xmrig | c593cb3c07f1f3e9ff649269f765e2fefd6e57858eb835e628431cbd7962f65b

Analysis

max time kernel
68s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 02:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
Size

2.2MB
MD5

0236b25b74135f1c403119ac67c82a9f
SHA1

f91c4504998d6819576e50fcf0d8a66d8a0e9baa
SHA256

c593cb3c07f1f3e9ff649269f765e2fefd6e57858eb835e628431cbd7962f65b
SHA512

3d1d0cce6b2c7eec80c811a8e3485b19d6a64e3413c801a56fcda2667279b10921c67e6318a969788d0172b3b3e4374009426aed5520b46b9e30c0166e3d6291
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aD7:NABc

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 42 IoCs

miner

resource	yara_rule
behavioral2/memory/2164-193-0x00007FF786320000-0x00007FF786712000-memory.dmp	xmrig
behavioral2/memory/4620-232-0x00007FF7A9920000-0x00007FF7A9D12000-memory.dmp	xmrig
behavioral2/memory/4440-255-0x00007FF7BC0E0000-0x00007FF7BC4D2000-memory.dmp	xmrig
behavioral2/memory/1912-295-0x00007FF7AA6A0000-0x00007FF7AAA92000-memory.dmp	xmrig
behavioral2/memory/4476-312-0x00007FF7CDA70000-0x00007FF7CDE62000-memory.dmp	xmrig
behavioral2/memory/392-339-0x00007FF6C77E0000-0x00007FF6C7BD2000-memory.dmp	xmrig
behavioral2/memory/1104-348-0x00007FF6BBA50000-0x00007FF6BBE42000-memory.dmp	xmrig
behavioral2/memory/3404-340-0x00007FF68ECC0000-0x00007FF68F0B2000-memory.dmp	xmrig
behavioral2/memory/4100-320-0x00007FF700CF0000-0x00007FF7010E2000-memory.dmp	xmrig
behavioral2/memory/4508-288-0x00007FF746010000-0x00007FF746402000-memory.dmp	xmrig
behavioral2/memory/2976-277-0x00007FF6339E0000-0x00007FF633DD2000-memory.dmp	xmrig
behavioral2/memory/4808-258-0x00007FF7A5630000-0x00007FF7A5A22000-memory.dmp	xmrig
behavioral2/memory/4480-239-0x00007FF67A470000-0x00007FF67A862000-memory.dmp	xmrig
behavioral2/memory/1816-223-0x00007FF74D4B0000-0x00007FF74D8A2000-memory.dmp	xmrig
behavioral2/memory/2904-159-0x00007FF7EB810000-0x00007FF7EBC02000-memory.dmp	xmrig
behavioral2/memory/540-151-0x00007FF7FDA60000-0x00007FF7FDE52000-memory.dmp	xmrig
behavioral2/memory/1620-95-0x00007FF61B870000-0x00007FF61BC62000-memory.dmp	xmrig
behavioral2/memory/4276-68-0x00007FF704870000-0x00007FF704C62000-memory.dmp	xmrig
behavioral2/memory/1840-54-0x00007FF6BC270000-0x00007FF6BC662000-memory.dmp	xmrig
behavioral2/memory/3560-39-0x00007FF6A35B0000-0x00007FF6A39A2000-memory.dmp	xmrig
behavioral2/memory/1564-2592-0x00007FF793D30000-0x00007FF794122000-memory.dmp	xmrig
behavioral2/memory/4476-2628-0x00007FF7CDA70000-0x00007FF7CDE62000-memory.dmp	xmrig
behavioral2/memory/3560-2630-0x00007FF6A35B0000-0x00007FF6A39A2000-memory.dmp	xmrig
behavioral2/memory/4276-2633-0x00007FF704870000-0x00007FF704C62000-memory.dmp	xmrig
behavioral2/memory/1840-2634-0x00007FF6BC270000-0x00007FF6BC662000-memory.dmp	xmrig
behavioral2/memory/1816-2636-0x00007FF74D4B0000-0x00007FF74D8A2000-memory.dmp	xmrig
behavioral2/memory/1732-2649-0x00007FF6359A0000-0x00007FF635D92000-memory.dmp	xmrig
behavioral2/memory/4620-2647-0x00007FF7A9920000-0x00007FF7A9D12000-memory.dmp	xmrig
behavioral2/memory/1620-2643-0x00007FF61B870000-0x00007FF61BC62000-memory.dmp	xmrig
behavioral2/memory/4480-2645-0x00007FF67A470000-0x00007FF67A862000-memory.dmp	xmrig
behavioral2/memory/540-2639-0x00007FF7FDA60000-0x00007FF7FDE52000-memory.dmp	xmrig
behavioral2/memory/1104-2655-0x00007FF6BBA50000-0x00007FF6BBE42000-memory.dmp	xmrig
behavioral2/memory/2976-2659-0x00007FF6339E0000-0x00007FF633DD2000-memory.dmp	xmrig
behavioral2/memory/3404-2657-0x00007FF68ECC0000-0x00007FF68F0B2000-memory.dmp	xmrig
behavioral2/memory/2164-2654-0x00007FF786320000-0x00007FF786712000-memory.dmp	xmrig
behavioral2/memory/4508-2663-0x00007FF746010000-0x00007FF746402000-memory.dmp	xmrig
behavioral2/memory/2904-2652-0x00007FF7EB810000-0x00007FF7EBC02000-memory.dmp	xmrig
behavioral2/memory/4100-2640-0x00007FF700CF0000-0x00007FF7010E2000-memory.dmp	xmrig
behavioral2/memory/4440-2666-0x00007FF7BC0E0000-0x00007FF7BC4D2000-memory.dmp	xmrig
behavioral2/memory/392-2670-0x00007FF6C77E0000-0x00007FF6C7BD2000-memory.dmp	xmrig
behavioral2/memory/1912-2668-0x00007FF7AA6A0000-0x00007FF7AAA92000-memory.dmp	xmrig
behavioral2/memory/4808-2674-0x00007FF7A5630000-0x00007FF7A5A22000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4476	yLhMadR.exe
3560	JlMQKuU.exe
1840	lDeurnR.exe
4276	pDNeUnc.exe
1620	CfrzOHf.exe
1732	DhlrcIR.exe
540	iqTldsA.exe
2904	fTUfSaN.exe
4100	dNCrqvA.exe
2164	PAYvRkQ.exe
1816	eGHnWZn.exe
392	DpflHIZ.exe
4620	hkpnMvW.exe
4480	dMBNNoP.exe
3404	eAkomiB.exe
4440	mwjUlsJ.exe
4808	wkPWexy.exe
2976	hBSELFm.exe
1104	KBpAWPo.exe
4508	XBNlhQX.exe
1912	kJmhBGi.exe
2876	RqrckUR.exe
2596	dHgHpfi.exe
3220	ZOvRizU.exe
1064	BiXhzSa.exe
3868	MCGkFDa.exe
3548	islxeVb.exe
4676	iJsDtku.exe
3660	PfyTlPf.exe
4532	swrpglI.exe
4456	zztdzUV.exe
396	zwqiNYq.exe
3980	PrZZwEn.exe
3644	KJSiGZm.exe
4888	kivQQcX.exe
2300	JoBByeL.exe
2472	eUPUwWj.exe
4184	EmkLzbG.exe
4752	DfWWnrk.exe
2132	DxYKzoF.exe
3612	jkWfTHJ.exe
3652	yXWWPRz.exe
4788	jCWFKGa.exe
2424	oAzVTGY.exe
2416	ZYzpfHL.exe
3800	WBVVNdU.exe
1472	nFxZwNa.exe
1932	hriQjFJ.exe
208	wnljTpN.exe
2872	BcMJvRD.exe
3620	zUocodJ.exe
4352	ynrYNjx.exe
4344	yQLHZKp.exe
3312	FCHeuHn.exe
512	HRJFCNl.exe
1456	YSLYJrW.exe
4572	DcmJSJk.exe
1856	GgvGLiU.exe
1984	EjsdHDi.exe
3696	CyzGjog.exe
440	OQvNFip.exe
4368	CVIMtEJ.exe
5104	ToIqSpv.exe
2224	WuMbcqE.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1564-0-0x00007FF793D30000-0x00007FF794122000-memory.dmp	upx
behavioral2/files/0x000c000000023b35-7.dat	upx
behavioral2/files/0x000a000000023b93-19.dat	upx
behavioral2/files/0x000b000000023b8f-10.dat	upx
behavioral2/files/0x000a000000023b9a-46.dat	upx
behavioral2/files/0x000a000000023b9c-58.dat	upx
behavioral2/files/0x000a000000023bab-132.dat	upx
behavioral2/files/0x000a000000023bb1-167.dat	upx
behavioral2/memory/2164-193-0x00007FF786320000-0x00007FF786712000-memory.dmp	upx
behavioral2/memory/4620-232-0x00007FF7A9920000-0x00007FF7A9D12000-memory.dmp	upx
behavioral2/memory/4440-255-0x00007FF7BC0E0000-0x00007FF7BC4D2000-memory.dmp	upx
behavioral2/memory/1912-295-0x00007FF7AA6A0000-0x00007FF7AAA92000-memory.dmp	upx
behavioral2/memory/4476-312-0x00007FF7CDA70000-0x00007FF7CDE62000-memory.dmp	upx
behavioral2/memory/392-339-0x00007FF6C77E0000-0x00007FF6C7BD2000-memory.dmp	upx
behavioral2/memory/1104-348-0x00007FF6BBA50000-0x00007FF6BBE42000-memory.dmp	upx
behavioral2/memory/3404-340-0x00007FF68ECC0000-0x00007FF68F0B2000-memory.dmp	upx
behavioral2/memory/4100-320-0x00007FF700CF0000-0x00007FF7010E2000-memory.dmp	upx
behavioral2/memory/4508-288-0x00007FF746010000-0x00007FF746402000-memory.dmp	upx
behavioral2/memory/2976-277-0x00007FF6339E0000-0x00007FF633DD2000-memory.dmp	upx
behavioral2/memory/4808-258-0x00007FF7A5630000-0x00007FF7A5A22000-memory.dmp	upx
behavioral2/memory/4480-239-0x00007FF67A470000-0x00007FF67A862000-memory.dmp	upx
behavioral2/memory/1816-223-0x00007FF74D4B0000-0x00007FF74D8A2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba5-183.dat	upx
behavioral2/files/0x000a000000023bb3-181.dat	upx
behavioral2/files/0x000a000000023bb2-172.dat	upx
behavioral2/files/0x000a000000023ba7-169.dat	upx
behavioral2/files/0x000a000000023bb0-165.dat	upx
behavioral2/files/0x000a000000023ba6-161.dat	upx
behavioral2/files/0x000a000000023ba4-160.dat	upx
behavioral2/memory/2904-159-0x00007FF7EB810000-0x00007FF7EBC02000-memory.dmp	upx
behavioral2/files/0x000a000000023bae-155.dat	upx
behavioral2/files/0x000a000000023baf-154.dat	upx
behavioral2/files/0x000a000000023bad-153.dat	upx
behavioral2/memory/540-151-0x00007FF7FDA60000-0x00007FF7FDE52000-memory.dmp	upx
behavioral2/files/0x000a000000023ba1-141.dat	upx
behavioral2/files/0x000a000000023ba0-139.dat	upx
behavioral2/files/0x000a000000023b9f-129.dat	upx
behavioral2/files/0x000a000000023baa-123.dat	upx
behavioral2/memory/1732-122-0x00007FF6359A0000-0x00007FF635D92000-memory.dmp	upx
behavioral2/files/0x000a000000023ba3-117.dat	upx
behavioral2/files/0x000a000000023ba9-114.dat	upx
behavioral2/files/0x000a000000023ba8-111.dat	upx
behavioral2/files/0x000a000000023b9e-110.dat	upx
behavioral2/files/0x000a000000023ba2-143.dat	upx
behavioral2/files/0x000a000000023b9d-108.dat	upx
behavioral2/memory/1620-95-0x00007FF61B870000-0x00007FF61BC62000-memory.dmp	upx
behavioral2/files/0x000a000000023b98-82.dat	upx
behavioral2/files/0x000a000000023b99-71.dat	upx
behavioral2/files/0x000a000000023b97-74.dat	upx
behavioral2/files/0x000a000000023b96-57.dat	upx
behavioral2/memory/4276-68-0x00007FF704870000-0x00007FF704C62000-memory.dmp	upx
behavioral2/memory/1840-54-0x00007FF6BC270000-0x00007FF6BC662000-memory.dmp	upx
behavioral2/files/0x000a000000023b9b-50.dat	upx
behavioral2/files/0x000a000000023b95-42.dat	upx
behavioral2/memory/3560-39-0x00007FF6A35B0000-0x00007FF6A39A2000-memory.dmp	upx
behavioral2/files/0x000a000000023b94-24.dat	upx
behavioral2/memory/1564-2592-0x00007FF793D30000-0x00007FF794122000-memory.dmp	upx
behavioral2/memory/4476-2628-0x00007FF7CDA70000-0x00007FF7CDE62000-memory.dmp	upx
behavioral2/memory/3560-2630-0x00007FF6A35B0000-0x00007FF6A39A2000-memory.dmp	upx
behavioral2/memory/4276-2633-0x00007FF704870000-0x00007FF704C62000-memory.dmp	upx
behavioral2/memory/1840-2634-0x00007FF6BC270000-0x00007FF6BC662000-memory.dmp	upx
behavioral2/memory/1816-2636-0x00007FF74D4B0000-0x00007FF74D8A2000-memory.dmp	upx
behavioral2/memory/1732-2649-0x00007FF6359A0000-0x00007FF635D92000-memory.dmp	upx
behavioral2/memory/4620-2647-0x00007FF7A9920000-0x00007FF7A9D12000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\oMpBICA.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\gkCTPSA.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\hhlXhAJ.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\yXWWPRz.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\bHWcLlE.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\BISkvkE.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\WCnsWHn.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\hqqoSaW.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\aXDJMse.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\sHJmyQG.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\oTmWTKd.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\euzFgvF.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\pLGrXhx.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\AfPkWwL.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\KJSiGZm.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\WGfJctO.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\fmCbixm.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\hcOjEbf.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\WmQIOMi.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\sbphpiL.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\zEkmort.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\hmTAckV.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\lHiWrwE.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\fxQWEtU.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\SzJkrIk.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\gMKZAVz.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\TEawxfn.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\jQCeiSX.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\SCSZvQL.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\zSMlzAf.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\ChguBcQ.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\kLHLScS.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\LWLSaYs.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\OIBAjmv.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\YSLYJrW.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\YRTMDJM.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\ulIyUmV.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\ExAcIef.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\LqYGxcP.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\KAJrUaY.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\IdQjHQZ.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\VLEhfUN.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\QQtfBiH.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\dyoURLE.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\NiKiJob.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\typxyFT.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\xMgYTyj.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\iqTldsA.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\eUPUwWj.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\HmcZnrp.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\INNPfrr.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\wzcHdpw.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\zQXlRsa.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\vGCvtSf.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\HvTvzRV.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\zZicCzI.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\YuPujxl.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\UOzLdET.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\hyEtYTG.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\dkawDOR.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\nvmaFtY.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\VxXBmUP.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\LtKbcjL.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
