xmrig | a441bf67e2131f7cce8961084f1a236b1a1209c8980d3783bf6945fe18d6c02a

Analysis

max time kernel
69s
max time network
55s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30-04-2024 04:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
Size

1.9MB
MD5

090ed9728133ec123c17fb688e5e0f5b
SHA1

7110cbccef466701bd9e205747c33811b77ff94e
SHA256

a441bf67e2131f7cce8961084f1a236b1a1209c8980d3783bf6945fe18d6c02a
SHA512

60cb9a69d8dd107f86e6daedfc7f61b3ca323e01d8a21ba0822c230d12d20460897dee47aef4a583858e9bb8d2ccd061a54cc649753fbb8373016c7a81853e4c
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1P:NABK

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 41 IoCs

miner

resource	yara_rule
behavioral2/memory/1040-565-0x00007FF7D0FF0000-0x00007FF7D13E2000-memory.dmp	xmrig
behavioral2/memory/1212-576-0x00007FF6D8FC0000-0x00007FF6D93B2000-memory.dmp	xmrig
behavioral2/memory/2332-575-0x00007FF776730000-0x00007FF776B22000-memory.dmp	xmrig
behavioral2/memory/2448-574-0x00007FF7541F0000-0x00007FF7545E2000-memory.dmp	xmrig
behavioral2/memory/4772-573-0x00007FF79A270000-0x00007FF79A662000-memory.dmp	xmrig
behavioral2/memory/2416-572-0x00007FF647CE0000-0x00007FF6480D2000-memory.dmp	xmrig
behavioral2/memory/4672-571-0x00007FF6A9D50000-0x00007FF6AA142000-memory.dmp	xmrig
behavioral2/memory/4760-570-0x00007FF6B8C80000-0x00007FF6B9072000-memory.dmp	xmrig
behavioral2/memory/4536-569-0x00007FF71E7A0000-0x00007FF71EB92000-memory.dmp	xmrig
behavioral2/memory/4744-568-0x00007FF742510000-0x00007FF742902000-memory.dmp	xmrig
behavioral2/memory/2120-567-0x00007FF7B7900000-0x00007FF7B7CF2000-memory.dmp	xmrig
behavioral2/memory/2612-532-0x00007FF7955F0000-0x00007FF7959E2000-memory.dmp	xmrig
behavioral2/memory/1192-415-0x00007FF7AF190000-0x00007FF7AF582000-memory.dmp	xmrig
behavioral2/memory/5068-413-0x00007FF7207A0000-0x00007FF720B92000-memory.dmp	xmrig
behavioral2/memory/3004-325-0x00007FF68BA10000-0x00007FF68BE02000-memory.dmp	xmrig
behavioral2/memory/2408-277-0x00007FF642A00000-0x00007FF642DF2000-memory.dmp	xmrig
behavioral2/memory/4752-221-0x00007FF68F0E0000-0x00007FF68F4D2000-memory.dmp	xmrig
behavioral2/memory/3476-220-0x00007FF6F3F70000-0x00007FF6F4362000-memory.dmp	xmrig
behavioral2/memory/1088-163-0x00007FF7712D0000-0x00007FF7716C2000-memory.dmp	xmrig
behavioral2/memory/5080-129-0x00007FF63FDB0000-0x00007FF6401A2000-memory.dmp	xmrig
behavioral2/memory/5080-3015-0x00007FF63FDB0000-0x00007FF6401A2000-memory.dmp	xmrig
behavioral2/memory/4752-3017-0x00007FF68F0E0000-0x00007FF68F4D2000-memory.dmp	xmrig
behavioral2/memory/4904-3019-0x00007FF781F70000-0x00007FF782362000-memory.dmp	xmrig
behavioral2/memory/3004-3028-0x00007FF68BA10000-0x00007FF68BE02000-memory.dmp	xmrig
behavioral2/memory/5068-3030-0x00007FF7207A0000-0x00007FF720B92000-memory.dmp	xmrig
behavioral2/memory/2612-3033-0x00007FF7955F0000-0x00007FF7959E2000-memory.dmp	xmrig
behavioral2/memory/4536-3035-0x00007FF71E7A0000-0x00007FF71EB92000-memory.dmp	xmrig
behavioral2/memory/1088-3031-0x00007FF7712D0000-0x00007FF7716C2000-memory.dmp	xmrig
behavioral2/memory/3476-3024-0x00007FF6F3F70000-0x00007FF6F4362000-memory.dmp	xmrig
behavioral2/memory/1212-3023-0x00007FF6D8FC0000-0x00007FF6D93B2000-memory.dmp	xmrig
behavioral2/memory/2408-3025-0x00007FF642A00000-0x00007FF642DF2000-memory.dmp	xmrig
behavioral2/memory/4772-3064-0x00007FF79A270000-0x00007FF79A662000-memory.dmp	xmrig
behavioral2/memory/2332-3055-0x00007FF776730000-0x00007FF776B22000-memory.dmp	xmrig
behavioral2/memory/4760-3065-0x00007FF6B8C80000-0x00007FF6B9072000-memory.dmp	xmrig
behavioral2/memory/4672-3051-0x00007FF6A9D50000-0x00007FF6AA142000-memory.dmp	xmrig
behavioral2/memory/1040-3045-0x00007FF7D0FF0000-0x00007FF7D13E2000-memory.dmp	xmrig
behavioral2/memory/2416-3039-0x00007FF647CE0000-0x00007FF6480D2000-memory.dmp	xmrig
behavioral2/memory/2448-3057-0x00007FF7541F0000-0x00007FF7545E2000-memory.dmp	xmrig
behavioral2/memory/2120-3050-0x00007FF7B7900000-0x00007FF7B7CF2000-memory.dmp	xmrig
behavioral2/memory/4744-3043-0x00007FF742510000-0x00007FF742902000-memory.dmp	xmrig
behavioral2/memory/1192-3038-0x00007FF7AF190000-0x00007FF7AF582000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4904	RuRWwPb.exe
1212	clDRwEC.exe
5080	osCDROX.exe
1088	JOoLhwH.exe
3476	sBXFQnv.exe
4752	aLDlYTm.exe
2408	DNEvHNT.exe
3004	nonCTti.exe
5068	ovbjuqX.exe
1192	yLwrlVo.exe
2612	vkujThB.exe
1040	hOXWbvG.exe
2120	HxcVZpe.exe
4744	qozezUa.exe
4536	jDQLnNg.exe
4760	AkTsCWw.exe
4672	kgFPMrr.exe
2416	RMkcscx.exe
4772	KbvNGiP.exe
2448	WDBLHYT.exe
2332	RKOcIeg.exe
3352	PYUxgtw.exe
4252	phzuFfu.exe
4428	EEZuDnD.exe
4068	JlfFYTe.exe
3960	NIWZuzK.exe
5100	CwvvFLz.exe
4936	miPDGmu.exe
2220	eAnRpyJ.exe
2196	pszZjeO.exe
4504	KRBMIdR.exe
4896	OfFeqXp.exe
656	CuDSzKv.exe
984	yseWQQW.exe
1868	HPHhvOc.exe
4544	sEevKTo.exe
60	rYFrRDL.exe
720	iSldOyz.exe
932	dJkwJRp.exe
3996	yTMhcxR.exe
4336	KwiCsYK.exe
4588	bUgtYTM.exe
1976	lSpEgVJ.exe
1352	CznBawi.exe
4372	jvKCoVi.exe
3440	xINikfk.exe
4964	qnxyGhF.exe
4944	uiEmQBv.exe
2360	ZfmKdmj.exe
396	agHYzjM.exe
5076	HZoZjOl.exe
3008	plZWFJb.exe
4212	KdfOKCj.exe
4980	FcehtBl.exe
2548	atsEwMw.exe
3800	vcDAWlF.exe
3192	vtxkZRA.exe
3656	EyBZmBF.exe
3028	aDcXHQw.exe
4520	EnxkqMV.exe
4332	JLLocOe.exe
4328	OXgVnbg.exe
2828	OAtAVAb.exe
1400	fVTPKUp.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3412-0-0x00007FF61B9F0000-0x00007FF61BDE2000-memory.dmp	upx
behavioral2/files/0x000a000000023b84-22.dat	upx
behavioral2/files/0x000a000000023b8d-65.dat	upx
behavioral2/files/0x000a000000023b94-102.dat	upx
behavioral2/files/0x000a000000023b8c-171.dat	upx
behavioral2/memory/1040-565-0x00007FF7D0FF0000-0x00007FF7D13E2000-memory.dmp	upx
behavioral2/memory/1212-576-0x00007FF6D8FC0000-0x00007FF6D93B2000-memory.dmp	upx
behavioral2/memory/2332-575-0x00007FF776730000-0x00007FF776B22000-memory.dmp	upx
behavioral2/memory/2448-574-0x00007FF7541F0000-0x00007FF7545E2000-memory.dmp	upx
behavioral2/memory/4772-573-0x00007FF79A270000-0x00007FF79A662000-memory.dmp	upx
behavioral2/memory/2416-572-0x00007FF647CE0000-0x00007FF6480D2000-memory.dmp	upx
behavioral2/memory/4672-571-0x00007FF6A9D50000-0x00007FF6AA142000-memory.dmp	upx
behavioral2/memory/4760-570-0x00007FF6B8C80000-0x00007FF6B9072000-memory.dmp	upx
behavioral2/memory/4536-569-0x00007FF71E7A0000-0x00007FF71EB92000-memory.dmp	upx
behavioral2/memory/4744-568-0x00007FF742510000-0x00007FF742902000-memory.dmp	upx
behavioral2/memory/2120-567-0x00007FF7B7900000-0x00007FF7B7CF2000-memory.dmp	upx
behavioral2/memory/2612-532-0x00007FF7955F0000-0x00007FF7959E2000-memory.dmp	upx
behavioral2/memory/1192-415-0x00007FF7AF190000-0x00007FF7AF582000-memory.dmp	upx
behavioral2/memory/5068-413-0x00007FF7207A0000-0x00007FF720B92000-memory.dmp	upx
behavioral2/memory/3004-325-0x00007FF68BA10000-0x00007FF68BE02000-memory.dmp	upx
behavioral2/memory/2408-277-0x00007FF642A00000-0x00007FF642DF2000-memory.dmp	upx
behavioral2/memory/4752-221-0x00007FF68F0E0000-0x00007FF68F4D2000-memory.dmp	upx
behavioral2/memory/3476-220-0x00007FF6F3F70000-0x00007FF6F4362000-memory.dmp	upx
behavioral2/files/0x000a000000023ba7-187.dat	upx
behavioral2/files/0x000a000000023ba6-185.dat	upx
behavioral2/files/0x000a000000023b95-184.dat	upx
behavioral2/files/0x000a000000023b9c-177.dat	upx
behavioral2/files/0x000a000000023b93-166.dat	upx
behavioral2/memory/1088-163-0x00007FF7712D0000-0x00007FF7716C2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba5-162.dat	upx
behavioral2/files/0x000a000000023ba4-161.dat	upx
behavioral2/files/0x000a000000023ba3-160.dat	upx
behavioral2/files/0x000a000000023ba2-159.dat	upx
behavioral2/files/0x000a000000023b99-115.dat	upx
behavioral2/files/0x000a000000023ba1-158.dat	upx
behavioral2/files/0x000a000000023b8a-154.dat	upx
behavioral2/files/0x000a000000023b91-153.dat	upx
behavioral2/files/0x000a000000023ba0-152.dat	upx
behavioral2/files/0x000a000000023b9f-151.dat	upx
behavioral2/files/0x000a000000023b97-143.dat	upx
behavioral2/files/0x000a000000023b8e-193.dat	upx
behavioral2/files/0x000a000000023b9d-135.dat	upx
behavioral2/memory/5080-129-0x00007FF63FDB0000-0x00007FF6401A2000-memory.dmp	upx
behavioral2/files/0x000a000000023b9b-124.dat	upx
behavioral2/files/0x000a000000023b9a-117.dat	upx
behavioral2/files/0x000a000000023b98-114.dat	upx
behavioral2/files/0x000a000000023b90-108.dat	upx
behavioral2/files/0x000a000000023b9e-148.dat	upx
behavioral2/files/0x000a000000023b96-104.dat	upx
behavioral2/files/0x000a000000023b8f-142.dat	upx
behavioral2/files/0x000a000000023b8b-95.dat	upx
behavioral2/files/0x000a000000023b89-85.dat	upx
behavioral2/files/0x000a000000023b92-84.dat	upx
behavioral2/files/0x000a000000023b82-73.dat	upx
behavioral2/files/0x000a000000023b85-53.dat	upx
behavioral2/files/0x000a000000023b88-48.dat	upx
behavioral2/files/0x000a000000023b87-61.dat	upx
behavioral2/files/0x000b000000023b7e-31.dat	upx
behavioral2/files/0x000a000000023b86-27.dat	upx
behavioral2/files/0x000a000000023b83-20.dat	upx
behavioral2/memory/4904-15-0x00007FF781F70000-0x00007FF782362000-memory.dmp	upx
behavioral2/memory/5080-3015-0x00007FF63FDB0000-0x00007FF6401A2000-memory.dmp	upx
behavioral2/memory/4752-3017-0x00007FF68F0E0000-0x00007FF68F4D2000-memory.dmp	upx
behavioral2/memory/4904-3019-0x00007FF781F70000-0x00007FF782362000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\KUoMwrN.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\nNujMPq.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\ynyBuvJ.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\xQyEhCy.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\xkLamiU.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\nAIpBeQ.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\iocGuMy.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\dqMnkYM.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\PwWRPWf.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\hLeuppo.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\cMRlyBT.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\afLzTYf.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\rFwjmDk.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\ZHybwvW.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\PrTkQuQ.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\AfvqCzg.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\xgQChfB.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\VxOyMkh.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\KYdGmNO.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\tKzUZkd.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\aXbSxpD.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\EMkdqBI.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\HBhuGTB.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\IXfdIdq.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\hDRhric.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\YOFtSYb.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\nytIqFx.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\ezZBgCA.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\AkjFwXo.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\zVXLzoD.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\kmbwWSQ.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\nogntpV.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\tZrWDZC.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\mmNeCeU.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\qnUnkQH.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\dJkwJRp.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\JtYMhwF.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\tJGQQJl.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\GdDGptF.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\IdZFJyF.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\KPrHCyy.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\ypaNUPa.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\cfFnrZv.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\EJwpKIN.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\aZJcvKN.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\AMJmRJS.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\NyTUpLL.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\IFZWVcm.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\AkOpQSC.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\zThZtrp.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\cgFtkAT.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\lBsteJg.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\qRDfCvz.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\ckOWNOO.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\rlBNSXU.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\kuTyoUa.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\IaTRFrO.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\pvukvyW.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\mRtLICT.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\qCdNzJB.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\McDaasm.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\hOpXRyW.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\dxWRGIS.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\vFgIwCC.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4952	powershell.exe
