xmrig | 8c39bad80224c81da9b1fea9500d48deb2ef31b3f6df4b2256f25c90c16ca039

Analysis

max time kernel
41s
max time network
42s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29-04-2024 16:50

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
Size

1.8MB
MD5

08253b9baab1c5dece6b01f0d4b7b8e7
SHA1

c2bbf6eef7abed49e2708d56b5da7d3869b0f06f
SHA256

8c39bad80224c81da9b1fea9500d48deb2ef31b3f6df4b2256f25c90c16ca039
SHA512

2ae2c65c9927012dc9a452996bd90da3eb89e6389d073dea85618e8778ffc5b0369de192bb14e12a34f913ba5168bee540dd3437b23eb78daefa4f3a7a64fa60
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlc:NABL

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 20 IoCs

miner

resource	yara_rule
behavioral2/memory/5068-255-0x00007FF77AA40000-0x00007FF77AE32000-memory.dmp	xmrig
behavioral2/memory/392-298-0x00007FF6A7D40000-0x00007FF6A8132000-memory.dmp	xmrig
behavioral2/memory/2996-312-0x00007FF6A7FC0000-0x00007FF6A83B2000-memory.dmp	xmrig
behavioral2/memory/3928-351-0x00007FF63B870000-0x00007FF63BC62000-memory.dmp	xmrig
behavioral2/memory/3560-358-0x00007FF7C7880000-0x00007FF7C7C72000-memory.dmp	xmrig
behavioral2/memory/2144-388-0x00007FF6BDB50000-0x00007FF6BDF42000-memory.dmp	xmrig
behavioral2/memory/3844-389-0x00007FF6579A0000-0x00007FF657D92000-memory.dmp	xmrig
behavioral2/memory/5076-385-0x00007FF74ADF0000-0x00007FF74B1E2000-memory.dmp	xmrig
behavioral2/memory/1912-356-0x00007FF63C2B0000-0x00007FF63C6A2000-memory.dmp	xmrig
behavioral2/memory/3312-311-0x00007FF616070000-0x00007FF616462000-memory.dmp	xmrig
behavioral2/memory/4332-304-0x00007FF638810000-0x00007FF638C02000-memory.dmp	xmrig
behavioral2/memory/4512-264-0x00007FF6108A0000-0x00007FF610C92000-memory.dmp	xmrig
behavioral2/memory/2760-236-0x00007FF681770000-0x00007FF681B62000-memory.dmp	xmrig
behavioral2/memory/2800-212-0x00007FF6EA100000-0x00007FF6EA4F2000-memory.dmp	xmrig
behavioral2/memory/2904-164-0x00007FF69C940000-0x00007FF69CD32000-memory.dmp	xmrig
behavioral2/memory/1304-158-0x00007FF78FEE0000-0x00007FF7902D2000-memory.dmp	xmrig
behavioral2/memory/4692-128-0x00007FF7A6A40000-0x00007FF7A6E32000-memory.dmp	xmrig
behavioral2/memory/4364-99-0x00007FF724180000-0x00007FF724572000-memory.dmp	xmrig
behavioral2/memory/4276-67-0x00007FF6204A0000-0x00007FF620892000-memory.dmp	xmrig
behavioral2/memory/752-50-0x00007FF7358F0000-0x00007FF735CE2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
312	AUFCeti.exe
3560	ywvxjZJ.exe
752	IsCgDoa.exe
4276	VYWizva.exe
4364	uboeCKE.exe
4692	OPgShLh.exe
1304	YlBMrdI.exe
2904	HLIXegv.exe
2800	WrGuzCk.exe
5076	RrkdqcC.exe
2760	BdqLoeR.exe
5068	MhWbSgw.exe
4512	zLXMsMi.exe
392	lyWkqmo.exe
2144	AfBVOTO.exe
4332	qgrGdlh.exe
3312	lwGmYOT.exe
2996	VAGfKqQ.exe
3844	RQJIvUF.exe
3928	LxIJNlu.exe
1912	aGgHQZa.exe
4308	gQHnUGy.exe
1704	SRUoUnQ.exe
3192	fyXxfYZ.exe
4060	FujXEgJ.exe
4996	IpnAEGm.exe
3988	jQKjmrp.exe
4316	WxHhcuh.exe
4376	oAozcLO.exe
3860	CWAxuuZ.exe
4532	IEuWfBx.exe
880	mqXAzpY.exe
4756	SZUGYxZ.exe
3608	aSxDslg.exe
1664	kzuUpFQ.exe
2736	BveokYo.exe
5028	NYCRpMM.exe
3624	aSqVdUC.exe
2856	wEdKcYG.exe
3700	MqPlXiB.exe
3500	HQeQgDc.exe
4752	cODAroU.exe
2224	QHREaRV.exe
4460	GaiZuUK.exe
4200	QIXlOBT.exe
1180	XvYkIJW.exe
4788	QQvsztc.exe
4384	jaCmwlW.exe
776	skgRAHD.exe
4428	GTZxXFw.exe
4072	vRRBqFJ.exe
1576	pUQQgUd.exe
3800	qmSQngT.exe
4344	qCkaOYb.exe
4896	fJGkWeP.exe
5036	NOOMwRg.exe
4372	uSwxhPw.exe
3752	umBXrax.exe
2016	VUgZOuN.exe
3140	tNwvIwe.exe
2636	ZqFIebj.exe
4368	wbuCdXC.exe
3360	kSKFCch.exe
3012	VDxtSxK.exe

