2/memory/696-344-0x00007FF7F6800000-0x00007FF7F6BF2000-memory.dmp	xmrig
behavioral2/memory/4524-346-0x00007FF7FC1E0000-0x00007FF7FC5D2000-memory.dmp	xmrig
behavioral2/memory/2740-345-0x00007FF6DC010000-0x00007FF6DC402000-memory.dmp	xmrig
behavioral2/memory/764-342-0x00007FF7A1C70000-0x00007FF7A2062000-memory.dmp	xmrig
behavioral2/memory/4004-341-0x00007FF64BEC0000-0x00007FF64C2B2000-memory.dmp	xmrig
behavioral2/memory/3844-339-0x00007FF75C3C0000-0x00007FF75C7B2000-memory.dmp	xmrig
behavioral2/memory/448-338-0x00007FF726FE0000-0x00007FF7273D2000-memory.dmp	xmrig
behavioral2/memory/4548-337-0x00007FF6DBCC0000-0x00007FF6DC0B2000-memory.dmp	xmrig
behavioral2/memory/1624-336-0x00007FF7B5270000-0x00007FF7B5662000-memory.dmp	xmrig
behavioral2/memory/2712-334-0x00007FF7A19A0000-0x00007FF7A1D92000-memory.dmp	xmrig
behavioral2/memory/1904-333-0x00007FF684E50000-0x00007FF685242000-memory.dmp	xmrig
behavioral2/memory/1368-332-0x00007FF7571A0000-0x00007FF757592000-memory.dmp	xmrig
behavioral2/memory/4556-331-0x00007FF7D9DD0000-0x00007FF7DA1C2000-memory.dmp	xmrig
behavioral2/memory/2420-330-0x00007FF6FAC80000-0x00007FF6FB072000-memory.dmp	xmrig
behavioral2/memory/808-300-0x00007FF6F3F90000-0x00007FF6F4382000-memory.dmp	xmrig
behavioral2/memory/388-231-0x00007FF721B50000-0x00007FF721F42000-memory.dmp	xmrig
behavioral2/memory/1808-192-0x00007FF611650000-0x00007FF611A42000-memory.dmp	xmrig
behavioral2/memory/808-3315-0x00007FF6F3F90000-0x00007FF6F4382000-memory.dmp	xmrig
behavioral2/memory/1808-3318-0x00007FF611650000-0x00007FF611A42000-memory.dmp	xmrig
behavioral2/memory/2544-3326-0x00007FF7B7B00000-0x00007FF7B7EF2000-memory.dmp	xmrig
behavioral2/memory/2740-3336-0x00007FF6DC010000-0x00007FF6DC402000-memory.dmp	xmrig
behavioral2/memory/2276-3341-0x00007FF671040000-0x00007FF671432000-memory.dmp	xmrig
behavioral2/memory/1536-3354-0x00007FF679840000-0x00007FF679C32000-memory.dmp	xmrig
behavioral2/memory/4556-3362-0x00007FF7D9DD0000-0x00007FF7DA1C2000-memory.dmp	xmrig
behavioral2/memory/4004-3385-0x00007FF64BEC0000-0x00007FF64C2B2000-memory.dmp	xmrig
behavioral2/memory/3844-3398-0x00007FF75C3C0000-0x00007FF75C7B2000-memory.dmp	xmrig
behavioral2/memory/1624-3404-0x00007FF7B5270000-0x00007FF7B5662000-memory.dmp	xmrig
behavioral2/memory/448-3408-0x00007FF726FE0000-0x00007FF7273D2000-memory.dmp	xmrig
behavioral2/memory/696-3439-0x00007FF7F6800000-0x00007FF7F6BF2000-memory.dmp	xmrig
behavioral2/memory/4024-3985-0x00007FF6CE560000-0x00007FF6CE952000-memory.dmp	xmrig
behavioral2/memory/2420-3434-0x00007FF6FAC80000-0x00007FF6FB072000-memory.dmp	xmrig
behavioral2/memory/4524-3422-0x00007FF7FC1E0000-0x00007FF7FC5D2000-memory.dmp	xmrig
behavioral2/memory/4920-3418-0x00007FF706680000-0x00007FF706A72000-memory.dmp	xmrig
behavioral2/memory/4548-3394-0x00007FF6DBCC0000-0x00007FF6DC0B2000-memory.dmp	xmrig
behavioral2/memory/764-3390-0x00007FF7A1C70000-0x00007FF7A2062000-memory.dmp	xmrig
behavioral2/memory/5044-3370-0x00007FF63C280000-0x00007FF63C672000-memory.dmp	xmrig
behavioral2/memory/1904-3361-0x00007FF684E50000-0x00007FF685242000-memory.dmp	xmrig
behavioral2/memory/1368-3359-0x00007FF7571A0000-0x00007FF757592000-memory.dmp	xmrig
behavioral2/memory/2712-3349-0x00007FF7A19A0000-0x00007FF7A1D92000-memory.dmp	xmrig
behavioral2/memory/388-3332-0x00007FF721B50000-0x00007FF721F42000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
10	1336	powershell.exe
12	1336	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1336	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3224	Uctthws.exe
1808	aPwFUPB.exe
388	GJHRenV.exe
2740	wsRSAjP.exe
2024	HFVdifN.exe
808	EKuDpYr.exe
2276	qQcNbZN.exe
2544	dElUolC.exe
1536	fomAomz.exe
2420	omyjQBD.exe
4556	IVfqloA.exe
1368	kdNISBS.exe
1904	VlKDXiY.exe
2712	VVQDzEc.exe
5044	hMSMlcl.exe
1624	hkSRcEJ.exe
4524	cOjNAqA.exe
4548	eGhGuHA.exe
448	vnAjkaP.exe
3844	vYXwMEy.exe
4920	ECgmocl.exe
4004	YxhyVJt.exe
764	IZiAigj.exe
696	yFDPJgA.exe
1896	ejhxTqg.exe
4944	nwbeAnR.exe
1272	zVvUFTh.exe
3748	dXnvAGQ.exe
2124	sxyXaXG.exe
3772	amkRLJn.exe
3940	NKvwmtZ.exe
2408	GRHxotN.exe
4800	sgTsZqd.exe
3496	cCTzmud.exe
2288	LXVCtWN.exe
2364	zChABoL.exe
3064	BFckJpK.exe
2608	YFpOlRz.exe
1968	lSLYVEM.exe
368	yNxStig.exe
5000	uVxpDYW.exe
2076	DBoSDcs.exe
4084	AYJOiFC.exe
3024	xfRKDVJ.exe
2372	bnqiCbd.exe
3244	gbVkzWz.exe
1836	wfsvbcs.exe
656	MVWuqqK.exe
820	ORbqRyJ.exe
4772	flduCmo.exe
5088	mDEAXma.exe
896	cttiauR.exe
5104	CVHbdxG.exe
4656	YfwvuZg.exe
3304	SRAYjxG.exe
4000	gXlxAxu.exe
4396	LCaeqzj.exe
4388	BEIWUrs.exe
1128	ROeVJdi.exe
3892	vtiQEOB.exe
2028	jctmOoI.exe
1760	QGkQrMs.exe
3652	pttNZdL.exe
4300	cigktXZ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4024-0-0x00007FF6CE560000-0x00007FF6CE952000-memory.dmp	upx
behavioral2/files/0x0009000000023401-5.dat	upx
behavioral2/files/0x000700000002345c-8.dat	upx
behavioral2/files/0x0008000000023458-18.dat	upx
behavioral2/files/0x000700000002345d-22.dat	upx
behavioral2/files/0x000700000002345f-40.dat	upx
behavioral2/files/0x0007000000023464-68.dat	upx
behavioral2/files/0x0007000000023465-92.dat	upx
behavioral2/files/0x0007000000023471-124.dat	upx
behavioral2/memory/2024-257-0x00007FF6036F0000-0x00007FF603AE2000-memory.dmp	upx
behavioral2/memory/2276-291-0x00007FF671040000-0x00007FF671432000-memory.dmp	upx
behavioral2/memory/2544-315-0x00007FF7B7B00000-0x00007FF7B7EF2000-memory.dmp	upx
behavioral2/memory/1536-324-0x00007FF679840000-0x00007FF679C32000-memory.dmp	upx
behavioral2/memory/5044-335-0x00007FF63C280000-0x00007FF63C672000-memory.dmp	upx
behavioral2/memory/4920-340-0x00007FF706680000-0x00007FF706A72000-memory.dmp	upx
behavioral2/memory/696-344-0x00007FF7F6800000-0x00007FF7F6BF2000-memory.dmp	upx
behavioral2/memory/4524-346-0x00007FF7FC1E0000-0x00007FF7FC5D2000-memory.dmp	upx
behavioral2/memory/2740-345-0x00007FF6DC010000-0x00007FF6DC402000-memory.dmp	upx
behavioral2/memory/764-342-0x00007FF7A1C70000-0x00007FF7A2062000-memory.dmp	upx
behavioral2/memory/4004-341-0x00007FF64BEC0000-0x00007FF64C2B2000-memory.dmp	upx
behavioral2/memory/3844-339-0x00007FF75C3C0000-0x00007FF75C7B2000-memory.dmp	upx
behavioral2/memory/448-338-0x00007FF726FE0000-0x00007FF7273D2000-memory.dmp	upx
behavioral2/memory/4548-337-0x00007FF6DBCC0000-0x00007FF6DC0B2000-memory.dmp	upx
behavioral2/memory/1624-336-0x00007FF7B5270000-0x00007FF7B5662000-memory.dmp	upx
behavioral2/memory/2712-334-0x00007FF7A19A0000-0x00007FF7A1D92000-memory.dmp	upx
behavioral2/memory/1904-333-0x00007FF684E50000-0x00007FF685242000-memory.dmp	upx
behavioral2/memory/1368-332-0x00007FF7571A0000-0x00007FF757592000-memory.dmp	upx
behavioral2/memory/4556-331-0x00007FF7D9DD0000-0x00007FF7DA1C2000-memory.dmp	upx
behavioral2/memory/2420-330-0x00007FF6FAC80000-0x00007FF6FB072000-memory.dmp	upx
behavioral2/memory/808-300-0x00007FF6F3F90000-0x00007FF6F4382000-memory.dmp	upx
behavioral2/memory/388-231-0x00007FF721B50000-0x00007FF721F42000-memory.dmp	upx
behavioral2/files/0x0008000000023459-189.dat	upx
behavioral2/files/0x000700000002347d-179.dat	upx
behavioral2/files/0x000700000002347a-178.dat	upx
behavioral2/files/0x000700000002347c-174.dat	upx
behavioral2/files/0x000700000002346f-167.dat	upx
behavioral2/memory/1808-192-0x00007FF611650000-0x00007FF611A42000-memory.dmp	upx
behavioral2/files/0x0007000000023478-188.dat	upx
behavioral2/files/0x000700000002347b-166.dat	upx
behavioral2/files/0x0008000000023476-187.dat	upx
behavioral2/files/0x000700000002347e-184.dat	upx
behavioral2/files/0x000700000002346a-180.dat	upx
behavioral2/files/0x000700000002346e-153.dat	upx
behavioral2/files/0x0007000000023479-152.dat	upx
behavioral2/files/0x000700000002346d-147.dat	upx
behavioral2/files/0x000700000002346b-143.dat	upx
behavioral2/files/0x0007000000023477-142.dat	upx
behavioral2/files/0x000700000002346c-141.dat	upx
behavioral2/files/0x0007000000023474-135.dat	upx
behavioral2/files/0x0007000000023473-134.dat	upx
behavioral2/files/0x0007000000023472-133.dat	upx
behavioral2/files/0x0007000000023469-130.dat	upx
behavioral2/files/0x0007000000023468-98.dat	upx
behavioral2/files/0x0007000000023466-94.dat	upx
behavioral2/files/0x0007000000023463-90.dat	upx
behavioral2/files/0x0007000000023470-105.dat	upx
behavioral2/files/0x0007000000023467-79.dat	upx
behavioral2/files/0x0007000000023462-76.dat	upx
behavioral2/files/0x0007000000023461-48.dat	upx
behavioral2/files/0x0007000000023460-62.dat	upx
behavioral2/files/0x000700000002345e-37.dat	upx
behavioral2/memory/3224-11-0x00007FF7625B0000-0x00007FF7629A2000-memory.dmp	upx
behavioral2/memory/808-3315-0x00007FF6F3F90000-0x00007FF6F4382000-memory.dmp	upx
behavioral2/memory/1808-3318-0x00007FF611650000-0x00007FF611A42000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
10	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\wfRBpOn.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\PBSZYFK.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\lqaZEER.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\MZnFYkD.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\hyvIQtR.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\rGAQoNs.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\gBupNDj.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\xHNwtAw.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\JaFUdfQ.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\TkMWdYP.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\JqIuiel.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\duRBrBb.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\NLdLbFt.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\uLIcQFn.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\RerxBbh.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\wDYMIaN.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\ZEBLFtL.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\PQCMKEM.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\UnzHija.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\bMfWDnk.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\MzWPRrL.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\isyNzOY.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\fFjSgGs.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\ugaFotU.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\XKYeImP.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\XynIbJL.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\dQeKfag.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\zVMOdhp.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\ovsDFIT.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\Rfajlnj.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\MmIzAsL.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\kTGGlZd.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\VyGoVGj.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\ggttAsg.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\ulEkGsO.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\ojRcTAA.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\djvNUJv.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\RJHlrDd.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\RDXDyUL.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\vwaYsVJ.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\uOHOnKM.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\dElUolC.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\mjArMeW.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\lynVRcA.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\NoTwUou.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\pftXfLn.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\zkiLzsJ.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\sTUExCn.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\VqkvTFQ.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\LgvpFuT.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\rmonJem.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\byHRfdh.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\wLQVhbS.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\TMfPsXl.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\mCChouE.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\qnmjRYn.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\emkaHdG.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\JdhwuHR.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\olwNlPc.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\eXPEhLm.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\ajSDnJU.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\LKLHauD.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\bmdURMI.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\hhoxhBT.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1336	powershell.exe
1336	powershell.exe
1336	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1336	powershell.exe
Token: SeLockMemoryPrivilege	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4024 wrote to memory of 1336	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	85
PID 4024 wrote to memory of 1336	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	85
PID 4024 wrote to memory of 3224	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	86
PID 4024 wrote to memory of 3224	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	86
PID 4024 wrote to memory of 388	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	87
PID 4024 wrote to memory of 388	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	87
PID 4024 wrote to memory of 1808	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	88
PID 4024 wrote to memory of 1808	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	88
PID 4024 wrote to memory of 2740	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	89
PID 4024 wrote to memory of 2740	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	89
PID 4024 wrote to memory of 2024	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	90
PID 4024 wrote to memory of 2024	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	90
PID 4024 wrote to memory of 808	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	91
PID 4024 wrote to memory of 808	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	91
PID 4024 wrote to memory of 2276	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	92
PID 4024 wrote to memory of 2276	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	92
PID 4024 wrote to memory of 2544	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	93
PID 4024 wrote to memory of 2544	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	93
PID 4024 wrote to memory of 1368	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	94
PID 4024 wrote to memory of 1368	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	94
PID 4024 wrote to memory of 1536	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	95
PID 4024 wrote to memory of 1536	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	95
PID 4024 wrote to memory of 2420	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	96
PID 4024 wrote to memory of 2420	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	96
PID 4024 wrote to memory of 4556	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	97
PID 4024 wrote to memory of 4556	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	97
PID 4024 wrote to memory of 1904	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	98
PID 4024 wrote to memory of 1904	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	98
PID 4024 wrote to memory of 2712	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	99
PID 4024 wrote to memory of 2712	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	99
PID 4024 wrote to memory of 5044	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	100
PID 4024 wrote to memory of 5044	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	100
PID 4024 wrote to memory of 1624	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	101
PID 4024 wrote to memory of 1624	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	101
PID 4024 wrote to memory of 4524	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	102
PID 4024 wrote to memory of 4524	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	102
PID 4024 wrote to memory of 764	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	103
PID 4024 wrote to memory of 764	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	103
PID 4024 wrote to memory of 4548	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	104
PID 4024 wrote to memory of 4548	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	104
PID 4024 wrote to memory of 448	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	105
PID 4024 wrote to memory of 448	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	105
PID 4024 wrote to memory of 3844	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	106
PID 4024 wrote to memory of 3844	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	106
PID 4024 wrote to memory of 4920	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	107
PID 4024 wrote to memory of 4920	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	107