File created	C:\Windows\System\xOrwkvC.exe	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1420	powershell.exe
1420	powershell.exe
1420	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1420	powershell.exe
Token: SeLockMemoryPrivilege	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 1420	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	85
PID 1564 wrote to memory of 1420	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	85
PID 1564 wrote to memory of 4476	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	86
PID 1564 wrote to memory of 4476	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	86
PID 1564 wrote to memory of 3560	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	87
PID 1564 wrote to memory of 3560	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	87
PID 1564 wrote to memory of 1840	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	88
PID 1564 wrote to memory of 1840	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	88
PID 1564 wrote to memory of 4276	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	89
PID 1564 wrote to memory of 4276	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	89
PID 1564 wrote to memory of 1620	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	90
PID 1564 wrote to memory of 1620	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	90
PID 1564 wrote to memory of 1732	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	91
PID 1564 wrote to memory of 1732	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	91
PID 1564 wrote to memory of 540	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	92
PID 1564 wrote to memory of 540	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	92
PID 1564 wrote to memory of 2904	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	93
PID 1564 wrote to memory of 2904	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	93
PID 1564 wrote to memory of 4100	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	94
PID 1564 wrote to memory of 4100	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	94
PID 1564 wrote to memory of 2164	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	95
PID 1564 wrote to memory of 2164	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	95
PID 1564 wrote to memory of 1816	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	96
PID 1564 wrote to memory of 1816	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	96
PID 1564 wrote to memory of 392	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	97
PID 1564 wrote to memory of 392	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	97
PID 1564 wrote to memory of 4620	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	98
PID 1564 wrote to memory of 4620	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	98
PID 1564 wrote to memory of 4480	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	99
PID 1564 wrote to memory of 4480	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	99
PID 1564 wrote to memory of 3404	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	100
PID 1564 wrote to memory of 3404	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	100
PID 1564 wrote to memory of 4440	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	101
PID 1564 wrote to memory of 4440	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	101
PID 1564 wrote to memory of 4808	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	102
PID 1564 wrote to memory of 4808	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	102
PID 1564 wrote to memory of 2976	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	103
PID 1564 wrote to memory of 2976	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	103
PID 1564 wrote to memory of 1104	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	104
PID 1564 wrote to memory of 1104	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	104
PID 1564 wrote to memory of 4508	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	105
PID 1564 wrote to memory of 4508	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	105
PID 1564 wrote to memory of 1912	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	106
PID 1564 wrote to memory of 1912	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	106
PID 1564 wrote to memory of 2876	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	107
PID 1564 wrote to memory of 2876	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	107
PID 1564 wrote to memory of 2596	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	108
PID 1564 wrote to memory of 2596	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	108
PID 1564 wrote to memory of 3220	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	109
PID 1564 wrote to memory of 3220	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	109
PID 1564 wrote to memory of 1064	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	110
PID 1564 wrote to memory of 1064	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	110
PID 1564 wrote to memory of 3868	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	111
PID 1564 wrote to memory of 3868	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	111
PID 1564 wrote to memory of 3548	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	112
PID 1564 wrote to memory of 3548	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	112
PID 1564 wrote to memory of 2300	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	113
PID 1564 wrote to memory of 2300	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	113
PID 1564 wrote to memory of 4676	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	114
PID 1564 wrote to memory of 4676	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	114
PID 1564 wrote to memory of 3660	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	115
PID 1564 wrote to memory of 3660	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	115
PID 1564 wrote to memory of 4532	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	116
PID 1564 wrote to memory of 4532	1564	0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0236b25b74135f1c403119ac67c82a9f_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1420
- C:\Windows\System\yLhMadR.exe
  C:\Windows\System\yLhMadR.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\JlMQKuU.exe
  C:\Windows\System\JlMQKuU.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\lDeurnR.exe
  C:\Windows\System\lDeurnR.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\pDNeUnc.exe
  C:\Windows\System\pDNeUnc.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\CfrzOHf.exe
  C:\Windows\System\CfrzOHf.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\DhlrcIR.exe
  C:\Windows\System\DhlrcIR.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\iqTldsA.exe
  C:\Windows\System\iqTldsA.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\fTUfSaN.exe
  C:\Windows\System\fTUfSaN.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\dNCrqvA.exe
  C:\Windows\System\dNCrqvA.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\PAYvRkQ.exe
  C:\Windows\System\PAYvRkQ.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\eGHnWZn.exe
  C:\Windows\System\eGHnWZn.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\DpflHIZ.exe
  C:\Windows\System\DpflHIZ.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\hkpnMvW.exe
  C:\Windows\System\hkpnMvW.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\dMBNNoP.exe
  C:\Windows\System\dMBNNoP.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\eAkomiB.exe
  C:\Windows\System\eAkomiB.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\mwjUlsJ.exe
  C:\Windows\System\mwjUlsJ.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\wkPWexy.exe
  C:\Windows\System\wkPWexy.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\hBSELFm.exe
  C:\Windows\System\hBSELFm.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\KBpAWPo.exe
  C:\Windows\System\KBpAWPo.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\XBNlhQX.exe
  C:\Windows\System\XBNlhQX.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\kJmhBGi.exe
  C:\Windows\System\kJmhBGi.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\RqrckUR.exe
  C:\Windows\System\RqrckUR.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\dHgHpfi.exe
  C:\Windows\System\dHgHpfi.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\ZOvRizU.exe
  C:\Windows\System\ZOvRizU.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\BiXhzSa.exe
  C:\Windows\System\BiXhzSa.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\MCGkFDa.exe
  C:\Windows\System\MCGkFDa.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\islxeVb.exe
  C:\Windows\System\islxeVb.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\JoBByeL.exe
  C:\Windows\System\JoBByeL.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\iJsDtku.exe
  C:\Windows\System\iJsDtku.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\PfyTlPf.exe
  C:\Windows\System\PfyTlPf.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\swrpglI.exe
  C:\Windows\System\swrpglI.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\zztdzUV.exe
  C:\Windows\System\zztdzUV.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\zwqiNYq.exe
  C:\Windows\System\zwqiNYq.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\PrZZwEn.exe
  C:\Windows\System\PrZZwEn.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\KJSiGZm.exe
  C:\Windows\System\KJSiGZm.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\kivQQcX.exe
  C:\Windows\System\kivQQcX.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\eUPUwWj.exe
  C:\Windows\System\eUPUwWj.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\EmkLzbG.exe
  C:\Windows\System\EmkLzbG.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\oAzVTGY.exe
  C:\Windows\System\oAzVTGY.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\DfWWnrk.exe
  C:\Windows\System\DfWWnrk.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\hriQjFJ.exe
  C:\Windows\System\hriQjFJ.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\DxYKzoF.exe
  C:\Windows\System\DxYKzoF.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\jkWfTHJ.exe
  C:\Windows\System\jkWfTHJ.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\yXWWPRz.exe
  C:\Windows\System\yXWWPRz.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\jCWFKGa.exe
  C:\Windows\System\jCWFKGa.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\ZYzpfHL.exe
  C:\Windows\System\ZYzpfHL.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\WBVVNdU.exe
  C:\Windows\System\WBVVNdU.exe
  2⤵
  - Executes dropped EXE
  PID:3800
- C:\Windows\System\nFxZwNa.exe
  C:\Windows\System\nFxZwNa.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\wnljTpN.exe
  C:\Windows\System\wnljTpN.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\BcMJvRD.exe
  C:\Windows\System\BcMJvRD.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\zUocodJ.exe
  C:\Windows\System\zUocodJ.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\ynrYNjx.exe
  C:\Windows\System\ynrYNjx.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\yQLHZKp.exe
  C:\Windows\System\yQLHZKp.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\FCHeuHn.exe
  C:\Windows\System\FCHeuHn.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\HRJFCNl.exe
  C:\Windows\System\HRJFCNl.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\YSLYJrW.exe
  C:\Windows\System\YSLYJrW.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\DcmJSJk.exe
  C:\Windows\System\DcmJSJk.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\GgvGLiU.exe
  C:\Windows\System\GgvGLiU.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\EjsdHDi.exe
  C:\Windows\System\EjsdHDi.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\CyzGjog.exe
  C:\Windows\System\CyzGjog.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\OQvNFip.exe