UPX packed file 59 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5100-0-0x00007FF751F70000-0x00007FF752362000-memory.dmp	upx
behavioral2/files/0x000c000000023b35-5.dat	upx
behavioral2/files/0x000a000000023b93-7.dat	upx
behavioral2/files/0x000b000000023b8f-12.dat	upx
behavioral2/files/0x000a000000023b96-39.dat	upx
behavioral2/files/0x000a000000023b9c-56.dat	upx
behavioral2/files/0x000a000000023bac-140.dat	upx
behavioral2/files/0x000a000000023bb3-176.dat	upx
behavioral2/memory/5068-255-0x00007FF77AA40000-0x00007FF77AE32000-memory.dmp	upx
behavioral2/memory/392-298-0x00007FF6A7D40000-0x00007FF6A8132000-memory.dmp	upx
behavioral2/memory/2996-312-0x00007FF6A7FC0000-0x00007FF6A83B2000-memory.dmp	upx
behavioral2/memory/3928-351-0x00007FF63B870000-0x00007FF63BC62000-memory.dmp	upx
behavioral2/memory/3560-358-0x00007FF7C7880000-0x00007FF7C7C72000-memory.dmp	upx
behavioral2/memory/2144-388-0x00007FF6BDB50000-0x00007FF6BDF42000-memory.dmp	upx
behavioral2/memory/3844-389-0x00007FF6579A0000-0x00007FF657D92000-memory.dmp	upx
behavioral2/memory/5076-385-0x00007FF74ADF0000-0x00007FF74B1E2000-memory.dmp	upx
behavioral2/memory/1912-356-0x00007FF63C2B0000-0x00007FF63C6A2000-memory.dmp	upx
behavioral2/memory/3312-311-0x00007FF616070000-0x00007FF616462000-memory.dmp	upx
behavioral2/memory/4332-304-0x00007FF638810000-0x00007FF638C02000-memory.dmp	upx
behavioral2/memory/4512-264-0x00007FF6108A0000-0x00007FF610C92000-memory.dmp	upx
behavioral2/memory/2760-236-0x00007FF681770000-0x00007FF681B62000-memory.dmp	upx
behavioral2/memory/2800-212-0x00007FF6EA100000-0x00007FF6EA4F2000-memory.dmp	upx
behavioral2/files/0x000a000000023bb5-202.dat	upx
behavioral2/files/0x000a000000023bae-201.dat	upx
behavioral2/files/0x000a000000023ba8-199.dat	upx
behavioral2/files/0x000a000000023ba7-196.dat	upx
behavioral2/files/0x000a000000023bad-191.dat	upx
behavioral2/files/0x000a000000023bb4-190.dat	upx
behavioral2/files/0x000a000000023bab-173.dat	upx
behavioral2/files/0x000a000000023bb2-170.dat	upx
behavioral2/files/0x000a000000023baa-167.dat	upx
behavioral2/files/0x000a000000023bb1-166.dat	upx
behavioral2/memory/2904-164-0x00007FF69C940000-0x00007FF69CD32000-memory.dmp	upx
behavioral2/memory/1304-158-0x00007FF78FEE0000-0x00007FF7902D2000-memory.dmp	upx
behavioral2/files/0x000a000000023bb0-155.dat	upx
behavioral2/files/0x000a000000023baf-151.dat	upx
behavioral2/files/0x000a000000023ba6-149.dat	upx
behavioral2/files/0x000a000000023ba0-143.dat	upx
behavioral2/files/0x000a000000023ba3-132.dat	upx
behavioral2/memory/4692-128-0x00007FF7A6A40000-0x00007FF7A6E32000-memory.dmp	upx
behavioral2/files/0x000a000000023ba9-127.dat	upx
behavioral2/files/0x000a000000023ba2-154.dat	upx
behavioral2/files/0x000a000000023b9d-122.dat	upx
behavioral2/files/0x000a000000023b9e-119.dat	upx
behavioral2/files/0x000a000000023ba5-113.dat	upx
behavioral2/files/0x000a000000023b9b-135.dat	upx
behavioral2/files/0x000a000000023b9f-101.dat	upx
behavioral2/memory/4364-99-0x00007FF724180000-0x00007FF724572000-memory.dmp	upx
behavioral2/files/0x000a000000023ba1-89.dat	upx
behavioral2/files/0x000a000000023b99-88.dat	upx
behavioral2/files/0x000a000000023b98-83.dat	upx
behavioral2/files/0x000a000000023b97-77.dat	upx
behavioral2/files/0x000a000000023ba4-105.dat	upx
behavioral2/files/0x000a000000023b9a-69.dat	upx
behavioral2/memory/4276-67-0x00007FF6204A0000-0x00007FF620892000-memory.dmp	upx
behavioral2/files/0x000a000000023b94-59.dat	upx
behavioral2/memory/752-50-0x00007FF7358F0000-0x00007FF735CE2000-memory.dmp	upx
behavioral2/files/0x000a000000023b95-33.dat	upx
behavioral2/memory/312-8-0x00007FF671CD0000-0x00007FF6720C2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\yzLssrF.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\ZqqjhEv.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\LeCILbw.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\FclKYRx.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\GxwnvJi.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\JcWCuwr.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\RnRhPHj.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\vsZSzQu.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\ShoyKeq.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\NwBUQCN.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\lpJfBTq.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\NJLgENF.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\mRIrxhD.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\Gtitvfy.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\cxfdqGA.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\wPGrEyG.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\hxslCwd.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\NexqPXI.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\DBmYPrz.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\DjGnCet.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\HJoUJyU.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\dvrwLPH.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\AlQvmlZ.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\MnQpbhr.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\IeZPkAg.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\GdJBtxW.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\sQScWDi.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\xgjyzNC.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\oTpsuLP.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\HyGeXGK.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\TcmtDyH.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\pyfiuXe.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\fvdAHzc.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\NVKdfKT.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\IRlzQji.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\KYuwTgK.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\cadDPrk.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\qpACfJs.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\DgAzToa.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\bVMUbIS.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\DeKPRjq.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\aSqVdUC.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\MUbGlVl.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\qlroCJo.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\IAlYUaF.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\AUFCeti.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\kGZzwDw.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\csfwKhW.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\WETxhPL.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\MZPvjGk.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\XSodNad.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\vPzxbpS.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\RgqYXFN.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\dHSIrwK.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\jcXpVbl.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\lyzvXag.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\OuAEprW.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\qDieJan.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\NlLYCva.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\URcGAkN.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\koGWlwi.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\WUeSWlp.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\cgBaUDo.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\fHebkqM.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
652	powershell.exe
652	powershell.exe
652	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
Token: SeDebugPrivilege	652	powershell.exe
Token: SeLockMemoryPrivilege	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 652	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	85
PID 5100 wrote to memory of 652	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	85
PID 5100 wrote to memory of 312	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	86
PID 5100 wrote to memory of 312	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	86
PID 5100 wrote to memory of 3560	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	87
PID 5100 wrote to memory of 3560	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	87
PID 5100 wrote to memory of 752	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	88
PID 5100 wrote to memory of 752	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	88
PID 5100 wrote to memory of 4276	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	89
PID 5100 wrote to memory of 4276	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	89
PID 5100 wrote to memory of 4364	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	90
PID 5100 wrote to memory of 4364	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	90
PID 5100 wrote to memory of 4692	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	91
PID 5100 wrote to memory of 4692	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	91
PID 5100 wrote to memory of 1304	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	92
PID 5100 wrote to memory of 1304	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	92
PID 5100 wrote to memory of 2904	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	93
PID 5100 wrote to memory of 2904	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	93
PID 5100 wrote to memory of 2800	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	94
PID 5100 wrote to memory of 2800	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	94
PID 5100 wrote to memory of 5076	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	95
PID 5100 wrote to memory of 5076	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	95
PID 5100 wrote to memory of 2760	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	96
PID 5100 wrote to memory of 2760	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	96
PID 5100 wrote to memory of 5068	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	97
PID 5100 wrote to memory of 5068	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	97
PID 5100 wrote to memory of 4512	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	98
PID 5100 wrote to memory of 4512	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	98
PID 5100 wrote to memory of 392	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	99
PID 5100 wrote to memory of 392	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	99
PID 5100 wrote to memory of 2144	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	100
PID 5100 wrote to memory of 2144	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	100
PID 5100 wrote to memory of 4332	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	101
PID 5100 wrote to memory of 4332	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	101
PID 5100 wrote to memory of 3312	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	102
PID 5100 wrote to memory of 3312	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	102
PID 5100 wrote to memory of 2996	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	103
PID 5100 wrote to memory of 2996	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	103
PID 5100 wrote to memory of 3844	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	104
PID 5100 wrote to memory of 3844	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	104
PID 5100 wrote to memory of 3928	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	105
PID 5100 wrote to memory of 3928	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	105
PID 5100 wrote to memory of 1912	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	106
PID 5100 wrote to memory of 1912	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	106
PID 5100 wrote to memory of 4308	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	107
PID 5100 wrote to memory of 4308	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	107
PID 5100 wrote to memory of 1704	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	108
PID 5100 wrote to memory of 1704	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	108
PID 5100 wrote to memory of 3192	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	109
PID 5100 wrote to memory of 3192	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	109
PID 5100 wrote to memory of 4060	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	110
PID 5100 wrote to memory of 4060	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	110
PID 5100 wrote to memory of 4996	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	111
PID 5100 wrote to memory of 4996	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	111
PID 5100 wrote to memory of 3988	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	112
PID 5100 wrote to memory of 3988	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	112
PID 5100 wrote to memory of 4316	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	113
PID 5100 wrote to memory of 4316	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	113
PID 5100 wrote to memory of 4376	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	114
PID 5100 wrote to memory of 4376	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	114
PID 5100 wrote to memory of 3860	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	115
PID 5100 wrote to memory of 3860	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	115
PID 5100 wrote to memory of 4532	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	116
PID 5100 wrote to memory of 4532	5100	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:652
- C:\Windows\System\AUFCeti.exe
  C:\Windows\System\AUFCeti.exe
  2⤵
  - Executes dropped EXE
  PID:312
- C:\Windows\System\ywvxjZJ.exe
  C:\Windows\System\ywvxjZJ.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\IsCgDoa.exe
  C:\Windows\System\IsCgDoa.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\VYWizva.exe
  C:\Windows\System\VYWizva.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\uboeCKE.exe
  C:\Windows\System\uboeCKE.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\OPgShLh.exe
  C:\Windows\System\OPgShLh.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\YlBMrdI.exe
