xmrig | 2c45b6bc6ba80738deaace4dbd174fb8a0c407b23c71158b94b502f43af05329

Analysis

max time kernel
92s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 01:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
Size

2.2MB
MD5

021d201699832ba2d6e3d46f652f5a16
SHA1

990cc358b7c469e69cfb6c7783f46c6216647ea0
SHA256

2c45b6bc6ba80738deaace4dbd174fb8a0c407b23c71158b94b502f43af05329
SHA512

5a444909fa3c839f6b65d9015e8805de3fbb3cb77e40fd69f3bbbc00f948c180e33e1873d012471611f5309ec8592c6d4e03c0cca87e14d31c256b1a5907e292
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrf4:NABp

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 42 IoCs

miner

resource	yara_rule
behavioral2/memory/4524-201-0x00007FF6844C0000-0x00007FF6848B2000-memory.dmp	xmrig
behavioral2/memory/1984-227-0x00007FF714B60000-0x00007FF714F52000-memory.dmp	xmrig
behavioral2/memory/212-287-0x00007FF678730000-0x00007FF678B22000-memory.dmp	xmrig
behavioral2/memory/2408-323-0x00007FF74D750000-0x00007FF74DB42000-memory.dmp	xmrig
behavioral2/memory/2184-333-0x00007FF72F060000-0x00007FF72F452000-memory.dmp	xmrig
behavioral2/memory/3884-359-0x00007FF740BF0000-0x00007FF740FE2000-memory.dmp	xmrig
behavioral2/memory/3876-363-0x00007FF671DC0000-0x00007FF6721B2000-memory.dmp	xmrig
behavioral2/memory/2840-362-0x00007FF737A20000-0x00007FF737E12000-memory.dmp	xmrig
behavioral2/memory/4100-361-0x00007FF76C520000-0x00007FF76C912000-memory.dmp	xmrig
behavioral2/memory/1088-360-0x00007FF7EED40000-0x00007FF7EF132000-memory.dmp	xmrig
behavioral2/memory/1760-358-0x00007FF6F7470000-0x00007FF6F7862000-memory.dmp	xmrig
behavioral2/memory/436-282-0x00007FF78F570000-0x00007FF78F962000-memory.dmp	xmrig
behavioral2/memory/1684-260-0x00007FF6ED640000-0x00007FF6EDA32000-memory.dmp	xmrig
behavioral2/memory/3140-254-0x00007FF763F40000-0x00007FF764332000-memory.dmp	xmrig
behavioral2/memory/5116-253-0x00007FF6B11E0000-0x00007FF6B15D2000-memory.dmp	xmrig
behavioral2/memory/1020-168-0x00007FF740D50000-0x00007FF741142000-memory.dmp	xmrig
behavioral2/memory/2616-163-0x00007FF707C90000-0x00007FF708082000-memory.dmp	xmrig
behavioral2/memory/4736-129-0x00007FF7FB420000-0x00007FF7FB812000-memory.dmp	xmrig
behavioral2/memory/2640-96-0x00007FF64BA20000-0x00007FF64BE12000-memory.dmp	xmrig
behavioral2/memory/2868-69-0x00007FF7D7A40000-0x00007FF7D7E32000-memory.dmp	xmrig
behavioral2/memory/632-50-0x00007FF70C1C0000-0x00007FF70C5B2000-memory.dmp	xmrig
behavioral2/memory/632-3850-0x00007FF70C1C0000-0x00007FF70C5B2000-memory.dmp	xmrig
behavioral2/memory/2640-3852-0x00007FF64BA20000-0x00007FF64BE12000-memory.dmp	xmrig
behavioral2/memory/2868-3854-0x00007FF7D7A40000-0x00007FF7D7E32000-memory.dmp	xmrig
behavioral2/memory/3884-3856-0x00007FF740BF0000-0x00007FF740FE2000-memory.dmp	xmrig
behavioral2/memory/4736-3858-0x00007FF7FB420000-0x00007FF7FB812000-memory.dmp	xmrig
behavioral2/memory/1684-3860-0x00007FF6ED640000-0x00007FF6EDA32000-memory.dmp	xmrig
behavioral2/memory/212-3865-0x00007FF678730000-0x00007FF678B22000-memory.dmp	xmrig
behavioral2/memory/2184-3891-0x00007FF72F060000-0x00007FF72F452000-memory.dmp	xmrig
behavioral2/memory/2408-3889-0x00007FF74D750000-0x00007FF74DB42000-memory.dmp	xmrig
behavioral2/memory/1760-3894-0x00007FF6F7470000-0x00007FF6F7862000-memory.dmp	xmrig
behavioral2/memory/4100-3885-0x00007FF76C520000-0x00007FF76C912000-memory.dmp	xmrig
behavioral2/memory/1088-3884-0x00007FF7EED40000-0x00007FF7EF132000-memory.dmp	xmrig
behavioral2/memory/436-3880-0x00007FF78F570000-0x00007FF78F962000-memory.dmp	xmrig
behavioral2/memory/2616-3878-0x00007FF707C90000-0x00007FF708082000-memory.dmp	xmrig
behavioral2/memory/3876-3876-0x00007FF671DC0000-0x00007FF6721B2000-memory.dmp	xmrig
behavioral2/memory/4524-3872-0x00007FF6844C0000-0x00007FF6848B2000-memory.dmp	xmrig
behavioral2/memory/3140-3870-0x00007FF763F40000-0x00007FF764332000-memory.dmp	xmrig
behavioral2/memory/2840-3863-0x00007FF737A20000-0x00007FF737E12000-memory.dmp	xmrig
behavioral2/memory/1020-3882-0x00007FF740D50000-0x00007FF741142000-memory.dmp	xmrig
behavioral2/memory/1984-3874-0x00007FF714B60000-0x00007FF714F52000-memory.dmp	xmrig
behavioral2/memory/5116-3867-0x00007FF6B11E0000-0x00007FF6B15D2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3884	mSDPlIc.exe
632	gmIiIRE.exe
2868	zKaPbXE.exe
2640	zPxyvMl.exe
4736	DENTUFs.exe
1088	QEqEyKH.exe
2616	fazkRrl.exe
1020	Poklmzc.exe
4524	KJVoqUu.exe
1984	ZsQXblI.exe
5116	oTKzmqA.exe
4100	exMdgex.exe
2840	mqNKymt.exe
3140	jFIItTE.exe
1684	TIEeptF.exe
436	HFSeFbI.exe
3876	SseABuk.exe
212	jMxQeNF.exe
2408	zSFsMWq.exe
2184	WbEpfJh.exe
1760	HURTTwA.exe
2920	nnpirjr.exe
3432	akNFSoM.exe
2656	DlFBZaI.exe
4456	HQlOgmc.exe
1068	ASaDQIA.exe
1148	rHcKHKd.exe
3824	mCbhKEu.exe
4676	MIHEKJc.exe
3260	SSbWpyz.exe
4772	squhAgd.exe
948	GXJghgn.exe
1620	TnAELKp.exe
1508	simVbkt.exe
1556	MzYeHeW.exe
468	drkwOEn.exe
3372	BGJqvYM.exe
2332	OptfMLL.exe
364	AzBbWQk.exe
4984	rSzrMBa.exe
4056	MENeCxB.exe
5040	PdjRqAB.exe
4168	FWxcOvu.exe
3832	LYDdLfq.exe
1656	hMVLmzP.exe
5012	QeClDjL.exe
4556	GxUjHga.exe
1464	zlrUkDf.exe
3784	MgGkvFU.exe
760	siykwvG.exe
1012	ESXpxLF.exe
3844	lzWBjAw.exe
4324	pYvkMhD.exe
4388	oIalEqN.exe
2496	RcvntnJ.exe
2788	ArzFpil.exe
2028	wYGKyMI.exe
3408	rFDrVCH.exe
4784	mMAfSaU.exe
1264	kOzzcUN.exe
2296	dQVbWcB.exe
2764	aOXACEz.exe
4360	drYpUPX.exe
3416	HuajOZr.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2888-0-0x00007FF749CE0000-0x00007FF74A0D2000-memory.dmp	upx
behavioral2/files/0x00080000000233ff-7.dat	upx
behavioral2/files/0x0007000000023402-34.dat	upx
behavioral2/files/0x0007000000023403-39.dat	upx
behavioral2/files/0x0007000000023406-81.dat	upx
behavioral2/files/0x0008000000023400-111.dat	upx
behavioral2/files/0x0007000000023416-146.dat	upx
behavioral2/memory/4524-201-0x00007FF6844C0000-0x00007FF6848B2000-memory.dmp	upx
behavioral2/memory/1984-227-0x00007FF714B60000-0x00007FF714F52000-memory.dmp	upx
behavioral2/memory/212-287-0x00007FF678730000-0x00007FF678B22000-memory.dmp	upx
behavioral2/memory/2408-323-0x00007FF74D750000-0x00007FF74DB42000-memory.dmp	upx
behavioral2/memory/2184-333-0x00007FF72F060000-0x00007FF72F452000-memory.dmp	upx
behavioral2/memory/3884-359-0x00007FF740BF0000-0x00007FF740FE2000-memory.dmp	upx
behavioral2/memory/3876-363-0x00007FF671DC0000-0x00007FF6721B2000-memory.dmp	upx
behavioral2/memory/2840-362-0x00007FF737A20000-0x00007FF737E12000-memory.dmp	upx
behavioral2/memory/4100-361-0x00007FF76C520000-0x00007FF76C912000-memory.dmp	upx
behavioral2/memory/1088-360-0x00007FF7EED40000-0x00007FF7EF132000-memory.dmp	upx
behavioral2/memory/1760-358-0x00007FF6F7470000-0x00007FF6F7862000-memory.dmp	upx
behavioral2/memory/436-282-0x00007FF78F570000-0x00007FF78F962000-memory.dmp	upx
behavioral2/memory/1684-260-0x00007FF6ED640000-0x00007FF6EDA32000-memory.dmp	upx
behavioral2/memory/3140-254-0x00007FF763F40000-0x00007FF764332000-memory.dmp	upx
behavioral2/memory/5116-253-0x00007FF6B11E0000-0x00007FF6B15D2000-memory.dmp	upx
behavioral2/files/0x0007000000023422-200.dat	upx
behavioral2/files/0x0007000000023421-193.dat	upx
behavioral2/files/0x0007000000023420-188.dat	upx
behavioral2/files/0x000700000002341f-187.dat	upx
behavioral2/files/0x000700000002341e-177.dat	upx
behavioral2/files/0x000700000002340f-174.dat	upx
behavioral2/files/0x000700000002341d-170.dat	upx
behavioral2/files/0x0007000000023415-169.dat	upx
behavioral2/files/0x000700000002341c-195.dat	upx
behavioral2/memory/1020-168-0x00007FF740D50000-0x00007FF741142000-memory.dmp	upx
behavioral2/memory/2616-163-0x00007FF707C90000-0x00007FF708082000-memory.dmp	upx
behavioral2/files/0x000700000002341a-159.dat	upx
behavioral2/files/0x000700000002341b-158.dat	upx
behavioral2/files/0x0007000000023413-155.dat	upx
behavioral2/files/0x0007000000023410-181.dat	upx
behavioral2/files/0x0007000000023412-178.dat	upx
behavioral2/files/0x000700000002340b-149.dat	upx
behavioral2/files/0x0007000000023418-148.dat	upx
behavioral2/files/0x0007000000023417-147.dat	upx
behavioral2/files/0x0007000000023414-133.dat	upx
behavioral2/memory/4736-129-0x00007FF7FB420000-0x00007FF7FB812000-memory.dmp	upx
behavioral2/files/0x0007000000023411-154.dat	upx
behavioral2/files/0x0007000000023419-153.dat	upx
behavioral2/files/0x0007000000023407-119.dat	upx
behavioral2/files/0x000700000002340a-116.dat	upx
behavioral2/files/0x0007000000023409-141.dat	upx
behavioral2/files/0x000700000002340d-106.dat	upx
behavioral2/files/0x000700000002340e-136.dat	upx
behavioral2/memory/2640-96-0x00007FF64BA20000-0x00007FF64BE12000-memory.dmp	upx
behavioral2/files/0x000700000002340c-91.dat	upx
behavioral2/files/0x0008000000023401-84.dat	upx
behavioral2/files/0x0007000000023405-98.dat	upx
behavioral2/files/0x0007000000023404-73.dat	upx
behavioral2/memory/2868-69-0x00007FF7D7A40000-0x00007FF7D7E32000-memory.dmp	upx
behavioral2/files/0x0007000000023408-72.dat	upx
behavioral2/memory/632-50-0x00007FF70C1C0000-0x00007FF70C5B2000-memory.dmp	upx
behavioral2/files/0x00080000000233fc-27.dat	upx
behavioral2/files/0x00090000000233f9-21.dat	upx
behavioral2/memory/632-3850-0x00007FF70C1C0000-0x00007FF70C5B2000-memory.dmp	upx
behavioral2/memory/2640-3852-0x00007FF64BA20000-0x00007FF64BE12000-memory.dmp	upx
behavioral2/memory/2868-3854-0x00007FF7D7A40000-0x00007FF7D7E32000-memory.dmp	upx
behavioral2/memory/3884-3856-0x00007FF740BF0000-0x00007FF740FE2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\okplCRS.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\iGdmjWT.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\cHuLBTl.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\iuvfIsU.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\kWCApmZ.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\LbHFQbG.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\POmEmsb.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\ymXlvVM.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\XkpOUih.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\XyuAPJN.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\tlYkjwy.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\mCrYCqh.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\dEHyDhN.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\MGDORNN.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\gmIiIRE.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\siXRPOj.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\YPYdCJB.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\bSgTWuR.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\KOzEjyG.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\oAOKkdU.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\CGPplyr.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\gwTXAXz.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\mBJffTm.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\OcdXjBu.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\QkSVMgI.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\fzxMqEF.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\wYwoPuv.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\CcAggPa.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\kaCvNEa.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\tKIqBmU.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\WJrkQKt.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\CgpeRDq.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\ovMOibv.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\BoxPNQn.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\ZmdrMMx.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\cnEPZCV.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\adOyhEU.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\KSiDNOM.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\YcgKaTw.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\romaYrM.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\jufzKUw.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\lzaMDuX.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\EAiVkFd.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\SLwDITH.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\QxHVIvh.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\bfsfYUN.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\xpuRIHr.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\qcRnHwy.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\mohszWX.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\OuQavzu.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\ZXWUJZh.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\gzIGFgu.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\bVApsuc.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\YHbagMM.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\jtWUDvr.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\URmTwcL.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\mJXvzxw.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\qKaMAxi.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\nrjKjwu.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\UZMHUwG.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\QgpsUbk.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\yrhOFuX.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\ZJbkvxz.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
File created	C:\Windows\System\QBpENNY.exe	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1668	powershell.exe
1668	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
Token: SeDebugPrivilege	1668	powershell.exe
Token: SeLockMemoryPrivilege	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 1668	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	81
PID 2888 wrote to memory of 1668	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	81
PID 2888 wrote to memory of 3884	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	82
PID 2888 wrote to memory of 3884	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	82
PID 2888 wrote to memory of 632	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	83
PID 2888 wrote to memory of 632	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	83
PID 2888 wrote to memory of 2868	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	84
PID 2888 wrote to memory of 2868	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	84
PID 2888 wrote to memory of 2640	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	85
PID 2888 wrote to memory of 2640	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	85
PID 2888 wrote to memory of 4736	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	86
PID 2888 wrote to memory of 4736	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	86
PID 2888 wrote to memory of 4524	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	87
PID 2888 wrote to memory of 4524	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	87
PID 2888 wrote to memory of 1088	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	88
PID 2888 wrote to memory of 1088	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	88
PID 2888 wrote to memory of 2616	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	89
PID 2888 wrote to memory of 2616	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	89
PID 2888 wrote to memory of 1020	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	90
PID 2888 wrote to memory of 1020	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	90
PID 2888 wrote to memory of 1984	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	91
PID 2888 wrote to memory of 1984	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	91
PID 2888 wrote to memory of 5116	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	92
PID 2888 wrote to memory of 5116	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	92
PID 2888 wrote to memory of 4100	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	93
PID 2888 wrote to memory of 4100	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	93
PID 2888 wrote to memory of 2840	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	94
PID 2888 wrote to memory of 2840	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	94
PID 2888 wrote to memory of 3140	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	95
PID 2888 wrote to memory of 3140	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	95
PID 2888 wrote to memory of 1684	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	96
PID 2888 wrote to memory of 1684	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	96
PID 2888 wrote to memory of 436	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	97
PID 2888 wrote to memory of 436	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	97
PID 2888 wrote to memory of 3876	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	98
PID 2888 wrote to memory of 3876	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	98
PID 2888 wrote to memory of 212	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	99
PID 2888 wrote to memory of 212	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	99
PID 2888 wrote to memory of 2408	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	100
PID 2888 wrote to memory of 2408	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	100
PID 2888 wrote to memory of 2184	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	101
PID 2888 wrote to memory of 2184	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	101
PID 2888 wrote to memory of 4676	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	102
PID 2888 wrote to memory of 4676	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	102
PID 2888 wrote to memory of 1760	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	103
PID 2888 wrote to memory of 1760	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	103
PID 2888 wrote to memory of 2920	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	104
PID 2888 wrote to memory of 2920	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	104
PID 2888 wrote to memory of 3432	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	105
PID 2888 wrote to memory of 3432	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	105
PID 2888 wrote to memory of 2656	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	106
PID 2888 wrote to memory of 2656	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	106
PID 2888 wrote to memory of 4456	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	107
PID 2888 wrote to memory of 4456	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	107
PID 2888 wrote to memory of 1068	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	108
PID 2888 wrote to memory of 1068	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	108
PID 2888 wrote to memory of 1148	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	109
PID 2888 wrote to memory of 1148	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	109
PID 2888 wrote to memory of 3824	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	110
PID 2888 wrote to memory of 3824	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	110
PID 2888 wrote to memory of 3260	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	111
PID 2888 wrote to memory of 3260	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	111
PID 2888 wrote to memory of 4772	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	112
PID 2888 wrote to memory of 4772	2888	021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe	112