  C:\Windows\System\OQvNFip.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\CVIMtEJ.exe
  C:\Windows\System\CVIMtEJ.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\ToIqSpv.exe
  C:\Windows\System\ToIqSpv.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\WuMbcqE.exe
  C:\Windows\System\WuMbcqE.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\ICFXpmI.exe
  C:\Windows\System\ICFXpmI.exe
  2⤵
  PID:3636
- C:\Windows\System\OYnqVAM.exe
  C:\Windows\System\OYnqVAM.exe
  2⤵
  PID:4420
- C:\Windows\System\lhKdiTF.exe
  C:\Windows\System\lhKdiTF.exe
  2⤵
  PID:4616
- C:\Windows\System\TbmmKjT.exe
  C:\Windows\System\TbmmKjT.exe
  2⤵
  PID:5088
- C:\Windows\System\umivCQJ.exe
  C:\Windows\System\umivCQJ.exe
  2⤵
  PID:3816
- C:\Windows\System\gWtaDDT.exe
  C:\Windows\System\gWtaDDT.exe
  2⤵
  PID:4556
- C:\Windows\System\dDbDWqk.exe
  C:\Windows\System\dDbDWqk.exe
  2⤵
  PID:1320
- C:\Windows\System\bHWcLlE.exe
  C:\Windows\System\bHWcLlE.exe
  2⤵
  PID:1072
- C:\Windows\System\usVBwnv.exe
  C:\Windows\System\usVBwnv.exe
  2⤵
  PID:1704
- C:\Windows\System\juONHQN.exe
  C:\Windows\System\juONHQN.exe
  2⤵
  PID:4840
- C:\Windows\System\NvbzTcJ.exe
  C:\Windows\System\NvbzTcJ.exe
  2⤵
  PID:3424
- C:\Windows\System\sqyCXIo.exe
  C:\Windows\System\sqyCXIo.exe
  2⤵
  PID:5140
- C:\Windows\System\uqzflpl.exe
  C:\Windows\System\uqzflpl.exe
  2⤵
  PID:5156
- C:\Windows\System\gwTFTdQ.exe
  C:\Windows\System\gwTFTdQ.exe
  2⤵
  PID:5176
- C:\Windows\System\InRDcdI.exe
  C:\Windows\System\InRDcdI.exe
  2⤵
  PID:5200
- C:\Windows\System\PaUDSPz.exe
  C:\Windows\System\PaUDSPz.exe
  2⤵
  PID:5268
- C:\Windows\System\WyKSERS.exe
  C:\Windows\System\WyKSERS.exe
  2⤵
  PID:5284
- C:\Windows\System\wrxoMvh.exe
  C:\Windows\System\wrxoMvh.exe
  2⤵
  PID:5300
- C:\Windows\System\bQUuZZi.exe
  C:\Windows\System\bQUuZZi.exe
  2⤵
  PID:5316
- C:\Windows\System\PSmgQih.exe
  C:\Windows\System\PSmgQih.exe
  2⤵
  PID:5332
- C:\Windows\System\izGpeej.exe
  C:\Windows\System\izGpeej.exe
  2⤵
  PID:5348
- C:\Windows\System\yutnvHY.exe
  C:\Windows\System\yutnvHY.exe
  2⤵
  PID:5364
- C:\Windows\System\BzQnySM.exe
  C:\Windows\System\BzQnySM.exe
  2⤵
  PID:5484
- C:\Windows\System\klXuNmz.exe
  C:\Windows\System\klXuNmz.exe
  2⤵
  PID:5520
- C:\Windows\System\LiCcuNg.exe
  C:\Windows\System\LiCcuNg.exe
  2⤵
  PID:5540
- C:\Windows\System\wUfANwY.exe
  C:\Windows\System\wUfANwY.exe
  2⤵
  PID:5564
- C:\Windows\System\BOTOmkx.exe
  C:\Windows\System\BOTOmkx.exe
  2⤵
  PID:5588
- C:\Windows\System\MKHwzPb.exe
  C:\Windows\System\MKHwzPb.exe
  2⤵
  PID:5612
- C:\Windows\System\CbDYIGc.exe
  C:\Windows\System\CbDYIGc.exe
  2⤵
  PID:5632
- C:\Windows\System\XAnpSML.exe
  C:\Windows\System\XAnpSML.exe
  2⤵
  PID:5840
- C:\Windows\System\KaPhhoP.exe
  C:\Windows\System\KaPhhoP.exe
  2⤵
  PID:5856
- C:\Windows\System\OQetMbh.exe
  C:\Windows\System\OQetMbh.exe
  2⤵
  PID:5872
- C:\Windows\System\PvhjAeJ.exe
  C:\Windows\System\PvhjAeJ.exe
  2⤵
  PID:5892
- C:\Windows\System\LsAEYAj.exe
  C:\Windows\System\LsAEYAj.exe
  2⤵
  PID:5908
- C:\Windows\System\CrupyML.exe
  C:\Windows\System\CrupyML.exe
  2⤵
  PID:5936
- C:\Windows\System\RSSImpu.exe
  C:\Windows\System\RSSImpu.exe
  2⤵
  PID:5956
- C:\Windows\System\HmcZnrp.exe
  C:\Windows\System\HmcZnrp.exe
  2⤵
  PID:5980
- C:\Windows\System\OsrRubB.exe
  C:\Windows\System\OsrRubB.exe
  2⤵
  PID:6004
- C:\Windows\System\sOcUmEP.exe
  C:\Windows\System\sOcUmEP.exe
  2⤵
  PID:6028
- C:\Windows\System\fUhDBck.exe
  C:\Windows\System\fUhDBck.exe
  2⤵
  PID:6056
- C:\Windows\System\TMSDoca.exe
  C:\Windows\System\TMSDoca.exe
  2⤵
  PID:6084
- C:\Windows\System\JyVRXkV.exe
  C:\Windows\System\JyVRXkV.exe
  2⤵
  PID:6104
- C:\Windows\System\kBTtrmy.exe
  C:\Windows\System\kBTtrmy.exe
  2⤵
  PID:6128
- C:\Windows\System\UTukVJo.exe
  C:\Windows\System\UTukVJo.exe
  2⤵
  PID:4868
- C:\Windows\System\AFtQwfm.exe
  C:\Windows\System\AFtQwfm.exe
  2⤵
  PID:4460
- C:\Windows\System\YjWSKuz.exe
  C:\Windows\System\YjWSKuz.exe
  2⤵
  PID:1788
- C:\Windows\System\qYFvvaS.exe
  C:\Windows\System\qYFvvaS.exe
  2⤵
  PID:764
- C:\Windows\System\erMfkFg.exe
  C:\Windows\System\erMfkFg.exe
  2⤵
  PID:2732
- C:\Windows\System\oVGmNmp.exe
  C:\Windows\System\oVGmNmp.exe
  2⤵
  PID:5228
- C:\Windows\System\AMIEEKL.exe
  C:\Windows\System\AMIEEKL.exe
  2⤵
  PID:4796
- C:\Windows\System\MZLSPtU.exe
  C:\Windows\System\MZLSPtU.exe
  2⤵
  PID:1060
- C:\Windows\System\pFrafiP.exe
  C:\Windows\System\pFrafiP.exe
  2⤵
  PID:5132
- C:\Windows\System\hdVIwCx.exe
  C:\Windows\System\hdVIwCx.exe
  2⤵
  PID:5184
- C:\Windows\System\cbMksjf.exe
  C:\Windows\System\cbMksjf.exe
  2⤵
  PID:3936
- C:\Windows\System\YsahkQd.exe
  C:\Windows\System\YsahkQd.exe
  2⤵
  PID:5328
- C:\Windows\System\aXDJMse.exe
  C:\Windows\System\aXDJMse.exe
  2⤵
  PID:5360
- C:\Windows\System\GdyGSAf.exe
  C:\Windows\System\GdyGSAf.exe
  2⤵
  PID:5444
- C:\Windows\System\LeygWvl.exe
  C:\Windows\System\LeygWvl.exe
  2⤵
  PID:5480
- C:\Windows\System\sJzUCaL.exe
  C:\Windows\System\sJzUCaL.exe
  2⤵
  PID:5512
- C:\Windows\System\tmSxpND.exe
  C:\Windows\System\tmSxpND.exe
  2⤵
  PID:5572
- C:\Windows\System\urmdRzY.exe
  C:\Windows\System\urmdRzY.exe
  2⤵
  PID:5608
- C:\Windows\System\qIWDcdr.exe
  C:\Windows\System\qIWDcdr.exe
  2⤵
  PID:5724
- C:\Windows\System\nifEflX.exe
  C:\Windows\System\nifEflX.exe
  2⤵
  PID:4756
- C:\Windows\System\aPrJXlE.exe
  C:\Windows\System\aPrJXlE.exe
  2⤵
  PID:4372
- C:\Windows\System\KCvPkBb.exe
  C:\Windows\System\KCvPkBb.exe
  2⤵
  PID:3940
- C:\Windows\System\CWZROIR.exe
  C:\Windows\System\CWZROIR.exe
  2⤵
  PID:2060
- C:\Windows\System\YZCIjMw.exe
  C:\Windows\System\YZCIjMw.exe
  2⤵
  PID:684
- C:\Windows\System\qfYQHGy.exe
  C:\Windows\System\qfYQHGy.exe
  2⤵
  PID:2636
- C:\Windows\System\ZQuzsFe.exe
  C:\Windows\System\ZQuzsFe.exe
  2⤵
  PID:4424
- C:\Windows\System\JgjqWpq.exe
  C:\Windows\System\JgjqWpq.exe
  2⤵
  PID:3608
- C:\Windows\System\SnarHkt.exe
  C:\Windows\System\SnarHkt.exe
  2⤵
  PID:1608
- C:\Windows\System\HStcZsN.exe
  C:\Windows\System\HStcZsN.exe
  2⤵
  PID:3356
- C:\Windows\System\MQedasW.exe
  C:\Windows\System\MQedasW.exe
  2⤵
  PID:4024
- C:\Windows\System\ieteSIg.exe
  C:\Windows\System\ieteSIg.exe
  2⤵
  PID:4332
- C:\Windows\System\XUvSOrZ.exe
  C:\Windows\System\XUvSOrZ.exe
  2⤵
  PID:3976
- C:\Windows\System\PojZLnP.exe
  C:\Windows\System\PojZLnP.exe
  2⤵
  PID:4152
- C:\Windows\System\HPqyoQN.exe
  C:\Windows\System\HPqyoQN.exe
  2⤵
  PID:5384
- C:\Windows\System\wejYooq.exe
  C:\Windows\System\wejYooq.exe
  2⤵
  PID:5848
- C:\Windows\System\SSkwWbX.exe
  C:\Windows\System\SSkwWbX.exe
  2⤵
  PID:5904
- C:\Windows\System\cDZbPnU.exe
  C:\Windows\System\cDZbPnU.exe
  2⤵
  PID:5952
- C:\Windows\System\IMWPBAa.exe
  C:\Windows\System\IMWPBAa.exe
  2⤵
  PID:5972
- C:\Windows\System\LtYbqbK.exe
  C:\Windows\System\LtYbqbK.exe
  2⤵
  PID:6124
- C:\Windows\System\sCnchnK.exe
  C:\Windows\System\sCnchnK.exe
  2⤵
  PID:6072
- C:\Windows\System\sbphpiL.exe
  C:\Windows\System\sbphpiL.exe
  2⤵
  PID:1160
- C:\Windows\System\HrlVoCS.exe
  C:\Windows\System\HrlVoCS.exe
  2⤵
  PID:4364
- C:\Windows\System\HzKXgAw.exe
  C:\Windows\System\HzKXgAw.exe
  2⤵
  PID:628
- C:\Windows\System\PsiECMf.exe
  C:\Windows\System\PsiECMf.exe
  2⤵
  PID:3996
- C:\Windows\System\eUPIUVs.exe
  C:\Windows\System\eUPIUVs.exe
  2⤵
  PID:5164
- C:\Windows\System\uGGJPUR.exe
  C:\Windows\System\uGGJPUR.exe
  2⤵
  PID:5308
- C:\Windows\System\LVLTOhP.exe
  C:\Windows\System\LVLTOhP.exe
  2⤵
  PID:5436
- C:\Windows\System\jbBTLIp.exe
  C:\Windows\System\jbBTLIp.exe
  2⤵
  PID:5624
- C:\Windows\System\DMvAySY.exe
  C:\Windows\System\DMvAySY.exe
  2⤵
  PID:1832
- C:\Windows\System\qnzkgNo.exe
  C:\Windows\System\qnzkgNo.exe
  2⤵
  PID:5080
- C:\Windows\System\MpGMnwb.exe
  C:\Windows\System\MpGMnwb.exe
  2⤵
  PID:3416
- C:\Windows\System\MQQHGBf.exe
  C:\Windows\System\MQQHGBf.exe
  2⤵
  PID:1380
- C:\Windows\System\cTroOWg.exe
  C:\Windows\System\cTroOWg.exe
  2⤵
  PID:5404
- C:\Windows\System\QLKPiOo.exe
  C:\Windows\System\QLKPiOo.exe
  2⤵
  PID:5028
- C:\Windows\System\jfeaRyG.exe
  C:\Windows\System\jfeaRyG.exe
  2⤵
  PID:6156
- C:\Windows\System\ltmDMDz.exe
  C:\Windows\System\ltmDMDz.exe
  2⤵
  PID:6172
- C:\Windows\System\vTUlWRK.exe
  C:\Windows\System\vTUlWRK.exe
  2⤵
  PID:6200
- C:\Windows\System\EzKHMZE.exe
  C:\Windows\System\EzKHMZE.exe
  2⤵
  PID:6220
- C:\Windows\System\WycwsmD.exe
  C:\Windows\System\WycwsmD.exe
  2⤵
  PID:6244
- C:\Windows\System\WGfJctO.exe
  C:\Windows\System\WGfJctO.exe
  2⤵
  PID:6264
- C:\Windows\System\uwQbreP.exe
  C:\Windows\System\uwQbreP.exe
  2⤵
  PID:6288
- C:\Windows\System\NyUTTlc.exe
  C:\Windows\System\NyUTTlc.exe
  2⤵
  PID:6312
- C:\Windows\System\OKKsVIj.exe
  C:\Windows\System\OKKsVIj.exe
  2⤵
  PID:6328
- C:\Windows\System\fYFiYVt.exe
  C:\Windows\System\fYFiYVt.exe
  2⤵
  PID:6352
- C:\Windows\System\zvoIKHZ.exe
  C:\Windows\System\zvoIKHZ.exe
  2⤵
  PID:6376
- C:\Windows\System\QXvHXgf.exe
  C:\Windows\System\QXvHXgf.exe
  2⤵
  PID:6392
- C:\Windows\System\NTftQhr.exe
  C:\Windows\System\NTftQhr.exe
  2⤵
  PID:6420
- C:\Windows\System\zcTTMxd.exe
  C:\Windows\System\zcTTMxd.exe
  2⤵
  PID:6444
- C:\Windows\System\wDTAwNj.exe
  C:\Windows\System\wDTAwNj.exe
  2⤵
  PID:6468
- C:\Windows\System\qUSSuPZ.exe
  C:\Windows\System\qUSSuPZ.exe
  2⤵
  PID:6488
- C:\Windows\System\SqXDXEt.exe
  C:\Windows\System\SqXDXEt.exe
  2⤵
  PID:6516
- C:\Windows\System\bQeLUyF.exe
  C:\Windows\System\bQeLUyF.exe
  2⤵
  PID:6544
- C:\Windows\System\ByZxQYh.exe
  C:\Windows\System\ByZxQYh.exe
  2⤵
  PID:6560
- C:\Windows\System\TJLWBTP.exe
  C:\Windows\System\TJLWBTP.exe
  2⤵
  PID:6584
- C:\Windows\System\EYngJCX.exe
  C:\Windows\System\EYngJCX.exe
  2⤵
  PID:6608
- C:\Windows\System\bPwMeJu.exe
  C:\Windows\System\bPwMeJu.exe
  2⤵
  PID:6632
- C:\Windows\System\knrCIeY.exe
  C:\Windows\System\knrCIeY.exe
  2⤵
  PID:6652
- C:\Windows\System\qcXglti.exe
  C:\Windows\System\qcXglti.exe
  2⤵
  PID:6680
- C:\Windows\System\PaMRWJQ.exe
  C:\Windows\System\PaMRWJQ.exe
  2⤵
  PID:6700
- C:\Windows\System\oBfrJTr.exe
  C:\Windows\System\oBfrJTr.exe
  2⤵
  PID:6724
- C:\Windows\System\COfiWnf.exe
  C:\Windows\System\COfiWnf.exe
  2⤵
  PID:6752
- C:\Windows\System\NANRNwR.exe
  C:\Windows\System\NANRNwR.exe
  2⤵
  PID:6772
- C:\Windows\System\UUTIuwh.exe
  C:\Windows\System\UUTIuwh.exe
  2⤵
  PID:6800
- C:\Windows\System\hMjsboX.exe
  C:\Windows\System\hMjsboX.exe
  2⤵
  PID:6816
- C:\Windows\System\SGGyksS.exe
  C:\Windows\System\SGGyksS.exe
  2⤵
  PID:6840
- C:\Windows\System\hKTeBnu.exe
  C:\Windows\System\hKTeBnu.exe
  2⤵
  PID:6868
- C:\Windows\System\FesfYUd.exe
  C:\Windows\System\FesfYUd.exe
  2⤵
  PID:6892
- C:\Windows\System\LQyiZFR.exe
  C:\Windows\System\LQyiZFR.exe
  2⤵
  PID:6912
- C:\Windows\System\WcpsDrB.exe
  C:\Windows\System\WcpsDrB.exe
  2⤵
  PID:6940
- C:\Windows\System\HwqeLPU.exe
  C:\Windows\System\HwqeLPU.exe
  2⤵
  PID:6964
- C:\Windows\System\XqmAYRR.exe
  C:\Windows\System\XqmAYRR.exe
  2⤵
  PID:6992
- C:\Windows\System\EROtyUV.exe
  C:\Windows\System\EROtyUV.exe
  2⤵
  PID:7012
- C:\Windows\System\inRkwcV.exe
  C:\Windows\System\inRkwcV.exe
  2⤵
  PID:7036
- C:\Windows\System\fEdSWxK.exe
  C:\Windows\System\fEdSWxK.exe
  2⤵
  PID:7056
- C:\Windows\System\MdcbeVJ.exe
  C:\Windows\System\MdcbeVJ.exe
  2⤵
  PID:7080
- C:\Windows\System\UGflFSn.exe
  C:\Windows\System\UGflFSn.exe
  2⤵
  PID:7112
- C:\Windows\System\CrSBmZG.exe
  C:\Windows\System\CrSBmZG.exe
  2⤵
  PID:7132
- C:\Windows\System\TSERbTk.exe
  C:\Windows\System\TSERbTk.exe
  2⤵
  PID:7160
- C:\Windows\System\aLtEEaY.exe
  C:\Windows\System\aLtEEaY.exe
  2⤵
  PID:5596
- C:\Windows\System\WOavSnm.exe
  C:\Windows\System\WOavSnm.exe
  2⤵
  PID:5548
- C:\Windows\System\zXWZzfS.exe
  C:\Windows\System\zXWZzfS.exe
  2⤵
  PID:6068
- C:\Windows\System\EwdCSSb.exe
  C:\Windows\System\EwdCSSb.exe
  2⤵
  PID:1100
- C:\Windows\System\pxIidTx.exe
  C:\Windows\System\pxIidTx.exe
  2⤵
  PID:6188
- C:\Windows\System\zGydKrd.exe
  C:\Windows\System\zGydKrd.exe
  2⤵
  PID:6216
- C:\Windows\System\fmCbixm.exe
  C:\Windows\System\fmCbixm.exe
  2⤵
  PID:6096
- C:\Windows\System\velsHDb.exe
  C:\Windows\System\velsHDb.exe
  2⤵
  PID:6260
- C:\Windows\System\ChguBcQ.exe
  C:\Windows\System\ChguBcQ.exe
  2⤵
  PID:6320
- C:\Windows\System\imqfphC.exe
  C:\Windows\System\imqfphC.exe
  2⤵
  PID:2168
- C:\Windows\System\wZrtEhH.exe
  C:\Windows\System\wZrtEhH.exe
  2⤵
  PID:5344
- C:\Windows\System\julYYFf.exe
  C:\Windows\System\julYYFf.exe
  2⤵
  PID:6440
- C:\Windows\System\hZEetrV.exe