  C:\Windows\System\YlBMrdI.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\HLIXegv.exe
  C:\Windows\System\HLIXegv.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\WrGuzCk.exe
  C:\Windows\System\WrGuzCk.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\RrkdqcC.exe
  C:\Windows\System\RrkdqcC.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\BdqLoeR.exe
  C:\Windows\System\BdqLoeR.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\MhWbSgw.exe
  C:\Windows\System\MhWbSgw.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\zLXMsMi.exe
  C:\Windows\System\zLXMsMi.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\lyWkqmo.exe
  C:\Windows\System\lyWkqmo.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\AfBVOTO.exe
  C:\Windows\System\AfBVOTO.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\qgrGdlh.exe
  C:\Windows\System\qgrGdlh.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\lwGmYOT.exe
  C:\Windows\System\lwGmYOT.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\VAGfKqQ.exe
  C:\Windows\System\VAGfKqQ.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\RQJIvUF.exe
  C:\Windows\System\RQJIvUF.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System\LxIJNlu.exe
  C:\Windows\System\LxIJNlu.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\aGgHQZa.exe
  C:\Windows\System\aGgHQZa.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\gQHnUGy.exe
  C:\Windows\System\gQHnUGy.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\SRUoUnQ.exe
  C:\Windows\System\SRUoUnQ.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\fyXxfYZ.exe
  C:\Windows\System\fyXxfYZ.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\FujXEgJ.exe
  C:\Windows\System\FujXEgJ.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\IpnAEGm.exe
  C:\Windows\System\IpnAEGm.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\jQKjmrp.exe
  C:\Windows\System\jQKjmrp.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\WxHhcuh.exe
  C:\Windows\System\WxHhcuh.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\oAozcLO.exe
  C:\Windows\System\oAozcLO.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\CWAxuuZ.exe
  C:\Windows\System\CWAxuuZ.exe
  2⤵
  - Executes dropped EXE
  PID:3860
- C:\Windows\System\IEuWfBx.exe
  C:\Windows\System\IEuWfBx.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\mqXAzpY.exe
  C:\Windows\System\mqXAzpY.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\SZUGYxZ.exe
  C:\Windows\System\SZUGYxZ.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\aSxDslg.exe
  C:\Windows\System\aSxDslg.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\kzuUpFQ.exe
  C:\Windows\System\kzuUpFQ.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\BveokYo.exe
  C:\Windows\System\BveokYo.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\NYCRpMM.exe
  C:\Windows\System\NYCRpMM.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\aSqVdUC.exe
  C:\Windows\System\aSqVdUC.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\wEdKcYG.exe
  C:\Windows\System\wEdKcYG.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\MqPlXiB.exe
  C:\Windows\System\MqPlXiB.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System\HQeQgDc.exe
  C:\Windows\System\HQeQgDc.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\cODAroU.exe
  C:\Windows\System\cODAroU.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\QHREaRV.exe
  C:\Windows\System\QHREaRV.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\GaiZuUK.exe
  C:\Windows\System\GaiZuUK.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\QIXlOBT.exe
  C:\Windows\System\QIXlOBT.exe
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\System\XvYkIJW.exe
  C:\Windows\System\XvYkIJW.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\QQvsztc.exe
  C:\Windows\System\QQvsztc.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\jaCmwlW.exe
  C:\Windows\System\jaCmwlW.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\skgRAHD.exe
  C:\Windows\System\skgRAHD.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\GTZxXFw.exe
  C:\Windows\System\GTZxXFw.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\vRRBqFJ.exe
  C:\Windows\System\vRRBqFJ.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\pUQQgUd.exe
  C:\Windows\System\pUQQgUd.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\qmSQngT.exe
  C:\Windows\System\qmSQngT.exe
  2⤵
  - Executes dropped EXE
  PID:3800
- C:\Windows\System\qCkaOYb.exe
  C:\Windows\System\qCkaOYb.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\fJGkWeP.exe
  C:\Windows\System\fJGkWeP.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\NOOMwRg.exe
  C:\Windows\System\NOOMwRg.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\uSwxhPw.exe
  C:\Windows\System\uSwxhPw.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\umBXrax.exe
  C:\Windows\System\umBXrax.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\VUgZOuN.exe
  C:\Windows\System\VUgZOuN.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\tNwvIwe.exe
  C:\Windows\System\tNwvIwe.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\ZqFIebj.exe
  C:\Windows\System\ZqFIebj.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\eNlvidb.exe
  C:\Windows\System\eNlvidb.exe
  2⤵
  PID:3504
- C:\Windows\System\xICkhAz.exe
  C:\Windows\System\xICkhAz.exe
  2⤵
  PID:448
- C:\Windows\System\wbuCdXC.exe
  C:\Windows\System\wbuCdXC.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\kSKFCch.exe
  C:\Windows\System\kSKFCch.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\VDxtSxK.exe
  C:\Windows\System\VDxtSxK.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\GeyBfWt.exe
  C:\Windows\System\GeyBfWt.exe
  2⤵
  PID:3248
- C:\Windows\System\EKdDscY.exe
  C:\Windows\System\EKdDscY.exe
  2⤵
  PID:2036
- C:\Windows\System\OUAoAWa.exe
  C:\Windows\System\OUAoAWa.exe
  2⤵
  PID:1920
- C:\Windows\System\ClrEpNB.exe
  C:\Windows\System\ClrEpNB.exe
  2⤵
  PID:4280
- C:\Windows\System\SFlYyqN.exe
  C:\Windows\System\SFlYyqN.exe
  2⤵
  PID:1048
- C:\Windows\System\VmpeQxB.exe
  C:\Windows\System\VmpeQxB.exe
  2⤵
  PID:4968
- C:\Windows\System\VJFQooK.exe
  C:\Windows\System\VJFQooK.exe
  2⤵
  PID:3672
- C:\Windows\System\iKNtGuQ.exe
  C:\Windows\System\iKNtGuQ.exe
  2⤵
  PID:1036
- C:\Windows\System\sjkShXT.exe
  C:\Windows\System\sjkShXT.exe
  2⤵
  PID:3588
- C:\Windows\System\EJiZgKx.exe
  C:\Windows\System\EJiZgKx.exe
  2⤵
  PID:5128
- C:\Windows\System\ncICOeP.exe
  C:\Windows\System\ncICOeP.exe
  2⤵
  PID:5148
- C:\Windows\System\Cwltrxa.exe
  C:\Windows\System\Cwltrxa.exe
  2⤵
  PID:5200
- C:\Windows\System\mOVeJtA.exe
  C:\Windows\System\mOVeJtA.exe
  2⤵
  PID:5328
- C:\Windows\System\HJoUJyU.exe
  C:\Windows\System\HJoUJyU.exe
  2⤵
  PID:5364
- C:\Windows\System\aRjmYqx.exe
  C:\Windows\System\aRjmYqx.exe
  2⤵
  PID:5388
- C:\Windows\System\kcmecru.exe
  C:\Windows\System\kcmecru.exe
  2⤵
  PID:5408
- C:\Windows\System\dIlxkxi.exe
  C:\Windows\System\dIlxkxi.exe
  2⤵
  PID:5444
- C:\Windows\System\tRJaAZs.exe
  C:\Windows\System\tRJaAZs.exe
  2⤵
  PID:5468
- C:\Windows\System\NvNaoZI.exe
  C:\Windows\System\NvNaoZI.exe
  2⤵
  PID:5488
- C:\Windows\System\WyBHUPg.exe
  C:\Windows\System\WyBHUPg.exe
  2⤵
  PID:5520
- C:\Windows\System\WishwaB.exe
  C:\Windows\System\WishwaB.exe
  2⤵
  PID:5560
- C:\Windows\System\mRCPfqr.exe
  C:\Windows\System\mRCPfqr.exe
  2⤵
  PID:5584
- C:\Windows\System\eZSnvAr.exe
  C:\Windows\System\eZSnvAr.exe
  2⤵
  PID:5600
- C:\Windows\System\iZHnjGe.exe
  C:\Windows\System\iZHnjGe.exe
  2⤵
  PID:5616
- C:\Windows\System\mULlVWZ.exe
  C:\Windows\System\mULlVWZ.exe
  2⤵
  PID:5632
- C:\Windows\System\ZysRvep.exe
  C:\Windows\System\ZysRvep.exe
  2⤵
  PID:5648
- C:\Windows\System\MCsoMdf.exe
  C:\Windows\System\MCsoMdf.exe
  2⤵
  PID:5676
- C:\Windows\System\RdMFUXl.exe
  C:\Windows\System\RdMFUXl.exe
  2⤵
  PID:5832
- C:\Windows\System\fbYsKvu.exe
  C:\Windows\System\fbYsKvu.exe
  2⤵
  PID:5856
- C:\Windows\System\zzpUQvT.exe
  C:\Windows\System\zzpUQvT.exe
  2⤵
  PID:5876
- C:\Windows\System\DVapCDP.exe
  C:\Windows\System\DVapCDP.exe
  2⤵
  PID:5924
- C:\Windows\System\nkZplml.exe
  C:\Windows\System\nkZplml.exe
  2⤵
  PID:5944
- C:\Windows\System\vosLrjF.exe
  C:\Windows\System\vosLrjF.exe
  2⤵
  PID:5960
- C:\Windows\System\kjuunBB.exe
  C:\Windows\System\kjuunBB.exe
  2⤵
  PID:5984
- C:\Windows\System\lTKXcuL.exe
  C:\Windows\System\lTKXcuL.exe
  2⤵
  PID:4648
- C:\Windows\System\TqqoXJI.exe
  C:\Windows\System\TqqoXJI.exe
  2⤵
  PID:3180
- C:\Windows\System\YAXMquw.exe
  C:\Windows\System\YAXMquw.exe
  2⤵
  PID:4080
- C:\Windows\System\UbyeTCK.exe
  C:\Windows\System\UbyeTCK.exe
  2⤵
  PID:4204
- C:\Windows\System\krkOtWz.exe
  C:\Windows\System\krkOtWz.exe
  2⤵
  PID:2308
- C:\Windows\System\wKkPXQT.exe
  C:\Windows\System\wKkPXQT.exe
  2⤵
  PID:1060
- C:\Windows\System\maIHwQE.exe
  C:\Windows\System\maIHwQE.exe
  2⤵
  PID:1428
- C:\Windows\System\yetBwvj.exe
  C:\Windows\System\yetBwvj.exe
  2⤵
  PID:4176
- C:\Windows\System\WYuRCea.exe
  C:\Windows\System\WYuRCea.exe
  2⤵
  PID:3644
- C:\Windows\System\TxmLpKg.exe
  C:\Windows\System\TxmLpKg.exe
  2⤵
  PID:2988
- C:\Windows\System\DOfSffI.exe
  C:\Windows\System\DOfSffI.exe
  2⤵
  PID:1012
- C:\Windows\System\YoXAAlv.exe
  C:\Windows\System\YoXAAlv.exe
  2⤵
  PID:4800
- C:\Windows\System\XDWCBGT.exe
  C:\Windows\System\XDWCBGT.exe
  2⤵
  PID:5160
- C:\Windows\System\bXKRXje.exe
  C:\Windows\System\bXKRXje.exe
  2⤵
  PID:5244
- C:\Windows\System\owgsFbt.exe
  C:\Windows\System\owgsFbt.exe
  2⤵
  PID:5292
- C:\Windows\System\UmeBBYa.exe
  C:\Windows\System\UmeBBYa.exe
  2⤵
  PID:5348
- C:\Windows\System\hoLujqS.exe
  C:\Windows\System\hoLujqS.exe
  2⤵
  PID:5396
- C:\Windows\System\gTfrPxk.exe
  C:\Windows\System\gTfrPxk.exe
  2⤵
  PID:5452
- C:\Windows\System\mnxwmio.exe
  C:\Windows\System\mnxwmio.exe
  2⤵
  PID:5496
- C:\Windows\System\tQLnzra.exe
  C:\Windows\System\tQLnzra.exe
  2⤵
  PID:5544
- C:\Windows\System\dqipPwq.exe
  C:\Windows\System\dqipPwq.exe
  2⤵
  PID:5580
- C:\Windows\System\rPpuToF.exe
  C:\Windows\System\rPpuToF.exe
  2⤵
  PID:5640
- C:\Windows\System\MZdiHPx.exe
  C:\Windows\System\MZdiHPx.exe
  2⤵
  PID:5684
- C:\Windows\System\yLLmHNi.exe
  C:\Windows\System\yLLmHNi.exe
  2⤵
  PID:5796
- C:\Windows\System\HzWihSw.exe
  C:\Windows\System\HzWihSw.exe
  2⤵
  PID:5848
- C:\Windows\System\kIgNPzM.exe
  C:\Windows\System\kIgNPzM.exe
  2⤵
  PID:5888
- C:\Windows\System\iSivhKR.exe
  C:\Windows\System\iSivhKR.exe
  2⤵
  PID:5936
- C:\Windows\System\cxApPGC.exe
  C:\Windows\System\cxApPGC.exe
  2⤵
  PID:5968
- C:\Windows\System\qXdmhmF.exe
  C:\Windows\System\qXdmhmF.exe
  2⤵
  PID:6096
- C:\Windows\System\cFzxOrG.exe
  C:\Windows\System\cFzxOrG.exe
  2⤵
  PID:3076
- C:\Windows\System\vWfuZJB.exe
  C:\Windows\System\vWfuZJB.exe
  2⤵
  PID:1004
- C:\Windows\System\wQCpgtH.exe
  C:\Windows\System\wQCpgtH.exe
  2⤵
  PID:3940
- C:\Windows\System\WkByYqS.exe
  C:\Windows\System\WkByYqS.exe
  2⤵
  PID:3176
- C:\Windows\System\LDLwsUJ.exe
  C:\Windows\System\LDLwsUJ.exe
  2⤵
  PID:3548
- C:\Windows\System\aWnIYBn.exe
  C:\Windows\System\aWnIYBn.exe
  2⤵
  PID:1136
- C:\Windows\System\HbKlWuJ.exe
  C:\Windows\System\HbKlWuJ.exe
  2⤵
  PID:4852
- C:\Windows\System\RsSABRh.exe
  C:\Windows\System\RsSABRh.exe
  2⤵
  PID:1964
- C:\Windows\System\CPJYjYH.exe
  C:\Windows\System\CPJYjYH.exe
  2⤵
  PID:1316
- C:\Windows\System\qgXciMD.exe
  C:\Windows\System\qgXciMD.exe
  2⤵
  PID:3436
- C:\Windows\System\ytwAKzx.exe
  C:\Windows\System\ytwAKzx.exe
  2⤵
  PID:2520
- C:\Windows\System\fcacdHa.exe
  C:\Windows\System\fcacdHa.exe
  2⤵
  PID:1616
- C:\Windows\System\lGqDafY.exe
  C:\Windows\System\lGqDafY.exe
  2⤵
  PID:3196
- C:\Windows\System\aqqcKmv.exe
  C:\Windows\System\aqqcKmv.exe
  2⤵
  PID:5312
- C:\Windows\System\AAxKmYG.exe
  C:\Windows\System\AAxKmYG.exe
  2⤵
  PID:5976
- C:\Windows\System\xXdgKEn.exe
  C:\Windows\System\xXdgKEn.exe
  2⤵
  PID:1416
- C:\Windows\System\GHaHyKH.exe
  C:\Windows\System\GHaHyKH.exe
  2⤵
  PID:540
- C:\Windows\System\AulGhLx.exe
  C:\Windows\System\AulGhLx.exe
  2⤵
  PID:628
- C:\Windows\System\IZbHmEL.exe
  C:\Windows\System\IZbHmEL.exe
  2⤵
  PID:3408
- C:\Windows\System\AnOVxNc.exe
  C:\Windows\System\AnOVxNc.exe
  2⤵
  PID:4840
- C:\Windows\System\cslpTEi.exe
  C:\Windows\System\cslpTEi.exe
  2⤵
  PID:3652
- C:\Windows\System\gMSUHnV.exe
  C:\Windows\System\gMSUHnV.exe
  2⤵
  PID:2584
- C:\Windows\System\jztnQMw.exe
  C:\Windows\System\jztnQMw.exe
  2⤵
  PID:5144
- C:\Windows\System\woIqQGY.exe
  C:\Windows\System\woIqQGY.exe
  2⤵
  PID:5460
- C:\Windows\System\nciFPmT.exe
  C:\Windows\System\nciFPmT.exe
  2⤵
  PID:5760
- C:\Windows\System\VKpeWxW.exe
  C:\Windows\System\VKpeWxW.exe
  2⤵
  PID:5568
- C:\Windows\System\ZUHPGYx.exe
  C:\Windows\System\ZUHPGYx.exe
  2⤵
  PID:5624
- C:\Windows\System\zOrjFYm.exe
  C:\Windows\System\zOrjFYm.exe
  2⤵
  PID:5952
- C:\Windows\System\qItmIGi.exe
  C:\Windows\System\qItmIGi.exe
  2⤵
  PID:2368
- C:\Windows\System\ATJboVq.exe
  C:\Windows\System\ATJboVq.exe
  2⤵
  PID:1388
- C:\Windows\System\OWzXeZs.exe
  C:\Windows\System\OWzXeZs.exe
  2⤵
  PID:2360
- C:\Windows\System\pVvHaYl.exe
  C:\Windows\System\pVvHaYl.exe
  2⤵
  PID:5080
- C:\Windows\System\DWpyoTk.exe
  C:\Windows\System\DWpyoTk.exe
  2⤵
  PID:1968
- C:\Windows\System\tXnazSN.exe
  C:\Windows\System\tXnazSN.exe
  2⤵
  PID:6112
- C:\Windows\System\wEIdRAx.exe
  C:\Windows\System\wEIdRAx.exe
  2⤵
  PID:2876
- C:\Windows\System\cQXMEQA.exe
  C:\Windows\System\cQXMEQA.exe
  2⤵
  PID:6160
- C:\Windows\System\ITnZokm.exe
  C:\Windows\System\ITnZokm.exe
  2⤵
  PID:6184
- C:\Windows\System\mNgoUPB.exe
  C:\Windows\System\mNgoUPB.exe
  2⤵
  PID:6200
- C:\Windows\System\nIFzJER.exe
  C:\Windows\System\nIFzJER.exe
  2⤵
  PID:6224
- C:\Windows\System\TRkMBUB.exe
  C:\Windows\System\TRkMBUB.exe
  2⤵
  PID:6248
- C:\Windows\System\sMtTBdM.exe
  C:\Windows\System\sMtTBdM.exe
  2⤵
  PID:6264
- C:\Windows\System\EoHleAh.exe
  C:\Windows\System\EoHleAh.exe
  2⤵
  PID:6288
- C:\Windows\System\GbWPlSc.exe
  C:\Windows\System\GbWPlSc.exe
  2⤵
  PID:6308
- C:\Windows\System\TbKswZs.exe
  C:\Windows\System\TbKswZs.exe
  2⤵
  PID:6340
- C:\Windows\System\EnGdQBW.exe
