xmrig | 436d42a897d66da7431a75a9f0784ff2e779ba8a8ed38dcf407bf6268bdedf31

Analysis

max time kernel
64s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 21:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
Size

1.9MB
MD5

03b7cb44c5d09f7aabcc83c21389dfe2
SHA1

9c6f06be20cde170beeb3089ceb484fa47dc6f0b
SHA256

436d42a897d66da7431a75a9f0784ff2e779ba8a8ed38dcf407bf6268bdedf31
SHA512

b0bd0697a4cda2219cea30932d1e6575c1ee2a88e1f6e250b648a6b996f22e8198f9fa5ed0f628b9ee535a398b73902e548f3e7294afb7f3df8b64594e187e14
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+UR:NABW

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 39 IoCs

miner

resource	yara_rule
behavioral2/memory/4916-170-0x00007FF6E2760000-0x00007FF6E2B52000-memory.dmp	xmrig
behavioral2/memory/2168-172-0x00007FF7BAAB0000-0x00007FF7BAEA2000-memory.dmp	xmrig
behavioral2/memory/2908-182-0x00007FF6C7830000-0x00007FF6C7C22000-memory.dmp	xmrig
behavioral2/memory/1312-243-0x00007FF6B6C80000-0x00007FF6B7072000-memory.dmp	xmrig
behavioral2/memory/1840-242-0x00007FF7EB1E0000-0x00007FF7EB5D2000-memory.dmp	xmrig
behavioral2/memory/3068-183-0x00007FF7C0A00000-0x00007FF7C0DF2000-memory.dmp	xmrig
behavioral2/memory/456-180-0x00007FF718D10000-0x00007FF719102000-memory.dmp	xmrig
behavioral2/memory/2548-179-0x00007FF789100000-0x00007FF7894F2000-memory.dmp	xmrig
behavioral2/memory/3448-178-0x00007FF736B30000-0x00007FF736F22000-memory.dmp	xmrig
behavioral2/memory/4980-177-0x00007FF6B8220000-0x00007FF6B8612000-memory.dmp	xmrig
behavioral2/memory/1828-175-0x00007FF707190000-0x00007FF707582000-memory.dmp	xmrig
behavioral2/memory/4476-174-0x00007FF7C84A0000-0x00007FF7C8892000-memory.dmp	xmrig
behavioral2/memory/2244-171-0x00007FF750D60000-0x00007FF751152000-memory.dmp	xmrig
behavioral2/memory/3292-169-0x00007FF780830000-0x00007FF780C22000-memory.dmp	xmrig
behavioral2/memory/4072-168-0x00007FF7E88E0000-0x00007FF7E8CD2000-memory.dmp	xmrig
behavioral2/memory/1000-154-0x00007FF747C80000-0x00007FF748072000-memory.dmp	xmrig
behavioral2/memory/4456-124-0x00007FF61CB50000-0x00007FF61CF42000-memory.dmp	xmrig
behavioral2/memory/3820-95-0x00007FF631E30000-0x00007FF632222000-memory.dmp	xmrig
behavioral2/memory/3820-3408-0x00007FF631E30000-0x00007FF632222000-memory.dmp	xmrig
behavioral2/memory/1000-3410-0x00007FF747C80000-0x00007FF748072000-memory.dmp	xmrig
behavioral2/memory/4456-3412-0x00007FF61CB50000-0x00007FF61CF42000-memory.dmp	xmrig
behavioral2/memory/1840-3414-0x00007FF7EB1E0000-0x00007FF7EB5D2000-memory.dmp	xmrig
behavioral2/memory/3292-3416-0x00007FF780830000-0x00007FF780C22000-memory.dmp	xmrig
behavioral2/memory/456-3419-0x00007FF718D10000-0x00007FF719102000-memory.dmp	xmrig
behavioral2/memory/4072-3423-0x00007FF7E88E0000-0x00007FF7E8CD2000-memory.dmp	xmrig
behavioral2/memory/4916-3425-0x00007FF6E2760000-0x00007FF6E2B52000-memory.dmp	xmrig
behavioral2/memory/4980-3432-0x00007FF6B8220000-0x00007FF6B8612000-memory.dmp	xmrig
behavioral2/memory/1828-3430-0x00007FF707190000-0x00007FF707582000-memory.dmp	xmrig
behavioral2/memory/4476-3428-0x00007FF7C84A0000-0x00007FF7C8892000-memory.dmp	xmrig
behavioral2/memory/2244-3420-0x00007FF750D60000-0x00007FF751152000-memory.dmp	xmrig
behavioral2/memory/2548-3426-0x00007FF789100000-0x00007FF7894F2000-memory.dmp	xmrig
behavioral2/memory/2168-3450-0x00007FF7BAAB0000-0x00007FF7BAEA2000-memory.dmp	xmrig
behavioral2/memory/3448-3455-0x00007FF736B30000-0x00007FF736F22000-memory.dmp	xmrig
behavioral2/memory/1312-3454-0x00007FF6B6C80000-0x00007FF6B7072000-memory.dmp	xmrig
behavioral2/memory/2908-3452-0x00007FF6C7830000-0x00007FF6C7C22000-memory.dmp	xmrig
behavioral2/memory/3444-3448-0x00007FF7664F0000-0x00007FF7668E2000-memory.dmp	xmrig
behavioral2/memory/1480-3445-0x00007FF69A090000-0x00007FF69A482000-memory.dmp	xmrig
behavioral2/memory/4744-3437-0x00007FF6F42D0000-0x00007FF6F46C2000-memory.dmp	xmrig
behavioral2/memory/3068-3435-0x00007FF7C0A00000-0x00007FF7C0DF2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3820	CikVtDB.exe
1840	JooBTRJ.exe
4456	CMzOwTR.exe
1000	nSMiWqA.exe
4072	olqMVBR.exe
3292	CuITsUF.exe
4916	FKzGBOA.exe
2244	dwOmsWN.exe
2168	iwPdgRz.exe
4744	AGFbMId.exe
4476	KxKPKwV.exe
1828	rZkbStj.exe
1480	YjTQRZs.exe
4980	UCcSflk.exe
3448	LjOEFPf.exe
2548	HoZzABA.exe
456	DKnzLBh.exe
1312	zqwdfCA.exe
3444	pbYXoDZ.exe
2908	OBgJVOj.exe
3068	fYQhJAZ.exe
1924	tFWqWsf.exe
3020	wSsBUaR.exe
3708	CAiXMzc.exe
412	CPULUvu.exe
3488	ejQRYQN.exe
2556	pTIxCqu.exe
3976	wEChjuH.exe
1836	lUlUJgs.exe
556	PlUWQsV.exe
2428	tbeQVwd.exe
884	SmTRkns.exe
1036	HPqkbpw.exe
1740	LEtEEXV.exe
964	WdhsESp.exe
4932	ONbDWxc.exe
3116	NuhVinw.exe
2108	xEzfuqm.exe
1948	bCKlEHL.exe
3940	aHhNgjO.exe
2504	QhEtApV.exe
2508	WNlVHWY.exe
2996	dVmMVQa.exe
1180	zNgaXII.exe
4512	ccNwGAo.exe
3484	GhUpMeD.exe
2712	lyOloRN.exe
4844	aBQOzGK.exe
4296	GXuKDYx.exe
4528	zLwqDix.exe
3616	tqMUUJy.exe
4336	CClPlzh.exe
4344	KMUdpVH.exe
2364	Wgmabzd.exe
4860	zlFzGKU.exe
4468	hAtZAyM.exe
1660	HfkrZti.exe
1580	bOVVevI.exe
772	oOLJlkA.exe
4632	MJiblsl.exe
4448	zWSSvQB.exe
4716	JkjLjuU.exe
2044	eWqlhjB.exe
2256	gqPFzSY.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4184-0-0x00007FF6790C0000-0x00007FF6794B2000-memory.dmp	upx
behavioral2/files/0x000d000000023b24-5.dat	upx
behavioral2/files/0x000b000000023b86-14.dat	upx
behavioral2/files/0x000a000000023b8b-16.dat	upx
behavioral2/files/0x000a000000023b9a-83.dat	upx
behavioral2/files/0x000a000000023ba1-119.dat	upx
behavioral2/files/0x000a000000023ba5-144.dat	upx
behavioral2/files/0x000a000000023b9e-165.dat	upx
behavioral2/memory/4916-170-0x00007FF6E2760000-0x00007FF6E2B52000-memory.dmp	upx
behavioral2/memory/2168-172-0x00007FF7BAAB0000-0x00007FF7BAEA2000-memory.dmp	upx
behavioral2/memory/4744-173-0x00007FF6F42D0000-0x00007FF6F46C2000-memory.dmp	upx
behavioral2/memory/1480-176-0x00007FF69A090000-0x00007FF69A482000-memory.dmp	upx
behavioral2/memory/2908-182-0x00007FF6C7830000-0x00007FF6C7C22000-memory.dmp	upx
behavioral2/memory/1312-243-0x00007FF6B6C80000-0x00007FF6B7072000-memory.dmp	upx
behavioral2/memory/1840-242-0x00007FF7EB1E0000-0x00007FF7EB5D2000-memory.dmp	upx
behavioral2/files/0x000a000000023b9c-220.dat	upx
behavioral2/files/0x000a000000023bae-217.dat	upx
behavioral2/files/0x000a000000023ba2-213.dat	upx
behavioral2/files/0x000a000000023bad-212.dat	upx
behavioral2/files/0x000a000000023b92-209.dat	upx
behavioral2/files/0x000a000000023bac-208.dat	upx
behavioral2/files/0x000a000000023ba0-198.dat	upx
behavioral2/files/0x000a000000023bab-195.dat	upx
behavioral2/files/0x000a000000023b95-191.dat	upx
behavioral2/files/0x000a000000023ba4-185.dat	upx
behavioral2/memory/3068-183-0x00007FF7C0A00000-0x00007FF7C0DF2000-memory.dmp	upx
behavioral2/memory/3444-181-0x00007FF7664F0000-0x00007FF7668E2000-memory.dmp	upx
behavioral2/memory/456-180-0x00007FF718D10000-0x00007FF719102000-memory.dmp	upx
behavioral2/memory/2548-179-0x00007FF789100000-0x00007FF7894F2000-memory.dmp	upx
behavioral2/memory/3448-178-0x00007FF736B30000-0x00007FF736F22000-memory.dmp	upx
behavioral2/memory/4980-177-0x00007FF6B8220000-0x00007FF6B8612000-memory.dmp	upx
behavioral2/memory/1828-175-0x00007FF707190000-0x00007FF707582000-memory.dmp	upx
behavioral2/memory/4476-174-0x00007FF7C84A0000-0x00007FF7C8892000-memory.dmp	upx
behavioral2/memory/2244-171-0x00007FF750D60000-0x00007FF751152000-memory.dmp	upx
behavioral2/memory/3292-169-0x00007FF780830000-0x00007FF780C22000-memory.dmp	upx
behavioral2/memory/4072-168-0x00007FF7E88E0000-0x00007FF7E8CD2000-memory.dmp	upx
behavioral2/files/0x000a000000023baa-164.dat	upx
behavioral2/files/0x000a000000023ba9-162.dat	upx
behavioral2/files/0x000a000000023ba8-161.dat	upx
behavioral2/files/0x000a000000023b9d-157.dat	upx
behavioral2/memory/1000-154-0x00007FF747C80000-0x00007FF748072000-memory.dmp	upx
behavioral2/files/0x000a000000023ba7-153.dat	upx
behavioral2/files/0x000a000000023ba6-152.dat	upx
behavioral2/files/0x000a000000023b9b-147.dat	upx
behavioral2/files/0x000a000000023b98-138.dat	upx
behavioral2/files/0x000a000000023b91-137.dat	upx
behavioral2/files/0x000b000000023b97-136.dat	upx
behavioral2/files/0x000a000000023b90-132.dat	upx
behavioral2/files/0x000a000000023b94-127.dat	upx
behavioral2/memory/4456-124-0x00007FF61CB50000-0x00007FF61CF42000-memory.dmp	upx
behavioral2/files/0x000a000000023b99-114.dat	upx
behavioral2/files/0x000a000000023b9f-110.dat	upx
behavioral2/files/0x000a000000023ba3-128.dat	upx
behavioral2/memory/3820-95-0x00007FF631E30000-0x00007FF632222000-memory.dmp	upx
behavioral2/files/0x000a000000023b8f-104.dat	upx
behavioral2/files/0x000a000000023b8c-69.dat	upx
behavioral2/files/0x000a000000023b93-63.dat	upx
behavioral2/files/0x000a000000023b8e-80.dat	upx
behavioral2/files/0x000a000000023b8d-55.dat	upx
behavioral2/files/0x000a000000023b8a-38.dat	upx
behavioral2/memory/3820-3408-0x00007FF631E30000-0x00007FF632222000-memory.dmp	upx
behavioral2/memory/1000-3410-0x00007FF747C80000-0x00007FF748072000-memory.dmp	upx
behavioral2/memory/4456-3412-0x00007FF61CB50000-0x00007FF61CF42000-memory.dmp	upx
behavioral2/memory/1840-3414-0x00007FF7EB1E0000-0x00007FF7EB5D2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\kVDZHoV.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\CgFgaRU.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\OLXPSXC.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\GUVZWbW.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\siKgAia.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\LbtGoMq.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\OFHAdiB.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\yIXYlEN.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\MmbwHSN.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\nDjPHEO.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\LoXqFHZ.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\ESNkqHc.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\AdeJWYu.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\KdMLpiY.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\ioRgCez.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\lbAgpPp.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\itnplIf.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\kBNQTDV.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\ntllYOe.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\GKwUeOR.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\ugHqvJF.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\DbNSLYz.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\OxfPTER.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\sSFMYEt.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\HOnJNra.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\UJAVDdY.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\dsFjbrQ.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\vPKnOCQ.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\MjUTOAF.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\nnfmGIS.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\tdyljxq.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\ZUNTNEH.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\iWOfxvb.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\zUOzzHt.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\kKeZOZg.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\HxWhkez.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\RwLNdWb.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\NzhhiBV.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\fnCnpZq.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\jOVWcWG.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\MTHCxpJ.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\NlbJkRS.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\YlXLTpU.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\CveFisB.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\xTSsbfx.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\tjvcwgL.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\jzDaDmL.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\BpTixNE.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\YoZgKPK.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\EDfleRw.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\eVgocDk.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\VWGmLYt.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\bdpCQIk.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\btggiNW.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\ExeSAsW.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\TcJmIpV.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\aNiTuMf.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\mjcRigE.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\KKJhJkv.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\EGKEIgl.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\FIfOMwg.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\wSsBUaR.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\IjmSDti.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
