xmrig | 6ea0f8a3a97a495e8829a8ce6d4a43fe9b925788d1d2096ba577dd5101f400a6

Analysis

max time kernel
38s
max time network
38s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 01:50

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
Size

1.9MB
MD5

041c2b2e898fb4c5b78b56a2998a7a2c
SHA1

f2360416815c2670e95b2b50b9eaca0c55426faa
SHA256

6ea0f8a3a97a495e8829a8ce6d4a43fe9b925788d1d2096ba577dd5101f400a6
SHA512

d604e183d91e9b4e2aafb13a582ab4c6923ef92f66346c14f16c60a466830980558638ab69b0032e1a39a19daa769355553af75d22b3e869d42b34bbc4e2c4df
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlfR4:NABt

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 21 IoCs

miner

resource	yara_rule
behavioral2/memory/1916-451-0x00007FF734C90000-0x00007FF735082000-memory.dmp	xmrig
behavioral2/memory/4500-565-0x00007FF796C60000-0x00007FF797052000-memory.dmp	xmrig
behavioral2/memory/5064-570-0x00007FF69ECC0000-0x00007FF69F0B2000-memory.dmp	xmrig
behavioral2/memory/4424-573-0x00007FF7635F0000-0x00007FF7639E2000-memory.dmp	xmrig
behavioral2/memory/1712-572-0x00007FF736730000-0x00007FF736B22000-memory.dmp	xmrig
behavioral2/memory/2120-571-0x00007FF758500000-0x00007FF7588F2000-memory.dmp	xmrig
behavioral2/memory/1968-569-0x00007FF7D99C0000-0x00007FF7D9DB2000-memory.dmp	xmrig
behavioral2/memory/4912-568-0x00007FF67D3E0000-0x00007FF67D7D2000-memory.dmp	xmrig
behavioral2/memory/1228-567-0x00007FF7736F0000-0x00007FF773AE2000-memory.dmp	xmrig
behavioral2/memory/1960-566-0x00007FF6F6420000-0x00007FF6F6812000-memory.dmp	xmrig
behavioral2/memory/2756-563-0x00007FF6ABB30000-0x00007FF6ABF22000-memory.dmp	xmrig
behavioral2/memory/2072-509-0x00007FF6EFD30000-0x00007FF6F0122000-memory.dmp	xmrig
behavioral2/memory/2300-506-0x00007FF6E8A80000-0x00007FF6E8E72000-memory.dmp	xmrig
behavioral2/memory/2424-410-0x00007FF76B800000-0x00007FF76BBF2000-memory.dmp	xmrig
behavioral2/memory/64-295-0x00007FF7E9A00000-0x00007FF7E9DF2000-memory.dmp	xmrig
behavioral2/memory/2956-292-0x00007FF681630000-0x00007FF681A22000-memory.dmp	xmrig
behavioral2/memory/5068-238-0x00007FF72A5F0000-0x00007FF72A9E2000-memory.dmp	xmrig
behavioral2/memory/2052-209-0x00007FF63C5D0000-0x00007FF63C9C2000-memory.dmp	xmrig
behavioral2/memory/1188-161-0x00007FF751CF0000-0x00007FF7520E2000-memory.dmp	xmrig
behavioral2/memory/1496-157-0x00007FF798090000-0x00007FF798482000-memory.dmp	xmrig
behavioral2/memory/3124-113-0x00007FF6476F0000-0x00007FF647AE2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1712	DXbGJwU.exe
3124	sQeghGN.exe
1496	BEMwEXE.exe
1188	uGiMNSC.exe
2052	WwRUrGS.exe
5068	zzvkFGA.exe
2956	kchbzau.exe
64	yGlARVA.exe
2424	ZftEUbL.exe
1916	slNXnZe.exe
2300	eBYMEpg.exe
2072	ufpxvvw.exe
2756	Okhyglp.exe
4500	ZiCDIxv.exe
4424	hfMDQxK.exe
1960	mhyuaek.exe
1228	evlrLFY.exe
4912	tHwLINZ.exe
1968	adswFbj.exe
5064	ybLYuHS.exe
2120	cUDnAwF.exe
3516	djfMxOu.exe
4272	nlejnFP.exe
2948	azWMJkS.exe
3800	OMGmEfe.exe
4380	EVUaMnR.exe
1956	NujCKBf.exe
780	BVqxYVS.exe
2644	StphURS.exe
4496	EunQJYc.exe
2840	CcytHUp.exe
3372	FvrXskR.exe
4640	toRcopd.exe
1608	fMBYRjx.exe
1500	afURCql.exe
208	HutYarg.exe
1368	KyyUVzk.exe
2600	gctQruv.exe
3764	bdpHQeo.exe
3696	eENbWRO.exe
4672	mtLzrue.exe
2168	YrPfELd.exe
2720	KFeyEKF.exe
3128	IBUxbfI.exe
3016	nXPQega.exe
1840	TCMFroJ.exe
1844	ctAYWvY.exe
1852	EHbUtho.exe
4524	ixYnMHr.exe
4232	laRSenq.exe
4064	TapboCz.exe
2260	WylTenu.exe
2660	zgfBNUq.exe
3988	MczXWMW.exe
2076	gaydlCi.exe
1300	JbgKwec.exe
2888	NEwdWuS.exe
1504	yrlTArB.exe
4056	tjhuHsq.exe
4408	WPtqamp.exe
3760	kHIicNV.exe
1332	aqMPuGg.exe
4068	LvmpEjT.exe
2892	UOmiaoO.exe

UPX packed file 60 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4420-0-0x00007FF6F5930000-0x00007FF6F5D22000-memory.dmp	upx
behavioral2/files/0x0005000000023266-5.dat	upx
behavioral2/files/0x0009000000023410-8.dat	upx
behavioral2/files/0x000700000002341a-62.dat	upx
behavioral2/files/0x000700000002341e-59.dat	upx
behavioral2/files/0x0007000000023417-58.dat	upx
behavioral2/files/0x0007000000023420-90.dat	upx
behavioral2/files/0x0007000000023416-56.dat	upx
behavioral2/files/0x000700000002341c-50.dat	upx
behavioral2/files/0x0007000000023418-65.dat	upx
behavioral2/files/0x0007000000023419-45.dat	upx
behavioral2/files/0x0008000000023412-53.dat	upx
behavioral2/files/0x0007000000023413-42.dat	upx
behavioral2/files/0x0007000000023421-97.dat	upx
behavioral2/files/0x000700000002342c-174.dat	upx
behavioral2/memory/1916-451-0x00007FF734C90000-0x00007FF735082000-memory.dmp	upx
behavioral2/memory/4500-565-0x00007FF796C60000-0x00007FF797052000-memory.dmp	upx
behavioral2/memory/5064-570-0x00007FF69ECC0000-0x00007FF69F0B2000-memory.dmp	upx
behavioral2/memory/4424-573-0x00007FF7635F0000-0x00007FF7639E2000-memory.dmp	upx
behavioral2/memory/1712-572-0x00007FF736730000-0x00007FF736B22000-memory.dmp	upx
behavioral2/memory/2120-571-0x00007FF758500000-0x00007FF7588F2000-memory.dmp	upx
behavioral2/memory/1968-569-0x00007FF7D99C0000-0x00007FF7D9DB2000-memory.dmp	upx
behavioral2/memory/4912-568-0x00007FF67D3E0000-0x00007FF67D7D2000-memory.dmp	upx
behavioral2/memory/1228-567-0x00007FF7736F0000-0x00007FF773AE2000-memory.dmp	upx
behavioral2/memory/1960-566-0x00007FF6F6420000-0x00007FF6F6812000-memory.dmp	upx
behavioral2/memory/2756-563-0x00007FF6ABB30000-0x00007FF6ABF22000-memory.dmp	upx
behavioral2/memory/2072-509-0x00007FF6EFD30000-0x00007FF6F0122000-memory.dmp	upx
behavioral2/memory/2300-506-0x00007FF6E8A80000-0x00007FF6E8E72000-memory.dmp	upx
behavioral2/memory/2424-410-0x00007FF76B800000-0x00007FF76BBF2000-memory.dmp	upx
behavioral2/memory/64-295-0x00007FF7E9A00000-0x00007FF7E9DF2000-memory.dmp	upx
behavioral2/memory/2956-292-0x00007FF681630000-0x00007FF681A22000-memory.dmp	upx
behavioral2/memory/5068-238-0x00007FF72A5F0000-0x00007FF72A9E2000-memory.dmp	upx
behavioral2/memory/2052-209-0x00007FF63C5D0000-0x00007FF63C9C2000-memory.dmp	upx
behavioral2/files/0x0007000000023427-194.dat	upx
behavioral2/files/0x0007000000023426-187.dat	upx
behavioral2/files/0x0007000000023425-185.dat	upx
behavioral2/files/0x0007000000023436-183.dat	upx
behavioral2/files/0x0007000000023423-181.dat	upx
behavioral2/files/0x0007000000023422-176.dat	upx
behavioral2/files/0x0007000000023434-173.dat	upx
behavioral2/files/0x000700000002342b-171.dat	upx
behavioral2/files/0x0007000000023433-170.dat	upx
behavioral2/files/0x0007000000023432-169.dat	upx
behavioral2/files/0x000700000002342a-168.dat	upx
behavioral2/files/0x0007000000023431-165.dat	upx
behavioral2/memory/1188-161-0x00007FF751CF0000-0x00007FF7520E2000-memory.dmp	upx
behavioral2/files/0x0007000000023430-160.dat	upx
behavioral2/files/0x000700000002341f-154.dat	upx
behavioral2/files/0x000700000002342e-144.dat	upx
behavioral2/files/0x000700000002341d-143.dat	upx
behavioral2/files/0x0007000000023424-141.dat	upx
behavioral2/files/0x000700000002342d-137.dat	upx
behavioral2/files/0x0007000000023435-180.dat	upx
behavioral2/memory/1496-157-0x00007FF798090000-0x00007FF798482000-memory.dmp	upx
behavioral2/files/0x0007000000023429-112.dat	upx
behavioral2/files/0x000700000002341b-134.dat	upx
behavioral2/memory/3124-113-0x00007FF6476F0000-0x00007FF647AE2000-memory.dmp	upx
behavioral2/files/0x0007000000023428-111.dat	upx
behavioral2/files/0x0007000000023414-39.dat	upx
behavioral2/files/0x0007000000023415-49.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\oVuRkVW.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\qBhEcrs.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\MtwBGKP.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\lWWMWIz.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\iUaPWhp.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\oiajgCX.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\AnqDCYq.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\BrkbjEh.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\nmoLUmw.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\OOUlFUG.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\nOyHDeg.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\bwYILVW.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\lHltSAv.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\eLSCDXG.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\AqfWzpn.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\BTCbtkQ.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\UgKEjEM.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\FgHoxJF.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\rgWZRXS.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\pWKxcYs.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\jFloMPs.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\tzNeOWY.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\tHHLafC.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\ZJqNxVI.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\zLlmfIx.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\dwMxJEb.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\cdKdZLq.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\XCaSIqs.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\FhWvETF.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\YmLfkBR.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\kVrFTem.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\DFlJXkO.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\zksisqx.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\GLDVuNZ.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\gZqoGet.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\CcRoBfE.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\DeFgPHv.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\nlkdtvt.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\UhyxnrU.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\qKBVtBk.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\hnGbcJR.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\RdaFVWe.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\DhwbUOS.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\VVYotOm.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\pSBaSgW.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\xPYdHvg.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\LHzSoIW.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\nmDjxph.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\dBsQWof.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\oVYfhDT.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\KLyCIOa.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\jPbdNiE.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\uzMWgZd.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\cqLvxuW.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\UcFfkat.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\tgHKykK.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\EqxCgDz.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\YogxUGB.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\lfRmMNi.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\dRziXiJ.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\WwRUrGS.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\UIMpzPL.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\tkTUFuo.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\CntbzxR.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4840	powershell.exe
4840	powershell.exe
4840	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
Token: SeDebugPrivilege	4840	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 4840	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	82
PID 4420 wrote to memory of 4840	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	82
PID 4420 wrote to memory of 1712	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	83
PID 4420 wrote to memory of 1712	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	83
PID 4420 wrote to memory of 3124	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	84
PID 4420 wrote to memory of 3124	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	84
PID 4420 wrote to memory of 5068	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	85
PID 4420 wrote to memory of 5068	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	85
PID 4420 wrote to memory of 1496	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	86
PID 4420 wrote to memory of 1496	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	86
PID 4420 wrote to memory of 1188	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	87
PID 4420 wrote to memory of 1188	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	87
PID 4420 wrote to memory of 2052	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	88
PID 4420 wrote to memory of 2052	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	88
PID 4420 wrote to memory of 2956	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	89
PID 4420 wrote to memory of 2956	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	89
PID 4420 wrote to memory of 64	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	90
PID 4420 wrote to memory of 64	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	90
PID 4420 wrote to memory of 2424	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	91
PID 4420 wrote to memory of 2424	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	91
PID 4420 wrote to memory of 1916	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	92
PID 4420 wrote to memory of 1916	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	92
PID 4420 wrote to memory of 2300	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	93
PID 4420 wrote to memory of 2300	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	93
PID 4420 wrote to memory of 4500	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	94
PID 4420 wrote to memory of 4500	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	94
PID 4420 wrote to memory of 2072	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	95
PID 4420 wrote to memory of 2072	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	95
PID 4420 wrote to memory of 4424	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	96
PID 4420 wrote to memory of 4424	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	96
PID 4420 wrote to memory of 2756	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	97
PID 4420 wrote to memory of 2756	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	97
PID 4420 wrote to memory of 1960	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	98
PID 4420 wrote to memory of 1960	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	98
PID 4420 wrote to memory of 1228	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	99
PID 4420 wrote to memory of 1228	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	99
PID 4420 wrote to memory of 4912	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	100
PID 4420 wrote to memory of 4912	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	100
PID 4420 wrote to memory of 1968	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	101
PID 4420 wrote to memory of 1968	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	101
PID 4420 wrote to memory of 5064	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	102
PID 4420 wrote to memory of 5064	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	102
PID 4420 wrote to memory of 2644	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	103
PID 4420 wrote to memory of 2644	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	103
PID 4420 wrote to memory of 2120	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	104
PID 4420 wrote to memory of 2120	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	104
PID 4420 wrote to memory of 3516	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	105
PID 4420 wrote to memory of 3516	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	105
PID 4420 wrote to memory of 4272	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	106
PID 4420 wrote to memory of 4272	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	106
PID 4420 wrote to memory of 2948	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	107
PID 4420 wrote to memory of 2948	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	107
PID 4420 wrote to memory of 3800	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	108
PID 4420 wrote to memory of 3800	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	108
PID 4420 wrote to memory of 4380	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	109
PID 4420 wrote to memory of 4380	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	109
PID 4420 wrote to memory of 1500	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	110
PID 4420 wrote to memory of 1500	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	110
PID 4420 wrote to memory of 1956	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	111
PID 4420 wrote to memory of 1956	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	111
PID 4420 wrote to memory of 780	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	112
PID 4420 wrote to memory of 780	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	112
PID 4420 wrote to memory of 4496	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	113
PID 4420 wrote to memory of 4496	4420	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	113

