xmrig | c9598cdc5354004aa176bff3fb1c8b194e5e245308d761751704545221994000

Analysis

max time kernel
9s
max time network
40s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01/05/2024, 12:44

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
Size

2.2MB
MD5

0bd3dd647e2f6d48e6aac708cb7b8e8c
SHA1

9fe368a173aa80cd8b11a2bc336a3e1a11d6887b
SHA256

c9598cdc5354004aa176bff3fb1c8b194e5e245308d761751704545221994000
SHA512

b913c6843c86e7d589238d7e063d5336532359b0c36e3b98d991f12eb449d2530245c19a24927969ee98ea6a6b851fa8a896a562da7369777b393bddc75c27de
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qr8+PX:NABi

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 21 IoCs

miner

resource	yara_rule
behavioral2/memory/2140-250-0x00007FF650B80000-0x00007FF650F72000-memory.dmp	xmrig
behavioral2/memory/3344-292-0x00007FF7BB2E0000-0x00007FF7BB6D2000-memory.dmp	xmrig
behavioral2/memory/2020-327-0x00007FF630FF0000-0x00007FF6313E2000-memory.dmp	xmrig
behavioral2/memory/3288-331-0x00007FF7CF8B0000-0x00007FF7CFCA2000-memory.dmp	xmrig
behavioral2/memory/4532-342-0x00007FF77DAD0000-0x00007FF77DEC2000-memory.dmp	xmrig
behavioral2/memory/1752-345-0x00007FF644260000-0x00007FF644652000-memory.dmp	xmrig
behavioral2/memory/832-344-0x00007FF62BFD0000-0x00007FF62C3C2000-memory.dmp	xmrig
behavioral2/memory/2544-343-0x00007FF7D1070000-0x00007FF7D1462000-memory.dmp	xmrig
behavioral2/memory/3308-341-0x00007FF7CE930000-0x00007FF7CED22000-memory.dmp	xmrig
behavioral2/memory/736-330-0x00007FF689F90000-0x00007FF68A382000-memory.dmp	xmrig
behavioral2/memory/2620-329-0x00007FF728400000-0x00007FF7287F2000-memory.dmp	xmrig
behavioral2/memory/5088-320-0x00007FF790E80000-0x00007FF791272000-memory.dmp	xmrig
behavioral2/memory/2204-291-0x00007FF6E2B40000-0x00007FF6E2F32000-memory.dmp	xmrig
behavioral2/memory/2628-266-0x00007FF731F00000-0x00007FF7322F2000-memory.dmp	xmrig
behavioral2/memory/3292-264-0x00007FF736A30000-0x00007FF736E22000-memory.dmp	xmrig
behavioral2/memory/1112-224-0x00007FF6DD990000-0x00007FF6DDD82000-memory.dmp	xmrig
behavioral2/memory/3080-202-0x00007FF6E02A0000-0x00007FF6E0692000-memory.dmp	xmrig
behavioral2/memory/2696-152-0x00007FF75D1B0000-0x00007FF75D5A2000-memory.dmp	xmrig
behavioral2/memory/3504-117-0x00007FF67E550000-0x00007FF67E942000-memory.dmp	xmrig
behavioral2/memory/2672-85-0x00007FF623720000-0x00007FF623B12000-memory.dmp	xmrig
behavioral2/memory/1588-61-0x00007FF64FC00000-0x00007FF64FFF2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	1392	powershell.exe
8	1392	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2544	IaARqqG.exe
1588	SckxTCu.exe
2672	nggVKlp.exe
3504	xsrtCBD.exe
2696	cdICiMS.exe
3080	rFsSKMd.exe
1112	XCTwljs.exe
2140	vrlYXXt.exe
3292	UPyHmnU.exe
2628	zlXoHsx.exe
2204	WhifpRE.exe
832	GNuArsz.exe
3344	JdbrInN.exe
5088	boPihLl.exe
2020	GPqWcUv.exe
2620	IcKvfVm.exe
736	sOpkwel.exe
3288	wRQbyuY.exe
1752	XRAODSh.exe
3308	SKxfrFu.exe
4532	wWySrok.exe
4536	gGSLeOS.exe
3956	BCyHhmc.exe
5104	wqpKykb.exe
3412	ikWkbLd.exe
3304	qzHXyxn.exe
1200	CctGYDI.exe
756	YIickxh.exe
5096	bUCgxgg.exe
3116	ArHobuz.exe
4712	himTJgE.exe
4244	HclAqlD.exe
512	bBUlOcw.exe
3812	sutpwMO.exe
4868	WFAuVuo.exe
4988	dmvLBDR.exe
3852	fglAeVl.exe
3556	hafrHOB.exe
2480	uASssTX.exe
988	YjdqUng.exe
4160	OLlfhDX.exe
1648	ypXARwD.exe
4660	XcDBsDE.exe
4944	qHbtBYW.exe
3724	DRjcMhu.exe
3088	dqGcFix.exe
2324	QPWxczV.exe
2772	qrdckGu.exe
4168	eYrlRJI.exe
4688	MYXIxni.exe
3672	zHQdFop.exe
1352	ySmzbbM.exe
224	zYXAQxv.exe
2164	lpOIAfO.exe
4388	UokDqHB.exe
4380	UpQfcEy.exe
1072	JIjLVRn.exe
3524	WKlXcyL.exe
3568	leWBiih.exe
3964	ZJSmtRO.exe
2208	zlRsnwK.exe
2760	MhuGSFu.exe
3496	aitFyMM.exe
1564	JEfCzDv.exe

