xmrig | ef6bf171c91db19306daafb0d600be2abadbc2b19a4a67ddac56783b82a28f6f

Analysis

max time kernel
91s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 04:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
Size

1.9MB
MD5

1f849ddd4e12a3a41d18c8d75cb36347
SHA1

e51e6cdc3f8ee0c11a7f684451501654db9abdf0
SHA256

ef6bf171c91db19306daafb0d600be2abadbc2b19a4a67ddac56783b82a28f6f
SHA512

237e796c4ebb45b42bc529f90b6b6dd27e534ce513078e8bd0d6ee71a66cf428d5456e41d8afaa2e6783c8ef3caf214054f59a067451f304435458bc3f67db8c
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHaffe:NABn

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/432-199-0x00007FF6E6AB0000-0x00007FF6E6EA2000-memory.dmp	xmrig
behavioral2/memory/1552-206-0x00007FF7EB4D0000-0x00007FF7EB8C2000-memory.dmp	xmrig
behavioral2/memory/4512-228-0x00007FF675500000-0x00007FF6758F2000-memory.dmp	xmrig
behavioral2/memory/2764-238-0x00007FF75D940000-0x00007FF75DD32000-memory.dmp	xmrig
behavioral2/memory/4092-247-0x00007FF6D9EE0000-0x00007FF6DA2D2000-memory.dmp	xmrig
behavioral2/memory/4544-246-0x00007FF7D4F20000-0x00007FF7D5312000-memory.dmp	xmrig
behavioral2/memory/4056-244-0x00007FF75B870000-0x00007FF75BC62000-memory.dmp	xmrig
behavioral2/memory/1156-243-0x00007FF6F11F0000-0x00007FF6F15E2000-memory.dmp	xmrig
behavioral2/memory/4228-241-0x00007FF7A0C90000-0x00007FF7A1082000-memory.dmp	xmrig
behavioral2/memory/3916-239-0x00007FF712AB0000-0x00007FF712EA2000-memory.dmp	xmrig
behavioral2/memory/720-229-0x00007FF653FE0000-0x00007FF6543D2000-memory.dmp	xmrig
behavioral2/memory/1788-227-0x00007FF669C70000-0x00007FF66A062000-memory.dmp	xmrig
behavioral2/memory/3468-217-0x00007FF77F210000-0x00007FF77F602000-memory.dmp	xmrig
behavioral2/memory/2232-205-0x00007FF67C860000-0x00007FF67CC52000-memory.dmp	xmrig
behavioral2/memory/1704-187-0x00007FF67E2A0000-0x00007FF67E692000-memory.dmp	xmrig
behavioral2/memory/380-160-0x00007FF63E9A0000-0x00007FF63ED92000-memory.dmp	xmrig
behavioral2/memory/3116-142-0x00007FF76A440000-0x00007FF76A832000-memory.dmp	xmrig
behavioral2/memory/3580-133-0x00007FF680B80000-0x00007FF680F72000-memory.dmp	xmrig
behavioral2/memory/2780-132-0x00007FF6CFD20000-0x00007FF6D0112000-memory.dmp	xmrig
behavioral2/memory/664-106-0x00007FF6209F0000-0x00007FF620DE2000-memory.dmp	xmrig
behavioral2/memory/1224-85-0x00007FF6C2A30000-0x00007FF6C2E22000-memory.dmp	xmrig
behavioral2/memory/4764-64-0x00007FF6C1B80000-0x00007FF6C1F72000-memory.dmp	xmrig
behavioral2/memory/1728-2969-0x00007FF75C210000-0x00007FF75C602000-memory.dmp	xmrig
behavioral2/memory/1544-2970-0x00007FF77FC80000-0x00007FF780072000-memory.dmp	xmrig
behavioral2/memory/1728-2974-0x00007FF75C210000-0x00007FF75C602000-memory.dmp	xmrig
behavioral2/memory/4764-2976-0x00007FF6C1B80000-0x00007FF6C1F72000-memory.dmp	xmrig
behavioral2/memory/1544-2978-0x00007FF77FC80000-0x00007FF780072000-memory.dmp	xmrig
behavioral2/memory/1224-2980-0x00007FF6C2A30000-0x00007FF6C2E22000-memory.dmp	xmrig
behavioral2/memory/664-2982-0x00007FF6209F0000-0x00007FF620DE2000-memory.dmp	xmrig
behavioral2/memory/4544-2984-0x00007FF7D4F20000-0x00007FF7D5312000-memory.dmp	xmrig
behavioral2/memory/2232-3004-0x00007FF67C860000-0x00007FF67CC52000-memory.dmp	xmrig
behavioral2/memory/3468-3000-0x00007FF77F210000-0x00007FF77F602000-memory.dmp	xmrig
behavioral2/memory/3916-3018-0x00007FF712AB0000-0x00007FF712EA2000-memory.dmp	xmrig
behavioral2/memory/720-3020-0x00007FF653FE0000-0x00007FF6543D2000-memory.dmp	xmrig
behavioral2/memory/2764-3016-0x00007FF75D940000-0x00007FF75DD32000-memory.dmp	xmrig
behavioral2/memory/4092-3014-0x00007FF6D9EE0000-0x00007FF6DA2D2000-memory.dmp	xmrig
behavioral2/memory/4512-3012-0x00007FF675500000-0x00007FF6758F2000-memory.dmp	xmrig
behavioral2/memory/380-3010-0x00007FF63E9A0000-0x00007FF63ED92000-memory.dmp	xmrig
behavioral2/memory/3580-3008-0x00007FF680B80000-0x00007FF680F72000-memory.dmp	xmrig
behavioral2/memory/1788-3006-0x00007FF669C70000-0x00007FF66A062000-memory.dmp	xmrig
behavioral2/memory/1552-3003-0x00007FF7EB4D0000-0x00007FF7EB8C2000-memory.dmp	xmrig
behavioral2/memory/4228-2996-0x00007FF7A0C90000-0x00007FF7A1082000-memory.dmp	xmrig
behavioral2/memory/2780-2995-0x00007FF6CFD20000-0x00007FF6D0112000-memory.dmp	xmrig