C:\Users\Admin\AppData\Local\Temp\041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4840
- C:\Windows\System\DXbGJwU.exe
  C:\Windows\System\DXbGJwU.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\sQeghGN.exe
  C:\Windows\System\sQeghGN.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\zzvkFGA.exe
  C:\Windows\System\zzvkFGA.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\BEMwEXE.exe
  C:\Windows\System\BEMwEXE.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\uGiMNSC.exe
  C:\Windows\System\uGiMNSC.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\WwRUrGS.exe
  C:\Windows\System\WwRUrGS.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\kchbzau.exe
  C:\Windows\System\kchbzau.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\yGlARVA.exe
  C:\Windows\System\yGlARVA.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\ZftEUbL.exe
  C:\Windows\System\ZftEUbL.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\slNXnZe.exe
  C:\Windows\System\slNXnZe.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\eBYMEpg.exe
  C:\Windows\System\eBYMEpg.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\ZiCDIxv.exe
  C:\Windows\System\ZiCDIxv.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\ufpxvvw.exe
  C:\Windows\System\ufpxvvw.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\hfMDQxK.exe
  C:\Windows\System\hfMDQxK.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\Okhyglp.exe
  C:\Windows\System\Okhyglp.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\mhyuaek.exe
  C:\Windows\System\mhyuaek.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\evlrLFY.exe
  C:\Windows\System\evlrLFY.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\tHwLINZ.exe
  C:\Windows\System\tHwLINZ.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\adswFbj.exe
  C:\Windows\System\adswFbj.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\ybLYuHS.exe
  C:\Windows\System\ybLYuHS.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\StphURS.exe
  C:\Windows\System\StphURS.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\cUDnAwF.exe
  C:\Windows\System\cUDnAwF.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\djfMxOu.exe
  C:\Windows\System\djfMxOu.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\nlejnFP.exe
  C:\Windows\System\nlejnFP.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\azWMJkS.exe
  C:\Windows\System\azWMJkS.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\OMGmEfe.exe
  C:\Windows\System\OMGmEfe.exe
  2⤵
  - Executes dropped EXE
  PID:3800
- C:\Windows\System\EVUaMnR.exe
  C:\Windows\System\EVUaMnR.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\afURCql.exe
  C:\Windows\System\afURCql.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\NujCKBf.exe
  C:\Windows\System\NujCKBf.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\BVqxYVS.exe
  C:\Windows\System\BVqxYVS.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\EunQJYc.exe
  C:\Windows\System\EunQJYc.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\KFeyEKF.exe
  C:\Windows\System\KFeyEKF.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\CcytHUp.exe
  C:\Windows\System\CcytHUp.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\FvrXskR.exe
  C:\Windows\System\FvrXskR.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\toRcopd.exe
  C:\Windows\System\toRcopd.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\fMBYRjx.exe
  C:\Windows\System\fMBYRjx.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\HutYarg.exe
  C:\Windows\System\HutYarg.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\KyyUVzk.exe
  C:\Windows\System\KyyUVzk.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\gctQruv.exe
  C:\Windows\System\gctQruv.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\bdpHQeo.exe
  C:\Windows\System\bdpHQeo.exe
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Windows\System\eENbWRO.exe
  C:\Windows\System\eENbWRO.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\mtLzrue.exe
  C:\Windows\System\mtLzrue.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\YrPfELd.exe
  C:\Windows\System\YrPfELd.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\gaydlCi.exe
  C:\Windows\System\gaydlCi.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\IBUxbfI.exe
  C:\Windows\System\IBUxbfI.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\nXPQega.exe
  C:\Windows\System\nXPQega.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\TCMFroJ.exe
  C:\Windows\System\TCMFroJ.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\ctAYWvY.exe
  C:\Windows\System\ctAYWvY.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\EHbUtho.exe
  C:\Windows\System\EHbUtho.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\ixYnMHr.exe
  C:\Windows\System\ixYnMHr.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\laRSenq.exe
  C:\Windows\System\laRSenq.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\TapboCz.exe
  C:\Windows\System\TapboCz.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\WylTenu.exe
  C:\Windows\System\WylTenu.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\zgfBNUq.exe
  C:\Windows\System\zgfBNUq.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\MczXWMW.exe
  C:\Windows\System\MczXWMW.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\JbgKwec.exe
  C:\Windows\System\JbgKwec.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\NEwdWuS.exe
  C:\Windows\System\NEwdWuS.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\yrlTArB.exe
  C:\Windows\System\yrlTArB.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\tjhuHsq.exe
  C:\Windows\System\tjhuHsq.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\WPtqamp.exe
  C:\Windows\System\WPtqamp.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\kHIicNV.exe
  C:\Windows\System\kHIicNV.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\aqMPuGg.exe
  C:\Windows\System\aqMPuGg.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\LvmpEjT.exe
  C:\Windows\System\LvmpEjT.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\UOmiaoO.exe
  C:\Windows\System\UOmiaoO.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\srUeilZ.exe
  C:\Windows\System\srUeilZ.exe
  2⤵
  PID:1136
- C:\Windows\System\XFeRGdq.exe
  C:\Windows\System\XFeRGdq.exe
  2⤵
  PID:3048
- C:\Windows\System\lNwbvES.exe
  C:\Windows\System\lNwbvES.exe
  2⤵
  PID:4660
- C:\Windows\System\rqWLkCw.exe
  C:\Windows\System\rqWLkCw.exe
  2⤵
  PID:940
- C:\Windows\System\bWsSLSe.exe
  C:\Windows\System\bWsSLSe.exe
  2⤵
  PID:1532
- C:\Windows\System\dyrlzTp.exe
  C:\Windows\System\dyrlzTp.exe
  2⤵
  PID:1076
- C:\Windows\System\albLrpg.exe
  C:\Windows\System\albLrpg.exe
  2⤵
  PID:5108
- C:\Windows\System\ANsVVGy.exe
  C:\Windows\System\ANsVVGy.exe
  2⤵
  PID:4000
- C:\Windows\System\cpiFvzf.exe
  C:\Windows\System\cpiFvzf.exe
  2⤵
  PID:5072
- C:\Windows\System\uBsHsgS.exe
  C:\Windows\System\uBsHsgS.exe
  2⤵
  PID:4568
- C:\Windows\System\aMIwCoY.exe
  C:\Windows\System\aMIwCoY.exe
  2⤵
  PID:468
- C:\Windows\System\UsIDLQe.exe
  C:\Windows\System\UsIDLQe.exe
  2⤵
  PID:640
- C:\Windows\System\YGgHAfJ.exe
  C:\Windows\System\YGgHAfJ.exe
  2⤵
  PID:4124
- C:\Windows\System\EnlIiQX.exe
  C:\Windows\System\EnlIiQX.exe
  2⤵
  PID:556
- C:\Windows\System\INlYRdY.exe
  C:\Windows\System\INlYRdY.exe
  2⤵
  PID:920
- C:\Windows\System\ZaBxEFd.exe
  C:\Windows\System\ZaBxEFd.exe
  2⤵
  PID:4316
- C:\Windows\System\jTqGaak.exe
  C:\Windows\System\jTqGaak.exe
  2⤵
  PID:1604
- C:\Windows\System\PwjPSKL.exe
  C:\Windows\System\PwjPSKL.exe
  2⤵
  PID:1700
- C:\Windows\System\omuhhoM.exe
  C:\Windows\System\omuhhoM.exe
  2⤵
  PID:3080
- C:\Windows\System\NWEPyvL.exe
  C:\Windows\System\NWEPyvL.exe
  2⤵
  PID:60
- C:\Windows\System\RgYKqRD.exe
  C:\Windows\System\RgYKqRD.exe
  2⤵
  PID:1480
- C:\Windows\System\eaIsWqD.exe
  C:\Windows\System\eaIsWqD.exe
  2⤵
  PID:1104
- C:\Windows\System\ggbVgfg.exe
  C:\Windows\System\ggbVgfg.exe
  2⤵
  PID:2648
- C:\Windows\System\QwosYqK.exe
  C:\Windows\System\QwosYqK.exe
  2⤵
  PID:5144
- C:\Windows\System\uPwMQey.exe
  C:\Windows\System\uPwMQey.exe
  2⤵
  PID:5160
- C:\Windows\System\rBFKnvM.exe
  C:\Windows\System\rBFKnvM.exe
  2⤵
  PID:5180
- C:\Windows\System\odImvbY.exe
  C:\Windows\System\odImvbY.exe
  2⤵
  PID:5200
- C:\Windows\System\FujCAaQ.exe
  C:\Windows\System\FujCAaQ.exe
  2⤵
  PID:5240
- C:\Windows\System\axJLkqm.exe
  C:\Windows\System\axJLkqm.exe
  2⤵
  PID:5280
- C:\Windows\System\lxYGpyj.exe
  C:\Windows\System\lxYGpyj.exe
  2⤵
  PID:5304
- C:\Windows\System\mvrJQdu.exe
  C:\Windows\System\mvrJQdu.exe
  2⤵
  PID:5336
- C:\Windows\System\zZXYqdm.exe
  C:\Windows\System\zZXYqdm.exe
  2⤵
  PID:5356
- C:\Windows\System\pSBaSgW.exe
  C:\Windows\System\pSBaSgW.exe
  2⤵
  PID:5376
- C:\Windows\System\eHLJIvb.exe
  C:\Windows\System\eHLJIvb.exe
  2⤵
  PID:5400
- C:\Windows\System\BdaJBDz.exe
  C:\Windows\System\BdaJBDz.exe
  2⤵
  PID:5416
- C:\Windows\System\OrOTIsV.exe
  C:\Windows\System\OrOTIsV.exe
  2⤵
  PID:5432
- C:\Windows\System\JTgeaUP.exe
  C:\Windows\System\JTgeaUP.exe
  2⤵
  PID:5456
- C:\Windows\System\eGSdInv.exe
  C:\Windows\System\eGSdInv.exe
  2⤵
  PID:5484
- C:\Windows\System\iwrLcDa.exe
  C:\Windows\System\iwrLcDa.exe
  2⤵
  PID:5520
- C:\Windows\System\tvvZAXK.exe
  C:\Windows\System\tvvZAXK.exe
  2⤵
  PID:5536
- C:\Windows\System\VuDeDVg.exe
  C:\Windows\System\VuDeDVg.exe
  2⤵
  PID:5560
- C:\Windows\System\NigyOjL.exe
  C:\Windows\System\NigyOjL.exe
  2⤵
  PID:5580
- C:\Windows\System\lnxfnkD.exe
  C:\Windows\System\lnxfnkD.exe
  2⤵
  PID:5600
- C:\Windows\System\SPgzhhy.exe
  C:\Windows\System\SPgzhhy.exe
  2⤵
  PID:5624
- C:\Windows\System\qfGPwDO.exe
  C:\Windows\System\qfGPwDO.exe
  2⤵
  PID:5668
- C:\Windows\System\CWvTldQ.exe
  C:\Windows\System\CWvTldQ.exe
  2⤵
  PID:5692
- C:\Windows\System\CNTsfvj.exe
  C:\Windows\System\CNTsfvj.exe
  2⤵
  PID:5716
- C:\Windows\System\gLZemoo.exe
  C:\Windows\System\gLZemoo.exe
  2⤵
  PID:5736
- C:\Windows\System\DhiwTRH.exe
  C:\Windows\System\DhiwTRH.exe
  2⤵
  PID:5756
- C:\Windows\System\DlWNqHi.exe
  C:\Windows\System\DlWNqHi.exe
  2⤵
  PID:5776
- C:\Windows\System\mCHlTbM.exe
  C:\Windows\System\mCHlTbM.exe
  2⤵
  PID:5800
- C:\Windows\System\QLgsceg.exe
  C:\Windows\System\QLgsceg.exe
  2⤵
  PID:5824
- C:\Windows\System\GCirTFJ.exe
  C:\Windows\System\GCirTFJ.exe
  2⤵
  PID:5844
- C:\Windows\System\vcHmPhL.exe
  C:\Windows\System\vcHmPhL.exe
  2⤵
  PID:5864
- C:\Windows\System\nRvKmyJ.exe
  C:\Windows\System\nRvKmyJ.exe
  2⤵
  PID:5880
- C:\Windows\System\wZFkhXH.exe
  C:\Windows\System\wZFkhXH.exe
  2⤵
  PID:5900
- C:\Windows\System\ZPucSoX.exe
  C:\Windows\System\ZPucSoX.exe
  2⤵
  PID:5924
- C:\Windows\System\YKOuxaG.exe
  C:\Windows\System\YKOuxaG.exe
  2⤵
  PID:5940
- C:\Windows\System\FwaqAXL.exe
  C:\Windows\System\FwaqAXL.exe
  2⤵
  PID:5964
- C:\Windows\System\Bpstwnp.exe
  C:\Windows\System\Bpstwnp.exe
  2⤵
  PID:5992
- C:\Windows\System\whqICFM.exe
  C:\Windows\System\whqICFM.exe
  2⤵
  PID:6008
- C:\Windows\System\CCGStsm.exe
  C:\Windows\System\CCGStsm.exe
  2⤵
  PID:6036
- C:\Windows\System\bucsOLQ.exe
  C:\Windows\System\bucsOLQ.exe
  2⤵
  PID:6052
- C:\Windows\System\SDJfSRO.exe
  C:\Windows\System\SDJfSRO.exe
  2⤵
  PID:6072
- C:\Windows\System\BLmzgLh.exe
  C:\Windows\System\BLmzgLh.exe
  2⤵
  PID:6096
- C:\Windows\System\oMiMDMw.exe
  C:\Windows\System\oMiMDMw.exe
  2⤵
  PID:6116
- C:\Windows\System\otIywqt.exe
  C:\Windows\System\otIywqt.exe
  2⤵
  PID:6136
- C:\Windows\System\EYCqpKX.exe
  C:\Windows\System\EYCqpKX.exe
  2⤵
  PID:1248
- C:\Windows\System\uLgvlaf.exe
  C:\Windows\System\uLgvlaf.exe
  2⤵
  PID:4996
- C:\Windows\System\bkZbqOT.exe
  C:\Windows\System\bkZbqOT.exe