File created	C:\Windows\System\Zouhnyt.exe	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4244	powershell.exe
4244	powershell.exe
4244	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4244	powershell.exe
Token: SeLockMemoryPrivilege	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 4244	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	84
PID 4184 wrote to memory of 4244	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	84
PID 4184 wrote to memory of 3820	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	85
PID 4184 wrote to memory of 3820	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	85
PID 4184 wrote to memory of 1840	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	86
PID 4184 wrote to memory of 1840	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	86
PID 4184 wrote to memory of 4456	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	87
PID 4184 wrote to memory of 4456	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	87
PID 4184 wrote to memory of 1000	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	88
PID 4184 wrote to memory of 1000	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	88
PID 4184 wrote to memory of 4072	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	89
PID 4184 wrote to memory of 4072	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	89
PID 4184 wrote to memory of 3292	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	90
PID 4184 wrote to memory of 3292	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	90
PID 4184 wrote to memory of 4916	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	91
PID 4184 wrote to memory of 4916	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	91
PID 4184 wrote to memory of 2244	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	92
PID 4184 wrote to memory of 2244	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	92
PID 4184 wrote to memory of 4980	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	93
PID 4184 wrote to memory of 4980	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	93
PID 4184 wrote to memory of 2168	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	94
PID 4184 wrote to memory of 2168	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	94
PID 4184 wrote to memory of 4744	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	95
PID 4184 wrote to memory of 4744	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	95
PID 4184 wrote to memory of 4476	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	96
PID 4184 wrote to memory of 4476	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	96
PID 4184 wrote to memory of 1828	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	97
PID 4184 wrote to memory of 1828	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	97
PID 4184 wrote to memory of 1480	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	98
PID 4184 wrote to memory of 1480	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	98
PID 4184 wrote to memory of 3448	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	99
PID 4184 wrote to memory of 3448	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	99
PID 4184 wrote to memory of 2548	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	100
PID 4184 wrote to memory of 2548	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	100
PID 4184 wrote to memory of 456	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	101
PID 4184 wrote to memory of 456	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	101
PID 4184 wrote to memory of 1312	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	102
PID 4184 wrote to memory of 1312	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	102
PID 4184 wrote to memory of 3444	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	103
PID 4184 wrote to memory of 3444	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	103
PID 4184 wrote to memory of 2908	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	104
PID 4184 wrote to memory of 2908	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	104
PID 4184 wrote to memory of 3068	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	105
PID 4184 wrote to memory of 3068	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	105
PID 4184 wrote to memory of 1924	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	106
PID 4184 wrote to memory of 1924	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	106
PID 4184 wrote to memory of 3020	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	107
PID 4184 wrote to memory of 3020	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	107
PID 4184 wrote to memory of 3708	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	108
PID 4184 wrote to memory of 3708	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	108
PID 4184 wrote to memory of 412	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	109
PID 4184 wrote to memory of 412	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	109
PID 4184 wrote to memory of 3488	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	110
PID 4184 wrote to memory of 3488	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	110
PID 4184 wrote to memory of 2556	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	111
PID 4184 wrote to memory of 2556	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	111
PID 4184 wrote to memory of 3976	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	112
PID 4184 wrote to memory of 3976	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	112
PID 4184 wrote to memory of 1836	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	113
PID 4184 wrote to memory of 1836	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	113
PID 4184 wrote to memory of 556	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	114
PID 4184 wrote to memory of 556	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	114
PID 4184 wrote to memory of 2428	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	115
PID 4184 wrote to memory of 2428	4184	03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03b7cb44c5d09f7aabcc83c21389dfe2_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4244
- C:\Windows\System\CikVtDB.exe
  C:\Windows\System\CikVtDB.exe
  2⤵
  - Executes dropped EXE
  PID:3820
- C:\Windows\System\JooBTRJ.exe
  C:\Windows\System\JooBTRJ.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\CMzOwTR.exe
  C:\Windows\System\CMzOwTR.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\nSMiWqA.exe
  C:\Windows\System\nSMiWqA.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\olqMVBR.exe
  C:\Windows\System\olqMVBR.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\CuITsUF.exe
  C:\Windows\System\CuITsUF.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\FKzGBOA.exe
  C:\Windows\System\FKzGBOA.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\dwOmsWN.exe
  C:\Windows\System\dwOmsWN.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\UCcSflk.exe
  C:\Windows\System\UCcSflk.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\iwPdgRz.exe
  C:\Windows\System\iwPdgRz.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\AGFbMId.exe
  C:\Windows\System\AGFbMId.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\KxKPKwV.exe
  C:\Windows\System\KxKPKwV.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\rZkbStj.exe
  C:\Windows\System\rZkbStj.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\YjTQRZs.exe
  C:\Windows\System\YjTQRZs.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\LjOEFPf.exe
  C:\Windows\System\LjOEFPf.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\HoZzABA.exe
  C:\Windows\System\HoZzABA.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\DKnzLBh.exe
  C:\Windows\System\DKnzLBh.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\zqwdfCA.exe
  C:\Windows\System\zqwdfCA.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\pbYXoDZ.exe
  C:\Windows\System\pbYXoDZ.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\OBgJVOj.exe
  C:\Windows\System\OBgJVOj.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\fYQhJAZ.exe
  C:\Windows\System\fYQhJAZ.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\tFWqWsf.exe
  C:\Windows\System\tFWqWsf.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\wSsBUaR.exe
  C:\Windows\System\wSsBUaR.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\CAiXMzc.exe
  C:\Windows\System\CAiXMzc.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\CPULUvu.exe
  C:\Windows\System\CPULUvu.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\ejQRYQN.exe
  C:\Windows\System\ejQRYQN.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\pTIxCqu.exe
  C:\Windows\System\pTIxCqu.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\wEChjuH.exe
  C:\Windows\System\wEChjuH.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\lUlUJgs.exe
  C:\Windows\System\lUlUJgs.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\PlUWQsV.exe
  C:\Windows\System\PlUWQsV.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\tbeQVwd.exe
  C:\Windows\System\tbeQVwd.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\SmTRkns.exe
  C:\Windows\System\SmTRkns.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\HPqkbpw.exe
  C:\Windows\System\HPqkbpw.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\LEtEEXV.exe
  C:\Windows\System\LEtEEXV.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\WdhsESp.exe
  C:\Windows\System\WdhsESp.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\ONbDWxc.exe
  C:\Windows\System\ONbDWxc.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\NuhVinw.exe
  C:\Windows\System\NuhVinw.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\xEzfuqm.exe
  C:\Windows\System\xEzfuqm.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\bCKlEHL.exe
  C:\Windows\System\bCKlEHL.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\aHhNgjO.exe
  C:\Windows\System\aHhNgjO.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\QhEtApV.exe
  C:\Windows\System\QhEtApV.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\WNlVHWY.exe
  C:\Windows\System\WNlVHWY.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\dVmMVQa.exe
  C:\Windows\System\dVmMVQa.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\zNgaXII.exe
  C:\Windows\System\zNgaXII.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\ccNwGAo.exe
  C:\Windows\System\ccNwGAo.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\GhUpMeD.exe
  C:\Windows\System\GhUpMeD.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\lyOloRN.exe
  C:\Windows\System\lyOloRN.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\aBQOzGK.exe
  C:\Windows\System\aBQOzGK.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\GXuKDYx.exe
  C:\Windows\System\GXuKDYx.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\zLwqDix.exe
  C:\Windows\System\zLwqDix.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\tqMUUJy.exe
  C:\Windows\System\tqMUUJy.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\CClPlzh.exe
  C:\Windows\System\CClPlzh.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\KMUdpVH.exe
  C:\Windows\System\KMUdpVH.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\Wgmabzd.exe
  C:\Windows\System\Wgmabzd.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\zlFzGKU.exe
  C:\Windows\System\zlFzGKU.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\hAtZAyM.exe
  C:\Windows\System\hAtZAyM.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\HfkrZti.exe
  C:\Windows\System\HfkrZti.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\bOVVevI.exe
  C:\Windows\System\bOVVevI.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\LEARFvd.exe
  C:\Windows\System\LEARFvd.exe
  2⤵
  PID:2612
- C:\Windows\System\oOLJlkA.exe
  C:\Windows\System\oOLJlkA.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\MJiblsl.exe
  C:\Windows\System\MJiblsl.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\zWSSvQB.exe
  C:\Windows\System\zWSSvQB.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\JkjLjuU.exe
  C:\Windows\System\JkjLjuU.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\eWqlhjB.exe
