xmrig | f3f2a1c347878dd21dd35ead44b9ff2f26ba6c4258673175412b4f87ca1c0fa2

Analysis

max time kernel
67s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 07:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
Size

1.9MB
MD5

071245b6aa0d079c9b239d9aff2ec7e6
SHA1

24c74652755b4b5f6861453c51418faac6604047
SHA256

f3f2a1c347878dd21dd35ead44b9ff2f26ba6c4258673175412b4f87ca1c0fa2
SHA512

844000887ac29919cb42278c3d42525579911ea99bfb5e78df4c08fb5d769c602cc3f95393c56a83c9cbe5b25da4bc6d5dbf7ecb6c8ab1d2be1d9500b5b2c7cf
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrCD:NABl

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 40 IoCs

miner

resource	yara_rule
behavioral2/memory/2904-214-0x00007FF7264B0000-0x00007FF7268A2000-memory.dmp	xmrig
behavioral2/memory/4644-225-0x00007FF7DFBA0000-0x00007FF7DFF92000-memory.dmp	xmrig
behavioral2/memory/1776-256-0x00007FF70B290000-0x00007FF70B682000-memory.dmp	xmrig
behavioral2/memory/4704-260-0x00007FF738070000-0x00007FF738462000-memory.dmp	xmrig
behavioral2/memory/2688-261-0x00007FF6DAD50000-0x00007FF6DB142000-memory.dmp	xmrig
behavioral2/memory/3924-259-0x00007FF6A1190000-0x00007FF6A1582000-memory.dmp	xmrig
behavioral2/memory/1656-258-0x00007FF776010000-0x00007FF776402000-memory.dmp	xmrig
behavioral2/memory/2984-257-0x00007FF7BE720000-0x00007FF7BEB12000-memory.dmp	xmrig
behavioral2/memory/1888-255-0x00007FF6FF580000-0x00007FF6FF972000-memory.dmp	xmrig
behavioral2/memory/3804-254-0x00007FF768880000-0x00007FF768C72000-memory.dmp	xmrig
behavioral2/memory/1928-253-0x00007FF6E33E0000-0x00007FF6E37D2000-memory.dmp	xmrig
behavioral2/memory/3372-252-0x00007FF688820000-0x00007FF688C12000-memory.dmp	xmrig
behavioral2/memory/4608-251-0x00007FF682670000-0x00007FF682A62000-memory.dmp	xmrig
behavioral2/memory/4624-250-0x00007FF7EF240000-0x00007FF7EF632000-memory.dmp	xmrig
behavioral2/memory/2248-248-0x00007FF6AB280000-0x00007FF6AB672000-memory.dmp	xmrig
behavioral2/memory/1276-150-0x00007FF68A920000-0x00007FF68AD12000-memory.dmp	xmrig
behavioral2/memory/2936-117-0x00007FF78A110000-0x00007FF78A502000-memory.dmp	xmrig
behavioral2/memory/64-88-0x00007FF627CA0000-0x00007FF628092000-memory.dmp	xmrig
behavioral2/memory/5092-70-0x00007FF6BED50000-0x00007FF6BF142000-memory.dmp	xmrig
behavioral2/memory/2424-3380-0x00007FF7A1C10000-0x00007FF7A2002000-memory.dmp	xmrig
behavioral2/memory/2936-3383-0x00007FF78A110000-0x00007FF78A502000-memory.dmp	xmrig
behavioral2/memory/1656-3384-0x00007FF776010000-0x00007FF776402000-memory.dmp	xmrig
behavioral2/memory/5092-3386-0x00007FF6BED50000-0x00007FF6BF142000-memory.dmp	xmrig
behavioral2/memory/1276-3392-0x00007FF68A920000-0x00007FF68AD12000-memory.dmp	xmrig
behavioral2/memory/64-3401-0x00007FF627CA0000-0x00007FF628092000-memory.dmp	xmrig
behavioral2/memory/4608-3402-0x00007FF682670000-0x00007FF682A62000-memory.dmp	xmrig
behavioral2/memory/4624-3406-0x00007FF7EF240000-0x00007FF7EF632000-memory.dmp	xmrig
behavioral2/memory/1928-3409-0x00007FF6E33E0000-0x00007FF6E37D2000-memory.dmp	xmrig
behavioral2/memory/4704-3404-0x00007FF738070000-0x00007FF738462000-memory.dmp	xmrig
behavioral2/memory/3924-3399-0x00007FF6A1190000-0x00007FF6A1582000-memory.dmp	xmrig
behavioral2/memory/2904-3394-0x00007FF7264B0000-0x00007FF7268A2000-memory.dmp	xmrig
behavioral2/memory/2248-3397-0x00007FF6AB280000-0x00007FF6AB672000-memory.dmp	xmrig
behavioral2/memory/4644-3391-0x00007FF7DFBA0000-0x00007FF7DFF92000-memory.dmp	xmrig
behavioral2/memory/1888-3389-0x00007FF6FF580000-0x00007FF6FF972000-memory.dmp	xmrig
behavioral2/memory/3372-3410-0x00007FF688820000-0x00007FF688C12000-memory.dmp	xmrig
behavioral2/memory/2984-3425-0x00007FF7BE720000-0x00007FF7BEB12000-memory.dmp	xmrig
behavioral2/memory/2688-3431-0x00007FF6DAD50000-0x00007FF6DB142000-memory.dmp	xmrig
behavioral2/memory/1776-3430-0x00007FF70B290000-0x00007FF70B682000-memory.dmp	xmrig
behavioral2/memory/1308-3428-0x00007FF76B0A0000-0x00007FF76B492000-memory.dmp	xmrig
behavioral2/memory/3804-3420-0x00007FF768880000-0x00007FF768C72000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2424	GXQYOXI.exe
1656	xRjyqAd.exe
3924	GeZayTr.exe
5092	jdOvlTE.exe
64	ypEsmEj.exe
2936	EKypgSq.exe
1276	wudkRMi.exe
2904	GUcRBtI.exe
4644	oyfTIQs.exe
2248	bmZSOWo.exe
4704	cZYOlUv.exe
4624	aZmVuCT.exe
4608	iVmdJQz.exe
3372	XHJpUKN.exe
1928	jiYmUPG.exe
2688	pahgJAX.exe
3804	HQoEsQl.exe
1888	iuyDXNH.exe
1308	blAsApN.exe
1776	RouffFn.exe
2984	QCSYrHi.exe
2324	PtfDloM.exe
3796	VtcZiSs.exe
4636	gyqVoFx.exe
3856	YJIoNiS.exe
2200	gwRVxjG.exe
4640	JisaSaJ.exe
4536	BnxLfiB.exe
1948	yUUWqdq.exe
5108	SkNaUUp.exe
1252	HuXXdRV.exe
3600	tOwRdAZ.exe
700	ywTZXzx.exe
1624	lsLdMpf.exe
4928	lIWRkaG.exe
5068	FLHpIYV.exe
4428	csYpECk.exe
5116	dsYAgSg.exe
5104	PXDjCpb.exe
1184	JYVaKrM.exe
3476	PwxOkwk.exe
4596	oEGgbJM.exe
1232	eNsKYsW.exe
3524	DTgIlpT.exe
4544	cbpFDsS.exe
1760	ZYThbrD.exe
1188	VnpoUhJ.exe
4408	ArQMiiC.exe
980	DiybrOY.exe
1940	gKpfIUL.exe
1712	BsHcLeD.exe
920	XZiJCme.exe
1912	zYOnCad.exe
3304	SIEpfDd.exe
4444	JsZEakq.exe
3368	ZHLNeJC.exe
1060	XMdFqzu.exe
4280	DvFDsSQ.exe
3852	DrgnIcb.exe
3584	jGpkdTh.exe
964	wRfUkNm.exe
4948	DPjmXxa.exe
4500	TprMYzv.exe
1540	yyeAkZQ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1012-0-0x00007FF6B99A0000-0x00007FF6B9D92000-memory.dmp	upx
behavioral2/files/0x000b000000023ba4-5.dat	upx
behavioral2/memory/2424-15-0x00007FF7A1C10000-0x00007FF7A2002000-memory.dmp	upx
behavioral2/files/0x000a000000023ba9-24.dat	upx
behavioral2/files/0x000a000000023bb1-68.dat	upx
behavioral2/files/0x000a000000023bc5-161.dat	upx
behavioral2/memory/2904-214-0x00007FF7264B0000-0x00007FF7268A2000-memory.dmp	upx
behavioral2/memory/4644-225-0x00007FF7DFBA0000-0x00007FF7DFF92000-memory.dmp	upx
behavioral2/memory/1776-256-0x00007FF70B290000-0x00007FF70B682000-memory.dmp	upx
behavioral2/memory/4704-260-0x00007FF738070000-0x00007FF738462000-memory.dmp	upx
behavioral2/memory/1308-262-0x00007FF76B0A0000-0x00007FF76B492000-memory.dmp	upx
behavioral2/memory/2688-261-0x00007FF6DAD50000-0x00007FF6DB142000-memory.dmp	upx
behavioral2/memory/3924-259-0x00007FF6A1190000-0x00007FF6A1582000-memory.dmp	upx
behavioral2/memory/1656-258-0x00007FF776010000-0x00007FF776402000-memory.dmp	upx
behavioral2/memory/2984-257-0x00007FF7BE720000-0x00007FF7BEB12000-memory.dmp	upx
behavioral2/memory/1888-255-0x00007FF6FF580000-0x00007FF6FF972000-memory.dmp	upx
behavioral2/memory/3804-254-0x00007FF768880000-0x00007FF768C72000-memory.dmp	upx
behavioral2/memory/1928-253-0x00007FF6E33E0000-0x00007FF6E37D2000-memory.dmp	upx
behavioral2/memory/3372-252-0x00007FF688820000-0x00007FF688C12000-memory.dmp	upx
behavioral2/memory/4608-251-0x00007FF682670000-0x00007FF682A62000-memory.dmp	upx
behavioral2/memory/4624-250-0x00007FF7EF240000-0x00007FF7EF632000-memory.dmp	upx
behavioral2/memory/2248-248-0x00007FF6AB280000-0x00007FF6AB672000-memory.dmp	upx
behavioral2/files/0x000a000000023bca-211.dat	upx
behavioral2/files/0x000a000000023bc9-210.dat	upx
behavioral2/files/0x000a000000023bc3-203.dat	upx
behavioral2/files/0x000a000000023bbc-185.dat	upx
behavioral2/files/0x000a000000023bc8-184.dat	upx
behavioral2/files/0x0031000000023bb6-178.dat	upx
behavioral2/files/0x000a000000023bc7-175.dat	upx
behavioral2/files/0x000a000000023bc6-171.dat	upx
behavioral2/files/0x0031000000023bb8-164.dat	upx
behavioral2/files/0x0031000000023bb7-158.dat	upx
behavioral2/memory/1276-150-0x00007FF68A920000-0x00007FF68AD12000-memory.dmp	upx
behavioral2/files/0x000a000000023bc2-149.dat	upx
behavioral2/files/0x000a000000023bc1-146.dat	upx
behavioral2/files/0x000a000000023bc0-145.dat	upx
behavioral2/files/0x000a000000023bbb-181.dat	upx
behavioral2/files/0x000a000000023bbe-138.dat	upx
behavioral2/files/0x000a000000023bb9-167.dat	upx
behavioral2/files/0x000a000000023bb4-137.dat	upx
behavioral2/files/0x000a000000023bbd-136.dat	upx
behavioral2/files/0x000a000000023bc4-155.dat	upx
behavioral2/memory/2936-117-0x00007FF78A110000-0x00007FF78A502000-memory.dmp	upx
behavioral2/files/0x000a000000023bba-115.dat	upx
behavioral2/files/0x000a000000023bae-111.dat	upx
behavioral2/files/0x000a000000023bbf-142.dat	upx
behavioral2/files/0x000a000000023bb2-103.dat	upx
behavioral2/files/0x000a000000023bb0-99.dat	upx
behavioral2/files/0x000a000000023baf-98.dat	upx
behavioral2/files/0x000a000000023bb3-95.dat	upx
behavioral2/files/0x000a000000023bb5-91.dat	upx
behavioral2/memory/64-88-0x00007FF627CA0000-0x00007FF628092000-memory.dmp	upx
behavioral2/files/0x000a000000023baa-73.dat	upx
behavioral2/memory/5092-70-0x00007FF6BED50000-0x00007FF6BF142000-memory.dmp	upx
behavioral2/files/0x000a000000023bac-79.dat	upx
behavioral2/files/0x000a000000023bab-62.dat	upx
behavioral2/files/0x000a000000023bad-53.dat	upx
behavioral2/files/0x000a000000023ba8-41.dat	upx
behavioral2/files/0x000a000000023ba7-37.dat	upx
behavioral2/files/0x000a000000023ba5-35.dat	upx
behavioral2/files/0x000a000000023ba6-27.dat	upx
behavioral2/memory/2424-3380-0x00007FF7A1C10000-0x00007FF7A2002000-memory.dmp	upx
behavioral2/memory/2936-3383-0x00007FF78A110000-0x00007FF78A502000-memory.dmp	upx
behavioral2/memory/1656-3384-0x00007FF776010000-0x00007FF776402000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\utrYqhm.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\GmZdPuz.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\EWevbpQ.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\jmTclfy.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\dBfEewa.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\aBtHUFG.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\rdFwYqk.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\ctKPesS.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\yxIDjJD.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\BPmuzPs.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\Lxzukko.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\FhSCOIm.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\xTrYCBr.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\BltnNEE.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\ANvfvYR.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\QKuslYH.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\RmzBqlW.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\RDdCair.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\wcFpMrV.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\KfMufFl.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\MDtVKlF.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\WIBxenQ.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\fZOvbNS.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\aTZQCWj.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\BRNrDem.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\bbTymBl.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\vBgfCNv.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\wWcetXE.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\woIiauF.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\EmpNSma.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\bJxCuUu.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\pahgJAX.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\VYmsghP.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\BIoIhYd.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\FSmcvLX.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\nyRgVzU.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\JbIaRXA.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\WBFOLuz.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\OgkusOG.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\ypEsmEj.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\QbxMWpH.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\YOiwnUD.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\RfRpPXH.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\oMoyhUA.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\WIhZNtC.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\cUmGgns.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\xTBNxzj.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\zAOZbVW.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\cXNHAGz.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\oqKrPhq.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\vWnABzW.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\mHiGhDn.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\YcylKgZ.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\vxeKONI.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\vlMttDu.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\hCJnOQo.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\TSqtSrP.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\tEtOjRP.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\UgUdQBi.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\oPSWFut.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\jOHINNi.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\KNoGpgM.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\cZYOlUv.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\wXWGkin.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2316	powershell.exe
2316	powershell.exe
2316	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
Token: SeDebugPrivilege	2316	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1012 wrote to memory of 2316	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	87
PID 1012 wrote to memory of 2316	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	87
PID 1012 wrote to memory of 2424	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	88
PID 1012 wrote to memory of 2424	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	88
PID 1012 wrote to memory of 1656	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	89
PID 1012 wrote to memory of 1656	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	89
PID 1012 wrote to memory of 3924	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	90
PID 1012 wrote to memory of 3924	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	90
PID 1012 wrote to memory of 5092	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	91
PID 1012 wrote to memory of 5092	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	91
PID 1012 wrote to memory of 64	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	92
PID 1012 wrote to memory of 64	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	92
PID 1012 wrote to memory of 2936	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	93
PID 1012 wrote to memory of 2936	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	93
PID 1012 wrote to memory of 1276	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	94
PID 1012 wrote to memory of 1276	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	94
PID 1012 wrote to memory of 2904	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	95
PID 1012 wrote to memory of 2904	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	95
PID 1012 wrote to memory of 4644	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	96
PID 1012 wrote to memory of 4644	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	96
PID 1012 wrote to memory of 2248	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	97
PID 1012 wrote to memory of 2248	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	97
PID 1012 wrote to memory of 4704	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	98
PID 1012 wrote to memory of 4704	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	98
PID 1012 wrote to memory of 4624	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	99
PID 1012 wrote to memory of 4624	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	99
PID 1012 wrote to memory of 4608	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	100
PID 1012 wrote to memory of 4608	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	100
PID 1012 wrote to memory of 3372	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	101
PID 1012 wrote to memory of 3372	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	101
PID 1012 wrote to memory of 1928	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	102
PID 1012 wrote to memory of 1928	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	102
PID 1012 wrote to memory of 2688	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	103
PID 1012 wrote to memory of 2688	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	103
PID 1012 wrote to memory of 3804	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	104
PID 1012 wrote to memory of 3804	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	104
PID 1012 wrote to memory of 1888	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	105
PID 1012 wrote to memory of 1888	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	105
PID 1012 wrote to memory of 3796	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	106
PID 1012 wrote to memory of 3796	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	106
PID 1012 wrote to memory of 1308	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	107
PID 1012 wrote to memory of 1308	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	107
PID 1012 wrote to memory of 1776	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	108
PID 1012 wrote to memory of 1776	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	108
PID 1012 wrote to memory of 2984	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	109
PID 1012 wrote to memory of 2984	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	109
PID 1012 wrote to memory of 2324	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	110
PID 1012 wrote to memory of 2324	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	110
PID 1012 wrote to memory of 4636	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	111
PID 1012 wrote to memory of 4636	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	111
PID 1012 wrote to memory of 3856	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	112
PID 1012 wrote to memory of 3856	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	112
PID 1012 wrote to memory of 2200	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	113
PID 1012 wrote to memory of 2200	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	113
PID 1012 wrote to memory of 4640	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	114
PID 1012 wrote to memory of 4640	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	114
PID 1012 wrote to memory of 4536	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	115
PID 1012 wrote to memory of 4536	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	115
PID 1012 wrote to memory of 1948	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	116
PID 1012 wrote to memory of 1948	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	116
PID 1012 wrote to memory of 5108	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	117
PID 1012 wrote to memory of 5108	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	117
PID 1012 wrote to memory of 1252	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	118
PID 1012 wrote to memory of 1252	1012	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	118

