xmrig | 1c534428c13991ab47501d92debaf33246cbdccb7508d91674030da9a7876582

Analysis

max time kernel
137s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 22:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
Size

1.6MB
MD5

d08f6e52fe2d93f9a9271772ffb74813
SHA1

8818dd1e6dac1d673b2cd3354d848edf035449bd
SHA256

1c534428c13991ab47501d92debaf33246cbdccb7508d91674030da9a7876582
SHA512

43bac1efa381ee8aaf96a8004c0a3a498d6f46967e13a42def22e69337f1891e69ab2e276545244740d14ecf936dc5c8d7be5cbd2f825d6b36aa00d1de04d4dc
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82Sz66f:NABe

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 50 IoCs

miner

resource	yara_rule
behavioral2/memory/5260-267-0x00007FF7CD4B0000-0x00007FF7CD8A2000-memory.dmp	xmrig
behavioral2/memory/1736-301-0x00007FF634470000-0x00007FF634862000-memory.dmp	xmrig
behavioral2/memory/5624-310-0x00007FF683840000-0x00007FF683C32000-memory.dmp	xmrig
behavioral2/memory/5888-317-0x00007FF629370000-0x00007FF629762000-memory.dmp	xmrig
behavioral2/memory/4140-316-0x00007FF67E430000-0x00007FF67E822000-memory.dmp	xmrig
behavioral2/memory/1508-315-0x00007FF610970000-0x00007FF610D62000-memory.dmp	xmrig
behavioral2/memory/2664-314-0x00007FF604E10000-0x00007FF605202000-memory.dmp	xmrig
behavioral2/memory/2656-313-0x00007FF7B84B0000-0x00007FF7B88A2000-memory.dmp	xmrig
behavioral2/memory/5900-312-0x00007FF61A840000-0x00007FF61AC32000-memory.dmp	xmrig
behavioral2/memory/3164-311-0x00007FF77D560000-0x00007FF77D952000-memory.dmp	xmrig
behavioral2/memory/1540-309-0x00007FF6AE570000-0x00007FF6AE962000-memory.dmp	xmrig
behavioral2/memory/4872-308-0x00007FF6B0620000-0x00007FF6B0A12000-memory.dmp	xmrig
behavioral2/memory/5012-307-0x00007FF6F9670000-0x00007FF6F9A62000-memory.dmp	xmrig
behavioral2/memory/5780-300-0x00007FF6B7E10000-0x00007FF6B8202000-memory.dmp	xmrig
behavioral2/memory/2184-234-0x00007FF7D4DD0000-0x00007FF7D51C2000-memory.dmp	xmrig
behavioral2/memory/2952-205-0x00007FF70EE40000-0x00007FF70F232000-memory.dmp	xmrig
behavioral2/memory/1500-157-0x00007FF7FA470000-0x00007FF7FA862000-memory.dmp	xmrig
behavioral2/memory/1956-156-0x00007FF70A7A0000-0x00007FF70AB92000-memory.dmp	xmrig
behavioral2/memory/5352-84-0x00007FF7B3F70000-0x00007FF7B4362000-memory.dmp	xmrig
behavioral2/memory/2852-335-0x00007FF69EDC0000-0x00007FF69F1B2000-memory.dmp	xmrig
behavioral2/memory/1800-332-0x00007FF60BAD0000-0x00007FF60BEC2000-memory.dmp	xmrig
behavioral2/memory/852-331-0x00007FF78EAC0000-0x00007FF78EEB2000-memory.dmp	xmrig
behavioral2/memory/852-2442-0x00007FF78EAC0000-0x00007FF78EEB2000-memory.dmp	xmrig
behavioral2/memory/2436-341-0x00007FF6C5E80000-0x00007FF6C6272000-memory.dmp	xmrig
behavioral2/memory/2056-336-0x00007FF6BDA00000-0x00007FF6BDDF2000-memory.dmp	xmrig
behavioral2/memory/2996-333-0x00007FF7AD7B0000-0x00007FF7ADBA2000-memory.dmp	xmrig
behavioral2/memory/1800-3333-0x00007FF60BAD0000-0x00007FF60BEC2000-memory.dmp	xmrig
behavioral2/memory/2996-3332-0x00007FF7AD7B0000-0x00007FF7ADBA2000-memory.dmp	xmrig
behavioral2/memory/2664-3337-0x00007FF604E10000-0x00007FF605202000-memory.dmp	xmrig
behavioral2/memory/2852-3335-0x00007FF69EDC0000-0x00007FF69F1B2000-memory.dmp	xmrig
behavioral2/memory/2056-3339-0x00007FF6BDA00000-0x00007FF6BDDF2000-memory.dmp	xmrig
behavioral2/memory/1508-3341-0x00007FF610970000-0x00007FF610D62000-memory.dmp	xmrig
behavioral2/memory/1956-3352-0x00007FF70A7A0000-0x00007FF70AB92000-memory.dmp	xmrig
behavioral2/memory/4140-3353-0x00007FF67E430000-0x00007FF67E822000-memory.dmp	xmrig
behavioral2/memory/5352-3355-0x00007FF7B3F70000-0x00007FF7B4362000-memory.dmp	xmrig
behavioral2/memory/5780-3357-0x00007FF6B7E10000-0x00007FF6B8202000-memory.dmp	xmrig
behavioral2/memory/4872-3361-0x00007FF6B0620000-0x00007FF6B0A12000-memory.dmp	xmrig
behavioral2/memory/2436-3359-0x00007FF6C5E80000-0x00007FF6C6272000-memory.dmp	xmrig
behavioral2/memory/1500-3350-0x00007FF7FA470000-0x00007FF7FA862000-memory.dmp	xmrig
behavioral2/memory/2952-3348-0x00007FF70EE40000-0x00007FF70F232000-memory.dmp	xmrig
behavioral2/memory/2184-3345-0x00007FF7D4DD0000-0x00007FF7D51C2000-memory.dmp	xmrig
behavioral2/memory/2656-3344-0x00007FF7B84B0000-0x00007FF7B88A2000-memory.dmp	xmrig
behavioral2/memory/5012-3404-0x00007FF6F9670000-0x00007FF6F9A62000-memory.dmp	xmrig
behavioral2/memory/1736-3399-0x00007FF634470000-0x00007FF634862000-memory.dmp	xmrig
behavioral2/memory/1540-3392-0x00007FF6AE570000-0x00007FF6AE962000-memory.dmp	xmrig
behavioral2/memory/3164-3389-0x00007FF77D560000-0x00007FF77D952000-memory.dmp	xmrig
behavioral2/memory/5900-3387-0x00007FF61A840000-0x00007FF61AC32000-memory.dmp	xmrig
behavioral2/memory/5260-3381-0x00007FF7CD4B0000-0x00007FF7CD8A2000-memory.dmp	xmrig
behavioral2/memory/5888-3379-0x00007FF629370000-0x00007FF629762000-memory.dmp	xmrig
behavioral2/memory/5624-3398-0x00007FF683840000-0x00007FF683C32000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
9	1796	powershell.exe
11	1796	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1796	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2996	nPJvsnD.exe
1800	UZLwrGS.exe
2664	xddSDkq.exe
2852	kpxBPIe.exe
2056	KkwhEDr.exe
5352	lDAyNbZ.exe
1508	arqIXeK.exe
4140	VWBvgYj.exe
2436	lVQcSys.exe
1956	AAAjPwt.exe
1500	MIlPluC.exe
2952	UbUkkpW.exe
2184	TihSDwp.exe
5260	EYEmurI.exe
5780	nQJjCqq.exe
1736	jQsPxHE.exe
5012	eyzKSib.exe
5888	iERiQBC.exe
4872	TahqYhb.exe
1540	fhcyqOj.exe
5624	ClkTTBi.exe
3164	pucKxhb.exe
5900	ezepFLt.exe
2656	EgkacqM.exe
4844	GTvHRzv.exe
3140	CDdNKqT.exe
796	NeWQFUm.exe
1184	ILTEUit.exe
4664	VIqDEVE.exe
3664	vUHRbcc.exe
3676	OgLCGTH.exe
5612	RMGVeWO.exe
4528	pwwCsLc.exe
2768	OcPtVnR.exe
6076	IXvfdGV.exe
5268	thfUWUD.exe
3336	dLysiez.exe
4716	RRClcFv.exe
5528	OTfTIPH.exe
3472	UlBeGGe.exe
4452	AlhbHPo.exe
4848	UiqIMvF.exe
5308	WSSQnki.exe
4940	TVaVxki.exe
4228	jNDvnKU.exe
2612	dzkhQwL.exe
4116	yOChObD.exe
2908	HUKkVMU.exe
6124	CNKFxhk.exe
4436	FHsnPPb.exe
6052	JiFSyHB.exe
1372	BCVAWaL.exe
3000	aIshPWG.exe
4384	KodshjF.exe
3056	ggjlZbn.exe
4512	scDLnsr.exe
1204	vqDGjWj.exe
2776	AcMHgLu.exe
4200	tbNvZhb.exe
1464	ndUmXlq.exe
3256	bgwJLJE.exe
2380	flXsmpe.exe
912	yWcXTzg.exe
5740	ZgvVzeX.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/852-0-0x00007FF78EAC0000-0x00007FF78EEB2000-memory.dmp	upx
behavioral2/files/0x0007000000023613-6.dat	upx
behavioral2/files/0x0007000000023619-54.dat	upx
behavioral2/files/0x000700000002361f-72.dat	upx
behavioral2/files/0x0007000000023623-158.dat	upx
behavioral2/memory/5260-267-0x00007FF7CD4B0000-0x00007FF7CD8A2000-memory.dmp	upx
behavioral2/memory/1736-301-0x00007FF634470000-0x00007FF634862000-memory.dmp	upx
behavioral2/memory/5624-310-0x00007FF683840000-0x00007FF683C32000-memory.dmp	upx
behavioral2/memory/5888-317-0x00007FF629370000-0x00007FF629762000-memory.dmp	upx
behavioral2/memory/4140-316-0x00007FF67E430000-0x00007FF67E822000-memory.dmp	upx
behavioral2/memory/1508-315-0x00007FF610970000-0x00007FF610D62000-memory.dmp	upx
behavioral2/memory/2664-314-0x00007FF604E10000-0x00007FF605202000-memory.dmp	upx
behavioral2/memory/2656-313-0x00007FF7B84B0000-0x00007FF7B88A2000-memory.dmp	upx
behavioral2/memory/5900-312-0x00007FF61A840000-0x00007FF61AC32000-memory.dmp	upx
behavioral2/memory/3164-311-0x00007FF77D560000-0x00007FF77D952000-memory.dmp	upx
behavioral2/memory/1540-309-0x00007FF6AE570000-0x00007FF6AE962000-memory.dmp	upx
behavioral2/memory/4872-308-0x00007FF6B0620000-0x00007FF6B0A12000-memory.dmp	upx
behavioral2/memory/5012-307-0x00007FF6F9670000-0x00007FF6F9A62000-memory.dmp	upx
behavioral2/memory/5780-300-0x00007FF6B7E10000-0x00007FF6B8202000-memory.dmp	upx
behavioral2/memory/2184-234-0x00007FF7D4DD0000-0x00007FF7D51C2000-memory.dmp	upx
behavioral2/memory/2952-205-0x00007FF70EE40000-0x00007FF70F232000-memory.dmp	upx
behavioral2/files/0x0007000000023637-197.dat	upx
behavioral2/files/0x0007000000023636-196.dat	upx
behavioral2/files/0x0007000000023620-192.dat	upx
behavioral2/files/0x0007000000023622-186.dat	upx
behavioral2/files/0x0007000000023626-185.dat	upx
behavioral2/files/0x000700000002362e-175.dat	upx
behavioral2/files/0x000700000002362d-173.dat	upx
behavioral2/files/0x000700000002362c-171.dat	upx
behavioral2/files/0x000800000002360f-170.dat	upx
behavioral2/files/0x0007000000023635-169.dat	upx
behavioral2/files/0x000700000002362b-163.dat	upx
behavioral2/memory/1500-157-0x00007FF7FA470000-0x00007FF7FA862000-memory.dmp	upx
behavioral2/memory/1956-156-0x00007FF70A7A0000-0x00007FF70AB92000-memory.dmp	upx
behavioral2/files/0x0007000000023632-154.dat	upx
behavioral2/files/0x0007000000023630-152.dat	upx
behavioral2/files/0x0007000000023625-184.dat	upx
behavioral2/files/0x000700000002362f-146.dat	upx
behavioral2/files/0x0007000000023634-166.dat	upx
behavioral2/files/0x000700000002362a-133.dat	upx
behavioral2/files/0x0007000000023629-130.dat	upx
behavioral2/memory/2436-126-0x00007FF6C5E80000-0x00007FF6C6272000-memory.dmp	upx
behavioral2/files/0x0007000000023628-122.dat	upx
behavioral2/files/0x000700000002361e-121.dat	upx
behavioral2/files/0x0007000000023627-116.dat	upx
behavioral2/files/0x0007000000023631-153.dat	upx
behavioral2/files/0x000700000002361d-114.dat	upx
behavioral2/files/0x000700000002361c-105.dat	upx
behavioral2/files/0x000700000002361b-102.dat	upx
behavioral2/files/0x0007000000023624-99.dat	upx
behavioral2/files/0x0007000000023618-91.dat	upx
behavioral2/files/0x000700000002361a-87.dat	upx
behavioral2/files/0x0007000000023621-81.dat	upx
behavioral2/memory/5352-84-0x00007FF7B3F70000-0x00007FF7B4362000-memory.dmp	upx
behavioral2/memory/2056-65-0x00007FF6BDA00000-0x00007FF6BDDF2000-memory.dmp	upx
behavioral2/files/0x0007000000023617-61.dat	upx
behavioral2/files/0x0007000000023616-48.dat	upx
behavioral2/files/0x0007000000023615-45.dat	upx
behavioral2/memory/2852-44-0x00007FF69EDC0000-0x00007FF69F1B2000-memory.dmp	upx
behavioral2/files/0x0007000000023614-34.dat	upx
behavioral2/files/0x0008000000023611-26.dat	upx
behavioral2/memory/1800-27-0x00007FF60BAD0000-0x00007FF60BEC2000-memory.dmp	upx
behavioral2/memory/2996-16-0x00007FF7AD7B0000-0x00007FF7ADBA2000-memory.dmp	upx
behavioral2/files/0x0007000000023612-14.dat	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\DzwTRWJ.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\zkwkGVA.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\QiTazAW.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\QZkaphS.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\TTGsjea.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\qrniIfO.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\DfeqXhl.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\BYGcPsm.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\LQtVErw.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\GdUbTyI.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\pwKqJVb.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\VFwGbgF.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\DRmIxsH.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\qkmFzom.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\BnYXDJp.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\WmymRZH.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\tTaQVsu.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\AXsoqtf.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\ZSFBgMY.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\yIqaylr.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\sGpWkBk.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\lxbAUYp.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\FUuAGZJ.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\aiWtjJL.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\mQLgOki.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\TfoxTOE.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\NTiSDVF.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\FZhXajO.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\uRCzOHj.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\fIMKFCH.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\moDxwQW.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\ZsmXqAS.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\cSSGBwu.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\WxCbWga.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\VUyHcTX.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\vqDGjWj.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\XMeaXNP.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\jyUIhcg.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\LnivCmB.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\jMcHyGk.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\ZFKCwHc.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\FDRgvtc.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\EJWhQAj.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\MKwkvQt.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\GrWLoUH.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\cdvmYLJ.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\mmOJnwG.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\zMLvwzO.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\IxbClMH.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\DMcMywe.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\tZPuXvT.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\YlXoYwt.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\lcWSZwO.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\ysMmsXT.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\Wgyhpes.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\LCEfSqd.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\cijXByw.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\VwYsqWe.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\TeinNJo.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\FbsjKdP.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\lkciceG.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\rRnZirK.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\RJMUcuY.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
File created	C:\Windows\System\fAWzSTk.exe	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
Token: SeDebugPrivilege	1796	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 852 wrote to memory of 1796	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	91
PID 852 wrote to memory of 1796	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	91
PID 852 wrote to memory of 1800	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	92
PID 852 wrote to memory of 1800	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	92
PID 852 wrote to memory of 2996	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	93
PID 852 wrote to memory of 2996	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	93
PID 852 wrote to memory of 2664	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	94
PID 852 wrote to memory of 2664	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	94
PID 852 wrote to memory of 2852	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	95
PID 852 wrote to memory of 2852	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	95
PID 852 wrote to memory of 2056	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	96
PID 852 wrote to memory of 2056	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	96
PID 852 wrote to memory of 5352	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	97
PID 852 wrote to memory of 5352	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	97
PID 852 wrote to memory of 1508	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	98
PID 852 wrote to memory of 1508	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	98
PID 852 wrote to memory of 2436	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	99
PID 852 wrote to memory of 2436	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	99
PID 852 wrote to memory of 1956	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	100
PID 852 wrote to memory of 1956	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	100
PID 852 wrote to memory of 4140	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	101
PID 852 wrote to memory of 4140	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	101
PID 852 wrote to memory of 1500	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	102
PID 852 wrote to memory of 1500	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	102
PID 852 wrote to memory of 2952	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	103
PID 852 wrote to memory of 2952	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	103
PID 852 wrote to memory of 2184	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	104
PID 852 wrote to memory of 2184	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	104
PID 852 wrote to memory of 5260	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	105
PID 852 wrote to memory of 5260	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	105
PID 852 wrote to memory of 5780	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	106
PID 852 wrote to memory of 5780	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	106
PID 852 wrote to memory of 1736	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	107
PID 852 wrote to memory of 1736	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	107
PID 852 wrote to memory of 5012	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	108
PID 852 wrote to memory of 5012	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	108
PID 852 wrote to memory of 3164	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	109
PID 852 wrote to memory of 3164	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	109
PID 852 wrote to memory of 5888	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	110
PID 852 wrote to memory of 5888	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	110
PID 852 wrote to memory of 4872	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	111
PID 852 wrote to memory of 4872	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	111
PID 852 wrote to memory of 1540	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	112
PID 852 wrote to memory of 1540	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	112
PID 852 wrote to memory of 5624	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	113
PID 852 wrote to memory of 5624	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	113
PID 852 wrote to memory of 5900	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	114
PID 852 wrote to memory of 5900	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	114
PID 852 wrote to memory of 2656	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	115
PID 852 wrote to memory of 2656	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	115
PID 852 wrote to memory of 4844	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	116
PID 852 wrote to memory of 4844	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	116
PID 852 wrote to memory of 3140	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	117
PID 852 wrote to memory of 3140	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	117
PID 852 wrote to memory of 2768	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	118
PID 852 wrote to memory of 2768	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	118
PID 852 wrote to memory of 796	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	119
PID 852 wrote to memory of 796	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	119
PID 852 wrote to memory of 1184	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	120
PID 852 wrote to memory of 1184	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	120
PID 852 wrote to memory of 4664	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	121
PID 852 wrote to memory of 4664	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	121
PID 852 wrote to memory of 3664	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	122
PID 852 wrote to memory of 3664	852	d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe	122