  C:\Windows\System\eWqlhjB.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\gqPFzSY.exe
  C:\Windows\System\gqPFzSY.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\TyvtJpb.exe
  C:\Windows\System\TyvtJpb.exe
  2⤵
  PID:532
- C:\Windows\System\dJyIAVe.exe
  C:\Windows\System\dJyIAVe.exe
  2⤵
  PID:3152
- C:\Windows\System\jPFhszy.exe
  C:\Windows\System\jPFhszy.exe
  2⤵
  PID:4032
- C:\Windows\System\XqeTqsV.exe
  C:\Windows\System\XqeTqsV.exe
  2⤵
  PID:4068
- C:\Windows\System\wVJwynh.exe
  C:\Windows\System\wVJwynh.exe
  2⤵
  PID:4132
- C:\Windows\System\yXkxQzG.exe
  C:\Windows\System\yXkxQzG.exe
  2⤵
  PID:5124
- C:\Windows\System\bXMVbqJ.exe
  C:\Windows\System\bXMVbqJ.exe
  2⤵
  PID:5148
- C:\Windows\System\Jzwsbhk.exe
  C:\Windows\System\Jzwsbhk.exe
  2⤵
  PID:5172
- C:\Windows\System\VrKNoVi.exe
  C:\Windows\System\VrKNoVi.exe
  2⤵
  PID:5192
- C:\Windows\System\XygSNyS.exe
  C:\Windows\System\XygSNyS.exe
  2⤵
  PID:5208
- C:\Windows\System\acsOojX.exe
  C:\Windows\System\acsOojX.exe
  2⤵
  PID:5224
- C:\Windows\System\uUDffKd.exe
  C:\Windows\System\uUDffKd.exe
  2⤵
  PID:5240
- C:\Windows\System\FSACnnF.exe
  C:\Windows\System\FSACnnF.exe
  2⤵
  PID:5260
- C:\Windows\System\FPfLzvg.exe
  C:\Windows\System\FPfLzvg.exe
  2⤵
  PID:5276
- C:\Windows\System\IjmSDti.exe
  C:\Windows\System\IjmSDti.exe
  2⤵
  PID:5292
- C:\Windows\System\BqKuYAQ.exe
  C:\Windows\System\BqKuYAQ.exe
  2⤵
  PID:5312
- C:\Windows\System\vocAuDf.exe
  C:\Windows\System\vocAuDf.exe
  2⤵
  PID:5328
- C:\Windows\System\EzzWrsp.exe
  C:\Windows\System\EzzWrsp.exe
  2⤵
  PID:5352
- C:\Windows\System\sMvOAFe.exe
  C:\Windows\System\sMvOAFe.exe
  2⤵
  PID:5376
- C:\Windows\System\gVCienx.exe
  C:\Windows\System\gVCienx.exe
  2⤵
  PID:5396
- C:\Windows\System\rcfZXXH.exe
  C:\Windows\System\rcfZXXH.exe
  2⤵
  PID:5428
- C:\Windows\System\yQntbIj.exe
  C:\Windows\System\yQntbIj.exe
  2⤵
  PID:5460
- C:\Windows\System\KLPddEx.exe
  C:\Windows\System\KLPddEx.exe
  2⤵
  PID:5480
- C:\Windows\System\tdyljxq.exe
  C:\Windows\System\tdyljxq.exe
  2⤵
  PID:5504
- C:\Windows\System\ozfqiem.exe
  C:\Windows\System\ozfqiem.exe
  2⤵
  PID:5528
- C:\Windows\System\AlfhBVF.exe
  C:\Windows\System\AlfhBVF.exe
  2⤵
  PID:5552
- C:\Windows\System\EIlJpSl.exe
  C:\Windows\System\EIlJpSl.exe
  2⤵
  PID:5584
- C:\Windows\System\OYrLIKo.exe
  C:\Windows\System\OYrLIKo.exe
  2⤵
  PID:5616
- C:\Windows\System\Rheoeva.exe
  C:\Windows\System\Rheoeva.exe
  2⤵
  PID:5632
- C:\Windows\System\rjXbuQV.exe
  C:\Windows\System\rjXbuQV.exe
  2⤵
  PID:5648
- C:\Windows\System\sxmfGXu.exe
  C:\Windows\System\sxmfGXu.exe
  2⤵
  PID:5664
- C:\Windows\System\XdvIdnf.exe
  C:\Windows\System\XdvIdnf.exe
  2⤵
  PID:5724
- C:\Windows\System\YYuEaKI.exe
  C:\Windows\System\YYuEaKI.exe
  2⤵
  PID:5740
- C:\Windows\System\sJInYsj.exe
  C:\Windows\System\sJInYsj.exe
  2⤵
  PID:5756
- C:\Windows\System\wMSybYJ.exe
  C:\Windows\System\wMSybYJ.exe
  2⤵
  PID:5776
- C:\Windows\System\pVnDZkG.exe
  C:\Windows\System\pVnDZkG.exe
  2⤵
  PID:5792
- C:\Windows\System\JZGrILH.exe
  C:\Windows\System\JZGrILH.exe
  2⤵
  PID:5808
- C:\Windows\System\LrQaQtG.exe
  C:\Windows\System\LrQaQtG.exe
  2⤵
  PID:5824
- C:\Windows\System\kpDBXjq.exe
  C:\Windows\System\kpDBXjq.exe
  2⤵
  PID:5840
- C:\Windows\System\SqlpdWj.exe
  C:\Windows\System\SqlpdWj.exe
  2⤵
  PID:5856
- C:\Windows\System\hJSZild.exe
  C:\Windows\System\hJSZild.exe
  2⤵
  PID:5872
- C:\Windows\System\ZuHXBeu.exe
  C:\Windows\System\ZuHXBeu.exe
  2⤵
  PID:5888
- C:\Windows\System\HAvjacE.exe
  C:\Windows\System\HAvjacE.exe
  2⤵
  PID:5904
- C:\Windows\System\tSsMRwj.exe
  C:\Windows\System\tSsMRwj.exe
  2⤵
  PID:5924
- C:\Windows\System\PIFVUBe.exe
  C:\Windows\System\PIFVUBe.exe
  2⤵
  PID:5940
- C:\Windows\System\GUVZWbW.exe
  C:\Windows\System\GUVZWbW.exe
  2⤵
  PID:5960
- C:\Windows\System\cSHQQxL.exe
  C:\Windows\System\cSHQQxL.exe
  2⤵
  PID:5988
- C:\Windows\System\CiPdjSO.exe
  C:\Windows\System\CiPdjSO.exe
  2⤵
  PID:6008
- C:\Windows\System\SAZzCJx.exe
  C:\Windows\System\SAZzCJx.exe
  2⤵
  PID:6072
- C:\Windows\System\blTkPKn.exe
  C:\Windows\System\blTkPKn.exe
  2⤵
  PID:6092
- C:\Windows\System\zHCIeVH.exe
  C:\Windows\System\zHCIeVH.exe
  2⤵
  PID:6112
- C:\Windows\System\MOXyAyt.exe
  C:\Windows\System\MOXyAyt.exe
  2⤵
  PID:6132
- C:\Windows\System\ulttfMo.exe
  C:\Windows\System\ulttfMo.exe
  2⤵
  PID:628
- C:\Windows\System\cHIZSKk.exe
  C:\Windows\System\cHIZSKk.exe
  2⤵
  PID:4496
- C:\Windows\System\ZySIBKm.exe
  C:\Windows\System\ZySIBKm.exe
  2⤵
  PID:220
- C:\Windows\System\RFSzJDA.exe
  C:\Windows\System\RFSzJDA.exe
  2⤵
  PID:4908
- C:\Windows\System\irlwePr.exe
  C:\Windows\System\irlwePr.exe
  2⤵
  PID:216
- C:\Windows\System\HeZJfED.exe
  C:\Windows\System\HeZJfED.exe
  2⤵
  PID:2528
- C:\Windows\System\VeXjPxY.exe
  C:\Windows\System\VeXjPxY.exe
  2⤵
  PID:4872
- C:\Windows\System\IXQcQpx.exe
  C:\Windows\System\IXQcQpx.exe
  2⤵
  PID:1608
- C:\Windows\System\xKlSadP.exe
  C:\Windows\System\xKlSadP.exe
  2⤵
  PID:2768
- C:\Windows\System\xtftrNg.exe
  C:\Windows\System\xtftrNg.exe
  2⤵
  PID:3080
- C:\Windows\System\Oumybmi.exe
  C:\Windows\System\Oumybmi.exe
  2⤵
  PID:3024
- C:\Windows\System\ufWNoHX.exe
  C:\Windows\System\ufWNoHX.exe
  2⤵
  PID:5476
- C:\Windows\System\eCAuffe.exe
  C:\Windows\System\eCAuffe.exe
  2⤵
  PID:5048
- C:\Windows\System\ahUkwXY.exe
  C:\Windows\System\ahUkwXY.exe
  2⤵
  PID:2140
- C:\Windows\System\kDDxcFS.exe
  C:\Windows\System\kDDxcFS.exe
  2⤵
  PID:5520
- C:\Windows\System\sRhMvGu.exe
  C:\Windows\System\sRhMvGu.exe
  2⤵
  PID:5560
- C:\Windows\System\WJGZTOB.exe
  C:\Windows\System\WJGZTOB.exe
  2⤵
  PID:5160
- C:\Windows\System\ekKBZJv.exe
  C:\Windows\System\ekKBZJv.exe
  2⤵
  PID:5216
- C:\Windows\System\wcByWmS.exe
  C:\Windows\System\wcByWmS.exe
  2⤵
  PID:5252
- C:\Windows\System\HkeeVjw.exe
  C:\Windows\System\HkeeVjw.exe
  2⤵
  PID:5304
- C:\Windows\System\FrlIghh.exe
  C:\Windows\System\FrlIghh.exe
  2⤵
  PID:5340
- C:\Windows\System\oYTtXao.exe
  C:\Windows\System\oYTtXao.exe
  2⤵
  PID:5408
- C:\Windows\System\hyrWsjl.exe
  C:\Windows\System\hyrWsjl.exe
  2⤵
  PID:5188
- C:\Windows\System\ScKpyON.exe
  C:\Windows\System\ScKpyON.exe
  2⤵
  PID:5456
- C:\Windows\System\lFrYgLl.exe
  C:\Windows\System\lFrYgLl.exe
  2⤵
  PID:6164
- C:\Windows\System\fmRzfhY.exe
  C:\Windows\System\fmRzfhY.exe
  2⤵
  PID:6196
- C:\Windows\System\nMKzKhx.exe
  C:\Windows\System\nMKzKhx.exe
  2⤵
  PID:6216
- C:\Windows\System\vepVLZp.exe
  C:\Windows\System\vepVLZp.exe
  2⤵
  PID:6244
- C:\Windows\System\pcFuFCw.exe
  C:\Windows\System\pcFuFCw.exe
  2⤵
  PID:6260
- C:\Windows\System\yJyLWlL.exe
  C:\Windows\System\yJyLWlL.exe
  2⤵
  PID:6280
- C:\Windows\System\ODbHMKT.exe
  C:\Windows\System\ODbHMKT.exe
  2⤵
  PID:6304
- C:\Windows\System\HIfRfSH.exe
  C:\Windows\System\HIfRfSH.exe
  2⤵
  PID:6328
- C:\Windows\System\JbkeyHt.exe
  C:\Windows\System\JbkeyHt.exe
  2⤵
  PID:6344
- C:\Windows\System\zBOVQcP.exe
  C:\Windows\System\zBOVQcP.exe
  2⤵
  PID:6364
- C:\Windows\System\RJjWBFX.exe
  C:\Windows\System\RJjWBFX.exe
  2⤵
  PID:6388
- C:\Windows\System\ILprgcy.exe
  C:\Windows\System\ILprgcy.exe
  2⤵
  PID:6408
- C:\Windows\System\shFBJMk.exe
  C:\Windows\System\shFBJMk.exe
  2⤵
  PID:6432
- C:\Windows\System\xgGoxMa.exe
  C:\Windows\System\xgGoxMa.exe
  2⤵
  PID:6452
- C:\Windows\System\pgSUkMi.exe
  C:\Windows\System\pgSUkMi.exe
  2⤵
  PID:6468
- C:\Windows\System\eNJRHDN.exe
  C:\Windows\System\eNJRHDN.exe
  2⤵
  PID:6484
- C:\Windows\System\zJCKXFe.exe
  C:\Windows\System\zJCKXFe.exe
  2⤵
  PID:6504
- C:\Windows\System\uWBWlGo.exe
  C:\Windows\System\uWBWlGo.exe
  2⤵
  PID:6556
- C:\Windows\System\IxQneHZ.exe
  C:\Windows\System\IxQneHZ.exe
  2⤵
  PID:6572
- C:\Windows\System\fPxAMWh.exe
  C:\Windows\System\fPxAMWh.exe
  2⤵
  PID:6588
- C:\Windows\System\WKffkRs.exe
  C:\Windows\System\WKffkRs.exe
  2⤵
  PID:6604
- C:\Windows\System\cMyQQWe.exe
  C:\Windows\System\cMyQQWe.exe
  2⤵
  PID:6620
- C:\Windows\System\aKriONl.exe
  C:\Windows\System\aKriONl.exe
  2⤵
  PID:6636
- C:\Windows\System\nVEPoUp.exe
  C:\Windows\System\nVEPoUp.exe
  2⤵
  PID:6652
- C:\Windows\System\unqUkVm.exe
  C:\Windows\System\unqUkVm.exe
  2⤵
  PID:6672
- C:\Windows\System\sXfsXwp.exe
  C:\Windows\System\sXfsXwp.exe
  2⤵
  PID:6688
- C:\Windows\System\XYIMHmM.exe
  C:\Windows\System\XYIMHmM.exe
  2⤵
  PID:6712
- C:\Windows\System\UPTuzYs.exe
  C:\Windows\System\UPTuzYs.exe
  2⤵
  PID:6728
- C:\Windows\System\vCOGYWj.exe
  C:\Windows\System\vCOGYWj.exe
  2⤵
  PID:6752
- C:\Windows\System\shUMtxS.exe
  C:\Windows\System\shUMtxS.exe
  2⤵
  PID:6772
- C:\Windows\System\WfelnRi.exe
  C:\Windows\System\WfelnRi.exe
  2⤵
  PID:6792
- C:\Windows\System\pBOMnUr.exe
  C:\Windows\System\pBOMnUr.exe
  2⤵
  PID:6816
- C:\Windows\System\cvEumyv.exe
  C:\Windows\System\cvEumyv.exe
  2⤵
  PID:6836
- C:\Windows\System\ixqGVXK.exe
  C:\Windows\System\ixqGVXK.exe
  2⤵
  PID:6868
- C:\Windows\System\gckhyvA.exe
  C:\Windows\System\gckhyvA.exe
  2⤵
  PID:6888
- C:\Windows\System\ioRgCez.exe
  C:\Windows\System\ioRgCez.exe
  2⤵
  PID:6908
- C:\Windows\System\HmcRuBp.exe
  C:\Windows\System\HmcRuBp.exe
  2⤵
  PID:6932
- C:\Windows\System\QmRvOPV.exe
  C:\Windows\System\QmRvOPV.exe
  2⤵
  PID:6952
- C:\Windows\System\PzJyNVU.exe
  C:\Windows\System\PzJyNVU.exe
  2⤵
  PID:6972
- C:\Windows\System\wdCBAuh.exe
  C:\Windows\System\wdCBAuh.exe
  2⤵
  PID:7000
- C:\Windows\System\OyhadTC.exe
  C:\Windows\System\OyhadTC.exe
  2⤵
  PID:7020
- C:\Windows\System\KAcHUSq.exe
  C:\Windows\System\KAcHUSq.exe
  2⤵
  PID:7044
- C:\Windows\System\zipzFHd.exe
  C:\Windows\System\zipzFHd.exe
  2⤵
  PID:7072
- C:\Windows\System\EHJUHft.exe
  C:\Windows\System\EHJUHft.exe
  2⤵
  PID:7092
- C:\Windows\System\vNVTjHb.exe
  C:\Windows\System\vNVTjHb.exe
  2⤵
  PID:7116
- C:\Windows\System\ZyVjhMC.exe
  C:\Windows\System\ZyVjhMC.exe
  2⤵
  PID:7132
- C:\Windows\System\NBUlowi.exe
  C:\Windows\System\NBUlowi.exe
  2⤵
  PID:7156
- C:\Windows\System\jXRbLCb.exe
  C:\Windows\System\jXRbLCb.exe
  2⤵
  PID:232
- C:\Windows\System\DmNHvzt.exe
  C:\Windows\System\DmNHvzt.exe
  2⤵
  PID:4400
- C:\Windows\System\mqAZJGe.exe
  C:\Windows\System\mqAZJGe.exe
  2⤵
  PID:5040
- C:\Windows\System\HDKNYUb.exe
  C:\Windows\System\HDKNYUb.exe
  2⤵
  PID:5676
- C:\Windows\System\ovnJvhJ.exe
  C:\Windows\System\ovnJvhJ.exe
  2⤵
  PID:5720
- C:\Windows\System\LnEPyCy.exe
  C:\Windows\System\LnEPyCy.exe
  2⤵
  PID:5784
- C:\Windows\System\tWdPglM.exe
  C:\Windows\System\tWdPglM.exe
  2⤵
  PID:5820
- C:\Windows\System\gMuaOVi.exe
  C:\Windows\System\gMuaOVi.exe
  2⤵
  PID:5868
- C:\Windows\System\runkIpw.exe
  C:\Windows\System\runkIpw.exe
  2⤵
  PID:5536
- C:\Windows\System\ocdKqoU.exe
  C:\Windows\System\ocdKqoU.exe
  2⤵
  PID:5236
- C:\Windows\System\TAFJlZE.exe
  C:\Windows\System\TAFJlZE.exe
  2⤵
  PID:5932
- C:\Windows\System\eyeyWtw.exe
  C:\Windows\System\eyeyWtw.exe
  2⤵
  PID:5952
- C:\Windows\System\hJchYCr.exe
  C:\Windows\System\hJchYCr.exe
  2⤵
  PID:6100
- C:\Windows\System\jpuItpy.exe
  C:\Windows\System\jpuItpy.exe
  2⤵
  PID:1808
- C:\Windows\System\oEJptDg.exe
  C:\Windows\System\oEJptDg.exe
  2⤵
  PID:7192
- C:\Windows\System\RVwKrix.exe
  C:\Windows\System\RVwKrix.exe
  2⤵
  PID:7212
- C:\Windows\System\tyUmcyC.exe
  C:\Windows\System\tyUmcyC.exe
  2⤵
  PID:7232
- C:\Windows\System\KcmLqYg.exe
  C:\Windows\System\KcmLqYg.exe
  2⤵
  PID:7260
- C:\Windows\System\qdUECgH.exe
  C:\Windows\System\qdUECgH.exe
  2⤵
  PID:7276
- C:\Windows\System\zvpreBU.exe
  C:\Windows\System\zvpreBU.exe
  2⤵
  PID:7300
- C:\Windows\System\SaeoUkq.exe
  C:\Windows\System\SaeoUkq.exe
  2⤵
  PID:7328
- C:\Windows\System\huoCsqh.exe
  C:\Windows\System\huoCsqh.exe
  2⤵
  PID:7344
- C:\Windows\System\GZIYVGp.exe
  C:\Windows\System\GZIYVGp.exe
  2⤵
  PID:7360
- C:\Windows\System\BFsJSsM.exe
  C:\Windows\System\BFsJSsM.exe
  2⤵
  PID:7380
- C:\Windows\System\XgvoVMt.exe
  C:\Windows\System\XgvoVMt.exe
  2⤵
  PID:7404
- C:\Windows\System\XKDaoVH.exe
  C:\Windows\System\XKDaoVH.exe
  2⤵
  PID:7424
- C:\Windows\System\tjXdPdH.exe
  C:\Windows\System\tjXdPdH.exe
  2⤵
  PID:7444
- C:\Windows\System\OHeSJdC.exe
  C:\Windows\System\OHeSJdC.exe
  2⤵
  PID:7464
- C:\Windows\System\bMsmvow.exe
  C:\Windows\System\bMsmvow.exe
  2⤵
  PID:7484
- C:\Windows\System\iomSgBL.exe
  C:\Windows\System\iomSgBL.exe
  2⤵
  PID:7512
- C:\Windows\System\YRjNZin.exe
  C:\Windows\System\YRjNZin.exe
  2⤵
  PID:7532
- C:\Windows\System\qnHlOwi.exe
  C:\Windows\System\qnHlOwi.exe
  2⤵
  PID:7556
- C:\Windows\System\LfeVSgH.exe