C:\Users\Admin\AppData\Local\Temp\021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\021d201699832ba2d6e3d46f652f5a16_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1668
- C:\Windows\System\mSDPlIc.exe
  C:\Windows\System\mSDPlIc.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System\gmIiIRE.exe
  C:\Windows\System\gmIiIRE.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\zKaPbXE.exe
  C:\Windows\System\zKaPbXE.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\zPxyvMl.exe
  C:\Windows\System\zPxyvMl.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\DENTUFs.exe
  C:\Windows\System\DENTUFs.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\KJVoqUu.exe
  C:\Windows\System\KJVoqUu.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\QEqEyKH.exe
  C:\Windows\System\QEqEyKH.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\fazkRrl.exe
  C:\Windows\System\fazkRrl.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\Poklmzc.exe
  C:\Windows\System\Poklmzc.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\ZsQXblI.exe
  C:\Windows\System\ZsQXblI.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\oTKzmqA.exe
  C:\Windows\System\oTKzmqA.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\exMdgex.exe
  C:\Windows\System\exMdgex.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\mqNKymt.exe
  C:\Windows\System\mqNKymt.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\jFIItTE.exe
  C:\Windows\System\jFIItTE.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\TIEeptF.exe
  C:\Windows\System\TIEeptF.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\HFSeFbI.exe
  C:\Windows\System\HFSeFbI.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\SseABuk.exe
  C:\Windows\System\SseABuk.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\jMxQeNF.exe
  C:\Windows\System\jMxQeNF.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\zSFsMWq.exe
  C:\Windows\System\zSFsMWq.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\WbEpfJh.exe
  C:\Windows\System\WbEpfJh.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\MIHEKJc.exe
  C:\Windows\System\MIHEKJc.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\HURTTwA.exe
  C:\Windows\System\HURTTwA.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\nnpirjr.exe
  C:\Windows\System\nnpirjr.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\akNFSoM.exe
  C:\Windows\System\akNFSoM.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\DlFBZaI.exe
  C:\Windows\System\DlFBZaI.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\HQlOgmc.exe
  C:\Windows\System\HQlOgmc.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\ASaDQIA.exe
  C:\Windows\System\ASaDQIA.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\rHcKHKd.exe
  C:\Windows\System\rHcKHKd.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\mCbhKEu.exe
  C:\Windows\System\mCbhKEu.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\SSbWpyz.exe
  C:\Windows\System\SSbWpyz.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\squhAgd.exe
  C:\Windows\System\squhAgd.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\BGJqvYM.exe
  C:\Windows\System\BGJqvYM.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\GXJghgn.exe
  C:\Windows\System\GXJghgn.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\TnAELKp.exe
  C:\Windows\System\TnAELKp.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\simVbkt.exe
  C:\Windows\System\simVbkt.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\MzYeHeW.exe
  C:\Windows\System\MzYeHeW.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\drkwOEn.exe
  C:\Windows\System\drkwOEn.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\OptfMLL.exe
  C:\Windows\System\OptfMLL.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\AzBbWQk.exe
  C:\Windows\System\AzBbWQk.exe
  2⤵
  - Executes dropped EXE
  PID:364
- C:\Windows\System\rSzrMBa.exe
  C:\Windows\System\rSzrMBa.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\MENeCxB.exe
  C:\Windows\System\MENeCxB.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\PdjRqAB.exe
  C:\Windows\System\PdjRqAB.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\FWxcOvu.exe
  C:\Windows\System\FWxcOvu.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\LYDdLfq.exe
  C:\Windows\System\LYDdLfq.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System\hMVLmzP.exe
  C:\Windows\System\hMVLmzP.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\QeClDjL.exe
  C:\Windows\System\QeClDjL.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\GxUjHga.exe
  C:\Windows\System\GxUjHga.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\zlrUkDf.exe
  C:\Windows\System\zlrUkDf.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\MgGkvFU.exe
  C:\Windows\System\MgGkvFU.exe
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\System\siykwvG.exe
  C:\Windows\System\siykwvG.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\ESXpxLF.exe
  C:\Windows\System\ESXpxLF.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\lzWBjAw.exe
  C:\Windows\System\lzWBjAw.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System\pYvkMhD.exe
  C:\Windows\System\pYvkMhD.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\oIalEqN.exe
  C:\Windows\System\oIalEqN.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\RcvntnJ.exe
  C:\Windows\System\RcvntnJ.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\ArzFpil.exe
  C:\Windows\System\ArzFpil.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\wYGKyMI.exe
  C:\Windows\System\wYGKyMI.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\rFDrVCH.exe
  C:\Windows\System\rFDrVCH.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\mMAfSaU.exe
  C:\Windows\System\mMAfSaU.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\kOzzcUN.exe
  C:\Windows\System\kOzzcUN.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\dQVbWcB.exe
  C:\Windows\System\dQVbWcB.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\aOXACEz.exe
  C:\Windows\System\aOXACEz.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\drYpUPX.exe
  C:\Windows\System\drYpUPX.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\HuajOZr.exe
  C:\Windows\System\HuajOZr.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\WgoArbU.exe
  C:\Windows\System\WgoArbU.exe
  2⤵
  PID:3996
- C:\Windows\System\fyHeWxL.exe
  C:\Windows\System\fyHeWxL.exe
  2⤵
  PID:1516
- C:\Windows\System\YuwwIpQ.exe
  C:\Windows\System\YuwwIpQ.exe
  2⤵
  PID:3436
- C:\Windows\System\hwvgGxa.exe
  C:\Windows\System\hwvgGxa.exe
  2⤵
  PID:4020
- C:\Windows\System\xahQJze.exe
  C:\Windows\System\xahQJze.exe
  2⤵
  PID:2936
- C:\Windows\System\faNRNSu.exe
  C:\Windows\System\faNRNSu.exe
  2⤵
  PID:4988
- C:\Windows\System\XKoBSZr.exe
  C:\Windows\System\XKoBSZr.exe
  2⤵
  PID:4348
- C:\Windows\System\DkRTeGi.exe
  C:\Windows\System\DkRTeGi.exe
  2⤵
  PID:3628
- C:\Windows\System\HZDTNxR.exe
  C:\Windows\System\HZDTNxR.exe
  2⤵
  PID:4588
- C:\Windows\System\NnxVTxw.exe
  C:\Windows\System\NnxVTxw.exe
  2⤵
  PID:2140
- C:\Windows\System\yExFxop.exe
  C:\Windows\System\yExFxop.exe
  2⤵
  PID:2348
- C:\Windows\System\IeRoIYI.exe
  C:\Windows\System\IeRoIYI.exe
  2⤵
  PID:3180
- C:\Windows\System\rbFnfNq.exe
  C:\Windows\System\rbFnfNq.exe
  2⤵
  PID:3028
- C:\Windows\System\WYSmIoh.exe
  C:\Windows\System\WYSmIoh.exe
  2⤵
  PID:3656
- C:\Windows\System\gHXRkCY.exe
  C:\Windows\System\gHXRkCY.exe
  2⤵
  PID:1140
- C:\Windows\System\eqEjymU.exe
  C:\Windows\System\eqEjymU.exe
  2⤵
  PID:4288
- C:\Windows\System\jiweNqE.exe
  C:\Windows\System\jiweNqE.exe
  2⤵
  PID:5132
- C:\Windows\System\xqoYdrj.exe
  C:\Windows\System\xqoYdrj.exe
  2⤵
  PID:5156
- C:\Windows\System\CZxgETn.exe
  C:\Windows\System\CZxgETn.exe
  2⤵
  PID:5180
- C:\Windows\System\GqeZbOI.exe
  C:\Windows\System\GqeZbOI.exe
  2⤵
  PID:5200
- C:\Windows\System\EmilfUY.exe
  C:\Windows\System\EmilfUY.exe
  2⤵
  PID:5216
- C:\Windows\System\sSmVRIk.exe
  C:\Windows\System\sSmVRIk.exe
  2⤵
  PID:5236
- C:\Windows\System\ULOsvQz.exe
  C:\Windows\System\ULOsvQz.exe
  2⤵
  PID:5256
- C:\Windows\System\JXXgdZE.exe
  C:\Windows\System\JXXgdZE.exe
  2⤵
  PID:5272
- C:\Windows\System\pfeMgCC.exe
  C:\Windows\System\pfeMgCC.exe
  2⤵
  PID:5380
- C:\Windows\System\IWfKTdH.exe
  C:\Windows\System\IWfKTdH.exe
  2⤵
  PID:5404
- C:\Windows\System\jxNDuRH.exe
  C:\Windows\System\jxNDuRH.exe
  2⤵
  PID:5432
- C:\Windows\System\qWPboSF.exe
  C:\Windows\System\qWPboSF.exe
  2⤵
  PID:5452
- C:\Windows\System\bREnZoe.exe
  C:\Windows\System\bREnZoe.exe
  2⤵
  PID:5472
- C:\Windows\System\AkzZwCE.exe
  C:\Windows\System\AkzZwCE.exe
  2⤵
  PID:5496
- C:\Windows\System\Cvacqqn.exe
  C:\Windows\System\Cvacqqn.exe
  2⤵
  PID:5516
- C:\Windows\System\GTmXVvu.exe
  C:\Windows\System\GTmXVvu.exe
  2⤵
  PID:5556
- C:\Windows\System\joyDPzk.exe
  C:\Windows\System\joyDPzk.exe
  2⤵
  PID:5824
- C:\Windows\System\XUpvfwS.exe
  C:\Windows\System\XUpvfwS.exe
  2⤵
  PID:5844
- C:\Windows\System\Sqdyync.exe
  C:\Windows\System\Sqdyync.exe
  2⤵
  PID:5868
- C:\Windows\System\iQbBDMN.exe
  C:\Windows\System\iQbBDMN.exe
  2⤵
  PID:5892
- C:\Windows\System\mYAfXSa.exe
  C:\Windows\System\mYAfXSa.exe
  2⤵
  PID:5944
- C:\Windows\System\fetzIKw.exe
  C:\Windows\System\fetzIKw.exe
  2⤵
  PID:5964
- C:\Windows\System\Brmwkhb.exe
  C:\Windows\System\Brmwkhb.exe
  2⤵
  PID:5984
- C:\Windows\System\EoTsrSm.exe
  C:\Windows\System\EoTsrSm.exe
  2⤵
  PID:6004
- C:\Windows\System\DGXQTie.exe
  C:\Windows\System\DGXQTie.exe
  2⤵
  PID:6028
- C:\Windows\System\jfbVSkR.exe
  C:\Windows\System\jfbVSkR.exe
  2⤵
  PID:6052
- C:\Windows\System\uRPwAGX.exe
  C:\Windows\System\uRPwAGX.exe
  2⤵
  PID:6068
- C:\Windows\System\XzKGOYE.exe
  C:\Windows\System\XzKGOYE.exe
  2⤵
  PID:6092
- C:\Windows\System\Iyofmfb.exe
  C:\Windows\System\Iyofmfb.exe
  2⤵
  PID:6116
- C:\Windows\System\NgmzBzT.exe
  C:\Windows\System\NgmzBzT.exe
  2⤵
  PID:520
- C:\Windows\System\jYjQnSf.exe
  C:\Windows\System\jYjQnSf.exe
  2⤵
  PID:2232
- C:\Windows\System\BcAuaec.exe
  C:\Windows\System\BcAuaec.exe
  2⤵
  PID:3440
- C:\Windows\System\ZeQIEGp.exe
  C:\Windows\System\ZeQIEGp.exe
  2⤵
  PID:3292
- C:\Windows\System\MMvDqLO.exe
  C:\Windows\System\MMvDqLO.exe
  2⤵
  PID:3968
- C:\Windows\System\kWwAriY.exe
  C:\Windows\System\kWwAriY.exe
  2⤵
  PID:4340
- C:\Windows\System\uipXctN.exe
  C:\Windows\System\uipXctN.exe
  2⤵
  PID:3300
- C:\Windows\System\kphWZkT.exe
  C:\Windows\System\kphWZkT.exe
  2⤵
  PID:3888
- C:\Windows\System\FOIRnTH.exe
  C:\Windows\System\FOIRnTH.exe
  2⤵
  PID:2924
- C:\Windows\System\EeiFAzM.exe
  C:\Windows\System\EeiFAzM.exe
  2⤵
  PID:4780
- C:\Windows\System\VTrHOlb.exe
  C:\Windows\System\VTrHOlb.exe
  2⤵
  PID:5124
- C:\Windows\System\FxmJkcC.exe
  C:\Windows\System\FxmJkcC.exe
  2⤵
  PID:5176
- C:\Windows\System\necgJAn.exe
  C:\Windows\System\necgJAn.exe
  2⤵
  PID:5284
- C:\Windows\System\HSrYYrx.exe
  C:\Windows\System\HSrYYrx.exe
  2⤵
  PID:5412
- C:\Windows\System\lSAsPvU.exe
  C:\Windows\System\lSAsPvU.exe
  2⤵
  PID:5464
- C:\Windows\System\nEPofGH.exe
  C:\Windows\System\nEPofGH.exe
  2⤵
  PID:5508
- C:\Windows\System\xxqnMfU.exe
  C:\Windows\System\xxqnMfU.exe
  2⤵
  PID:5564
- C:\Windows\System\nrMCwhv.exe
  C:\Windows\System\nrMCwhv.exe
  2⤵
  PID:1612
- C:\Windows\System\PKWVAhp.exe
  C:\Windows\System\PKWVAhp.exe
  2⤵
  PID:5860