  C:\Windows\System\EnGdQBW.exe
  2⤵
  PID:6360
- C:\Windows\System\LExVHbk.exe
  C:\Windows\System\LExVHbk.exe
  2⤵
  PID:6384
- C:\Windows\System\ElViett.exe
  C:\Windows\System\ElViett.exe
  2⤵
  PID:6404
- C:\Windows\System\KEKdpgO.exe
  C:\Windows\System\KEKdpgO.exe
  2⤵
  PID:6428
- C:\Windows\System\DIIQYWJ.exe
  C:\Windows\System\DIIQYWJ.exe
  2⤵
  PID:6452
- C:\Windows\System\kSmbVtz.exe
  C:\Windows\System\kSmbVtz.exe
  2⤵
  PID:6468
- C:\Windows\System\zhxQUSn.exe
  C:\Windows\System\zhxQUSn.exe
  2⤵
  PID:6496
- C:\Windows\System\SZAxMhy.exe
  C:\Windows\System\SZAxMhy.exe
  2⤵
  PID:6520
- C:\Windows\System\vHcZkBc.exe
  C:\Windows\System\vHcZkBc.exe
  2⤵
  PID:6540
- C:\Windows\System\GJvSBFd.exe
  C:\Windows\System\GJvSBFd.exe
  2⤵
  PID:6560
- C:\Windows\System\IZMleZJ.exe
  C:\Windows\System\IZMleZJ.exe
  2⤵
  PID:6588
- C:\Windows\System\SCTGPzj.exe
  C:\Windows\System\SCTGPzj.exe
  2⤵
  PID:6608
- C:\Windows\System\sLEcQvI.exe
  C:\Windows\System\sLEcQvI.exe
  2⤵
  PID:6628
- C:\Windows\System\OcnPwJU.exe
  C:\Windows\System\OcnPwJU.exe
  2⤵
  PID:6656
- C:\Windows\System\RhhqdJG.exe
  C:\Windows\System\RhhqdJG.exe
  2⤵
  PID:6672
- C:\Windows\System\gPoAwlC.exe
  C:\Windows\System\gPoAwlC.exe
  2⤵
  PID:6696
- C:\Windows\System\HXolrol.exe
  C:\Windows\System\HXolrol.exe
  2⤵
  PID:6712
- C:\Windows\System\HAEAVzw.exe
  C:\Windows\System\HAEAVzw.exe
  2⤵
  PID:6740
- C:\Windows\System\btKIGnI.exe
  C:\Windows\System\btKIGnI.exe
  2⤵
  PID:6756
- C:\Windows\System\RyrgTmJ.exe
  C:\Windows\System\RyrgTmJ.exe
  2⤵
  PID:6780
- C:\Windows\System\FeZYTME.exe
  C:\Windows\System\FeZYTME.exe
  2⤵
  PID:6804
- C:\Windows\System\DUrbvAE.exe
  C:\Windows\System\DUrbvAE.exe
  2⤵
  PID:6820
- C:\Windows\System\RadRsQx.exe
  C:\Windows\System\RadRsQx.exe
  2⤵
  PID:6844
- C:\Windows\System\NfFLMCB.exe
  C:\Windows\System\NfFLMCB.exe
  2⤵
  PID:6868
- C:\Windows\System\xGKiant.exe
  C:\Windows\System\xGKiant.exe
  2⤵
  PID:6884
- C:\Windows\System\OfTLaMc.exe
  C:\Windows\System\OfTLaMc.exe
  2⤵
  PID:6908
- C:\Windows\System\AufDWcX.exe
  C:\Windows\System\AufDWcX.exe
  2⤵
  PID:6928
- C:\Windows\System\ibVCRwb.exe
  C:\Windows\System\ibVCRwb.exe
  2⤵
  PID:6948
- C:\Windows\System\mOeDlTh.exe
  C:\Windows\System\mOeDlTh.exe
  2⤵
  PID:6972
- C:\Windows\System\bbKehml.exe
  C:\Windows\System\bbKehml.exe
  2⤵
  PID:6996
- C:\Windows\System\Bzwlvna.exe
  C:\Windows\System\Bzwlvna.exe
  2⤵
  PID:7020
- C:\Windows\System\yyjOFqa.exe
  C:\Windows\System\yyjOFqa.exe
  2⤵
  PID:7036
- C:\Windows\System\AJZfdDW.exe
  C:\Windows\System\AJZfdDW.exe
  2⤵
  PID:7060
- C:\Windows\System\bCWUwJp.exe
  C:\Windows\System\bCWUwJp.exe
  2⤵
  PID:7084
- C:\Windows\System\ECWkQnB.exe
  C:\Windows\System\ECWkQnB.exe
  2⤵
  PID:7108
- C:\Windows\System\ppeQktZ.exe
  C:\Windows\System\ppeQktZ.exe
  2⤵
  PID:7132
- C:\Windows\System\osGlqhN.exe
  C:\Windows\System\osGlqhN.exe
  2⤵
  PID:7152
- C:\Windows\System\VEqbwlO.exe
  C:\Windows\System\VEqbwlO.exe
  2⤵
  PID:2756
- C:\Windows\System\sqQbjKB.exe
  C:\Windows\System\sqQbjKB.exe
  2⤵
  PID:5820
- C:\Windows\System\RlErrmq.exe
  C:\Windows\System\RlErrmq.exe
  2⤵
  PID:4184
- C:\Windows\System\zzXcyzA.exe
  C:\Windows\System\zzXcyzA.exe
  2⤵
  PID:1608
- C:\Windows\System\ubLVuPu.exe
  C:\Windows\System\ubLVuPu.exe
  2⤵
  PID:1196
- C:\Windows\System\LDMwCDq.exe
  C:\Windows\System\LDMwCDq.exe
  2⤵
  PID:5336
- C:\Windows\System\QRzOZfC.exe
  C:\Windows\System\QRzOZfC.exe
  2⤵
  PID:5664
- C:\Windows\System\XpWHRAz.exe
  C:\Windows\System\XpWHRAz.exe
  2⤵
  PID:5920
- C:\Windows\System\DHLPAGK.exe
  C:\Windows\System\DHLPAGK.exe
  2⤵
  PID:6220
- C:\Windows\System\CGbuLKd.exe
  C:\Windows\System\CGbuLKd.exe
  2⤵
  PID:2772
- C:\Windows\System\OZffzkE.exe
  C:\Windows\System\OZffzkE.exe
  2⤵
  PID:6352
- C:\Windows\System\MEZUgUb.exe
  C:\Windows\System\MEZUgUb.exe
  2⤵
  PID:2916
- C:\Windows\System\GAEAZpW.exe
  C:\Windows\System\GAEAZpW.exe
  2⤵
  PID:6648
- C:\Windows\System\VURdKwv.exe
  C:\Windows\System\VURdKwv.exe
  2⤵
  PID:6772
- C:\Windows\System\dutuiAv.exe
  C:\Windows\System\dutuiAv.exe
  2⤵
  PID:6488
- C:\Windows\System\CVtDESJ.exe
  C:\Windows\System\CVtDESJ.exe
  2⤵
  PID:6860
- C:\Windows\System\bhNBkyi.exe
  C:\Windows\System\bhNBkyi.exe
  2⤵
  PID:6260
- C:\Windows\System\qdROKHq.exe
  C:\Windows\System\qdROKHq.exe
  2⤵
  PID:6296
- C:\Windows\System\LgHtFjk.exe
  C:\Windows\System\LgHtFjk.exe
  2⤵
  PID:6356
- C:\Windows\System\bQXTYJZ.exe
  C:\Windows\System\bQXTYJZ.exe
  2⤵
  PID:7188
- C:\Windows\System\ZDMhlvT.exe
  C:\Windows\System\ZDMhlvT.exe
  2⤵
  PID:7208
- C:\Windows\System\pWwPbaW.exe
  C:\Windows\System\pWwPbaW.exe
  2⤵
  PID:7228
- C:\Windows\System\DZmNEcw.exe
  C:\Windows\System\DZmNEcw.exe
  2⤵
  PID:7248
- C:\Windows\System\HlqWQLz.exe
  C:\Windows\System\HlqWQLz.exe
  2⤵
  PID:7272
- C:\Windows\System\dxOfRoo.exe
  C:\Windows\System\dxOfRoo.exe
  2⤵
  PID:7292
- C:\Windows\System\HYRjqDd.exe
  C:\Windows\System\HYRjqDd.exe
  2⤵
  PID:7312
- C:\Windows\System\nJeAynU.exe
  C:\Windows\System\nJeAynU.exe
  2⤵
  PID:7340
- C:\Windows\System\yWAcfPI.exe
  C:\Windows\System\yWAcfPI.exe
  2⤵
  PID:7356
- C:\Windows\System\gGGtZhR.exe
  C:\Windows\System\gGGtZhR.exe
  2⤵
  PID:7380
- C:\Windows\System\vFuMtiC.exe
  C:\Windows\System\vFuMtiC.exe
  2⤵
  PID:7404
- C:\Windows\System\fMUhUYy.exe
  C:\Windows\System\fMUhUYy.exe
  2⤵
  PID:7420
- C:\Windows\System\alPgmhT.exe
  C:\Windows\System\alPgmhT.exe
  2⤵
  PID:7444
- C:\Windows\System\PbtJqMH.exe
  C:\Windows\System\PbtJqMH.exe
  2⤵
  PID:7464
- C:\Windows\System\MovEPrH.exe
  C:\Windows\System\MovEPrH.exe
  2⤵
  PID:7484
- C:\Windows\System\rhuLLwO.exe
  C:\Windows\System\rhuLLwO.exe
  2⤵
  PID:7504
- C:\Windows\System\bxnVgzg.exe
  C:\Windows\System\bxnVgzg.exe
  2⤵
  PID:7524
- C:\Windows\System\zcnCWat.exe
  C:\Windows\System\zcnCWat.exe
  2⤵
  PID:7548
- C:\Windows\System\KUJInRH.exe
  C:\Windows\System\KUJInRH.exe
  2⤵
  PID:7572
- C:\Windows\System\YitdMGt.exe
  C:\Windows\System\YitdMGt.exe
  2⤵
  PID:7588
- C:\Windows\System\btYuWHg.exe
  C:\Windows\System\btYuWHg.exe
  2⤵
  PID:7616
- C:\Windows\System\syBUPII.exe
  C:\Windows\System\syBUPII.exe
  2⤵
  PID:7636
- C:\Windows\System\AbJQSPG.exe
  C:\Windows\System\AbJQSPG.exe
  2⤵
  PID:7660
- C:\Windows\System\YppplFL.exe
  C:\Windows\System\YppplFL.exe
  2⤵
  PID:7688
- C:\Windows\System\ggTHjDe.exe
  C:\Windows\System\ggTHjDe.exe
  2⤵
  PID:7704
- C:\Windows\System\aDomnyK.exe
  C:\Windows\System\aDomnyK.exe
  2⤵
  PID:7732
- C:\Windows\System\ZNlDuIc.exe
  C:\Windows\System\ZNlDuIc.exe
  2⤵
  PID:7752
- C:\Windows\System\lFqMghh.exe
  C:\Windows\System\lFqMghh.exe
  2⤵
  PID:7776
- C:\Windows\System\GZTraDA.exe
  C:\Windows\System\GZTraDA.exe
  2⤵
  PID:7804
- C:\Windows\System\KmYzqQx.exe
  C:\Windows\System\KmYzqQx.exe
  2⤵
  PID:7824
- C:\Windows\System\jevzjZY.exe
  C:\Windows\System\jevzjZY.exe
  2⤵
  PID:7844
- C:\Windows\System\uUegSoB.exe
  C:\Windows\System\uUegSoB.exe
  2⤵
  PID:7868
- C:\Windows\System\RuvBoIt.exe
  C:\Windows\System\RuvBoIt.exe
  2⤵
  PID:7888
- C:\Windows\System\HRZXadG.exe
  C:\Windows\System\HRZXadG.exe
  2⤵
  PID:7912
- C:\Windows\System\DMcBjCD.exe
  C:\Windows\System\DMcBjCD.exe
  2⤵
  PID:7932
- C:\Windows\System\MDuBjaK.exe
  C:\Windows\System\MDuBjaK.exe
  2⤵
  PID:7960
- C:\Windows\System\IAfOcbK.exe
  C:\Windows\System\IAfOcbK.exe
  2⤵
  PID:7976
- C:\Windows\System\IxtvFVG.exe
  C:\Windows\System\IxtvFVG.exe
  2⤵
  PID:8000
- C:\Windows\System\BEPgGBo.exe
  C:\Windows\System\BEPgGBo.exe
  2⤵
  PID:8020
- C:\Windows\System\EHVvKJm.exe
  C:\Windows\System\EHVvKJm.exe
  2⤵
  PID:8040
- C:\Windows\System\BInZATE.exe
  C:\Windows\System\BInZATE.exe
  2⤵
  PID:8064
- C:\Windows\System\YnLlAbg.exe
  C:\Windows\System\YnLlAbg.exe
  2⤵
  PID:8088
- C:\Windows\System\rfQxgWz.exe
  C:\Windows\System\rfQxgWz.exe
  2⤵
  PID:8108
- C:\Windows\System\ilCpRdD.exe
  C:\Windows\System\ilCpRdD.exe
  2⤵
  PID:8132
- C:\Windows\System\wImGuAK.exe
  C:\Windows\System\wImGuAK.exe
  2⤵
  PID:8152
- C:\Windows\System\qcLvMEm.exe
  C:\Windows\System\qcLvMEm.exe
  2⤵
  PID:8172
- C:\Windows\System\efTEQio.exe
  C:\Windows\System\efTEQio.exe
  2⤵
  PID:6664
- C:\Windows\System\aGlNqzS.exe
  C:\Windows\System\aGlNqzS.exe
  2⤵
  PID:6412
- C:\Windows\System\MnQpbhr.exe
  C:\Windows\System\MnQpbhr.exe
  2⤵
  PID:6708
- C:\Windows\System\OKqwzGD.exe
  C:\Windows\System\OKqwzGD.exe
  2⤵
  PID:6460
- C:\Windows\System\virUZiX.exe
  C:\Windows\System\virUZiX.exe
  2⤵
  PID:6736
- C:\Windows\System\kGZzwDw.exe
  C:\Windows\System\kGZzwDw.exe
  2⤵
  PID:6800
- C:\Windows\System\WhyNjuk.exe
  C:\Windows\System\WhyNjuk.exe
  2⤵
  PID:6080
- C:\Windows\System\wWRbsPY.exe
  C:\Windows\System\wWRbsPY.exe
  2⤵
  PID:6956
- C:\Windows\System\YFKDQhJ.exe
  C:\Windows\System\YFKDQhJ.exe
  2⤵
  PID:6568
- C:\Windows\System\ErHybUj.exe
  C:\Windows\System\ErHybUj.exe
  2⤵
  PID:5884
- C:\Windows\System\bdagzZQ.exe
  C:\Windows\System\bdagzZQ.exe
  2⤵
  PID:7068
- C:\Windows\System\aFKPcHr.exe
  C:\Windows\System\aFKPcHr.exe
  2⤵
  PID:6680
- C:\Windows\System\LYcwfjc.exe
  C:\Windows\System\LYcwfjc.exe
  2⤵
  PID:7268
- C:\Windows\System\pTaqpyV.exe
  C:\Windows\System\pTaqpyV.exe
  2⤵
  PID:7100
- C:\Windows\System\VQlElYw.exe
  C:\Windows\System\VQlElYw.exe
  2⤵
  PID:1636
- C:\Windows\System\YGcHCmu.exe
  C:\Windows\System\YGcHCmu.exe
  2⤵
  PID:6880
- C:\Windows\System\UersqbP.exe
  C:\Windows\System\UersqbP.exe
  2⤵
  PID:5372
- C:\Windows\System\Mzkisby.exe
  C:\Windows\System\Mzkisby.exe
  2⤵
  PID:7500
- C:\Windows\System\LuBknyv.exe
  C:\Windows\System\LuBknyv.exe
  2⤵
  PID:6968
- C:\Windows\System\FmhcNlp.exe
  C:\Windows\System\FmhcNlp.exe
  2⤵
  PID:7716
- C:\Windows\System\ecHDTZZ.exe
  C:\Windows\System\ecHDTZZ.exe
  2⤵
  PID:7784
- C:\Windows\System\rBebbgb.exe
  C:\Windows\System\rBebbgb.exe
  2⤵
  PID:7768
- C:\Windows\System\RgqYXFN.exe
  C:\Windows\System\RgqYXFN.exe
  2⤵
  PID:7172
- C:\Windows\System\oUhQKta.exe
  C:\Windows\System\oUhQKta.exe
  2⤵
  PID:7180
- C:\Windows\System\OeqwlOO.exe
  C:\Windows\System\OeqwlOO.exe
  2⤵
  PID:7076
- C:\Windows\System\PtWfuLO.exe
  C:\Windows\System\PtWfuLO.exe
  2⤵
  PID:7204
- C:\Windows\System\ZatQobK.exe
  C:\Windows\System\ZatQobK.exe
  2⤵
  PID:8212
- C:\Windows\System\zeZPnnS.exe
  C:\Windows\System\zeZPnnS.exe
  2⤵
  PID:8236
- C:\Windows\System\iDDdBHp.exe
  C:\Windows\System\iDDdBHp.exe
  2⤵
  PID:8260
- C:\Windows\System\MCUrPrb.exe
  C:\Windows\System\MCUrPrb.exe
  2⤵
  PID:8280
- C:\Windows\System\AQhitZj.exe
  C:\Windows\System\AQhitZj.exe
  2⤵
  PID:8304
- C:\Windows\System\OuAEprW.exe
  C:\Windows\System\OuAEprW.exe
  2⤵
  PID:8328
- C:\Windows\System\uYTaVzI.exe
  C:\Windows\System\uYTaVzI.exe
  2⤵
  PID:8352
- C:\Windows\System\rvzVzMD.exe
  C:\Windows\System\rvzVzMD.exe
  2⤵
  PID:8368
- C:\Windows\System\MTdvbwA.exe
  C:\Windows\System\MTdvbwA.exe
  2⤵
  PID:8392
- C:\Windows\System\OsgTryC.exe
  C:\Windows\System\OsgTryC.exe
  2⤵
  PID:8412
- C:\Windows\System\rCmRNsL.exe
  C:\Windows\System\rCmRNsL.exe
  2⤵
  PID:8440
- C:\Windows\System\jDiVvbX.exe
  C:\Windows\System\jDiVvbX.exe
  2⤵
  PID:8456
- C:\Windows\System\CqYrZvn.exe
  C:\Windows\System\CqYrZvn.exe
  2⤵
  PID:8484
- C:\Windows\System\QrrUvbL.exe
  C:\Windows\System\QrrUvbL.exe
  2⤵
  PID:8508
- C:\Windows\System\VSnMmkG.exe
  C:\Windows\System\VSnMmkG.exe
  2⤵
  PID:8528
- C:\Windows\System\IWTazaV.exe
  C:\Windows\System\IWTazaV.exe
  2⤵
  PID:8552
- C:\Windows\System\VIMmZZr.exe
  C:\Windows\System\VIMmZZr.exe
  2⤵
  PID:8572
- C:\Windows\System\WmWllkd.exe
  C:\Windows\System\WmWllkd.exe
  2⤵
  PID:8600
- C:\Windows\System\aKfFjCn.exe
  C:\Windows\System\aKfFjCn.exe
  2⤵
  PID:8616
- C:\Windows\System\ykQBMqZ.exe
  C:\Windows\System\ykQBMqZ.exe
  2⤵
  PID:8644
- C:\Windows\System\OLBSRqj.exe
  C:\Windows\System\OLBSRqj.exe
  2⤵
  PID:8664
- C:\Windows\System\gWtzLpf.exe
  C:\Windows\System\gWtzLpf.exe
  2⤵
  PID:8684
- C:\Windows\System\mGWGIpz.exe
  C:\Windows\System\mGWGIpz.exe
  2⤵
  PID:8708
- C:\Windows\System\PIekJOY.exe
  C:\Windows\System\PIekJOY.exe
  2⤵
  PID:8724
- C:\Windows\System\FGZaFLK.exe
  C:\Windows\System\FGZaFLK.exe
  2⤵
  PID:8748
- C:\Windows\System\OUGkOcI.exe
  C:\Windows\System\OUGkOcI.exe
  2⤵
  PID:8772
- C:\Windows\System\ChdfCNx.exe
  C:\Windows\System\ChdfCNx.exe
  2⤵
  PID:8792
- C:\Windows\System\EXtGVmJ.exe
  C:\Windows\System\EXtGVmJ.exe
  2⤵
  PID:8820
- C:\Windows\System\qhEYtbI.exe
  C:\Windows\System\qhEYtbI.exe
  2⤵
  PID:8836
- C:\Windows\System\veEJeVQ.exe
  C:\Windows\System\veEJeVQ.exe
  2⤵
  PID:8860
- C:\Windows\System\iLbcVCR.exe
  C:\Windows\System\iLbcVCR.exe
  2⤵
  PID:8884
- C:\Windows\System\FWfvUlL.exe
  C:\Windows\System\FWfvUlL.exe
  2⤵
  PID:8904
- C:\Windows\System\jUyVxMi.exe
  C:\Windows\System\jUyVxMi.exe
  2⤵
  PID:8924
- C:\Windows\System\bZHAvsO.exe
  C:\Windows\System\bZHAvsO.exe
  2⤵
  PID:8948
- C:\Windows\System\hbZuEyD.exe
  C:\Windows\System\hbZuEyD.exe
  2⤵
  PID:8972
- C:\Windows\System\JQbfqLB.exe
  C:\Windows\System\JQbfqLB.exe
  2⤵
  PID:8988
- C:\Windows\System\YibWohh.exe
  C:\Windows\System\YibWohh.exe
  2⤵
  PID:9004
- C:\Windows\System\uqIHpcb.exe
  C:\Windows\System\uqIHpcb.exe
  2⤵
  PID:9020
- C:\Windows\System\wKISDhL.exe
  C:\Windows\System\wKISDhL.exe
  2⤵
  PID:9040
- C:\Windows\System\ZafGmtQ.exe
  C:\Windows\System\ZafGmtQ.exe
  2⤵
  PID:9060
- C:\Windows\System\uAWTfNF.exe
  C:\Windows\System\uAWTfNF.exe
  2⤵
  PID:9080
- C:\Windows\System\LeCILbw.exe
  C:\Windows\System\LeCILbw.exe
  2⤵
  PID:9112
- C:\Windows\System\CjiQyPC.exe
  C:\Windows\System\CjiQyPC.exe
  2⤵
  PID:9132
- C:\Windows\System\yfUfTlm.exe
  C:\Windows\System\yfUfTlm.exe
  2⤵
  PID:9152
- C:\Windows\System\YXySDEY.exe
  C:\Windows\System\YXySDEY.exe
  2⤵
  PID:9172
- C:\Windows\System\IZvHwkb.exe
  C:\Windows\System\IZvHwkb.exe
  2⤵
  PID:9200
- C:\Windows\System\nIjePEx.exe
  C:\Windows\System\nIjePEx.exe
  2⤵
  PID:7308
- C:\Windows\System\Abzsvdp.exe
  C:\Windows\System\Abzsvdp.exe
  2⤵
  PID:8060
- C:\Windows\System\LWeidke.exe
  C:\Windows\System\LWeidke.exe
  2⤵
  PID:8128
- C:\Windows\System\ieBwcJQ.exe
  C:\Windows\System\ieBwcJQ.exe
  2⤵
  PID:7428