  C:\Windows\System\LfeVSgH.exe
  2⤵
  PID:7572
- C:\Windows\System\dBHZhfB.exe
  C:\Windows\System\dBHZhfB.exe
  2⤵
  PID:7596
- C:\Windows\System\EptKiJG.exe
  C:\Windows\System\EptKiJG.exe
  2⤵
  PID:7620
- C:\Windows\System\OrYqZjB.exe
  C:\Windows\System\OrYqZjB.exe
  2⤵
  PID:7644
- C:\Windows\System\QJclifC.exe
  C:\Windows\System\QJclifC.exe
  2⤵
  PID:7664
- C:\Windows\System\TWjVbLs.exe
  C:\Windows\System\TWjVbLs.exe
  2⤵
  PID:7692
- C:\Windows\System\jMeQgwS.exe
  C:\Windows\System\jMeQgwS.exe
  2⤵
  PID:7708
- C:\Windows\System\JckTHwt.exe
  C:\Windows\System\JckTHwt.exe
  2⤵
  PID:7820
- C:\Windows\System\bCwyMUG.exe
  C:\Windows\System\bCwyMUG.exe
  2⤵
  PID:7904
- C:\Windows\System\aLTGFyp.exe
  C:\Windows\System\aLTGFyp.exe
  2⤵
  PID:7928
- C:\Windows\System\xvKTnxr.exe
  C:\Windows\System\xvKTnxr.exe
  2⤵
  PID:7956
- C:\Windows\System\ktYtSda.exe
  C:\Windows\System\ktYtSda.exe
  2⤵
  PID:7980
- C:\Windows\System\KfuHkwF.exe
  C:\Windows\System\KfuHkwF.exe
  2⤵
  PID:8004
- C:\Windows\System\KBZGvEK.exe
  C:\Windows\System\KBZGvEK.exe
  2⤵
  PID:8024
- C:\Windows\System\RtLwBzM.exe
  C:\Windows\System\RtLwBzM.exe
  2⤵
  PID:8052
- C:\Windows\System\ylLYvAl.exe
  C:\Windows\System\ylLYvAl.exe
  2⤵
  PID:8068
- C:\Windows\System\rqQONcF.exe
  C:\Windows\System\rqQONcF.exe
  2⤵
  PID:8088
- C:\Windows\System\VVQrNkA.exe
  C:\Windows\System\VVQrNkA.exe
  2⤵
  PID:8112
- C:\Windows\System\LSUzrZh.exe
  C:\Windows\System\LSUzrZh.exe
  2⤵
  PID:8132
- C:\Windows\System\GDhdHZW.exe
  C:\Windows\System\GDhdHZW.exe
  2⤵
  PID:8156
- C:\Windows\System\CeJNOvQ.exe
  C:\Windows\System\CeJNOvQ.exe
  2⤵
  PID:8176
- C:\Windows\System\CfDTVMH.exe
  C:\Windows\System\CfDTVMH.exe
  2⤵
  PID:6880
- C:\Windows\System\ngPlmTg.exe
  C:\Windows\System\ngPlmTg.exe
  2⤵
  PID:6940
- C:\Windows\System\wzJcTyw.exe
  C:\Windows\System\wzJcTyw.exe
  2⤵
  PID:7008
- C:\Windows\System\eaHqXum.exe
  C:\Windows\System\eaHqXum.exe
  2⤵
  PID:5324
- C:\Windows\System\mDbTlEg.exe
  C:\Windows\System\mDbTlEg.exe
  2⤵
  PID:5440
- C:\Windows\System\QdKCMxU.exe
  C:\Windows\System\QdKCMxU.exe
  2⤵
  PID:6156
- C:\Windows\System\DYIAaPg.exe
  C:\Windows\System\DYIAaPg.exe
  2⤵
  PID:3324
- C:\Windows\System\LUqdcYt.exe
  C:\Windows\System\LUqdcYt.exe
  2⤵
  PID:5180
- C:\Windows\System\CJQwPfR.exe
  C:\Windows\System\CJQwPfR.exe
  2⤵
  PID:6288
- C:\Windows\System\CMwwLIS.exe
  C:\Windows\System\CMwwLIS.exe
  2⤵
  PID:5800
- C:\Windows\System\CQrwDNA.exe
  C:\Windows\System\CQrwDNA.exe
  2⤵
  PID:6352
- C:\Windows\System\zdigbfK.exe
  C:\Windows\System\zdigbfK.exe
  2⤵
  PID:6396
- C:\Windows\System\hZuNzSx.exe
  C:\Windows\System\hZuNzSx.exe
  2⤵
  PID:5512
- C:\Windows\System\aTeNRcs.exe
  C:\Windows\System\aTeNRcs.exe
  2⤵
  PID:468
- C:\Windows\System\uKoIVdu.exe
  C:\Windows\System\uKoIVdu.exe
  2⤵
  PID:5540
- C:\Windows\System\GatCrBe.exe
  C:\Windows\System\GatCrBe.exe
  2⤵
  PID:7064
- C:\Windows\System\jZceAoP.exe
  C:\Windows\System\jZceAoP.exe
  2⤵
  PID:7124
- C:\Windows\System\qZuwByA.exe
  C:\Windows\System\qZuwByA.exe
  2⤵
  PID:7164
- C:\Windows\System\xfizuTh.exe
  C:\Windows\System\xfizuTh.exe
  2⤵
  PID:7440
- C:\Windows\System\MNJyueX.exe
  C:\Windows\System\MNJyueX.exe
  2⤵
  PID:7460
- C:\Windows\System\CmFhCbT.exe
  C:\Windows\System\CmFhCbT.exe
  2⤵
  PID:7520
- C:\Windows\System\cIiauTL.exe
  C:\Windows\System\cIiauTL.exe
  2⤵
  PID:6480
- C:\Windows\System\SKlthsH.exe
  C:\Windows\System\SKlthsH.exe
  2⤵
  PID:6520
- C:\Windows\System\zBYUGLN.exe
  C:\Windows\System\zBYUGLN.exe
  2⤵
  PID:6596
- C:\Windows\System\EJDgiUk.exe
  C:\Windows\System\EJDgiUk.exe
  2⤵
  PID:6644
- C:\Windows\System\ChOBnfk.exe
  C:\Windows\System\ChOBnfk.exe
  2⤵
  PID:6680
- C:\Windows\System\VnVDziF.exe
  C:\Windows\System\VnVDziF.exe
  2⤵
  PID:6724
- C:\Windows\System\KiBVaVg.exe
  C:\Windows\System\KiBVaVg.exe
  2⤵
  PID:6828
- C:\Windows\System\nybKHkv.exe
  C:\Windows\System\nybKHkv.exe
  2⤵
  PID:6784
- C:\Windows\System\oglxLUy.exe
  C:\Windows\System\oglxLUy.exe
  2⤵
  PID:6904
- C:\Windows\System\yQreBBJ.exe
  C:\Windows\System\yQreBBJ.exe
  2⤵
  PID:7040
- C:\Windows\System\AykZjch.exe
  C:\Windows\System\AykZjch.exe
  2⤵
  PID:7376
- C:\Windows\System\HhKAodQ.exe
  C:\Windows\System\HhKAodQ.exe
  2⤵
  PID:8208
- C:\Windows\System\cmFvNGl.exe
  C:\Windows\System\cmFvNGl.exe
  2⤵
  PID:8232
- C:\Windows\System\PifbLwo.exe
  C:\Windows\System\PifbLwo.exe
  2⤵
  PID:8256
- C:\Windows\System\eZidXpo.exe
  C:\Windows\System\eZidXpo.exe
  2⤵
  PID:8284
- C:\Windows\System\OxXkbkc.exe
  C:\Windows\System\OxXkbkc.exe
  2⤵
  PID:8308
- C:\Windows\System\rEFuMYz.exe
  C:\Windows\System\rEFuMYz.exe
  2⤵
  PID:8328
- C:\Windows\System\dwUkWIn.exe
  C:\Windows\System\dwUkWIn.exe
  2⤵
  PID:8360
- C:\Windows\System\aCJmJHS.exe
  C:\Windows\System\aCJmJHS.exe
  2⤵
  PID:8384
- C:\Windows\System\Shqmeru.exe
  C:\Windows\System\Shqmeru.exe
  2⤵
  PID:8404
- C:\Windows\System\VQEmSse.exe
  C:\Windows\System\VQEmSse.exe
  2⤵
  PID:8428
- C:\Windows\System\aqqquRp.exe
  C:\Windows\System\aqqquRp.exe
  2⤵
  PID:8452
- C:\Windows\System\yzNURkC.exe
  C:\Windows\System\yzNURkC.exe
  2⤵
  PID:8472
- C:\Windows\System\XUQhpwb.exe
  C:\Windows\System\XUQhpwb.exe
  2⤵
  PID:8492
- C:\Windows\System\TwiOdSg.exe
  C:\Windows\System\TwiOdSg.exe
  2⤵
  PID:8512
- C:\Windows\System\XrNHcDK.exe
  C:\Windows\System\XrNHcDK.exe
  2⤵
  PID:8536
- C:\Windows\System\kfAuiGr.exe
  C:\Windows\System\kfAuiGr.exe
  2⤵
  PID:8564
- C:\Windows\System\xwCVpRe.exe
  C:\Windows\System\xwCVpRe.exe
  2⤵
  PID:8592
- C:\Windows\System\zROLldL.exe
  C:\Windows\System\zROLldL.exe
  2⤵
  PID:8608
- C:\Windows\System\jqnhawr.exe
  C:\Windows\System\jqnhawr.exe
  2⤵
  PID:8628
- C:\Windows\System\ydDjvIw.exe
  C:\Windows\System\ydDjvIw.exe
  2⤵
  PID:8656
- C:\Windows\System\WANRlMO.exe
  C:\Windows\System\WANRlMO.exe
  2⤵
  PID:8672
- C:\Windows\System\xvAOOMc.exe
  C:\Windows\System\xvAOOMc.exe
  2⤵
  PID:8696
- C:\Windows\System\EsrRyoy.exe
  C:\Windows\System\EsrRyoy.exe
  2⤵
  PID:8716
- C:\Windows\System\oLOJrCc.exe
  C:\Windows\System\oLOJrCc.exe
  2⤵
  PID:8740
- C:\Windows\System\sBvFyVC.exe
  C:\Windows\System\sBvFyVC.exe
  2⤵
  PID:8760
- C:\Windows\System\wfabBFL.exe
  C:\Windows\System\wfabBFL.exe
  2⤵
  PID:8784
- C:\Windows\System\WPRPkFq.exe
  C:\Windows\System\WPRPkFq.exe
  2⤵
  PID:8804
- C:\Windows\System\jxoPzjL.exe
  C:\Windows\System\jxoPzjL.exe
  2⤵
  PID:8824
- C:\Windows\System\inqFLkw.exe
  C:\Windows\System\inqFLkw.exe
  2⤵
  PID:8840
- C:\Windows\System\PHjoyxH.exe
  C:\Windows\System\PHjoyxH.exe
  2⤵
  PID:8864
- C:\Windows\System\qkhngCy.exe
  C:\Windows\System\qkhngCy.exe
  2⤵
  PID:8888
- C:\Windows\System\TDhlYqr.exe
  C:\Windows\System\TDhlYqr.exe
  2⤵
  PID:8916
- C:\Windows\System\bopzRjz.exe
  C:\Windows\System\bopzRjz.exe
  2⤵
  PID:8940
- C:\Windows\System\AYwhlHh.exe
  C:\Windows\System\AYwhlHh.exe
  2⤵
  PID:8960
- C:\Windows\System\cLWCWgj.exe
  C:\Windows\System\cLWCWgj.exe
  2⤵
  PID:8984
- C:\Windows\System\KhYbPVE.exe
  C:\Windows\System\KhYbPVE.exe
  2⤵
  PID:9004
- C:\Windows\System\qblNgeo.exe
  C:\Windows\System\qblNgeo.exe
  2⤵
  PID:9028
- C:\Windows\System\yWQRmcg.exe
  C:\Windows\System\yWQRmcg.exe
  2⤵
  PID:9052
- C:\Windows\System\BTeLWqh.exe
  C:\Windows\System\BTeLWqh.exe
  2⤵
  PID:9072
- C:\Windows\System\ypPvefY.exe
  C:\Windows\System\ypPvefY.exe
  2⤵
  PID:9092
- C:\Windows\System\nXSjcJL.exe
  C:\Windows\System\nXSjcJL.exe
  2⤵
  PID:9108
- C:\Windows\System\cQDbRkv.exe
  C:\Windows\System\cQDbRkv.exe
  2⤵
  PID:9132
- C:\Windows\System\HruDUHV.exe
  C:\Windows\System\HruDUHV.exe
  2⤵
  PID:9156
- C:\Windows\System\xIhduzW.exe
  C:\Windows\System\xIhduzW.exe
  2⤵
  PID:9172
- C:\Windows\System\fYtzYgV.exe
  C:\Windows\System\fYtzYgV.exe
  2⤵
  PID:9196
- C:\Windows\System\bsBKrIx.exe
  C:\Windows\System\bsBKrIx.exe
  2⤵
  PID:7564
- C:\Windows\System\MjSkObK.exe
  C:\Windows\System\MjSkObK.exe
  2⤵
  PID:5284
- C:\Windows\System\dOEEzPW.exe
  C:\Windows\System\dOEEzPW.exe
  2⤵
  PID:5364
- C:\Windows\System\peGXrmG.exe
  C:\Windows\System\peGXrmG.exe
  2⤵
  PID:7108
- C:\Windows\System\VRxAhfG.exe
  C:\Windows\System\VRxAhfG.exe
  2⤵
  PID:6252
- C:\Windows\System\BTzxIyP.exe
  C:\Windows\System\BTzxIyP.exe
  2⤵
  PID:6336
- C:\Windows\System\YZpbMEH.exe
  C:\Windows\System\YZpbMEH.exe
  2⤵
  PID:2276
- C:\Windows\System\lkBXxsA.exe
  C:\Windows\System\lkBXxsA.exe
  2⤵
  PID:7140
- C:\Windows\System\NUwkiWF.exe
  C:\Windows\System\NUwkiWF.exe
  2⤵
  PID:4340
- C:\Windows\System\hQEyZyz.exe
  C:\Windows\System\hQEyZyz.exe
  2⤵
  PID:4556
- C:\Windows\System\dJVkORS.exe
  C:\Windows\System\dJVkORS.exe
  2⤵
  PID:6856
- C:\Windows\System\zSLGfnW.exe
  C:\Windows\System\zSLGfnW.exe
  2⤵
  PID:7204
- C:\Windows\System\qXOjyCe.exe
  C:\Windows\System\qXOjyCe.exe
  2⤵
  PID:7252
- C:\Windows\System\Voopezn.exe
  C:\Windows\System\Voopezn.exe
  2⤵
  PID:7392
- C:\Windows\System\ZUNTNEH.exe
  C:\Windows\System\ZUNTNEH.exe
  2⤵
  PID:7432
- C:\Windows\System\BkdfWIo.exe
  C:\Windows\System\BkdfWIo.exe
  2⤵
  PID:8220
- C:\Windows\System\bOyjFzb.exe
  C:\Windows\System\bOyjFzb.exe
  2⤵
  PID:8060
- C:\Windows\System\wSxncoE.exe
  C:\Windows\System\wSxncoE.exe
  2⤵
  PID:9236
- C:\Windows\System\KdkqtuA.exe
  C:\Windows\System\KdkqtuA.exe
  2⤵
  PID:9256
- C:\Windows\System\DejiELU.exe
  C:\Windows\System\DejiELU.exe
  2⤵
  PID:9276
- C:\Windows\System\jIKtUuy.exe
  C:\Windows\System\jIKtUuy.exe
  2⤵
  PID:9296
- C:\Windows\System\OQaamqz.exe
  C:\Windows\System\OQaamqz.exe
  2⤵
  PID:9320
- C:\Windows\System\zZhkkPV.exe
  C:\Windows\System\zZhkkPV.exe
  2⤵
  PID:9348
- C:\Windows\System\wXUOYJI.exe
  C:\Windows\System\wXUOYJI.exe
  2⤵
  PID:9368
- C:\Windows\System\hEsIvBZ.exe
  C:\Windows\System\hEsIvBZ.exe
  2⤵
  PID:9396
- C:\Windows\System\KuWVrME.exe
  C:\Windows\System\KuWVrME.exe
  2⤵
  PID:9424
- C:\Windows\System\lSPuYeb.exe
  C:\Windows\System\lSPuYeb.exe
  2⤵
  PID:9440
- C:\Windows\System\kcCFBTg.exe
  C:\Windows\System\kcCFBTg.exe
  2⤵
  PID:9456
- C:\Windows\System\xYwgytW.exe
  C:\Windows\System\xYwgytW.exe
  2⤵
  PID:9472
- C:\Windows\System\TAecFoA.exe
  C:\Windows\System\TAecFoA.exe
  2⤵
  PID:9496
- C:\Windows\System\IBMGZQb.exe
  C:\Windows\System\IBMGZQb.exe
  2⤵
  PID:9512
- C:\Windows\System\tToVoGw.exe
  C:\Windows\System\tToVoGw.exe
  2⤵
  PID:9536
- C:\Windows\System\eikMGRA.exe
  C:\Windows\System\eikMGRA.exe
  2⤵
  PID:9556
- C:\Windows\System\aZALomh.exe
  C:\Windows\System\aZALomh.exe
  2⤵
  PID:9576
- C:\Windows\System\AIigIai.exe
  C:\Windows\System\AIigIai.exe
  2⤵
  PID:9600
- C:\Windows\System\SrIwkeR.exe
  C:\Windows\System\SrIwkeR.exe
  2⤵
  PID:9620
- C:\Windows\System\VohYRtZ.exe
  C:\Windows\System\VohYRtZ.exe
  2⤵
  PID:9664
- C:\Windows\System\KHfXTqt.exe
  C:\Windows\System\KHfXTqt.exe
  2⤵
  PID:9688
- C:\Windows\System\eKZwLHD.exe
  C:\Windows\System\eKZwLHD.exe
  2⤵
  PID:9708
- C:\Windows\System\nIxsLfL.exe
  C:\Windows\System\nIxsLfL.exe
  2⤵
  PID:9728
- C:\Windows\System\CfumvMI.exe
  C:\Windows\System\CfumvMI.exe
  2⤵
  PID:9844
- C:\Windows\System\CspUyOP.exe
  C:\Windows\System\CspUyOP.exe
  2⤵
  PID:9868
- C:\Windows\System\WXEvglv.exe
  C:\Windows\System\WXEvglv.exe
  2⤵
  PID:9892
- C:\Windows\System\gnRLdec.exe
  C:\Windows\System\gnRLdec.exe
  2⤵
  PID:9916
- C:\Windows\System\xefIlXU.exe
  C:\Windows\System\xefIlXU.exe
  2⤵
  PID:9940
- C:\Windows\System\GQJjsAm.exe
  C:\Windows\System\GQJjsAm.exe
  2⤵
  PID:9968
- C:\Windows\System\VNQGieL.exe
  C:\Windows\System\VNQGieL.exe
  2⤵
  PID:9992
- C:\Windows\System\nJAzDxb.exe
  C:\Windows\System\nJAzDxb.exe
  2⤵
  PID:10012
- C:\Windows\System\srLOkus.exe
  C:\Windows\System\srLOkus.exe
  2⤵
  PID:10036
- C:\Windows\System\orkXSzH.exe
  C:\Windows\System\orkXSzH.exe
  2⤵
  PID:10052
- C:\Windows\System\LoXqFHZ.exe
  C:\Windows\System\LoXqFHZ.exe
  2⤵
  PID:10076
- C:\Windows\System\SQWhEVb.exe
  C:\Windows\System\SQWhEVb.exe
  2⤵
  PID:10104
- C:\Windows\System\rCswVve.exe
  C:\Windows\System\rCswVve.exe
  2⤵
  PID:10128
- C:\Windows\System\pyIyohS.exe
  C:\Windows\System\pyIyohS.exe
  2⤵
  PID:10152
- C:\Windows\System\whsivFr.exe
  C:\Windows\System\whsivFr.exe
  2⤵
  PID:10176
- C:\Windows\System\PDZjAWc.exe
  C:\Windows\System\PDZjAWc.exe
  2⤵
  PID:10196
- C:\Windows\System\oifyzOU.exe
  C:\Windows\System\oifyzOU.exe
  2⤵
  PID:10228
- C:\Windows\System\hAjSXBb.exe
  C:\Windows\System\hAjSXBb.exe
  2⤵
  PID:8392
- C:\Windows\System\KqGmjoz.exe
  C:\Windows\System\KqGmjoz.exe
  2⤵
  PID:8460