Token: SeLockMemoryPrivilege	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 4952	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	84
PID 3412 wrote to memory of 4952	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	84
PID 3412 wrote to memory of 4904	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	85
PID 3412 wrote to memory of 4904	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	85
PID 3412 wrote to memory of 1212	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	86
PID 3412 wrote to memory of 1212	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	86
PID 3412 wrote to memory of 5080	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	87
PID 3412 wrote to memory of 5080	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	87
PID 3412 wrote to memory of 1088	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	88
PID 3412 wrote to memory of 1088	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	88
PID 3412 wrote to memory of 3476	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	89
PID 3412 wrote to memory of 3476	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	89
PID 3412 wrote to memory of 4752	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	90
PID 3412 wrote to memory of 4752	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	90
PID 3412 wrote to memory of 2408	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	91
PID 3412 wrote to memory of 2408	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	91
PID 3412 wrote to memory of 3004	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	92
PID 3412 wrote to memory of 3004	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	92
PID 3412 wrote to memory of 5068	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	93
PID 3412 wrote to memory of 5068	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	93
PID 3412 wrote to memory of 1192	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	94
PID 3412 wrote to memory of 1192	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	94
PID 3412 wrote to memory of 2612	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	95
PID 3412 wrote to memory of 2612	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	95
PID 3412 wrote to memory of 4772	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	96
PID 3412 wrote to memory of 4772	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	96
PID 3412 wrote to memory of 1040	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	97
PID 3412 wrote to memory of 1040	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	97
PID 3412 wrote to memory of 2120	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	98
PID 3412 wrote to memory of 2120	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	98
PID 3412 wrote to memory of 4744	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	99
PID 3412 wrote to memory of 4744	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	99
PID 3412 wrote to memory of 4536	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	100
PID 3412 wrote to memory of 4536	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	100
PID 3412 wrote to memory of 4760	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	101
PID 3412 wrote to memory of 4760	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	101
PID 3412 wrote to memory of 4672	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	102
PID 3412 wrote to memory of 4672	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	102
PID 3412 wrote to memory of 2416	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	103
PID 3412 wrote to memory of 2416	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	103
PID 3412 wrote to memory of 2448	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	104
PID 3412 wrote to memory of 2448	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	104
PID 3412 wrote to memory of 2332	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	105
PID 3412 wrote to memory of 2332	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	105
PID 3412 wrote to memory of 3352	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	106
PID 3412 wrote to memory of 3352	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	106
PID 3412 wrote to memory of 4252	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	107
PID 3412 wrote to memory of 4252	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	107
PID 3412 wrote to memory of 4428	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	108
PID 3412 wrote to memory of 4428	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	108
PID 3412 wrote to memory of 4068	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	109
PID 3412 wrote to memory of 4068	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	109
PID 3412 wrote to memory of 3960	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	110
PID 3412 wrote to memory of 3960	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	110
PID 3412 wrote to memory of 5100	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	111
PID 3412 wrote to memory of 5100	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	111
PID 3412 wrote to memory of 4936	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	112
PID 3412 wrote to memory of 4936	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	112
PID 3412 wrote to memory of 2220	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	113
PID 3412 wrote to memory of 2220	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	113
PID 3412 wrote to memory of 2196	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	114
PID 3412 wrote to memory of 2196	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	114
PID 3412 wrote to memory of 4504	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	115
PID 3412 wrote to memory of 4504	3412	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4952
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4952" "2496" "2420" "2500" "0" "0" "2504" "0" "0" "0" "0" "0"
    3⤵
    PID:13968
- C:\Windows\System\RuRWwPb.exe
  C:\Windows\System\RuRWwPb.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\clDRwEC.exe
  C:\Windows\System\clDRwEC.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\osCDROX.exe
  C:\Windows\System\osCDROX.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\JOoLhwH.exe
  C:\Windows\System\JOoLhwH.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\sBXFQnv.exe
  C:\Windows\System\sBXFQnv.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\aLDlYTm.exe
  C:\Windows\System\aLDlYTm.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\DNEvHNT.exe
  C:\Windows\System\DNEvHNT.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\nonCTti.exe
  C:\Windows\System\nonCTti.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\ovbjuqX.exe
  C:\Windows\System\ovbjuqX.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\yLwrlVo.exe
  C:\Windows\System\yLwrlVo.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\vkujThB.exe
  C:\Windows\System\vkujThB.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\KbvNGiP.exe
  C:\Windows\System\KbvNGiP.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\hOXWbvG.exe
  C:\Windows\System\hOXWbvG.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\HxcVZpe.exe
  C:\Windows\System\HxcVZpe.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\qozezUa.exe
  C:\Windows\System\qozezUa.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\jDQLnNg.exe
  C:\Windows\System\jDQLnNg.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\AkTsCWw.exe
  C:\Windows\System\AkTsCWw.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\kgFPMrr.exe
  C:\Windows\System\kgFPMrr.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\RMkcscx.exe
  C:\Windows\System\RMkcscx.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\WDBLHYT.exe
  C:\Windows\System\WDBLHYT.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\RKOcIeg.exe
  C:\Windows\System\RKOcIeg.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\PYUxgtw.exe
  C:\Windows\System\PYUxgtw.exe
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Windows\System\phzuFfu.exe
  C:\Windows\System\phzuFfu.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\EEZuDnD.exe
  C:\Windows\System\EEZuDnD.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\JlfFYTe.exe
  C:\Windows\System\JlfFYTe.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\NIWZuzK.exe
  C:\Windows\System\NIWZuzK.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\CwvvFLz.exe
  C:\Windows\System\CwvvFLz.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\miPDGmu.exe
  C:\Windows\System\miPDGmu.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\eAnRpyJ.exe
  C:\Windows\System\eAnRpyJ.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\pszZjeO.exe
  C:\Windows\System\pszZjeO.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\KRBMIdR.exe
  C:\Windows\System\KRBMIdR.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\OfFeqXp.exe
  C:\Windows\System\OfFeqXp.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\CuDSzKv.exe
  C:\Windows\System\CuDSzKv.exe
  2⤵
  - Executes dropped EXE
  PID:656
- C:\Windows\System\yseWQQW.exe
  C:\Windows\System\yseWQQW.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\HPHhvOc.exe
  C:\Windows\System\HPHhvOc.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\sEevKTo.exe
  C:\Windows\System\sEevKTo.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\rYFrRDL.exe
  C:\Windows\System\rYFrRDL.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\iSldOyz.exe
  C:\Windows\System\iSldOyz.exe
  2⤵
  - Executes dropped EXE
  PID:720
- C:\Windows\System\dJkwJRp.exe
  C:\Windows\System\dJkwJRp.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\yTMhcxR.exe
  C:\Windows\System\yTMhcxR.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\KwiCsYK.exe
  C:\Windows\System\KwiCsYK.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\bUgtYTM.exe
  C:\Windows\System\bUgtYTM.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\lSpEgVJ.exe
  C:\Windows\System\lSpEgVJ.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\CznBawi.exe
  C:\Windows\System\CznBawi.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\jvKCoVi.exe
  C:\Windows\System\jvKCoVi.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\xINikfk.exe
  C:\Windows\System\xINikfk.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\qnxyGhF.exe
  C:\Windows\System\qnxyGhF.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\uiEmQBv.exe
  C:\Windows\System\uiEmQBv.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\ZfmKdmj.exe
  C:\Windows\System\ZfmKdmj.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\agHYzjM.exe
  C:\Windows\System\agHYzjM.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\HZoZjOl.exe
  C:\Windows\System\HZoZjOl.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\plZWFJb.exe
  C:\Windows\System\plZWFJb.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\Afshziu.exe
  C:\Windows\System\Afshziu.exe
  2⤵
  PID:3392
- C:\Windows\System\KdfOKCj.exe
  C:\Windows\System\KdfOKCj.exe
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Windows\System\FcehtBl.exe
  C:\Windows\System\FcehtBl.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\atsEwMw.exe
  C:\Windows\System\atsEwMw.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\vcDAWlF.exe
  C:\Windows\System\vcDAWlF.exe
  2⤵
  - Executes dropped EXE
  PID:3800
- C:\Windows\System\vtxkZRA.exe
  C:\Windows\System\vtxkZRA.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\EyBZmBF.exe
  C:\Windows\System\EyBZmBF.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\aDcXHQw.exe
  C:\Windows\System\aDcXHQw.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\EnxkqMV.exe
  C:\Windows\System\EnxkqMV.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\JLLocOe.exe