PID 4024 wrote to memory of 4004	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	108
PID 4024 wrote to memory of 4004	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	108
PID 4024 wrote to memory of 696	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	109
PID 4024 wrote to memory of 696	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	109
PID 4024 wrote to memory of 1896	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	110
PID 4024 wrote to memory of 1896	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	110
PID 4024 wrote to memory of 4944	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	111
PID 4024 wrote to memory of 4944	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	111
PID 4024 wrote to memory of 1272	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	112
PID 4024 wrote to memory of 1272	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	112
PID 4024 wrote to memory of 3748	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	113
PID 4024 wrote to memory of 3748	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	113
PID 4024 wrote to memory of 2124	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	114
PID 4024 wrote to memory of 2124	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	114
PID 4024 wrote to memory of 3772	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	115
PID 4024 wrote to memory of 3772	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	115
PID 4024 wrote to memory of 3940	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	116
PID 4024 wrote to memory of 3940	4024	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1336
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1336" "2940" "2876" "2944" "0" "0" "2948" "0" "0" "0" "0" "0"
    3⤵
    PID:11504
- C:\Windows\System\Uctthws.exe
  C:\Windows\System\Uctthws.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\GJHRenV.exe
  C:\Windows\System\GJHRenV.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\aPwFUPB.exe
  C:\Windows\System\aPwFUPB.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\wsRSAjP.exe
  C:\Windows\System\wsRSAjP.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\HFVdifN.exe
  C:\Windows\System\HFVdifN.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\EKuDpYr.exe
  C:\Windows\System\EKuDpYr.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\qQcNbZN.exe
  C:\Windows\System\qQcNbZN.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\dElUolC.exe
  C:\Windows\System\dElUolC.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\kdNISBS.exe
  C:\Windows\System\kdNISBS.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\fomAomz.exe
  C:\Windows\System\fomAomz.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\omyjQBD.exe
  C:\Windows\System\omyjQBD.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\IVfqloA.exe
  C:\Windows\System\IVfqloA.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\VlKDXiY.exe
  C:\Windows\System\VlKDXiY.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\VVQDzEc.exe
  C:\Windows\System\VVQDzEc.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\hMSMlcl.exe
  C:\Windows\System\hMSMlcl.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\hkSRcEJ.exe
  C:\Windows\System\hkSRcEJ.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\cOjNAqA.exe
  C:\Windows\System\cOjNAqA.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\IZiAigj.exe
  C:\Windows\System\IZiAigj.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\eGhGuHA.exe
  C:\Windows\System\eGhGuHA.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\vnAjkaP.exe
  C:\Windows\System\vnAjkaP.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\vYXwMEy.exe
  C:\Windows\System\vYXwMEy.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System\ECgmocl.exe
  C:\Windows\System\ECgmocl.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\YxhyVJt.exe
  C:\Windows\System\YxhyVJt.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\yFDPJgA.exe
  C:\Windows\System\yFDPJgA.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\ejhxTqg.exe
  C:\Windows\System\ejhxTqg.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\nwbeAnR.exe
  C:\Windows\System\nwbeAnR.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\zVvUFTh.exe
  C:\Windows\System\zVvUFTh.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\dXnvAGQ.exe
  C:\Windows\System\dXnvAGQ.exe
  2⤵
  - Executes dropped EXE
  PID:3748
- C:\Windows\System\sxyXaXG.exe
  C:\Windows\System\sxyXaXG.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\amkRLJn.exe
  C:\Windows\System\amkRLJn.exe
  2⤵
  - Executes dropped EXE
  PID:3772
- C:\Windows\System\NKvwmtZ.exe
  C:\Windows\System\NKvwmtZ.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\GRHxotN.exe
  C:\Windows\System\GRHxotN.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\BFckJpK.exe
  C:\Windows\System\BFckJpK.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\sgTsZqd.exe
  C:\Windows\System\sgTsZqd.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\cCTzmud.exe
  C:\Windows\System\cCTzmud.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\LXVCtWN.exe
  C:\Windows\System\LXVCtWN.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\zChABoL.exe
  C:\Windows\System\zChABoL.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\YFpOlRz.exe
  C:\Windows\System\YFpOlRz.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\lSLYVEM.exe
  C:\Windows\System\lSLYVEM.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\yNxStig.exe
  C:\Windows\System\yNxStig.exe
  2⤵
  - Executes dropped EXE
  PID:368
- C:\Windows\System\uVxpDYW.exe
  C:\Windows\System\uVxpDYW.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\DBoSDcs.exe
  C:\Windows\System\DBoSDcs.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\AYJOiFC.exe
  C:\Windows\System\AYJOiFC.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\xfRKDVJ.exe
  C:\Windows\System\xfRKDVJ.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\bnqiCbd.exe
  C:\Windows\System\bnqiCbd.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\gbVkzWz.exe
  C:\Windows\System\gbVkzWz.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\wfsvbcs.exe
  C:\Windows\System\wfsvbcs.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\MVWuqqK.exe
  C:\Windows\System\MVWuqqK.exe
  2⤵
  - Executes dropped EXE
  PID:656
- C:\Windows\System\ORbqRyJ.exe
  C:\Windows\System\ORbqRyJ.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\flduCmo.exe
  C:\Windows\System\flduCmo.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\mDEAXma.exe
  C:\Windows\System\mDEAXma.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\cttiauR.exe
  C:\Windows\System\cttiauR.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\CVHbdxG.exe
  C:\Windows\System\CVHbdxG.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\YfwvuZg.exe
  C:\Windows\System\YfwvuZg.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\SRAYjxG.exe
  C:\Windows\System\SRAYjxG.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System\gXlxAxu.exe
  C:\Windows\System\gXlxAxu.exe
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Windows\System\LCaeqzj.exe
  C:\Windows\System\LCaeqzj.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\BEIWUrs.exe
  C:\Windows\System\BEIWUrs.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\ROeVJdi.exe
  C:\Windows\System\ROeVJdi.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\vtiQEOB.exe
  C:\Windows\System\vtiQEOB.exe
  2⤵
  - Executes dropped EXE
  PID:3892
- C:\Windows\System\jctmOoI.exe
  C:\Windows\System\jctmOoI.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\QGkQrMs.exe
  C:\Windows\System\QGkQrMs.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\pttNZdL.exe
  C:\Windows\System\pttNZdL.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\cigktXZ.exe
  C:\Windows\System\cigktXZ.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\JOiIhry.exe
  C:\Windows\System\JOiIhry.exe
  2⤵
  PID:100
- C:\Windows\System\uSOLXYE.exe
  C:\Windows\System\uSOLXYE.exe
  2⤵
  PID:1584
- C:\Windows\System\ujqRhqc.exe
  C:\Windows\System\ujqRhqc.exe
  2⤵
  PID:3948
- C:\Windows\System\NNGTBiV.exe
  C:\Windows\System\NNGTBiV.exe
  2⤵
  PID:4488
- C:\Windows\System\lIOXaCv.exe
  C:\Windows\System\lIOXaCv.exe
  2⤵
  PID:1924
- C:\Windows\System\SZGqBce.exe
  C:\Windows\System\SZGqBce.exe
  2⤵
  PID:1340
- C:\Windows\System\ymTUyoq.exe
  C:\Windows\System\ymTUyoq.exe
  2⤵
  PID:2452
- C:\Windows\System\EHCmIpP.exe
  C:\Windows\System\EHCmIpP.exe
  2⤵
  PID:2524
- C:\Windows\System\lxlFWFJ.exe
  C:\Windows\System\lxlFWFJ.exe
  2⤵
  PID:3032
- C:\Windows\System\sKthzTC.exe
  C:\Windows\System\sKthzTC.exe
  2⤵
  PID:4016
- C:\Windows\System\yemAnXr.exe
  C:\Windows\System\yemAnXr.exe
  2⤵
  PID:1436
- C:\Windows\System\rEknEbQ.exe
  C:\Windows\System\rEknEbQ.exe
  2⤵
  PID:4304
- C:\Windows\System\wgUeMMh.exe
  C:\Windows\System\wgUeMMh.exe
  2⤵
  PID:5072
- C:\Windows\System\rxhCfsO.exe
  C:\Windows\System\rxhCfsO.exe
  2⤵
  PID:2916
- C:\Windows\System\brmpLzR.exe
  C:\Windows\System\brmpLzR.exe
  2⤵
  PID:3212
- C:\Windows\System\QdePoqb.exe
  C:\Windows\System\QdePoqb.exe
  2⤵
  PID:2960
- C:\Windows\System\pwUzzbG.exe
  C:\Windows\System\pwUzzbG.exe
  2⤵
  PID:5324
- C:\Windows\System\EZIfouT.exe
  C:\Windows\System\EZIfouT.exe
  2⤵
  PID:5356
- C:\Windows\System\UTwAdEt.exe
  C:\Windows\System\UTwAdEt.exe
  2⤵
  PID:5664
- C:\Windows\System\qnakuJf.exe
  C:\Windows\System\qnakuJf.exe
  2⤵
  PID:5692
- C:\Windows\System\pRujDUq.exe
  C:\Windows\System\pRujDUq.exe
  2⤵
  PID:5724
- C:\Windows\System\tNXLRCH.exe
  C:\Windows\System\tNXLRCH.exe
  2⤵
  PID:5748
- C:\Windows\System\QRpoZUr.exe
  C:\Windows\System\QRpoZUr.exe
  2⤵
  PID:5764
- C:\Windows\System\hPzWWiM.exe
  C:\Windows\System\hPzWWiM.exe
  2⤵
  PID:5788
- C:\Windows\System\FAdpMqj.exe
  C:\Windows\System\FAdpMqj.exe
  2⤵
  PID:5812
- C:\Windows\System\Rivpcqt.exe
  C:\Windows\System\Rivpcqt.exe
  2⤵
  PID:5828
- C:\Windows\System\vlcLygG.exe
  C:\Windows\System\vlcLygG.exe
  2⤵
  PID:5856
- C:\Windows\System\JrELMJt.exe
  C:\Windows\System\JrELMJt.exe
  2⤵
  PID:5876
- C:\Windows\System\rWQosDb.exe
  C:\Windows\System\rWQosDb.exe
  2⤵
  PID:5904
- C:\Windows\System\QYJgZQe.exe
  C:\Windows\System\QYJgZQe.exe
  2⤵
  PID:5924
- C:\Windows\System\TYSUcrY.exe
  C:\Windows\System\TYSUcrY.exe
  2⤵
  PID:5952
- C:\Windows\System\ZcyncsX.exe
  C:\Windows\System\ZcyncsX.exe
  2⤵
  PID:5972
- C:\Windows\System\sliHHPt.exe
  C:\Windows\System\sliHHPt.exe
  2⤵
  PID:6004
- C:\Windows\System\vRXLivn.exe
  C:\Windows\System\vRXLivn.exe
  2⤵
  PID:6024
- C:\Windows\System\XOiKDdu.exe
  C:\Windows\System\XOiKDdu.exe
  2⤵
  PID:6052
- C:\Windows\System\NLWhQQc.exe
  C:\Windows\System\NLWhQQc.exe
  2⤵
  PID:6076
- C:\Windows\System\hzVdSSt.exe
  C:\Windows\System\hzVdSSt.exe
  2⤵
  PID:6096
- C:\Windows\System\fLpccws.exe
  C:\Windows\System\fLpccws.exe
  2⤵
  PID:6120
- C:\Windows\System\YVIEFJI.exe
  C:\Windows\System\YVIEFJI.exe
  2⤵
  PID:1724
- C:\Windows\System\AEvQBvq.exe
  C:\Windows\System\AEvQBvq.exe
  2⤵
  PID:2672
- C:\Windows\System\wRovgJc.exe
  C:\Windows\System\wRovgJc.exe
  2⤵
  PID:4828
- C:\Windows\System\MVHavgr.exe
  C:\Windows\System\MVHavgr.exe
  2⤵
  PID:4888
- C:\Windows\System\bqJxPJJ.exe
  C:\Windows\System\bqJxPJJ.exe
  2⤵
  PID:2080
- C:\Windows\System\HXEwvpl.exe
  C:\Windows\System\HXEwvpl.exe
  2⤵
  PID:4824
- C:\Windows\System\tGlCOmI.exe
  C:\Windows\System\tGlCOmI.exe
  2⤵
  PID:2620
- C:\Windows\System\hoNEsAl.exe
  C:\Windows\System\hoNEsAl.exe
  2⤵
  PID:996
- C:\Windows\System\AUwbUix.exe
  C:\Windows\System\AUwbUix.exe
  2⤵
  PID:2128
- C:\Windows\System\MMSVwvs.exe
  C:\Windows\System\MMSVwvs.exe
  2⤵
  PID:4404
- C:\Windows\System\otEgHIE.exe
  C:\Windows\System\otEgHIE.exe
  2⤵
  PID:5132
- C:\Windows\System\aRNaggm.exe
  C:\Windows\System\aRNaggm.exe
  2⤵
  PID:5204
- C:\Windows\System\DjNyKZR.exe
  C:\Windows\System\DjNyKZR.exe
  2⤵
  PID:5296
- C:\Windows\System\FngeYAe.exe
  C:\Windows\System\FngeYAe.exe
  2⤵
  PID:5344
- C:\Windows\System\swdYuPX.exe
  C:\Windows\System\swdYuPX.exe
  2⤵
  PID:1404
- C:\Windows\System\TdfrhzQ.exe
  C:\Windows\System\TdfrhzQ.exe
  2⤵
  PID:1520
- C:\Windows\System\KVhrwWv.exe
  C:\Windows\System\KVhrwWv.exe
  2⤵
  PID:2136
- C:\Windows\System\uYfgIDN.exe
  C:\Windows\System\uYfgIDN.exe
  2⤵
  PID:3700
- C:\Windows\System\VUowZFW.exe
  C:\Windows\System\VUowZFW.exe
  2⤵
  PID:3648
- C:\Windows\System\YcTPiNI.exe
  C:\Windows\System\YcTPiNI.exe
  2⤵
  PID:4312
- C:\Windows\System\yEGGQkb.exe
  C:\Windows\System\yEGGQkb.exe
  2⤵
  PID:3292
- C:\Windows\System\PKylpjh.exe
  C:\Windows\System\PKylpjh.exe
  2⤵
  PID:4164
- C:\Windows\System\JhPTMQT.exe
  C:\Windows\System\JhPTMQT.exe
  2⤵
  PID:4868
- C:\Windows\System\yQwUdxC.exe
  C:\Windows\System\yQwUdxC.exe
  2⤵
  PID:1148
- C:\Windows\System\tyosmaw.exe
  C:\Windows\System\tyosmaw.exe
  2⤵
  PID:2232
- C:\Windows\System\YnucPED.exe
  C:\Windows\System\YnucPED.exe
  2⤵
  PID:5472
- C:\Windows\System\FMsaWpf.exe
  C:\Windows\System\FMsaWpf.exe
  2⤵
  PID:5656
- C:\Windows\System\bKrSkSc.exe
  C:\Windows\System\bKrSkSc.exe
  2⤵
  PID:5720
- C:\Windows\System\nTOAVVg.exe
  C:\Windows\System\nTOAVVg.exe
  2⤵
  PID:5760
- C:\Windows\System\FYQtHvG.exe
  C:\Windows\System\FYQtHvG.exe
  2⤵
  PID:5740
- C:\Windows\System\cHViYeV.exe
  C:\Windows\System\cHViYeV.exe
  2⤵
  PID:5960
- C:\Windows\System\nprYPSs.exe
  C:\Windows\System\nprYPSs.exe
  2⤵
  PID:5872
- C:\Windows\System\JmzoeKN.exe
  C:\Windows\System\JmzoeKN.exe
  2⤵
  PID:5896
- C:\Windows\System\QhBcXbX.exe
  C:\Windows\System\QhBcXbX.exe
  2⤵
  PID:6064
- C:\Windows\System\fNpIAEW.exe
  C:\Windows\System\fNpIAEW.exe
  2⤵
  PID:5988
- C:\Windows\System\mnfbUpF.exe
  C:\Windows\System\mnfbUpF.exe
  2⤵
  PID:6012
- C:\Windows\System\SOJVaDn.exe
  C:\Windows\System\SOJVaDn.exe
  2⤵
  PID:6104
- C:\Windows\System\WsamUNH.exe
  C:\Windows\System\WsamUNH.exe
  2⤵
  PID:2184
- C:\Windows\System\ROMdNbO.exe
  C:\Windows\System\ROMdNbO.exe
  2⤵
  PID:2692
- C:\Windows\System\PeHcBmf.exe
  C:\Windows\System\PeHcBmf.exe
  2⤵
  PID:1888
- C:\Windows\System\NKWBfYH.exe
  C:\Windows\System\NKWBfYH.exe
  2⤵
  PID:5192
- C:\Windows\System\leKNkSW.exe
  C:\Windows\System\leKNkSW.exe
  2⤵
  PID:5336
- C:\Windows\System\VLBLRUa.exe
  C:\Windows\System\VLBLRUa.exe
  2⤵
  PID:4128
- C:\Windows\System\pcujNFX.exe
  C:\Windows\System\pcujNFX.exe
  2⤵
  PID:3356
- C:\Windows\System\MzWPRrL.exe
  C:\Windows\System\MzWPRrL.exe
  2⤵
  PID:2000
- C:\Windows\System\AIlrjjq.exe
  C:\Windows\System\AIlrjjq.exe
  2⤵
  PID:5716
- C:\Windows\System\vRQhmon.exe
  C:\Windows\System\vRQhmon.exe
  2⤵
  PID:1792
- C:\Windows\System\uSnrPcM.exe
  C:\Windows\System\uSnrPcM.exe
  2⤵
  PID:5912
- C:\Windows\System\UddhLyH.exe
  C:\Windows\System\UddhLyH.exe
  2⤵
  PID:6084
- C:\Windows\System\ysqVKhp.exe
  C:\Windows\System\ysqVKhp.exe
  2⤵
  PID:4020
- C:\Windows\System\fCJToIB.exe
  C:\Windows\System\fCJToIB.exe
  2⤵
  PID:5736
- C:\Windows\System\RmFoUep.exe
  C:\Windows\System\RmFoUep.exe
  2⤵
  PID:5780
- C:\Windows\System\FVfGnpT.exe
  C:\Windows\System\FVfGnpT.exe
  2⤵
  PID:6164
- C:\Windows\System\dJGymfZ.exe
  C:\Windows\System\dJGymfZ.exe
  2⤵
  PID:6188
- C:\Windows\System\wzMsdPV.exe
  C:\Windows\System\wzMsdPV.exe
  2⤵
  PID:6204
- C:\Windows\System\amjFLvg.exe
  C:\Windows\System\amjFLvg.exe
  2⤵
  PID:6228
- C:\Windows\System\JIlWwza.exe
  C:\Windows\System\JIlWwza.exe
  2⤵
  PID:6248
- C:\Windows\System\xDsxQsF.exe
  C:\Windows\System\xDsxQsF.exe
  2⤵
  PID:6268
- C:\Windows\System\CjhIbNP.exe
  C:\Windows\System\CjhIbNP.exe
  2⤵
  PID:6292
- C:\Windows\System\zgayehR.exe
  C:\Windows\System\zgayehR.exe
  2⤵
  PID:6312
- C:\Windows\System\TpIGnaI.exe
  C:\Windows\System\TpIGnaI.exe
  2⤵
  PID:6328
- C:\Windows\System\AYwnZVP.exe
  C:\Windows\System\AYwnZVP.exe
  2⤵
  PID:6352
- C:\Windows\System\uPzKSRL.exe
  C:\Windows\System\uPzKSRL.exe
  2⤵
  PID:6376
- C:\Windows\System\KiqNNSi.exe
  C:\Windows\System\KiqNNSi.exe
  2⤵
  PID:6400
- C:\Windows\System\PBjVOcv.exe
  C:\Windows\System\PBjVOcv.exe
  2⤵
  PID:6424
- C:\Windows\System\bSsGwBR.exe
  C:\Windows\System\bSsGwBR.exe
  2⤵
  PID:6444
- C:\Windows\System\daSfbuh.exe
  C:\Windows\System\daSfbuh.exe
  2⤵
  PID:6468
- C:\Windows\System\XPARPcq.exe
  C:\Windows\System\XPARPcq.exe
  2⤵
  PID:6484
- C:\Windows\System\gcCMAjy.exe
  C:\Windows\System\gcCMAjy.exe
  2⤵
  PID:6508
- C:\Windows\System\uLIcQFn.exe
  C:\Windows\System\uLIcQFn.exe
  2⤵
  PID:6528
- C:\Windows\System\UsSNvpg.exe
  C:\Windows\System\UsSNvpg.exe
  2⤵
  PID:6548
- C:\Windows\System\GNpWCUl.exe
  C:\Windows\System\GNpWCUl.exe
  2⤵
  PID:6572
- C:\Windows\System\zWJCSLR.exe
  C:\Windows\System\zWJCSLR.exe
  2⤵
  PID:6592
- C:\Windows\System\iSxxGNY.exe
  C:\Windows\System\iSxxGNY.exe
  2⤵
  PID:6612
- C:\Windows\System\zDabjkh.exe
  C:\Windows\System\zDabjkh.exe
  2⤵
  PID:6640
- C:\Windows\System\ePPCVIh.exe