- C:\Windows\System\mbjNZwn.exe
  C:\Windows\System\mbjNZwn.exe
  2⤵
  PID:8504
- C:\Windows\System\sVspQHS.exe
  C:\Windows\System\sVspQHS.exe
  2⤵
  PID:8600
- C:\Windows\System\wtuUTqF.exe
  C:\Windows\System\wtuUTqF.exe
  2⤵
  PID:6340
- C:\Windows\System\iEfEOrz.exe
  C:\Windows\System\iEfEOrz.exe
  2⤵
  PID:8952
- C:\Windows\System\lHkVITc.exe
  C:\Windows\System\lHkVITc.exe
  2⤵
  PID:7804
- C:\Windows\System\copbnlt.exe
  C:\Windows\System\copbnlt.exe
  2⤵
  PID:2336
- C:\Windows\System\UJSMAvj.exe
  C:\Windows\System\UJSMAvj.exe
  2⤵
  PID:8268
- C:\Windows\System\vEcLgKZ.exe
  C:\Windows\System\vEcLgKZ.exe
  2⤵
  PID:7500
- C:\Windows\System\lbAgpPp.exe
  C:\Windows\System\lbAgpPp.exe
  2⤵
  PID:8300
- C:\Windows\System\nfMvioZ.exe
  C:\Windows\System\nfMvioZ.exe
  2⤵
  PID:8048
- C:\Windows\System\KWZTgeo.exe
  C:\Windows\System\KWZTgeo.exe
  2⤵
  PID:9284
- C:\Windows\System\BOlaKFp.exe
  C:\Windows\System\BOlaKFp.exe
  2⤵
  PID:8448
- C:\Windows\System\HanneKk.exe
  C:\Windows\System\HanneKk.exe
  2⤵
  PID:5132
- C:\Windows\System\SHmisjr.exe
  C:\Windows\System\SHmisjr.exe
  2⤵
  PID:9468
- C:\Windows\System\OzKSxQc.exe
  C:\Windows\System\OzKSxQc.exe
  2⤵
  PID:8664
- C:\Windows\System\MBjlYpr.exe
  C:\Windows\System\MBjlYpr.exe
  2⤵
  PID:10248
- C:\Windows\System\MhdHQdC.exe
  C:\Windows\System\MhdHQdC.exe
  2⤵
  PID:10264
- C:\Windows\System\YwRwgyB.exe
  C:\Windows\System\YwRwgyB.exe
  2⤵
  PID:10280
- C:\Windows\System\JCIvniV.exe
  C:\Windows\System\JCIvniV.exe
  2⤵
  PID:10304
- C:\Windows\System\SLRMnLz.exe
  C:\Windows\System\SLRMnLz.exe
  2⤵
  PID:10324
- C:\Windows\System\ymUzDvN.exe
  C:\Windows\System\ymUzDvN.exe
  2⤵
  PID:10348
- C:\Windows\System\mwBeODE.exe
  C:\Windows\System\mwBeODE.exe
  2⤵
  PID:10372
- C:\Windows\System\fdxHsvL.exe
  C:\Windows\System\fdxHsvL.exe
  2⤵
  PID:10392
- C:\Windows\System\ZgcbJFW.exe
  C:\Windows\System\ZgcbJFW.exe
  2⤵
  PID:10416
- C:\Windows\System\BwoSPls.exe
  C:\Windows\System\BwoSPls.exe
  2⤵
  PID:10448
- C:\Windows\System\JZtpoSQ.exe
  C:\Windows\System\JZtpoSQ.exe
  2⤵
  PID:10468
- C:\Windows\System\tFztmFR.exe
  C:\Windows\System\tFztmFR.exe
  2⤵
  PID:10488
- C:\Windows\System\KeSfacD.exe
  C:\Windows\System\KeSfacD.exe
  2⤵
  PID:10520
- C:\Windows\System\zFXgMIb.exe
  C:\Windows\System\zFXgMIb.exe
  2⤵
  PID:10536
- C:\Windows\System\fUgekrC.exe
  C:\Windows\System\fUgekrC.exe
  2⤵
  PID:10552
- C:\Windows\System\NlnxobD.exe
  C:\Windows\System\NlnxobD.exe
  2⤵
  PID:10572
- C:\Windows\System\MbnPOUn.exe
  C:\Windows\System\MbnPOUn.exe
  2⤵
  PID:10604
- C:\Windows\System\hUZboUe.exe
  C:\Windows\System\hUZboUe.exe
  2⤵
  PID:10632
- C:\Windows\System\iyDeyuf.exe
  C:\Windows\System\iyDeyuf.exe
  2⤵
  PID:10656
- C:\Windows\System\hKjSpxi.exe
  C:\Windows\System\hKjSpxi.exe
  2⤵
  PID:10684
- C:\Windows\System\EhOetMs.exe
  C:\Windows\System\EhOetMs.exe
  2⤵
  PID:10716
- C:\Windows\System\sRMSYKk.exe
  C:\Windows\System\sRMSYKk.exe
  2⤵
  PID:10732
- C:\Windows\System\NIOZyxj.exe
  C:\Windows\System\NIOZyxj.exe
  2⤵
  PID:10748
- C:\Windows\System\ToWSjgQ.exe
  C:\Windows\System\ToWSjgQ.exe
  2⤵
  PID:10772
- C:\Windows\System\NUwPIUN.exe
  C:\Windows\System\NUwPIUN.exe
  2⤵
  PID:10816
- C:\Windows\System\toCezXp.exe
  C:\Windows\System\toCezXp.exe
  2⤵
  PID:10840
- C:\Windows\System\KdcUeqQ.exe
  C:\Windows\System\KdcUeqQ.exe
  2⤵
  PID:10864
- C:\Windows\System\BMHGiaC.exe
  C:\Windows\System\BMHGiaC.exe
  2⤵
  PID:10884
- C:\Windows\System\ppGLnWu.exe
  C:\Windows\System\ppGLnWu.exe
  2⤵
  PID:10904
- C:\Windows\System\nfFkbAL.exe
  C:\Windows\System\nfFkbAL.exe
  2⤵
  PID:10928
- C:\Windows\System\oShHmGn.exe
  C:\Windows\System\oShHmGn.exe
  2⤵
  PID:10948
- C:\Windows\System\KTvReIg.exe
  C:\Windows\System\KTvReIg.exe
  2⤵
  PID:10972
- C:\Windows\System\BaquvyJ.exe
  C:\Windows\System\BaquvyJ.exe
  2⤵
  PID:10992
- C:\Windows\System\mzVvgKC.exe
  C:\Windows\System\mzVvgKC.exe
  2⤵
  PID:11012
- C:\Windows\System\IsIkWMZ.exe
  C:\Windows\System\IsIkWMZ.exe
  2⤵
  PID:11036
- C:\Windows\System\mhxoqIx.exe
  C:\Windows\System\mhxoqIx.exe
  2⤵
  PID:11056
- C:\Windows\System\lDfQpQU.exe
  C:\Windows\System\lDfQpQU.exe
  2⤵
  PID:11080
- C:\Windows\System\NernpYZ.exe
  C:\Windows\System\NernpYZ.exe
  2⤵
  PID:11100
- C:\Windows\System\BaIJEhw.exe
  C:\Windows\System\BaIJEhw.exe
  2⤵
  PID:11124
- C:\Windows\System\wsCrDHE.exe
  C:\Windows\System\wsCrDHE.exe
  2⤵
  PID:11144
- C:\Windows\System\YQWQoxv.exe
  C:\Windows\System\YQWQoxv.exe
  2⤵
  PID:11164
- C:\Windows\System\INuqYHU.exe
  C:\Windows\System\INuqYHU.exe
  2⤵
  PID:11184
- C:\Windows\System\AVTGpSR.exe
  C:\Windows\System\AVTGpSR.exe
  2⤵
  PID:11208
- C:\Windows\System\ugPRYzb.exe
  C:\Windows\System\ugPRYzb.exe
  2⤵
  PID:11232
- C:\Windows\System\YPLXDrf.exe
  C:\Windows\System\YPLXDrf.exe
  2⤵
  PID:11252
- C:\Windows\System\ILyWbUr.exe
  C:\Windows\System\ILyWbUr.exe
  2⤵
  PID:2440
- C:\Windows\System\WuMCdlL.exe
  C:\Windows\System\WuMCdlL.exe
  2⤵
  PID:9588
- C:\Windows\System\TGQXQkb.exe
  C:\Windows\System\TGQXQkb.exe
  2⤵
  PID:6900
- C:\Windows\System\ReuZlys.exe
  C:\Windows\System\ReuZlys.exe
  2⤵
  PID:8956
- C:\Windows\System\QgPmyuI.exe
  C:\Windows\System\QgPmyuI.exe
  2⤵
  PID:9016
- C:\Windows\System\jPxCSuR.exe
  C:\Windows\System\jPxCSuR.exe
  2⤵
  PID:9044
- C:\Windows\System\RfAMFYt.exe
  C:\Windows\System\RfAMFYt.exe
  2⤵
  PID:9720
- C:\Windows\System\hbpZBmd.exe
  C:\Windows\System\hbpZBmd.exe
  2⤵
  PID:7676
- C:\Windows\System\sJdltvy.exe
  C:\Windows\System\sJdltvy.exe
  2⤵
  PID:6496
- C:\Windows\System\dHjpusE.exe
  C:\Windows\System\dHjpusE.exe
  2⤵
  PID:6612
- C:\Windows\System\mBKdCgR.exe
  C:\Windows\System\mBKdCgR.exe
  2⤵
  PID:6696
- C:\Windows\System\SDdGzaT.exe
  C:\Windows\System\SDdGzaT.exe
  2⤵
  PID:6788
- C:\Windows\System\LbtGoMq.exe
  C:\Windows\System\LbtGoMq.exe
  2⤵
  PID:7864
- C:\Windows\System\DzNkLcl.exe
  C:\Windows\System\DzNkLcl.exe
  2⤵
  PID:8248
- C:\Windows\System\jUhKmlF.exe
  C:\Windows\System\jUhKmlF.exe
  2⤵
  PID:9952
- C:\Windows\System\ZZERwhv.exe
  C:\Windows\System\ZZERwhv.exe
  2⤵
  PID:6384
- C:\Windows\System\eETTmWI.exe
  C:\Windows\System\eETTmWI.exe
  2⤵
  PID:10084
- C:\Windows\System\DKWpsWE.exe
  C:\Windows\System\DKWpsWE.exe
  2⤵
  PID:8340
- C:\Windows\System\RwLNdWb.exe
  C:\Windows\System\RwLNdWb.exe
  2⤵
  PID:10148
- C:\Windows\System\uwuntLS.exe
  C:\Windows\System\uwuntLS.exe
  2⤵
  PID:8040
- C:\Windows\System\PFfzRjv.exe
  C:\Windows\System\PFfzRjv.exe
  2⤵
  PID:9220
- C:\Windows\System\IKkXvwQ.exe
  C:\Windows\System\IKkXvwQ.exe
  2⤵
  PID:9268
- C:\Windows\System\ZLkGNvS.exe
  C:\Windows\System\ZLkGNvS.exe
  2⤵
  PID:9288
- C:\Windows\System\xLDPemt.exe
  C:\Windows\System\xLDPemt.exe
  2⤵
  PID:9340
- C:\Windows\System\zLYdiuQ.exe
  C:\Windows\System\zLYdiuQ.exe
  2⤵
  PID:7768
- C:\Windows\System\JiRlRAA.exe
  C:\Windows\System\JiRlRAA.exe
  2⤵
  PID:8508
- C:\Windows\System\YjhuopL.exe
  C:\Windows\System\YjhuopL.exe
  2⤵
  PID:9464
- C:\Windows\System\sSpuSGn.exe
  C:\Windows\System\sSpuSGn.exe
  2⤵
  PID:7988
- C:\Windows\System\WIUQPjy.exe
  C:\Windows\System\WIUQPjy.exe
  2⤵
  PID:8636
- C:\Windows\System\GHAkEZc.exe
  C:\Windows\System\GHAkEZc.exe
  2⤵
  PID:8704
- C:\Windows\System\wRpuBqa.exe
  C:\Windows\System\wRpuBqa.exe
  2⤵
  PID:7016
- C:\Windows\System\UdPjcAN.exe
  C:\Windows\System\UdPjcAN.exe
  2⤵
  PID:10260
- C:\Windows\System\BWWYyoa.exe
  C:\Windows\System\BWWYyoa.exe
  2⤵
  PID:10320
- C:\Windows\System\xsZZAjH.exe
  C:\Windows\System\xsZZAjH.exe
  2⤵
  PID:11276
- C:\Windows\System\PyqrBpf.exe
  C:\Windows\System\PyqrBpf.exe
  2⤵
  PID:11296
- C:\Windows\System\UnDhqrS.exe
  C:\Windows\System\UnDhqrS.exe
  2⤵
  PID:11320
- C:\Windows\System\juOXLAd.exe
  C:\Windows\System\juOXLAd.exe
  2⤵
  PID:11344
- C:\Windows\System\qltmfTZ.exe
  C:\Windows\System\qltmfTZ.exe
  2⤵
  PID:11372
- C:\Windows\System\WcJJbnK.exe
  C:\Windows\System\WcJJbnK.exe
  2⤵
  PID:11404
- C:\Windows\System\tawlUTP.exe
  C:\Windows\System\tawlUTP.exe
  2⤵
  PID:11432
- C:\Windows\System\SvFEbDg.exe
  C:\Windows\System\SvFEbDg.exe
  2⤵
  PID:11456
- C:\Windows\System\shbQTPK.exe
  C:\Windows\System\shbQTPK.exe
  2⤵
  PID:11480
- C:\Windows\System\dAfvHaV.exe
  C:\Windows\System\dAfvHaV.exe
  2⤵
  PID:11504
- C:\Windows\System\KAcvrEP.exe
  C:\Windows\System\KAcvrEP.exe
  2⤵
  PID:11532
- C:\Windows\System\OGmiWcT.exe
  C:\Windows\System\OGmiWcT.exe
  2⤵
  PID:11552
- C:\Windows\System\tnJHrmp.exe
  C:\Windows\System\tnJHrmp.exe
  2⤵
  PID:11568
- C:\Windows\System\IgVVcPW.exe
  C:\Windows\System\IgVVcPW.exe
  2⤵
  PID:11592
- C:\Windows\System\yZaonEI.exe
  C:\Windows\System\yZaonEI.exe
  2⤵
  PID:11620
- C:\Windows\System\YPzMyjS.exe
  C:\Windows\System\YPzMyjS.exe
  2⤵
  PID:11640
- C:\Windows\System\tAaYPBR.exe
  C:\Windows\System\tAaYPBR.exe
  2⤵
  PID:11668
- C:\Windows\System\reDVaGc.exe
  C:\Windows\System\reDVaGc.exe
  2⤵
  PID:11692
- C:\Windows\System\jhuihBm.exe
  C:\Windows\System\jhuihBm.exe
  2⤵
  PID:12020
- C:\Windows\System\eclSjyi.exe
  C:\Windows\System\eclSjyi.exe
  2⤵
  PID:12040
- C:\Windows\System\hrQzuov.exe
  C:\Windows\System\hrQzuov.exe
  2⤵
  PID:8776
- C:\Windows\System\mCehGNY.exe
  C:\Windows\System\mCehGNY.exe
  2⤵
  PID:8816
- C:\Windows\System\Tbppnfe.exe
  C:\Windows\System\Tbppnfe.exe
  2⤵
  PID:8848
- C:\Windows\System\CDkqGFe.exe
  C:\Windows\System\CDkqGFe.exe
  2⤵
  PID:8880
- C:\Windows\System\aWGpmpA.exe
  C:\Windows\System\aWGpmpA.exe
  2⤵
  PID:8908
- C:\Windows\System\nuztNkT.exe
  C:\Windows\System\nuztNkT.exe
  2⤵
  PID:10460
- C:\Windows\System\ttGnZdj.exe
  C:\Windows\System\ttGnZdj.exe
  2⤵
  PID:9696
- C:\Windows\System\nYFqchn.exe
  C:\Windows\System\nYFqchn.exe
  2⤵
  PID:10544
- C:\Windows\System\vmJOghF.exe
  C:\Windows\System\vmJOghF.exe
  2⤵
  PID:9140
- C:\Windows\System\XfnWyaY.exe
  C:\Windows\System\XfnWyaY.exe
  2⤵
  PID:404
- C:\Windows\System\qulLrSV.exe
  C:\Windows\System\qulLrSV.exe
  2⤵
  PID:7912
- C:\Windows\System\MuAuUjN.exe
  C:\Windows\System\MuAuUjN.exe
  2⤵
  PID:7972
- C:\Windows\System\AeawuSt.exe
  C:\Windows\System\AeawuSt.exe
  2⤵
  PID:7636
- C:\Windows\System\UivixKb.exe
  C:\Windows\System\UivixKb.exe
  2⤵
  PID:5896
- C:\Windows\System\VuupWGx.exe
  C:\Windows\System\VuupWGx.exe
  2⤵
  PID:60
- C:\Windows\System\nbPeAoW.exe
  C:\Windows\System\nbPeAoW.exe
  2⤵
  PID:6852
- C:\Windows\System\QDQtdVG.exe
  C:\Windows\System\QDQtdVG.exe
  2⤵
  PID:10144
- C:\Windows\System\vNLyUvn.exe
  C:\Windows\System\vNLyUvn.exe
  2⤵
  PID:8064
- C:\Windows\System\iTSaxxM.exe
  C:\Windows\System\iTSaxxM.exe
  2⤵
  PID:9484
- C:\Windows\System\anXodlX.exe
  C:\Windows\System\anXodlX.exe
  2⤵
  PID:10272
- C:\Windows\System\OjlwmtC.exe
  C:\Windows\System\OjlwmtC.exe
  2⤵
  PID:10412
- C:\Windows\System\KqRqzEw.exe
  C:\Windows\System\KqRqzEw.exe
  2⤵
  PID:10436
- C:\Windows\System\VlHxMpd.exe
  C:\Windows\System\VlHxMpd.exe
  2⤵
  PID:11452
- C:\Windows\System\LQZUvos.exe
  C:\Windows\System\LQZUvos.exe
  2⤵
  PID:2524
- C:\Windows\System\YgqgvwG.exe
  C:\Windows\System\YgqgvwG.exe
  2⤵
  PID:12400
- C:\Windows\System\QzBCnRM.exe
  C:\Windows\System\QzBCnRM.exe
  2⤵
  PID:12420
- C:\Windows\System\nWOVGSH.exe
  C:\Windows\System\nWOVGSH.exe
  2⤵
  PID:12436
- C:\Windows\System\RJrobcb.exe
  C:\Windows\System\RJrobcb.exe
  2⤵
  PID:12452
- C:\Windows\System\tsPcGik.exe
  C:\Windows\System\tsPcGik.exe
  2⤵
  PID:12472
- C:\Windows\System\Keridza.exe
  C:\Windows\System\Keridza.exe
  2⤵
  PID:12496
- C:\Windows\System\lbaBHCp.exe
  C:\Windows\System\lbaBHCp.exe
  2⤵
  PID:12520
- C:\Windows\System\YvRZChi.exe
  C:\Windows\System\YvRZChi.exe
  2⤵
  PID:12544
- C:\Windows\System\KaNFtrl.exe
  C:\Windows\System\KaNFtrl.exe
  2⤵
  PID:12568
- C:\Windows\System\SvWNyKu.exe
  C:\Windows\System\SvWNyKu.exe
  2⤵
  PID:12592
- C:\Windows\System\XONpFor.exe
  C:\Windows\System\XONpFor.exe
  2⤵
  PID:12612
- C:\Windows\System\lkpfUsf.exe
  C:\Windows\System\lkpfUsf.exe
  2⤵
  PID:12636
- C:\Windows\System\IjZFmLP.exe
  C:\Windows\System\IjZFmLP.exe
  2⤵
  PID:12660
- C:\Windows\System\gyMLkjx.exe
  C:\Windows\System\gyMLkjx.exe
  2⤵
  PID:12684
- C:\Windows\System\LsscaNL.exe
  C:\Windows\System\LsscaNL.exe
  2⤵
  PID:12708
- C:\Windows\System\phaxbth.exe
  C:\Windows\System\phaxbth.exe
  2⤵
  PID:12732
- C:\Windows\System\IyxtrvI.exe
  C:\Windows\System\IyxtrvI.exe
  2⤵
  PID:12752
- C:\Windows\System\TlzmGIi.exe
  C:\Windows\System\TlzmGIi.exe
  2⤵
  PID:12776
- C:\Windows\System\DBiHqQt.exe
  C:\Windows\System\DBiHqQt.exe