  C:\Windows\System\JLLocOe.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\OXgVnbg.exe
  C:\Windows\System\OXgVnbg.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\OAtAVAb.exe
  C:\Windows\System\OAtAVAb.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\fVTPKUp.exe
  C:\Windows\System\fVTPKUp.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\giILLmY.exe
  C:\Windows\System\giILLmY.exe
  2⤵
  PID:3536
- C:\Windows\System\ZGbRNpV.exe
  C:\Windows\System\ZGbRNpV.exe
  2⤵
  PID:3872
- C:\Windows\System\WwPvsSL.exe
  C:\Windows\System\WwPvsSL.exe
  2⤵
  PID:4240
- C:\Windows\System\xzoTaJC.exe
  C:\Windows\System\xzoTaJC.exe
  2⤵
  PID:376
- C:\Windows\System\FmTEYez.exe
  C:\Windows\System\FmTEYez.exe
  2⤵
  PID:3728
- C:\Windows\System\FeJPaUs.exe
  C:\Windows\System\FeJPaUs.exe
  2⤵
  PID:2004
- C:\Windows\System\PwWRPWf.exe
  C:\Windows\System\PwWRPWf.exe
  2⤵
  PID:1020
- C:\Windows\System\UVAlgeK.exe
  C:\Windows\System\UVAlgeK.exe
  2⤵
  PID:1800
- C:\Windows\System\eWLrbxR.exe
  C:\Windows\System\eWLrbxR.exe
  2⤵
  PID:3116
- C:\Windows\System\hLeuppo.exe
  C:\Windows\System\hLeuppo.exe
  2⤵
  PID:804
- C:\Windows\System\osFtJFy.exe
  C:\Windows\System\osFtJFy.exe
  2⤵
  PID:3532
- C:\Windows\System\lBsteJg.exe
  C:\Windows\System\lBsteJg.exe
  2⤵
  PID:992
- C:\Windows\System\cyCknxa.exe
  C:\Windows\System\cyCknxa.exe
  2⤵
  PID:368
- C:\Windows\System\VTFQTQi.exe
  C:\Windows\System\VTFQTQi.exe
  2⤵
  PID:3336
- C:\Windows\System\WeYFHtX.exe
  C:\Windows\System\WeYFHtX.exe
  2⤵
  PID:3560
- C:\Windows\System\PdFKBlG.exe
  C:\Windows\System\PdFKBlG.exe
  2⤵
  PID:3372
- C:\Windows\System\FHvtYpW.exe
  C:\Windows\System\FHvtYpW.exe
  2⤵
  PID:1428
- C:\Windows\System\IFnrAAy.exe
  C:\Windows\System\IFnrAAy.exe
  2⤵
  PID:4932
- C:\Windows\System\SCpLRhd.exe
  C:\Windows\System\SCpLRhd.exe
  2⤵
  PID:1216
- C:\Windows\System\ZcuJrqG.exe
  C:\Windows\System\ZcuJrqG.exe
  2⤵
  PID:5136
- C:\Windows\System\KqsVSNg.exe
  C:\Windows\System\KqsVSNg.exe
  2⤵
  PID:5156
- C:\Windows\System\RCtAqUh.exe
  C:\Windows\System\RCtAqUh.exe
  2⤵
  PID:5176
- C:\Windows\System\JtYMhwF.exe
  C:\Windows\System\JtYMhwF.exe
  2⤵
  PID:5192
- C:\Windows\System\kjdFTVu.exe
  C:\Windows\System\kjdFTVu.exe
  2⤵
  PID:5216
- C:\Windows\System\DBxBLUl.exe
  C:\Windows\System\DBxBLUl.exe
  2⤵
  PID:5240
- C:\Windows\System\qqAWdkA.exe
  C:\Windows\System\qqAWdkA.exe
  2⤵
  PID:5256
- C:\Windows\System\SnKBMTm.exe
  C:\Windows\System\SnKBMTm.exe
  2⤵
  PID:5284
- C:\Windows\System\nURfxQv.exe
  C:\Windows\System\nURfxQv.exe
  2⤵
  PID:5308
- C:\Windows\System\PypZLgI.exe
  C:\Windows\System\PypZLgI.exe
  2⤵
  PID:5324
- C:\Windows\System\KvyTNtC.exe
  C:\Windows\System\KvyTNtC.exe
  2⤵
  PID:5356
- C:\Windows\System\VXPvWqM.exe
  C:\Windows\System\VXPvWqM.exe
  2⤵
  PID:5372
- C:\Windows\System\PhygdYb.exe
  C:\Windows\System\PhygdYb.exe
  2⤵
  PID:5400
- C:\Windows\System\LqKezcL.exe
  C:\Windows\System\LqKezcL.exe
  2⤵
  PID:5428
- C:\Windows\System\rdGsMfq.exe
  C:\Windows\System\rdGsMfq.exe
  2⤵
  PID:5448
- C:\Windows\System\cGSANBK.exe
  C:\Windows\System\cGSANBK.exe
  2⤵
  PID:5464
- C:\Windows\System\qRmpmMz.exe
  C:\Windows\System\qRmpmMz.exe
  2⤵
  PID:5484
- C:\Windows\System\HwfYeSm.exe
  C:\Windows\System\HwfYeSm.exe
  2⤵
  PID:5512
- C:\Windows\System\AYAueWe.exe
  C:\Windows\System\AYAueWe.exe
  2⤵
  PID:5548
- C:\Windows\System\aXBZJQW.exe
  C:\Windows\System\aXBZJQW.exe
  2⤵
  PID:5568
- C:\Windows\System\vsmRkua.exe
  C:\Windows\System\vsmRkua.exe
  2⤵
  PID:5588
- C:\Windows\System\NyTUpLL.exe
  C:\Windows\System\NyTUpLL.exe
  2⤵
  PID:5628
- C:\Windows\System\AksCZEu.exe
  C:\Windows\System\AksCZEu.exe
  2⤵
  PID:5648
- C:\Windows\System\xWFQgiZ.exe
  C:\Windows\System\xWFQgiZ.exe
  2⤵
  PID:5664
- C:\Windows\System\HbuyncT.exe
  C:\Windows\System\HbuyncT.exe
  2⤵
  PID:5684
- C:\Windows\System\TDaXENp.exe
  C:\Windows\System\TDaXENp.exe
  2⤵
  PID:5708
- C:\Windows\System\wKlQmJT.exe
  C:\Windows\System\wKlQmJT.exe
  2⤵
  PID:5724
- C:\Windows\System\OwjrTRY.exe
  C:\Windows\System\OwjrTRY.exe
  2⤵
  PID:5748
- C:\Windows\System\CQdsQav.exe
  C:\Windows\System\CQdsQav.exe
  2⤵
  PID:5764
- C:\Windows\System\HvMigvC.exe
  C:\Windows\System\HvMigvC.exe
  2⤵
  PID:5788
- C:\Windows\System\fHeuIUR.exe
  C:\Windows\System\fHeuIUR.exe
  2⤵
  PID:5804
- C:\Windows\System\MMGOPjg.exe
  C:\Windows\System\MMGOPjg.exe
  2⤵
  PID:5820
- C:\Windows\System\DvcFoSq.exe
  C:\Windows\System\DvcFoSq.exe
  2⤵
  PID:5844
- C:\Windows\System\oHxrfSD.exe
  C:\Windows\System\oHxrfSD.exe
  2⤵
  PID:5864
- C:\Windows\System\eTvRwow.exe
  C:\Windows\System\eTvRwow.exe
  2⤵
  PID:5880
- C:\Windows\System\XWKTLXB.exe
  C:\Windows\System\XWKTLXB.exe
  2⤵
  PID:5908
- C:\Windows\System\ebsWDNC.exe
  C:\Windows\System\ebsWDNC.exe
  2⤵
  PID:5932
- C:\Windows\System\DdRoExx.exe
  C:\Windows\System\DdRoExx.exe
  2⤵
  PID:5952
- C:\Windows\System\RbyjxiP.exe
  C:\Windows\System\RbyjxiP.exe
  2⤵
  PID:5980
- C:\Windows\System\GxfwqEw.exe
  C:\Windows\System\GxfwqEw.exe
  2⤵
  PID:5996
- C:\Windows\System\NLhrurT.exe
  C:\Windows\System\NLhrurT.exe
  2⤵
  PID:6024
- C:\Windows\System\YFleefI.exe
  C:\Windows\System\YFleefI.exe
  2⤵
  PID:6048
- C:\Windows\System\lQPIoQa.exe
  C:\Windows\System\lQPIoQa.exe
  2⤵
  PID:6068
- C:\Windows\System\GuQnvXs.exe
  C:\Windows\System\GuQnvXs.exe
  2⤵
  PID:6100
- C:\Windows\System\uakogzU.exe
  C:\Windows\System\uakogzU.exe
  2⤵
  PID:6116
- C:\Windows\System\FNrTUUR.exe
  C:\Windows\System\FNrTUUR.exe
  2⤵
  PID:6136
- C:\Windows\System\VpsVkHC.exe
  C:\Windows\System\VpsVkHC.exe
  2⤵
  PID:2976
- C:\Windows\System\eqjcDZV.exe
  C:\Windows\System\eqjcDZV.exe
  2⤵
  PID:2160
- C:\Windows\System\NuZwmpn.exe
  C:\Windows\System\NuZwmpn.exe
  2⤵
  PID:3784
- C:\Windows\System\xMBMceA.exe
  C:\Windows\System\xMBMceA.exe
  2⤵
  PID:3436
- C:\Windows\System\ZjVrlYu.exe
  C:\Windows\System\ZjVrlYu.exe
  2⤵
  PID:3916
- C:\Windows\System\DMdSGLf.exe
  C:\Windows\System\DMdSGLf.exe
  2⤵
  PID:668
- C:\Windows\System\fpkjdLx.exe
  C:\Windows\System\fpkjdLx.exe
  2⤵
  PID:920
- C:\Windows\System\GzOBswl.exe
  C:\Windows\System\GzOBswl.exe
  2⤵
  PID:1828
- C:\Windows\System\moFHgkq.exe
  C:\Windows\System\moFHgkq.exe
  2⤵
  PID:5096
- C:\Windows\System\ckOWNOO.exe
  C:\Windows\System\ckOWNOO.exe
  2⤵
  PID:1584
- C:\Windows\System\NNzCeZJ.exe
  C:\Windows\System\NNzCeZJ.exe
  2⤵
  PID:5476
- C:\Windows\System\qTSKJTL.exe
  C:\Windows\System\qTSKJTL.exe
  2⤵
  PID:4476
- C:\Windows\System\ipBWHUe.exe
  C:\Windows\System\ipBWHUe.exe
  2⤵
  PID:5132
- C:\Windows\System\IXfdIdq.exe
  C:\Windows\System\IXfdIdq.exe
  2⤵
  PID:6148
- C:\Windows\System\rWSBYxx.exe
  C:\Windows\System\rWSBYxx.exe
  2⤵
  PID:6164
- C:\Windows\System\ruOUyGs.exe
  C:\Windows\System\ruOUyGs.exe
  2⤵
  PID:6188
- C:\Windows\System\wnOxWga.exe
  C:\Windows\System\wnOxWga.exe
  2⤵
  PID:6216
- C:\Windows\System\bpUHjfR.exe
  C:\Windows\System\bpUHjfR.exe
  2⤵
  PID:6232
- C:\Windows\System\qwitHln.exe
  C:\Windows\System\qwitHln.exe
  2⤵
  PID:6256
- C:\Windows\System\rzSyCei.exe
  C:\Windows\System\rzSyCei.exe
  2⤵
  PID:6272
- C:\Windows\System\yLqeDKA.exe
  C:\Windows\System\yLqeDKA.exe
  2⤵
  PID:6292
- C:\Windows\System\lTHNRFN.exe
  C:\Windows\System\lTHNRFN.exe
  2⤵
  PID:6312
- C:\Windows\System\cMRlyBT.exe
  C:\Windows\System\cMRlyBT.exe
  2⤵
  PID:6336
- C:\Windows\System\NASMRAn.exe
  C:\Windows\System\NASMRAn.exe
  2⤵
  PID:6360
- C:\Windows\System\JZlATfr.exe
  C:\Windows\System\JZlATfr.exe
  2⤵
  PID:6392
- C:\Windows\System\PrzoOub.exe
  C:\Windows\System\PrzoOub.exe
  2⤵
  PID:6444
- C:\Windows\System\MNXEiAh.exe
  C:\Windows\System\MNXEiAh.exe
  2⤵
  PID:6476
- C:\Windows\System\DyKyDsy.exe
  C:\Windows\System\DyKyDsy.exe
  2⤵
  PID:6492
- C:\Windows\System\PsTyOTO.exe
  C:\Windows\System\PsTyOTO.exe
  2⤵
  PID:6520
- C:\Windows\System\DomlkBG.exe
  C:\Windows\System\DomlkBG.exe
  2⤵
  PID:6548
- C:\Windows\System\hSFdPrU.exe
  C:\Windows\System\hSFdPrU.exe
  2⤵
  PID:6564
- C:\Windows\System\rgbXhzT.exe
  C:\Windows\System\rgbXhzT.exe
  2⤵
  PID:6588
- C:\Windows\System\sxatPii.exe
  C:\Windows\System\sxatPii.exe
  2⤵
  PID:6604
- C:\Windows\System\HPIJghO.exe
  C:\Windows\System\HPIJghO.exe
  2⤵
  PID:6628
- C:\Windows\System\gDfVhUx.exe
  C:\Windows\System\gDfVhUx.exe
  2⤵
  PID:6648
- C:\Windows\System\zuPLqKV.exe
  C:\Windows\System\zuPLqKV.exe
  2⤵
  PID:6668
- C:\Windows\System\xzgUCNI.exe
  C:\Windows\System\xzgUCNI.exe
  2⤵
  PID:6684
- C:\Windows\System\FUPzkyB.exe
  C:\Windows\System\FUPzkyB.exe
  2⤵
  PID:6708
- C:\Windows\System\fqJtLKJ.exe
  C:\Windows\System\fqJtLKJ.exe
  2⤵
  PID:6724
- C:\Windows\System\nuitoyk.exe
  C:\Windows\System\nuitoyk.exe
  2⤵
  PID:6748
- C:\Windows\System\vMZKTGp.exe
  C:\Windows\System\vMZKTGp.exe
  2⤵
  PID:6780
- C:\Windows\System\FMpydlp.exe
  C:\Windows\System\FMpydlp.exe
  2⤵
  PID:6796
- C:\Windows\System\rzfYUab.exe
  C:\Windows\System\rzfYUab.exe
  2⤵
  PID:6812
- C:\Windows\System\itSTcZS.exe
  C:\Windows\System\itSTcZS.exe
  2⤵
  PID:6832
- C:\Windows\System\svrGWee.exe
  C:\Windows\System\svrGWee.exe
  2⤵
  PID:6852
- C:\Windows\System\OTkunAE.exe
  C:\Windows\System\OTkunAE.exe
  2⤵
  PID:6872
- C:\Windows\System\lUbfzec.exe
  C:\Windows\System\lUbfzec.exe
  2⤵
  PID:6892
- C:\Windows\System\cYNvjSX.exe
  C:\Windows\System\cYNvjSX.exe
  2⤵
  PID:6916
- C:\Windows\System\qaUtihc.exe
  C:\Windows\System\qaUtihc.exe
  2⤵
  PID:6936
- C:\Windows\System\UyWOEhK.exe
  C:\Windows\System\UyWOEhK.exe
  2⤵
  PID:6956
- C:\Windows\System\NdNIUYY.exe
  C:\Windows\System\NdNIUYY.exe
  2⤵
  PID:6972
- C:\Windows\System\ojMHEQq.exe
  C:\Windows\System\ojMHEQq.exe
  2⤵
  PID:7000
- C:\Windows\System\MFwBfuU.exe
  C:\Windows\System\MFwBfuU.exe
  2⤵
  PID:7024
- C:\Windows\System\DMEJkZx.exe
  C:\Windows\System\DMEJkZx.exe
  2⤵
  PID:7044
- C:\Windows\System\XtPTInL.exe
  C:\Windows\System\XtPTInL.exe
  2⤵
  PID:7076
- C:\Windows\System\mjlhKFM.exe
  C:\Windows\System\mjlhKFM.exe
  2⤵
  PID:7100
- C:\Windows\System\uknQqJc.exe
  C:\Windows\System\uknQqJc.exe
  2⤵
  PID:7124
- C:\Windows\System\IXoVGup.exe
  C:\Windows\System\IXoVGup.exe
  2⤵
  PID:7144
- C:\Windows\System\elmpsRo.exe
  C:\Windows\System\elmpsRo.exe
  2⤵
  PID:7160
- C:\Windows\System\YPJhLFP.exe
  C:\Windows\System\YPJhLFP.exe
  2⤵
  PID:5732
- C:\Windows\System\BZFUxHC.exe
  C:\Windows\System\BZFUxHC.exe
  2⤵
  PID:5796
- C:\Windows\System\apTNABr.exe
  C:\Windows\System\apTNABr.exe
  2⤵
  PID:4684
- C:\Windows\System\PbMOijE.exe
  C:\Windows\System\PbMOijE.exe
  2⤵
  PID:5904
- C:\Windows\System\JwOxSYZ.exe
  C:\Windows\System\JwOxSYZ.exe
  2⤵
  PID:5988
- C:\Windows\System\qlCTzAa.exe
  C:\Windows\System\qlCTzAa.exe
  2⤵
  PID:6040
- C:\Windows\System\bzzZZdi.exe
  C:\Windows\System\bzzZZdi.exe
  2⤵
  PID:6076
- C:\Windows\System\aCbbMtT.exe
  C:\Windows\System\aCbbMtT.exe
  2⤵
  PID:1248
- C:\Windows\System\nSbfQjm.exe
  C:\Windows\System\nSbfQjm.exe
  2⤵
  PID:4364
- C:\Windows\System\nTUzzJx.exe
  C:\Windows\System\nTUzzJx.exe
  2⤵
  PID:6716
- C:\Windows\System\yCJVWbh.exe
  C:\Windows\System\yCJVWbh.exe
  2⤵
  PID:6756
- C:\Windows\System\nayhaBy.exe
  C:\Windows\System\nayhaBy.exe
  2⤵
  PID:6808
- C:\Windows\System\xpCpRvE.exe
  C:\Windows\System\xpCpRvE.exe
  2⤵
  PID:6860
- C:\Windows\System\HCCSdyi.exe
  C:\Windows\System\HCCSdyi.exe
  2⤵
  PID:6908
- C:\Windows\System\tghSYoG.exe
  C:\Windows\System\tghSYoG.exe
  2⤵
  PID:6964
- C:\Windows\System\ZmaBPZA.exe
  C:\Windows\System\ZmaBPZA.exe
  2⤵
  PID:7008
- C:\Windows\System\qCdNzJB.exe
  C:\Windows\System\qCdNzJB.exe
  2⤵
  PID:7064
- C:\Windows\System\YCdgzKI.exe
  C:\Windows\System\YCdgzKI.exe
  2⤵
  PID:7136
- C:\Windows\System\adcHzsf.exe
  C:\Windows\System\adcHzsf.exe
  2⤵
  PID:2508
- C:\Windows\System\QaNHzCF.exe
  C:\Windows\System\QaNHzCF.exe
  2⤵
  PID:1632
- C:\Windows\System\wPpCums.exe
  C:\Windows\System\wPpCums.exe
  2⤵
  PID:6004
- C:\Windows\System\fvSVpWM.exe
  C:\Windows\System\fvSVpWM.exe
  2⤵
  PID:7424
- C:\Windows\System\XyxDgOZ.exe
  C:\Windows\System\XyxDgOZ.exe
  2⤵
  PID:7444
- C:\Windows\System\yIfmhnu.exe
  C:\Windows\System\yIfmhnu.exe
  2⤵
  PID:7464
- C:\Windows\System\CfDaLds.exe
  C:\Windows\System\CfDaLds.exe
  2⤵
  PID:7488
- C:\Windows\System\lOdITuf.exe
  C:\Windows\System\lOdITuf.exe
  2⤵
  PID:7508
- C:\Windows\System\JSrYysN.exe
  C:\Windows\System\JSrYysN.exe
  2⤵
  PID:7524
- C:\Windows\System\hUERdhd.exe
  C:\Windows\System\hUERdhd.exe