UPX packed file 59 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1416-0-0x00007FF638310000-0x00007FF638702000-memory.dmp	upx
behavioral2/files/0x000c000000023b89-5.dat	upx
behavioral2/files/0x000a000000023ba8-168.dat	upx
behavioral2/files/0x000a000000023baf-163.dat	upx
behavioral2/memory/2140-250-0x00007FF650B80000-0x00007FF650F72000-memory.dmp	upx
behavioral2/memory/3344-292-0x00007FF7BB2E0000-0x00007FF7BB6D2000-memory.dmp	upx
behavioral2/memory/2020-327-0x00007FF630FF0000-0x00007FF6313E2000-memory.dmp	upx
behavioral2/memory/3288-331-0x00007FF7CF8B0000-0x00007FF7CFCA2000-memory.dmp	upx
behavioral2/memory/4532-342-0x00007FF77DAD0000-0x00007FF77DEC2000-memory.dmp	upx
behavioral2/memory/1752-345-0x00007FF644260000-0x00007FF644652000-memory.dmp	upx
behavioral2/memory/832-344-0x00007FF62BFD0000-0x00007FF62C3C2000-memory.dmp	upx
behavioral2/memory/2544-343-0x00007FF7D1070000-0x00007FF7D1462000-memory.dmp	upx
behavioral2/memory/3308-341-0x00007FF7CE930000-0x00007FF7CED22000-memory.dmp	upx
behavioral2/memory/736-330-0x00007FF689F90000-0x00007FF68A382000-memory.dmp	upx
behavioral2/memory/2620-329-0x00007FF728400000-0x00007FF7287F2000-memory.dmp	upx
behavioral2/memory/5088-320-0x00007FF790E80000-0x00007FF791272000-memory.dmp	upx
behavioral2/memory/2204-291-0x00007FF6E2B40000-0x00007FF6E2F32000-memory.dmp	upx
behavioral2/memory/2628-266-0x00007FF731F00000-0x00007FF7322F2000-memory.dmp	upx
behavioral2/memory/3292-264-0x00007FF736A30000-0x00007FF736E22000-memory.dmp	upx
behavioral2/memory/1112-224-0x00007FF6DD990000-0x00007FF6DDD82000-memory.dmp	upx
behavioral2/files/0x000a000000023bb8-201.dat	upx
behavioral2/memory/3080-202-0x00007FF6E02A0000-0x00007FF6E0692000-memory.dmp	upx
behavioral2/files/0x000a000000023bac-196.dat	upx
behavioral2/files/0x000a000000023bab-193.dat	upx
behavioral2/files/0x000a000000023bb7-191.dat	upx
behavioral2/files/0x000a000000023ba1-188.dat	upx
behavioral2/files/0x0031000000023bb6-187.dat	upx
behavioral2/files/0x0031000000023bb5-186.dat	upx
behavioral2/files/0x000a000000023ba9-184.dat	upx
behavioral2/files/0x0031000000023bb4-183.dat	upx
behavioral2/files/0x000a000000023ba7-160.dat	upx
behavioral2/files/0x000c000000023b8a-159.dat	upx
behavioral2/files/0x000a000000023bae-158.dat	upx
behavioral2/files/0x000a000000023bb3-155.dat	upx
behavioral2/memory/2696-152-0x00007FF75D1B0000-0x00007FF75D5A2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba0-143.dat	upx
behavioral2/files/0x000a000000023ba5-140.dat	upx
behavioral2/files/0x000a000000023ba4-136.dat	upx
behavioral2/files/0x000a000000023bb1-134.dat	upx
behavioral2/files/0x000a000000023ba2-129.dat	upx
behavioral2/files/0x000a000000023bad-123.dat	upx
behavioral2/files/0x000a000000023b9c-118.dat	upx
behavioral2/memory/3504-117-0x00007FF67E550000-0x00007FF67E942000-memory.dmp	upx
behavioral2/files/0x000a000000023baa-114.dat	upx
behavioral2/files/0x000a000000023b9f-104.dat	upx
behavioral2/files/0x000a000000023ba3-103.dat	upx
behavioral2/files/0x000a000000023bb0-133.dat	upx
behavioral2/files/0x000a000000023b9a-98.dat	upx
behavioral2/files/0x000a000000023b9d-97.dat	upx
behavioral2/files/0x000a000000023ba6-90.dat	upx
behavioral2/memory/2672-85-0x00007FF623720000-0x00007FF623B12000-memory.dmp	upx
behavioral2/files/0x000a000000023b9b-76.dat	upx
behavioral2/files/0x000a000000023b9e-89.dat	upx
behavioral2/memory/1588-61-0x00007FF64FC00000-0x00007FF64FFF2000-memory.dmp	upx
behavioral2/files/0x000a000000023b98-71.dat	upx
behavioral2/files/0x000a000000023b95-43.dat	upx
behavioral2/files/0x000a000000023b97-29.dat	upx
behavioral2/files/0x000a000000023b99-26.dat	upx
behavioral2/files/0x000a000000023b96-22.dat	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
4	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\wqpKykb.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\dmvLBDR.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\hafrHOB.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\qHbtBYW.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\dqGcFix.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\ySmzbbM.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\byetuDu.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\GPqWcUv.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\eyOtoNn.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\GNuArsz.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\XRAODSh.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\DRjcMhu.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\UokDqHB.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\JIjLVRn.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\sHambdn.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\UPyHmnU.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\sOpkwel.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\SKxfrFu.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\uASssTX.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\YjdqUng.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\SckxTCu.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\XcDBsDE.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\XCTwljs.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\aitFyMM.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\uPoDRyG.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\mvoVfsG.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\sKmJnMM.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\ZJSmtRO.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\zHQdFop.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\MYXIxni.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\wWySrok.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\ArHobuz.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\HclAqlD.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\sutpwMO.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\lpOIAfO.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\LfShfxm.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\TPRvlHm.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\IaARqqG.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\nnKRYKZ.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\WKlXcyL.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\TJAyZpd.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\rDRaXRS.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\WFAuVuo.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\qzHXyxn.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\YIickxh.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\bUCgxgg.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\leWBiih.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\WCfGnBF.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\IhoFcNk.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\mgtkNdR.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\JdbrInN.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\mJjgkuI.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\gGSLeOS.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\UpQfcEy.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\cdICiMS.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\xsrtCBD.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\WhifpRE.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\IcKvfVm.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\BCyHhmc.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\MhuGSFu.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\JEfCzDv.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\lgSqFBW.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\nggVKlp.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
File created	C:\Windows\System\himTJgE.exe	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1392	powershell.exe
1392	powershell.exe
1392	powershell.exe
1392	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
Token: SeDebugPrivilege	1392	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 1392	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	84
PID 1416 wrote to memory of 1392	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	84
PID 1416 wrote to memory of 2544	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	85
PID 1416 wrote to memory of 2544	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	85
PID 1416 wrote to memory of 1588	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	86
PID 1416 wrote to memory of 1588	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	86
PID 1416 wrote to memory of 2672	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	87
PID 1416 wrote to memory of 2672	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	87
PID 1416 wrote to memory of 3504	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	88
PID 1416 wrote to memory of 3504	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	88
PID 1416 wrote to memory of 2696	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	89
PID 1416 wrote to memory of 2696	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	89
PID 1416 wrote to memory of 3080	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	90
PID 1416 wrote to memory of 3080	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	90
PID 1416 wrote to memory of 2628	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	91
PID 1416 wrote to memory of 2628	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	91
PID 1416 wrote to memory of 1112	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	92
PID 1416 wrote to memory of 1112	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	92
PID 1416 wrote to memory of 3344	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	93
PID 1416 wrote to memory of 3344	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	93
PID 1416 wrote to memory of 2140	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	94
PID 1416 wrote to memory of 2140	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	94
PID 1416 wrote to memory of 3292	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	95
PID 1416 wrote to memory of 3292	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	95
PID 1416 wrote to memory of 2204	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	96
PID 1416 wrote to memory of 2204	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	96
PID 1416 wrote to memory of 832	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	97
PID 1416 wrote to memory of 832	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	97
PID 1416 wrote to memory of 3288	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	98
PID 1416 wrote to memory of 3288	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	98
PID 1416 wrote to memory of 5088	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	99
PID 1416 wrote to memory of 5088	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	99
PID 1416 wrote to memory of 2020	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	100
PID 1416 wrote to memory of 2020	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	100
PID 1416 wrote to memory of 2620	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	101
PID 1416 wrote to memory of 2620	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	101
PID 1416 wrote to memory of 736	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	102
PID 1416 wrote to memory of 736	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	102
PID 1416 wrote to memory of 1752	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	103
PID 1416 wrote to memory of 1752	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	103
PID 1416 wrote to memory of 3308	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	104
PID 1416 wrote to memory of 3308	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	104
PID 1416 wrote to memory of 4532	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	105
PID 1416 wrote to memory of 4532	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	105
PID 1416 wrote to memory of 4536	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	106
PID 1416 wrote to memory of 4536	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	106
PID 1416 wrote to memory of 3956	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	107
PID 1416 wrote to memory of 3956	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	107
PID 1416 wrote to memory of 5104	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	108
PID 1416 wrote to memory of 5104	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	108
PID 1416 wrote to memory of 3412	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	109
PID 1416 wrote to memory of 3412	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	109
PID 1416 wrote to memory of 3304	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	110
PID 1416 wrote to memory of 3304	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	110
PID 1416 wrote to memory of 1200	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	111
PID 1416 wrote to memory of 1200	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	111
PID 1416 wrote to memory of 756	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	112
PID 1416 wrote to memory of 756	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	112
PID 1416 wrote to memory of 5096	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	113
PID 1416 wrote to memory of 5096	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	113
PID 1416 wrote to memory of 3116	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	114
PID 1416 wrote to memory of 3116	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	114
PID 1416 wrote to memory of 2480	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	115
PID 1416 wrote to memory of 2480	1416	0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0bd3dd647e2f6d48e6aac708cb7b8e8c_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1392
- C:\Windows\System\IaARqqG.exe
  C:\Windows\System\IaARqqG.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\SckxTCu.exe
  C:\Windows\System\SckxTCu.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\nggVKlp.exe
  C:\Windows\System\nggVKlp.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\xsrtCBD.exe