C:\Users\Admin\AppData\Local\Temp\d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d08f6e52fe2d93f9a9271772ffb74813_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1796
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1796" "2980" "2912" "2984" "0" "0" "2988" "0" "0" "0" "0" "0"
    3⤵
    PID:14948
- C:\Windows\System\UZLwrGS.exe
  C:\Windows\System\UZLwrGS.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\nPJvsnD.exe
  C:\Windows\System\nPJvsnD.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\xddSDkq.exe
  C:\Windows\System\xddSDkq.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\kpxBPIe.exe
  C:\Windows\System\kpxBPIe.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\KkwhEDr.exe
  C:\Windows\System\KkwhEDr.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\lDAyNbZ.exe
  C:\Windows\System\lDAyNbZ.exe
  2⤵
  - Executes dropped EXE
  PID:5352
- C:\Windows\System\arqIXeK.exe
  C:\Windows\System\arqIXeK.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\lVQcSys.exe
  C:\Windows\System\lVQcSys.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\AAAjPwt.exe
  C:\Windows\System\AAAjPwt.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\VWBvgYj.exe
  C:\Windows\System\VWBvgYj.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\MIlPluC.exe
  C:\Windows\System\MIlPluC.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\UbUkkpW.exe
  C:\Windows\System\UbUkkpW.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\TihSDwp.exe
  C:\Windows\System\TihSDwp.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\EYEmurI.exe
  C:\Windows\System\EYEmurI.exe
  2⤵
  - Executes dropped EXE
  PID:5260
- C:\Windows\System\nQJjCqq.exe
  C:\Windows\System\nQJjCqq.exe
  2⤵
  - Executes dropped EXE
  PID:5780
- C:\Windows\System\jQsPxHE.exe
  C:\Windows\System\jQsPxHE.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\eyzKSib.exe
  C:\Windows\System\eyzKSib.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\pucKxhb.exe
  C:\Windows\System\pucKxhb.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\iERiQBC.exe
  C:\Windows\System\iERiQBC.exe
  2⤵
  - Executes dropped EXE
  PID:5888
- C:\Windows\System\TahqYhb.exe
  C:\Windows\System\TahqYhb.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\fhcyqOj.exe
  C:\Windows\System\fhcyqOj.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\ClkTTBi.exe
  C:\Windows\System\ClkTTBi.exe
  2⤵
  - Executes dropped EXE
  PID:5624
- C:\Windows\System\ezepFLt.exe
  C:\Windows\System\ezepFLt.exe
  2⤵
  - Executes dropped EXE
  PID:5900
- C:\Windows\System\EgkacqM.exe
  C:\Windows\System\EgkacqM.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\GTvHRzv.exe
  C:\Windows\System\GTvHRzv.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\CDdNKqT.exe
  C:\Windows\System\CDdNKqT.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\OcPtVnR.exe
  C:\Windows\System\OcPtVnR.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\NeWQFUm.exe
  C:\Windows\System\NeWQFUm.exe
  2⤵
  - Executes dropped EXE
  PID:796
- C:\Windows\System\ILTEUit.exe
  C:\Windows\System\ILTEUit.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\VIqDEVE.exe
  C:\Windows\System\VIqDEVE.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\vUHRbcc.exe
  C:\Windows\System\vUHRbcc.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\OgLCGTH.exe
  C:\Windows\System\OgLCGTH.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System\RMGVeWO.exe
  C:\Windows\System\RMGVeWO.exe
  2⤵
  - Executes dropped EXE
  PID:5612
- C:\Windows\System\pwwCsLc.exe
  C:\Windows\System\pwwCsLc.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\UlBeGGe.exe
  C:\Windows\System\UlBeGGe.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System\IXvfdGV.exe
  C:\Windows\System\IXvfdGV.exe
  2⤵
  - Executes dropped EXE
  PID:6076
- C:\Windows\System\thfUWUD.exe
  C:\Windows\System\thfUWUD.exe
  2⤵
  - Executes dropped EXE
  PID:5268
- C:\Windows\System\dLysiez.exe
  C:\Windows\System\dLysiez.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\RRClcFv.exe
  C:\Windows\System\RRClcFv.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\OTfTIPH.exe
  C:\Windows\System\OTfTIPH.exe
  2⤵
  - Executes dropped EXE
  PID:5528
- C:\Windows\System\AlhbHPo.exe
  C:\Windows\System\AlhbHPo.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\UiqIMvF.exe
  C:\Windows\System\UiqIMvF.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\WSSQnki.exe
  C:\Windows\System\WSSQnki.exe
  2⤵
  - Executes dropped EXE
  PID:5308
- C:\Windows\System\TVaVxki.exe
  C:\Windows\System\TVaVxki.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\jNDvnKU.exe
  C:\Windows\System\jNDvnKU.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\dzkhQwL.exe
  C:\Windows\System\dzkhQwL.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\yOChObD.exe
  C:\Windows\System\yOChObD.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System\HUKkVMU.exe
  C:\Windows\System\HUKkVMU.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\AcMHgLu.exe
  C:\Windows\System\AcMHgLu.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\CNKFxhk.exe
  C:\Windows\System\CNKFxhk.exe
  2⤵
  - Executes dropped EXE
  PID:6124
- C:\Windows\System\FHsnPPb.exe
  C:\Windows\System\FHsnPPb.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\JiFSyHB.exe
  C:\Windows\System\JiFSyHB.exe
  2⤵
  - Executes dropped EXE
  PID:6052
- C:\Windows\System\BCVAWaL.exe
  C:\Windows\System\BCVAWaL.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\aIshPWG.exe
  C:\Windows\System\aIshPWG.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\KodshjF.exe
  C:\Windows\System\KodshjF.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\ggjlZbn.exe
  C:\Windows\System\ggjlZbn.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\scDLnsr.exe
  C:\Windows\System\scDLnsr.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\vqDGjWj.exe
  C:\Windows\System\vqDGjWj.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\tbNvZhb.exe
  C:\Windows\System\tbNvZhb.exe
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\System\ndUmXlq.exe
  C:\Windows\System\ndUmXlq.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\bgwJLJE.exe
  C:\Windows\System\bgwJLJE.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\flXsmpe.exe
  C:\Windows\System\flXsmpe.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\yWcXTzg.exe
  C:\Windows\System\yWcXTzg.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\ZgvVzeX.exe
  C:\Windows\System\ZgvVzeX.exe
  2⤵
  - Executes dropped EXE
  PID:5740
- C:\Windows\System\oiUuNit.exe
  C:\Windows\System\oiUuNit.exe
  2⤵
  PID:2864
- C:\Windows\System\SOxjnJK.exe
  C:\Windows\System\SOxjnJK.exe
  2⤵
  PID:2400
- C:\Windows\System\DmvrDsb.exe
  C:\Windows\System\DmvrDsb.exe
  2⤵
  PID:5700
- C:\Windows\System\ueALLNh.exe
  C:\Windows\System\ueALLNh.exe
  2⤵
  PID:4076
- C:\Windows\System\MNvxleH.exe
  C:\Windows\System\MNvxleH.exe
  2⤵
  PID:4712
- C:\Windows\System\eeUjnKa.exe
  C:\Windows\System\eeUjnKa.exe
  2⤵
  PID:5664
- C:\Windows\System\NTiSDVF.exe
  C:\Windows\System\NTiSDVF.exe
  2⤵
  PID:1896
- C:\Windows\System\sYzeznG.exe
  C:\Windows\System\sYzeznG.exe
  2⤵
  PID:4904
- C:\Windows\System\hOpSUnp.exe
  C:\Windows\System\hOpSUnp.exe
  2⤵
  PID:3672
- C:\Windows\System\ExXvHYR.exe
  C:\Windows\System\ExXvHYR.exe
  2⤵
  PID:3828
- C:\Windows\System\mqnOnhx.exe
  C:\Windows\System\mqnOnhx.exe
  2⤵
  PID:5064
- C:\Windows\System\PfrnAgu.exe
  C:\Windows\System\PfrnAgu.exe
  2⤵
  PID:3812
- C:\Windows\System\bQcPiuP.exe
  C:\Windows\System\bQcPiuP.exe
  2⤵
  PID:2496
- C:\Windows\System\hPEyral.exe
  C:\Windows\System\hPEyral.exe
  2⤵
  PID:3456
- C:\Windows\System\VjgjkHB.exe
  C:\Windows\System\VjgjkHB.exe
  2⤵
  PID:3104
- C:\Windows\System\hanIzAS.exe
  C:\Windows\System\hanIzAS.exe
  2⤵
  PID:4080
- C:\Windows\System\NpNXsHp.exe
  C:\Windows\System\NpNXsHp.exe
  2⤵
  PID:1620
- C:\Windows\System\JrHVgxA.exe
  C:\Windows\System\JrHVgxA.exe
  2⤵
  PID:1904
- C:\Windows\System\LdYgJBe.exe
  C:\Windows\System\LdYgJBe.exe
  2⤵
  PID:1264
- C:\Windows\System\yvXUPPH.exe
  C:\Windows\System\yvXUPPH.exe
  2⤵
  PID:4412
- C:\Windows\System\wwRkFLA.exe
  C:\Windows\System\wwRkFLA.exe
  2⤵
  PID:2724
- C:\Windows\System\dFJGeSu.exe
  C:\Windows\System\dFJGeSu.exe
  2⤵
  PID:2992
- C:\Windows\System\RaISiRM.exe
  C:\Windows\System\RaISiRM.exe
  2⤵
  PID:3592
- C:\Windows\System\YlTqNBX.exe
  C:\Windows\System\YlTqNBX.exe
  2⤵
  PID:1532
- C:\Windows\System\jfVAQww.exe
  C:\Windows\System\jfVAQww.exe
  2⤵
  PID:2980
- C:\Windows\System\PZmZBOT.exe
  C:\Windows\System\PZmZBOT.exe
  2⤵
  PID:3884
- C:\Windows\System\JMVwMtf.exe
  C:\Windows\System\JMVwMtf.exe
  2⤵
  PID:4404
- C:\Windows\System\jRmyeNW.exe
  C:\Windows\System\jRmyeNW.exe
  2⤵
  PID:4444
- C:\Windows\System\lTJfizt.exe
  C:\Windows\System\lTJfizt.exe
  2⤵
  PID:3312
- C:\Windows\System\NVXyTWJ.exe
  C:\Windows\System\NVXyTWJ.exe
  2⤵
  PID:2480
- C:\Windows\System\jARrqTO.exe
  C:\Windows\System\jARrqTO.exe
  2⤵
  PID:1644
- C:\Windows\System\nXAlCmq.exe
  C:\Windows\System\nXAlCmq.exe
  2⤵
  PID:1760
- C:\Windows\System\chaaHyR.exe
  C:\Windows\System\chaaHyR.exe
  2⤵
  PID:4732
- C:\Windows\System\wpwikQZ.exe
  C:\Windows\System\wpwikQZ.exe
  2⤵
  PID:3772
- C:\Windows\System\VgKziYU.exe
  C:\Windows\System\VgKziYU.exe
  2⤵
  PID:1068
- C:\Windows\System\uFJzFlA.exe
  C:\Windows\System\uFJzFlA.exe
  2⤵
  PID:2352
- C:\Windows\System\pKhKZlD.exe
  C:\Windows\System\pKhKZlD.exe
  2⤵
  PID:3116
- C:\Windows\System\dRJjfHP.exe
  C:\Windows\System\dRJjfHP.exe
  2⤵
  PID:1344
- C:\Windows\System\VQMPZEo.exe
  C:\Windows\System\VQMPZEo.exe
  2⤵
  PID:3932
- C:\Windows\System\ZLbRrmK.exe
  C:\Windows\System\ZLbRrmK.exe
  2⤵
  PID:5588
- C:\Windows\System\FVLSOxi.exe
  C:\Windows\System\FVLSOxi.exe
  2⤵
  PID:5824
- C:\Windows\System\FtyqaAG.exe
  C:\Windows\System\FtyqaAG.exe
  2⤵
  PID:856
- C:\Windows\System\BXSRwXQ.exe
  C:\Windows\System\BXSRwXQ.exe
  2⤵
  PID:6016
- C:\Windows\System\XoipSmw.exe
  C:\Windows\System\XoipSmw.exe
  2⤵
  PID:5920
- C:\Windows\System\PMjUXnP.exe
  C:\Windows\System\PMjUXnP.exe
  2⤵
  PID:3208
- C:\Windows\System\fostWRq.exe
  C:\Windows\System\fostWRq.exe
  2⤵
  PID:4028
- C:\Windows\System\XCLzvpO.exe
  C:\Windows\System\XCLzvpO.exe
  2⤵
  PID:3748
- C:\Windows\System\KlHfSLh.exe
  C:\Windows\System\KlHfSLh.exe
  2⤵
  PID:5096
- C:\Windows\System\lrsWiBo.exe
  C:\Windows\System\lrsWiBo.exe
  2⤵
  PID:4804
- C:\Windows\System\mUpQwNa.exe
  C:\Windows\System\mUpQwNa.exe
  2⤵
  PID:1668
- C:\Windows\System\KVXJoKU.exe
  C:\Windows\System\KVXJoKU.exe
  2⤵
  PID:1696
- C:\Windows\System\OzSWxtS.exe
  C:\Windows\System\OzSWxtS.exe
  2⤵
  PID:5456
- C:\Windows\System\YnwHgTH.exe
  C:\Windows\System\YnwHgTH.exe
  2⤵
  PID:4736
- C:\Windows\System\cYsTyRq.exe
  C:\Windows\System\cYsTyRq.exe
  2⤵
  PID:3712
- C:\Windows\System\RogqwEi.exe
  C:\Windows\System\RogqwEi.exe
  2⤵
  PID:2388
- C:\Windows\System\wqmaTEo.exe
  C:\Windows\System\wqmaTEo.exe
  2⤵
  PID:5808
- C:\Windows\System\eWrGogx.exe
  C:\Windows\System\eWrGogx.exe
  2⤵
  PID:3204
- C:\Windows\System\OXnIpyP.exe
  C:\Windows\System\OXnIpyP.exe
  2⤵
  PID:5904
- C:\Windows\System\eXpIuIw.exe
  C:\Windows\System\eXpIuIw.exe
  2⤵
  PID:2976
- C:\Windows\System\GKdYmKQ.exe
  C:\Windows\System\GKdYmKQ.exe
  2⤵
  PID:2760
- C:\Windows\System\EIataXE.exe
  C:\Windows\System\EIataXE.exe
  2⤵
  PID:4876
- C:\Windows\System\kYtELVh.exe
  C:\Windows\System\kYtELVh.exe
  2⤵
  PID:5156
- C:\Windows\System\CrOgNXC.exe
  C:\Windows\System\CrOgNXC.exe
  2⤵
  PID:3588
- C:\Windows\System\sNuOnek.exe
  C:\Windows\System\sNuOnek.exe
  2⤵
  PID:3736
- C:\Windows\System\Cswnpbg.exe
  C:\Windows\System\Cswnpbg.exe
  2⤵
  PID:4608
- C:\Windows\System\NBKDQJY.exe
  C:\Windows\System\NBKDQJY.exe
  2⤵
  PID:4072
- C:\Windows\System\sqcxjtW.exe
  C:\Windows\System\sqcxjtW.exe
  2⤵
  PID:1404
- C:\Windows\System\GEhVGZQ.exe
  C:\Windows\System\GEhVGZQ.exe
  2⤵
  PID:5028
- C:\Windows\System\EFfIHba.exe
  C:\Windows\System\EFfIHba.exe
  2⤵
  PID:6156
- C:\Windows\System\EJWhQAj.exe
  C:\Windows\System\EJWhQAj.exe
  2⤵
  PID:6176
- C:\Windows\System\akkhiuA.exe
  C:\Windows\System\akkhiuA.exe
  2⤵
  PID:6200
- C:\Windows\System\ntPICwh.exe
  C:\Windows\System\ntPICwh.exe
  2⤵
  PID:6220
- C:\Windows\System\AJVClVm.exe
  C:\Windows\System\AJVClVm.exe
  2⤵
  PID:6240
- C:\Windows\System\nHZnbCd.exe
  C:\Windows\System\nHZnbCd.exe
  2⤵
  PID:6260
- C:\Windows\System\DvCVvRu.exe
  C:\Windows\System\DvCVvRu.exe
  2⤵
  PID:6280
- C:\Windows\System\vMPLjNG.exe
  C:\Windows\System\vMPLjNG.exe
  2⤵
  PID:6308
- C:\Windows\System\qFHvOBr.exe
  C:\Windows\System\qFHvOBr.exe
  2⤵
  PID:6332
- C:\Windows\System\vyZHLqW.exe
  C:\Windows\System\vyZHLqW.exe
  2⤵
  PID:6356
- C:\Windows\System\lXcQJyb.exe
  C:\Windows\System\lXcQJyb.exe
  2⤵
  PID:6376
- C:\Windows\System\BKGmHHZ.exe
  C:\Windows\System\BKGmHHZ.exe
  2⤵
  PID:6396
- C:\Windows\System\dzNNFKI.exe
  C:\Windows\System\dzNNFKI.exe
  2⤵
  PID:6412
- C:\Windows\System\MfTHQDH.exe
  C:\Windows\System\MfTHQDH.exe
  2⤵
  PID:6436
- C:\Windows\System\OcSnTiB.exe
  C:\Windows\System\OcSnTiB.exe
  2⤵
  PID:6452
- C:\Windows\System\OUWDxao.exe
  C:\Windows\System\OUWDxao.exe
  2⤵
  PID:6472
- C:\Windows\System\VxjRmho.exe
  C:\Windows\System\VxjRmho.exe
  2⤵
  PID:6488
- C:\Windows\System\qJMHYSu.exe
  C:\Windows\System\qJMHYSu.exe