- C:\Windows\System\fFteOMb.exe
  C:\Windows\System\fFteOMb.exe
  2⤵
  PID:5812
- C:\Windows\System\ZPGvwJv.exe
  C:\Windows\System\ZPGvwJv.exe
  2⤵
  PID:3364
- C:\Windows\System\rHZMsSt.exe
  C:\Windows\System\rHZMsSt.exe
  2⤵
  PID:4432
- C:\Windows\System\vfDCnXD.exe
  C:\Windows\System\vfDCnXD.exe
  2⤵
  PID:5916
- C:\Windows\System\VlhMppO.exe
  C:\Windows\System\VlhMppO.exe
  2⤵
  PID:5940
- C:\Windows\System\fHiMNCq.exe
  C:\Windows\System\fHiMNCq.exe
  2⤵
  PID:5980
- C:\Windows\System\GozdQmJ.exe
  C:\Windows\System\GozdQmJ.exe
  2⤵
  PID:6048
- C:\Windows\System\xDHITBJ.exe
  C:\Windows\System\xDHITBJ.exe
  2⤵
  PID:5528
- C:\Windows\System\MFbtOpu.exe
  C:\Windows\System\MFbtOpu.exe
  2⤵
  PID:2104
- C:\Windows\System\gJpacFN.exe
  C:\Windows\System\gJpacFN.exe
  2⤵
  PID:1260
- C:\Windows\System\iyrtEPC.exe
  C:\Windows\System\iyrtEPC.exe
  2⤵
  PID:5192
- C:\Windows\System\dqeBqTx.exe
  C:\Windows\System\dqeBqTx.exe
  2⤵
  PID:5232
- C:\Windows\System\fWJbxCh.exe
  C:\Windows\System\fWJbxCh.exe
  2⤵
  PID:5936
- C:\Windows\System\WsswZzJ.exe
  C:\Windows\System\WsswZzJ.exe
  2⤵
  PID:6172
- C:\Windows\System\JaqZmoy.exe
  C:\Windows\System\JaqZmoy.exe
  2⤵
  PID:6204
- C:\Windows\System\zIReHEu.exe
  C:\Windows\System\zIReHEu.exe
  2⤵
  PID:6228
- C:\Windows\System\FEvbEUT.exe
  C:\Windows\System\FEvbEUT.exe
  2⤵
  PID:6268
- C:\Windows\System\KxCbFpJ.exe
  C:\Windows\System\KxCbFpJ.exe
  2⤵
  PID:6284
- C:\Windows\System\uCIiRQs.exe
  C:\Windows\System\uCIiRQs.exe
  2⤵
  PID:6312
- C:\Windows\System\TNlRufy.exe
  C:\Windows\System\TNlRufy.exe
  2⤵
  PID:6328
- C:\Windows\System\TFYFhCM.exe
  C:\Windows\System\TFYFhCM.exe
  2⤵
  PID:6348
- C:\Windows\System\FgoTRVj.exe
  C:\Windows\System\FgoTRVj.exe
  2⤵
  PID:6368
- C:\Windows\System\hvHyFQy.exe
  C:\Windows\System\hvHyFQy.exe
  2⤵
  PID:6400
- C:\Windows\System\XkpOUih.exe
  C:\Windows\System\XkpOUih.exe
  2⤵
  PID:6416
- C:\Windows\System\Exwsxhj.exe
  C:\Windows\System\Exwsxhj.exe
  2⤵
  PID:6440
- C:\Windows\System\rNMRboD.exe
  C:\Windows\System\rNMRboD.exe
  2⤵
  PID:6484
- C:\Windows\System\XtwZMiE.exe
  C:\Windows\System\XtwZMiE.exe
  2⤵
  PID:6508
- C:\Windows\System\mAHhKUX.exe
  C:\Windows\System\mAHhKUX.exe
  2⤵
  PID:6532
- C:\Windows\System\TRLnpEY.exe
  C:\Windows\System\TRLnpEY.exe
  2⤵
  PID:6548
- C:\Windows\System\BFoceTh.exe
  C:\Windows\System\BFoceTh.exe
  2⤵
  PID:6568
- C:\Windows\System\NzDczlp.exe
  C:\Windows\System\NzDczlp.exe
  2⤵
  PID:6592
- C:\Windows\System\KJZuriY.exe
  C:\Windows\System\KJZuriY.exe
  2⤵
  PID:6616
- C:\Windows\System\XhgPXhl.exe
  C:\Windows\System\XhgPXhl.exe
  2⤵
  PID:6636
- C:\Windows\System\JbxwzeF.exe
  C:\Windows\System\JbxwzeF.exe
  2⤵
  PID:6664
- C:\Windows\System\WEPxUCg.exe
  C:\Windows\System\WEPxUCg.exe
  2⤵
  PID:6684
- C:\Windows\System\kPHiJLv.exe
  C:\Windows\System\kPHiJLv.exe
  2⤵
  PID:6708
- C:\Windows\System\tRjAvEC.exe
  C:\Windows\System\tRjAvEC.exe
  2⤵
  PID:6732
- C:\Windows\System\XTHANHN.exe
  C:\Windows\System\XTHANHN.exe
  2⤵
  PID:6748
- C:\Windows\System\ibzJZFx.exe
  C:\Windows\System\ibzJZFx.exe
  2⤵
  PID:6776
- C:\Windows\System\zUyIGrr.exe
  C:\Windows\System\zUyIGrr.exe
  2⤵
  PID:6792
- C:\Windows\System\OcdXjBu.exe
  C:\Windows\System\OcdXjBu.exe
  2⤵
  PID:6820
- C:\Windows\System\lzvXLfn.exe
  C:\Windows\System\lzvXLfn.exe
  2⤵
  PID:6836
- C:\Windows\System\BKdljYO.exe
  C:\Windows\System\BKdljYO.exe
  2⤵
  PID:6868
- C:\Windows\System\HpqSfSF.exe
  C:\Windows\System\HpqSfSF.exe
  2⤵
  PID:6892
- C:\Windows\System\JexOZnB.exe
  C:\Windows\System\JexOZnB.exe
  2⤵
  PID:6908
- C:\Windows\System\LMTlJUm.exe
  C:\Windows\System\LMTlJUm.exe
  2⤵
  PID:6928
- C:\Windows\System\gTjiNVm.exe
  C:\Windows\System\gTjiNVm.exe
  2⤵
  PID:6952
- C:\Windows\System\FdJnvEy.exe
  C:\Windows\System\FdJnvEy.exe
  2⤵
  PID:6972
- C:\Windows\System\nnjoQlN.exe
  C:\Windows\System\nnjoQlN.exe
  2⤵
  PID:7000
- C:\Windows\System\ZkPFAuf.exe
  C:\Windows\System\ZkPFAuf.exe
  2⤵
  PID:7024
- C:\Windows\System\tsomqNA.exe
  C:\Windows\System\tsomqNA.exe
  2⤵
  PID:7044
- C:\Windows\System\PFQxYEd.exe
  C:\Windows\System\PFQxYEd.exe
  2⤵
  PID:7072
- C:\Windows\System\dnXbmag.exe
  C:\Windows\System\dnXbmag.exe
  2⤵
  PID:7092
- C:\Windows\System\HwPyctb.exe
  C:\Windows\System\HwPyctb.exe
  2⤵
  PID:7116
- C:\Windows\System\zwqzKtX.exe
  C:\Windows\System\zwqzKtX.exe
  2⤵
  PID:7140
- C:\Windows\System\bZSsfAD.exe
  C:\Windows\System\bZSsfAD.exe
  2⤵
  PID:7160
- C:\Windows\System\mQmZgpP.exe
  C:\Windows\System\mQmZgpP.exe
  2⤵
  PID:5344
- C:\Windows\System\FIxIlrw.exe
  C:\Windows\System\FIxIlrw.exe
  2⤵
  PID:5480
- C:\Windows\System\TitHmce.exe
  C:\Windows\System\TitHmce.exe
  2⤵
  PID:3788
- C:\Windows\System\vfPuVXG.exe
  C:\Windows\System\vfPuVXG.exe
  2⤵
  PID:3428
- C:\Windows\System\fJActYj.exe
  C:\Windows\System\fJActYj.exe
  2⤵
  PID:748
- C:\Windows\System\tzZPxGk.exe
  C:\Windows\System\tzZPxGk.exe
  2⤵
  PID:6212
- C:\Windows\System\yCyoKSO.exe
  C:\Windows\System\yCyoKSO.exe
  2⤵
  PID:5820
- C:\Windows\System\qkBJDzA.exe
  C:\Windows\System\qkBJDzA.exe
  2⤵
  PID:6124
- C:\Windows\System\INcErqp.exe
  C:\Windows\System\INcErqp.exe
  2⤵
  PID:5928
- C:\Windows\System\szTcygo.exe
  C:\Windows\System\szTcygo.exe
  2⤵
  PID:440
- C:\Windows\System\kyNLFHI.exe
  C:\Windows\System\kyNLFHI.exe
  2⤵
  PID:5092
- C:\Windows\System\BfEViba.exe
  C:\Windows\System\BfEViba.exe
  2⤵
  PID:3808
- C:\Windows\System\LFfXlGG.exe
  C:\Windows\System\LFfXlGG.exe
  2⤵
  PID:6100
- C:\Windows\System\LbwbwUY.exe
  C:\Windows\System\LbwbwUY.exe
  2⤵
  PID:6148
- C:\Windows\System\RBzbEEC.exe
  C:\Windows\System\RBzbEEC.exe
  2⤵
  PID:6304
- C:\Windows\System\lMTDcgl.exe
  C:\Windows\System\lMTDcgl.exe
  2⤵
  PID:6476
- C:\Windows\System\RFUFRXS.exe
  C:\Windows\System\RFUFRXS.exe
  2⤵
  PID:1812
- C:\Windows\System\FXFJVAD.exe
  C:\Windows\System\FXFJVAD.exe
  2⤵
  PID:3032
- C:\Windows\System\hlgAOVN.exe
  C:\Windows\System\hlgAOVN.exe
  2⤵
  PID:6436
- C:\Windows\System\njJuOEu.exe
  C:\Windows\System\njJuOEu.exe
  2⤵
  PID:6720
- C:\Windows\System\NWnVSkt.exe
  C:\Windows\System\NWnVSkt.exe
  2⤵
  PID:6360
- C:\Windows\System\NGAiYHw.exe
  C:\Windows\System\NGAiYHw.exe
  2⤵
  PID:1252
- C:\Windows\System\GFXBBsP.exe
  C:\Windows\System\GFXBBsP.exe
  2⤵
  PID:6588
- C:\Windows\System\DIwcktc.exe
  C:\Windows\System\DIwcktc.exe
  2⤵
  PID:6644
- C:\Windows\System\edXeNTV.exe
  C:\Windows\System\edXeNTV.exe
  2⤵
  PID:6968
- C:\Windows\System\VxUEdSU.exe
  C:\Windows\System\VxUEdSU.exe
  2⤵
  PID:6704
- C:\Windows\System\xARslFX.exe
  C:\Windows\System\xARslFX.exe
  2⤵
  PID:7016
- C:\Windows\System\UPeKnHs.exe
  C:\Windows\System\UPeKnHs.exe
  2⤵
  PID:7052
- C:\Windows\System\TSCPaku.exe
  C:\Windows\System\TSCPaku.exe
  2⤵
  PID:6804
- C:\Windows\System\GKIOfMV.exe
  C:\Windows\System\GKIOfMV.exe
  2⤵
  PID:6504
- C:\Windows\System\CKGgmIg.exe
  C:\Windows\System\CKGgmIg.exe
  2⤵
  PID:7156
- C:\Windows\System\iGdmjWT.exe
  C:\Windows\System\iGdmjWT.exe
  2⤵
  PID:6584
- C:\Windows\System\ffYUddM.exe
  C:\Windows\System\ffYUddM.exe
  2⤵
  PID:2396
- C:\Windows\System\JvgCHyd.exe
  C:\Windows\System\JvgCHyd.exe
  2⤵
  PID:3420
- C:\Windows\System\WTmmJfO.exe
  C:\Windows\System\WTmmJfO.exe
  2⤵
  PID:2268
- C:\Windows\System\aWsnrjs.exe
  C:\Windows\System\aWsnrjs.exe
  2⤵
  PID:7056
- C:\Windows\System\UvuOEHi.exe
  C:\Windows\System\UvuOEHi.exe
  2⤵
  PID:7084
- C:\Windows\System\XZhgGJt.exe
  C:\Windows\System\XZhgGJt.exe
  2⤵
  PID:3948
- C:\Windows\System\DGZkWLG.exe
  C:\Windows\System\DGZkWLG.exe
  2⤵
  PID:6456
- C:\Windows\System\IOMcaNk.exe
  C:\Windows\System\IOMcaNk.exe
  2⤵
  PID:5016
- C:\Windows\System\IxokOYU.exe
  C:\Windows\System\IxokOYU.exe
  2⤵
  PID:7176
- C:\Windows\System\uXwoDvV.exe
  C:\Windows\System\uXwoDvV.exe
  2⤵
  PID:7196
- C:\Windows\System\IctzbAx.exe
  C:\Windows\System\IctzbAx.exe
  2⤵
  PID:7220
- C:\Windows\System\KrVDNkk.exe
  C:\Windows\System\KrVDNkk.exe
  2⤵
  PID:7244
- C:\Windows\System\uZhQDFT.exe
  C:\Windows\System\uZhQDFT.exe
  2⤵
  PID:7264
- C:\Windows\System\vfxxJmF.exe
  C:\Windows\System\vfxxJmF.exe
  2⤵
  PID:7288
- C:\Windows\System\naKbpaO.exe
  C:\Windows\System\naKbpaO.exe
  2⤵
  PID:7316
- C:\Windows\System\gKNrRjq.exe
  C:\Windows\System\gKNrRjq.exe
  2⤵
  PID:7336
- C:\Windows\System\JaBuNCd.exe
  C:\Windows\System\JaBuNCd.exe
  2⤵
  PID:7360
- C:\Windows\System\ltyQMOu.exe
  C:\Windows\System\ltyQMOu.exe
  2⤵
  PID:7380
- C:\Windows\System\iQFyulh.exe
  C:\Windows\System\iQFyulh.exe
  2⤵
  PID:7404
- C:\Windows\System\WXXIbGd.exe
  C:\Windows\System\WXXIbGd.exe
  2⤵
  PID:7428
- C:\Windows\System\svlElGr.exe
  C:\Windows\System\svlElGr.exe
  2⤵
  PID:7444
- C:\Windows\System\ZpRsnTt.exe
  C:\Windows\System\ZpRsnTt.exe
  2⤵
  PID:7468
- C:\Windows\System\qBppqZt.exe
  C:\Windows\System\qBppqZt.exe
  2⤵
  PID:7492
- C:\Windows\System\vocuEFU.exe
  C:\Windows\System\vocuEFU.exe
  2⤵
  PID:7512
- C:\Windows\System\QFkVKRd.exe
  C:\Windows\System\QFkVKRd.exe
  2⤵
  PID:7532
- C:\Windows\System\xteJWhR.exe
  C:\Windows\System\xteJWhR.exe
  2⤵
  PID:7560
- C:\Windows\System\tzHnsfx.exe
  C:\Windows\System\tzHnsfx.exe
  2⤵
  PID:7584
- C:\Windows\System\IbhVCMb.exe
  C:\Windows\System\IbhVCMb.exe
  2⤵
  PID:7608
- C:\Windows\System\tnIfIYP.exe
  C:\Windows\System\tnIfIYP.exe
  2⤵
  PID:7628
- C:\Windows\System\khvHjNf.exe
  C:\Windows\System\khvHjNf.exe
  2⤵
  PID:7648
- C:\Windows\System\ydPSZph.exe
  C:\Windows\System\ydPSZph.exe
  2⤵
  PID:7676
- C:\Windows\System\cEoHEKQ.exe
  C:\Windows\System\cEoHEKQ.exe
  2⤵
  PID:7700
- C:\Windows\System\nQEuPEn.exe
  C:\Windows\System\nQEuPEn.exe
  2⤵
  PID:7732
- C:\Windows\System\ikYPVpe.exe
  C:\Windows\System\ikYPVpe.exe
  2⤵
  PID:7760
- C:\Windows\System\dHXePBp.exe
  C:\Windows\System\dHXePBp.exe
  2⤵
  PID:7780
- C:\Windows\System\VDCxtBL.exe
  C:\Windows\System\VDCxtBL.exe
  2⤵
  PID:7808
- C:\Windows\System\SUUKvds.exe
  C:\Windows\System\SUUKvds.exe
  2⤵
  PID:7832
- C:\Windows\System\gOZTQEP.exe
  C:\Windows\System\gOZTQEP.exe
  2⤵
  PID:7856
- C:\Windows\System\UGsPyQN.exe
  C:\Windows\System\UGsPyQN.exe
  2⤵
  PID:7876
- C:\Windows\System\XbgEZaY.exe
  C:\Windows\System\XbgEZaY.exe
  2⤵
  PID:7904
- C:\Windows\System\UOMvTmm.exe
  C:\Windows\System\UOMvTmm.exe
  2⤵
  PID:7932
- C:\Windows\System\CsUzYjy.exe
  C:\Windows\System\CsUzYjy.exe
  2⤵
  PID:7956
- C:\Windows\System\XSYcybv.exe
  C:\Windows\System\XSYcybv.exe
  2⤵
  PID:7976
- C:\Windows\System\XyuAPJN.exe
  C:\Windows\System\XyuAPJN.exe
  2⤵
  PID:8000
- C:\Windows\System\PkVEGLY.exe
  C:\Windows\System\PkVEGLY.exe
  2⤵
  PID:8036
- C:\Windows\System\ozrKVst.exe
  C:\Windows\System\ozrKVst.exe
  2⤵
  PID:8056
- C:\Windows\System\oSNtWED.exe
  C:\Windows\System\oSNtWED.exe
  2⤵
  PID:8076
- C:\Windows\System\sPzhZea.exe
  C:\Windows\System\sPzhZea.exe
  2⤵
  PID:8096
- C:\Windows\System\mgrkmyR.exe
  C:\Windows\System\mgrkmyR.exe
  2⤵
  PID:8120
- C:\Windows\System\UEPQpzy.exe
  C:\Windows\System\UEPQpzy.exe
  2⤵
  PID:8148
- C:\Windows\System\pzQSZWN.exe
  C:\Windows\System\pzQSZWN.exe
  2⤵
  PID:8168
- C:\Windows\System\FSloQna.exe
  C:\Windows\System\FSloQna.exe
  2⤵
  PID:8188
- C:\Windows\System\dJVeMBq.exe
  C:\Windows\System\dJVeMBq.exe
  2⤵
  PID:5832
- C:\Windows\System\RcACGEK.exe
  C:\Windows\System\RcACGEK.exe
  2⤵
  PID:4328
- C:\Windows\System\kzRefBH.exe