  C:\Windows\System\xsrtCBD.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\cdICiMS.exe
  C:\Windows\System\cdICiMS.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\rFsSKMd.exe
  C:\Windows\System\rFsSKMd.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\zlXoHsx.exe
  C:\Windows\System\zlXoHsx.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\XCTwljs.exe
  C:\Windows\System\XCTwljs.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\JdbrInN.exe
  C:\Windows\System\JdbrInN.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System\vrlYXXt.exe
  C:\Windows\System\vrlYXXt.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\UPyHmnU.exe
  C:\Windows\System\UPyHmnU.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\WhifpRE.exe
  C:\Windows\System\WhifpRE.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\GNuArsz.exe
  C:\Windows\System\GNuArsz.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\wRQbyuY.exe
  C:\Windows\System\wRQbyuY.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\boPihLl.exe
  C:\Windows\System\boPihLl.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\GPqWcUv.exe
  C:\Windows\System\GPqWcUv.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\IcKvfVm.exe
  C:\Windows\System\IcKvfVm.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\sOpkwel.exe
  C:\Windows\System\sOpkwel.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\XRAODSh.exe
  C:\Windows\System\XRAODSh.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\SKxfrFu.exe
  C:\Windows\System\SKxfrFu.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System\wWySrok.exe
  C:\Windows\System\wWySrok.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\gGSLeOS.exe
  C:\Windows\System\gGSLeOS.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\BCyHhmc.exe
  C:\Windows\System\BCyHhmc.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\wqpKykb.exe
  C:\Windows\System\wqpKykb.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\ikWkbLd.exe
  C:\Windows\System\ikWkbLd.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\qzHXyxn.exe
  C:\Windows\System\qzHXyxn.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System\CctGYDI.exe
  C:\Windows\System\CctGYDI.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\YIickxh.exe
  C:\Windows\System\YIickxh.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\bUCgxgg.exe
  C:\Windows\System\bUCgxgg.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\ArHobuz.exe
  C:\Windows\System\ArHobuz.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\uASssTX.exe
  C:\Windows\System\uASssTX.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\himTJgE.exe
  C:\Windows\System\himTJgE.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\HclAqlD.exe
  C:\Windows\System\HclAqlD.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\bBUlOcw.exe
  C:\Windows\System\bBUlOcw.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\sutpwMO.exe
  C:\Windows\System\sutpwMO.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\WFAuVuo.exe
  C:\Windows\System\WFAuVuo.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\dmvLBDR.exe
  C:\Windows\System\dmvLBDR.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\fglAeVl.exe
  C:\Windows\System\fglAeVl.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\hafrHOB.exe
  C:\Windows\System\hafrHOB.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\YjdqUng.exe
  C:\Windows\System\YjdqUng.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\OLlfhDX.exe
  C:\Windows\System\OLlfhDX.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System\ypXARwD.exe
  C:\Windows\System\ypXARwD.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\XcDBsDE.exe
  C:\Windows\System\XcDBsDE.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\qHbtBYW.exe
  C:\Windows\System\qHbtBYW.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\DRjcMhu.exe
  C:\Windows\System\DRjcMhu.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\dqGcFix.exe
  C:\Windows\System\dqGcFix.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\QPWxczV.exe
  C:\Windows\System\QPWxczV.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\qrdckGu.exe
  C:\Windows\System\qrdckGu.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\eYrlRJI.exe
  C:\Windows\System\eYrlRJI.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\MYXIxni.exe
  C:\Windows\System\MYXIxni.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\UpQfcEy.exe
  C:\Windows\System\UpQfcEy.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\zHQdFop.exe
  C:\Windows\System\zHQdFop.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\ySmzbbM.exe
  C:\Windows\System\ySmzbbM.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\zYXAQxv.exe
  C:\Windows\System\zYXAQxv.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\lpOIAfO.exe
  C:\Windows\System\lpOIAfO.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\UokDqHB.exe
  C:\Windows\System\UokDqHB.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\JIjLVRn.exe
  C:\Windows\System\JIjLVRn.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\WKlXcyL.exe
  C:\Windows\System\WKlXcyL.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\leWBiih.exe
  C:\Windows\System\leWBiih.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\ZJSmtRO.exe
  C:\Windows\System\ZJSmtRO.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\zlRsnwK.exe
  C:\Windows\System\zlRsnwK.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\MhuGSFu.exe
  C:\Windows\System\MhuGSFu.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\aitFyMM.exe
  C:\Windows\System\aitFyMM.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\byetuDu.exe
  C:\Windows\System\byetuDu.exe
  2⤵
  PID:4668
- C:\Windows\System\JEfCzDv.exe
  C:\Windows\System\JEfCzDv.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\TJAyZpd.exe
  C:\Windows\System\TJAyZpd.exe
  2⤵
  PID:3544
- C:\Windows\System\LfShfxm.exe
  C:\Windows\System\LfShfxm.exe
  2⤵
  PID:1612
- C:\Windows\System\ShUQNFx.exe
  C:\Windows\System\ShUQNFx.exe
  2⤵
  PID:3796
- C:\Windows\System\aVpOjUU.exe
  C:\Windows\System\aVpOjUU.exe
  2⤵
  PID:4912
- C:\Windows\System\WCfGnBF.exe
  C:\Windows\System\WCfGnBF.exe
  2⤵
  PID:3508
- C:\Windows\System\IhoFcNk.exe
  C:\Windows\System\IhoFcNk.exe
  2⤵
  PID:2228
- C:\Windows\System\JJctCLQ.exe
  C:\Windows\System\JJctCLQ.exe
  2⤵
  PID:2412
- C:\Windows\System\TPRvlHm.exe
  C:\Windows\System\TPRvlHm.exe
  2⤵
  PID:5012
- C:\Windows\System\nnKRYKZ.exe
  C:\Windows\System\nnKRYKZ.exe
  2⤵
  PID:1824
- C:\Windows\System\uPoDRyG.exe
  C:\Windows\System\uPoDRyG.exe
  2⤵
  PID:3612
- C:\Windows\System\rDRaXRS.exe
  C:\Windows\System\rDRaXRS.exe
  2⤵
  PID:2656
- C:\Windows\System\mgtkNdR.exe
  C:\Windows\System\mgtkNdR.exe
  2⤵
  PID:664
- C:\Windows\System\eyOtoNn.exe
  C:\Windows\System\eyOtoNn.exe
  2⤵
  PID:3016
- C:\Windows\System\mvoVfsG.exe
  C:\Windows\System\mvoVfsG.exe
  2⤵
  PID:2292
- C:\Windows\System\lgSqFBW.exe
  C:\Windows\System\lgSqFBW.exe
  2⤵
  PID:2420
- C:\Windows\System\mJjgkuI.exe
  C:\Windows\System\mJjgkuI.exe
  2⤵
  PID:5144
- C:\Windows\System\sHambdn.exe
  C:\Windows\System\sHambdn.exe
  2⤵
  PID:5168
- C:\Windows\System\sKmJnMM.exe
  C:\Windows\System\sKmJnMM.exe
  2⤵
  PID:5400
- C:\Windows\System\ysbMTiz.exe
  C:\Windows\System\ysbMTiz.exe
  2⤵
  PID:5420
- C:\Windows\System\kdDpMqo.exe
  C:\Windows\System\kdDpMqo.exe
  2⤵
  PID:3664
- C:\Windows\System\fWwLVTL.exe
  C:\Windows\System\fWwLVTL.exe
  2⤵
  PID:1272
- C:\Windows\System\LimFZbp.exe
  C:\Windows\System\LimFZbp.exe
  2⤵
  PID:5112
- C:\Windows\System\htLwcYO.exe
  C:\Windows\System\htLwcYO.exe
  2⤵
  PID:688
- C:\Windows\System\Nygxvcw.exe
  C:\Windows\System\Nygxvcw.exe
  2⤵
  PID:1064
- C:\Windows\System\fXSaNmc.exe
  C:\Windows\System\fXSaNmc.exe
  2⤵
  PID:2984
- C:\Windows\System\EQtVhWO.exe
  C:\Windows\System\EQtVhWO.exe
  2⤵
  PID:956
- C:\Windows\System\GOBVqdY.exe
  C:\Windows\System\GOBVqdY.exe
  2⤵
  PID:4880
- C:\Windows\System\CjXJsyl.exe
  C:\Windows\System\CjXJsyl.exe
  2⤵
  PID:4028
- C:\Windows\System\OsEDBeR.exe
  C:\Windows\System\OsEDBeR.exe
  2⤵
  PID:1472
- C:\Windows\System\hGSiBop.exe
  C:\Windows\System\hGSiBop.exe
  2⤵
  PID:5620
- C:\Windows\System\yOxuSUa.exe
  C:\Windows\System\yOxuSUa.exe
  2⤵
  PID:5644
- C:\Windows\System\LOnDfAj.exe
  C:\Windows\System\LOnDfAj.exe
  2⤵
  PID:5672
- C:\Windows\System\wjcjVpt.exe
  C:\Windows\System\wjcjVpt.exe
  2⤵
  PID:5692
- C:\Windows\System\nDTBFuU.exe
  C:\Windows\System\nDTBFuU.exe
  2⤵
  PID:5716
- C:\Windows\System\CeoEQye.exe
  C:\Windows\System\CeoEQye.exe
  2⤵
  PID:5744
- C:\Windows\System\BxChlLp.exe
  C:\Windows\System\BxChlLp.exe
  2⤵
  PID:5732
- C:\Windows\System\oSXHRcS.exe
  C:\Windows\System\oSXHRcS.exe
  2⤵
  PID:5776
- C:\Windows\System\KBJltii.exe
  C:\Windows\System\KBJltii.exe
  2⤵
  PID:4088
- C:\Windows\System\SkWmJpB.exe
  C:\Windows\System\SkWmJpB.exe
  2⤵
  PID:5824
- C:\Windows\System\MDAfMCB.exe
  C:\Windows\System\MDAfMCB.exe
  2⤵
  PID:5844
- C:\Windows\System\kwhDEYX.exe
  C:\Windows\System\kwhDEYX.exe
  2⤵
  PID:5860
- C:\Windows\System\efrENOO.exe
  C:\Windows\System\efrENOO.exe
  2⤵
  PID:5884
- C:\Windows\System\fosVBDZ.exe
  C:\Windows\System\fosVBDZ.exe
  2⤵
  PID:5900
- C:\Windows\System\yJLXWkp.exe
  C:\Windows\System\yJLXWkp.exe
  2⤵
  PID:2712
- C:\Windows\System\fRwmVwe.exe
  C:\Windows\System\fRwmVwe.exe
  2⤵
  PID:5932
- C:\Windows\System\NyWOFpW.exe
  C:\Windows\System\NyWOFpW.exe
  2⤵
  PID:5964
- C:\Windows\System\fAThTbA.exe
  C:\Windows\System\fAThTbA.exe
  2⤵
  PID:5988
- C:\Windows\System\ranlGDh.exe
  C:\Windows\System\ranlGDh.exe
  2⤵
  PID:5436
- C:\Windows\System\wmMjpQF.exe
  C:\Windows\System\wmMjpQF.exe
  2⤵
  PID:6000
- C:\Windows\System\ETlRJJO.exe
  C:\Windows\System\ETlRJJO.exe
  2⤵
  PID:6036
- C:\Windows\System\GZBJJaa.exe
  C:\Windows\System\GZBJJaa.exe
  2⤵
  PID:6044
- C:\Windows\System\ILhNHyb.exe
  C:\Windows\System\ILhNHyb.exe
  2⤵
  PID:6072
- C:\Windows\System\QxInWXk.exe
  C:\Windows\System\QxInWXk.exe
  2⤵
  PID:6092
- C:\Windows\System\EzHvuzx.exe
  C:\Windows\System\EzHvuzx.exe
  2⤵
  PID:6120
- C:\Windows\System\cUPJxRq.exe
  C:\Windows\System\cUPJxRq.exe
  2⤵
  PID:3552
- C:\Windows\System\sNixnxk.exe
  C:\Windows\System\sNixnxk.exe
  2⤵
  PID:4948
- C:\Windows\System\UmRMSML.exe
  C:\Windows\System\UmRMSML.exe
  2⤵
  PID:428
- C:\Windows\System\BtMtlKj.exe
  C:\Windows\System\BtMtlKj.exe
  2⤵
  PID:4424
- C:\Windows\System\riaQVMY.exe
  C:\Windows\System\riaQVMY.exe
  2⤵
  PID:4572
- C:\Windows\System\JZKcPwk.exe
  C:\Windows\System\JZKcPwk.exe
  2⤵
  PID:1348
- C:\Windows\System\rAnSCwS.exe
  C:\Windows\System\rAnSCwS.exe
  2⤵
  PID:3848
- C:\Windows\System\gwMzePm.exe
  C:\Windows\System\gwMzePm.exe
  2⤵
  PID:3424
- C:\Windows\System\VJPWBCL.exe
  C:\Windows\System\VJPWBCL.exe
  2⤵
  PID:3840
- C:\Windows\System\gmJgYbP.exe
  C:\Windows\System\gmJgYbP.exe
  2⤵
  PID:4436
- C:\Windows\System\kJkkQAf.exe
  C:\Windows\System\kJkkQAf.exe
  2⤵
  PID:5284
- C:\Windows\System\xhMcRil.exe
  C:\Windows\System\xhMcRil.exe
  2⤵
  PID:5416
- C:\Windows\System\NuLYErf.exe
  C:\Windows\System\NuLYErf.exe
  2⤵
  PID:3972
- C:\Windows\System\MbCeNUQ.exe
  C:\Windows\System\MbCeNUQ.exe
  2⤵
  PID:4072
- C:\Windows\System\ukxzyhW.exe
  C:\Windows\System\ukxzyhW.exe
  2⤵
  PID:5060
- C:\Windows\System\eheYEEP.exe
  C:\Windows\System\eheYEEP.exe
  2⤵
  PID:4924
- C:\Windows\System\mruWjUa.exe
  C:\Windows\System\mruWjUa.exe
  2⤵
  PID:5612
- C:\Windows\System\VaZIZpW.exe
  C:\Windows\System\VaZIZpW.exe
  2⤵
  PID:5660
- C:\Windows\System\HauKSWA.exe
  C:\Windows\System\HauKSWA.exe
  2⤵
  PID:5604
- C:\Windows\System\ERiTdIi.exe
  C:\Windows\System\ERiTdIi.exe
  2⤵
  PID:5772
- C:\Windows\System\pDvPseo.exe
  C:\Windows\System\pDvPseo.exe
  2⤵
  PID:5632
- C:\Windows\System\dCVPMCg.exe
  C:\Windows\System\dCVPMCg.exe
  2⤵
  PID:4676
- C:\Windows\System\hvtsNau.exe
  C:\Windows\System\hvtsNau.exe
  2⤵
  PID:5740
- C:\Windows\System\WKsBQAA.exe
  C:\Windows\System\WKsBQAA.exe
  2⤵
  PID:4716
- C:\Windows\System\zwNNatL.exe
  C:\Windows\System\zwNNatL.exe
  2⤵
  PID:5392
- C:\Windows\System\BuHjbWx.exe
  C:\Windows\System\BuHjbWx.exe
  2⤵
  PID:5892
- C:\Windows\System\ESzRUoE.exe
  C:\Windows\System\ESzRUoE.exe
  2⤵
  PID:3788
- C:\Windows\System\XOnTFew.exe
  C:\Windows\System\XOnTFew.exe
  2⤵
  PID:6088
- C:\Windows\System\Hbybfeo.exe
  C:\Windows\System\Hbybfeo.exe
  2⤵
  PID:5880
- C:\Windows\System\buYBvee.exe
  C:\Windows\System\buYBvee.exe
  2⤵
  PID:2376
- C:\Windows\System\LssJrLw.exe
  C:\Windows\System\LssJrLw.exe
  2⤵
  PID:2784
- C:\Windows\System\WTEyNXy.exe
  C:\Windows\System\WTEyNXy.exe
  2⤵
  PID:1904
- C:\Windows\System\JTSVWBE.exe
  C:\Windows\System\JTSVWBE.exe
  2⤵
  PID:5136
- C:\Windows\System\ddQwzjG.exe
  C:\Windows\System\ddQwzjG.exe
  2⤵
  PID:5564
- C:\Windows\System\OywgxjX.exe
  C:\Windows\System\OywgxjX.exe
  2⤵
  PID:1688
- C:\Windows\System\JTZLzyz.exe
  C:\Windows\System\JTZLzyz.exe
  2⤵
  PID:452
- C:\Windows\System\xmGvLHU.exe
  C:\Windows\System\xmGvLHU.exe
  2⤵
  PID:5628
- C:\Windows\System\gMbNMrI.exe
  C:\Windows\System\gMbNMrI.exe
  2⤵
  PID:5760
- C:\Windows\System\iCrIrsa.exe
  C:\Windows\System\iCrIrsa.exe
  2⤵
  PID:2800
- C:\Windows\System\lYgnFMf.exe
  C:\Windows\System\lYgnFMf.exe
  2⤵
  PID:5928
- C:\Windows\System\ZJdigzB.exe
  C:\Windows\System\ZJdigzB.exe
  2⤵
  PID:6108
- C:\Windows\System\wVcVLpA.exe
  C:\Windows\System\wVcVLpA.exe
  2⤵
  PID:5956
- C:\Windows\System\kxIIQbn.exe
  C:\Windows\System\kxIIQbn.exe
  2⤵
  PID:6156
- C:\Windows\System\xKBkglM.exe
  C:\Windows\System\xKBkglM.exe
  2⤵
  PID:6180
- C:\Windows\System\zMnXuBI.exe
  C:\Windows\System\zMnXuBI.exe
  2⤵
  PID:6200
- C:\Windows\System\XrpmBvk.exe
  C:\Windows\System\XrpmBvk.exe
  2⤵
  PID:6224
- C:\Windows\System\uQHfQNi.exe
  C:\Windows\System\uQHfQNi.exe
  2⤵
  PID:6240
- C:\Windows\System\JoExvQL.exe
  C:\Windows\System\JoExvQL.exe
  2⤵
  PID:6264
- C:\Windows\System\GHMPAgU.exe
  C:\Windows\System\GHMPAgU.exe
  2⤵
  PID:6288