C:\Users\Admin\AppData\Local\Temp\071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2316
- C:\Windows\System\GXQYOXI.exe
  C:\Windows\System\GXQYOXI.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\xRjyqAd.exe
  C:\Windows\System\xRjyqAd.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\GeZayTr.exe
  C:\Windows\System\GeZayTr.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\jdOvlTE.exe
  C:\Windows\System\jdOvlTE.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\ypEsmEj.exe
  C:\Windows\System\ypEsmEj.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\EKypgSq.exe
  C:\Windows\System\EKypgSq.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\wudkRMi.exe
  C:\Windows\System\wudkRMi.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\GUcRBtI.exe
  C:\Windows\System\GUcRBtI.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\oyfTIQs.exe
  C:\Windows\System\oyfTIQs.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\bmZSOWo.exe
  C:\Windows\System\bmZSOWo.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\cZYOlUv.exe
  C:\Windows\System\cZYOlUv.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\aZmVuCT.exe
  C:\Windows\System\aZmVuCT.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\iVmdJQz.exe
  C:\Windows\System\iVmdJQz.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\XHJpUKN.exe
  C:\Windows\System\XHJpUKN.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\jiYmUPG.exe
  C:\Windows\System\jiYmUPG.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\pahgJAX.exe
  C:\Windows\System\pahgJAX.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\HQoEsQl.exe
  C:\Windows\System\HQoEsQl.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\iuyDXNH.exe
  C:\Windows\System\iuyDXNH.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\VtcZiSs.exe
  C:\Windows\System\VtcZiSs.exe
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Windows\System\blAsApN.exe
  C:\Windows\System\blAsApN.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\RouffFn.exe
  C:\Windows\System\RouffFn.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\QCSYrHi.exe
  C:\Windows\System\QCSYrHi.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\PtfDloM.exe
  C:\Windows\System\PtfDloM.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\gyqVoFx.exe
  C:\Windows\System\gyqVoFx.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\YJIoNiS.exe
  C:\Windows\System\YJIoNiS.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\gwRVxjG.exe
  C:\Windows\System\gwRVxjG.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\JisaSaJ.exe
  C:\Windows\System\JisaSaJ.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\BnxLfiB.exe
  C:\Windows\System\BnxLfiB.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\yUUWqdq.exe
  C:\Windows\System\yUUWqdq.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\SkNaUUp.exe
  C:\Windows\System\SkNaUUp.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\HuXXdRV.exe
  C:\Windows\System\HuXXdRV.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\tOwRdAZ.exe
  C:\Windows\System\tOwRdAZ.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\ywTZXzx.exe
  C:\Windows\System\ywTZXzx.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\lsLdMpf.exe
  C:\Windows\System\lsLdMpf.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\lIWRkaG.exe
  C:\Windows\System\lIWRkaG.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\FLHpIYV.exe
  C:\Windows\System\FLHpIYV.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\csYpECk.exe
  C:\Windows\System\csYpECk.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\VnpoUhJ.exe
  C:\Windows\System\VnpoUhJ.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\dsYAgSg.exe
  C:\Windows\System\dsYAgSg.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\PXDjCpb.exe
  C:\Windows\System\PXDjCpb.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\JYVaKrM.exe
  C:\Windows\System\JYVaKrM.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\JsZEakq.exe
  C:\Windows\System\JsZEakq.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\XMdFqzu.exe
  C:\Windows\System\XMdFqzu.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\PwxOkwk.exe
  C:\Windows\System\PwxOkwk.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\oEGgbJM.exe
  C:\Windows\System\oEGgbJM.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\eNsKYsW.exe
  C:\Windows\System\eNsKYsW.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\DPjmXxa.exe
  C:\Windows\System\DPjmXxa.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\DTgIlpT.exe
  C:\Windows\System\DTgIlpT.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\cbpFDsS.exe
  C:\Windows\System\cbpFDsS.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\ZYThbrD.exe
  C:\Windows\System\ZYThbrD.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\ArQMiiC.exe
  C:\Windows\System\ArQMiiC.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\DiybrOY.exe
  C:\Windows\System\DiybrOY.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\gKpfIUL.exe
  C:\Windows\System\gKpfIUL.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\BsHcLeD.exe
  C:\Windows\System\BsHcLeD.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\XZiJCme.exe
  C:\Windows\System\XZiJCme.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\zYOnCad.exe
  C:\Windows\System\zYOnCad.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\SIEpfDd.exe
  C:\Windows\System\SIEpfDd.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System\ZHLNeJC.exe
  C:\Windows\System\ZHLNeJC.exe
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Windows\System\DrgnIcb.exe
  C:\Windows\System\DrgnIcb.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\DvFDsSQ.exe
  C:\Windows\System\DvFDsSQ.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\jGpkdTh.exe
  C:\Windows\System\jGpkdTh.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\wRfUkNm.exe
  C:\Windows\System\wRfUkNm.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\TprMYzv.exe
  C:\Windows\System\TprMYzv.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\yyeAkZQ.exe
  C:\Windows\System\yyeAkZQ.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\puvsuEB.exe
  C:\Windows\System\puvsuEB.exe
  2⤵
  PID:5060
- C:\Windows\System\UzDMBAi.exe
  C:\Windows\System\UzDMBAi.exe
  2⤵
  PID:552
- C:\Windows\System\jmTclfy.exe
  C:\Windows\System\jmTclfy.exe
  2⤵
  PID:2192
- C:\Windows\System\urjVSst.exe
  C:\Windows\System\urjVSst.exe
  2⤵
  PID:3176
- C:\Windows\System\wGbMlHs.exe
  C:\Windows\System\wGbMlHs.exe
  2⤵
  PID:4084
- C:\Windows\System\AtwlfUs.exe
  C:\Windows\System\AtwlfUs.exe
  2⤵
  PID:2592
- C:\Windows\System\bKaWBPd.exe
  C:\Windows\System\bKaWBPd.exe
  2⤵
  PID:3348
- C:\Windows\System\JwQMUCo.exe
  C:\Windows\System\JwQMUCo.exe
  2⤵
  PID:1932
- C:\Windows\System\qFDTsvy.exe
  C:\Windows\System\qFDTsvy.exe
  2⤵
  PID:4292
- C:\Windows\System\nWmMhmu.exe
  C:\Windows\System\nWmMhmu.exe
  2⤵
  PID:880
- C:\Windows\System\fzpXgPt.exe
  C:\Windows\System\fzpXgPt.exe
  2⤵
  PID:4880
- C:\Windows\System\JjdvQtP.exe
  C:\Windows\System\JjdvQtP.exe
  2⤵
  PID:2940
- C:\Windows\System\ZTKgMNu.exe
  C:\Windows\System\ZTKgMNu.exe
  2⤵
  PID:4576
- C:\Windows\System\pWjtvCc.exe
  C:\Windows\System\pWjtvCc.exe
  2⤵
  PID:540
- C:\Windows\System\LcQTPmA.exe
  C:\Windows\System\LcQTPmA.exe
  2⤵
  PID:1136
- C:\Windows\System\AthiVWg.exe
  C:\Windows\System\AthiVWg.exe
  2⤵
  PID:2040
- C:\Windows\System\hJXGHuO.exe
  C:\Windows\System\hJXGHuO.exe
  2⤵
  PID:5132
- C:\Windows\System\hdeyvRR.exe
  C:\Windows\System\hdeyvRR.exe
  2⤵
  PID:5148
- C:\Windows\System\oYaSzzr.exe
  C:\Windows\System\oYaSzzr.exe
  2⤵
  PID:5168
- C:\Windows\System\bbTymBl.exe
  C:\Windows\System\bbTymBl.exe
  2⤵
  PID:5184
- C:\Windows\System\aJRXtCN.exe
  C:\Windows\System\aJRXtCN.exe
  2⤵
  PID:5204
- C:\Windows\System\HexAWWe.exe
  C:\Windows\System\HexAWWe.exe
  2⤵
  PID:5340
- C:\Windows\System\ywKpSoc.exe
  C:\Windows\System\ywKpSoc.exe
  2⤵
  PID:5364
- C:\Windows\System\uijSrKe.exe
  C:\Windows\System\uijSrKe.exe
  2⤵
  PID:5384
- C:\Windows\System\uYNgKLC.exe
  C:\Windows\System\uYNgKLC.exe
  2⤵
  PID:5408
- C:\Windows\System\kinVFvi.exe
  C:\Windows\System\kinVFvi.exe
  2⤵
  PID:5428
- C:\Windows\System\ZOHOvee.exe
  C:\Windows\System\ZOHOvee.exe
  2⤵
  PID:5452
- C:\Windows\System\RNSBmjj.exe
  C:\Windows\System\RNSBmjj.exe
  2⤵
  PID:5480
- C:\Windows\System\RfZJlWr.exe
  C:\Windows\System\RfZJlWr.exe
  2⤵
  PID:5508
- C:\Windows\System\cWMTnZG.exe
  C:\Windows\System\cWMTnZG.exe
  2⤵
  PID:5528
- C:\Windows\System\KaPDoZA.exe
  C:\Windows\System\KaPDoZA.exe
  2⤵
  PID:5552
- C:\Windows\System\WxcrtkW.exe
  C:\Windows\System\WxcrtkW.exe
  2⤵
  PID:5576
- C:\Windows\System\WpJoksh.exe
  C:\Windows\System\WpJoksh.exe
  2⤵
  PID:5600
- C:\Windows\System\xGuUCqR.exe
  C:\Windows\System\xGuUCqR.exe
  2⤵
  PID:5620
- C:\Windows\System\EogPVTG.exe
  C:\Windows\System\EogPVTG.exe
  2⤵
  PID:5640
- C:\Windows\System\dcXqGRu.exe
  C:\Windows\System\dcXqGRu.exe
  2⤵
  PID:5664
- C:\Windows\System\ebxjMhw.exe
  C:\Windows\System\ebxjMhw.exe
  2⤵
  PID:5688
- C:\Windows\System\SoSVRnn.exe
  C:\Windows\System\SoSVRnn.exe
  2⤵
  PID:5708
- C:\Windows\System\SkuIAPQ.exe
  C:\Windows\System\SkuIAPQ.exe
  2⤵
  PID:5724
- C:\Windows\System\vOOUKzH.exe
  C:\Windows\System\vOOUKzH.exe
  2⤵
  PID:5740
- C:\Windows\System\BlmUCgc.exe
  C:\Windows\System\BlmUCgc.exe
  2⤵
  PID:5756
- C:\Windows\System\QqjxQDL.exe
  C:\Windows\System\QqjxQDL.exe
  2⤵
  PID:5772
- C:\Windows\System\eUYFFIn.exe
  C:\Windows\System\eUYFFIn.exe
  2⤵
  PID:5796
- C:\Windows\System\MDtVKlF.exe
  C:\Windows\System\MDtVKlF.exe
  2⤵
  PID:5820
- C:\Windows\System\ZyuAMzY.exe
  C:\Windows\System\ZyuAMzY.exe
  2⤵
  PID:5836
- C:\Windows\System\utrYqhm.exe
  C:\Windows\System\utrYqhm.exe
  2⤵
  PID:5860
- C:\Windows\System\ThaLDoA.exe
  C:\Windows\System\ThaLDoA.exe
  2⤵
  PID:5896
- C:\Windows\System\hwbxGia.exe
  C:\Windows\System\hwbxGia.exe
  2⤵
  PID:5912
- C:\Windows\System\iPvbUuU.exe
  C:\Windows\System\iPvbUuU.exe
  2⤵
  PID:5948
- C:\Windows\System\pzTFJQe.exe
  C:\Windows\System\pzTFJQe.exe
  2⤵
  PID:5968
- C:\Windows\System\RORlxdW.exe
  C:\Windows\System\RORlxdW.exe
  2⤵
  PID:5992
- C:\Windows\System\AIYpjvE.exe
  C:\Windows\System\AIYpjvE.exe
  2⤵
  PID:6008
- C:\Windows\System\kKyFqwo.exe
  C:\Windows\System\kKyFqwo.exe
  2⤵
  PID:6112
- C:\Windows\System\lIoPTVq.exe
  C:\Windows\System\lIoPTVq.exe
  2⤵
  PID:6132
- C:\Windows\System\sxBgWoE.exe
  C:\Windows\System\sxBgWoE.exe
  2⤵
  PID:624
- C:\Windows\System\XtHMLDL.exe
  C:\Windows\System\XtHMLDL.exe
  2⤵
  PID:4248
- C:\Windows\System\SQqrzGG.exe
  C:\Windows\System\SQqrzGG.exe
  2⤵
  PID:940
- C:\Windows\System\ZojkOEK.exe
  C:\Windows\System\ZojkOEK.exe
  2⤵
  PID:4420
- C:\Windows\System\vlMttDu.exe
  C:\Windows\System\vlMttDu.exe
  2⤵
  PID:5396
- C:\Windows\System\dJfjztv.exe
  C:\Windows\System\dJfjztv.exe
  2⤵
  PID:5440
- C:\Windows\System\zxHFuxb.exe
  C:\Windows\System\zxHFuxb.exe
  2⤵
  PID:5476
- C:\Windows\System\kIMLjJF.exe
  C:\Windows\System\kIMLjJF.exe
  2⤵
  PID:5124
- C:\Windows\System\KhuEAXm.exe
  C:\Windows\System\KhuEAXm.exe
  2⤵
  PID:5176
- C:\Windows\System\DPZZgYU.exe
  C:\Windows\System\DPZZgYU.exe