  C:\Windows\System\kzRefBH.exe
  2⤵
  PID:6564
- C:\Windows\System\cGTdmvv.exe
  C:\Windows\System\cGTdmvv.exe
  2⤵
  PID:6280
- C:\Windows\System\giIdopm.exe
  C:\Windows\System\giIdopm.exe
  2⤵
  PID:4752
- C:\Windows\System\uEcwGbB.exe
  C:\Windows\System\uEcwGbB.exe
  2⤵
  PID:6700
- C:\Windows\System\ukqAaZT.exe
  C:\Windows\System\ukqAaZT.exe
  2⤵
  PID:4352
- C:\Windows\System\KpXExQk.exe
  C:\Windows\System\KpXExQk.exe
  2⤵
  PID:7324
- C:\Windows\System\OtWYYyh.exe
  C:\Windows\System\OtWYYyh.exe
  2⤵
  PID:1748
- C:\Windows\System\cDYSERG.exe
  C:\Windows\System\cDYSERG.exe
  2⤵
  PID:7480
- C:\Windows\System\bJRERHp.exe
  C:\Windows\System\bJRERHp.exe
  2⤵
  PID:5924
- C:\Windows\System\EuhUWyy.exe
  C:\Windows\System\EuhUWyy.exe
  2⤵
  PID:6876
- C:\Windows\System\SEIlmKL.exe
  C:\Windows\System\SEIlmKL.exe
  2⤵
  PID:3472
- C:\Windows\System\AhPCXHL.exe
  C:\Windows\System\AhPCXHL.exe
  2⤵
  PID:6648
- C:\Windows\System\rnnCMkK.exe
  C:\Windows\System\rnnCMkK.exe
  2⤵
  PID:7776
- C:\Windows\System\pIWqyQV.exe
  C:\Windows\System\pIWqyQV.exe
  2⤵
  PID:7204
- C:\Windows\System\QvLgMOR.exe
  C:\Windows\System\QvLgMOR.exe
  2⤵
  PID:7280
- C:\Windows\System\txcxXKQ.exe
  C:\Windows\System\txcxXKQ.exe
  2⤵
  PID:7388
- C:\Windows\System\tNIBIFG.exe
  C:\Windows\System\tNIBIFG.exe
  2⤵
  PID:7424
- C:\Windows\System\QgpsUbk.exe
  C:\Windows\System\QgpsUbk.exe
  2⤵
  PID:6412
- C:\Windows\System\NZMhrwT.exe
  C:\Windows\System\NZMhrwT.exe
  2⤵
  PID:6756
- C:\Windows\System\gdPCHoC.exe
  C:\Windows\System\gdPCHoC.exe
  2⤵
  PID:8228
- C:\Windows\System\FBmAiST.exe
  C:\Windows\System\FBmAiST.exe
  2⤵
  PID:8252
- C:\Windows\System\Emrdoik.exe
  C:\Windows\System\Emrdoik.exe
  2⤵
  PID:8276
- C:\Windows\System\NuyTAuV.exe
  C:\Windows\System\NuyTAuV.exe
  2⤵
  PID:8300
- C:\Windows\System\YfNLDaU.exe
  C:\Windows\System\YfNLDaU.exe
  2⤵
  PID:8324
- C:\Windows\System\cpGVqdq.exe
  C:\Windows\System\cpGVqdq.exe
  2⤵
  PID:8356
- C:\Windows\System\cCetsvO.exe
  C:\Windows\System\cCetsvO.exe
  2⤵
  PID:8380
- C:\Windows\System\YbeXmEY.exe
  C:\Windows\System\YbeXmEY.exe
  2⤵
  PID:8400
- C:\Windows\System\DQoQVVB.exe
  C:\Windows\System\DQoQVVB.exe
  2⤵
  PID:8432
- C:\Windows\System\GZlJdPq.exe
  C:\Windows\System\GZlJdPq.exe
  2⤵
  PID:8452
- C:\Windows\System\OlCqMbA.exe
  C:\Windows\System\OlCqMbA.exe
  2⤵
  PID:8472
- C:\Windows\System\tiwoRdj.exe
  C:\Windows\System\tiwoRdj.exe
  2⤵
  PID:8492
- C:\Windows\System\yxpMcfD.exe
  C:\Windows\System\yxpMcfD.exe
  2⤵
  PID:8516
- C:\Windows\System\vrHshQu.exe
  C:\Windows\System\vrHshQu.exe
  2⤵
  PID:8532
- C:\Windows\System\UEHABik.exe
  C:\Windows\System\UEHABik.exe
  2⤵
  PID:8552
- C:\Windows\System\GKWCzrH.exe
  C:\Windows\System\GKWCzrH.exe
  2⤵
  PID:8572
- C:\Windows\System\oMMIQoE.exe
  C:\Windows\System\oMMIQoE.exe
  2⤵
  PID:8600
- C:\Windows\System\zzKizxQ.exe
  C:\Windows\System\zzKizxQ.exe
  2⤵
  PID:8624
- C:\Windows\System\NNbESit.exe
  C:\Windows\System\NNbESit.exe
  2⤵
  PID:8648
- C:\Windows\System\fgUZJyu.exe
  C:\Windows\System\fgUZJyu.exe
  2⤵
  PID:8664
- C:\Windows\System\Ceoiori.exe
  C:\Windows\System\Ceoiori.exe
  2⤵
  PID:8688
- C:\Windows\System\pyhKvqO.exe
  C:\Windows\System\pyhKvqO.exe
  2⤵
  PID:8712
- C:\Windows\System\fdptVoC.exe
  C:\Windows\System\fdptVoC.exe
  2⤵
  PID:8736
- C:\Windows\System\kzjfgEy.exe
  C:\Windows\System\kzjfgEy.exe
  2⤵
  PID:8764
- C:\Windows\System\ZqrUhyJ.exe
  C:\Windows\System\ZqrUhyJ.exe
  2⤵
  PID:8784
- C:\Windows\System\JdTGiJd.exe
  C:\Windows\System\JdTGiJd.exe
  2⤵
  PID:8804
- C:\Windows\System\XmjgOhD.exe
  C:\Windows\System\XmjgOhD.exe
  2⤵
  PID:8828
- C:\Windows\System\vwfjlSS.exe
  C:\Windows\System\vwfjlSS.exe
  2⤵
  PID:8852
- C:\Windows\System\kozctrK.exe
  C:\Windows\System\kozctrK.exe
  2⤵
  PID:8876
- C:\Windows\System\LFIzoHG.exe
  C:\Windows\System\LFIzoHG.exe
  2⤵
  PID:8900
- C:\Windows\System\isVObox.exe
  C:\Windows\System\isVObox.exe
  2⤵
  PID:8932
- C:\Windows\System\xBpvRXD.exe
  C:\Windows\System\xBpvRXD.exe
  2⤵
  PID:8948
- C:\Windows\System\VikxyKu.exe
  C:\Windows\System\VikxyKu.exe
  2⤵
  PID:8972
- C:\Windows\System\hkyYqDQ.exe
  C:\Windows\System\hkyYqDQ.exe
  2⤵
  PID:8988
- C:\Windows\System\VBlwbEH.exe
  C:\Windows\System\VBlwbEH.exe
  2⤵
  PID:9016
- C:\Windows\System\pwGMGgr.exe
  C:\Windows\System\pwGMGgr.exe
  2⤵
  PID:9040
- C:\Windows\System\IrQDrAa.exe
  C:\Windows\System\IrQDrAa.exe
  2⤵
  PID:9068
- C:\Windows\System\UznwTlr.exe
  C:\Windows\System\UznwTlr.exe
  2⤵
  PID:9096
- C:\Windows\System\YfSyWoc.exe
  C:\Windows\System\YfSyWoc.exe
  2⤵
  PID:9120
- C:\Windows\System\LniBBnj.exe
  C:\Windows\System\LniBBnj.exe
  2⤵
  PID:9148
- C:\Windows\System\pOlsClT.exe
  C:\Windows\System\pOlsClT.exe
  2⤵
  PID:9172
- C:\Windows\System\sWYnZzO.exe
  C:\Windows\System\sWYnZzO.exe
  2⤵
  PID:9192
- C:\Windows\System\LaKCJDR.exe
  C:\Windows\System\LaKCJDR.exe
  2⤵
  PID:9212
- C:\Windows\System\fAydyKt.exe
  C:\Windows\System\fAydyKt.exe
  2⤵
  PID:7624
- C:\Windows\System\tmyKxAH.exe
  C:\Windows\System\tmyKxAH.exe
  2⤵
  PID:5804
- C:\Windows\System\tlYkjwy.exe
  C:\Windows\System\tlYkjwy.exe
  2⤵
  PID:7664
- C:\Windows\System\rFBYPMg.exe
  C:\Windows\System\rFBYPMg.exe
  2⤵
  PID:224
- C:\Windows\System\CvaxdPC.exe
  C:\Windows\System\CvaxdPC.exe
  2⤵
  PID:7352
- C:\Windows\System\FQMauMf.exe
  C:\Windows\System\FQMauMf.exe
  2⤵
  PID:6012
- C:\Windows\System\txqaDRU.exe
  C:\Windows\System\txqaDRU.exe
  2⤵
  PID:7772
- C:\Windows\System\jzxWGyk.exe
  C:\Windows\System\jzxWGyk.exe
  2⤵
  PID:7828
- C:\Windows\System\vpqIdQZ.exe
  C:\Windows\System\vpqIdQZ.exe
  2⤵
  PID:7344
- C:\Windows\System\qnKWmTb.exe
  C:\Windows\System\qnKWmTb.exe
  2⤵
  PID:7944
- C:\Windows\System\VDWwpXG.exe
  C:\Windows\System\VDWwpXG.exe
  2⤵
  PID:7872
- C:\Windows\System\EoXKZef.exe
  C:\Windows\System\EoXKZef.exe
  2⤵
  PID:8020
- C:\Windows\System\VtuPmaS.exe
  C:\Windows\System\VtuPmaS.exe
  2⤵
  PID:7540
- C:\Windows\System\aeJsXxT.exe
  C:\Windows\System\aeJsXxT.exe
  2⤵
  PID:7576
- C:\Windows\System\CVXQqoS.exe
  C:\Windows\System\CVXQqoS.exe
  2⤵
  PID:8208
- C:\Windows\System\WBuarnt.exe
  C:\Windows\System\WBuarnt.exe
  2⤵
  PID:8104
- C:\Windows\System\WgsAodS.exe
  C:\Windows\System\WgsAodS.exe
  2⤵
  PID:2552
- C:\Windows\System\vNBKnnq.exe
  C:\Windows\System\vNBKnnq.exe
  2⤵
  PID:8144
- C:\Windows\System\Eswfjqt.exe
  C:\Windows\System\Eswfjqt.exe
  2⤵
  PID:8372
- C:\Windows\System\WjqzThK.exe
  C:\Windows\System\WjqzThK.exe
  2⤵
  PID:6604
- C:\Windows\System\GNKXNuF.exe
  C:\Windows\System\GNKXNuF.exe
  2⤵
  PID:8460
- C:\Windows\System\hYMLbpI.exe
  C:\Windows\System\hYMLbpI.exe
  2⤵
  PID:8524
- C:\Windows\System\nItHMMa.exe
  C:\Windows\System\nItHMMa.exe
  2⤵
  PID:8568
- C:\Windows\System\CEDTQKM.exe
  C:\Windows\System\CEDTQKM.exe
  2⤵
  PID:7452
- C:\Windows\System\WRPoxSl.exe
  C:\Windows\System\WRPoxSl.exe
  2⤵
  PID:8708
- C:\Windows\System\NjeFfAG.exe
  C:\Windows\System\NjeFfAG.exe
  2⤵
  PID:7844
- C:\Windows\System\ijoopxF.exe
  C:\Windows\System\ijoopxF.exe
  2⤵
  PID:8872
- C:\Windows\System\hzHFMbe.exe
  C:\Windows\System\hzHFMbe.exe
  2⤵
  PID:7688
- C:\Windows\System\XsQnEXt.exe
  C:\Windows\System\XsQnEXt.exe
  2⤵
  PID:9232
- C:\Windows\System\rtNGCvW.exe
  C:\Windows\System\rtNGCvW.exe
  2⤵
  PID:9256
- C:\Windows\System\rrULggz.exe
  C:\Windows\System\rrULggz.exe
  2⤵
  PID:9272
- C:\Windows\System\iuFwXWr.exe
  C:\Windows\System\iuFwXWr.exe
  2⤵
  PID:9292
- C:\Windows\System\UnvjtsI.exe
  C:\Windows\System\UnvjtsI.exe
  2⤵
  PID:9320
- C:\Windows\System\olRQiGo.exe
  C:\Windows\System\olRQiGo.exe
  2⤵
  PID:9340
- C:\Windows\System\tBvEiET.exe
  C:\Windows\System\tBvEiET.exe
  2⤵
  PID:9360
- C:\Windows\System\WOshnvy.exe
  C:\Windows\System\WOshnvy.exe
  2⤵
  PID:9384
- C:\Windows\System\YmsYxGh.exe
  C:\Windows\System\YmsYxGh.exe
  2⤵
  PID:9408
- C:\Windows\System\AJZOLat.exe
  C:\Windows\System\AJZOLat.exe
  2⤵
  PID:9436
- C:\Windows\System\TqroGHv.exe
  C:\Windows\System\TqroGHv.exe
  2⤵
  PID:9456
- C:\Windows\System\yOGhklG.exe
  C:\Windows\System\yOGhklG.exe
  2⤵
  PID:9476
- C:\Windows\System\WTrebjv.exe
  C:\Windows\System\WTrebjv.exe
  2⤵
  PID:10016
- C:\Windows\System\DWasUKY.exe
  C:\Windows\System\DWasUKY.exe
  2⤵
  PID:10052
- C:\Windows\System\RGdWHZq.exe
  C:\Windows\System\RGdWHZq.exe
  2⤵
  PID:10072
- C:\Windows\System\AXhWXZF.exe
  C:\Windows\System\AXhWXZF.exe
  2⤵
  PID:10096
- C:\Windows\System\Rigtqig.exe
  C:\Windows\System\Rigtqig.exe
  2⤵
  PID:10120
- C:\Windows\System\NttjdrV.exe
  C:\Windows\System\NttjdrV.exe
  2⤵
  PID:10140
- C:\Windows\System\rhPuclF.exe
  C:\Windows\System\rhPuclF.exe
  2⤵
  PID:10168
- C:\Windows\System\RRxkTCO.exe
  C:\Windows\System\RRxkTCO.exe
  2⤵
  PID:10192
- C:\Windows\System\BSuqrfV.exe
  C:\Windows\System\BSuqrfV.exe
  2⤵
  PID:10216
- C:\Windows\System\UZWykfT.exe
  C:\Windows\System\UZWykfT.exe
  2⤵
  PID:8984
- C:\Windows\System\VXBPsRb.exe
  C:\Windows\System\VXBPsRb.exe
  2⤵
  PID:7900
- C:\Windows\System\DGlWqiH.exe
  C:\Windows\System\DGlWqiH.exe
  2⤵
  PID:7992
- C:\Windows\System\qhTLNSO.exe
  C:\Windows\System\qhTLNSO.exe
  2⤵
  PID:9140
- C:\Windows\System\LWnxlcP.exe
  C:\Windows\System\LWnxlcP.exe
  2⤵
  PID:1604
- C:\Windows\System\MQPqLqC.exe
  C:\Windows\System\MQPqLqC.exe
  2⤵
  PID:6784
- C:\Windows\System\DXRNQtc.exe
  C:\Windows\System\DXRNQtc.exe
  2⤵
  PID:8512
- C:\Windows\System\ZVWrvYD.exe
  C:\Windows\System\ZVWrvYD.exe
  2⤵
  PID:8760
- C:\Windows\System\RStPQTG.exe
  C:\Windows\System\RStPQTG.exe
  2⤵
  PID:8800
- C:\Windows\System\PrnLVdB.exe
  C:\Windows\System\PrnLVdB.exe
  2⤵
  PID:8892
- C:\Windows\System\fBMtohw.exe
  C:\Windows\System\fBMtohw.exe
  2⤵
  PID:9392
- C:\Windows\System\geeaShc.exe
  C:\Windows\System\geeaShc.exe
  2⤵
  PID:7504
- C:\Windows\System\pZdkYTY.exe
  C:\Windows\System\pZdkYTY.exe
  2⤵
  PID:8548
- C:\Windows\System\YLyWoEo.exe
  C:\Windows\System\YLyWoEo.exe
  2⤵
  PID:9588
- C:\Windows\System\ZFgdfhn.exe
  C:\Windows\System\ZFgdfhn.exe
  2⤵
  PID:8540
- C:\Windows\System\IiaYQqs.exe
  C:\Windows\System\IiaYQqs.exe
  2⤵
  PID:8848
- C:\Windows\System\JgVTWNk.exe
  C:\Windows\System\JgVTWNk.exe
  2⤵
  PID:7192
- C:\Windows\System\TKYOVtV.exe
  C:\Windows\System\TKYOVtV.exe
  2⤵
  PID:9224
- C:\Windows\System\lJTKJUJ.exe
  C:\Windows\System\lJTKJUJ.exe
  2⤵
  PID:9348
- C:\Windows\System\IXxZRcd.exe
  C:\Windows\System\IXxZRcd.exe
  2⤵
  PID:9468
- C:\Windows\System\PdjXqIe.exe
  C:\Windows\System\PdjXqIe.exe
  2⤵
  PID:8956
- C:\Windows\System\apVnMEG.exe
  C:\Windows\System\apVnMEG.exe
  2⤵
  PID:9716
- C:\Windows\System\sQlBFTe.exe
  C:\Windows\System\sQlBFTe.exe
  2⤵
  PID:9484
- C:\Windows\System\VXFWDxL.exe
  C:\Windows\System\VXFWDxL.exe
  2⤵
  PID:1624
- C:\Windows\System\zHdXWPO.exe
  C:\Windows\System\zHdXWPO.exe
  2⤵
  PID:8424
- C:\Windows\System\SGQEYQR.exe
  C:\Windows\System\SGQEYQR.exe
  2⤵
  PID:10252
- C:\Windows\System\eLFGdZY.exe
  C:\Windows\System\eLFGdZY.exe
  2⤵
  PID:10284
- C:\Windows\System\xGRlMOA.exe
  C:\Windows\System\xGRlMOA.exe
  2⤵
  PID:10308
- C:\Windows\System\ekXVHmU.exe
  C:\Windows\System\ekXVHmU.exe
  2⤵
  PID:10344
- C:\Windows\System\DQCwAvj.exe
  C:\Windows\System\DQCwAvj.exe
  2⤵
  PID:10360
- C:\Windows\System\mWayebQ.exe
  C:\Windows\System\mWayebQ.exe
  2⤵
  PID:10376
- C:\Windows\System\GzgLcDj.exe