- C:\Windows\System\fIFKRgI.exe
  C:\Windows\System\fIFKRgI.exe
  2⤵
  PID:6316
- C:\Windows\System\VGcilFh.exe
  C:\Windows\System\VGcilFh.exe
  2⤵
  PID:6340
- C:\Windows\System\lYEWARV.exe
  C:\Windows\System\lYEWARV.exe
  2⤵
  PID:6364
- C:\Windows\System\eiDnYQR.exe
  C:\Windows\System\eiDnYQR.exe
  2⤵
  PID:6392
- C:\Windows\System\VUXeesa.exe
  C:\Windows\System\VUXeesa.exe
  2⤵
  PID:6416
- C:\Windows\System\DpgWEkk.exe
  C:\Windows\System\DpgWEkk.exe
  2⤵
  PID:6440
- C:\Windows\System\cplZCSj.exe
  C:\Windows\System\cplZCSj.exe
  2⤵
  PID:6464
- C:\Windows\System\mgkOfch.exe
  C:\Windows\System\mgkOfch.exe
  2⤵
  PID:6488
- C:\Windows\System\wLSDBoX.exe
  C:\Windows\System\wLSDBoX.exe
  2⤵
  PID:6512
- C:\Windows\System\PLBBuif.exe
  C:\Windows\System\PLBBuif.exe
  2⤵
  PID:6532
- C:\Windows\System\bQbLrNP.exe
  C:\Windows\System\bQbLrNP.exe
  2⤵
  PID:6556
- C:\Windows\System\dozOUXX.exe
  C:\Windows\System\dozOUXX.exe
  2⤵
  PID:6580
- C:\Windows\System\EIcOQyF.exe
  C:\Windows\System\EIcOQyF.exe
  2⤵
  PID:6596
- C:\Windows\System\HDjAAfS.exe
  C:\Windows\System\HDjAAfS.exe
  2⤵
  PID:6620
- C:\Windows\System\oyWZjzo.exe
  C:\Windows\System\oyWZjzo.exe
  2⤵
  PID:6644
- C:\Windows\System\kTJWUsZ.exe
  C:\Windows\System\kTJWUsZ.exe
  2⤵
  PID:6668
- C:\Windows\System\gmOVAbU.exe
  C:\Windows\System\gmOVAbU.exe
  2⤵
  PID:6688
- C:\Windows\System\BYqUAxp.exe
  C:\Windows\System\BYqUAxp.exe
  2⤵
  PID:6712
- C:\Windows\System\kkepqqr.exe
  C:\Windows\System\kkepqqr.exe
  2⤵
  PID:6740
- C:\Windows\System\zIEvrSi.exe
  C:\Windows\System\zIEvrSi.exe
  2⤵
  PID:6760
- C:\Windows\System\ibLokQJ.exe
  C:\Windows\System\ibLokQJ.exe
  2⤵
  PID:6784
- C:\Windows\System\kQjIElW.exe
  C:\Windows\System\kQjIElW.exe
  2⤵
  PID:6800
- C:\Windows\System\iixmRvd.exe
  C:\Windows\System\iixmRvd.exe
  2⤵
  PID:6824
- C:\Windows\System\azFUZrS.exe
  C:\Windows\System\azFUZrS.exe
  2⤵
  PID:6848
- C:\Windows\System\oNwhkic.exe
  C:\Windows\System\oNwhkic.exe
  2⤵
  PID:6868
- C:\Windows\System\bjgRRwG.exe
  C:\Windows\System\bjgRRwG.exe
  2⤵
  PID:6892
- C:\Windows\System\vOHTUfi.exe
  C:\Windows\System\vOHTUfi.exe
  2⤵
  PID:6912
- C:\Windows\System\ZkseJLV.exe
  C:\Windows\System\ZkseJLV.exe
  2⤵
  PID:6936
- C:\Windows\System\olbZcJu.exe
  C:\Windows\System\olbZcJu.exe
  2⤵
  PID:6956
- C:\Windows\System\bHczYry.exe
  C:\Windows\System\bHczYry.exe
  2⤵
  PID:6980
- C:\Windows\System\VznEWye.exe
  C:\Windows\System\VznEWye.exe
  2⤵
  PID:6996
- C:\Windows\System\DzcSitv.exe
  C:\Windows\System\DzcSitv.exe
  2⤵
  PID:7024
- C:\Windows\System\ZdQAsWn.exe
  C:\Windows\System\ZdQAsWn.exe
  2⤵
  PID:7048
- C:\Windows\System\KrCyJfp.exe
  C:\Windows\System\KrCyJfp.exe
  2⤵
  PID:7092
- C:\Windows\System\cmYjyUZ.exe
  C:\Windows\System\cmYjyUZ.exe
  2⤵
  PID:7124
- C:\Windows\System\BWjBcDF.exe
  C:\Windows\System\BWjBcDF.exe
  2⤵
  PID:7152
- C:\Windows\System\bShmUsq.exe
  C:\Windows\System\bShmUsq.exe
  2⤵
  PID:4476
- C:\Windows\System\dlzBSuu.exe
  C:\Windows\System\dlzBSuu.exe
  2⤵
  PID:5804
- C:\Windows\System\LNmGQml.exe
  C:\Windows\System\LNmGQml.exe
  2⤵
  PID:2768
- C:\Windows\System\sfUwlLq.exe
  C:\Windows\System\sfUwlLq.exe
  2⤵
  PID:5996
- C:\Windows\System\xtdoSYz.exe
  C:\Windows\System\xtdoSYz.exe
  2⤵
  PID:6148
- C:\Windows\System\WMxjuBj.exe
  C:\Windows\System\WMxjuBj.exe
  2⤵
  PID:2916
- C:\Windows\System\KActnKz.exe
  C:\Windows\System\KActnKz.exe
  2⤵
  PID:6300
- C:\Windows\System\BWIXtIZ.exe
  C:\Windows\System\BWIXtIZ.exe
  2⤵
  PID:6312
- C:\Windows\System\RKFIGCP.exe
  C:\Windows\System\RKFIGCP.exe
  2⤵
  PID:6352
- C:\Windows\System\MKmgYFd.exe
  C:\Windows\System\MKmgYFd.exe
  2⤵
  PID:6412
- C:\Windows\System\CtMULWX.exe
  C:\Windows\System\CtMULWX.exe
  2⤵
  PID:6484
- C:\Windows\System\sTlGLSs.exe
  C:\Windows\System\sTlGLSs.exe
  2⤵
  PID:6604
- C:\Windows\System\ixyAuFl.exe
  C:\Windows\System\ixyAuFl.exe
  2⤵
  PID:6640
- C:\Windows\System\BgmTrtJ.exe
  C:\Windows\System\BgmTrtJ.exe
  2⤵
  PID:5236
- C:\Windows\System\aQBhOLC.exe
  C:\Windows\System\aQBhOLC.exe
  2⤵
  PID:6776
- C:\Windows\System\OeBXvdY.exe
  C:\Windows\System\OeBXvdY.exe
  2⤵
  PID:6836
- C:\Windows\System\NcIpFyq.exe
  C:\Windows\System\NcIpFyq.exe
  2⤵
  PID:6360
- C:\Windows\System\zkQSXME.exe
  C:\Windows\System\zkQSXME.exe
  2⤵
  PID:6376
- C:\Windows\System\LaotvKC.exe
  C:\Windows\System\LaotvKC.exe
  2⤵
  PID:7004
- C:\Windows\System\IqcMvsX.exe
  C:\Windows\System\IqcMvsX.exe
  2⤵
  PID:6456
- C:\Windows\System\HkSwvdU.exe
  C:\Windows\System\HkSwvdU.exe
  2⤵
  PID:6524
- C:\Windows\System\EAAJxNv.exe
  C:\Windows\System\EAAJxNv.exe
  2⤵
  PID:7180
- C:\Windows\System\vworwQK.exe
  C:\Windows\System\vworwQK.exe
  2⤵
  PID:7200
- C:\Windows\System\FrzIXPa.exe
  C:\Windows\System\FrzIXPa.exe
  2⤵
  PID:7224
- C:\Windows\System\KQAXfBZ.exe
  C:\Windows\System\KQAXfBZ.exe
  2⤵
  PID:7244
- C:\Windows\System\WnuRKYu.exe
  C:\Windows\System\WnuRKYu.exe
  2⤵
  PID:7264
- C:\Windows\System\MjSeTVc.exe
  C:\Windows\System\MjSeTVc.exe
  2⤵
  PID:7288
- C:\Windows\System\mpSLLPq.exe
  C:\Windows\System\mpSLLPq.exe
  2⤵
  PID:7308
- C:\Windows\System\HOhiKZP.exe
  C:\Windows\System\HOhiKZP.exe
  2⤵
  PID:7328
- C:\Windows\System\CfiUyaF.exe
  C:\Windows\System\CfiUyaF.exe
  2⤵
  PID:7344
- C:\Windows\System\EAoTXtK.exe
  C:\Windows\System\EAoTXtK.exe
  2⤵
  PID:7372
- C:\Windows\System\usnCCgx.exe
  C:\Windows\System\usnCCgx.exe
  2⤵
  PID:7396
- C:\Windows\System\eWjZqQt.exe
  C:\Windows\System\eWjZqQt.exe
  2⤵
  PID:7420
- C:\Windows\System\nRbQmwN.exe
  C:\Windows\System\nRbQmwN.exe
  2⤵
  PID:7448
- C:\Windows\System\nZCVGKh.exe
  C:\Windows\System\nZCVGKh.exe
  2⤵
  PID:7468
- C:\Windows\System\VVabwuH.exe
  C:\Windows\System\VVabwuH.exe
  2⤵
  PID:7500
- C:\Windows\System\zqHybkl.exe
  C:\Windows\System\zqHybkl.exe
  2⤵
  PID:7516
- C:\Windows\System\pyCCEMX.exe
  C:\Windows\System\pyCCEMX.exe
  2⤵
  PID:7544
- C:\Windows\System\hsUtqzf.exe
  C:\Windows\System\hsUtqzf.exe
  2⤵
  PID:7568
- C:\Windows\System\SsoJmGQ.exe
  C:\Windows\System\SsoJmGQ.exe
  2⤵
  PID:7584
- C:\Windows\System\EPHfyqM.exe
  C:\Windows\System\EPHfyqM.exe
  2⤵
  PID:7612
- C:\Windows\System\LBYaILj.exe
  C:\Windows\System\LBYaILj.exe
  2⤵
  PID:7632
- C:\Windows\System\VmQbPsH.exe
  C:\Windows\System\VmQbPsH.exe
  2⤵
  PID:7652
- C:\Windows\System\eVwrhjJ.exe
  C:\Windows\System\eVwrhjJ.exe
  2⤵
  PID:7676
- C:\Windows\System\qspesch.exe
  C:\Windows\System\qspesch.exe
  2⤵
  PID:7704
- C:\Windows\System\VhakkAu.exe
  C:\Windows\System\VhakkAu.exe
  2⤵
  PID:7724
- C:\Windows\System\ygxVkXN.exe
  C:\Windows\System\ygxVkXN.exe
  2⤵
  PID:7748
- C:\Windows\System\AzxrJjf.exe
  C:\Windows\System\AzxrJjf.exe
  2⤵
  PID:7776
- C:\Windows\System\jVEHpor.exe
  C:\Windows\System\jVEHpor.exe
  2⤵
  PID:7796
- C:\Windows\System\tJibSdZ.exe
  C:\Windows\System\tJibSdZ.exe
  2⤵
  PID:7820
- C:\Windows\System\uJsvQbn.exe
  C:\Windows\System\uJsvQbn.exe
  2⤵
  PID:7844
- C:\Windows\System\fkvMjsm.exe
  C:\Windows\System\fkvMjsm.exe
  2⤵
  PID:7864
- C:\Windows\System\JNWarPZ.exe
  C:\Windows\System\JNWarPZ.exe
  2⤵
  PID:7892
- C:\Windows\System\ikgBuxv.exe
  C:\Windows\System\ikgBuxv.exe
  2⤵
  PID:7916
- C:\Windows\System\MtlOAgh.exe
  C:\Windows\System\MtlOAgh.exe
  2⤵
  PID:7936
- C:\Windows\System\mHDpaCr.exe
  C:\Windows\System\mHDpaCr.exe
  2⤵
  PID:7960
- C:\Windows\System\kksgxKm.exe
  C:\Windows\System\kksgxKm.exe
  2⤵
  PID:7980
- C:\Windows\System\pGuvCsO.exe
  C:\Windows\System\pGuvCsO.exe
  2⤵
  PID:8004
- C:\Windows\System\VtmSoGV.exe
  C:\Windows\System\VtmSoGV.exe
  2⤵
  PID:8028
- C:\Windows\System\iTCmCvx.exe
  C:\Windows\System\iTCmCvx.exe
  2⤵
  PID:8056
- C:\Windows\System\mBkISCc.exe
  C:\Windows\System\mBkISCc.exe
  2⤵
  PID:8080
- C:\Windows\System\oiDaNpc.exe
  C:\Windows\System\oiDaNpc.exe
  2⤵
  PID:8104
- C:\Windows\System\gRDjQIx.exe
  C:\Windows\System\gRDjQIx.exe
  2⤵
  PID:8128
- C:\Windows\System\NTlxMWv.exe
  C:\Windows\System\NTlxMWv.exe
  2⤵
  PID:8148
- C:\Windows\System\IpBcVDH.exe
  C:\Windows\System\IpBcVDH.exe
  2⤵
  PID:8176
- C:\Windows\System\usKEVVW.exe
  C:\Windows\System\usKEVVW.exe
  2⤵
  PID:5156
- C:\Windows\System\tBBZvXC.exe
  C:\Windows\System\tBBZvXC.exe
  2⤵
  PID:5796
- C:\Windows\System\sUgnlJP.exe
  C:\Windows\System\sUgnlJP.exe
  2⤵
  PID:5756
- C:\Windows\System\CTBqkBB.exe
  C:\Windows\System\CTBqkBB.exe
  2⤵
  PID:6720
- C:\Windows\System\oZKgJBk.exe
  C:\Windows\System\oZKgJBk.exe
  2⤵
  PID:6388
- C:\Windows\System\AtCnyyE.exe
  C:\Windows\System\AtCnyyE.exe
  2⤵
  PID:6864
- C:\Windows\System\wOAlPJO.exe
  C:\Windows\System\wOAlPJO.exe
  2⤵
  PID:6948
- C:\Windows\System\OsOKjOJ.exe
  C:\Windows\System\OsOKjOJ.exe
  2⤵
  PID:6112
- C:\Windows\System\ewuVUFL.exe
  C:\Windows\System\ewuVUFL.exe
  2⤵
  PID:6496
- C:\Windows\System\wXyTRzY.exe
  C:\Windows\System\wXyTRzY.exe
  2⤵
  PID:6500
- C:\Windows\System\CKMTkIW.exe
  C:\Windows\System\CKMTkIW.exe
  2⤵
  PID:7196
- C:\Windows\System\wlmrYFs.exe
  C:\Windows\System\wlmrYFs.exe
  2⤵
  PID:7132
- C:\Windows\System\KoZUdoc.exe
  C:\Windows\System\KoZUdoc.exe
  2⤵
  PID:3056
- C:\Windows\System\BYxirsj.exe
  C:\Windows\System\BYxirsj.exe
  2⤵
  PID:7304
- C:\Windows\System\TLXgCgM.exe
  C:\Windows\System\TLXgCgM.exe
  2⤵
  PID:6752
- C:\Windows\System\ZmBsEkx.exe
  C:\Windows\System\ZmBsEkx.exe
  2⤵
  PID:6020
- C:\Windows\System\eLXieDG.exe
  C:\Windows\System\eLXieDG.exe
  2⤵
  PID:7508
- C:\Windows\System\pqiQxSw.exe
  C:\Windows\System\pqiQxSw.exe
  2⤵
  PID:7556
- C:\Windows\System\GSYXnRj.exe
  C:\Windows\System\GSYXnRj.exe
  2⤵
  PID:6684
- C:\Windows\System\SofotgR.exe
  C:\Windows\System\SofotgR.exe
  2⤵
  PID:7660
- C:\Windows\System\KjYJgwW.exe
  C:\Windows\System\KjYJgwW.exe
  2⤵
  PID:6820
- C:\Windows\System\oVbBtsT.exe
  C:\Windows\System\oVbBtsT.exe
  2⤵
  PID:7772
- C:\Windows\System\xehazYc.exe
  C:\Windows\System\xehazYc.exe
  2⤵
  PID:6436
- C:\Windows\System\XTvPymo.exe
  C:\Windows\System\XTvPymo.exe
  2⤵
  PID:7148
- C:\Windows\System\rTPFzLj.exe
  C:\Windows\System\rTPFzLj.exe
  2⤵
  PID:8020
- C:\Windows\System\NLaBXll.exe
  C:\Windows\System\NLaBXll.exe
  2⤵
  PID:4940
- C:\Windows\System\BpgfPLh.exe
  C:\Windows\System\BpgfPLh.exe
  2⤵
  PID:8092
- C:\Windows\System\NsybKEy.exe
  C:\Windows\System\NsybKEy.exe
  2⤵
  PID:7336
- C:\Windows\System\BpFRBMD.exe
  C:\Windows\System\BpFRBMD.exe
  2⤵
  PID:8200
- C:\Windows\System\NbwBwRx.exe
  C:\Windows\System\NbwBwRx.exe
  2⤵
  PID:8224
- C:\Windows\System\rnqrPiV.exe
  C:\Windows\System\rnqrPiV.exe
  2⤵
  PID:8248
- C:\Windows\System\bOvbctC.exe
  C:\Windows\System\bOvbctC.exe
  2⤵
  PID:8268
- C:\Windows\System\IesgDqT.exe
  C:\Windows\System\IesgDqT.exe
  2⤵
  PID:8292
- C:\Windows\System\IqlfcQq.exe
  C:\Windows\System\IqlfcQq.exe
  2⤵
  PID:8324
- C:\Windows\System\iuUkzgf.exe
  C:\Windows\System\iuUkzgf.exe
  2⤵
  PID:8340
- C:\Windows\System\DlWvYab.exe
  C:\Windows\System\DlWvYab.exe
  2⤵
  PID:8364
- C:\Windows\System\GEcgYrF.exe
  C:\Windows\System\GEcgYrF.exe
  2⤵
  PID:8392
- C:\Windows\System\fSSjiFB.exe
  C:\Windows\System\fSSjiFB.exe
  2⤵
  PID:8420
- C:\Windows\System\gcjqbUe.exe
  C:\Windows\System\gcjqbUe.exe
  2⤵
  PID:8440
- C:\Windows\System\zJqfBjG.exe
  C:\Windows\System\zJqfBjG.exe
  2⤵
  PID:8460
- C:\Windows\System\wrLuohN.exe
  C:\Windows\System\wrLuohN.exe
  2⤵
  PID:8484
- C:\Windows\System\TKPwaBa.exe
  C:\Windows\System\TKPwaBa.exe
  2⤵
  PID:8508
- C:\Windows\System\oNPXbEU.exe
  C:\Windows\System\oNPXbEU.exe
  2⤵
  PID:8528
- C:\Windows\System\FujtAoH.exe
  C:\Windows\System\FujtAoH.exe
  2⤵
  PID:8548
- C:\Windows\System\cZDkxuU.exe
  C:\Windows\System\cZDkxuU.exe
  2⤵
  PID:8568
- C:\Windows\System\XsbEvNM.exe
  C:\Windows\System\XsbEvNM.exe
  2⤵
  PID:8584
- C:\Windows\System\yenCOaV.exe
  C:\Windows\System\yenCOaV.exe
  2⤵
  PID:8600
- C:\Windows\System\ekRKhOY.exe
  C:\Windows\System\ekRKhOY.exe
  2⤵
  PID:8628
- C:\Windows\System\wqCYjAR.exe
  C:\Windows\System\wqCYjAR.exe
  2⤵
  PID:8660
- C:\Windows\System\zFaJlhq.exe
  C:\Windows\System\zFaJlhq.exe
  2⤵
  PID:8676
- C:\Windows\System\mPIsexB.exe
  C:\Windows\System\mPIsexB.exe
  2⤵
  PID:8696
- C:\Windows\System\TpdGJjK.exe
  C:\Windows\System\TpdGJjK.exe
  2⤵
  PID:8720
- C:\Windows\System\EEBuNiD.exe
  C:\Windows\System\EEBuNiD.exe
  2⤵
  PID:8744
- C:\Windows\System\hbIQxLL.exe
  C:\Windows\System\hbIQxLL.exe
  2⤵
  PID:8760
- C:\Windows\System\MeFrGEx.exe
  C:\Windows\System\MeFrGEx.exe
  2⤵
  PID:8784
- C:\Windows\System\CDZOWQY.exe
  C:\Windows\System\CDZOWQY.exe
  2⤵
  PID:8808
- C:\Windows\System\YuVJuIv.exe
  C:\Windows\System\YuVJuIv.exe
  2⤵
  PID:8832
- C:\Windows\System\rTHSeRc.exe
  C:\Windows\System\rTHSeRc.exe
  2⤵
  PID:8852
- C:\Windows\System\lcoxTNh.exe
  C:\Windows\System\lcoxTNh.exe
  2⤵
  PID:8880
- C:\Windows\System\IubHwxd.exe
  C:\Windows\System\IubHwxd.exe
  2⤵
  PID:8900
- C:\Windows\System\xgYdWPl.exe
  C:\Windows\System\xgYdWPl.exe
  2⤵
  PID:8928
- C:\Windows\System\LHJGntX.exe
  C:\Windows\System\LHJGntX.exe
  2⤵
  PID:8960
- C:\Windows\System\CwsvGMp.exe
  C:\Windows\System\CwsvGMp.exe
  2⤵
  PID:8980
- C:\Windows\System\wGVewrZ.exe
  C:\Windows\System\wGVewrZ.exe
  2⤵
  PID:9000
- C:\Windows\System\AbkMsOe.exe
  C:\Windows\System\AbkMsOe.exe
  2⤵
  PID:9024
- C:\Windows\System\wiPedvY.exe
  C:\Windows\System\wiPedvY.exe
  2⤵
  PID:9048
- C:\Windows\System\nYgZGQn.exe
  C:\Windows\System\nYgZGQn.exe
  2⤵
  PID:9068
- C:\Windows\System\MLTGRIX.exe
  C:\Windows\System\MLTGRIX.exe
  2⤵
  PID:9092
- C:\Windows\System\gMThVHv.exe
  C:\Windows\System\gMThVHv.exe
  2⤵
  PID:9124
- C:\Windows\System\VAwsLSj.exe
  C:\Windows\System\VAwsLSj.exe
  2⤵
  PID:9148
- C:\Windows\System\kSuNnUD.exe
  C:\Windows\System\kSuNnUD.exe
  2⤵
  PID:9172
- C:\Windows\System\PNfVEwG.exe
  C:\Windows\System\PNfVEwG.exe
  2⤵
  PID:9200
- C:\Windows\System\qnsEkFc.exe
  C:\Windows\System\qnsEkFc.exe
  2⤵
  PID:6220
- C:\Windows\System\SZWQimB.exe
  C:\Windows\System\SZWQimB.exe
  2⤵
  PID:8172
- C:\Windows\System\obzUGaW.exe
  C:\Windows\System\obzUGaW.exe
  2⤵
  PID:7524