  2⤵
  PID:12804
- C:\Windows\System\kbzsleL.exe
  C:\Windows\System\kbzsleL.exe
  2⤵
  PID:12828
- C:\Windows\System\fcHFGBC.exe
  C:\Windows\System\fcHFGBC.exe
  2⤵
  PID:12848
- C:\Windows\System\aVdIifs.exe
  C:\Windows\System\aVdIifs.exe
  2⤵
  PID:12876
- C:\Windows\System\wHYvwMJ.exe
  C:\Windows\System\wHYvwMJ.exe
  2⤵
  PID:12892
- C:\Windows\System\MpnizoW.exe
  C:\Windows\System\MpnizoW.exe
  2⤵
  PID:12912
- C:\Windows\System\geiUwQI.exe
  C:\Windows\System\geiUwQI.exe
  2⤵
  PID:12936
- C:\Windows\System\jitFEze.exe
  C:\Windows\System\jitFEze.exe
  2⤵
  PID:12964
- C:\Windows\System\lJorIiH.exe
  C:\Windows\System\lJorIiH.exe
  2⤵
  PID:12980
- C:\Windows\System\JBnqwmm.exe
  C:\Windows\System\JBnqwmm.exe
  2⤵
  PID:12996
- C:\Windows\System\rzYrnDU.exe
  C:\Windows\System\rzYrnDU.exe
  2⤵
  PID:13024
- C:\Windows\System\DPErbUX.exe
  C:\Windows\System\DPErbUX.exe
  2⤵
  PID:13044
- C:\Windows\System\jghPzNA.exe
  C:\Windows\System\jghPzNA.exe
  2⤵
  PID:13076
- C:\Windows\System\xaCJllZ.exe
  C:\Windows\System\xaCJllZ.exe
  2⤵
  PID:13092
- C:\Windows\System\tvJsEFz.exe
  C:\Windows\System\tvJsEFz.exe
  2⤵
  PID:13116
- C:\Windows\System\vgBVfCh.exe
  C:\Windows\System\vgBVfCh.exe
  2⤵
  PID:13144
- C:\Windows\System\JeGorGC.exe
  C:\Windows\System\JeGorGC.exe
  2⤵
  PID:13164
- C:\Windows\System\hqmhCct.exe
  C:\Windows\System\hqmhCct.exe
  2⤵
  PID:13184
- C:\Windows\System\ajXaGqv.exe
  C:\Windows\System\ajXaGqv.exe
  2⤵
  PID:13212
- C:\Windows\System\AvHjGHs.exe
  C:\Windows\System\AvHjGHs.exe
  2⤵
  PID:13228
- C:\Windows\System\qkiSYFW.exe
  C:\Windows\System\qkiSYFW.exe
  2⤵
  PID:13248
- C:\Windows\System\sXbrWhr.exe
  C:\Windows\System\sXbrWhr.exe
  2⤵
  PID:13272
- C:\Windows\System\wDXcDdL.exe
  C:\Windows\System\wDXcDdL.exe
  2⤵
  PID:13296
- C:\Windows\System\vGJbotu.exe
  C:\Windows\System\vGJbotu.exe
  2⤵
  PID:3896
- C:\Windows\System\osGcOwp.exe
  C:\Windows\System\osGcOwp.exe
  2⤵
  PID:9852
- C:\Windows\System\oUOHQjH.exe
  C:\Windows\System\oUOHQjH.exe
  2⤵
  PID:9900
- C:\Windows\System\LhChajG.exe
  C:\Windows\System\LhChajG.exe
  2⤵
  PID:10120
- C:\Windows\System\zOHhbbr.exe
  C:\Windows\System\zOHhbbr.exe
  2⤵
  PID:6992
- C:\Windows\System\iwfqsHz.exe
  C:\Windows\System\iwfqsHz.exe
  2⤵
  PID:8032
- C:\Windows\System\dUvpsWy.exe
  C:\Windows\System\dUvpsWy.exe
  2⤵
  PID:10340
- C:\Windows\System\EwKJcsJ.exe
  C:\Windows\System\EwKJcsJ.exe
  2⤵
  PID:11268
- C:\Windows\System\UBZnuQw.exe
  C:\Windows\System\UBZnuQw.exe
  2⤵
  PID:4304
- C:\Windows\System\bsqijQb.exe
  C:\Windows\System\bsqijQb.exe
  2⤵
  PID:9148
- C:\Windows\System\ZRLazwi.exe
  C:\Windows\System\ZRLazwi.exe
  2⤵
  PID:8096
- C:\Windows\System\ztRVgpi.exe
  C:\Windows\System\ztRVgpi.exe
  2⤵
  PID:10504
- C:\Windows\System\rQlsOEY.exe
  C:\Windows\System\rQlsOEY.exe
  2⤵
  PID:11600
- C:\Windows\System\UhYuxQN.exe
  C:\Windows\System\UhYuxQN.exe
  2⤵
  PID:9316
- C:\Windows\System\RrFUtid.exe
  C:\Windows\System\RrFUtid.exe
  2⤵
  PID:11632
- C:\Windows\System\DRDHYfY.exe
  C:\Windows\System\DRDHYfY.exe
  2⤵
  PID:11656
- C:\Windows\System\weTkiUE.exe
  C:\Windows\System\weTkiUE.exe
  2⤵
  PID:10588
- C:\Windows\System\FUKIxsM.exe
  C:\Windows\System\FUKIxsM.exe
  2⤵
  PID:10620
- C:\Windows\System\RVeRHFb.exe
  C:\Windows\System\RVeRHFb.exe
  2⤵
  PID:10640
- C:\Windows\System\HdRPdwH.exe
  C:\Windows\System\HdRPdwH.exe
  2⤵
  PID:10676
- C:\Windows\System\IajdZwg.exe
  C:\Windows\System\IajdZwg.exe
  2⤵
  PID:10728
- C:\Windows\System\MvyuIdR.exe
  C:\Windows\System\MvyuIdR.exe
  2⤵
  PID:10784
- C:\Windows\System\FvQgyFP.exe
  C:\Windows\System\FvQgyFP.exe
  2⤵
  PID:10836
- C:\Windows\System\QnaeBzg.exe
  C:\Windows\System\QnaeBzg.exe
  2⤵
  PID:10924
- C:\Windows\System\JdbOqGD.exe
  C:\Windows\System\JdbOqGD.exe
  2⤵
  PID:10960
- C:\Windows\System\LlzFYyU.exe
  C:\Windows\System\LlzFYyU.exe
  2⤵
  PID:11020
- C:\Windows\System\kYOjFRH.exe
  C:\Windows\System\kYOjFRH.exe
  2⤵
  PID:1652
- C:\Windows\System\PijvIhY.exe
  C:\Windows\System\PijvIhY.exe
  2⤵
  PID:4808
- C:\Windows\System\SEFupAN.exe
  C:\Windows\System\SEFupAN.exe
  2⤵
  PID:13240
- C:\Windows\System\JQRnTfy.exe
  C:\Windows\System\JQRnTfy.exe
  2⤵
  PID:8488
- C:\Windows\System\cVKxBCm.exe
  C:\Windows\System\cVKxBCm.exe
  2⤵
  PID:12356
- C:\Windows\System\ChyzJvh.exe
  C:\Windows\System\ChyzJvh.exe
  2⤵
  PID:11448
- C:\Windows\System\vURepoY.exe
  C:\Windows\System\vURepoY.exe
  2⤵
  PID:12464
- C:\Windows\System\OAZchnH.exe
  C:\Windows\System\OAZchnH.exe
  2⤵
  PID:12872
- C:\Windows\System\lhaLmDE.exe
  C:\Windows\System\lhaLmDE.exe
  2⤵
  PID:12080
- C:\Windows\System\wtsDahD.exe
  C:\Windows\System\wtsDahD.exe
  2⤵
  PID:12608
- C:\Windows\System\UtoUWHT.exe
  C:\Windows\System\UtoUWHT.exe
  2⤵
  PID:9040
- C:\Windows\System\IDXcsIp.exe
  C:\Windows\System\IDXcsIp.exe
  2⤵
  PID:12088
- C:\Windows\System\LiIoleE.exe
  C:\Windows\System\LiIoleE.exe
  2⤵
  PID:12112
- C:\Windows\System\HEFKPDG.exe
  C:\Windows\System\HEFKPDG.exe
  2⤵
  PID:12128
- C:\Windows\System\DgHLpdV.exe
  C:\Windows\System\DgHLpdV.exe
  2⤵
  PID:12140
- C:\Windows\System\RlGtEkt.exe
  C:\Windows\System\RlGtEkt.exe
  2⤵
  PID:12168
- C:\Windows\System\sXObuyL.exe
  C:\Windows\System\sXObuyL.exe
  2⤵
  PID:12192
- C:\Windows\System\GrpOtgN.exe
  C:\Windows\System\GrpOtgN.exe
  2⤵
  PID:12728
- C:\Windows\System\atTgTPB.exe
  C:\Windows\System\atTgTPB.exe
  2⤵
  PID:10188
- C:\Windows\System\JxvwtcZ.exe
  C:\Windows\System\JxvwtcZ.exe
  2⤵
  PID:4024
- C:\Windows\System\xAZKEoT.exe
  C:\Windows\System\xAZKEoT.exe
  2⤵
  PID:12252
- C:\Windows\System\qXcbpzo.exe
  C:\Windows\System\qXcbpzo.exe
  2⤵
  PID:10580
- C:\Windows\System\KlZuCDH.exe
  C:\Windows\System\KlZuCDH.exe
  2⤵
  PID:6276
- C:\Windows\System\BNnsBkY.exe
  C:\Windows\System\BNnsBkY.exe
  2⤵
  PID:11464
- C:\Windows\System\tmFZSPR.exe
  C:\Windows\System\tmFZSPR.exe
  2⤵
  PID:12628
- C:\Windows\System\fBDJsol.exe
  C:\Windows\System\fBDJsol.exe
  2⤵
  PID:12380
- C:\Windows\System\QLaHUOL.exe
  C:\Windows\System\QLaHUOL.exe
  2⤵
  PID:3788
- C:\Windows\System\IyxvfcW.exe
  C:\Windows\System\IyxvfcW.exe
  2⤵
  PID:8896
- C:\Windows\System\IIceNst.exe
  C:\Windows\System\IIceNst.exe
  2⤵
  PID:1552
- C:\Windows\System\zbnsMZk.exe
  C:\Windows\System\zbnsMZk.exe
  2⤵
  PID:12772
- C:\Windows\System\KdbaegO.exe
  C:\Windows\System\KdbaegO.exe
  2⤵
  PID:3224
- C:\Windows\System\vLPHqpd.exe
  C:\Windows\System\vLPHqpd.exe
  2⤵
  PID:10044
- C:\Windows\System\GgDwoyT.exe
  C:\Windows\System\GgDwoyT.exe
  2⤵
  PID:13200
- C:\Windows\System\ZacwVvN.exe
  C:\Windows\System\ZacwVvN.exe
  2⤵
  PID:11588
- C:\Windows\System\SJQABZJ.exe
  C:\Windows\System\SJQABZJ.exe
  2⤵
  PID:13172
- C:\Windows\System\znEtzYj.exe
  C:\Windows\System\znEtzYj.exe
  2⤵
  PID:12012
- C:\Windows\System\yuUhbgp.exe
  C:\Windows\System\yuUhbgp.exe
  2⤵
  PID:10708
- C:\Windows\System\vYCURHm.exe
  C:\Windows\System\vYCURHm.exe
  2⤵
  PID:12952
- C:\Windows\System\irOsNty.exe
  C:\Windows\System\irOsNty.exe
  2⤵
  PID:12692
- C:\Windows\System\JZXFbBZ.exe
  C:\Windows\System\JZXFbBZ.exe
  2⤵
  PID:2476
- C:\Windows\System\qZXxObp.exe
  C:\Windows\System\qZXxObp.exe
  2⤵
  PID:6800
- C:\Windows\System\cjeOdya.exe
  C:\Windows\System\cjeOdya.exe
  2⤵
  PID:11248
- C:\Windows\System\fzwhhHX.exe
  C:\Windows\System\fzwhhHX.exe
  2⤵
  PID:11636
- C:\Windows\System\MivqqRR.exe
  C:\Windows\System\MivqqRR.exe
  2⤵
  PID:1308
- C:\Windows\System\SmssHFQ.exe
  C:\Windows\System\SmssHFQ.exe
  2⤵
  PID:12768
- C:\Windows\System\aFXRkfc.exe
  C:\Windows\System\aFXRkfc.exe
  2⤵
  PID:1232
- C:\Windows\System\BiygAdj.exe
  C:\Windows\System\BiygAdj.exe
  2⤵
  PID:9192
- C:\Windows\System\waLpBLd.exe
  C:\Windows\System\waLpBLd.exe
  2⤵
  PID:11916
- C:\Windows\System\ZUIyFov.exe
  C:\Windows\System\ZUIyFov.exe
  2⤵
  PID:3716
- C:\Windows\System\HsVZxOq.exe
  C:\Windows\System\HsVZxOq.exe
  2⤵
  PID:12068
- C:\Windows\System\EfGPWVf.exe
  C:\Windows\System\EfGPWVf.exe
  2⤵
  PID:3652
- C:\Windows\System\yHIuUAP.exe
  C:\Windows\System\yHIuUAP.exe
  2⤵
  PID:1988
- C:\Windows\System\UOnxUGI.exe
  C:\Windows\System\UOnxUGI.exe
  2⤵
  PID:4444
- C:\Windows\System\XrFDibV.exe
  C:\Windows\System\XrFDibV.exe
  2⤵
  PID:7856
- C:\Windows\System\yjwdjKt.exe
  C:\Windows\System\yjwdjKt.exe
  2⤵
  PID:8320
- C:\Windows\System\VYMjpQM.exe
  C:\Windows\System\VYMjpQM.exe
  2⤵
  PID:3016
- C:\Windows\System\MTHCxpJ.exe
  C:\Windows\System\MTHCxpJ.exe
  2⤵
  PID:13316
- C:\Windows\System\ZmeftSc.exe
  C:\Windows\System\ZmeftSc.exe
  2⤵
  PID:13356
- C:\Windows\System\VvWSVwd.exe
  C:\Windows\System\VvWSVwd.exe
  2⤵
  PID:13380
- C:\Windows\System\GaOarYp.exe
  C:\Windows\System\GaOarYp.exe
  2⤵
  PID:13400
- C:\Windows\System\LqutjAk.exe
  C:\Windows\System\LqutjAk.exe
  2⤵
  PID:13432
- C:\Windows\System\zxIHCBq.exe
  C:\Windows\System\zxIHCBq.exe
  2⤵
  PID:13456
- C:\Windows\System\nmZAkmY.exe
  C:\Windows\System\nmZAkmY.exe
  2⤵
  PID:13476
- C:\Windows\System\ZpAzqGk.exe
  C:\Windows\System\ZpAzqGk.exe
  2⤵
  PID:13500
- C:\Windows\System\xWkJLgj.exe
  C:\Windows\System\xWkJLgj.exe
  2⤵
  PID:13536
- C:\Windows\System\HHJrLNe.exe
  C:\Windows\System\HHJrLNe.exe
  2⤵
  PID:13556
- C:\Windows\System\dTlSqvI.exe
  C:\Windows\System\dTlSqvI.exe
  2⤵
  PID:13584
- C:\Windows\System\kttkGuO.exe
  C:\Windows\System\kttkGuO.exe
  2⤵
  PID:13608
- C:\Windows\System\HhywiXU.exe
  C:\Windows\System\HhywiXU.exe
  2⤵
  PID:13628
- C:\Windows\System\CUwLZyR.exe
  C:\Windows\System\CUwLZyR.exe
  2⤵
  PID:13652
- C:\Windows\System\PExbXWL.exe
  C:\Windows\System\PExbXWL.exe
  2⤵
  PID:13672
- C:\Windows\System\vQPGMMw.exe
  C:\Windows\System\vQPGMMw.exe
  2⤵
  PID:14024
- C:\Windows\System\HnMjNyZ.exe
  C:\Windows\System\HnMjNyZ.exe
  2⤵
  PID:14048
- C:\Windows\System\qlrYOeB.exe
  C:\Windows\System\qlrYOeB.exe
  2⤵
  PID:14116
- C:\Windows\System\gIIEitX.exe
  C:\Windows\System\gIIEitX.exe
  2⤵
  PID:14160
- C:\Windows\System\dLsBpVK.exe
  C:\Windows\System\dLsBpVK.exe
  2⤵
  PID:14184
- C:\Windows\System\ocNgKBC.exe
  C:\Windows\System\ocNgKBC.exe
  2⤵
  PID:14208
- C:\Windows\System\PmIxdTV.exe
  C:\Windows\System\PmIxdTV.exe
  2⤵
  PID:14228
- C:\Windows\System\HOukAKl.exe
  C:\Windows\System\HOukAKl.exe
  2⤵
  PID:14248
- C:\Windows\System\oNPePhO.exe
  C:\Windows\System\oNPePhO.exe
  2⤵
  PID:14280
- C:\Windows\System\abMekoN.exe
  C:\Windows\System\abMekoN.exe
  2⤵
  PID:14308
- C:\Windows\System\rytSmIi.exe
  C:\Windows\System\rytSmIi.exe
  2⤵
  PID:14328
- C:\Windows\System\HbJKvsn.exe
  C:\Windows\System\HbJKvsn.exe
  2⤵
  PID:10808
- C:\Windows\System\VagkaQM.exe
  C:\Windows\System\VagkaQM.exe
  2⤵
  PID:10988
- C:\Windows\System\xkFdHFT.exe
  C:\Windows\System\xkFdHFT.exe
  2⤵
  PID:10652
- C:\Windows\System\UjYbAwu.exe
  C:\Windows\System\UjYbAwu.exe
  2⤵
  PID:7832
- C:\Windows\System\Ztfaylg.exe
  C:\Windows\System\Ztfaylg.exe
  2⤵
  PID:4524
- C:\Windows\System\krsCvZH.exe
  C:\Windows\System\krsCvZH.exe
  2⤵
  PID:12036
- C:\Windows\System\gecqywT.exe
  C:\Windows\System\gecqywT.exe
  2⤵
  PID:11424
- C:\Windows\System\YHavOKJ.exe
  C:\Windows\System\YHavOKJ.exe
  2⤵
  PID:12392
- C:\Windows\System\HmipoLr.exe
  C:\Windows\System\HmipoLr.exe
  2⤵
  PID:9716
- C:\Windows\System\VsXXgeS.exe
  C:\Windows\System\VsXXgeS.exe
  2⤵
  PID:13516
- C:\Windows\System\wHEymxC.exe
  C:\Windows\System\wHEymxC.exe
  2⤵
  PID:4228
- C:\Windows\System\SXrNThB.exe
  C:\Windows\System\SXrNThB.exe
  2⤵
  PID:9084
- C:\Windows\System\FJANVhU.exe
  C:\Windows\System\FJANVhU.exe
  2⤵
  PID:12748
- C:\Windows\System\BvOsqUa.exe
  C:\Windows\System\BvOsqUa.exe
  2⤵
  PID:13864
- C:\Windows\System\HcWvvyU.exe
  C:\Windows\System\HcWvvyU.exe
  2⤵
  PID:4668
- C:\Windows\System\TPFnken.exe
  C:\Windows\System\TPFnken.exe
  2⤵
  PID:13724
- C:\Windows\System\SgPItxB.exe
  C:\Windows\System\SgPItxB.exe
  2⤵
  PID:4320
- C:\Windows\System\JfpQbFV.exe
  C:\Windows\System\JfpQbFV.exe
  2⤵
  PID:14104
- C:\Windows\System\jhuPlxi.exe
  C:\Windows\System\jhuPlxi.exe
  2⤵
  PID:14204
- C:\Windows\System\GgwhCfI.exe
  C:\Windows\System\GgwhCfI.exe
  2⤵
  PID:13236
- C:\Windows\System\EykCVZF.exe
  C:\Windows\System\EykCVZF.exe
  2⤵
  PID:1196
- C:\Windows\System\qNSCklv.exe
  C:\Windows\System\qNSCklv.exe
  2⤵
  PID:12136
- C:\Windows\System\aHlHkEG.exe
  C:\Windows\System\aHlHkEG.exe
  2⤵
  PID:13920
- C:\Windows\System\gISOhLB.exe
  C:\Windows\System\gISOhLB.exe
  2⤵
  PID:13604
- C:\Windows\System\FcMOHQr.exe
  C:\Windows\System\FcMOHQr.exe
  2⤵
  PID:5140