  2⤵
  PID:796
- C:\Windows\System\UWSYljJ.exe
  C:\Windows\System\UWSYljJ.exe
  2⤵
  PID:3436
- C:\Windows\System\BmalZqk.exe
  C:\Windows\System\BmalZqk.exe
  2⤵
  PID:3704
- C:\Windows\System\awEWFlr.exe
  C:\Windows\System\awEWFlr.exe
  2⤵
  PID:1488
- C:\Windows\System\ijXhJiS.exe
  C:\Windows\System\ijXhJiS.exe
  2⤵
  PID:624
- C:\Windows\System\gtSPzCu.exe
  C:\Windows\System\gtSPzCu.exe
  2⤵
  PID:1684
- C:\Windows\System\ipjxjps.exe
  C:\Windows\System\ipjxjps.exe
  2⤵
  PID:1660
- C:\Windows\System\truaBCz.exe
  C:\Windows\System\truaBCz.exe
  2⤵
  PID:4076
- C:\Windows\System\kGyZLRw.exe
  C:\Windows\System\kGyZLRw.exe
  2⤵
  PID:5128
- C:\Windows\System\aGugAnK.exe
  C:\Windows\System\aGugAnK.exe
  2⤵
  PID:1544
- C:\Windows\System\WxwjOAT.exe
  C:\Windows\System\WxwjOAT.exe
  2⤵
  PID:6152
- C:\Windows\System\UnsuvqT.exe
  C:\Windows\System\UnsuvqT.exe
  2⤵
  PID:6168
- C:\Windows\System\qXZXsKq.exe
  C:\Windows\System\qXZXsKq.exe
  2⤵
  PID:6196
- C:\Windows\System\IcHdaBS.exe
  C:\Windows\System\IcHdaBS.exe
  2⤵
  PID:6216
- C:\Windows\System\RNiAVKn.exe
  C:\Windows\System\RNiAVKn.exe
  2⤵
  PID:6236
- C:\Windows\System\ZleRQFo.exe
  C:\Windows\System\ZleRQFo.exe
  2⤵
  PID:6260
- C:\Windows\System\VLvtHho.exe
  C:\Windows\System\VLvtHho.exe
  2⤵
  PID:6280
- C:\Windows\System\byfCWNN.exe
  C:\Windows\System\byfCWNN.exe
  2⤵
  PID:6300
- C:\Windows\System\DNYLuoJ.exe
  C:\Windows\System\DNYLuoJ.exe
  2⤵
  PID:6320
- C:\Windows\System\yibVtxx.exe
  C:\Windows\System\yibVtxx.exe
  2⤵
  PID:6340
- C:\Windows\System\yITVOLv.exe
  C:\Windows\System\yITVOLv.exe
  2⤵
  PID:6364
- C:\Windows\System\NPutSEv.exe
  C:\Windows\System\NPutSEv.exe
  2⤵
  PID:6384
- C:\Windows\System\pITbYcO.exe
  C:\Windows\System\pITbYcO.exe
  2⤵
  PID:6404
- C:\Windows\System\RnSWqnR.exe
  C:\Windows\System\RnSWqnR.exe
  2⤵
  PID:6420
- C:\Windows\System\pZfHtNb.exe
  C:\Windows\System\pZfHtNb.exe
  2⤵
  PID:6444
- C:\Windows\System\oUJsNov.exe
  C:\Windows\System\oUJsNov.exe
  2⤵
  PID:6460
- C:\Windows\System\hAsAgkt.exe
  C:\Windows\System\hAsAgkt.exe
  2⤵
  PID:6492
- C:\Windows\System\cjKnMSJ.exe
  C:\Windows\System\cjKnMSJ.exe
  2⤵
  PID:6512
- C:\Windows\System\SJOmVud.exe
  C:\Windows\System\SJOmVud.exe
  2⤵
  PID:6576
- C:\Windows\System\MMZxzpD.exe
  C:\Windows\System\MMZxzpD.exe
  2⤵
  PID:6600
- C:\Windows\System\NrEPJTo.exe
  C:\Windows\System\NrEPJTo.exe
  2⤵
  PID:6620
- C:\Windows\System\FxmSfGD.exe
  C:\Windows\System\FxmSfGD.exe
  2⤵
  PID:6636
- C:\Windows\System\flbXRxs.exe
  C:\Windows\System\flbXRxs.exe
  2⤵
  PID:6656
- C:\Windows\System\cZjqWNB.exe
  C:\Windows\System\cZjqWNB.exe
  2⤵
  PID:6700
- C:\Windows\System\wipOYfl.exe
  C:\Windows\System\wipOYfl.exe
  2⤵
  PID:6716
- C:\Windows\System\UpFdRkY.exe
  C:\Windows\System\UpFdRkY.exe
  2⤵
  PID:6740
- C:\Windows\System\aMAspfz.exe
  C:\Windows\System\aMAspfz.exe
  2⤵
  PID:6764
- C:\Windows\System\QNtQWsP.exe
  C:\Windows\System\QNtQWsP.exe
  2⤵
  PID:6780
- C:\Windows\System\lFwzWnK.exe
  C:\Windows\System\lFwzWnK.exe
  2⤵
  PID:6800
- C:\Windows\System\FSQkxOJ.exe
  C:\Windows\System\FSQkxOJ.exe
  2⤵
  PID:6820
- C:\Windows\System\FlJqajO.exe
  C:\Windows\System\FlJqajO.exe
  2⤵
  PID:6852
- C:\Windows\System\GomURsR.exe
  C:\Windows\System\GomURsR.exe
  2⤵
  PID:6868
- C:\Windows\System\KvhzXpQ.exe
  C:\Windows\System\KvhzXpQ.exe
  2⤵
  PID:6892
- C:\Windows\System\OSfEDHu.exe
  C:\Windows\System\OSfEDHu.exe
  2⤵
  PID:6916
- C:\Windows\System\BvIBgDm.exe
  C:\Windows\System\BvIBgDm.exe
  2⤵
  PID:6936
- C:\Windows\System\FvHmzgD.exe
  C:\Windows\System\FvHmzgD.exe
  2⤵
  PID:6956
- C:\Windows\System\eoVcpLz.exe
  C:\Windows\System\eoVcpLz.exe
  2⤵
  PID:6976
- C:\Windows\System\vEWGXeR.exe
  C:\Windows\System\vEWGXeR.exe
  2⤵
  PID:6996
- C:\Windows\System\wblXWvo.exe
  C:\Windows\System\wblXWvo.exe
  2⤵
  PID:7020
- C:\Windows\System\iOwdwdX.exe
  C:\Windows\System\iOwdwdX.exe
  2⤵
  PID:7040
- C:\Windows\System\uRlpzEQ.exe
  C:\Windows\System\uRlpzEQ.exe
  2⤵
  PID:7060
- C:\Windows\System\NSurlcM.exe
  C:\Windows\System\NSurlcM.exe
  2⤵
  PID:7084
- C:\Windows\System\tCVBecv.exe
  C:\Windows\System\tCVBecv.exe
  2⤵
  PID:7108
- C:\Windows\System\YnOQKFV.exe
  C:\Windows\System\YnOQKFV.exe
  2⤵
  PID:3752
- C:\Windows\System\BgRBRGN.exe
  C:\Windows\System\BgRBRGN.exe
  2⤵
  PID:1116
- C:\Windows\System\yFSlQaY.exe
  C:\Windows\System\yFSlQaY.exe
  2⤵
  PID:2456
- C:\Windows\System\TaJWSQI.exe
  C:\Windows\System\TaJWSQI.exe
  2⤵
  PID:1472
- C:\Windows\System\bRciigo.exe
  C:\Windows\System\bRciigo.exe
  2⤵
  PID:4972
- C:\Windows\System\FnnTOOn.exe
  C:\Windows\System\FnnTOOn.exe
  2⤵
  PID:4704
- C:\Windows\System\GuZkxwM.exe
  C:\Windows\System\GuZkxwM.exe
  2⤵
  PID:5156
- C:\Windows\System\LAEOoXr.exe
  C:\Windows\System\LAEOoXr.exe
  2⤵
  PID:5192
- C:\Windows\System\CvQvaDa.exe
  C:\Windows\System\CvQvaDa.exe
  2⤵
  PID:4364
- C:\Windows\System\StiOREq.exe
  C:\Windows\System\StiOREq.exe
  2⤵
  PID:6228
- C:\Windows\System\MGACPdK.exe
  C:\Windows\System\MGACPdK.exe
  2⤵
  PID:5320
- C:\Windows\System\OplWeXY.exe
  C:\Windows\System\OplWeXY.exe
  2⤵
  PID:6292
- C:\Windows\System\jeiyNFZ.exe
  C:\Windows\System\jeiyNFZ.exe
  2⤵
  PID:5352
- C:\Windows\System\fUTHSCI.exe
  C:\Windows\System\fUTHSCI.exe
  2⤵
  PID:2636
- C:\Windows\System\VlTbAIJ.exe
  C:\Windows\System\VlTbAIJ.exe
  2⤵
  PID:5640
- C:\Windows\System\wmUymYw.exe
  C:\Windows\System\wmUymYw.exe
  2⤵
  PID:5816
- C:\Windows\System\wXwUsZQ.exe
  C:\Windows\System\wXwUsZQ.exe
  2⤵
  PID:5860
- C:\Windows\System\dqTGxjR.exe
  C:\Windows\System\dqTGxjR.exe
  2⤵
  PID:5888
- C:\Windows\System\vBgBCWT.exe
  C:\Windows\System\vBgBCWT.exe
  2⤵
  PID:5932
- C:\Windows\System\rhBaNon.exe
  C:\Windows\System\rhBaNon.exe
  2⤵
  PID:5956
- C:\Windows\System\obkgZHD.exe
  C:\Windows\System\obkgZHD.exe
  2⤵
  PID:5984
- C:\Windows\System\cyaLAbH.exe
  C:\Windows\System\cyaLAbH.exe
  2⤵
  PID:6020
- C:\Windows\System\RGYSSeh.exe
  C:\Windows\System\RGYSSeh.exe
  2⤵
  PID:6064
- C:\Windows\System\QsncOqP.exe
  C:\Windows\System\QsncOqP.exe
  2⤵
  PID:6132
- C:\Windows\System\CAfETJq.exe
  C:\Windows\System\CAfETJq.exe
  2⤵
  PID:6296
- C:\Windows\System\AkBdNKX.exe
  C:\Windows\System\AkBdNKX.exe
  2⤵
  PID:4504
- C:\Windows\System\cLYHnMX.exe
  C:\Windows\System\cLYHnMX.exe
  2⤵
  PID:3096
- C:\Windows\System\gszWSCg.exe
  C:\Windows\System\gszWSCg.exe
  2⤵
  PID:6208
- C:\Windows\System\STRnxJZ.exe
  C:\Windows\System\STRnxJZ.exe
  2⤵
  PID:6392
- C:\Windows\System\gkUpHJe.exe
  C:\Windows\System\gkUpHJe.exe
  2⤵
  PID:6456
- C:\Windows\System\aRTrlOD.exe
  C:\Windows\System\aRTrlOD.exe
  2⤵
  PID:6520
- C:\Windows\System\kBBaVTy.exe
  C:\Windows\System\kBBaVTy.exe
  2⤵
  PID:6724
- C:\Windows\System\xXIXycU.exe
  C:\Windows\System\xXIXycU.exe
  2⤵
  PID:6972
- C:\Windows\System\tjkpeMq.exe
  C:\Windows\System\tjkpeMq.exe
  2⤵
  PID:7096
- C:\Windows\System\XdCUgqK.exe
  C:\Windows\System\XdCUgqK.exe
  2⤵
  PID:4864
- C:\Windows\System\idONzRa.exe
  C:\Windows\System\idONzRa.exe
  2⤵
  PID:6596
- C:\Windows\System\KBnrVYb.exe
  C:\Windows\System\KBnrVYb.exe
  2⤵
  PID:6708
- C:\Windows\System\iUnIzPR.exe
  C:\Windows\System\iUnIzPR.exe
  2⤵
  PID:6756
- C:\Windows\System\zYvsIVM.exe
  C:\Windows\System\zYvsIVM.exe
  2⤵
  PID:6812
- C:\Windows\System\xwIOOEh.exe
  C:\Windows\System\xwIOOEh.exe
  2⤵
  PID:6884
- C:\Windows\System\hFUjJuA.exe
  C:\Windows\System\hFUjJuA.exe
  2⤵
  PID:6948
- C:\Windows\System\FJTLMgW.exe
  C:\Windows\System\FJTLMgW.exe
  2⤵
  PID:6988
- C:\Windows\System\rdXZbzQ.exe
  C:\Windows\System\rdXZbzQ.exe
  2⤵
  PID:7052
- C:\Windows\System\oQmSEFh.exe
  C:\Windows\System\oQmSEFh.exe
  2⤵
  PID:7092
- C:\Windows\System\XJIevoL.exe
  C:\Windows\System\XJIevoL.exe
  2⤵
  PID:7180
- C:\Windows\System\yDVKZnZ.exe
  C:\Windows\System\yDVKZnZ.exe
  2⤵
  PID:7204
- C:\Windows\System\fustqUQ.exe
  C:\Windows\System\fustqUQ.exe
  2⤵
  PID:7220
- C:\Windows\System\xtbQcnb.exe
  C:\Windows\System\xtbQcnb.exe
  2⤵
  PID:7248
- C:\Windows\System\hIUluUU.exe
  C:\Windows\System\hIUluUU.exe
  2⤵
  PID:7268
- C:\Windows\System\QKMHxmx.exe
  C:\Windows\System\QKMHxmx.exe
  2⤵
  PID:7288
- C:\Windows\System\jTxcidx.exe
  C:\Windows\System\jTxcidx.exe
  2⤵
  PID:7308
- C:\Windows\System\BQteKOj.exe
  C:\Windows\System\BQteKOj.exe
  2⤵
  PID:7328
- C:\Windows\System\iPDgljG.exe
  C:\Windows\System\iPDgljG.exe
  2⤵
  PID:7352
- C:\Windows\System\icBrLWe.exe
  C:\Windows\System\icBrLWe.exe
  2⤵
  PID:7372
- C:\Windows\System\FXhhdjv.exe
  C:\Windows\System\FXhhdjv.exe
  2⤵
  PID:7392
- C:\Windows\System\eCBwqCj.exe
  C:\Windows\System\eCBwqCj.exe
  2⤵
  PID:7420
- C:\Windows\System\KSSCEkb.exe
  C:\Windows\System\KSSCEkb.exe
  2⤵
  PID:7440
- C:\Windows\System\XJCGAuC.exe
  C:\Windows\System\XJCGAuC.exe
  2⤵
  PID:7456
- C:\Windows\System\TXVAPjm.exe
  C:\Windows\System\TXVAPjm.exe
  2⤵
  PID:7480
- C:\Windows\System\NuPJEDD.exe
  C:\Windows\System\NuPJEDD.exe
  2⤵
  PID:7500
- C:\Windows\System\WzupxqF.exe
  C:\Windows\System\WzupxqF.exe
  2⤵
  PID:7520
- C:\Windows\System\mOZEcBd.exe
  C:\Windows\System\mOZEcBd.exe
  2⤵
  PID:7544
- C:\Windows\System\JJzMZeg.exe
  C:\Windows\System\JJzMZeg.exe
  2⤵
  PID:7568
- C:\Windows\System\UTIlkqZ.exe
  C:\Windows\System\UTIlkqZ.exe
  2⤵
  PID:7588
- C:\Windows\System\kXVxLTo.exe
  C:\Windows\System\kXVxLTo.exe
  2⤵
  PID:7612
- C:\Windows\System\NBPRAeT.exe
  C:\Windows\System\NBPRAeT.exe
  2⤵
  PID:7632
- C:\Windows\System\XDiQGde.exe
  C:\Windows\System\XDiQGde.exe
  2⤵
  PID:7656
- C:\Windows\System\LieCclg.exe
  C:\Windows\System\LieCclg.exe
  2⤵
  PID:7680
- C:\Windows\System\zEJKJrg.exe
  C:\Windows\System\zEJKJrg.exe
  2⤵
  PID:7700
- C:\Windows\System\jLAaGDd.exe
  C:\Windows\System\jLAaGDd.exe
  2⤵
  PID:7728
- C:\Windows\System\rdNGkKi.exe
  C:\Windows\System\rdNGkKi.exe
  2⤵
  PID:7752
- C:\Windows\System\QmWbhGI.exe
  C:\Windows\System\QmWbhGI.exe
  2⤵
  PID:7772
- C:\Windows\System\RmmSkoT.exe
  C:\Windows\System\RmmSkoT.exe
  2⤵
  PID:8124
- C:\Windows\System\nFEujnP.exe
  C:\Windows\System\nFEujnP.exe
  2⤵
  PID:8140
- C:\Windows\System\PKvIqgZ.exe
  C:\Windows\System\PKvIqgZ.exe
  2⤵
  PID:8156
- C:\Windows\System\ximpIio.exe
  C:\Windows\System\ximpIio.exe
  2⤵
  PID:8180
- C:\Windows\System\JpIQXep.exe
  C:\Windows\System\JpIQXep.exe
  2⤵
  PID:8200
- C:\Windows\System\MsvAeyQ.exe
  C:\Windows\System\MsvAeyQ.exe
  2⤵
  PID:8216
- C:\Windows\System\sjXCyJO.exe
  C:\Windows\System\sjXCyJO.exe
  2⤵
  PID:8240
- C:\Windows\System\MvZpcqP.exe
  C:\Windows\System\MvZpcqP.exe
  2⤵
  PID:8260
- C:\Windows\System\CHhzeiX.exe
  C:\Windows\System\CHhzeiX.exe
  2⤵
  PID:8280
- C:\Windows\System\wvERCzh.exe
  C:\Windows\System\wvERCzh.exe
  2⤵
  PID:8296
- C:\Windows\System\YJEqXAn.exe
  C:\Windows\System\YJEqXAn.exe
  2⤵
  PID:8316
- C:\Windows\System\rnBppMF.exe
  C:\Windows\System\rnBppMF.exe
  2⤵
  PID:8336
- C:\Windows\System\SHzgYEk.exe
  C:\Windows\System\SHzgYEk.exe
  2⤵
  PID:8356
- C:\Windows\System\usaWDRf.exe
  C:\Windows\System\usaWDRf.exe
  2⤵
  PID:8372
- C:\Windows\System\SMgXAli.exe
  C:\Windows\System\SMgXAli.exe
  2⤵
  PID:8396
- C:\Windows\System\LKjlsNJ.exe
  C:\Windows\System\LKjlsNJ.exe
  2⤵
  PID:8412
- C:\Windows\System\ymGlDdn.exe
  C:\Windows\System\ymGlDdn.exe
  2⤵
  PID:8432
- C:\Windows\System\kjVCUkF.exe
  C:\Windows\System\kjVCUkF.exe
  2⤵
  PID:8452
- C:\Windows\System\BzAcZfD.exe
  C:\Windows\System\BzAcZfD.exe
  2⤵
  PID:8472
- C:\Windows\System\TNkUepf.exe
  C:\Windows\System\TNkUepf.exe
  2⤵
  PID:8492
- C:\Windows\System\pjfGvPs.exe
  C:\Windows\System\pjfGvPs.exe
  2⤵
  PID:8516
- C:\Windows\System\PATydtg.exe
  C:\Windows\System\PATydtg.exe
  2⤵
  PID:8532