- C:\Windows\System\HFEaFEo.exe
  C:\Windows\System\HFEaFEo.exe
  2⤵
  PID:6272
- C:\Windows\System\DrgyEHu.exe
  C:\Windows\System\DrgyEHu.exe
  2⤵
  PID:7648
- C:\Windows\System\IPavsOW.exe
  C:\Windows\System\IPavsOW.exe
  2⤵
  PID:7272
- C:\Windows\System\WYyXYHg.exe
  C:\Windows\System\WYyXYHg.exe
  2⤵
  PID:7756
- C:\Windows\System\gbSjIAH.exe
  C:\Windows\System\gbSjIAH.exe
  2⤵
  PID:6976
- C:\Windows\System\RGFwldw.exe
  C:\Windows\System\RGFwldw.exe
  2⤵
  PID:6540
- C:\Windows\System\RaLtauL.exe
  C:\Windows\System\RaLtauL.exe
  2⤵
  PID:6860
- C:\Windows\System\zRARonB.exe
  C:\Windows\System\zRARonB.exe
  2⤵
  PID:7860
- C:\Windows\System\PQNrLlS.exe
  C:\Windows\System\PQNrLlS.exe
  2⤵
  PID:7320
- C:\Windows\System\wspmHQL.exe
  C:\Windows\System\wspmHQL.exe
  2⤵
  PID:7404
- C:\Windows\System\fwpsqJl.exe
  C:\Windows\System\fwpsqJl.exe
  2⤵
  PID:8332
- C:\Windows\System\mZSejrr.exe
  C:\Windows\System\mZSejrr.exe
  2⤵
  PID:6052
- C:\Windows\System\TcDzuVS.exe
  C:\Windows\System\TcDzuVS.exe
  2⤵
  PID:6816
- C:\Windows\System\YvuKHwj.exe
  C:\Windows\System\YvuKHwj.exe
  2⤵
  PID:6944
- C:\Windows\System\jIgKBDj.exe
  C:\Windows\System\jIgKBDj.exe
  2⤵
  PID:6964
- C:\Windows\System\vceOZUy.exe
  C:\Windows\System\vceOZUy.exe
  2⤵
  PID:8576
- C:\Windows\System\rXmnVli.exe
  C:\Windows\System\rXmnVli.exe
  2⤵
  PID:7172
- C:\Windows\System\EjQrUyv.exe
  C:\Windows\System\EjQrUyv.exe
  2⤵
  PID:9228
- C:\Windows\System\VURSWaX.exe
  C:\Windows\System\VURSWaX.exe
  2⤵
  PID:9248
- C:\Windows\System\NTDtXIl.exe
  C:\Windows\System\NTDtXIl.exe
  2⤵
  PID:9268
- C:\Windows\System\HRHlfbu.exe
  C:\Windows\System\HRHlfbu.exe
  2⤵
  PID:9288
- C:\Windows\System\LbjtEGF.exe
  C:\Windows\System\LbjtEGF.exe
  2⤵
  PID:9312
- C:\Windows\System\yrOWKhA.exe
  C:\Windows\System\yrOWKhA.exe
  2⤵
  PID:9332
- C:\Windows\System\rtpoany.exe
  C:\Windows\System\rtpoany.exe
  2⤵
  PID:9352
- C:\Windows\System\TBoCJDB.exe
  C:\Windows\System\TBoCJDB.exe
  2⤵
  PID:9380
- C:\Windows\System\SJtNYnS.exe
  C:\Windows\System\SJtNYnS.exe
  2⤵
  PID:9404
- C:\Windows\System\LvIwnMB.exe
  C:\Windows\System\LvIwnMB.exe
  2⤵
  PID:9428
- C:\Windows\System\DBgNnNf.exe
  C:\Windows\System\DBgNnNf.exe
  2⤵
  PID:9448
- C:\Windows\System\pdGPxEW.exe
  C:\Windows\System\pdGPxEW.exe
  2⤵
  PID:9472
- C:\Windows\System\GXIXfhi.exe
  C:\Windows\System\GXIXfhi.exe
  2⤵
  PID:9492
- C:\Windows\System\uDBKdIu.exe
  C:\Windows\System\uDBKdIu.exe
  2⤵
  PID:9716
- C:\Windows\System\BUScKgx.exe
  C:\Windows\System\BUScKgx.exe
  2⤵
  PID:9740
- C:\Windows\System\guiCPOY.exe
  C:\Windows\System\guiCPOY.exe
  2⤵
  PID:9764
- C:\Windows\System\PLobTCJ.exe
  C:\Windows\System\PLobTCJ.exe
  2⤵
  PID:9784
- C:\Windows\System\rqOHrrf.exe
  C:\Windows\System\rqOHrrf.exe
  2⤵
  PID:9804
- C:\Windows\System\GJEmygD.exe
  C:\Windows\System\GJEmygD.exe
  2⤵
  PID:9828
- C:\Windows\System\JnaZVUH.exe
  C:\Windows\System\JnaZVUH.exe
  2⤵
  PID:9844
- C:\Windows\System\kIgrrpp.exe
  C:\Windows\System\kIgrrpp.exe
  2⤵
  PID:9868
- C:\Windows\System\NFxpWBM.exe
  C:\Windows\System\NFxpWBM.exe
  2⤵
  PID:9896
- C:\Windows\System\VlacFTq.exe
  C:\Windows\System\VlacFTq.exe
  2⤵
  PID:9920
- C:\Windows\System\COnzXNT.exe
  C:\Windows\System\COnzXNT.exe
  2⤵
  PID:9936
- C:\Windows\System\BiVltIp.exe
  C:\Windows\System\BiVltIp.exe
  2⤵
  PID:9960
- C:\Windows\System\AgbqwKa.exe
  C:\Windows\System\AgbqwKa.exe
  2⤵
  PID:9984
- C:\Windows\System\bCMdxcE.exe
  C:\Windows\System\bCMdxcE.exe
  2⤵
  PID:10008
- C:\Windows\System\MIfspnd.exe
  C:\Windows\System\MIfspnd.exe
  2⤵
  PID:10028
- C:\Windows\System\EXLRmaY.exe
  C:\Windows\System\EXLRmaY.exe
  2⤵
  PID:10052
- C:\Windows\System\JeaIuTQ.exe
  C:\Windows\System\JeaIuTQ.exe
  2⤵
  PID:10072
- C:\Windows\System\etOcdwI.exe
  C:\Windows\System\etOcdwI.exe
  2⤵
  PID:10096
- C:\Windows\System\fnkfour.exe
  C:\Windows\System\fnkfour.exe
  2⤵
  PID:10120
- C:\Windows\System\Bhctwux.exe
  C:\Windows\System\Bhctwux.exe
  2⤵
  PID:10148
- C:\Windows\System\VsgUsCA.exe
  C:\Windows\System\VsgUsCA.exe
  2⤵
  PID:10172
- C:\Windows\System\BuvuYxz.exe
  C:\Windows\System\BuvuYxz.exe
  2⤵
  PID:10196
- C:\Windows\System\EShAPzZ.exe
  C:\Windows\System\EShAPzZ.exe
  2⤵
  PID:10216
- C:\Windows\System\vvAKyKy.exe
  C:\Windows\System\vvAKyKy.exe
  2⤵
  PID:10232
- C:\Windows\System\xMnsvZS.exe
  C:\Windows\System\xMnsvZS.exe
  2⤵
  PID:8688
- C:\Windows\System\FCgrorw.exe
  C:\Windows\System\FCgrorw.exe
  2⤵
  PID:8728
- C:\Windows\System\gXULJyB.exe
  C:\Windows\System\gXULJyB.exe
  2⤵
  PID:8820
- C:\Windows\System\gKFeihF.exe
  C:\Windows\System\gKFeihF.exe
  2⤵
  PID:7444
- C:\Windows\System\FfmpJzE.exe
  C:\Windows\System\FfmpJzE.exe
  2⤵
  PID:7956
- C:\Windows\System\KHeiLal.exe
  C:\Windows\System\KHeiLal.exe
  2⤵
  PID:7996
- C:\Windows\System\CJNaXNF.exe
  C:\Windows\System\CJNaXNF.exe
  2⤵
  PID:9084
- C:\Windows\System\uzMISzO.exe
  C:\Windows\System\uzMISzO.exe
  2⤵
  PID:9164
- C:\Windows\System\yBJnmNr.exe
  C:\Windows\System\yBJnmNr.exe
  2⤵
  PID:8156
- C:\Windows\System\EPmcSeM.exe
  C:\Windows\System\EPmcSeM.exe
  2⤵
  PID:8260
- C:\Windows\System\EjcgZyH.exe
  C:\Windows\System\EjcgZyH.exe
  2⤵
  PID:8164
- C:\Windows\System\nlnnRXG.exe
  C:\Windows\System\nlnnRXG.exe
  2⤵
  PID:7888
- C:\Windows\System\JoCUfsX.exe
  C:\Windows\System\JoCUfsX.exe
  2⤵
  PID:7240
- C:\Windows\System\GSIgmkI.exe
  C:\Windows\System\GSIgmkI.exe
  2⤵
  PID:6636
- C:\Windows\System\ObAxwkT.exe
  C:\Windows\System\ObAxwkT.exe
  2⤵
  PID:8580
- C:\Windows\System\uigzPuS.exe
  C:\Windows\System\uigzPuS.exe
  2⤵
  PID:7116
- C:\Windows\System\FrJkbsS.exe
  C:\Windows\System\FrJkbsS.exe
  2⤵
  PID:9412
- C:\Windows\System\XakXKyx.exe
  C:\Windows\System\XakXKyx.exe
  2⤵
  PID:5724
- C:\Windows\System\ReOykVf.exe
  C:\Windows\System\ReOykVf.exe
  2⤵
  PID:7580
- C:\Windows\System\IXxpPQO.exe
  C:\Windows\System\IXxpPQO.exe
  2⤵
  PID:9060
- C:\Windows\System\KaYleeG.exe
  C:\Windows\System\KaYleeG.exe
  2⤵
  PID:10264
- C:\Windows\System\zWEYJsp.exe
  C:\Windows\System\zWEYJsp.exe
  2⤵
  PID:10284
- C:\Windows\System\KxizfAR.exe
  C:\Windows\System\KxizfAR.exe
  2⤵
  PID:10300
- C:\Windows\System\fECEfPQ.exe
  C:\Windows\System\fECEfPQ.exe
  2⤵
  PID:10316
- C:\Windows\System\GaIIDME.exe
  C:\Windows\System\GaIIDME.exe
  2⤵
  PID:10336
- C:\Windows\System\NGQxoZm.exe
  C:\Windows\System\NGQxoZm.exe
  2⤵
  PID:10356
- C:\Windows\System\bXAnDaV.exe
  C:\Windows\System\bXAnDaV.exe
  2⤵
  PID:10396
- C:\Windows\System\VbOntFS.exe
  C:\Windows\System\VbOntFS.exe
  2⤵
  PID:10412
- C:\Windows\System\xYKWBUf.exe
  C:\Windows\System\xYKWBUf.exe
  2⤵
  PID:10436
- C:\Windows\System\YrKZezZ.exe
  C:\Windows\System\YrKZezZ.exe
  2⤵
  PID:10472
- C:\Windows\System\GKMjfhD.exe
  C:\Windows\System\GKMjfhD.exe
  2⤵
  PID:10500
- C:\Windows\System\rSAPnFH.exe
  C:\Windows\System\rSAPnFH.exe
  2⤵
  PID:10524
- C:\Windows\System\ZRRQvRi.exe
  C:\Windows\System\ZRRQvRi.exe
  2⤵
  PID:10544
- C:\Windows\System\jnbbzPy.exe
  C:\Windows\System\jnbbzPy.exe
  2⤵
  PID:10564
- C:\Windows\System\uhHuRiP.exe
  C:\Windows\System\uhHuRiP.exe
  2⤵
  PID:10588
- C:\Windows\System\yALpOIM.exe
  C:\Windows\System\yALpOIM.exe
  2⤵
  PID:10616
- C:\Windows\System\PfmsljT.exe
  C:\Windows\System\PfmsljT.exe
  2⤵
  PID:10640
- C:\Windows\System\jCnJzgk.exe
  C:\Windows\System\jCnJzgk.exe
  2⤵
  PID:10668
- C:\Windows\System\CwxzjbI.exe
  C:\Windows\System\CwxzjbI.exe
  2⤵
  PID:10688
- C:\Windows\System\ZjwrNRE.exe
  C:\Windows\System\ZjwrNRE.exe
  2⤵
  PID:10708
- C:\Windows\System\ixgdWJh.exe
  C:\Windows\System\ixgdWJh.exe
  2⤵
  PID:10736
- C:\Windows\System\dhtXKSB.exe
  C:\Windows\System\dhtXKSB.exe
  2⤵
  PID:10776
- C:\Windows\System\xdvUFnt.exe
  C:\Windows\System\xdvUFnt.exe
  2⤵
  PID:10796
- C:\Windows\System\cwcdWGo.exe
  C:\Windows\System\cwcdWGo.exe
  2⤵
  PID:10816
- C:\Windows\System\qispEib.exe
  C:\Windows\System\qispEib.exe
  2⤵
  PID:10840
- C:\Windows\System\KCefxgi.exe
  C:\Windows\System\KCefxgi.exe
  2⤵
  PID:10864
- C:\Windows\System\rMzsOqI.exe
  C:\Windows\System\rMzsOqI.exe
  2⤵
  PID:10888
- C:\Windows\System\RyNPfhd.exe
  C:\Windows\System\RyNPfhd.exe
  2⤵
  PID:10916
- C:\Windows\System\syTOVVX.exe
  C:\Windows\System\syTOVVX.exe
  2⤵
  PID:10936
- C:\Windows\System\qVcUOmF.exe
  C:\Windows\System\qVcUOmF.exe
  2⤵
  PID:10960
- C:\Windows\System\fkXufKg.exe
  C:\Windows\System\fkXufKg.exe
  2⤵
  PID:10984
- C:\Windows\System\dzKRGLF.exe
  C:\Windows\System\dzKRGLF.exe
  2⤵
  PID:11004
- C:\Windows\System\avWUgdk.exe
  C:\Windows\System\avWUgdk.exe
  2⤵
  PID:11020
- C:\Windows\System\rruanXG.exe
  C:\Windows\System\rruanXG.exe
  2⤵
  PID:11044
- C:\Windows\System\tfhdBzP.exe
  C:\Windows\System\tfhdBzP.exe
  2⤵
  PID:11068
- C:\Windows\System\CAjnlLh.exe
  C:\Windows\System\CAjnlLh.exe
  2⤵
  PID:11092
- C:\Windows\System\Rynrxjb.exe
  C:\Windows\System\Rynrxjb.exe
  2⤵
  PID:11116
- C:\Windows\System\fswzJzR.exe
  C:\Windows\System\fswzJzR.exe
  2⤵
  PID:11136
- C:\Windows\System\vNnIAyo.exe
  C:\Windows\System\vNnIAyo.exe
  2⤵
  PID:11152
- C:\Windows\System\tBprMdy.exe
  C:\Windows\System\tBprMdy.exe
  2⤵
  PID:11180
- C:\Windows\System\SzWzRwf.exe
  C:\Windows\System\SzWzRwf.exe
  2⤵
  PID:11200
- C:\Windows\System\VorTZIi.exe
  C:\Windows\System\VorTZIi.exe
  2⤵
  PID:11224
- C:\Windows\System\uluNsfw.exe
  C:\Windows\System\uluNsfw.exe
  2⤵
  PID:11248
- C:\Windows\System\nvKlLoy.exe
  C:\Windows\System\nvKlLoy.exe
  2⤵
  PID:8048
- C:\Windows\System\COKQPin.exe
  C:\Windows\System\COKQPin.exe
  2⤵
  PID:9104
- C:\Windows\System\LUQYHvo.exe
  C:\Windows\System\LUQYHvo.exe
  2⤵
  PID:8216
- C:\Windows\System\EQebQzz.exe
  C:\Windows\System\EQebQzz.exe
  2⤵
  PID:9796
- C:\Windows\System\vnnmckw.exe
  C:\Windows\System\vnnmckw.exe
  2⤵
  PID:7256
- C:\Windows\System\UPgOEJT.exe
  C:\Windows\System\UPgOEJT.exe
  2⤵
  PID:9908
- C:\Windows\System\EVYZWDq.exe
  C:\Windows\System\EVYZWDq.exe
  2⤵
  PID:9952
- C:\Windows\System\ZHTEzcq.exe
  C:\Windows\System\ZHTEzcq.exe
  2⤵
  PID:8412
- C:\Windows\System\IjbmMfI.exe
  C:\Windows\System\IjbmMfI.exe
  2⤵
  PID:7988
- C:\Windows\System\rNyMViw.exe
  C:\Windows\System\rNyMViw.exe
  2⤵
  PID:7432
- C:\Windows\System\kyVbGto.exe
  C:\Windows\System\kyVbGto.exe
  2⤵
  PID:10156
- C:\Windows\System\ZFfvJeC.exe
  C:\Windows\System\ZFfvJeC.exe
  2⤵
  PID:7060
- C:\Windows\System\qZNTqkA.exe
  C:\Windows\System\qZNTqkA.exe
  2⤵
  PID:7040
- C:\Windows\System\OEXUDzm.exe
  C:\Windows\System\OEXUDzm.exe
  2⤵
  PID:9264
- C:\Windows\System\XhXeaUI.exe
  C:\Windows\System\XhXeaUI.exe
  2⤵
  PID:9308
- C:\Windows\System\nJtIyRR.exe
  C:\Windows\System\nJtIyRR.exe
  2⤵
  PID:9360
- C:\Windows\System\vTGUbxQ.exe
  C:\Windows\System\vTGUbxQ.exe
  2⤵
  PID:8116
- C:\Windows\System\noeMacY.exe
  C:\Windows\System\noeMacY.exe
  2⤵
  PID:8276
- C:\Windows\System\WKooSZf.exe
  C:\Windows\System\WKooSZf.exe
  2⤵
  PID:9420
- C:\Windows\System\sshkMLA.exe
  C:\Windows\System\sshkMLA.exe
  2⤵
  PID:9484
- C:\Windows\System\ciOxtlP.exe
  C:\Windows\System\ciOxtlP.exe
  2⤵
  PID:9520
- C:\Windows\System\cyrLygZ.exe
  C:\Windows\System\cyrLygZ.exe
  2⤵
  PID:8304
- C:\Windows\System\qqZrLJA.exe
  C:\Windows\System\qqZrLJA.exe
  2⤵
  PID:9284
- C:\Windows\System\hsqfNnv.exe
  C:\Windows\System\hsqfNnv.exe
  2⤵
  PID:8948
- C:\Windows\System\LKVxNhJ.exe
  C:\Windows\System\LKVxNhJ.exe
  2⤵
  PID:11276
- C:\Windows\System\qsisMga.exe
  C:\Windows\System\qsisMga.exe
  2⤵
  PID:11304
- C:\Windows\System\RbKvUfA.exe
  C:\Windows\System\RbKvUfA.exe
  2⤵
  PID:11324
- C:\Windows\System\EzoGghE.exe
  C:\Windows\System\EzoGghE.exe
  2⤵
  PID:11348
- C:\Windows\System\aGhInti.exe
  C:\Windows\System\aGhInti.exe
  2⤵
  PID:11372
- C:\Windows\System\nHeyROw.exe
  C:\Windows\System\nHeyROw.exe
  2⤵
  PID:11392
- C:\Windows\System\snETEad.exe
  C:\Windows\System\snETEad.exe
  2⤵
  PID:11416
- C:\Windows\System\MCAskIz.exe
  C:\Windows\System\MCAskIz.exe
  2⤵
  PID:11440
- C:\Windows\System\csrImnJ.exe
  C:\Windows\System\csrImnJ.exe
  2⤵
  PID:11456
- C:\Windows\System\dbSOHzP.exe
  C:\Windows\System\dbSOHzP.exe
  2⤵
  PID:11480
- C:\Windows\System\CkluQPd.exe
  C:\Windows\System\CkluQPd.exe
  2⤵
  PID:11504
- C:\Windows\System\JepwnNt.exe
  C:\Windows\System\JepwnNt.exe
  2⤵
  PID:11524
- C:\Windows\System\gCtKxRh.exe
  C:\Windows\System\gCtKxRh.exe
  2⤵
  PID:11548
- C:\Windows\System\ORQRFoI.exe
  C:\Windows\System\ORQRFoI.exe
  2⤵
  PID:11572
- C:\Windows\System\AckOBOy.exe
  C:\Windows\System\AckOBOy.exe
  2⤵
  PID:11596
- C:\Windows\System\nqlORFA.exe
  C:\Windows\System\nqlORFA.exe
  2⤵
  PID:11624
- C:\Windows\System\pPRHPiC.exe
  C:\Windows\System\pPRHPiC.exe
  2⤵
  PID:11648
- C:\Windows\System\ALqfrGd.exe
  C:\Windows\System\ALqfrGd.exe
  2⤵
  PID:11672
- C:\Windows\System\sxZLrYO.exe
  C:\Windows\System\sxZLrYO.exe
  2⤵
  PID:11692
- C:\Windows\System\DKLYqvr.exe
  C:\Windows\System\DKLYqvr.exe
  2⤵
  PID:11720
- C:\Windows\System\hTqIaDh.exe
  C:\Windows\System\hTqIaDh.exe
  2⤵
  PID:11752
- C:\Windows\System\lNPvTdN.exe
  C:\Windows\System\lNPvTdN.exe
  2⤵
  PID:11780
- C:\Windows\System\sjTanLI.exe
  C:\Windows\System\sjTanLI.exe
  2⤵
  PID:11804
- C:\Windows\System\AoteJhX.exe
  C:\Windows\System\AoteJhX.exe
  2⤵
  PID:11820
- C:\Windows\System\ftnUtbN.exe
  C:\Windows\System\ftnUtbN.exe
  2⤵
  PID:11844
- C:\Windows\System\BEHeYKu.exe
  C:\Windows\System\BEHeYKu.exe
  2⤵
  PID:11868
- C:\Windows\System\rcWzclb.exe
  C:\Windows\System\rcWzclb.exe
  2⤵
  PID:11892
- C:\Windows\System\EKtibWZ.exe
  C:\Windows\System\EKtibWZ.exe
  2⤵
  PID:11916
- C:\Windows\System\dffMcOH.exe
  C:\Windows\System\dffMcOH.exe
  2⤵
  PID:11940
- C:\Windows\System\IRdlYCU.exe
  C:\Windows\System\IRdlYCU.exe
  2⤵
  PID:11960
- C:\Windows\System\NUCgJZp.exe
  C:\Windows\System\NUCgJZp.exe
  2⤵
  PID:11980
- C:\Windows\System\JWeHlHk.exe
  C:\Windows\System\JWeHlHk.exe
  2⤵
  PID:12008
- C:\Windows\System\YNhiruG.exe
  C:\Windows\System\YNhiruG.exe
  2⤵
  PID:12040
- C:\Windows\System\efarYCH.exe
  C:\Windows\System\efarYCH.exe
  2⤵