- C:\Windows\System\XjCZIvo.exe
  C:\Windows\System\XjCZIvo.exe
  2⤵
  PID:2352
- C:\Windows\System\SBpgrjb.exe
  C:\Windows\System\SBpgrjb.exe
  2⤵
  PID:6828
- C:\Windows\System\KdqZjQJ.exe
  C:\Windows\System\KdqZjQJ.exe
  2⤵
  PID:5572
- C:\Windows\System\bBTIFLg.exe
  C:\Windows\System\bBTIFLg.exe
  2⤵
  PID:7564
- C:\Windows\System\wNQUxbQ.exe
  C:\Windows\System\wNQUxbQ.exe
  2⤵
  PID:6256
- C:\Windows\System\EItSjnd.exe
  C:\Windows\System\EItSjnd.exe
  2⤵
  PID:7244
- C:\Windows\System\oNBFJxi.exe
  C:\Windows\System\oNBFJxi.exe
  2⤵
  PID:6748
- C:\Windows\System\OJgINSz.exe
  C:\Windows\System\OJgINSz.exe
  2⤵
  PID:1524
- C:\Windows\System\XAyuoEj.exe
  C:\Windows\System\XAyuoEj.exe
  2⤵
  PID:6852
- C:\Windows\System\ZqEqQNe.exe
  C:\Windows\System\ZqEqQNe.exe
  2⤵
  PID:6900
- C:\Windows\System\mjMGcDo.exe
  C:\Windows\System\mjMGcDo.exe
  2⤵
  PID:6980
- C:\Windows\System\LyYtfzp.exe
  C:\Windows\System\LyYtfzp.exe
  2⤵
  PID:7184
- C:\Windows\System\VhmTAAH.exe
  C:\Windows\System\VhmTAAH.exe
  2⤵
  PID:7856
- C:\Windows\System\lMxNPbj.exe
  C:\Windows\System\lMxNPbj.exe
  2⤵
  PID:7284
- C:\Windows\System\hvrnZug.exe
  C:\Windows\System\hvrnZug.exe
  2⤵
  PID:7332
- C:\Windows\System\mayTQKq.exe
  C:\Windows\System\mayTQKq.exe
  2⤵
  PID:8028
- C:\Windows\System\TrpOymS.exe
  C:\Windows\System\TrpOymS.exe
  2⤵
  PID:8300
- C:\Windows\System\nEaSxgD.exe
  C:\Windows\System\nEaSxgD.exe
  2⤵
  PID:8360
- C:\Windows\System\FantuOw.exe
  C:\Windows\System\FantuOw.exe
  2⤵
  PID:8408
- C:\Windows\System\rEvZkHK.exe
  C:\Windows\System\rEvZkHK.exe
  2⤵
  PID:8448
- C:\Windows\System\NYppGRR.exe
  C:\Windows\System\NYppGRR.exe
  2⤵
  PID:7072
- C:\Windows\System\vsZSzQu.exe
  C:\Windows\System\vsZSzQu.exe
  2⤵
  PID:8536
- C:\Windows\System\qiwWtUJ.exe
  C:\Windows\System\qiwWtUJ.exe
  2⤵
  PID:7480
- C:\Windows\System\FkMeHgv.exe
  C:\Windows\System\FkMeHgv.exe
  2⤵
  PID:9232
- C:\Windows\System\zHvDEVN.exe
  C:\Windows\System\zHvDEVN.exe
  2⤵
  PID:9252
- C:\Windows\System\DRVvtGN.exe
  C:\Windows\System\DRVvtGN.exe
  2⤵
  PID:9276
- C:\Windows\System\MeokBIk.exe
  C:\Windows\System\MeokBIk.exe
  2⤵
  PID:9300
- C:\Windows\System\wTFAQfw.exe
  C:\Windows\System\wTFAQfw.exe
  2⤵
  PID:9316
- C:\Windows\System\XunRRoH.exe
  C:\Windows\System\XunRRoH.exe
  2⤵
  PID:9344
- C:\Windows\System\mRJKaHq.exe
  C:\Windows\System\mRJKaHq.exe
  2⤵
  PID:9364
- C:\Windows\System\AWHmXWk.exe
  C:\Windows\System\AWHmXWk.exe
  2⤵
  PID:9384
- C:\Windows\System\mSHXJZM.exe
  C:\Windows\System\mSHXJZM.exe
  2⤵
  PID:9408
- C:\Windows\System\vmiyCsv.exe
  C:\Windows\System\vmiyCsv.exe
  2⤵
  PID:9428
- C:\Windows\System\wEkUQGS.exe
  C:\Windows\System\wEkUQGS.exe
  2⤵
  PID:9452
- C:\Windows\System\JPzwiuX.exe
  C:\Windows\System\JPzwiuX.exe
  2⤵
  PID:9472
- C:\Windows\System\tkunpSw.exe
  C:\Windows\System\tkunpSw.exe
  2⤵
  PID:9500
- C:\Windows\System\ebYbJwe.exe
  C:\Windows\System\ebYbJwe.exe
  2⤵
  PID:9520
- C:\Windows\System\HjHZBMV.exe
  C:\Windows\System\HjHZBMV.exe
  2⤵
  PID:9544
- C:\Windows\System\zTudMiu.exe
  C:\Windows\System\zTudMiu.exe
  2⤵
  PID:9560
- C:\Windows\System\eHgUBam.exe
  C:\Windows\System\eHgUBam.exe
  2⤵
  PID:9580
- C:\Windows\System\MMnNdFK.exe
  C:\Windows\System\MMnNdFK.exe
  2⤵
  PID:9604
- C:\Windows\System\AYrMbhY.exe
  C:\Windows\System\AYrMbhY.exe
  2⤵
  PID:9628
- C:\Windows\System\ethyuJk.exe
  C:\Windows\System\ethyuJk.exe
  2⤵
  PID:9652
- C:\Windows\System\tFbRUtl.exe
  C:\Windows\System\tFbRUtl.exe
  2⤵
  PID:9676
- C:\Windows\System\MmyGzNi.exe
  C:\Windows\System\MmyGzNi.exe
  2⤵
  PID:9696
- C:\Windows\System\xxZwTFu.exe
  C:\Windows\System\xxZwTFu.exe
  2⤵
  PID:9720
- C:\Windows\System\yxwSJlo.exe
  C:\Windows\System\yxwSJlo.exe
  2⤵
  PID:9740
- C:\Windows\System\PrxlNXR.exe
  C:\Windows\System\PrxlNXR.exe
  2⤵
  PID:9764
- C:\Windows\System\ykvLOmh.exe
  C:\Windows\System\ykvLOmh.exe
  2⤵
  PID:9784
- C:\Windows\System\gdmsRzj.exe
  C:\Windows\System\gdmsRzj.exe
  2⤵
  PID:9804
- C:\Windows\System\frLSDZe.exe
  C:\Windows\System\frLSDZe.exe
  2⤵
  PID:9832
- C:\Windows\System\VzZankv.exe
  C:\Windows\System\VzZankv.exe
  2⤵
  PID:9852
- C:\Windows\System\MYjneCS.exe
  C:\Windows\System\MYjneCS.exe
  2⤵
  PID:9880
- C:\Windows\System\UohbTwF.exe
  C:\Windows\System\UohbTwF.exe
  2⤵
  PID:9896
- C:\Windows\System\tRKTvYw.exe
  C:\Windows\System\tRKTvYw.exe
  2⤵
  PID:9920
- C:\Windows\System\xmVJLLJ.exe
  C:\Windows\System\xmVJLLJ.exe
  2⤵
  PID:9940
- C:\Windows\System\AHOnTLT.exe
  C:\Windows\System\AHOnTLT.exe
  2⤵
  PID:10144
- C:\Windows\System\oGuERyA.exe
  C:\Windows\System\oGuERyA.exe
  2⤵
  PID:10172
- C:\Windows\System\mgfrQPS.exe
  C:\Windows\System\mgfrQPS.exe
  2⤵
  PID:10192
- C:\Windows\System\XttLBWd.exe
  C:\Windows\System\XttLBWd.exe
  2⤵
  PID:10220
- C:\Windows\System\EQqiqBy.exe
  C:\Windows\System\EQqiqBy.exe
  2⤵
  PID:10236
- C:\Windows\System\MirbhrJ.exe
  C:\Windows\System\MirbhrJ.exe
  2⤵
  PID:7624
- C:\Windows\System\sgwmSrT.exe
  C:\Windows\System\sgwmSrT.exe
  2⤵
  PID:8760
- C:\Windows\System\vRLyqgl.exe
  C:\Windows\System\vRLyqgl.exe
  2⤵
  PID:7348
- C:\Windows\System\TVFvLIx.exe
  C:\Windows\System\TVFvLIx.exe
  2⤵
  PID:8980
- C:\Windows\System\xzycgSR.exe
  C:\Windows\System\xzycgSR.exe
  2⤵
  PID:7772
- C:\Windows\System\DZuxacR.exe
  C:\Windows\System\DZuxacR.exe
  2⤵
  PID:9052
- C:\Windows\System\yHKiKpQ.exe
  C:\Windows\System\yHKiKpQ.exe
  2⤵
  PID:6280
- C:\Windows\System\BwmawBN.exe
  C:\Windows\System\BwmawBN.exe
  2⤵
  PID:7836
- C:\Windows\System\AYBKTAv.exe
  C:\Windows\System\AYBKTAv.exe
  2⤵
  PID:9192
- C:\Windows\System\mgLBmWU.exe
  C:\Windows\System\mgLBmWU.exe
  2⤵
  PID:7908
- C:\Windows\System\scKCDhV.exe
  C:\Windows\System\scKCDhV.exe
  2⤵
  PID:8208
- C:\Windows\System\OniqhEj.exe
  C:\Windows\System\OniqhEj.exe
  2⤵
  PID:8232
- C:\Windows\System\oLBAZap.exe
  C:\Windows\System\oLBAZap.exe
  2⤵
  PID:7676
- C:\Windows\System\yjpUirh.exe
  C:\Windows\System\yjpUirh.exe
  2⤵
  PID:8324
- C:\Windows\System\FuPyKlX.exe
  C:\Windows\System\FuPyKlX.exe
  2⤵
  PID:6924
- C:\Windows\System\akrclVd.exe
  C:\Windows\System\akrclVd.exe
  2⤵
  PID:8200
- C:\Windows\System\PpOvBcd.exe
  C:\Windows\System\PpOvBcd.exe
  2⤵
  PID:8500
- C:\Windows\System\jsQSZof.exe
  C:\Windows\System\jsQSZof.exe
  2⤵
  PID:7124
- C:\Windows\System\bulJAhL.exe
  C:\Windows\System\bulJAhL.exe
  2⤵
  PID:4516
- C:\Windows\System\wKnqsMx.exe
  C:\Windows\System\wKnqsMx.exe
  2⤵
  PID:9220
- C:\Windows\System\XzrsaoT.exe
  C:\Windows\System\XzrsaoT.exe
  2⤵
  PID:9296
- C:\Windows\System\lqibHbI.exe
  C:\Windows\System\lqibHbI.exe
  2⤵
  PID:9360
- C:\Windows\System\YEaDxEJ.exe
  C:\Windows\System\YEaDxEJ.exe
  2⤵
  PID:7364
- C:\Windows\System\heFCHuz.exe
  C:\Windows\System\heFCHuz.exe
  2⤵
  PID:9464
- C:\Windows\System\ZwTTZRI.exe
  C:\Windows\System\ZwTTZRI.exe
  2⤵
  PID:9508
- C:\Windows\System\RNGXuOy.exe
  C:\Windows\System\RNGXuOy.exe
  2⤵
  PID:9556
- C:\Windows\System\SxaWOOc.exe
  C:\Windows\System\SxaWOOc.exe
  2⤵
  PID:7544
- C:\Windows\System\TPNUcWN.exe
  C:\Windows\System\TPNUcWN.exe
  2⤵
  PID:9712
- C:\Windows\System\NoWHTwL.exe
  C:\Windows\System\NoWHTwL.exe
  2⤵
  PID:9732
- C:\Windows\System\lNBNPSf.exe
  C:\Windows\System\lNBNPSf.exe
  2⤵
  PID:10260
- C:\Windows\System\zJEryLz.exe
  C:\Windows\System\zJEryLz.exe
  2⤵
  PID:10280
- C:\Windows\System\CTxFvSf.exe
  C:\Windows\System\CTxFvSf.exe
  2⤵
  PID:10304
- C:\Windows\System\jooOGxN.exe
  C:\Windows\System\jooOGxN.exe
  2⤵
  PID:10328
- C:\Windows\System\YgEUIii.exe
  C:\Windows\System\YgEUIii.exe
  2⤵
  PID:10352
- C:\Windows\System\gzhBhUr.exe
  C:\Windows\System\gzhBhUr.exe
  2⤵
  PID:10372
- C:\Windows\System\WpgcdvW.exe
  C:\Windows\System\WpgcdvW.exe
  2⤵
  PID:10392
- C:\Windows\System\flONTlu.exe
  C:\Windows\System\flONTlu.exe
  2⤵
  PID:10412
- C:\Windows\System\HyGeXGK.exe
  C:\Windows\System\HyGeXGK.exe
  2⤵
  PID:10436
- C:\Windows\System\mpTiYkM.exe
  C:\Windows\System\mpTiYkM.exe
  2⤵
  PID:10452
- C:\Windows\System\sIbSxmN.exe
  C:\Windows\System\sIbSxmN.exe
  2⤵
  PID:10480
- C:\Windows\System\KoMUafw.exe
  C:\Windows\System\KoMUafw.exe
  2⤵
  PID:10496
- C:\Windows\System\hwmRffn.exe
  C:\Windows\System\hwmRffn.exe
  2⤵
  PID:10528
- C:\Windows\System\OvFIfjY.exe
  C:\Windows\System\OvFIfjY.exe
  2⤵
  PID:10544
- C:\Windows\System\ReQeNJN.exe
  C:\Windows\System\ReQeNJN.exe
  2⤵
  PID:10568
- C:\Windows\System\eKqYrLP.exe
  C:\Windows\System\eKqYrLP.exe
  2⤵
  PID:10596
- C:\Windows\System\eTaAxCH.exe
  C:\Windows\System\eTaAxCH.exe
  2⤵
  PID:10620
- C:\Windows\System\LmDusFH.exe
  C:\Windows\System\LmDusFH.exe
  2⤵
  PID:10636
- C:\Windows\System\fVypNrE.exe
  C:\Windows\System\fVypNrE.exe
  2⤵
  PID:10660
- C:\Windows\System\gFHkUWc.exe
  C:\Windows\System\gFHkUWc.exe
  2⤵
  PID:10688
- C:\Windows\System\mifkFMP.exe
  C:\Windows\System\mifkFMP.exe
  2⤵
  PID:10712
- C:\Windows\System\lCJPHpQ.exe
  C:\Windows\System\lCJPHpQ.exe
  2⤵
  PID:10732
- C:\Windows\System\uZIXhrp.exe
  C:\Windows\System\uZIXhrp.exe
  2⤵
  PID:10752
- C:\Windows\System\RSYaHDO.exe
  C:\Windows\System\RSYaHDO.exe
  2⤵
  PID:10772
- C:\Windows\System\xrLiffJ.exe
  C:\Windows\System\xrLiffJ.exe
  2⤵
  PID:10800
- C:\Windows\System\bnamGZQ.exe
  C:\Windows\System\bnamGZQ.exe
  2⤵
  PID:10816
- C:\Windows\System\ocElAyy.exe
  C:\Windows\System\ocElAyy.exe
  2⤵
  PID:10836
- C:\Windows\System\CdXsdDL.exe
  C:\Windows\System\CdXsdDL.exe
  2⤵
  PID:10860
- C:\Windows\System\tedJtJn.exe
  C:\Windows\System\tedJtJn.exe
  2⤵
  PID:10888
- C:\Windows\System\csfwKhW.exe
  C:\Windows\System\csfwKhW.exe
  2⤵
  PID:10916
- C:\Windows\System\oeRyKJL.exe
  C:\Windows\System\oeRyKJL.exe
  2⤵
  PID:10936
- C:\Windows\System\AAeOKxu.exe
  C:\Windows\System\AAeOKxu.exe
  2⤵
  PID:10956
- C:\Windows\System\mMXHunu.exe
  C:\Windows\System\mMXHunu.exe
  2⤵
  PID:10984
- C:\Windows\System\uloeYlq.exe
  C:\Windows\System\uloeYlq.exe
  2⤵
  PID:11012
- C:\Windows\System\FlbswgS.exe
  C:\Windows\System\FlbswgS.exe
  2⤵
  PID:11032
- C:\Windows\System\vDLJvxv.exe
  C:\Windows\System\vDLJvxv.exe
  2⤵
  PID:11060
- C:\Windows\System\nioDPzs.exe
  C:\Windows\System\nioDPzs.exe
  2⤵
  PID:11080
- C:\Windows\System\WoKGjLy.exe
  C:\Windows\System\WoKGjLy.exe
  2⤵
  PID:11100
- C:\Windows\System\elsMjJp.exe
  C:\Windows\System\elsMjJp.exe
  2⤵
  PID:11124
- C:\Windows\System\lKdKoMs.exe
  C:\Windows\System\lKdKoMs.exe
  2⤵
  PID:11148
- C:\Windows\System\rbLpGMS.exe
  C:\Windows\System\rbLpGMS.exe
  2⤵
  PID:11168
- C:\Windows\System\EPlXrLO.exe
  C:\Windows\System\EPlXrLO.exe
  2⤵
  PID:11192
- C:\Windows\System\fXfBCyn.exe
  C:\Windows\System\fXfBCyn.exe
  2⤵
  PID:11212
- C:\Windows\System\qDieJan.exe
  C:\Windows\System\qDieJan.exe
  2⤵
  PID:11240
- C:\Windows\System\xsvSnLj.exe
  C:\Windows\System\xsvSnLj.exe
  2⤵
  PID:11256
- C:\Windows\System\QZJmcTb.exe
  C:\Windows\System\QZJmcTb.exe
  2⤵
  PID:9096
- C:\Windows\System\xMxIEhQ.exe
  C:\Windows\System\xMxIEhQ.exe
  2⤵
  PID:9796
- C:\Windows\System\RdnXlxY.exe
  C:\Windows\System\RdnXlxY.exe
  2⤵
  PID:8012
- C:\Windows\System\yTWuyfl.exe
  C:\Windows\System\yTWuyfl.exe
  2⤵
  PID:9188
- C:\Windows\System\StHWaYS.exe
  C:\Windows\System\StHWaYS.exe
  2⤵
  PID:8168
- C:\Windows\System\oIrSyEi.exe
  C:\Windows\System\oIrSyEi.exe
  2⤵
  PID:6448
- C:\Windows\System\YZGhEda.exe
  C:\Windows\System\YZGhEda.exe
  2⤵
  PID:10028
- C:\Windows\System\axSkIQp.exe
  C:\Windows\System\axSkIQp.exe
  2⤵
  PID:7748
- C:\Windows\System\dTOMzWc.exe
  C:\Windows\System\dTOMzWc.exe
  2⤵
  PID:11272
- C:\Windows\System\gQoOHka.exe
  C:\Windows\System\gQoOHka.exe
  2⤵
  PID:11300
- C:\Windows\System\gWZPObI.exe
  C:\Windows\System\gWZPObI.exe
  2⤵
  PID:11328
- C:\Windows\System\BRgcOVH.exe
  C:\Windows\System\BRgcOVH.exe
  2⤵
  PID:11344
- C:\Windows\System\ITRvrNh.exe
  C:\Windows\System\ITRvrNh.exe
  2⤵
  PID:11368
- C:\Windows\System\aPPdSpI.exe
  C:\Windows\System\aPPdSpI.exe
  2⤵
  PID:11396
- C:\Windows\System\iWRvozb.exe
  C:\Windows\System\iWRvozb.exe
  2⤵
  PID:11420
- C:\Windows\System\iNlFGHf.exe
  C:\Windows\System\iNlFGHf.exe
  2⤵
  PID:11436
- C:\Windows\System\XCusptW.exe
  C:\Windows\System\XCusptW.exe
  2⤵
  PID:11464
- C:\Windows\System\lYOlZAn.exe
  C:\Windows\System\lYOlZAn.exe
  2⤵
  PID:11480
- C:\Windows\System\rTFMvxJ.exe
  C:\Windows\System\rTFMvxJ.exe
  2⤵
  PID:11508
- C:\Windows\System\xuxZlwM.exe
  C:\Windows\System\xuxZlwM.exe
  2⤵
  PID:11524
- C:\Windows\System\BZGztcV.exe
  C:\Windows\System\BZGztcV.exe
  2⤵
  PID:11552
- C:\Windows\System\GIdZNno.exe
  C:\Windows\System\GIdZNno.exe
  2⤵
  PID:11568
- C:\Windows\System\wwSWYvW.exe
  C:\Windows\System\wwSWYvW.exe
  2⤵
  PID:11592
- C:\Windows\System\BvDoTMr.exe
  C:\Windows\System\BvDoTMr.exe
  2⤵
  PID:11608
- C:\Windows\System\royywWu.exe
  C:\Windows\System\royywWu.exe
  2⤵
  PID:11624
- C:\Windows\System\xrHhGfr.exe
  C:\Windows\System\xrHhGfr.exe
  2⤵
  PID:11644
- C:\Windows\System\TbOvQCW.exe
  C:\Windows\System\TbOvQCW.exe
  2⤵
  PID:11664
- C:\Windows\System\tgJEeXu.exe
  C:\Windows\System\tgJEeXu.exe
  2⤵
  PID:11684
- C:\Windows\System\ZxERceV.exe
  C:\Windows\System\ZxERceV.exe
  2⤵
  PID:11708
- C:\Windows\System\WKhWdiF.exe
  C:\Windows\System\WKhWdiF.exe
  2⤵
  PID:11732
- C:\Windows\System\sAVEwzx.exe
  C:\Windows\System\sAVEwzx.exe
  2⤵
  PID:11752
- C:\Windows\System\VazzVmo.exe
  C:\Windows\System\VazzVmo.exe
  2⤵
  PID:11776
- C:\Windows\System\wMbHkCK.exe
  C:\Windows\System\wMbHkCK.exe
  2⤵
  PID:11796
- C:\Windows\System\inCqnut.exe
  C:\Windows\System\inCqnut.exe
  2⤵
  PID:11816
- C:\Windows\System\ZksiKUb.exe
  C:\Windows\System\ZksiKUb.exe
  2⤵
  PID:11832
- C:\Windows\System\proVBQc.exe
  C:\Windows\System\proVBQc.exe
  2⤵
  PID:11852
- C:\Windows\System\YvaiAqg.exe
  C:\Windows\System\YvaiAqg.exe
  2⤵
  PID:11876
- C:\Windows\System\YVdGFcV.exe
  C:\Windows\System\YVdGFcV.exe
  2⤵
  PID:11900
- C:\Windows\System\mRRnNAv.exe
  C:\Windows\System\mRRnNAv.exe
  2⤵
  PID:11920
- C:\Windows\System\PodJvhl.exe
  C:\Windows\System\PodJvhl.exe
  2⤵
  PID:11944
- C:\Windows\System\rVbvwBr.exe
  C:\Windows\System\rVbvwBr.exe
  2⤵
  PID:11964
- C:\Windows\System\esCLNdY.exe
  C:\Windows\System\esCLNdY.exe