  2⤵
  PID:5376
- C:\Windows\System\VCDWRwN.exe
  C:\Windows\System\VCDWRwN.exe
  2⤵
  PID:5856
- C:\Windows\System\WVpTSTI.exe
  C:\Windows\System\WVpTSTI.exe
  2⤵
  PID:5436
- C:\Windows\System\HuxysZf.exe
  C:\Windows\System\HuxysZf.exe
  2⤵
  PID:5940
- C:\Windows\System\uOxClSi.exe
  C:\Windows\System\uOxClSi.exe
  2⤵
  PID:6380
- C:\Windows\System\tHNhxkQ.exe
  C:\Windows\System\tHNhxkQ.exe
  2⤵
  PID:6400
- C:\Windows\System\NdIBtiq.exe
  C:\Windows\System\NdIBtiq.exe
  2⤵
  PID:6420
- C:\Windows\System\jXkLBGb.exe
  C:\Windows\System\jXkLBGb.exe
  2⤵
  PID:6436
- C:\Windows\System\SjPtHtl.exe
  C:\Windows\System\SjPtHtl.exe
  2⤵
  PID:6460
- C:\Windows\System\cXNHAGz.exe
  C:\Windows\System\cXNHAGz.exe
  2⤵
  PID:6476
- C:\Windows\System\VryTkcR.exe
  C:\Windows\System\VryTkcR.exe
  2⤵
  PID:6500
- C:\Windows\System\lxumMYg.exe
  C:\Windows\System\lxumMYg.exe
  2⤵
  PID:6520
- C:\Windows\System\RPeIGIi.exe
  C:\Windows\System\RPeIGIi.exe
  2⤵
  PID:6552
- C:\Windows\System\sdyEfof.exe
  C:\Windows\System\sdyEfof.exe
  2⤵
  PID:6572
- C:\Windows\System\PCPCwqm.exe
  C:\Windows\System\PCPCwqm.exe
  2⤵
  PID:6596
- C:\Windows\System\rNJThhV.exe
  C:\Windows\System\rNJThhV.exe
  2⤵
  PID:6612
- C:\Windows\System\tIVxbOO.exe
  C:\Windows\System\tIVxbOO.exe
  2⤵
  PID:6636
- C:\Windows\System\wYUTRUD.exe
  C:\Windows\System\wYUTRUD.exe
  2⤵
  PID:6656
- C:\Windows\System\OQtLMrp.exe
  C:\Windows\System\OQtLMrp.exe
  2⤵
  PID:6676
- C:\Windows\System\avbngzj.exe
  C:\Windows\System\avbngzj.exe
  2⤵
  PID:6704
- C:\Windows\System\YonMTCl.exe
  C:\Windows\System\YonMTCl.exe
  2⤵
  PID:6720
- C:\Windows\System\mDQhAKI.exe
  C:\Windows\System\mDQhAKI.exe
  2⤵
  PID:6740
- C:\Windows\System\budGkKl.exe
  C:\Windows\System\budGkKl.exe
  2⤵
  PID:6760
- C:\Windows\System\iUOSyNB.exe
  C:\Windows\System\iUOSyNB.exe
  2⤵
  PID:6788
- C:\Windows\System\HjPIOMB.exe
  C:\Windows\System\HjPIOMB.exe
  2⤵
  PID:6808
- C:\Windows\System\EZsMWgJ.exe
  C:\Windows\System\EZsMWgJ.exe
  2⤵
  PID:6828
- C:\Windows\System\DsFbZms.exe
  C:\Windows\System\DsFbZms.exe
  2⤵
  PID:6856
- C:\Windows\System\YqSigrA.exe
  C:\Windows\System\YqSigrA.exe
  2⤵
  PID:6872
- C:\Windows\System\oZoDYIY.exe
  C:\Windows\System\oZoDYIY.exe
  2⤵
  PID:6892
- C:\Windows\System\bqeHkYl.exe
  C:\Windows\System\bqeHkYl.exe
  2⤵
  PID:6912
- C:\Windows\System\yyNvZvy.exe
  C:\Windows\System\yyNvZvy.exe
  2⤵
  PID:6948
- C:\Windows\System\VlRKaxX.exe
  C:\Windows\System\VlRKaxX.exe
  2⤵
  PID:6972
- C:\Windows\System\GoIidqh.exe
  C:\Windows\System\GoIidqh.exe
  2⤵
  PID:6992
- C:\Windows\System\uNZGQVB.exe
  C:\Windows\System\uNZGQVB.exe
  2⤵
  PID:7016
- C:\Windows\System\EYpXlCb.exe
  C:\Windows\System\EYpXlCb.exe
  2⤵
  PID:7040
- C:\Windows\System\RsmBXSI.exe
  C:\Windows\System\RsmBXSI.exe
  2⤵
  PID:7060
- C:\Windows\System\xfoXbrr.exe
  C:\Windows\System\xfoXbrr.exe
  2⤵
  PID:7076
- C:\Windows\System\mrtSote.exe
  C:\Windows\System\mrtSote.exe
  2⤵
  PID:7100
- C:\Windows\System\vIhgQyJ.exe
  C:\Windows\System\vIhgQyJ.exe
  2⤵
  PID:7124
- C:\Windows\System\ATVnPUA.exe
  C:\Windows\System\ATVnPUA.exe
  2⤵
  PID:7144
- C:\Windows\System\SqOlUfi.exe
  C:\Windows\System\SqOlUfi.exe
  2⤵
  PID:6052
- C:\Windows\System\KDUtRhH.exe
  C:\Windows\System\KDUtRhH.exe
  2⤵
  PID:6092
- C:\Windows\System\WVRPYQB.exe
  C:\Windows\System\WVRPYQB.exe
  2⤵
  PID:6140
- C:\Windows\System\bwPipYN.exe
  C:\Windows\System\bwPipYN.exe
  2⤵
  PID:3764
- C:\Windows\System\iYyofyf.exe
  C:\Windows\System\iYyofyf.exe
  2⤵
  PID:4056
- C:\Windows\System\VNCMxDK.exe
  C:\Windows\System\VNCMxDK.exe
  2⤵
  PID:4104
- C:\Windows\System\TeLGqzD.exe
  C:\Windows\System\TeLGqzD.exe
  2⤵
  PID:3444
- C:\Windows\System\rMGzDDR.exe
  C:\Windows\System\rMGzDDR.exe
  2⤵
  PID:4152
- C:\Windows\System\lpNyINP.exe
  C:\Windows\System\lpNyINP.exe
  2⤵
  PID:5192
- C:\Windows\System\qlrsIYU.exe
  C:\Windows\System\qlrsIYU.exe
  2⤵
  PID:5928
- C:\Windows\System\cbSKsji.exe
  C:\Windows\System\cbSKsji.exe
  2⤵
  PID:1436
- C:\Windows\System\EFWkBBv.exe
  C:\Windows\System\EFWkBBv.exe
  2⤵
  PID:2916
- C:\Windows\System\JbIaRXA.exe
  C:\Windows\System\JbIaRXA.exe
  2⤵
  PID:4992
- C:\Windows\System\rNKFSPO.exe
  C:\Windows\System\rNKFSPO.exe
  2⤵
  PID:3424
- C:\Windows\System\pODhdRF.exe
  C:\Windows\System\pODhdRF.exe
  2⤵
  PID:4320
- C:\Windows\System\mPSWCzS.exe
  C:\Windows\System\mPSWCzS.exe
  2⤵
  PID:4412
- C:\Windows\System\WRbbovf.exe
  C:\Windows\System\WRbbovf.exe
  2⤵
  PID:3472
- C:\Windows\System\vyiwiNj.exe
  C:\Windows\System\vyiwiNj.exe
  2⤵
  PID:4920
- C:\Windows\System\fYHxLaW.exe
  C:\Windows\System\fYHxLaW.exe
  2⤵
  PID:1052
- C:\Windows\System\FflEyzT.exe
  C:\Windows\System\FflEyzT.exe
  2⤵
  PID:1364
- C:\Windows\System\vmmdNhn.exe
  C:\Windows\System\vmmdNhn.exe
  2⤵
  PID:5872
- C:\Windows\System\iEgOrgK.exe
  C:\Windows\System\iEgOrgK.exe
  2⤵
  PID:3576
- C:\Windows\System\llqAwQn.exe
  C:\Windows\System\llqAwQn.exe
  2⤵
  PID:3792
- C:\Windows\System\ODbaPfE.exe
  C:\Windows\System\ODbaPfE.exe
  2⤵
  PID:3340
- C:\Windows\System\fczidaN.exe
  C:\Windows\System\fczidaN.exe
  2⤵
  PID:3004
- C:\Windows\System\qZdIKtY.exe
  C:\Windows\System\qZdIKtY.exe
  2⤵
  PID:816
- C:\Windows\System\CosgTzA.exe
  C:\Windows\System\CosgTzA.exe
  2⤵
  PID:2460
- C:\Windows\System\CqndAtl.exe
  C:\Windows\System\CqndAtl.exe
  2⤵
  PID:1008
- C:\Windows\System\WARNfYj.exe
  C:\Windows\System\WARNfYj.exe
  2⤵
  PID:6396
- C:\Windows\System\pZLDNDY.exe
  C:\Windows\System\pZLDNDY.exe
  2⤵
  PID:6248
- C:\Windows\System\PcxARJw.exe
  C:\Windows\System\PcxARJw.exe
  2⤵
  PID:6508
- C:\Windows\System\LroDGJR.exe
  C:\Windows\System\LroDGJR.exe
  2⤵
  PID:6268
- C:\Windows\System\KiSbKhA.exe
  C:\Windows\System\KiSbKhA.exe
  2⤵
  PID:6288
- C:\Windows\System\vvkGZFU.exe
  C:\Windows\System\vvkGZFU.exe
  2⤵
  PID:6304
- C:\Windows\System\OopIEIi.exe
  C:\Windows\System\OopIEIi.exe
  2⤵
  PID:6324
- C:\Windows\System\SzitVvK.exe
  C:\Windows\System\SzitVvK.exe
  2⤵
  PID:6564
- C:\Windows\System\VuIFKna.exe
  C:\Windows\System\VuIFKna.exe
  2⤵
  PID:6604
- C:\Windows\System\QASNPhS.exe
  C:\Windows\System\QASNPhS.exe
  2⤵
  PID:6472
- C:\Windows\System\ONQBYRc.exe
  C:\Windows\System\ONQBYRc.exe
  2⤵
  PID:6736
- C:\Windows\System\wrwelkH.exe
  C:\Windows\System\wrwelkH.exe
  2⤵
  PID:6432
- C:\Windows\System\JrZBRLi.exe
  C:\Windows\System\JrZBRLi.exe
  2⤵
  PID:6728
- C:\Windows\System\kOzsOmc.exe
  C:\Windows\System\kOzsOmc.exe
  2⤵
  PID:6880
- C:\Windows\System\WfhYVTi.exe
  C:\Windows\System\WfhYVTi.exe
  2⤵
  PID:6908
- C:\Windows\System\umfyrwN.exe
  C:\Windows\System\umfyrwN.exe
  2⤵
  PID:6820
- C:\Windows\System\KyaMLPB.exe
  C:\Windows\System\KyaMLPB.exe
  2⤵
  PID:6904
- C:\Windows\System\wsWrgUZ.exe
  C:\Windows\System\wsWrgUZ.exe
  2⤵
  PID:7108
- C:\Windows\System\MLTIcBk.exe
  C:\Windows\System\MLTIcBk.exe
  2⤵
  PID:7140
- C:\Windows\System\OPDidSU.exe
  C:\Windows\System\OPDidSU.exe
  2⤵
  PID:2676
- C:\Windows\System\rLDTREZ.exe
  C:\Windows\System\rLDTREZ.exe
  2⤵
  PID:2064
- C:\Windows\System\LwtKwKg.exe
  C:\Windows\System\LwtKwKg.exe
  2⤵
  PID:5012
- C:\Windows\System\hzniePw.exe
  C:\Windows\System\hzniePw.exe
  2⤵
  PID:1792
- C:\Windows\System\JyAcRns.exe
  C:\Windows\System\JyAcRns.exe
  2⤵
  PID:7072
- C:\Windows\System\ZewbpWG.exe
  C:\Windows\System\ZewbpWG.exe
  2⤵
  PID:2136
- C:\Windows\System\vdLFUdp.exe
  C:\Windows\System\vdLFUdp.exe
  2⤵
  PID:7136
- C:\Windows\System\dwUSBJS.exe
  C:\Windows\System\dwUSBJS.exe
  2⤵
  PID:5196
- C:\Windows\System\pyUUOiB.exe
  C:\Windows\System\pyUUOiB.exe
  2⤵
  PID:6128
- C:\Windows\System\xvQmWPJ.exe
  C:\Windows\System\xvQmWPJ.exe
  2⤵
  PID:852
- C:\Windows\System\TbCUzqk.exe
  C:\Windows\System\TbCUzqk.exe
  2⤵
  PID:6280
- C:\Windows\System\uXHoIjc.exe
  C:\Windows\System\uXHoIjc.exe
  2⤵
  PID:7184
- C:\Windows\System\NcgxNff.exe
  C:\Windows\System\NcgxNff.exe
  2⤵
  PID:7204
- C:\Windows\System\qzuKmIj.exe
  C:\Windows\System\qzuKmIj.exe
  2⤵
  PID:7232
- C:\Windows\System\VONXZLG.exe
  C:\Windows\System\VONXZLG.exe
  2⤵
  PID:7252
- C:\Windows\System\pitzJIz.exe
  C:\Windows\System\pitzJIz.exe
  2⤵
  PID:7272
- C:\Windows\System\zPaEkhk.exe
  C:\Windows\System\zPaEkhk.exe
  2⤵
  PID:7296
- C:\Windows\System\fBtMSZV.exe
  C:\Windows\System\fBtMSZV.exe
  2⤵
  PID:7320
- C:\Windows\System\rgUGeOC.exe
  C:\Windows\System\rgUGeOC.exe
  2⤵
  PID:7336
- C:\Windows\System\GXeiYjF.exe
  C:\Windows\System\GXeiYjF.exe
  2⤵
  PID:7356
- C:\Windows\System\noZMqju.exe
  C:\Windows\System\noZMqju.exe
  2⤵
  PID:7376
- C:\Windows\System\pklOOMI.exe
  C:\Windows\System\pklOOMI.exe
  2⤵
  PID:7396
- C:\Windows\System\fnmJbGC.exe
  C:\Windows\System\fnmJbGC.exe
  2⤵
  PID:7424
- C:\Windows\System\weSDtVG.exe
  C:\Windows\System\weSDtVG.exe
  2⤵
  PID:7440
- C:\Windows\System\ASIqAWO.exe
  C:\Windows\System\ASIqAWO.exe
  2⤵
  PID:7468
- C:\Windows\System\pSfMeGO.exe
  C:\Windows\System\pSfMeGO.exe
  2⤵
  PID:7488
- C:\Windows\System\qGwQeSt.exe
  C:\Windows\System\qGwQeSt.exe
  2⤵
  PID:7508
- C:\Windows\System\RWdUjck.exe
  C:\Windows\System\RWdUjck.exe
  2⤵
  PID:7532
- C:\Windows\System\hVSzOAl.exe
  C:\Windows\System\hVSzOAl.exe
  2⤵
  PID:7556
- C:\Windows\System\XURuasX.exe
  C:\Windows\System\XURuasX.exe
  2⤵
  PID:7572
- C:\Windows\System\FhSCOIm.exe
  C:\Windows\System\FhSCOIm.exe
  2⤵
  PID:7596
- C:\Windows\System\fjszLIs.exe
  C:\Windows\System\fjszLIs.exe
  2⤵
  PID:7616
- C:\Windows\System\RbsMEmE.exe
  C:\Windows\System\RbsMEmE.exe
  2⤵
  PID:7632
- C:\Windows\System\rOrbOYs.exe
  C:\Windows\System\rOrbOYs.exe
  2⤵
  PID:7656
- C:\Windows\System\cHfloRf.exe
  C:\Windows\System\cHfloRf.exe
  2⤵
  PID:7680
- C:\Windows\System\MtSewpR.exe
  C:\Windows\System\MtSewpR.exe
  2⤵
  PID:7704
- C:\Windows\System\GlpMMCG.exe
  C:\Windows\System\GlpMMCG.exe
  2⤵
  PID:7720
- C:\Windows\System\mtiHYYl.exe
  C:\Windows\System\mtiHYYl.exe
  2⤵
  PID:7744
- C:\Windows\System\kwEReCL.exe
  C:\Windows\System\kwEReCL.exe
  2⤵
  PID:7764
- C:\Windows\System\TsNlIYZ.exe
  C:\Windows\System\TsNlIYZ.exe
  2⤵
  PID:7784
- C:\Windows\System\qDRgYcy.exe
  C:\Windows\System\qDRgYcy.exe
  2⤵
  PID:7816
- C:\Windows\System\xpkxKRA.exe
  C:\Windows\System\xpkxKRA.exe
  2⤵
  PID:7840
- C:\Windows\System\nqtFeqM.exe
  C:\Windows\System\nqtFeqM.exe
  2⤵
  PID:7860
- C:\Windows\System\xyCNIOl.exe
  C:\Windows\System\xyCNIOl.exe
  2⤵
  PID:7876
- C:\Windows\System\TXMyxTh.exe
  C:\Windows\System\TXMyxTh.exe
  2⤵
  PID:7904
- C:\Windows\System\DkHcglf.exe
  C:\Windows\System\DkHcglf.exe
  2⤵
  PID:7924
- C:\Windows\System\nGJeulz.exe
  C:\Windows\System\nGJeulz.exe
  2⤵
  PID:7948
- C:\Windows\System\BNwHYoW.exe
  C:\Windows\System\BNwHYoW.exe
  2⤵
  PID:7968
- C:\Windows\System\EMaOHQW.exe
  C:\Windows\System\EMaOHQW.exe
  2⤵
  PID:8000
- C:\Windows\System\ZmxWKQp.exe
  C:\Windows\System\ZmxWKQp.exe
  2⤵
  PID:8024
- C:\Windows\System\OAlQaRs.exe
  C:\Windows\System\OAlQaRs.exe
  2⤵
  PID:8052
- C:\Windows\System\GMxyMCt.exe
  C:\Windows\System\GMxyMCt.exe
  2⤵
  PID:8072
- C:\Windows\System\qhOBOoh.exe
  C:\Windows\System\qhOBOoh.exe
  2⤵
  PID:8096
- C:\Windows\System\uukZlXg.exe
  C:\Windows\System\uukZlXg.exe
  2⤵
  PID:8112
- C:\Windows\System\oqKrPhq.exe