  PID:12060
- C:\Windows\System\beilRUz.exe
  C:\Windows\System\beilRUz.exe
  2⤵
  PID:12080
- C:\Windows\System\hgQoKsy.exe
  C:\Windows\System\hgQoKsy.exe
  2⤵
  PID:12104
- C:\Windows\System\rLGmQpS.exe
  C:\Windows\System\rLGmQpS.exe
  2⤵
  PID:12124
- C:\Windows\System\OxJxkes.exe
  C:\Windows\System\OxJxkes.exe
  2⤵
  PID:12144
- C:\Windows\System\ZXpxNhs.exe
  C:\Windows\System\ZXpxNhs.exe
  2⤵
  PID:12172
- C:\Windows\System\YGaWpRE.exe
  C:\Windows\System\YGaWpRE.exe
  2⤵
  PID:12200
- C:\Windows\System\hdWSLBy.exe
  C:\Windows\System\hdWSLBy.exe
  2⤵
  PID:12224
- C:\Windows\System\llWOXZJ.exe
  C:\Windows\System\llWOXZJ.exe
  2⤵
  PID:12248
- C:\Windows\System\PXolfbu.exe
  C:\Windows\System\PXolfbu.exe
  2⤵
  PID:12268
- C:\Windows\System\GxvHLLh.exe
  C:\Windows\System\GxvHLLh.exe
  2⤵
  PID:9640
- C:\Windows\System\BesbwfG.exe
  C:\Windows\System\BesbwfG.exe
  2⤵
  PID:10272
- C:\Windows\System\fPKmkDp.exe
  C:\Windows\System\fPKmkDp.exe
  2⤵
  PID:10388
- C:\Windows\System\EUspsKE.exe
  C:\Windows\System\EUspsKE.exe
  2⤵
  PID:10516
- C:\Windows\System\zkMxQbx.exe
  C:\Windows\System\zkMxQbx.exe
  2⤵
  PID:7604
- C:\Windows\System\vQMCFWS.exe
  C:\Windows\System\vQMCFWS.exe
  2⤵
  PID:10624
- C:\Windows\System\BBFqARq.exe
  C:\Windows\System\BBFqARq.exe
  2⤵
  PID:10652
- C:\Windows\System\jLgTAyi.exe
  C:\Windows\System\jLgTAyi.exe
  2⤵
  PID:10724
- C:\Windows\System\IrQjTFC.exe
  C:\Windows\System\IrQjTFC.exe
  2⤵
  PID:10756
- C:\Windows\System\hEVjxRM.exe
  C:\Windows\System\hEVjxRM.exe
  2⤵
  PID:9992
- C:\Windows\System\iLsYwXU.exe
  C:\Windows\System\iLsYwXU.exe
  2⤵
  PID:10876
- C:\Windows\System\xENiSCB.exe
  C:\Windows\System\xENiSCB.exe
  2⤵
  PID:10884
- C:\Windows\System\kCLedjN.exe
  C:\Windows\System\kCLedjN.exe
  2⤵
  PID:10928
- C:\Windows\System\OsVrjXW.exe
  C:\Windows\System\OsVrjXW.exe
  2⤵
  PID:10956
- C:\Windows\System\KOZSAfT.exe
  C:\Windows\System\KOZSAfT.exe
  2⤵
  PID:10188
- C:\Windows\System\JoghOgQ.exe
  C:\Windows\System\JoghOgQ.exe
  2⤵
  PID:11108
- C:\Windows\System\weGjXAm.exe
  C:\Windows\System\weGjXAm.exe
  2⤵
  PID:8672
- C:\Windows\System\vKTzUqm.exe
  C:\Windows\System\vKTzUqm.exe
  2⤵
  PID:11196
- C:\Windows\System\tRaIjGO.exe
  C:\Windows\System\tRaIjGO.exe
  2⤵
  PID:6616
- C:\Windows\System\WgwUQQm.exe
  C:\Windows\System\WgwUQQm.exe
  2⤵
  PID:9680
- C:\Windows\System\ehmCFQS.exe
  C:\Windows\System\ehmCFQS.exe
  2⤵
  PID:7620
- C:\Windows\System\YorLrae.exe
  C:\Windows\System\YorLrae.exe
  2⤵
  PID:9396
- C:\Windows\System\zCTlMqj.exe
  C:\Windows\System\zCTlMqj.exe
  2⤵
  PID:7976
- C:\Windows\System\teROtCU.exe
  C:\Windows\System\teROtCU.exe
  2⤵
  PID:10136
- C:\Windows\System\yMOuQrE.exe
  C:\Windows\System\yMOuQrE.exe
  2⤵
  PID:8616
- C:\Windows\System\SgoweRJ.exe
  C:\Windows\System\SgoweRJ.exe
  2⤵
  PID:10228
- C:\Windows\System\tEbmSJQ.exe
  C:\Windows\System\tEbmSJQ.exe
  2⤵
  PID:8692
- C:\Windows\System\FNvWeDO.exe
  C:\Windows\System\FNvWeDO.exe
  2⤵
  PID:6704
- C:\Windows\System\uVJgLMY.exe
  C:\Windows\System\uVJgLMY.exe
  2⤵
  PID:9556
- C:\Windows\System\SEoSLPI.exe
  C:\Windows\System\SEoSLPI.exe
  2⤵
  PID:11288
- C:\Windows\System\yOtfqQB.exe
  C:\Windows\System\yOtfqQB.exe
  2⤵
  PID:11320
- C:\Windows\System\kzcVLEK.exe
  C:\Windows\System\kzcVLEK.exe
  2⤵
  PID:10312
- C:\Windows\System\BccQJtb.exe
  C:\Windows\System\BccQJtb.exe
  2⤵
  PID:12300
- C:\Windows\System\eneNNGT.exe
  C:\Windows\System\eneNNGT.exe
  2⤵
  PID:12320
- C:\Windows\System\rmmNVou.exe
  C:\Windows\System\rmmNVou.exe
  2⤵
  PID:12340
- C:\Windows\System\eLYSPXU.exe
  C:\Windows\System\eLYSPXU.exe
  2⤵
  PID:12364
- C:\Windows\System\qGJFlNa.exe
  C:\Windows\System\qGJFlNa.exe
  2⤵
  PID:12384
- C:\Windows\System\ilheLvg.exe
  C:\Windows\System\ilheLvg.exe
  2⤵
  PID:12408
- C:\Windows\System\SSaRbNh.exe
  C:\Windows\System\SSaRbNh.exe
  2⤵
  PID:12428
- C:\Windows\System\zwwGtDl.exe
  C:\Windows\System\zwwGtDl.exe
  2⤵
  PID:12452
- C:\Windows\System\DyNBaJU.exe
  C:\Windows\System\DyNBaJU.exe
  2⤵
  PID:12472
- C:\Windows\System\VRDCcFM.exe
  C:\Windows\System\VRDCcFM.exe
  2⤵
  PID:12492
- C:\Windows\System\ifuVSlG.exe
  C:\Windows\System\ifuVSlG.exe
  2⤵
  PID:12516
- C:\Windows\System\ycqDoFK.exe
  C:\Windows\System\ycqDoFK.exe
  2⤵
  PID:12536
- C:\Windows\System\wqLnwZI.exe
  C:\Windows\System\wqLnwZI.exe
  2⤵
  PID:12560
- C:\Windows\System\PogkaAK.exe
  C:\Windows\System\PogkaAK.exe
  2⤵
  PID:12580
- C:\Windows\System\ieZmKrN.exe
  C:\Windows\System\ieZmKrN.exe
  2⤵
  PID:12604
- C:\Windows\System\bSRSYmm.exe
  C:\Windows\System\bSRSYmm.exe
  2⤵
  PID:12624
- C:\Windows\System\vUZsdRW.exe
  C:\Windows\System\vUZsdRW.exe
  2⤵
  PID:12648
- C:\Windows\System\rtXvPqb.exe
  C:\Windows\System\rtXvPqb.exe
  2⤵
  PID:12668
- C:\Windows\System\thomqOq.exe
  C:\Windows\System\thomqOq.exe
  2⤵
  PID:12692
- C:\Windows\System\jygkpNA.exe
  C:\Windows\System\jygkpNA.exe
  2⤵
  PID:12712
- C:\Windows\System\QqYsXXu.exe
  C:\Windows\System\QqYsXXu.exe
  2⤵
  PID:12740
- C:\Windows\System\sQGzIlT.exe
  C:\Windows\System\sQGzIlT.exe
  2⤵
  PID:12764
- C:\Windows\System\ToYyVYf.exe
  C:\Windows\System\ToYyVYf.exe
  2⤵
  PID:12796
- C:\Windows\System\SCdbfNA.exe
  C:\Windows\System\SCdbfNA.exe
  2⤵
  PID:12820
- C:\Windows\System\HLnoINj.exe
  C:\Windows\System\HLnoINj.exe
  2⤵
  PID:12844
- C:\Windows\System\VMgsWef.exe
  C:\Windows\System\VMgsWef.exe
  2⤵
  PID:12888
- C:\Windows\System\zQpeaZK.exe
  C:\Windows\System\zQpeaZK.exe
  2⤵
  PID:11520
- C:\Windows\System\enNveYa.exe
  C:\Windows\System\enNveYa.exe
  2⤵
  PID:4188
- C:\Windows\System\nIpyLIY.exe
  C:\Windows\System\nIpyLIY.exe
  2⤵
  PID:10852
- C:\Windows\System\FKbJmrF.exe
  C:\Windows\System\FKbJmrF.exe
  2⤵
  PID:10064
- C:\Windows\System\vllRBNn.exe
  C:\Windows\System\vllRBNn.exe
  2⤵
  PID:10968
- C:\Windows\System\ogxxKAV.exe
  C:\Windows\System\ogxxKAV.exe
  2⤵
  PID:12088
- C:\Windows\System\PhSxrfO.exe
  C:\Windows\System\PhSxrfO.exe
  2⤵
  PID:8716
- C:\Windows\System\NyBrVbX.exe
  C:\Windows\System\NyBrVbX.exe
  2⤵
  PID:12136
- C:\Windows\System\IMikpaK.exe
  C:\Windows\System\IMikpaK.exe
  2⤵
  PID:12196
- C:\Windows\System\YLBBnuS.exe
  C:\Windows\System\YLBBnuS.exe
  2⤵
  PID:11244
- C:\Windows\System\SjyYWuJ.exe
  C:\Windows\System\SjyYWuJ.exe
  2⤵
  PID:10248
- C:\Windows\System\BqblJbl.exe
  C:\Windows\System\BqblJbl.exe
  2⤵
  PID:9208
- C:\Windows\System\RDSWCYP.exe
  C:\Windows\System\RDSWCYP.exe
  2⤵
  PID:8312
- C:\Windows\System\sbLJMRm.exe
  C:\Windows\System\sbLJMRm.exe
  2⤵
  PID:11236
- C:\Windows\System\nXsQIpG.exe
  C:\Windows\System\nXsQIpG.exe
  2⤵
  PID:8244
- C:\Windows\System\cxXypTv.exe
  C:\Windows\System\cxXypTv.exe
  2⤵
  PID:8300
- C:\Windows\System\lSDGluD.exe
  C:\Windows\System\lSDGluD.exe
  2⤵
  PID:8892
- C:\Windows\System\YrHEyxA.exe
  C:\Windows\System\YrHEyxA.exe
  2⤵
  PID:9516
- C:\Windows\System\qBaLsAu.exe
  C:\Windows\System\qBaLsAu.exe
  2⤵
  PID:11388
- C:\Windows\System\SfjrRci.exe
  C:\Windows\System\SfjrRci.exe
  2⤵
  PID:12336
- C:\Windows\System\oLdJvCF.exe
  C:\Windows\System\oLdJvCF.exe
  2⤵
  PID:10488
- C:\Windows\System\dQgBkMx.exe
  C:\Windows\System\dQgBkMx.exe
  2⤵
  PID:12576
- C:\Windows\System\vocPuFX.exe
  C:\Windows\System\vocPuFX.exe
  2⤵
  PID:10716
- C:\Windows\System\rNdWhpz.exe
  C:\Windows\System\rNdWhpz.exe
  2⤵
  PID:11748
- C:\Windows\System\wOKcMKY.exe
  C:\Windows\System\wOKcMKY.exe
  2⤵
  PID:10836
- C:\Windows\System\SVmHjeQ.exe
  C:\Windows\System\SVmHjeQ.exe
  2⤵
  PID:11912
- C:\Windows\System\FtUciTt.exe
  C:\Windows\System\FtUciTt.exe
  2⤵
  PID:11976
- C:\Windows\System\rIppmKu.exe
  C:\Windows\System\rIppmKu.exe
  2⤵
  PID:11076
- C:\Windows\System\aGnHzMg.exe
  C:\Windows\System\aGnHzMg.exe
  2⤵
  PID:11240
- C:\Windows\System\UMAgUKA.exe
  C:\Windows\System\UMAgUKA.exe
  2⤵
  PID:10636
- C:\Windows\System\MwBLKSV.exe
  C:\Windows\System\MwBLKSV.exe
  2⤵
  PID:10912
- C:\Windows\System\zzEXOsp.exe
  C:\Windows\System\zzEXOsp.exe
  2⤵
  PID:9932
- C:\Windows\System\CGwmeeM.exe
  C:\Windows\System\CGwmeeM.exe
  2⤵
  PID:9852
- C:\Windows\System\fneyblB.exe
  C:\Windows\System\fneyblB.exe
  2⤵
  PID:7384
- C:\Windows\System\TXVHyLM.exe
  C:\Windows\System\TXVHyLM.exe
  2⤵
  PID:11268
- C:\Windows\System\TnxOHDH.exe
  C:\Windows\System\TnxOHDH.exe
  2⤵
  PID:11356
- C:\Windows\System\HUisVnS.exe
  C:\Windows\System\HUisVnS.exe
  2⤵
  PID:13036
- C:\Windows\System\KdIVNxi.exe
  C:\Windows\System\KdIVNxi.exe
  2⤵
  PID:12380
- C:\Windows\System\jlCRidn.exe
  C:\Windows\System\jlCRidn.exe
  2⤵
  PID:12424
- C:\Windows\System\uyMuJrJ.exe
  C:\Windows\System\uyMuJrJ.exe
  2⤵
  PID:11448
- C:\Windows\System\abXYHCh.exe
  C:\Windows\System\abXYHCh.exe
  2⤵
  PID:12468
- C:\Windows\System\zDVCcVm.exe
  C:\Windows\System\zDVCcVm.exe
  2⤵
  PID:12484
- C:\Windows\System\BbbyzlQ.exe
  C:\Windows\System\BbbyzlQ.exe
  2⤵
  PID:12524
- C:\Windows\System\EemDVMI.exe
  C:\Windows\System\EemDVMI.exe
  2⤵
  PID:12528
- C:\Windows\System\PSznteC.exe
  C:\Windows\System\PSznteC.exe
  2⤵
  PID:11584
- C:\Windows\System\YNPzGln.exe
  C:\Windows\System\YNPzGln.exe
  2⤵
  PID:12684
- C:\Windows\System\uEpnGJn.exe
  C:\Windows\System\uEpnGJn.exe
  2⤵
  PID:12720
- C:\Windows\System\OoNGSGT.exe
  C:\Windows\System\OoNGSGT.exe
  2⤵
  PID:12760
- C:\Windows\System\yKPpoKb.exe
  C:\Windows\System\yKPpoKb.exe
  2⤵
  PID:12784
- C:\Windows\System\BvkboNV.exe
  C:\Windows\System\BvkboNV.exe
  2⤵
  PID:13200
- C:\Windows\System\hZgmPaA.exe
  C:\Windows\System\hZgmPaA.exe
  2⤵
  PID:6384
- C:\Windows\System\TSCAwMM.exe
  C:\Windows\System\TSCAwMM.exe
  2⤵
  PID:8920
- C:\Windows\System\rZmLoJQ.exe
  C:\Windows\System\rZmLoJQ.exe
  2⤵
  PID:12636
- C:\Windows\System\SspHHqr.exe
  C:\Windows\System\SspHHqr.exe
  2⤵
  PID:12948
- C:\Windows\System\TdkhxVR.exe
  C:\Windows\System\TdkhxVR.exe
  2⤵
  PID:13140
- C:\Windows\System\xXveRxy.exe
  C:\Windows\System\xXveRxy.exe
  2⤵
  PID:12756
- C:\Windows\System\oSSMHKQ.exe
  C:\Windows\System\oSSMHKQ.exe
  2⤵
  PID:2308
- C:\Windows\System\ASLDauJ.exe
  C:\Windows\System\ASLDauJ.exe
  2⤵
  PID:10972
- C:\Windows\System\zjtvVjE.exe
  C:\Windows\System\zjtvVjE.exe
  2⤵
  PID:8428
- C:\Windows\System\zZQNIli.exe
  C:\Windows\System\zZQNIli.exe
  2⤵
  PID:11876
- C:\Windows\System\iUvxUyV.exe
  C:\Windows\System\iUvxUyV.exe
  2⤵
  PID:12444
- C:\Windows\System\RSekqjM.exe
  C:\Windows\System\RSekqjM.exe
  2⤵
  PID:13156
- C:\Windows\System\KajJavK.exe
  C:\Windows\System\KajJavK.exe
  2⤵
  PID:11812
- C:\Windows\System\ucZvqTD.exe
  C:\Windows\System\ucZvqTD.exe
  2⤵
  PID:12180
- C:\Windows\System\ACuZizM.exe
  C:\Windows\System\ACuZizM.exe
  2⤵
  PID:9144
- C:\Windows\System\MDRLfse.exe
  C:\Windows\System\MDRLfse.exe
  2⤵
  PID:5496
- C:\Windows\System\hpycdlD.exe
  C:\Windows\System\hpycdlD.exe
  2⤵
  PID:11736
- C:\Windows\System\MNwGOQv.exe
  C:\Windows\System\MNwGOQv.exe
  2⤵
  PID:13228
- C:\Windows\System\KsslptA.exe
  C:\Windows\System\KsslptA.exe
  2⤵
  PID:13148
- C:\Windows\System\AUWgACD.exe
  C:\Windows\System\AUWgACD.exe
  2⤵
  PID:11972
- C:\Windows\System\xTjLLza.exe
  C:\Windows\System\xTjLLza.exe
  2⤵
  PID:12924
- C:\Windows\System\VxyIbDJ.exe
  C:\Windows\System\VxyIbDJ.exe
  2⤵
  PID:10432
- C:\Windows\System\QGRNdgP.exe
  C:\Windows\System\QGRNdgP.exe
  2⤵
  PID:12616
- C:\Windows\System\RjBqQli.exe
  C:\Windows\System\RjBqQli.exe
  2⤵
  PID:11680
- C:\Windows\System\WLLtpTK.exe
  C:\Windows\System\WLLtpTK.exe
  2⤵
  PID:13280
- C:\Windows\System\cLsldur.exe
  C:\Windows\System\cLsldur.exe
  2⤵
  PID:12572
- C:\Windows\System\jKmTWPF.exe
  C:\Windows\System\jKmTWPF.exe
  2⤵
  PID:12296
- C:\Windows\System\TOagDmv.exe
  C:\Windows\System\TOagDmv.exe
  2⤵
  PID:12944
- C:\Windows\System\cGeQFbW.exe
  C:\Windows\System\cGeQFbW.exe
  2⤵
  PID:12132
- C:\Windows\System\DAxkQSK.exe
  C:\Windows\System\DAxkQSK.exe
  2⤵
  PID:12360
- C:\Windows\System\qwgHbKF.exe
  C:\Windows\System\qwgHbKF.exe
  2⤵
  PID:13320
- C:\Windows\System\qYUBWjN.exe
  C:\Windows\System\qYUBWjN.exe
  2⤵
  PID:13356
- C:\Windows\System\JjGYCbH.exe
  C:\Windows\System\JjGYCbH.exe
  2⤵
  PID:13460
- C:\Windows\System\EFEbgit.exe
  C:\Windows\System\EFEbgit.exe
  2⤵
  PID:13476
- C:\Windows\System\nQfeUbU.exe
  C:\Windows\System\nQfeUbU.exe
  2⤵
  PID:13496
- C:\Windows\System\gdisGfF.exe
  C:\Windows\System\gdisGfF.exe
  2⤵
  PID:13512
- C:\Windows\System\PflHnTu.exe
  C:\Windows\System\PflHnTu.exe
  2⤵
  PID:13532
- C:\Windows\System\VhEGlcF.exe
  C:\Windows\System\VhEGlcF.exe
  2⤵
  PID:13600
- C:\Windows\System\qiWiyxx.exe
  C:\Windows\System\qiWiyxx.exe
  2⤵
  PID:13620
- C:\Windows\System\bHYXHRJ.exe
  C:\Windows\System\bHYXHRJ.exe
  2⤵
  PID:13684
- C:\Windows\System\kMnDlwb.exe
  C:\Windows\System\kMnDlwb.exe
  2⤵
  PID:13700
- C:\Windows\System\KPVuebx.exe
  C:\Windows\System\KPVuebx.exe
  2⤵
  PID:13716
- C:\Windows\System\tLTmhPo.exe
  C:\Windows\System\tLTmhPo.exe
  2⤵
  PID:13752
- C:\Windows\System\sGSymeH.exe
  C:\Windows\System\sGSymeH.exe
  2⤵
  PID:14000
- C:\Windows\System\DpBukoj.exe
  C:\Windows\System\DpBukoj.exe
  2⤵
  PID:14040
- C:\Windows\System\OejMjKT.exe
  C:\Windows\System\OejMjKT.exe
  2⤵
  PID:14116
- C:\Windows\System\mGsjsCl.exe
  C:\Windows\System\mGsjsCl.exe
  2⤵
  PID:14140
- C:\Windows\System\vXSQpGj.exe
  C:\Windows\System\vXSQpGj.exe
  2⤵
  PID:11796
- C:\Windows\System\XrLSeJe.exe
  C:\Windows\System\XrLSeJe.exe
  2⤵
  PID:9776
- C:\Windows\System\sKgeQnM.exe
  C:\Windows\System\sKgeQnM.exe
  2⤵
  PID:13004
- C:\Windows\System\wYLlbnX.exe
  C:\Windows\System\wYLlbnX.exe
  2⤵
  PID:13540
- C:\Windows\System\eOjwUhI.exe
  C:\Windows\System\eOjwUhI.exe
  2⤵
  PID:13092
- C:\Windows\System\SGeyhgz.exe
  C:\Windows\System\SGeyhgz.exe
  2⤵
  PID:13660
- C:\Windows\System\txuZwor.exe
  C:\Windows\System\txuZwor.exe
  2⤵
  PID:13648
- C:\Windows\System\DUfCioH.exe
  C:\Windows\System\DUfCioH.exe
  2⤵
  PID:13856
- C:\Windows\System\umlAALj.exe
  C:\Windows\System\umlAALj.exe
  2⤵
  PID:13804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LA4X8NGR\home-993d2c38b2c1[1].css