behavioral2/memory/1704-2992-0x00007FF67E2A0000-0x00007FF67E692000-memory.dmp	xmrig
behavioral2/memory/4056-2988-0x00007FF75B870000-0x00007FF75BC62000-memory.dmp	xmrig
behavioral2/memory/3116-2987-0x00007FF76A440000-0x00007FF76A832000-memory.dmp	xmrig
behavioral2/memory/1156-2999-0x00007FF6F11F0000-0x00007FF6F15E2000-memory.dmp	xmrig
behavioral2/memory/432-2991-0x00007FF6E6AB0000-0x00007FF6E6EA2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
9	1016	powershell.exe
11	1016	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1016	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1728	SXOGNjV.exe
4764	StXicsO.exe
1544	TYNBsEk.exe
1224	jlazDQp.exe
4228	MnMERjT.exe
664	pxmrIWc.exe
1156	zjgCKUX.exe
2780	ddQBwdx.exe
3580	MXZTnoC.exe
3116	piEPrlh.exe
380	YiYouqo.exe
1704	rwrvLWX.exe
432	pOfXAsV.exe
4056	ScRmVRi.exe
2232	VamoSkp.exe
1552	YtfoIej.exe
3468	sijBLcX.exe
4544	vmIeOvR.exe
1788	uPnuPNf.exe
4512	xJjjIjZ.exe
720	gDsxAqY.exe
4092	gFQQoNd.exe
2764	cgCtOaS.exe
3916	sHniTGf.exe
2376	mDYNZXB.exe
4340	IZfCyXE.exe
2896	mEcdGEl.exe
1864	omINfUV.exe
4740	SXPjIzt.exe
1516	MFgtOzD.exe
3896	PwQIrAY.exe
4076	DJYexRq.exe
4584	rWrgYkC.exe
3696	BWuccQr.exe
4300	CzLZpWL.exe
2120	ZyXbezY.exe
1044	kKPGXAy.exe
1272	dPbUtju.exe
1620	mkfJeUp.exe
312	vjGCPUR.exe
3608	BBmYjDK.exe
4948	AginGOm.exe
4288	QbAezLp.exe
3944	YEYpjkY.exe
2360	pwobJZJ.exe
1188	sqcRcRa.exe
4780	ChiSijn.exe
1288	WwwiKKK.exe
3556	yukKbSB.exe
3372	CkowdAY.exe
2160	qXnodGh.exe
2220	elJcQzj.exe
4872	ALUplmc.exe
4088	KeBDAJe.exe
1328	mdyVUtQ.exe
2400	UMuFmLX.exe
1404	fBjSFwn.exe
3472	DpZlaGz.exe
3660	lVoQtoM.exe
4768	oQnDWuf.exe
1688	FhonseD.exe
4632	kQfnttJ.exe
4752	FgddgbD.exe
1588	BRaeBEm.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2968-0-0x00007FF678CF0000-0x00007FF6790E2000-memory.dmp	upx
behavioral2/files/0x000c000000023b55-25.dat	upx
behavioral2/files/0x000a000000023bb7-49.dat	upx
behavioral2/files/0x000a000000023bbf-66.dat	upx
behavioral2/files/0x000a000000023bc3-83.dat	upx
behavioral2/files/0x000a000000023bc7-101.dat	upx
behavioral2/files/0x000a000000023bcd-131.dat	upx
behavioral2/files/0x000a000000023bd0-153.dat	upx
behavioral2/files/0x000a000000023bca-150.dat	upx
behavioral2/files/0x000a000000023bd3-185.dat	upx
behavioral2/memory/432-199-0x00007FF6E6AB0000-0x00007FF6E6EA2000-memory.dmp	upx
behavioral2/memory/1552-206-0x00007FF7EB4D0000-0x00007FF7EB8C2000-memory.dmp	upx
behavioral2/memory/4512-228-0x00007FF675500000-0x00007FF6758F2000-memory.dmp	upx
behavioral2/memory/2764-238-0x00007FF75D940000-0x00007FF75DD32000-memory.dmp	upx
behavioral2/memory/4092-247-0x00007FF6D9EE0000-0x00007FF6DA2D2000-memory.dmp	upx
behavioral2/memory/4544-246-0x00007FF7D4F20000-0x00007FF7D5312000-memory.dmp	upx
behavioral2/memory/4056-244-0x00007FF75B870000-0x00007FF75BC62000-memory.dmp	upx
behavioral2/memory/1156-243-0x00007FF6F11F0000-0x00007FF6F15E2000-memory.dmp	upx
behavioral2/memory/4228-241-0x00007FF7A0C90000-0x00007FF7A1082000-memory.dmp	upx
behavioral2/memory/3916-239-0x00007FF712AB0000-0x00007FF712EA2000-memory.dmp	upx
behavioral2/memory/720-229-0x00007FF653FE0000-0x00007FF6543D2000-memory.dmp	upx
behavioral2/memory/1788-227-0x00007FF669C70000-0x00007FF66A062000-memory.dmp	upx
behavioral2/memory/3468-217-0x00007FF77F210000-0x00007FF77F602000-memory.dmp	upx
behavioral2/memory/2232-205-0x00007FF67C860000-0x00007FF67CC52000-memory.dmp	upx
behavioral2/memory/1704-187-0x00007FF67E2A0000-0x00007FF67E692000-memory.dmp	upx
behavioral2/files/0x000a000000023bd2-182.dat	upx
behavioral2/files/0x000a000000023bcf-179.dat	upx
behavioral2/files/0x000a000000023bce-175.dat	upx
behavioral2/files/0x000a000000023bc8-170.dat	upx
behavioral2/files/0x000a000000023bcc-168.dat	upx
behavioral2/files/0x000a000000023bcb-164.dat	upx
behavioral2/files/0x000a000000023bd1-163.dat	upx
behavioral2/files/0x000b000000023bb1-162.dat	upx
behavioral2/memory/380-160-0x00007FF63E9A0000-0x00007FF63ED92000-memory.dmp	upx
behavioral2/files/0x000a000000023bc9-143.dat	upx
behavioral2/memory/3116-142-0x00007FF76A440000-0x00007FF76A832000-memory.dmp	upx
behavioral2/files/0x000a000000023bc6-138.dat	upx
behavioral2/files/0x000a000000023bc5-136.dat	upx