  2⤵
  PID:11984
- C:\Windows\System\ebDOhtE.exe
  C:\Windows\System\ebDOhtE.exe
  2⤵
  PID:12012
- C:\Windows\System\SxgmEZK.exe
  C:\Windows\System\SxgmEZK.exe
  2⤵
  PID:12028
- C:\Windows\System\xtjgqDo.exe
  C:\Windows\System\xtjgqDo.exe
  2⤵
  PID:12052
- C:\Windows\System\mwvMhpd.exe
  C:\Windows\System\mwvMhpd.exe
  2⤵
  PID:12076
- C:\Windows\System\LUFEpXw.exe
  C:\Windows\System\LUFEpXw.exe
  2⤵
  PID:12092
- C:\Windows\System\WUyszed.exe
  C:\Windows\System\WUyszed.exe
  2⤵
  PID:12112
- C:\Windows\System\sxaBjuH.exe
  C:\Windows\System\sxaBjuH.exe
  2⤵
  PID:12136
- C:\Windows\System\pvVoCbA.exe
  C:\Windows\System\pvVoCbA.exe
  2⤵
  PID:12156
- C:\Windows\System\JkIyCzp.exe
  C:\Windows\System\JkIyCzp.exe
  2⤵
  PID:12176
- C:\Windows\System\uSPkVQo.exe
  C:\Windows\System\uSPkVQo.exe
  2⤵
  PID:12200
- C:\Windows\System\nnGJwQQ.exe
  C:\Windows\System\nnGJwQQ.exe
  2⤵
  PID:12216
- C:\Windows\System\kHrQpLv.exe
  C:\Windows\System\kHrQpLv.exe
  2⤵
  PID:12244
- C:\Windows\System\lfLOvQP.exe
  C:\Windows\System\lfLOvQP.exe
  2⤵
  PID:12264
- C:\Windows\System\CJXVWqm.exe
  C:\Windows\System\CJXVWqm.exe
  2⤵
  PID:10112
- C:\Windows\System\NPkHoUz.exe
  C:\Windows\System\NPkHoUz.exe
  2⤵
  PID:8608
- C:\Windows\System\ZQblVzz.exe
  C:\Windows\System\ZQblVzz.exe
  2⤵
  PID:10156
- C:\Windows\System\ueSVPBG.exe
  C:\Windows\System\ueSVPBG.exe
  2⤵
  PID:8704
- C:\Windows\System\BkPEkqe.exe
  C:\Windows\System\BkPEkqe.exe
  2⤵
  PID:2700
- C:\Windows\System\JyZfyuf.exe
  C:\Windows\System\JyZfyuf.exe
  2⤵
  PID:8768
- C:\Windows\System\GjmKOJI.exe
  C:\Windows\System\GjmKOJI.exe
  2⤵
  PID:8844
- C:\Windows\System\gcbZUgt.exe
  C:\Windows\System\gcbZUgt.exe
  2⤵
  PID:7396
- C:\Windows\System\CcxYGyG.exe
  C:\Windows\System\CcxYGyG.exe
  2⤵
  PID:3616
- C:\Windows\System\UqTHlwu.exe
  C:\Windows\System\UqTHlwu.exe
  2⤵
  PID:9576
- C:\Windows\System\TIFvMOs.exe
  C:\Windows\System\TIFvMOs.exe
  2⤵
  PID:7496
- C:\Windows\System\mYwvzbz.exe
  C:\Windows\System\mYwvzbz.exe
  2⤵
  PID:6936
- C:\Windows\System\wFsrynr.exe
  C:\Windows\System\wFsrynr.exe
  2⤵
  PID:10320
- C:\Windows\System\XrOKXAE.exe
  C:\Windows\System\XrOKXAE.exe
  2⤵
  PID:9208
- C:\Windows\System\jtZGyGk.exe
  C:\Windows\System\jtZGyGk.exe
  2⤵
  PID:8124
- C:\Windows\System\QwerAvQ.exe
  C:\Windows\System\QwerAvQ.exe
  2⤵
  PID:7412
- C:\Windows\System\pXrPKXQ.exe
  C:\Windows\System\pXrPKXQ.exe
  2⤵
  PID:10652
- C:\Windows\System\whdhBeZ.exe
  C:\Windows\System\whdhBeZ.exe
  2⤵
  PID:6992
- C:\Windows\System\HdOKsAG.exe
  C:\Windows\System\HdOKsAG.exe
  2⤵
  PID:6300
- C:\Windows\System\GqWvNAI.exe
  C:\Windows\System\GqWvNAI.exe
  2⤵
  PID:12292
- C:\Windows\System\cPPyVfX.exe
  C:\Windows\System\cPPyVfX.exe
  2⤵
  PID:12324
- C:\Windows\System\PFwkJPM.exe
  C:\Windows\System\PFwkJPM.exe
  2⤵
  PID:12340
- C:\Windows\System\tKIuIjB.exe
  C:\Windows\System\tKIuIjB.exe
  2⤵
  PID:12372
- C:\Windows\System\vfvDgtF.exe
  C:\Windows\System\vfvDgtF.exe
  2⤵
  PID:12388
- C:\Windows\System\oZfNVeb.exe
  C:\Windows\System\oZfNVeb.exe
  2⤵
  PID:12416
- C:\Windows\System\aUNoKEb.exe
  C:\Windows\System\aUNoKEb.exe
  2⤵
  PID:12432
- C:\Windows\System\fdMJEKI.exe
  C:\Windows\System\fdMJEKI.exe
  2⤵
  PID:12464
- C:\Windows\System\HnOvfgg.exe
  C:\Windows\System\HnOvfgg.exe
  2⤵
  PID:12484
- C:\Windows\System\hVStRKj.exe
  C:\Windows\System\hVStRKj.exe
  2⤵
  PID:12508
- C:\Windows\System\OhNlVWg.exe
  C:\Windows\System\OhNlVWg.exe
  2⤵
  PID:12528
- C:\Windows\System\XOwPiXM.exe
  C:\Windows\System\XOwPiXM.exe
  2⤵
  PID:12548
- C:\Windows\System\QsYxuWC.exe
  C:\Windows\System\QsYxuWC.exe
  2⤵
  PID:12568
- C:\Windows\System\LSIqSYZ.exe
  C:\Windows\System\LSIqSYZ.exe
  2⤵
  PID:12592
- C:\Windows\System\YaAUOqp.exe
  C:\Windows\System\YaAUOqp.exe
  2⤵
  PID:12612
- C:\Windows\System\KriJkri.exe
  C:\Windows\System\KriJkri.exe
  2⤵
  PID:12636
- C:\Windows\System\NlsvdCb.exe
  C:\Windows\System\NlsvdCb.exe
  2⤵
  PID:12656
- C:\Windows\System\NAnFiMJ.exe
  C:\Windows\System\NAnFiMJ.exe
  2⤵
  PID:12680
- C:\Windows\System\ALiHdxc.exe
  C:\Windows\System\ALiHdxc.exe
  2⤵
  PID:12700
- C:\Windows\System\yoljLQo.exe
  C:\Windows\System\yoljLQo.exe
  2⤵
  PID:12716
- C:\Windows\System\eOSXgoE.exe
  C:\Windows\System\eOSXgoE.exe
  2⤵
  PID:12732
- C:\Windows\System\uFCayEh.exe
  C:\Windows\System\uFCayEh.exe
  2⤵
  PID:12752
- C:\Windows\System\UxgjwcJ.exe
  C:\Windows\System\UxgjwcJ.exe
  2⤵
  PID:12776
- C:\Windows\System\VSrLdoc.exe
  C:\Windows\System\VSrLdoc.exe
  2⤵
  PID:12800
- C:\Windows\System\MrjRRLu.exe
  C:\Windows\System\MrjRRLu.exe
  2⤵
  PID:12820
- C:\Windows\System\nbFORXq.exe
  C:\Windows\System\nbFORXq.exe
  2⤵
  PID:12836
- C:\Windows\System\UqipiAD.exe
  C:\Windows\System\UqipiAD.exe
  2⤵
  PID:12864
- C:\Windows\System\hyqBgnH.exe
  C:\Windows\System\hyqBgnH.exe
  2⤵
  PID:12884
- C:\Windows\System\Izszgqp.exe
  C:\Windows\System\Izszgqp.exe
  2⤵
  PID:12908
- C:\Windows\System\dblHZOc.exe
  C:\Windows\System\dblHZOc.exe
  2⤵
  PID:12924
- C:\Windows\System\TJQdPgu.exe
  C:\Windows\System\TJQdPgu.exe
  2⤵
  PID:12940
- C:\Windows\System\wukyOgc.exe
  C:\Windows\System\wukyOgc.exe
  2⤵
  PID:12960
- C:\Windows\System\NitLdhL.exe
  C:\Windows\System\NitLdhL.exe
  2⤵
  PID:12988
- C:\Windows\System\KCdByAt.exe
  C:\Windows\System\KCdByAt.exe
  2⤵
  PID:13016
- C:\Windows\System\dmEvYJK.exe
  C:\Windows\System\dmEvYJK.exe
  2⤵
  PID:13036
- C:\Windows\System\xhZlRTp.exe
  C:\Windows\System\xhZlRTp.exe
  2⤵
  PID:13060
- C:\Windows\System\XSvMeoW.exe
  C:\Windows\System\XSvMeoW.exe
  2⤵
  PID:13080
- C:\Windows\System\sHxRYdY.exe
  C:\Windows\System\sHxRYdY.exe
  2⤵
  PID:13104
- C:\Windows\System\moncsGt.exe
  C:\Windows\System\moncsGt.exe
  2⤵
  PID:13124
- C:\Windows\System\kHULDWL.exe
  C:\Windows\System\kHULDWL.exe
  2⤵
  PID:13144
- C:\Windows\System\bsVYFUT.exe
  C:\Windows\System\bsVYFUT.exe
  2⤵
  PID:13168
- C:\Windows\System\JncPFlZ.exe
  C:\Windows\System\JncPFlZ.exe
  2⤵
  PID:13184
- C:\Windows\System\wfNkgIo.exe
  C:\Windows\System\wfNkgIo.exe
  2⤵
  PID:13208
- C:\Windows\System\chYJCcI.exe
  C:\Windows\System\chYJCcI.exe
  2⤵
  PID:13228
- C:\Windows\System\HCUrUPF.exe
  C:\Windows\System\HCUrUPF.exe
  2⤵
  PID:13252
- C:\Windows\System\JfgLdam.exe
  C:\Windows\System\JfgLdam.exe
  2⤵
  PID:12896
- C:\Windows\System\fqExkae.exe
  C:\Windows\System\fqExkae.exe
  2⤵
  PID:11428
- C:\Windows\System\CTEDnbg.exe
  C:\Windows\System\CTEDnbg.exe
  2⤵
  PID:12968
- C:\Windows\System\jVRhwfH.exe
  C:\Windows\System\jVRhwfH.exe
  2⤵
  PID:12084
- C:\Windows\System\KaHeTuh.exe
  C:\Windows\System\KaHeTuh.exe
  2⤵
  PID:12088
- C:\Windows\System\oBuJdOy.exe
  C:\Windows\System\oBuJdOy.exe
  2⤵
  PID:9056
- C:\Windows\System\MCvPftC.exe
  C:\Windows\System\MCvPftC.exe
  2⤵
  PID:10292
- C:\Windows\System\jbSazwr.exe
  C:\Windows\System\jbSazwr.exe
  2⤵
  PID:13000
- C:\Windows\System\kgQqlry.exe
  C:\Windows\System\kgQqlry.exe
  2⤵
  PID:10868
- C:\Windows\System\eJVdtmj.exe
  C:\Windows\System\eJVdtmj.exe
  2⤵
  PID:11544
- C:\Windows\System\MunIlZA.exe
  C:\Windows\System\MunIlZA.exe
  2⤵
  PID:11584
- C:\Windows\System\HdkQmJU.exe
  C:\Windows\System\HdkQmJU.exe
  2⤵
  PID:11472
- C:\Windows\System\KWmQfuC.exe
  C:\Windows\System\KWmQfuC.exe
  2⤵
  PID:12936
- C:\Windows\System\NtiFikb.exe
  C:\Windows\System\NtiFikb.exe
  2⤵
  PID:13152
- C:\Windows\System\CxKJVXl.exe
  C:\Windows\System\CxKJVXl.exe
  2⤵
  PID:12460
- C:\Windows\System\GIMIhOc.exe
  C:\Windows\System\GIMIhOc.exe
  2⤵
  PID:9664
- C:\Windows\System\GXpyYUG.exe
  C:\Windows\System\GXpyYUG.exe
  2⤵
  PID:11980
- C:\Windows\System\PYIkKeR.exe
  C:\Windows\System\PYIkKeR.exe
  2⤵
  PID:12036
- C:\Windows\System\zMHLrtJ.exe
  C:\Windows\System\zMHLrtJ.exe
  2⤵
  PID:6476
- C:\Windows\System\cxfdqGA.exe
  C:\Windows\System\cxfdqGA.exe
  2⤵
  PID:1340
- C:\Windows\System\kMKeNcb.exe
  C:\Windows\System\kMKeNcb.exe
  2⤵
  PID:11724
- C:\Windows\System\PvinXkJ.exe
  C:\Windows\System\PvinXkJ.exe
  2⤵
  PID:12020
- C:\Windows\System\ikVYSYk.exe
  C:\Windows\System\ikVYSYk.exe
  2⤵
  PID:13220
- C:\Windows\System\XYzXzls.exe
  C:\Windows\System\XYzXzls.exe
  2⤵
  PID:8076
- C:\Windows\System\wIwbcSd.exe
  C:\Windows\System\wIwbcSd.exe
  2⤵
  PID:9660
- C:\Windows\System\PCeUhVF.exe
  C:\Windows\System\PCeUhVF.exe
  2⤵
  PID:9600
- C:\Windows\System\AFntIcv.exe
  C:\Windows\System\AFntIcv.exe
  2⤵
  PID:11040
- C:\Windows\System\wZvMytf.exe
  C:\Windows\System\wZvMytf.exe
  2⤵
  PID:11992
- C:\Windows\System\lkYAjdj.exe
  C:\Windows\System\lkYAjdj.exe
  2⤵
  PID:10200
- C:\Windows\System\bsUujrZ.exe
  C:\Windows\System\bsUujrZ.exe
  2⤵
  PID:8892
- C:\Windows\System\KBXBDrF.exe
  C:\Windows\System\KBXBDrF.exe
  2⤵
  PID:12308
- C:\Windows\System\SLcWADN.exe
  C:\Windows\System\SLcWADN.exe
  2⤵
  PID:9092
- C:\Windows\System\nCuyASA.exe
  C:\Windows\System\nCuyASA.exe
  2⤵
  PID:12880
- C:\Windows\System\pyfiuXe.exe
  C:\Windows\System\pyfiuXe.exe
  2⤵
  PID:11560
- C:\Windows\System\kxsEqdJ.exe
  C:\Windows\System\kxsEqdJ.exe
  2⤵
  PID:11940
- C:\Windows\System\ABKotNo.exe
  C:\Windows\System\ABKotNo.exe
  2⤵
  PID:11284
- C:\Windows\System\VjWVJpW.exe
  C:\Windows\System\VjWVJpW.exe
  2⤵
  PID:10104
- C:\Windows\System\AJvOKQR.exe
  C:\Windows\System\AJvOKQR.exe
  2⤵
  PID:7840
- C:\Windows\System\OhcNAat.exe
  C:\Windows\System\OhcNAat.exe
  2⤵
  PID:10432
- C:\Windows\System\nzfuoFA.exe
  C:\Windows\System\nzfuoFA.exe
  2⤵
  PID:8184
- C:\Windows\System\jsoqXHS.exe
  C:\Windows\System\jsoqXHS.exe
  2⤵
  PID:11536
- C:\Windows\System\yhOWTNh.exe
  C:\Windows\System\yhOWTNh.exe
  2⤵
  PID:13140
- C:\Windows\System\KBXMnvI.exe
  C:\Windows\System\KBXMnvI.exe
  2⤵
  PID:11432
- C:\Windows\System\MFHnKxV.exe
  C:\Windows\System\MFHnKxV.exe
  2⤵
  PID:13308
- C:\Windows\System\mKvcCJa.exe
  C:\Windows\System\mKvcCJa.exe
  2⤵
  PID:12228
- C:\Windows\System\brvmqCH.exe
  C:\Windows\System\brvmqCH.exe
  2⤵
  PID:10404
- C:\Windows\System\EHONmKr.exe
  C:\Windows\System\EHONmKr.exe
  2⤵
  PID:10384
- C:\Windows\System\ZSDnDrz.exe
  C:\Windows\System\ZSDnDrz.exe
  2⤵
  PID:11744
- C:\Windows\System\ExcZcrl.exe
  C:\Windows\System\ExcZcrl.exe
  2⤵
  PID:12380
- C:\Windows\System\uwuddbz.exe
  C:\Windows\System\uwuddbz.exe
  2⤵
  PID:11376
- C:\Windows\System\CGbZCry.exe
  C:\Windows\System\CGbZCry.exe
  2⤵
  PID:6572
- C:\Windows\System\qpnwRNr.exe
  C:\Windows\System\qpnwRNr.exe
  2⤵
  PID:12740
- C:\Windows\System\unGPkVg.exe
  C:\Windows\System\unGPkVg.exe
  2⤵
  PID:12956
- C:\Windows\System\jGULpVM.exe
  C:\Windows\System\jGULpVM.exe
  2⤵
  PID:12844
- C:\Windows\System\FAuPtiE.exe
  C:\Windows\System\FAuPtiE.exe
  2⤵
  PID:12260
- C:\Windows\System\hoOQkBM.exe
  C:\Windows\System\hoOQkBM.exe
  2⤵
  PID:10096
- C:\Windows\System\vDJLjhS.exe
  C:\Windows\System\vDJLjhS.exe
  2⤵
  PID:11156
- C:\Windows\System\evvCtGZ.exe
  C:\Windows\System\evvCtGZ.exe
  2⤵
  PID:9380
- C:\Windows\System\PtOZrHP.exe
  C:\Windows\System\PtOZrHP.exe
  2⤵
  PID:10068
- C:\Windows\System\tcOpXan.exe
  C:\Windows\System\tcOpXan.exe
  2⤵
  PID:11680
- C:\Windows\System\tkduDvO.exe
  C:\Windows\System\tkduDvO.exe
  2⤵
  PID:7012
- C:\Windows\System\YsyQjox.exe
  C:\Windows\System\YsyQjox.exe
  2⤵
  PID:13164
- C:\Windows\System\gfzDOsG.exe
  C:\Windows\System\gfzDOsG.exe
  2⤵
  PID:10460
- C:\Windows\System\WuuCqPC.exe
  C:\Windows\System\WuuCqPC.exe
  2⤵
  PID:13444
- C:\Windows\System\DgAzToa.exe
  C:\Windows\System\DgAzToa.exe
  2⤵
  PID:13572
- C:\Windows\System\qxgWJrH.exe
  C:\Windows\System\qxgWJrH.exe
  2⤵
  PID:13616
- C:\Windows\System\WHJBmmh.exe
  C:\Windows\System\WHJBmmh.exe
  2⤵
  PID:13664
- C:\Windows\System\lyNBvcm.exe
  C:\Windows\System\lyNBvcm.exe
  2⤵
  PID:13684
- C:\Windows\System\ljaDqsZ.exe
  C:\Windows\System\ljaDqsZ.exe
  2⤵
  PID:13728
- C:\Windows\System\xRgtLlL.exe
  C:\Windows\System\xRgtLlL.exe
  2⤵
  PID:13876
- C:\Windows\System\vnUKPaX.exe
  C:\Windows\System\vnUKPaX.exe
  2⤵
  PID:13920
- C:\Windows\System\WNIjHtN.exe
  C:\Windows\System\WNIjHtN.exe
  2⤵
  PID:13952
- C:\Windows\System\IxxdPRp.exe
  C:\Windows\System\IxxdPRp.exe
  2⤵
  PID:13972
- C:\Windows\System\LHJldOK.exe
  C:\Windows\System\LHJldOK.exe
  2⤵
  PID:14004
- C:\Windows\System\DkiVUBX.exe
  C:\Windows\System\DkiVUBX.exe
  2⤵
  PID:14024
- C:\Windows\System\fAPEGTt.exe
  C:\Windows\System\fAPEGTt.exe
  2⤵
  PID:14080
- C:\Windows\System\OpasouW.exe
  C:\Windows\System\OpasouW.exe
  2⤵
  PID:14100
- C:\Windows\System\HUIuocM.exe
  C:\Windows\System\HUIuocM.exe
  2⤵
  PID:14132
- C:\Windows\System\qQiGirD.exe
  C:\Windows\System\qQiGirD.exe
  2⤵
  PID:14156
- C:\Windows\System\NfnDHwn.exe
  C:\Windows\System\NfnDHwn.exe
  2⤵
  PID:14180
- C:\Windows\System\ocKkXiH.exe
  C:\Windows\System\ocKkXiH.exe
  2⤵
  PID:14200
- C:\Windows\System\RFVnerh.exe
  C:\Windows\System\RFVnerh.exe
  2⤵
  PID:13324
- C:\Windows\System\cgWDiIt.exe
  C:\Windows\System\cgWDiIt.exe
  2⤵
  PID:13376
- C:\Windows\System\sdiPzqo.exe
  C:\Windows\System\sdiPzqo.exe
  2⤵
  PID:13596
- C:\Windows\System\wirFpfV.exe
  C:\Windows\System\wirFpfV.exe
  2⤵
  PID:13740
- C:\Windows\System\CtIeiBM.exe
  C:\Windows\System\CtIeiBM.exe
  2⤵
  PID:13336
- C:\Windows\System\SMfjQBT.exe
  C:\Windows\System\SMfjQBT.exe
  2⤵
  PID:220
- C:\Windows\System\gsVREMV.exe
  C:\Windows\System\gsVREMV.exe
  2⤵
  PID:13332
- C:\Windows\System\RslMVwX.exe
  C:\Windows\System\RslMVwX.exe
  2⤵
  PID:14020
- C:\Windows\System\xrovKBL.exe
  C:\Windows\System\xrovKBL.exe
  2⤵
  PID:14128
- C:\Windows\System\AXFoWCl.exe
  C:\Windows\System\AXFoWCl.exe
  2⤵
  PID:13868
- C:\Windows\System\DzfpBSk.exe
  C:\Windows\System\DzfpBSk.exe
  2⤵
  PID:12724
- C:\Windows\System\uFVaHQm.exe
  C:\Windows\System\uFVaHQm.exe
  2⤵
  PID:12628
- C:\Windows\System\pqPARAm.exe
  C:\Windows\System\pqPARAm.exe
  2⤵
  PID:13556
- C:\Windows\System\ZlpmTVa.exe
  C:\Windows\System\ZlpmTVa.exe
  2⤵
  PID:13724
- C:\Windows\System\vgGBgmW.exe
  C:\Windows\System\vgGBgmW.exe
  2⤵
  PID:4480
- C:\Windows\System\DFUQmMR.exe
  C:\Windows\System\DFUQmMR.exe
  2⤵
  PID:1348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xyzxhjgs.ame.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AUFCeti.exe