  C:\Windows\System\GzgLcDj.exe
  2⤵
  PID:10392
- C:\Windows\System\NRWQdzz.exe
  C:\Windows\System\NRWQdzz.exe
  2⤵
  PID:10408
- C:\Windows\System\ryipokL.exe
  C:\Windows\System\ryipokL.exe
  2⤵
  PID:10424
- C:\Windows\System\yUiZNKB.exe
  C:\Windows\System\yUiZNKB.exe
  2⤵
  PID:10440
- C:\Windows\System\vYYOieC.exe
  C:\Windows\System\vYYOieC.exe
  2⤵
  PID:10456
- C:\Windows\System\YxVvAJH.exe
  C:\Windows\System\YxVvAJH.exe
  2⤵
  PID:10476
- C:\Windows\System\YhcBLCr.exe
  C:\Windows\System\YhcBLCr.exe
  2⤵
  PID:10504
- C:\Windows\System\VKAmDEe.exe
  C:\Windows\System\VKAmDEe.exe
  2⤵
  PID:10528
- C:\Windows\System\uVaIiWB.exe
  C:\Windows\System\uVaIiWB.exe
  2⤵
  PID:10564
- C:\Windows\System\RyQVVXQ.exe
  C:\Windows\System\RyQVVXQ.exe
  2⤵
  PID:10580
- C:\Windows\System\DJGgXLL.exe
  C:\Windows\System\DJGgXLL.exe
  2⤵
  PID:10608
- C:\Windows\System\BpiHbyM.exe
  C:\Windows\System\BpiHbyM.exe
  2⤵
  PID:10640
- C:\Windows\System\LojVoZq.exe
  C:\Windows\System\LojVoZq.exe
  2⤵
  PID:10660
- C:\Windows\System\KHVfvZs.exe
  C:\Windows\System\KHVfvZs.exe
  2⤵
  PID:10688
- C:\Windows\System\LOqHwwK.exe
  C:\Windows\System\LOqHwwK.exe
  2⤵
  PID:10716
- C:\Windows\System\TrOgxrM.exe
  C:\Windows\System\TrOgxrM.exe
  2⤵
  PID:10752
- C:\Windows\System\qpRQVeq.exe
  C:\Windows\System\qpRQVeq.exe
  2⤵
  PID:10772
- C:\Windows\System\uoepbWD.exe
  C:\Windows\System\uoepbWD.exe
  2⤵
  PID:10792
- C:\Windows\System\zazRBZz.exe
  C:\Windows\System\zazRBZz.exe
  2⤵
  PID:10820
- C:\Windows\System\zCNcpwI.exe
  C:\Windows\System\zCNcpwI.exe
  2⤵
  PID:10844
- C:\Windows\System\GGgfRIS.exe
  C:\Windows\System\GGgfRIS.exe
  2⤵
  PID:10868
- C:\Windows\System\mYVKpQm.exe
  C:\Windows\System\mYVKpQm.exe
  2⤵
  PID:10888
- C:\Windows\System\pykcBUs.exe
  C:\Windows\System\pykcBUs.exe
  2⤵
  PID:10912
- C:\Windows\System\YcCqASb.exe
  C:\Windows\System\YcCqASb.exe
  2⤵
  PID:10940
- C:\Windows\System\koyaZEd.exe
  C:\Windows\System\koyaZEd.exe
  2⤵
  PID:10964
- C:\Windows\System\xeaotbF.exe
  C:\Windows\System\xeaotbF.exe
  2⤵
  PID:10988
- C:\Windows\System\EutXNVR.exe
  C:\Windows\System\EutXNVR.exe
  2⤵
  PID:11020
- C:\Windows\System\XLAlkWF.exe
  C:\Windows\System\XLAlkWF.exe
  2⤵
  PID:11048
- C:\Windows\System\nIRrbWy.exe
  C:\Windows\System\nIRrbWy.exe
  2⤵
  PID:11068
- C:\Windows\System\cSaeZAa.exe
  C:\Windows\System\cSaeZAa.exe
  2⤵
  PID:11092
- C:\Windows\System\nzqoKoD.exe
  C:\Windows\System\nzqoKoD.exe
  2⤵
  PID:11120
- C:\Windows\System\jEEMllp.exe
  C:\Windows\System\jEEMllp.exe
  2⤵
  PID:11140
- C:\Windows\System\aajYpzl.exe
  C:\Windows\System\aajYpzl.exe
  2⤵
  PID:11168
- C:\Windows\System\wzlApiQ.exe
  C:\Windows\System\wzlApiQ.exe
  2⤵
  PID:11200
- C:\Windows\System\ExfPrIK.exe
  C:\Windows\System\ExfPrIK.exe
  2⤵
  PID:11224
- C:\Windows\System\yeJxFjj.exe
  C:\Windows\System\yeJxFjj.exe
  2⤵
  PID:11248
- C:\Windows\System\fEiYeLR.exe
  C:\Windows\System\fEiYeLR.exe
  2⤵
  PID:9612
- C:\Windows\System\HYJEzeY.exe
  C:\Windows\System\HYJEzeY.exe
  2⤵
  PID:9264
- C:\Windows\System\WFUbRaB.exe
  C:\Windows\System\WFUbRaB.exe
  2⤵
  PID:7552
- C:\Windows\System\aRjaMjs.exe
  C:\Windows\System\aRjaMjs.exe
  2⤵
  PID:10088
- C:\Windows\System\UUFkIwM.exe
  C:\Windows\System\UUFkIwM.exe
  2⤵
  PID:10116
- C:\Windows\System\qdctPDx.exe
  C:\Windows\System\qdctPDx.exe
  2⤵
  PID:10200
- C:\Windows\System\TzITayn.exe
  C:\Windows\System\TzITayn.exe
  2⤵
  PID:9684
- C:\Windows\System\LkJTVqg.exe
  C:\Windows\System\LkJTVqg.exe
  2⤵
  PID:9288
- C:\Windows\System\WwQEqxo.exe
  C:\Windows\System\WwQEqxo.exe
  2⤵
  PID:9380
- C:\Windows\System\eihSNBD.exe
  C:\Windows\System\eihSNBD.exe
  2⤵
  PID:7996
- C:\Windows\System\HlkwLQE.exe
  C:\Windows\System\HlkwLQE.exe
  2⤵
  PID:9760
- C:\Windows\System\vUzhcok.exe
  C:\Windows\System\vUzhcok.exe
  2⤵
  PID:6936
- C:\Windows\System\qFCUiGA.exe
  C:\Windows\System\qFCUiGA.exe
  2⤵
  PID:6084
- C:\Windows\System\FxhUCkn.exe
  C:\Windows\System\FxhUCkn.exe
  2⤵
  PID:7212
- C:\Windows\System\NkxNFPS.exe
  C:\Windows\System\NkxNFPS.exe
  2⤵
  PID:9336
- C:\Windows\System\xEPTHdE.exe
  C:\Windows\System\xEPTHdE.exe
  2⤵
  PID:10316
- C:\Windows\System\aXyOiGb.exe
  C:\Windows\System\aXyOiGb.exe
  2⤵
  PID:10336
- C:\Windows\System\qcRnHwy.exe
  C:\Windows\System\qcRnHwy.exe
  2⤵
  PID:10420
- C:\Windows\System\ltvzJzN.exe
  C:\Windows\System\ltvzJzN.exe
  2⤵
  PID:8824
- C:\Windows\System\KhmwLFk.exe
  C:\Windows\System\KhmwLFk.exe
  2⤵
  PID:7412
- C:\Windows\System\SWXvVFh.exe
  C:\Windows\System\SWXvVFh.exe
  2⤵
  PID:9204
- C:\Windows\System\Jnxxppl.exe
  C:\Windows\System\Jnxxppl.exe
  2⤵
  PID:9988
- C:\Windows\System\QvDBBUk.exe
  C:\Windows\System\QvDBBUk.exe
  2⤵
  PID:10540
- C:\Windows\System\TwmdIon.exe
  C:\Windows\System\TwmdIon.exe
  2⤵
  PID:10616
- C:\Windows\System\kSREIVl.exe
  C:\Windows\System\kSREIVl.exe
  2⤵
  PID:10680
- C:\Windows\System\IffFHyu.exe
  C:\Windows\System\IffFHyu.exe
  2⤵
  PID:10708
- C:\Windows\System\acFcKHa.exe
  C:\Windows\System\acFcKHa.exe
  2⤵
  PID:10224
- C:\Windows\System\aHILHtJ.exe
  C:\Windows\System\aHILHtJ.exe
  2⤵
  PID:10808
- C:\Windows\System\EvPcoRm.exe
  C:\Windows\System\EvPcoRm.exe
  2⤵
  PID:10836
- C:\Windows\System\zoMGFwH.exe
  C:\Windows\System\zoMGFwH.exe
  2⤵
  PID:8200
- C:\Windows\System\GoEMoIR.exe
  C:\Windows\System\GoEMoIR.exe
  2⤵
  PID:11288
- C:\Windows\System\wjFpwQd.exe
  C:\Windows\System\wjFpwQd.exe
  2⤵
  PID:11308
- C:\Windows\System\kDoldgS.exe
  C:\Windows\System\kDoldgS.exe
  2⤵
  PID:11328
- C:\Windows\System\FPhNwkD.exe
  C:\Windows\System\FPhNwkD.exe
  2⤵
  PID:11352
- C:\Windows\System\jvCpzvs.exe
  C:\Windows\System\jvCpzvs.exe
  2⤵
  PID:11368
- C:\Windows\System\romaYrM.exe
  C:\Windows\System\romaYrM.exe
  2⤵
  PID:11396
- C:\Windows\System\frFKLiX.exe
  C:\Windows\System\frFKLiX.exe
  2⤵
  PID:11416
- C:\Windows\System\aRgEpMw.exe
  C:\Windows\System\aRgEpMw.exe
  2⤵
  PID:11436
- C:\Windows\System\JzRkevB.exe
  C:\Windows\System\JzRkevB.exe
  2⤵
  PID:11464
- C:\Windows\System\etRZjZn.exe
  C:\Windows\System\etRZjZn.exe
  2⤵
  PID:11484
- C:\Windows\System\mIXjbbG.exe
  C:\Windows\System\mIXjbbG.exe
  2⤵
  PID:11504
- C:\Windows\System\yrhOFuX.exe
  C:\Windows\System\yrhOFuX.exe
  2⤵
  PID:11524
- C:\Windows\System\ZLnqHNW.exe
  C:\Windows\System\ZLnqHNW.exe
  2⤵
  PID:11548
- C:\Windows\System\DXYUdZZ.exe
  C:\Windows\System\DXYUdZZ.exe
  2⤵
  PID:11572
- C:\Windows\System\FBZodAN.exe
  C:\Windows\System\FBZodAN.exe
  2⤵
  PID:11596
- C:\Windows\System\djxztLD.exe
  C:\Windows\System\djxztLD.exe
  2⤵
  PID:11612
- C:\Windows\System\obJaOgS.exe
  C:\Windows\System\obJaOgS.exe
  2⤵
  PID:11632
- C:\Windows\System\qvFmzQD.exe
  C:\Windows\System\qvFmzQD.exe
  2⤵
  PID:11656
- C:\Windows\System\wqBqInO.exe
  C:\Windows\System\wqBqInO.exe
  2⤵
  PID:11680
- C:\Windows\System\jsJtkOp.exe
  C:\Windows\System\jsJtkOp.exe
  2⤵
  PID:11700
- C:\Windows\System\abwQMVd.exe
  C:\Windows\System\abwQMVd.exe
  2⤵
  PID:11732
- C:\Windows\System\qwXQWlW.exe
  C:\Windows\System\qwXQWlW.exe
  2⤵
  PID:11748
- C:\Windows\System\gerUXpI.exe
  C:\Windows\System\gerUXpI.exe
  2⤵
  PID:11772
- C:\Windows\System\DmWnBxp.exe
  C:\Windows\System\DmWnBxp.exe
  2⤵
  PID:11800
- C:\Windows\System\kObIlbD.exe
  C:\Windows\System\kObIlbD.exe
  2⤵
  PID:11832
- C:\Windows\System\EtLnmPe.exe
  C:\Windows\System\EtLnmPe.exe
  2⤵
  PID:11852
- C:\Windows\System\Uefiqja.exe
  C:\Windows\System\Uefiqja.exe
  2⤵
  PID:11876
- C:\Windows\System\xQCHBQx.exe
  C:\Windows\System\xQCHBQx.exe
  2⤵
  PID:11896
- C:\Windows\System\RrgdBvP.exe
  C:\Windows\System\RrgdBvP.exe
  2⤵
  PID:11912
- C:\Windows\System\qHsplau.exe
  C:\Windows\System\qHsplau.exe
  2⤵
  PID:11932
- C:\Windows\System\pzoNzKm.exe
  C:\Windows\System\pzoNzKm.exe
  2⤵
  PID:11952
- C:\Windows\System\MnOrsKw.exe
  C:\Windows\System\MnOrsKw.exe
  2⤵
  PID:11972
- C:\Windows\System\jviBkwd.exe
  C:\Windows\System\jviBkwd.exe
  2⤵
  PID:12004
- C:\Windows\System\TYvzAAM.exe
  C:\Windows\System\TYvzAAM.exe
  2⤵
  PID:12024
- C:\Windows\System\lfKVfhe.exe
  C:\Windows\System\lfKVfhe.exe
  2⤵
  PID:12040
- C:\Windows\System\hXTmOEz.exe
  C:\Windows\System\hXTmOEz.exe
  2⤵
  PID:12056
- C:\Windows\System\ywjzmUd.exe
  C:\Windows\System\ywjzmUd.exe
  2⤵
  PID:12080
- C:\Windows\System\MzZkOUH.exe
  C:\Windows\System\MzZkOUH.exe
  2⤵
  PID:12108
- C:\Windows\System\wVbUlnS.exe
  C:\Windows\System\wVbUlnS.exe
  2⤵
  PID:12128
- C:\Windows\System\PYQjxVT.exe
  C:\Windows\System\PYQjxVT.exe
  2⤵
  PID:12148
- C:\Windows\System\iKiggYY.exe
  C:\Windows\System\iKiggYY.exe
  2⤵
  PID:12172
- C:\Windows\System\CNZUfbF.exe
  C:\Windows\System\CNZUfbF.exe
  2⤵
  PID:12188
- C:\Windows\System\PSbOLzD.exe
  C:\Windows\System\PSbOLzD.exe
  2⤵
  PID:12216
- C:\Windows\System\OhEbaqa.exe
  C:\Windows\System\OhEbaqa.exe
  2⤵
  PID:12236
- C:\Windows\System\QNhgrEE.exe
  C:\Windows\System\QNhgrEE.exe
  2⤵
  PID:12252
- C:\Windows\System\mOAtHJc.exe
  C:\Windows\System\mOAtHJc.exe
  2⤵
  PID:12272
- C:\Windows\System\DqQUpSK.exe
  C:\Windows\System\DqQUpSK.exe
  2⤵
  PID:8236
- C:\Windows\System\lKqKssC.exe
  C:\Windows\System\lKqKssC.exe
  2⤵
  PID:10952
- C:\Windows\System\iEXwjLL.exe
  C:\Windows\System\iEXwjLL.exe
  2⤵
  PID:11032
- C:\Windows\System\OoGigcM.exe
  C:\Windows\System\OoGigcM.exe
  2⤵
  PID:8944
- C:\Windows\System\NzTsqOR.exe
  C:\Windows\System\NzTsqOR.exe
  2⤵
  PID:11100
- C:\Windows\System\UJKtEDX.exe
  C:\Windows\System\UJKtEDX.exe
  2⤵
  PID:11184
- C:\Windows\System\vwlOSit.exe
  C:\Windows\System\vwlOSit.exe
  2⤵
  PID:9652
- C:\Windows\System\TKPAqsB.exe
  C:\Windows\System\TKPAqsB.exe
  2⤵
  PID:11212
- C:\Windows\System\WAQyjiF.exe
  C:\Windows\System\WAQyjiF.exe
  2⤵
  PID:11236
- C:\Windows\System\TzCbOof.exe
  C:\Windows\System\TzCbOof.exe
  2⤵
  PID:11260
- C:\Windows\System\ldsTVdu.exe
  C:\Windows\System\ldsTVdu.exe
  2⤵
  PID:9876
- C:\Windows\System\ROmWkHT.exe
  C:\Windows\System\ROmWkHT.exe
  2⤵
  PID:10404
- C:\Windows\System\UKOnKZd.exe
  C:\Windows\System\UKOnKZd.exe
  2⤵
  PID:10188
- C:\Windows\System\gBvzUuR.exe
  C:\Windows\System\gBvzUuR.exe
  2⤵
  PID:9080
- C:\Windows\System\kzeuxCS.exe
  C:\Windows\System\kzeuxCS.exe
  2⤵
  PID:9432
- C:\Windows\System\qHSISNz.exe
  C:\Windows\System\qHSISNz.exe
  2⤵
  PID:10652
- C:\Windows\System\ANNcBjS.exe
  C:\Windows\System\ANNcBjS.exe
  2⤵
  PID:9848
- C:\Windows\System\lCgxUri.exe
  C:\Windows\System\lCgxUri.exe
  2⤵
  PID:10384
- C:\Windows\System\ImsgSVh.exe
  C:\Windows\System\ImsgSVh.exe
  2⤵
  PID:8052
- C:\Windows\System\oTDUfQa.exe
  C:\Windows\System\oTDUfQa.exe
  2⤵
  PID:10136
- C:\Windows\System\RCxJmzJ.exe
  C:\Windows\System\RCxJmzJ.exe
  2⤵
  PID:10896
- C:\Windows\System\sQHOtQM.exe
  C:\Windows\System\sQHOtQM.exe
  2⤵
  PID:8448
- C:\Windows\System\ITjYufT.exe
  C:\Windows\System\ITjYufT.exe
  2⤵
  PID:11004
- C:\Windows\System\auVyCsQ.exe
  C:\Windows\System\auVyCsQ.exe
  2⤵
  PID:2592
- C:\Windows\System\DyjsEJe.exe
  C:\Windows\System\DyjsEJe.exe
  2⤵
  PID:7568
- C:\Windows\System\nnoFfPE.exe
  C:\Windows\System\nnoFfPE.exe
  2⤵
  PID:8592
- C:\Windows\System\vwSlAEp.exe
  C:\Windows\System\vwSlAEp.exe
  2⤵
  PID:11152
- C:\Windows\System\yvfxmzz.exe
  C:\Windows\System\yvfxmzz.exe
  2⤵
  PID:9736
- C:\Windows\System\OMMtnMR.exe
  C:\Windows\System\OMMtnMR.exe
  2⤵
  PID:8444