- C:\Windows\System\KDxZWMF.exe
  C:\Windows\System\KDxZWMF.exe
  2⤵
  PID:8556
- C:\Windows\System\YLpGFXD.exe
  C:\Windows\System\YLpGFXD.exe
  2⤵
  PID:8572
- C:\Windows\System\aUtrGrN.exe
  C:\Windows\System\aUtrGrN.exe
  2⤵
  PID:8588
- C:\Windows\System\lcCQqFu.exe
  C:\Windows\System\lcCQqFu.exe
  2⤵
  PID:8604
- C:\Windows\System\iuGRnCI.exe
  C:\Windows\System\iuGRnCI.exe
  2⤵
  PID:8624
- C:\Windows\System\vBnojfc.exe
  C:\Windows\System\vBnojfc.exe
  2⤵
  PID:8648
- C:\Windows\System\cxTWraz.exe
  C:\Windows\System\cxTWraz.exe
  2⤵
  PID:8664
- C:\Windows\System\QVONxte.exe
  C:\Windows\System\QVONxte.exe
  2⤵
  PID:8696
- C:\Windows\System\nIGGVSu.exe
  C:\Windows\System\nIGGVSu.exe
  2⤵
  PID:8712
- C:\Windows\System\RBFoDTy.exe
  C:\Windows\System\RBFoDTy.exe
  2⤵
  PID:8828
- C:\Windows\System\TLWQvDC.exe
  C:\Windows\System\TLWQvDC.exe
  2⤵
  PID:8848
- C:\Windows\System\lEoYliX.exe
  C:\Windows\System\lEoYliX.exe
  2⤵
  PID:8872
- C:\Windows\System\PeECoYq.exe
  C:\Windows\System\PeECoYq.exe
  2⤵
  PID:8896
- C:\Windows\System\JPpBiuB.exe
  C:\Windows\System\JPpBiuB.exe
  2⤵
  PID:8912
- C:\Windows\System\lUCPOyf.exe
  C:\Windows\System\lUCPOyf.exe
  2⤵
  PID:8928
- C:\Windows\System\RGtQqCC.exe
  C:\Windows\System\RGtQqCC.exe
  2⤵
  PID:8944
- C:\Windows\System\KjRBFOX.exe
  C:\Windows\System\KjRBFOX.exe
  2⤵
  PID:8968
- C:\Windows\System\uyVKAWo.exe
  C:\Windows\System\uyVKAWo.exe
  2⤵
  PID:8988
- C:\Windows\System\cMLbZzC.exe
  C:\Windows\System\cMLbZzC.exe
  2⤵
  PID:9008
- C:\Windows\System\bySfbCa.exe
  C:\Windows\System\bySfbCa.exe
  2⤵
  PID:9032
- C:\Windows\System\PaFCQTm.exe
  C:\Windows\System\PaFCQTm.exe
  2⤵
  PID:9056
- C:\Windows\System\xXhjDHr.exe
  C:\Windows\System\xXhjDHr.exe
  2⤵
  PID:9076
- C:\Windows\System\qtpNHba.exe
  C:\Windows\System\qtpNHba.exe
  2⤵
  PID:9100
- C:\Windows\System\QQfZney.exe
  C:\Windows\System\QQfZney.exe
  2⤵
  PID:9116
- C:\Windows\System\szoeOIo.exe
  C:\Windows\System\szoeOIo.exe
  2⤵
  PID:9140
- C:\Windows\System\JghGMZx.exe
  C:\Windows\System\JghGMZx.exe
  2⤵
  PID:9164
- C:\Windows\System\tjthJEV.exe
  C:\Windows\System\tjthJEV.exe
  2⤵
  PID:9180
- C:\Windows\System\ZFggWLI.exe
  C:\Windows\System\ZFggWLI.exe
  2⤵
  PID:9204
- C:\Windows\System\tATTcst.exe
  C:\Windows\System\tATTcst.exe
  2⤵
  PID:3956
- C:\Windows\System\aZvIsRi.exe
  C:\Windows\System\aZvIsRi.exe
  2⤵
  PID:612
- C:\Windows\System\tvZeLZx.exe
  C:\Windows\System\tvZeLZx.exe
  2⤵
  PID:2024
- C:\Windows\System\dRrWCFb.exe
  C:\Windows\System\dRrWCFb.exe
  2⤵
  PID:5224
- C:\Windows\System\JLVQDBL.exe
  C:\Windows\System\JLVQDBL.exe
  2⤵
  PID:6088
- C:\Windows\System\cyeZZfZ.exe
  C:\Windows\System\cyeZZfZ.exe
  2⤵
  PID:3040
- C:\Windows\System\XlXFxcM.exe
  C:\Windows\System\XlXFxcM.exe
  2⤵
  PID:1588
- C:\Windows\System\ZTCSKwo.exe
  C:\Windows\System\ZTCSKwo.exe
  2⤵
  PID:5412
- C:\Windows\System\FKhyxRE.exe
  C:\Windows\System\FKhyxRE.exe
  2⤵
  PID:6204
- C:\Windows\System\MxnrhzM.exe
  C:\Windows\System\MxnrhzM.exe
  2⤵
  PID:6412
- C:\Windows\System\DiEGeQP.exe
  C:\Windows\System\DiEGeQP.exe
  2⤵
  PID:6476
- C:\Windows\System\ieUnXvx.exe
  C:\Windows\System\ieUnXvx.exe
  2⤵
  PID:6568
- C:\Windows\System\dXrtVys.exe
  C:\Windows\System\dXrtVys.exe
  2⤵
  PID:6876
- C:\Windows\System\LeuveMt.exe
  C:\Windows\System\LeuveMt.exe
  2⤵
  PID:2580
- C:\Windows\System\XjnomNK.exe
  C:\Windows\System\XjnomNK.exe
  2⤵
  PID:6736
- C:\Windows\System\lpfHQAo.exe
  C:\Windows\System\lpfHQAo.exe
  2⤵
  PID:6860
- C:\Windows\System\IlBJhbu.exe
  C:\Windows\System\IlBJhbu.exe
  2⤵
  PID:6964
- C:\Windows\System\Ebkwpio.exe
  C:\Windows\System\Ebkwpio.exe
  2⤵
  PID:7080
- C:\Windows\System\HlyKTMP.exe
  C:\Windows\System\HlyKTMP.exe
  2⤵
  PID:7200
- C:\Windows\System\KBbQjlG.exe
  C:\Windows\System\KBbQjlG.exe
  2⤵
  PID:7244
- C:\Windows\System\EQUsmAP.exe
  C:\Windows\System\EQUsmAP.exe
  2⤵
  PID:7284
- C:\Windows\System\Pqlzpbb.exe
  C:\Windows\System\Pqlzpbb.exe
  2⤵
  PID:7336
- C:\Windows\System\vIxBkQU.exe
  C:\Windows\System\vIxBkQU.exe
  2⤵
  PID:7384
- C:\Windows\System\rYODtwE.exe
  C:\Windows\System\rYODtwE.exe
  2⤵
  PID:7428
- C:\Windows\System\LDAuQet.exe
  C:\Windows\System\LDAuQet.exe
  2⤵
  PID:7464
- C:\Windows\System\bGdYwuf.exe
  C:\Windows\System\bGdYwuf.exe
  2⤵
  PID:7512
- C:\Windows\System\QvMtlPD.exe
  C:\Windows\System\QvMtlPD.exe
  2⤵
  PID:7556
- C:\Windows\System\pkaUtfh.exe
  C:\Windows\System\pkaUtfh.exe
  2⤵
  PID:7584
- C:\Windows\System\MHiJnle.exe
  C:\Windows\System\MHiJnle.exe
  2⤵
  PID:7640
- C:\Windows\System\JCWkqEL.exe
  C:\Windows\System\JCWkqEL.exe
  2⤵
  PID:7692
- C:\Windows\System\MlQdEgd.exe
  C:\Windows\System\MlQdEgd.exe
  2⤵
  PID:7740
- C:\Windows\System\EhmdUTu.exe
  C:\Windows\System\EhmdUTu.exe
  2⤵
  PID:7800
- C:\Windows\System\IJMzwVM.exe
  C:\Windows\System\IJMzwVM.exe
  2⤵
  PID:9228
- C:\Windows\System\uNSDJSR.exe
  C:\Windows\System\uNSDJSR.exe
  2⤵
  PID:9248
- C:\Windows\System\lPbFKva.exe
  C:\Windows\System\lPbFKva.exe
  2⤵
  PID:9268
- C:\Windows\System\UyhJzdH.exe
  C:\Windows\System\UyhJzdH.exe
  2⤵
  PID:9340
- C:\Windows\System\ytnUBwh.exe
  C:\Windows\System\ytnUBwh.exe
  2⤵
  PID:9368
- C:\Windows\System\azVVcma.exe
  C:\Windows\System\azVVcma.exe
  2⤵
  PID:9388
- C:\Windows\System\yzAWNik.exe
  C:\Windows\System\yzAWNik.exe
  2⤵
  PID:9420
- C:\Windows\System\JSarIUN.exe
  C:\Windows\System\JSarIUN.exe
  2⤵
  PID:9440
- C:\Windows\System\sgwkhlO.exe
  C:\Windows\System\sgwkhlO.exe
  2⤵
  PID:9468
- C:\Windows\System\zMeXtat.exe
  C:\Windows\System\zMeXtat.exe
  2⤵
  PID:9492
- C:\Windows\System\WdgDSVh.exe
  C:\Windows\System\WdgDSVh.exe
  2⤵
  PID:9528
- C:\Windows\System\phDSsnQ.exe
  C:\Windows\System\phDSsnQ.exe
  2⤵
  PID:9552
- C:\Windows\System\ChWdxZH.exe
  C:\Windows\System\ChWdxZH.exe
  2⤵
  PID:9576
- C:\Windows\System\rTlwEAI.exe
  C:\Windows\System\rTlwEAI.exe
  2⤵
  PID:9600
- C:\Windows\System\MXvMZvJ.exe
  C:\Windows\System\MXvMZvJ.exe
  2⤵
  PID:9624
- C:\Windows\System\oeVhIqf.exe
  C:\Windows\System\oeVhIqf.exe
  2⤵
  PID:9644
- C:\Windows\System\WVzioYF.exe
  C:\Windows\System\WVzioYF.exe
  2⤵
  PID:9664
- C:\Windows\System\iJuJFtc.exe
  C:\Windows\System\iJuJFtc.exe
  2⤵
  PID:9688
- C:\Windows\System\PrdMswn.exe
  C:\Windows\System\PrdMswn.exe
  2⤵
  PID:9712
- C:\Windows\System\naAVmNk.exe
  C:\Windows\System\naAVmNk.exe
  2⤵
  PID:9732
- C:\Windows\System\xETbWCt.exe
  C:\Windows\System\xETbWCt.exe
  2⤵
  PID:9756
- C:\Windows\System\WKfUTBa.exe
  C:\Windows\System\WKfUTBa.exe
  2⤵
  PID:9780
- C:\Windows\System\KLUlpDt.exe
  C:\Windows\System\KLUlpDt.exe
  2⤵
  PID:9800
- C:\Windows\System\qjhZjUb.exe
  C:\Windows\System\qjhZjUb.exe
  2⤵
  PID:9820
- C:\Windows\System\tngbpxY.exe
  C:\Windows\System\tngbpxY.exe
  2⤵
  PID:9844
- C:\Windows\System\FpucPmi.exe
  C:\Windows\System\FpucPmi.exe
  2⤵
  PID:9864
- C:\Windows\System\HvwWDBx.exe
  C:\Windows\System\HvwWDBx.exe
  2⤵
  PID:9880
- C:\Windows\System\Ucpmwie.exe
  C:\Windows\System\Ucpmwie.exe
  2⤵
  PID:9920
- C:\Windows\System\YfIQgzE.exe
  C:\Windows\System\YfIQgzE.exe
  2⤵
  PID:9948
- C:\Windows\System\BqQXyco.exe
  C:\Windows\System\BqQXyco.exe
  2⤵
  PID:9976
- C:\Windows\System\fFfqiHz.exe
  C:\Windows\System\fFfqiHz.exe
  2⤵
  PID:9996
- C:\Windows\System\HpEGCVx.exe
  C:\Windows\System\HpEGCVx.exe
  2⤵
  PID:10024
- C:\Windows\System\huUqZsw.exe
  C:\Windows\System\huUqZsw.exe
  2⤵
  PID:10048
- C:\Windows\System\jzYDuco.exe
  C:\Windows\System\jzYDuco.exe
  2⤵
  PID:10068
- C:\Windows\System\FzabgBR.exe
  C:\Windows\System\FzabgBR.exe
  2⤵
  PID:10092
- C:\Windows\System\BaRTgRn.exe
  C:\Windows\System\BaRTgRn.exe
  2⤵
  PID:10116
- C:\Windows\System\ltwqQug.exe
  C:\Windows\System\ltwqQug.exe
  2⤵
  PID:10140
- C:\Windows\System\jrYXbge.exe
  C:\Windows\System\jrYXbge.exe
  2⤵
  PID:10160
- C:\Windows\System\wBBHjly.exe
  C:\Windows\System\wBBHjly.exe
  2⤵
  PID:10180
- C:\Windows\System\xkeLBcd.exe
  C:\Windows\System\xkeLBcd.exe
  2⤵
  PID:10204
- C:\Windows\System\mjjnLUz.exe
  C:\Windows\System\mjjnLUz.exe
  2⤵
  PID:10228
- C:\Windows\System\VAaIZLb.exe
  C:\Windows\System\VAaIZLb.exe
  2⤵
  PID:8132
- C:\Windows\System\zEPKUaV.exe
  C:\Windows\System\zEPKUaV.exe
  2⤵
  PID:8172
- C:\Windows\System\wSHGwmt.exe
  C:\Windows\System\wSHGwmt.exe
  2⤵
  PID:8212
- C:\Windows\System\qBhEcrs.exe
  C:\Windows\System\qBhEcrs.exe
  2⤵
  PID:8252
- C:\Windows\System\djiJflM.exe
  C:\Windows\System\djiJflM.exe
  2⤵
  PID:8304
- C:\Windows\System\HWcJQVu.exe
  C:\Windows\System\HWcJQVu.exe
  2⤵
  PID:8328
- C:\Windows\System\DZrxerM.exe
  C:\Windows\System\DZrxerM.exe
  2⤵
  PID:8364
- C:\Windows\System\YgqEzNw.exe
  C:\Windows\System\YgqEzNw.exe
  2⤵
  PID:8404
- C:\Windows\System\fvfxnfu.exe
  C:\Windows\System\fvfxnfu.exe
  2⤵
  PID:8444
- C:\Windows\System\CweGxDQ.exe
  C:\Windows\System\CweGxDQ.exe
  2⤵
  PID:8480
- C:\Windows\System\zAhOMMF.exe
  C:\Windows\System\zAhOMMF.exe
  2⤵
  PID:8544
- C:\Windows\System\bdGcAUD.exe
  C:\Windows\System\bdGcAUD.exe
  2⤵
  PID:8596
- C:\Windows\System\TqgMPMY.exe
  C:\Windows\System\TqgMPMY.exe
  2⤵
  PID:8640
- C:\Windows\System\BrkWCAt.exe
  C:\Windows\System\BrkWCAt.exe
  2⤵
  PID:8680
- C:\Windows\System\ywhbGzz.exe
  C:\Windows\System\ywhbGzz.exe
  2⤵
  PID:8724
- C:\Windows\System\suisWkH.exe
  C:\Windows\System\suisWkH.exe
  2⤵
  PID:6928
- C:\Windows\System\PAfnUaP.exe
  C:\Windows\System\PAfnUaP.exe
  2⤵
  PID:7188
- C:\Windows\System\iLCLUIe.exe
  C:\Windows\System\iLCLUIe.exe
  2⤵
  PID:7236
- C:\Windows\System\ONxsMhA.exe
  C:\Windows\System\ONxsMhA.exe
  2⤵
  PID:7324
- C:\Windows\System\ZBMbJDV.exe
  C:\Windows\System\ZBMbJDV.exe
  2⤵
  PID:7400
- C:\Windows\System\VgtOAuv.exe
  C:\Windows\System\VgtOAuv.exe
  2⤵
  PID:7476
- C:\Windows\System\RPirKUI.exe
  C:\Windows\System\RPirKUI.exe
  2⤵
  PID:7604
- C:\Windows\System\vPwQroj.exe
  C:\Windows\System\vPwQroj.exe
  2⤵
  PID:7736
- C:\Windows\System\BoDdfIq.exe
  C:\Windows\System\BoDdfIq.exe
  2⤵
  PID:6148
- C:\Windows\System\xWmrHQG.exe
  C:\Windows\System\xWmrHQG.exe
  2⤵
  PID:8776
- C:\Windows\System\kvwMgoD.exe
  C:\Windows\System\kvwMgoD.exe
  2⤵
  PID:8824
- C:\Windows\System\bFSfVtD.exe
  C:\Windows\System\bFSfVtD.exe
  2⤵
  PID:8864
- C:\Windows\System\CzrAjqZ.exe
  C:\Windows\System\CzrAjqZ.exe
  2⤵
  PID:8920
- C:\Windows\System\ehLaglh.exe
  C:\Windows\System\ehLaglh.exe
  2⤵
  PID:8960
- C:\Windows\System\orXQdFk.exe
  C:\Windows\System\orXQdFk.exe
  2⤵
  PID:8984
- C:\Windows\System\ZHqWwUk.exe
  C:\Windows\System\ZHqWwUk.exe
  2⤵
  PID:9028
- C:\Windows\System\TIhSgoy.exe
  C:\Windows\System\TIhSgoy.exe
  2⤵
  PID:9068
- C:\Windows\System\QPtPJHC.exe
  C:\Windows\System\QPtPJHC.exe
  2⤵
  PID:7780
- C:\Windows\System\AdtskOq.exe
  C:\Windows\System\AdtskOq.exe
  2⤵
  PID:9652
- C:\Windows\System\MuEkWdr.exe
  C:\Windows\System\MuEkWdr.exe
  2⤵
  PID:9740
- C:\Windows\System\KwHxoFz.exe
  C:\Windows\System\KwHxoFz.exe
  2⤵
  PID:9792
- C:\Windows\System\wrZgWGT.exe
  C:\Windows\System\wrZgWGT.exe
  2⤵
  PID:6016
- C:\Windows\System\XULSrjG.exe
  C:\Windows\System\XULSrjG.exe
  2⤵
  PID:4460
- C:\Windows\System\YQvzhny.exe
  C:\Windows\System\YQvzhny.exe
  2⤵
  PID:6184
- C:\Windows\System\rKuIdMa.exe
  C:\Windows\System\rKuIdMa.exe
  2⤵
  PID:6676
- C:\Windows\System\DvPOXVu.exe
  C:\Windows\System\DvPOXVu.exe
  2⤵
  PID:7072
- C:\Windows\System\KClJjVq.exe
  C:\Windows\System\KClJjVq.exe
  2⤵
  PID:6180
- C:\Windows\System\HsWAnIU.exe
  C:\Windows\System\HsWAnIU.exe
  2⤵
  PID:6904
- C:\Windows\System\kJiwFLv.exe
  C:\Windows\System\kJiwFLv.exe
  2⤵
  PID:9592
- C:\Windows\System\DzLMncW.exe
  C:\Windows\System\DzLMncW.exe
  2⤵
  PID:1764