Filesize
1.8MB

MD5
afcc092a1f1291eaa47f5a7022995f49

SHA1
ca6107147fc50aea91e1e020df3ea1f829aebf47

SHA256
92c63eda45a008c0307b6d7df835614f781cc0f10289e8704acbfeaf5b241581

SHA512
c377b9c5b5c88d70d8f59b09136649f971d2e7f3d1af9a30a7864118aa01f0640472a59f9192ed94092b605ddc90cc0d4132f61331f34c6a7bbee37775d7ada4

Download Submit
C:\Windows\System\AfBVOTO.exe

Filesize
1.8MB

MD5
2301fe2b67926a8d2094a4f64d1920e4

SHA1
4a7d8e1a35f4bcf488eb90b2829c637830163132

SHA256
03b2304b79fbc2cbd3932e5d1c0ef041fdb06c5a6b25898f902f7f9147ad52a1

SHA512
1d694a35c0f0900b5d8a475551ecfb95cb0745e573e662e89dcf557be1d218ecaf9a8d7c5771e216e12f1c5e24d2cb25c3d418dec46d6b5c078a50cd56dd7c44

Download Submit
C:\Windows\System\BdqLoeR.exe

Filesize
1.8MB

MD5
44fd64d783eb787fe4d8c50aef80e277

SHA1
1cb1e464de907d61e977a4d8dba80fb92f003fe1

SHA256
1586a3151b22951458c61499ec6b96dd83c6c2ead10b991ea7db66dd11d27d76

SHA512
2873c1f03efa2ac1b2301cfab879ccac6ce1a8f306a83a15bb05633d20fff3ff20b39640ba24335a709e9e8119262c2421a9d99dfe4b73ba06c93163c096a997

Download Submit
C:\Windows\System\BveokYo.exe

Filesize
1.9MB

MD5
0f8519d4b9673ffd579a58eac345d120

SHA1
5ff27cf0cb71d4df7531ef1d837eaa56dad6c4d0

SHA256
f13571d4c93fe531aaa86b265ae6c0c2308cc902b4f36ac716ff70ee23cdf532

SHA512
6f9cd1cdeebb4be468b0a17dfc9372a27256001cf7d50428cffba3db631210dc55d0461cec28f90ec87f65838deccb2b7d8b621a980050fed570f2bea424ccbe

Download Submit
C:\Windows\System\CWAxuuZ.exe

Filesize
1.8MB

MD5
4621d649ce0fd7954ff7ac89799f19d8

SHA1
8b14dfcf1af9767efe4fd1f820ba30829c0fdbe1

SHA256
b83745d9aebf22b597122c2e2f4967d5a273525c9d5a37e8d8c47c360aca4b8b

SHA512
caeaa0f8a18d7660c7624cd60bd060ad651e7506882e4980d139766f3d5fe22dbd7cceac3bf563d7dbd1029dc9d3161e876d91d983b276e6a3544aedfb6f797c

Download Submit
C:\Windows\System\FujXEgJ.exe

Filesize
1.8MB

MD5
e5ffb02de78e09bda21ae7b7dfa70f78

SHA1
a1e4e939317639bd804be879b7acb1495f5cbdc3

SHA256
e5ee471ca5302ce65a7c17dea08e6547d943fec54fa91b607939e0d665d65025

SHA512
12319e2e00893007d4e6ad36e99c36981daaba3a86d12908455bab4a8021cf21b45563db48f4adfb477cf41575698a63601156bd9361f40246b4d4547660abfe

Download Submit
C:\Windows\System\HLIXegv.exe

Filesize
1.8MB

MD5
de69bb8b38ef0d1f28f93c3f01ef557d

SHA1
873424066c9bde77c0792987b83290e1b42352b7

SHA256
41784091934598010a34f1635830794a51e28cba2728954a8732f418697259f7

SHA512
5392ef59d8d05b496adcd909d143d560b0331a4e6205dd177a4eb67d1b347c857557683c31694ea7df1a4dae6c7f85b818f2365e106ccf2cdae1d8521a2b7b8b

Download Submit
C:\Windows\System\IEuWfBx.exe

Filesize
1.9MB

MD5
6c56cdbfa830e1cf040fa4e22fdb4950

SHA1
faa6fc032e9624dac2c4df4b23b5d0e9dad698d1

SHA256
eaed18bb1a6755bf5b7f227001e20772ee675fa8c43bc59c914ad8ecb006db6c

SHA512
a7f1b70aaab8b59395f5c91d8826f2ac0829d9116f3ab82e97a8eaccf3a02326ba0cc4d1f17d86f89a6ffb434328eaae27fa3ce866ff0f0326faec75a0b7917f

Download Submit
C:\Windows\System\IpnAEGm.exe

Filesize
1.8MB

MD5
0e6041c31dce30122f62aa7e118bac0f

SHA1
5ebba0e20c11e53c0370013f180fd55f7677bee3

SHA256
79e00b8862809cc4f3bc5084c4c034b9294b7c714b8aa2fe8f67d4aef74e9860

SHA512
737153e75c92fa2bf6b877a1c372583f106a1ddf89a5aa217d7b487c4319338d5b7a00a78aa94b0597b065f267e2e8eb67699ab6628983eb2d42cb6e6b84c663

Download Submit
C:\Windows\System\IsCgDoa.exe

Filesize
1.8MB

MD5
5c910064deacad077ae33a62df6f6bd2

SHA1
dd3c5246d4769bdeac2c9529723ce4990728f692

SHA256
53f75bbd22d1dc5c7aac4fc6d8655e541839e5b7b9462f39d563dfc18f70a6c5

SHA512
8a9ccc96262065b63462168ac8b6737400430af62e9bcdafb6cf2aae7a5ccf48e7803401fbae1a73177b6ff1d99e892beba4b9c0ac0130dd935ec55d27e4e4b9

Download Submit
C:\Windows\System\LxIJNlu.exe

Filesize
1.8MB

MD5
379b74a7ed3667ab0ee40b8948462f5b

SHA1
077d8da57fa0e4bafcc51c43b3a732bafd29cb78

SHA256
3c4dc362dc9b728863b87e8fc0cf67923d2eb377e10e70a267f4440752363c1b

SHA512
dcd892b989158680b9c243eba0c1e0095f942ba2627443c21f57aa18db41ceb139548ada0068f88e8b35b32201f56d4d167a78b35eac29a30fa1dba98c25daa4

Download Submit
C:\Windows\System\MhWbSgw.exe

Filesize
1.8MB

MD5
968e416a6e8e5762a09b9a19ae13ce9b

SHA1
f9a8360147e76fec2bf0369768b200c57bda17f9

SHA256
a3e6a4a3c3dfe77985199d3dd5939cbb2f41205092e94e0a13f1b49b18d63efa

SHA512
6c80e0c9e59943720299b128dbd9bbe1e5a9426226b22da3296549adb6bec31c7916d1ffa8f56bd5f635eedeb2a880dd2d7d5fbb3f62032a7409762baf9a5b5c

Download Submit
C:\Windows\System\NYCRpMM.exe

Filesize
1.9MB

MD5
200bc75fede2bb1c4b64fd54ec36e610

SHA1
03f2d4d6daf54dcaf3545a9c91d153d5fff78da2

SHA256
d6e64772eecfa1e3edfc8b4ea0fd9f30568c4293b47adfcec1736e1f5cefebd5

SHA512
b84b18ba307744464e60cb95104cb7a01f9489586358ab7548f2d8b5f93ff8ae73c08b0f9c36078f819a090a48e2da7cbdd0e199f3aa79962c631d670f1044af

Download Submit
C:\Windows\System\OPgShLh.exe

Filesize
1.8MB

MD5
aa9bb1ad10bef168aded9e7abc5caaa4

SHA1
f4d446f8abcc9660b5c9c1d405b483a63962a6f0

SHA256
fd705ba96b8bbb57d0bbd71b862ff583f0fddc1a6b8a6ce7c4dc7075678bf140

SHA512
87ccd41d4ee50c3c46eb6a59c32e498bf46fb21469894a2684eb8fd32f7d3709254299741cb4b49cf58189c4070f12d02ebc7ca1a48c2f6752e1d4447f2ac6fb

Download Submit
C:\Windows\System\RQJIvUF.exe

Filesize
1.8MB

MD5
e81ec324a2f511f872ad7e3571ae83ec

SHA1
339a7b0705bfa227fb4c458d515006861d186de9

SHA256
f996b258af6a9a99b6bda63074b6d94bc41ab5b15bfe92fac21c2384259c073d

SHA512
16a8aa1f9f1ea13e4c8426c7242ba8720c41dae25f6657a4c993ebb38fadf8e42f860010650cfd4a85a00ebe172ced83e145a744237fe8ad6902ab5e92a47a07