  C:\Windows\System\hZEetrV.exe
  2⤵
  PID:6476
- C:\Windows\System\cSXwFFI.exe
  C:\Windows\System\cSXwFFI.exe
  2⤵
  PID:6536
- C:\Windows\System\YfmFMMe.exe
  C:\Windows\System\YfmFMMe.exe
  2⤵
  PID:6640
- C:\Windows\System\guqoxQy.exe
  C:\Windows\System\guqoxQy.exe
  2⤵
  PID:6300
- C:\Windows\System\LbsOHOP.exe
  C:\Windows\System\LbsOHOP.exe
  2⤵
  PID:6360
- C:\Windows\System\cPAiBWz.exe
  C:\Windows\System\cPAiBWz.exe
  2⤵
  PID:4084
- C:\Windows\System\pNwaRVO.exe
  C:\Windows\System\pNwaRVO.exe
  2⤵
  PID:6556
- C:\Windows\System\ObRoHGk.exe
  C:\Windows\System\ObRoHGk.exe
  2⤵
  PID:7024
- C:\Windows\System\NMdzzkb.exe
  C:\Windows\System\NMdzzkb.exe
  2⤵
  PID:6384
- C:\Windows\System\XRGFiCd.exe
  C:\Windows\System\XRGFiCd.exe
  2⤵
  PID:7176
- C:\Windows\System\lEbDKsF.exe
  C:\Windows\System\lEbDKsF.exe
  2⤵
  PID:7200
- C:\Windows\System\cPQoZvm.exe
  C:\Windows\System\cPQoZvm.exe
  2⤵
  PID:7224
- C:\Windows\System\DNfQFfm.exe
  C:\Windows\System\DNfQFfm.exe
  2⤵
  PID:7244
- C:\Windows\System\oJFfVEc.exe
  C:\Windows\System\oJFfVEc.exe
  2⤵
  PID:7272
- C:\Windows\System\RXXTvEI.exe
  C:\Windows\System\RXXTvEI.exe
  2⤵
  PID:7288
- C:\Windows\System\FBgFNcN.exe
  C:\Windows\System\FBgFNcN.exe
  2⤵
  PID:7316
- C:\Windows\System\pwnnsdL.exe
  C:\Windows\System\pwnnsdL.exe
  2⤵
  PID:7332
- C:\Windows\System\WGnDiFS.exe
  C:\Windows\System\WGnDiFS.exe
  2⤵
  PID:7360
- C:\Windows\System\jwIlqMm.exe
  C:\Windows\System\jwIlqMm.exe
  2⤵
  PID:7384
- C:\Windows\System\LUGigNr.exe
  C:\Windows\System\LUGigNr.exe
  2⤵
  PID:7404
- C:\Windows\System\TnBWmqz.exe
  C:\Windows\System\TnBWmqz.exe
  2⤵
  PID:7436
- C:\Windows\System\CUgUgnE.exe
  C:\Windows\System\CUgUgnE.exe
  2⤵
  PID:7456
- C:\Windows\System\dKusaJd.exe
  C:\Windows\System\dKusaJd.exe
  2⤵
  PID:7476
- C:\Windows\System\oUXHqBC.exe
  C:\Windows\System\oUXHqBC.exe
  2⤵
  PID:7504
- C:\Windows\System\nwPCSHe.exe
  C:\Windows\System\nwPCSHe.exe
  2⤵
  PID:7528
- C:\Windows\System\ylJEyUh.exe
  C:\Windows\System\ylJEyUh.exe
  2⤵
  PID:7552
- C:\Windows\System\ONReAwI.exe
  C:\Windows\System\ONReAwI.exe
  2⤵
  PID:7704
- C:\Windows\System\ZHlrvIb.exe
  C:\Windows\System\ZHlrvIb.exe
  2⤵
  PID:7728
- C:\Windows\System\RadpxDr.exe
  C:\Windows\System\RadpxDr.exe
  2⤵
  PID:7752
- C:\Windows\System\aHpIvpb.exe
  C:\Windows\System\aHpIvpb.exe
  2⤵
  PID:7772
- C:\Windows\System\FGbjBYs.exe
  C:\Windows\System\FGbjBYs.exe
  2⤵
  PID:7800
- C:\Windows\System\bjPDTSS.exe
  C:\Windows\System\bjPDTSS.exe
  2⤵
  PID:7828
- C:\Windows\System\zJrOfbY.exe
  C:\Windows\System\zJrOfbY.exe
  2⤵
  PID:7888
- C:\Windows\System\iIfOpsM.exe
  C:\Windows\System\iIfOpsM.exe
  2⤵
  PID:7920
- C:\Windows\System\bLXlKpG.exe
  C:\Windows\System\bLXlKpG.exe
  2⤵
  PID:7940
- C:\Windows\System\jpBlrWk.exe
  C:\Windows\System\jpBlrWk.exe
  2⤵
  PID:7960
- C:\Windows\System\DchSYiT.exe
  C:\Windows\System\DchSYiT.exe
  2⤵
  PID:7980
- C:\Windows\System\jQCeiSX.exe
  C:\Windows\System\jQCeiSX.exe
  2⤵
  PID:8008
- C:\Windows\System\sHJmyQG.exe
  C:\Windows\System\sHJmyQG.exe
  2⤵
  PID:8028
- C:\Windows\System\mjtOqjF.exe
  C:\Windows\System\mjtOqjF.exe
  2⤵
  PID:8052
- C:\Windows\System\nJCYLAL.exe
  C:\Windows\System\nJCYLAL.exe
  2⤵
  PID:8076
- C:\Windows\System\lNWcYDk.exe
  C:\Windows\System\lNWcYDk.exe
  2⤵
  PID:8100
- C:\Windows\System\MKnyaDh.exe
  C:\Windows\System\MKnyaDh.exe
  2⤵
  PID:8124
- C:\Windows\System\UfdVvmp.exe
  C:\Windows\System\UfdVvmp.exe
  2⤵
  PID:8148
- C:\Windows\System\WJsYpYY.exe
  C:\Windows\System\WJsYpYY.exe
  2⤵
  PID:8176
- C:\Windows\System\yvMslmK.exe
  C:\Windows\System\yvMslmK.exe
  2⤵
  PID:5556
- C:\Windows\System\DEwUoRf.exe
  C:\Windows\System\DEwUoRf.exe
  2⤵
  PID:6948
- C:\Windows\System\Uditiwm.exe
  C:\Windows\System\Uditiwm.exe
  2⤵
  PID:6568
- C:\Windows\System\ZXLYzaZ.exe
  C:\Windows\System\ZXLYzaZ.exe
  2⤵
  PID:6984
- C:\Windows\System\lQLwOWr.exe
  C:\Windows\System\lQLwOWr.exe
  2⤵
  PID:6348
- C:\Windows\System\HvTvzRV.exe
  C:\Windows\System\HvTvzRV.exe
  2⤵
  PID:3992
- C:\Windows\System\yETvMnY.exe
  C:\Windows\System\yETvMnY.exe
  2⤵
  PID:6708
- C:\Windows\System\EuNZDGi.exe
  C:\Windows\System\EuNZDGi.exe
  2⤵
  PID:6720
- C:\Windows\System\fSZDyWV.exe
  C:\Windows\System\fSZDyWV.exe
  2⤵
  PID:6764
- C:\Windows\System\ZtTczgX.exe
  C:\Windows\System\ZtTczgX.exe
  2⤵
  PID:7148
- C:\Windows\System\hISKpSj.exe
  C:\Windows\System\hISKpSj.exe
  2⤵
  PID:6876
- C:\Windows\System\CXckaQn.exe
  C:\Windows\System\CXckaQn.exe
  2⤵
  PID:6928
- C:\Windows\System\uhWScnd.exe
  C:\Windows\System\uhWScnd.exe
  2⤵
  PID:7324
- C:\Windows\System\OEdXWno.exe
  C:\Windows\System\OEdXWno.exe
  2⤵
  PID:7428
- C:\Windows\System\ifFGzFm.exe
  C:\Windows\System\ifFGzFm.exe
  2⤵
  PID:6696
- C:\Windows\System\OjJWcLD.exe
  C:\Windows\System\OjJWcLD.exe
  2⤵
  PID:6812
- C:\Windows\System\Okzgocx.exe
  C:\Windows\System\Okzgocx.exe
  2⤵
  PID:7128
- C:\Windows\System\cxLNyWc.exe
  C:\Windows\System\cxLNyWc.exe
  2⤵
  PID:2624
- C:\Windows\System\BISkvkE.exe
  C:\Windows\System\BISkvkE.exe
  2⤵
  PID:2036
- C:\Windows\System\OLlRVZJ.exe
  C:\Windows\System\OLlRVZJ.exe
  2⤵
  PID:7260
- C:\Windows\System\UJJNISA.exe
  C:\Windows\System\UJJNISA.exe
  2⤵
  PID:7412
- C:\Windows\System\KHDZWVz.exe
  C:\Windows\System\KHDZWVz.exe
  2⤵
  PID:6808
- C:\Windows\System\eoqPfcq.exe
  C:\Windows\System\eoqPfcq.exe
  2⤵
  PID:7640
- C:\Windows\System\KqLctPP.exe
  C:\Windows\System\KqLctPP.exe
  2⤵
  PID:7284
- C:\Windows\System\VWSOYwf.exe
  C:\Windows\System\VWSOYwf.exe
  2⤵
  PID:7768
- C:\Windows\System\RuRReBF.exe
  C:\Windows\System\RuRReBF.exe
  2⤵
  PID:7812
- C:\Windows\System\VgaHvvv.exe
  C:\Windows\System\VgaHvvv.exe
  2⤵
  PID:7876
- C:\Windows\System\jNkdHrm.exe
  C:\Windows\System\jNkdHrm.exe
  2⤵
  PID:7956
- C:\Windows\System\csujtqp.exe
  C:\Windows\System\csujtqp.exe
  2⤵
  PID:8108
- C:\Windows\System\pKVkYpd.exe
  C:\Windows\System\pKVkYpd.exe
  2⤵
  PID:6456
- C:\Windows\System\ORygoWu.exe
  C:\Windows\System\ORygoWu.exe
  2⤵
  PID:6284
- C:\Windows\System\hMkjuMR.exe
  C:\Windows\System\hMkjuMR.exe
  2⤵
  PID:5412
- C:\Windows\System\TWALxOH.exe
  C:\Windows\System\TWALxOH.exe
  2⤵
  PID:7124
- C:\Windows\System\iNDPQPG.exe
  C:\Windows\System\iNDPQPG.exe
  2⤵
  PID:7700
- C:\Windows\System\SVGJKCX.exe
  C:\Windows\System\SVGJKCX.exe
  2⤵
  PID:8204
- C:\Windows\System\ghkqgza.exe
  C:\Windows\System\ghkqgza.exe
  2⤵
  PID:8224
- C:\Windows\System\MzNnhKJ.exe
  C:\Windows\System\MzNnhKJ.exe
  2⤵
  PID:8252
- C:\Windows\System\NGKUFnD.exe
  C:\Windows\System\NGKUFnD.exe
  2⤵
  PID:8280
- C:\Windows\System\GzIhlbF.exe
  C:\Windows\System\GzIhlbF.exe
  2⤵
  PID:8308
- C:\Windows\System\xYzwSSb.exe
  C:\Windows\System\xYzwSSb.exe
  2⤵
  PID:8332
- C:\Windows\System\hcOjEbf.exe
  C:\Windows\System\hcOjEbf.exe
  2⤵
  PID:8356
- C:\Windows\System\JPdYRHx.exe
  C:\Windows\System\JPdYRHx.exe
  2⤵
  PID:8376
- C:\Windows\System\XEXOtTS.exe
  C:\Windows\System\XEXOtTS.exe
  2⤵
  PID:8400
- C:\Windows\System\YAXsPKA.exe
  C:\Windows\System\YAXsPKA.exe
  2⤵
  PID:8420
- C:\Windows\System\geopISO.exe
  C:\Windows\System\geopISO.exe
  2⤵
  PID:8444
- C:\Windows\System\QcIFILu.exe
  C:\Windows\System\QcIFILu.exe
  2⤵
  PID:8468
- C:\Windows\System\lMrHSOB.exe
  C:\Windows\System\lMrHSOB.exe
  2⤵
  PID:8492
- C:\Windows\System\nJsEIza.exe
  C:\Windows\System\nJsEIza.exe
  2⤵
  PID:8512
- C:\Windows\System\rwUVLjT.exe
  C:\Windows\System\rwUVLjT.exe
  2⤵
  PID:8532
- C:\Windows\System\tTbwzLT.exe
  C:\Windows\System\tTbwzLT.exe
  2⤵
  PID:8568
- C:\Windows\System\xSBkABe.exe
  C:\Windows\System\xSBkABe.exe
  2⤵
  PID:8592
- C:\Windows\System\xTeaRKr.exe
  C:\Windows\System\xTeaRKr.exe
  2⤵
  PID:8616
- C:\Windows\System\YRTMDJM.exe
  C:\Windows\System\YRTMDJM.exe
  2⤵
  PID:8644
- C:\Windows\System\uhhFdFJ.exe
  C:\Windows\System\uhhFdFJ.exe
  2⤵
  PID:8672
- C:\Windows\System\MfpQtEB.exe
  C:\Windows\System\MfpQtEB.exe
  2⤵
  PID:8688
- C:\Windows\System\ENCtYqJ.exe
  C:\Windows\System\ENCtYqJ.exe
  2⤵
  PID:8708
- C:\Windows\System\TvjOsmT.exe
  C:\Windows\System\TvjOsmT.exe
  2⤵
  PID:8732
- C:\Windows\System\urEGlMZ.exe
  C:\Windows\System\urEGlMZ.exe
  2⤵
  PID:8756
- C:\Windows\System\cMdnWKJ.exe
  C:\Windows\System\cMdnWKJ.exe
  2⤵
  PID:8780
- C:\Windows\System\dfxVzpf.exe
  C:\Windows\System\dfxVzpf.exe
  2⤵
  PID:8796
- C:\Windows\System\ytbhIdZ.exe
  C:\Windows\System\ytbhIdZ.exe
  2⤵
  PID:8820
- C:\Windows\System\SMMxICR.exe
  C:\Windows\System\SMMxICR.exe
  2⤵
  PID:8844
- C:\Windows\System\FcBngpY.exe
  C:\Windows\System\FcBngpY.exe
  2⤵
  PID:8872
- C:\Windows\System\fhMFBCy.exe
  C:\Windows\System\fhMFBCy.exe
  2⤵
  PID:8892
- C:\Windows\System\emJZPAv.exe
  C:\Windows\System\emJZPAv.exe
  2⤵
  PID:8912
- C:\Windows\System\QqbvSOe.exe
  C:\Windows\System\QqbvSOe.exe
  2⤵
  PID:8936
- C:\Windows\System\FzNxpFR.exe
  C:\Windows\System\FzNxpFR.exe
  2⤵
  PID:8956
- C:\Windows\System\uLOUiIK.exe
  C:\Windows\System\uLOUiIK.exe
  2⤵
  PID:8984
- C:\Windows\System\wcjKUvd.exe
  C:\Windows\System\wcjKUvd.exe
  2⤵
  PID:9008
- C:\Windows\System\xDKuAfE.exe
  C:\Windows\System\xDKuAfE.exe
  2⤵
  PID:9028
- C:\Windows\System\gJaiuHD.exe
  C:\Windows\System\gJaiuHD.exe
  2⤵
  PID:9052
- C:\Windows\System\nJbQxNl.exe
  C:\Windows\System\nJbQxNl.exe
  2⤵
  PID:9076
- C:\Windows\System\sDHRRwU.exe
  C:\Windows\System\sDHRRwU.exe
  2⤵
  PID:9096
- C:\Windows\System\XGYuUyK.exe
  C:\Windows\System\XGYuUyK.exe
  2⤵
  PID:9124
- C:\Windows\System\fwIYkIE.exe
  C:\Windows\System\fwIYkIE.exe
  2⤵
  PID:9148
- C:\Windows\System\ugXirRW.exe
  C:\Windows\System\ugXirRW.exe
  2⤵
  PID:9172
- C:\Windows\System\zvFanfQ.exe
  C:\Windows\System\zvFanfQ.exe
  2⤵
  PID:9204
- C:\Windows\System\TEawxfn.exe
  C:\Windows\System\TEawxfn.exe
  2⤵
  PID:7448
- C:\Windows\System\kctNlXk.exe
  C:\Windows\System\kctNlXk.exe
  2⤵
  PID:7048
- C:\Windows\System\Canzzkf.exe
  C:\Windows\System\Canzzkf.exe
  2⤵
  PID:8020
- C:\Windows\System\EXcGZSv.exe
  C:\Windows\System\EXcGZSv.exe
  2⤵
  PID:8084
- C:\Windows\System\MvcmVPf.exe
  C:\Windows\System\MvcmVPf.exe
  2⤵
  PID:7788
- C:\Windows\System\cSAemjW.exe
  C:\Windows\System\cSAemjW.exe
  2⤵
  PID:7724
- C:\Windows\System\eUqvRoH.exe
  C:\Windows\System\eUqvRoH.exe
  2⤵
  PID:1772
- C:\Windows\System\XVPtUwL.exe
  C:\Windows\System\XVPtUwL.exe
  2⤵
  PID:7420
- C:\Windows\System\lHiWrwE.exe
  C:\Windows\System\lHiWrwE.exe
  2⤵
  PID:7912
- C:\Windows\System\CQCKaxd.exe
  C:\Windows\System\CQCKaxd.exe
  2⤵
  PID:8384
- C:\Windows\System\TRZRbXD.exe
  C:\Windows\System\TRZRbXD.exe
  2⤵
  PID:8048
- C:\Windows\System\rSKFRaz.exe
  C:\Windows\System\rSKFRaz.exe
  2⤵
  PID:8508
- C:\Windows\System\UqCnDaC.exe
  C:\Windows\System\UqCnDaC.exe
  2⤵
  PID:7240
- C:\Windows\System\xGmXXQL.exe
  C:\Windows\System\xGmXXQL.exe
  2⤵
  PID:8604
- C:\Windows\System\ILuOIbr.exe
  C:\Windows\System\ILuOIbr.exe
  2⤵
  PID:8660
- C:\Windows\System\lJfMmzr.exe
  C:\Windows\System\lJfMmzr.exe
  2⤵
  PID:6620
- C:\Windows\System\GAVluZs.exe
  C:\Windows\System\GAVluZs.exe
  2⤵
  PID:9232
- C:\Windows\System\kKwpDSc.exe
  C:\Windows\System\kKwpDSc.exe
  2⤵
  PID:9256
- C:\Windows\System\oETzZCE.exe
  C:\Windows\System\oETzZCE.exe
  2⤵
  PID:9280
- C:\Windows\System\sDutlfq.exe
  C:\Windows\System\sDutlfq.exe
  2⤵
  PID:9304
- C:\Windows\System\qhOWmzn.exe
  C:\Windows\System\qhOWmzn.exe
  2⤵
  PID:9324
- C:\Windows\System\hJnKrLF.exe
  C:\Windows\System\hJnKrLF.exe
  2⤵
  PID:9352
- C:\Windows\System\GYtshRP.exe
  C:\Windows\System\GYtshRP.exe
  2⤵
  PID:9376
- C:\Windows\System\pTjDeXe.exe
  C:\Windows\System\pTjDeXe.exe
  2⤵
  PID:9404
- C:\Windows\System\zEbcwtp.exe
  C:\Windows\System\zEbcwtp.exe
  2⤵
  PID:9424
- C:\Windows\System\fZnvYGQ.exe
  C:\Windows\System\fZnvYGQ.exe
  2⤵
  PID:9444
- C:\Windows\System\tdmYWMP.exe
  C:\Windows\System\tdmYWMP.exe
  2⤵
  PID:9468
- C:\Windows\System\xebMWqr.exe
  C:\Windows\System\xebMWqr.exe
  2⤵
  PID:9484
- C:\Windows\System\MjwoFBL.exe
  C:\Windows\System\MjwoFBL.exe
  2⤵
  PID:9500
- C:\Windows\System\INNPfrr.exe
  C:\Windows\System\INNPfrr.exe
  2⤵
  PID:9532
- C:\Windows\System\oKyyVVx.exe
  C:\Windows\System\oKyyVVx.exe
  2⤵
  PID:9552
- C:\Windows\System\aVQVkhy.exe
  C:\Windows\System\aVQVkhy.exe
  2⤵
  PID:9576
- C:\Windows\System\PQgdTNd.exe
  C:\Windows\System\PQgdTNd.exe
  2⤵
  PID:9604
- C:\Windows\System\FvZvBJa.exe
  C:\Windows\System\FvZvBJa.exe
  2⤵
  PID:9624
- C:\Windows\System\nEWoaqz.exe
  C:\Windows\System\nEWoaqz.exe
  2⤵
  PID:9644
- C:\Windows\System\ZhpYCZM.exe
  C:\Windows\System\ZhpYCZM.exe