- C:\Windows\System\pNzkGjw.exe
  C:\Windows\System\pNzkGjw.exe
  2⤵
  PID:10248
- C:\Windows\System\YecACYX.exe
  C:\Windows\System\YecACYX.exe
  2⤵
  PID:10292
- C:\Windows\System\LMXEntR.exe
  C:\Windows\System\LMXEntR.exe
  2⤵
  PID:10108
- C:\Windows\System\THZbVhd.exe
  C:\Windows\System\THZbVhd.exe
  2⤵
  PID:12316
- C:\Windows\System\zGpFuul.exe
  C:\Windows\System\zGpFuul.exe
  2⤵
  PID:12340
- C:\Windows\System\ajIAhlh.exe
  C:\Windows\System\ajIAhlh.exe
  2⤵
  PID:12360
- C:\Windows\System\bKwfkvU.exe
  C:\Windows\System\bKwfkvU.exe
  2⤵
  PID:12396
- C:\Windows\System\jiwiJHd.exe
  C:\Windows\System\jiwiJHd.exe
  2⤵
  PID:12436
- C:\Windows\System\hpQjSLA.exe
  C:\Windows\System\hpQjSLA.exe
  2⤵
  PID:12456
- C:\Windows\System\kmXtYGE.exe
  C:\Windows\System\kmXtYGE.exe
  2⤵
  PID:12488
- C:\Windows\System\HRaaeZx.exe
  C:\Windows\System\HRaaeZx.exe
  2⤵
  PID:12504
- C:\Windows\System\CuwhVdQ.exe
  C:\Windows\System\CuwhVdQ.exe
  2⤵
  PID:12536
- C:\Windows\System\ZFAcbpl.exe
  C:\Windows\System\ZFAcbpl.exe
  2⤵
  PID:12564
- C:\Windows\System\IxyiEnI.exe
  C:\Windows\System\IxyiEnI.exe
  2⤵
  PID:12596
- C:\Windows\System\QgwUvgB.exe
  C:\Windows\System\QgwUvgB.exe
  2⤵
  PID:12640
- C:\Windows\System\aUnyAGK.exe
  C:\Windows\System\aUnyAGK.exe
  2⤵
  PID:12684
- C:\Windows\System\oECPWcd.exe
  C:\Windows\System\oECPWcd.exe
  2⤵
  PID:12716
- C:\Windows\System\mohszWX.exe
  C:\Windows\System\mohszWX.exe
  2⤵
  PID:12736
- C:\Windows\System\IRuLbgT.exe
  C:\Windows\System\IRuLbgT.exe
  2⤵
  PID:12768
- C:\Windows\System\TOPRhOJ.exe
  C:\Windows\System\TOPRhOJ.exe
  2⤵
  PID:12844
- C:\Windows\System\ZMgKFrX.exe
  C:\Windows\System\ZMgKFrX.exe
  2⤵
  PID:12864
- C:\Windows\System\CpOSaiP.exe
  C:\Windows\System\CpOSaiP.exe
  2⤵
  PID:12888
- C:\Windows\System\ffdbGNF.exe
  C:\Windows\System\ffdbGNF.exe
  2⤵
  PID:12908
- C:\Windows\System\WNsPNJz.exe
  C:\Windows\System\WNsPNJz.exe
  2⤵
  PID:12928
- C:\Windows\System\JkLyBln.exe
  C:\Windows\System\JkLyBln.exe
  2⤵
  PID:12944
- C:\Windows\System\wleGLTK.exe
  C:\Windows\System\wleGLTK.exe
  2⤵
  PID:12960
- C:\Windows\System\LUFzath.exe
  C:\Windows\System\LUFzath.exe
  2⤵
  PID:12976
- C:\Windows\System\zzAaOKB.exe
  C:\Windows\System\zzAaOKB.exe
  2⤵
  PID:12996
- C:\Windows\System\cexSQNk.exe
  C:\Windows\System\cexSQNk.exe
  2⤵
  PID:13016
- C:\Windows\System\aNNphsQ.exe
  C:\Windows\System\aNNphsQ.exe
  2⤵
  PID:13032
- C:\Windows\System\vgNLpzM.exe
  C:\Windows\System\vgNLpzM.exe
  2⤵
  PID:13048
- C:\Windows\System\dvfhjGO.exe
  C:\Windows\System\dvfhjGO.exe
  2⤵
  PID:13064
- C:\Windows\System\raWmEbb.exe
  C:\Windows\System\raWmEbb.exe
  2⤵
  PID:13080
- C:\Windows\System\vWUXKIu.exe
  C:\Windows\System\vWUXKIu.exe
  2⤵
  PID:13096
- C:\Windows\System\yQkqVXR.exe
  C:\Windows\System\yQkqVXR.exe
  2⤵
  PID:8392
- C:\Windows\System\cAlFCbS.exe
  C:\Windows\System\cAlFCbS.exe
  2⤵
  PID:10268
- C:\Windows\System\LlpwyKe.exe
  C:\Windows\System\LlpwyKe.exe
  2⤵
  PID:10880
- C:\Windows\System\wouNYpD.exe
  C:\Windows\System\wouNYpD.exe
  2⤵
  PID:8776
- C:\Windows\System\hieImlh.exe
  C:\Windows\System\hieImlh.exe
  2⤵
  PID:11132
- C:\Windows\System\Eofmwrf.exe
  C:\Windows\System\Eofmwrf.exe
  2⤵
  PID:11580
- C:\Windows\System\SqNVEKf.exe
  C:\Windows\System\SqNVEKf.exe
  2⤵
  PID:12916
- C:\Windows\System\jnCysoH.exe
  C:\Windows\System\jnCysoH.exe
  2⤵
  PID:13272
- C:\Windows\System\tyfSOVZ.exe
  C:\Windows\System\tyfSOVZ.exe
  2⤵
  PID:12788
- C:\Windows\System\KKDaVPI.exe
  C:\Windows\System\KKDaVPI.exe
  2⤵
  PID:12880
- C:\Windows\System\kfwxOfc.exe
  C:\Windows\System\kfwxOfc.exe
  2⤵
  PID:10588
- C:\Windows\System\CLYynlx.exe
  C:\Windows\System\CLYynlx.exe
  2⤵
  PID:13204
- C:\Windows\System\CAdtgYn.exe
  C:\Windows\System\CAdtgYn.exe
  2⤵
  PID:12180
- C:\Windows\System\ZqxAZDH.exe
  C:\Windows\System\ZqxAZDH.exe
  2⤵
  PID:12208
- C:\Windows\System\zaICudA.exe
  C:\Windows\System\zaICudA.exe
  2⤵
  PID:12092
- C:\Windows\System\NUgCiRT.exe
  C:\Windows\System\NUgCiRT.exe
  2⤵
  PID:8704
- C:\Windows\System\wFDqecv.exe
  C:\Windows\System\wFDqecv.exe
  2⤵
  PID:12052
- C:\Windows\System\ejkBoqM.exe
  C:\Windows\System\ejkBoqM.exe
  2⤵
  PID:12264
- C:\Windows\System\rWHuJHU.exe
  C:\Windows\System\rWHuJHU.exe
  2⤵
  PID:8320
- C:\Windows\System\pQSPGGM.exe
  C:\Windows\System\pQSPGGM.exe
  2⤵
  PID:9428
- C:\Windows\System\UteviWe.exe
  C:\Windows\System\UteviWe.exe
  2⤵
  PID:8132
- C:\Windows\System\mqrQyym.exe
  C:\Windows\System\mqrQyym.exe
  2⤵
  PID:11672
- C:\Windows\System\ayXuyYY.exe
  C:\Windows\System\ayXuyYY.exe
  2⤵
  PID:12828
- C:\Windows\System\jbVysjx.exe
  C:\Windows\System\jbVysjx.exe
  2⤵
  PID:13108
- C:\Windows\System\eBqtZJw.exe
  C:\Windows\System\eBqtZJw.exe
  2⤵
  PID:13180
- C:\Windows\System\ibNpTzl.exe
  C:\Windows\System\ibNpTzl.exe
  2⤵
  PID:13104
- C:\Windows\System\GNKygtZ.exe
  C:\Windows\System\GNKygtZ.exe
  2⤵
  PID:5788
- C:\Windows\System\eJFDAZL.exe
  C:\Windows\System\eJFDAZL.exe
  2⤵
  PID:12920
- C:\Windows\System\QbuPAbe.exe
  C:\Windows\System\QbuPAbe.exe
  2⤵
  PID:13184
- C:\Windows\System\VKbzWos.exe
  C:\Windows\System\VKbzWos.exe
  2⤵
  PID:10932
- C:\Windows\System\HijpaSj.exe
  C:\Windows\System\HijpaSj.exe
  2⤵
  PID:11480
- C:\Windows\System\TvmWWOD.exe
  C:\Windows\System\TvmWWOD.exe
  2⤵
  PID:9976
- C:\Windows\System\cHuLBTl.exe
  C:\Windows\System\cHuLBTl.exe
  2⤵
  PID:4912
- C:\Windows\System\iezUyDK.exe
  C:\Windows\System\iezUyDK.exe
  2⤵
  PID:12800
- C:\Windows\System\lAiHCAc.exe
  C:\Windows\System\lAiHCAc.exe
  2⤵
  PID:12820
- C:\Windows\System\UILrXgA.exe
  C:\Windows\System\UILrXgA.exe
  2⤵
  PID:13256
- C:\Windows\System\JLyqjuG.exe
  C:\Windows\System\JLyqjuG.exe
  2⤵
  PID:11676
- C:\Windows\System\HyiHini.exe
  C:\Windows\System\HyiHini.exe
  2⤵
  PID:12356
- C:\Windows\System\glWAzBY.exe
  C:\Windows\System\glWAzBY.exe
  2⤵
  PID:12972
- C:\Windows\System\odxXzJd.exe
  C:\Windows\System\odxXzJd.exe
  2⤵
  PID:10536
- C:\Windows\System\JkqIaDS.exe
  C:\Windows\System\JkqIaDS.exe
  2⤵
  PID:13308
- C:\Windows\System\YSXJKRM.exe
  C:\Windows\System\YSXJKRM.exe
  2⤵
  PID:10500
- C:\Windows\System\kMLsdzD.exe
  C:\Windows\System\kMLsdzD.exe
  2⤵
  PID:11240
- C:\Windows\System\zVsYQNq.exe
  C:\Windows\System\zVsYQNq.exe
  2⤵
  PID:2308
- C:\Windows\System\mDeoWBl.exe
  C:\Windows\System\mDeoWBl.exe
  2⤵
  PID:10044
- C:\Windows\System\UWoFrst.exe
  C:\Windows\System\UWoFrst.exe
  2⤵
  PID:12020
- C:\Windows\System\JasejLj.exe
  C:\Windows\System\JasejLj.exe
  2⤵
  PID:4024
- C:\Windows\System\jufzKUw.exe
  C:\Windows\System\jufzKUw.exe
  2⤵
  PID:9676
- C:\Windows\System\WBIeTEc.exe
  C:\Windows\System\WBIeTEc.exe
  2⤵
  PID:13280
- C:\Windows\System\fwdTwgq.exe
  C:\Windows\System\fwdTwgq.exe
  2⤵
  PID:5572
- C:\Windows\System\bAQMHBB.exe
  C:\Windows\System\bAQMHBB.exe
  2⤵
  PID:4308
- C:\Windows\System\tsAJkDo.exe
  C:\Windows\System\tsAJkDo.exe
  2⤵
  PID:13160
- C:\Windows\System\aaNnfPE.exe
  C:\Windows\System\aaNnfPE.exe
  2⤵
  PID:10704
- C:\Windows\System\MEeiGlO.exe
  C:\Windows\System\MEeiGlO.exe
  2⤵
  PID:11360
- C:\Windows\System\YlPQkOJ.exe
  C:\Windows\System\YlPQkOJ.exe
  2⤵
  PID:11860
- C:\Windows\System\uJRcnOe.exe
  C:\Windows\System\uJRcnOe.exe
  2⤵
  PID:13024
- C:\Windows\System\fuGmHVR.exe
  C:\Windows\System\fuGmHVR.exe
  2⤵
  PID:10764
- C:\Windows\System\FrFSTuI.exe
  C:\Windows\System\FrFSTuI.exe
  2⤵
  PID:13232
- C:\Windows\System\yvptoMX.exe
  C:\Windows\System\yvptoMX.exe
  2⤵
  PID:12032
- C:\Windows\System\IUYcwrb.exe
  C:\Windows\System\IUYcwrb.exe
  2⤵
  PID:12468
- C:\Windows\System\aIzVGAM.exe
  C:\Windows\System\aIzVGAM.exe
  2⤵
  PID:10784
- C:\Windows\System\kcwyiIG.exe
  C:\Windows\System\kcwyiIG.exe
  2⤵
  PID:12588
- C:\Windows\System\ECxadDT.exe
  C:\Windows\System\ECxadDT.exe
  2⤵
  PID:10908
- C:\Windows\System\JDFMUWr.exe
  C:\Windows\System\JDFMUWr.exe
  2⤵
  PID:8016
- C:\Windows\System\vQnvfrS.exe
  C:\Windows\System\vQnvfrS.exe
  2⤵
  PID:13332
- C:\Windows\System\zUrFAru.exe
  C:\Windows\System\zUrFAru.exe
  2⤵
  PID:13356
- C:\Windows\System\wAhujBK.exe
  C:\Windows\System\wAhujBK.exe
  2⤵
  PID:13380
- C:\Windows\System\UCGZNLN.exe
  C:\Windows\System\UCGZNLN.exe
  2⤵
  PID:13400
- C:\Windows\System\yWLlEOM.exe
  C:\Windows\System\yWLlEOM.exe
  2⤵
  PID:13420
- C:\Windows\System\YHdslix.exe
  C:\Windows\System\YHdslix.exe
  2⤵
  PID:13708
- C:\Windows\System\BrIRUUw.exe
  C:\Windows\System\BrIRUUw.exe
  2⤵
  PID:13852
- C:\Windows\System\LrLiwMs.exe
  C:\Windows\System\LrLiwMs.exe
  2⤵
  PID:13908
- C:\Windows\System\oZKYXwc.exe
  C:\Windows\System\oZKYXwc.exe
  2⤵
  PID:14040
- C:\Windows\System\jQjwAZo.exe
  C:\Windows\System\jQjwAZo.exe
  2⤵
  PID:14192
- C:\Windows\System\iiQItaA.exe
  C:\Windows\System\iiQItaA.exe
  2⤵
  PID:14220
- C:\Windows\System\FdvbBWe.exe
  C:\Windows\System\FdvbBWe.exe
  2⤵
  PID:14312
- C:\Windows\System\cjTonyV.exe
  C:\Windows\System\cjTonyV.exe
  2⤵
  PID:11404
- C:\Windows\System\YrHGvbp.exe
  C:\Windows\System\YrHGvbp.exe
  2⤵
  PID:12984
- C:\Windows\System\Lbfinbq.exe
  C:\Windows\System\Lbfinbq.exe
  2⤵
  PID:11408
- C:\Windows\System\XDKxnTS.exe
  C:\Windows\System\XDKxnTS.exe
  2⤵
  PID:13416
- C:\Windows\System\ixKnoRU.exe
  C:\Windows\System\ixKnoRU.exe
  2⤵
  PID:5720
- C:\Windows\System\IhCCstM.exe
  C:\Windows\System\IhCCstM.exe
  2⤵
  PID:13536
- C:\Windows\System\WRLTUpW.exe
  C:\Windows\System\WRLTUpW.exe
  2⤵
  PID:13396
- C:\Windows\System\TGtNZVx.exe
  C:\Windows\System\TGtNZVx.exe
  2⤵
  PID:13568
- C:\Windows\System\KqujZmr.exe
  C:\Windows\System\KqujZmr.exe
  2⤵
  PID:13792
- C:\Windows\System\MiKQsUN.exe
  C:\Windows\System\MiKQsUN.exe
  2⤵
  PID:13684
- C:\Windows\System\wOLYuAu.exe
  C:\Windows\System\wOLYuAu.exe
  2⤵
  PID:13840
- C:\Windows\System\GYsBZsX.exe
  C:\Windows\System\GYsBZsX.exe
  2⤵
  PID:14168
- C:\Windows\System\Icrnycj.exe
  C:\Windows\System\Icrnycj.exe
  2⤵
  PID:14004
- C:\Windows\System\ByHiFJq.exe
  C:\Windows\System\ByHiFJq.exe
  2⤵
  PID:7752
- C:\Windows\System\zegOxxk.exe
  C:\Windows\System\zegOxxk.exe
  2⤵
  PID:14112
- C:\Windows\System\fQpwNCg.exe
  C:\Windows\System\fQpwNCg.exe
  2⤵
  PID:14008
- C:\Windows\System\TGOpvXC.exe
  C:\Windows\System\TGOpvXC.exe
  2⤵
  PID:13700
- C:\Windows\System\nZYyOKK.exe
  C:\Windows\System\nZYyOKK.exe
  2⤵
  PID:14252
- C:\Windows\System\dxWluRR.exe
  C:\Windows\System\dxWluRR.exe
  2⤵
  PID:14128
- C:\Windows\System\GVFKjjS.exe
  C:\Windows\System\GVFKjjS.exe
  2⤵
  PID:14108
- C:\Windows\System\IYipkze.exe
  C:\Windows\System\IYipkze.exe
  2⤵
  PID:14188
- C:\Windows\System\gwfpNnn.exe
  C:\Windows\System\gwfpNnn.exe
  2⤵
  PID:10176
- C:\Windows\System\MNhDqGd.exe
  C:\Windows\System\MNhDqGd.exe
  2⤵
  PID:2252
- C:\Windows\System\jyfNLdW.exe
  C:\Windows\System\jyfNLdW.exe
  2⤵
  PID:12708
- C:\Windows\System\HAuvrwW.exe
  C:\Windows\System\HAuvrwW.exe
  2⤵
  PID:14332
- C:\Windows\System\mbtSdpb.exe
  C:\Windows\System\mbtSdpb.exe
  2⤵
  PID:12348
- C:\Windows\System\NzRPSOE.exe
  C:\Windows\System\NzRPSOE.exe
  2⤵
  PID:13040
- C:\Windows\System\pWvhLsF.exe
  C:\Windows\System\pWvhLsF.exe
  2⤵
  PID:5796
- C:\Windows\System\gJalGAu.exe
  C:\Windows\System\gJalGAu.exe
  2⤵
  PID:4896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_531rzxgc.znm.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ASaDQIA.exe