Filesize
11KB

MD5
6328d6d9a6b00ce7f992230b97b17c1f

SHA1
88837b802bdde407e37e92641072ea2eeec95556

SHA256
c9d9b80794cebd7d97daf52f7f0ce0e31bcf7a6f65a6e07851c688d67f10dba8

SHA512
993d2c38b2c15499aebdb39c1f9c21d0501d4c2a5973caec65be9ddc3ddfd6e46d06449e7483daa4fa9afa17cb81ff27a391519a64629169eb15c52911aab2c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b0zacsn0.jry.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ArHobuz.exe

Filesize
2.2MB

MD5
0b4ee54d74f6b52cc109c8efbc06bbee

SHA1
3f89aac70ca1178d52d269d564ab84b5a9e61a99

SHA256
7c30cf5e58192a572ae57b490323c2b260a6a42748720e425893a56c16d3e5cb

SHA512
c29d898483603a93d75a937c3ff820f4b9cc0431110d6169f09e6786b272d81ada4fa01099b839dd491dbe2244df3e1234a4ce2f4568fa6cde3d51c78a0fd9ce

Download Submit
C:\Windows\System\BCyHhmc.exe

Filesize
2.2MB

MD5
57f0c83d1afff896e8c80c7df97cad51

SHA1
c26831798a3236ecf5be9f0e46ec510a78d37253

SHA256
d4b174326bb6be3a6a96a59628ae5dcd4728b0e4697b9c52433ca4171456ffdf

SHA512
e3989ce9871a9e041817cd92d06cd62844d4b4b7c08b23baf05c295afe9329cc37fdd0472e746eac140185ddd454e4920086475461e3a3112b5ef5be3c2b6c9f

Download Submit
C:\Windows\System\CctGYDI.exe

Filesize
2.2MB

MD5
41b05a53ba36e7eefaf6d1cfd6b75951

SHA1
3d83df163e5758405e3ad83894157293b0b2027e

SHA256
ece2e033e2a007975f3e10f83d355850f3b57e693cff8a6b113e89f649fdebec

SHA512
b6cbcb76e8c623d0533e2b366de12e0b09383a3fd320386e07c0164e65ecb5b61f5304abec8d7f76d102f5b02f1c858422e488231c9ee11378cb6eacfc00321c

Download Submit
C:\Windows\System\GNuArsz.exe

Filesize
2.2MB

MD5
09c674ba0cdddcfb80a9740f4ae693e6

SHA1
ad44e8418df4090965fc6553da9f014580006701

SHA256
9a57573bf808c0853de54111bdc14a61c719842ce8779d2b7d74e45e912e9c13

SHA512
9b510bcd7733e6ae38ea8ebea9eee83167b0d850393cf6a2c0d3914685fa4b96638cb1b6402b8e93b5e30aa460a7eb889885bdda3f18581fc2fbbf00beb63f3b

Download Submit
C:\Windows\System\GPqWcUv.exe

Filesize
2.2MB

MD5
e36a8828ab4aa063f7fb237683c80449

SHA1
46ee65cc40730d0ddec51a2fbeea20185e7f4b95

SHA256
23b5c98a34224d545ee064820941f6f4e9d9ad6e10957bea23e45e451ec3e4de

SHA512
2c43a9b0f4bc701622ca81b19bb72743e12d0f1ee23c73183b643ff75c6a547341475e3323cc8fc1e14bd84857d6d7bc8599cb29aee4fc7c1ea655ccff63224e

Download Submit
C:\Windows\System\HclAqlD.exe

Filesize
2.2MB

MD5
36885291bcbd7b3c249eba89d16a6344

SHA1
062a42af133a2aab41fcb4e85824da89551c801b

SHA256
c90bfc9a71d156ef8ee33a80b14b6be03c7bdeb77a27f24b7e9de48493426dfd

SHA512
dcf78c1a64efd6465f260445adc8c6f53be7f24fb79d722fc8af05c35b11db70d8d41c9a46b9d4217915e20ab91ec9a6eb23addb02f919f2bf525ca7ce145998

Download Submit
C:\Windows\System\IaARqqG.exe

Filesize
2.2MB

MD5
b7db67e529fce9b2a4b5ebe37fbcd5b2

SHA1
6d2453f509b87fcaeb5149616d48cea745500495

SHA256
90749fc5ee55ae03deb85826c5696347879c2aab732457d493d036f02b838332

SHA512
9e05a527357871dc496086aea878b64d1550bf3257e660d713b8533e3b8c8b24fc81e0c6be92796bfcf45fef5b449b6388916f12e73f48b6e67470d070907a4f

Download Submit
C:\Windows\System\IcKvfVm.exe

Filesize
2.2MB

MD5
28793feb60e528f9be0c4e45fddd6023

SHA1
af037c53a3f1f65c5d131cdb3bfed24ff3d4563b

SHA256
aff540c0ecca9dff363a44f189520a947b9c9e45357f3ce7f113835a9ce751f3

SHA512
11db89a2828e619e9a648c64919f050d8bd590541ad7ff4ae54dc9d5dd848f2d4886a4c484aa5b51c89bd37321e15663f54f85119d29b08c2ad13c87be2d87af

Download Submit
C:\Windows\System\JdbrInN.exe

Filesize
2.2MB

MD5
431917ce13eda04842492054b4be4d9e

SHA1
363d5085cb1496d06ccc720ebd86ff359e1134a8

SHA256
e9021002539d73313590a61f9ec16d71b5017e9e9c645f0de34f40b909a0df71

SHA512
a1b672d9b26e446d83f438cf8ee96f7c5a37583afdac31e35ea4d831ae1ac5db0832aa7d46902f4809a4e6d5dc03e4b7f43970384715a91a614fc28777bf9c38

Download Submit
C:\Windows\System\SKxfrFu.exe

Filesize
2.2MB

MD5
08797b9559e07206cb131b67561d06e9

SHA1
f39a623026481761cf0839193706a70f920ef67a

SHA256
c1219250c56c521b6f5c2fdab62e3782ae06d9c115e006af0a8bc78c023cd0ab

SHA512
213f7519adf4065d18e506589a32ae29a3ee1b0a34cb9f422204c38f0beac5a20385bc2a6b55ef2eb7916a6609d249b78a98e5aa403cd21ab0663cbeea474ec4

Download Submit
C:\Windows\System\SckxTCu.exe

Filesize
2.2MB

MD5
f0870295c092cc8ea42f966f449c1d39

SHA1
578b8083e3fd163d5f983f835a95bb1b417a7520

SHA256
a388d40d06a5ccd3529cd429f95d8a42842f61a00a1c488ad21e85292ef7aef1

SHA512
11bd9c7aac376912128fe63e349e2ff4e9af83bd4696413a7de51cea41149ea98da7329ad61a7bbf4bccdfd53d6b0673ed1bba3761d0042df5130dc07f3b511d

Download Submit
C:\Windows\System\UPyHmnU.exe

Filesize
2.2MB

MD5
6d181b22a90667f522c92d0e6e2e4474

SHA1
a8bb61b17bf010d45af19e992505c0a57b04f9d4

SHA256
6c9a6c85f13dde8da0b3e42a42a37880ce85e713d1e5f6f180f4217d95a5eef9

SHA512
325fce4510a419f725bbeaca246274ccde9f4c3c117776d86b596a97726cf08d2765c52dec5c624ad64b979f4e2d2d6d3550ad1b61000751178d2d177fc2b0bd

Download Submit
C:\Windows\System\WFAuVuo.exe

Filesize
2.2MB

MD5
25b8e4c6d98f1fe45c7a382e0c393dc3

SHA1
f9247c805acb5732ec52481979a793441dbcaf7b

SHA256
bcde97d8a436041e589fe6e07b9fdc481e42ed6eebe5e4c46639e08a53a38796

SHA512
def41e10874853d2e7cc73b7badf47422720e4e87893a38f0ddf46cb06de631a34b62848a532314e83548b228bb72b9563cdd238c3f1dea3ec9743560eeb5934

Download Submit
C:\Windows\System\WhifpRE.exe

Filesize
2.2MB

MD5
caa49341ea5d431e6a4fc5b0355a6cd7

SHA1
0013d03021087a08799609ef4d235cdda8c1ff57

SHA256
91c7ef24f2a914196e6a40b5f8326632edd3423f760d2c3f6ee7a5bca11778d1

SHA512
270036922ed89cfa81c612f91a0bf334a900cd4236b4fdb7c4b9277017d249477c2169b49a4b83fb20b0faedb25d4f04ecaf826d00cf27cd829573295b3b839b

Download Submit
C:\Windows\System\XCTwljs.exe

Filesize
2.2MB

MD5
0404b8af6b79642ddcb3d2fd01643273

SHA1
b4dd3c4e8a1ee5af98d39d4e30c0ec4dffac97f7

SHA256
15c6a4b5d7bd0b7e2b779f6ba3ce100be878b17d2e52eb31af142c79e16c695c

SHA512
c326d0baf47e14cc7f68d5de27a0f3833d8ba3a99c11452997f691def62045b6786a0fb0afe04e5138af35acb13fa4209e2ea00ae71e37358940e2f3ce0ee347