  2⤵
  PID:6512
- C:\Windows\System\hgAwvNY.exe
  C:\Windows\System\hgAwvNY.exe
  2⤵
  PID:6528
- C:\Windows\System\MAWrvAp.exe
  C:\Windows\System\MAWrvAp.exe
  2⤵
  PID:6552
- C:\Windows\System\FhOQGEY.exe
  C:\Windows\System\FhOQGEY.exe
  2⤵
  PID:6572
- C:\Windows\System\HdMwSWe.exe
  C:\Windows\System\HdMwSWe.exe
  2⤵
  PID:6592
- C:\Windows\System\zgULzcK.exe
  C:\Windows\System\zgULzcK.exe
  2⤵
  PID:6608
- C:\Windows\System\eAgBnBG.exe
  C:\Windows\System\eAgBnBG.exe
  2⤵
  PID:6648
- C:\Windows\System\plciVoS.exe
  C:\Windows\System\plciVoS.exe
  2⤵
  PID:6664
- C:\Windows\System\nmyrRdu.exe
  C:\Windows\System\nmyrRdu.exe
  2⤵
  PID:6692
- C:\Windows\System\taqOgUk.exe
  C:\Windows\System\taqOgUk.exe
  2⤵
  PID:6708
- C:\Windows\System\rYRgsau.exe
  C:\Windows\System\rYRgsau.exe
  2⤵
  PID:6732
- C:\Windows\System\gjZtbtM.exe
  C:\Windows\System\gjZtbtM.exe
  2⤵
  PID:6752
- C:\Windows\System\lZBpaWf.exe
  C:\Windows\System\lZBpaWf.exe
  2⤵
  PID:6772
- C:\Windows\System\qxIAXDQ.exe
  C:\Windows\System\qxIAXDQ.exe
  2⤵
  PID:6796
- C:\Windows\System\MMZdDKj.exe
  C:\Windows\System\MMZdDKj.exe
  2⤵
  PID:6820
- C:\Windows\System\ftmTKZx.exe
  C:\Windows\System\ftmTKZx.exe
  2⤵
  PID:6836
- C:\Windows\System\NVzswbQ.exe
  C:\Windows\System\NVzswbQ.exe
  2⤵
  PID:6860
- C:\Windows\System\zzHHSBq.exe
  C:\Windows\System\zzHHSBq.exe
  2⤵
  PID:6880
- C:\Windows\System\fdbTKlb.exe
  C:\Windows\System\fdbTKlb.exe
  2⤵
  PID:6904
- C:\Windows\System\ojUHQqx.exe
  C:\Windows\System\ojUHQqx.exe
  2⤵
  PID:6928
- C:\Windows\System\xKWXcNp.exe
  C:\Windows\System\xKWXcNp.exe
  2⤵
  PID:6944
- C:\Windows\System\HnbaLng.exe
  C:\Windows\System\HnbaLng.exe
  2⤵
  PID:6964
- C:\Windows\System\jIXKKHW.exe
  C:\Windows\System\jIXKKHW.exe
  2⤵
  PID:6980
- C:\Windows\System\uSCMPco.exe
  C:\Windows\System\uSCMPco.exe
  2⤵
  PID:7004
- C:\Windows\System\tBXzsFJ.exe
  C:\Windows\System\tBXzsFJ.exe
  2⤵
  PID:7024
- C:\Windows\System\ZaXTAiQ.exe
  C:\Windows\System\ZaXTAiQ.exe
  2⤵
  PID:7044
- C:\Windows\System\QpMvMRg.exe
  C:\Windows\System\QpMvMRg.exe
  2⤵
  PID:7064
- C:\Windows\System\MiYwSSH.exe
  C:\Windows\System\MiYwSSH.exe
  2⤵
  PID:7088
- C:\Windows\System\hpJKFcW.exe
  C:\Windows\System\hpJKFcW.exe
  2⤵
  PID:7104
- C:\Windows\System\NlGnrtE.exe
  C:\Windows\System\NlGnrtE.exe
  2⤵
  PID:7132
- C:\Windows\System\VwYsqWe.exe
  C:\Windows\System\VwYsqWe.exe
  2⤵
  PID:7148
- C:\Windows\System\iIszXVO.exe
  C:\Windows\System\iIszXVO.exe
  2⤵
  PID:1804
- C:\Windows\System\fMKaHya.exe
  C:\Windows\System\fMKaHya.exe
  2⤵
  PID:2568
- C:\Windows\System\yGtpfAQ.exe
  C:\Windows\System\yGtpfAQ.exe
  2⤵
  PID:3940
- C:\Windows\System\TOlGdaC.exe
  C:\Windows\System\TOlGdaC.exe
  2⤵
  PID:1656
- C:\Windows\System\MyRmXYc.exe
  C:\Windows\System\MyRmXYc.exe
  2⤵
  PID:5812
- C:\Windows\System\gvTGMew.exe
  C:\Windows\System\gvTGMew.exe
  2⤵
  PID:5492
- C:\Windows\System\yKClYfD.exe
  C:\Windows\System\yKClYfD.exe
  2⤵
  PID:1900
- C:\Windows\System\igshota.exe
  C:\Windows\System\igshota.exe
  2⤵
  PID:1384
- C:\Windows\System\QIxERvH.exe
  C:\Windows\System\QIxERvH.exe
  2⤵
  PID:6248
- C:\Windows\System\CUVBycI.exe
  C:\Windows\System\CUVBycI.exe
  2⤵
  PID:5088
- C:\Windows\System\yIqaylr.exe
  C:\Windows\System\yIqaylr.exe
  2⤵
  PID:3212
- C:\Windows\System\GdUbTyI.exe
  C:\Windows\System\GdUbTyI.exe
  2⤵
  PID:6268
- C:\Windows\System\YWFsEYL.exe
  C:\Windows\System\YWFsEYL.exe
  2⤵
  PID:6328
- C:\Windows\System\GerGOlL.exe
  C:\Windows\System\GerGOlL.exe
  2⤵
  PID:1140
- C:\Windows\System\gUqSRGf.exe
  C:\Windows\System\gUqSRGf.exe
  2⤵
  PID:2356
- C:\Windows\System\nHImgEo.exe
  C:\Windows\System\nHImgEo.exe
  2⤵
  PID:936
- C:\Windows\System\kgjjacg.exe
  C:\Windows\System\kgjjacg.exe
  2⤵
  PID:5360
- C:\Windows\System\MUnNwdU.exe
  C:\Windows\System\MUnNwdU.exe
  2⤵
  PID:6168
- C:\Windows\System\otRyQzw.exe
  C:\Windows\System\otRyQzw.exe
  2⤵
  PID:6520
- C:\Windows\System\xNDdWiD.exe
  C:\Windows\System\xNDdWiD.exe
  2⤵
  PID:5252
- C:\Windows\System\XFfDAdS.exe
  C:\Windows\System\XFfDAdS.exe
  2⤵
  PID:2460
- C:\Windows\System\EDbOUnL.exe
  C:\Windows\System\EDbOUnL.exe
  2⤵
  PID:1940
- C:\Windows\System\WewsAqt.exe
  C:\Windows\System\WewsAqt.exe
  2⤵
  PID:6316
- C:\Windows\System\EGSdtxe.exe
  C:\Windows\System\EGSdtxe.exe
  2⤵
  PID:5512
- C:\Windows\System\pMfnnUJ.exe
  C:\Windows\System\pMfnnUJ.exe
  2⤵
  PID:7180
- C:\Windows\System\umVyumn.exe
  C:\Windows\System\umVyumn.exe
  2⤵
  PID:7196
- C:\Windows\System\VIXyZoq.exe
  C:\Windows\System\VIXyZoq.exe
  2⤵
  PID:7216
- C:\Windows\System\YZlCYqA.exe
  C:\Windows\System\YZlCYqA.exe
  2⤵
  PID:7236
- C:\Windows\System\CjTJxhq.exe
  C:\Windows\System\CjTJxhq.exe
  2⤵
  PID:7260
- C:\Windows\System\DNXudhA.exe
  C:\Windows\System\DNXudhA.exe
  2⤵
  PID:7280
- C:\Windows\System\heNIWDR.exe
  C:\Windows\System\heNIWDR.exe
  2⤵
  PID:7300
- C:\Windows\System\HOEsadU.exe
  C:\Windows\System\HOEsadU.exe
  2⤵
  PID:7320
- C:\Windows\System\EYFOjbB.exe
  C:\Windows\System\EYFOjbB.exe
  2⤵
  PID:7340
- C:\Windows\System\vWVJJhy.exe
  C:\Windows\System\vWVJJhy.exe
  2⤵
  PID:7364
- C:\Windows\System\qMaNDML.exe
  C:\Windows\System\qMaNDML.exe
  2⤵
  PID:7380
- C:\Windows\System\CJFjqco.exe
  C:\Windows\System\CJFjqco.exe
  2⤵
  PID:7404
- C:\Windows\System\QmeRHfN.exe
  C:\Windows\System\QmeRHfN.exe
  2⤵
  PID:7428
- C:\Windows\System\rdSEjDy.exe
  C:\Windows\System\rdSEjDy.exe
  2⤵
  PID:7444
- C:\Windows\System\pWKlwgg.exe
  C:\Windows\System\pWKlwgg.exe
  2⤵
  PID:7468
- C:\Windows\System\DAUzbbO.exe
  C:\Windows\System\DAUzbbO.exe
  2⤵
  PID:7488
- C:\Windows\System\wdOJmNK.exe
  C:\Windows\System\wdOJmNK.exe
  2⤵
  PID:7516
- C:\Windows\System\hcXNGnn.exe
  C:\Windows\System\hcXNGnn.exe
  2⤵
  PID:7532
- C:\Windows\System\crVEpnR.exe
  C:\Windows\System\crVEpnR.exe
  2⤵
  PID:7556
- C:\Windows\System\fPpTHKx.exe
  C:\Windows\System\fPpTHKx.exe
  2⤵
  PID:7576
- C:\Windows\System\CCuxGDw.exe
  C:\Windows\System\CCuxGDw.exe
  2⤵
  PID:7592
- C:\Windows\System\XjKAQko.exe
  C:\Windows\System\XjKAQko.exe
  2⤵
  PID:7612
- C:\Windows\System\lMGxZGC.exe
  C:\Windows\System\lMGxZGC.exe
  2⤵
  PID:7636
- C:\Windows\System\fzbwhKm.exe
  C:\Windows\System\fzbwhKm.exe
  2⤵
  PID:7652
- C:\Windows\System\ofkUIDN.exe
  C:\Windows\System\ofkUIDN.exe
  2⤵
  PID:7668
- C:\Windows\System\jxTTAxJ.exe
  C:\Windows\System\jxTTAxJ.exe
  2⤵
  PID:7688
- C:\Windows\System\hKxBZMr.exe
  C:\Windows\System\hKxBZMr.exe
  2⤵
  PID:7716
- C:\Windows\System\prYEWVq.exe
  C:\Windows\System\prYEWVq.exe
  2⤵
  PID:7736
- C:\Windows\System\pwKqJVb.exe
  C:\Windows\System\pwKqJVb.exe
  2⤵
  PID:7752
- C:\Windows\System\MemQUUS.exe
  C:\Windows\System\MemQUUS.exe
  2⤵
  PID:7772
- C:\Windows\System\QxrnOcO.exe
  C:\Windows\System\QxrnOcO.exe
  2⤵
  PID:7788
- C:\Windows\System\RvTsiOA.exe
  C:\Windows\System\RvTsiOA.exe
  2⤵
  PID:7812
- C:\Windows\System\QWSPNSz.exe
  C:\Windows\System\QWSPNSz.exe
  2⤵
  PID:7828
- C:\Windows\System\ZAHzdMY.exe
  C:\Windows\System\ZAHzdMY.exe
  2⤵
  PID:7856
- C:\Windows\System\sDENoBX.exe
  C:\Windows\System\sDENoBX.exe
  2⤵
  PID:7876
- C:\Windows\System\hDRlftZ.exe
  C:\Windows\System\hDRlftZ.exe
  2⤵
  PID:7896
- C:\Windows\System\cqxHCap.exe
  C:\Windows\System\cqxHCap.exe
  2⤵
  PID:7912
- C:\Windows\System\iRxAWps.exe
  C:\Windows\System\iRxAWps.exe
  2⤵
  PID:7932
- C:\Windows\System\ntRNOIu.exe
  C:\Windows\System\ntRNOIu.exe
  2⤵
  PID:7952
- C:\Windows\System\kPpYneu.exe
  C:\Windows\System\kPpYneu.exe
  2⤵
  PID:7980
- C:\Windows\System\LiwNLkG.exe
  C:\Windows\System\LiwNLkG.exe
  2⤵
  PID:8000
- C:\Windows\System\vRGDcOW.exe
  C:\Windows\System\vRGDcOW.exe
  2⤵
  PID:8024
- C:\Windows\System\nbguIad.exe
  C:\Windows\System\nbguIad.exe
  2⤵
  PID:8044
- C:\Windows\System\pZIWpEv.exe
  C:\Windows\System\pZIWpEv.exe
  2⤵
  PID:8064
- C:\Windows\System\jiNQuyy.exe
  C:\Windows\System\jiNQuyy.exe
  2⤵
  PID:8080
- C:\Windows\System\NeLrckk.exe
  C:\Windows\System\NeLrckk.exe
  2⤵
  PID:8108
- C:\Windows\System\BjyNQfn.exe
  C:\Windows\System\BjyNQfn.exe
  2⤵
  PID:8124
- C:\Windows\System\TGJXKvc.exe
  C:\Windows\System\TGJXKvc.exe
  2⤵
  PID:8144
- C:\Windows\System\uCECCfY.exe
  C:\Windows\System\uCECCfY.exe
  2⤵
  PID:8168
- C:\Windows\System\ZowIRCU.exe
  C:\Windows\System\ZowIRCU.exe
  2⤵
  PID:8188
- C:\Windows\System\QzMWfGt.exe
  C:\Windows\System\QzMWfGt.exe
  2⤵
  PID:6164
- C:\Windows\System\mUXIduh.exe
  C:\Windows\System\mUXIduh.exe
  2⤵
  PID:6212
- C:\Windows\System\EFJcvfu.exe
  C:\Windows\System\EFJcvfu.exe
  2⤵
  PID:6584
- C:\Windows\System\vBLBZxh.exe
  C:\Windows\System\vBLBZxh.exe
  2⤵
  PID:6624
- C:\Windows\System\TFQKwzK.exe
  C:\Windows\System\TFQKwzK.exe
  2⤵
  PID:6684
- C:\Windows\System\BDxgitv.exe
  C:\Windows\System\BDxgitv.exe
  2⤵
  PID:2796
- C:\Windows\System\vebCuWz.exe
  C:\Windows\System\vebCuWz.exe
  2⤵
  PID:6768
- C:\Windows\System\QZmWjlN.exe
  C:\Windows\System\QZmWjlN.exe
  2⤵
  PID:6788
- C:\Windows\System\vjgUVyj.exe
  C:\Windows\System\vjgUVyj.exe
  2⤵
  PID:6828
- C:\Windows\System\KnIWPws.exe
  C:\Windows\System\KnIWPws.exe
  2⤵
  PID:6152
- C:\Windows\System\klezDvr.exe
  C:\Windows\System\klezDvr.exe
  2⤵
  PID:6856
- C:\Windows\System\BSVFPOf.exe
  C:\Windows\System\BSVFPOf.exe
  2⤵
  PID:5032
- C:\Windows\System\hsHSdvz.exe
  C:\Windows\System\hsHSdvz.exe
  2⤵
  PID:6924
- C:\Windows\System\bsCouLb.exe
  C:\Windows\System\bsCouLb.exe
  2⤵
  PID:6940
- C:\Windows\System\CZuidQO.exe
  C:\Windows\System\CZuidQO.exe
  2⤵
  PID:6524
- C:\Windows\System\OOemBYw.exe
  C:\Windows\System\OOemBYw.exe
  2⤵
  PID:7036
- C:\Windows\System\Xtjngpt.exe
  C:\Windows\System\Xtjngpt.exe
  2⤵
  PID:7436
- C:\Windows\System\PjYTyKA.exe
  C:\Windows\System\PjYTyKA.exe
  2⤵
  PID:7476
- C:\Windows\System\cvErwpw.exe
  C:\Windows\System\cvErwpw.exe
  2⤵
  PID:7112
- C:\Windows\System\wvfXQwP.exe
  C:\Windows\System\wvfXQwP.exe
  2⤵
  PID:7540
- C:\Windows\System\XakOqxA.exe
  C:\Windows\System\XakOqxA.exe
  2⤵
  PID:8204
- C:\Windows\System\VhvnWOZ.exe
  C:\Windows\System\VhvnWOZ.exe
  2⤵
  PID:8224
- C:\Windows\System\HqHLdet.exe
  C:\Windows\System\HqHLdet.exe
  2⤵
  PID:8248
- C:\Windows\System\GngZhWa.exe
  C:\Windows\System\GngZhWa.exe
  2⤵
  PID:8264
- C:\Windows\System\wUeSWmX.exe
  C:\Windows\System\wUeSWmX.exe
  2⤵
  PID:8284
- C:\Windows\System\EtoTKxq.exe
  C:\Windows\System\EtoTKxq.exe
  2⤵
  PID:8308
- C:\Windows\System\YlXoYwt.exe
  C:\Windows\System\YlXoYwt.exe
  2⤵
  PID:8328
- C:\Windows\System\diNrOhJ.exe
  C:\Windows\System\diNrOhJ.exe
  2⤵
  PID:8348
- C:\Windows\System\Bytsywg.exe
  C:\Windows\System\Bytsywg.exe
  2⤵
  PID:8368
- C:\Windows\System\lcWSZwO.exe
  C:\Windows\System\lcWSZwO.exe
  2⤵
  PID:8388
- C:\Windows\System\yJpjHbM.exe
  C:\Windows\System\yJpjHbM.exe
  2⤵
  PID:8404
- C:\Windows\System\JnKUjkd.exe
  C:\Windows\System\JnKUjkd.exe
  2⤵
  PID:8424
- C:\Windows\System\kOfGpNH.exe
  C:\Windows\System\kOfGpNH.exe
  2⤵
  PID:8648
- C:\Windows\System\JRiiwfx.exe
  C:\Windows\System\JRiiwfx.exe
  2⤵
  PID:8688
- C:\Windows\System\oFQLwDT.exe
  C:\Windows\System\oFQLwDT.exe
  2⤵
  PID:8708
- C:\Windows\System\zMLvwzO.exe
  C:\Windows\System\zMLvwzO.exe
  2⤵
  PID:8736
- C:\Windows\System\kuwNZCf.exe
  C:\Windows\System\kuwNZCf.exe
  2⤵
  PID:8756
- C:\Windows\System\UznVCZC.exe
  C:\Windows\System\UznVCZC.exe
  2⤵
  PID:8776
- C:\Windows\System\NIqBCxk.exe
  C:\Windows\System\NIqBCxk.exe
  2⤵
  PID:8800
- C:\Windows\System\WFcTzmG.exe
  C:\Windows\System\WFcTzmG.exe
  2⤵
  PID:8820
- C:\Windows\System\YvhsIXN.exe
  C:\Windows\System\YvhsIXN.exe
  2⤵
  PID:8840
- C:\Windows\System\FesMUSP.exe
  C:\Windows\System\FesMUSP.exe
  2⤵
  PID:8860
- C:\Windows\System\OzTGhvW.exe
  C:\Windows\System\OzTGhvW.exe
  2⤵
  PID:8884
- C:\Windows\System\jgnVVut.exe
  C:\Windows\System\jgnVVut.exe
  2⤵
  PID:8900
- C:\Windows\System\FbsjKdP.exe
  C:\Windows\System\FbsjKdP.exe
  2⤵
  PID:8924
- C:\Windows\System\sgQNsAy.exe
  C:\Windows\System\sgQNsAy.exe
  2⤵
  PID:8948
- C:\Windows\System\ZBdXXAZ.exe
  C:\Windows\System\ZBdXXAZ.exe
  2⤵
  PID:8964
- C:\Windows\System\irikJZg.exe
  C:\Windows\System\irikJZg.exe
  2⤵
  PID:8984
- C:\Windows\System\pBsgOfW.exe
  C:\Windows\System\pBsgOfW.exe
  2⤵
  PID:9004
- C:\Windows\System\ekOkMVc.exe
  C:\Windows\System\ekOkMVc.exe
  2⤵
  PID:9068
- C:\Windows\System\siQLZoM.exe
  C:\Windows\System\siQLZoM.exe
  2⤵
  PID:9084
- C:\Windows\System\jrNupiw.exe
  C:\Windows\System\jrNupiw.exe
  2⤵
  PID:9108
- C:\Windows\System\dysCjxN.exe
  C:\Windows\System\dysCjxN.exe
  2⤵
  PID:9132
- C:\Windows\System\dFwhPMT.exe
  C:\Windows\System\dFwhPMT.exe
  2⤵
  PID:9156
- C:\Windows\System\cYQoQjR.exe
  C:\Windows\System\cYQoQjR.exe
  2⤵
  PID:9176
- C:\Windows\System\MDUKrUm.exe
  C:\Windows\System\MDUKrUm.exe
  2⤵
  PID:9196
- C:\Windows\System\uOdhxzD.exe
  C:\Windows\System\uOdhxzD.exe
  2⤵
  PID:7608
- C:\Windows\System\HiHCqri.exe
  C:\Windows\System\HiHCqri.exe
  2⤵
  PID:2248
- C:\Windows\System\ATLIQex.exe
  C:\Windows\System\ATLIQex.exe
  2⤵
  PID:6672
- C:\Windows\System\tLngRqx.exe
  C:\Windows\System\tLngRqx.exe
  2⤵
  PID:7708
- C:\Windows\System\rTbVkou.exe
  C:\Windows\System\rTbVkou.exe
  2⤵
  PID:1908
- C:\Windows\System\xYcDenT.exe
  C:\Windows\System\xYcDenT.exe
  2⤵
  PID:7808
- C:\Windows\System\gGGQAzj.exe
  C:\Windows\System\gGGQAzj.exe