  2⤵
  PID:9672
- C:\Windows\System\NOMAzDn.exe
  C:\Windows\System\NOMAzDn.exe
  2⤵
  PID:9692
- C:\Windows\System\ZWFjdKi.exe
  C:\Windows\System\ZWFjdKi.exe
  2⤵
  PID:9712
- C:\Windows\System\PrZCZNZ.exe
  C:\Windows\System\PrZCZNZ.exe
  2⤵
  PID:9972
- C:\Windows\System\ZZoqiAC.exe
  C:\Windows\System\ZZoqiAC.exe
  2⤵
  PID:9996
- C:\Windows\System\ZEdvrod.exe
  C:\Windows\System\ZEdvrod.exe
  2⤵
  PID:10016
- C:\Windows\System\FBpTBnh.exe
  C:\Windows\System\FBpTBnh.exe
  2⤵
  PID:10040
- C:\Windows\System\hqkHDto.exe
  C:\Windows\System\hqkHDto.exe
  2⤵
  PID:10068
- C:\Windows\System\PcifNRT.exe
  C:\Windows\System\PcifNRT.exe
  2⤵
  PID:10088
- C:\Windows\System\TuLuhZR.exe
  C:\Windows\System\TuLuhZR.exe
  2⤵
  PID:10108
- C:\Windows\System\HicGVsp.exe
  C:\Windows\System\HicGVsp.exe
  2⤵
  PID:10132
- C:\Windows\System\NTAignx.exe
  C:\Windows\System\NTAignx.exe
  2⤵
  PID:10152
- C:\Windows\System\ZszXlEs.exe
  C:\Windows\System\ZszXlEs.exe
  2⤵
  PID:10172
- C:\Windows\System\aHzROfs.exe
  C:\Windows\System\aHzROfs.exe
  2⤵
  PID:10196
- C:\Windows\System\olCFaxl.exe
  C:\Windows\System\olCFaxl.exe
  2⤵
  PID:10224
- C:\Windows\System\dezsMiu.exe
  C:\Windows\System\dezsMiu.exe
  2⤵
  PID:8764
- C:\Windows\System\DhTPLbI.exe
  C:\Windows\System\DhTPLbI.exe
  2⤵
  PID:6372
- C:\Windows\System\wYHGsAk.exe
  C:\Windows\System\wYHGsAk.exe
  2⤵
  PID:6484
- C:\Windows\System\IZrjXhV.exe
  C:\Windows\System\IZrjXhV.exe
  2⤵
  PID:8196
- C:\Windows\System\lKNkRjK.exe
  C:\Windows\System\lKNkRjK.exe
  2⤵
  PID:9004
- C:\Windows\System\nHLkXxV.exe
  C:\Windows\System\nHLkXxV.exe
  2⤵
  PID:9048
- C:\Windows\System\AzMAQFA.exe
  C:\Windows\System\AzMAQFA.exe
  2⤵
  PID:6428
- C:\Windows\System\Vgdbdxo.exe
  C:\Windows\System\Vgdbdxo.exe
  2⤵
  PID:5948
- C:\Windows\System\wpnZyPf.exe
  C:\Windows\System\wpnZyPf.exe
  2⤵
  PID:7676
- C:\Windows\System\TwGgjpj.exe
  C:\Windows\System\TwGgjpj.exe
  2⤵
  PID:6000
- C:\Windows\System\sttkSIH.exe
  C:\Windows\System\sttkSIH.exe
  2⤵
  PID:8000
- C:\Windows\System\etBMies.exe
  C:\Windows\System\etBMies.exe
  2⤵
  PID:8792
- C:\Windows\System\hAToSXw.exe
  C:\Windows\System\hAToSXw.exe
  2⤵
  PID:6580
- C:\Windows\System\QrQyHRd.exe
  C:\Windows\System\QrQyHRd.exe
  2⤵
  PID:6344
- C:\Windows\System\JoyoQSF.exe
  C:\Windows\System\JoyoQSF.exe
  2⤵
  PID:7696
- C:\Windows\System\NitzPqf.exe
  C:\Windows\System\NitzPqf.exe
  2⤵
  PID:8980
- C:\Windows\System\YicalQA.exe
  C:\Windows\System\YicalQA.exe
  2⤵
  PID:8260
- C:\Windows\System\yemOqnP.exe
  C:\Windows\System\yemOqnP.exe
  2⤵
  PID:9656
- C:\Windows\System\DwIOtCB.exe
  C:\Windows\System\DwIOtCB.exe
  2⤵
  PID:9168
- C:\Windows\System\cshmsnA.exe
  C:\Windows\System\cshmsnA.exe
  2⤵
  PID:8488
- C:\Windows\System\VXrlzcv.exe
  C:\Windows\System\VXrlzcv.exe
  2⤵
  PID:8540
- C:\Windows\System\NtFxBzM.exe
  C:\Windows\System\NtFxBzM.exe
  2⤵
  PID:8368
- C:\Windows\System\ZMzEfuu.exe
  C:\Windows\System\ZMzEfuu.exe
  2⤵
  PID:8704
- C:\Windows\System\qjOdHvV.exe
  C:\Windows\System\qjOdHvV.exe
  2⤵
  PID:8752
- C:\Windows\System\JVkHUdQ.exe
  C:\Windows\System\JVkHUdQ.exe
  2⤵
  PID:9804
- C:\Windows\System\DDYkuaM.exe
  C:\Windows\System\DDYkuaM.exe
  2⤵
  PID:8852
- C:\Windows\System\XkDwizu.exe
  C:\Windows\System\XkDwizu.exe
  2⤵
  PID:9856
- C:\Windows\System\jMHBRuO.exe
  C:\Windows\System\jMHBRuO.exe
  2⤵
  PID:9548
- C:\Windows\System\YRdqZLu.exe
  C:\Windows\System\YRdqZLu.exe
  2⤵
  PID:9068
- C:\Windows\System\ApzVIsX.exe
  C:\Windows\System\ApzVIsX.exe
  2⤵
  PID:10264
- C:\Windows\System\UIrxnIE.exe
  C:\Windows\System\UIrxnIE.exe
  2⤵
  PID:10288
- C:\Windows\System\lRGNQmc.exe
  C:\Windows\System\lRGNQmc.exe
  2⤵
  PID:10304
- C:\Windows\System\MtMMEIn.exe
  C:\Windows\System\MtMMEIn.exe
  2⤵
  PID:10324
- C:\Windows\System\dkawDOR.exe
  C:\Windows\System\dkawDOR.exe
  2⤵
  PID:10344
- C:\Windows\System\WryNhXm.exe
  C:\Windows\System\WryNhXm.exe
  2⤵
  PID:10360
- C:\Windows\System\EVFtvTz.exe
  C:\Windows\System\EVFtvTz.exe
  2⤵
  PID:10380
- C:\Windows\System\nOyCTcx.exe
  C:\Windows\System\nOyCTcx.exe
  2⤵
  PID:10400
- C:\Windows\System\hlebPoN.exe
  C:\Windows\System\hlebPoN.exe
  2⤵
  PID:10428
- C:\Windows\System\SPFqyiO.exe
  C:\Windows\System\SPFqyiO.exe
  2⤵
  PID:10452
- C:\Windows\System\omyIHqC.exe
  C:\Windows\System\omyIHqC.exe
  2⤵
  PID:10476
- C:\Windows\System\LDrqxFQ.exe
  C:\Windows\System\LDrqxFQ.exe
  2⤵
  PID:10504
- C:\Windows\System\HceKQwS.exe
  C:\Windows\System\HceKQwS.exe
  2⤵
  PID:10524
- C:\Windows\System\WCnsWHn.exe
  C:\Windows\System\WCnsWHn.exe
  2⤵
  PID:10552
- C:\Windows\System\ZaVGEpo.exe
  C:\Windows\System\ZaVGEpo.exe
  2⤵
  PID:10576
- C:\Windows\System\yjeMEZs.exe
  C:\Windows\System\yjeMEZs.exe
  2⤵
  PID:10612
- C:\Windows\System\GfXJhRw.exe
  C:\Windows\System\GfXJhRw.exe
  2⤵
  PID:10644
- C:\Windows\System\cETfwFE.exe
  C:\Windows\System\cETfwFE.exe
  2⤵
  PID:10680
- C:\Windows\System\MBPHfQA.exe
  C:\Windows\System\MBPHfQA.exe
  2⤵
  PID:10704
- C:\Windows\System\zYOmgPn.exe
  C:\Windows\System\zYOmgPn.exe
  2⤵
  PID:10724
- C:\Windows\System\nTptsUq.exe
  C:\Windows\System\nTptsUq.exe
  2⤵
  PID:10756
- C:\Windows\System\DtADjXR.exe
  C:\Windows\System\DtADjXR.exe
  2⤵
  PID:10776
- C:\Windows\System\RvDboOK.exe
  C:\Windows\System\RvDboOK.exe
  2⤵
  PID:10804
- C:\Windows\System\gttaJZg.exe
  C:\Windows\System\gttaJZg.exe
  2⤵
  PID:10828
- C:\Windows\System\lMoUqKR.exe
  C:\Windows\System\lMoUqKR.exe
  2⤵
  PID:10860
- C:\Windows\System\mTzuBRg.exe
  C:\Windows\System\mTzuBRg.exe
  2⤵
  PID:10880
- C:\Windows\System\QNpVyjq.exe
  C:\Windows\System\QNpVyjq.exe
  2⤵
  PID:10904
- C:\Windows\System\ftRSeXu.exe
  C:\Windows\System\ftRSeXu.exe
  2⤵
  PID:10928
- C:\Windows\System\FxEVpOI.exe
  C:\Windows\System\FxEVpOI.exe
  2⤵
  PID:10948
- C:\Windows\System\zDTOmzg.exe
  C:\Windows\System\zDTOmzg.exe
  2⤵
  PID:10972
- C:\Windows\System\WhgTHYo.exe
  C:\Windows\System\WhgTHYo.exe
  2⤵
  PID:10996
- C:\Windows\System\RWbaTZR.exe
  C:\Windows\System\RWbaTZR.exe
  2⤵
  PID:11016
- C:\Windows\System\NdcPzEt.exe
  C:\Windows\System\NdcPzEt.exe
  2⤵
  PID:11040
- C:\Windows\System\aysEKvg.exe
  C:\Windows\System\aysEKvg.exe
  2⤵
  PID:11064
- C:\Windows\System\HvOLNZM.exe
  C:\Windows\System\HvOLNZM.exe
  2⤵
  PID:11088
- C:\Windows\System\cfjoGll.exe
  C:\Windows\System\cfjoGll.exe
  2⤵
  PID:11108
- C:\Windows\System\mVMkTGF.exe
  C:\Windows\System\mVMkTGF.exe
  2⤵
  PID:11136
- C:\Windows\System\sIWpYTU.exe
  C:\Windows\System\sIWpYTU.exe
  2⤵
  PID:11160
- C:\Windows\System\oUOTFAF.exe
  C:\Windows\System\oUOTFAF.exe
  2⤵
  PID:11184
- C:\Windows\System\ELIEKmM.exe
  C:\Windows\System\ELIEKmM.exe
  2⤵
  PID:11212
- C:\Windows\System\YwjBrvz.exe
  C:\Windows\System\YwjBrvz.exe
  2⤵
  PID:11236
- C:\Windows\System\klnmotn.exe
  C:\Windows\System\klnmotn.exe
  2⤵
  PID:11260
- C:\Windows\System\tCEVyWf.exe
  C:\Windows\System\tCEVyWf.exe
  2⤵
  PID:9116
- C:\Windows\System\mJVnWLe.exe
  C:\Windows\System\mJVnWLe.exe
  2⤵
  PID:9736
- C:\Windows\System\nPUmsMr.exe
  C:\Windows\System\nPUmsMr.exe
  2⤵
  PID:10056
- C:\Windows\System\frXFGHS.exe
  C:\Windows\System\frXFGHS.exe
  2⤵
  PID:6748
- C:\Windows\System\evQpyhp.exe
  C:\Windows\System\evQpyhp.exe
  2⤵
  PID:7348
- C:\Windows\System\rbvtJBk.exe
  C:\Windows\System\rbvtJBk.exe
  2⤵
  PID:2584
- C:\Windows\System\gmcCdzz.exe
  C:\Windows\System\gmcCdzz.exe
  2⤵
  PID:5836
- C:\Windows\System\kcnUtQw.exe
  C:\Windows\System\kcnUtQw.exe
  2⤵
  PID:7632
- C:\Windows\System\hMiMzyt.exe
  C:\Windows\System\hMiMzyt.exe
  2⤵
  PID:9248
- C:\Windows\System\cCbvGGc.exe
  C:\Windows\System\cCbvGGc.exe
  2⤵
  PID:8964
- C:\Windows\System\hqqoSaW.exe
  C:\Windows\System\hqqoSaW.exe
  2⤵
  PID:9300
- C:\Windows\System\pohtmoJ.exe
  C:\Windows\System\pohtmoJ.exe
  2⤵
  PID:9344
- C:\Windows\System\RnUvRTO.exe
  C:\Windows\System\RnUvRTO.exe
  2⤵
  PID:9436
- C:\Windows\System\sBFuepq.exe
  C:\Windows\System\sBFuepq.exe
  2⤵
  PID:9476
- C:\Windows\System\zHoUAuH.exe
  C:\Windows\System\zHoUAuH.exe
  2⤵
  PID:8828
- C:\Windows\System\zZicCzI.exe
  C:\Windows\System\zZicCzI.exe
  2⤵
  PID:9960
- C:\Windows\System\NsWTMog.exe
  C:\Windows\System\NsWTMog.exe
  2⤵
  PID:10260
- C:\Windows\System\cGCDxGI.exe
  C:\Windows\System\cGCDxGI.exe
  2⤵
  PID:9700
- C:\Windows\System\rlpuOdg.exe
  C:\Windows\System\rlpuOdg.exe
  2⤵
  PID:10316
- C:\Windows\System\MJFKyRT.exe
  C:\Windows\System\MJFKyRT.exe
  2⤵
  PID:10368
- C:\Windows\System\RbPJvoe.exe
  C:\Windows\System\RbPJvoe.exe
  2⤵
  PID:10516
- C:\Windows\System\XVdyALP.exe
  C:\Windows\System\XVdyALP.exe
  2⤵
  PID:10544
- C:\Windows\System\TQcKDmm.exe
  C:\Windows\System\TQcKDmm.exe
  2⤵
  PID:10004
- C:\Windows\System\QbfOTBM.exe
  C:\Windows\System\QbfOTBM.exe
  2⤵
  PID:10080
- C:\Windows\System\VXBkKbe.exe
  C:\Windows\System\VXBkKbe.exe
  2⤵
  PID:10128
- C:\Windows\System\WmQIOMi.exe
  C:\Windows\System\WmQIOMi.exe
  2⤵
  PID:10652
- C:\Windows\System\MOHpJPc.exe
  C:\Windows\System\MOHpJPc.exe
  2⤵
  PID:8840
- C:\Windows\System\NphblMP.exe
  C:\Windows\System\NphblMP.exe
  2⤵
  PID:11280
- C:\Windows\System\ATCWddR.exe
  C:\Windows\System\ATCWddR.exe
  2⤵
  PID:11304
- C:\Windows\System\kLHLScS.exe
  C:\Windows\System\kLHLScS.exe
  2⤵
  PID:11324
- C:\Windows\System\Ylweujv.exe
  C:\Windows\System\Ylweujv.exe
  2⤵
  PID:11344
- C:\Windows\System\rHWRmZk.exe
  C:\Windows\System\rHWRmZk.exe
  2⤵
  PID:11368
- C:\Windows\System\odRdACT.exe
  C:\Windows\System\odRdACT.exe
  2⤵
  PID:11388
- C:\Windows\System\dCiNfhQ.exe
  C:\Windows\System\dCiNfhQ.exe
  2⤵
  PID:11416
- C:\Windows\System\xOaqpMS.exe
  C:\Windows\System\xOaqpMS.exe
  2⤵
  PID:11456
- C:\Windows\System\oXjDkup.exe
  C:\Windows\System\oXjDkup.exe
  2⤵
  PID:11480
- C:\Windows\System\owbutCk.exe
  C:\Windows\System\owbutCk.exe
  2⤵
  PID:11500
- C:\Windows\System\QfzpNyo.exe
  C:\Windows\System\QfzpNyo.exe
  2⤵
  PID:11528
- C:\Windows\System\NrvAPJs.exe
  C:\Windows\System\NrvAPJs.exe
  2⤵
  PID:11552
- C:\Windows\System\RNXLtIz.exe
  C:\Windows\System\RNXLtIz.exe
  2⤵
  PID:11572
- C:\Windows\System\yaJjVMx.exe
  C:\Windows\System\yaJjVMx.exe
  2⤵
  PID:11592
- C:\Windows\System\JYoSMqn.exe
  C:\Windows\System\JYoSMqn.exe
  2⤵
  PID:11616
- C:\Windows\System\YNafGnH.exe
  C:\Windows\System\YNafGnH.exe
  2⤵
  PID:11640
- C:\Windows\System\FyNnsMe.exe
  C:\Windows\System\FyNnsMe.exe
  2⤵
  PID:11664
- C:\Windows\System\fVTZvZK.exe
  C:\Windows\System\fVTZvZK.exe
  2⤵
  PID:11684
- C:\Windows\System\gPgVLqN.exe
  C:\Windows\System\gPgVLqN.exe
  2⤵
  PID:11704
- C:\Windows\System\MBAdrWP.exe
  C:\Windows\System\MBAdrWP.exe
  2⤵
  PID:11732
- C:\Windows\System\IrHvVZs.exe
  C:\Windows\System\IrHvVZs.exe
  2⤵
  PID:11752
- C:\Windows\System\nYVPIfe.exe
  C:\Windows\System\nYVPIfe.exe
  2⤵
  PID:11776
- C:\Windows\System\zEkmort.exe
  C:\Windows\System\zEkmort.exe
  2⤵
  PID:11796
- C:\Windows\System\YXvWNSo.exe
  C:\Windows\System\YXvWNSo.exe
  2⤵
  PID:11816
- C:\Windows\System\CzGxVJw.exe
  C:\Windows\System\CzGxVJw.exe
  2⤵
  PID:11840
- C:\Windows\System\EcnKkbM.exe
  C:\Windows\System\EcnKkbM.exe
  2⤵
  PID:11860
- C:\Windows\System\HrmCqtY.exe
  C:\Windows\System\HrmCqtY.exe
  2⤵
  PID:11880
- C:\Windows\System\LdIcasZ.exe
  C:\Windows\System\LdIcasZ.exe
  2⤵
  PID:11904
- C:\Windows\System\EbXICew.exe
  C:\Windows\System\EbXICew.exe
  2⤵
  PID:11924
- C:\Windows\System\FtOYmqd.exe
  C:\Windows\System\FtOYmqd.exe
  2⤵
  PID:11940
- C:\Windows\System\LMuSLqU.exe
  C:\Windows\System\LMuSLqU.exe
  2⤵
  PID:11956
- C:\Windows\System\ZtrtnHf.exe
  C:\Windows\System\ZtrtnHf.exe
  2⤵
  PID:11980
- C:\Windows\System\WeOHxeP.exe
  C:\Windows\System\WeOHxeP.exe
  2⤵
  PID:11996
- C:\Windows\System\JIwIBOS.exe
  C:\Windows\System\JIwIBOS.exe
  2⤵
  PID:12032
- C:\Windows\System\uPYnYCE.exe
  C:\Windows\System\uPYnYCE.exe
  2⤵
  PID:12052
- C:\Windows\System\NwMKYhc.exe
  C:\Windows\System\NwMKYhc.exe
  2⤵
  PID:12076
- C:\Windows\System\FTdveXL.exe
  C:\Windows\System\FTdveXL.exe
  2⤵
  PID:12096
- C:\Windows\System\YuPujxl.exe
  C:\Windows\System\YuPujxl.exe
  2⤵
  PID:12116
- C:\Windows\System\suSXaWU.exe
  C:\Windows\System\suSXaWU.exe
  2⤵
  PID:12132
- C:\Windows\System\pKcElpW.exe
  C:\Windows\System\pKcElpW.exe
  2⤵
  PID:12152
- C:\Windows\System\OYsuTKL.exe
  C:\Windows\System\OYsuTKL.exe
  2⤵
  PID:12172
- C:\Windows\System\MWuQiwe.exe
  C:\Windows\System\MWuQiwe.exe
  2⤵
  PID:12200
- C:\Windows\System\dMAumxW.exe
  C:\Windows\System\dMAumxW.exe
  2⤵
  PID:12220
- C:\Windows\System\rwshwBA.exe
  C:\Windows\System\rwshwBA.exe