  C:\Windows\System\ePPCVIh.exe
  2⤵
  PID:6664
- C:\Windows\System\WbQhhUe.exe
  C:\Windows\System\WbQhhUe.exe
  2⤵
  PID:6688
- C:\Windows\System\drrUfOO.exe
  C:\Windows\System\drrUfOO.exe
  2⤵
  PID:6704
- C:\Windows\System\DqrYymk.exe
  C:\Windows\System\DqrYymk.exe
  2⤵
  PID:6736
- C:\Windows\System\iQIqWAW.exe
  C:\Windows\System\iQIqWAW.exe
  2⤵
  PID:6764
- C:\Windows\System\OSkIvOu.exe
  C:\Windows\System\OSkIvOu.exe
  2⤵
  PID:6792
- C:\Windows\System\WlTTETc.exe
  C:\Windows\System\WlTTETc.exe
  2⤵
  PID:6816
- C:\Windows\System\HevHNVj.exe
  C:\Windows\System\HevHNVj.exe
  2⤵
  PID:6836
- C:\Windows\System\cKNFcgU.exe
  C:\Windows\System\cKNFcgU.exe
  2⤵
  PID:6864
- C:\Windows\System\EpwzfAs.exe
  C:\Windows\System\EpwzfAs.exe
  2⤵
  PID:6884
- C:\Windows\System\isyNzOY.exe
  C:\Windows\System\isyNzOY.exe
  2⤵
  PID:6908
- C:\Windows\System\RhVXFZr.exe
  C:\Windows\System\RhVXFZr.exe
  2⤵
  PID:6932
- C:\Windows\System\bjcmNhn.exe
  C:\Windows\System\bjcmNhn.exe
  2⤵
  PID:6956
- C:\Windows\System\clAiFaT.exe
  C:\Windows\System\clAiFaT.exe
  2⤵
  PID:6984
- C:\Windows\System\JLrIpfR.exe
  C:\Windows\System\JLrIpfR.exe
  2⤵
  PID:7008
- C:\Windows\System\CIjSAOf.exe
  C:\Windows\System\CIjSAOf.exe
  2⤵
  PID:7028
- C:\Windows\System\uZfVINx.exe
  C:\Windows\System\uZfVINx.exe
  2⤵
  PID:7056
- C:\Windows\System\LNFIRWg.exe
  C:\Windows\System\LNFIRWg.exe
  2⤵
  PID:7076
- C:\Windows\System\RPmmisy.exe
  C:\Windows\System\RPmmisy.exe
  2⤵
  PID:7100
- C:\Windows\System\JsDAzPk.exe
  C:\Windows\System\JsDAzPk.exe
  2⤵
  PID:7128
- C:\Windows\System\guMzyYg.exe
  C:\Windows\System\guMzyYg.exe
  2⤵
  PID:7148
- C:\Windows\System\XHIbxAD.exe
  C:\Windows\System\XHIbxAD.exe
  2⤵
  PID:3520
- C:\Windows\System\bOPCeGs.exe
  C:\Windows\System\bOPCeGs.exe
  2⤵
  PID:4296
- C:\Windows\System\nLbRbCO.exe
  C:\Windows\System\nLbRbCO.exe
  2⤵
  PID:1660
- C:\Windows\System\KfwUCFs.exe
  C:\Windows\System\KfwUCFs.exe
  2⤵
  PID:5944
- C:\Windows\System\ouSvljv.exe
  C:\Windows\System\ouSvljv.exe
  2⤵
  PID:6156
- C:\Windows\System\IVcDWqx.exe
  C:\Windows\System\IVcDWqx.exe
  2⤵
  PID:6224
- C:\Windows\System\bLXFxLE.exe
  C:\Windows\System\bLXFxLE.exe
  2⤵
  PID:6276
- C:\Windows\System\MlujgYf.exe
  C:\Windows\System\MlujgYf.exe
  2⤵
  PID:5288
- C:\Windows\System\mKDLwNv.exe
  C:\Windows\System\mKDLwNv.exe
  2⤵
  PID:2536
- C:\Windows\System\MurfwqG.exe
  C:\Windows\System\MurfwqG.exe
  2⤵
  PID:2332
- C:\Windows\System\RLbyQQV.exe
  C:\Windows\System\RLbyQQV.exe
  2⤵
  PID:6652
- C:\Windows\System\AGdYGRQ.exe
  C:\Windows\System\AGdYGRQ.exe
  2⤵
  PID:6696
- C:\Windows\System\ebrJjjS.exe
  C:\Windows\System\ebrJjjS.exe
  2⤵
  PID:5184
- C:\Windows\System\CGVUVNP.exe
  C:\Windows\System\CGVUVNP.exe
  2⤵
  PID:6540
- C:\Windows\System\YhBEwSZ.exe
  C:\Windows\System\YhBEwSZ.exe
  2⤵
  PID:6580
- C:\Windows\System\LjENKNs.exe
  C:\Windows\System\LjENKNs.exe
  2⤵
  PID:6632
- C:\Windows\System\XXiXngJ.exe
  C:\Windows\System\XXiXngJ.exe
  2⤵
  PID:6244
- C:\Windows\System\ZYfsOJG.exe
  C:\Windows\System\ZYfsOJG.exe
  2⤵
  PID:6336
- C:\Windows\System\BlfIUeW.exe
  C:\Windows\System\BlfIUeW.exe
  2⤵
  PID:6372
- C:\Windows\System\GSnwLEZ.exe
  C:\Windows\System\GSnwLEZ.exe
  2⤵
  PID:6804
- C:\Windows\System\IopeoAp.exe
  C:\Windows\System\IopeoAp.exe
  2⤵
  PID:7192
- C:\Windows\System\ovsDFIT.exe
  C:\Windows\System\ovsDFIT.exe
  2⤵
  PID:7220
- C:\Windows\System\LjiYyYz.exe
  C:\Windows\System\LjiYyYz.exe
  2⤵
  PID:7244
- C:\Windows\System\bKKMYwU.exe
  C:\Windows\System\bKKMYwU.exe
  2⤵
  PID:7268
- C:\Windows\System\KthCiei.exe
  C:\Windows\System\KthCiei.exe
  2⤵
  PID:7292
- C:\Windows\System\TYsnslw.exe
  C:\Windows\System\TYsnslw.exe
  2⤵
  PID:7312
- C:\Windows\System\UJsXstE.exe
  C:\Windows\System\UJsXstE.exe
  2⤵
  PID:7332
- C:\Windows\System\AXbNeNI.exe
  C:\Windows\System\AXbNeNI.exe
  2⤵
  PID:7352
- C:\Windows\System\xbkhnPf.exe
  C:\Windows\System\xbkhnPf.exe
  2⤵
  PID:7372
- C:\Windows\System\ZafuTJU.exe
  C:\Windows\System\ZafuTJU.exe
  2⤵
  PID:7400
- C:\Windows\System\DSIKqda.exe
  C:\Windows\System\DSIKqda.exe
  2⤵
  PID:7428
- C:\Windows\System\MawTXoE.exe
  C:\Windows\System\MawTXoE.exe
  2⤵
  PID:7444
- C:\Windows\System\dOOtiPh.exe
  C:\Windows\System\dOOtiPh.exe
  2⤵
  PID:7472
- C:\Windows\System\AjbUzpl.exe
  C:\Windows\System\AjbUzpl.exe
  2⤵
  PID:7496
- C:\Windows\System\GkyRziQ.exe
  C:\Windows\System\GkyRziQ.exe
  2⤵
  PID:7516
- C:\Windows\System\oZMoyqW.exe
  C:\Windows\System\oZMoyqW.exe
  2⤵
  PID:7536
- C:\Windows\System\OsvQJjD.exe
  C:\Windows\System\OsvQJjD.exe
  2⤵
  PID:7564
- C:\Windows\System\gVlHjIE.exe
  C:\Windows\System\gVlHjIE.exe
  2⤵
  PID:7584
- C:\Windows\System\ywLVras.exe
  C:\Windows\System\ywLVras.exe
  2⤵
  PID:7608
- C:\Windows\System\iEmbGgY.exe
  C:\Windows\System\iEmbGgY.exe
  2⤵
  PID:7624
- C:\Windows\System\SlmffLr.exe
  C:\Windows\System\SlmffLr.exe
  2⤵
  PID:7648
- C:\Windows\System\uQehLYA.exe
  C:\Windows\System\uQehLYA.exe
  2⤵
  PID:7668
- C:\Windows\System\VpcxxXm.exe
  C:\Windows\System\VpcxxXm.exe
  2⤵
  PID:7692
- C:\Windows\System\UokzeIA.exe
  C:\Windows\System\UokzeIA.exe
  2⤵
  PID:7716
- C:\Windows\System\LimIoFj.exe
  C:\Windows\System\LimIoFj.exe
  2⤵
  PID:7740
- C:\Windows\System\ULfgYPl.exe
  C:\Windows\System\ULfgYPl.exe
  2⤵
  PID:7764
- C:\Windows\System\tXetDSC.exe
  C:\Windows\System\tXetDSC.exe
  2⤵
  PID:7788
- C:\Windows\System\xsgDctf.exe
  C:\Windows\System\xsgDctf.exe
  2⤵
  PID:7820
- C:\Windows\System\tBPkoIc.exe
  C:\Windows\System\tBPkoIc.exe
  2⤵
  PID:7836
- C:\Windows\System\rImqkzw.exe
  C:\Windows\System\rImqkzw.exe
  2⤵
  PID:7860
- C:\Windows\System\JaDJKgr.exe
  C:\Windows\System\JaDJKgr.exe
  2⤵
  PID:7888
- C:\Windows\System\ysqKlYl.exe
  C:\Windows\System\ysqKlYl.exe
  2⤵
  PID:7916
- C:\Windows\System\gqtFByy.exe
  C:\Windows\System\gqtFByy.exe
  2⤵
  PID:7932
- C:\Windows\System\hbanoNW.exe
  C:\Windows\System\hbanoNW.exe
  2⤵
  PID:7952
- C:\Windows\System\XFdgiHo.exe
  C:\Windows\System\XFdgiHo.exe
  2⤵
  PID:7972
- C:\Windows\System\Nntymgn.exe
  C:\Windows\System\Nntymgn.exe
  2⤵
  PID:8000
- C:\Windows\System\DkstmtE.exe
  C:\Windows\System\DkstmtE.exe
  2⤵
  PID:8024
- C:\Windows\System\LeDkSWx.exe
  C:\Windows\System\LeDkSWx.exe
  2⤵
  PID:8044
- C:\Windows\System\iVbMgyp.exe
  C:\Windows\System\iVbMgyp.exe
  2⤵
  PID:8064
- C:\Windows\System\Wzahodq.exe
  C:\Windows\System\Wzahodq.exe
  2⤵
  PID:8088
- C:\Windows\System\wrvnEMN.exe
  C:\Windows\System\wrvnEMN.exe
  2⤵
  PID:8116
- C:\Windows\System\ggttAsg.exe
  C:\Windows\System\ggttAsg.exe
  2⤵
  PID:8132
- C:\Windows\System\QxDfRJf.exe
  C:\Windows\System\QxDfRJf.exe
  2⤵
  PID:8156
- C:\Windows\System\MJiFfVO.exe
  C:\Windows\System\MJiFfVO.exe
  2⤵
  PID:8176
- C:\Windows\System\hgBotcM.exe
  C:\Windows\System\hgBotcM.exe
  2⤵
  PID:6412
- C:\Windows\System\arLIxem.exe
  C:\Windows\System\arLIxem.exe
  2⤵
  PID:6460
- C:\Windows\System\cyIcMMp.exe
  C:\Windows\System\cyIcMMp.exe
  2⤵
  PID:6516
- C:\Windows\System\fqDSDNs.exe
  C:\Windows\System\fqDSDNs.exe
  2⤵
  PID:6564
- C:\Windows\System\rcpgPVN.exe
  C:\Windows\System\rcpgPVN.exe
  2⤵
  PID:6948
- C:\Windows\System\lPDGSCJ.exe
  C:\Windows\System\lPDGSCJ.exe
  2⤵
  PID:6996
- C:\Windows\System\nvFwshb.exe
  C:\Windows\System\nvFwshb.exe
  2⤵
  PID:6728
- C:\Windows\System\AQRBptF.exe
  C:\Windows\System\AQRBptF.exe
  2⤵
  PID:6756
- C:\Windows\System\fABCHdz.exe
  C:\Windows\System\fABCHdz.exe
  2⤵
  PID:7188
- C:\Windows\System\UVYNLYC.exe
  C:\Windows\System\UVYNLYC.exe
  2⤵
  PID:6832
- C:\Windows\System\ttqrgLf.exe
  C:\Windows\System\ttqrgLf.exe
  2⤵
  PID:7108
- C:\Windows\System\ZDAEjeR.exe
  C:\Windows\System\ZDAEjeR.exe
  2⤵
  PID:6916
- C:\Windows\System\RtagqsF.exe
  C:\Windows\System\RtagqsF.exe
  2⤵
  PID:6964
- C:\Windows\System\XVhPAND.exe
  C:\Windows\System\XVhPAND.exe
  2⤵
  PID:3920
- C:\Windows\System\urcLyQM.exe
  C:\Windows\System\urcLyQM.exe
  2⤵
  PID:1644
- C:\Windows\System\XGlFXIu.exe
  C:\Windows\System\XGlFXIu.exe
  2⤵
  PID:6684
- C:\Windows\System\mujDwYj.exe
  C:\Windows\System\mujDwYj.exe
  2⤵
  PID:7072
- C:\Windows\System\JfzwVSw.exe
  C:\Windows\System\JfzwVSw.exe
  2⤵
  PID:6788
- C:\Windows\System\qpJrTnN.exe
  C:\Windows\System\qpJrTnN.exe
  2⤵
  PID:7828
- C:\Windows\System\BmbvGzb.exe
  C:\Windows\System\BmbvGzb.exe
  2⤵
  PID:7908
- C:\Windows\System\ROxhUcs.exe
  C:\Windows\System\ROxhUcs.exe
  2⤵
  PID:5640
- C:\Windows\System\ObLhKkg.exe
  C:\Windows\System\ObLhKkg.exe
  2⤵
  PID:8204
- C:\Windows\System\gaAhzfq.exe
  C:\Windows\System\gaAhzfq.exe
  2⤵
  PID:8228
- C:\Windows\System\cuiFuRn.exe
  C:\Windows\System\cuiFuRn.exe
  2⤵
  PID:8256
- C:\Windows\System\bDqtpBJ.exe
  C:\Windows\System\bDqtpBJ.exe
  2⤵
  PID:8272
- C:\Windows\System\KtIFDbf.exe
  C:\Windows\System\KtIFDbf.exe
  2⤵
  PID:8300
- C:\Windows\System\KpAULpg.exe
  C:\Windows\System\KpAULpg.exe
  2⤵
  PID:8320
- C:\Windows\System\IpLQCNw.exe
  C:\Windows\System\IpLQCNw.exe
  2⤵
  PID:8344
- C:\Windows\System\NQrJCFu.exe
  C:\Windows\System\NQrJCFu.exe
  2⤵
  PID:8364
- C:\Windows\System\XuaEDwf.exe
  C:\Windows\System\XuaEDwf.exe
  2⤵
  PID:8388
- C:\Windows\System\bAovqKq.exe
  C:\Windows\System\bAovqKq.exe
  2⤵
  PID:8412
- C:\Windows\System\DPaAeMo.exe
  C:\Windows\System\DPaAeMo.exe
  2⤵
  PID:8436
- C:\Windows\System\LFVTeGl.exe
  C:\Windows\System\LFVTeGl.exe
  2⤵
  PID:8456
- C:\Windows\System\iGUKVdJ.exe
  C:\Windows\System\iGUKVdJ.exe
  2⤵
  PID:8480
- C:\Windows\System\WkGJJca.exe
  C:\Windows\System\WkGJJca.exe
  2⤵
  PID:8504
- C:\Windows\System\CyLEFVH.exe
  C:\Windows\System\CyLEFVH.exe
  2⤵
  PID:8520
- C:\Windows\System\nAqXVvZ.exe
  C:\Windows\System\nAqXVvZ.exe
  2⤵
  PID:8536
- C:\Windows\System\RISTviY.exe
  C:\Windows\System\RISTviY.exe
  2⤵
  PID:8568
- C:\Windows\System\BAyUmkh.exe
  C:\Windows\System\BAyUmkh.exe
  2⤵
  PID:8584
- C:\Windows\System\OQkhQiK.exe
  C:\Windows\System\OQkhQiK.exe
  2⤵
  PID:8608
- C:\Windows\System\tVUWoWn.exe
  C:\Windows\System\tVUWoWn.exe
  2⤵
  PID:8632
- C:\Windows\System\nkCJUVc.exe
  C:\Windows\System\nkCJUVc.exe
  2⤵
  PID:8660
- C:\Windows\System\WJnAAep.exe
  C:\Windows\System\WJnAAep.exe
  2⤵
  PID:8680
- C:\Windows\System\oJkbCWM.exe
  C:\Windows\System\oJkbCWM.exe
  2⤵
  PID:8704
- C:\Windows\System\JszquuY.exe
  C:\Windows\System\JszquuY.exe
  2⤵
  PID:8728
- C:\Windows\System\fVrmKvW.exe
  C:\Windows\System\fVrmKvW.exe
  2⤵
  PID:8752
- C:\Windows\System\jzVySQZ.exe
  C:\Windows\System\jzVySQZ.exe
  2⤵
  PID:8772
- C:\Windows\System\rCmCYYv.exe
  C:\Windows\System\rCmCYYv.exe
  2⤵
  PID:8796
- C:\Windows\System\ksbBKOV.exe
  C:\Windows\System\ksbBKOV.exe
  2⤵
  PID:8824
- C:\Windows\System\ufvFnlE.exe
  C:\Windows\System\ufvFnlE.exe
  2⤵
  PID:8848
- C:\Windows\System\SHHJKPF.exe
  C:\Windows\System\SHHJKPF.exe
  2⤵
  PID:8868
- C:\Windows\System\SQJoaRv.exe
  C:\Windows\System\SQJoaRv.exe
  2⤵
  PID:8884
- C:\Windows\System\OtZKvkV.exe
  C:\Windows\System\OtZKvkV.exe
  2⤵
  PID:8908
- C:\Windows\System\cPHbmKK.exe
  C:\Windows\System\cPHbmKK.exe
  2⤵
  PID:8932
- C:\Windows\System\ynLQiiN.exe
  C:\Windows\System\ynLQiiN.exe
  2⤵
  PID:8952
- C:\Windows\System\ZAXUlrd.exe
  C:\Windows\System\ZAXUlrd.exe
  2⤵
  PID:8976
- C:\Windows\System\CsNOILF.exe
  C:\Windows\System\CsNOILF.exe
  2⤵
  PID:8996
- C:\Windows\System\cpmszrA.exe
  C:\Windows\System\cpmszrA.exe
  2⤵
  PID:9020
- C:\Windows\System\lbLpKlp.exe
  C:\Windows\System\lbLpKlp.exe
  2⤵
  PID:9044
- C:\Windows\System\cMHYTCQ.exe
  C:\Windows\System\cMHYTCQ.exe
  2⤵
  PID:9076
- C:\Windows\System\iDPXAnn.exe
  C:\Windows\System\iDPXAnn.exe
  2⤵
  PID:9092
- C:\Windows\System\YGRpDGV.exe
  C:\Windows\System\YGRpDGV.exe
  2⤵
  PID:9116
- C:\Windows\System\MhHijBH.exe
  C:\Windows\System\MhHijBH.exe
  2⤵
  PID:9140
- C:\Windows\System\gItcVBk.exe
  C:\Windows\System\gItcVBk.exe
  2⤵
  PID:9160
- C:\Windows\System\vzTDWUT.exe
  C:\Windows\System\vzTDWUT.exe
  2⤵
  PID:9184
- C:\Windows\System\QyKbLHJ.exe
  C:\Windows\System\QyKbLHJ.exe
  2⤵
  PID:9204
- C:\Windows\System\ACbJbcm.exe
  C:\Windows\System\ACbJbcm.exe
  2⤵
  PID:8100
- C:\Windows\System\OhBDPrJ.exe
  C:\Windows\System\OhBDPrJ.exe
  2⤵
  PID:6288
- C:\Windows\System\wxYhNkT.exe
  C:\Windows\System\wxYhNkT.exe
  2⤵
  PID:8144
- C:\Windows\System\zvCwTaU.exe
  C:\Windows\System\zvCwTaU.exe
  2⤵
  PID:6436
- C:\Windows\System\lPhAUHm.exe
  C:\Windows\System\lPhAUHm.exe
  2⤵
  PID:7164
- C:\Windows\System\rkVYfeu.exe
  C:\Windows\System\rkVYfeu.exe
  2⤵
  PID:6700
- C:\Windows\System\IDfozDx.exe
  C:\Windows\System\IDfozDx.exe
  2⤵
  PID:7660
- C:\Windows\System\KPbzGXD.exe
  C:\Windows\System\KPbzGXD.exe
  2⤵
  PID:7736
- C:\Windows\System\ADVhaJv.exe
  C:\Windows\System\ADVhaJv.exe
  2⤵
  PID:7200
- C:\Windows\System\wPxcXdo.exe
  C:\Windows\System\wPxcXdo.exe
  2⤵
  PID:6852
- C:\Windows\System\aDQXgyZ.exe
  C:\Windows\System\aDQXgyZ.exe
  2⤵
  PID:2384
- C:\Windows\System\cuhVqxG.exe
  C:\Windows\System\cuhVqxG.exe
  2⤵
  PID:7284
- C:\Windows\System\ppqWHgP.exe
  C:\Windows\System\ppqWHgP.exe
  2⤵
  PID:7324
- C:\Windows\System\DyDrOHL.exe
  C:\Windows\System\DyDrOHL.exe
  2⤵
  PID:7940
- C:\Windows\System\tfZuorj.exe
  C:\Windows\System\tfZuorj.exe
  2⤵
  PID:7416
- C:\Windows\System\DhyLkoX.exe
  C:\Windows\System\DhyLkoX.exe
  2⤵
  PID:7440
- C:\Windows\System\junbfwT.exe
  C:\Windows\System\junbfwT.exe
  2⤵
  PID:8056
- C:\Windows\System\xQlvgLF.exe
  C:\Windows\System\xQlvgLF.exe
  2⤵
  PID:8292
- C:\Windows\System\nHgVYNP.exe
  C:\Windows\System\nHgVYNP.exe
  2⤵
  PID:8408
- C:\Windows\System\NPziVbE.exe
  C:\Windows\System\NPziVbE.exe
  2⤵
  PID:7580
- C:\Windows\System\GUoyrHB.exe
  C:\Windows\System\GUoyrHB.exe
  2⤵
  PID:8600
- C:\Windows\System\tMeYKBx.exe
  C:\Windows\System\tMeYKBx.exe
  2⤵
  PID:8696
- C:\Windows\System\vOjZqGH.exe
  C:\Windows\System\vOjZqGH.exe
  2⤵
  PID:8748
- C:\Windows\System\wVdviyf.exe
  C:\Windows\System\wVdviyf.exe
  2⤵
  PID:7724
- C:\Windows\System\rtwbEEe.exe
  C:\Windows\System\rtwbEEe.exe
  2⤵
  PID:8808
- C:\Windows\System\ACGMNbg.exe
  C:\Windows\System\ACGMNbg.exe
  2⤵
  PID:9240
- C:\Windows\System\XtpdVhO.exe
  C:\Windows\System\XtpdVhO.exe
  2⤵
  PID:9264
- C:\Windows\System\cWGkRzS.exe
  C:\Windows\System\cWGkRzS.exe
  2⤵
  PID:9284
- C:\Windows\System\MKDQCQW.exe
  C:\Windows\System\MKDQCQW.exe
  2⤵
  PID:9308
- C:\Windows\System\otJmssC.exe
  C:\Windows\System\otJmssC.exe
  2⤵
  PID:9332
- C:\Windows\System\lIJLZzz.exe
  C:\Windows\System\lIJLZzz.exe
  2⤵
  PID:9356
- C:\Windows\System\WlJBDzS.exe
  C:\Windows\System\WlJBDzS.exe
  2⤵
  PID:9376
- C:\Windows\System\eErIpaX.exe
  C:\Windows\System\eErIpaX.exe
  2⤵
  PID:9396
- C:\Windows\System\KWYonVM.exe
  C:\Windows\System\KWYonVM.exe
  2⤵
  PID:9416
- C:\Windows\System\lHHnokv.exe
  C:\Windows\System\lHHnokv.exe
  2⤵
  PID:9440
- C:\Windows\System\GEflJHO.exe
  C:\Windows\System\GEflJHO.exe
  2⤵
  PID:9464
- C:\Windows\System\ZvjIJPa.exe
  C:\Windows\System\ZvjIJPa.exe
  2⤵
  PID:9484
- C:\Windows\System\NRCarQK.exe
  C:\Windows\System\NRCarQK.exe
  2⤵
  PID:9512
- C:\Windows\System\AeyPgZb.exe
  C:\Windows\System\AeyPgZb.exe
  2⤵
  PID:9532
- C:\Windows\System\VoQeFKl.exe
  C:\Windows\System\VoQeFKl.exe
  2⤵
  PID:9556
- C:\Windows\System\DybqpfX.exe
  C:\Windows\System\DybqpfX.exe
  2⤵
  PID:9580
- C:\Windows\System\xNOnzNM.exe
  C:\Windows\System\xNOnzNM.exe
  2⤵
  PID:9600
- C:\Windows\System\dpidkJa.exe
  C:\Windows\System\dpidkJa.exe
  2⤵
  PID:9624
- C:\Windows\System\WcEPGna.exe
  C:\Windows\System\WcEPGna.exe
  2⤵
  PID:9648
- C:\Windows\System\gqenWap.exe
  C:\Windows\System\gqenWap.exe
  2⤵
  PID:9668
- C:\Windows\System\wYEgSKZ.exe
  C:\Windows\System\wYEgSKZ.exe
  2⤵
  PID:9696
- C:\Windows\System\ehbJKLg.exe
  C:\Windows\System\ehbJKLg.exe
  2⤵
  PID:9720
- C:\Windows\System\PBjVGMx.exe
  C:\Windows\System\PBjVGMx.exe
  2⤵
  PID:9740
- C:\Windows\System\TsMnDhj.exe
  C:\Windows\System\TsMnDhj.exe
  2⤵
  PID:9764
- C:\Windows\System\LsLFibx.exe
  C:\Windows\System\LsLFibx.exe
  2⤵
  PID:9784
- C:\Windows\System\hIPAFoB.exe
  C:\Windows\System\hIPAFoB.exe
  2⤵
  PID:9804
- C:\Windows\System\CkJxtjh.exe
  C:\Windows\System\CkJxtjh.exe
  2⤵
  PID:9824
- C:\Windows\System\jlVdimH.exe
  C:\Windows\System\jlVdimH.exe
  2⤵
  PID:9844
- C:\Windows\System\KCWNuYa.exe
  C:\Windows\System\KCWNuYa.exe
  2⤵
  PID:9868
- C:\Windows\System\keTuMYY.exe
  C:\Windows\System\keTuMYY.exe
  2⤵
  PID:9888
- C:\Windows\System\mCDpfFx.exe
  C:\Windows\System\mCDpfFx.exe
  2⤵
  PID:9908
- C:\Windows\System\cnwDdUV.exe
  C:\Windows\System\cnwDdUV.exe
  2⤵
  PID:9932
- C:\Windows\System\cZzEfsr.exe
  C:\Windows\System\cZzEfsr.exe
  2⤵
  PID:9956
- C:\Windows\System\yveHGPh.exe
  C:\Windows\System\yveHGPh.exe
  2⤵
  PID:9980
- C:\Windows\System\GpRQHwx.exe
  C:\Windows\System\GpRQHwx.exe
  2⤵
  PID:10004
- C:\Windows\System\ObYNwaD.exe
  C:\Windows\System\ObYNwaD.exe
  2⤵
  PID:10028
- C:\Windows\System\oBAqxow.exe