Download Submit
C:\Windows\System\XRAODSh.exe

Filesize
2.2MB

MD5
aa46d463dac21abf9b28c0eec5bdca23

SHA1
3bad73d9996db909a1f3713b1c548339272b7660

SHA256
cd5d3d8d4bbd709c98abd86d8d784df46fb974ac597713f7fc5adc2add0c574f

SHA512
bc99bc591f17d5842ae4883d364bd5587eeece9901049cffc5ab5996c88db926b8c4fe2c193cf1b5ff1249400fdb6ec98f79e02f149eca9d6ffbe4fbaddd4fde

Download Submit
C:\Windows\System\YIickxh.exe

Filesize
2.2MB

MD5
40233cc4c41b81761c81c73977492af0

SHA1
6a9c833142bf4ad48310d7033e30308a2254a059

SHA256
3d8af6fc2476480f719af84d93b1cf4fb1915b7e8174423ddcc0cfb331998fa0

SHA512
552534bd1e247c992e79ebfd1f540d303628e57dd958151280e33cf204066e0350bfc11ce709a4ba444150c0554092fb3b76ef869d9924f8ea2b9a0fe7e0dba4

Download Submit
C:\Windows\System\bBUlOcw.exe

Filesize
2.2MB

MD5
12242903fec2542bd14cdf29ef04a7ca

SHA1
e7eaca4e5cedb15a0d0dc7439745ae5d8579e000

SHA256
d4f0e4c5cec3baf2c7c5ecf37005291986b38723714947a97e777d1fd39922e8

SHA512
e432813dfa006b9a1ae88055439bb74de1572f212e9e6b5e34e14b2b8969f126da5109a33626c994c2fccfeb53dc8e8af63edb25b34b1defc010a284c137b710

Download Submit
C:\Windows\System\bUCgxgg.exe

Filesize
2.2MB

MD5
234747610633ab0de1e2fa841476e2f6

SHA1
67ab5a2b72a350b596765f7db84bada41abdea57

SHA256
3379799c93efe3322e563fbea49e0a834417c67a2ec195d287eb63ec72b424d9

SHA512
dfa07b3f09d7f8ebb737e548efd796c36ef32d544c90268f6341cb5291b0e6cfe9be00cda121f63d25ed9bcb1d825dda1cec01e88f59624166d8eeea5a6c43c9

Download Submit
C:\Windows\System\boPihLl.exe

Filesize
2.2MB

MD5
a92e308cdb059fe697b09891b3db1dfc

SHA1
cbe73f4f539ece58e6c00e2049f016d114cce5a3

SHA256
f36f4c71e43186ff0004652e185ad3a52be222051a270489e18a1df059e344e0

SHA512
b4be020e29829bc3566fb555187e61dbf7b670bf85c644e04cee40f8370f9e84908b021a8cbeddc08946b6a5679a27575700cc7745047cd50b17525b20b6e497

Download Submit
C:\Windows\System\cdICiMS.exe

Filesize
2.2MB

MD5
b6feeb74464e066ff31dbf2fe795b6ea

SHA1
d26ac4a6545765b823a941609d1f6dae79b6e60a

SHA256
46c1f78a4b635ddeb113776486cc2c412cfc227a79f1abf7121de1751c366abd

SHA512
d2ca76bc321a2dede12f022f9f4d42ad512cca2177559d6bd24e33fe42df7ed14f28fb45678b7c91fa310cdfea2ec26ab96c48564a6d56e361521f05661082ae

Download Submit
C:\Windows\System\dmvLBDR.exe

Filesize
2.2MB

MD5
ab7de6d4c122b2eee7284e6ee178adae

SHA1
9ed946f670e88669e08b2805f6c94de51c035150

SHA256
44ec6d0c3d4dfb141b97463bf79974000e21ab1f1bc9b3f753f9cba4f524580f

SHA512
e07e0ab2cbfd695b797f7f9ac851b25528659940bebe43f4e6b599774955e04848e647c9e3a9f5b0db09833e1d9c75aa40d319203335b90622890cbc58a8309d

Download Submit
C:\Windows\System\fglAeVl.exe

Filesize
2.2MB

MD5
0eecc52e670c0e03335d4c8590802182

SHA1
cef1bae2c6c91bd4ac3ac0562d1961007b464a93

SHA256
e5b121a97eadc404629f2b9ecced7036cf0d5cf3c609cea14d0bc29d0f37721c

SHA512
e3da5f5da6d27db658e833149cc104335f7635789cd43382f27eac9e2719efd31e2839e9c75baec2851d28861874811ec6efc127a14d46c729796af5f2b4a48d

Download Submit
C:\Windows\System\gGSLeOS.exe

Filesize
2.2MB

MD5
cc41980ab7b12b37fec2fb297b40987f

SHA1
17469f06e34216c4d286740a0385205eeb5dfb88

SHA256
3b3a76d74158ac498ca8812a3bac91f8f22ede22b51bc2e7bb2329d748483092

SHA512
f24505ab86cd2d320427028d772f26fc3eda8021581a068bc6f0cb008e7e86f7c5784d55cb4639d8af9694cd2c7172aa41635d0d487f53dc259d488ed0a4c3c3

Download Submit
C:\Windows\System\himTJgE.exe

Filesize
2.2MB

MD5
dbb7a80de0c3239d8aa6bf75ff3d4704

SHA1
2452b15c0a15d10a9a92420afab1830558482955

SHA256
64a9410d48b396914deaf674eef73a106a96fb6534a0a8625c72cd8f416899a6

SHA512
7342ab3dd8c9abf3f5337bd612aee4ad968526770fdef2d3af1f3333b4d1773076bfdcab219c6f8482203a473489aefb0285238d2e3c4488ea5a0d4bb10bf89f

Download Submit
C:\Windows\System\ikWkbLd.exe

Filesize
2.2MB

MD5
707205d6979946023dbc7256ca7b707d

SHA1
de1222e87c7f91d8f10b78e1ec93b9dab462ba42

SHA256
c523bf40d19e6c4d43877624fc31974ae6ce85132200bf89e3da997ac56ad547

SHA512
2477e2a5ca75f1afb758ee21568a80ef73e0d396de6078f671acb4848cf6956f8efce299bde63c56303e610b2e3f6f6664da45c2937d254aff9051231f2fbd15

Download Submit
C:\Windows\System\nggVKlp.exe

Filesize
2.2MB

MD5
e5094b01722449d466e914d0ffbb2f3a

SHA1
726951a94acadd931a75ba47c96fec105e409805

SHA256
f5171c21193bc1f288d22c5084f87aa34a0d1779054aebd80fb747c929ab430c

SHA512
636ed0da6ab8711f77ba3d291945e7e88c8edd2b56400f99267d5c963119a023c4fd30395f0cf9b4d3e7445d832e8657d724a492bdd8981fef781b1654117f8a

Download Submit
C:\Windows\System\qzHXyxn.exe

Filesize
2.2MB

MD5
56c956f75abdd852678356cb71842af8

SHA1
8e5ae22fb9f4990461ae792512b9256e4e7dd34e

SHA256
ff6b6a23f531f29c33bbe387f99b1189b8301b174e125d928d8571fc51fb7e16

SHA512
8d7649ea8026d117e2d05a98210f259254ff39ffab427e0cce3e50e5b496ea0afbd80430146d577ac38b5cc05c2f662535f9839e298f077eb6f276dd50713913

Download Submit
C:\Windows\System\rFsSKMd.exe

Filesize
2.2MB

MD5
f25e0aa6fba8add294d1bd6ee820e021

SHA1
c603b96777373df081d8cf771d82b159848b2e79

SHA256
5306a2e1c0fe537a61777c723f076738181a745dac1fcd8903d49f39bc3bae95

SHA512
cf8553a9a021ff72e198f3444242e681971e85eecf6383e8653bea52646e1f39bfceb17fd9dd72b11c5a6addee215b8daacfb918dc4bdb46ec375d5784e62ed5

Download Submit
C:\Windows\System\sOpkwel.exe

Filesize
2.2MB

MD5
943fe647ce75cc400c1011a8ba32d7c2

SHA1
27bbd3122653c75ea15405a183961b76252a9b07

SHA256
8db84e2429cffd86292920e6bbb57c8be7e50312fb9660984d112ad5d8f4c643

SHA512
466109da2ce9cfab62a18484549dc4e4ed6941f831f58987a8227d25076b49dc60c70db636cc9cdc7cedd9884e9fe46521887c655cb13f070ef4dc9504c879b1

Download Submit
C:\Windows\System\sutpwMO.exe

Filesize
2.2MB

MD5
7f043719878d005f2d3a848fe7b5f1fc

SHA1
d0ce0cc7652a2157102fe48c331b91147c790ac8

SHA256
71b802d526e5d34b34762fce3078440a67be511ad2e33df983a2435aae2d1040

SHA512
4d24a5447825cadc054bf85794fc04ab7cb33dc61bcb1c466a0e004473c7265aa0cf2dde0eb473b19b84a44c3f037d24a7cf84a808e00c9a562be1bbb166053d

Download Submit
C:\Windows\System\vrlYXXt.exe

Filesize
2.2MB

MD5
39f0e4c053ae95060f061a22274134d6

SHA1
8b3bc48e161c4845c8040cee57ce1d09d72bd4be

SHA256
91c312ccef69e518738e4807b090d617120f218b178b91d664bf70fdd55898fe

SHA512
066314d4d57af19a93de70dff9709d249b7c8b5d89debf658412a1a7d48e760cbe62f962aa1e8f13408fdd11c61af988da873d7324e74dcbdc3d3ef4693a2097

Download Submit
C:\Windows\System\wRQbyuY.exe

Filesize
2.2MB

MD5
e5f2852053c12a9e3ddef5f910f62deb

SHA1
f4d500e390086b365588d762cc2a2b6d049e7a7d

SHA256
9a6af94e3dab2c696284540fbe1830c06b84237eaeb12668fccd9c3d30ae76da

SHA512
9cf30be7c492fd5e569442afd64b86d6763a4aca2dea94049ff33d65c8a36a004dd5b151cb9f7055a96a3ac966769a8555b0f5234fd72f1d6765d46dad216e53

Download Submit
C:\Windows\System\wWySrok.exe

Filesize
2.2MB

MD5
7d7f6f6e473d1f26129a95c86e9cdb5d

SHA1
de68dcd1d9a8ad356389528273ca1a1bfebebfa6

SHA256
7203677b29a2b7d7e0ac1e9e667fef5beb9848256ca1609c808ef16f51bd9f17

SHA512
f4480182a3ca13f5f7e0ef3698de253b67ed2133092e5a3f971bfdc5a8c7912db6b5704b5da7185c5f5afacbc83966088bf862476dd174027d3049fb8bd61af9

Download Submit
C:\Windows\System\wqpKykb.exe

Filesize
2.2MB

MD5
5a991360dea8df465d4c5e84408dce64

SHA1
74cde17a6cf5affd387d2cbd37116a6aa4ab4396

SHA256
ab97614b2cdc2e4687069f817db8e2a7e2fc2ffdd8684441d362d6cb9e6fa929

SHA512
315da5d56c39385aa342212ccae7f745bc6de768dc630b587d83db1363f646fe5c288f2d646847d14e3953539af748efaf32819df619c04924e4d50c5347f736

Download Submit
C:\Windows\System\xsrtCBD.exe

Filesize
2.2MB

MD5
553eb7198689756887932ab6858ba967

SHA1
dcce548c40251f93586d80114e24b822492bff1f

SHA256
d5fba6ddc42ecdfe5bbc3966faf772ab6a2b5a38bb87f25b978d1da54e13cd82

SHA512
6017aacefbf40d35b54b0fa30821b5f76eab3a93cf0a391238d94add2f363df8e6595fae5994b3837d1dce8a6dd298f9b8c70805b05232e75972eb9047d3053f

Download Submit
C:\Windows\System\zlXoHsx.exe

Filesize
2.2MB

MD5
d09f2e10b4f273427077670053d41ba6

SHA1
cf04c7c96e6c82aef52e5f51bddf2c386fd5d4cd

SHA256
b5f21066626b6df1332eeeb6a3fa6a82573f252423aa6447e784a2b360df5dcf

SHA512
cd40464d7c3a786b50b4b88cd15f0b1835109990e6163142363ce40cd4c04f06a5cc63ab88a1caf2a165d469db1a67109b4ad6d4e070a401749f80e4b6df1849

Download Submit
memory/736-330-0x00007FF689F90000-0x00007FF68A382000-memory.dmp

Filesize
3.9MB

Download
memory/832-344-0x00007FF62BFD0000-0x00007FF62C3C2000-memory.dmp

Filesize
3.9MB

Download
memory/1112-224-0x00007FF6DD990000-0x00007FF6DDD82000-memory.dmp

Filesize
3.9MB

Download
memory/1392-35-0x00007FFA667F0000-0x00007FFA672B1000-memory.dmp

Filesize
10.8MB

Download
memory/1392-55-0x0000025182400000-0x0000025182410000-memory.dmp

Filesize
64KB

Download
memory/1392-135-0x000002519A940000-0x000002519A962000-memory.dmp

Filesize
136KB

Download
memory/1392-346-0x000002519B600000-0x000002519BDA6000-memory.dmp

Filesize
7.6MB

Download
memory/1416-0-0x00007FF638310000-0x00007FF638702000-memory.dmp

Filesize
3.9MB

Download
memory/1416-1-0x00000142D5650000-0x00000142D5660000-memory.dmp

Filesize
64KB

Download
memory/1588-61-0x00007FF64FC00000-0x00007FF64FFF2000-memory.dmp

Filesize
3.9MB

Download
memory/1752-345-0x00007FF644260000-0x00007FF644652000-memory.dmp

Filesize
3.9MB

Download
memory/2020-327-0x00007FF630FF0000-0x00007FF6313E2000-memory.dmp

Filesize
3.9MB

Download
memory/2140-250-0x00007FF650B80000-0x00007FF650F72000-memory.dmp

Filesize
3.9MB

Download
memory/2204-291-0x00007FF6E2B40000-0x00007FF6E2F32000-memory.dmp

Filesize
3.9MB

Download
memory/2544-343-0x00007FF7D1070000-0x00007FF7D1462000-memory.dmp

Filesize
3.9MB

Download
memory/2620-329-0x00007FF728400000-0x00007FF7287F2000-memory.dmp

Filesize
3.9MB

Download
memory/2628-266-0x00007FF731F00000-0x00007FF7322F2000-memory.dmp

Filesize
3.9MB

Download
memory/2672-85-0x00007FF623720000-0x00007FF623B12000-memory.dmp

Filesize
3.9MB

Download
memory/2696-152-0x00007FF75D1B0000-0x00007FF75D5A2000-memory.dmp

Filesize
3.9MB

Download
memory/3080-202-0x00007FF6E02A0000-0x00007FF6E0692000-memory.dmp

Filesize
3.9MB

Download
memory/3288-331-0x00007FF7CF8B0000-0x00007FF7CFCA2000-memory.dmp

Filesize
3.9MB

Download
memory/3292-264-0x00007FF736A30000-0x00007FF736E22000-memory.dmp

Filesize
3.9MB

Download
memory/3308-341-0x00007FF7CE930000-0x00007FF7CED22000-memory.dmp

Filesize
3.9MB

Download
memory/3344-292-0x00007FF7BB2E0000-0x00007FF7BB6D2000-memory.dmp

Filesize
3.9MB

Download
memory/3504-117-0x00007FF67E550000-0x00007FF67E942000-memory.dmp

Filesize
3.9MB

Download
memory/4532-342-0x00007FF77DAD0000-0x00007FF77DEC2000-memory.dmp

Filesize
3.9MB

Download
memory/5088-320-0x00007FF790E80000-0x00007FF791272000-memory.dmp

Filesize
3.9MB

Download