  2⤵
  PID:6348
- C:\Windows\System\hNopbOf.exe
  C:\Windows\System\hNopbOf.exe
  2⤵
  PID:8056
- C:\Windows\System\mBJkTKz.exe
  C:\Windows\System\mBJkTKz.exe
  2⤵
  PID:6876
- C:\Windows\System\OOuoQot.exe
  C:\Windows\System\OOuoQot.exe
  2⤵
  PID:7248
- C:\Windows\System\BdzZckG.exe
  C:\Windows\System\BdzZckG.exe
  2⤵
  PID:6996
- C:\Windows\System\DzwTRWJ.exe
  C:\Windows\System\DzwTRWJ.exe
  2⤵
  PID:7416
- C:\Windows\System\JwimoCE.exe
  C:\Windows\System\JwimoCE.exe
  2⤵
  PID:6988
- C:\Windows\System\AXsoqtf.exe
  C:\Windows\System\AXsoqtf.exe
  2⤵
  PID:7388
- C:\Windows\System\BWLVIIA.exe
  C:\Windows\System\BWLVIIA.exe
  2⤵
  PID:1580
- C:\Windows\System\OqXViDm.exe
  C:\Windows\System\OqXViDm.exe
  2⤵
  PID:5396
- C:\Windows\System\LtIUZnL.exe
  C:\Windows\System\LtIUZnL.exe
  2⤵
  PID:7764
- C:\Windows\System\uoMylrG.exe
  C:\Windows\System\uoMylrG.exe
  2⤵
  PID:7904
- C:\Windows\System\qesHRwc.exe
  C:\Windows\System\qesHRwc.exe
  2⤵
  PID:8136
- C:\Windows\System\JYzweJJ.exe
  C:\Windows\System\JYzweJJ.exe
  2⤵
  PID:5424
- C:\Windows\System\blqoMAG.exe
  C:\Windows\System\blqoMAG.exe
  2⤵
  PID:6660
- C:\Windows\System\KLhNmMv.exe
  C:\Windows\System\KLhNmMv.exe
  2⤵
  PID:6972
- C:\Windows\System\rlKpEZs.exe
  C:\Windows\System\rlKpEZs.exe
  2⤵
  PID:8196
- C:\Windows\System\sEKAKhC.exe
  C:\Windows\System\sEKAKhC.exe
  2⤵
  PID:8296
- C:\Windows\System\aPStbQE.exe
  C:\Windows\System\aPStbQE.exe
  2⤵
  PID:7928
- C:\Windows\System\xPHTlKy.exe
  C:\Windows\System\xPHTlKy.exe
  2⤵
  PID:6428
- C:\Windows\System\XMeaXNP.exe
  C:\Windows\System\XMeaXNP.exe
  2⤵
  PID:6568
- C:\Windows\System\lyrZjPI.exe
  C:\Windows\System\lyrZjPI.exe
  2⤵
  PID:7192
- C:\Windows\System\UNrnAHh.exe
  C:\Windows\System\UNrnAHh.exe
  2⤵
  PID:8520
- C:\Windows\System\ZcFrZpl.exe
  C:\Windows\System\ZcFrZpl.exe
  2⤵
  PID:7332
- C:\Windows\System\JbtXFCD.exe
  C:\Windows\System\JbtXFCD.exe
  2⤵
  PID:7348
- C:\Windows\System\yBKGMSe.exe
  C:\Windows\System\yBKGMSe.exe
  2⤵
  PID:7564
- C:\Windows\System\TFcqsqe.exe
  C:\Windows\System\TFcqsqe.exe
  2⤵
  PID:7120
- C:\Windows\System\lkciceG.exe
  C:\Windows\System\lkciceG.exe
  2⤵
  PID:9228
- C:\Windows\System\BYGcPsm.exe
  C:\Windows\System\BYGcPsm.exe
  2⤵
  PID:9244
- C:\Windows\System\THrldna.exe
  C:\Windows\System\THrldna.exe
  2⤵
  PID:9268
- C:\Windows\System\lBYFGte.exe
  C:\Windows\System\lBYFGte.exe
  2⤵
  PID:9284
- C:\Windows\System\QiTazAW.exe
  C:\Windows\System\QiTazAW.exe
  2⤵
  PID:9332
- C:\Windows\System\InYtOOY.exe
  C:\Windows\System\InYtOOY.exe
  2⤵
  PID:9348
- C:\Windows\System\tOUmKHe.exe
  C:\Windows\System\tOUmKHe.exe
  2⤵
  PID:9372
- C:\Windows\System\BRGrEKx.exe
  C:\Windows\System\BRGrEKx.exe
  2⤵
  PID:9392
- C:\Windows\System\jyUIhcg.exe
  C:\Windows\System\jyUIhcg.exe
  2⤵
  PID:9420
- C:\Windows\System\kRBDtmT.exe
  C:\Windows\System\kRBDtmT.exe
  2⤵
  PID:9440
- C:\Windows\System\azAdYHn.exe
  C:\Windows\System\azAdYHn.exe
  2⤵
  PID:9456
- C:\Windows\System\iPWxKDV.exe
  C:\Windows\System\iPWxKDV.exe
  2⤵
  PID:9472
- C:\Windows\System\KrtTOWe.exe
  C:\Windows\System\KrtTOWe.exe
  2⤵
  PID:9492
- C:\Windows\System\RUUZKwY.exe
  C:\Windows\System\RUUZKwY.exe
  2⤵
  PID:9524
- C:\Windows\System\eyIlBpE.exe
  C:\Windows\System\eyIlBpE.exe
  2⤵
  PID:9540
- C:\Windows\System\JfPNSwy.exe
  C:\Windows\System\JfPNSwy.exe
  2⤵
  PID:9564
- C:\Windows\System\dRcETPL.exe
  C:\Windows\System\dRcETPL.exe
  2⤵
  PID:9580
- C:\Windows\System\keigJnN.exe
  C:\Windows\System\keigJnN.exe
  2⤵
  PID:9612
- C:\Windows\System\gxvqrCT.exe
  C:\Windows\System\gxvqrCT.exe
  2⤵
  PID:9648
- C:\Windows\System\MztaYHp.exe
  C:\Windows\System\MztaYHp.exe
  2⤵
  PID:9668
- C:\Windows\System\INQjyYJ.exe
  C:\Windows\System\INQjyYJ.exe
  2⤵
  PID:9688
- C:\Windows\System\NedxbLM.exe
  C:\Windows\System\NedxbLM.exe
  2⤵
  PID:9708
- C:\Windows\System\EmXrABT.exe
  C:\Windows\System\EmXrABT.exe
  2⤵
  PID:9724
- C:\Windows\System\GfKZkAN.exe
  C:\Windows\System\GfKZkAN.exe
  2⤵
  PID:9752
- C:\Windows\System\dDnWJqp.exe
  C:\Windows\System\dDnWJqp.exe
  2⤵
  PID:9780
- C:\Windows\System\uDJBrMy.exe
  C:\Windows\System\uDJBrMy.exe
  2⤵
  PID:9800
- C:\Windows\System\MsZnpMb.exe
  C:\Windows\System\MsZnpMb.exe
  2⤵
  PID:9820
- C:\Windows\System\CbvfhtH.exe
  C:\Windows\System\CbvfhtH.exe
  2⤵
  PID:9836
- C:\Windows\System\bhkYpZQ.exe
  C:\Windows\System\bhkYpZQ.exe
  2⤵
  PID:9860
- C:\Windows\System\vgYCmvy.exe
  C:\Windows\System\vgYCmvy.exe
  2⤵
  PID:9880
- C:\Windows\System\WpBeqFy.exe
  C:\Windows\System\WpBeqFy.exe
  2⤵
  PID:9900
- C:\Windows\System\qxQFETx.exe
  C:\Windows\System\qxQFETx.exe
  2⤵
  PID:9920
- C:\Windows\System\vKndQym.exe
  C:\Windows\System\vKndQym.exe
  2⤵
  PID:9940
- C:\Windows\System\mMghZVk.exe
  C:\Windows\System\mMghZVk.exe
  2⤵
  PID:9968
- C:\Windows\System\MKwkvQt.exe
  C:\Windows\System\MKwkvQt.exe
  2⤵
  PID:9988
- C:\Windows\System\seIVqln.exe
  C:\Windows\System\seIVqln.exe
  2⤵
  PID:10012
- C:\Windows\System\woWgFCh.exe
  C:\Windows\System\woWgFCh.exe
  2⤵
  PID:10032
- C:\Windows\System\lqZuDoc.exe
  C:\Windows\System\lqZuDoc.exe
  2⤵
  PID:10048
- C:\Windows\System\GrWLoUH.exe
  C:\Windows\System\GrWLoUH.exe
  2⤵
  PID:10076
- C:\Windows\System\mVnPVUp.exe
  C:\Windows\System\mVnPVUp.exe
  2⤵
  PID:10104
- C:\Windows\System\SyOYjZT.exe
  C:\Windows\System\SyOYjZT.exe
  2⤵
  PID:10124
- C:\Windows\System\HVfDZdq.exe
  C:\Windows\System\HVfDZdq.exe
  2⤵
  PID:10152
- C:\Windows\System\NMGJmQe.exe
  C:\Windows\System\NMGJmQe.exe
  2⤵
  PID:10172
- C:\Windows\System\jaVONJH.exe
  C:\Windows\System\jaVONJH.exe
  2⤵
  PID:10196
- C:\Windows\System\oUyVmUW.exe
  C:\Windows\System\oUyVmUW.exe
  2⤵
  PID:10224
- C:\Windows\System\nVPLKfE.exe
  C:\Windows\System\nVPLKfE.exe
  2⤵
  PID:7660
- C:\Windows\System\QrSyLIv.exe
  C:\Windows\System\QrSyLIv.exe
  2⤵
  PID:8344
- C:\Windows\System\IxbClMH.exe
  C:\Windows\System\IxbClMH.exe
  2⤵
  PID:8384
- C:\Windows\System\hMkOMPK.exe
  C:\Windows\System\hMkOMPK.exe
  2⤵
  PID:7804
- C:\Windows\System\RIQCVwh.exe
  C:\Windows\System\RIQCVwh.exe
  2⤵
  PID:8416
- C:\Windows\System\MICKnpC.exe
  C:\Windows\System\MICKnpC.exe
  2⤵
  PID:8732
- C:\Windows\System\YANmIzs.exe
  C:\Windows\System\YANmIzs.exe
  2⤵
  PID:7924
- C:\Windows\System\bXegFIj.exe
  C:\Windows\System\bXegFIj.exe
  2⤵
  PID:7872
- C:\Windows\System\XYCogGl.exe
  C:\Windows\System\XYCogGl.exe
  2⤵
  PID:8132
- C:\Windows\System\SiggTQT.exe
  C:\Windows\System\SiggTQT.exe
  2⤵
  PID:8076
- C:\Windows\System\OlnVoWD.exe
  C:\Windows\System\OlnVoWD.exe
  2⤵
  PID:7072
- C:\Windows\System\GlaDNne.exe
  C:\Windows\System\GlaDNne.exe
  2⤵
  PID:10264
- C:\Windows\System\IhCnAOC.exe
  C:\Windows\System\IhCnAOC.exe
  2⤵
  PID:10292
- C:\Windows\System\gFHaMzw.exe
  C:\Windows\System\gFHaMzw.exe
  2⤵
  PID:10308
- C:\Windows\System\NLzbCTY.exe
  C:\Windows\System\NLzbCTY.exe
  2⤵
  PID:10328
- C:\Windows\System\BcBkIge.exe
  C:\Windows\System\BcBkIge.exe
  2⤵
  PID:10344
- C:\Windows\System\ubbXuCT.exe
  C:\Windows\System\ubbXuCT.exe
  2⤵
  PID:10360
- C:\Windows\System\rsxdaYa.exe
  C:\Windows\System\rsxdaYa.exe
  2⤵
  PID:10376
- C:\Windows\System\rGFTVhS.exe
  C:\Windows\System\rGFTVhS.exe
  2⤵
  PID:10396
- C:\Windows\System\xBXhWcE.exe
  C:\Windows\System\xBXhWcE.exe
  2⤵
  PID:10416
- C:\Windows\System\PTIyWmX.exe
  C:\Windows\System\PTIyWmX.exe
  2⤵
  PID:10444
- C:\Windows\System\MmBkemJ.exe
  C:\Windows\System\MmBkemJ.exe
  2⤵
  PID:10460
- C:\Windows\System\wfnfuHC.exe
  C:\Windows\System\wfnfuHC.exe
  2⤵
  PID:10488
- C:\Windows\System\XfxwYaz.exe
  C:\Windows\System\XfxwYaz.exe
  2⤵
  PID:10512
- C:\Windows\System\ZPjvpCO.exe
  C:\Windows\System\ZPjvpCO.exe
  2⤵
  PID:10532
- C:\Windows\System\nmLdxJk.exe
  C:\Windows\System\nmLdxJk.exe
  2⤵
  PID:10548
- C:\Windows\System\INUFCKn.exe
  C:\Windows\System\INUFCKn.exe
  2⤵
  PID:10572
- C:\Windows\System\nZdBznJ.exe
  C:\Windows\System\nZdBznJ.exe
  2⤵
  PID:10596
- C:\Windows\System\gJgVhEH.exe
  C:\Windows\System\gJgVhEH.exe
  2⤵
  PID:10616
- C:\Windows\System\FZhXajO.exe
  C:\Windows\System\FZhXajO.exe
  2⤵
  PID:10632
- C:\Windows\System\viVRDMG.exe
  C:\Windows\System\viVRDMG.exe
  2⤵
  PID:10656
- C:\Windows\System\VoKglWd.exe
  C:\Windows\System\VoKglWd.exe
  2⤵
  PID:10672
- C:\Windows\System\XaXRrHr.exe
  C:\Windows\System\XaXRrHr.exe
  2⤵
  PID:10696
- C:\Windows\System\cUaMmPB.exe
  C:\Windows\System\cUaMmPB.exe
  2⤵
  PID:10716
- C:\Windows\System\HpDsTLs.exe
  C:\Windows\System\HpDsTLs.exe
  2⤵
  PID:10736
- C:\Windows\System\EOxQWto.exe
  C:\Windows\System\EOxQWto.exe
  2⤵
  PID:10760
- C:\Windows\System\MefjDfc.exe
  C:\Windows\System\MefjDfc.exe
  2⤵
  PID:10776
- C:\Windows\System\VtraaKG.exe
  C:\Windows\System\VtraaKG.exe
  2⤵
  PID:10792
- C:\Windows\System\fRqGuue.exe
  C:\Windows\System\fRqGuue.exe
  2⤵
  PID:10812
- C:\Windows\System\mHWKbHn.exe
  C:\Windows\System\mHWKbHn.exe
  2⤵
  PID:10832
- C:\Windows\System\FXBwgfi.exe
  C:\Windows\System\FXBwgfi.exe
  2⤵
  PID:10856
- C:\Windows\System\feqDfIn.exe
  C:\Windows\System\feqDfIn.exe
  2⤵
  PID:10880
- C:\Windows\System\diOHCvY.exe
  C:\Windows\System\diOHCvY.exe
  2⤵
  PID:10900
- C:\Windows\System\bxQXwfd.exe
  C:\Windows\System\bxQXwfd.exe
  2⤵
  PID:10920
- C:\Windows\System\lRNFUHJ.exe
  C:\Windows\System\lRNFUHJ.exe
  2⤵
  PID:10944
- C:\Windows\System\LElgumT.exe
  C:\Windows\System\LElgumT.exe
  2⤵
  PID:10964
- C:\Windows\System\haCQQTD.exe
  C:\Windows\System\haCQQTD.exe
  2⤵
  PID:10984
- C:\Windows\System\GtvwzRI.exe
  C:\Windows\System\GtvwzRI.exe
  2⤵
  PID:11008
- C:\Windows\System\OnMgVXZ.exe
  C:\Windows\System\OnMgVXZ.exe
  2⤵
  PID:11032
- C:\Windows\System\ScbEExK.exe
  C:\Windows\System\ScbEExK.exe
  2⤵
  PID:11048
- C:\Windows\System\nhSbjBn.exe
  C:\Windows\System\nhSbjBn.exe
  2⤵
  PID:11072
- C:\Windows\System\fFubXHB.exe
  C:\Windows\System\fFubXHB.exe
  2⤵
  PID:11088
- C:\Windows\System\pmmIZrv.exe
  C:\Windows\System\pmmIZrv.exe
  2⤵
  PID:11112
- C:\Windows\System\rZwMzXX.exe
  C:\Windows\System\rZwMzXX.exe
  2⤵
  PID:11132
- C:\Windows\System\FXNcVvW.exe
  C:\Windows\System\FXNcVvW.exe
  2⤵
  PID:11152
- C:\Windows\System\JUZLUss.exe
  C:\Windows\System\JUZLUss.exe
  2⤵
  PID:11172
- C:\Windows\System\iPUwPCb.exe
  C:\Windows\System\iPUwPCb.exe
  2⤵
  PID:11192
- C:\Windows\System\BFvXwuC.exe
  C:\Windows\System\BFvXwuC.exe
  2⤵
  PID:11220
- C:\Windows\System\vNMEvov.exe
  C:\Windows\System\vNMEvov.exe
  2⤵
  PID:11240
- C:\Windows\System\AZNYkMj.exe
  C:\Windows\System\AZNYkMj.exe
  2⤵
  PID:11260
- C:\Windows\System\POlvBkN.exe
  C:\Windows\System\POlvBkN.exe
  2⤵
  PID:8772
- C:\Windows\System\wDTvcrG.exe
  C:\Windows\System\wDTvcrG.exe
  2⤵
  PID:9716
- C:\Windows\System\rjDmgQB.exe
  C:\Windows\System\rjDmgQB.exe
  2⤵
  PID:6480
- C:\Windows\System\OFFAlRO.exe
  C:\Windows\System\OFFAlRO.exe
  2⤵
  PID:7844
- C:\Windows\System\LujwmTN.exe
  C:\Windows\System\LujwmTN.exe
  2⤵
  PID:9764
- C:\Windows\System\kNPcMXB.exe
  C:\Windows\System\kNPcMXB.exe
  2⤵
  PID:9772
- C:\Windows\System\GYEZTyH.exe
  C:\Windows\System\GYEZTyH.exe
  2⤵
  PID:9792
- C:\Windows\System\cGFahHF.exe
  C:\Windows\System\cGFahHF.exe
  2⤵
  PID:9872
- C:\Windows\System\JKOaZPu.exe
  C:\Windows\System\JKOaZPu.exe
  2⤵
  PID:10000
- C:\Windows\System\WnQQhFU.exe
  C:\Windows\System\WnQQhFU.exe
  2⤵
  PID:8500
- C:\Windows\System\decfKCH.exe
  C:\Windows\System\decfKCH.exe
  2⤵
  PID:10096
- C:\Windows\System\BDVAAek.exe
  C:\Windows\System\BDVAAek.exe
  2⤵
  PID:10180
- C:\Windows\System\qSOaWcX.exe
  C:\Windows\System\qSOaWcX.exe
  2⤵
  PID:9164
- C:\Windows\System\mggNviR.exe
  C:\Windows\System\mggNviR.exe
  2⤵
  PID:7684
- C:\Windows\System\vkWOxyO.exe
  C:\Windows\System\vkWOxyO.exe
  2⤵
  PID:8700
- C:\Windows\System\WXBCalB.exe
  C:\Windows\System\WXBCalB.exe
  2⤵
  PID:7848
- C:\Windows\System\lXdidDo.exe
  C:\Windows\System\lXdidDo.exe
  2⤵
  PID:7372
- C:\Windows\System\rCzitMZ.exe
  C:\Windows\System\rCzitMZ.exe
  2⤵
  PID:7584
- C:\Windows\System\YXuQCqB.exe
  C:\Windows\System\YXuQCqB.exe
  2⤵
  PID:7820
- C:\Windows\System\HpbwtgP.exe
  C:\Windows\System\HpbwtgP.exe
  2⤵
  PID:6936
- C:\Windows\System\mFRrIfd.exe
  C:\Windows\System\mFRrIfd.exe
  2⤵
  PID:8256
- C:\Windows\System\BDHmQxz.exe
  C:\Windows\System\BDHmQxz.exe
  2⤵
  PID:8008
- C:\Windows\System\hQzWlzy.exe
  C:\Windows\System\hQzWlzy.exe
  2⤵
  PID:11268
- C:\Windows\System\ANPcCGg.exe
  C:\Windows\System\ANPcCGg.exe
  2⤵
  PID:11296
- C:\Windows\System\OAXloAE.exe
  C:\Windows\System\OAXloAE.exe
  2⤵
  PID:11312
- C:\Windows\System\wTcNcde.exe
  C:\Windows\System\wTcNcde.exe
  2⤵
  PID:11328
- C:\Windows\System\OIOATxA.exe
  C:\Windows\System\OIOATxA.exe
  2⤵
  PID:11344
- C:\Windows\System\pKSgNjD.exe
  C:\Windows\System\pKSgNjD.exe
  2⤵
  PID:11360
- C:\Windows\System\caacuuS.exe
  C:\Windows\System\caacuuS.exe
  2⤵
  PID:11376
- C:\Windows\System\qvRduea.exe
  C:\Windows\System\qvRduea.exe
  2⤵
  PID:11392
- C:\Windows\System\jNXkEwK.exe
  C:\Windows\System\jNXkEwK.exe
  2⤵
  PID:11408
- C:\Windows\System\LfyvHFQ.exe
  C:\Windows\System\LfyvHFQ.exe
  2⤵
  PID:11428
- C:\Windows\System\WfRUIcW.exe
  C:\Windows\System\WfRUIcW.exe
  2⤵
  PID:11444
- C:\Windows\System\yGrRZQv.exe
  C:\Windows\System\yGrRZQv.exe
  2⤵
  PID:11468
- C:\Windows\System\Hwfwiiw.exe
  C:\Windows\System\Hwfwiiw.exe
  2⤵
  PID:11492