Download Submit
C:\Windows\System\RrkdqcC.exe

Filesize
1.8MB

MD5
e8240e8212d0985b4016796017df2498

SHA1
f6c7287e84fb8c48c0f76f4105fe5b82d29c897e

SHA256
0d56d5b516c1cbd9798dc21952acdb005e86b96e652b9afc00506c4a418b4290

SHA512
f0afeaaeada77f8fcfa14c1492ceeb5f1ca48f3b56a53c7681994791c12dc7621725e3160291711efa316542c1c23d5e3bdbea8e2d1885719634c7c95910e578

Download Submit
C:\Windows\System\SRUoUnQ.exe

Filesize
1.8MB

MD5
7a812003d8b5b7086b1bf7c0456fe7de

SHA1
ec642c5de1628e49ee061ea581c979a0a65faa71

SHA256
0786827333255e208f36977aec430a458a0f03e10948474933cb0856c38f5d2f

SHA512
54351f8a42fb42c51d8caba9a14fecb3876e88c367c5dcda83aff7cde8dbdc9ac3b607a985000d1b715b8cb74d7715c2ec3ee2c311e948ba3f3c6f768e555a09

Download Submit
C:\Windows\System\SZUGYxZ.exe

Filesize
1.9MB

MD5
edf9fd83b8e55584d022328f20e15657

SHA1
e79401d173479ddf25f455904c1bfd2073afc501

SHA256
b09cfe3d1f6a42fc721326b5fad7a5ccc465492e8ad73003436dfeada80c96b9

SHA512
be548d25b91e88f24e6362357ef1411c6d42d04a589a0f4da205379d30db38625b5ed816d4467c9ae8da5fb476665bc573c08a57de76de05bc275f69700fb291

Download Submit
C:\Windows\System\VAGfKqQ.exe

Filesize
1.8MB

MD5
1709ec5b07b03be3b0edc4676fc0e1df

SHA1
7e693e268e5c4002d77f17f92641e93270b76e3d

SHA256
0dd2c14c926cd8e7d24c840552b528ef107ffa3611e1097aa41bb853d978367f

SHA512
ac9428b081cab7be22ea38a7300b049d362c52f66a4ce16e475adad467420ff82bfe3af2b0380f4b151f53d9b693f31b563fc0c762a3278933d5f72522a076c2

Download Submit
C:\Windows\System\VYWizva.exe

Filesize
1.8MB

MD5
9a537ac1afe2df08138c679dace49430

SHA1
addc75c1b358665ccb6cb1405eb9448244331f6f

SHA256
80a960d0d591d59bf0f9db12ddadf92d1c3e82acb33a126c22f5b51260697c06

SHA512
d62ee6c4ae7f304f707892ec9f2a969e5df88d316b611bc7be936c24cbebfba40a1d55064b387b4c57e230e5cf9a6c7dba1c9c97e7852e43563a8aaad5108e3c

Download Submit
C:\Windows\System\WrGuzCk.exe

Filesize
1.8MB

MD5
d381e533d77905de10db3c4f15a2e5bf

SHA1
ae916d1beb69892bcb5280153e7d2c1e0a364247

SHA256
a65d0e337b477731ee990eed2abcccf7ac12f57e300d12fe1abf4c5dafe72aed

SHA512
67958f34367342f185c60f023b74769a8e3c1619485e97a925e0a0b9f8bc8b3a20a29e6093e6664a06031705c46135047bba6aea7517afca190684d7b6130ba8

Download Submit
C:\Windows\System\WxHhcuh.exe

Filesize
1.8MB

MD5
9dfb79b71bd7957c67534f0300fe23a2

SHA1
bf1f50252b554cbb873591dc454df209fbd19393

SHA256
e6e4984160e7bed2183febae7a52080f4a326d1e4cbb2481c8466720396b8ddc

SHA512
cad1a52355ad90ca390006e6b2e7b9af77ae16b452b64857ae483749fa47a91231d492c8e1b22e8fb3ada2da32c2a1211d2d36f048bd0c88115ecfa3e3930ae2

Download Submit
C:\Windows\System\YlBMrdI.exe

Filesize
1.8MB

MD5
c78476c6721d6155ef804e06b231e7df

SHA1
eb0fc6a84ead43436922c6b4be9c0dc80a6013f0

SHA256
f4852516c7d9a2955831c8c12ffb0acbeb5d6784f93393fed2ae3578053995d2

SHA512
411eaf97b2cc19021fc4d292228038e45b7151497bc8f171de1195561d22c476b4319e978d6f070c2bb26e6f60c71010c7f9d85b349ada466e00ad2b18f03f5c

Download Submit
C:\Windows\System\aGgHQZa.exe

Filesize
1.8MB

MD5
5ac1ba492aa8cde0cf03455deab26975

SHA1
3d289782062ce61a4fb947f090adb5469ce7bdc0

SHA256
fe201b79e02c9a23ea5d285f6f66f007c1913abfa7572b5ea37231c55fc09701

SHA512
591a9ce4ad5d1a939adad9d140f9d34492701247649af3c3cf95421506c8a1d9cccab357b6c2beabbf1c4e3fc5289b1714e17f14383ec34115ecb40a0d3cbd93

Download Submit
C:\Windows\System\aSxDslg.exe

Filesize
1.9MB

MD5
2ef7cafaed3162b10b73f8d8c68c3b81

SHA1
898685d6028804ce10288a192858fbc1e7f7e9b7

SHA256
c2abfb94b337915f26dd39d7a1aa744a404c7012d6ba06c0cc9cfbeac3022ebc

SHA512
2c530b19315ba57a09970f7d324af2d62eee7f4f7098ed1d57dcf30f5c17d132dd8978bc17d4f2cf75cac987c67d1011b2f575286cdfe7cfa921c3e0d7b47346

Download Submit
C:\Windows\System\fyXxfYZ.exe

Filesize
1.8MB

MD5
8c9360373933fc8ce608d7e659c2dff6

SHA1
3c344f5a5af32bec71609840c0cfba0b47db5dc9

SHA256
25ea486726aca64eb886b48214888e8d081426babf922f443d8bf41c6922d720

SHA512
7cf681d4b4fb1c33495e9c3691f2b54e259639ebd379bd51c1a608b0c26ce78c31ba73c7956408d9bc6ceefd24db0857803145926ec21770407c8fe556a546aa

Download Submit
C:\Windows\System\gQHnUGy.exe

Filesize
1.8MB

MD5
153ce80e0243bccbf3a1865116bd7be0

SHA1
b4f87ea84abdb3e9f95dc2568863bc692939c82b

SHA256
8424cc1dcf362887337665832df8e38c7488b3ed10d10d7ddf23f3a387993eac

SHA512
7902e75db1a8cc8c47abf83a09543ad3df8250677b14dfc56bc5c48163b33a66cd3d1bc3a7d593e321fc90f2659e47f876f54796d5c0c06eb579e95bf41dfbac

Download Submit
C:\Windows\System\hxiIlfl.exe

Filesize
8B

MD5
0a4d9fd0cc8fe1472d155d5d981ff235

SHA1
137003f778b74f1b96494293112b43e4307e765e

SHA256
4707e767d70e4899759ce8aba6535007a27f8c132e3f3e05b8b8ae03c23dd080

SHA512
ad9c5b802b25d2a28cbec3d4cc246b638fad901bd44704bb559f8a0cf5c0d25f339a2e2fe9f4b8bbba249477fc11b0b14c51d97cfa76d081fb255f90811dd5c7

Download Submit
C:\Windows\System\jQKjmrp.exe

Filesize
1.8MB

MD5
e99a08a160b0956557cc30afb8de3d8b

SHA1
6f2ef2fe1e9d0ee05c56f19ee0e5db3ed1da2e26

SHA256
45f672038541abc1ea4cbdde4076923ea81d7afab88da4c79bb1821b649a3641

SHA512
cc0afbb8312d29c3a71f9053c9e754255d8d4df2244da664cbc147eb1abea11d889a1dd70233dcea232d08be9b962d4544cd54593c5951c0d67a2a59966d0cf5

Download Submit
C:\Windows\System\kzuUpFQ.exe

Filesize
1.9MB

MD5
58d17c20c0bfaa1f9730b979329ff624

SHA1
6812185a99025a593916bf7874c0e185ee666152

SHA256
e58668cceb11531c743dbc99656c1e71118762091ab9c81e0020d607f7989da3

SHA512
1d46bfc67f0c15795834a2791c968aae8a3ec4b6f335ca7c86e84854155cd4beb1284a205eaac591b3906a152af513752f1fb2c25aed45d11982668966421f79

Download Submit
C:\Windows\System\lwGmYOT.exe

Filesize
1.8MB

MD5
f96ca8ae8e4cea0122c2cf79f18db76a

SHA1
dd817f1439e704a481e858a47817a3a7f391993a

SHA256
9086e24af67f59b75d2fc1f4e5a884b4ce6fa7b4f69776390c02b54e8e96e120

SHA512
016745c28b706d18d3da3fa705a03fda859b62c7351ff0c3d93e47a165e368548a69abbe207fef360d962daba9465cd012cffe256715e2a989b3afd203dcebd7

Download Submit
C:\Windows\System\lyWkqmo.exe

Filesize
1.8MB

MD5
3e3399c2dcdbe92d50beca294aba4271

SHA1
2782cf5f85adf2f9f9fde4ad0bcfea1c3209dedc

SHA256
35fcec57c7b04314a509844d7746d1ae1a8c253c1f0e8086fadc4c9772e1fccc

SHA512
cc24f25ea22ec81aaef544aa8ded6c57f543de6dd663f2d18f31f45f5d59054937f56409c941603bbc30475395121e9fe9ac44010b3563162bab82dbbd6d7de1

Download Submit
C:\Windows\System\mqXAzpY.exe

Filesize
1.9MB

MD5
3d0da73e4e989ea247a31159086d725b

SHA1
ccb9d0b9a8653d95140f74d9b46d90cad39494e9

SHA256
b6a3781cc485b3b0a9257a0b275bf0eecdf862ab40bd7ea4370a2723e96a8988

SHA512
739ad2a537850bb71d4616ba06d6e36f79dc2b080623cd0394d3d54513a9d4675ad5d18be99ef37515db3b61171a1b579794756b621624146cc3c436ce66a946

Download Submit
C:\Windows\System\oAozcLO.exe

Filesize
1.8MB

MD5
95faf90f196392c48cda4977128be05e

SHA1
af60d925e90d9b04b711fa189e8f0b28d9f576ea

SHA256
f726dfc47eb5d62c3cad879cd122c0c9b9312bb0773080dc9062d6e31bc3747b

SHA512
440701f89236f3058c8354be04bc9ba194f978310450bc46b5535f9ee14e6933c7493eddee661d3e35f5b193c326d67868705567c9fa2eb3f96e2540c4177035

Download Submit
C:\Windows\System\qgrGdlh.exe

Filesize
1.8MB

MD5
0eb86be08dd786591e5016c26aa3631c

SHA1
c84a70828a012e2bd1db3c06a82a08dc7e8b9181

SHA256
6c77a20e473f3b67d9fe082ad39c6580ff121293da496604aa045d3f4f0350a4

SHA512
b3587fcd619f13dc5fe2bd047aa27813566c1268424978bfa0126c2142e730dfd92f79348c7e874285b5f7be62fc9b750f8b845a25e7671f81bc86bd47df7af1

Download Submit
C:\Windows\System\uboeCKE.exe

Filesize
1.8MB

MD5
e8d5665640787f11ab7bcdd7815ba5cf

SHA1
8046cd2eef1880951177704384504368b25de242

SHA256
2fc164de187ec99dba1afa07680581437260d60912f608a8354fca7d8abe2619

SHA512
f596729a887568d6bb9f5c4d5ab90cb8bb5c994069df091907d53e0260e0292699981d8c8c0b9a8acdcb3430951e58633273516ccf30907a60d7345b3b16e807

Download Submit
C:\Windows\System\ywvxjZJ.exe

Filesize
1.8MB

MD5
516cfb4bd13649965cf296d92766104f

SHA1
53199e01c04cad4ffa1f5cef3db8dd4d19c13f81

SHA256
e1091a96de35e00a399102812ca6004467716f6ea9836b14b51bfe337e303a11

SHA512
fbf89f1316a72c2e9b1d8e8fc360fd06c6993d32db212e4a4f5fb39a04d3f3b10ff7d604e37e7392a5f71b431d5509b8992a551c14cd23589a196840a04b0fd0

Download Submit
C:\Windows\System\zLXMsMi.exe

Filesize
1.8MB

MD5
db10adaaa092370266c0ac6c8d6307ef

SHA1
31a2ff9d2841c8c8568ba87b8fa74ab7fc1d36a4

SHA256
2ffeeaac12382ac6338f8bee7f2fed74a40b83501eabc9f4a47db4de192ea3fb

SHA512
ac8c01c208661850e032798c5d8c3645d166a1d1dcad1a91e43376f1b85c0b652c7012919bf756758aa10f99b0e74f55c1b31d6c278807f691c7ff911cca6873

Download Submit
memory/312-8-0x00007FF671CD0000-0x00007FF6720C2000-memory.dmp

Filesize
3.9MB

Download
memory/392-298-0x00007FF6A7D40000-0x00007FF6A8132000-memory.dmp

Filesize
3.9MB

Download
memory/652-187-0x00000286E9F60000-0x00000286E9F82000-memory.dmp

Filesize
136KB

Download
memory/652-47-0x00007FF986560000-0x00007FF987021000-memory.dmp

Filesize
10.8MB

Download
memory/652-9-0x00000286E9DA0000-0x00000286E9DB0000-memory.dmp

Filesize
64KB

Download
memory/752-50-0x00007FF7358F0000-0x00007FF735CE2000-memory.dmp

Filesize
3.9MB

Download
memory/1304-158-0x00007FF78FEE0000-0x00007FF7902D2000-memory.dmp

Filesize
3.9MB

Download
memory/1912-356-0x00007FF63C2B0000-0x00007FF63C6A2000-memory.dmp

Filesize
3.9MB

Download
memory/2144-388-0x00007FF6BDB50000-0x00007FF6BDF42000-memory.dmp

Filesize
3.9MB

Download
memory/2760-236-0x00007FF681770000-0x00007FF681B62000-memory.dmp

Filesize
3.9MB

Download
memory/2800-212-0x00007FF6EA100000-0x00007FF6EA4F2000-memory.dmp

Filesize
3.9MB

Download
memory/2904-164-0x00007FF69C940000-0x00007FF69CD32000-memory.dmp

Filesize
3.9MB

Download
memory/2996-312-0x00007FF6A7FC0000-0x00007FF6A83B2000-memory.dmp

Filesize
3.9MB

Download
memory/3312-311-0x00007FF616070000-0x00007FF616462000-memory.dmp

Filesize
3.9MB

Download
memory/3560-358-0x00007FF7C7880000-0x00007FF7C7C72000-memory.dmp

Filesize
3.9MB

Download
memory/3844-389-0x00007FF6579A0000-0x00007FF657D92000-memory.dmp

Filesize
3.9MB

Download
memory/3928-351-0x00007FF63B870000-0x00007FF63BC62000-memory.dmp

Filesize
3.9MB

Download
memory/4276-67-0x00007FF6204A0000-0x00007FF620892000-memory.dmp

Filesize
3.9MB

Download
memory/4332-304-0x00007FF638810000-0x00007FF638C02000-memory.dmp

Filesize
3.9MB

Download
memory/4364-99-0x00007FF724180000-0x00007FF724572000-memory.dmp

Filesize
3.9MB

Download
memory/4512-264-0x00007FF6108A0000-0x00007FF610C92000-memory.dmp

Filesize
3.9MB

Download
memory/4692-128-0x00007FF7A6A40000-0x00007FF7A6E32000-memory.dmp

Filesize
3.9MB

Download
memory/5068-255-0x00007FF77AA40000-0x00007FF77AE32000-memory.dmp

Filesize
3.9MB

Download
memory/5076-385-0x00007FF74ADF0000-0x00007FF74B1E2000-memory.dmp

Filesize
3.9MB

Download
memory/5100-1-0x000002C46FBC0000-0x000002C46FBD0000-memory.dmp

Filesize
64KB

Download
memory/5100-0-0x00007FF751F70000-0x00007FF752362000-memory.dmp

Filesize
3.9MB

Download