  C:\Windows\System\oBAqxow.exe
  2⤵
  PID:10052
- C:\Windows\System\pjtAKHt.exe
  C:\Windows\System\pjtAKHt.exe
  2⤵
  PID:10068
- C:\Windows\System\TJctNZQ.exe
  C:\Windows\System\TJctNZQ.exe
  2⤵
  PID:10088
- C:\Windows\System\MPyJbgq.exe
  C:\Windows\System\MPyJbgq.exe
  2⤵
  PID:10108
- C:\Windows\System\WKmNElK.exe
  C:\Windows\System\WKmNElK.exe
  2⤵
  PID:10128
- C:\Windows\System\TCNnCEJ.exe
  C:\Windows\System\TCNnCEJ.exe
  2⤵
  PID:10148
- C:\Windows\System\sXyjWca.exe
  C:\Windows\System\sXyjWca.exe
  2⤵
  PID:10172
- C:\Windows\System\EZgEbnO.exe
  C:\Windows\System\EZgEbnO.exe
  2⤵
  PID:10196
- C:\Windows\System\riyaPJi.exe
  C:\Windows\System\riyaPJi.exe
  2⤵
  PID:10232
- C:\Windows\System\AfCdFpZ.exe
  C:\Windows\System\AfCdFpZ.exe
  2⤵
  PID:7256
- C:\Windows\System\NAltJTc.exe
  C:\Windows\System\NAltJTc.exe
  2⤵
  PID:8944
- C:\Windows\System\bPJmGaC.exe
  C:\Windows\System\bPJmGaC.exe
  2⤵
  PID:8984
- C:\Windows\System\oekZvQa.exe
  C:\Windows\System\oekZvQa.exe
  2⤵
  PID:7968
- C:\Windows\System\tnRiWKJ.exe
  C:\Windows\System\tnRiWKJ.exe
  2⤵
  PID:7992
- C:\Windows\System\ZrHgRcb.exe
  C:\Windows\System\ZrHgRcb.exe
  2⤵
  PID:7252
- C:\Windows\System\PFOhNZS.exe
  C:\Windows\System\PFOhNZS.exe
  2⤵
  PID:9064
- C:\Windows\System\brNADpP.exe
  C:\Windows\System\brNADpP.exe
  2⤵
  PID:9124
- C:\Windows\System\oMEawSe.exe
  C:\Windows\System\oMEawSe.exe
  2⤵
  PID:8072
- C:\Windows\System\mufXzTO.exe
  C:\Windows\System\mufXzTO.exe
  2⤵
  PID:9212
- C:\Windows\System\sxqiVXo.exe
  C:\Windows\System\sxqiVXo.exe
  2⤵
  PID:8248
- C:\Windows\System\LVDTToX.exe
  C:\Windows\System\LVDTToX.exe
  2⤵
  PID:5632
- C:\Windows\System\kYSsDEv.exe
  C:\Windows\System\kYSsDEv.exe
  2⤵
  PID:8372
- C:\Windows\System\fVjpKau.exe
  C:\Windows\System\fVjpKau.exe
  2⤵
  PID:8396
- C:\Windows\System\eKWXnPh.exe
  C:\Windows\System\eKWXnPh.exe
  2⤵
  PID:8172
- C:\Windows\System\hvvhwMR.exe
  C:\Windows\System\hvvhwMR.exe
  2⤵
  PID:8468
- C:\Windows\System\HmxwRDf.exe
  C:\Windows\System\HmxwRDf.exe
  2⤵
  PID:8544
- C:\Windows\System\WsSxIiM.exe
  C:\Windows\System\WsSxIiM.exe
  2⤵
  PID:6476
- C:\Windows\System\UjVpOKy.exe
  C:\Windows\System\UjVpOKy.exe
  2⤵
  PID:6088
- C:\Windows\System\fGnjAih.exe
  C:\Windows\System\fGnjAih.exe
  2⤵
  PID:8280
- C:\Windows\System\mwxpkhH.exe
  C:\Windows\System\mwxpkhH.exe
  2⤵
  PID:8764
- C:\Windows\System\UcGmAIX.exe
  C:\Windows\System\UcGmAIX.exe
  2⤵
  PID:7780
- C:\Windows\System\HmglRTv.exe
  C:\Windows\System\HmglRTv.exe
  2⤵
  PID:9252
- C:\Windows\System\GUJXTPI.exe
  C:\Windows\System\GUJXTPI.exe
  2⤵
  PID:1788
- C:\Windows\System\GhuxdLd.exe
  C:\Windows\System\GhuxdLd.exe
  2⤵
  PID:7508
- C:\Windows\System\QkEnMVD.exe
  C:\Windows\System\QkEnMVD.exe
  2⤵
  PID:9456
- C:\Windows\System\CacYuPy.exe
  C:\Windows\System\CacYuPy.exe
  2⤵
  PID:10260
- C:\Windows\System\nhMPhft.exe
  C:\Windows\System\nhMPhft.exe
  2⤵
  PID:10292
- C:\Windows\System\MxcXoXm.exe
  C:\Windows\System\MxcXoXm.exe
  2⤵
  PID:10312
- C:\Windows\System\nJeutzL.exe
  C:\Windows\System\nJeutzL.exe
  2⤵
  PID:10340
- C:\Windows\System\PFzAQjl.exe
  C:\Windows\System\PFzAQjl.exe
  2⤵
  PID:10364
- C:\Windows\System\oHFtgZV.exe
  C:\Windows\System\oHFtgZV.exe
  2⤵
  PID:10388
- C:\Windows\System\mBxSpux.exe
  C:\Windows\System\mBxSpux.exe
  2⤵
  PID:10412
- C:\Windows\System\hrpiNdT.exe
  C:\Windows\System\hrpiNdT.exe
  2⤵
  PID:10436
- C:\Windows\System\QorSQUv.exe
  C:\Windows\System\QorSQUv.exe
  2⤵
  PID:10456
- C:\Windows\System\wQjkyKN.exe
  C:\Windows\System\wQjkyKN.exe
  2⤵
  PID:10480
- C:\Windows\System\ilwYpVp.exe
  C:\Windows\System\ilwYpVp.exe
  2⤵
  PID:10504
- C:\Windows\System\ZYaVQhx.exe
  C:\Windows\System\ZYaVQhx.exe
  2⤵
  PID:10524
- C:\Windows\System\CgWUNql.exe
  C:\Windows\System\CgWUNql.exe
  2⤵
  PID:10540
- C:\Windows\System\moTHRgm.exe
  C:\Windows\System\moTHRgm.exe
  2⤵
  PID:10560
- C:\Windows\System\NzEiPEW.exe
  C:\Windows\System\NzEiPEW.exe
  2⤵
  PID:10580
- C:\Windows\System\luuBIIb.exe
  C:\Windows\System\luuBIIb.exe
  2⤵
  PID:10604
- C:\Windows\System\zLenVur.exe
  C:\Windows\System\zLenVur.exe
  2⤵
  PID:10628
- C:\Windows\System\KbwjiLI.exe
  C:\Windows\System\KbwjiLI.exe
  2⤵
  PID:10648
- C:\Windows\System\OKkKupB.exe
  C:\Windows\System\OKkKupB.exe
  2⤵
  PID:10672
- C:\Windows\System\nqMJmzD.exe
  C:\Windows\System\nqMJmzD.exe
  2⤵
  PID:10692
- C:\Windows\System\qOQaaPx.exe
  C:\Windows\System\qOQaaPx.exe
  2⤵
  PID:10712
- C:\Windows\System\eqdXoFy.exe
  C:\Windows\System\eqdXoFy.exe
  2⤵
  PID:10740
- C:\Windows\System\idpUJAt.exe
  C:\Windows\System\idpUJAt.exe
  2⤵
  PID:10760
- C:\Windows\System\tHytsPa.exe
  C:\Windows\System\tHytsPa.exe
  2⤵
  PID:10784
- C:\Windows\System\jzVUWZr.exe
  C:\Windows\System\jzVUWZr.exe
  2⤵
  PID:10804
- C:\Windows\System\hQSbpcm.exe
  C:\Windows\System\hQSbpcm.exe
  2⤵
  PID:10836
- C:\Windows\System\QOnLpMs.exe
  C:\Windows\System\QOnLpMs.exe
  2⤵
  PID:10864
- C:\Windows\System\BeWiFSr.exe
  C:\Windows\System\BeWiFSr.exe
  2⤵
  PID:10884
- C:\Windows\System\ZlFYJDc.exe
  C:\Windows\System\ZlFYJDc.exe
  2⤵
  PID:10908
- C:\Windows\System\jDkGrXa.exe
  C:\Windows\System\jDkGrXa.exe
  2⤵
  PID:10932
- C:\Windows\System\GwITCxK.exe
  C:\Windows\System\GwITCxK.exe
  2⤵
  PID:10948
- C:\Windows\System\nqwsaks.exe
  C:\Windows\System\nqwsaks.exe
  2⤵
  PID:10972
- C:\Windows\System\LxmeFaB.exe
  C:\Windows\System\LxmeFaB.exe
  2⤵
  PID:11004
- C:\Windows\System\VvdLYNB.exe
  C:\Windows\System\VvdLYNB.exe
  2⤵
  PID:11040
- C:\Windows\System\TNEhcxt.exe
  C:\Windows\System\TNEhcxt.exe
  2⤵
  PID:11056
- C:\Windows\System\YtXFjuq.exe
  C:\Windows\System\YtXFjuq.exe
  2⤵
  PID:11076
- C:\Windows\System\ZXOgVrC.exe
  C:\Windows\System\ZXOgVrC.exe
  2⤵
  PID:11100
- C:\Windows\System\uFfihDk.exe
  C:\Windows\System\uFfihDk.exe
  2⤵
  PID:11132
- C:\Windows\System\AsJbxbU.exe
  C:\Windows\System\AsJbxbU.exe
  2⤵
  PID:11156
- C:\Windows\System\KNFMbUG.exe
  C:\Windows\System\KNFMbUG.exe
  2⤵
  PID:11172
- C:\Windows\System\CfFhPGY.exe
  C:\Windows\System\CfFhPGY.exe
  2⤵
  PID:11196
- C:\Windows\System\NhnhHJi.exe
  C:\Windows\System\NhnhHJi.exe
  2⤵
  PID:11224
- C:\Windows\System\Fvgdjue.exe
  C:\Windows\System\Fvgdjue.exe
  2⤵
  PID:11244
- C:\Windows\System\aFNahyv.exe
  C:\Windows\System\aFNahyv.exe
  2⤵
  PID:7532
- C:\Windows\System\KBZopDj.exe
  C:\Windows\System\KBZopDj.exe
  2⤵
  PID:9524
- C:\Windows\System\OhESluh.exe
  C:\Windows\System\OhESluh.exe
  2⤵
  PID:9588
- C:\Windows\System\mGHVOUP.exe
  C:\Windows\System\mGHVOUP.exe
  2⤵
  PID:8212
- C:\Windows\System\HHrvNQO.exe
  C:\Windows\System\HHrvNQO.exe
  2⤵
  PID:6240
- C:\Windows\System\owqTIdv.exe
  C:\Windows\System\owqTIdv.exe
  2⤵
  PID:8124
- C:\Windows\System\PWDDsai.exe
  C:\Windows\System\PWDDsai.exe
  2⤵
  PID:9876
- C:\Windows\System\pLCsufH.exe
  C:\Windows\System\pLCsufH.exe
  2⤵
  PID:9952
- C:\Windows\System\MAIqsfL.exe
  C:\Windows\System\MAIqsfL.exe
  2⤵
  PID:10020
- C:\Windows\System\fizMvVu.exe
  C:\Windows\System\fizMvVu.exe
  2⤵
  PID:10084
- C:\Windows\System\dLsJXzI.exe
  C:\Windows\System\dLsJXzI.exe
  2⤵
  PID:7304
- C:\Windows\System\HfYxFXu.exe
  C:\Windows\System\HfYxFXu.exe
  2⤵
  PID:3656
- C:\Windows\System\XShsuAB.exe
  C:\Windows\System\XShsuAB.exe
  2⤵
  PID:8012
- C:\Windows\System\IGDkmvx.exe
  C:\Windows\System\IGDkmvx.exe
  2⤵
  PID:8288
- C:\Windows\System\TRLjWqK.exe
  C:\Windows\System\TRLjWqK.exe
  2⤵
  PID:6716
- C:\Windows\System\yHkJSfM.exe
  C:\Windows\System\yHkJSfM.exe
  2⤵
  PID:6396
- C:\Windows\System\QnLqZhu.exe
  C:\Windows\System\QnLqZhu.exe
  2⤵
  PID:11276
- C:\Windows\System\PWYjIPI.exe
  C:\Windows\System\PWYjIPI.exe
  2⤵
  PID:11296
- C:\Windows\System\LRpiPVb.exe
  C:\Windows\System\LRpiPVb.exe
  2⤵
  PID:11312
- C:\Windows\System\naQSmnF.exe
  C:\Windows\System\naQSmnF.exe
  2⤵
  PID:11332
- C:\Windows\System\IdlmeBm.exe
  C:\Windows\System\IdlmeBm.exe
  2⤵
  PID:11356
- C:\Windows\System\hdmrFcw.exe
  C:\Windows\System\hdmrFcw.exe
  2⤵
  PID:11380
- C:\Windows\System\aomrTpw.exe
  C:\Windows\System\aomrTpw.exe
  2⤵
  PID:11400
- C:\Windows\System\dqmCHuh.exe
  C:\Windows\System\dqmCHuh.exe
  2⤵
  PID:11428
- C:\Windows\System\EfdJvmH.exe
  C:\Windows\System\EfdJvmH.exe
  2⤵
  PID:11444
- C:\Windows\System\HqWcfYr.exe
  C:\Windows\System\HqWcfYr.exe
  2⤵
  PID:11468
- C:\Windows\System\bDMSWlq.exe
  C:\Windows\System\bDMSWlq.exe
  2⤵
  PID:11492
- C:\Windows\System\TctHrLV.exe
  C:\Windows\System\TctHrLV.exe
  2⤵
  PID:11520
- C:\Windows\System\TpVrFYC.exe
  C:\Windows\System\TpVrFYC.exe
  2⤵
  PID:11540
- C:\Windows\System\VMQUUIe.exe
  C:\Windows\System\VMQUUIe.exe
  2⤵
  PID:11568
- C:\Windows\System\YCHRmXD.exe
  C:\Windows\System\YCHRmXD.exe
  2⤵
  PID:11588
- C:\Windows\System\VVFTHCk.exe
  C:\Windows\System\VVFTHCk.exe
  2⤵
  PID:11612
- C:\Windows\System\vRUKceC.exe
  C:\Windows\System\vRUKceC.exe
  2⤵
  PID:11636
- C:\Windows\System\aZAWfqp.exe
  C:\Windows\System\aZAWfqp.exe
  2⤵
  PID:11660
- C:\Windows\System\TICNesJ.exe
  C:\Windows\System\TICNesJ.exe
  2⤵
  PID:11680
- C:\Windows\System\LmtWKvj.exe
  C:\Windows\System\LmtWKvj.exe
  2⤵
  PID:11708
- C:\Windows\System\RCvgSBh.exe
  C:\Windows\System\RCvgSBh.exe
  2⤵
  PID:11732
- C:\Windows\System\bwIhlOt.exe
  C:\Windows\System\bwIhlOt.exe
  2⤵
  PID:11756
- C:\Windows\System\SJjdygT.exe
  C:\Windows\System\SJjdygT.exe
  2⤵
  PID:11780
- C:\Windows\System\RvvLTLF.exe
  C:\Windows\System\RvvLTLF.exe
  2⤵
  PID:11800
- C:\Windows\System\ZeTXpiv.exe
  C:\Windows\System\ZeTXpiv.exe
  2⤵
  PID:11824
- C:\Windows\System\KinHtCw.exe
  C:\Windows\System\KinHtCw.exe
  2⤵
  PID:11844
- C:\Windows\System\ViIHYdE.exe
  C:\Windows\System\ViIHYdE.exe
  2⤵
  PID:11868
- C:\Windows\System\bxcbscF.exe
  C:\Windows\System\bxcbscF.exe
  2⤵
  PID:11888
- C:\Windows\System\ryZqUHr.exe
  C:\Windows\System\ryZqUHr.exe
  2⤵
  PID:11904
- C:\Windows\System\JgnqdWf.exe
  C:\Windows\System\JgnqdWf.exe
  2⤵
  PID:11928
- C:\Windows\System\kXjDYAm.exe
  C:\Windows\System\kXjDYAm.exe
  2⤵
  PID:11956
- C:\Windows\System\MsPDviY.exe
  C:\Windows\System\MsPDviY.exe
  2⤵
  PID:11988
- C:\Windows\System\LPfNdGg.exe
  C:\Windows\System\LPfNdGg.exe
  2⤵
  PID:11696
- C:\Windows\System\PTswxWW.exe
  C:\Windows\System\PTswxWW.exe
  2⤵
  PID:9632
- C:\Windows\System\uCgAPMD.exe
  C:\Windows\System\uCgAPMD.exe
  2⤵
  PID:5484
- C:\Windows\System\HXgUNuV.exe
  C:\Windows\System\HXgUNuV.exe
  2⤵
  PID:11856
- C:\Windows\System\dTnnnQc.exe
  C:\Windows\System\dTnnnQc.exe
  2⤵
  PID:10708
- C:\Windows\System\aVymZcK.exe
  C:\Windows\System\aVymZcK.exe
  2⤵
  PID:10752
- C:\Windows\System\xjnlfOj.exe
  C:\Windows\System\xjnlfOj.exe
  2⤵
  PID:10792
- C:\Windows\System\FYmzAvs.exe
  C:\Windows\System\FYmzAvs.exe
  2⤵
  PID:9940
- C:\Windows\System\lUcNpfR.exe
  C:\Windows\System\lUcNpfR.exe
  2⤵
  PID:9996
- C:\Windows\System\cICEIxM.exe
  C:\Windows\System\cICEIxM.exe
  2⤵
  PID:12120
- C:\Windows\System\ElRIchV.exe
  C:\Windows\System\ElRIchV.exe
  2⤵
  PID:10956
- C:\Windows\System\fKNnzjC.exe
  C:\Windows\System\fKNnzjC.exe
  2⤵
  PID:10144
- C:\Windows\System\NYIihqh.exe
  C:\Windows\System\NYIihqh.exe
  2⤵
  PID:10192
- C:\Windows\System\UBybWSo.exe
  C:\Windows\System\UBybWSo.exe
  2⤵
  PID:11148
- C:\Windows\System\tqMWOjy.exe
  C:\Windows\System\tqMWOjy.exe
  2⤵
  PID:9508
- C:\Windows\System\riewUAc.exe
  C:\Windows\System\riewUAc.exe
  2⤵
  PID:9756
- C:\Windows\System\RdfqDHx.exe
  C:\Windows\System\RdfqDHx.exe
  2⤵
  PID:12264
- C:\Windows\System\CAbgKmk.exe
  C:\Windows\System\CAbgKmk.exe
  2⤵
  PID:9880
- C:\Windows\System\gpkbBim.exe
  C:\Windows\System\gpkbBim.exe
  2⤵
  PID:9964
- C:\Windows\System\bubiuRD.exe
  C:\Windows\System\bubiuRD.exe
  2⤵
  PID:9200
- C:\Windows\System\qriWjSz.exe
  C:\Windows\System\qriWjSz.exe
  2⤵
  PID:8140
- C:\Windows\System\QhjWFLd.exe
  C:\Windows\System\QhjWFLd.exe
  2⤵
  PID:8700
- C:\Windows\System\QydTOZi.exe
  C:\Windows\System\QydTOZi.exe
  2⤵
  PID:8648
- C:\Windows\System\tOVstsI.exe
  C:\Windows\System\tOVstsI.exe
  2⤵
  PID:3272
- C:\Windows\System\BwVOfcH.exe
  C:\Windows\System\BwVOfcH.exe
  2⤵
  PID:8452
- C:\Windows\System\yCzBetL.exe
  C:\Windows\System\yCzBetL.exe
  2⤵
  PID:11284
- C:\Windows\System\gouzzEh.exe
  C:\Windows\System\gouzzEh.exe
  2⤵
  PID:7068
- C:\Windows\System\TunYHKT.exe
  C:\Windows\System\TunYHKT.exe
  2⤵
  PID:11328
- C:\Windows\System\ZbWCQWn.exe
  C:\Windows\System\ZbWCQWn.exe
  2⤵
  PID:9248
- C:\Windows\System\tGxuLTn.exe
  C:\Windows\System\tGxuLTn.exe
  2⤵
  PID:12308
- C:\Windows\System\tDCjRjt.exe
  C:\Windows\System\tDCjRjt.exe
  2⤵
  PID:12340
- C:\Windows\System\pkpxoCq.exe
  C:\Windows\System\pkpxoCq.exe
  2⤵
  PID:12380
- C:\Windows\System\sXNxcNI.exe
  C:\Windows\System\sXNxcNI.exe
  2⤵
  PID:12412
- C:\Windows\System\NYOIGpq.exe
  C:\Windows\System\NYOIGpq.exe
  2⤵
  PID:12440
- C:\Windows\System\PDyrRSG.exe
  C:\Windows\System\PDyrRSG.exe
  2⤵
  PID:12468
- C:\Windows\System\MdeAORL.exe
  C:\Windows\System\MdeAORL.exe
  2⤵
  PID:12500
- C:\Windows\System\dFiVzuw.exe
  C:\Windows\System\dFiVzuw.exe
  2⤵
  PID:12524
- C:\Windows\System\oNhzxjw.exe
  C:\Windows\System\oNhzxjw.exe
  2⤵
  PID:12552
- C:\Windows\System\rpLHYUT.exe
  C:\Windows\System\rpLHYUT.exe
  2⤵
  PID:12580
- C:\Windows\System\gnkmtTm.exe
  C:\Windows\System\gnkmtTm.exe
  2⤵
  PID:12612
- C:\Windows\System\gCUxeRh.exe
  C:\Windows\System\gCUxeRh.exe
  2⤵
  PID:12648
- C:\Windows\System\sTUExCn.exe
  C:\Windows\System\sTUExCn.exe
  2⤵
  PID:12668
- C:\Windows\System\RbQZSUK.exe
  C:\Windows\System\RbQZSUK.exe
  2⤵
  PID:12696
- C:\Windows\System\ElJfkXY.exe
  C:\Windows\System\ElJfkXY.exe
  2⤵
  PID:12724
- C:\Windows\System\zaPXRJR.exe
  C:\Windows\System\zaPXRJR.exe
  2⤵
  PID:12748
- C:\Windows\System\hgdoafX.exe
  C:\Windows\System\hgdoafX.exe
  2⤵
  PID:12772
- C:\Windows\System\HDtGlRV.exe
  C:\Windows\System\HDtGlRV.exe
  2⤵
  PID:12800
- C:\Windows\System\ObsrHYo.exe
  C:\Windows\System\ObsrHYo.exe
  2⤵
  PID:12824
- C:\Windows\System\xjDZxPG.exe
  C:\Windows\System\xjDZxPG.exe
  2⤵
  PID:12848
- C:\Windows\System\PGVzyMe.exe
  C:\Windows\System\PGVzyMe.exe
  2⤵
  PID:12880
- C:\Windows\System\zSaEhUo.exe
  C:\Windows\System\zSaEhUo.exe
  2⤵
  PID:12908
- C:\Windows\System\keUYPdO.exe
  C:\Windows\System\keUYPdO.exe
  2⤵
  PID:12932
- C:\Windows\System\mZTEAzE.exe
  C:\Windows\System\mZTEAzE.exe
  2⤵
  PID:12960
- C:\Windows\System\LtHxblK.exe
  C:\Windows\System\LtHxblK.exe
  2⤵
  PID:12984
- C:\Windows\System\sbBPdRf.exe
  C:\Windows\System\sbBPdRf.exe
  2⤵
  PID:13012
- C:\Windows\System\JfKmrWb.exe
  C:\Windows\System\JfKmrWb.exe
  2⤵
  PID:13060
- C:\Windows\System\euinSUO.exe
  C:\Windows\System\euinSUO.exe
  2⤵
  PID:13076
- C:\Windows\System\qaioxSc.exe
  C:\Windows\System\qaioxSc.exe
  2⤵
  PID:11836
- C:\Windows\System\vOXRAsV.exe
  C:\Windows\System\vOXRAsV.exe
  2⤵
  PID:10640
- C:\Windows\System\JaFUdfQ.exe
  C:\Windows\System\JaFUdfQ.exe
  2⤵
  PID:9856
- C:\Windows\System\XbrXvpC.exe
  C:\Windows\System\XbrXvpC.exe
  2⤵
  PID:8972
- C:\Windows\System\NmLbSOC.exe
  C:\Windows\System\NmLbSOC.exe
  2⤵
  PID:11412
- C:\Windows\System\VIcqsXK.exe
  C:\Windows\System\VIcqsXK.exe
  2⤵
  PID:13108
- C:\Windows\System\KVLjwxF.exe
  C:\Windows\System\KVLjwxF.exe
  2⤵
  PID:10064
- C:\Windows\System\QiNsgzh.exe
  C:\Windows\System\QiNsgzh.exe
  2⤵
  PID:11180
- C:\Windows\System\REWXtcG.exe
  C:\Windows\System\REWXtcG.exe
  2⤵
  PID:11940
- C:\Windows\System\RzZndhZ.exe
  C:\Windows\System\RzZndhZ.exe
  2⤵
  PID:12940
- C:\Windows\System\GGpZCJP.exe
  C:\Windows\System\GGpZCJP.exe
  2⤵
  PID:13048
- C:\Windows\System\zlJoVpL.exe
  C:\Windows\System\zlJoVpL.exe
  2⤵
  PID:13196
- C:\Windows\System\jhWkKUr.exe
  C:\Windows\System\jhWkKUr.exe
  2⤵
  PID:13232
- C:\Windows\System\cxCnloq.exe
  C:\Windows\System\cxCnloq.exe
  2⤵
  PID:8500
- C:\Windows\System\PfWwCCx.exe
  C:\Windows\System\PfWwCCx.exe
  2⤵
  PID:13284
- C:\Windows\System\WYaoXEu.exe
  C:\Windows\System\WYaoXEu.exe
  2⤵
  PID:10244
- C:\Windows\System\eHXYLrp.exe
  C:\Windows\System\eHXYLrp.exe
  2⤵
  PID:10140
- C:\Windows\System\aRhbpLg.exe
  C:\Windows\System\aRhbpLg.exe
  2⤵
  PID:10496
- C:\Windows\System\mVZRXwj.exe
  C:\Windows\System\mVZRXwj.exe
  2⤵
  PID:5824
- C:\Windows\System\ovgkcKD.exe
  C:\Windows\System\ovgkcKD.exe
  2⤵
  PID:12304
- C:\Windows\System\eZQKDdw.exe
  C:\Windows\System\eZQKDdw.exe
  2⤵
  PID:11024
- C:\Windows\System\ZwVKqJl.exe
  C:\Windows\System\ZwVKqJl.exe
  2⤵
  PID:11648
- C:\Windows\System\QbJsBAX.exe
  C:\Windows\System\QbJsBAX.exe
  2⤵
  PID:10536
- C:\Windows\System\PZOGDtv.exe
  C:\Windows\System\PZOGDtv.exe
  2⤵
  PID:12244
- C:\Windows\System\UyxTiwP.exe
  C:\Windows\System\UyxTiwP.exe
  2⤵
  PID:8628
- C:\Windows\System\zhggzqu.exe
  C:\Windows\System\zhggzqu.exe
  2⤵
  PID:12508
- C:\Windows\System\YKyfgfr.exe
  C:\Windows\System\YKyfgfr.exe
  2⤵
  PID:13024
- C:\Windows\System\AXKrujB.exe
  C:\Windows\System\AXKrujB.exe