- C:\Windows\System\YiwVgpB.exe
  C:\Windows\System\YiwVgpB.exe
  2⤵
  PID:11508
- C:\Windows\System\xGFkyXr.exe
  C:\Windows\System\xGFkyXr.exe
  2⤵
  PID:11532
- C:\Windows\System\qXyZasr.exe
  C:\Windows\System\qXyZasr.exe
  2⤵
  PID:11580
- C:\Windows\System\xzFEjJe.exe
  C:\Windows\System\xzFEjJe.exe
  2⤵
  PID:11600
- C:\Windows\System\KRVgnYw.exe
  C:\Windows\System\KRVgnYw.exe
  2⤵
  PID:11620
- C:\Windows\System\tbygpon.exe
  C:\Windows\System\tbygpon.exe
  2⤵
  PID:11640
- C:\Windows\System\ArYOOeQ.exe
  C:\Windows\System\ArYOOeQ.exe
  2⤵
  PID:11656
- C:\Windows\System\tOXduFk.exe
  C:\Windows\System\tOXduFk.exe
  2⤵
  PID:11672
- C:\Windows\System\sKKvTFG.exe
  C:\Windows\System\sKKvTFG.exe
  2⤵
  PID:11692
- C:\Windows\System\bppGuPN.exe
  C:\Windows\System\bppGuPN.exe
  2⤵
  PID:11712
- C:\Windows\System\jHPxAlz.exe
  C:\Windows\System\jHPxAlz.exe
  2⤵
  PID:11732
- C:\Windows\System\kxQAuhk.exe
  C:\Windows\System\kxQAuhk.exe
  2⤵
  PID:11756
- C:\Windows\System\JiZQUVT.exe
  C:\Windows\System\JiZQUVT.exe
  2⤵
  PID:11784
- C:\Windows\System\dfrCYtE.exe
  C:\Windows\System\dfrCYtE.exe
  2⤵
  PID:11804
- C:\Windows\System\hvxMgFW.exe
  C:\Windows\System\hvxMgFW.exe
  2⤵
  PID:11820
- C:\Windows\System\cEOQUxe.exe
  C:\Windows\System\cEOQUxe.exe
  2⤵
  PID:11844
- C:\Windows\System\XypewnF.exe
  C:\Windows\System\XypewnF.exe
  2⤵
  PID:11884
- C:\Windows\System\vApZSwi.exe
  C:\Windows\System\vApZSwi.exe
  2⤵
  PID:11904
- C:\Windows\System\PccTtbv.exe
  C:\Windows\System\PccTtbv.exe
  2⤵
  PID:11928
- C:\Windows\System\hZSjxWF.exe
  C:\Windows\System\hZSjxWF.exe
  2⤵
  PID:11948
- C:\Windows\System\tKSCvPj.exe
  C:\Windows\System\tKSCvPj.exe
  2⤵
  PID:11968
- C:\Windows\System\VxrsxsK.exe
  C:\Windows\System\VxrsxsK.exe
  2⤵
  PID:11988
- C:\Windows\System\YaRQPPX.exe
  C:\Windows\System\YaRQPPX.exe
  2⤵
  PID:12016
- C:\Windows\System\wOaDVZz.exe
  C:\Windows\System\wOaDVZz.exe
  2⤵
  PID:12040
- C:\Windows\System\mQLgOki.exe
  C:\Windows\System\mQLgOki.exe
  2⤵
  PID:12060
- C:\Windows\System\ZoDRddM.exe
  C:\Windows\System\ZoDRddM.exe
  2⤵
  PID:12084
- C:\Windows\System\sgWgjBG.exe
  C:\Windows\System\sgWgjBG.exe
  2⤵
  PID:12120
- C:\Windows\System\BpSuYke.exe
  C:\Windows\System\BpSuYke.exe
  2⤵
  PID:12140
- C:\Windows\System\VaMfHbB.exe
  C:\Windows\System\VaMfHbB.exe
  2⤵
  PID:12156
- C:\Windows\System\rLNtIZF.exe
  C:\Windows\System\rLNtIZF.exe
  2⤵
  PID:12176
- C:\Windows\System\RGQEgiJ.exe
  C:\Windows\System\RGQEgiJ.exe
  2⤵
  PID:12196
- C:\Windows\System\vehxHlV.exe
  C:\Windows\System\vehxHlV.exe
  2⤵
  PID:12220
- C:\Windows\System\EfvcvpW.exe
  C:\Windows\System\EfvcvpW.exe
  2⤵
  PID:12240
- C:\Windows\System\yCQxDDh.exe
  C:\Windows\System\yCQxDDh.exe
  2⤵
  PID:12260
- C:\Windows\System\dMKwABu.exe
  C:\Windows\System\dMKwABu.exe
  2⤵
  PID:12280
- C:\Windows\System\JZQSVsf.exe
  C:\Windows\System\JZQSVsf.exe
  2⤵
  PID:7400
- C:\Windows\System\lPiRegx.exe
  C:\Windows\System\lPiRegx.exe
  2⤵
  PID:9264
- C:\Windows\System\WYbwtwf.exe
  C:\Windows\System\WYbwtwf.exe
  2⤵
  PID:9412
- C:\Windows\System\TVDWneF.exe
  C:\Windows\System\TVDWneF.exe
  2⤵
  PID:9532
- C:\Windows\System\YynjwNJ.exe
  C:\Windows\System\YynjwNJ.exe
  2⤵
  PID:10252
- C:\Windows\System\MwGixvl.exe
  C:\Windows\System\MwGixvl.exe
  2⤵
  PID:9660
- C:\Windows\System\oqeURnM.exe
  C:\Windows\System\oqeURnM.exe
  2⤵
  PID:8944
- C:\Windows\System\zLTAKeP.exe
  C:\Windows\System\zLTAKeP.exe
  2⤵
  PID:8916
- C:\Windows\System\tkfxltp.exe
  C:\Windows\System\tkfxltp.exe
  2⤵
  PID:8908
- C:\Windows\System\FPBxtfy.exe
  C:\Windows\System\FPBxtfy.exe
  2⤵
  PID:10336
- C:\Windows\System\UOqKRiD.exe
  C:\Windows\System\UOqKRiD.exe
  2⤵
  PID:9868
- C:\Windows\System\hqgbMpp.exe
  C:\Windows\System\hqgbMpp.exe
  2⤵
  PID:10508
- C:\Windows\System\nuisGDR.exe
  C:\Windows\System\nuisGDR.exe
  2⤵
  PID:12304
- C:\Windows\System\SebBqEI.exe
  C:\Windows\System\SebBqEI.exe
  2⤵
  PID:12324
- C:\Windows\System\VFwGbgF.exe
  C:\Windows\System\VFwGbgF.exe
  2⤵
  PID:12344
- C:\Windows\System\IzvMElD.exe
  C:\Windows\System\IzvMElD.exe
  2⤵
  PID:12372
- C:\Windows\System\DrkmRzC.exe
  C:\Windows\System\DrkmRzC.exe
  2⤵
  PID:12392
- C:\Windows\System\XUrKzKa.exe
  C:\Windows\System\XUrKzKa.exe
  2⤵
  PID:12412
- C:\Windows\System\rplDpnh.exe
  C:\Windows\System\rplDpnh.exe
  2⤵
  PID:12428
- C:\Windows\System\DkvvDdl.exe
  C:\Windows\System\DkvvDdl.exe
  2⤵
  PID:12448
- C:\Windows\System\vbuwejg.exe
  C:\Windows\System\vbuwejg.exe
  2⤵
  PID:12464
- C:\Windows\System\PQYpIbY.exe
  C:\Windows\System\PQYpIbY.exe
  2⤵
  PID:12480
- C:\Windows\System\LQtVErw.exe
  C:\Windows\System\LQtVErw.exe
  2⤵
  PID:12496
- C:\Windows\System\GElEbFY.exe
  C:\Windows\System\GElEbFY.exe
  2⤵
  PID:12512
- C:\Windows\System\sGpWkBk.exe
  C:\Windows\System\sGpWkBk.exe
  2⤵
  PID:12528
- C:\Windows\System\esgkYpF.exe
  C:\Windows\System\esgkYpF.exe
  2⤵
  PID:12544
- C:\Windows\System\ZoRAbDi.exe
  C:\Windows\System\ZoRAbDi.exe
  2⤵
  PID:12560
- C:\Windows\System\POcKtVi.exe
  C:\Windows\System\POcKtVi.exe
  2⤵
  PID:12576
- C:\Windows\System\HJOLKpN.exe
  C:\Windows\System\HJOLKpN.exe
  2⤵
  PID:12596
- C:\Windows\System\SAVRJit.exe
  C:\Windows\System\SAVRJit.exe
  2⤵
  PID:12616
- C:\Windows\System\yWLfpoe.exe
  C:\Windows\System\yWLfpoe.exe
  2⤵
  PID:12636
- C:\Windows\System\dqJAVHM.exe
  C:\Windows\System\dqJAVHM.exe
  2⤵
  PID:12660
- C:\Windows\System\xShVSKw.exe
  C:\Windows\System\xShVSKw.exe
  2⤵
  PID:12680
- C:\Windows\System\brCfePe.exe
  C:\Windows\System\brCfePe.exe
  2⤵
  PID:12704
- C:\Windows\System\msjmJtG.exe
  C:\Windows\System\msjmJtG.exe
  2⤵
  PID:12724
- C:\Windows\System\jsZpwIQ.exe
  C:\Windows\System\jsZpwIQ.exe
  2⤵
  PID:12740
- C:\Windows\System\qKRTnFV.exe
  C:\Windows\System\qKRTnFV.exe
  2⤵
  PID:12760
- C:\Windows\System\zRNquVd.exe
  C:\Windows\System\zRNquVd.exe
  2⤵
  PID:12780
- C:\Windows\System\JnGMBIX.exe
  C:\Windows\System\JnGMBIX.exe
  2⤵
  PID:12800
- C:\Windows\System\NUatVtq.exe
  C:\Windows\System\NUatVtq.exe
  2⤵
  PID:12824
- C:\Windows\System\JhEBtVL.exe
  C:\Windows\System\JhEBtVL.exe
  2⤵
  PID:12844
- C:\Windows\System\mdjBdUC.exe
  C:\Windows\System\mdjBdUC.exe
  2⤵
  PID:12864
- C:\Windows\System\aGPevej.exe
  C:\Windows\System\aGPevej.exe
  2⤵
  PID:12884
- C:\Windows\System\DcCRENC.exe
  C:\Windows\System\DcCRENC.exe
  2⤵
  PID:12908
- C:\Windows\System\GwlUhsy.exe
  C:\Windows\System\GwlUhsy.exe
  2⤵
  PID:12928
- C:\Windows\System\sTgaBEW.exe
  C:\Windows\System\sTgaBEW.exe
  2⤵
  PID:12944
- C:\Windows\System\YYFOzCq.exe
  C:\Windows\System\YYFOzCq.exe
  2⤵
  PID:12968
- C:\Windows\System\AgLsdMo.exe
  C:\Windows\System\AgLsdMo.exe
  2⤵
  PID:12988
- C:\Windows\System\YWbQOpf.exe
  C:\Windows\System\YWbQOpf.exe
  2⤵
  PID:13016
- C:\Windows\System\DmuUkBS.exe
  C:\Windows\System\DmuUkBS.exe
  2⤵
  PID:13036
- C:\Windows\System\KECefHG.exe
  C:\Windows\System\KECefHG.exe
  2⤵
  PID:13052
- C:\Windows\System\NJVfJvy.exe
  C:\Windows\System\NJVfJvy.exe
  2⤵
  PID:13076
- C:\Windows\System\rFoxigr.exe
  C:\Windows\System\rFoxigr.exe
  2⤵
  PID:13092
- C:\Windows\System\tmyaDfV.exe
  C:\Windows\System\tmyaDfV.exe
  2⤵
  PID:13120
- C:\Windows\System\jnPRXAj.exe
  C:\Windows\System\jnPRXAj.exe
  2⤵
  PID:13136
- C:\Windows\System\ZsmXqAS.exe
  C:\Windows\System\ZsmXqAS.exe
  2⤵
  PID:13156
- C:\Windows\System\YCHXACI.exe
  C:\Windows\System\YCHXACI.exe
  2⤵
  PID:13180
- C:\Windows\System\iqgBiHp.exe
  C:\Windows\System\iqgBiHp.exe
  2⤵
  PID:13200
- C:\Windows\System\YpYZmVJ.exe
  C:\Windows\System\YpYZmVJ.exe
  2⤵
  PID:13224
- C:\Windows\System\ZSKJcKB.exe
  C:\Windows\System\ZSKJcKB.exe
  2⤵
  PID:13240
- C:\Windows\System\qwwjcqi.exe
  C:\Windows\System\qwwjcqi.exe
  2⤵
  PID:13264
- C:\Windows\System\stvWoXO.exe
  C:\Windows\System\stvWoXO.exe
  2⤵
  PID:13280
- C:\Windows\System\ldEqsUH.exe
  C:\Windows\System\ldEqsUH.exe
  2⤵
  PID:13300
- C:\Windows\System\DrjdPCc.exe
  C:\Windows\System\DrjdPCc.exe
  2⤵
  PID:10568
- C:\Windows\System\KetxuIr.exe
  C:\Windows\System\KetxuIr.exe
  2⤵
  PID:10608
- C:\Windows\System\jwTkfDQ.exe
  C:\Windows\System\jwTkfDQ.exe
  2⤵
  PID:9488
- C:\Windows\System\IhigQke.exe
  C:\Windows\System\IhigQke.exe
  2⤵
  PID:12508
- C:\Windows\System\kqanoql.exe
  C:\Windows\System\kqanoql.exe
  2⤵
  PID:11648
- C:\Windows\System\NhxZBOl.exe
  C:\Windows\System\NhxZBOl.exe
  2⤵
  PID:11764
- C:\Windows\System\WPMlWjh.exe
  C:\Windows\System\WPMlWjh.exe
  2⤵
  PID:12008
- C:\Windows\System\OJMIcwb.exe
  C:\Windows\System\OJMIcwb.exe
  2⤵
  PID:10352
- C:\Windows\System\eenXmiN.exe
  C:\Windows\System\eenXmiN.exe
  2⤵
  PID:9236
- C:\Windows\System\vvQxfps.exe
  C:\Windows\System\vvQxfps.exe
  2⤵
  PID:12400
- C:\Windows\System\TWdwwzY.exe
  C:\Windows\System\TWdwwzY.exe
  2⤵
  PID:12572
- C:\Windows\System\CbISsGt.exe
  C:\Windows\System\CbISsGt.exe
  2⤵
  PID:12672
- C:\Windows\System\bevYXOb.exe
  C:\Windows\System\bevYXOb.exe
  2⤵
  PID:12748
- C:\Windows\System\FwkcomK.exe
  C:\Windows\System\FwkcomK.exe
  2⤵
  PID:11064
- C:\Windows\System\yTxMLck.exe
  C:\Windows\System\yTxMLck.exe
  2⤵
  PID:11168
- C:\Windows\System\QIhCMJE.exe
  C:\Windows\System\QIhCMJE.exe
  2⤵
  PID:10056
- C:\Windows\System\BeHhXRp.exe
  C:\Windows\System\BeHhXRp.exe
  2⤵
  PID:8096
- C:\Windows\System\sroOYCt.exe
  C:\Windows\System\sroOYCt.exe
  2⤵
  PID:9116
- C:\Windows\System\YmYVjQQ.exe
  C:\Windows\System\YmYVjQQ.exe
  2⤵
  PID:9192
- C:\Windows\System\GmNnFAn.exe
  C:\Windows\System\GmNnFAn.exe
  2⤵
  PID:8116
- C:\Windows\System\PBSrWvF.exe
  C:\Windows\System\PBSrWvF.exe
  2⤵
  PID:6616
- C:\Windows\System\rOmHQKl.exe
  C:\Windows\System\rOmHQKl.exe
  2⤵
  PID:11128
- C:\Windows\System\MzGifkb.exe
  C:\Windows\System\MzGifkb.exe
  2⤵
  PID:8696
- C:\Windows\System\hQqemAm.exe
  C:\Windows\System\hQqemAm.exe
  2⤵
  PID:10068
- C:\Windows\System\bolZorB.exe
  C:\Windows\System\bolZorB.exe
  2⤵
  PID:13252
- C:\Windows\System\OjayhNN.exe
  C:\Windows\System\OjayhNN.exe
  2⤵
  PID:13192
- C:\Windows\System\lFtUoDX.exe
  C:\Windows\System\lFtUoDX.exe
  2⤵
  PID:13148
- C:\Windows\System\XJLHNDg.exe
  C:\Windows\System\XJLHNDg.exe
  2⤵
  PID:13032
- C:\Windows\System\BHwVJFT.exe
  C:\Windows\System\BHwVJFT.exe
  2⤵
  PID:12436
- C:\Windows\System\cTuNizX.exe
  C:\Windows\System\cTuNizX.exe
  2⤵
  PID:9340
- C:\Windows\System\cSoBQIu.exe
  C:\Windows\System\cSoBQIu.exe
  2⤵
  PID:10320
- C:\Windows\System\JxfvTLd.exe
  C:\Windows\System\JxfvTLd.exe
  2⤵
  PID:8896
- C:\Windows\System\HKyLuJa.exe
  C:\Windows\System\HKyLuJa.exe
  2⤵
  PID:9664
- C:\Windows\System\tCzMpqS.exe
  C:\Windows\System\tCzMpqS.exe
  2⤵
  PID:12272
- C:\Windows\System\aNeLXyJ.exe
  C:\Windows\System\aNeLXyJ.exe
  2⤵
  PID:12188
- C:\Windows\System\gPeFfVL.exe
  C:\Windows\System\gPeFfVL.exe
  2⤵
  PID:12100
- C:\Windows\System\OjOzHkl.exe
  C:\Windows\System\OjOzHkl.exe
  2⤵
  PID:11944
- C:\Windows\System\SqwvldQ.exe
  C:\Windows\System\SqwvldQ.exe
  2⤵
  PID:11920
- C:\Windows\System\rlOzndy.exe
  C:\Windows\System\rlOzndy.exe
  2⤵
  PID:11860
- C:\Windows\System\TUSJXJY.exe
  C:\Windows\System\TUSJXJY.exe
  2⤵
  PID:11768
- C:\Windows\System\zSMLfTy.exe
  C:\Windows\System\zSMLfTy.exe
  2⤵
  PID:11632
- C:\Windows\System\eoJhUqD.exe
  C:\Windows\System\eoJhUqD.exe
  2⤵
  PID:11576
- C:\Windows\System\xwDoByC.exe
  C:\Windows\System\xwDoByC.exe
  2⤵
  PID:6184
- C:\Windows\System\JLRqCwt.exe
  C:\Windows\System\JLRqCwt.exe
  2⤵
  PID:9152
- C:\Windows\System\sfeXXfJ.exe
  C:\Windows\System\sfeXXfJ.exe
  2⤵
  PID:9844
- C:\Windows\System\ycBAMig.exe
  C:\Windows\System\ycBAMig.exe
  2⤵
  PID:9696
- C:\Windows\System\DpiogUV.exe
  C:\Windows\System\DpiogUV.exe
  2⤵
  PID:11040
- C:\Windows\System\XbgXyFV.exe
  C:\Windows\System\XbgXyFV.exe
  2⤵
  PID:10748
- C:\Windows\System\QJwGxcY.exe
  C:\Windows\System\QJwGxcY.exe
  2⤵
  PID:12736
- C:\Windows\System\cYeQkyv.exe
  C:\Windows\System\cYeQkyv.exe
  2⤵
  PID:11960
- C:\Windows\System\AMcUfqT.exe
  C:\Windows\System\AMcUfqT.exe
  2⤵
  PID:12036
- C:\Windows\System\gdkAquu.exe
  C:\Windows\System\gdkAquu.exe
  2⤵
  PID:12256
- C:\Windows\System\iynaRPr.exe
  C:\Windows\System\iynaRPr.exe
  2⤵
  PID:11460
- C:\Windows\System\lQUEwFj.exe
  C:\Windows\System\lQUEwFj.exe
  2⤵
  PID:10504
- C:\Windows\System\cGElfNu.exe
  C:\Windows\System\cGElfNu.exe
  2⤵
  PID:12316
- C:\Windows\System\PNMDJBs.exe
  C:\Windows\System\PNMDJBs.exe
  2⤵
  PID:12384
- C:\Windows\System\ZrCtofx.exe
  C:\Windows\System\ZrCtofx.exe
  2⤵
  PID:12460
- C:\Windows\System\vQIxPJy.exe
  C:\Windows\System\vQIxPJy.exe
  2⤵
  PID:12536
- C:\Windows\System\McCwMNW.exe
  C:\Windows\System\McCwMNW.exe
  2⤵
  PID:11664
- C:\Windows\System\wpDsBrp.exe
  C:\Windows\System\wpDsBrp.exe
  2⤵
  PID:12212
- C:\Windows\System\yUWjgph.exe
  C:\Windows\System\yUWjgph.exe
  2⤵
  PID:11924
- C:\Windows\System\gFXlQHC.exe
  C:\Windows\System\gFXlQHC.exe
  2⤵
  PID:11816
- C:\Windows\System\yswZZqW.exe
  C:\Windows\System\yswZZqW.exe
  2⤵
  PID:12960
- C:\Windows\System\OHPhfLE.exe
  C:\Windows\System\OHPhfLE.exe
  2⤵
  PID:11104
- C:\Windows\System\XvFubYz.exe
  C:\Windows\System\XvFubYz.exe
  2⤵
  PID:11208
- C:\Windows\System\uRCzOHj.exe
  C:\Windows\System\uRCzOHj.exe
  2⤵
  PID:8484
- C:\Windows\System\lYdmdXg.exe
  C:\Windows\System\lYdmdXg.exe
  2⤵
  PID:13332
- C:\Windows\System\QEgoSDC.exe