  2⤵
  PID:12244
- C:\Windows\System\UOzLdET.exe
  C:\Windows\System\UOzLdET.exe
  2⤵
  PID:12264
- C:\Windows\System\xImeYKd.exe
  C:\Windows\System\xImeYKd.exe
  2⤵
  PID:7096
- C:\Windows\System\MLgiSPw.exe
  C:\Windows\System\MLgiSPw.exe
  2⤵
  PID:8624
- C:\Windows\System\qXcXtXV.exe
  C:\Windows\System\qXcXtXV.exe
  2⤵
  PID:9420
- C:\Windows\System\SCCYALO.exe
  C:\Windows\System\SCCYALO.exe
  2⤵
  PID:11116
- C:\Windows\System\nvmaFtY.exe
  C:\Windows\System\nvmaFtY.exe
  2⤵
  PID:8484
- C:\Windows\System\RWqjDuu.exe
  C:\Windows\System\RWqjDuu.exe
  2⤵
  PID:11196
- C:\Windows\System\gkCTPSA.exe
  C:\Windows\System\gkCTPSA.exe
  2⤵
  PID:11204
- C:\Windows\System\JXbmsat.exe
  C:\Windows\System\JXbmsat.exe
  2⤵
  PID:8188
- C:\Windows\System\bwyZrfF.exe
  C:\Windows\System\bwyZrfF.exe
  2⤵
  PID:11244
- C:\Windows\System\snSAEKx.exe
  C:\Windows\System\snSAEKx.exe
  2⤵
  PID:9224
- C:\Windows\System\srrVZSt.exe
  C:\Windows\System\srrVZSt.exe
  2⤵
  PID:9944
- C:\Windows\System\FMGWjYP.exe
  C:\Windows\System\FMGWjYP.exe
  2⤵
  PID:10012
- C:\Windows\System\tzYqIoy.exe
  C:\Windows\System\tzYqIoy.exe
  2⤵
  PID:8164
- C:\Windows\System\RYsOMND.exe
  C:\Windows\System\RYsOMND.exe
  2⤵
  PID:10396
- C:\Windows\System\ItZKGFu.exe
  C:\Windows\System\ItZKGFu.exe
  2⤵
  PID:10444
- C:\Windows\System\cUtdfxw.exe
  C:\Windows\System\cUtdfxw.exe
  2⤵
  PID:8452
- C:\Windows\System\NgLvRka.exe
  C:\Windows\System\NgLvRka.exe
  2⤵
  PID:9984
- C:\Windows\System\IYFMPLS.exe
  C:\Windows\System\IYFMPLS.exe
  2⤵
  PID:8992
- C:\Windows\System\UNTcRgk.exe
  C:\Windows\System\UNTcRgk.exe
  2⤵
  PID:8068
- C:\Windows\System\XYJRHFj.exe
  C:\Windows\System\XYJRHFj.exe
  2⤵
  PID:10632
- C:\Windows\System\OAtYHeD.exe
  C:\Windows\System\OAtYHeD.exe
  2⤵
  PID:10668
- C:\Windows\System\XGBUrwJ.exe
  C:\Windows\System\XGBUrwJ.exe
  2⤵
  PID:10716
- C:\Windows\System\vdvJqCy.exe
  C:\Windows\System\vdvJqCy.exe
  2⤵
  PID:10356
- C:\Windows\System\VHBrqDy.exe
  C:\Windows\System\VHBrqDy.exe
  2⤵
  PID:6660
- C:\Windows\System\rvouKTB.exe
  C:\Windows\System\rvouKTB.exe
  2⤵
  PID:10816
- C:\Windows\System\YJkmQfp.exe
  C:\Windows\System\YJkmQfp.exe
  2⤵
  PID:11384
- C:\Windows\System\hNJEEvZ.exe
  C:\Windows\System\hNJEEvZ.exe
  2⤵
  PID:10872
- C:\Windows\System\oTmWTKd.exe
  C:\Windows\System\oTmWTKd.exe
  2⤵
  PID:10916
- C:\Windows\System\sLAHAup.exe
  C:\Windows\System\sLAHAup.exe
  2⤵
  PID:10956
- C:\Windows\System\VxXBmUP.exe
  C:\Windows\System\VxXBmUP.exe
  2⤵
  PID:11444
- C:\Windows\System\MSrziye.exe
  C:\Windows\System\MSrziye.exe
  2⤵
  PID:9372
- C:\Windows\System\cjKgZFu.exe
  C:\Windows\System\cjKgZFu.exe
  2⤵
  PID:11564
- C:\Windows\System\fxQWEtU.exe
  C:\Windows\System\fxQWEtU.exe
  2⤵
  PID:12316
- C:\Windows\System\gSsfQJY.exe
  C:\Windows\System\gSsfQJY.exe
  2⤵
  PID:12336
- C:\Windows\System\RMJLmoA.exe
  C:\Windows\System\RMJLmoA.exe
  2⤵
  PID:12360
- C:\Windows\System\JRmiLqh.exe
  C:\Windows\System\JRmiLqh.exe
  2⤵
  PID:12380
- C:\Windows\System\SzFtcbG.exe
  C:\Windows\System\SzFtcbG.exe
  2⤵
  PID:12404
- C:\Windows\System\bDskKbN.exe
  C:\Windows\System\bDskKbN.exe
  2⤵
  PID:12428
- C:\Windows\System\aJNmdOL.exe
  C:\Windows\System\aJNmdOL.exe
  2⤵
  PID:12448
- C:\Windows\System\bvJadjY.exe
  C:\Windows\System\bvJadjY.exe
  2⤵
  PID:12476
- C:\Windows\System\IhVBrco.exe
  C:\Windows\System\IhVBrco.exe
  2⤵
  PID:12500
- C:\Windows\System\UDVNdac.exe
  C:\Windows\System\UDVNdac.exe
  2⤵
  PID:12520
- C:\Windows\System\EhlQzdd.exe
  C:\Windows\System\EhlQzdd.exe
  2⤵
  PID:12548
- C:\Windows\System\FSWvoon.exe
  C:\Windows\System\FSWvoon.exe
  2⤵
  PID:12572
- C:\Windows\System\ikYiZYI.exe
  C:\Windows\System\ikYiZYI.exe
  2⤵
  PID:12596
- C:\Windows\System\FTlWHAY.exe
  C:\Windows\System\FTlWHAY.exe
  2⤵
  PID:12616
- C:\Windows\System\EwJEndS.exe
  C:\Windows\System\EwJEndS.exe
  2⤵
  PID:12640
- C:\Windows\System\fXBdtbA.exe
  C:\Windows\System\fXBdtbA.exe
  2⤵
  PID:12660
- C:\Windows\System\JRfdzkU.exe
  C:\Windows\System\JRfdzkU.exe
  2⤵
  PID:12684
- C:\Windows\System\RjqKICw.exe
  C:\Windows\System\RjqKICw.exe
  2⤵
  PID:12712
- C:\Windows\System\FSIFxDM.exe
  C:\Windows\System\FSIFxDM.exe
  2⤵
  PID:12732
- C:\Windows\System\HLCNzFL.exe
  C:\Windows\System\HLCNzFL.exe
  2⤵
  PID:12752
- C:\Windows\System\HAcPcyy.exe
  C:\Windows\System\HAcPcyy.exe
  2⤵
  PID:12772
- C:\Windows\System\rGnGDOy.exe
  C:\Windows\System\rGnGDOy.exe
  2⤵
  PID:12796
- C:\Windows\System\ZHAbTle.exe
  C:\Windows\System\ZHAbTle.exe
  2⤵
  PID:12816
- C:\Windows\System\flppXcb.exe
  C:\Windows\System\flppXcb.exe
  2⤵
  PID:12836
- C:\Windows\System\vdGfNkw.exe
  C:\Windows\System\vdGfNkw.exe
  2⤵
  PID:12860
- C:\Windows\System\UEZRhoD.exe
  C:\Windows\System\UEZRhoD.exe
  2⤵
  PID:12884
- C:\Windows\System\jpWhAGG.exe
  C:\Windows\System\jpWhAGG.exe
  2⤵
  PID:12908
- C:\Windows\System\gDyGBuq.exe
  C:\Windows\System\gDyGBuq.exe
  2⤵
  PID:12932
- C:\Windows\System\KFpsKxr.exe
  C:\Windows\System\KFpsKxr.exe
  2⤵
  PID:12956
- C:\Windows\System\NwIjwca.exe
  C:\Windows\System\NwIjwca.exe
  2⤵
  PID:12980
- C:\Windows\System\pcogjMM.exe
  C:\Windows\System\pcogjMM.exe
  2⤵
  PID:13000
- C:\Windows\System\xwBPhnT.exe
  C:\Windows\System\xwBPhnT.exe
  2⤵
  PID:13028
- C:\Windows\System\VNWMWqI.exe
  C:\Windows\System\VNWMWqI.exe
  2⤵
  PID:12948
- C:\Windows\System\PqmxBIw.exe
  C:\Windows\System\PqmxBIw.exe
  2⤵
  PID:12212
- C:\Windows\System\CAiPmRc.exe
  C:\Windows\System\CAiPmRc.exe
  2⤵
  PID:13124
- C:\Windows\System\ivcrlsg.exe
  C:\Windows\System\ivcrlsg.exe
  2⤵
  PID:6668
- C:\Windows\System\cLtiUOW.exe
  C:\Windows\System\cLtiUOW.exe
  2⤵
  PID:13184
- C:\Windows\System\typxyFT.exe
  C:\Windows\System\typxyFT.exe
  2⤵
  PID:7076
- C:\Windows\System\HRVBiyD.exe
  C:\Windows\System\HRVBiyD.exe
  2⤵
  PID:13296
- C:\Windows\System\cnYbRZO.exe
  C:\Windows\System\cnYbRZO.exe
  2⤵
  PID:6768
- C:\Windows\System\DIijowf.exe
  C:\Windows\System\DIijowf.exe
  2⤵
  PID:11700
- C:\Windows\System\TxSskIa.exe
  C:\Windows\System\TxSskIa.exe
  2⤵
  PID:12512
- C:\Windows\System\tBifjPj.exe
  C:\Windows\System\tBifjPj.exe
  2⤵
  PID:11808
- C:\Windows\System\oxVKIfm.exe
  C:\Windows\System\oxVKIfm.exe
  2⤵
  PID:9092
- C:\Windows\System\gFBceTn.exe
  C:\Windows\System\gFBceTn.exe
  2⤵
  PID:12928
- C:\Windows\System\DQQAOmW.exe
  C:\Windows\System\DQQAOmW.exe
  2⤵
  PID:12992
- C:\Windows\System\psRIGii.exe
  C:\Windows\System\psRIGii.exe
  2⤵
  PID:13052
- C:\Windows\System\uZzUgXF.exe
  C:\Windows\System\uZzUgXF.exe
  2⤵
  PID:12012
- C:\Windows\System\zisQFLj.exe
  C:\Windows\System\zisQFLj.exe
  2⤵
  PID:972
- C:\Windows\System\MTibfpq.exe
  C:\Windows\System\MTibfpq.exe
  2⤵
  PID:11412
- C:\Windows\System\UqlcBzU.exe
  C:\Windows\System\UqlcBzU.exe
  2⤵
  PID:8728
- C:\Windows\System\yGavcJM.exe
  C:\Windows\System\yGavcJM.exe
  2⤵
  PID:11008
- C:\Windows\System\TyPaaaQ.exe
  C:\Windows\System\TyPaaaQ.exe
  2⤵
  PID:12636
- C:\Windows\System\WEgRNAu.exe
  C:\Windows\System\WEgRNAu.exe
  2⤵
  PID:13236
- C:\Windows\System\YkvFGeV.exe
  C:\Windows\System\YkvFGeV.exe
  2⤵
  PID:12064
- C:\Windows\System\atxCDRB.exe
  C:\Windows\System\atxCDRB.exe
  2⤵
  PID:12580
- C:\Windows\System\qvxhhqG.exe
  C:\Windows\System\qvxhhqG.exe
  2⤵
  PID:9724
- C:\Windows\System\yFarhbi.exe
  C:\Windows\System\yFarhbi.exe
  2⤵
  PID:12804
- C:\Windows\System\HAjQqxq.exe
  C:\Windows\System\HAjQqxq.exe
  2⤵
  PID:11920
- C:\Windows\System\bpdbOKc.exe
  C:\Windows\System\bpdbOKc.exe
  2⤵
  PID:10796
- C:\Windows\System\SzJkrIk.exe
  C:\Windows\System\SzJkrIk.exe
  2⤵
  PID:12300
- C:\Windows\System\yNSZJgC.exe
  C:\Windows\System\yNSZJgC.exe
  2⤵
  PID:9988
- C:\Windows\System\aLzcMZt.exe
  C:\Windows\System\aLzcMZt.exe
  2⤵
  PID:12048
- C:\Windows\System\QKFfRkd.exe
  C:\Windows\System\QKFfRkd.exe
  2⤵
  PID:12228
- C:\Windows\System\RBnfAfh.exe
  C:\Windows\System\RBnfAfh.exe
  2⤵
  PID:13288
- C:\Windows\System\GzZayhC.exe
  C:\Windows\System\GzZayhC.exe
  2⤵
  PID:12388
- C:\Windows\System\DnTWrPX.exe
  C:\Windows\System\DnTWrPX.exe
  2⤵
  PID:12652
- C:\Windows\System\hmTAckV.exe
  C:\Windows\System\hmTAckV.exe
  2⤵
  PID:13044
- C:\Windows\System\irdHjDf.exe
  C:\Windows\System\irdHjDf.exe
  2⤵
  PID:10484
- C:\Windows\System\AEpWcwD.exe
  C:\Windows\System\AEpWcwD.exe
  2⤵
  PID:1308
- C:\Windows\System\lVPqHgT.exe
  C:\Windows\System\lVPqHgT.exe
  2⤵
  PID:9272
- C:\Windows\System\wmUacBv.exe
  C:\Windows\System\wmUacBv.exe
  2⤵
  PID:8668
- C:\Windows\System\ZRUcEAq.exe
  C:\Windows\System\ZRUcEAq.exe
  2⤵
  PID:10116
- C:\Windows\System\kkyIeSx.exe
  C:\Windows\System\kkyIeSx.exe
  2⤵
  PID:13168
- C:\Windows\System\YufMPgo.exe
  C:\Windows\System\YufMPgo.exe
  2⤵
  PID:12876
- C:\Windows\System\okcfruI.exe
  C:\Windows\System\okcfruI.exe
  2⤵
  PID:12468
- C:\Windows\System\WxSNOvX.exe
  C:\Windows\System\WxSNOvX.exe
  2⤵
  PID:10300
- C:\Windows\System\dVGvcQS.exe
  C:\Windows\System\dVGvcQS.exe
  2⤵
  PID:10772
- C:\Windows\System\LlBraks.exe
  C:\Windows\System\LlBraks.exe
  2⤵
  PID:11748
- C:\Windows\System\GPOTdWZ.exe
  C:\Windows\System\GPOTdWZ.exe
  2⤵
  PID:13300
- C:\Windows\System\NXRKGuw.exe
  C:\Windows\System\NXRKGuw.exe
  2⤵
  PID:11144
- C:\Windows\System\jHHPNBx.exe
  C:\Windows\System\jHHPNBx.exe
  2⤵
  PID:5944
- C:\Windows\System\QwhtbMT.exe
  C:\Windows\System\QwhtbMT.exe
  2⤵
  PID:13668
- C:\Windows\System\ByXNDNR.exe
  C:\Windows\System\ByXNDNR.exe
  2⤵
  PID:13976
- C:\Windows\System\vnmngRA.exe
  C:\Windows\System\vnmngRA.exe
  2⤵
  PID:14016
- C:\Windows\System\wacsswf.exe
  C:\Windows\System\wacsswf.exe
  2⤵
  PID:14080
- C:\Windows\System\jqrWEqo.exe
  C:\Windows\System\jqrWEqo.exe
  2⤵
  PID:14108
- C:\Windows\System\hyEtYTG.exe
  C:\Windows\System\hyEtYTG.exe
  2⤵
  PID:14124
- C:\Windows\System\YJaxzGI.exe
  C:\Windows\System\YJaxzGI.exe
  2⤵
  PID:9832
- C:\Windows\System\FtttkmQ.exe
  C:\Windows\System\FtttkmQ.exe
  2⤵
  PID:10492
- C:\Windows\System\XcjzUZD.exe
  C:\Windows\System\XcjzUZD.exe
  2⤵
  PID:11540
- C:\Windows\System\qUyHJvD.exe
  C:\Windows\System\qUyHJvD.exe
  2⤵
  PID:13176
- C:\Windows\System\imAzzia.exe
  C:\Windows\System\imAzzia.exe
  2⤵
  PID:12400
- C:\Windows\System\wmiHBRt.exe
  C:\Windows\System\wmiHBRt.exe
  2⤵
  PID:10540
- C:\Windows\System\IzIbngM.exe
  C:\Windows\System\IzIbngM.exe
  2⤵
  PID:12124
- C:\Windows\System\fXDMKAH.exe
  C:\Windows\System\fXDMKAH.exe
  2⤵
  PID:12720
- C:\Windows\System\QQtfBiH.exe
  C:\Windows\System\QQtfBiH.exe
  2⤵
  PID:13384
- C:\Windows\System\SJsaKop.exe
  C:\Windows\System\SJsaKop.exe
  2⤵
  PID:13432
- C:\Windows\System\AbtjkfT.exe
  C:\Windows\System\AbtjkfT.exe
  2⤵
  PID:13440
- C:\Windows\System\wcacnbd.exe
  C:\Windows\System\wcacnbd.exe
  2⤵
  PID:13372
- C:\Windows\System\lXQIaxl.exe
  C:\Windows\System\lXQIaxl.exe
  2⤵
  PID:13468
- C:\Windows\System\yeReKsH.exe
  C:\Windows\System\yeReKsH.exe
  2⤵
  PID:13400
- C:\Windows\System\hsAOkcJ.exe
  C:\Windows\System\hsAOkcJ.exe
  2⤵
  PID:13516
- C:\Windows\System\dJhKpMG.exe
  C:\Windows\System\dJhKpMG.exe
  2⤵
  PID:13504
- C:\Windows\System\XpMlGRH.exe
  C:\Windows\System\XpMlGRH.exe
  2⤵
  PID:13584
- C:\Windows\System\KldwpLT.exe
  C:\Windows\System\KldwpLT.exe
  2⤵
  PID:12564
- C:\Windows\System\ZvsSySh.exe
  C:\Windows\System\ZvsSySh.exe
  2⤵
  PID:13676
- C:\Windows\System\hzGlrdS.exe
  C:\Windows\System\hzGlrdS.exe
  2⤵
  PID:13716
- C:\Windows\System\xOrwkvC.exe
  C:\Windows\System\xOrwkvC.exe
  2⤵
  PID:13744
- C:\Windows\System\ycnZvIu.exe
  C:\Windows\System\ycnZvIu.exe
  2⤵
  PID:13560
- C:\Windows\System\AhZizvr.exe
  C:\Windows\System\AhZizvr.exe
  2⤵
  PID:13596
- C:\Windows\System\KAJrUaY.exe
  C:\Windows\System\KAJrUaY.exe
  2⤵
  PID:13800
- C:\Windows\System\hLjKFYr.exe
  C:\Windows\System\hLjKFYr.exe
  2⤵
  PID:13756
- C:\Windows\System\cSfwnEn.exe
  C:\Windows\System\cSfwnEn.exe
  2⤵
  PID:13576
- C:\Windows\System\QjzTPEA.exe
  C:\Windows\System\QjzTPEA.exe
  2⤵
  PID:14160
- C:\Windows\System\GdezwfL.exe
  C:\Windows\System\GdezwfL.exe
  2⤵
  PID:14300
- C:\Windows\System\njDomFV.exe
  C:\Windows\System\njDomFV.exe
  2⤵
  PID:14260
- C:\Windows\System\HxGGmXv.exe
  C:\Windows\System\HxGGmXv.exe
  2⤵
  PID:12780
- C:\Windows\System\qxRfNya.exe
  C:\Windows\System\qxRfNya.exe
  2⤵
  PID:1684
- C:\Windows\System\deNicvL.exe
  C:\Windows\System\deNicvL.exe
  2⤵
  PID:11764
- C:\Windows\System\nQXPEdF.exe
  C:\Windows\System\nQXPEdF.exe
  2⤵
  PID:13740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4jtllu5v.yiz.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BiXhzSa.exe