  C:\Windows\System\oqKrPhq.exe
  2⤵
  PID:8136
- C:\Windows\System\piLvWBq.exe
  C:\Windows\System\piLvWBq.exe
  2⤵
  PID:8156
- C:\Windows\System\FMVhQHv.exe
  C:\Windows\System\FMVhQHv.exe
  2⤵
  PID:8172
- C:\Windows\System\omBmjbn.exe
  C:\Windows\System\omBmjbn.exe
  2⤵
  PID:3220
- C:\Windows\System\oNrkGYw.exe
  C:\Windows\System\oNrkGYw.exe
  2⤵
  PID:6888
- C:\Windows\System\pLUHKJl.exe
  C:\Windows\System\pLUHKJl.exe
  2⤵
  PID:2004
- C:\Windows\System\lNPOaog.exe
  C:\Windows\System\lNPOaog.exe
  2⤵
  PID:1664
- C:\Windows\System\UGmYJsg.exe
  C:\Windows\System\UGmYJsg.exe
  2⤵
  PID:6084
- C:\Windows\System\tuvqsoc.exe
  C:\Windows\System\tuvqsoc.exe
  2⤵
  PID:6388
- C:\Windows\System\RmzBqlW.exe
  C:\Windows\System\RmzBqlW.exe
  2⤵
  PID:7092
- C:\Windows\System\TNKhCrA.exe
  C:\Windows\System\TNKhCrA.exe
  2⤵
  PID:6068
- C:\Windows\System\JArXyPb.exe
  C:\Windows\System\JArXyPb.exe
  2⤵
  PID:5100
- C:\Windows\System\vWnABzW.exe
  C:\Windows\System\vWnABzW.exe
  2⤵
  PID:7056
- C:\Windows\System\hiEeshd.exe
  C:\Windows\System\hiEeshd.exe
  2⤵
  PID:7196
- C:\Windows\System\FeOWEYB.exe
  C:\Windows\System\FeOWEYB.exe
  2⤵
  PID:6580
- C:\Windows\System\OidiscS.exe
  C:\Windows\System\OidiscS.exe
  2⤵
  PID:6732
- C:\Windows\System\WEDcokz.exe
  C:\Windows\System\WEDcokz.exe
  2⤵
  PID:6768
- C:\Windows\System\ZpFMRnq.exe
  C:\Windows\System\ZpFMRnq.exe
  2⤵
  PID:7404
- C:\Windows\System\pVSdtWm.exe
  C:\Windows\System\pVSdtWm.exe
  2⤵
  PID:8016
- C:\Windows\System\OTPLEBP.exe
  C:\Windows\System\OTPLEBP.exe
  2⤵
  PID:7940
- C:\Windows\System\hfsUIXX.exe
  C:\Windows\System\hfsUIXX.exe
  2⤵
  PID:8200
- C:\Windows\System\yldGQXe.exe
  C:\Windows\System\yldGQXe.exe
  2⤵
  PID:8216
- C:\Windows\System\YBRfYmQ.exe
  C:\Windows\System\YBRfYmQ.exe
  2⤵
  PID:8252
- C:\Windows\System\TrHRwKX.exe
  C:\Windows\System\TrHRwKX.exe
  2⤵
  PID:8272
- C:\Windows\System\bGxZuIf.exe
  C:\Windows\System\bGxZuIf.exe
  2⤵
  PID:8296
- C:\Windows\System\gVvQVjM.exe
  C:\Windows\System\gVvQVjM.exe
  2⤵
  PID:8320
- C:\Windows\System\iawpcmg.exe
  C:\Windows\System\iawpcmg.exe
  2⤵
  PID:8348
- C:\Windows\System\vpjjMJj.exe
  C:\Windows\System\vpjjMJj.exe
  2⤵
  PID:8364
- C:\Windows\System\drqxZkg.exe
  C:\Windows\System\drqxZkg.exe
  2⤵
  PID:8392
- C:\Windows\System\BOUrlID.exe
  C:\Windows\System\BOUrlID.exe
  2⤵
  PID:8436
- C:\Windows\System\GZXbvnH.exe
  C:\Windows\System\GZXbvnH.exe
  2⤵
  PID:8456
- C:\Windows\System\YxqUMhc.exe
  C:\Windows\System\YxqUMhc.exe
  2⤵
  PID:8480
- C:\Windows\System\zZNYayv.exe
  C:\Windows\System\zZNYayv.exe
  2⤵
  PID:8508
- C:\Windows\System\qEaSPrm.exe
  C:\Windows\System\qEaSPrm.exe
  2⤵
  PID:8524
- C:\Windows\System\ONrUZef.exe
  C:\Windows\System\ONrUZef.exe
  2⤵
  PID:8548
- C:\Windows\System\bUYElhO.exe
  C:\Windows\System\bUYElhO.exe
  2⤵
  PID:8572
- C:\Windows\System\zkTjncN.exe
  C:\Windows\System\zkTjncN.exe
  2⤵
  PID:8592
- C:\Windows\System\xCsbzPA.exe
  C:\Windows\System\xCsbzPA.exe
  2⤵
  PID:8612
- C:\Windows\System\mUiTPdJ.exe
  C:\Windows\System\mUiTPdJ.exe
  2⤵
  PID:8636
- C:\Windows\System\qIUKBhS.exe
  C:\Windows\System\qIUKBhS.exe
  2⤵
  PID:8656
- C:\Windows\System\ZktkSjw.exe
  C:\Windows\System\ZktkSjw.exe
  2⤵
  PID:8676
- C:\Windows\System\ctKPesS.exe
  C:\Windows\System\ctKPesS.exe
  2⤵
  PID:8700
- C:\Windows\System\ZhQVIxh.exe
  C:\Windows\System\ZhQVIxh.exe
  2⤵
  PID:8724
- C:\Windows\System\quTMtMf.exe
  C:\Windows\System\quTMtMf.exe
  2⤵
  PID:8748
- C:\Windows\System\qluggQk.exe
  C:\Windows\System\qluggQk.exe
  2⤵
  PID:8768
- C:\Windows\System\IuVxqzJ.exe
  C:\Windows\System\IuVxqzJ.exe
  2⤵
  PID:8792
- C:\Windows\System\tkJOXXK.exe
  C:\Windows\System\tkJOXXK.exe
  2⤵
  PID:8812
- C:\Windows\System\pWMYPkY.exe
  C:\Windows\System\pWMYPkY.exe
  2⤵
  PID:8832
- C:\Windows\System\xjUNwye.exe
  C:\Windows\System\xjUNwye.exe
  2⤵
  PID:8856
- C:\Windows\System\pqSgrUu.exe
  C:\Windows\System\pqSgrUu.exe
  2⤵
  PID:8880
- C:\Windows\System\qZNFgAr.exe
  C:\Windows\System\qZNFgAr.exe
  2⤵
  PID:8904
- C:\Windows\System\JHKxovJ.exe
  C:\Windows\System\JHKxovJ.exe
  2⤵
  PID:8936
- C:\Windows\System\tdrJAQf.exe
  C:\Windows\System\tdrJAQf.exe
  2⤵
  PID:8960
- C:\Windows\System\jpIHTLE.exe
  C:\Windows\System\jpIHTLE.exe
  2⤵
  PID:9008
- C:\Windows\System\TfpIrnL.exe
  C:\Windows\System\TfpIrnL.exe
  2⤵
  PID:9048
- C:\Windows\System\ZySDrfn.exe
  C:\Windows\System\ZySDrfn.exe
  2⤵
  PID:9068
- C:\Windows\System\UcbnQED.exe
  C:\Windows\System\UcbnQED.exe
  2⤵
  PID:9096
- C:\Windows\System\gkVQCST.exe
  C:\Windows\System\gkVQCST.exe
  2⤵
  PID:9120
- C:\Windows\System\WIBxenQ.exe
  C:\Windows\System\WIBxenQ.exe
  2⤵
  PID:9144
- C:\Windows\System\uucXzCr.exe
  C:\Windows\System\uucXzCr.exe
  2⤵
  PID:9164
- C:\Windows\System\akfdtYg.exe
  C:\Windows\System\akfdtYg.exe
  2⤵
  PID:9192
- C:\Windows\System\UtjVZOK.exe
  C:\Windows\System\UtjVZOK.exe
  2⤵
  PID:9212
- C:\Windows\System\EfifLzR.exe
  C:\Windows\System\EfifLzR.exe
  2⤵
  PID:3496
- C:\Windows\System\kNSnSDb.exe
  C:\Windows\System\kNSnSDb.exe
  2⤵
  PID:7980
- C:\Windows\System\mkNqkSI.exe
  C:\Windows\System\mkNqkSI.exe
  2⤵
  PID:8068
- C:\Windows\System\CFQFUpL.exe
  C:\Windows\System\CFQFUpL.exe
  2⤵
  PID:8092
- C:\Windows\System\XPXGOOE.exe
  C:\Windows\System\XPXGOOE.exe
  2⤵
  PID:6456
- C:\Windows\System\BmIQSme.exe
  C:\Windows\System\BmIQSme.exe
  2⤵
  PID:7456
- C:\Windows\System\xLFeYeY.exe
  C:\Windows\System\xLFeYeY.exe
  2⤵
  PID:7484
- C:\Windows\System\CDmqZap.exe
  C:\Windows\System\CDmqZap.exe
  2⤵
  PID:6988
- C:\Windows\System\fVfDdKZ.exe
  C:\Windows\System\fVfDdKZ.exe
  2⤵
  PID:7640
- C:\Windows\System\bBTLqIC.exe
  C:\Windows\System\bBTLqIC.exe
  2⤵
  PID:7668
- C:\Windows\System\VYRHxuE.exe
  C:\Windows\System\VYRHxuE.exe
  2⤵
  PID:6836
- C:\Windows\System\PcshHpM.exe
  C:\Windows\System\PcshHpM.exe
  2⤵
  PID:7004
- C:\Windows\System\lsvjOYf.exe
  C:\Windows\System\lsvjOYf.exe
  2⤵
  PID:8032
- C:\Windows\System\OFuZXDb.exe
  C:\Windows\System\OFuZXDb.exe
  2⤵
  PID:7500
- C:\Windows\System\DBjVRcE.exe
  C:\Windows\System\DBjVRcE.exe
  2⤵
  PID:7896
- C:\Windows\System\IFBHmec.exe
  C:\Windows\System\IFBHmec.exe
  2⤵
  PID:8312
- C:\Windows\System\syMyawo.exe
  C:\Windows\System\syMyawo.exe
  2⤵
  PID:8008
- C:\Windows\System\AVAdeZT.exe
  C:\Windows\System\AVAdeZT.exe
  2⤵
  PID:8464
- C:\Windows\System\MgfBmVK.exe
  C:\Windows\System\MgfBmVK.exe
  2⤵
  PID:9220
- C:\Windows\System\JbXlKxJ.exe
  C:\Windows\System\JbXlKxJ.exe
  2⤵
  PID:9236
- C:\Windows\System\yfIKqSo.exe
  C:\Windows\System\yfIKqSo.exe
  2⤵
  PID:9264
- C:\Windows\System\mGPeuqi.exe
  C:\Windows\System\mGPeuqi.exe
  2⤵
  PID:9292
- C:\Windows\System\nNRQYQq.exe
  C:\Windows\System\nNRQYQq.exe
  2⤵
  PID:9320
- C:\Windows\System\xoGxgJa.exe
  C:\Windows\System\xoGxgJa.exe
  2⤵
  PID:9352
- C:\Windows\System\VBeNUza.exe
  C:\Windows\System\VBeNUza.exe
  2⤵
  PID:9368
- C:\Windows\System\xMBCMIK.exe
  C:\Windows\System\xMBCMIK.exe
  2⤵
  PID:9388
- C:\Windows\System\bVkYcqW.exe
  C:\Windows\System\bVkYcqW.exe
  2⤵
  PID:9420
- C:\Windows\System\vzjhcKt.exe
  C:\Windows\System\vzjhcKt.exe
  2⤵
  PID:9440
- C:\Windows\System\SCtxeXP.exe
  C:\Windows\System\SCtxeXP.exe
  2⤵
  PID:9464
- C:\Windows\System\SpiYXnd.exe
  C:\Windows\System\SpiYXnd.exe
  2⤵
  PID:9484
- C:\Windows\System\XgdUkxy.exe
  C:\Windows\System\XgdUkxy.exe
  2⤵
  PID:9512
- C:\Windows\System\XhkMOoW.exe
  C:\Windows\System\XhkMOoW.exe
  2⤵
  PID:9536
- C:\Windows\System\vBgfCNv.exe
  C:\Windows\System\vBgfCNv.exe
  2⤵
  PID:9556
- C:\Windows\System\sRQshXk.exe
  C:\Windows\System\sRQshXk.exe
  2⤵
  PID:9576
- C:\Windows\System\fIMMhBu.exe
  C:\Windows\System\fIMMhBu.exe
  2⤵
  PID:9600
- C:\Windows\System\ocbtIBZ.exe
  C:\Windows\System\ocbtIBZ.exe
  2⤵
  PID:9624
- C:\Windows\System\cjglgtf.exe
  C:\Windows\System\cjglgtf.exe
  2⤵
  PID:9644
- C:\Windows\System\shlJMCg.exe
  C:\Windows\System\shlJMCg.exe
  2⤵
  PID:9672
- C:\Windows\System\wZAmiqE.exe
  C:\Windows\System\wZAmiqE.exe
  2⤵
  PID:9688
- C:\Windows\System\AZOsERp.exe
  C:\Windows\System\AZOsERp.exe
  2⤵
  PID:9712
- C:\Windows\System\dwqRJUj.exe
  C:\Windows\System\dwqRJUj.exe
  2⤵
  PID:9732
- C:\Windows\System\JOcwbWk.exe
  C:\Windows\System\JOcwbWk.exe
  2⤵
  PID:9748
- C:\Windows\System\kUNTXMX.exe
  C:\Windows\System\kUNTXMX.exe
  2⤵
  PID:9768
- C:\Windows\System\bqiDhAU.exe
  C:\Windows\System\bqiDhAU.exe
  2⤵
  PID:9796
- C:\Windows\System\dViZboW.exe
  C:\Windows\System\dViZboW.exe
  2⤵
  PID:9816
- C:\Windows\System\wXWGkin.exe
  C:\Windows\System\wXWGkin.exe
  2⤵
  PID:9836
- C:\Windows\System\tmrzXww.exe
  C:\Windows\System\tmrzXww.exe
  2⤵
  PID:9852
- C:\Windows\System\enQcwTK.exe
  C:\Windows\System\enQcwTK.exe
  2⤵
  PID:9872
- C:\Windows\System\baYgaZg.exe
  C:\Windows\System\baYgaZg.exe
  2⤵
  PID:9896
- C:\Windows\System\KWUYgkq.exe
  C:\Windows\System\KWUYgkq.exe
  2⤵
  PID:9912
- C:\Windows\System\znsOIAW.exe
  C:\Windows\System\znsOIAW.exe
  2⤵
  PID:9936
- C:\Windows\System\TtlfIgn.exe
  C:\Windows\System\TtlfIgn.exe
  2⤵
  PID:9960
- C:\Windows\System\cevFvAM.exe
  C:\Windows\System\cevFvAM.exe
  2⤵
  PID:9980
- C:\Windows\System\pQiWfrX.exe
  C:\Windows\System\pQiWfrX.exe
  2⤵
  PID:9996
- C:\Windows\System\jmSsRxt.exe
  C:\Windows\System\jmSsRxt.exe
  2⤵
  PID:10016
- C:\Windows\System\vvtTlqg.exe
  C:\Windows\System\vvtTlqg.exe
  2⤵
  PID:10040
- C:\Windows\System\WAuKxOe.exe
  C:\Windows\System\WAuKxOe.exe
  2⤵
  PID:10060
- C:\Windows\System\AbTEphG.exe
  C:\Windows\System\AbTEphG.exe
  2⤵
  PID:10080
- C:\Windows\System\kmMgiSE.exe
  C:\Windows\System\kmMgiSE.exe
  2⤵
  PID:10112
- C:\Windows\System\AxbMCNk.exe
  C:\Windows\System\AxbMCNk.exe
  2⤵
  PID:10132
- C:\Windows\System\kmayMyM.exe
  C:\Windows\System\kmayMyM.exe
  2⤵
  PID:10152
- C:\Windows\System\OZSooNL.exe
  C:\Windows\System\OZSooNL.exe
  2⤵
  PID:10176
- C:\Windows\System\fTXmKAI.exe
  C:\Windows\System\fTXmKAI.exe
  2⤵
  PID:10204
- C:\Windows\System\VeeIHNg.exe
  C:\Windows\System\VeeIHNg.exe
  2⤵
  PID:10228
- C:\Windows\System\BCJCOpU.exe
  C:\Windows\System\BCJCOpU.exe
  2⤵
  PID:7120
- C:\Windows\System\KONluDh.exe
  C:\Windows\System\KONluDh.exe
  2⤵
  PID:8604
- C:\Windows\System\yLQeyec.exe
  C:\Windows\System\yLQeyec.exe
  2⤵
  PID:8648
- C:\Windows\System\mqONDiQ.exe
  C:\Windows\System\mqONDiQ.exe
  2⤵
  PID:3780
- C:\Windows\System\VrnzayU.exe
  C:\Windows\System\VrnzayU.exe
  2⤵
  PID:8848
- C:\Windows\System\lhbnauX.exe
  C:\Windows\System\lhbnauX.exe
  2⤵
  PID:8920
- C:\Windows\System\raJENoz.exe
  C:\Windows\System\raJENoz.exe
  2⤵
  PID:6296
- C:\Windows\System\mGpTcIb.exe
  C:\Windows\System\mGpTcIb.exe
  2⤵
  PID:7028
- C:\Windows\System\bpXtZmY.exe
  C:\Windows\System\bpXtZmY.exe
  2⤵
  PID:7848
- C:\Windows\System\TaKRRSE.exe
  C:\Windows\System\TaKRRSE.exe
  2⤵
  PID:9080
- C:\Windows\System\nWSFqeK.exe
  C:\Windows\System\nWSFqeK.exe
  2⤵
  PID:9156
- C:\Windows\System\KTqkTpe.exe
  C:\Windows\System\KTqkTpe.exe
  2⤵
  PID:8264
- C:\Windows\System\bppZAFC.exe
  C:\Windows\System\bppZAFC.exe
  2⤵
  PID:7096
- C:\Windows\System\ddtvIqw.exe
  C:\Windows\System\ddtvIqw.exe
  2⤵
  PID:8620
- C:\Windows\System\oLdNvqO.exe
  C:\Windows\System\oLdNvqO.exe