  C:\Windows\System\QEgoSDC.exe
  2⤵
  PID:13352
- C:\Windows\System\wEVtNnG.exe
  C:\Windows\System\wEVtNnG.exe
  2⤵
  PID:13376
- C:\Windows\System\RXtvORv.exe
  C:\Windows\System\RXtvORv.exe
  2⤵
  PID:13396
- C:\Windows\System\CgorFNK.exe
  C:\Windows\System\CgorFNK.exe
  2⤵
  PID:13412
- C:\Windows\System\overAOq.exe
  C:\Windows\System\overAOq.exe
  2⤵
  PID:13432
- C:\Windows\System\KxQwnaJ.exe
  C:\Windows\System\KxQwnaJ.exe
  2⤵
  PID:13456
- C:\Windows\System\dtlfIpP.exe
  C:\Windows\System\dtlfIpP.exe
  2⤵
  PID:13476
- C:\Windows\System\yaSyXZg.exe
  C:\Windows\System\yaSyXZg.exe
  2⤵
  PID:13496
- C:\Windows\System\MLQvbFu.exe
  C:\Windows\System\MLQvbFu.exe
  2⤵
  PID:13512
- C:\Windows\System\JGBRtLo.exe
  C:\Windows\System\JGBRtLo.exe
  2⤵
  PID:13536
- C:\Windows\System\WdktSEy.exe
  C:\Windows\System\WdktSEy.exe
  2⤵
  PID:13556
- C:\Windows\System\xsLkAcE.exe
  C:\Windows\System\xsLkAcE.exe
  2⤵
  PID:13572
- C:\Windows\System\BHsKCOd.exe
  C:\Windows\System\BHsKCOd.exe
  2⤵
  PID:13588
- C:\Windows\System\Zlydjoa.exe
  C:\Windows\System\Zlydjoa.exe
  2⤵
  PID:13604
- C:\Windows\System\UanxXNz.exe
  C:\Windows\System\UanxXNz.exe
  2⤵
  PID:13620
- C:\Windows\System\qgpCrTY.exe
  C:\Windows\System\qgpCrTY.exe
  2⤵
  PID:13636
- C:\Windows\System\JTFRwLl.exe
  C:\Windows\System\JTFRwLl.exe
  2⤵
  PID:13652
- C:\Windows\System\odMNhKz.exe
  C:\Windows\System\odMNhKz.exe
  2⤵
  PID:13668
- C:\Windows\System\fBMdXcv.exe
  C:\Windows\System\fBMdXcv.exe
  2⤵
  PID:13688
- C:\Windows\System\VReFBTW.exe
  C:\Windows\System\VReFBTW.exe
  2⤵
  PID:13704
- C:\Windows\System\FJWxbVp.exe
  C:\Windows\System\FJWxbVp.exe
  2⤵
  PID:13724
- C:\Windows\System\FUuAGZJ.exe
  C:\Windows\System\FUuAGZJ.exe
  2⤵
  PID:13740
- C:\Windows\System\BfmzaoJ.exe
  C:\Windows\System\BfmzaoJ.exe
  2⤵
  PID:13756
- C:\Windows\System\TYKiLNe.exe
  C:\Windows\System\TYKiLNe.exe
  2⤵
  PID:13772
- C:\Windows\System\cbkMytd.exe
  C:\Windows\System\cbkMytd.exe
  2⤵
  PID:13788
- C:\Windows\System\dhGWLSj.exe
  C:\Windows\System\dhGWLSj.exe
  2⤵
  PID:13808
- C:\Windows\System\dRgAjSj.exe
  C:\Windows\System\dRgAjSj.exe
  2⤵
  PID:13992
- C:\Windows\System\TklBhLX.exe
  C:\Windows\System\TklBhLX.exe
  2⤵
  PID:14012
- C:\Windows\System\mlZwJrG.exe
  C:\Windows\System\mlZwJrG.exe
  2⤵
  PID:14252
- C:\Windows\System\hiFDlmZ.exe
  C:\Windows\System\hiFDlmZ.exe
  2⤵
  PID:13660
- C:\Windows\System\nEIdrmW.exe
  C:\Windows\System\nEIdrmW.exe
  2⤵
  PID:14276
- C:\Windows\System\rEpXuMj.exe
  C:\Windows\System\rEpXuMj.exe
  2⤵
  PID:13260
- C:\Windows\System\VUyHcTX.exe
  C:\Windows\System\VUyHcTX.exe
  2⤵
  PID:10996
- C:\Windows\System\wVLabAD.exe
  C:\Windows\System\wVLabAD.exe
  2⤵
  PID:11628
- C:\Windows\System\WJwjKmE.exe
  C:\Windows\System\WJwjKmE.exe
  2⤵
  PID:13720
- C:\Windows\System\RgQUiZb.exe
  C:\Windows\System\RgQUiZb.exe
  2⤵
  PID:14244
- C:\Windows\System\BUxNpyH.exe
  C:\Windows\System\BUxNpyH.exe
  2⤵
  PID:13872
- C:\Windows\System\bVslWYG.exe
  C:\Windows\System\bVslWYG.exe
  2⤵
  PID:14232
- C:\Windows\System\sikclcg.exe
  C:\Windows\System\sikclcg.exe
  2⤵
  PID:14124
- C:\Windows\System\XShSkkO.exe
  C:\Windows\System\XShSkkO.exe
  2⤵
  PID:14088
- C:\Windows\System\dQkYllH.exe
  C:\Windows\System\dQkYllH.exe
  2⤵
  PID:12312
- C:\Windows\System\CInSSep.exe
  C:\Windows\System\CInSSep.exe
  2⤵
  PID:13372
- C:\Windows\System\qUAZimg.exe
  C:\Windows\System\qUAZimg.exe
  2⤵
  PID:13528
- C:\Windows\System\NrmyfIJ.exe
  C:\Windows\System\NrmyfIJ.exe
  2⤵
  PID:13864
- C:\Windows\System\lkzRJsZ.exe
  C:\Windows\System\lkzRJsZ.exe
  2⤵
  PID:14072
- C:\Windows\System\GpeixSg.exe
  C:\Windows\System\GpeixSg.exe
  2⤵
  PID:12984
- C:\Windows\System\zgFmsra.exe
  C:\Windows\System\zgFmsra.exe
  2⤵
  PID:14140
- C:\Windows\System\LTefZDZ.exe
  C:\Windows\System\LTefZDZ.exe
  2⤵
  PID:11588
- C:\Windows\System\FjosjVq.exe
  C:\Windows\System\FjosjVq.exe
  2⤵
  PID:11840
- C:\Windows\System\mWpBAPR.exe
  C:\Windows\System\mWpBAPR.exe
  2⤵
  PID:14100
- C:\Windows\System\uYcywnB.exe
  C:\Windows\System\uYcywnB.exe
  2⤵
  PID:12252
- C:\Windows\System\VDbXEWv.exe
  C:\Windows\System\VDbXEWv.exe
  2⤵
  PID:1716
- C:\Windows\System\kXeXCbw.exe
  C:\Windows\System\kXeXCbw.exe
  2⤵
  PID:14160
- C:\Windows\System\MlRkYme.exe
  C:\Windows\System\MlRkYme.exe
  2⤵
  PID:13804
- C:\Windows\System\SBceWSf.exe
  C:\Windows\System\SBceWSf.exe
  2⤵
  PID:8856
- C:\Windows\System\YtVJfAB.exe
  C:\Windows\System\YtVJfAB.exe
  2⤵
  PID:7164
- C:\Windows\System\AzlOykc.exe
  C:\Windows\System\AzlOykc.exe
  2⤵
  PID:12228
- C:\Windows\System\QVDxHJN.exe
  C:\Windows\System\QVDxHJN.exe
  2⤵
  PID:10024
- C:\Windows\System\tbfrImY.exe
  C:\Windows\System\tbfrImY.exe
  2⤵
  PID:11528
- C:\Windows\System\cJCidUG.exe
  C:\Windows\System\cJCidUG.exe
  2⤵
  PID:13700
- C:\Windows\System\WoYDsji.exe
  C:\Windows\System\WoYDsji.exe
  2⤵
  PID:12024
- C:\Windows\System\VKDTwmv.exe
  C:\Windows\System\VKDTwmv.exe
  2⤵
  PID:13664
- C:\Windows\System\FPotPMe.exe
  C:\Windows\System\FPotPMe.exe
  2⤵
  PID:14164
- C:\Windows\System\rRnZirK.exe
  C:\Windows\System\rRnZirK.exe
  2⤵
  PID:13440
- C:\Windows\System\wciwZZc.exe
  C:\Windows\System\wciwZZc.exe
  2⤵
  PID:14292
- C:\Windows\System\cXGXkXI.exe
  C:\Windows\System\cXGXkXI.exe
  2⤵
  PID:14144
- C:\Windows\System\yXdNyYs.exe
  C:\Windows\System\yXdNyYs.exe
  2⤵
  PID:10340
- C:\Windows\System\bdzAwLp.exe
  C:\Windows\System\bdzAwLp.exe
  2⤵
  PID:4340
- C:\Windows\System\JfdkEOS.exe
  C:\Windows\System\JfdkEOS.exe
  2⤵
  PID:13852
- C:\Windows\System\xhZPZsk.exe
  C:\Windows\System\xhZPZsk.exe
  2⤵
  PID:13532
- C:\Windows\System\EmkYetn.exe
  C:\Windows\System\EmkYetn.exe
  2⤵
  PID:6508
- C:\Windows\System\ibntBik.exe
  C:\Windows\System\ibntBik.exe
  2⤵
  PID:13196
- C:\Windows\System\LWcrNvu.exe
  C:\Windows\System\LWcrNvu.exe
  2⤵
  PID:13896
- C:\Windows\System\aiOQDsS.exe
  C:\Windows\System\aiOQDsS.exe
  2⤵
  PID:12712
- C:\Windows\System\POXfLCQ.exe
  C:\Windows\System\POXfLCQ.exe
  2⤵
  PID:9952
- C:\Windows\System\CgYlqUu.exe
  C:\Windows\System\CgYlqUu.exe
  2⤵
  PID:8492
- C:\Windows\System\MduqLej.exe
  C:\Windows\System\MduqLej.exe
  2⤵
  PID:11964
- C:\Windows\System\cqZLmZx.exe
  C:\Windows\System\cqZLmZx.exe
  2⤵
  PID:13484
- C:\Windows\System\bGfLCML.exe
  C:\Windows\System\bGfLCML.exe
  2⤵
  PID:13048
- C:\Windows\System\fEHZZSV.exe
  C:\Windows\System\fEHZZSV.exe
  2⤵
  PID:13464
- C:\Windows\System\WnJlPey.exe
  C:\Windows\System\WnJlPey.exe
  2⤵
  PID:12696
- C:\Windows\System\uFOhGdE.exe
  C:\Windows\System\uFOhGdE.exe
  2⤵
  PID:13164
- C:\Windows\System\cijXByw.exe
  C:\Windows\System\cijXByw.exe
  2⤵
  PID:7732
- C:\Windows\System\utrTXIj.exe
  C:\Windows\System\utrTXIj.exe
  2⤵
  PID:8788
- C:\Windows\System\NrtroeU.exe
  C:\Windows\System\NrtroeU.exe
  2⤵
  PID:14348
- C:\Windows\System\xHmUHNL.exe
  C:\Windows\System\xHmUHNL.exe
  2⤵
  PID:14432
- C:\Windows\System\yjwllWH.exe
  C:\Windows\System\yjwllWH.exe
  2⤵
  PID:14452
- C:\Windows\System\bjIqKJc.exe
  C:\Windows\System\bjIqKJc.exe
  2⤵
  PID:14472
- C:\Windows\System\NWBpEPM.exe
  C:\Windows\System\NWBpEPM.exe
  2⤵
  PID:14816
- C:\Windows\System\LgePLPT.exe
  C:\Windows\System\LgePLPT.exe
  2⤵
  PID:14832
- C:\Windows\System\pOubLaI.exe
  C:\Windows\System\pOubLaI.exe
  2⤵
  PID:14852
- C:\Windows\System\iFewTLk.exe
  C:\Windows\System\iFewTLk.exe
  2⤵
  PID:14876
- C:\Windows\System\crRsSkF.exe
  C:\Windows\System\crRsSkF.exe
  2⤵
  PID:14964
- C:\Windows\System\ZFKCwHc.exe
  C:\Windows\System\ZFKCwHc.exe
  2⤵
  PID:15252
- C:\Windows\System\RULzPqw.exe
  C:\Windows\System\RULzPqw.exe
  2⤵
  PID:15268
- C:\Windows\System\GJsoMjU.exe
  C:\Windows\System\GJsoMjU.exe
  2⤵
  PID:15284
- C:\Windows\System\FiDIQdc.exe
  C:\Windows\System\FiDIQdc.exe
  2⤵
  PID:15304
- C:\Windows\System\yiVYCMm.exe
  C:\Windows\System\yiVYCMm.exe
  2⤵
  PID:15324
- C:\Windows\System\LWUdnZz.exe
  C:\Windows\System\LWUdnZz.exe
  2⤵
  PID:14900
- C:\Windows\System\CbJaFjX.exe
  C:\Windows\System\CbJaFjX.exe
  2⤵
  PID:15144
- C:\Windows\System\ulOdAxr.exe
  C:\Windows\System\ulOdAxr.exe
  2⤵
  PID:15160
- C:\Windows\System\UJnMhkS.exe
  C:\Windows\System\UJnMhkS.exe
  2⤵
  PID:15176
- C:\Windows\System\EJblMmW.exe
  C:\Windows\System\EJblMmW.exe
  2⤵
  PID:15192
- C:\Windows\System\YEWtHiT.exe
  C:\Windows\System\YEWtHiT.exe
  2⤵
  PID:15212
- C:\Windows\System\BXjyNtr.exe
  C:\Windows\System\BXjyNtr.exe
  2⤵
  PID:15232
- C:\Windows\System\VTuCcZD.exe
  C:\Windows\System\VTuCcZD.exe
  2⤵
  PID:15244
- C:\Windows\System\sGUGREe.exe
  C:\Windows\System\sGUGREe.exe
  2⤵
  PID:15276
- C:\Windows\System\MAzskDw.exe
  C:\Windows\System\MAzskDw.exe
  2⤵
  PID:15344
- C:\Windows\System\LUBZCoY.exe
  C:\Windows\System\LUBZCoY.exe
  2⤵
  PID:15320
- C:\Windows\System\dMNSuaf.exe
  C:\Windows\System\dMNSuaf.exe
  2⤵
  PID:13632
- C:\Windows\System\XhGRhSd.exe
  C:\Windows\System\XhGRhSd.exe
  2⤵
  PID:5816
- C:\Windows\System\fSoWLPP.exe
  C:\Windows\System\fSoWLPP.exe
  2⤵
  PID:11516
- C:\Windows\System\gedhAuE.exe
  C:\Windows\System\gedhAuE.exe
  2⤵
  PID:12688
- C:\Windows\System\jScjsXp.exe
  C:\Windows\System\jScjsXp.exe
  2⤵
  PID:5944
- C:\Windows\System\LoipsER.exe
  C:\Windows\System\LoipsER.exe
  2⤵
  PID:14060
- C:\Windows\System\wgarHzh.exe
  C:\Windows\System\wgarHzh.exe
  2⤵
  PID:10864
- C:\Windows\System\NYAkiqq.exe
  C:\Windows\System\NYAkiqq.exe
  2⤵
  PID:14460
- C:\Windows\System\vGkVCbt.exe
  C:\Windows\System\vGkVCbt.exe
  2⤵
  PID:14488
- C:\Windows\System\YoXSHKd.exe
  C:\Windows\System\YoXSHKd.exe
  2⤵
  PID:14500
- C:\Windows\System\rtMOxwQ.exe
  C:\Windows\System\rtMOxwQ.exe
  2⤵
  PID:14376
- C:\Windows\System\KANQgUg.exe
  C:\Windows\System\KANQgUg.exe
  2⤵
  PID:4456
- C:\Windows\System\nefqFzR.exe
  C:\Windows\System\nefqFzR.exe
  2⤵
  PID:15200
- C:\Windows\System\CtObmoE.exe
  C:\Windows\System\CtObmoE.exe
  2⤵
  PID:13856
- C:\Windows\System\pYXUUGW.exe
  C:\Windows\System\pYXUUGW.exe
  2⤵
  PID:14572
- C:\Windows\System\sTIkpcu.exe
  C:\Windows\System\sTIkpcu.exe
  2⤵
  PID:14592
- C:\Windows\System\NFcjhHn.exe
  C:\Windows\System\NFcjhHn.exe
  2⤵
  PID:14412
- C:\Windows\System\IKlexKa.exe
  C:\Windows\System\IKlexKa.exe
  2⤵
  PID:14540
- C:\Windows\System\DXxGdIA.exe
  C:\Windows\System\DXxGdIA.exe
  2⤵
  PID:14556
- C:\Windows\System\DhsBMYv.exe
  C:\Windows\System\DhsBMYv.exe
  2⤵
  PID:14640
- C:\Windows\System\DNgVEHH.exe
  C:\Windows\System\DNgVEHH.exe
  2⤵
  PID:14588
- C:\Windows\System\uGTUyYc.exe
  C:\Windows\System\uGTUyYc.exe
  2⤵
  PID:14668
- C:\Windows\System\GfCyGCh.exe
  C:\Windows\System\GfCyGCh.exe
  2⤵
  PID:5932
- C:\Windows\System\VqnGIeI.exe
  C:\Windows\System\VqnGIeI.exe
  2⤵
  PID:2384
- C:\Windows\System\KVopzbY.exe
  C:\Windows\System\KVopzbY.exe
  2⤵
  PID:14684
- C:\Windows\System\YfGduYk.exe
  C:\Windows\System\YfGduYk.exe
  2⤵
  PID:14728
- C:\Windows\System\qMGmRCt.exe
  C:\Windows\System\qMGmRCt.exe
  2⤵
  PID:3452
- C:\Windows\System\SODcDyi.exe
  C:\Windows\System\SODcDyi.exe
  2⤵
  PID:14704
- C:\Windows\System\vFWrNmq.exe
  C:\Windows\System\vFWrNmq.exe
  2⤵
  PID:14768
- C:\Windows\System\ozjAmug.exe
  C:\Windows\System\ozjAmug.exe
  2⤵
  PID:14652
- C:\Windows\System\MbisbJr.exe
  C:\Windows\System\MbisbJr.exe
  2⤵
  PID:14712
- C:\Windows\System\VvUIjia.exe
  C:\Windows\System\VvUIjia.exe
  2⤵
  PID:14792
- C:\Windows\System\bqosUEE.exe
  C:\Windows\System\bqosUEE.exe
  2⤵
  PID:14800
- C:\Windows\System\TTyCIeS.exe
  C:\Windows\System\TTyCIeS.exe
  2⤵
  PID:14824
- C:\Windows\System\HIcFjvZ.exe
  C:\Windows\System\HIcFjvZ.exe
  2⤵
  PID:14872
- C:\Windows\System\TFYZvRx.exe
  C:\Windows\System\TFYZvRx.exe
  2⤵
  PID:14860
- C:\Windows\System\KGYioYF.exe
  C:\Windows\System\KGYioYF.exe
  2⤵
  PID:14924
- C:\Windows\System\JziRCoA.exe
  C:\Windows\System\JziRCoA.exe
  2⤵
  PID:14904
- C:\Windows\System\TkeKEVT.exe
  C:\Windows\System\TkeKEVT.exe
  2⤵
  PID:14972
- C:\Windows\System\Fxpnmhh.exe
  C:\Windows\System\Fxpnmhh.exe
  2⤵
  PID:14996
- C:\Windows\System\ZSmGbUF.exe
  C:\Windows\System\ZSmGbUF.exe
  2⤵
  PID:15012
- C:\Windows\System\BhunJFo.exe
  C:\Windows\System\BhunJFo.exe
  2⤵
  PID:15032
- C:\Windows\System\pmhhuAJ.exe
  C:\Windows\System\pmhhuAJ.exe
  2⤵
  PID:15052
- C:\Windows\System\QJgMplt.exe
  C:\Windows\System\QJgMplt.exe
  2⤵
  PID:15064
- C:\Windows\System\OQUpXKZ.exe
  C:\Windows\System\OQUpXKZ.exe
  2⤵
  PID:15072
- C:\Windows\System\egtcNWk.exe
  C:\Windows\System\egtcNWk.exe
  2⤵
  PID:15084
- C:\Windows\System\ZJSJDte.exe
  C:\Windows\System\ZJSJDte.exe
  2⤵
  PID:15092
- C:\Windows\System\HMDDSyN.exe
  C:\Windows\System\HMDDSyN.exe
  2⤵
  PID:2332
- C:\Windows\System\LYUXnwu.exe
  C:\Windows\System\LYUXnwu.exe
  2⤵
  PID:15116
- C:\Windows\System\rUjifAv.exe
  C:\Windows\System\rUjifAv.exe
  2⤵
  PID:4744
- C:\Windows\System\gyGSdmN.exe
  C:\Windows\System\gyGSdmN.exe
  2⤵
  PID:888
- C:\Windows\System\RSQKtmL.exe
  C:\Windows\System\RSQKtmL.exe
  2⤵
  PID:1756
- C:\Windows\System\PAGmvKF.exe
  C:\Windows\System\PAGmvKF.exe
  2⤵
  PID:15168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3820,i,2904906934812054273,11716976550456127484,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:8
1⤵
PID:4328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l51etnku.4zz.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AAAjPwt.exe