  2⤵
  PID:7540
- C:\Windows\System\CVbYhrz.exe
  C:\Windows\System\CVbYhrz.exe
  2⤵
  PID:7556
- C:\Windows\System\UlmEuKJ.exe
  C:\Windows\System\UlmEuKJ.exe
  2⤵
  PID:7572
- C:\Windows\System\aCMLPus.exe
  C:\Windows\System\aCMLPus.exe
  2⤵
  PID:7596
- C:\Windows\System\pYreZPx.exe
  C:\Windows\System\pYreZPx.exe
  2⤵
  PID:7612
- C:\Windows\System\MVePXtV.exe
  C:\Windows\System\MVePXtV.exe
  2⤵
  PID:7628
- C:\Windows\System\OjiJXyA.exe
  C:\Windows\System\OjiJXyA.exe
  2⤵
  PID:7652
- C:\Windows\System\lqGyPaj.exe
  C:\Windows\System\lqGyPaj.exe
  2⤵
  PID:7672
- C:\Windows\System\JfFnUve.exe
  C:\Windows\System\JfFnUve.exe
  2⤵
  PID:7696
- C:\Windows\System\jxoisxS.exe
  C:\Windows\System\jxoisxS.exe
  2⤵
  PID:7884
- C:\Windows\System\zCeoQkl.exe
  C:\Windows\System\zCeoQkl.exe
  2⤵
  PID:7924
- C:\Windows\System\KYdGmNO.exe
  C:\Windows\System\KYdGmNO.exe
  2⤵
  PID:7944
- C:\Windows\System\ClNXCHW.exe
  C:\Windows\System\ClNXCHW.exe
  2⤵
  PID:7960
- C:\Windows\System\EvuvVAa.exe
  C:\Windows\System\EvuvVAa.exe
  2⤵
  PID:7980
- C:\Windows\System\vkKOSNf.exe
  C:\Windows\System\vkKOSNf.exe
  2⤵
  PID:5472
- C:\Windows\System\kutbpUv.exe
  C:\Windows\System\kutbpUv.exe
  2⤵
  PID:5940
- C:\Windows\System\kUjFdWu.exe
  C:\Windows\System\kUjFdWu.exe
  2⤵
  PID:6848
- C:\Windows\System\YCSMUvk.exe
  C:\Windows\System\YCSMUvk.exe
  2⤵
  PID:7036
- C:\Windows\System\WkxMmwW.exe
  C:\Windows\System\WkxMmwW.exe
  2⤵
  PID:7112
- C:\Windows\System\cwMBeaV.exe
  C:\Windows\System\cwMBeaV.exe
  2⤵
  PID:5776
- C:\Windows\System\jhscDDh.exe
  C:\Windows\System\jhscDDh.exe
  2⤵
  PID:6108
- C:\Windows\System\TiMQLrA.exe
  C:\Windows\System\TiMQLrA.exe
  2⤵
  PID:5580
- C:\Windows\System\VIMctUy.exe
  C:\Windows\System\VIMctUy.exe
  2⤵
  PID:5656
- C:\Windows\System\OTgHYXK.exe
  C:\Windows\System\OTgHYXK.exe
  2⤵
  PID:5816
- C:\Windows\System\BHICpwW.exe
  C:\Windows\System\BHICpwW.exe
  2⤵
  PID:5924
- C:\Windows\System\xxiSHoG.exe
  C:\Windows\System\xxiSHoG.exe
  2⤵
  PID:4924
- C:\Windows\System\dKyxmhy.exe
  C:\Windows\System\dKyxmhy.exe
  2⤵
  PID:5676
- C:\Windows\System\HToWudE.exe
  C:\Windows\System\HToWudE.exe
  2⤵
  PID:6280
- C:\Windows\System\rsWMRCh.exe
  C:\Windows\System\rsWMRCh.exe
  2⤵
  PID:6764
- C:\Windows\System\xvXTwDj.exe
  C:\Windows\System\xvXTwDj.exe
  2⤵
  PID:5900
- C:\Windows\System\nKehBwH.exe
  C:\Windows\System\nKehBwH.exe
  2⤵
  PID:6388
- C:\Windows\System\joKFOOQ.exe
  C:\Windows\System\joKFOOQ.exe
  2⤵
  PID:6512
- C:\Windows\System\RnCZFeM.exe
  C:\Windows\System\RnCZFeM.exe
  2⤵
  PID:6596
- C:\Windows\System\tKzUZkd.exe
  C:\Windows\System\tKzUZkd.exe
  2⤵
  PID:6788
- C:\Windows\System\SHlbAnT.exe
  C:\Windows\System\SHlbAnT.exe
  2⤵
  PID:7708
- C:\Windows\System\wjvCxwj.exe
  C:\Windows\System\wjvCxwj.exe
  2⤵
  PID:7936
- C:\Windows\System\ygEogOP.exe
  C:\Windows\System\ygEogOP.exe
  2⤵
  PID:7972
- C:\Windows\System\jQMXpgm.exe
  C:\Windows\System\jQMXpgm.exe
  2⤵
  PID:8008
- C:\Windows\System\eAxztKh.exe
  C:\Windows\System\eAxztKh.exe
  2⤵
  PID:8040
- C:\Windows\System\qyDdaKN.exe
  C:\Windows\System\qyDdaKN.exe
  2⤵
  PID:6888
- C:\Windows\System\moKYXQc.exe
  C:\Windows\System\moKYXQc.exe
  2⤵
  PID:8208
- C:\Windows\System\AVleWIn.exe
  C:\Windows\System\AVleWIn.exe
  2⤵
  PID:8448
- C:\Windows\System\FOlQpAI.exe
  C:\Windows\System\FOlQpAI.exe
  2⤵
  PID:8464
- C:\Windows\System\ViFCTqp.exe
  C:\Windows\System\ViFCTqp.exe
  2⤵
  PID:8480
- C:\Windows\System\xkaozTt.exe
  C:\Windows\System\xkaozTt.exe
  2⤵
  PID:8496
- C:\Windows\System\biDCDZI.exe
  C:\Windows\System\biDCDZI.exe
  2⤵
  PID:8512
- C:\Windows\System\yiqHtkI.exe
  C:\Windows\System\yiqHtkI.exe
  2⤵
  PID:8528
- C:\Windows\System\xFaqPFe.exe
  C:\Windows\System\xFaqPFe.exe
  2⤵
  PID:8544
- C:\Windows\System\pBHfGJK.exe
  C:\Windows\System\pBHfGJK.exe
  2⤵
  PID:8560
- C:\Windows\System\gYPHJYV.exe
  C:\Windows\System\gYPHJYV.exe
  2⤵
  PID:8576
- C:\Windows\System\TiDQLgR.exe
  C:\Windows\System\TiDQLgR.exe
  2⤵
  PID:8592
- C:\Windows\System\cGYTvnn.exe
  C:\Windows\System\cGYTvnn.exe
  2⤵
  PID:8608
- C:\Windows\System\gISCSMG.exe
  C:\Windows\System\gISCSMG.exe
  2⤵
  PID:8624
- C:\Windows\System\wVjcMRP.exe
  C:\Windows\System\wVjcMRP.exe
  2⤵
  PID:8640
- C:\Windows\System\QyjjGNG.exe
  C:\Windows\System\QyjjGNG.exe
  2⤵
  PID:8660
- C:\Windows\System\vvlvDiH.exe
  C:\Windows\System\vvlvDiH.exe
  2⤵
  PID:8676
- C:\Windows\System\jQHSFYd.exe
  C:\Windows\System\jQHSFYd.exe
  2⤵
  PID:8792
- C:\Windows\System\EZxyfyT.exe
  C:\Windows\System\EZxyfyT.exe
  2⤵
  PID:8812
- C:\Windows\System\VPXvmYB.exe
  C:\Windows\System\VPXvmYB.exe
  2⤵
  PID:8836
- C:\Windows\System\YTFPBXl.exe
  C:\Windows\System\YTFPBXl.exe
  2⤵
  PID:8872
- C:\Windows\System\VKxGlJU.exe
  C:\Windows\System\VKxGlJU.exe
  2⤵
  PID:8888
- C:\Windows\System\afLzTYf.exe
  C:\Windows\System\afLzTYf.exe
  2⤵
  PID:9036
- C:\Windows\System\ORjirfs.exe
  C:\Windows\System\ORjirfs.exe
  2⤵
  PID:9052
- C:\Windows\System\tOwwlvm.exe
  C:\Windows\System\tOwwlvm.exe
  2⤵
  PID:9072
- C:\Windows\System\wjNFDyW.exe
  C:\Windows\System\wjNFDyW.exe
  2⤵
  PID:9088
- C:\Windows\System\XKFnHWy.exe
  C:\Windows\System\XKFnHWy.exe
  2⤵
  PID:9108
- C:\Windows\System\GbgSXUx.exe
  C:\Windows\System\GbgSXUx.exe
  2⤵
  PID:9128
- C:\Windows\System\mUCCDcy.exe
  C:\Windows\System\mUCCDcy.exe
  2⤵
  PID:9148
- C:\Windows\System\avHXWKH.exe
  C:\Windows\System\avHXWKH.exe
  2⤵
  PID:9172
- C:\Windows\System\zPErOft.exe
  C:\Windows\System\zPErOft.exe
  2⤵
  PID:9196
- C:\Windows\System\muMBLKK.exe
  C:\Windows\System\muMBLKK.exe
  2⤵
  PID:8116
- C:\Windows\System\ypaNUPa.exe
  C:\Windows\System\ypaNUPa.exe
  2⤵
  PID:8148
- C:\Windows\System\DGphhcw.exe
  C:\Windows\System\DGphhcw.exe
  2⤵
  PID:4376
- C:\Windows\System\KSusBeo.exe
  C:\Windows\System\KSusBeo.exe
  2⤵
  PID:6988
- C:\Windows\System\vsbqyCe.exe
  C:\Windows\System\vsbqyCe.exe
  2⤵
  PID:5800
- C:\Windows\System\oDMvAzj.exe
  C:\Windows\System\oDMvAzj.exe
  2⤵
  PID:5640
- C:\Windows\System\vdETotG.exe
  C:\Windows\System\vdETotG.exe
  2⤵
  PID:5832
- C:\Windows\System\uHLOsbC.exe
  C:\Windows\System\uHLOsbC.exe
  2⤵
  PID:5000
- C:\Windows\System\zhzoSGT.exe
  C:\Windows\System\zhzoSGT.exe
  2⤵
  PID:6528
- C:\Windows\System\jGUKwgT.exe
  C:\Windows\System\jGUKwgT.exe
  2⤵
  PID:3148
- C:\Windows\System\epjVgcb.exe
  C:\Windows\System\epjVgcb.exe
  2⤵
  PID:6576
- C:\Windows\System\oYzNeIK.exe
  C:\Windows\System\oYzNeIK.exe
  2⤵
  PID:6700
- C:\Windows\System\omDpUFq.exe
  C:\Windows\System\omDpUFq.exe
  2⤵
  PID:7536
- C:\Windows\System\owNcnDi.exe
  C:\Windows\System\owNcnDi.exe
  2⤵
  PID:7592
- C:\Windows\System\ScPSLvr.exe
  C:\Windows\System\ScPSLvr.exe
  2⤵
  PID:7680
- C:\Windows\System\JqlZydf.exe
  C:\Windows\System\JqlZydf.exe
  2⤵
  PID:7932
- C:\Windows\System\AHLPQgi.exe
  C:\Windows\System\AHLPQgi.exe
  2⤵
  PID:8032
- C:\Windows\System\NVOjQgH.exe
  C:\Windows\System\NVOjQgH.exe
  2⤵
  PID:8216
- C:\Windows\System\PurELql.exe
  C:\Windows\System\PurELql.exe
  2⤵
  PID:8352
- C:\Windows\System\xfwPZZg.exe
  C:\Windows\System\xfwPZZg.exe
  2⤵
  PID:8604
- C:\Windows\System\EvFAMMS.exe
  C:\Windows\System\EvFAMMS.exe
  2⤵
  PID:8668
- C:\Windows\System\iPtCrSP.exe
  C:\Windows\System\iPtCrSP.exe
  2⤵
  PID:8716
- C:\Windows\System\IJMLHjI.exe
  C:\Windows\System\IJMLHjI.exe
  2⤵
  PID:8740
- C:\Windows\System\oywwrLw.exe
  C:\Windows\System\oywwrLw.exe
  2⤵
  PID:8808
- C:\Windows\System\BfAxafM.exe
  C:\Windows\System\BfAxafM.exe
  2⤵
  PID:8856
- C:\Windows\System\DByPZqN.exe
  C:\Windows\System\DByPZqN.exe
  2⤵
  PID:448
- C:\Windows\System\pjqQNSL.exe
  C:\Windows\System\pjqQNSL.exe
  2⤵
  PID:8980
- C:\Windows\System\jipGNtZ.exe
  C:\Windows\System\jipGNtZ.exe
  2⤵
  PID:2400
- C:\Windows\System\zTgoHFl.exe
  C:\Windows\System\zTgoHFl.exe
  2⤵
  PID:4460
- C:\Windows\System\hTRDXQl.exe
  C:\Windows\System\hTRDXQl.exe
  2⤵
  PID:3820
- C:\Windows\System\bUeeezl.exe
  C:\Windows\System\bUeeezl.exe
  2⤵
  PID:2552
- C:\Windows\System\nQmayRC.exe
  C:\Windows\System\nQmayRC.exe
  2⤵
  PID:4968
- C:\Windows\System\OHkfhDu.exe
  C:\Windows\System\OHkfhDu.exe
  2⤵
  PID:964
- C:\Windows\System\JMbOeCm.exe
  C:\Windows\System\JMbOeCm.exe
  2⤵
  PID:3208
- C:\Windows\System\nTfewKQ.exe
  C:\Windows\System\nTfewKQ.exe
  2⤵
  PID:1104
- C:\Windows\System\kfGZEHU.exe
  C:\Windows\System\kfGZEHU.exe
  2⤵
  PID:4500
- C:\Windows\System\NxsmIXd.exe
  C:\Windows\System\NxsmIXd.exe
  2⤵
  PID:2272
- C:\Windows\System\FpiglIM.exe
  C:\Windows\System\FpiglIM.exe
  2⤵
  PID:3280
- C:\Windows\System\NqFPoFi.exe
  C:\Windows\System\NqFPoFi.exe
  2⤵
  PID:6980
- C:\Windows\System\YexyNVo.exe
  C:\Windows\System\YexyNVo.exe
  2⤵
  PID:4568
- C:\Windows\System\TQiMXXA.exe
  C:\Windows\System\TQiMXXA.exe
  2⤵
  PID:9068
- C:\Windows\System\TFItGbC.exe
  C:\Windows\System\TFItGbC.exe
  2⤵
  PID:9116
- C:\Windows\System\AXShGRA.exe
  C:\Windows\System\AXShGRA.exe
  2⤵
  PID:9120
- C:\Windows\System\KkQDuZl.exe
  C:\Windows\System\KkQDuZl.exe
  2⤵
  PID:9124
- C:\Windows\System\MmljHIa.exe
  C:\Windows\System\MmljHIa.exe
  2⤵
  PID:8180
- C:\Windows\System\BgsECbc.exe
  C:\Windows\System\BgsECbc.exe
  2⤵
  PID:5744
- C:\Windows\System\kAylPCL.exe
  C:\Windows\System\kAylPCL.exe
  2⤵
  PID:6828
- C:\Windows\System\rHvzlSK.exe
  C:\Windows\System\rHvzlSK.exe
  2⤵
  PID:7568
- C:\Windows\System\yBjlxtA.exe
  C:\Windows\System\yBjlxtA.exe
  2⤵
  PID:7664
- C:\Windows\System\hHjGSDx.exe
  C:\Windows\System\hHjGSDx.exe
  2⤵
  PID:7400
- C:\Windows\System\MinJDjh.exe
  C:\Windows\System\MinJDjh.exe
  2⤵
  PID:7968
- C:\Windows\System\MgJxGhc.exe
  C:\Windows\System\MgJxGhc.exe
  2⤵
  PID:8344
- C:\Windows\System\ElRXgFw.exe
  C:\Windows\System\ElRXgFw.exe
  2⤵
  PID:8688
- C:\Windows\System\qCDXqcy.exe
  C:\Windows\System\qCDXqcy.exe
  2⤵
  PID:8368
- C:\Windows\System\xlXzKGF.exe
  C:\Windows\System\xlXzKGF.exe
  2⤵
  PID:8780
- C:\Windows\System\oZpbiNe.exe
  C:\Windows\System\oZpbiNe.exe
  2⤵
  PID:8536
- C:\Windows\System\YHwdrpJ.exe
  C:\Windows\System\YHwdrpJ.exe
  2⤵
  PID:8748
- C:\Windows\System\AwivCUL.exe
  C:\Windows\System\AwivCUL.exe
  2⤵
  PID:8884
- C:\Windows\System\lxxFdJR.exe
  C:\Windows\System\lxxFdJR.exe
  2⤵
  PID:8648
- C:\Windows\System\bQbbvjL.exe
  C:\Windows\System\bQbbvjL.exe
  2⤵
  PID:3908
- C:\Windows\System\YVvudhd.exe
  C:\Windows\System\YVvudhd.exe
  2⤵
  PID:1612
- C:\Windows\System\IdwJgyc.exe
  C:\Windows\System\IdwJgyc.exe
  2⤵
  PID:4304
- C:\Windows\System\dYrKoYQ.exe
  C:\Windows\System\dYrKoYQ.exe
  2⤵
  PID:1340
- C:\Windows\System\IpFgZeR.exe
  C:\Windows\System\IpFgZeR.exe
  2⤵
  PID:9064
- C:\Windows\System\Bwccjgp.exe
  C:\Windows\System\Bwccjgp.exe
  2⤵
  PID:1404
- C:\Windows\System\LRbCXHg.exe
  C:\Windows\System\LRbCXHg.exe
  2⤵
  PID:6932
- C:\Windows\System\qRDfCvz.exe
  C:\Windows\System\qRDfCvz.exe
  2⤵
  PID:8964
- C:\Windows\System\hcxUXjM.exe
  C:\Windows\System\hcxUXjM.exe
  2⤵
  PID:9244
- C:\Windows\System\GmZpujn.exe
  C:\Windows\System\GmZpujn.exe
  2⤵
  PID:9268
- C:\Windows\System\DySwiCk.exe
  C:\Windows\System\DySwiCk.exe
  2⤵
  PID:9288
- C:\Windows\System\paUpnvo.exe
  C:\Windows\System\paUpnvo.exe
  2⤵
  PID:9304
- C:\Windows\System\KuvuHHc.exe
  C:\Windows\System\KuvuHHc.exe
  2⤵
  PID:9324
- C:\Windows\System\NsiSSMT.exe
  C:\Windows\System\NsiSSMT.exe
  2⤵
  PID:9344
- C:\Windows\System\VWQSkzq.exe
  C:\Windows\System\VWQSkzq.exe
  2⤵
  PID:9364
- C:\Windows\System\LNiNNXh.exe
  C:\Windows\System\LNiNNXh.exe
  2⤵
  PID:9392
- C:\Windows\System\diEgKhE.exe
  C:\Windows\System\diEgKhE.exe
  2⤵
  PID:9416
- C:\Windows\System\GJNPOFR.exe
  C:\Windows\System\GJNPOFR.exe
  2⤵
  PID:9436
- C:\Windows\System\tYlTLiI.exe
  C:\Windows\System\tYlTLiI.exe
  2⤵
  PID:9456
- C:\Windows\System\BslWIjL.exe
  C:\Windows\System\BslWIjL.exe
  2⤵
  PID:9484
- C:\Windows\System\RKVipAu.exe
  C:\Windows\System\RKVipAu.exe
  2⤵
  PID:9504
- C:\Windows\System\RWtOzcf.exe
  C:\Windows\System\RWtOzcf.exe
  2⤵
  PID:9524
- C:\Windows\System\UjwUZJz.exe
  C:\Windows\System\UjwUZJz.exe
  2⤵
  PID:9540
- C:\Windows\System\jXdDECI.exe
  C:\Windows\System\jXdDECI.exe
  2⤵
  PID:9568
- C:\Windows\System\ZDbrNtZ.exe
  C:\Windows\System\ZDbrNtZ.exe
  2⤵
  PID:9600
- C:\Windows\System\qlFhDTJ.exe
  C:\Windows\System\qlFhDTJ.exe
  2⤵
  PID:9624
- C:\Windows\System\ouBivIn.exe
  C:\Windows\System\ouBivIn.exe
  2⤵
  PID:9648
- C:\Windows\System\WyCMPwe.exe
  C:\Windows\System\WyCMPwe.exe
  2⤵
  PID:9664