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rypuzkvv.nzm.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AGFbMId.exe

Filesize
1.9MB

MD5
fb2407ec9fe523f60bfe298ec628ec5e

SHA1
5bb8f811c20c1d1ef05627997ae656497479d708

SHA256
027b8eca8010fce8e04de9ba4e9982380479a077b33bd7634a9279b37db986b9

SHA512
35871f537e1098399e14f5625e6765587922ecaddeff9f318281db6084ffd3b368aadd04ce159e9eb7e7de3cd8536138e489105363ad70e63bb2575206b46ff9

Download Submit
C:\Windows\System\CAiXMzc.exe

Filesize
1.9MB

MD5
f930483227c9e3f382158af85ae1aeba

SHA1
5eaecbf645cb535aa25542eb2f6616636ac14738

SHA256
8ac53e98c7678c039b7ca99da4e11bd1455d937acf8648c4c8a4e337a6fe0502

SHA512
e9289a7aad6ec787c72d3bf59e32f0b60f7bae85454d82085e7b50b8012d1949cbb0bfa52d21c0d6b0e1d4acfe2bbbec320f19f6f8f138085b19de2b6de2c752

Download Submit
C:\Windows\System\CMzOwTR.exe

Filesize
1.9MB

MD5
909c7cb8210c15eb06c4d92c48912fd9

SHA1
baf2874bf18bc769776cdd3fbe3ebf87fb22d74a

SHA256
ef3e1a3406135080a8aa50e6026821a63b3eba49a50af4a997deb2fdabeaf054

SHA512
e667bee2f4769e1f381f4ac758eb577d9b3873f976e075ee5d1503a38fd5135b71423ce320f24a80ab5afd14d2c7a754ccb4740f611c9f0c7448c68d9cdb3fdc

Download Submit
C:\Windows\System\CPULUvu.exe

Filesize
1.9MB

MD5
dc0d6a7e9e003eae4b090892103edecb

SHA1
11de8e3d5b53eaf38a41824e462f3ea52181b28c

SHA256
d9558cf7b97fc8dae8a0f0929aa60b1754226849a4e0764bca028f187238fff9

SHA512
9dd555855b59544bcc25661f0ab7852702ebacb32ab60dce7f5962243ea601f8c75cdb5cc573467dcaa87e7559e04242c79028a2c2d0be7095d1124775493c63

Download Submit
C:\Windows\System\CikVtDB.exe

Filesize
1.9MB

MD5
d81d2a455a3d623feb502d04191300c1

SHA1
84f18544883631c264c00b6e58d3393ace3ae0fe

SHA256
332f05c06ff41173e05e5f5fbc65ad752b3b62f89d7ac5fe41154f6c99dd1193

SHA512
71d682ef543d682ea985177a1179f7cb4d7b1887f1091e3a9559004eccb18c0f60adbb8e3dca0b2432465687ae634fff408c0ccc9c2574e5882c04bec7a0a3a8

Download Submit
C:\Windows\System\CuITsUF.exe

Filesize
1.9MB

MD5
45a45748f8695a140145ab1135ca8520

SHA1
dc10efe3e52312bb928d6715102821a697d46e57

SHA256
6f239de1d0e104be6cf55efd6fbb2378412395fde46a027d0a9abeb09735848c

SHA512
e1bcde7414cb1b14e2dd95413b482afa827cb8888e585b6ba22a24d2b7d4f1690ad24318307610600d825960122a85847fc8c4c6304300b2172bae725ce82f2c

Download Submit
C:\Windows\System\DKnzLBh.exe

Filesize
1.9MB

MD5
ce71d6ccd2564bc34aebbd962b96b3e4

SHA1
a009e1801e15d0d5f53a225f2ac5704330bb3978

SHA256
783b3b5046e2717cd2a82e12ab5d672948a98c34bb26e114804b4698d5d61851

SHA512
7c12d63d6b5572cdf02914e3aa52003ea1a112aa8c162e55c0f53b9a684828031eeadc03bdb1d048c23041ad384cb105114d8adb1b6ad0daf2b1aa983ae4119b

Download Submit
C:\Windows\System\FKzGBOA.exe

Filesize
1.9MB

MD5
e5b2241377dc2c20caf71357a0af2a66

SHA1
34f7fced44ffd0b845b2ee99f4cb4ec2a7cc7f92

SHA256
7dbb300d3aa37cf58624aa98f3f51c0d19b8baab0e3212d58c6d102c5e3c6402

SHA512
0c9fb7017057ee3e553e99f837f3534af7cddee538aa82c085b114fdccbace2e88823bb43024a8eac8bae74abe52d027c565db540af0b3e9c0f8d5e47ff0335e

Download Submit
C:\Windows\System\HPqkbpw.exe

Filesize
1.9MB

MD5
0e6e0cfafb109b02db732df60cdcb7ee

SHA1
ec68b65f89059bbcdc9408192bfc57680a0ba460

SHA256
4c22d51bc9127496eca7a146a97410afc35d5d80bdcb8899f9f004ba387a2e08

SHA512
2451dc4ef461b28db0287c1b413807862011063813ca25573418c5c9a0b35f9ed68b4ae450249d6da4dd54caeb8547b6e97a03d4ede5d1e394090877d885a982

Download Submit
C:\Windows\System\HoZzABA.exe

Filesize
1.9MB

MD5
0bb5afbe210a93076fde278bfcabfb0d

SHA1
868bf927f30c48be6ac3a716b5707a6f82726fd7

SHA256
7670db1d32c44904e5a17ce12a41aaa2df8648176886569d9fc9e01d9925028e

SHA512
f47bbacf15b2cddd2bd8e9880f76c930bbb4aa5f66299c697d59374542b39d573249291946ab29b9e0bf5ae74d7515a11e8f0fa9221511ae4c1e4e69a857993a

Download Submit
C:\Windows\System\JooBTRJ.exe

Filesize
1.9MB

MD5
3b39dea3f64a76cc4878505903113869

SHA1
ed4f8e74f3e7ee6b244a02174fd53096c80f8639

SHA256
1677620b50b5e12fc200eb18e705c876507b5e0d0f4074bf746d47b0669e77cf

SHA512
614ab8da5953420c8e367696e04ee56674c6042cbec2e62a5d913a54fbba10f35545b26f56e104c36434ac71d1adca4e11fe356521492778ebe721cea073c841

Download Submit
C:\Windows\System\KxKPKwV.exe

Filesize
1.9MB

MD5
4ef081690b8f6673a999dc5270b77b87

SHA1
1aa594ab825ae5801a025ec57319cb4008b95d07

SHA256
6b9d3d05f74907de8afb052fd7b7c807a2b1fc85cae3cb15e1f410f5c8a3888f

SHA512
3391e989d9ddfa62b20e3c08d6015505b25e1398228a0a27d6af9856a6df44ce05be6f6c90be06a31e582bd341f5ff2dcab2228b19092f1d8fd98528a6f03001

Download Submit
C:\Windows\System\LEtEEXV.exe

Filesize
1.9MB

MD5
27f075d1ab4e09fb8b1500b4bbdcd6ff

SHA1
0c1d3b314e9a716736bbdbdb8a06acbedb65b136

SHA256
1b5f7789d94a45693131e5cdadff57a0983975b529638bf0edc714d9e0e200e4

SHA512
94f7934dffab24b668cfa8f586c28449fc2e2ad6c83b6a5cd630a8fc8a824db5c0ec990257165784537a2d48ed6950a511c64d66fe39593895c2a1201cc1782f

Download Submit
C:\Windows\System\LjOEFPf.exe

Filesize
1.9MB

MD5
560ff0f51b9c1d6e37c6e5a2108d1e46

SHA1
2a440c2fcf7e5d47384de660784de8a10a640d7b

SHA256
41dcb95d7872b9ec45d0b909a00b2c52b32970d950140f810a8506f001c5cf5e

SHA512
7f225d96e3a63a0a9da28ff4c406ebe3d11d1d8be1b7f30b9e225d5d15cb3f134bf9881421c7eaec58244a84358685beca56005f3d0aa0d910ba7ef2904cb05d

Download Submit
C:\Windows\System\NuhVinw.exe

Filesize
1.9MB

MD5
449816c79507405d705972fd0e80f7e7

SHA1
54c47f41951b7d3768fe4a436842c25b51ff1559

SHA256
946e9f299278b8903cb89cd9aa71dc4a58d4e0cf5d4437674f6bb3cb55ae2add

SHA512
6f2669335e5ad3e385093080ad4f335e7504a28a45e9ad4b2ab0a1f4101cf3ecc3d09bde3c4a04cfdc84479301da504df0b90feca16c01587f62b73a13886850

Download Submit
C:\Windows\System\OBgJVOj.exe

Filesize
1.9MB

MD5
26ba85e8d7c9d6fb08091a550f516c2e

SHA1
728fab62a4b8a03dddb3227584310b20d72857b2

SHA256
4cf3ef8cd670f0ed83e9ebec094e6cf108a210ac39486382d5e3fecb30055b28

SHA512
f00c26d94dc1b22aa1aae6ac97adce513088852553ac704fa2eff24b790d42dce44dad2317bfb11086fde92a115302b2523ddd0f99f8487fb4fb1342d8750620

Download Submit
C:\Windows\System\ONbDWxc.exe

Filesize
1.9MB

MD5
868e02f99657b8a35d8a420ffd962414

SHA1
db9e770cbcf92003d5e2940466d53b78ce5c4c1e

SHA256
97e0d87a9abc9fe54f7ada29ac0c95b322ab53072ff59ccb72c60c5cab806bba

SHA512
306492a931fbc5738cd97a8579af0827a801ea28273031826cc01dba93dcaa845c67aded104313072af899d885a767dc26e3504708add684c19184ecaf2890b5

Download Submit
C:\Windows\System\PlUWQsV.exe

Filesize
1.9MB

MD5
1a7761ef067da6a117614410789a4154

SHA1
80428c14e3f3ff392a80c4408935951aec4cb6eb

SHA256
c7d4b7d14787e9f1b24bb09af1dfb68087a7c9b6acb23299ca2c06e9378df7bc

SHA512
7e1dfa2d924b0488211da0518d818046e1afafb37b6c90f459465318fdc947d09ebf8f4927cc527416a82987be27e9b03da88322cf4da8e6a68555c18feed75c

Download Submit
C:\Windows\System\SmTRkns.exe

Filesize
1.9MB

MD5
1c11d9bfb7a3c7f9941340cb6fe519d0

SHA1
5dabad5e050e121e8b1842dd64c334e09effde18

SHA256
c08230470b354ee5316ff49f6af8244a723c43364250512abdcc0871b48363ca

SHA512
74bf3e199d8b1c3431974e616a1e0930c91ced997fbf79a61d755fe6a92a76ad2047f2ff7fbfac7bd99b90be19af781188a063b6dd36434d7529204e0d4d931f

Download Submit
C:\Windows\System\UCcSflk.exe

Filesize
1.9MB

MD5
446832d1db16332b2296c1269618dd78

SHA1
582be882ae3a70da8c8a7ee6c754f0e61c79e94f

SHA256
af8ac1741eb87b46e5d2e5e998dc2c6fa3e9cdc7d4e88d5a2c0c80cc01424470

SHA512
cf78ebc12c506bab6a1bde34d3bb763c13ca96fc6e4cee153993c4ee05a31910d91fc236a1bcfd5a918fa32cfc5604960cef9425050369eea71d4700a1ed8780