Filesize
1.6MB

MD5
bfcebc9a5b1abc50ef8d1efc941c3642

SHA1
beb4e59c7abd077326aaee2232e43018a789b1fa

SHA256
7224ca8cdbd0c4bfbe5adc3139177ad474fb40def315799c1b109db46f8734b6

SHA512
1d4cb95e1d07ab2f19e9dac5a6b85314fb550518013d4746a99c44fa6c64726404528675af01fcf1da7d0dffcac4744a90b763553496dcf39ccc01d8123cc669

Download Submit
C:\Windows\System\CDdNKqT.exe

Filesize
1.6MB

MD5
db12c728e6bd05f37d6fcff815604244

SHA1
bdd292ee68d8cbcc499e36ada818fdccee67f230

SHA256
f18dc14b49c7a3fa1a983d4891be9580b829b4478373ab4c1610e7aea96aad9a

SHA512
985cca1d5bbe71ddc1c698485e06cdc044855d856255fe0e8d79a58ccd9eb13d6fe6d3cc0db91f977609a438a0ffc96278fb15e597c87545b9d705f3c6434d38

Download Submit
C:\Windows\System\ClkTTBi.exe

Filesize
1.6MB

MD5
f8a33c38cdfd0685086de8d0324e3863

SHA1
9058bb1e1b9accc718d058342caa351500c87229

SHA256
2b6718765aae324ba3b8c1af3da06501f509192a7289e86ce5e8a6fb65d0a358

SHA512
9d32a835c4f8f98a0c50fc620e8a30409bcedd1b1daefc327c99df769b3b6811bbe581275310e1f665697c956b4a6684836aaca1ebe56b7c184e244071543ffd

Download Submit
C:\Windows\System\EYEmurI.exe

Filesize
1.6MB

MD5
19b3be443257ccbd9350f62f07b43915

SHA1
016966b5a605b2c9f48908c5eaaa8ab9a7e21dfc

SHA256
9daa7f49f374114ae7cc3093d74169df8337fb7b730c05d8e59b635cb5b2d438

SHA512
5f349e653cbfcb3babae3c27b9fa8da076a447986703913bdd7729ba63481079aa776ce104e1eb141dc9158a7424554dc3b7038573028364f3119f191f11cabb

Download Submit
C:\Windows\System\EgkacqM.exe

Filesize
1.6MB

MD5
6ce77ec250defd4f573e2fce5ec31a9c

SHA1
1117d1d4bf68e887d5be0eb0306a1674cb0aacb1

SHA256
e7ad9b56002f7bcf2521613ceccb6620064a3405e329efee2f658bfc601356f8

SHA512
f03ee618c0657024f92962facc1e76fe2a039dc5d3a3f06bdc029f42f7c58d35a52e938924149add775b2fe0e0681d1d52fdb3ffca93a9dd49513a1dea30686a

Download Submit
C:\Windows\System\GTvHRzv.exe

Filesize
1.6MB

MD5
6507d8f8ed50a972526d71d9ad2c0910

SHA1
69837d23efa1e73b1b11b4d69e6bd47368bdc187

SHA256
90d48bfb6e426f5f6baeee17bec2cf0c7f45521fa439b240e8b4ef1431d175d7

SHA512
57f0ff712d0f8fa7392d9c6bdb6b8b0f73e0ccb2d03e555a112d072d0a769c862b2698eca4c6c7d1c728915c73da45bd7535a71cb0a86125f11ccfe01ea225dc

Download Submit
C:\Windows\System\ILTEUit.exe

Filesize
1.6MB

MD5
6e42c86ab03f839c688e33fd06929dad

SHA1
e8248275f0e212b9e05e07d0a800a63e30d194fe

SHA256
fea372a9eaaa71c16c09ea9b2a77fce45e490ba95263bf53178884ffd206dda8

SHA512
71a4b4f5e67aff5f2df6c4c0487fdcc940c23a6e6d284548dba45a1ff56148bd6533250b5acfd02962c964e5ff581dea1b9342c7404a0fde6e3fed5f97bbb305

Download Submit
C:\Windows\System\IXvfdGV.exe

Filesize
1.6MB

MD5
38846e8d2be6b87a6f0170d3309065ee

SHA1
da175287f3b54a95dc5e2042e0345bf3b3c19a80

SHA256
9776553f76c7f10f939ed30151281fd65b1174cbbeb0e1e0e20f4f38939cfb13

SHA512
de7ccc00faf26bc2e1083b1ab6105e1f9026b99009fe7e43692cb03127f27b966b7e06094eaad696b5f2800975efae9d47b44496bbbeb3a1bf0af6f9fbc019f9

Download Submit
C:\Windows\System\KkwhEDr.exe

Filesize
1.6MB

MD5
3287e0ff060312afd2c53f0daf7ef1bd

SHA1
a226dadf2622d0153dd03ce912d87850b954ec89

SHA256
e8d13b4ea7967857f2a22a9f3d68692ab48003d63466852859ecc3866e97fa1f

SHA512
239d1b55a0306b6e29d394d2c1a472b872ee6dfbbfddb214a53b8212d410c6b5749f9e718e7e8bc73b2ef94019f0eac0ceedd8519ddd5b461be00f2101fec279

Download Submit
C:\Windows\System\MIlPluC.exe

Filesize
1.6MB

MD5
8d7582a1ea8be16fbd6da8ce86f84994

SHA1
7a908c828b48f31e249cd71cccbf47de646db82f

SHA256
8a7c0baca29d209ad10eb6d551348c9e2eca176fd4cc09093f94990162cf52fd

SHA512
e6358304f420bb8e2537994a13826ebca93571b3f1dfde9d52b4af6cddbbf6d410507381d6d52808bbf0b201288466751c42a3bf02ddf0136fc2495f043bb339

Download Submit
C:\Windows\System\NeWQFUm.exe

Filesize
1.6MB

MD5
68be0a3c69a889fd3852bc9d05691523

SHA1
700b32768e5e137980f20e10cdadedb0ef99681f

SHA256
eab638c5ee175c0f594ecc141209185742b5f140f959f54c3bed8e6e66cd66ea

SHA512
bab120174b50ea5d0a2acfc271792e41239c9ca82612302fa679e0cd71a721ca03eccd8805a5b86f7caad2a178c1b5d45a5fbc5ada793d41b92fb67aa033df3e

Download Submit
C:\Windows\System\OTfTIPH.exe

Filesize
1.6MB

MD5
819b501fbdf0c244f50fa4f13b074293

SHA1
9df4824287b44e43c2574debfa214d72b33ae866

SHA256
4c26d4aa56c147c64b68c6a2e3efdca1c3de0bc20687ed1626b107bb7c723bf8

SHA512
8162cbbfaa388d6aaa68c0a8573d7561b8563676fc199d58831de2fdc73f6c18fa791beb6f7e76f3e46e39a1ead5b67185af8f1c7e01b6358b1ea256e216bd4b

Download Submit
C:\Windows\System\OcPtVnR.exe

Filesize
1.6MB

MD5
aff0bd79ff482fd28743cbf285f3b3bf

SHA1
6e08de5677adac811cdd53699cb5e1dfbe21601f

SHA256
d951e7f48389b2e61320e9b9d5e6f7c29c9876b438a26ba562173cef3725ac1d

SHA512
8576438abb07d2b91c6977f12fc337c1f899f29266c3328254c2c0b445c5dbcab065031c00b6022b8eed03546a6965f8e3ae04412f4996832d11d0eda3cba61c

Download Submit
C:\Windows\System\OgLCGTH.exe

Filesize
1.6MB

MD5
a90634754fbfb047c868a3cdd7745bae

SHA1
d5da9295dda3614ca804067cbbccf8e1890e52e3

SHA256
fcc6856c4e97e47c1e359f809b44f8178e51cafbfc09e9718be601a5b26ed6aa

SHA512
c8fa17670e27578e17e6a24f78939a0f21bf7a27896975f41097b2123c57e8fd24ae4908610a9afdfad5419c5740faa5317cecb40907874cfea6afe136c45812

Download Submit
C:\Windows\System\QbuBTsn.exe

Filesize
8B

MD5
d33d66ea64213a11220ff46e1066e8c4

SHA1
11df077d45cb6c18dde351720388ac43664403a2

SHA256
b2aac390d4a70eec771d01aa85ea606c2fcf5e3b2ec05338e195df492df26016

SHA512
4f6272cb17b1ae9b4ebb9b755a9d4f83dd7a010a29db67c7a6463d91c58d4250809d9f6f8bdb747b657363c9141bbd4db149efd469384e92e75f03d0396ea32b

Download Submit
C:\Windows\System\RMGVeWO.exe

Filesize
1.6MB

MD5
0bad260520c4ae53d60b63b201f830fb

SHA1
97a5545bd3ecba5e41b57a781a693322b37b849b

SHA256
e24942b91d87c469c1208d13b7d2d8a04cc5ba694167be5f804434dc2ad68353

SHA512
274309557c3abebf355360d42545b5c2cc2d2e67eafbf3aaa43f5d21dec697ddcce797bda50750f56d2ff5af0db534e0a94e5d49a5496887b0908497340e7f36

Download Submit
C:\Windows\System\RRClcFv.exe

Filesize
1.6MB

MD5
bc91f6a24d75ea0c057fa93cd64d5d04

SHA1
fa5c7a782d8cee32123ca43e532a01d140522be2

SHA256
a4b2b8b87b776a8fcff0f0f108155b9df84a22a310a885ad5d9ed14fc6b52525

SHA512
2236b1f327ad80ae95c2398f72e7094aa1470084a83061c0b78996e5c17e41613f517bab02f52276eff6ea175f82617d627012891949e160b7c4ff2e17667744

Download Submit
C:\Windows\System\TahqYhb.exe

Filesize
1.6MB

MD5
225b757d19e2ec7e57f09365e2aa531d

SHA1
345c08564ff71bf8025811736b2982fbf7dcff4b

SHA256
717aec6ab7a95db7e1a687abf9e0231afb32b550d2222e59ce0ceb414464f671

SHA512
32c0026ab822f592d2cfa4519776828fc9bd3d623dcdd2071ce725e992b051bb8f076d8277eff2e9ec7f74d6b94649faa0cd34f3fcb6f0a2ad1161870087f484

Download Submit
C:\Windows\System\TihSDwp.exe

Filesize
1.6MB

MD5
a3e9818f43f49b85ff1456ac51ed76d8

SHA1
94b147382e6e3dda8a56feb8323a7d5054e561e5

SHA256
45de30729bd128c80596902d00378d9ee8e2dab430e1d1b4a9966b82fed6b6b4

SHA512
912360183124b0f067cbddcaea6a6990e59a96bd53c9b6474c59d4e096d1770ee79bbbe1db7060bde5444fb89fdf615f52424dd826e7698c9388d093d6f0b3e5

Download Submit
C:\Windows\System\UZLwrGS.exe

Filesize
1.6MB

MD5
dd53d8f2302bf5a5bb892455947f17a2

SHA1
fb3bf8de3b2b0e4ed8c7ab62f274d82f8f6b6d5d

SHA256
aa4c459ee11bb719829c400f87b7b4bd9bb02e87c4a2a2aa8c2409198281f275

SHA512
6451e54ba1f4192eb28ab72525ab60aa0ce0e0b00fe1d6c3141991d1cb5be3b29c11223d972726ac7f798d40684155e1b2b24fe3d8296bc8d3487d6a9a189094