- C:\Windows\System\AIzdTdG.exe
  C:\Windows\System\AIzdTdG.exe
  2⤵
  PID:9688
- C:\Windows\System\ciYyUXV.exe
  C:\Windows\System\ciYyUXV.exe
  2⤵
  PID:9708
- C:\Windows\System\WzpnvtA.exe
  C:\Windows\System\WzpnvtA.exe
  2⤵
  PID:9732
- C:\Windows\System\nbmepzq.exe
  C:\Windows\System\nbmepzq.exe
  2⤵
  PID:9752
- C:\Windows\System\hyTKTCM.exe
  C:\Windows\System\hyTKTCM.exe
  2⤵
  PID:9776
- C:\Windows\System\KwvjMyx.exe
  C:\Windows\System\KwvjMyx.exe
  2⤵
  PID:9796
- C:\Windows\System\wSigZVA.exe
  C:\Windows\System\wSigZVA.exe
  2⤵
  PID:9824
- C:\Windows\System\uGlGxyu.exe
  C:\Windows\System\uGlGxyu.exe
  2⤵
  PID:9852
- C:\Windows\System\cnepejS.exe
  C:\Windows\System\cnepejS.exe
  2⤵
  PID:9868
- C:\Windows\System\HAymklv.exe
  C:\Windows\System\HAymklv.exe
  2⤵
  PID:9888
- C:\Windows\System\wilfzup.exe
  C:\Windows\System\wilfzup.exe
  2⤵
  PID:9908
- C:\Windows\System\tJGQQJl.exe
  C:\Windows\System\tJGQQJl.exe
  2⤵
  PID:9932
- C:\Windows\System\vqTtPtD.exe
  C:\Windows\System\vqTtPtD.exe
  2⤵
  PID:9952
- C:\Windows\System\UsYbVlM.exe
  C:\Windows\System\UsYbVlM.exe
  2⤵
  PID:9980
- C:\Windows\System\bXJBTjT.exe
  C:\Windows\System\bXJBTjT.exe
  2⤵
  PID:10000
- C:\Windows\System\YaUduCJ.exe
  C:\Windows\System\YaUduCJ.exe
  2⤵
  PID:10020
- C:\Windows\System\PhXiwZU.exe
  C:\Windows\System\PhXiwZU.exe
  2⤵
  PID:10040
- C:\Windows\System\BFYkgMA.exe
  C:\Windows\System\BFYkgMA.exe
  2⤵
  PID:10060
- C:\Windows\System\FyyfnUY.exe
  C:\Windows\System\FyyfnUY.exe
  2⤵
  PID:10080
- C:\Windows\System\xtUXySi.exe
  C:\Windows\System\xtUXySi.exe
  2⤵
  PID:10104
- C:\Windows\System\wmBRoYz.exe
  C:\Windows\System\wmBRoYz.exe
  2⤵
  PID:10120
- C:\Windows\System\DHLRhbe.exe
  C:\Windows\System\DHLRhbe.exe
  2⤵
  PID:10148
- C:\Windows\System\bQklIwa.exe
  C:\Windows\System\bQklIwa.exe
  2⤵
  PID:10168
- C:\Windows\System\qgvGqzC.exe
  C:\Windows\System\qgvGqzC.exe
  2⤵
  PID:10196
- C:\Windows\System\oDGKagq.exe
  C:\Windows\System\oDGKagq.exe
  2⤵
  PID:10216
- C:\Windows\System\VHHYbiP.exe
  C:\Windows\System\VHHYbiP.exe
  2⤵
  PID:10236
- C:\Windows\System\BEZStbO.exe
  C:\Windows\System\BEZStbO.exe
  2⤵
  PID:6680
- C:\Windows\System\bYTMQXP.exe
  C:\Windows\System\bYTMQXP.exe
  2⤵
  PID:9160
- C:\Windows\System\wgGtTHA.exe
  C:\Windows\System\wgGtTHA.exe
  2⤵
  PID:8724
- C:\Windows\System\SAXxENr.exe
  C:\Windows\System\SAXxENr.exe
  2⤵
  PID:2956
- C:\Windows\System\rFwjmDk.exe
  C:\Windows\System\rFwjmDk.exe
  2⤵
  PID:5320
- C:\Windows\System\nYyLdhw.exe
  C:\Windows\System\nYyLdhw.exe
  2⤵
  PID:9264
- C:\Windows\System\LjWURrm.exe
  C:\Windows\System\LjWURrm.exe
  2⤵
  PID:9672
- C:\Windows\System\ccbLGcq.exe
  C:\Windows\System\ccbLGcq.exe
  2⤵
  PID:9716
- C:\Windows\System\rWIhsBq.exe
  C:\Windows\System\rWIhsBq.exe
  2⤵
  PID:9332
- C:\Windows\System\DmcRvps.exe
  C:\Windows\System\DmcRvps.exe
  2⤵
  PID:9884
- C:\Windows\System\zcWOEnz.exe
  C:\Windows\System\zcWOEnz.exe
  2⤵
  PID:9924
- C:\Windows\System\GRzAFim.exe
  C:\Windows\System\GRzAFim.exe
  2⤵
  PID:9972
- C:\Windows\System\QeosABf.exe
  C:\Windows\System\QeosABf.exe
  2⤵
  PID:9640
- C:\Windows\System\BewzQxc.exe
  C:\Windows\System\BewzQxc.exe
  2⤵
  PID:10156
- C:\Windows\System\WihhrSO.exe
  C:\Windows\System\WihhrSO.exe
  2⤵
  PID:9104
- C:\Windows\System\kmbwWSQ.exe
  C:\Windows\System\kmbwWSQ.exe
  2⤵
  PID:8632
- C:\Windows\System\srspDOd.exe
  C:\Windows\System\srspDOd.exe
  2⤵
  PID:9948
- C:\Windows\System\rHAxyrj.exe
  C:\Windows\System\rHAxyrj.exe
  2⤵
  PID:9548
- C:\Windows\System\gXkqTyK.exe
  C:\Windows\System\gXkqTyK.exe
  2⤵
  PID:9592
- C:\Windows\System\FTXvwjh.exe
  C:\Windows\System\FTXvwjh.exe
  2⤵
  PID:9620
- C:\Windows\System\rrTyrtm.exe
  C:\Windows\System\rrTyrtm.exe
  2⤵
  PID:9656
- C:\Windows\System\xgQChfB.exe
  C:\Windows\System\xgQChfB.exe
  2⤵
  PID:10252
- C:\Windows\System\IFZWVcm.exe
  C:\Windows\System\IFZWVcm.exe
  2⤵
  PID:10276
- C:\Windows\System\oXkJRnn.exe
  C:\Windows\System\oXkJRnn.exe
  2⤵
  PID:10296
- C:\Windows\System\nAIpBeQ.exe
  C:\Windows\System\nAIpBeQ.exe
  2⤵
  PID:10316
- C:\Windows\System\AcTmHvv.exe
  C:\Windows\System\AcTmHvv.exe
  2⤵
  PID:10336
- C:\Windows\System\IWDtkIH.exe
  C:\Windows\System\IWDtkIH.exe
  2⤵
  PID:10364
- C:\Windows\System\TNrATIi.exe
  C:\Windows\System\TNrATIi.exe
  2⤵
  PID:10384
- C:\Windows\System\ACwXzJG.exe
  C:\Windows\System\ACwXzJG.exe
  2⤵
  PID:10404
- C:\Windows\System\zJtxkmR.exe
  C:\Windows\System\zJtxkmR.exe
  2⤵
  PID:10428
- C:\Windows\System\DETzTxO.exe
  C:\Windows\System\DETzTxO.exe
  2⤵
  PID:10448
- C:\Windows\System\XABoFqx.exe
  C:\Windows\System\XABoFqx.exe
  2⤵
  PID:10476
- C:\Windows\System\PLeMLNh.exe
  C:\Windows\System\PLeMLNh.exe
  2⤵
  PID:10500
- C:\Windows\System\ckhnafb.exe
  C:\Windows\System\ckhnafb.exe
  2⤵
  PID:10520
- C:\Windows\System\dImsnlE.exe
  C:\Windows\System\dImsnlE.exe
  2⤵
  PID:10548
- C:\Windows\System\jMeRExm.exe
  C:\Windows\System\jMeRExm.exe
  2⤵
  PID:10568
- C:\Windows\System\XksPLXL.exe
  C:\Windows\System\XksPLXL.exe
  2⤵
  PID:10596
- C:\Windows\System\mAazxLK.exe
  C:\Windows\System\mAazxLK.exe
  2⤵
  PID:10616
- C:\Windows\System\rlBNSXU.exe
  C:\Windows\System\rlBNSXU.exe
  2⤵
  PID:10640
- C:\Windows\System\tFmuJpT.exe
  C:\Windows\System\tFmuJpT.exe
  2⤵
  PID:10660
- C:\Windows\System\ZSCZiYb.exe
  C:\Windows\System\ZSCZiYb.exe
  2⤵
  PID:10684
- C:\Windows\System\KSIkcWl.exe
  C:\Windows\System\KSIkcWl.exe
  2⤵
  PID:10704
- C:\Windows\System\zJOgrOB.exe
  C:\Windows\System\zJOgrOB.exe
  2⤵
  PID:10724
- C:\Windows\System\GHvQnxk.exe
  C:\Windows\System\GHvQnxk.exe
  2⤵
  PID:10752
- C:\Windows\System\FQyprzf.exe
  C:\Windows\System\FQyprzf.exe
  2⤵
  PID:10776
- C:\Windows\System\GoJAlMR.exe
  C:\Windows\System\GoJAlMR.exe
  2⤵
  PID:10796
- C:\Windows\System\DdBAblM.exe
  C:\Windows\System\DdBAblM.exe
  2⤵
  PID:10824
- C:\Windows\System\lReisYE.exe
  C:\Windows\System\lReisYE.exe
  2⤵
  PID:10844
- C:\Windows\System\jySxaYb.exe
  C:\Windows\System\jySxaYb.exe
  2⤵
  PID:10868
- C:\Windows\System\ALcOINT.exe
  C:\Windows\System\ALcOINT.exe
  2⤵
  PID:10884
- C:\Windows\System\dmEgcyB.exe
  C:\Windows\System\dmEgcyB.exe
  2⤵
  PID:10912
- C:\Windows\System\OVVGfne.exe
  C:\Windows\System\OVVGfne.exe
  2⤵
  PID:10932
- C:\Windows\System\zNLaUAo.exe
  C:\Windows\System\zNLaUAo.exe
  2⤵
  PID:10956
- C:\Windows\System\GWJceig.exe
  C:\Windows\System\GWJceig.exe
  2⤵
  PID:10976
- C:\Windows\System\MybOSvY.exe
  C:\Windows\System\MybOSvY.exe
  2⤵
  PID:11000
- C:\Windows\System\lWGFhOZ.exe
  C:\Windows\System\lWGFhOZ.exe
  2⤵
  PID:11020
- C:\Windows\System\HEYrSMV.exe
  C:\Windows\System\HEYrSMV.exe
  2⤵
  PID:11040
- C:\Windows\System\sJZZpFN.exe
  C:\Windows\System\sJZZpFN.exe
  2⤵
  PID:11064
- C:\Windows\System\eIYBgDg.exe
  C:\Windows\System\eIYBgDg.exe
  2⤵
  PID:11088
- C:\Windows\System\TSGcwuF.exe
  C:\Windows\System\TSGcwuF.exe
  2⤵
  PID:11108
- C:\Windows\System\PguXayg.exe
  C:\Windows\System\PguXayg.exe
  2⤵
  PID:11132
- C:\Windows\System\YadmefE.exe
  C:\Windows\System\YadmefE.exe
  2⤵
  PID:11152
- C:\Windows\System\zrnlCPO.exe
  C:\Windows\System\zrnlCPO.exe
  2⤵
  PID:11176
- C:\Windows\System\OlZrFEb.exe
  C:\Windows\System\OlZrFEb.exe
  2⤵
  PID:11196
- C:\Windows\System\yLYlTOW.exe
  C:\Windows\System\yLYlTOW.exe
  2⤵
  PID:11220
- C:\Windows\System\nogntpV.exe
  C:\Windows\System\nogntpV.exe
  2⤵
  PID:11236
- C:\Windows\System\XNYPJoL.exe
  C:\Windows\System\XNYPJoL.exe
  2⤵
  PID:9704
- C:\Windows\System\fEGBKFn.exe
  C:\Windows\System\fEGBKFn.exe
  2⤵
  PID:10176
- C:\Windows\System\QzcYayz.exe
  C:\Windows\System\QzcYayz.exe
  2⤵
  PID:9764
- C:\Windows\System\GBBheYS.exe
  C:\Windows\System\GBBheYS.exe
  2⤵
  PID:8108
- C:\Windows\System\EfGhEen.exe
  C:\Windows\System\EfGhEen.exe
  2⤵
  PID:9876
- C:\Windows\System\tUxuhMw.exe
  C:\Windows\System\tUxuhMw.exe
  2⤵
  PID:9404
- C:\Windows\System\KWzkUZD.exe
  C:\Windows\System\KWzkUZD.exe
  2⤵
  PID:9512
- C:\Windows\System\MWlegqw.exe
  C:\Windows\System\MWlegqw.exe
  2⤵
  PID:9964
- C:\Windows\System\XdxDGbS.exe
  C:\Windows\System\XdxDGbS.exe
  2⤵
  PID:5716
- C:\Windows\System\bWDAHJf.exe
  C:\Windows\System\bWDAHJf.exe
  2⤵
  PID:10032
- C:\Windows\System\hpjjIuP.exe
  C:\Windows\System\hpjjIuP.exe
  2⤵
  PID:10304
- C:\Windows\System\swGCVFr.exe
  C:\Windows\System\swGCVFr.exe
  2⤵
  PID:10360
- C:\Windows\System\ipnyxEj.exe
  C:\Windows\System\ipnyxEj.exe
  2⤵
  PID:6356
- C:\Windows\System\qigQpuk.exe
  C:\Windows\System\qigQpuk.exe
  2⤵
  PID:8852
- C:\Windows\System\sVuihYE.exe
  C:\Windows\System\sVuihYE.exe
  2⤵
  PID:9252
- C:\Windows\System\FAPfCzH.exe
  C:\Windows\System\FAPfCzH.exe
  2⤵
  PID:9744
- C:\Windows\System\KkoOhZs.exe
  C:\Windows\System\KkoOhZs.exe
  2⤵
  PID:10648
- C:\Windows\System\LkOfTaX.exe
  C:\Windows\System\LkOfTaX.exe
  2⤵
  PID:10700
- C:\Windows\System\OcCLcmR.exe
  C:\Windows\System\OcCLcmR.exe
  2⤵
  PID:10788
- C:\Windows\System\KUoMwrN.exe
  C:\Windows\System\KUoMwrN.exe
  2⤵
  PID:10876
- C:\Windows\System\DqXSymh.exe
  C:\Windows\System\DqXSymh.exe
  2⤵
  PID:11268
- C:\Windows\System\RhxfIAB.exe
  C:\Windows\System\RhxfIAB.exe
  2⤵
  PID:11292
- C:\Windows\System\RnJdRMA.exe
  C:\Windows\System\RnJdRMA.exe
  2⤵
  PID:11316
- C:\Windows\System\kuTyoUa.exe
  C:\Windows\System\kuTyoUa.exe
  2⤵
  PID:11336
- C:\Windows\System\YDNRnOG.exe
  C:\Windows\System\YDNRnOG.exe
  2⤵
  PID:11364
- C:\Windows\System\NezHRKu.exe
  C:\Windows\System\NezHRKu.exe
  2⤵
  PID:11380
- C:\Windows\System\lPyWrex.exe
  C:\Windows\System\lPyWrex.exe
  2⤵
  PID:11400
- C:\Windows\System\tbRFQcW.exe
  C:\Windows\System\tbRFQcW.exe
  2⤵
  PID:11420
- C:\Windows\System\eGDsFeD.exe
  C:\Windows\System\eGDsFeD.exe
  2⤵
  PID:11444
- C:\Windows\System\nZZTXhX.exe
  C:\Windows\System\nZZTXhX.exe
  2⤵
  PID:11468
- C:\Windows\System\BEKqMzG.exe
  C:\Windows\System\BEKqMzG.exe
  2⤵
  PID:11488
- C:\Windows\System\bQAySxM.exe
  C:\Windows\System\bQAySxM.exe
  2⤵
  PID:11512
- C:\Windows\System\MGmLKXa.exe
  C:\Windows\System\MGmLKXa.exe
  2⤵
  PID:11540
- C:\Windows\System\tZrWDZC.exe
  C:\Windows\System\tZrWDZC.exe
  2⤵
  PID:11560
- C:\Windows\System\DeMPjUL.exe
  C:\Windows\System\DeMPjUL.exe
  2⤵
  PID:11580
- C:\Windows\System\vQdIQxa.exe
  C:\Windows\System\vQdIQxa.exe
  2⤵
  PID:11600
- C:\Windows\System\SlKeJPz.exe
  C:\Windows\System\SlKeJPz.exe
  2⤵
  PID:11620
- C:\Windows\System\vCUbBoe.exe
  C:\Windows\System\vCUbBoe.exe
  2⤵
  PID:11640
- C:\Windows\System\vGnRLJw.exe
  C:\Windows\System\vGnRLJw.exe
  2⤵
  PID:11664
- C:\Windows\System\jAMznxN.exe
  C:\Windows\System\jAMznxN.exe
  2⤵
  PID:11688
- C:\Windows\System\tEekJty.exe
  C:\Windows\System\tEekJty.exe
  2⤵
  PID:11716
- C:\Windows\System\lyXcEgC.exe
  C:\Windows\System\lyXcEgC.exe
  2⤵
  PID:11736
- C:\Windows\System\bxgWxqD.exe
  C:\Windows\System\bxgWxqD.exe
  2⤵
  PID:11756
- C:\Windows\System\ZfJAcCG.exe
  C:\Windows\System\ZfJAcCG.exe
  2⤵
  PID:11780
- C:\Windows\System\ciSnGlZ.exe
  C:\Windows\System\ciSnGlZ.exe
  2⤵
  PID:11800
- C:\Windows\System\OttySoH.exe
  C:\Windows\System\OttySoH.exe
  2⤵
  PID:11820
- C:\Windows\System\hDRhric.exe
  C:\Windows\System\hDRhric.exe
  2⤵
  PID:11848
- C:\Windows\System\uzhsIqC.exe
  C:\Windows\System\uzhsIqC.exe
  2⤵
  PID:11868
- C:\Windows\System\TnuBSri.exe
  C:\Windows\System\TnuBSri.exe
  2⤵
  PID:11888
- C:\Windows\System\pLiOXrj.exe
  C:\Windows\System\pLiOXrj.exe
  2⤵
  PID:11908
- C:\Windows\System\YxgwMBV.exe
  C:\Windows\System\YxgwMBV.exe
  2⤵
  PID:11928
- C:\Windows\System\oUWmciQ.exe
  C:\Windows\System\oUWmciQ.exe
  2⤵
  PID:11952
- C:\Windows\System\anxKDiN.exe
  C:\Windows\System\anxKDiN.exe
  2⤵
  PID:11972
- C:\Windows\System\bxiZFFr.exe
  C:\Windows\System\bxiZFFr.exe
  2⤵
  PID:11992
- C:\Windows\System\FEPVacp.exe
  C:\Windows\System\FEPVacp.exe
  2⤵
  PID:12020
- C:\Windows\System\kRIQIxQ.exe
  C:\Windows\System\kRIQIxQ.exe
  2⤵
  PID:12040
- C:\Windows\System\LjvMmlQ.exe
  C:\Windows\System\LjvMmlQ.exe
  2⤵
  PID:12060
- C:\Windows\System\JxJyZgO.exe
  C:\Windows\System\JxJyZgO.exe
  2⤵
  PID:12084
- C:\Windows\System\ZHLYjas.exe
  C:\Windows\System\ZHLYjas.exe
  2⤵
  PID:12104
- C:\Windows\System\mcLAUzA.exe
  C:\Windows\System\mcLAUzA.exe
  2⤵
  PID:12124
- C:\Windows\System\TLjwpjL.exe
  C:\Windows\System\TLjwpjL.exe
  2⤵
  PID:12144
- C:\Windows\System\dypGPsA.exe
  C:\Windows\System\dypGPsA.exe
  2⤵
  PID:12168
- C:\Windows\System\eCXiqZU.exe
  C:\Windows\System\eCXiqZU.exe
  2⤵
  PID:12192