  2⤵
  PID:8672
- C:\Windows\System\qcxVNhs.exe
  C:\Windows\System\qcxVNhs.exe
  2⤵
  PID:8732
- C:\Windows\System\tvlXCSd.exe
  C:\Windows\System\tvlXCSd.exe
  2⤵
  PID:9504
- C:\Windows\System\OlxOmvq.exe
  C:\Windows\System\OlxOmvq.exe
  2⤵
  PID:9592
- C:\Windows\System\sbzGjwH.exe
  C:\Windows\System\sbzGjwH.exe
  2⤵
  PID:1976
- C:\Windows\System\SMeOvPs.exe
  C:\Windows\System\SMeOvPs.exe
  2⤵
  PID:9016
- C:\Windows\System\oyFhebx.exe
  C:\Windows\System\oyFhebx.exe
  2⤵
  PID:7960
- C:\Windows\System\heJZVNP.exe
  C:\Windows\System\heJZVNP.exe
  2⤵
  PID:8212
- C:\Windows\System\OJLSySs.exe
  C:\Windows\System\OJLSySs.exe
  2⤵
  PID:9892
- C:\Windows\System\XTANmZL.exe
  C:\Windows\System\XTANmZL.exe
  2⤵
  PID:7368
- C:\Windows\System\NiOEIXm.exe
  C:\Windows\System\NiOEIXm.exe
  2⤵
  PID:8372
- C:\Windows\System\kPYXoel.exe
  C:\Windows\System\kPYXoel.exe
  2⤵
  PID:6336
- C:\Windows\System\qNfgDTy.exe
  C:\Windows\System\qNfgDTy.exe
  2⤵
  PID:8544
- C:\Windows\System\zXUluhi.exe
  C:\Windows\System\zXUluhi.exe
  2⤵
  PID:9328
- C:\Windows\System\PdWgHEp.exe
  C:\Windows\System\PdWgHEp.exe
  2⤵
  PID:10236
- C:\Windows\System\ncsCDny.exe
  C:\Windows\System\ncsCDny.exe
  2⤵
  PID:9456
- C:\Windows\System\mHiGhDn.exe
  C:\Windows\System\mHiGhDn.exe
  2⤵
  PID:8776
- C:\Windows\System\rgZGkFb.exe
  C:\Windows\System\rgZGkFb.exe
  2⤵
  PID:8896
- C:\Windows\System\rdFwYqk.exe
  C:\Windows\System\rdFwYqk.exe
  2⤵
  PID:10256
- C:\Windows\System\dnAzEZY.exe
  C:\Windows\System\dnAzEZY.exe
  2⤵
  PID:10284
- C:\Windows\System\pODpFGi.exe
  C:\Windows\System\pODpFGi.exe
  2⤵
  PID:10304
- C:\Windows\System\wymgnjA.exe
  C:\Windows\System\wymgnjA.exe
  2⤵
  PID:10324
- C:\Windows\System\bzHxZpn.exe
  C:\Windows\System\bzHxZpn.exe
  2⤵
  PID:10348
- C:\Windows\System\TvtiwNw.exe
  C:\Windows\System\TvtiwNw.exe
  2⤵
  PID:10384
- C:\Windows\System\mjmDQBI.exe
  C:\Windows\System\mjmDQBI.exe
  2⤵
  PID:10408
- C:\Windows\System\plUNxoU.exe
  C:\Windows\System\plUNxoU.exe
  2⤵
  PID:10448
- C:\Windows\System\aQZjTRL.exe
  C:\Windows\System\aQZjTRL.exe
  2⤵
  PID:10476
- C:\Windows\System\JyymwDC.exe
  C:\Windows\System\JyymwDC.exe
  2⤵
  PID:10496
- C:\Windows\System\pojrNbj.exe
  C:\Windows\System\pojrNbj.exe
  2⤵
  PID:10520
- C:\Windows\System\ygIeqgx.exe
  C:\Windows\System\ygIeqgx.exe
  2⤵
  PID:10544
- C:\Windows\System\xYZXJoa.exe
  C:\Windows\System\xYZXJoa.exe
  2⤵
  PID:10568
- C:\Windows\System\NAwBsll.exe
  C:\Windows\System\NAwBsll.exe
  2⤵
  PID:10584
- C:\Windows\System\spdMJHH.exe
  C:\Windows\System\spdMJHH.exe
  2⤵
  PID:10608
- C:\Windows\System\zAOZbVW.exe
  C:\Windows\System\zAOZbVW.exe
  2⤵
  PID:10636
- C:\Windows\System\kVnQmaz.exe
  C:\Windows\System\kVnQmaz.exe
  2⤵
  PID:10652
- C:\Windows\System\mLOLsoQ.exe
  C:\Windows\System\mLOLsoQ.exe
  2⤵
  PID:10676
- C:\Windows\System\RCMwkRb.exe
  C:\Windows\System\RCMwkRb.exe
  2⤵
  PID:10700
- C:\Windows\System\HviVfVU.exe
  C:\Windows\System\HviVfVU.exe
  2⤵
  PID:10724
- C:\Windows\System\aouowxR.exe
  C:\Windows\System\aouowxR.exe
  2⤵
  PID:10764
- C:\Windows\System\XyXkatX.exe
  C:\Windows\System\XyXkatX.exe
  2⤵
  PID:10784
- C:\Windows\System\WtvCdGD.exe
  C:\Windows\System\WtvCdGD.exe
  2⤵
  PID:10808
- C:\Windows\System\uKiTljT.exe
  C:\Windows\System\uKiTljT.exe
  2⤵
  PID:10836
- C:\Windows\System\vFOmfWP.exe
  C:\Windows\System\vFOmfWP.exe
  2⤵
  PID:10860
- C:\Windows\System\vphYhzx.exe
  C:\Windows\System\vphYhzx.exe
  2⤵
  PID:10880
- C:\Windows\System\CkQWBZD.exe
  C:\Windows\System\CkQWBZD.exe
  2⤵
  PID:10904
- C:\Windows\System\soXYFQA.exe
  C:\Windows\System\soXYFQA.exe
  2⤵
  PID:10924
- C:\Windows\System\XCVDAFV.exe
  C:\Windows\System\XCVDAFV.exe
  2⤵
  PID:10948
- C:\Windows\System\UFXGKyQ.exe
  C:\Windows\System\UFXGKyQ.exe
  2⤵
  PID:10968
- C:\Windows\System\RfRpPXH.exe
  C:\Windows\System\RfRpPXH.exe
  2⤵
  PID:10996
- C:\Windows\System\QXoqJZf.exe
  C:\Windows\System\QXoqJZf.exe
  2⤵
  PID:11016
- C:\Windows\System\oMoyhUA.exe
  C:\Windows\System\oMoyhUA.exe
  2⤵
  PID:11040
- C:\Windows\System\xlaawGT.exe
  C:\Windows\System\xlaawGT.exe
  2⤵
  PID:11064
- C:\Windows\System\iKuAwYt.exe
  C:\Windows\System\iKuAwYt.exe
  2⤵
  PID:11088
- C:\Windows\System\olWlCGR.exe
  C:\Windows\System\olWlCGR.exe
  2⤵
  PID:11108
- C:\Windows\System\pKsvVdj.exe
  C:\Windows\System\pKsvVdj.exe
  2⤵
  PID:11128
- C:\Windows\System\IBRbywV.exe
  C:\Windows\System\IBRbywV.exe
  2⤵
  PID:11144
- C:\Windows\System\hgiBkva.exe
  C:\Windows\System\hgiBkva.exe
  2⤵
  PID:11160
- C:\Windows\System\EyyJTJn.exe
  C:\Windows\System\EyyJTJn.exe
  2⤵
  PID:11176
- C:\Windows\System\yFisScw.exe
  C:\Windows\System\yFisScw.exe
  2⤵
  PID:11192
- C:\Windows\System\zJTyEDm.exe
  C:\Windows\System\zJTyEDm.exe
  2⤵
  PID:11212
- C:\Windows\System\AnODgMW.exe
  C:\Windows\System\AnODgMW.exe
  2⤵
  PID:11228
- C:\Windows\System\BxLnqBv.exe
  C:\Windows\System\BxLnqBv.exe
  2⤵
  PID:11248
- C:\Windows\System\GJZRhzo.exe
  C:\Windows\System\GJZRhzo.exe
  2⤵
  PID:8872
- C:\Windows\System\YasbCfL.exe
  C:\Windows\System\YasbCfL.exe
  2⤵
  PID:7388
- C:\Windows\System\mLIIYYL.exe
  C:\Windows\System\mLIIYYL.exe
  2⤵
  PID:9616
- C:\Windows\System\SzhQUii.exe
  C:\Windows\System\SzhQUii.exe
  2⤵
  PID:6412
- C:\Windows\System\ZPqFSWn.exe
  C:\Windows\System\ZPqFSWn.exe
  2⤵
  PID:9140
- C:\Windows\System\tPffuha.exe
  C:\Windows\System\tPffuha.exe
  2⤵
  PID:9784
- C:\Windows\System\bnOpyGi.exe
  C:\Windows\System\bnOpyGi.exe
  2⤵
  PID:1072
- C:\Windows\System\gLQRidL.exe
  C:\Windows\System\gLQRidL.exe
  2⤵
  PID:4260
- C:\Windows\System\WArYdnx.exe
  C:\Windows\System\WArYdnx.exe
  2⤵
  PID:8084
- C:\Windows\System\SlDepyq.exe
  C:\Windows\System\SlDepyq.exe
  2⤵
  PID:10076
- C:\Windows\System\lHqUvTK.exe
  C:\Windows\System\lHqUvTK.exe
  2⤵
  PID:10092
- C:\Windows\System\fGoOLzm.exe
  C:\Windows\System\fGoOLzm.exe
  2⤵
  PID:7996
- C:\Windows\System\IfqJpEE.exe
  C:\Windows\System\IfqJpEE.exe
  2⤵
  PID:10168
- C:\Windows\System\TsxfNNA.exe
  C:\Windows\System\TsxfNNA.exe
  2⤵
  PID:4472
- C:\Windows\System\fVlxOqc.exe
  C:\Windows\System\fVlxOqc.exe
  2⤵
  PID:11288
- C:\Windows\System\DyHYaga.exe
  C:\Windows\System\DyHYaga.exe
  2⤵
  PID:11308
- C:\Windows\System\QCyrjKU.exe
  C:\Windows\System\QCyrjKU.exe
  2⤵
  PID:11328
- C:\Windows\System\jopZTOw.exe
  C:\Windows\System\jopZTOw.exe
  2⤵
  PID:11352
- C:\Windows\System\OBYrchA.exe
  C:\Windows\System\OBYrchA.exe
  2⤵
  PID:11376
- C:\Windows\System\KfMufFl.exe
  C:\Windows\System\KfMufFl.exe
  2⤵
  PID:11392
- C:\Windows\System\uCCarkD.exe
  C:\Windows\System\uCCarkD.exe
  2⤵
  PID:11416
- C:\Windows\System\KXeOqrw.exe
  C:\Windows\System\KXeOqrw.exe
  2⤵
  PID:11440
- C:\Windows\System\ZVxreIM.exe
  C:\Windows\System\ZVxreIM.exe
  2⤵
  PID:11464
- C:\Windows\System\juzlsKO.exe
  C:\Windows\System\juzlsKO.exe
  2⤵
  PID:11484
- C:\Windows\System\iZjlOAK.exe
  C:\Windows\System\iZjlOAK.exe
  2⤵
  PID:11500
- C:\Windows\System\pgWFFjd.exe
  C:\Windows\System\pgWFFjd.exe
  2⤵
  PID:11528
- C:\Windows\System\okaIRfC.exe
  C:\Windows\System\okaIRfC.exe
  2⤵
  PID:11548
- C:\Windows\System\phGfPyc.exe
  C:\Windows\System\phGfPyc.exe
  2⤵
  PID:11568
- C:\Windows\System\aHsbaAk.exe
  C:\Windows\System\aHsbaAk.exe
  2⤵
  PID:11592
- C:\Windows\System\BUSyQcI.exe
  C:\Windows\System\BUSyQcI.exe
  2⤵
  PID:11612
- C:\Windows\System\NoeZjxa.exe
  C:\Windows\System\NoeZjxa.exe
  2⤵
  PID:11636
- C:\Windows\System\dBfEewa.exe
  C:\Windows\System\dBfEewa.exe
  2⤵
  PID:11652
- C:\Windows\System\ngWZJzP.exe
  C:\Windows\System\ngWZJzP.exe
  2⤵
  PID:11672
- C:\Windows\System\NZzGEvR.exe
  C:\Windows\System\NZzGEvR.exe
  2⤵
  PID:11700
- C:\Windows\System\ANJVhvq.exe
  C:\Windows\System\ANJVhvq.exe
  2⤵
  PID:11720
- C:\Windows\System\yxIDjJD.exe
  C:\Windows\System\yxIDjJD.exe
  2⤵
  PID:11744
- C:\Windows\System\jfiMmOI.exe
  C:\Windows\System\jfiMmOI.exe
  2⤵
  PID:11768
- C:\Windows\System\QqtiLAF.exe
  C:\Windows\System\QqtiLAF.exe
  2⤵
  PID:11788
- C:\Windows\System\ZifAdbH.exe
  C:\Windows\System\ZifAdbH.exe
  2⤵
  PID:11808
- C:\Windows\System\zPoyOZE.exe
  C:\Windows\System\zPoyOZE.exe
  2⤵
  PID:11828
- C:\Windows\System\hpbucmh.exe
  C:\Windows\System\hpbucmh.exe
  2⤵
  PID:11848
- C:\Windows\System\bcrbeJZ.exe
  C:\Windows\System\bcrbeJZ.exe
  2⤵
  PID:11872
- C:\Windows\System\WjREPAV.exe
  C:\Windows\System\WjREPAV.exe
  2⤵
  PID:11896
- C:\Windows\System\zpvBZmq.exe
  C:\Windows\System\zpvBZmq.exe
  2⤵
  PID:11916
- C:\Windows\System\fZOvbNS.exe
  C:\Windows\System\fZOvbNS.exe
  2⤵
  PID:11944
- C:\Windows\System\OBZMceH.exe
  C:\Windows\System\OBZMceH.exe
  2⤵
  PID:11964
- C:\Windows\System\LONiJTA.exe
  C:\Windows\System\LONiJTA.exe
  2⤵
  PID:11992
- C:\Windows\System\wRBHCXM.exe
  C:\Windows\System\wRBHCXM.exe
  2⤵
  PID:12016
- C:\Windows\System\GslLbNx.exe
  C:\Windows\System\GslLbNx.exe
  2⤵
  PID:12036
- C:\Windows\System\OVByFiz.exe
  C:\Windows\System\OVByFiz.exe
  2⤵
  PID:12056
- C:\Windows\System\PZEzZzy.exe
  C:\Windows\System\PZEzZzy.exe
  2⤵
  PID:12080
- C:\Windows\System\WRawgIR.exe
  C:\Windows\System\WRawgIR.exe
  2⤵
  PID:12104
- C:\Windows\System\mPzfsqh.exe
  C:\Windows\System\mPzfsqh.exe
  2⤵
  PID:12132
- C:\Windows\System\wWcetXE.exe
  C:\Windows\System\wWcetXE.exe
  2⤵
  PID:12156
- C:\Windows\System\QtcOrYT.exe
  C:\Windows\System\QtcOrYT.exe
  2⤵
  PID:12176
- C:\Windows\System\miYoXOp.exe
  C:\Windows\System\miYoXOp.exe
  2⤵
  PID:12200
- C:\Windows\System\kzAmXlX.exe
  C:\Windows\System\kzAmXlX.exe
  2⤵
  PID:12224
- C:\Windows\System\dlzhjpd.exe
  C:\Windows\System\dlzhjpd.exe
  2⤵
  PID:12244
- C:\Windows\System\woIiauF.exe
  C:\Windows\System\woIiauF.exe
  2⤵
  PID:12264
- C:\Windows\System\SCUIcQg.exe
  C:\Windows\System\SCUIcQg.exe
  2⤵
  PID:9396
- C:\Windows\System\oAABQUS.exe
  C:\Windows\System\oAABQUS.exe
  2⤵
  PID:10144
- C:\Windows\System\wmFyQUc.exe
  C:\Windows\System\wmFyQUc.exe
  2⤵
  PID:10224
- C:\Windows\System\rKmDnFP.exe
  C:\Windows\System\rKmDnFP.exe
  2⤵
  PID:10252
- C:\Windows\System\dhtMjhE.exe
  C:\Windows\System\dhtMjhE.exe
  2⤵
  PID:10280
- C:\Windows\System\meXlpsq.exe
  C:\Windows\System\meXlpsq.exe
  2⤵
  PID:8128
- C:\Windows\System\AACQliP.exe
  C:\Windows\System\AACQliP.exe
  2⤵
  PID:10320
- C:\Windows\System\wlQrkic.exe
  C:\Windows\System\wlQrkic.exe
  2⤵
  PID:10340
- C:\Windows\System\VmJlYqa.exe
  C:\Windows\System\VmJlYqa.exe
  2⤵
  PID:9696
- C:\Windows\System\skuJjsL.exe
  C:\Windows\System\skuJjsL.exe
  2⤵
  PID:7628
- C:\Windows\System\lYHPzHt.exe
  C:\Windows\System\lYHPzHt.exe
  2⤵
  PID:10460
- C:\Windows\System\ULtRNlm.exe
  C:\Windows\System\ULtRNlm.exe
  2⤵
  PID:10492
- C:\Windows\System\KffYUEZ.exe
  C:\Windows\System\KffYUEZ.exe
  2⤵
  PID:10552
- C:\Windows\System\FDmaugh.exe
  C:\Windows\System\FDmaugh.exe
  2⤵
  PID:9848
- C:\Windows\System\aphEBVr.exe
  C:\Windows\System\aphEBVr.exe
  2⤵
  PID:10668
- C:\Windows\System\VcTpHJk.exe
  C:\Windows\System\VcTpHJk.exe
  2⤵
  PID:9908
- C:\Windows\System\mthROnT.exe
  C:\Windows\System\mthROnT.exe
  2⤵
  PID:10792
- C:\Windows\System\NUiOXon.exe
  C:\Windows\System\NUiOXon.exe
  2⤵
  PID:10872
- C:\Windows\System\vcIGWbP.exe
  C:\Windows\System\vcIGWbP.exe
  2⤵
  PID:12304