- C:\Windows\System\lbNBxNJ.exe
  C:\Windows\System\lbNBxNJ.exe
  2⤵
  PID:9960
- C:\Windows\System\NWArdQz.exe
  C:\Windows\System\NWArdQz.exe
  2⤵
  PID:9816
- C:\Windows\System\lVWbDbH.exe
  C:\Windows\System\lVWbDbH.exe
  2⤵
  PID:10256
- C:\Windows\System\dWNCwvU.exe
  C:\Windows\System\dWNCwvU.exe
  2⤵
  PID:10272
- C:\Windows\System\rQssJgb.exe
  C:\Windows\System\rQssJgb.exe
  2⤵
  PID:10292
- C:\Windows\System\nSNupJj.exe
  C:\Windows\System\nSNupJj.exe
  2⤵
  PID:10316
- C:\Windows\System\EfqXtQD.exe
  C:\Windows\System\EfqXtQD.exe
  2⤵
  PID:10340
- C:\Windows\System\EHGOgON.exe
  C:\Windows\System\EHGOgON.exe
  2⤵
  PID:10360
- C:\Windows\System\yZMebur.exe
  C:\Windows\System\yZMebur.exe
  2⤵
  PID:10384
- C:\Windows\System\RVRZEtR.exe
  C:\Windows\System\RVRZEtR.exe
  2⤵
  PID:10404
- C:\Windows\System\nmFjOEp.exe
  C:\Windows\System\nmFjOEp.exe
  2⤵
  PID:10432
- C:\Windows\System\YFBzCxU.exe
  C:\Windows\System\YFBzCxU.exe
  2⤵
  PID:10452
- C:\Windows\System\kLTRLDI.exe
  C:\Windows\System\kLTRLDI.exe
  2⤵
  PID:10480
- C:\Windows\System\vUeaGhM.exe
  C:\Windows\System\vUeaGhM.exe
  2⤵
  PID:10504
- C:\Windows\System\WSQDXEi.exe
  C:\Windows\System\WSQDXEi.exe
  2⤵
  PID:10524
- C:\Windows\System\EVgnYss.exe
  C:\Windows\System\EVgnYss.exe
  2⤵
  PID:10548
- C:\Windows\System\rOlABSY.exe
  C:\Windows\System\rOlABSY.exe
  2⤵
  PID:10568
- C:\Windows\System\NxfNWhJ.exe
  C:\Windows\System\NxfNWhJ.exe
  2⤵
  PID:10592
- C:\Windows\System\oyUOOqU.exe
  C:\Windows\System\oyUOOqU.exe
  2⤵
  PID:10616
- C:\Windows\System\yrKaylB.exe
  C:\Windows\System\yrKaylB.exe
  2⤵
  PID:10632
- C:\Windows\System\sVTHJmK.exe
  C:\Windows\System\sVTHJmK.exe
  2⤵
  PID:10656
- C:\Windows\System\okeQwmH.exe
  C:\Windows\System\okeQwmH.exe
  2⤵
  PID:10680
- C:\Windows\System\cHBkhSY.exe
  C:\Windows\System\cHBkhSY.exe
  2⤵
  PID:10704
- C:\Windows\System\EelplWP.exe
  C:\Windows\System\EelplWP.exe
  2⤵
  PID:10744
- C:\Windows\System\pyYdWFm.exe
  C:\Windows\System\pyYdWFm.exe
  2⤵
  PID:10760
- C:\Windows\System\ltobifT.exe
  C:\Windows\System\ltobifT.exe
  2⤵
  PID:10776
- C:\Windows\System\yGqmGHj.exe
  C:\Windows\System\yGqmGHj.exe
  2⤵
  PID:10796
- C:\Windows\System\yfbxEHU.exe
  C:\Windows\System\yfbxEHU.exe
  2⤵
  PID:10812
- C:\Windows\System\cevOCxt.exe
  C:\Windows\System\cevOCxt.exe
  2⤵
  PID:10828
- C:\Windows\System\WhDTVmt.exe
  C:\Windows\System\WhDTVmt.exe
  2⤵
  PID:10856
- C:\Windows\System\WBOoUKm.exe
  C:\Windows\System\WBOoUKm.exe
  2⤵
  PID:10880
- C:\Windows\System\GcyvkQq.exe
  C:\Windows\System\GcyvkQq.exe
  2⤵
  PID:10904
- C:\Windows\System\iwHaotg.exe
  C:\Windows\System\iwHaotg.exe
  2⤵
  PID:10928
- C:\Windows\System\GfKzcIQ.exe
  C:\Windows\System\GfKzcIQ.exe
  2⤵
  PID:10948
- C:\Windows\System\nLIRkej.exe
  C:\Windows\System\nLIRkej.exe
  2⤵
  PID:10972
- C:\Windows\System\Xdaknnn.exe
  C:\Windows\System\Xdaknnn.exe
  2⤵
  PID:10996
- C:\Windows\System\VqYVKms.exe
  C:\Windows\System\VqYVKms.exe
  2⤵
  PID:11024
- C:\Windows\System\mcUTPSE.exe
  C:\Windows\System\mcUTPSE.exe
  2⤵
  PID:11044
- C:\Windows\System\XacqQCs.exe
  C:\Windows\System\XacqQCs.exe
  2⤵
  PID:11064
- C:\Windows\System\HHDCnMg.exe
  C:\Windows\System\HHDCnMg.exe
  2⤵
  PID:11092
- C:\Windows\System\zFiQfOc.exe
  C:\Windows\System\zFiQfOc.exe
  2⤵
  PID:11112
- C:\Windows\System\nkXXAbP.exe
  C:\Windows\System\nkXXAbP.exe
  2⤵
  PID:11136
- C:\Windows\System\stBheNF.exe
  C:\Windows\System\stBheNF.exe
  2⤵
  PID:11168
- C:\Windows\System\sdSHSrS.exe
  C:\Windows\System\sdSHSrS.exe
  2⤵
  PID:11196
- C:\Windows\System\MnaMAKY.exe
  C:\Windows\System\MnaMAKY.exe
  2⤵
  PID:11224
- C:\Windows\System\VGHnbUV.exe
  C:\Windows\System\VGHnbUV.exe
  2⤵
  PID:11252
- C:\Windows\System\DYrMntn.exe
  C:\Windows\System\DYrMntn.exe
  2⤵
  PID:10100
- C:\Windows\System\kUBGYDd.exe
  C:\Windows\System\kUBGYDd.exe
  2⤵
  PID:8152
- C:\Windows\System\cyycxUh.exe
  C:\Windows\System\cyycxUh.exe
  2⤵
  PID:8256
- C:\Windows\System\ZTwjjyx.exe
  C:\Windows\System\ZTwjjyx.exe
  2⤵
  PID:8324
- C:\Windows\System\hBCbGHs.exe
  C:\Windows\System\hBCbGHs.exe
  2⤵
  PID:8420
- C:\Windows\System\xlFDHGR.exe
  C:\Windows\System\xlFDHGR.exe
  2⤵
  PID:8580
- C:\Windows\System\rYstgZb.exe
  C:\Windows\System\rYstgZb.exe
  2⤵
  PID:8720
- C:\Windows\System\ZAsOBub.exe
  C:\Windows\System\ZAsOBub.exe
  2⤵
  PID:9256
- C:\Windows\System\VsdRwWz.exe
  C:\Windows\System\VsdRwWz.exe
  2⤵
  PID:7412
- C:\Windows\System\yZXKHPA.exe
  C:\Windows\System\yZXKHPA.exe
  2⤵
  PID:7672
- C:\Windows\System\EEWmJjL.exe
  C:\Windows\System\EEWmJjL.exe
  2⤵
  PID:11272
- C:\Windows\System\QFPudmJ.exe
  C:\Windows\System\QFPudmJ.exe
  2⤵
  PID:11292
- C:\Windows\System\FMsyeQL.exe
  C:\Windows\System\FMsyeQL.exe
  2⤵
  PID:11316
- C:\Windows\System\QlyHLnT.exe
  C:\Windows\System\QlyHLnT.exe
  2⤵
  PID:11336
- C:\Windows\System\xEbsdTN.exe
  C:\Windows\System\xEbsdTN.exe
  2⤵
  PID:11356
- C:\Windows\System\dDrisOM.exe
  C:\Windows\System\dDrisOM.exe
  2⤵
  PID:11376
- C:\Windows\System\wpKLCND.exe
  C:\Windows\System\wpKLCND.exe
  2⤵
  PID:11400
- C:\Windows\System\LpjOzmn.exe
  C:\Windows\System\LpjOzmn.exe
  2⤵
  PID:11420
- C:\Windows\System\TcpwNka.exe
  C:\Windows\System\TcpwNka.exe
  2⤵
  PID:11440
- C:\Windows\System\AGxRNOC.exe
  C:\Windows\System\AGxRNOC.exe
  2⤵
  PID:11468
- C:\Windows\System\PMwFsxU.exe
  C:\Windows\System\PMwFsxU.exe
  2⤵
  PID:11488
- C:\Windows\System\pgkRoNl.exe
  C:\Windows\System\pgkRoNl.exe
  2⤵
  PID:11520
- C:\Windows\System\DJabuRg.exe
  C:\Windows\System\DJabuRg.exe
  2⤵
  PID:11548
- C:\Windows\System\nexQuIG.exe
  C:\Windows\System\nexQuIG.exe
  2⤵
  PID:11572
- C:\Windows\System\fCUeAqJ.exe
  C:\Windows\System\fCUeAqJ.exe
  2⤵
  PID:11588
- C:\Windows\System\KRHPnci.exe
  C:\Windows\System\KRHPnci.exe
  2⤵
  PID:11608
- C:\Windows\System\wvQowdk.exe
  C:\Windows\System\wvQowdk.exe
  2⤵
  PID:11628
- C:\Windows\System\TwrlEuE.exe
  C:\Windows\System\TwrlEuE.exe
  2⤵
  PID:11648
- C:\Windows\System\QYMnLUj.exe
  C:\Windows\System\QYMnLUj.exe
  2⤵
  PID:11668
- C:\Windows\System\hSsfxnk.exe
  C:\Windows\System\hSsfxnk.exe
  2⤵
  PID:11684
- C:\Windows\System\cCifomK.exe
  C:\Windows\System\cCifomK.exe
  2⤵
  PID:11700
- C:\Windows\System\YoiAwYi.exe
  C:\Windows\System\YoiAwYi.exe
  2⤵
  PID:11720
- C:\Windows\System\OPJWzUO.exe
  C:\Windows\System\OPJWzUO.exe
  2⤵
  PID:11740
- C:\Windows\System\bVfHyUK.exe
  C:\Windows\System\bVfHyUK.exe
  2⤵
  PID:11756
- C:\Windows\System\AxxovKs.exe
  C:\Windows\System\AxxovKs.exe
  2⤵
  PID:11780
- C:\Windows\System\qxNEGkM.exe
  C:\Windows\System\qxNEGkM.exe
  2⤵
  PID:11812
- C:\Windows\System\VyIcVtO.exe
  C:\Windows\System\VyIcVtO.exe
  2⤵
  PID:11832
- C:\Windows\System\TdTxdVK.exe
  C:\Windows\System\TdTxdVK.exe
  2⤵
  PID:11876
- C:\Windows\System\gSBNUzK.exe
  C:\Windows\System\gSBNUzK.exe
  2⤵
  PID:11892
- C:\Windows\System\mnXFtlO.exe
  C:\Windows\System\mnXFtlO.exe
  2⤵
  PID:11908
- C:\Windows\System\GANwAWf.exe
  C:\Windows\System\GANwAWf.exe
  2⤵
  PID:11924
- C:\Windows\System\CfHdSzE.exe
  C:\Windows\System\CfHdSzE.exe
  2⤵
  PID:11940
- C:\Windows\System\pcHnkFg.exe
  C:\Windows\System\pcHnkFg.exe
  2⤵
  PID:11956
- C:\Windows\System\jMmWpxB.exe
  C:\Windows\System\jMmWpxB.exe
  2⤵
  PID:11972
- C:\Windows\System\phaLNEj.exe
  C:\Windows\System\phaLNEj.exe
  2⤵
  PID:11988
- C:\Windows\System\eyEnzUY.exe
  C:\Windows\System\eyEnzUY.exe
  2⤵
  PID:12004
- C:\Windows\System\LIRzAkl.exe
  C:\Windows\System\LIRzAkl.exe
  2⤵
  PID:12024
- C:\Windows\System\jnDXagq.exe
  C:\Windows\System\jnDXagq.exe
  2⤵
  PID:12040
- C:\Windows\System\idednxI.exe
  C:\Windows\System\idednxI.exe
  2⤵
  PID:12056
- C:\Windows\System\GLDVuNZ.exe
  C:\Windows\System\GLDVuNZ.exe
  2⤵
  PID:12072
- C:\Windows\System\MOUsaRI.exe
  C:\Windows\System\MOUsaRI.exe
  2⤵
  PID:12104
- C:\Windows\System\hvnUuiN.exe
  C:\Windows\System\hvnUuiN.exe
  2⤵
  PID:12120
- C:\Windows\System\RJpAtLg.exe
  C:\Windows\System\RJpAtLg.exe
  2⤵
  PID:12136
- C:\Windows\System\HyrJcGi.exe
  C:\Windows\System\HyrJcGi.exe
  2⤵
  PID:12156
- C:\Windows\System\PhwQtWJ.exe
  C:\Windows\System\PhwQtWJ.exe
  2⤵
  PID:12180
- C:\Windows\System\TFxJZrR.exe
  C:\Windows\System\TFxJZrR.exe
  2⤵
  PID:12196
- C:\Windows\System\ZvxGWnl.exe
  C:\Windows\System\ZvxGWnl.exe
  2⤵
  PID:12220
- C:\Windows\System\TMgZZOW.exe
  C:\Windows\System\TMgZZOW.exe
  2⤵
  PID:12236
- C:\Windows\System\YKewkld.exe
  C:\Windows\System\YKewkld.exe
  2⤵
  PID:12256
- C:\Windows\System\UJMHXDG.exe
  C:\Windows\System\UJMHXDG.exe
  2⤵
  PID:12272
- C:\Windows\System\lTmVpTq.exe
  C:\Windows\System\lTmVpTq.exe
  2⤵
  PID:8792
- C:\Windows\System\AwovfxO.exe
  C:\Windows\System\AwovfxO.exe
  2⤵
  PID:8940
- C:\Windows\System\cuuRWTv.exe
  C:\Windows\System\cuuRWTv.exe
  2⤵
  PID:9332
- C:\Windows\System\IBqPtTX.exe
  C:\Windows\System\IBqPtTX.exe
  2⤵
  PID:9396
- C:\Windows\System\TBZZlKF.exe
  C:\Windows\System\TBZZlKF.exe
  2⤵
  PID:9460
- C:\Windows\System\kFiVTlX.exe
  C:\Windows\System\kFiVTlX.exe
  2⤵
  PID:9540
- C:\Windows\System\bZzLZGH.exe
  C:\Windows\System\bZzLZGH.exe
  2⤵
  PID:9612
- C:\Windows\System\qvXkbSJ.exe
  C:\Windows\System\qvXkbSJ.exe
  2⤵
  PID:9764
- C:\Windows\System\BcyyJhG.exe
  C:\Windows\System\BcyyJhG.exe
  2⤵
  PID:12312
- C:\Windows\System\uPvQIuo.exe
  C:\Windows\System\uPvQIuo.exe
  2⤵
  PID:12336
- C:\Windows\System\pbdrmNb.exe
  C:\Windows\System\pbdrmNb.exe
  2⤵
  PID:12360
- C:\Windows\System\cwjioWM.exe
  C:\Windows\System\cwjioWM.exe
  2⤵
  PID:12384
- C:\Windows\System\lDBFyWx.exe
  C:\Windows\System\lDBFyWx.exe
  2⤵
  PID:12420
- C:\Windows\System\DAlSFQx.exe
  C:\Windows\System\DAlSFQx.exe
  2⤵
  PID:12436
- C:\Windows\System\QgJCMWi.exe
  C:\Windows\System\QgJCMWi.exe
  2⤵
  PID:12472
- C:\Windows\System\hScJSDq.exe
  C:\Windows\System\hScJSDq.exe
  2⤵
  PID:12488
- C:\Windows\System\WQkhjbW.exe
  C:\Windows\System\WQkhjbW.exe
  2⤵
  PID:12524
- C:\Windows\System\uaGhhzf.exe
  C:\Windows\System\uaGhhzf.exe
  2⤵
  PID:12544
- C:\Windows\System\oSNzgbG.exe
  C:\Windows\System\oSNzgbG.exe
  2⤵
  PID:12568
- C:\Windows\System\xEbraQK.exe
  C:\Windows\System\xEbraQK.exe
  2⤵
  PID:12592
- C:\Windows\System\PhLmWaT.exe
  C:\Windows\System\PhLmWaT.exe
  2⤵
  PID:12616
- C:\Windows\System\JZuovYF.exe
  C:\Windows\System\JZuovYF.exe
  2⤵
  PID:12640
- C:\Windows\System\LfMeZmx.exe
  C:\Windows\System\LfMeZmx.exe
  2⤵
  PID:12660
- C:\Windows\System\IpcAvVl.exe
  C:\Windows\System\IpcAvVl.exe
  2⤵
  PID:12688
- C:\Windows\System\wisuqSl.exe
  C:\Windows\System\wisuqSl.exe
  2⤵
  PID:12712
- C:\Windows\System\JUhEiQS.exe
  C:\Windows\System\JUhEiQS.exe
  2⤵
  PID:12736
- C:\Windows\System\cycqwYF.exe
  C:\Windows\System\cycqwYF.exe
  2⤵
  PID:12752
- C:\Windows\System\iUcFWvp.exe
  C:\Windows\System\iUcFWvp.exe
  2⤵
  PID:12772
- C:\Windows\System\ftgiouS.exe
  C:\Windows\System\ftgiouS.exe
  2⤵
  PID:12788
- C:\Windows\System\RdcwCGl.exe
  C:\Windows\System\RdcwCGl.exe
  2⤵
  PID:12816
- C:\Windows\System\IuXFqrt.exe
  C:\Windows\System\IuXFqrt.exe
  2⤵
  PID:12836
- C:\Windows\System\BPCOGRj.exe
  C:\Windows\System\BPCOGRj.exe
  2⤵
  PID:12856
- C:\Windows\System\KfzuIfW.exe
  C:\Windows\System\KfzuIfW.exe
  2⤵
  PID:12884
- C:\Windows\System\LzxUtMf.exe
  C:\Windows\System\LzxUtMf.exe
  2⤵
  PID:12908
- C:\Windows\System\AheezLH.exe
  C:\Windows\System\AheezLH.exe
  2⤵
  PID:12928
- C:\Windows\System\nttMCbl.exe
  C:\Windows\System\nttMCbl.exe
  2⤵
  PID:12960
- C:\Windows\System\LUIBuix.exe
  C:\Windows\System\LUIBuix.exe
  2⤵
  PID:12984
- C:\Windows\System\VHKUQcT.exe
  C:\Windows\System\VHKUQcT.exe
  2⤵
  PID:13008
- C:\Windows\System\wiwKtOM.exe
  C:\Windows\System\wiwKtOM.exe
  2⤵