behavioral2/memory/3580-133-0x00007FF680B80000-0x00007FF680F72000-memory.dmp	upx
behavioral2/memory/2780-132-0x00007FF6CFD20000-0x00007FF6D0112000-memory.dmp	upx
behavioral2/files/0x000a000000023bc2-123.dat	upx
behavioral2/files/0x000a000000023bc1-118.dat	upx
behavioral2/files/0x000a000000023bb8-114.dat	upx
behavioral2/files/0x000a000000023bc4-111.dat	upx
behavioral2/files/0x000a000000023bc0-108.dat	upx
behavioral2/memory/664-106-0x00007FF6209F0000-0x00007FF620DE2000-memory.dmp	upx
behavioral2/files/0x000a000000023bbc-97.dat	upx
behavioral2/files/0x000a000000023bbd-91.dat	upx
behavioral2/memory/1224-85-0x00007FF6C2A30000-0x00007FF6C2E22000-memory.dmp	upx
behavioral2/files/0x000a000000023bbe-77.dat	upx
behavioral2/files/0x000a000000023bbb-69.dat	upx
behavioral2/files/0x000a000000023bba-51.dat	upx
behavioral2/memory/4764-64-0x00007FF6C1B80000-0x00007FF6C1F72000-memory.dmp	upx
behavioral2/files/0x000a000000023bb9-41.dat	upx
behavioral2/files/0x0031000000023bb5-35.dat	upx
behavioral2/files/0x0031000000023bb4-29.dat	upx
behavioral2/memory/1544-19-0x00007FF77FC80000-0x00007FF780072000-memory.dmp	upx
behavioral2/files/0x0031000000023bb6-18.dat	upx
behavioral2/memory/1728-15-0x00007FF75C210000-0x00007FF75C602000-memory.dmp	upx
behavioral2/memory/1728-2969-0x00007FF75C210000-0x00007FF75C602000-memory.dmp	upx
behavioral2/memory/1544-2970-0x00007FF77FC80000-0x00007FF780072000-memory.dmp	upx
behavioral2/memory/1728-2974-0x00007FF75C210000-0x00007FF75C602000-memory.dmp	upx
behavioral2/memory/4764-2976-0x00007FF6C1B80000-0x00007FF6C1F72000-memory.dmp	upx
behavioral2/memory/1544-2978-0x00007FF77FC80000-0x00007FF780072000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\YzYcIbX.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\iQwjEaY.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\OAKxNib.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\kwaRymK.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\jvyWHBy.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\fWOGUnG.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\tcEtLKV.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\OqlixVG.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\WvMumuQ.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\nvNdXAj.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\sJjGzUn.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\YEYpjkY.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\FOLzOpF.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\ZeUjlPx.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\UISrDjb.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\oxLrkSx.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\zrgRBCm.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\hpMOBgQ.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\pppXLZE.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\BDxmEuB.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\wJmCCZa.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\JLONojq.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\sQLpjNr.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\QRlzfly.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\umJDHMH.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\qYcFNHd.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\MXZTnoC.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\aENScIG.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\zfsnxku.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\IYdEEfr.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\tWqEmBf.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\hcvPvuR.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\OhcDTss.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\gDsxAqY.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\iOKFGXu.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\acbLMdf.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\KetOGnY.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\YahbdBE.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\DgVYxcC.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\YAXVpJL.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\qpqKkAq.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\YXusVOa.