Filesize
2.2MB

MD5
7d97392a2844047265840bfe495b1494

SHA1
bcebd212b57ca5f9161470e7d7ef4d99114f9dc9

SHA256
59c4eb112bd020f0ddeb55c01bbe7c652a68fec1f2b3877be24d866b4bd894c5

SHA512
f363a49461d27b8c593e60da955113be6abe64003fbab8f1775aeb8830f16a62709b700b13ad181f96412fa3d5c01d12ed0f76dce8391e629f9fd5b6887c4e64

Download Submit
C:\Windows\System\BGJqvYM.exe

Filesize
2.2MB

MD5
5869ece81681f461acf9feaaeb6b1434

SHA1
6ef165b50ddf97ef33554173afdba68a24849a45

SHA256
7deda9a3f65ea0f154b206028946df9f59c771453e4666e66476d05be3ca3b25

SHA512
d779e8fee9e6fd77304ae20949fe51dba623b95121f52ffa3c24d6a109a328622207ade23174a09f6873367f42dbcddcb04845d312a5d9ee6a9016eb03c6ae55

Download Submit
C:\Windows\System\DENTUFs.exe

Filesize
2.2MB

MD5
7c8aed4481cf771383fcbe92853ab0d3

SHA1
73bc56fa358363504776da8bbcc66ca4c5d6e490

SHA256
61fa779eee133c88ae90d9bc6558cb727fbba4c0d98102767f86f2827d7e48bf

SHA512
9ef9de8b4dbf1a75ea36a239b3ee1b033b62a0be1eaf5448ed00297b592b4cabce0f2c18d9e68ec1acb620a8dd86819f2b5db6ed2d1908e62fcae3e87aa9d211

Download Submit
C:\Windows\System\DlFBZaI.exe

Filesize
2.2MB

MD5
ee9f8bca54b49f09113e78b77005f87e

SHA1
b929e0141cb4bb83280daecf6928645480aea5e4

SHA256
78201b5ab4626afa9c9b79af3521b651746715ebd29fa28ee29b3191069e5675

SHA512
ddf17e413e063011e622be4f75504ed000d0d9a69fdac4a06e2470fd4dce9e26fc646cf14f04237d7e5620e9d070bc5c14915fec07e75c3ef7e377bdeec75a68

Download Submit
C:\Windows\System\EmfkNuU.exe

Filesize
8B

MD5
0b02220145771e90ebe4310a5742c9eb

SHA1
9bd568d96b03bd5446f96a7b59c08196eb5a57c3

SHA256
6135f164d0697be47c97ab606a7a1adcbc1eb3846ae4debecafb1a6ccfd23e4e

SHA512
cb08dee7f4e4dd1bb8de836a2364c078d9de5aef5dcb329e7e0b8e1cc2bfaa06c42f8b8ddf04bdb30392074759beef091a761854b0812b9a726b3c820c99a5a8

Download Submit
C:\Windows\System\GXJghgn.exe

Filesize
2.2MB

MD5
192e18930e9b000e9255f1b320409b68

SHA1
1ad6ac26c33a09c6214bb92d438e5c46fea4c6e2

SHA256
42ae39a771377bf7fb3416dbe3e14ef8d243e563301c62a28137688e6ce95309

SHA512
03477eff16384156a65109cca9192fa4046a5250279102a75e9f4acd0012ad0e5bf4db98d3abbf4e6154c3c8bdc8b0fdb88ece45a755555b0d80fea0b351d619

Download Submit
C:\Windows\System\HFSeFbI.exe

Filesize
2.2MB

MD5
1a632329288da482096bbc07bd4dfaa7

SHA1
12a86ae06cc05cc65fadbea19f3056d5511d40d0

SHA256
5112eb8df1d17d5e414bc6da479d65444603e0bb0f405d1b57a853440d3efe4d

SHA512
245995bedb3c98ec12a7f851b3bc7a20090299c0cb85a8f9833d4772b50e1cd965246d3263924b8488275df9be21d683131f092d66bc18840f35f11e5abc7fde

Download Submit
C:\Windows\System\HQlOgmc.exe

Filesize
2.2MB

MD5
e84851e9f2441a495c2480d4caf6db59

SHA1
26188323c340707e8344af614be9a12ff8f8e434

SHA256
a7ce3c1cf07e5605c79cd2f7e192b684951164eef9ad91bdd2d8ec5ea1cfa7a0

SHA512
60ac72ceb2ae870086a121130d3cca74ccd246a220a80bf48453ef582b3f6cf6b67a53cc782bfc848529a4788debde222ca989ccea34438bcc1996ca441139f7

Download Submit
C:\Windows\System\HURTTwA.exe

Filesize
2.2MB

MD5
7f23e95ae4e2340823fc96bfdbe736d5

SHA1
03f1eb380fdd4d6e34a9e5a13df777178a506293

SHA256
d0030c70a9e1513fc6a529c7f9e52fb33619e0ad8a00fa3575e0cad4ac7c7895

SHA512
3dce55d29a89e5ad709e6ebb667a9dd458ade9e018d03f45b8efea6a9b74945bb9fab59545c6e84f640a247cbc2b2d5f208ac5854918939df637eed20d15eca6

Download Submit
C:\Windows\System\KJVoqUu.exe

Filesize
2.2MB

MD5
a5931d6d15edd71749cc112d95734ed1

SHA1
5602de97c0bc080eee36720342c01a7d3e82e1ac

SHA256
46550dbd0a4455cc3848e07acdc6bb0fc11cbeb8e926836c50ed454acd42a1ca

SHA512
cbcc54f50fbb1aa04e34bf14cd4964a54b7c62ea74ed5ab0aa6229b2febeccac3b01491efde65f37c6aec815c8969b01aa733b73a628525fed8747a48fdebadf

Download Submit
C:\Windows\System\MIHEKJc.exe

Filesize
2.2MB

MD5
df5b53887621c98763f5ae1f3fd0f65e

SHA1
70f2835f40dac89fd9f0402f5a28bb951ed6d9e4

SHA256
8ea8abeb4233e19e9c3a42c9d725527d435e42c3644e17323a62acfea455170b

SHA512
a2af0571f71d58fc178096755d67cc8d479910288c76ebf6abddd76029afe87d3d7f405b84342f8f3f73ed9f75076ce9f4feb60587a5cd5b72c7d6311b1d4fa0

Download Submit
C:\Windows\System\MzYeHeW.exe

Filesize
2.2MB

MD5
2ff2cb822b0fd7115d64489bd22ede68

SHA1
01e8ee754e86eea448ca3e272321d7dcc7da314d

SHA256
c23652a691ad57b758bdd0c3569ec09596ca41c654ebcf1752511d38a3916de2

SHA512
ecbe0bad66c1e90b92ff1342c29c0ee67ffce98cef779dd18cba18c4901c6732e57a74e99d1dc8497de31750a13ff7780a73d36b14efe9571ab816deb0557369

Download Submit
C:\Windows\System\OptfMLL.exe

Filesize
2.2MB

MD5
35268466c52efbdb28b480943320e4e0

SHA1
c449013897c71367491b0fe22d78f82d12d5eaf0

SHA256
bda18cbf8dbd376212bb2dae29bdd960f68193285671b068ade2993256779b79

SHA512
82f81fb72d323137cbb97a9184f16f111837b2bec2364f8be66b8cf26807102098f7e1a6d69aeba3e0cd0275faf9ee82d2c77260d48bfb8f28fa60b55d06fd32

Download Submit
C:\Windows\System\Poklmzc.exe

Filesize
2.2MB

MD5
be50815e1776077b6a2998b3e1e8569a

SHA1
23f46311d3d08b8a6c89863621f7e55f3043a7b7

SHA256
97cbbc6dd4bcf022cf21e5b74ef8dc2d95658ceaf2675413d2c20145c827503b

SHA512
4a76041a3bbc6fdf9dbee87d606f751e6853890e1ac0f830df73514c80b46f31c6b4622f2b0064f51a7bad651260ae349917f636ee66b661bfc73c768d3e25b4

Download Submit
C:\Windows\System\QEqEyKH.exe

Filesize
2.2MB

MD5
b350014034d3a53e65c722ef6d402337

SHA1
91ffde9668d87b5ce8a7c30598b908d1c05f169a

SHA256
013e95e76f29fee4464a4528c4dc477f54ffed446e5eee44286f4066ce78ebef

SHA512
2d7d23b11117509f7ac1968489b66c81538970b83a93c3f7fa0d00779e0d410b9d86c34fb6c07d415178e3b80e7b484ccbc03bad1517670e0992bef7788ec104

Download Submit
C:\Windows\System\SSbWpyz.exe

Filesize
2.2MB

MD5
3d654fa9c68b499980ec75ea63ebaf8e

SHA1
5bcd561290e7023b68fefd60cd0b81f0f7cb7af9

SHA256
50fdc61ff99a0ea669353564d71429400d26b2284dc71d14039783ed3f5e3abd

SHA512
1b3c3cfd6f9e4549ac0fcccaa75fc51b7921f8a49adca22ce256cfefeab2b2ed5af5bde86aa06c2655b9b2a0a3837ac38fadafaf7f86bbec956f4d8bba90ba2d

Download Submit
C:\Windows\System\SseABuk.exe

Filesize
2.2MB

MD5
6519c2efeab9d9c86eb79012175cf65a

SHA1
85254bd5e14dae68ed093950b8efb0571622cc27

SHA256
f27e7a9614a315b73dd2f06b924abc698e5173c8ee4ba71dab26caa913db1951

SHA512
2b1e2e42207c2231e53bb1d0deea70dd513ad689ed2e76674e5890a7bc409aff01dddbeb93bfe07830094eea505cd6c4cbe8c694e726bfe78422b6277b0be03b

Download Submit
C:\Windows\System\TIEeptF.exe

Filesize
2.2MB

MD5
acf48f76282d4d6dbfe291d02a7d9034

SHA1
45720635e835c93c82f55be6724dee5a8e071601

SHA256
1753e3f624a28ca9e897e38e76d36dc03eed4fa852788d281de6abf66145abbd

SHA512
45da04539e54f50ee7603d88939b57988f86eb2093ebc116dd75a0f22f1f273c90a08c92cddc9d7bb2f328225308653bcaedce9a30d7ef9f8f7fab4f778ed837

Download Submit
C:\Windows\System\TnAELKp.exe

Filesize
2.2MB

MD5
0549a0ccafb32408ac517aff11234e9d

SHA1
c6e897637193fde46f95d9ae06a2827c4d457215

SHA256
ed730a5bb2e1ae2407e3ab148ccf5d7eb4c21a4d6389b93e0cc9d12083ce4907

SHA512
b4a6727bd90e686fbcc4c0483fea2592869eeceb1a05b49e606369067617204d9ba327c6f1fcb0d81763b6db7cfad95ebf8ca557b597a6fbfbf679eef625e53e

Download Submit
C:\Windows\System\WbEpfJh.exe

Filesize
2.2MB

MD5
721048212da07135feaf8dfd80644705

SHA1
7faeadb5929984621996ae3ed79f70941387f6b5

SHA256
fa007d70d241a1b877e9634f95851248c26fe971121a261f694d00ddd87e7666

SHA512
a6810131f63e7f5d832d8ed37b1a9869fae364c78f4b7302230ebe918edf7040d7d5263bc4475bb292b64caa4d742f49a23b72ae3e53b5ac930cfd812026aac2