  PID:13024
- C:\Windows\System\eNpvHkK.exe
  C:\Windows\System\eNpvHkK.exe
  2⤵
  PID:13040
- C:\Windows\System\MvHpoTU.exe
  C:\Windows\System\MvHpoTU.exe
  2⤵
  PID:13056
- C:\Windows\System\gbBQPma.exe
  C:\Windows\System\gbBQPma.exe
  2⤵
  PID:13072
- C:\Windows\System\JGkEteN.exe
  C:\Windows\System\JGkEteN.exe
  2⤵
  PID:13088
- C:\Windows\System\yIoxqPC.exe
  C:\Windows\System\yIoxqPC.exe
  2⤵
  PID:13104
- C:\Windows\System\zNjZmtd.exe
  C:\Windows\System\zNjZmtd.exe
  2⤵
  PID:13124
- C:\Windows\System\GxcnQoy.exe
  C:\Windows\System\GxcnQoy.exe
  2⤵
  PID:13144
- C:\Windows\System\YAcffMo.exe
  C:\Windows\System\YAcffMo.exe
  2⤵
  PID:13164
- C:\Windows\System\VflqiQW.exe
  C:\Windows\System\VflqiQW.exe
  2⤵
  PID:13184
- C:\Windows\System\fNwaABc.exe
  C:\Windows\System\fNwaABc.exe
  2⤵
  PID:13204
- C:\Windows\System\hZrJESs.exe
  C:\Windows\System\hZrJESs.exe
  2⤵
  PID:13228
- C:\Windows\System\SiUIpAw.exe
  C:\Windows\System\SiUIpAw.exe
  2⤵
  PID:13248
- C:\Windows\System\mrfBLuM.exe
  C:\Windows\System\mrfBLuM.exe
  2⤵
  PID:13276
- C:\Windows\System\VFcqLOB.exe
  C:\Windows\System\VFcqLOB.exe
  2⤵
  PID:13296
- C:\Windows\System\xsXyIMx.exe
  C:\Windows\System\xsXyIMx.exe
  2⤵
  PID:10036
- C:\Windows\System\FappQRp.exe
  C:\Windows\System\FappQRp.exe
  2⤵
  PID:10376
- C:\Windows\System\sWepNWh.exe
  C:\Windows\System\sWepNWh.exe
  2⤵
  PID:10448
- C:\Windows\System\oFJHXES.exe
  C:\Windows\System\oFJHXES.exe
  2⤵
  PID:10488
- C:\Windows\System\nDkubXA.exe
  C:\Windows\System\nDkubXA.exe
  2⤵
  PID:10556
- C:\Windows\System\yQNMvzh.exe
  C:\Windows\System\yQNMvzh.exe
  2⤵
  PID:10628
- C:\Windows\System\UQgnuhL.exe
  C:\Windows\System\UQgnuhL.exe
  2⤵
  PID:12936
- C:\Windows\System\Jwjhudu.exe
  C:\Windows\System\Jwjhudu.exe
  2⤵
  PID:11040
- C:\Windows\System\UYQGTxY.exe
  C:\Windows\System\UYQGTxY.exe
  2⤵
  PID:13032
- C:\Windows\System\dYlBKdS.exe
  C:\Windows\System\dYlBKdS.exe
  2⤵
  PID:13068
- C:\Windows\System\GHZQaoC.exe
  C:\Windows\System\GHZQaoC.exe
  2⤵
  PID:13116
- C:\Windows\System\HFFjniv.exe
  C:\Windows\System\HFFjniv.exe
  2⤵
  PID:11104
- C:\Windows\System\GzIJFxN.exe
  C:\Windows\System\GzIJFxN.exe
  2⤵
  PID:13156
- C:\Windows\System\lDcTWDE.exe
  C:\Windows\System\lDcTWDE.exe
  2⤵
  PID:11240
- C:\Windows\System\kkvqZTK.exe
  C:\Windows\System\kkvqZTK.exe
  2⤵
  PID:10088
- C:\Windows\System\bNZvKVJ.exe
  C:\Windows\System\bNZvKVJ.exe
  2⤵
  PID:3144
- C:\Windows\System\yayQWjh.exe
  C:\Windows\System\yayQWjh.exe
  2⤵
  PID:9176
- C:\Windows\System\BHieoMx.exe
  C:\Windows\System\BHieoMx.exe
  2⤵
  PID:7276
- C:\Windows\System\invhePL.exe
  C:\Windows\System\invhePL.exe
  2⤵
  PID:9608
- C:\Windows\System\LuHNTAj.exe
  C:\Windows\System\LuHNTAj.exe
  2⤵
  PID:10716
- C:\Windows\System\Dalohwc.exe
  C:\Windows\System\Dalohwc.exe
  2⤵
  PID:10940
- C:\Windows\System\mxiVBSz.exe
  C:\Windows\System\mxiVBSz.exe
  2⤵
  PID:10964
- C:\Windows\System\zMNDfVt.exe
  C:\Windows\System\zMNDfVt.exe
  2⤵
  PID:11004
- C:\Windows\System\AnoVvKH.exe
  C:\Windows\System\AnoVvKH.exe
  2⤵
  PID:12900
- C:\Windows\System\mtbyYjg.exe
  C:\Windows\System\mtbyYjg.exe
  2⤵
  PID:3500
- C:\Windows\System\ljyfzWw.exe
  C:\Windows\System\ljyfzWw.exe
  2⤵
  PID:11508
- C:\Windows\System\blDtgJu.exe
  C:\Windows\System\blDtgJu.exe
  2⤵
  PID:11036
- C:\Windows\System\PniSQGh.exe
  C:\Windows\System\PniSQGh.exe
  2⤵
  PID:11616
- C:\Windows\System\OidHMxG.exe
  C:\Windows\System\OidHMxG.exe
  2⤵
  PID:11660
- C:\Windows\System\RmIlGzR.exe
  C:\Windows\System\RmIlGzR.exe
  2⤵
  PID:11232
- C:\Windows\System\IilApeJ.exe
  C:\Windows\System\IilApeJ.exe
  2⤵
  PID:11860
- C:\Windows\System\qAukRQB.exe
  C:\Windows\System\qAukRQB.exe
  2⤵
  PID:6160
- C:\Windows\System\lIAFFQw.exe
  C:\Windows\System\lIAFFQw.exe
  2⤵
  PID:12172
- C:\Windows\System\rZzKXoF.exe
  C:\Windows\System\rZzKXoF.exe
  2⤵
  PID:9132
- C:\Windows\System\YPAslYL.exe
  C:\Windows\System\YPAslYL.exe
  2⤵
  PID:10016
- C:\Windows\System\jztExmJ.exe
  C:\Windows\System\jztExmJ.exe
  2⤵
  PID:12372
- C:\Windows\System\hizkOEw.exe
  C:\Windows\System\hizkOEw.exe
  2⤵
  PID:12484
- C:\Windows\System\kYIqpYO.exe
  C:\Windows\System\kYIqpYO.exe
  2⤵
  PID:12540
- C:\Windows\System\zJIncrC.exe
  C:\Windows\System\zJIncrC.exe
  2⤵
  PID:12680
- C:\Windows\System\APlfrPN.exe
  C:\Windows\System\APlfrPN.exe
  2⤵
  PID:12804
- C:\Windows\System\yZnJdkR.exe
  C:\Windows\System\yZnJdkR.exe
  2⤵
  PID:12876
- C:\Windows\System\XmfDUMt.exe
  C:\Windows\System\XmfDUMt.exe
  2⤵
  PID:12940
- C:\Windows\System\ThygNKN.exe
  C:\Windows\System\ThygNKN.exe
  2⤵
  PID:13176
- C:\Windows\System\NVCCKYR.exe
  C:\Windows\System\NVCCKYR.exe
  2⤵
  PID:13292
- C:\Windows\System\uKYimZL.exe
  C:\Windows\System\uKYimZL.exe
  2⤵
  PID:9932
- C:\Windows\System\CmPcxZs.exe
  C:\Windows\System\CmPcxZs.exe
  2⤵
  PID:11352
- C:\Windows\System\IwYIGMk.exe
  C:\Windows\System\IwYIGMk.exe
  2⤵
  PID:3272
- C:\Windows\System\BtgJrBF.exe
  C:\Windows\System\BtgJrBF.exe
  2⤵
  PID:12148
- C:\Windows\System\fhByddv.exe
  C:\Windows\System\fhByddv.exe
  2⤵
  PID:13020
- C:\Windows\System\PoOZNVG.exe
  C:\Windows\System\PoOZNVG.exe
  2⤵
  PID:12324
- C:\Windows\System\IXkCgOy.exe
  C:\Windows\System\IXkCgOy.exe
  2⤵
  PID:12480
- C:\Windows\System\KKYWfOj.exe
  C:\Windows\System\KKYWfOj.exe
  2⤵
  PID:10220
- C:\Windows\System\GbTVzGt.exe
  C:\Windows\System\GbTVzGt.exe
  2⤵
  PID:11060
- C:\Windows\System\vBcFZdr.exe
  C:\Windows\System\vBcFZdr.exe
  2⤵
  PID:11148
- C:\Windows\System\YzFGdLk.exe
  C:\Windows\System\YzFGdLk.exe
  2⤵
  PID:7228
- C:\Windows\System\OEUdeeE.exe
  C:\Windows\System\OEUdeeE.exe
  2⤵
  PID:12628
- C:\Windows\System\kCiFjqz.exe
  C:\Windows\System\kCiFjqz.exe
  2⤵
  PID:10512
- C:\Windows\System\kiyAOvr.exe
  C:\Windows\System\kiyAOvr.exe
  2⤵
  PID:6128
- C:\Windows\System\CufCHwI.exe
  C:\Windows\System\CufCHwI.exe
  2⤵
  PID:8004
- C:\Windows\System\RMgWVHc.exe
  C:\Windows\System\RMgWVHc.exe
  2⤵
  PID:11152
- C:\Windows\System\equYRaM.exe
  C:\Windows\System\equYRaM.exe
  2⤵
  PID:13332
- C:\Windows\System\MXSximV.exe
  C:\Windows\System\MXSximV.exe
  2⤵
  PID:13368
- C:\Windows\System\nIFljlU.exe
  C:\Windows\System\nIFljlU.exe
  2⤵
  PID:13392
- C:\Windows\System\AXzQhoQ.exe
  C:\Windows\System\AXzQhoQ.exe
  2⤵
  PID:13412
- C:\Windows\System\ZvmXzLk.exe
  C:\Windows\System\ZvmXzLk.exe
  2⤵
  PID:13672
- C:\Windows\System\UwFrbHT.exe
  C:\Windows\System\UwFrbHT.exe
  2⤵
  PID:13688
- C:\Windows\System\xjhHAQD.exe
  C:\Windows\System\xjhHAQD.exe
  2⤵
  PID:13708
- C:\Windows\System\oWSLMTX.exe
  C:\Windows\System\oWSLMTX.exe
  2⤵
  PID:13732
- C:\Windows\System\PUhwEhW.exe
  C:\Windows\System\PUhwEhW.exe
  2⤵
  PID:13752
- C:\Windows\System\utFBbHV.exe
  C:\Windows\System\utFBbHV.exe
  2⤵
  PID:13956
- C:\Windows\System\BFJsGPu.exe
  C:\Windows\System\BFJsGPu.exe
  2⤵
  PID:14256
- C:\Windows\System\tweXEYs.exe
  C:\Windows\System\tweXEYs.exe
  2⤵
  PID:14292
- C:\Windows\System\CnSmhbt.exe
  C:\Windows\System\CnSmhbt.exe
  2⤵
  PID:7552
- C:\Windows\System\tMZCORa.exe
  C:\Windows\System\tMZCORa.exe
  2⤵
  PID:11324
- C:\Windows\System\hKPbtTS.exe
  C:\Windows\System\hKPbtTS.exe
  2⤵
  PID:11480
- C:\Windows\System\TVmRJHi.exe
  C:\Windows\System\TVmRJHi.exe
  2⤵
  PID:11560
- C:\Windows\System\BJjteVF.exe
  C:\Windows\System\BJjteVF.exe
  2⤵
  PID:11596
- C:\Windows\System\FtApNFM.exe
  C:\Windows\System\FtApNFM.exe
  2⤵
  PID:11872
- C:\Windows\System\OPjbZwV.exe
  C:\Windows\System\OPjbZwV.exe
  2⤵
  PID:13340
- C:\Windows\System\IxbXTlF.exe
  C:\Windows\System\IxbXTlF.exe
  2⤵
  PID:13400
- C:\Windows\System\dLfvsMz.exe
  C:\Windows\System\dLfvsMz.exe
  2⤵
  PID:12536
- C:\Windows\System\ZpPnnBs.exe
  C:\Windows\System\ZpPnnBs.exe
  2⤵
  PID:12460
- C:\Windows\System\UJAzCsQ.exe
  C:\Windows\System\UJAzCsQ.exe
  2⤵
  PID:11016
- C:\Windows\System\qaeMUgu.exe
  C:\Windows\System\qaeMUgu.exe
  2⤵
  PID:13816
- C:\Windows\System\dVhtgXU.exe
  C:\Windows\System\dVhtgXU.exe
  2⤵
  PID:13836
- C:\Windows\System\bvuQSPM.exe
  C:\Windows\System\bvuQSPM.exe
  2⤵
  PID:13424
- C:\Windows\System\nWtJLuA.exe
  C:\Windows\System\nWtJLuA.exe
  2⤵
  PID:13464
- C:\Windows\System\IPkHykT.exe
  C:\Windows\System\IPkHykT.exe
  2⤵
  PID:13888
- C:\Windows\System\ImtoxhD.exe
  C:\Windows\System\ImtoxhD.exe
  2⤵
  PID:13648
- C:\Windows\System\yofrHRq.exe
  C:\Windows\System\yofrHRq.exe
  2⤵
  PID:13684
- C:\Windows\System\XpesFOM.exe
  C:\Windows\System\XpesFOM.exe
  2⤵
  PID:13720
- C:\Windows\System\BkXxHjP.exe
  C:\Windows\System\BkXxHjP.exe
  2⤵
  PID:13764
- C:\Windows\System\rvGeSZu.exe
  C:\Windows\System\rvGeSZu.exe
  2⤵
  PID:14276
- C:\Windows\System\gjomziC.exe
  C:\Windows\System\gjomziC.exe
  2⤵
  PID:13196
- C:\Windows\System\OjghWZf.exe
  C:\Windows\System\OjghWZf.exe
  2⤵
  PID:4992
- C:\Windows\System\nLcGBOv.exe
  C:\Windows\System\nLcGBOv.exe
  2⤵
  PID:11312
- C:\Windows\System\cNvunpe.exe
  C:\Windows\System\cNvunpe.exe
  2⤵
  PID:12904
- C:\Windows\System\xgxFiNL.exe
  C:\Windows\System\xgxFiNL.exe
  2⤵
  PID:12920
- C:\Windows\System\JWEwRrY.exe
  C:\Windows\System\JWEwRrY.exe
  2⤵
  PID:1616
- C:\Windows\System\OIgfVNH.exe
  C:\Windows\System\OIgfVNH.exe
  2⤵
  PID:10332
- C:\Windows\System\ovqOTHJ.exe
  C:\Windows\System\ovqOTHJ.exe
  2⤵
  PID:13828
- C:\Windows\System\bcXtGqW.exe
  C:\Windows\System\bcXtGqW.exe
  2⤵
  PID:1644
- C:\Windows\System\AnKSSWq.exe
  C:\Windows\System\AnKSSWq.exe
  2⤵
  PID:11368
- C:\Windows\System\aaeEaIL.exe
  C:\Windows\System\aaeEaIL.exe
  2⤵
  PID:13488
- C:\Windows\System\RBVlnEc.exe
  C:\Windows\System\RBVlnEc.exe
  2⤵
  PID:1972
- C:\Windows\System\TTXUgjo.exe
  C:\Windows\System\TTXUgjo.exe
  2⤵
  PID:11952
- C:\Windows\System\GiRlCsb.exe
  C:\Windows\System\GiRlCsb.exe
  2⤵
  PID:11212
- C:\Windows\System\copAiYT.exe
  C:\Windows\System\copAiYT.exe
  2⤵
  PID:13460
- C:\Windows\System\vwoNCoV.exe
  C:\Windows\System\vwoNCoV.exe
  2⤵
  PID:13612
- C:\Windows\System\jDHFzfK.exe
  C:\Windows\System\jDHFzfK.exe
  2⤵
  PID:14028
- C:\Windows\System\HByLMBz.exe
  C:\Windows\System\HByLMBz.exe
  2⤵
  PID:14124
- C:\Windows\System\aCyMgMl.exe
  C:\Windows\System\aCyMgMl.exe
  2⤵
  PID:12132
- C:\Windows\System\rCZlQgL.exe
  C:\Windows\System\rCZlQgL.exe
  2⤵
  PID:10804
- C:\Windows\System\QDIFSml.exe
  C:\Windows\System\QDIFSml.exe
  2⤵
  PID:9912
- C:\Windows\System\MslqjVs.exe
  C:\Windows\System\MslqjVs.exe
  2⤵
  PID:10280
- C:\Windows\System\CFDotNX.exe
  C:\Windows\System\CFDotNX.exe
  2⤵
  PID:13984
- C:\Windows\System\ClMvLrt.exe
  C:\Windows\System\ClMvLrt.exe
  2⤵
  PID:13588
- C:\Windows\System\IeDNtjB.exe
  C:\Windows\System\IeDNtjB.exe
  2⤵
  PID:14080
- C:\Windows\System\pkEgAAV.exe
  C:\Windows\System\pkEgAAV.exe
  2⤵
  PID:13512
- C:\Windows\System\NlVrmOk.exe
  C:\Windows\System\NlVrmOk.exe
  2⤵
  PID:13544
- C:\Windows\System\IZADwfm.exe
  C:\Windows\System\IZADwfm.exe
  2⤵
  PID:9872
- C:\Windows\System\PtssXgi.exe
  C:\Windows\System\PtssXgi.exe
  2⤵
  PID:14112
- C:\Windows\System\PadZnax.exe
  C:\Windows\System\PadZnax.exe
  2⤵
  PID:13700
- C:\Windows\System\xEaUQCA.exe
  C:\Windows\System\xEaUQCA.exe
  2⤵
  PID:10664
- C:\Windows\System\NtfSnCL.exe
  C:\Windows\System\NtfSnCL.exe
  2⤵
  PID:14280
- C:\Windows\System\yrGMPUb.exe
  C:\Windows\System\yrGMPUb.exe
  2⤵
  PID:2532
- C:\Windows\System\UovVRQV.exe
  C:\Windows\System\UovVRQV.exe
  2⤵
  PID:14128
- C:\Windows\System\YzopAXf.exe
  C:\Windows\System\YzopAXf.exe
  2⤵
  PID:13592
- C:\Windows\System\PFAdjRR.exe
  C:\Windows\System\PFAdjRR.exe
  2⤵
  PID:11636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2cebtx5y.3mu.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BEMwEXE.exe