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\IQPeAtI.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\QksZyZQ.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\CXqPmhn.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\VyFtJAc.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\iyetwGs.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\RQRhNdB.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\oqRcpDm.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\PWEVxBU.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\TTPGKxR.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\LehLYox.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\BBdGpmQ.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\UEJAJuN.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\lhHsNqs.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\OniLKPF.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\qvusruw.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\LpcSayV.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\VWugZSg.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\RPEFegF.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\kjMSHsl.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\uDRulVH.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\ecrwdIq.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
File created	C:\Windows\System\fFxRQqU.exe	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1016	powershell.exe
1016	powershell.exe
1016	powershell.exe
1016	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
Token: SeDebugPrivilege	1016	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 1016	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	85
PID 2968 wrote to memory of 1016	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	85
PID 2968 wrote to memory of 1728	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	86
PID 2968 wrote to memory of 1728	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	86
PID 2968 wrote to memory of 4764	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	87
PID 2968 wrote to memory of 4764	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	87
PID 2968 wrote to memory of 1544	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	88
PID 2968 wrote to memory of 1544	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	88
PID 2968 wrote to memory of 1224	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	89
PID 2968 wrote to memory of 1224	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	89
PID 2968 wrote to memory of 4228	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	90
PID 2968 wrote to memory of 4228	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	90
PID 2968 wrote to memory of 3580	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	91
PID 2968 wrote to memory of 3580	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	91
PID 2968 wrote to memory of 664	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	92
PID 2968 wrote to memory of 664	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	92
PID 2968 wrote to memory of 1156	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	93
PID 2968 wrote to memory of 1156	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	93
PID 2968 wrote to memory of 2780	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	94
PID 2968 wrote to memory of 2780	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	94
PID 2968 wrote to memory of 3116	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	95
PID 2968 wrote to memory of 3116	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	95
PID 2968 wrote to memory of 380	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	96
PID 2968 wrote to memory of 380	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	96
PID 2968 wrote to memory of 1704	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	97
PID 2968 wrote to memory of 1704	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	97
PID 2968 wrote to memory of 432	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	98
PID 2968 wrote to memory of 432	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	98