- C:\Windows\System\ULFCGzk.exe
  C:\Windows\System\ULFCGzk.exe
  2⤵
  PID:12212
- C:\Windows\System\ScqoJkA.exe
  C:\Windows\System\ScqoJkA.exe
  2⤵
  PID:12232
- C:\Windows\System\gthDGXr.exe
  C:\Windows\System\gthDGXr.exe
  2⤵
  PID:12252
- C:\Windows\System\MYKZini.exe
  C:\Windows\System\MYKZini.exe
  2⤵
  PID:12272
- C:\Windows\System\AkOpQSC.exe
  C:\Windows\System\AkOpQSC.exe
  2⤵
  PID:11028
- C:\Windows\System\mXQGXSE.exe
  C:\Windows\System\mXQGXSE.exe
  2⤵
  PID:11084
- C:\Windows\System\trWtXNP.exe
  C:\Windows\System\trWtXNP.exe
  2⤵
  PID:11160
- C:\Windows\System\MeaBSQo.exe
  C:\Windows\System\MeaBSQo.exe
  2⤵
  PID:9728
- C:\Windows\System\JWhiZQV.exe
  C:\Windows\System\JWhiZQV.exe
  2⤵
  PID:8508
- C:\Windows\System\mmNeCeU.exe
  C:\Windows\System\mmNeCeU.exe
  2⤵
  PID:10052
- C:\Windows\System\McDaasm.exe
  C:\Windows\System\McDaasm.exe
  2⤵
  PID:9384
- C:\Windows\System\YoIvDMc.exe
  C:\Windows\System\YoIvDMc.exe
  2⤵
  PID:10260
- C:\Windows\System\jsJDIgs.exe
  C:\Windows\System\jsJDIgs.exe
  2⤵
  PID:10288
- C:\Windows\System\MgHEPSt.exe
  C:\Windows\System\MgHEPSt.exe
  2⤵
  PID:10840
- C:\Windows\System\hNQoMGB.exe
  C:\Windows\System\hNQoMGB.exe
  2⤵
  PID:10880
- C:\Windows\System\UZNpshK.exe
  C:\Windows\System\UZNpshK.exe
  2⤵
  PID:10952
- C:\Windows\System\psGdWNw.exe
  C:\Windows\System\psGdWNw.exe
  2⤵
  PID:11280
- C:\Windows\System\UyowIHP.exe
  C:\Windows\System\UyowIHP.exe
  2⤵
  PID:11284
- C:\Windows\System\ZGRhgYH.exe
  C:\Windows\System\ZGRhgYH.exe
  2⤵
  PID:10540
- C:\Windows\System\lgoJlow.exe
  C:\Windows\System\lgoJlow.exe
  2⤵
  PID:10556
- C:\Windows\System\GkdlIqr.exe
  C:\Windows\System\GkdlIqr.exe
  2⤵
  PID:11396
- C:\Windows\System\MnGiUBA.exe
  C:\Windows\System\MnGiUBA.exe
  2⤵
  PID:11460
- C:\Windows\System\bekWilH.exe
  C:\Windows\System\bekWilH.exe
  2⤵
  PID:10612
- C:\Windows\System\mTjQNdv.exe
  C:\Windows\System\mTjQNdv.exe
  2⤵
  PID:11588
- C:\Windows\System\JvSvVjC.exe
  C:\Windows\System\JvSvVjC.exe
  2⤵
  PID:10712
- C:\Windows\System\DNgXrwL.exe
  C:\Windows\System\DNgXrwL.exe
  2⤵
  PID:10740
- C:\Windows\System\ZIikpbV.exe
  C:\Windows\System\ZIikpbV.exe
  2⤵
  PID:11732
- C:\Windows\System\DgmhKYZ.exe
  C:\Windows\System\DgmhKYZ.exe
  2⤵
  PID:12296
- C:\Windows\System\DKNYPIy.exe
  C:\Windows\System\DKNYPIy.exe
  2⤵
  PID:12316
- C:\Windows\System\rSPJrho.exe
  C:\Windows\System\rSPJrho.exe
  2⤵
  PID:12352
- C:\Windows\System\QauOFVh.exe
  C:\Windows\System\QauOFVh.exe
  2⤵
  PID:12376
- C:\Windows\System\zxJBxVy.exe
  C:\Windows\System\zxJBxVy.exe
  2⤵
  PID:12400
- C:\Windows\System\vOmRTMp.exe
  C:\Windows\System\vOmRTMp.exe
  2⤵
  PID:12420
- C:\Windows\System\Lkbhmhz.exe
  C:\Windows\System\Lkbhmhz.exe
  2⤵
  PID:12440
- C:\Windows\System\ObsJbdV.exe
  C:\Windows\System\ObsJbdV.exe
  2⤵
  PID:12468
- C:\Windows\System\eDYkyNR.exe
  C:\Windows\System\eDYkyNR.exe
  2⤵
  PID:12492
- C:\Windows\System\yxyPZPj.exe
  C:\Windows\System\yxyPZPj.exe
  2⤵
  PID:12516
- C:\Windows\System\EBWfDTu.exe
  C:\Windows\System\EBWfDTu.exe
  2⤵
  PID:12540
- C:\Windows\System\LrQzagV.exe
  C:\Windows\System\LrQzagV.exe
  2⤵
  PID:12560
- C:\Windows\System\RbtIROv.exe
  C:\Windows\System\RbtIROv.exe
  2⤵
  PID:12584
- C:\Windows\System\OVQReKK.exe
  C:\Windows\System\OVQReKK.exe
  2⤵
  PID:12608
- C:\Windows\System\SYjuUcE.exe
  C:\Windows\System\SYjuUcE.exe
  2⤵
  PID:12632
- C:\Windows\System\wrstaCW.exe
  C:\Windows\System\wrstaCW.exe
  2⤵
  PID:12652
- C:\Windows\System\GaIIqjE.exe
  C:\Windows\System\GaIIqjE.exe
  2⤵
  PID:12680
- C:\Windows\System\nICOkDP.exe
  C:\Windows\System\nICOkDP.exe
  2⤵
  PID:12700
- C:\Windows\System\qnOTGKM.exe
  C:\Windows\System\qnOTGKM.exe
  2⤵
  PID:12724
- C:\Windows\System\bUTSltG.exe
  C:\Windows\System\bUTSltG.exe
  2⤵
  PID:12760
- C:\Windows\System\TRsbZLT.exe
  C:\Windows\System\TRsbZLT.exe
  2⤵
  PID:12780
- C:\Windows\System\JLZiLlx.exe
  C:\Windows\System\JLZiLlx.exe
  2⤵
  PID:12800
- C:\Windows\System\ZRNVuSl.exe
  C:\Windows\System\ZRNVuSl.exe
  2⤵
  PID:12820
- C:\Windows\System\aOgxtjW.exe
  C:\Windows\System\aOgxtjW.exe
  2⤵
  PID:12840
- C:\Windows\System\uIPupEm.exe
  C:\Windows\System\uIPupEm.exe
  2⤵
  PID:12860
- C:\Windows\System\mvLGYIE.exe
  C:\Windows\System\mvLGYIE.exe
  2⤵
  PID:12880
- C:\Windows\System\KEmKMSD.exe
  C:\Windows\System\KEmKMSD.exe
  2⤵
  PID:12900
- C:\Windows\System\mcEShtJ.exe
  C:\Windows\System\mcEShtJ.exe
  2⤵
  PID:12920
- C:\Windows\System\CAXIHKD.exe
  C:\Windows\System\CAXIHKD.exe
  2⤵
  PID:12944
- C:\Windows\System\iEybyOU.exe
  C:\Windows\System\iEybyOU.exe
  2⤵
  PID:12964
- C:\Windows\System\YsSpmiW.exe
  C:\Windows\System\YsSpmiW.exe
  2⤵
  PID:12980
- C:\Windows\System\saqSwpK.exe
  C:\Windows\System\saqSwpK.exe
  2⤵
  PID:13000
- C:\Windows\System\wxCasKw.exe
  C:\Windows\System\wxCasKw.exe
  2⤵
  PID:13016
- C:\Windows\System\sEmbrpD.exe
  C:\Windows\System\sEmbrpD.exe
  2⤵
  PID:13040
- C:\Windows\System\ANaHVcR.exe
  C:\Windows\System\ANaHVcR.exe
  2⤵
  PID:13060
- C:\Windows\System\NJERIQZ.exe
  C:\Windows\System\NJERIQZ.exe
  2⤵
  PID:13076
- C:\Windows\System\HfFnxok.exe
  C:\Windows\System\HfFnxok.exe
  2⤵
  PID:5152
- C:\Windows\System\WerIaMM.exe
  C:\Windows\System\WerIaMM.exe
  2⤵
  PID:12308
- C:\Windows\System\bmluRKk.exe
  C:\Windows\System\bmluRKk.exe
  2⤵
  PID:12436
- C:\Windows\System\HOKhMAd.exe
  C:\Windows\System\HOKhMAd.exe
  2⤵
  PID:12692
- C:\Windows\System\DoRhAVx.exe
  C:\Windows\System\DoRhAVx.exe
  2⤵
  PID:12176
- C:\Windows\System\ELHThuW.exe
  C:\Windows\System\ELHThuW.exe
  2⤵
  PID:12796
- C:\Windows\System\iocGuMy.exe
  C:\Windows\System\iocGuMy.exe
  2⤵
  PID:12280
- C:\Windows\System\iMvjGAW.exe
  C:\Windows\System\iMvjGAW.exe
  2⤵
  PID:12896
- C:\Windows\System\bXwhxXl.exe
  C:\Windows\System\bXwhxXl.exe
  2⤵
  PID:1920
- C:\Windows\System\xDTVnoQ.exe
  C:\Windows\System\xDTVnoQ.exe
  2⤵
  PID:1996
- C:\Windows\System\muBHgxW.exe
  C:\Windows\System\muBHgxW.exe
  2⤵
  PID:10924
- C:\Windows\System\vFnpiqR.exe
  C:\Windows\System\vFnpiqR.exe
  2⤵
  PID:10984
- C:\Windows\System\toWDlbE.exe
  C:\Windows\System\toWDlbE.exe
  2⤵
  PID:13112
- C:\Windows\System\yrZSdRX.exe
  C:\Windows\System\yrZSdRX.exe
  2⤵
  PID:12572
- C:\Windows\System\htaZILd.exe
  C:\Windows\System\htaZILd.exe
  2⤵
  PID:11656
- C:\Windows\System\YHegmQl.exe
  C:\Windows\System\YHegmQl.exe
  2⤵
  PID:10496
- C:\Windows\System\qxzcejh.exe
  C:\Windows\System\qxzcejh.exe
  2⤵
  PID:11392
- C:\Windows\System\JOFonus.exe
  C:\Windows\System\JOFonus.exe
  2⤵
  PID:12384
- C:\Windows\System\XSivUtw.exe
  C:\Windows\System\XSivUtw.exe
  2⤵
  PID:12952
- C:\Windows\System\nNujMPq.exe
  C:\Windows\System\nNujMPq.exe
  2⤵
  PID:12344
- C:\Windows\System\TJDisnB.exe
  C:\Windows\System\TJDisnB.exe
  2⤵
  PID:11532
- C:\Windows\System\MRSakce.exe
  C:\Windows\System\MRSakce.exe
  2⤵
  PID:10900
- C:\Windows\System\UvhONzt.exe
  C:\Windows\System\UvhONzt.exe
  2⤵
  PID:4616
- C:\Windows\System\lxEzTaD.exe
  C:\Windows\System\lxEzTaD.exe
  2⤵
  PID:12080
- C:\Windows\System\PQzarnL.exe
  C:\Windows\System\PQzarnL.exe
  2⤵
  PID:13132
- C:\Windows\System\fhrfTBI.exe
  C:\Windows\System\fhrfTBI.exe
  2⤵
  PID:9660
- C:\Windows\System\hPtHeDZ.exe
  C:\Windows\System\hPtHeDZ.exe
  2⤵
  PID:11148
- C:\Windows\System\yrjcncO.exe
  C:\Windows\System\yrjcncO.exe
  2⤵
  PID:11372
- C:\Windows\System\iFLirvH.exe
  C:\Windows\System\iFLirvH.exe
  2⤵
  PID:12648
- C:\Windows\System\gjvXGHo.exe
  C:\Windows\System\gjvXGHo.exe
  2⤵
  PID:11484
- C:\Windows\System\DrRpuNo.exe
  C:\Windows\System\DrRpuNo.exe
  2⤵
  PID:13056
- C:\Windows\System\bIvdwZt.exe
  C:\Windows\System\bIvdwZt.exe
  2⤵
  PID:11332
- C:\Windows\System\uythsGK.exe
  C:\Windows\System\uythsGK.exe
  2⤵
  PID:12552
- C:\Windows\System\YzNvsAT.exe
  C:\Windows\System\YzNvsAT.exe
  2⤵
  PID:10204
- C:\Windows\System\vwXVEjq.exe
  C:\Windows\System\vwXVEjq.exe
  2⤵
  PID:10696
- C:\Windows\System\gxXqPEt.exe
  C:\Windows\System\gxXqPEt.exe
  2⤵
  PID:12508
- C:\Windows\System\TIjgXuk.exe
  C:\Windows\System\TIjgXuk.exe
  2⤵
  PID:11212
- C:\Windows\System\KBFmGQK.exe
  C:\Windows\System\KBFmGQK.exe
  2⤵
  PID:11808
- C:\Windows\System\GsEyUAx.exe
  C:\Windows\System\GsEyUAx.exe
  2⤵
  PID:13008
- C:\Windows\System\dxWRGIS.exe
  C:\Windows\System\dxWRGIS.exe
  2⤵
  PID:12412
- C:\Windows\System\kXiHYbN.exe
  C:\Windows\System\kXiHYbN.exe
  2⤵
  PID:10492
- C:\Windows\System\FVudOtt.exe
  C:\Windows\System\FVudOtt.exe
  2⤵
  PID:10284
- C:\Windows\System\amHDQTg.exe
  C:\Windows\System\amHDQTg.exe
  2⤵
  PID:10420
- C:\Windows\System\lSzkcVl.exe
  C:\Windows\System\lSzkcVl.exe
  2⤵
  PID:11724
- C:\Windows\System\OAkyfsa.exe
  C:\Windows\System\OAkyfsa.exe
  2⤵
  PID:1336
- C:\Windows\System\xABiCyf.exe
  C:\Windows\System\xABiCyf.exe
  2⤵
  PID:11876
- C:\Windows\System\kVNMwfe.exe
  C:\Windows\System\kVNMwfe.exe
  2⤵
  PID:4624
- C:\Windows\System\hlnDXIT.exe
  C:\Windows\System\hlnDXIT.exe
  2⤵
  PID:11884
- C:\Windows\System\LJQyWcy.exe
  C:\Windows\System\LJQyWcy.exe
  2⤵
  PID:4528
- C:\Windows\System\VAWLFWN.exe
  C:\Windows\System\VAWLFWN.exe
  2⤵
  PID:12312
- C:\Windows\System\GlUeDdU.exe
  C:\Windows\System\GlUeDdU.exe
  2⤵
  PID:12720
- C:\Windows\System\rdYpQPL.exe
  C:\Windows\System\rdYpQPL.exe
  2⤵
  PID:12856
- C:\Windows\System\cgFtkAT.exe
  C:\Windows\System\cgFtkAT.exe
  2⤵
  PID:11452
- C:\Windows\System\bgLTgLc.exe
  C:\Windows\System\bgLTgLc.exe
  2⤵
  PID:11556
- C:\Windows\System\ZuvtmLv.exe
  C:\Windows\System\ZuvtmLv.exe
  2⤵
  PID:11984
- C:\Windows\System\ARPlCLZ.exe
  C:\Windows\System\ARPlCLZ.exe
  2⤵
  PID:12140
- C:\Windows\System\HmEHeJx.exe
  C:\Windows\System\HmEHeJx.exe
  2⤵
  PID:12000
- C:\Windows\System\fokaBee.exe
  C:\Windows\System\fokaBee.exe
  2⤵
  PID:12100
- C:\Windows\System\AMJmRJS.exe
  C:\Windows\System\AMJmRJS.exe
  2⤵
  PID:2128
- C:\Windows\System\JACXPzk.exe
  C:\Windows\System\JACXPzk.exe
  2⤵
  PID:10636
- C:\Windows\System\noOnwFa.exe
  C:\Windows\System\noOnwFa.exe
  2⤵
  PID:13024
- C:\Windows\System\ILHrBcD.exe
  C:\Windows\System\ILHrBcD.exe
  2⤵
  PID:12056
- C:\Windows\System\Izncfqh.exe
  C:\Windows\System\Izncfqh.exe
  2⤵
  PID:13284
- C:\Windows\System\TMFVkkH.exe
  C:\Windows\System\TMFVkkH.exe
  2⤵
  PID:4484
- C:\Windows\System\ifZfQSx.exe
  C:\Windows\System\ifZfQSx.exe
  2⤵
  PID:13204
- C:\Windows\System\DzCHtWT.exe
  C:\Windows\System\DzCHtWT.exe
  2⤵
  PID:13068
- C:\Windows\System\fYeQFTZ.exe
  C:\Windows\System\fYeQFTZ.exe
  2⤵
  PID:11536
- C:\Windows\System\cFPfdeX.exe
  C:\Windows\System\cFPfdeX.exe
  2⤵
  PID:11968
- C:\Windows\System\HkJWQSi.exe
  C:\Windows\System\HkJWQSi.exe
  2⤵
  PID:1652
- C:\Windows\System\gHJinqq.exe
  C:\Windows\System\gHJinqq.exe
  2⤵
  PID:11244
- C:\Windows\System\HmQbExu.exe
  C:\Windows\System\HmQbExu.exe
  2⤵
  PID:9240
- C:\Windows\System\IaTRFrO.exe
  C:\Windows\System\IaTRFrO.exe
  2⤵
  PID:9860
- C:\Windows\System\WKlgQxO.exe
  C:\Windows\System\WKlgQxO.exe
  2⤵
  PID:10380
- C:\Windows\System\WpLYWDp.exe
  C:\Windows\System\WpLYWDp.exe
  2⤵
  PID:11548
- C:\Windows\System\GqRpKwq.exe
  C:\Windows\System\GqRpKwq.exe
  2⤵
  PID:9904
- C:\Windows\System\PXWduQy.exe
  C:\Windows\System\PXWduQy.exe
  2⤵
  PID:4876
- C:\Windows\System\BPMjQje.exe
  C:\Windows\System\BPMjQje.exe
  2⤵
  PID:14048
- C:\Windows\System\IUoZRmz.exe
  C:\Windows\System\IUoZRmz.exe
  2⤵
  PID:14064
- C:\Windows\System\hMgknOP.exe
  C:\Windows\System\hMgknOP.exe
  2⤵
  PID:14084
- C:\Windows\System\hFXMMVo.exe
  C:\Windows\System\hFXMMVo.exe
  2⤵
  PID:14104
- C:\Windows\System\LMgKoRA.exe
  C:\Windows\System\LMgKoRA.exe
  2⤵
  PID:14124
- C:\Windows\System\fXHezXK.exe
  C:\Windows\System\fXHezXK.exe
  2⤵
  PID:14144
- C:\Windows\System\JkMWPhi.exe
  C:\Windows\System\JkMWPhi.exe
  2⤵
  PID:14168
- C:\Windows\System\DwToEFf.exe
  C:\Windows\System\DwToEFf.exe
  2⤵
  PID:14196
- C:\Windows\System\FpgCZWD.exe
  C:\Windows\System\FpgCZWD.exe
  2⤵
  PID:14220
- C:\Windows\System\mKGMjJh.exe
  C:\Windows\System\mKGMjJh.exe
  2⤵
  PID:14240
- C:\Windows\System\tnbltlU.exe
  C:\Windows\System\tnbltlU.exe
  2⤵
  PID:14260
- C:\Windows\System\pyQPNQH.exe
  C:\Windows\System\pyQPNQH.exe
  2⤵
  PID:14284
- C:\Windows\System\AkjFwXo.exe
  C:\Windows\System\AkjFwXo.exe
  2⤵
  PID:14304
- C:\Windows\System\ywzzwZA.exe
  C:\Windows\System\ywzzwZA.exe
  2⤵
  PID:12120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_45eg1iqu.02j.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AkTsCWw.exe