  2⤵
  PID:8356
- C:\Windows\System\KyKbxSv.exe
  C:\Windows\System\KyKbxSv.exe
  2⤵
  PID:11644
- C:\Windows\System\PlgrTTZ.exe
  C:\Windows\System\PlgrTTZ.exe
  2⤵
  PID:12660
- C:\Windows\System\pyZgdkg.exe
  C:\Windows\System\pyZgdkg.exe
  2⤵
  PID:2764
- C:\Windows\System\expENqd.exe
  C:\Windows\System\expENqd.exe
  2⤵
  PID:11816
- C:\Windows\System\CiLnjbL.exe
  C:\Windows\System\CiLnjbL.exe
  2⤵
  PID:10308
- C:\Windows\System\TKTDMFK.exe
  C:\Windows\System\TKTDMFK.exe
  2⤵
  PID:13176
- C:\Windows\System\GjSgliB.exe
  C:\Windows\System\GjSgliB.exe
  2⤵
  PID:6172
- C:\Windows\System\RQosjOw.exe
  C:\Windows\System\RQosjOw.exe
  2⤵
  PID:11556
- C:\Windows\System\blryUdM.exe
  C:\Windows\System\blryUdM.exe
  2⤵
  PID:10612
- C:\Windows\System\hYNfbth.exe
  C:\Windows\System\hYNfbth.exe
  2⤵
  PID:12968
- C:\Windows\System\ZYQZpBK.exe
  C:\Windows\System\ZYQZpBK.exe
  2⤵
  PID:12620
- C:\Windows\System\gxFABeb.exe
  C:\Windows\System\gxFABeb.exe
  2⤵
  PID:12532
- C:\Windows\System\FrRCaKQ.exe
  C:\Windows\System\FrRCaKQ.exe
  2⤵
  PID:13276
- C:\Windows\System\dYMkrCO.exe
  C:\Windows\System\dYMkrCO.exe
  2⤵
  PID:12404
- C:\Windows\System\XzhUPrZ.exe
  C:\Windows\System\XzhUPrZ.exe
  2⤵
  PID:5436
- C:\Windows\System\RZRcgpM.exe
  C:\Windows\System\RZRcgpM.exe
  2⤵
  PID:5096
- C:\Windows\System\yDYIJYF.exe
  C:\Windows\System\yDYIJYF.exe
  2⤵
  PID:12600
- C:\Windows\System\mBCOiRL.exe
  C:\Windows\System\mBCOiRL.exe
  2⤵
  PID:8924
- C:\Windows\System\GyvOBEv.exe
  C:\Windows\System\GyvOBEv.exe
  2⤵
  PID:8840
- C:\Windows\System\aCQXddN.exe
  C:\Windows\System\aCQXddN.exe
  2⤵
  PID:9884
- C:\Windows\System\OygXIQf.exe
  C:\Windows\System\OygXIQf.exe
  2⤵
  PID:12424
- C:\Windows\System\BOQYLkR.exe
  C:\Windows\System\BOQYLkR.exe
  2⤵
  PID:2992
- C:\Windows\System\zSdBZUI.exe
  C:\Windows\System\zSdBZUI.exe
  2⤵
  PID:1708
- C:\Windows\System\nePVNQe.exe
  C:\Windows\System\nePVNQe.exe
  2⤵
  PID:11456
- C:\Windows\System\jREaSjb.exe
  C:\Windows\System\jREaSjb.exe
  2⤵
  PID:13240
- C:\Windows\System\NeezuFx.exe
  C:\Windows\System\NeezuFx.exe
  2⤵
  PID:12000
- C:\Windows\System\rAMCUkc.exe
  C:\Windows\System\rAMCUkc.exe
  2⤵
  PID:10076
- C:\Windows\System\caSHfbT.exe
  C:\Windows\System\caSHfbT.exe
  2⤵
  PID:11232
- C:\Windows\System\GuEVLlJ.exe
  C:\Windows\System\GuEVLlJ.exe
  2⤵
  PID:12428
- C:\Windows\System\QJSKaCT.exe
  C:\Windows\System\QJSKaCT.exe
  2⤵
  PID:12488
- C:\Windows\System\yjOMjYi.exe
  C:\Windows\System\yjOMjYi.exe
  2⤵
  PID:12976
- C:\Windows\System\gNLBPZO.exe
  C:\Windows\System\gNLBPZO.exe
  2⤵
  PID:11308
- C:\Windows\System\eoJnIhI.exe
  C:\Windows\System\eoJnIhI.exe
  2⤵
  PID:13224
- C:\Windows\System\DyEzwHj.exe
  C:\Windows\System\DyEzwHj.exe
  2⤵
  PID:9304
- C:\Windows\System\RwJSCnM.exe
  C:\Windows\System\RwJSCnM.exe
  2⤵
  PID:216
- C:\Windows\System\QyyabYN.exe
  C:\Windows\System\QyyabYN.exe
  2⤵
  PID:5684
- C:\Windows\System\cjyPMhg.exe
  C:\Windows\System\cjyPMhg.exe
  2⤵
  PID:12808
- C:\Windows\System\oZcICiR.exe
  C:\Windows\System\oZcICiR.exe
  2⤵
  PID:11324
- C:\Windows\System\esIYNep.exe
  C:\Windows\System\esIYNep.exe
  2⤵
  PID:12336
- C:\Windows\System\rLrFVus.exe
  C:\Windows\System\rLrFVus.exe
  2⤵
  PID:10180
- C:\Windows\System\aOlsDxT.exe
  C:\Windows\System\aOlsDxT.exe
  2⤵
  PID:4368
- C:\Windows\System\YOcAnlS.exe
  C:\Windows\System\YOcAnlS.exe
  2⤵
  PID:528
- C:\Windows\System\qLPmHEZ.exe
  C:\Windows\System\qLPmHEZ.exe
  2⤵
  PID:5796
- C:\Windows\System\vbHbhVG.exe
  C:\Windows\System\vbHbhVG.exe
  2⤵
  PID:13216
- C:\Windows\System\uOTvtek.exe
  C:\Windows\System\uOTvtek.exe
  2⤵
  PID:12768
- C:\Windows\System\KfLKHfl.exe
  C:\Windows\System\KfLKHfl.exe
  2⤵
  PID:11168
- C:\Windows\System\wjXAHdc.exe
  C:\Windows\System\wjXAHdc.exe
  2⤵
  PID:13244
- C:\Windows\System\PystvBG.exe
  C:\Windows\System\PystvBG.exe
  2⤵
  PID:9392
- C:\Windows\System\vmvPUKd.exe
  C:\Windows\System\vmvPUKd.exe
  2⤵
  PID:4964
- C:\Windows\System\VRtAReP.exe
  C:\Windows\System\VRtAReP.exe
  2⤵
  PID:5508
- C:\Windows\System\YcYwsbT.exe
  C:\Windows\System\YcYwsbT.exe
  2⤵
  PID:5516
- C:\Windows\System\CHRNFyc.exe
  C:\Windows\System\CHRNFyc.exe
  2⤵
  PID:3816
- C:\Windows\System\bwcLKjG.exe
  C:\Windows\System\bwcLKjG.exe
  2⤵
  PID:12980
- C:\Windows\System\tjBhqAy.exe
  C:\Windows\System\tjBhqAy.exe
  2⤵
  PID:13252
- C:\Windows\System\qVTzREh.exe
  C:\Windows\System\qVTzREh.exe
  2⤵
  PID:13120
- C:\Windows\System\XNHmNjZ.exe
  C:\Windows\System\XNHmNjZ.exe
  2⤵
  PID:7024
- C:\Windows\System\ufEllVy.exe
  C:\Windows\System\ufEllVy.exe
  2⤵
  PID:5456
- C:\Windows\System\gqIkRFK.exe
  C:\Windows\System\gqIkRFK.exe
  2⤵
  PID:11460
- C:\Windows\System\MdvHlAh.exe
  C:\Windows\System\MdvHlAh.exe
  2⤵
  PID:2348
- C:\Windows\System\NwyCMtQ.exe
  C:\Windows\System\NwyCMtQ.exe
  2⤵
  PID:12688
- C:\Windows\System\MIWEGyt.exe
  C:\Windows\System\MIWEGyt.exe
  2⤵
  PID:7800
- C:\Windows\System\ziEHJCX.exe
  C:\Windows\System\ziEHJCX.exe
  2⤵
  PID:4264
- C:\Windows\System\qPYgjzB.exe
  C:\Windows\System\qPYgjzB.exe
  2⤵
  PID:9168
- C:\Windows\System\MFcZwwU.exe
  C:\Windows\System\MFcZwwU.exe
  2⤵
  PID:11768
- C:\Windows\System\ELQwDyd.exe
  C:\Windows\System\ELQwDyd.exe
  2⤵
  PID:10768
- C:\Windows\System\SidpHUF.exe
  C:\Windows\System\SidpHUF.exe
  2⤵
  PID:3252
- C:\Windows\System\tYthgEd.exe
  C:\Windows\System\tYthgEd.exe
  2⤵
  PID:5528
- C:\Windows\System\GGKXuMs.exe
  C:\Windows\System\GGKXuMs.exe
  2⤵
  PID:5708
- C:\Windows\System\cwjEjHc.exe
  C:\Windows\System\cwjEjHc.exe
  2⤵
  PID:5512
- C:\Windows\System\mqzIqJY.exe
  C:\Windows\System\mqzIqJY.exe
  2⤵
  PID:6648
- C:\Windows\System\iocmtpq.exe
  C:\Windows\System\iocmtpq.exe
  2⤵
  PID:11484
- C:\Windows\System\BbphXYy.exe
  C:\Windows\System\BbphXYy.exe
  2⤵
  PID:12896
- C:\Windows\System\lBsZdpC.exe
  C:\Windows\System\lBsZdpC.exe
  2⤵
  PID:4960
- C:\Windows\System\lqaZEER.exe
  C:\Windows\System\lqaZEER.exe
  2⤵
  PID:12640
- C:\Windows\System\JrglKWe.exe
  C:\Windows\System\JrglKWe.exe
  2⤵
  PID:3444
- C:\Windows\System\jIacsXz.exe
  C:\Windows\System\jIacsXz.exe
  2⤵
  PID:12068
- C:\Windows\System\szIBGhV.exe
  C:\Windows\System\szIBGhV.exe
  2⤵
  PID:10356
- C:\Windows\System\RQAHBKV.exe
  C:\Windows\System\RQAHBKV.exe
  2⤵
  PID:10164
- C:\Windows\System\ROjIARb.exe
  C:\Windows\System\ROjIARb.exe
  2⤵
  PID:11500
- C:\Windows\System\FtabuiE.exe
  C:\Windows\System\FtabuiE.exe
  2⤵
  PID:5524
- C:\Windows\System\xHBBajK.exe
  C:\Windows\System\xHBBajK.exe
  2⤵
  PID:13228
- C:\Windows\System\SCKocEu.exe
  C:\Windows\System\SCKocEu.exe
  2⤵
  PID:2432
- C:\Windows\System\VzRCyOm.exe
  C:\Windows\System\VzRCyOm.exe
  2⤵
  PID:11268
- C:\Windows\System\llaBzip.exe
  C:\Windows\System\llaBzip.exe
  2⤵
  PID:13316
- C:\Windows\System\kXvuCRV.exe
  C:\Windows\System\kXvuCRV.exe
  2⤵
  PID:13332
- C:\Windows\System\lsAPjiP.exe
  C:\Windows\System\lsAPjiP.exe
  2⤵
  PID:13348
- C:\Windows\System\IbJnmjL.exe
  C:\Windows\System\IbJnmjL.exe
  2⤵
  PID:13364
- C:\Windows\System\EaDOdZL.exe
  C:\Windows\System\EaDOdZL.exe
  2⤵
  PID:13380
- C:\Windows\System\UOxkIPd.exe
  C:\Windows\System\UOxkIPd.exe
  2⤵
  PID:13396
- C:\Windows\System\sRNkqFN.exe
  C:\Windows\System\sRNkqFN.exe
  2⤵
  PID:13412
- C:\Windows\System\nevFrJZ.exe
  C:\Windows\System\nevFrJZ.exe
  2⤵
  PID:13428
- C:\Windows\System\gvRONMY.exe
  C:\Windows\System\gvRONMY.exe
  2⤵
  PID:13444
- C:\Windows\System\YXHAMEU.exe
  C:\Windows\System\YXHAMEU.exe
  2⤵
  PID:13460
- C:\Windows\System\EDnKRjr.exe
  C:\Windows\System\EDnKRjr.exe
  2⤵
  PID:13476
- C:\Windows\System\aTssSxd.exe
  C:\Windows\System\aTssSxd.exe
  2⤵
  PID:13492
- C:\Windows\System\aElKngd.exe
  C:\Windows\System\aElKngd.exe
  2⤵
  PID:13508
- C:\Windows\System\cZghano.exe
  C:\Windows\System\cZghano.exe
  2⤵
  PID:13524
- C:\Windows\System\NQZuDgX.exe
  C:\Windows\System\NQZuDgX.exe
  2⤵
  PID:13540
- C:\Windows\System\FAIeEjn.exe
  C:\Windows\System\FAIeEjn.exe
  2⤵
  PID:13556
- C:\Windows\System\XDubMKx.exe
  C:\Windows\System\XDubMKx.exe
  2⤵
  PID:13572
- C:\Windows\System\YMGtOUV.exe
  C:\Windows\System\YMGtOUV.exe
  2⤵
  PID:13588
- C:\Windows\System\zqVTjAu.exe
  C:\Windows\System\zqVTjAu.exe
  2⤵
  PID:13604
- C:\Windows\System\fjzGFpW.exe
  C:\Windows\System\fjzGFpW.exe
  2⤵
  PID:13620
- C:\Windows\System\PbQHzDE.exe
  C:\Windows\System\PbQHzDE.exe
  2⤵
  PID:13636
- C:\Windows\System\JhyKBgX.exe
  C:\Windows\System\JhyKBgX.exe
  2⤵
  PID:13652
- C:\Windows\System\FTMFqoz.exe
  C:\Windows\System\FTMFqoz.exe
  2⤵
  PID:13668
- C:\Windows\System\iqsHNeA.exe
  C:\Windows\System\iqsHNeA.exe
  2⤵
  PID:13684
- C:\Windows\System\NmOoFPx.exe
  C:\Windows\System\NmOoFPx.exe
  2⤵
  PID:13700
- C:\Windows\System\NykiEpH.exe
  C:\Windows\System\NykiEpH.exe
  2⤵
  PID:13716
- C:\Windows\System\YIgSmHr.exe
  C:\Windows\System\YIgSmHr.exe
  2⤵
  PID:13732
- C:\Windows\System\JqIuiel.exe
  C:\Windows\System\JqIuiel.exe
  2⤵
  PID:13748
- C:\Windows\System\dGjcpNO.exe
  C:\Windows\System\dGjcpNO.exe
  2⤵
  PID:13764
- C:\Windows\System\iItQJJr.exe
  C:\Windows\System\iItQJJr.exe
  2⤵
  PID:13780
- C:\Windows\System\QYeZYZi.exe
  C:\Windows\System\QYeZYZi.exe
  2⤵
  PID:13796
- C:\Windows\System\cNWgRFk.exe
  C:\Windows\System\cNWgRFk.exe
  2⤵
  PID:13816
- C:\Windows\System\EPrZjfQ.exe
  C:\Windows\System\EPrZjfQ.exe
  2⤵
  PID:13832
- C:\Windows\System\nUCADIP.exe
  C:\Windows\System\nUCADIP.exe
  2⤵
  PID:13848
- C:\Windows\System\MdFfSdk.exe
  C:\Windows\System\MdFfSdk.exe
  2⤵
  PID:13864
- C:\Windows\System\BWmURAZ.exe
  C:\Windows\System\BWmURAZ.exe
  2⤵
  PID:13880
- C:\Windows\System\caPvuKn.exe
  C:\Windows\System\caPvuKn.exe
  2⤵
  PID:13896
- C:\Windows\System\mMshFBj.exe
  C:\Windows\System\mMshFBj.exe
  2⤵
  PID:13916
- C:\Windows\System\fvsafAg.exe
  C:\Windows\System\fvsafAg.exe
  2⤵
  PID:13936
- C:\Windows\System\luAwfSl.exe
  C:\Windows\System\luAwfSl.exe
  2⤵
  PID:13952
- C:\Windows\System\EyXYaHh.exe
  C:\Windows\System\EyXYaHh.exe
  2⤵
  PID:13968
- C:\Windows\System\ZdrJGbA.exe
  C:\Windows\System\ZdrJGbA.exe
  2⤵
  PID:13988
- C:\Windows\System\swGlWEi.exe
  C:\Windows\System\swGlWEi.exe
  2⤵
  PID:14004
- C:\Windows\System\SFnlsWG.exe
  C:\Windows\System\SFnlsWG.exe
  2⤵
  PID:14020
- C:\Windows\System\DkHgunC.exe
  C:\Windows\System\DkHgunC.exe
  2⤵
  PID:14036
- C:\Windows\System\NpfWhmq.exe
  C:\Windows\System\NpfWhmq.exe
  2⤵
  PID:14052
- C:\Windows\System\CtFCpPc.exe
  C:\Windows\System\CtFCpPc.exe
  2⤵
  PID:14068
- C:\Windows\System\AcZyevG.exe
  C:\Windows\System\AcZyevG.exe
  2⤵
  PID:14084
- C:\Windows\System\GyLZcCu.exe
  C:\Windows\System\GyLZcCu.exe
  2⤵
  PID:14100
- C:\Windows\System\FEgWAQf.exe
  C:\Windows\System\FEgWAQf.exe
  2⤵
  PID:14116
- C:\Windows\System\tIXfQOa.exe
  C:\Windows\System\tIXfQOa.exe
  2⤵
  PID:14132
- C:\Windows\System\pTVAxFP.exe
  C:\Windows\System\pTVAxFP.exe
  2⤵
  PID:14156
- C:\Windows\System\ZQiPBYX.exe
  C:\Windows\System\ZQiPBYX.exe
  2⤵
  PID:14172
- C:\Windows\System\WIYhOVx.exe
  C:\Windows\System\WIYhOVx.exe
  2⤵
  PID:14200
- C:\Windows\System\HJLqERv.exe
  C:\Windows\System\HJLqERv.exe
  2⤵
  PID:14216
- C:\Windows\System\rxzgytj.exe
  C:\Windows\System\rxzgytj.exe
  2⤵
  PID:14232
- C:\Windows\System\zjEszzD.exe
  C:\Windows\System\zjEszzD.exe
  2⤵
  PID:14248
- C:\Windows\System\VjlPNpZ.exe
  C:\Windows\System\VjlPNpZ.exe
  2⤵
  PID:14264
- C:\Windows\System\QxGtmjq.exe
  C:\Windows\System\QxGtmjq.exe
  2⤵
  PID:14280
- C:\Windows\System\zEOfBFS.exe
  C:\Windows\System\zEOfBFS.exe
  2⤵
  PID:14296
- C:\Windows\System\pNHUann.exe
  C:\Windows\System\pNHUann.exe
  2⤵
  PID:14312
- C:\Windows\System\nazqrtk.exe
  C:\Windows\System\nazqrtk.exe
  2⤵
  PID:14328
- C:\Windows\System\YOWAQgE.exe
  C:\Windows\System\YOWAQgE.exe
  2⤵
  PID:13328
- C:\Windows\System\FJEaUrk.exe
  C:\Windows\System\FJEaUrk.exe
  2⤵
  PID:13356
- C:\Windows\System\sDhGbHj.exe
  C:\Windows\System\sDhGbHj.exe
  2⤵
  PID:13392
- C:\Windows\System\wBRsERo.exe
  C:\Windows\System\wBRsERo.exe
  2⤵
  PID:13424
- C:\Windows\System\wkoNUdy.exe
  C:\Windows\System\wkoNUdy.exe
  2⤵
  PID:13456
- C:\Windows\System\ujLEyMv.exe
  C:\Windows\System\ujLEyMv.exe
  2⤵
  PID:13488
- C:\Windows\System\BELvXau.exe
  C:\Windows\System\BELvXau.exe
  2⤵
  PID:13520
- C:\Windows\System\pVPKovM.exe
  C:\Windows\System\pVPKovM.exe
  2⤵
  PID:13552
- C:\Windows\System\HwqbWLR.exe
  C:\Windows\System\HwqbWLR.exe
  2⤵
  PID:13584
- C:\Windows\System\mGhsjeV.exe
  C:\Windows\System\mGhsjeV.exe
  2⤵
  PID:13616
- C:\Windows\System\dONHvkc.exe
  C:\Windows\System\dONHvkc.exe
  2⤵
  PID:13648
- C:\Windows\System\fYLokSq.exe
  C:\Windows\System\fYLokSq.exe
  2⤵
  PID:13680
- C:\Windows\System\XQLKpNE.exe
  C:\Windows\System\XQLKpNE.exe
  2⤵
  PID:13712
- C:\Windows\System\fTAmZQY.exe
  C:\Windows\System\fTAmZQY.exe
  2⤵
  PID:13744
- C:\Windows\System\TKGfTPL.exe
  C:\Windows\System\TKGfTPL.exe
  2⤵
  PID:13776
- C:\Windows\System\NoifhJP.exe
  C:\Windows\System\NoifhJP.exe
  2⤵
  PID:13840
- C:\Windows\System\HfUiNAi.exe
  C:\Windows\System\HfUiNAi.exe
  2⤵
  PID:13872
- C:\Windows\System\wlTLDsR.exe
  C:\Windows\System\wlTLDsR.exe
  2⤵
  PID:13908
- C:\Windows\System\XdZVdEx.exe
  C:\Windows\System\XdZVdEx.exe
  2⤵
  PID:13932
- C:\Windows\System\KytcoZO.exe
  C:\Windows\System\KytcoZO.exe
  2⤵
  PID:13980
- C:\Windows\System\pxSGVnd.exe
  C:\Windows\System\pxSGVnd.exe
  2⤵
  PID:14016
- C:\Windows\System\dLbjcOu.exe
  C:\Windows\System\dLbjcOu.exe
  2⤵
  PID:14028
- C:\Windows\System\jhOdiBn.exe
  C:\Windows\System\jhOdiBn.exe
  2⤵
  PID:14076
- C:\Windows\System\EgIvhzF.exe
  C:\Windows\System\EgIvhzF.exe
  2⤵
  PID:14108
- C:\Windows\System\kUHTzlD.exe
  C:\Windows\System\kUHTzlD.exe
  2⤵
  PID:14144
- C:\Windows\System\NHIHbFg.exe
  C:\Windows\System\NHIHbFg.exe
  2⤵
  PID:14180
- C:\Windows\System\luPfrld.exe
  C:\Windows\System\luPfrld.exe
  2⤵
  PID:14224
- C:\Windows\System\kazzDfv.exe
  C:\Windows\System\kazzDfv.exe
  2⤵
  PID:14260
- C:\Windows\System\cjUCKgn.exe
  C:\Windows\System\cjUCKgn.exe
  2⤵
  PID:14288
- C:\Windows\System\PPIpQuW.exe
  C:\Windows\System\PPIpQuW.exe
  2⤵
  PID:14320
- C:\Windows\System\SRfrwKU.exe
  C:\Windows\System\SRfrwKU.exe
  2⤵
  PID:13360
- C:\Windows\System\olnlHOG.exe
  C:\Windows\System\olnlHOG.exe
  2⤵
  PID:13408
- C:\Windows\System\xIycnjM.exe
  C:\Windows\System\xIycnjM.exe
  2⤵
  PID:13472
- C:\Windows\System\scVfbwT.exe
  C:\Windows\System\scVfbwT.exe
  2⤵
  PID:13536
- C:\Windows\System\zGabJHw.exe
  C:\Windows\System\zGabJHw.exe
  2⤵
  PID:13600
- C:\Windows\System\YAyHuQM.exe
  C:\Windows\System\YAyHuQM.exe
  2⤵
  PID:13660
- C:\Windows\System\pOvXgCz.exe
  C:\Windows\System\pOvXgCz.exe
  2⤵
  PID:13772
- C:\Windows\System\cLXEDBh.exe
  C:\Windows\System\cLXEDBh.exe
  2⤵
  PID:13888
- C:\Windows\System\mWURKYs.exe
  C:\Windows\System\mWURKYs.exe
  2⤵
  PID:13996
- C:\Windows\System\fZSTcYq.exe
  C:\Windows\System\fZSTcYq.exe
  2⤵
  PID:14064
- C:\Windows\System\eDwGDvT.exe
  C:\Windows\System\eDwGDvT.exe
  2⤵
  PID:13948
- C:\Windows\System\xMCeIlN.exe
  C:\Windows\System\xMCeIlN.exe
  2⤵
  PID:13440
- C:\Windows\System\VhXnZvO.exe
  C:\Windows\System\VhXnZvO.exe
  2⤵
  PID:13696
- C:\Windows\System\jsSeOTD.exe
  C:\Windows\System\jsSeOTD.exe
  2⤵
  PID:13760
- C:\Windows\System\HFcRgmW.exe
  C:\Windows\System\HFcRgmW.exe
  2⤵
  PID:3612
- C:\Windows\System\OfOqlHk.exe
  C:\Windows\System\OfOqlHk.exe
  2⤵
  PID:1056
- C:\Windows\System\yPsXiap.exe
  C:\Windows\System\yPsXiap.exe
  2⤵
  PID:14032
- C:\Windows\System\PjYdyjh.exe
  C:\Windows\System\PjYdyjh.exe
  2⤵
  PID:14124
- C:\Windows\System\YNsOtJc.exe
  C:\Windows\System\YNsOtJc.exe
  2⤵
  PID:612
- C:\Windows\System\aGAlPRg.exe
  C:\Windows\System\aGAlPRg.exe
  2⤵
  PID:13324
- C:\Windows\System\sSXoQBE.exe
  C:\Windows\System\sSXoQBE.exe
  2⤵
  PID:1108
- C:\Windows\System\vrhdLcK.exe
  C:\Windows\System\vrhdLcK.exe
  2⤵
  PID:13708
- C:\Windows\System\fifnElO.exe
  C:\Windows\System\fifnElO.exe
  2⤵
  PID:5712
- C:\Windows\System\UJAmhVF.exe
  C:\Windows\System\UJAmhVF.exe
  2⤵
  PID:14128
- C:\Windows\System\nZCXTvb.exe
  C:\Windows\System\nZCXTvb.exe
  2⤵
  PID:14168
- C:\Windows\System\oWUzQKf.exe
  C:\Windows\System\oWUzQKf.exe
  2⤵
  PID:13452
- C:\Windows\System\fqAUoLr.exe
  C:\Windows\System\fqAUoLr.exe
  2⤵
  PID:1892
- C:\Windows\System\LvcnXEB.exe
  C:\Windows\System\LvcnXEB.exe
  2⤵
  PID:4104
- C:\Windows\System\dQhzifv.exe
  C:\Windows\System\dQhzifv.exe
  2⤵
  PID:14212
- C:\Windows\System\cHGRQDA.exe
  C:\Windows\System\cHGRQDA.exe
  2⤵
  PID:4916
- C:\Windows\System\caBzjrw.exe
  C:\Windows\System\caBzjrw.exe
  2⤵
  PID:4112
- C:\Windows\System\ryHBQYB.exe
  C:\Windows\System\ryHBQYB.exe
  2⤵
  PID:3840
- C:\Windows\System\NItXtTU.exe
  C:\Windows\System\NItXtTU.exe
  2⤵
  PID:14256
- C:\Windows\System\CIhRUww.exe
  C:\Windows\System\CIhRUww.exe
  2⤵
  PID:4036
- C:\Windows\System\lOJRHuV.exe
  C:\Windows\System\lOJRHuV.exe