Filesize
2.2MB

MD5
08ef3c17e0a914597425d9e9e94d7deb

SHA1
3c924397d843d368e49d9df6b135353fe2392a4e

SHA256
9a861910a7699ea0ebee4ed21d7479d2235b563766608eb49a91d9fc058420f6

SHA512
86cdf1f4c5e74ad18a8a1b9522f20657b72d5d8b6fa2e3e3a20b85359319b34c16b5aa307a876202cde3693d9e7a6d30ec6bf8ce8101cd38e6e830fcb89e8a78

Download Submit
C:\Windows\System\CfrzOHf.exe

Filesize
2.2MB

MD5
14a3359e28a4019792e3b30a3134ed71

SHA1
6b7edbfe281907262c5c268b43417e611cba7d7c

SHA256
adc8cc4640f8477006aab819d93d8e6e9a79cd841ccfd4c8165f575b4e87d6c5

SHA512
e07aa35a99564a7b3864883d608d4c3aa328d82fdc68bd77963d64b93b44782f892ffa09182c2ccf7209ea10abf9eaf02be1a34382778d8d31cd8e2629c207c7

Download Submit
C:\Windows\System\DhlrcIR.exe

Filesize
2.2MB

MD5
ebb555c6856499cee2395c2aa7658aab

SHA1
a81a75aec213d7353e5ecbf870622bf42b70d236

SHA256
b3b92e7dec3fff463c3f5e2791d9586cb9336b3e357f817bce7518a1209336ba

SHA512
986b418f2e13d10f8448634ff445d0f06bb18e94e86e3bcce2cdbbb52dc4e30de3e3c35675c0032ef8b7755086006a9d54c932ffa95f8f0e8d96b864f474d446

Download Submit
C:\Windows\System\DpflHIZ.exe

Filesize
2.2MB

MD5
2dffb2cefa9110701ad70495aa622495

SHA1
7495a43f89f31b946c7278b3cefe52b1072fe983

SHA256
13cc807a83e522861586f335fc21f970b46ed4269bd77ad36a5439ba6d0835b6

SHA512
9e0880eddcf4b6f78d03eeb2dc328b6b48d335a322aff245847843939de271a1b230ed2c1257f5c1c5c9ecbff75f2be6d6d3a43b7f7f372a2d8804813422b1df

Download Submit
C:\Windows\System\JlMQKuU.exe

Filesize
2.2MB

MD5
d92eb665b62f9d2b730c5aa2e390cfad

SHA1
0af778aa744301c78e09ac8a5b7e81cd8cb0c8b0

SHA256
83434755b309a6738a89df75c9c9eefab2a64e0b7f373f3d9e7b4d03d74afd50

SHA512
1c57d9b81ccd39572b2551e0da7440f4335bc5bbf3c696d264b4a9a11d9ad438bd9be0aa4be0997cf5a87c90b699a2ca08638614198deaa70d4f393bed732a02

Download Submit
C:\Windows\System\KBpAWPo.exe

Filesize
2.2MB

MD5
7aea56963f6ab2dc4d88c5cf4e155739

SHA1
4a13d569e70315a3129d68a3bf3c6908fbfc196e

SHA256
e514f5c8eaa1ccab689c8de19b4e977e01e77cdab027610ac131f7c9e9fcbe7f

SHA512
b09f7a3adce0f962f2630d3b812946faff922279fe26a20465e6a1e192d92303ac7882f1f74ba1f4dcb2880ca913bf9faf73bbc4c96de921a8b3e82f83955734

Download Submit
C:\Windows\System\KJSiGZm.exe

Filesize
2.2MB

MD5
74a72f7f5ff2457a7b68bdef50d5c265

SHA1
e89abe524ff996d7e95a12a45a7eeccc5f15a0f9

SHA256
cb2281afb148790af0cbd44901d665e78c469b33e262512da41cf8bd51488fab

SHA512
7a1094237cc8cdd952e0d1d6b628174ee035b8673ffd76a460e1b84d4d46033c92fff9bce5fa01779e520016913b0987eb56434bca7f12b08ff451ea249859d9

Download Submit
C:\Windows\System\MCGkFDa.exe

Filesize
2.2MB

MD5
cfc09d25aec9575b03902d5c8f98a83f

SHA1
0d334e0c564f0b7e5a36bb97bb64140ce9ae9638

SHA256
c472adc8629e6635a00a550541d0e0f7b9bd9c23ac8ba45dc72f5b428204222e

SHA512
b879dbe263be5f7c6bd6cffe7258b5d59c239d3d444e4768f8e9956d0db28b0bd95c4dc27fe5a0c568ceeceb848862d6778b6c83c46c25707d717dda7b90edcf

Download Submit
C:\Windows\System\PAYvRkQ.exe

Filesize
2.2MB

MD5
0972f768e606f098f3aacc8c29b8e47c

SHA1
802c3931d8779678b4f1685462dd740a9ea026a1

SHA256
a9a3ddabda981817db80d7da7afddb4667471753be79a5a5b54137b3ff89e5fa

SHA512
062d0d533bffe83b1ea7aa6dfe7dc2f0d7d8230611723c597b19aaf6a7cbeb0fb469f877e2e7b97f6bc57ddbfc5d9f6f79d2087af07a8f6a405c19e0b82793df

Download Submit
C:\Windows\System\PfyTlPf.exe

Filesize
2.2MB

MD5
63560cf645db95ecfcd3a522c89c51f9

SHA1
b1e9e3d5a67129ee34ee09ef4869ceebb3a6f2e8

SHA256
c1cfe047911937d02a022eff9c27329431ae0b78ed46dd83a6235c534d5e9fa9

SHA512
4b7da8425733ff146ccf0c93ff5a81d5c8d439242e9227a64e13669e67e388b737f3cea5b81c1c6daec7da0acc4bbf46c33c743b8be236d1c5c6f6c70904a7ed

Download Submit
C:\Windows\System\PrZZwEn.exe

Filesize
2.2MB

MD5
17803a57a991d58d33988ccbf8e4f3ca

SHA1
1922f7b32f75f2280086336011ea58b16bcb0f4c

SHA256
221e5f2a7ed166b2b59c2341cddd95a488f60aec449fc14efecac86e30dc99d8

SHA512
00e3a3cfee8ee0b9ff29e9141394775fae116d1c0ebc36fc9ee40e74dbfefbf68c2c9a502f1606d15c940ce46feba0f4da4d81b562f8ca709cfbe62562d4ac4b

Download Submit
C:\Windows\System\RqrckUR.exe

Filesize
2.2MB

MD5
570faceec12801055bcca2b0a2f9df9a

SHA1
399cd136ff5539177639e7a5edbe4ed2ed2852b6

SHA256
3df912276461b3e536e5b2926550f67bfccabc07e5d16d76e1731b120bd75c20

SHA512
c7b1361f7723adbe649bbfe298ea7b26ef357b709040d1d00092b00e352044c63e3cb85f018dee68c0d6293e0ac8f5b8b6de40a82ac838115d48003ee7f39472

Download Submit
C:\Windows\System\XBNlhQX.exe

Filesize
2.2MB

MD5
3128edd1b1b6c319df2bee54c56b2d09

SHA1
0e7697437dd394ac797257b0539f6d56ec127d76

SHA256
e426610fe70711354bfd6bd555701564a18cfefe07b6085f8fe40337d918f7a6

SHA512
eaa467831c73b43e9f3f709567fb54962f45e9756a5ba8737c400d64d5eeb5d7b102bb4a1650e30c0d39d3a3ec7e1b067194bd4954c89b7bde81a71b23fec3b1

Download Submit
C:\Windows\System\ZOvRizU.exe

Filesize
2.2MB

MD5
c749f2849bf90836aed359722f7f1fdb

SHA1
7d09da6088827e9dd17a4d560e678d85fd3822c4

SHA256
227895eff93d35152265a46f215166b9fef8a1b6fe6b3890c009fbd9b98c56e0

SHA512
d803ae62c7c6510228137ccdd46bf176e3504b89c125da7e1cdd8b97ed88daa3824b00aea28170d5977254f32441c5d1d522525b2538bf667ac104e1bbcbb9cf

Download Submit
C:\Windows\System\dHgHpfi.exe

Filesize
2.2MB

MD5
020da503dc3c9d946cc92c77792f6333

SHA1
5f817a4896c2696fe78d65f102876ddbd9233d7a

SHA256
79b46b90e0b3bf2e35893c06381cbc022166ce22408054a9709e46cf23e428c9

SHA512
0154eb47a0f5fea0bb50297df7b089e74328c5c0f63452458086f828f4ed1e146a2e726f763125a7b419bc4e4d5dd461ca596bc0dc61abc691f8d2fcc3659a0e

Download Submit
C:\Windows\System\dMBNNoP.exe

Filesize
2.2MB

MD5
a7a835b46b21ea320c5d8b71a20dc180

SHA1
b74e1da34598077dac8978ffb4853346f59d2f33

SHA256
b86b2aa6a467bf2f205384b17f3d7db268f30425e9220743b26eefef125c18e7

SHA512
2f182346269b8e8a260245e449bac2087ecae2b4497a42bd9d1187f8d7eeb693dadaeddde3874d9e6385ef31e25e36d65f7b7d77ed5d3cb750d37a836a643985

Download Submit
C:\Windows\System\dNCrqvA.exe

Filesize
2.2MB

MD5
727520102147cc800c390f09813c27f0

SHA1
10a7958c96bdf1d67377ef532dd072a8e553b0f4

SHA256
836c82b9ddfa54a05417f0714b49d5781d23c2ed70e22021bce7d5fb69bc5be0

SHA512
b0387a31449f83b900ef39c7659f5aea31507f76f7ef25dc15c48ad3266b88bcea0bad78e886290bfb3e7d7cd814665752b49609cbdc29f0eeb0380c6f39dcef