- C:\Windows\System\TyDLerY.exe
  C:\Windows\System\TyDLerY.exe
  2⤵
  PID:12324
- C:\Windows\System\QSrzdrC.exe
  C:\Windows\System\QSrzdrC.exe
  2⤵
  PID:12352
- C:\Windows\System\SuHcBrx.exe
  C:\Windows\System\SuHcBrx.exe
  2⤵
  PID:12380
- C:\Windows\System\BliFEKM.exe
  C:\Windows\System\BliFEKM.exe
  2⤵
  PID:12404
- C:\Windows\System\CEwLijR.exe
  C:\Windows\System\CEwLijR.exe
  2⤵
  PID:12424
- C:\Windows\System\rXgjKzJ.exe
  C:\Windows\System\rXgjKzJ.exe
  2⤵
  PID:12440
- C:\Windows\System\fDKOXZv.exe
  C:\Windows\System\fDKOXZv.exe
  2⤵
  PID:12456
- C:\Windows\System\IdVsKJz.exe
  C:\Windows\System\IdVsKJz.exe
  2⤵
  PID:12476
- C:\Windows\System\AEDazln.exe
  C:\Windows\System\AEDazln.exe
  2⤵
  PID:12504
- C:\Windows\System\AFxxRsw.exe
  C:\Windows\System\AFxxRsw.exe
  2⤵
  PID:12520
- C:\Windows\System\SJtDlMF.exe
  C:\Windows\System\SJtDlMF.exe
  2⤵
  PID:12548
- C:\Windows\System\JexJemY.exe
  C:\Windows\System\JexJemY.exe
  2⤵
  PID:12568
- C:\Windows\System\ofkXIqZ.exe
  C:\Windows\System\ofkXIqZ.exe
  2⤵
  PID:12592
- C:\Windows\System\zpzPyaO.exe
  C:\Windows\System\zpzPyaO.exe
  2⤵
  PID:12608
- C:\Windows\System\xTrYCBr.exe
  C:\Windows\System\xTrYCBr.exe
  2⤵
  PID:12636
- C:\Windows\System\nYvGSWR.exe
  C:\Windows\System\nYvGSWR.exe
  2⤵
  PID:12656
- C:\Windows\System\gAgTmAe.exe
  C:\Windows\System\gAgTmAe.exe
  2⤵
  PID:12680
- C:\Windows\System\ZEEpEUD.exe
  C:\Windows\System\ZEEpEUD.exe
  2⤵
  PID:12700
- C:\Windows\System\ZzobUvS.exe
  C:\Windows\System\ZzobUvS.exe
  2⤵
  PID:12724
- C:\Windows\System\XiFvNnW.exe
  C:\Windows\System\XiFvNnW.exe
  2⤵
  PID:12752
- C:\Windows\System\NweRALd.exe
  C:\Windows\System\NweRALd.exe
  2⤵
  PID:12776
- C:\Windows\System\YudyIEh.exe
  C:\Windows\System\YudyIEh.exe
  2⤵
  PID:12800
- C:\Windows\System\RaECbzf.exe
  C:\Windows\System\RaECbzf.exe
  2⤵
  PID:12820
- C:\Windows\System\KQNDIci.exe
  C:\Windows\System\KQNDIci.exe
  2⤵
  PID:12840
- C:\Windows\System\kSaAioY.exe
  C:\Windows\System\kSaAioY.exe
  2⤵
  PID:12864
- C:\Windows\System\nREaHeA.exe
  C:\Windows\System\nREaHeA.exe
  2⤵
  PID:12888
- C:\Windows\System\YzNjbLl.exe
  C:\Windows\System\YzNjbLl.exe
  2⤵
  PID:12912
- C:\Windows\System\KiPEWTg.exe
  C:\Windows\System\KiPEWTg.exe
  2⤵
  PID:12940
- C:\Windows\System\qaBMoqL.exe
  C:\Windows\System\qaBMoqL.exe
  2⤵
  PID:12956
- C:\Windows\System\PQnkaTA.exe
  C:\Windows\System\PQnkaTA.exe
  2⤵
  PID:12980
- C:\Windows\System\uGZqzui.exe
  C:\Windows\System\uGZqzui.exe
  2⤵
  PID:13004
- C:\Windows\System\LUHKGce.exe
  C:\Windows\System\LUHKGce.exe
  2⤵
  PID:13024
- C:\Windows\System\KAFrFjr.exe
  C:\Windows\System\KAFrFjr.exe
  2⤵
  PID:13040
- C:\Windows\System\ilMkSPs.exe
  C:\Windows\System\ilMkSPs.exe
  2⤵
  PID:13064
- C:\Windows\System\OIHWdId.exe
  C:\Windows\System\OIHWdId.exe
  2⤵
  PID:13092
- C:\Windows\System\daCHsrU.exe
  C:\Windows\System\daCHsrU.exe
  2⤵
  PID:13112
- C:\Windows\System\BKdBbrF.exe
  C:\Windows\System\BKdBbrF.exe
  2⤵
  PID:13136
- C:\Windows\System\nufbQtE.exe
  C:\Windows\System\nufbQtE.exe
  2⤵
  PID:13160
- C:\Windows\System\mGpJBSc.exe
  C:\Windows\System\mGpJBSc.exe
  2⤵
  PID:13184
- C:\Windows\System\wBVyNLp.exe
  C:\Windows\System\wBVyNLp.exe
  2⤵
  PID:13204
- C:\Windows\System\sYOyWeY.exe
  C:\Windows\System\sYOyWeY.exe
  2⤵
  PID:13228
- C:\Windows\System\JCviqPp.exe
  C:\Windows\System\JCviqPp.exe
  2⤵
  PID:13252
- C:\Windows\System\xnUYHVi.exe
  C:\Windows\System\xnUYHVi.exe
  2⤵
  PID:13276
- C:\Windows\System\thZTFbf.exe
  C:\Windows\System\thZTFbf.exe
  2⤵
  PID:13296
- C:\Windows\System\rGpZisn.exe
  C:\Windows\System\rGpZisn.exe
  2⤵
  PID:10936
- C:\Windows\System\lytItRj.exe
  C:\Windows\System\lytItRj.exe
  2⤵
  PID:10960
- C:\Windows\System\EcLeiCG.exe
  C:\Windows\System\EcLeiCG.exe
  2⤵
  PID:11048
- C:\Windows\System\BZBKkCd.exe
  C:\Windows\System\BZBKkCd.exe
  2⤵
  PID:10100
- C:\Windows\System\pcqQOrW.exe
  C:\Windows\System\pcqQOrW.exe
  2⤵
  PID:9532
- C:\Windows\System\qbYhftM.exe
  C:\Windows\System\qbYhftM.exe
  2⤵
  PID:2920
- C:\Windows\System\itoxXrp.exe
  C:\Windows\System\itoxXrp.exe
  2⤵
  PID:9380
- C:\Windows\System\WZiqcMm.exe
  C:\Windows\System\WZiqcMm.exe
  2⤵
  PID:11284
- C:\Windows\System\BuWNiaa.exe
  C:\Windows\System\BuWNiaa.exe
  2⤵
  PID:11320
- C:\Windows\System\XLJrqqF.exe
  C:\Windows\System\XLJrqqF.exe
  2⤵
  PID:7856
- C:\Windows\System\eJinJgH.exe
  C:\Windows\System\eJinJgH.exe
  2⤵
  PID:11544
- C:\Windows\System\allMWGJ.exe
  C:\Windows\System\allMWGJ.exe
  2⤵
  PID:12420
- C:\Windows\System\hiRyewn.exe
  C:\Windows\System\hiRyewn.exe
  2⤵
  PID:11188
- C:\Windows\System\GmZdPuz.exe
  C:\Windows\System\GmZdPuz.exe
  2⤵
  PID:12600
- C:\Windows\System\PuQmSOi.exe
  C:\Windows\System\PuQmSOi.exe
  2⤵
  PID:12872
- C:\Windows\System\Llwyfjm.exe
  C:\Windows\System\Llwyfjm.exe
  2⤵
  PID:13176
- C:\Windows\System\LlLnron.exe
  C:\Windows\System\LlLnron.exe
  2⤵
  PID:13248
- C:\Windows\System\zNjuAOz.exe
  C:\Windows\System\zNjuAOz.exe
  2⤵
  PID:9620
- C:\Windows\System\gfYjGQQ.exe
  C:\Windows\System\gfYjGQQ.exe
  2⤵
  PID:11436
- C:\Windows\System\tMMRCAG.exe
  C:\Windows\System\tMMRCAG.exe
  2⤵
  PID:7912
- C:\Windows\System\JyIZmUP.exe
  C:\Windows\System\JyIZmUP.exe
  2⤵
  PID:11780
- C:\Windows\System\yJQUxSa.exe
  C:\Windows\System\yJQUxSa.exe
  2⤵
  PID:7228
- C:\Windows\System\PQrYUBY.exe
  C:\Windows\System\PQrYUBY.exe
  2⤵
  PID:9884
- C:\Windows\System\bOESrid.exe
  C:\Windows\System\bOESrid.exe
  2⤵
  PID:12052
- C:\Windows\System\uWvBAGv.exe
  C:\Windows\System\uWvBAGv.exe
  2⤵
  PID:8788
- C:\Windows\System\SFeQDCn.exe
  C:\Windows\System\SFeQDCn.exe
  2⤵
  PID:9172
- C:\Windows\System\zRluqgO.exe
  C:\Windows\System\zRluqgO.exe
  2⤵
  PID:12320
- C:\Windows\System\XOgJjhe.exe
  C:\Windows\System\XOgJjhe.exe
  2⤵
  PID:12240
- C:\Windows\System\EmpNSma.exe
  C:\Windows\System\EmpNSma.exe
  2⤵
  PID:10220
- C:\Windows\System\CxUABMj.exe
  C:\Windows\System\CxUABMj.exe
  2⤵
  PID:11952
- C:\Windows\System\emVcQtr.exe
  C:\Windows\System\emVcQtr.exe
  2⤵
  PID:11364
- C:\Windows\System\XJOwsgN.exe
  C:\Windows\System\XJOwsgN.exe
  2⤵
  PID:2400
- C:\Windows\System\LxBEcrv.exe
  C:\Windows\System\LxBEcrv.exe
  2⤵
  PID:12332
- C:\Windows\System\BGwVfrd.exe
  C:\Windows\System\BGwVfrd.exe
  2⤵
  PID:10696
- C:\Windows\System\YqZukWG.exe
  C:\Windows\System\YqZukWG.exe
  2⤵
  PID:8632
- C:\Windows\System\NCbRWlM.exe
  C:\Windows\System\NCbRWlM.exe
  2⤵
  PID:10776
- C:\Windows\System\IUqzdHp.exe
  C:\Windows\System\IUqzdHp.exe
  2⤵
  PID:11668
- C:\Windows\System\fxQrIJW.exe
  C:\Windows\System\fxQrIJW.exe
  2⤵
  PID:9524
- C:\Windows\System\rnBYdmy.exe
  C:\Windows\System\rnBYdmy.exe
  2⤵
  PID:11156
- C:\Windows\System\wnMSueQ.exe
  C:\Windows\System\wnMSueQ.exe
  2⤵
  PID:12112
- C:\Windows\System\mNrufoW.exe
  C:\Windows\System\mNrufoW.exe
  2⤵
  PID:9720
- C:\Windows\System\Nggbyca.exe
  C:\Windows\System\Nggbyca.exe
  2⤵
  PID:12116
- C:\Windows\System\AgeVzzH.exe
  C:\Windows\System\AgeVzzH.exe
  2⤵
  PID:11508
- C:\Windows\System\HRYRCrN.exe
  C:\Windows\System\HRYRCrN.exe
  2⤵
  PID:11892
- C:\Windows\System\ycRzJHM.exe
  C:\Windows\System\ycRzJHM.exe
  2⤵
  PID:9500
- C:\Windows\System\rgoaCAj.exe
  C:\Windows\System\rgoaCAj.exe
  2⤵
  PID:10892
- C:\Windows\System\RJIHmBp.exe
  C:\Windows\System\RJIHmBp.exe
  2⤵
  PID:12996
- C:\Windows\System\FWdpjyV.exe
  C:\Windows\System\FWdpjyV.exe
  2⤵
  PID:11712
- C:\Windows\System\EanqCxI.exe
  C:\Windows\System\EanqCxI.exe
  2⤵
  PID:11152
- C:\Windows\System\RmIlLOk.exe
  C:\Windows\System\RmIlLOk.exe
  2⤵
  PID:7292
- C:\Windows\System\pkRVqGK.exe
  C:\Windows\System\pkRVqGK.exe
  2⤵
  PID:8516
- C:\Windows\System\JTYefjo.exe
  C:\Windows\System\JTYefjo.exe
  2⤵
  PID:10528
- C:\Windows\System\qkwsgcH.exe
  C:\Windows\System\qkwsgcH.exe
  2⤵
  PID:11560
- C:\Windows\System\eNNHTrh.exe
  C:\Windows\System\eNNHTrh.exe
  2⤵
  PID:10336
- C:\Windows\System\NkADWKp.exe
  C:\Windows\System\NkADWKp.exe
  2⤵
  PID:12924
- C:\Windows\System\vzvgKCn.exe
  C:\Windows\System\vzvgKCn.exe
  2⤵
  PID:11344
- C:\Windows\System\DIMIOWr.exe
  C:\Windows\System\DIMIOWr.exe
  2⤵
  PID:2412
- C:\Windows\System\WzzgGBT.exe
  C:\Windows\System\WzzgGBT.exe
  2⤵
  PID:11984
- C:\Windows\System\ONBTFTn.exe
  C:\Windows\System\ONBTFTn.exe
  2⤵
  PID:11056
- C:\Windows\System\cRUpNdP.exe
  C:\Windows\System\cRUpNdP.exe
  2⤵
  PID:10072
- C:\Windows\System\iXzfsRh.exe
  C:\Windows\System\iXzfsRh.exe
  2⤵
  PID:11880
- C:\Windows\System\PoivvNi.exe
  C:\Windows\System\PoivvNi.exe
  2⤵
  PID:12496
- C:\Windows\System\wvxNcAu.exe
  C:\Windows\System\wvxNcAu.exe
  2⤵
  PID:10616
- C:\Windows\System\yhCmPBU.exe
  C:\Windows\System\yhCmPBU.exe
  2⤵
  PID:10932
- C:\Windows\System\sqZRjGP.exe
  C:\Windows\System\sqZRjGP.exe
  2⤵
  PID:6692
- C:\Windows\System\ozDAMkc.exe
  C:\Windows\System\ozDAMkc.exe
  2⤵
  PID:12284
- C:\Windows\System\rIZFaHm.exe
  C:\Windows\System\rIZFaHm.exe
  2⤵
  PID:13400
- C:\Windows\System\xDEAozy.exe
  C:\Windows\System\xDEAozy.exe
  2⤵
  PID:13452
- C:\Windows\System\wNxiNlF.exe
  C:\Windows\System\wNxiNlF.exe
  2⤵
  PID:13472
- C:\Windows\System\CtADsXP.exe
  C:\Windows\System\CtADsXP.exe
  2⤵
  PID:13492
- C:\Windows\System\sIwqzTk.exe
  C:\Windows\System\sIwqzTk.exe
  2⤵
  PID:13540
- C:\Windows\System\XenYXBr.exe
  C:\Windows\System\XenYXBr.exe
  2⤵
  PID:13572
- C:\Windows\System\StxckbL.exe
  C:\Windows\System\StxckbL.exe
  2⤵
  PID:13596
- C:\Windows\System\uQsdeaY.exe
  C:\Windows\System\uQsdeaY.exe
  2⤵
  PID:13620
- C:\Windows\System\TfXgjnU.exe
  C:\Windows\System\TfXgjnU.exe
  2⤵
  PID:13636
- C:\Windows\System\tnbznwJ.exe
  C:\Windows\System\tnbznwJ.exe
  2⤵
  PID:13656
- C:\Windows\System\yqjJAWe.exe
  C:\Windows\System\yqjJAWe.exe
  2⤵
  PID:13680
- C:\Windows\System\izOrfDw.exe
  C:\Windows\System\izOrfDw.exe
  2⤵
  PID:13700
- C:\Windows\System\umouAHu.exe
  C:\Windows\System\umouAHu.exe
  2⤵
  PID:13720
- C:\Windows\System\zeuRXll.exe
  C:\Windows\System\zeuRXll.exe
  2⤵
  PID:13740
- C:\Windows\System\BzkNroi.exe
  C:\Windows\System\BzkNroi.exe
  2⤵
  PID:13760
- C:\Windows\System\NQOcUZp.exe
  C:\Windows\System\NQOcUZp.exe
  2⤵
  PID:14280
- C:\Windows\System\PMuDIHb.exe
  C:\Windows\System\PMuDIHb.exe
  2⤵
  PID:12880
- C:\Windows\System\gNyLAFr.exe
  C:\Windows\System\gNyLAFr.exe
  2⤵
  PID:13328
- C:\Windows\System\HQWPASY.exe
  C:\Windows\System\HQWPASY.exe
  2⤵
  PID:10816
- C:\Windows\System\FhSEdfs.exe
  C:\Windows\System\FhSEdfs.exe
  2⤵
  PID:11300
- C:\Windows\System\FrtQfhq.exe
  C:\Windows\System\FrtQfhq.exe
  2⤵
  PID:11472
- C:\Windows\System\kuCjRCm.exe
  C:\Windows\System\kuCjRCm.exe
  2⤵
  PID:3252
- C:\Windows\System\BHBroSJ.exe
  C:\Windows\System\BHBroSJ.exe
  2⤵
  PID:13460
- C:\Windows\System\EyGrfuR.exe
  C:\Windows\System\EyGrfuR.exe
  2⤵
  PID:13504
- C:\Windows\System\pDHBIvz.exe
  C:\Windows\System\pDHBIvz.exe
  2⤵
  PID:13812
- C:\Windows\System\MFQABAu.exe
  C:\Windows\System\MFQABAu.exe
  2⤵
  PID:13732
- C:\Windows\System\yxxsWzp.exe
  C:\Windows\System\yxxsWzp.exe
  2⤵
  PID:13752
- C:\Windows\System\UyNlNWM.exe
  C:\Windows\System\UyNlNWM.exe
  2⤵
  PID:13840
- C:\Windows\System\cQafZXq.exe
  C:\Windows\System\cQafZXq.exe
  2⤵
  PID:14272