Filesize
1.9MB

MD5
ad078a2b7b80e5b28888ee08fd0ac325

SHA1
7ad00aa4703c0d2fa6ec86c1944d0f363ee4dcf0

SHA256
b1b5fb211bf94ef809c99347003d158f416825d670c4d2eb826b5d152e8a08cd

SHA512
32ef2c1a479c3abcf0e26db7bf33097321f802c28a328ebc849a0ba7735c694f9611a8a29b84de6106e0488242634b431c9715608df6ed416665e8a697d30f58

Download Submit
C:\Windows\System\CuDSzKv.exe

Filesize
1.9MB

MD5
1351d2b150a879e2eb2f00d07735297c

SHA1
cbc2de03733b6790202465860c3079c7f890c9f3

SHA256
63ff488cf770de7df2ff33191fcdcff6b651f33c4e502f87446220dd422fcf7c

SHA512
f1e417cbfa9b5aa9489b7549b3b06a38201f9f2e0aac67ddd9a6d235a73d290fea7c9a5facb0b8f779db159da9ec389f62407b35238ccff9921ba9e33a51e52a

Download Submit
C:\Windows\System\CwvvFLz.exe

Filesize
1.9MB

MD5
8a49a346e2b0dd989d0c41f2d8e1916f

SHA1
a24aedf14b997c3fb8fcc0514d52a2a6727c2108

SHA256
d112f2bbe5860e246f30755472a358703fa0284e27f65599ec28703d97cf4a0f

SHA512
6511e09ed4acb8fffc438d9d2d997b147f1c73c3e48bb4440dd66e463dc6c92aa85c60a8b392165a983b2f1247a72fa08fca1d1927b582f46a277a6d93f52fd1

Download Submit
C:\Windows\System\DNEvHNT.exe

Filesize
1.9MB

MD5
2efef74247eac1dde167c11b9d6eabd9

SHA1
156a4f5b0691322cc9e9a9e8c09c5bac3331bda5

SHA256
008e3731621058826c6096b4510a593cf2c15420bb8b68de20354e2a696da27e

SHA512
0455b71f4d044be5998918097bb9268cb0426b7db1315baa7b87cee94c73ac229161fe7ea1cc45c14fdbfe388f3f67ddd530b519342828ad09cf913bd956d823

Download Submit
C:\Windows\System\DYsWXNz.exe

Filesize
8B

MD5
9e16362b7eef9ff59cf4576b688fec20

SHA1
58714a79316bdda8b345ca47c2a7e8087e024871

SHA256
cb157cd47cb9ddacb8fa194262e9cc1364ca68490d93ad041938e77ef90ead7c

SHA512
53056e2e9a952538e1c61538c2bad2166adaf2d4a03d0e97e211329cd7f80967988343aa21690b08c2f1ad6d3fabfdc6095392f57b127d575de79d724d1a09de

Download Submit
C:\Windows\System\EEZuDnD.exe

Filesize
1.9MB

MD5
e3839e62b6d3cd36b3783248d50921cd

SHA1
268d3a847b7382a2cd86d5ccf382c2bed7278d34

SHA256
b9674088c0b6f3a9d41ca6ccd9f260d5356a81145fde46fd5e4d5b872564332e

SHA512
490052dfcd7f7958b3f03c05749128a0ebb3923725c81153893a1746e5232b29db7ec89a434f5656072b7b5ae9e8385a42bd2be51ca1d03998de22e360234be2

Download Submit
C:\Windows\System\HPHhvOc.exe

Filesize
1.9MB

MD5
cbae860627b699ba595df4d377033f44

SHA1
e674bc19b9b0038e4549e99aeb9ce6b4067168d0

SHA256
7c78e3ea32e15295c1c54f846b471b75d603c3484c2be1f7c1d45b937a70654a

SHA512
a038b2346cff5fbef59acc72c3f45fb48946d6e3fbdf62544f9e9823a5b9fdb85d5353d1fcab49f4a4c9910a3cb5b9319b7967be6a5d9ffe83516492663386ef

Download Submit
C:\Windows\System\HxcVZpe.exe

Filesize
1.9MB

MD5
49ee10a7186ba215e8ed2fa2028e98e5

SHA1
f27523b3edce1b2b91073d7a5b74903f0826ace8

SHA256
2edbef09da0de62e0d43d621607f6109279132e8a515629d73dfdf567ae66f85

SHA512
514cea846be91205a5f226f8423b2ba0be5d5c481e3b0f5c09494c50d1defde7ede40efd5bb512f2ef8bb397775a2e5886b01103b446bbde46c7f7bc06886ae4

Download Submit
C:\Windows\System\JOoLhwH.exe

Filesize
1.9MB

MD5
886e60908f97e4e0e5694a0014a4aa39

SHA1
1f2c2d1994226ab9cfae6d5cb370b085723648fb

SHA256
c5fc25d9b3e4d60f28621e9b7e82b5e521e43af1dbe1d34867769cad189da512

SHA512
a1c767a591fb469f7a66b4b99ae82a8aea7fe5ed9329c76d11f8df7d759b83e24f2b268adfb84675455534362a48bec14b3cdfbeb099c8e43e48ca4951e91bbd

Download Submit
C:\Windows\System\JlfFYTe.exe

Filesize
1.9MB

MD5
8650e70d9adb1af2927e8e82350e45c2

SHA1
960706add2e912a8c069e46970521753517edb50

SHA256
9a967749f91b2167be0029c46cf2c551dc1ce173bae41e24366d2fa70ae4b06c

SHA512
0e5e4598d2855155baf5f57fb36c88394985143e71565b961478c10a52fcd30ccec00552a8eb28dd04ddff0fdcd3fc79920af1adb2d796a99e5cdacf9b736f45

Download Submit
C:\Windows\System\KRBMIdR.exe

Filesize
1.9MB

MD5
e53a808a66249635e50e3553f4611e4f

SHA1
7c5195dfe3f0472f18631c801674452838c2d1f4

SHA256
37ba3e539496ffc12bb0ddc69397fed85bc7826cd53d29b72cdc9075858c8cbe

SHA512
6f24a37101c45280eb9b3ac1727718024bfa004dea75277bb1ee3c430f8adbe5da18c83517aff03d3df2457b34d26f64d54618be86593bffdf900fb94038a439

Download Submit
C:\Windows\System\KbvNGiP.exe

Filesize
1.9MB

MD5
3f07c0697fcf2430cabc1f19653ec8ad

SHA1
17b1519b8a632e5cd5ae49c1ca37b9556e5a906c

SHA256
9c306ecef8a46d10613c013c0c0639091cf0e2ed62db414c244ae939b8c2df61

SHA512
700fb1c3e2785c63e37d5cc3004574068a1f1f3a63e1a8cec41f7e0ed6f51f7f91554322ec1ce75ae04101ad0734d8e694b612bf4cea83dbb64721ad935d4598

Download Submit
C:\Windows\System\NIWZuzK.exe

Filesize
1.9MB

MD5
f639f8878a6af1a65ebc56c1cdd1f102

SHA1
3f0deb0808774470f0839a915a5220a9c3f10855

SHA256
2fe48e4b1a97bacc78bb1dcc3f28ff7244fe35fcfd28d5c354816f7de438d511

SHA512
ae790396c8e23d9fe27d0602ea25dba75a24de55134f58c3e73a020867eeebb4847f02ddc46740c72773985e41f06c1eaa1fbf286b30ed5ba6ca6db5bede394c

Download Submit
C:\Windows\System\OfFeqXp.exe

Filesize
1.9MB

MD5
e0ed431f941afa3f023eb056a429247a

SHA1
473e757de8aaabcb1fa841c47bff1fd696dd61f7

SHA256
ea48fc7de5cf54caec449ffc5ad2f1a306d71ef8a1e9dcb1eb9955a1db495429

SHA512
1df25efcb0150a79cd38e21f80e39e60c0ce93b5ccfe5f7fe227e55d0edeea1f8d4e881f179bb7bd182d2b019d0c4de5270a973b2fd009c2ba6d8cacd362a835

Download Submit
C:\Windows\System\PYUxgtw.exe

Filesize
1.9MB

MD5
6d68f60207d1c7dca182db249e7c21b6

SHA1
0e8d6bc6fcd2a78cf92d84435d055d05b51c93a3

SHA256
ff1b6c0b941d2c82e591a16cef1b30b434c774c7ed21c167139914825d8df6a9

SHA512
1050d0d242667e2a45f0e0176d08cf3c89adde9dae5fa7186d8f2e9a5f184aa5308c4e92ed5adeaeb4402b30a7b6dd10d6f67f5976fbdaf15b59d9027a4fb7e8

Download Submit
C:\Windows\System\RKOcIeg.exe

Filesize
1.9MB

MD5
70222ca771fd767a8f2fb541564853d5

SHA1
97071478d1c627e72b9fb16e9669e8ef58f1ca6f

SHA256
d7eb203119bcd045dbd2949e39eb7a042333ae572d356c8eca21606d176b8339

SHA512
16ac32044311ae35cbd2ec91dfedf3c69c0dfa61e84a6b682998ce2970300d2261c866b16b33c5dfb37cb9f8c882e71edafca17307e548e6fd2452f0538b53a2

Download Submit
C:\Windows\System\RMkcscx.exe

Filesize
1.9MB

MD5
fd71cd8de32ffcc294b68614aa889324

SHA1
c1c7ade2eecdc77b7926aa81724e6a5f1c2c93e5

SHA256
0b8ac66ce49ce7b86d8020c9f98e2739d26c8ebe77ad872e527aade03e6eb933

SHA512
6b941a2bbbe22a70fc2ca1b4093af8a22754317c79f5066d01f81863d32f906b29943329e02715d5e57d001ec844f6870f0218732041f13dc47307af8a45121c

Download Submit
C:\Windows\System\RuRWwPb.exe

Filesize
1.9MB

MD5
128e7c76f3cb0b884272ab1843d26b8f

SHA1
9235053326f668f7edb5d45d3bc882d0f262c10f

SHA256
cc4f3925c285323655aa977898a97b3f976638567e4a1234811073c5be2018ac

SHA512
e08051a8fb8aa747205cd3d6c6c76a0dbf1866adb9650a7d24be48d6336b084453baf046f83cf59a6c285d87ba0a1edc824b9a48cfacf98e3ce526f1646eda4a

Download Submit
C:\Windows\System\WDBLHYT.exe

Filesize
1.9MB

MD5
59c23a56063f02a382d9b03c2bedd137

SHA1
725da405238a4bd84a0c636a4ba51cd019d4b19c

SHA256
ea10254c98409ccd042c6d9e80ca7dbe71dfc4562046a746d6aa230464d38673

SHA512
e1973b221ee52b8a115e9930336e4ff7fedcf621425fef0f63ae9789773de8561b32633c548949e2f47b699c8030e8c25c39c0575b9afa807b2c873990971db5

Download Submit
C:\Windows\System\aLDlYTm.exe

Filesize
1.9MB

MD5
6538e103cba3890a746a09bec01c97b9

SHA1
f60fee9ad2b4e3283031e43c2584ebe7a50cdb8f

SHA256
ee910c36268ee31a03a87516d462ddf4a45c86b5c708a68727867f1fde34e94e

SHA512
6afce7edb576bcf336fc61a41cffac52e6f5b5f43c89b055fcb4cc08c62d22cc3373ad4218e9042345f494f72ea9a81308c54f618910a631f7585f7d23e14fd9

Download Submit
C:\Windows\System\clDRwEC.exe

Filesize
1.9MB

MD5
67163c0b8981dc7f60dcb755ea14d748

SHA1
00ab7a790fc7c6ec28907b6bc6cc236f022e6217

SHA256
98314814c6d10f3d5fe481d1e0f6e6cfff3f8ba4ed5a06d9e27be4d3b7046578

SHA512
b3eec2628476348b16a52c01195942118cecb32ddcf3d0ea7e83b1aacf000a3cc70a2c52a8c296f1084897e6a0eaea71e3ca806cb2481b23cc959c331b2d92b6