Filesize
1.9MB

MD5
6f780547565a72fe24e1ff68f9888256

SHA1
4516e282b9ba739a318db74b08983f03b44000af

SHA256
6f890973d03f0653ed7ae0c90188c9de0959c766e39a9b53eb5a61d301597cbf

SHA512
cc6ddefe562e4d33bbdc50761008232f608fe3a85ced17b225d7967e0d4f1d8ff1d5ae668fb182bb35dd113a8951a83e4772c74a318e8341314cb816653b3787

Download Submit
C:\Windows\System\BVqxYVS.exe

Filesize
1.9MB

MD5
e1866cc5ad4251a22bc444e724cfb4b0

SHA1
7ec65248a3012386ead8f83498c0fb7a5bf31455

SHA256
f51e654ede3c5a96af39e1e20821df397530fa3884eb7c126e28b75a2b0df7be

SHA512
4a06f723ee4aae621da659541c79893b76fd3c6d5c904c6fc1dfce8d071b10503101c6bbb67577e377bd03d42d66453af1225895c84c2587eb1a62f7bd33f111

Download Submit
C:\Windows\System\CcytHUp.exe

Filesize
1.9MB

MD5
121852a729b83dbf167088392c3bc36e

SHA1
551dd9bb1c547d067a6a3187ac43b999a3350409

SHA256
9b0d05daeb6488d0914c4a6ec37575f60c96361c42f121e5816c8f694a8437dc

SHA512
778452fb00ab738c36ac096e07dc924acd55761918070d9c81e623b2fa90a0502dd468c228d7a2634c6edb3cdc96c77b0d63c96acb9740e53d720a7d94f9aa3a

Download Submit
C:\Windows\System\DXbGJwU.exe

Filesize
1.9MB

MD5
bebd9bfea16c53f454708ae032d9b99e

SHA1
f1b5adf1fb3e30429e4fd5a68a318e6093023440

SHA256
57b7c55f8e1893fdb71ab0fa25dc43ba7ef09c3b27316b76be264468fee6b67b

SHA512
fb9bc776a1f4f8eeb1227e81e7f020cdf951d660684265187827260d0915734a2b8bd6de32bbf48925b6d6b68ebc227afddf956637ccbafaf55f62822d1b99d2

Download Submit
C:\Windows\System\EVUaMnR.exe

Filesize
1.9MB

MD5
cbe816463ae2fb64a08a8c5efa4ea232

SHA1
0a80e2211b8f6224d4f6fc086cdf5f468f75d3c6

SHA256
61c9fca5af481474358ac0d5ac05882ee928a7b71674212589d7313a48cf5a84

SHA512
d3e1d39d917de0684ea8f8761152760a9f56311040cd4506b15f11e0476a687fe5755e28471fe7b2bc628d8d94a1b1a2335440ad7f9c293bba7475f55a66aaea

Download Submit
C:\Windows\System\EunQJYc.exe

Filesize
1.9MB

MD5
604d919ec4539755c50d37a9d723c96f

SHA1
12041696deba85cd7c5c6dd40f1f7e4b8fa7b42b

SHA256
829d5c4c148ce770cf975bfe1578588fb8adc6cec82fe8875be01bca6609852e

SHA512
90b8ab796654ed70b2d7abce9fcb810b819e4af9d70ca669398875e092b1ee8b1eacddb6c1e6be1202f1d0b12a0e76a3aa7c6315408ecc76e23bb479374c3ee7

Download Submit
C:\Windows\System\FvrXskR.exe

Filesize
1.9MB

MD5
7a6c3f419bec6f068fd377d6789809e9

SHA1
f12256075074e6fa9d22560dceab767549435961

SHA256
e25ba1100173b0d952a286dfa5441626c81f0e7daeb7e50937c120a30ef97b55

SHA512
135b3139715d1aa18b6f8171fe99343dc6aaf8dac0740049ca42b8cd9d7ea100b252b6f1f60b02a20ce72049349b9b3ccf8542ad2185c76a69283c041179231c

Download Submit
C:\Windows\System\HutYarg.exe

Filesize
1.9MB

MD5
6566d0869d64feb550cfa47b4dfc3282

SHA1
00a65af72792dbd977802ec95d45e290b06b052f

SHA256
ebdcbe7f487b978ef32d6f4953e37394d7600708920a3bd45378a93ab6834f40

SHA512
dde64f53670d2c2c2916dc03895f623285420a9d5ed5e047356926a358729e4105d74bfa401e4e23e08ea3cb7fb651b9e15f5cd62224590a93d0cdd13bacc3ad

Download Submit
C:\Windows\System\KyyUVzk.exe

Filesize
1.9MB

MD5
6c0dd5357fd4210935f74f59e55e18e6

SHA1
a2d66336688b872ae299ebab94598e8849b2c956

SHA256
2916acb387cb6b2b1b85f658a428f63c065621ede19f41bc018e2c0eeb42cfee

SHA512
a0cab442171729cb82d587b37fe3d2fa12b046b24e0139cb27cee15e785575f44bc5530cc32df2da40e5686746ca217badcf27a7e8f371d0a2f66e7cd42efe38

Download Submit
C:\Windows\System\NujCKBf.exe

Filesize
1.9MB

MD5
33d11d8d6eb8bf7cf3560a454947ba29

SHA1
81fc4c9ebc7076a3cbc9330933e2b1e3988a0f16

SHA256
152e7a9f2c271281fc58fa1d8105ac18c0d527ab83c51625820b551c608c4924

SHA512
f802270298dfe4b32ca50aee7ef6bba866eb7eccf8a9571cb095626f5f11704b46d7672bf7740d4ef1c645bf31207b494ab91eb9932205ece5b561a6fe7970c5

Download Submit
C:\Windows\System\OMGmEfe.exe

Filesize
1.9MB

MD5
faee3c0dc58faa6647d4ec28ea079081

SHA1
d779c79693eff641c4f14803721814a5d4111133

SHA256
92dc976e310575bd35c0e69fd08c0c5c7124138603e002aa6f6c5b8b455270dd

SHA512
f45be9523a6584d567fb87777ca65e86d3828d2082ec3df31911644b44dcb238bd5eb354baeb79e55b5b97c6db94d91ba1366b264865d8b3b5493dc2993bdb9b

Download Submit
C:\Windows\System\Okhyglp.exe

Filesize
1.9MB

MD5
f31798147d34c6a4a911ff3c41a12d48

SHA1
72b5f8073bb79c25517bb03cdc134d65176090b6

SHA256
e6e6c92a196052ffc5bef49b36e424204cb6122e132596e11a2bf8e8b3c38413

SHA512
8e97177e23d46034539cc389c5e8aca1dff44eeace7f7831e4f4022fb03b2f04398deb644374a498362db677744e99412529fda62538cb7ccceeae23692bc892

Download Submit
C:\Windows\System\StphURS.exe

Filesize
1.9MB

MD5
168b3e76d6cd330b50d580fd3257c532

SHA1
f994671ffd2fbe5cca18c04dee46ec1b781b2350

SHA256
8511dca0604f0168576f6b34aa78161fdf132fc3647a23080fa1177a796a567d

SHA512
4b752d82709d5e58ebe7c74966f2a45d7fdaf0ecaefd6da630dd7ee45ad9c24a8bf8d95fb8ffff9a3dc8906dd5100e984abad454b4859905fa1a1c2d10c165c5

Download Submit
C:\Windows\System\WwRUrGS.exe

Filesize
1.9MB

MD5
ac9d57c19254333f346ace67825f7ff9

SHA1
c9d451aab009209442f5a79ba2d22b2da6b3fe2c

SHA256
08d99c8811974eaa490fac8c556ddedb310fde3848903c5c4b52af197b21f234

SHA512
f0ec81badf4681817d2a6d42f5b3f5c6bb0971de5e50484a00c64533a3d462981c6a423b2383714403aa1ecf1ea4dec544a22f79c8aa6fa3017ff8f6c7f52ae1

Download Submit
C:\Windows\System\ZftEUbL.exe

Filesize
1.9MB

MD5
962b29ee599e433a26d00c07f04b51cd

SHA1
50b54e485ec1dc61b246422afb4935bd328f2b72

SHA256
896713cfcae18a01acc03c1b97406c3ddadf38cfa409374014d41bd22245c5db

SHA512
ac4be62fd29dc688989af855a33a8d0856cd6d836fc29cb8cf7a8801dc774b66bb2f45420db2477f0000684f4e444a8404a39a18918fa9a198f33c9da1c9bad7

Download Submit
C:\Windows\System\ZiCDIxv.exe

Filesize
1.9MB

MD5
77750c490eeaa0bda0c7e693060f5536

SHA1
340e3384f8269f67476687b6c80f47dce9bcdcda

SHA256
a7a4389c41bb26e54d4e651cb40153998094fd11fb97f56c3d6c05bd0e26e8fe

SHA512
af664b033cfb7d1458816c894da99e0d61c7c6d1692b8ee7e1fcabd6ff96ce888af9e677776789f40105b544b6dd1645c9691c69bda6ba7c9447c020794084f2