  2⤵
  PID:14352
- C:\Windows\System\ozXVrEk.exe
  C:\Windows\System\ozXVrEk.exe
  2⤵
  PID:14380
- C:\Windows\System\ScecHkp.exe
  C:\Windows\System\ScecHkp.exe
  2⤵
  PID:14400
- C:\Windows\System\gvKLIdO.exe
  C:\Windows\System\gvKLIdO.exe
  2⤵
  PID:14424
- C:\Windows\System\YdKexQP.exe
  C:\Windows\System\YdKexQP.exe
  2⤵
  PID:14448
- C:\Windows\System\KKVudzt.exe
  C:\Windows\System\KKVudzt.exe
  2⤵
  PID:14468
- C:\Windows\System\zXWolkn.exe
  C:\Windows\System\zXWolkn.exe
  2⤵
  PID:14488
- C:\Windows\System\oedJaUf.exe
  C:\Windows\System\oedJaUf.exe
  2⤵
  PID:14508
- C:\Windows\System\XzWSnYI.exe
  C:\Windows\System\XzWSnYI.exe
  2⤵
  PID:14524
- C:\Windows\System\WmgkwEO.exe
  C:\Windows\System\WmgkwEO.exe
  2⤵
  PID:14548
- C:\Windows\System\MsJZHCu.exe
  C:\Windows\System\MsJZHCu.exe
  2⤵
  PID:14572
- C:\Windows\System\tePuiNK.exe
  C:\Windows\System\tePuiNK.exe
  2⤵
  PID:14588
- C:\Windows\System\nlMYxDu.exe
  C:\Windows\System\nlMYxDu.exe
  2⤵
  PID:14608
- C:\Windows\System\jSHVHKI.exe
  C:\Windows\System\jSHVHKI.exe
  2⤵
  PID:14628
- C:\Windows\System\cCYQOpc.exe
  C:\Windows\System\cCYQOpc.exe
  2⤵
  PID:14652
- C:\Windows\System\AUjofNf.exe
  C:\Windows\System\AUjofNf.exe
  2⤵
  PID:14672
- C:\Windows\System\odnnlaD.exe
  C:\Windows\System\odnnlaD.exe
  2⤵
  PID:14704
- C:\Windows\System\VedNTAI.exe
  C:\Windows\System\VedNTAI.exe
  2⤵
  PID:14732
- C:\Windows\System\uTODSoM.exe
  C:\Windows\System\uTODSoM.exe
  2⤵
  PID:14752
- C:\Windows\System\rsXGTYI.exe
  C:\Windows\System\rsXGTYI.exe
  2⤵
  PID:14776
- C:\Windows\System\SemrYtF.exe
  C:\Windows\System\SemrYtF.exe
  2⤵
  PID:14796
- C:\Windows\System\AyDGgCc.exe
  C:\Windows\System\AyDGgCc.exe
  2⤵
  PID:14812
- C:\Windows\System\mWJCvrt.exe
  C:\Windows\System\mWJCvrt.exe
  2⤵
  PID:14844
- C:\Windows\System\wsKuOOt.exe
  C:\Windows\System\wsKuOOt.exe
  2⤵
  PID:14876
- C:\Windows\System\MGzunBI.exe
  C:\Windows\System\MGzunBI.exe
  2⤵
  PID:14896
- C:\Windows\System\YCktchN.exe
  C:\Windows\System\YCktchN.exe
  2⤵
  PID:14924
- C:\Windows\System\cSjXSjr.exe
  C:\Windows\System\cSjXSjr.exe
  2⤵
  PID:14948
- C:\Windows\System\lbvofPo.exe
  C:\Windows\System\lbvofPo.exe
  2⤵
  PID:14972
- C:\Windows\System\zfMXZzn.exe
  C:\Windows\System\zfMXZzn.exe
  2⤵
  PID:14992
- C:\Windows\System\LGQqjBM.exe
  C:\Windows\System\LGQqjBM.exe
  2⤵
  PID:15008
- C:\Windows\System\XcRmAZz.exe
  C:\Windows\System\XcRmAZz.exe
  2⤵
  PID:15028
- C:\Windows\System\dEIyRGf.exe
  C:\Windows\System\dEIyRGf.exe
  2⤵
  PID:15048
- C:\Windows\System\QkQcBRU.exe
  C:\Windows\System\QkQcBRU.exe
  2⤵
  PID:15072
- C:\Windows\System\YMOyvCV.exe
  C:\Windows\System\YMOyvCV.exe
  2⤵
  PID:15088
- C:\Windows\System\veNNNRM.exe
  C:\Windows\System\veNNNRM.exe
  2⤵
  PID:15108
- C:\Windows\System\lFRKXPz.exe
  C:\Windows\System\lFRKXPz.exe
  2⤵
  PID:15148
- C:\Windows\System\AzkoXCC.exe
  C:\Windows\System\AzkoXCC.exe
  2⤵
  PID:15204
- C:\Windows\System\SKTPVfI.exe
  C:\Windows\System\SKTPVfI.exe
  2⤵
  PID:15228
- C:\Windows\System\OnSoIgK.exe
  C:\Windows\System\OnSoIgK.exe
  2⤵
  PID:15244
- C:\Windows\System\VYjcFWV.exe
  C:\Windows\System\VYjcFWV.exe
  2⤵
  PID:15260
- C:\Windows\System\bWhxgqi.exe
  C:\Windows\System\bWhxgqi.exe
  2⤵
  PID:15284
- C:\Windows\System\MqYThXR.exe
  C:\Windows\System\MqYThXR.exe
  2⤵
  PID:15308
- C:\Windows\System\BnMIGQQ.exe
  C:\Windows\System\BnMIGQQ.exe
  2⤵
  PID:15328
- C:\Windows\System\haPsyKt.exe
  C:\Windows\System\haPsyKt.exe
  2⤵
  PID:15344
- C:\Windows\System\EzzWLNi.exe
  C:\Windows\System\EzzWLNi.exe
  2⤵
  PID:14348
- C:\Windows\System\CcVuoZQ.exe
  C:\Windows\System\CcVuoZQ.exe
  2⤵
  PID:4616
- C:\Windows\System\QpddFrw.exe
  C:\Windows\System\QpddFrw.exe
  2⤵
  PID:14416
- C:\Windows\System\kSBjXht.exe
  C:\Windows\System\kSBjXht.exe
  2⤵
  PID:14440
- C:\Windows\System\NatNcTi.exe
  C:\Windows\System\NatNcTi.exe
  2⤵
  PID:14480
- C:\Windows\System\sxhoNRn.exe
  C:\Windows\System\sxhoNRn.exe
  2⤵
  PID:1012
- C:\Windows\System\qPBYCmo.exe
  C:\Windows\System\qPBYCmo.exe
  2⤵
  PID:14532
- C:\Windows\System\cULXBsx.exe
  C:\Windows\System\cULXBsx.exe
  2⤵
  PID:14556
- C:\Windows\System\qouGoSG.exe
  C:\Windows\System\qouGoSG.exe
  2⤵
  PID:4232
- C:\Windows\System\EhSlLsL.exe
  C:\Windows\System\EhSlLsL.exe
  2⤵
  PID:14624
- C:\Windows\System\snirHml.exe
  C:\Windows\System\snirHml.exe
  2⤵
  PID:14636
- C:\Windows\System\ttOPHtd.exe
  C:\Windows\System\ttOPHtd.exe
  2⤵
  PID:14664
- C:\Windows\System\VmNZbCx.exe
  C:\Windows\System\VmNZbCx.exe
  2⤵
  PID:14684
- C:\Windows\System\gNVPyoB.exe
  C:\Windows\System\gNVPyoB.exe
  2⤵
  PID:3980
- C:\Windows\System\CDtFWgJ.exe
  C:\Windows\System\CDtFWgJ.exe
  2⤵
  PID:2792
- C:\Windows\System\PWhfbdd.exe
  C:\Windows\System\PWhfbdd.exe
  2⤵
  PID:220
- C:\Windows\System\hGnKTiT.exe
  C:\Windows\System\hGnKTiT.exe
  2⤵
  PID:14788
- C:\Windows\System\mBjzrYR.exe
  C:\Windows\System\mBjzrYR.exe
  2⤵
  PID:4644
- C:\Windows\System\aLuHAsI.exe
  C:\Windows\System\aLuHAsI.exe
  2⤵
  PID:14912
- C:\Windows\System\ImBCHow.exe
  C:\Windows\System\ImBCHow.exe
  2⤵
  PID:14940
- C:\Windows\System\LdwbXDK.exe
  C:\Windows\System\LdwbXDK.exe
  2⤵
  PID:14984
- C:\Windows\System\lCdIwnv.exe
  C:\Windows\System\lCdIwnv.exe
  2⤵
  PID:776
- C:\Windows\System\UvlDMry.exe
  C:\Windows\System\UvlDMry.exe
  2⤵
  PID:4864
- C:\Windows\System\BgxUObc.exe
  C:\Windows\System\BgxUObc.exe
  2⤵
  PID:15036
- C:\Windows\System\PxJSREA.exe
  C:\Windows\System\PxJSREA.exe
  2⤵
  PID:15080
- C:\Windows\System\KuclfTh.exe
  C:\Windows\System\KuclfTh.exe
  2⤵
  PID:15104
- C:\Windows\System\snszifs.exe
  C:\Windows\System\snszifs.exe
  2⤵
  PID:15144
- C:\Windows\System\pftXfLn.exe
  C:\Windows\System\pftXfLn.exe
  2⤵
  PID:2356
- C:\Windows\System\KzsHjAV.exe
  C:\Windows\System\KzsHjAV.exe
  2⤵
  PID:4240
- C:\Windows\System\XVHxTHv.exe
  C:\Windows\System\XVHxTHv.exe
  2⤵
  PID:15200
- C:\Windows\System\WGTzzFy.exe
  C:\Windows\System\WGTzzFy.exe
  2⤵
  PID:15180
- C:\Windows\System\fHSEQkD.exe
  C:\Windows\System\fHSEQkD.exe
  2⤵
  PID:4072
- C:\Windows\System\edeAgRh.exe
  C:\Windows\System\edeAgRh.exe
  2⤵
  PID:1544
- C:\Windows\System\XrlIkAj.exe
  C:\Windows\System\XrlIkAj.exe
  2⤵
  PID:15280
- C:\Windows\System\jgdvcfE.exe
  C:\Windows\System\jgdvcfE.exe
  2⤵
  PID:15296
- C:\Windows\System\anAXKsA.exe
  C:\Windows\System\anAXKsA.exe
  2⤵
  PID:412
- C:\Windows\System\YqSYRAV.exe
  C:\Windows\System\YqSYRAV.exe
  2⤵
  PID:1656
- C:\Windows\System\aPFLZzG.exe
  C:\Windows\System\aPFLZzG.exe
  2⤵
  PID:15352
- C:\Windows\System\ULYPRpv.exe
  C:\Windows\System\ULYPRpv.exe
  2⤵
  PID:14344
- C:\Windows\System\WqGdkmp.exe
  C:\Windows\System\WqGdkmp.exe
  2⤵
  PID:4100
- C:\Windows\System\HxAzCLt.exe
  C:\Windows\System\HxAzCLt.exe
  2⤵
  PID:4660
- C:\Windows\System\TXOvJXA.exe
  C:\Windows\System\TXOvJXA.exe
  2⤵
  PID:14432
- C:\Windows\System\RKTVsUW.exe
  C:\Windows\System\RKTVsUW.exe
  2⤵
  PID:4440
- C:\Windows\System\PtJMusp.exe
  C:\Windows\System\PtJMusp.exe
  2⤵
  PID:14520
- C:\Windows\System\gjdVRFh.exe
  C:\Windows\System\gjdVRFh.exe
  2⤵
  PID:5228
- C:\Windows\System\qUGyaKB.exe
  C:\Windows\System\qUGyaKB.exe
  2⤵
  PID:5244
- C:\Windows\System\ADITdWH.exe
  C:\Windows\System\ADITdWH.exe
  2⤵
  PID:14504
- C:\Windows\System\lcRfbhc.exe
  C:\Windows\System\lcRfbhc.exe
  2⤵
  PID:3408
- C:\Windows\System\LdnltSU.exe
  C:\Windows\System\LdnltSU.exe
  2⤵
  PID:14560
- C:\Windows\System\KkmELwU.exe
  C:\Windows\System\KkmELwU.exe
  2⤵
  PID:1848
- C:\Windows\System\KfOqWvI.exe
  C:\Windows\System\KfOqWvI.exe
  2⤵
  PID:5160
- C:\Windows\System\EeHIymP.exe
  C:\Windows\System\EeHIymP.exe
  2⤵
  PID:1080
- C:\Windows\System\GxlnHHV.exe
  C:\Windows\System\GxlnHHV.exe
  2⤵
  PID:5316
- C:\Windows\System\AlhLAnD.exe
  C:\Windows\System\AlhLAnD.exe
  2⤵
  PID:14768
- C:\Windows\System\Nhaoskx.exe
  C:\Windows\System\Nhaoskx.exe
  2⤵
  PID:3664
- C:\Windows\System\AziVtzV.exe
  C:\Windows\System\AziVtzV.exe
  2⤵
  PID:5376
- C:\Windows\System\kmTZNcr.exe
  C:\Windows\System\kmTZNcr.exe
  2⤵
  PID:14724
- C:\Windows\System\QCLvLiO.exe
  C:\Windows\System\QCLvLiO.exe
  2⤵
  PID:5380
- C:\Windows\System\rhRxaGt.exe
  C:\Windows\System\rhRxaGt.exe
  2⤵
  PID:1648
- C:\Windows\System\VXIUVYD.exe
  C:\Windows\System\VXIUVYD.exe
  2⤵
  PID:5372
- C:\Windows\System\kborDkE.exe
  C:\Windows\System\kborDkE.exe
  2⤵
  PID:2512
- C:\Windows\System\ORPxSDD.exe
  C:\Windows\System\ORPxSDD.exe
  2⤵
  PID:14980
- C:\Windows\System\BeLXFtq.exe
  C:\Windows\System\BeLXFtq.exe
  2⤵
  PID:5320
- C:\Windows\System\wedltpe.exe
  C:\Windows\System\wedltpe.exe
  2⤵
  PID:15056
- C:\Windows\System\nZDIGyY.exe
  C:\Windows\System\nZDIGyY.exe
  2⤵
  PID:15100
- C:\Windows\System\yXRdiAv.exe
  C:\Windows\System\yXRdiAv.exe
  2⤵
  PID:2840
- C:\Windows\System\RmpIuuU.exe
  C:\Windows\System\RmpIuuU.exe
  2⤵
  PID:1380
- C:\Windows\System\nBSeZJv.exe
  C:\Windows\System\nBSeZJv.exe
  2⤵
  PID:1852
- C:\Windows\System\aivKlir.exe
  C:\Windows\System\aivKlir.exe
  2⤵
  PID:5240
- C:\Windows\System\dsrkzOE.exe
  C:\Windows\System\dsrkzOE.exe
  2⤵
  PID:5264
- C:\Windows\System\xaOTqsb.exe
  C:\Windows\System\xaOTqsb.exe
  2⤵
  PID:5124
- C:\Windows\System\eIXrRzg.exe
  C:\Windows\System\eIXrRzg.exe
  2⤵
  PID:4936
- C:\Windows\System\gHtuksT.exe
  C:\Windows\System\gHtuksT.exe
  2⤵
  PID:5216
- C:\Windows\System\FMuzLLB.exe
  C:\Windows\System\FMuzLLB.exe
  2⤵
  PID:5164
- C:\Windows\System\PtNIcyB.exe
  C:\Windows\System\PtNIcyB.exe
  2⤵
  PID:14808
- C:\Windows\System\okPIHiA.exe
  C:\Windows\System\okPIHiA.exe
  2⤵
  PID:1444
- C:\Windows\System\UVsJZwY.exe
  C:\Windows\System\UVsJZwY.exe
  2⤵
  PID:5152
- C:\Windows\System\jHeYlWN.exe
  C:\Windows\System\jHeYlWN.exe
  2⤵
  PID:5176
- C:\Windows\System\VgofAlL.exe
  C:\Windows\System\VgofAlL.exe
  2⤵
  PID:5280
- C:\Windows\System\jiCZHbt.exe
  C:\Windows\System\jiCZHbt.exe
  2⤵
  PID:15224
- C:\Windows\System\hCMKLsf.exe
  C:\Windows\System\hCMKLsf.exe
  2⤵
  PID:5352
- C:\Windows\System\ezQlkvp.exe
  C:\Windows\System\ezQlkvp.exe
  2⤵
  PID:14868
- C:\Windows\System\qmcHhaW.exe
  C:\Windows\System\qmcHhaW.exe
  2⤵
  PID:14824
- C:\Windows\System\dUUBDhZ.exe
  C:\Windows\System\dUUBDhZ.exe
  2⤵
  PID:15060
- C:\Windows\System\mlkqfdG.exe
  C:\Windows\System\mlkqfdG.exe
  2⤵
  PID:15300
- C:\Windows\System\oFyspvd.exe
  C:\Windows\System\oFyspvd.exe
  2⤵
  PID:14860
- C:\Windows\System\aRdUsKa.exe
  C:\Windows\System\aRdUsKa.exe
  2⤵
  PID:4852
- C:\Windows\System\nbnBPpQ.exe
  C:\Windows\System\nbnBPpQ.exe
  2⤵
  PID:780
- C:\Windows\System\EAdoBGf.exe
  C:\Windows\System\EAdoBGf.exe
  2⤵
  PID:3540
- C:\Windows\System\jQFjtcx.exe
  C:\Windows\System\jQFjtcx.exe
  2⤵
  PID:5168
- C:\Windows\System\sfZnUAm.exe
  C:\Windows\System\sfZnUAm.exe
  2⤵
  PID:15196
- C:\Windows\System\VJojstd.exe
  C:\Windows\System\VJojstd.exe
  2⤵
  PID:15220
- C:\Windows\System\hVcKuBR.exe
  C:\Windows\System\hVcKuBR.exe
  2⤵
  PID:1456
- C:\Windows\System\WUZbjYN.exe
  C:\Windows\System\WUZbjYN.exe
  2⤵
  PID:5252
- C:\Windows\System\AbiYZgK.exe
  C:\Windows\System\AbiYZgK.exe
  2⤵
  PID:15316
- C:\Windows\System\aqQktLc.exe
  C:\Windows\System\aqQktLc.exe
  2⤵
  PID:14604
- C:\Windows\System\VxzEPhB.exe
  C:\Windows\System\VxzEPhB.exe
  2⤵
  PID:4764
- C:\Windows\System\QdcLTTy.exe
  C:\Windows\System\QdcLTTy.exe
  2⤵
  PID:5144
- C:\Windows\System\xZdWGgh.exe
  C:\Windows\System\xZdWGgh.exe
  2⤵
  PID:15068
- C:\Windows\System\OTQmiRr.exe
  C:\Windows\System\OTQmiRr.exe
  2⤵
  PID:4600
- C:\Windows\System\WArlEru.exe
  C:\Windows\System\WArlEru.exe
  2⤵
  PID:15084
- C:\Windows\System\qIchXgu.exe
  C:\Windows\System\qIchXgu.exe
  2⤵
  PID:15340
- C:\Windows\System\gybNXfn.exe
  C:\Windows\System\gybNXfn.exe
  2⤵
  PID:14932
- C:\Windows\System\SXXLbwi.exe
  C:\Windows\System\SXXLbwi.exe
  2⤵
  PID:15000
- C:\Windows\System\OXHQYnf.exe
  C:\Windows\System\OXHQYnf.exe
  2⤵
  PID:11504
- C:\Windows\System\azaaVPI.exe
  C:\Windows\System\azaaVPI.exe
  2⤵
  PID:5272
- C:\Windows\System\sOsRxEx.exe
  C:\Windows\System\sOsRxEx.exe
  2⤵
  PID:3968
- C:\Windows\System\mqoYmxj.exe
  C:\Windows\System\mqoYmxj.exe
  2⤵
  PID:1304
- C:\Windows\System\SLYeCmB.exe
  C:\Windows\System\SLYeCmB.exe
  2⤵
  PID:15096
- C:\Windows\System\TeHrYhb.exe
  C:\Windows\System\TeHrYhb.exe
  2⤵
  PID:1684
- C:\Windows\System\UxLxmVz.exe
  C:\Windows\System\UxLxmVz.exe
  2⤵
  PID:14580
- C:\Windows\System\JEVoBHg.exe
  C:\Windows\System\JEVoBHg.exe
  2⤵
  PID:14864
- C:\Windows\System\eUegqmj.exe
  C:\Windows\System\eUegqmj.exe
  2⤵
  PID:15256
- C:\Windows\System\SdaSmAg.exe
  C:\Windows\System\SdaSmAg.exe
  2⤵
  PID:2368
- C:\Windows\System\oWzXlyX.exe
  C:\Windows\System\oWzXlyX.exe
  2⤵
  PID:2948
- C:\Windows\System\eQProJe.exe
  C:\Windows\System\eQProJe.exe
  2⤵
  PID:2768
- C:\Windows\System\VoJoLlF.exe
  C:\Windows\System\VoJoLlF.exe
  2⤵
  PID:5384
- C:\Windows\System\jqMWyaQ.exe
  C:\Windows\System\jqMWyaQ.exe
  2⤵
  PID:5136
- C:\Windows\System\ndShZXB.exe
  C:\Windows\System\ndShZXB.exe
  2⤵
  PID:14408
- C:\Windows\System\UrYnxLE.exe
  C:\Windows\System\UrYnxLE.exe
  2⤵
  PID:736
- C:\Windows\System\zWyfAjH.exe
  C:\Windows\System\zWyfAjH.exe
  2⤵
  PID:14392
- C:\Windows\System\jlxrshg.exe
  C:\Windows\System\jlxrshg.exe
  2⤵
  PID:14096
- C:\Windows\System\yDQYljW.exe
  C:\Windows\System\yDQYljW.exe
  2⤵
  PID:15376
- C:\Windows\System\sbBqids.exe
  C:\Windows\System\sbBqids.exe
  2⤵
  PID:15392
- C:\Windows\System\lNhAUOe.exe
  C:\Windows\System\lNhAUOe.exe
  2⤵
  PID:15408
- C:\Windows\System\jgRAEyu.exe
  C:\Windows\System\jgRAEyu.exe
  2⤵
  PID:15424
- C:\Windows\System\hczdzCE.exe
  C:\Windows\System\hczdzCE.exe
  2⤵
  PID:15440
- C:\Windows\System\nMFePdb.exe
  C:\Windows\System\nMFePdb.exe
  2⤵
  PID:15456
- C:\Windows\System\poVrPer.exe
  C:\Windows\System\poVrPer.exe
  2⤵
  PID:15472
- C:\Windows\System\vZfWril.exe
  C:\Windows\System\vZfWril.exe
  2⤵
  PID:15488
- C:\Windows\System\QMtJuTK.exe
  C:\Windows\System\QMtJuTK.exe
  2⤵
  PID:15504
- C:\Windows\System\VdqyXcX.exe
  C:\Windows\System\VdqyXcX.exe
  2⤵
  PID:15520
- C:\Windows\System\oUnuKtB.exe
  C:\Windows\System\oUnuKtB.exe
  2⤵
  PID:15536
- C:\Windows\System\IfEuCWr.exe
  C:\Windows\System\IfEuCWr.exe
  2⤵
  PID:15552
- C:\Windows\System\IrPxKXG.exe
  C:\Windows\System\IrPxKXG.exe
  2⤵
  PID:15568
- C:\Windows\System\oSFLMsy.exe
  C:\Windows\System\oSFLMsy.exe
  2⤵
  PID:15584
- C:\Windows\System\kxnUVZV.exe
  C:\Windows\System\kxnUVZV.exe
  2⤵
  PID:15600
- C:\Windows\System\SAvUDZn.exe
  C:\Windows\System\SAvUDZn.exe
  2⤵
  PID:15616
- C:\Windows\System\ZgQPSVK.exe
  C:\Windows\System\ZgQPSVK.exe
  2⤵
  PID:15632
- C:\Windows\System\eTcSDxZ.exe
  C:\Windows\System\eTcSDxZ.exe
  2⤵
  PID:15648
- C:\Windows\System\QFIoZiK.exe
  C:\Windows\System\QFIoZiK.exe
  2⤵
  PID:15664
- C:\Windows\System\tBzyJWo.exe
  C:\Windows\System\tBzyJWo.exe
  2⤵
  PID:15680
- C:\Windows\System\DQzDdyM.exe
  C:\Windows\System\DQzDdyM.exe
  2⤵
  PID:15696
- C:\Windows\System\AhJGrtc.exe
  C:\Windows\System\AhJGrtc.exe
  2⤵
  PID:15712
- C:\Windows\System\nCNLRsd.exe
  C:\Windows\System\nCNLRsd.exe
  2⤵
  PID:15728
- C:\Windows\System\uDSmxDZ.exe
  C:\Windows\System\uDSmxDZ.exe
  2⤵
  PID:15744
- C:\Windows\System\JpwJSvW.exe
  C:\Windows\System\JpwJSvW.exe
  2⤵
  PID:15760
- C:\Windows\System\ELDwzlZ.exe
  C:\Windows\System\ELDwzlZ.exe
  2⤵
  PID:15776
- C:\Windows\System\xvaPZWS.exe
  C:\Windows\System\xvaPZWS.exe
  2⤵
  PID:15792
- C:\Windows\System\BwLmvtk.exe
  C:\Windows\System\BwLmvtk.exe
  2⤵
  PID:15808
- C:\Windows\System\oJQdTpW.exe
  C:\Windows\System\oJQdTpW.exe
  2⤵
  PID:15824
- C:\Windows\System\ZdZZHvU.exe
  C:\Windows\System\ZdZZHvU.exe
  2⤵
  PID:15840
- C:\Windows\System\YETDmfj.exe
  C:\Windows\System\YETDmfj.exe
  2⤵
  PID:15856
- C:\Windows\System\pQTospN.exe
  C:\Windows\System\pQTospN.exe
  2⤵
  PID:15872
- C:\Windows\System\aLaITPC.exe
  C:\Windows\System\aLaITPC.exe
  2⤵
  PID:15888
- C:\Windows\System\PCbzJJs.exe
  C:\Windows\System\PCbzJJs.exe
  2⤵
  PID:15904
- C:\Windows\System\hZeZjdt.exe
  C:\Windows\System\hZeZjdt.exe
  2⤵
  PID:15920
- C:\Windows\System\gqiSHcN.exe
  C:\Windows\System\gqiSHcN.exe
  2⤵
  PID:15936
- C:\Windows\System\LKDAPoF.exe
  C:\Windows\System\LKDAPoF.exe
  2⤵
  PID:15980
- C:\Windows\System\uoOMoyp.exe
  C:\Windows\System\uoOMoyp.exe
  2⤵
  PID:16060
- C:\Windows\System\qpjyckU.exe
  C:\Windows\System\qpjyckU.exe
  2⤵
  PID:16076
- C:\Windows\System\NqtwJCc.exe
  C:\Windows\System\NqtwJCc.exe
  2⤵
  PID:16092
- C:\Windows\System\WjcXNiw.exe
  C:\Windows\System\WjcXNiw.exe
  2⤵
  PID:16112
- C:\Windows\System\JWQbTxs.exe
  C:\Windows\System\JWQbTxs.exe
  2⤵
  PID:16128
- C:\Windows\System\AFiBqGb.exe
  C:\Windows\System\AFiBqGb.exe
  2⤵
  PID:16144
- C:\Windows\System\sJbVejr.exe
  C:\Windows\System\sJbVejr.exe
  2⤵
  PID:16160
- C:\Windows\System\rOjLzCC.exe
  C:\Windows\System\rOjLzCC.exe
  2⤵
  PID:16176