Download Submit
C:\Windows\System\dJkwJRp.exe

Filesize
1.9MB

MD5
f87a46eb5d5bda9db9162b00818132b9

SHA1
f39efbfd9743ea317f537c7f5f08f77da70f83e8

SHA256
90f68149f2cca7e850e7188657472221575c64710b4303adc22556f78ac6197b

SHA512
d1fc8be5795eddaf4de3100e2c11a378644f3eb5e0afdfa14a34266fa70404f2697f5aa62041489c4a52a29ba741f5e5b811679584f3e5ca740c19f60360ae06

Download Submit
C:\Windows\System\eAnRpyJ.exe

Filesize
1.9MB

MD5
7900804275cb7ee8d939a063778d0ae0

SHA1
4a33d6dea8b910016f66920427fd7adb3d852534

SHA256
73f0da11700d8d456cfa3e7021926d338b6cde3685164b02b95bbda13636c3cc

SHA512
d804c0f39661df2afb656b1d9f8c508fd98a02fdde64e3906844edecc5853a66340e63452670600a762513bc43bbe5f5f632b49c15805161bc112a6222516fa2

Download Submit
C:\Windows\System\hOXWbvG.exe

Filesize
1.9MB

MD5
49685ccae05ef34e007903af2ccf7b2b

SHA1
2da1762a36b361a554c2f6f0bf4414cb626e4057

SHA256
72ed7f0ce8ea9ca6ec472b31998672817a2c2eab78dfc88f4596e663011b21c8

SHA512
eddd36dd01c9957b9ebb2d2addc09ae4663a22009b848ab9c3705a9c77df676695b150da34e058019bafb0498a5e1bde8dedb6c5ee78e667c692b50b06c55762

Download Submit
C:\Windows\System\iSldOyz.exe

Filesize
1.9MB

MD5
b7f5de20579935a803f16325310842f2

SHA1
543e2fd940477adb75f066b06305985ae9b08ed6

SHA256
cf9ef688e613238b394054a1086228f502506c190c329fecd8b8e2dd295ac424

SHA512
847fb80255d442afe63c28505a1503f4a884058acfffbb171d38725d5e37e8f694ce0a64f450929756e7e2d013837762715ed4e9da72897fe017069d8b449c86

Download Submit
C:\Windows\System\jDQLnNg.exe

Filesize
1.9MB

MD5
b90944b8a2909f070d1c109d7a2236ba

SHA1
a9ec683e6f29621209b622c3fe5eb4db44745a18

SHA256
672ee96ada55f4b2e11a9c0686b00eac6558dfa39035848a8c0b54e917fb20ab

SHA512
40c04c3350d04a03781f6c60d5bc03739daa779ce34296bba715c939540284569f8b6d2d4aac6aed7e5d67983dcc4bebe715ec8ff2843062e034f7390c986e3e

Download Submit
C:\Windows\System\kgFPMrr.exe

Filesize
1.9MB

MD5
1529d8a2c6133caedf7d87f1a95061c9

SHA1
bc3c990cc602d7816f91e4a47eb5abf5cd245ae8

SHA256
7619f95ae4c9121360280441a876d97bfcd07304aaa0cf6c2f44db4f60d48600

SHA512
3e24b6b55c6d57e7b6ea62bad79ff220b29a334eaca797079374159f714f76a486202935faef8f8d66945103c536a8da98c2edd945c528f8b20bd547e45fea1a

Download Submit
C:\Windows\System\miPDGmu.exe

Filesize
1.9MB

MD5
f6dc424c19328eb024950464b28b8938

SHA1
5d82326d9e1c450b38493a1b066d2a9f37c5c526

SHA256
3fd84a3d58cf48e95079855c156a1cf76d959b91f809aa0b17dafb8dc9dc35e6

SHA512
44ac5d4eb7990fb61c8b87c87d02f5977810f140996fd3eaa04ca959946e02091ebef005591da3b2d132ff6f3de85e50e0a6051f0e35a81f18b38644de3c2d4c

Download Submit
C:\Windows\System\nonCTti.exe

Filesize
1.9MB

MD5
1c3853ec452122c7f3ab04874e91e689

SHA1
ae9085b7b04b5014608a6b87317a739f428e8bc9

SHA256
53f81f863e0bebb89a623a7db53e290dd0aab8936ef2e3d7d78548d4036d5e45

SHA512
84c95cddec4ec1b60a3ee91ac961692cfed270e5acfe4624cf346ed497f156c50674c977fe5b46c2d9d8163b3596c76f263c7485157418a87286f932c915a17d

Download Submit
C:\Windows\System\osCDROX.exe

Filesize
1.9MB

MD5
0cecf8dce0bd082af096920110bb4861

SHA1
bf245086cb3e8ab61368cb9970f5685ed87ed388

SHA256
41d14821e61257e236293864443065e16ff8b9e6cbc574b13d544c28948b39b3

SHA512
85cfcc0db3315ddf84201a04396db3e9b91186db891150e12494e1beb43c59c1398c36882431e3033611e3dfed938d13c0efe4eaa5b292329d4586710510a158

Download Submit
C:\Windows\System\ovbjuqX.exe

Filesize
1.9MB

MD5
dcb9e67e55269078409878e2f232fa6b

SHA1
a63f1ed769dcec3c98dc2a7e2b7800a3b33184a6

SHA256
c8f4a3322dbc04f01417ac423eab1c6d065841be4274eb825984263a3add2ec8

SHA512
66983a761babce0e3c1b98e8ff16d144e07bb175c0b7887944081e4811865a5bee5b6efa7a5a2ff895a3c3988498aceeeb7e1e2c551c24209f98824454c80519

Download Submit
C:\Windows\System\phzuFfu.exe

Filesize
1.9MB

MD5
e07bab6f3195f5c35e418c7fee62dac7

SHA1
58393726c9e0c905aae3f330e7d95be04434f743

SHA256
b4780d021dd79fb276b4e85ab85207a4c157e6cbd87edd0662b64531a9b56630

SHA512
4eac70db712b942a933bc3f289f88710f14b3d9507ea8f52b35cf8057c9ce186f0aa6cf92eae2e3bc6d5c51edf0cb4ecea6a0a78e89c082c4ec74ec2e151c285

Download Submit
C:\Windows\System\pszZjeO.exe

Filesize
1.9MB

MD5
abb013c8b8eaf06a5104c2b8af07a075

SHA1
f99b9839c828c5eb4c9703e596c7b09b243a97bf

SHA256
a0714adfd99e1d92dcf8e61ccd33ac6436634d13ba3544dbd926c13d74cd9991

SHA512
abf8ed9252a75c863aedbccf7962c2ab5750da558c884bd9e26f9320f5ac9ef05bbba76fd7169ee2e17384078b13845c27f827397e6ce21b71fe45a8f5ba6bce

Download Submit
C:\Windows\System\qozezUa.exe

Filesize
1.9MB

MD5
955164dd55c7f9dcf2beaa7d90a7269e

SHA1
882e15d225a56669ed32741b6fddae8d4f458c1c

SHA256
8062fa275b5979988ecc67c7904dc71ab2cd9db62bb1e9d1c0c08565e4362fc8

SHA512
b0ee23c2b117b0c7141ef06fda20da154ba8e20f9c548735a31bd5862960a65114995843538aaa800ec7326971ce4930831693c34c6376bafdc2c49235625748

Download Submit
C:\Windows\System\rYFrRDL.exe

Filesize
1.9MB

MD5
a6808d3f2a39ed917fdc987300c82389

SHA1
3a98b7b60cba8c00299cc1a990f18d726bf7abcb

SHA256
69cfc3b656eed114d0c6441b181371850cce38acbfdd250e6546637cab2d1261

SHA512
f86e4b3916d7f841409f56977a2c6c4cb15a42b8d0907b4cbce6322ad37e84a24452e4b6d8f9d7cdbde92a754fd12d480da0f9fd1a5d24b7665df82880776bbf

Download Submit
C:\Windows\System\sBXFQnv.exe

Filesize
1.9MB

MD5
3f7d32e34e872aacf126e899b3e38dee

SHA1
cb045dc7ee8c1ff957dd28246f2124afd4710840

SHA256
729c93ae323c5f90328f097f23b548cc6c542e2ad5282c3c1d8702090aaec50d

SHA512
2620c21803d5ce37a81fc7388aa03f98c2a2a385dcd6f6709d6bd6a92ba2fd0b7ae2d1d981d8883ac6b5821d6aa0221df7a1b7f1f48d3d756b246376a02bbf22

Download Submit
C:\Windows\System\sEevKTo.exe

Filesize
1.9MB

MD5
af8d22234fa93524cada0d3af772505a

SHA1
fa1358c2725c4b2fd2f7001e40593aaac071bd5a

SHA256
ea7c99df2e90eecba1532c063658027a9cd3e2538b81e9444b107bd0c3cab605

SHA512
099607f4e921f0da86b6a541daf491b9ef3371ed442d711391ba2d66ce4fe615e81f6f9ce02cb2091aaa7494c6289497cbffb74b94673c6e2a3c644fb0bf707f

Download Submit
C:\Windows\System\vkujThB.exe

Filesize
1.9MB

MD5
b6992cd0df745460cfa6f8fd1568b842

SHA1
6a998942f5c6e19edd5a0827ee61ade02e294931

SHA256
a6c2d7cf95b65e89a778f35d3fd8afe056ed376a7a01b2b0019c0150ede7ad35

SHA512
417bd60737b78da6fd0f7788354233b2498671efd05746bf37e4f9adce1f5b70ba05c934d705c425111145c33a771941d566c79bfe232fce702ac0a90d626de7

Download Submit
C:\Windows\System\yLwrlVo.exe

Filesize
1.9MB

MD5
d7c4036cd0b1b9ab6e3ad1378df3f014

SHA1
e56a941cb07197a57b41dd03b9f4b2f750cfa64d

SHA256
e46eb0632a8a102ecfa3ea09fc97f2f24af9c3897eefd2982a36f81abc0e6e15

SHA512
94ce722a883a9f4f5d5c301d694044cf49a6b682a463755c6b14710cc4f82193545e994d6a4d932782f42cd05b1eda270038bb6ce181b9d381785db16e72e325

Download Submit
C:\Windows\System\yseWQQW.exe

Filesize
1.9MB

MD5
575dd9f6642f8f34cb6a19f5122cd734

SHA1
ba4d2299ab48ff1f098a93b335f24f525be9100c

SHA256
0a2ea698b6abfe394c77a74e1952340d75cf35853f15ac246587639e1eeefdd6

SHA512
59303104b3593e738ce4fa7ce9379f8bc5b70aa79acf56bd3342ac3541acf1aad0388e006e49b5f96fd6ea99800802c3e8a9844e1a4269153e16e40729abce9d

Download Submit
memory/1040-565-0x00007FF7D0FF0000-0x00007FF7D13E2000-memory.dmp

Filesize
3.9MB

Download
memory/1040-3045-0x00007FF7D0FF0000-0x00007FF7D13E2000-memory.dmp

Filesize
3.9MB

Download
memory/1088-3031-0x00007FF7712D0000-0x00007FF7716C2000-memory.dmp

Filesize
3.9MB

Download
memory/1088-163-0x00007FF7712D0000-0x00007FF7716C2000-memory.dmp

Filesize
3.9MB

Download
memory/1192-415-0x00007FF7AF190000-0x00007FF7AF582000-memory.dmp

Filesize
3.9MB

Download
memory/1192-3038-0x00007FF7AF190000-0x00007FF7AF582000-memory.dmp

Filesize
3.9MB

Download
memory/1212-576-0x00007FF6D8FC0000-0x00007FF6D93B2000-memory.dmp

Filesize
3.9MB

Download
memory/1212-3023-0x00007FF6D8FC0000-0x00007FF6D93B2000-memory.dmp

Filesize
3.9MB

Download
memory/2120-3050-0x00007FF7B7900000-0x00007FF7B7CF2000-memory.dmp

Filesize
3.9MB

Download
memory/2120-567-0x00007FF7B7900000-0x00007FF7B7CF2000-memory.dmp

Filesize
3.9MB

Download
memory/2332-575-0x00007FF776730000-0x00007FF776B22000-memory.dmp

Filesize
3.9MB

Download
memory/2332-3055-0x00007FF776730000-0x00007FF776B22000-memory.dmp

Filesize
3.9MB

Download
memory/2408-3025-0x00007FF642A00000-0x00007FF642DF2000-memory.dmp

Filesize
3.9MB

Download
memory/2408-277-0x00007FF642A00000-0x00007FF642DF2000-memory.dmp

Filesize
3.9MB

Download
memory/2416-3039-0x00007FF647CE0000-0x00007FF6480D2000-memory.dmp

Filesize
3.9MB

Download
memory/2416-572-0x00007FF647CE0000-0x00007FF6480D2000-memory.dmp

Filesize
3.9MB

Download
memory/2448-574-0x00007FF7541F0000-0x00007FF7545E2000-memory.dmp

Filesize
3.9MB

Download
memory/2448-3057-0x00007FF7541F0000-0x00007FF7545E2000-memory.dmp

Filesize
3.9MB

Download
memory/2612-532-0x00007FF7955F0000-0x00007FF7959E2000-memory.dmp

Filesize
3.9MB

Download
memory/2612-3033-0x00007FF7955F0000-0x00007FF7959E2000-memory.dmp

Filesize
3.9MB

Download
memory/3004-325-0x00007FF68BA10000-0x00007FF68BE02000-memory.dmp

Filesize
3.9MB

Download
memory/3004-3028-0x00007FF68BA10000-0x00007FF68BE02000-memory.dmp

Filesize
3.9MB

Download
memory/3412-1-0x000002904A830000-0x000002904A840000-memory.dmp

Filesize
64KB

Download
memory/3412-0-0x00007FF61B9F0000-0x00007FF61BDE2000-memory.dmp

Filesize
3.9MB

Download
memory/3476-3024-0x00007FF6F3F70000-0x00007FF6F4362000-memory.dmp

Filesize
3.9MB

Download
memory/3476-220-0x00007FF6F3F70000-0x00007FF6F4362000-memory.dmp

Filesize
3.9MB

Download
memory/4536-3035-0x00007FF71E7A0000-0x00007FF71EB92000-memory.dmp

Filesize
3.9MB

Download
memory/4536-569-0x00007FF71E7A0000-0x00007FF71EB92000-memory.dmp

Filesize
3.9MB

Download
memory/4672-3051-0x00007FF6A9D50000-0x00007FF6AA142000-memory.dmp

Filesize
3.9MB

Download
memory/4672-571-0x00007FF6A9D50000-0x00007FF6AA142000-memory.dmp

Filesize
3.9MB

Download
memory/4744-568-0x00007FF742510000-0x00007FF742902000-memory.dmp

Filesize
3.9MB

Download
memory/4744-3043-0x00007FF742510000-0x00007FF742902000-memory.dmp

Filesize
3.9MB

Download
memory/4752-221-0x00007FF68F0E0000-0x00007FF68F4D2000-memory.dmp

Filesize
3.9MB

Download
memory/4752-3017-0x00007FF68F0E0000-0x00007FF68F4D2000-memory.dmp

Filesize
3.9MB

Download
memory/4760-3065-0x00007FF6B8C80000-0x00007FF6B9072000-memory.dmp

Filesize
3.9MB

Download
memory/4760-570-0x00007FF6B8C80000-0x00007FF6B9072000-memory.dmp

Filesize
3.9MB

Download
memory/4772-573-0x00007FF79A270000-0x00007FF79A662000-memory.dmp

Filesize
3.9MB

Download
memory/4772-3064-0x00007FF79A270000-0x00007FF79A662000-memory.dmp

Filesize
3.9MB

Download
memory/4904-15-0x00007FF781F70000-0x00007FF782362000-memory.dmp

Filesize
3.9MB

Download
memory/4904-3019-0x00007FF781F70000-0x00007FF782362000-memory.dmp

Filesize
3.9MB

Download
memory/4952-472-0x000002CD078A0000-0x000002CD078C2000-memory.dmp

Filesize
136KB

Download
memory/4952-116-0x000002CD1FAD0000-0x000002CD1FAE0000-memory.dmp

Filesize
64KB

Download
memory/4952-88-0x00007FFF6E0A0000-0x00007FFF6EB61000-memory.dmp

Filesize
10.8MB

Download
memory/4952-577-0x000002CD1FAD0000-0x000002CD1FAE0000-memory.dmp

Filesize
64KB

Download
memory/5068-413-0x00007FF7207A0000-0x00007FF720B92000-memory.dmp

Filesize
3.9MB

Download
memory/5068-3030-0x00007FF7207A0000-0x00007FF720B92000-memory.dmp

Filesize
3.9MB

Download
memory/5080-129-0x00007FF63FDB0000-0x00007FF6401A2000-memory.dmp

Filesize
3.9MB

Download
memory/5080-3015-0x00007FF63FDB0000-0x00007FF6401A2000-memory.dmp

Filesize
3.9MB

Download