Download Submit
C:\Windows\System\adswFbj.exe

Filesize
1.9MB

MD5
49f8affee1308325ca8172eb3713f30c

SHA1
4b37e990060d23b334500d50a54587c84c4573f3

SHA256
8398bfa1fa12f430bb804405927be50debb46d5293c8043a728f26784562e1d6

SHA512
4bd725ce6bc0b8b9d77ece37b5df47538d87c4123e7380e6d136aff2178b509b75ec96d02b8f1551bddd62b399d29974415713a6c085e19c9d66cbe5b0737863

Download Submit
C:\Windows\System\afURCql.exe

Filesize
1.9MB

MD5
49dddfcad2f8a2a7af900ccb4bf9f7ac

SHA1
de7e92e07dd9cc34ccb20c13a2c10aeccb236e9c

SHA256
da66cd84d00641e14edbbab8597d99a6750931d3ed9ee07d4eb2f03d1f8864ef

SHA512
2535268512685b43e8e82be0861afd52615d51f679190a09a0b795b9bec06e07854e5004515f4835bcb1f251736aefb7a6b769dbe3f1bcd8cb6cd1144bcef13a

Download Submit
C:\Windows\System\azWMJkS.exe

Filesize
1.9MB

MD5
99d7e7ff58184087108ed1ce77a32cd9

SHA1
16dd48d182bad99d75809465af67ab8898b4b883

SHA256
a8a4975070436178f575511c6437c53742b43f9ce288280a07fa2659088307fb

SHA512
6774f801e2cc9020177bec8051e112538f98cb9ae6a63bd2d9d14c5ad2eb137d06014bcf31185157174c097e522e41e4aa9e78c91db0a2142a17e41b056bcb6d

Download Submit
C:\Windows\System\cUDnAwF.exe

Filesize
1.9MB

MD5
543cf9e24c34d8199e2799abc37364d0

SHA1
c09354e005c8ff02483a1872860bb42a6481997a

SHA256
6e9b60be3c31adea01e5368d15b5c778ead0cb2cfa156b67cefa1cb42967a230

SHA512
f4ed6f01080b96ab582ca2f1f2d2a33e1bd2370a9f9304eca98a3e5b31c10c240fe97d7d53092aa1329f2f7e6274f5e96e111ede76901d50f35f6e7fe31212ac

Download Submit
C:\Windows\System\dUbfStT.exe

Filesize
8B

MD5
0a4d9fd0cc8fe1472d155d5d981ff235

SHA1
137003f778b74f1b96494293112b43e4307e765e

SHA256
4707e767d70e4899759ce8aba6535007a27f8c132e3f3e05b8b8ae03c23dd080

SHA512
ad9c5b802b25d2a28cbec3d4cc246b638fad901bd44704bb559f8a0cf5c0d25f339a2e2fe9f4b8bbba249477fc11b0b14c51d97cfa76d081fb255f90811dd5c7

Download Submit
C:\Windows\System\djfMxOu.exe

Filesize
1.9MB

MD5
25cb46588c8db41e659b36fa21aa54a0

SHA1
8afd6ccd497e393c6516e6ca6025ebffa198efa0

SHA256
c79733f98358f65ddd4459c8d555761c0793d76e84fdfa36f283dbd497c43b09

SHA512
8d5cb1881b73242e5ec24dd292f1b3583352f1008a372403c361d8489d7033d8929306c5559b143297a620acf8fd6004d594bbb39febfafa3ab1d9b115b03b84

Download Submit
C:\Windows\System\eBYMEpg.exe

Filesize
1.9MB

MD5
b14009eb1fec6593cc5ca7317b39fe44

SHA1
f04babe7657e7cc73d969886afe70d08ee1e8dc6

SHA256
549d84067a2095cc26484a69f39caaf26e6fefecc7b7eba50dfa97c59e7fad97

SHA512
c5fb2b15bfa4bacd7f6ecefa5fcb904a82ec2b690325f34b2268033278e68f7a16a7fe525c28fc1a3c50d1226991ee34a0b036003e5362c85dfe1ec0dcc0582f

Download Submit
C:\Windows\System\evlrLFY.exe

Filesize
1.9MB

MD5
99ebd96e0676be8e736742d84d83e7de

SHA1
9a096550b728c897461bb67d1fed4683dd20a83d

SHA256
c878adb060fd87a41509a1f16f9db588c99d193dcbe74cb2cade03f2d0cb1a34

SHA512
207d4a287257bacbdbcc1c41df933f64fce589fac5a0cab992e6cf6ec0eeee7ff17359fef35392d1267c2a1312275a0a9b7cbae9af9c91758f2606470cba6260

Download Submit
C:\Windows\System\fMBYRjx.exe

Filesize
1.9MB

MD5
51216110fb492ffb5a7b37b4ec6a343d

SHA1
2cdba10a8f668971bef2e45ff06a622041df614a

SHA256
53357ff5f7f0a710daf1330bfecf981a8ef72cbac7a5a74c3e0d480adc180b42

SHA512
68c090ad7e2551537bb3dc5bdbe50e5f61b0c90035c017060669e1b8feb7a5b237995a27835d528b560617080c21383c1b134bc12de7f074707ef04a12bf3894

Download Submit
C:\Windows\System\gctQruv.exe

Filesize
1.9MB

MD5
e46d2664ce6f18bdf74d6f299b90857f

SHA1
91a74fc1f554d7ab8c47bd3a01219ebb78cbd11b

SHA256
ec6f54b7229250cbf54dd3fe2ab6b4d8a08ad215ed2d3f6d237c13203d0e8a85

SHA512
5c354044491e85916f814020123b9687837da115be2ad00aa6361ce122e689def3ddfeba249fb2744bc21c3de4b4e7cbc1113adece6ac9a90b84a44fba54eefd

Download Submit
C:\Windows\System\hfMDQxK.exe

Filesize
1.9MB

MD5
e01110e3881ad5b8cdb2afca39d49fc9

SHA1
7d7f96c1947dd01551687c018ff33ed50f4b96b2

SHA256
7cde9b8981f0914db709c8ae4f6d6e6ac774877bac92ee770982713caaaca648

SHA512
93b02338c7410bde11a5089435d68cd83c827249d7357e1057a64d85fd237e605dc2c7579e30e4049cbda4138e0d24924e068416dc7d76a13f56fc1083dc92db

Download Submit
C:\Windows\System\kchbzau.exe

Filesize
1.9MB

MD5
bbfa98736e4a8d58bde9e8b5fbada050

SHA1
a814859a5f284be73c184fc5be31401008acafbb

SHA256
3be5f83bbf4e3281e66d3914010b81c7d2161b5d4f6ae8b808f30ab357727fa7

SHA512
19af6a5c81cab1b571c80f2fc1ac02d66b487c7d857dc7ef626f368b3e411533a0ea42a189969ab6be97e1bab59d8ca6709b6ba7ad26cd0b48d784bac8965a19

Download Submit
C:\Windows\System\mhyuaek.exe

Filesize
1.9MB

MD5
2172fef96cc87b534bc4f3a635c22ebe

SHA1
d6e368c34e734b9bcf247759f7e531fefe29620c

SHA256
1834494bb819438fea92535ec4bc9c3bbffecb3c7b34ffefe82740822af531b0

SHA512
38b39a46b5a7099e2d7c847bb5ddfa58ffcc07338062da7ac0494707f7112b7c39b941c2bddaace9eebd9d16581248296b01da4835d37b121e77b6dc670b6899

Download Submit
C:\Windows\System\nlejnFP.exe

Filesize
1.9MB

MD5
7ed37a66681cc46c8add8f5b1c82c6d6

SHA1
00371f59765001f5e5d5f96db1caf1b6f0254902

SHA256
1bac031a5a059c28c515bc09c7b7a76bdc1ec817c412c7adf37182780409775e

SHA512
b272de8d8136686602313da8184550b997446173903220daf56b20cccda6815313f54313dd5118015e6882d8771e82647dd6ae2eac9dde6bc591eb43c66c2108

Download Submit
C:\Windows\System\sQeghGN.exe

Filesize
1.9MB

MD5
defb4ffbb7de6e85e516240bd04eacbb

SHA1
70a0e5663a14e187ac6231582d301f9ef7f6f8c9

SHA256
06cab2ddffbe59b9951d7c7fd6b33fcba6fd869cd4ab6f8b51085b9cf0535096

SHA512
8d316ab4ede40c45b4c3af37b9adb488a4ed6ccffe2109572a725024be6c98dd8e98bead5a983875602ca94647f547a70c319be7dd2cbdbe4c62ef228d8096e1

Download Submit
C:\Windows\System\slNXnZe.exe

Filesize
1.9MB

MD5
80cc9ce4aaae95e4986c9ce0c0cd508c

SHA1
e4240c9a46f43994717eb4a438806b94c5e4badf

SHA256
a6b2a76b8685120d691afd6d710b2be7a65bdd5536cb4eab0a8e91573bd62803

SHA512
a2a743e43d7d24982506c48dca389047b9cf4b10f3abea4eadcf758a61b6cecd2649cbe3ca10493fca9ab7480f1a548bacf009a9287d9210d182ae2466f2d1c1

Download Submit
C:\Windows\System\tHwLINZ.exe

Filesize
1.9MB

MD5
ca2f6d133427245d464a65e7a3e0233b

SHA1
275bc29f15e2aa007cc08cbfb207688f3bfdf798

SHA256
d2a4ea79b33e3f8e85ba9bd2bf76b3b87b28f6f042b8eb43420c4554c9e9888c

SHA512
0f3d2cc9f7d02178d8df7e2bcc58c0148e1f8c2b6069f2c09c14d244cd1060c29513ad8140ae80bc82b2723c374160a2ec2908f8c6dde074b4f3a804c11b737b

Download Submit
C:\Windows\System\toRcopd.exe

Filesize
1.9MB

MD5
357ef4df2a1292bc369678b010f71523

SHA1
a5f227c1a19a19e15a7dc0dcc05ad6e2947565ec

SHA256
7fc6f0ed58a63ef4a43f9ef4ed8fe56a7abd66ed52d88b66281b740a49f11a2e

SHA512
eec290c07091faf2065cbae333a0816cd11596d701f61650cf8b9f3a2af5d6e1a86a0029dd656a537433af2a2bf26b6337273d737e02d8526d93d054f6cd827d

Download Submit
C:\Windows\System\uGiMNSC.exe

Filesize
1.9MB

MD5
7a5acb9f7b12655015b96898c3d7c112

SHA1
027e2263d2121b4fb5fa27b84288e13194addde2

SHA256
6a932f6f884c25b20457c8119f0c9e676b8acb33cc31dc9ce3efd146946d556c

SHA512
a4164fe6ab777e2771bc0dd0abe978ce64a44677936d9659023e3c3ae9efb127a7a4e620bcdc502db374e187d30439369beeaa52f2f6e1c55bd2a4d7c987aafc

Download Submit
C:\Windows\System\ufpxvvw.exe

Filesize
1.9MB

MD5
7d253bd7294ae632f7a05c18b0455abf

SHA1
f967cbdd1e994f0041a2e2f523d145b2423d4e7f

SHA256
6100a8670821b32466fafaf1748a49b79aa46920d6384376c7119f2c65d667a1

SHA512
8a95c97c7a2370f9ee75b87f6b88b56fb55f01d72b7d94ccc4e0bf3e0636475567829dfcd903a8a1a8d863212d41f9a2711c20dafa0af5acc58bcb6868941501

Download Submit
C:\Windows\System\yGlARVA.exe

Filesize
1.9MB

MD5
7f418640c46b672931a0c2aeb8ebc4ea

SHA1
96638323c43a93dcb60951aa9f5ca3463305ca5b

SHA256
31723d5e8c1f21a34592d822cb811121905f8d4ec960a97d575db960d9988dba

SHA512
d2cd9ed8985223c16a297cc356ca21e74986a4f373bc85ecaa508a0bb732c2645abcbb29fe07083d8154e866626f3a19160171696c348601e8fecaef53d90b43

Download Submit
C:\Windows\System\ybLYuHS.exe

Filesize
1.9MB

MD5
da1783eb976bb1336499d032d56623eb

SHA1
b7c09e8099f60d25da9a9d506249280efae71e4f

SHA256
aab6254b13c87cc619fbc149ba3f2e229b63076bb8146829f58bd2ab51321601

SHA512
51a60afae81756bd421a6cb20db28e29f7575fea2025acb408b553656f6fffc1254b3afbe92da12f5736a72f0c91c46bccadf4a1ef4711e2d3a13b4fcc0fac6b

Download Submit
C:\Windows\System\zzvkFGA.exe

Filesize
1.9MB

MD5
917cf1b7b69c1b7948c68d36542c8d85

SHA1
49ad900d1f3c77741af20ea1d938b85e7d1af1b1

SHA256
a0eb1f1dba2d305f8402e8b5ea89422733ac2c4a645d27223f6a40829020eab0

SHA512
429655e7397e757fe39a6216abb7fd8f7a2096e15e707291f95993f105180f56abed2d0115c9c2ee53a47eedd5aecc35540077bf606f8c8a47dbba194a2bcfd6

Download Submit
memory/64-295-0x00007FF7E9A00000-0x00007FF7E9DF2000-memory.dmp

Filesize
3.9MB

Download
memory/1188-161-0x00007FF751CF0000-0x00007FF7520E2000-memory.dmp

Filesize
3.9MB

Download
memory/1228-567-0x00007FF7736F0000-0x00007FF773AE2000-memory.dmp

Filesize
3.9MB

Download
memory/1496-157-0x00007FF798090000-0x00007FF798482000-memory.dmp

Filesize
3.9MB

Download
memory/1712-572-0x00007FF736730000-0x00007FF736B22000-memory.dmp

Filesize
3.9MB

Download
memory/1916-451-0x00007FF734C90000-0x00007FF735082000-memory.dmp

Filesize
3.9MB

Download
memory/1960-566-0x00007FF6F6420000-0x00007FF6F6812000-memory.dmp

Filesize
3.9MB

Download
memory/1968-569-0x00007FF7D99C0000-0x00007FF7D9DB2000-memory.dmp

Filesize
3.9MB

Download
memory/2052-209-0x00007FF63C5D0000-0x00007FF63C9C2000-memory.dmp

Filesize
3.9MB

Download
memory/2072-509-0x00007FF6EFD30000-0x00007FF6F0122000-memory.dmp

Filesize
3.9MB

Download
memory/2120-571-0x00007FF758500000-0x00007FF7588F2000-memory.dmp

Filesize
3.9MB

Download
memory/2300-506-0x00007FF6E8A80000-0x00007FF6E8E72000-memory.dmp

Filesize
3.9MB

Download
memory/2424-410-0x00007FF76B800000-0x00007FF76BBF2000-memory.dmp

Filesize
3.9MB

Download
memory/2756-563-0x00007FF6ABB30000-0x00007FF6ABF22000-memory.dmp

Filesize
3.9MB

Download
memory/2956-292-0x00007FF681630000-0x00007FF681A22000-memory.dmp

Filesize
3.9MB

Download
memory/3124-113-0x00007FF6476F0000-0x00007FF647AE2000-memory.dmp

Filesize
3.9MB

Download
memory/4420-1-0x0000026594630000-0x0000026594640000-memory.dmp

Filesize
64KB

Download
memory/4420-0-0x00007FF6F5930000-0x00007FF6F5D22000-memory.dmp

Filesize
3.9MB

Download
memory/4424-573-0x00007FF7635F0000-0x00007FF7639E2000-memory.dmp

Filesize
3.9MB

Download
memory/4500-565-0x00007FF796C60000-0x00007FF797052000-memory.dmp

Filesize
3.9MB

Download
memory/4840-75-0x00007FF81B080000-0x00007FF81BB41000-memory.dmp

Filesize
10.8MB

Download
memory/4840-77-0x0000014F75880000-0x0000014F75890000-memory.dmp

Filesize
64KB

Download
memory/4840-518-0x0000014F75CC0000-0x0000014F75CE2000-memory.dmp

Filesize
136KB

Download
memory/4912-568-0x00007FF67D3E0000-0x00007FF67D7D2000-memory.dmp

Filesize
3.9MB

Download
memory/5064-570-0x00007FF69ECC0000-0x00007FF69F0B2000-memory.dmp

Filesize
3.9MB

Download
memory/5068-238-0x00007FF72A5F0000-0x00007FF72A9E2000-memory.dmp

Filesize
3.9MB

Download