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:3420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_f1ojaeaw.s5s.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BFckJpK.exe

Filesize
2.3MB

MD5
35dac452fbb163011d4b646caf52b47b

SHA1
4f6248f3756e2cbe46ca0acca88877967d5bfc3e

SHA256
8b168faec185dee73ac92141724e60f038fc128c4fe1db88f69552c5db6f48e4

SHA512
d0bdf991771ba329ceaff0b94514795ff690cc3bae6935b625b7b9b6b93b0de2688ae088d5daef852a0fae163091c3d6f7b3311d5059275eb3d9c0d285c161ca

Download Submit
C:\Windows\System\ECgmocl.exe

Filesize
2.2MB

MD5
4bae95d1541dc7e9f2c9adfcdb46eacd

SHA1
9f06c488046b1b9924aaa6d2ff5914e3cb41e090

SHA256
6be8e2ed84ccbc78a16f2f66fcac668ec7cdc50b508106fb07491f3b2f3a8e38

SHA512
a7b8c42b80836e2bd8adc7822baa05f44cb6c2c979a9b2d4cbde29461cbc581831b091cb4f3de7c891958087cc47c829162d566d9b0e26898531222d8dbedc31

Download Submit
C:\Windows\System\EKuDpYr.exe

Filesize
2.2MB

MD5
391e2d57c4d00f3c8f4a35e0164726e0

SHA1
46b46b3e6dcbe274d7c43687cb3305240e92cec7

SHA256
1e7df1893f59ca3fda7ed7cd0be71720eb8e5cddcaf3a26a68722fe88a928a90

SHA512
340ebe5a0611f63e1e381e1b426692132cfe4aad0dca72b6603d3ad6f85abbd30e29586897c98f0e1f798c6b5229493938330ceaec981aaa01d6e1953d1b8961

Download Submit
C:\Windows\System\GJHRenV.exe

Filesize
2.2MB

MD5
8e2374a9a6ffd3cfdda07e5ee6080f3a

SHA1
69354ad4474e5d4debde6a0af79cf396f93a65d8

SHA256
133d6ebf4e0b2342f5eb80b10c59125f38fbf055fa437ed6b0a742be5e7ce0f4

SHA512
97229ce6305063bf8d45c053f249d2d1e187c5efc663d5f66a65f23c633b160458ca1c3a6998eb46d37aca4b02e040e226950cfafdd485576503fa1b5ab3d085

Download Submit
C:\Windows\System\GRHxotN.exe

Filesize
2.3MB

MD5
48117ff0fed6c9896b4e5bd1ab579729

SHA1
2f9fbcf04331296a69b324bbd9c79fdcde6f0fff

SHA256
214449df51390e3859a3653cf96bbb0959f443477fe11c703a9e981841fe5033

SHA512
511e0157b4a91f87550d4eb8ba3a798a8f92c843bbd4a5aaeb93768400f3fbabef40a7b83b18c5acdfe1af74b34a63eb1f64eb7b3ce86bd701c693035b65c943

Download Submit
C:\Windows\System\HFVdifN.exe

Filesize
2.2MB

MD5
29132e160d0093d94eb8a38634197d0d

SHA1
b4ea5ee9d229a587e1c67897246e6a3abca1b01c

SHA256
050d663aa11707a4c95c99a827730b6b3e24a044a2d5c61d327ee3f6839acb98

SHA512
e3c8af494229f35cb5f3c689d5a7cd90ce9d32a271b7a4ee1a4b1407249e519e1f91f2abe4cb15c9fd5875bae30a1698e5d438b83483f82d59653456e249bd6e

Download Submit
C:\Windows\System\IVfqloA.exe

Filesize
2.2MB

MD5
66d2452c376eb9eb58c943f57036b498

SHA1
a8f8f2663a8f3098f1abb27d559e6a24ffc80d27

SHA256
fdc08e66a24630210ef9d255a8fb5a9f96632b3652ad4d92a8f38b9cd98e43d1

SHA512
493c317f7112c44feafdcf09e56a2ccfe2757a9dd45e9b3f1b7502f9a5dc66c1ee108b9d4548231ee59cc02f82b38d7138960fdec4e708a6b444e38c48ec5180

Download Submit
C:\Windows\System\IZiAigj.exe

Filesize
2.2MB

MD5
4e0d15bb70b664ab094cd9da04359eb3

SHA1
2592c7b80ed4f7e0c8b082947b85a8547a7aef40

SHA256
3563341761bde384d9a7213d3fcc4be72a2edc55d27925e83d3c563a38f949d6

SHA512
6041eea0d5ccb81c7dd524cad2336a4e1faf0f5632b20a484c7e8821fd964ca4553f41a53b6e2f0a1b59c6493875cb6bca5aaa6f5918617bccb86d0c1a21659e

Download Submit
C:\Windows\System\LXVCtWN.exe

Filesize
2.3MB

MD5
9e07f4e0fad9aa65a4e7685a1f14fcde

SHA1
0d43242f568cae2e0f2dd6b1515f77480d969808

SHA256
14c75e61723cece7323c4ab901be143481a4fa45868452d127cc690dd2600fd4

SHA512
177852c873598c69cf62cc0d515758ab997b0c5358a01177d7de535971c4bd3312f82ce3030c9d1b9c43ecfcdb42b0e664ca12480d7404b314ae27e492ce1813

Download Submit
C:\Windows\System\NKvwmtZ.exe

Filesize
2.2MB

MD5
45056a4be12a38be0ae04b068c83129b

SHA1
da6372f7882f7c22914f5297b5f64f8b57052a69

SHA256
8ad33b1dee3d54f4548a857c8d5f6db367cb6d5c1e9820a6e54107e10fc5c31b

SHA512
c23d4ae3a41d32d160457a31e618c0b64bcbdb11cc7e28e87d892d87fb368c080144b3a5d966d1920d9ca8c8e41395b8f17861b9bfae4732137f950ec6f0bce9

Download Submit
C:\Windows\System\Uctthws.exe

Filesize
2.2MB

MD5
848853531e4751687ddb1468ff7a3048

SHA1
e84be06efdc8495c0a09c31df7623075e49590ce

SHA256
3df1bda256de9828362af11269d2abf3663a96d8b9cbab2eaa3b5080d7406ab1

SHA512
7bc39570727a413aeb966eefa83247981689d8911d516ff10540b371552b32fea4ec7714c6552fb99bebd0bb2c391c7a18c6b7e30021b18a6c473b10ee3abeea