Download Submit
C:\Windows\System\UbUkkpW.exe

Filesize
1.6MB

MD5
6cbec15cd4fbde2145d862b025e33133

SHA1
bd10fd3a500adc562df82ca40c381110e7eb2579

SHA256
9f55c85a0550c610e0779d9a0523dea325d0b89e546ba9b3b94a9da8be134578

SHA512
3e674a08a7c32516e0b379b3eb62fd98ba2c672af284860217810af7296b6efb582aa30c6cc6e06c8a7b45c74322c07dabac8106e98dd0839eb1e6a72094dbe4

Download Submit
C:\Windows\System\VIqDEVE.exe

Filesize
1.6MB

MD5
7ae9fca831e23f36a50821bb1a4928f8

SHA1
14ca67dd114c1ac3c9c9044d1a214c12c16784f8

SHA256
16c28273b114f783593b8a703e70eca22da3e6955d7a2dbaa437a7b6e31bb1b7

SHA512
3480a6875dc2eeae7b5a2c9d3d9d53b23b216d8d4afd702c280b61d1f599284881d390f4e5c639e82a6e1cfa11d81bc50e47a46fe0442f5df630fa5e8f453949

Download Submit
C:\Windows\System\VWBvgYj.exe

Filesize
1.6MB

MD5
a32c2ff40a6502d972c6826c5aa4f100

SHA1
597d9f3bf2a4c4fd3178b4f5857ebc504e056f63

SHA256
598b776a15e5a5bbe1d5dcdf54716caf24ab518928a43e720571505859794781

SHA512
f29abb14e5819af9fc7d5fa3155f8097ac8b601bf1ec4ab8684f226a3a0e191d02935913c1243fbb5ea5dc3863df4ec9f50af909f7a293cbb56d9d174e0ce4cf

Download Submit
C:\Windows\System\arqIXeK.exe

Filesize
1.6MB

MD5
f9e5e3c2be0d92a1f12cc61a45f1531d

SHA1
a10a24b73ca099ef2bf23fc3f832ed0367dc3deb

SHA256
e739895615a9d6906cad8c4f74c6d80e938affd441a2be6fe00be7b0cae93188

SHA512
b4334723c9268f7e7e71eb32f4432c28a3242d7aee7f2c99307ceb52dccd903fa800cc40180bf04f94c06bd17beaf8044020387aac80eb8452084cc3010a8014

Download Submit
C:\Windows\System\dLysiez.exe

Filesize
1.6MB

MD5
0d2322f02c7a4f34e71cd76895ee3fd2

SHA1
3ff7bb26d30f91638b69b957ebf673b5bd058b75

SHA256
b5b381a4a084155116d78235cd06966416ae1d032cd700ef2b296dce01a1b99f

SHA512
4b9c87fb3855e193fe3c0e0c2907b422593e12fc6543845b1a14f5010000df53e8edec5f5e72089882daab1c3691545b0e9fc05fc0e7adac111b18b12c523f5e

Download Submit
C:\Windows\System\eyzKSib.exe

Filesize
1.6MB

MD5
6bb706fea7f124952b12844166bbbac5

SHA1
7fc0317c9ea79508618b10714c8e85debb865acb

SHA256
3806764c464643333fc162f50b00e3cdc497bd0c4bc3b965ec8af7f8f11622c9

SHA512
038e13172e5c5ea94341aec909045531c618546f6608b7918e868987feba54b05ec089a2dd1d10af8551f3819d1a89313f2701953f7229ac1fa9b37ff15ba569

Download Submit
C:\Windows\System\ezepFLt.exe

Filesize
1.6MB

MD5
33eb6007ff383aeb2920ee754e7ac254

SHA1
4a76594d2aa4e8ddaf8d8b53adbeecc273da092c

SHA256
8a138d72c8c3681ce664e8dfe3c0f50ad68b56dca14c361c279ccb10eee32898

SHA512
4cbecf657f98bb70b5a84da41f3d7d3a2997beb8455da8071c458ff67136fb4457f08ab24fb83cefa0a2b421a1ccddec01e9affc882a519c2976806768a42717

Download Submit
C:\Windows\System\fhcyqOj.exe

Filesize
1.6MB

MD5
d8637f2af9c125a0e50da1dd275e4ff3

SHA1
0092cc31b7a79fcca1cbf9bb2df3de88426b8c91

SHA256
7f5c897a76040d00aadb81ae7b6a43f12754893cc5b692cd913a339f7382ea56

SHA512
129dea6ee3f5100b3c9b1c86bea3ed38f8c001b8a9d69550b48a7f49f0f23429d42e0336455a696b0abf46641e158f8195e5ff2e25cbf66ae333bb29f07607fd

Download Submit
C:\Windows\System\iERiQBC.exe

Filesize
1.6MB

MD5
9176ba8fc5cd7d300ce81aa8f6e64076

SHA1
ecc4ec4c0edbdee058c8f5e0a03993fda4a071ae

SHA256
19515a675faa2f7933fae5eb02ff76fe6e80af967c1fbae78168e73788e8990f

SHA512
a42f623634086828e35f19619a6e7d51272cc2746c585595dda2498dcf8fdb0048cd98f56e1786135c9dbb166a82ba52f00313639da5e9040d0a0fe8f3b12a0c

Download Submit
C:\Windows\System\jQsPxHE.exe

Filesize
1.6MB

MD5
cfea617835a368aeb2c2bde95b457681

SHA1
a654481be4877831cc2421c19b40ad7f08084e3e

SHA256
084945bdf51c48f646bef618766a87a3a3b5a77b4712c10b3621d15c4c255bb0

SHA512
f9c7e8af5461a2ba8f3d654af3694ed74e6ef910b02288abf4779d47a029630757f2da1cae8b56d49fc0dd074859653f7ebb1694d3e954919d049e713bd11b35

Download Submit
C:\Windows\System\kpxBPIe.exe

Filesize
1.6MB

MD5
973905d2496075d5a7c268b1c07141aa

SHA1
a2bb65e1797b80c32ea49d1378777c3db6ceba13

SHA256
6d5a895174dba9165e74c478caaae5aaf6e77ea31627f0485c44f007fddf3a56

SHA512
d144da461cf09bd7d9a40659a0fe57d9599e4d7b0d950aa5ee3bf378db32495ca2c536b3c2899781ef93979e75b8e53a154ff35f0ab39d49dbd698b6572742b9

Download Submit
C:\Windows\System\lDAyNbZ.exe

Filesize
1.6MB

MD5
b9f9700b04dfe03c41698ee5f1ab46c4

SHA1
35c614d088ddb22576fa86455d7f62f4c3522df2

SHA256
ffec6f3a4eaa3099d44a5e6bdd374521949715e96fad229e69436f4e0d3ca917

SHA512
407e40313352376726504410953f8ab7d3bb4b88a9cef759a6494d5a5fc5b16d93ab5f90165f0c3b22c1e3084217e1f62d04ad757bf283d202a159e48b036693

Download Submit
C:\Windows\System\lVQcSys.exe

Filesize
1.6MB

MD5
3a7fedd14bdefcc32354e5fb27a87714

SHA1
dc74d671b2e9684f6201d59f491531368e28a1d4

SHA256
13206a3e80e3806bdaadbd31b9dc1e8a4e4d2e7bb3af2707a054cdf72fcb6c43

SHA512
9e645ce92926f563efd3e050ab4072e1a2fdb786361f0e94402a4c2933e61400b7dd324b781fbe45092f90fb8cfd29bd4c621a6dd5691d806fcf8d90f69270f3

Download Submit
C:\Windows\System\nPJvsnD.exe

Filesize
1.6MB

MD5
82f9c81d463a1290c19763239d7f597c

SHA1
59fc72c5bce0ced347fbb05b1a59b85ef8caa370

SHA256
8fb16efc2f35707bcded32fa20eb6bfabab9d75ca9c68d4c2154dce6cc93cc98

SHA512
f2e322e4f068c7e319831d83976556793911724c66ef7fdfa82e28d3ed3126a99f929f182514359bc14eac318fb0857ef5d7c87294cdd946343d7dd56022be4a

Download Submit
C:\Windows\System\nQJjCqq.exe

Filesize
1.6MB

MD5
0ec38001587c88ebf390944ca0d7937d

SHA1
613cdb311cdbde5221e81e944a7156381279ec1c

SHA256
3085eacda74921b854a00514f7765c7dd33758c9664a2aa7c842f8d5209f46d2

SHA512
a18fab861545ade91d0315698d7a318220c3beaa784ad1da33256d540c0f67af10256c9804a8d2ae16052133a8cda41ff5bff15f1acdf5a2791ecd3aa8c2b240

Download Submit
C:\Windows\System\pucKxhb.exe

Filesize
1.6MB

MD5
5600f8e4e597c1548d03745161c76086

SHA1
aee457c5b00258ba4a0044d570d2fd57f303204d

SHA256
9ea064325a3bc51978cd68c7b02bed58e564792c6027b25e618f890dc56aff74

SHA512
acc5b69f2496aaf2ebdf0f25bfcf92a12a567da8c4abd1d62e8fd673b3d0bb0f574680ed1f75093d1c8d5219938bd171deb61a67fec6ea1e43e255b4c5520662

Download Submit
C:\Windows\System\pwwCsLc.exe

Filesize
1.6MB

MD5
fd7e5b00ef6113db599891d6c19b056a

SHA1
ed1cb2fdf639f2261afbca9724ef5d8b50d38ff7

SHA256
b7851443f327d5c2f4722975ff845ceecd827e90379855890460c4d5d7e42923

SHA512
795867988b733a3d36a97afe51341fc88ee154507d8eeb1994a66b0247f442848aa24a3c7c43bd327e9f67cb85873333b57eeb15f67c55f88e7b69aade5cc460

Download Submit
C:\Windows\System\thfUWUD.exe

Filesize
1.6MB

MD5
79c947b088947b46b307a8fffdc5a15b

SHA1
d808434168e035bd8a797edc98204fc480f7302d

SHA256
d7744b6abf18fea4e0786e8bfb4ae7deeac6f0d4211724649273ba3431477a43

SHA512
6955ee96eedd4c68107025a696f3541dffd1a16c0dc12f03ad356df7b0d88bb53b73ebffb5a00db4d087dea36ae4aa3ae4cd9aa98c1cfc16ba7cc5aee53d07e5

Download Submit
C:\Windows\System\vUHRbcc.exe

Filesize
1.6MB

MD5
e0f9507da67d47ae8aceda033d1d25cf

SHA1
302ed556a925b2fece67713bcb256d9922a2a576

SHA256
d5ff0ec58d3d09c993a4cb2a8d7952449226025c3be0829bc4382fa692da7859

SHA512
58edc6aac5daefe8ba0bedd045ffb0ecf05459ec7b87d7cdccb1020a320904366c1552b783fa0a85dc0a6c9e6f503338e52f3ea66540068ad704c7e77036a09c

Download Submit
C:\Windows\System\xddSDkq.exe

Filesize
1.6MB

MD5
1859a33a23c8e4ccb69950537542366c

SHA1
4cd0d55cc685b2e085c594ab1b808ca5d515cc43

SHA256
3ce4ce84a8e46928d96f6bad5bf9ce7b36b555e1f0c76e797709ca1d3ff5a5b4

SHA512
f55e3eb3f2f7dd9c0cf7ec7a653bf037b7eae19962a48ac4d55a1b96056617384b8d62d37ca9e46ed638617a29f65ba1e67c55c927da6264d6b09cabd031fa31

Download Submit
memory/852-331-0x00007FF78EAC0000-0x00007FF78EEB2000-memory.dmp

Filesize
3.9MB

Download
memory/852-2442-0x00007FF78EAC0000-0x00007FF78EEB2000-memory.dmp

Filesize
3.9MB

Download
memory/852-1-0x0000025AC04E0000-0x0000025AC04F0000-memory.dmp

Filesize
64KB

Download
memory/852-0-0x00007FF78EAC0000-0x00007FF78EEB2000-memory.dmp

Filesize
3.9MB

Download
memory/1500-157-0x00007FF7FA470000-0x00007FF7FA862000-memory.dmp

Filesize
3.9MB

Download
memory/1500-3350-0x00007FF7FA470000-0x00007FF7FA862000-memory.dmp

Filesize
3.9MB

Download
memory/1508-3341-0x00007FF610970000-0x00007FF610D62000-memory.dmp

Filesize
3.9MB

Download
memory/1508-315-0x00007FF610970000-0x00007FF610D62000-memory.dmp

Filesize
3.9MB

Download
memory/1540-3392-0x00007FF6AE570000-0x00007FF6AE962000-memory.dmp

Filesize
3.9MB

Download
memory/1540-309-0x00007FF6AE570000-0x00007FF6AE962000-memory.dmp

Filesize
3.9MB

Download
memory/1736-301-0x00007FF634470000-0x00007FF634862000-memory.dmp

Filesize
3.9MB

Download
memory/1736-3399-0x00007FF634470000-0x00007FF634862000-memory.dmp

Filesize
3.9MB

Download
memory/1796-328-0x000001957EEC0000-0x000001957F666000-memory.dmp

Filesize
7.6MB

Download
memory/1796-327-0x000001957C030000-0x000001957C052000-memory.dmp

Filesize
136KB

Download
memory/1800-332-0x00007FF60BAD0000-0x00007FF60BEC2000-memory.dmp

Filesize
3.9MB

Download
memory/1800-27-0x00007FF60BAD0000-0x00007FF60BEC2000-memory.dmp

Filesize
3.9MB

Download
memory/1800-3333-0x00007FF60BAD0000-0x00007FF60BEC2000-memory.dmp

Filesize
3.9MB

Download
memory/1956-3352-0x00007FF70A7A0000-0x00007FF70AB92000-memory.dmp

Filesize
3.9MB

Download
memory/1956-156-0x00007FF70A7A0000-0x00007FF70AB92000-memory.dmp

Filesize
3.9MB

Download
memory/2056-3339-0x00007FF6BDA00000-0x00007FF6BDDF2000-memory.dmp

Filesize
3.9MB

Download
memory/2056-65-0x00007FF6BDA00000-0x00007FF6BDDF2000-memory.dmp

Filesize
3.9MB

Download
memory/2056-336-0x00007FF6BDA00000-0x00007FF6BDDF2000-memory.dmp

Filesize
3.9MB

Download
memory/2184-3345-0x00007FF7D4DD0000-0x00007FF7D51C2000-memory.dmp

Filesize
3.9MB

Download
memory/2184-234-0x00007FF7D4DD0000-0x00007FF7D51C2000-memory.dmp

Filesize
3.9MB

Download
memory/2436-3359-0x00007FF6C5E80000-0x00007FF6C6272000-memory.dmp

Filesize
3.9MB

Download
memory/2436-341-0x00007FF6C5E80000-0x00007FF6C6272000-memory.dmp

Filesize
3.9MB

Download
memory/2436-126-0x00007FF6C5E80000-0x00007FF6C6272000-memory.dmp

Filesize
3.9MB

Download
memory/2656-3344-0x00007FF7B84B0000-0x00007FF7B88A2000-memory.dmp

Filesize
3.9MB

Download
memory/2656-313-0x00007FF7B84B0000-0x00007FF7B88A2000-memory.dmp

Filesize
3.9MB

Download
memory/2664-314-0x00007FF604E10000-0x00007FF605202000-memory.dmp

Filesize
3.9MB

Download
memory/2664-3337-0x00007FF604E10000-0x00007FF605202000-memory.dmp

Filesize
3.9MB

Download
memory/2852-335-0x00007FF69EDC0000-0x00007FF69F1B2000-memory.dmp

Filesize
3.9MB

Download
memory/2852-44-0x00007FF69EDC0000-0x00007FF69F1B2000-memory.dmp

Filesize
3.9MB

Download
memory/2852-3335-0x00007FF69EDC0000-0x00007FF69F1B2000-memory.dmp

Filesize
3.9MB

Download
memory/2952-3348-0x00007FF70EE40000-0x00007FF70F232000-memory.dmp

Filesize
3.9MB

Download
memory/2952-205-0x00007FF70EE40000-0x00007FF70F232000-memory.dmp

Filesize
3.9MB

Download
memory/2996-16-0x00007FF7AD7B0000-0x00007FF7ADBA2000-memory.dmp

Filesize
3.9MB

Download
memory/2996-333-0x00007FF7AD7B0000-0x00007FF7ADBA2000-memory.dmp

Filesize
3.9MB

Download
memory/2996-3332-0x00007FF7AD7B0000-0x00007FF7ADBA2000-memory.dmp

Filesize
3.9MB

Download
memory/3164-311-0x00007FF77D560000-0x00007FF77D952000-memory.dmp

Filesize
3.9MB

Download
memory/3164-3389-0x00007FF77D560000-0x00007FF77D952000-memory.dmp

Filesize
3.9MB

Download
memory/4140-3353-0x00007FF67E430000-0x00007FF67E822000-memory.dmp

Filesize
3.9MB

Download
memory/4140-316-0x00007FF67E430000-0x00007FF67E822000-memory.dmp

Filesize
3.9MB

Download
memory/4872-308-0x00007FF6B0620000-0x00007FF6B0A12000-memory.dmp

Filesize
3.9MB

Download
memory/4872-3361-0x00007FF6B0620000-0x00007FF6B0A12000-memory.dmp

Filesize
3.9MB

Download
memory/5012-3404-0x00007FF6F9670000-0x00007FF6F9A62000-memory.dmp

Filesize
3.9MB

Download
memory/5012-307-0x00007FF6F9670000-0x00007FF6F9A62000-memory.dmp

Filesize
3.9MB

Download
memory/5260-267-0x00007FF7CD4B0000-0x00007FF7CD8A2000-memory.dmp

Filesize
3.9MB

Download
memory/5260-3381-0x00007FF7CD4B0000-0x00007FF7CD8A2000-memory.dmp

Filesize
3.9MB

Download
memory/5352-84-0x00007FF7B3F70000-0x00007FF7B4362000-memory.dmp

Filesize
3.9MB

Download
memory/5352-3355-0x00007FF7B3F70000-0x00007FF7B4362000-memory.dmp

Filesize
3.9MB

Download
memory/5624-310-0x00007FF683840000-0x00007FF683C32000-memory.dmp

Filesize
3.9MB

Download
memory/5624-3398-0x00007FF683840000-0x00007FF683C32000-memory.dmp

Filesize
3.9MB

Download
memory/5780-300-0x00007FF6B7E10000-0x00007FF6B8202000-memory.dmp

Filesize
3.9MB

Download
memory/5780-3357-0x00007FF6B7E10000-0x00007FF6B8202000-memory.dmp

Filesize
3.9MB

Download
memory/5888-317-0x00007FF629370000-0x00007FF629762000-memory.dmp

Filesize
3.9MB

Download
memory/5888-3379-0x00007FF629370000-0x00007FF629762000-memory.dmp

Filesize
3.9MB

Download
memory/5900-312-0x00007FF61A840000-0x00007FF61AC32000-memory.dmp

Filesize
3.9MB

Download
memory/5900-3387-0x00007FF61A840000-0x00007FF61AC32000-memory.dmp

Filesize
3.9MB

Download