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0plwjlou.tin.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BnxLfiB.exe

Filesize
1.9MB

MD5
877562c9f6dfbd18f91450bf0f40c617

SHA1
e2580fa7df28ce9bbc5ee21abcac010877fae8ab

SHA256
934e7878375458757c4ff9b9f141cc7f16d539e807b5d7b4bff63b9cafef4098

SHA512
e2a576a13e2cba1a109dfa81b2dbe8d4a8db50501706c49bf3815fe89e76a5b8b22f610c0a8ac80c6c076920c2cac2cb8df4b182f0db9f23e45bbf2eda9f3799

Download Submit
C:\Windows\System\EKypgSq.exe

Filesize
1.9MB

MD5
84d800ace7999e7854941165b3cb7072

SHA1
86a89bbcc1df97e57c3dda70cfcc697bbafaa97b

SHA256
578c7f8ca5a8ff8635d56eb877cec23fdb7015915b0305f43f76d56d4f10bc8b

SHA512
8666931dc8b39a6ad9fff8bd89a489acb3363738d6d9ab72a4a4601a6bd2a23f20e30b78d7c8d295e3449057d86465799adfc3a863c4f5b5656edeb06c69f07f

Download Submit
C:\Windows\System\FLHpIYV.exe

Filesize
1.9MB

MD5
c05c23391a222e74935517d04b4b0a5a

SHA1
693e1bf95897ac4c15aa5bad6524110dffba5231

SHA256
8639093a65893d4adb272e3050d3ba5864c54a68aafb32fcb135618ea21f8f50

SHA512
4d70973356dcd2b59dc73ff6737078a2d2cca030ffda0cbb4e8b6bfdb6fdfd88d05eda4a5300d449cf5b0b352462abea7ee83f9d55ff661d171cf49d6706cdaa

Download Submit
C:\Windows\System\GUcRBtI.exe

Filesize
1.9MB

MD5
85d4eb0d56e5bff67672790a8de4a016

SHA1
df392465b276ba27386d8f2e3566c631377ccbe2

SHA256
5a792ea52c46803e6371ca42935c62738099e538567799366f9d1fff9cf5c252

SHA512
1b2c9584065e79db7f50c257ad3ee62b73a78f26107de3af2402ca983a8eaaabd562c8c3c1b345bf780e00e22c24e4b7b9e7d9e5b93f6d64e18993731190204c

Download Submit
C:\Windows\System\GXQYOXI.exe

Filesize
1.9MB

MD5
3e430629c7f1e02de673fba20f5d8a7d

SHA1
5a07a6d56149248ab61b927d9d09d8170b28285a

SHA256
9c1b73d51c415113522ca12210d52e724fd16cb5782274c48b9962aece4d8151

SHA512
903d4b49b36a9ee0328aacd3e25aea7ac53ab64c7f6304eb3b445df5b9e61970ac97c9af15d0ffbcf80eb715e34ca4ce47ff3def249799c04829cf67dfe01795

Download Submit
C:\Windows\System\GeZayTr.exe

Filesize
1.9MB

MD5
89680d01c9c02ba04d26025cb7aa8f15

SHA1
291254d33da7f146892a433ba717acccef71073e

SHA256
72927ecc48ee681fe1b580dc87afeb80c87496476b4782b2b4c5553f5a5540e3

SHA512
ded7dae928cb6281a4f971109428648dd0b3dba47c83be95be5471f97a30492512a3083e08f4bd6441eb557eba930ce2204e0db6d092f2c10674d17ee7e35a08

Download Submit
C:\Windows\System\HQoEsQl.exe

Filesize
1.9MB

MD5
9d0032adabd5e28de72bc30928570cf4

SHA1
c19599f0df2df72a930b65eacdaec3c0b44f2bca

SHA256
c05345893be73150536c9a07c78d05ff4b2900cb1f1786b422c355a22960e8d1

SHA512
41a83e1f58b1a3feab7fd153a6aa5bddecec94d04a5aaef523bca62ff142739629b3c0ab8a9ef83179ab7a2608625a77147ecee67b88aebfacd10c9db8cd73f3

Download Submit
C:\Windows\System\HuXXdRV.exe

Filesize
1.9MB

MD5
1e12b0cfbd46b074abb5a7337683fa66

SHA1
d9484785d0e53b5e0ae0c694b76025df152d24f6

SHA256
0a20a05387c15cc5d204f7068ab36522fa14cc89f3e48dc8578288e1174b15b7

SHA512
63e3fff2fe6956a446c7c51ec80af809469d70dc6dca15a493d211bdff4242414708ad48e521659af4428dd674d3bfb3f2002df47ec6b08620ddc6257fe55b3e

Download Submit
C:\Windows\System\JisaSaJ.exe

Filesize
1.9MB

MD5
4c6b48801a41af754a3d299bf00ffd13

SHA1
99b79ea927de6a044894e8fee725a08321c87651

SHA256
913fbd8c6a80313504acfcc6f719ea7e3d15a5ff396ef011f4d3d98bf12c3800

SHA512
82d4d43bcf181f9c35942251f854c09ac88e527d56f76c5b84682c158a497b48c0704ba5a984cd9391d2bca1d734267988517642a3c28041598569abaf953b90

Download Submit
C:\Windows\System\PXDjCpb.exe

Filesize
1.9MB

MD5
867259ed4af67a5df90b597c34d49657

SHA1
0913f13fe383a6435acf7fcf37633440935bcadc

SHA256
8c7b1961beef5b95bff30141997226ac865ef066a2566cf7fa497593f35d8d67

SHA512
402904898a133e0c47467e89d9df1e3713e55ce0ae97d9d443ee817e9bab0440c7def07ba4f15aaa25a436d9f3027391b555ff4d65bfa0b928ce732c86b084c5

Download Submit
C:\Windows\System\PtfDloM.exe

Filesize
1.9MB

MD5
124fe882cd8c5cb771691c814a57da7b

SHA1
932ceb56757e184af3ebeb7a7cf2549cf7d28b5e

SHA256
717a980f908c1b9af43d958b9def73f5711e63363add93ddf87df265dcc6047a

SHA512
1abb19e006c7176bf188ace82caed15e619d139deb0955927f654b0c7dd4c573474a67bc910c0ec40102450aaebd3a87bd6453cfc870614c988874bb45ee3572

Download Submit
C:\Windows\System\QCSYrHi.exe

Filesize
1.9MB

MD5
9896700875bd688bb08e1fe03693c1aa

SHA1
49c2dac9e03d9de56d714b07f88987df0239fdbc

SHA256
bca50d797eeefccd77de78c962c43a1b249a551c1fcf3b836e4b6242100896ce

SHA512
67b0492c5025b2447d050bf9e836284c92783bf561e7e22ef25e66f1031cc14869d529538938efa8fd50f7adb33ba74952cb15215f45f4e600898115233617d3

Download Submit
C:\Windows\System\RouffFn.exe

Filesize
1.9MB

MD5
0eb3221ab9183729617d9afd5bd30944

SHA1
6df3374849115a4432ca18c4886759748bd5450e

SHA256
d2fa9bdbce5db19a3b9fc4790e15acbd10b76ea29df8cb5a889f7dc27240bc2b

SHA512
023baa11cceb0e0a6a4f313da45e8e8b3f69ea984cf48219cd4a2c191b32e5f1abf6a2ed7a5b88a1c5d1eb3993425f089044f635071a31c2f8379b35b1cdc274

Download Submit
C:\Windows\System\SkNaUUp.exe

Filesize
1.9MB

MD5
a56baa865e9ed710356495e8f7fa7055

SHA1
4b640c77ceb8e6dc547241696420762eb3806f4d

SHA256
ecca53c50e1bd39e63086d1884f3c65658d46cbc868efed7aff252579a21966a

SHA512
7bba68f1a2d711985391cc50d3a3e067cc2540e34970a48096d7b7051d8ae1b117e0f42c336e8a68eca91132fd0506660bb31d267f640358993ef6f2b3b7f75c

Download Submit
C:\Windows\System\VtcZiSs.exe

Filesize
1.9MB

MD5
eb1245039929f829bdff439c7e01883d

SHA1
03c03ee7ae487a01432b0fea90b142cb2233a5e3

SHA256
2f73e2023685f51228b31f2ff8e173d0417a917ef3986bb67bc7b38713d8696c

SHA512
26a8edb34e25da12376fb6f3a1b483530b325a6286e82d7e7a3ac87321b1ff1a19c5df8b1139630bdb56f094567faf2f538fbc88620a51ca540b9392f6ac5fcb

Download Submit
C:\Windows\System\XHJpUKN.exe

Filesize
1.9MB

MD5
f4f28f23aec45bb01c509e6d2538c884

SHA1
307998c80d7640fbcfc5addb2284ea6233e6ffd4

SHA256
e17e2cd9554bb8de41202625aaf6b8c221f6f33e9a1130514b3193fd794ceeb4

SHA512
acb66b6af1c55382e5b2a3639bb9765ee4d1d247b86d5b61605edb64bda445f08383e26b0794927daf15210d933bd429bfa37dfa6a8808b18941100f2219e013

Download Submit
C:\Windows\System\YJIoNiS.exe

Filesize
1.9MB

MD5
b2d4e41caecbf393632c7cc467ea55c7

SHA1
422fd3422ae4ea9ea6f6feea041b5e0d3be47bb4

SHA256
04910b7231cd0b49b3207fbed43ff64181e074c70e2d985899a679b46122ef3b

SHA512
bc161f5ceb4eb169a72ec39f7e2d2eb24ebf931821a75a6e189fe61b5847156735a63f11f8eb1ddb6a15915eb0c76a5e6c374eb006ec5a614d15b28916e66f91

Download Submit
C:\Windows\System\aZmVuCT.exe

Filesize
1.9MB

MD5
1e94bd1db69a0e363b2a82ad567055ae

SHA1
c73537ef6f54f00f93b74537ac88ac70febb22b6

SHA256
b2daffe8070a9d94af418d730d94035425938623ef890867ea4dd45cac2ee3b7

SHA512
d539d2afd633d65c6ba6e1e60c729f60e6837b6a2b4d890a79862e3621210e44111f11f5d3b9b334b9f45c55d6f2f548da1b0dbbc2fed72b0d7ed586dc40b988

Download Submit
C:\Windows\System\blAsApN.exe

Filesize
1.9MB

MD5
0631b2fd6bc66208496f04e5d85889ad

SHA1
d01b1cb21ded2c1367b146216c4e8aa3b1092769

SHA256
0714c58d2d02164ecee5b8ea7aa926f027b4f4963cdf4437021d057eb3b8f655

SHA512
a9e1b3d8ce02fc9454265ce3d830936c1f7ea8515cbeb8867b083ab1ea9e43fd97c97ba5afac56abfccf02905addfbbddd33c31041129d4ede31f9d2e1798a58

Download Submit
C:\Windows\System\bmZSOWo.exe

Filesize
1.9MB

MD5
43fc80a906db09a55dfe62f565ad161e

SHA1
5f99baaa2af334aaa0b11d6c54ccc87c7ba64299

SHA256
ce018d18eabfcafcaee3bd0f4f039c8ff8c86acb06822cc7f3bdb2da5349ae67

SHA512
cd687c1e187240bc61e65fb29bf1530c4477efbe44569a3c8a51d1132654774a7e5a2f8d1eafe0561e9fdb09ecbe46e85714e853cb7592facb13e227068c41b5

Download Submit
C:\Windows\System\cZYOlUv.exe

Filesize
1.9MB

MD5
b6b2b804d9654f5bc0f723c3abf008ad

SHA1
f1d3401dd277a855a6c85e23593c9d9448269e2e

SHA256
c44724a02d8c8ac8a2109475adb7560d8b69758ecc58a87ef8278b7479e2ed88

SHA512
1281ef1d10bfa006e89291a1ce9b21b17b6dbea9b7a05666a9ee26a67e47510355e5689ee9e64f88fa01305eafdec482433c87ef8339d2209665a58fce677f6f