Download Submit
C:\Windows\System\VVQDzEc.exe

Filesize
2.2MB

MD5
de655e84823a82c19406080f1cb848c4

SHA1
a5e57670a3c09a2ca41814763011f2106de7c025

SHA256
039c5d7844cb2ecfa91ca8c8b951210aeadb976635bd4c6e6a62cc9a2c3b1d15

SHA512
2cee9ceb782c93173c627a1969ea7c1f5582984d731f3707631ed342cab44defcd9fd7f8ee2866e40dd8886a41e8cfa4a84eaa13a4d23d966dabe7dfdc9c6196

Download Submit
C:\Windows\System\VlKDXiY.exe

Filesize
2.2MB

MD5
2de31ac5795c5073f441727d428751c9

SHA1
2c1064ab97667750a19610936392f8683035c6de

SHA256
aff79074cee5bda61ad21c50e63ac1ca9d1cfd64cb0cd593f236012a6e96348f

SHA512
32c09bd14a7f53f9ea7c11138ece31401deae574201a78bf88e68d1f173af441e3cf7dc5c76580b49e49724a1843304db7828560aa8eeffa40beb2f0f43fcb12

Download Submit
C:\Windows\System\YxhyVJt.exe

Filesize
2.2MB

MD5
f4bc6c0209037f376adf832ac5368f76

SHA1
629767784f36d170c0f439ea81f4bd7fd4808996

SHA256
12d54ef9870bb3feb4aad2d4c80d20cb6aea0f21eeb7a3a53a438d75c002d583

SHA512
0ae79473694ab7a06e040e0f5f4eb1c035aa9505aef30680868fbb3fc6458170b5f62ccc60dd875cae91573478224b667c820d20153a6141b4f37b5d4a67f959

Download Submit
C:\Windows\System\aPwFUPB.exe

Filesize
2.2MB

MD5
3d08f59075614f93948382a4a9ad0e12

SHA1
45bc50149675472948bbb6bd2280bb0d17fb0315

SHA256
a7e3410bc173b994c48a5bb612e33a1d22f439b7e8aaa546ab9bb0fb281bbd13

SHA512
89ea2d433b19f5e8022fbc2bfffd6e6841f8513ee8cac4b9b5e0d33b1c2ab6a02bec886ed38721b1db1b61625ccdb3704dd12650c77f699fb560dac1c050e516

Download Submit
C:\Windows\System\amkRLJn.exe

Filesize
2.2MB

MD5
ff982f56fba30a8a2a1d0d786c17933f

SHA1
f231086ce41d25d040773d16d2909c756177814f

SHA256
2f85e13255fcd6e22d024860df1bc57717df47bec19740abb4a941fcf604769f

SHA512
f347cf2ac0b58dab526045c56271c940bd5254e894a97f22a3758b4a7d786b2f5dd2a77499f6d6a6cbde31d13284f0199b636b34ad2041f0492be18abc7e76c1

Download Submit
C:\Windows\System\cCTzmud.exe

Filesize
2.3MB

MD5
07466e1a9f8d834959c2a9f744c2c27b

SHA1
e31b6c6744332f8a7fbc00e29e6e8b05f35e0129

SHA256
bde5f902d7beb261f974489d514779636b000594f5068b1826095c1e039480cf

SHA512
7f886457ec12ba1d91897159fcac3bb99ba301c9101b6f9c20b3011997898e54b8afba3b90d69fdf4feae32b9838be298dfb7997c1dc83b8b2697f2e7acbe857

Download Submit
C:\Windows\System\cOjNAqA.exe

Filesize
2.2MB

MD5
2f57d5989dbab7550380c080b8080386

SHA1
c921856717b60f702c5a3b46598a7a04b27627d6

SHA256
55fbac8db74d8f456a67582f28247d34d15149c88ffd5d483aa9358fdc1900c5

SHA512
7c68fbd84292a067392eab9f1cf63b0e5c19532c09d6e1defd91ce72ab68f9a9f7d3e9dbe811af9c6e804e44f5255bb1670bac3623dfeec230e9ae495bb4448f

Download Submit
C:\Windows\System\cxZMafT.exe

Filesize
8B

MD5
35e5aaaf64cfd996c128b5184afab2be

SHA1
d7f20e4be6b4dde2825158ba2dd315b1bd72d28d

SHA256
6844456d90722603693b3ccb4dc7bec92d10cefdd8ff55f8d3991fa66251cfa0

SHA512
8de872792634ad54586844c3ca75a8d446eafd9e8cd0e2be7e71c9b414ecc129d0165f96a35cf512cc4cf012f7eb348d16fa3bd899e37b2671c810982406d8b2

Download Submit
C:\Windows\System\dElUolC.exe

Filesize
2.2MB

MD5
29de424bcda2da0a8f79043aca5df9ec

SHA1
a890f999944e0e4e7a99e5b5ae8190ef447c69d8

SHA256
2277c4396fef8e1b9b934b29c2dadd83e76595c9fff4fae1848ae8e1185d7695

SHA512
ee7cd85d04ad11e84f842f88bea91e17f25170944816d1d2b12e7a9bf932246c56da00984ea9e4391f7ae2144199ff191715c5b5895e07638d35b268d684c3c8

Download Submit
C:\Windows\System\dXnvAGQ.exe

Filesize
2.2MB

MD5
64cb69e1cdc135eb195a553d9092d29e

SHA1
c78da361cc18f3b8c077cfd4ba44d1ac1c4d0707

SHA256
8a2e3fa95571b07549a8200053de96dff0364fb19cb41a45154f6e851a68cefa

SHA512
a0eef06ec10f2b32fea04b073252a5982cdb0256191f9c469bb074661f7c1fde2191e35b231ed08cc84363abdec4effa5adce411b95f56fa56f399c7a644bc97

Download Submit
C:\Windows\System\eGhGuHA.exe

Filesize
2.2MB

MD5
70a50de50ef726129adb43618e20d063

SHA1
890e7236900769aa21cd493ca06975f41273b82b

SHA256
fb67ede3e5b55ad48ca3083a741daf4cd057ad9463973f55432ff2645e9246f2

SHA512
1b88abda3740a6a2edbd33c34fad50f5b5fad75929c81314a8c046e5b133e454cd798c9c110e4a5393b958ad046a1f9651203a96a314b89a03353a3a31918a18

Download Submit
C:\Windows\System\ejhxTqg.exe

Filesize
2.2MB

MD5
a8fafa9fe99ca8d0451339ee1bb4f998

SHA1
bc5d794d0dc63bd8877a8daccbb226feaaef6bc7

SHA256
6f0bdbdc0f3881279e4db4991b4cd17dfbee259b71b425c3d425126c8e88100e

SHA512
0169ffca18a5463d2af636956dd870e05b03f253f8597708ebb4c9b3780c26a6ac6332f1a2f87e6bec292ce95860c33bf94e817e3a1e6ad689612c040727141b

Download Submit
C:\Windows\System\fomAomz.exe

Filesize
2.2MB

MD5
6fa3f3f05d2a29968ce088957d8aa39f

SHA1
78292f329db46b77002a0e4f20b3f98cc35847b6

SHA256
276e9abb0958b1a8a526fa1559132481c993a7e2c2e4f6f1f80fd3410053e3dd

SHA512
094bc8d9d0e8e959a34d42fd20a01e71c902807a760b503436859007e5bd3a4dd4cb87ee5cea65e7863471f18086a7becab1c1595f183db89cea2d520fcdab94

Download Submit
C:\Windows\System\hMSMlcl.exe

Filesize
2.2MB

MD5
91cfd675d6743a1e3b702fbb54c4e3db

SHA1
3fed552617f7f9cb0c030422998bd5b9f9ece08b

SHA256
71e18c0320b4b47489293f93628936b017d75f055fdf37ee536b757bb030f1db

SHA512
ddbec7d4288c284485fea6eb76152989e7bd115679b2646eb4d7b783b377b1c33bbdcae1184bb757b03e6a6846458de5315799e7b3123f52c34ef3ab7626b056

Download Submit
C:\Windows\System\hkSRcEJ.exe

Filesize
2.2MB

MD5
2565daa09d64a9a6186369c240119100

SHA1
1310abe616bc138e794da58197059022e23b2bed

SHA256
2d157ef98ec2c3a9e225dbd9fd75259406169697497e101358ddd9ef7f2729f6

SHA512
ca9f0ccc789154354282838d8fc6de49c3c4aa72fea7e406506b16204e4bba41b15787258f03d0a7f468a901e429a63f429d1dfb2d82512501868809f5f3e1f3

Download Submit
C:\Windows\System\kdNISBS.exe

Filesize
2.2MB

MD5
f67390782306085327f32598134a195b

SHA1
c2436e22d3498f58e8c9a9390dd185ed73171c50

SHA256
d4849761345db97ba653ededee5de91e6252612c85b8a3a47df6b0dab2f50ff5

SHA512
7af47ed588412bf3cdba1f539c70b9de8911cfd828428fb4a0e16c8f16d8acf1bc3a0c9aaf02e3c167d3d93c1d8b9f2b137ec13f9666a4710c185c316014b95b

Download Submit
C:\Windows\System\nwbeAnR.exe

Filesize
2.2MB

MD5
157672bb3fb30e82fa514f88e06d5aa2

SHA1
f053d0d0fe63703d4ed5d351591d77e8b5e55d9d

SHA256
17f334f6ac00d293ef8dc123964bcb0200d0741661e1982c8e66b9f971493f05

SHA512
0658f414ecec6f295f22a6bc447e3a75a1ba252ba6ea893414438d5209eb267c7744a9bf4c9dc3e4ac613bbcc9d871c178f242bf0bd2bca6f9b5ea16d2ebe82b

Download Submit
C:\Windows\System\omyjQBD.exe

Filesize
2.2MB

MD5
abcd27c8344da12990fa2b6c7174357f

SHA1
f39b58284924725d5455c149087cc4a64eb35e33

SHA256
6e1f58601e5b7b81cf7b565e6a5dc0f4255876a5a0c3b71c7956811f30f1bd52

SHA512
49cc39651922e8b9210c9b357e921249e10172874cd81b570190451428fd5265abde65830fcd03a6a5eb52ea97616b9d5a3509bb14dea70817e4cd790e6a313c

Download Submit
C:\Windows\System\qQcNbZN.exe

Filesize
2.2MB

MD5
5e0a0bd3e3930cca0d9cf38462dbac96

SHA1
df169ea5df6c7640fc6eb02b49b97b30c03e0ced

SHA256
6b640e82ffd7845849d2c3b34513de598300fd58996506f67112aff562dfaeb3

SHA512
8712f0b4993aecaf59a528c88bad4c62a02f83ea22103dd2be282bc3a15fcbb5c755d11ca51dc8a6683bbdeed2453e77288eb866b4703df354d99cb5c17b0c37

Download Submit
C:\Windows\System\sgTsZqd.exe

Filesize
2.3MB

MD5
adf8d4286b31735c3c8cd4b66b725705

SHA1
adc1f5751aea3ea10d19f873ee0c1636294014eb

SHA256
819689241d75e8a5f7d2bf5782ca776deb906fba8404da1e7f53900afb901207

SHA512
23bb0f19494d07b7fde420413953f54ea026aec402d04353a778edc6c446c939c6dab6dfc2f69052f67dc6f9eb620a897ff3713b157d4a439f15f2838bc54a3c

Download Submit
C:\Windows\System\sxyXaXG.exe

Filesize
2.2MB

MD5
e7d6d82238397308edcd5d25d2ca63c5

SHA1
083cb061f60e33aaf6a1964e426db245fc6113e7

SHA256
e1ea1bec8f13aaf0161efcb244ca26cebfccc89405642552b447d08c681f4192

SHA512
3f7e8426083fb2901e5a1e9c4c032cd945be5d9a4c382dd56e955704503474dbe8b2ace8f997aa807ef2cd120d8a9962fe119e845027523b6d020e8aa47b634a

Download Submit
C:\Windows\System\vYXwMEy.exe

Filesize
2.2MB

MD5
ccd9fa2d6527ff63348070a693054358

SHA1
2e8669530f9d9e1e83aa59234102cdae228ba87b

SHA256
5041fc2d4fdc8a0b3d5b4a142c9e6a1081cb78f9fb80b1f745768c0f588ec5a2

SHA512
61edebe6f9bcc0cd078e40d3d776073d8cc1656e95b44f09aa7fe4aea5c3bc962bffd5fd48d89882a2c0b01abfd6e719b0016ff385b4ef5313cb78e1b6a715e0

Download Submit
C:\Windows\System\vnAjkaP.exe

Filesize
2.2MB

MD5
c6a616ebe1faf77fa6425ce6e0c0d92c

SHA1
2bb6d97fbd51d7dbc8a9534c5907f0b164a63f99

SHA256
f152a9206695f32b65dffe961f6e34b4db7f554009a431ba4c8a1a4ae4283533

SHA512
0559e9a832065f3874576db71f4c18b3bbcde09738587fafedae2bc8bd3fe44d81c40ea17d03d7ab8dd012fdbab5535192dabd99caff6d65410efb27af10be50

Download Submit
C:\Windows\System\wsRSAjP.exe

Filesize
2.2MB

MD5
20fad60f2f4dc5f6ef5db16930bd91c0

SHA1
c33f784178c7d11af3586db64ec38d92389616d2

SHA256
e4dff5a81d6d505fce9d4e1d96d25a95fad41d6b3436a6f36ca8879da591611e

SHA512
09c39a875507ce594e32cee70aefb5aa0afb3220482fafd9ab37abb1244db3fa7413feecfa2d49b90a2b5e877aaa1fa5dafa2294531533656ef23097790ed1cf

Download Submit
C:\Windows\System\yFDPJgA.exe

Filesize
2.2MB

MD5
6b636c9cb8996d54e5502456d899711e

SHA1
2ac6d6672655956d77305e58a627c5de5a4d0fa2

SHA256
d130328f717222a6d891a38d01ed83dd25f4e638c811767c2337007bd5c4da09

SHA512
05af191b0acdbab5bf292d8e1c320a1abf281d06159d451ecdf199d3ddde7026444c635efc1a87006b1cbbd530a1dd8d00e77edebfe006c89a13b20aa0c4ab33

Download Submit
C:\Windows\System\zChABoL.exe

Filesize
2.3MB

MD5
528e68d107fdfdaab0985634fbe0f6d2

SHA1
4ddea1d92dfeb75d1b2651cb7586fe4187196d6d

SHA256
d9ac7507c2b1434cc64c2172c23ce495266cd526652ad270e0e9b0d239c22451

SHA512
9561bdfd3ffdfb0e7a90102ce2882a77dd1462365d37a73fef577126084190eaa4b6ffc17a7a3ed89d14b3564935c06f9534b7c99ecb5075a0d9c579f7ed8913

Download Submit
C:\Windows\System\zVvUFTh.exe

Filesize
2.2MB

MD5
32581ee2cc8db43e95eaf85a85ffc084

SHA1
8a41997e1885ae0da44dc08268830d8d615375c1

SHA256
05268d0a6516c06ca00bbb854b4f380d554a01ab756cee1cf294999405a11fba

SHA512
a532c0f2628f4cdc6f5dac4c594a10da1e6b532717edb6f632700d67adb65e89aa2bd478289061c4c18a4f99d252c1006ca2f8d2a1318289dff9443dab2f9618

Download Submit
memory/388-231-0x00007FF721B50000-0x00007FF721F42000-memory.dmp

Filesize
3.9MB

Download
memory/388-3332-0x00007FF721B50000-0x00007FF721F42000-memory.dmp

Filesize
3.9MB

Download
memory/448-338-0x00007FF726FE0000-0x00007FF7273D2000-memory.dmp

Filesize
3.9MB

Download
memory/448-3408-0x00007FF726FE0000-0x00007FF7273D2000-memory.dmp

Filesize
3.9MB

Download
memory/696-344-0x00007FF7F6800000-0x00007FF7F6BF2000-memory.dmp

Filesize
3.9MB

Download
memory/696-3439-0x00007FF7F6800000-0x00007FF7F6BF2000-memory.dmp

Filesize
3.9MB

Download
memory/764-342-0x00007FF7A1C70000-0x00007FF7A2062000-memory.dmp

Filesize
3.9MB

Download
memory/764-3390-0x00007FF7A1C70000-0x00007FF7A2062000-memory.dmp

Filesize
3.9MB

Download
memory/808-3315-0x00007FF6F3F90000-0x00007FF6F4382000-memory.dmp

Filesize
3.9MB

Download
memory/808-300-0x00007FF6F3F90000-0x00007FF6F4382000-memory.dmp

Filesize
3.9MB

Download
memory/1336-84-0x00007FFFAAE70000-0x00007FFFAB931000-memory.dmp

Filesize
10.8MB

Download
memory/1336-136-0x00007FFFAAE70000-0x00007FFFAB931000-memory.dmp

Filesize
10.8MB

Download
memory/1336-21-0x00007FFFAAE73000-0x00007FFFAAE75000-memory.dmp

Filesize
8KB

Download
memory/1336-113-0x0000022B03240000-0x0000022B03262000-memory.dmp

Filesize
136KB

Download
memory/1368-332-0x00007FF7571A0000-0x00007FF757592000-memory.dmp

Filesize
3.9MB

Download
memory/1368-3359-0x00007FF7571A0000-0x00007FF757592000-memory.dmp

Filesize
3.9MB

Download
memory/1536-3354-0x00007FF679840000-0x00007FF679C32000-memory.dmp

Filesize
3.9MB

Download
memory/1536-324-0x00007FF679840000-0x00007FF679C32000-memory.dmp

Filesize
3.9MB

Download
memory/1624-336-0x00007FF7B5270000-0x00007FF7B5662000-memory.dmp

Filesize
3.9MB

Download
memory/1624-3404-0x00007FF7B5270000-0x00007FF7B5662000-memory.dmp

Filesize
3.9MB

Download
memory/1808-3318-0x00007FF611650000-0x00007FF611A42000-memory.dmp

Filesize
3.9MB

Download
memory/1808-192-0x00007FF611650000-0x00007FF611A42000-memory.dmp

Filesize
3.9MB

Download
memory/1904-3361-0x00007FF684E50000-0x00007FF685242000-memory.dmp

Filesize
3.9MB

Download
memory/1904-333-0x00007FF684E50000-0x00007FF685242000-memory.dmp

Filesize
3.9MB

Download
memory/2024-257-0x00007FF6036F0000-0x00007FF603AE2000-memory.dmp

Filesize
3.9MB

Download
memory/2276-3341-0x00007FF671040000-0x00007FF671432000-memory.dmp

Filesize
3.9MB

Download
memory/2276-291-0x00007FF671040000-0x00007FF671432000-memory.dmp

Filesize
3.9MB

Download
memory/2420-330-0x00007FF6FAC80000-0x00007FF6FB072000-memory.dmp

Filesize
3.9MB

Download
memory/2420-3434-0x00007FF6FAC80000-0x00007FF6FB072000-memory.dmp

Filesize
3.9MB

Download
memory/2544-315-0x00007FF7B7B00000-0x00007FF7B7EF2000-memory.dmp

Filesize
3.9MB

Download
memory/2544-3326-0x00007FF7B7B00000-0x00007FF7B7EF2000-memory.dmp

Filesize
3.9MB

Download
memory/2712-3349-0x00007FF7A19A0000-0x00007FF7A1D92000-memory.dmp

Filesize
3.9MB

Download
memory/2712-334-0x00007FF7A19A0000-0x00007FF7A1D92000-memory.dmp

Filesize
3.9MB

Download
memory/2740-3336-0x00007FF6DC010000-0x00007FF6DC402000-memory.dmp

Filesize
3.9MB

Download
memory/2740-345-0x00007FF6DC010000-0x00007FF6DC402000-memory.dmp

Filesize
3.9MB

Download
memory/3224-11-0x00007FF7625B0000-0x00007FF7629A2000-memory.dmp

Filesize
3.9MB

Download
memory/3844-339-0x00007FF75C3C0000-0x00007FF75C7B2000-memory.dmp

Filesize
3.9MB

Download
memory/3844-3398-0x00007FF75C3C0000-0x00007FF75C7B2000-memory.dmp

Filesize
3.9MB

Download
memory/4004-341-0x00007FF64BEC0000-0x00007FF64C2B2000-memory.dmp

Filesize
3.9MB

Download
memory/4004-3385-0x00007FF64BEC0000-0x00007FF64C2B2000-memory.dmp

Filesize
3.9MB

Download
memory/4024-0-0x00007FF6CE560000-0x00007FF6CE952000-memory.dmp

Filesize
3.9MB

Download
memory/4024-1-0x0000018923CF0000-0x0000018923D00000-memory.dmp

Filesize
64KB

Download
memory/4024-3985-0x00007FF6CE560000-0x00007FF6CE952000-memory.dmp

Filesize
3.9MB

Download
memory/4524-3422-0x00007FF7FC1E0000-0x00007FF7FC5D2000-memory.dmp

Filesize
3.9MB

Download
memory/4524-346-0x00007FF7FC1E0000-0x00007FF7FC5D2000-memory.dmp

Filesize
3.9MB

Download
memory/4548-3394-0x00007FF6DBCC0000-0x00007FF6DC0B2000-memory.dmp

Filesize
3.9MB

Download
memory/4548-337-0x00007FF6DBCC0000-0x00007FF6DC0B2000-memory.dmp

Filesize
3.9MB

Download
memory/4556-3362-0x00007FF7D9DD0000-0x00007FF7DA1C2000-memory.dmp

Filesize
3.9MB

Download
memory/4556-331-0x00007FF7D9DD0000-0x00007FF7DA1C2000-memory.dmp

Filesize
3.9MB

Download
memory/4920-3418-0x00007FF706680000-0x00007FF706A72000-memory.dmp

Filesize
3.9MB

Download
memory/4920-340-0x00007FF706680000-0x00007FF706A72000-memory.dmp

Filesize
3.9MB

Download
memory/5044-3370-0x00007FF63C280000-0x00007FF63C672000-memory.dmp

Filesize
3.9MB

Download
memory/5044-335-0x00007FF63C280000-0x00007FF63C672000-memory.dmp

Filesize
3.9MB

Download