Download Submit
C:\Windows\System\ZsQXblI.exe

Filesize
2.2MB

MD5
72d025b893f34dd25e9c6ef81eb7b646

SHA1
3164308f75ae1f9bff6ca12dccb6a14c5973f21b

SHA256
4eb2eb843a709c704a632613a632737808d95136371190d0d6ea640b7fa4a753

SHA512
3055dcd63349c056774b92ec668bf364e70b304c45852f171d9000f0c6a41c002b6be3fc2990b347df5712cfcfd5b42f131e664f4ee772f91fac05f48c85382e

Download Submit
C:\Windows\System\akNFSoM.exe

Filesize
2.2MB

MD5
e54db41f3771aec1692fed51585910fb

SHA1
1ffcec61d835b283e0d5995abc189c95b5b3bc3a

SHA256
71e707f54f7dd355b135f3368e0cf738585a4e2ea4404c2502a44667764974cc

SHA512
62a77f4e43fce6201d8c168da0693265352d6d58f5e9b325896d75a805d88028abd9e6edb13d3795c389182e1802d6b195e2818e6c2d9d5999d0f16a899340ed

Download Submit
C:\Windows\System\drkwOEn.exe

Filesize
2.2MB

MD5
dc4bfa3df776c348748dc6fb8ff3ec12

SHA1
a5e22424314d349ad6a5085996a895247e1a5b4f

SHA256
e2dd68d5953d58afafdca521aaae8c0540c380d45bd8027bae1782d0fbc2f140

SHA512
163a5482ebdc8f121eda4eb9f6c6f4b484d179b78d86718584dca8dae75c73f1089e4e17aef52c49710d3b0f559e8558a856afe783509dad7261ef2962b0c8a0

Download Submit
C:\Windows\System\exMdgex.exe

Filesize
2.2MB

MD5
16dc0277028d8d49a187df73a5f6dc4d

SHA1
8246c2068cc9d8e1e4750133c5bf99f650cbf563

SHA256
8d7de22ed4d4f6c50bea08e2dcadb30ef943a0aac6710e74d7d7eee5a2abc1cc

SHA512
f5353d9b12d86b7b926bc6e027ffe3d5533eb69dd305578d5da90f3add7e3f97decbddcab0490523026065d0d93beb3cd9c9a085084475f8784efd479da3483b

Download Submit
C:\Windows\System\fazkRrl.exe

Filesize
2.2MB

MD5
05e4e67ab85c64afcee18c9c2e49f692

SHA1
291990bf32283e85d66110b2d47e8bba9726516a

SHA256
9eb16b3ebb966e13624420ae324628072d5b4301cb8ed31e46380595c943fa13

SHA512
32e5f527b0ca334dd83c7734ffaa9a61d8217a2ef262c87f435f4ea74bdc95bd3d0fc7b1a9d89da6c52db02127cb075edf7a5fe75cf7a4a32a95b3b1d25af95c

Download Submit
C:\Windows\System\gmIiIRE.exe

Filesize
2.2MB

MD5
ae2e2b777604470c1b6ec1dee1595460

SHA1
9de9ae2c6c5b4a22d93f77cc01650e5838c2b511

SHA256
a7281bea40ba9a3322f54a605462dab8cd32edf806946dd8c567bbb3d132f85a

SHA512
d34e301a077e8336f2001713e1baf246ffadeaba694300763bc69f142645d6f2b68e7b2bd52de7a90f4bdccde472e17feb7e8d0f18056dbfcb04c6770ea2f747

Download Submit
C:\Windows\System\jFIItTE.exe

Filesize
2.2MB

MD5
f61925c37c7991a4987c90d560d0770d

SHA1
f76e8431921509e4f7d8369db22374c3bc7af470

SHA256
7e6383dc0c67032792dc6e7aad6a96b3f4e0e39bc9851c1c008c9c333daddd58

SHA512
09f4a8f6a7bcc716b831f6cef99e9eb1dbbdc653dfd192a3aa8df728193b138f104551b9ea4117bcae2d7cfdb8b9e35c3f05bee45ab1dc218090718ee3a0bf4f

Download Submit
C:\Windows\System\jMxQeNF.exe

Filesize
2.2MB

MD5
727f722eda7d7e3804a225e5924e2223

SHA1
2d3e7e0f17a89efe7c19abd11d5167338a24a441

SHA256
240bc65ee3ae81b3697c1b3b89cebda217e0871ff663e315d2367add2be8444d

SHA512
cca11e59f759e1754bb84cdeb2568d258ab1fe98db3c98a301d3d8375fd46e83b9d97c63178acd764a3162c8143ab382e8d6b7e3f5006a6408d3b705882ae55c

Download Submit
C:\Windows\System\mCbhKEu.exe

Filesize
2.2MB

MD5
66e3b4f734dc2920e7b13827c186ed33

SHA1
174183b90740e6cea96f6dc59083f32a518a540b

SHA256
39c5bbefd823c16657b91b4a0565d2d101dc901886dd7a9707e23a7a6e4f675a

SHA512
06b23848f1286c092c8831a613ea4d48ea36d293f18566e82f2e10d8cb8f4c720403b12f5cf5d88bf03cc2f4d1f796152f95d76726498f7886e25e314287fbf6

Download Submit
C:\Windows\System\mSDPlIc.exe

Filesize
2.2MB

MD5
bc4e2820b416b41d1908f22a490f661b

SHA1
6c2229d5e1f3398ac2e08e52a33f510e68602cdb

SHA256
d903423a0b7f61517887b87989b3e3ae2d13adaf49b608f76558460bb5ce29b9

SHA512
354cce0d999c19880a786dd79d55f82641ae5cc04858b6b5f81bac90747b60458877ea3dcf82a66c67f370f3151db0be8a4a885fd0ca28f0380c86e4e476c073

Download Submit
C:\Windows\System\mqNKymt.exe

Filesize
2.2MB

MD5
f771166f3d572729f251541c32fe6a90

SHA1
aec10cd3b132053f47466e0dd9f1160b8ad91f9d

SHA256
1cadc3c0c97a47f72b2f7cbe75c8a8e1e33ce59b63ca5cae3fa0662042d02dff

SHA512
6c47e83715cd793bf385e2a6d9478c3e9b0c29783e6d8f78c811a5ce880a005d7c57f09aaaad565652fd5a0e49e0daef6fafc26c99613f1ab63099fe21686626

Download Submit
C:\Windows\System\nnpirjr.exe

Filesize
2.2MB

MD5
b7662840ae03e9da86f988bc840a19ee

SHA1
cd98768c4845972805f9fdb5996c95eac9b7fd07

SHA256
9fd19d38d5b5e0cd60f53e26c20e4e25da5d7c3abdb96697754f4c61a06b839d

SHA512
c65d3e6a3eb201ec77d9ca1489f5366f2160029290007ec1f96af4ea19f067f68a2df71927e93e78d8e41c2a2b515f95063df32d7a3bb146e2ce94d2650fb251

Download Submit
C:\Windows\System\oTKzmqA.exe

Filesize
2.2MB

MD5
abfdc8109894c36c02389fdc8c9823dd

SHA1
382eeea78eb41d3b1a257064c28b938969f9fdcc

SHA256
4eceadce829eaec2ae233745fc1a9d8bfdaa1ecbea22bbc01690ce89d8cedb19

SHA512
7aa0b646108a36447d089c7f2683fb1a883bccfd77d776391dd6e1ab5d4fe5d1f103ca4c9e9a5aaff03ae7c961a5c07de2e6eb1509a3b60f183e3840e4f00ce9

Download Submit
C:\Windows\System\rHcKHKd.exe

Filesize
2.2MB

MD5
0c01d84ed1b93500c8fa8d1155e7e9ca

SHA1
d982a69b6c7b8d1f19a272f7f6c1bf1c69d16d99

SHA256
d8e20e94d079ef589bdcbd6c6c0f36ec2527c311e2be308db66076c1e8acd3bc

SHA512
4896a55663883f067dc82785506ef3399d2979260a4c98e1e5b5ee4b3c52e0bf4cd22354ffc6122cab9d5c5a504b8b7ddfca88e0af59d1a0d1f34d0f201cfeec

Download Submit
C:\Windows\System\simVbkt.exe

Filesize
2.2MB

MD5
d0dc7bcd6a840a84914c7c1901a1d7ec

SHA1
cd3355ab1f043641d36371418f2cea3f44f155fb

SHA256
6c75d5223d120b20c5dd8d8704e1f75df0b1658effdd809a4a78977c91fd3fec

SHA512
fda6ddeae87b65bef3cd3bb652aebfd5f2735c1805482add8f71bcac8d7a39373c898f3edc8b3156ac9684308f1c2319867b98b9aa45246bea5a1fb1639bab94

Download Submit
C:\Windows\System\squhAgd.exe

Filesize
2.2MB

MD5
cac64874d3c64f4d771763acebd59ab4

SHA1
0c841116388a2aa3de4f4bd9ccd541c9f5d61ddc

SHA256
ec3ef2990bd0bd6b7f90b772b22b829a114e2e6fff4d14a871a5f26fae7b61de

SHA512
f2ed2e769920415f7ccb3e28b249a8120a57d93143bd4ef9d1823065fcf5022a45a3e985ea5121f2dd3e00a0f4f2f447e694ddd3456435faea27c041e230b3b0

Download Submit
C:\Windows\System\zKaPbXE.exe

Filesize
2.2MB

MD5
93c827e20db6d5a9a7c89fa76219458b

SHA1
3a16212c47054ace2da743fd582a6bbb7a179583

SHA256
09a3530b64d896185221823a3abf7b1e0e0ac690a44da567c944d05be43ae1c5

SHA512
0bea22f62cf19400176d795101956530779037b66f6bf2f0ed67e571a0d887dc2cba34fe745eed4cfd9527e4167249776b44713fcb5d92ca83bf66e59ecabe8c

Download Submit
C:\Windows\System\zPxyvMl.exe

Filesize
2.2MB

MD5
844492333cae63039b0da352d486449b

SHA1
831836a58688593fec7c1790fcd0438d57999e88

SHA256
6963992c8c929ac40a0a825e7a7013b7437fd8116f4dc0b342fe1b4316bd4a3a

SHA512
c35289a657ac4e12a3f789a081acb8ae2d5b5775e4548b8a2784bf1960346d55d99b6856a157dbf5b1e6095848c2471d52ef2115a29723ff94fbfb5d6ff21ec6

Download Submit
C:\Windows\System\zSFsMWq.exe

Filesize
2.2MB

MD5
3a05d1d3b430e79e89fe05cdd3666981

SHA1
972fad047dfcf983de9e19923cf9a5cd4b88afe1

SHA256
47a0a9b128a9ce101d0f96499310aeeb8aa45c133621f06bfa43941a4907afc8

SHA512
c423ae593d097c6d4ace925665cce569905e069c2269394abc63c48a7e5feabd6e9ae87f1f8ec49951c9fea253f492e5a36ce14271ee80e557e81bb0ce379d74

Download Submit
memory/212-287-0x00007FF678730000-0x00007FF678B22000-memory.dmp

Filesize
3.9MB

Download
memory/212-3865-0x00007FF678730000-0x00007FF678B22000-memory.dmp

Filesize
3.9MB

Download
memory/436-282-0x00007FF78F570000-0x00007FF78F962000-memory.dmp

Filesize
3.9MB

Download
memory/436-3880-0x00007FF78F570000-0x00007FF78F962000-memory.dmp

Filesize
3.9MB

Download
memory/632-3850-0x00007FF70C1C0000-0x00007FF70C5B2000-memory.dmp

Filesize
3.9MB

Download
memory/632-50-0x00007FF70C1C0000-0x00007FF70C5B2000-memory.dmp

Filesize
3.9MB

Download
memory/1020-3882-0x00007FF740D50000-0x00007FF741142000-memory.dmp

Filesize
3.9MB

Download
memory/1020-168-0x00007FF740D50000-0x00007FF741142000-memory.dmp

Filesize
3.9MB

Download
memory/1088-360-0x00007FF7EED40000-0x00007FF7EF132000-memory.dmp

Filesize
3.9MB

Download
memory/1088-3884-0x00007FF7EED40000-0x00007FF7EF132000-memory.dmp

Filesize
3.9MB

Download
memory/1668-45-0x00007FF8C0680000-0x00007FF8C1141000-memory.dmp

Filesize
10.8MB

Download
memory/1668-46-0x000001F525A90000-0x000001F525AA0000-memory.dmp

Filesize
64KB

Download
memory/1668-47-0x000001F525A90000-0x000001F525AA0000-memory.dmp

Filesize
64KB

Download
memory/1668-8-0x000001F525F40000-0x000001F525F62000-memory.dmp

Filesize
136KB

Download
memory/1684-3860-0x00007FF6ED640000-0x00007FF6EDA32000-memory.dmp

Filesize
3.9MB

Download
memory/1684-260-0x00007FF6ED640000-0x00007FF6EDA32000-memory.dmp

Filesize
3.9MB

Download
memory/1760-358-0x00007FF6F7470000-0x00007FF6F7862000-memory.dmp

Filesize
3.9MB

Download
memory/1760-3894-0x00007FF6F7470000-0x00007FF6F7862000-memory.dmp

Filesize
3.9MB

Download
memory/1984-227-0x00007FF714B60000-0x00007FF714F52000-memory.dmp

Filesize
3.9MB

Download
memory/1984-3874-0x00007FF714B60000-0x00007FF714F52000-memory.dmp

Filesize
3.9MB

Download
memory/2184-3891-0x00007FF72F060000-0x00007FF72F452000-memory.dmp

Filesize
3.9MB

Download
memory/2184-333-0x00007FF72F060000-0x00007FF72F452000-memory.dmp

Filesize
3.9MB

Download
memory/2408-3889-0x00007FF74D750000-0x00007FF74DB42000-memory.dmp

Filesize
3.9MB

Download
memory/2408-323-0x00007FF74D750000-0x00007FF74DB42000-memory.dmp

Filesize
3.9MB

Download
memory/2616-163-0x00007FF707C90000-0x00007FF708082000-memory.dmp

Filesize
3.9MB

Download
memory/2616-3878-0x00007FF707C90000-0x00007FF708082000-memory.dmp

Filesize
3.9MB

Download
memory/2640-96-0x00007FF64BA20000-0x00007FF64BE12000-memory.dmp

Filesize
3.9MB

Download
memory/2640-3852-0x00007FF64BA20000-0x00007FF64BE12000-memory.dmp

Filesize
3.9MB

Download
memory/2840-3863-0x00007FF737A20000-0x00007FF737E12000-memory.dmp

Filesize
3.9MB

Download
memory/2840-362-0x00007FF737A20000-0x00007FF737E12000-memory.dmp

Filesize
3.9MB

Download
memory/2868-69-0x00007FF7D7A40000-0x00007FF7D7E32000-memory.dmp

Filesize
3.9MB

Download
memory/2868-3854-0x00007FF7D7A40000-0x00007FF7D7E32000-memory.dmp

Filesize
3.9MB

Download
memory/2888-0-0x00007FF749CE0000-0x00007FF74A0D2000-memory.dmp

Filesize
3.9MB

Download
memory/2888-1-0x000001C48BD60000-0x000001C48BD70000-memory.dmp

Filesize
64KB

Download
memory/3140-3870-0x00007FF763F40000-0x00007FF764332000-memory.dmp

Filesize
3.9MB

Download
memory/3140-254-0x00007FF763F40000-0x00007FF764332000-memory.dmp

Filesize
3.9MB

Download
memory/3876-3876-0x00007FF671DC0000-0x00007FF6721B2000-memory.dmp

Filesize
3.9MB

Download
memory/3876-363-0x00007FF671DC0000-0x00007FF6721B2000-memory.dmp

Filesize
3.9MB

Download
memory/3884-359-0x00007FF740BF0000-0x00007FF740FE2000-memory.dmp

Filesize
3.9MB

Download
memory/3884-3856-0x00007FF740BF0000-0x00007FF740FE2000-memory.dmp

Filesize
3.9MB

Download
memory/4100-3885-0x00007FF76C520000-0x00007FF76C912000-memory.dmp

Filesize
3.9MB

Download
memory/4100-361-0x00007FF76C520000-0x00007FF76C912000-memory.dmp

Filesize
3.9MB

Download
memory/4524-201-0x00007FF6844C0000-0x00007FF6848B2000-memory.dmp

Filesize
3.9MB

Download
memory/4524-3872-0x00007FF6844C0000-0x00007FF6848B2000-memory.dmp

Filesize
3.9MB

Download
memory/4736-129-0x00007FF7FB420000-0x00007FF7FB812000-memory.dmp

Filesize
3.9MB

Download
memory/4736-3858-0x00007FF7FB420000-0x00007FF7FB812000-memory.dmp

Filesize
3.9MB

Download
memory/5116-253-0x00007FF6B11E0000-0x00007FF6B15D2000-memory.dmp

Filesize
3.9MB

Download
memory/5116-3867-0x00007FF6B11E0000-0x00007FF6B15D2000-memory.dmp

Filesize
3.9MB

Download