Download Submit
C:\Windows\System\eAkomiB.exe

Filesize
2.2MB

MD5
ddb947e4f7586591683f87bc63fbdf97

SHA1
4ed20b7c5583bc0688e160caeec29427a3f2a756

SHA256
e690d98cb905d8828f7a7e0f0cd06f93ae858e626f7bc9d311ca698ce731cf36

SHA512
8373ec63fafcfc1de1b4f5663b69268651c969318f5a8c9238155c87ea80eabfedc3b04f5a0cbb97e0c4846d4c3b48b42bb86556a133593a8dcfa29d0d02264c

Download Submit
C:\Windows\System\eGHnWZn.exe

Filesize
2.2MB

MD5
d337a6f2bdbd65ea98465621c087c9d2

SHA1
cd4cebf2d70ec97408c9c27711bac84dcdf38239

SHA256
de73c84eb861e5357797a865becc26d0d07b842170e5647121baaff6813b6637

SHA512
0cbec0dc125377a9e7f1123cb5564055e924c554afc112351865dfca4f175a536c132c5dd70f76218f9d0b898343f7f798e3ee9100b34e7a2b9e57cbadb9060d

Download Submit
C:\Windows\System\fTUfSaN.exe

Filesize
2.2MB

MD5
9167a10dadcff1c7c97d7e5eb823618a

SHA1
d7775d65fb5291641d6768819437ada346164ca3

SHA256
7a9b8504542c717cbe4ccfbc2cf55c4d0f1327fcbe111689a459f47584e78bfe

SHA512
5e83deaf2c7f6f8cd4d824ed1c0ae478dcc96155c44092f5229f3e08e6460f4b499c081b04f28af50319f3e4b5b5d05b7078775afe56876fe606262b36c6a388

Download Submit
C:\Windows\System\hBSELFm.exe

Filesize
2.2MB

MD5
0eda28abea73341eaafb72ef46cf2a69

SHA1
45dfc7c41a7bcc036030120cbfcb1f1f9379e2c8

SHA256
d682231872edd8a8ea910242f5752281f4a244259e9646e09640d18987302216

SHA512
242520af4b64b1905381d6f105dcfcbaf0241a82a30e4c739c05729460851a5870ad6e7cca0eb5a1f456b6f10046fb03c04e9b43545d1c2a2873b1cf886f2fa2

Download Submit
C:\Windows\System\hiSwltf.exe

Filesize
8B

MD5
7844449f1717b2590e53c215fcf07352

SHA1
79d0c9d199e3401234813cacf5dd2de0f53d76f4

SHA256
d54f9b9a769720c875f9b7152a74884a4a9e5a4d80da35d3f847cb8b30b14f4d

SHA512
08987ef45e3b930599e24a17bad53cfff0dadf3651ece3e5b0469612e6c0a9a6cc61ef278c49c769a425e8c5349976b197865ce68d78055e84972e2fe8a0851c

Download Submit
C:\Windows\System\hkpnMvW.exe

Filesize
2.2MB

MD5
5e12d57d8d54d81fbfb07c4d127f759b

SHA1
76bde4cffb57b9522399589ef01e44a9d8e7c611

SHA256
046b8a3cfac99fcd5039faba8bb79a19f024f6990f36d952629083aa47e0c78b

SHA512
8a7cbdc4416715168548e638eb32b0596b3a089d8dcad539364d86c38305694ed8aedc7c9996dab4f84d2e928106cd547cc015bb9ea97ca6bd92617541142081

Download Submit
C:\Windows\System\iJsDtku.exe

Filesize
2.2MB

MD5
2c4e1d2c04ed1fb26072e2054d3f2b0a

SHA1
cadc19b8d4543abe0bdf754e4e9edc666fdef632

SHA256
a05ce147af2ebf65cd426a328881cc33c9664557b9419fe5ef494ad843232a34

SHA512
944e2b61a11f9257848976344c7f0520a9608434e860417dc9658fdf718a80c8f6cff6d2a8df1babfca6315c901265819725bb830110e60868d256f6ea7d2b57

Download Submit
C:\Windows\System\iqTldsA.exe

Filesize
2.2MB

MD5
110809cc582b91032b9fb0f59a7e8588

SHA1
01082984b85063a758b8fe9f15b30c83c604727f

SHA256
70c5365779368a9029460e8f252a0e41877b2778b8430b5d74b281c538fcb553

SHA512
cd748345ebff8585dc6053d482af92dc7e0068ddeec8d13ad26036458f293fde5885d97860234866dc50b60dc8856395fd6ef62aebdf27085614e7c9d500d396

Download Submit
C:\Windows\System\islxeVb.exe

Filesize
2.2MB

MD5
8f3c7fff8947a4cf5cf62fc1ccec127b

SHA1
9ed5bf1e404a8b88930b7431ef2221d9a60b750e

SHA256
8954c36acb5852f1e993fbb50c0ced086597088737b3502d5be547d83f82af23

SHA512
97e9b752c080b0e27f651e5fcb7a12f5ed417d29b71b961532ec07baab40892af77cfc399237ba518e98de72bede373d220576a8af3d95d3c807fde2b8c53c8e

Download Submit
C:\Windows\System\kJmhBGi.exe

Filesize
2.2MB

MD5
184de5d4833d087b5e8c8d77f56ba7a3

SHA1
38b159c7d2abe53ccb75b526a665985c5b03deb0

SHA256
e6442affb81fda5a90ca08c2b45e9c3173c0e3710a9ee28ff1446558dbd6177f

SHA512
ee1998de3dc774e983754725e932b64da0e120b1e8367898f3c847a3d4e1dd25096e8ac55fe550ec110fb40ab1bbb345c660b1ed2fdadd138be1f963bcba75f1

Download Submit
C:\Windows\System\lDeurnR.exe

Filesize
2.2MB

MD5
1bdb974e1ebb19d360e0e116038596bb

SHA1
10f0efe65989460cc93166a4828aafbf5b74095e

SHA256
09306231650e3a96d5b58bd84ec7c1623e80cbe4880c41367d289552bb40d17a

SHA512
241b8daaaae1b13de41e8e5d32fef6cb0ea597bbbd042672a351ad97abfb319fbcaef4011fcee091bde3e7f404a0c5d88cdae43bb77509be014d1ebf6f14fc02

Download Submit
C:\Windows\System\mwjUlsJ.exe

Filesize
2.2MB

MD5
b237543cbe5268d5625b05af298ce71a

SHA1
1f7bd30415f7bdea8784ec56faa0608fd0e89b00

SHA256
a7e373519e075631c3740e0cc2f2522d621fe59e12a295a96452396a1b8dbe0c

SHA512
e652dff42f84153c4983265533e4e39ddae2136a16d8e3966f7df3e580ffc531be0d930d1e8dbe14f6afb03ddd3dd2cd562339d37aa527f94815393d9dc3d386

Download Submit
C:\Windows\System\pDNeUnc.exe

Filesize
2.2MB

MD5
bf29a6c55416be9153b73c3cbf588e91

SHA1
836db17076f18bc0c550ccdda3593ebeb1565b68

SHA256
60b5f355e68513a1cfade039c492bc79c4576dff7214349a16d1a3be67a3b134

SHA512
35a35b478fc7b89bdd256c3b5c973c502eec9b8434d3909714f85bf6eaa33b9f296e005e5a08f723ffd0166f494bd701fc0d8fc62133adcda2520c45ab1c8425

Download Submit
C:\Windows\System\swrpglI.exe

Filesize
2.2MB

MD5
3a2b34cedfc0e394b71c6824e822ee9b

SHA1
a2203c7e20037d7a6f395d520695ffad3424d2f1

SHA256
36065466a358bf23c1d822e49fb13cf619d0cdaa8fa5a881f841ab11cc25f901

SHA512
9c75c337232a767cd28a4af659faa5b85912a967211b802c647279f2b2a17acf887d622e78d6b7ce67779266531eed74e490d82b26f823506618de662f4e0ade

Download Submit
C:\Windows\System\wkPWexy.exe

Filesize
2.2MB

MD5
da9b06e1e451c7432cf96de1b84a01cd

SHA1
b98a166a6e1d0513d2d95bcf62cdf0d19934ae6d

SHA256
095b9164ac05ff333b96fbe6487297b4c2592718d152ac30005b850e2151da0d

SHA512
86c15910d8f564ec6000c2cf8a64b7d229bc84d237d38d2d7df5d5cb2738ff2b3400c18b9cc5b16bdfa2d3754e6658189dc3b7b8c72df5fa71cfc2b287f2f273

Download Submit
C:\Windows\System\yLhMadR.exe

Filesize
2.2MB

MD5
4583f27c04124ef79e919101ed9bde7a

SHA1
5822c6ea310ce3976413e802f5b0b10879d45be5

SHA256
699888f0a1ab2619c30a4f02ffaaf6f1e2afc59d0c84eb6c941e22bf39df2289

SHA512
b2f2ed2bce6e7b0c22ceae5cf8427aae4c5294c081525f0809f047de9c8109fcf90aeba792d7c2d07576512580370edf1ee102b40f290622accd2731cb633dd2

Download Submit
C:\Windows\System\zwqiNYq.exe

Filesize
2.2MB

MD5
74c15c777d8c3cd5b1972a803dc33dcb

SHA1
a1f3e10579e3b71c204e3a4d8c7b420089b02178

SHA256
072e5ae32269e9f4c09a3858b366735a1653944ab32d2a390038d010a8275d7b

SHA512
83b9386b373f6b6d4de7a4fb2f20a529e1cb618d5618736eb234526c03cf4b27b7ae0bf4e6aa7bb0f546579f7e9a79e997d5ec7e3fdef2ef88fe2fd3c295d844

Download Submit
C:\Windows\System\zztdzUV.exe

Filesize
2.2MB

MD5
1aceccc78f40b8af3b05ad505bed6a10

SHA1
8c798c7f8edf5bd62b9ebc2861898d23ae1fa0b8

SHA256
c010610af063cf54728a13425414248a78693c37ade7ed53e82439788eedbbf8

SHA512
666a0613011d3e4a42ffa696f168d6ea49cd13305a6a1836f59b866f50a7010b57f52b23d788cb59f3d2015d6370093b34e266510e52232a48cbc074303bf600

Download Submit
memory/392-2670-0x00007FF6C77E0000-0x00007FF6C7BD2000-memory.dmp

Filesize
3.9MB

Download
memory/392-339-0x00007FF6C77E0000-0x00007FF6C7BD2000-memory.dmp

Filesize
3.9MB

Download
memory/540-2639-0x00007FF7FDA60000-0x00007FF7FDE52000-memory.dmp

Filesize
3.9MB

Download
memory/540-151-0x00007FF7FDA60000-0x00007FF7FDE52000-memory.dmp

Filesize
3.9MB

Download
memory/1104-2655-0x00007FF6BBA50000-0x00007FF6BBE42000-memory.dmp

Filesize
3.9MB

Download
memory/1104-348-0x00007FF6BBA50000-0x00007FF6BBE42000-memory.dmp

Filesize
3.9MB

Download
memory/1420-28-0x00007FF986560000-0x00007FF987021000-memory.dmp

Filesize
10.8MB

Download
memory/1420-243-0x00000182DD050000-0x00000182DD072000-memory.dmp

Filesize
136KB

Download
memory/1420-38-0x00000182DD0C0000-0x00000182DD0D0000-memory.dmp

Filesize
64KB

Download
memory/1564-2592-0x00007FF793D30000-0x00007FF794122000-memory.dmp

Filesize
3.9MB

Download
memory/1564-1-0x000001CCBB0F0000-0x000001CCBB100000-memory.dmp

Filesize
64KB

Download
memory/1564-0-0x00007FF793D30000-0x00007FF794122000-memory.dmp

Filesize
3.9MB

Download
memory/1620-2643-0x00007FF61B870000-0x00007FF61BC62000-memory.dmp

Filesize
3.9MB

Download
memory/1620-95-0x00007FF61B870000-0x00007FF61BC62000-memory.dmp

Filesize
3.9MB

Download
memory/1732-122-0x00007FF6359A0000-0x00007FF635D92000-memory.dmp

Filesize
3.9MB

Download
memory/1732-2649-0x00007FF6359A0000-0x00007FF635D92000-memory.dmp

Filesize
3.9MB

Download
memory/1816-2636-0x00007FF74D4B0000-0x00007FF74D8A2000-memory.dmp

Filesize
3.9MB

Download
memory/1816-223-0x00007FF74D4B0000-0x00007FF74D8A2000-memory.dmp

Filesize
3.9MB

Download
memory/1840-54-0x00007FF6BC270000-0x00007FF6BC662000-memory.dmp

Filesize
3.9MB

Download
memory/1840-2634-0x00007FF6BC270000-0x00007FF6BC662000-memory.dmp

Filesize
3.9MB

Download
memory/1912-2668-0x00007FF7AA6A0000-0x00007FF7AAA92000-memory.dmp

Filesize
3.9MB

Download
memory/1912-295-0x00007FF7AA6A0000-0x00007FF7AAA92000-memory.dmp

Filesize
3.9MB

Download
memory/2164-193-0x00007FF786320000-0x00007FF786712000-memory.dmp

Filesize
3.9MB

Download
memory/2164-2654-0x00007FF786320000-0x00007FF786712000-memory.dmp

Filesize
3.9MB

Download
memory/2904-2652-0x00007FF7EB810000-0x00007FF7EBC02000-memory.dmp

Filesize
3.9MB

Download
memory/2904-159-0x00007FF7EB810000-0x00007FF7EBC02000-memory.dmp

Filesize
3.9MB

Download
memory/2976-277-0x00007FF6339E0000-0x00007FF633DD2000-memory.dmp

Filesize
3.9MB

Download
memory/2976-2659-0x00007FF6339E0000-0x00007FF633DD2000-memory.dmp

Filesize
3.9MB

Download
memory/3404-340-0x00007FF68ECC0000-0x00007FF68F0B2000-memory.dmp

Filesize
3.9MB

Download
memory/3404-2657-0x00007FF68ECC0000-0x00007FF68F0B2000-memory.dmp

Filesize
3.9MB

Download
memory/3560-2630-0x00007FF6A35B0000-0x00007FF6A39A2000-memory.dmp

Filesize
3.9MB

Download
memory/3560-39-0x00007FF6A35B0000-0x00007FF6A39A2000-memory.dmp

Filesize
3.9MB

Download
memory/4100-320-0x00007FF700CF0000-0x00007FF7010E2000-memory.dmp

Filesize
3.9MB

Download
memory/4100-2640-0x00007FF700CF0000-0x00007FF7010E2000-memory.dmp

Filesize
3.9MB

Download
memory/4276-2633-0x00007FF704870000-0x00007FF704C62000-memory.dmp

Filesize
3.9MB

Download
memory/4276-68-0x00007FF704870000-0x00007FF704C62000-memory.dmp

Filesize
3.9MB

Download
memory/4440-255-0x00007FF7BC0E0000-0x00007FF7BC4D2000-memory.dmp

Filesize
3.9MB

Download
memory/4440-2666-0x00007FF7BC0E0000-0x00007FF7BC4D2000-memory.dmp

Filesize
3.9MB

Download
memory/4476-2628-0x00007FF7CDA70000-0x00007FF7CDE62000-memory.dmp

Filesize
3.9MB

Download
memory/4476-312-0x00007FF7CDA70000-0x00007FF7CDE62000-memory.dmp

Filesize
3.9MB

Download
memory/4480-2645-0x00007FF67A470000-0x00007FF67A862000-memory.dmp

Filesize
3.9MB

Download
memory/4480-239-0x00007FF67A470000-0x00007FF67A862000-memory.dmp

Filesize
3.9MB

Download
memory/4508-2663-0x00007FF746010000-0x00007FF746402000-memory.dmp

Filesize
3.9MB

Download
memory/4508-288-0x00007FF746010000-0x00007FF746402000-memory.dmp

Filesize
3.9MB

Download
memory/4620-2647-0x00007FF7A9920000-0x00007FF7A9D12000-memory.dmp

Filesize
3.9MB

Download
memory/4620-232-0x00007FF7A9920000-0x00007FF7A9D12000-memory.dmp

Filesize
3.9MB

Download
memory/4808-258-0x00007FF7A5630000-0x00007FF7A5A22000-memory.dmp

Filesize
3.9MB

Download
memory/4808-2674-0x00007FF7A5630000-0x00007FF7A5A22000-memory.dmp

Filesize
3.9MB

Download