Download Submit
C:\Windows\System\csYpECk.exe

Filesize
1.9MB

MD5
4dd297a3c80c3e315684f05550907f1e

SHA1
626948090e272fd7c546a17c7e58d318d0368245

SHA256
fca2aafc7e3f0840b4fca0faed5273707ef37678ee53f78ea213fbce5a74172d

SHA512
9e306a83a0fd920fa42ade710849c317556f700589c2dc2ae03cd19fb15c78acfeec5d9cd38f68d192aed1a7ceeae39a3df9597baa5128317b6f4af3d352e113

Download Submit
C:\Windows\System\dsYAgSg.exe

Filesize
1.9MB

MD5
09feec30c7b5cad4a73067b5a22d56bc

SHA1
c5a4a4e0621f455ac40d27420ad25a938a4f07f5

SHA256
f0a0ef5c6154d9de0d6a9d13ecd360a62f9b9f6b8fb1a7fca42ff8e9e8370a13

SHA512
c6dfb1871344f7d572dc274f417321dd598b420be98116768cb70c05f70be79c2e990f6925112a2b730b5eabe5060f05d890d3e7c07f389bb030ba0a0bbfe3e1

Download Submit
C:\Windows\System\gwRVxjG.exe

Filesize
1.9MB

MD5
f7f176ca287629cb6c650c8e333394c5

SHA1
001165154837f5084be9729676d83f0813497fc1

SHA256
44c8a655cc26bf58c97994aef0f8b0cc77bf63adeba8434f835b2354791855e4

SHA512
0d19cf572925db3bf7cb01ecef434af8cba0f643a36b6f0ec1ca8cc172fab02363c932a18c55e00fe49fb7b86e7c607a3e720c92cf607724a1e1921437bc3f1c

Download Submit
C:\Windows\System\gyqVoFx.exe

Filesize
1.9MB

MD5
3466b895b2282781390d3c1afebada41

SHA1
ecafaaf36d29ec6f3c5d08333de2e50bab196247

SHA256
b4e643492bd2034bbba03884823ca36737ea822979509c32bd210340d4a96950

SHA512
e66098fc787d4a083479b1012d1440818571a5d187abca5b301e35872414e7b22955d60e65f0868dac6a456597694fe03fa9c1bc225f2647411cf399c9d224db

Download Submit
C:\Windows\System\hqRsmrx.exe

Filesize
8B

MD5
3277aa72bb7d7f1eb1043502fbd1c406

SHA1
8712dca2f3fbc82bf0cbbeecdc5d6a26c87f443c

SHA256
e94b62f30c9ce8b0b5cea14d4367a52fe08005d1bd56ca932a1fd7fc15c61bc9

SHA512
9fb0369549dba8937fb796cbc4ade6bacf540f10f98e02675f1b04c615cbb49e396cdbd25cd29de56c7bfb889c8464199939a84fa31434a75c020caeb4f9f503

Download Submit
C:\Windows\System\iVmdJQz.exe

Filesize
1.9MB

MD5
3efb38d404e7e9f051489318ebfb793b

SHA1
d15f83ceac41e41519d1c93c08fae4a6b81a543d

SHA256
d4fce262005a661771e16563427b29ec5b0dc5d70b45cb7d4978a3addc8fa36c

SHA512
9da9453ec5ffd40606f0e56e84936ef6a42075fe06a4ae59839867522ce900ca1ad7bf4dc99e7241d0790afea93834e4f830edb5b68869c9e12db5a2fe7537f7

Download Submit
C:\Windows\System\iuyDXNH.exe

Filesize
1.9MB

MD5
61afb3b997ff555eb6b49fcfc9175db0

SHA1
3bef2f2a7ccf44787dc933c87542af7feaeb958b

SHA256
ec43bbcb497227dca8f77ede548a69df53d45193b4a92ffaeab5f62599d7bba4

SHA512
56cd32bd9c349fa45cacdc938463047562b31c0593b27cb2660cecb9125ac24ba6bafc40c8228bd127089199752cf1f6d67c21869f27a63b973e26666a8116ae

Download Submit
C:\Windows\System\jdOvlTE.exe

Filesize
1.9MB

MD5
5e4e7e88a68036e183845dd1bd636df7

SHA1
caeb617fa893309ab84c0fa0486e43f15d316613

SHA256
800c034b7a4e222830210fac311fa57fd4b31659e35c2a5009b7fb2b5258888d

SHA512
a2a16de04de83d2decf680544d267eb5df59dd5ed38c11e04258b60b272df91cb2fb066f355b10beeb43bd2e2f348decd717a9a3b515f6c1a29cbc6230cf18e5

Download Submit
C:\Windows\System\jiYmUPG.exe

Filesize
1.9MB

MD5
90c9dff7d9ed4a07758e3ef3dedcfdd2

SHA1
968d20894b64f12192b5436de6a7d9f3def1ece5

SHA256
e2a0c4c83032cecf0ce4a79d271df8e7edb4b3339bf683eedaa91928a2faf5e7

SHA512
d2c4534c6aa2cea4354d39dae5fa34a067ba6e9d471756639379fafa050515053d85d109c093ff5e85ccca56975e0d2c40b4491ee0ce7a7c053db9fc030c2349

Download Submit
C:\Windows\System\lIWRkaG.exe

Filesize
1.9MB

MD5
8ff69b317f67703cd4163b1c89ef0c9b

SHA1
22420c2934abeff639d54dd9c1114f8c94b680a2

SHA256
64414c8b1e1418c8be49c71445cc281499bde3049fceea7e07588791084e7620

SHA512
e7f61f4c458aaa88703ec5d65ceebb6619b748de3e3f77b5fa8c5928b7aa5494d69eaf835b937e2373202e045a7a004a80aa88d5f30b10540a2e5efcc22bb5e5

Download Submit
C:\Windows\System\lsLdMpf.exe

Filesize
1.9MB

MD5
c5879f85d2f379cf6e1d11609d7e86d0

SHA1
5bf37a7a09339cc7e4c5fbd1723545de7be39b35

SHA256
3a1e8853a8b2de34d15814b788fd03e9d996cf07de1146d71096f74c5f16c532

SHA512
ba688713e9af88a3f14384976e48a4f67935f8d0c1682a44c87238074e9ab96ce6d0127832bd6574a349d9da76fca42d5220c9e4aba0240e0e3080168e9587d8

Download Submit
C:\Windows\System\oyfTIQs.exe

Filesize
1.9MB

MD5
c581c12f1e8a79e7682b2c98c0c18487

SHA1
cdb1d86cfaa785c94dc6e4234a98a81ebde9ae59

SHA256
7b00a788a28ea70daa93acbf61f1e54116c53d7a6200d63dee86874905e093c7

SHA512
3a8fb339b8f4aa85bce0567ae7a8d53e84cb2ccb16a3de535f40e21e763dacfcad6e5194cb5ef17d87de9e03564c76303b7b45fe8dfa1b52b7f827948c4dcde3

Download Submit
C:\Windows\System\pahgJAX.exe

Filesize
1.9MB

MD5
a6f6a6c73b4cd5d200fa410ad7cefa8d

SHA1
4dfa8b319447dde9a0169b65664c0028e0ad5c69

SHA256
f64714c5ee3341ff0f82570e170bdce49847113ce075bd33ffc89d81d5c55699

SHA512
bd393d1368481de834228b3284e137c7ab9a7c7a762b0f1d856bd1dd1043b96e63e78787c6ba085446738271ca4c4c006e4114608e6d6b6932599bd3387b4092

Download Submit
C:\Windows\System\tOwRdAZ.exe

Filesize
1.9MB

MD5
f045b33b930048fdc4be98cdf9508dac

SHA1
19cb5c8ea7e06d866cf1f7be854985b9caf46dde

SHA256
b273ff6bcfd592bf15864c62b2cf92fc505ba4a98fd1fafa3f9c4f41d7fd9694

SHA512
f0ce31cf8922ba00d6b10a6df14e252ffc1c1e4ce6bcce72668d2b3c4910fa92bc26789843d781c234d0ef5b6d4605aa2312cc0bf504bcb1c4691d89c8f801a9

Download Submit
C:\Windows\System\wudkRMi.exe

Filesize
1.9MB

MD5
ad1bdad35e516372ffe19e0a433e4bb5

SHA1
ed53c057541611f25aca993872b5faa9c2d1cdc9

SHA256
38eb5e222e2963672a2b30c12c1fffb726f8bcab515e67e1bac4953437a907e5

SHA512
6723cc4a634fbd00d3820d9bf8cdedf3c6e2dd979fcee7274602f8e8b3eea7ba9e096246ac34dff0a3dcfba8854b370cb506071b9065921e602b0f6c5ce1870a

Download Submit
C:\Windows\System\xRjyqAd.exe

Filesize
1.9MB

MD5
8a474972ee151e6adf687b45e100e56c

SHA1
be959beb6cc47f01d2b01c82c46740e4745ee341

SHA256
041d02fd4059e5f882ee163a3ca02d64587a98d98f91da4d907fa9c6cbbd1783

SHA512
27fe8c0a0c04d9dd0c1ea0c344a633fa7fa6d7797962f1c34049fa2e96f8fcf06592036ea1fc16b12573c28110b8b2491db6ac6279e41162051f77c30224f777

Download Submit
C:\Windows\System\yUUWqdq.exe

Filesize
1.9MB

MD5
8128889b8208b32a22120d3155bf7cdb

SHA1
254c9d0650716aab25df6c47df20257b6b31d59e

SHA256
306406c381e217c493add56e3736e2ce161039b115cc03cf4c5a5f3aa3df464e

SHA512
f363b207db1eb84de50d08c1073878ecd3625fda2f144944d017ab1d63cef49209ebb011eed67aaad46bf0afc1b1e3346f13fe44daa1fa6fa04052d1c2f65125

Download Submit
C:\Windows\System\ypEsmEj.exe

Filesize
1.9MB

MD5
4a3d7da31d16dc110084c88a69d224cc

SHA1
9ec42de776a8f16b3819ad58a24a27428924d99a

SHA256
37aca9a7837d706708c1d87503523b96fb7e80877ebef142d4acf3cad6455f53

SHA512
6950cefaf71b1be7454523f467531e37c422ffdc798d9f22f9f8f39907ef7dfb297adf8f88bc3c0452499a1fad34542fa3dbea00cdec0e8f7f916e2610fa332a

Download Submit
C:\Windows\System\ywTZXzx.exe

Filesize
1.9MB

MD5
73f7ad4f4b0f5b4853726532f6b77fb5

SHA1
0ae656167b8d994dd6c82eb81fcd059267d8fe1a

SHA256
e4aa523693434c6e0b06a2232cce18829a1671635835cf38d74412830a5d1f50

SHA512
595971f188f4dd24d80154dc3d9521ab33d8ca89a4d60a601abcd03d2688dba55c1a57847bf912be80e6f376128187d33e1f22dd18d56770404afc9e017c346b

Download Submit
memory/64-3401-0x00007FF627CA0000-0x00007FF628092000-memory.dmp

Filesize
3.9MB

Download
memory/64-88-0x00007FF627CA0000-0x00007FF628092000-memory.dmp

Filesize
3.9MB

Download
memory/1012-1-0x00000171EC740000-0x00000171EC750000-memory.dmp

Filesize
64KB

Download
memory/1012-0-0x00007FF6B99A0000-0x00007FF6B9D92000-memory.dmp

Filesize
3.9MB

Download
memory/1276-150-0x00007FF68A920000-0x00007FF68AD12000-memory.dmp

Filesize
3.9MB

Download
memory/1276-3392-0x00007FF68A920000-0x00007FF68AD12000-memory.dmp

Filesize
3.9MB

Download
memory/1308-262-0x00007FF76B0A0000-0x00007FF76B492000-memory.dmp

Filesize
3.9MB

Download
memory/1308-3428-0x00007FF76B0A0000-0x00007FF76B492000-memory.dmp

Filesize
3.9MB

Download
memory/1656-258-0x00007FF776010000-0x00007FF776402000-memory.dmp

Filesize
3.9MB

Download
memory/1656-3384-0x00007FF776010000-0x00007FF776402000-memory.dmp

Filesize
3.9MB

Download
memory/1776-256-0x00007FF70B290000-0x00007FF70B682000-memory.dmp

Filesize
3.9MB

Download
memory/1776-3430-0x00007FF70B290000-0x00007FF70B682000-memory.dmp

Filesize
3.9MB

Download
memory/1888-255-0x00007FF6FF580000-0x00007FF6FF972000-memory.dmp

Filesize
3.9MB

Download
memory/1888-3389-0x00007FF6FF580000-0x00007FF6FF972000-memory.dmp

Filesize
3.9MB

Download
memory/1928-3409-0x00007FF6E33E0000-0x00007FF6E37D2000-memory.dmp

Filesize
3.9MB

Download
memory/1928-253-0x00007FF6E33E0000-0x00007FF6E37D2000-memory.dmp

Filesize
3.9MB

Download
memory/2248-3397-0x00007FF6AB280000-0x00007FF6AB672000-memory.dmp

Filesize
3.9MB

Download
memory/2248-248-0x00007FF6AB280000-0x00007FF6AB672000-memory.dmp

Filesize
3.9MB

Download
memory/2316-58-0x0000019BD4990000-0x0000019BD49A0000-memory.dmp

Filesize
64KB

Download
memory/2316-57-0x0000019BD4990000-0x0000019BD49A0000-memory.dmp

Filesize
64KB

Download
memory/2316-51-0x00007FFE33BC0000-0x00007FFE34681000-memory.dmp

Filesize
10.8MB

Download
memory/2316-204-0x0000019BD4EA0000-0x0000019BD4EC2000-memory.dmp

Filesize
136KB

Download
memory/2424-3380-0x00007FF7A1C10000-0x00007FF7A2002000-memory.dmp

Filesize
3.9MB

Download
memory/2424-15-0x00007FF7A1C10000-0x00007FF7A2002000-memory.dmp

Filesize
3.9MB

Download
memory/2688-261-0x00007FF6DAD50000-0x00007FF6DB142000-memory.dmp

Filesize
3.9MB

Download
memory/2688-3431-0x00007FF6DAD50000-0x00007FF6DB142000-memory.dmp

Filesize
3.9MB

Download
memory/2904-214-0x00007FF7264B0000-0x00007FF7268A2000-memory.dmp

Filesize
3.9MB

Download
memory/2904-3394-0x00007FF7264B0000-0x00007FF7268A2000-memory.dmp

Filesize
3.9MB

Download
memory/2936-3383-0x00007FF78A110000-0x00007FF78A502000-memory.dmp

Filesize
3.9MB

Download
memory/2936-117-0x00007FF78A110000-0x00007FF78A502000-memory.dmp

Filesize
3.9MB

Download
memory/2984-3425-0x00007FF7BE720000-0x00007FF7BEB12000-memory.dmp

Filesize
3.9MB

Download
memory/2984-257-0x00007FF7BE720000-0x00007FF7BEB12000-memory.dmp

Filesize
3.9MB

Download
memory/3372-3410-0x00007FF688820000-0x00007FF688C12000-memory.dmp

Filesize
3.9MB

Download
memory/3372-252-0x00007FF688820000-0x00007FF688C12000-memory.dmp

Filesize
3.9MB

Download
memory/3804-3420-0x00007FF768880000-0x00007FF768C72000-memory.dmp

Filesize
3.9MB

Download
memory/3804-254-0x00007FF768880000-0x00007FF768C72000-memory.dmp

Filesize
3.9MB

Download
memory/3924-259-0x00007FF6A1190000-0x00007FF6A1582000-memory.dmp

Filesize
3.9MB

Download
memory/3924-3399-0x00007FF6A1190000-0x00007FF6A1582000-memory.dmp

Filesize
3.9MB

Download
memory/4608-3402-0x00007FF682670000-0x00007FF682A62000-memory.dmp

Filesize
3.9MB

Download
memory/4608-251-0x00007FF682670000-0x00007FF682A62000-memory.dmp

Filesize
3.9MB

Download
memory/4624-3406-0x00007FF7EF240000-0x00007FF7EF632000-memory.dmp

Filesize
3.9MB

Download
memory/4624-250-0x00007FF7EF240000-0x00007FF7EF632000-memory.dmp

Filesize
3.9MB

Download
memory/4644-3391-0x00007FF7DFBA0000-0x00007FF7DFF92000-memory.dmp

Filesize
3.9MB

Download
memory/4644-225-0x00007FF7DFBA0000-0x00007FF7DFF92000-memory.dmp

Filesize
3.9MB

Download
memory/4704-3404-0x00007FF738070000-0x00007FF738462000-memory.dmp

Filesize
3.9MB

Download
memory/4704-260-0x00007FF738070000-0x00007FF738462000-memory.dmp

Filesize
3.9MB

Download
memory/5092-70-0x00007FF6BED50000-0x00007FF6BF142000-memory.dmp

Filesize
3.9MB

Download
memory/5092-3386-0x00007FF6BED50000-0x00007FF6BF142000-memory.dmp

Filesize
3.9MB

Download