Download Submit
C:\Windows\System\WdhsESp.exe

Filesize
1.9MB

MD5
557c51ce882dd795685df13f55c2a5fe

SHA1
fb5b723560308c6c29867bdb180f38d8bb8c9c25

SHA256
7d72a39049403567e680cd014eb3f69250d2f9ccd0a792ea24b22fd407689604

SHA512
ec4f96084f45d27fe45710628aa4597531158a999f8c40b2a9f4d2966871491634c7bb9047e0275b642aa954da7663a0849f890f51cb82bdc484073c7f2ef8e6

Download Submit
C:\Windows\System\YjTQRZs.exe

Filesize
1.9MB

MD5
9d1b62739b42837d4806b66c80fbb1d6

SHA1
e2ed0bdba81eeb45568723f356cfb6b3f8c820fe

SHA256
15a596f7e0afb31f02c67e4efeefed4f375bfbbd28f0de04345f73cfc6146344

SHA512
52dc2c9b22b266a2ad89f0df4e9f0b3636f2ccb253d6dac76b8fbeea241f4b743be21d77e7aa283a542fa03fb30fdcc4031879162780b7711de5289c61ba92de

Download Submit
C:\Windows\System\ZSadAQU.exe

Filesize
8B

MD5
a8f2921c80c15a3d426e5fdff8a56196

SHA1
4dc21bf95e22427a9dafcd4930e81b62e77d5fda

SHA256
7e9bbeeba45dae16f8c444596ee4180d7313e899e46fa6263fde6904f32d92a1

SHA512
996666f646b1878ee129a778184f9520541ee458797b8bfaefed6e1f152a5436e0ff19d28744463b706ffe3e24e429f5af102aa1e7733dbeeb6210754c828802

Download Submit
C:\Windows\System\dwOmsWN.exe

Filesize
1.9MB

MD5
a9609db5e60647deda28d94ae82c93a7

SHA1
bcdea352f1639b66929d163bd3e3c0bea5652720

SHA256
39fed5517385115ad6eec998ad5346c1069e96637bceff4468e5784bb27a8706

SHA512
ae5a4ebf7926d514eec9713db837fe6333e84dcea858d61f5242bfa48e79a1736cdfb3f32b1473fa6145a987a75262f5b3797043623374eeba998c743927efe7

Download Submit
C:\Windows\System\ejQRYQN.exe

Filesize
1.9MB

MD5
a262e7dbc9269c340ae986528c1d0077

SHA1
b3c4261650a29c4de2d8d263bfce052ee80b8670

SHA256
352d9308aed7333059da92e9383040d6606bb0313624ae0c3eb2bee047e815b8

SHA512
10fb0218f2003bf90f189e14a1c42e0d2fc8ea2a4a6e724d95d8dd671c2afebf5cab63142f6dfd654bdd901d7cd3b89626efa7efab231cd748457e84d156e5dc

Download Submit
C:\Windows\System\fYQhJAZ.exe

Filesize
1.9MB

MD5
c566114978f2b0971ba20de2e85e76a5

SHA1
29e9c2abb10106465405adfdf07130036dd59b2d

SHA256
87a986b48373833110d9525be219aa02b776a33d329317ddd98e50a0184466fb

SHA512
76166d1888c5e326da84afbdc69c092c32056789befd49903f3a5c65e6db0f12c9a1edffafb4e332e770aa8065d7f67d91bc7106c72cbc3cfe01f597b90183b7

Download Submit
C:\Windows\System\iwPdgRz.exe

Filesize
1.9MB

MD5
2ae06e618d0f23be02b7dae77046def4

SHA1
9f6fd1409e64372911981e9535dcfc24382d8005

SHA256
8224aead151793edb9cf5145415a6251c0eaec3a47b7d0d48a7f8b1a5aac38ef

SHA512
0a62f5807233b25bfab28bc2042042f74b8a29863f2f21e6c13cf99a11d18365fd12f9135b5e92fd179acfd6d0fc6aff452de627487a7ed1284f7e65cdcddcc3

Download Submit
C:\Windows\System\lUlUJgs.exe

Filesize
1.9MB

MD5
d337adab9bf37ba451b05090bd20e42a

SHA1
b469a6171f5e7915c3dc330fab9f920e08416055

SHA256
d05fadda6e6543ecfd2cc5936179f5f2a2d0de7a39d259ae8642177cb9d80451

SHA512
bfb3d528d2ba4ec8130a7a46d8a1b890c163bf28bc1e6be612e2314a6f74c78e48c09b8401ed74e0684e9fdafb0e66339140801b3ffd780da9ab1c4402bedfd5

Download Submit
C:\Windows\System\nSMiWqA.exe

Filesize
1.9MB

MD5
24c412cd51dbb989466f7545ff85dffd

SHA1
48c3387c35b4f0c48b17417bcb12bd7be2fc7bff

SHA256
e1e20d171abf1be046c43424b4e3dfd3f2c876d0bbf33ba28f5f63defb979fc6

SHA512
0efe3f0decf88b3380d1a389d0482b932d4103d9593c80bdb71e051785f46a0db5bf0e085e922cf6ca678d144239c74232858d1c0a5f5a81d145ed3fbcdf9600

Download Submit
C:\Windows\System\olqMVBR.exe

Filesize
1.9MB

MD5
d2145d3f80ad04a808fe4e4e45599d50

SHA1
bc5f8ae1b19803d1331b5850fc44c326eeccf52e

SHA256
e1f91325b7e2d87ddfa44e6f30131cef76fdf47bfafd2f023d201a9228530135

SHA512
08755315cfface9f68829b0ae4e80834b05492ea550290834cba199ae27e9a03230a9f3194eb7eeff57533aaadf54364799306948f06f0b765ebf42373a3cf2d

Download Submit
C:\Windows\System\pTIxCqu.exe

Filesize
1.9MB

MD5
e7af1983e244eb5f8568b86813133f91

SHA1
fcda393b28bc1d594e458627efcc72329f0ead07

SHA256
3755e74e1209046448fd50dbd067416e62f9b2b9445a50017c358187a5e84301

SHA512
55628a1a15285ff0b349d9e71d4520884537dbed7ffa3962835d29b34f9eec85e81941722ad5abb95571df0505b7f3dcd014492cc73f013ff8a0f3d4dd2f0836

Download Submit
C:\Windows\System\pbYXoDZ.exe

Filesize
1.9MB

MD5
601c123f6f186eb5231a77c7f03b8da2

SHA1
2335871de5cba2b8554ffc9a701a93805c078176

SHA256
4a6f15e71d42123ca5b8c8eebd2bfee2224e58f0ec6be787b7bee280c28dadf3

SHA512
1a91e575d2f65b7395f1f10ec481c1de99bc3575002baa8adab366fe7c65fa9900a5f1519e1592200fbd8e417832cb369142e19086b7e6c1f361b0eb451889c4

Download Submit
C:\Windows\System\rZkbStj.exe

Filesize
1.9MB

MD5
b15d9e9eae510e18ff0f9225a50a0e33

SHA1
3479cbda362a080d43c4005bbe0def00f7f92990

SHA256
ff732273f26a77f619447f826916cd33baf58b82fb99f8a9b3e936f69e138242

SHA512
1d901d74d8fea3bb52f419a7687ca2b0604f71e93ed57fd58e75e48ab8c14272138fa3a01b17969d0a69b58ae6cf19db1bb9e721c049ef78d57c119959f0a1c9

Download Submit
C:\Windows\System\tFWqWsf.exe

Filesize
1.9MB

MD5
af0cebcb8b11f6df965f702b4e73dcef

SHA1
ecca06547b84175f21190b3d5b907cdd3d61541d

SHA256
3aaebeaeaa472a01c7dadb24922c5086515314681c5e06c42d2062cb4bb0e49e

SHA512
8232ccc58945f0957c46b062e2a1b875e5a18c5acf80adcc57577f3d5ad2a1d354e2c854b9f1c76b7e87e3a170bace55c1ff50d83b21ea045a12cf03ef585f3f

Download Submit
C:\Windows\System\tbeQVwd.exe

Filesize
1.9MB

MD5
414c876e3fa506d12e308122703efb18

SHA1
bbba986c0f5844fa97021d466c17f81b729323f0

SHA256
2374e17aee394cf426b71e2176a6a64ee0a44e1e09e456d9eeb4e386a5d9ceca

SHA512
c5b8cb93a507ebe8a827fdae55b6b7cc5208b32739a6e596697c50e6df14e71341182814a3dffde21e7cc14fcaf9946c6b0d06ea8c8217abdbd598133b02ee8b

Download Submit
C:\Windows\System\wEChjuH.exe

Filesize
1.9MB

MD5
3f4d497b2f8c3147972a3e53419976d9

SHA1
a9069f512136ef4ea7ed5ce7966d760b98d2adc7

SHA256
810825b0cdb222cd93ea7731d5854e4e564926515cca12a0814fb61e0c1bb1e4

SHA512
d323f81849cdc6928c0ca9837ebc4bff943758810a5a3975253dd790dec52d779dfeef0da552a61490fc3c5160f3d077cc774945ccc5878bcf2f9f7e4252bf34

Download Submit
C:\Windows\System\wSsBUaR.exe

Filesize
1.9MB

MD5
f8a2e5dc698eb49255250271e3c99291

SHA1
b1e05aaf55c620e3fd96d487f1d4a148dc57b6cc

SHA256
18417c7fab45acffe8a16679efaac7c86a1c64fcb683d7721f772e122212801f

SHA512
2b287dd783d8b4be7b37c144e86a720ff5366912856ade794ecbd4cb42f64040335b9793515421556bd6e0d4d5ab6d52f53c6609f460490ed2403fdbb4d6b6a7

Download Submit
C:\Windows\System\xEzfuqm.exe

Filesize
1.9MB

MD5
df196199ad648ba1e8ed6061c6dbddb4

SHA1
b6da9dedd7b34a77999853b0d3be88585aae12e2

SHA256
72dd1f88934ea42a23dd85a2bda08d0be2de5a9320e6534b0bd444329f0c86d5

SHA512
c0cca8617ca47114111855b49848aec23b1ffd472dbb9036987704a01b042132adfca7bf449977757ded26e96018220e701f1829df57f846ac64f86ad0e5d6c5

Download Submit
C:\Windows\System\zqwdfCA.exe

Filesize
1.9MB

MD5
96318154ed04b56b93ff3c86aab1861d

SHA1
6e0b5f4c0c3fe290f6209251549a50f0c8ca497d

SHA256
66146819b218b8cd5bde9977972e000af7760e42bb43962b7de62baa6467f41e

SHA512
e3c5543e1a8ecd9cb7df0d4b5516fa5e5db5a7bf50731d9f98b4ec68a73947d112094e6980a94d76d9ed6e9379e706475cc4b0d696929acb51c32e1b89f1656c

Download Submit
memory/456-180-0x00007FF718D10000-0x00007FF719102000-memory.dmp

Filesize
3.9MB

Download
memory/456-3419-0x00007FF718D10000-0x00007FF719102000-memory.dmp

Filesize
3.9MB

Download
memory/1000-154-0x00007FF747C80000-0x00007FF748072000-memory.dmp

Filesize
3.9MB

Download
memory/1000-3410-0x00007FF747C80000-0x00007FF748072000-memory.dmp

Filesize
3.9MB

Download
memory/1312-243-0x00007FF6B6C80000-0x00007FF6B7072000-memory.dmp

Filesize
3.9MB

Download
memory/1312-3454-0x00007FF6B6C80000-0x00007FF6B7072000-memory.dmp

Filesize
3.9MB

Download
memory/1480-176-0x00007FF69A090000-0x00007FF69A482000-memory.dmp

Filesize
3.9MB

Download
memory/1480-3445-0x00007FF69A090000-0x00007FF69A482000-memory.dmp

Filesize
3.9MB

Download
memory/1828-175-0x00007FF707190000-0x00007FF707582000-memory.dmp

Filesize
3.9MB

Download
memory/1828-3430-0x00007FF707190000-0x00007FF707582000-memory.dmp

Filesize
3.9MB

Download
memory/1840-3414-0x00007FF7EB1E0000-0x00007FF7EB5D2000-memory.dmp

Filesize
3.9MB

Download
memory/1840-242-0x00007FF7EB1E0000-0x00007FF7EB5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2168-172-0x00007FF7BAAB0000-0x00007FF7BAEA2000-memory.dmp

Filesize
3.9MB

Download
memory/2168-3450-0x00007FF7BAAB0000-0x00007FF7BAEA2000-memory.dmp

Filesize
3.9MB

Download
memory/2244-171-0x00007FF750D60000-0x00007FF751152000-memory.dmp

Filesize
3.9MB

Download
memory/2244-3420-0x00007FF750D60000-0x00007FF751152000-memory.dmp

Filesize
3.9MB

Download
memory/2548-3426-0x00007FF789100000-0x00007FF7894F2000-memory.dmp

Filesize
3.9MB

Download
memory/2548-179-0x00007FF789100000-0x00007FF7894F2000-memory.dmp

Filesize
3.9MB

Download
memory/2908-182-0x00007FF6C7830000-0x00007FF6C7C22000-memory.dmp

Filesize
3.9MB

Download
memory/2908-3452-0x00007FF6C7830000-0x00007FF6C7C22000-memory.dmp

Filesize
3.9MB

Download
memory/3068-183-0x00007FF7C0A00000-0x00007FF7C0DF2000-memory.dmp

Filesize
3.9MB

Download
memory/3068-3435-0x00007FF7C0A00000-0x00007FF7C0DF2000-memory.dmp

Filesize
3.9MB

Download
memory/3292-169-0x00007FF780830000-0x00007FF780C22000-memory.dmp

Filesize
3.9MB

Download
memory/3292-3416-0x00007FF780830000-0x00007FF780C22000-memory.dmp

Filesize
3.9MB

Download
memory/3444-3448-0x00007FF7664F0000-0x00007FF7668E2000-memory.dmp

Filesize
3.9MB

Download
memory/3444-181-0x00007FF7664F0000-0x00007FF7668E2000-memory.dmp

Filesize
3.9MB

Download
memory/3448-178-0x00007FF736B30000-0x00007FF736F22000-memory.dmp

Filesize
3.9MB

Download
memory/3448-3455-0x00007FF736B30000-0x00007FF736F22000-memory.dmp

Filesize
3.9MB

Download
memory/3820-95-0x00007FF631E30000-0x00007FF632222000-memory.dmp

Filesize
3.9MB

Download
memory/3820-3408-0x00007FF631E30000-0x00007FF632222000-memory.dmp

Filesize
3.9MB

Download
memory/4072-3423-0x00007FF7E88E0000-0x00007FF7E8CD2000-memory.dmp

Filesize
3.9MB

Download
memory/4072-168-0x00007FF7E88E0000-0x00007FF7E8CD2000-memory.dmp

Filesize
3.9MB

Download
memory/4184-1-0x000001F97B9F0000-0x000001F97BA00000-memory.dmp

Filesize
64KB

Download
memory/4184-0-0x00007FF6790C0000-0x00007FF6794B2000-memory.dmp

Filesize
3.9MB

Download
memory/4244-91-0x000001F36DF80000-0x000001F36DF90000-memory.dmp

Filesize
64KB

Download
memory/4244-58-0x00007FFDA3320000-0x00007FFDA3DE1000-memory.dmp

Filesize
10.8MB

Download
memory/4244-28-0x000001F36EF90000-0x000001F36EFB2000-memory.dmp

Filesize
136KB

Download
memory/4244-90-0x000001F36DF80000-0x000001F36DF90000-memory.dmp

Filesize
64KB

Download
memory/4244-1994-0x00007FFDA3320000-0x00007FFDA3DE1000-memory.dmp

Filesize
10.8MB

Download
memory/4456-124-0x00007FF61CB50000-0x00007FF61CF42000-memory.dmp

Filesize
3.9MB

Download
memory/4456-3412-0x00007FF61CB50000-0x00007FF61CF42000-memory.dmp

Filesize
3.9MB

Download
memory/4476-174-0x00007FF7C84A0000-0x00007FF7C8892000-memory.dmp

Filesize
3.9MB

Download
memory/4476-3428-0x00007FF7C84A0000-0x00007FF7C8892000-memory.dmp

Filesize
3.9MB

Download
memory/4744-173-0x00007FF6F42D0000-0x00007FF6F46C2000-memory.dmp

Filesize
3.9MB

Download
memory/4744-3437-0x00007FF6F42D0000-0x00007FF6F46C2000-memory.dmp

Filesize
3.9MB

Download
memory/4916-3425-0x00007FF6E2760000-0x00007FF6E2B52000-memory.dmp

Filesize
3.9MB

Download
memory/4916-170-0x00007FF6E2760000-0x00007FF6E2B52000-memory.dmp

Filesize
3.9MB

Download
memory/4980-3432-0x00007FF6B8220000-0x00007FF6B8612000-memory.dmp

Filesize
3.9MB

Download
memory/4980-177-0x00007FF6B8220000-0x00007FF6B8612000-memory.dmp

Filesize
3.9MB

Download