PID 2968 wrote to memory of 4056	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	99
PID 2968 wrote to memory of 4056	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	99
PID 2968 wrote to memory of 2232	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	100
PID 2968 wrote to memory of 2232	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	100
PID 2968 wrote to memory of 1552	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	101
PID 2968 wrote to memory of 1552	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	101
PID 2968 wrote to memory of 3468	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	102
PID 2968 wrote to memory of 3468	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	102
PID 2968 wrote to memory of 4544	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	103
PID 2968 wrote to memory of 4544	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	103
PID 2968 wrote to memory of 1788	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	104
PID 2968 wrote to memory of 1788	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	104
PID 2968 wrote to memory of 4512	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	105
PID 2968 wrote to memory of 4512	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	105
PID 2968 wrote to memory of 720	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	106
PID 2968 wrote to memory of 720	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	106
PID 2968 wrote to memory of 4340	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	107
PID 2968 wrote to memory of 4340	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	107
PID 2968 wrote to memory of 4092	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	108
PID 2968 wrote to memory of 4092	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	108
PID 2968 wrote to memory of 2764	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	109
PID 2968 wrote to memory of 2764	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	109
PID 2968 wrote to memory of 3916	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	110
PID 2968 wrote to memory of 3916	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	110
PID 2968 wrote to memory of 2376	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	111
PID 2968 wrote to memory of 2376	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	111
PID 2968 wrote to memory of 2896	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	112
PID 2968 wrote to memory of 2896	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	112
PID 2968 wrote to memory of 1864	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	113
PID 2968 wrote to memory of 1864	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	113
PID 2968 wrote to memory of 4740	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	114
PID 2968 wrote to memory of 4740	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	114
PID 2968 wrote to memory of 1516	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	115
PID 2968 wrote to memory of 1516	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	115
PID 2968 wrote to memory of 3896	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	116
PID 2968 wrote to memory of 3896	2968	1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1f849ddd4e12a3a41d18c8d75cb36347_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1016
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1016" "2932" "2868" "2936" "0" "0" "2940" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:13076
- C:\Windows\System\SXOGNjV.exe
  C:\Windows\System\SXOGNjV.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\StXicsO.exe
  C:\Windows\System\StXicsO.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\TYNBsEk.exe
  C:\Windows\System\TYNBsEk.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\jlazDQp.exe
  C:\Windows\System\jlazDQp.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\MnMERjT.exe
  C:\Windows\System\MnMERjT.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\MXZTnoC.exe
  C:\Windows\System\MXZTnoC.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\pxmrIWc.exe
  C:\Windows\System\pxmrIWc.exe
  2⤵
  - Executes dropped EXE
  PID:664
- C:\Windows\System\zjgCKUX.exe
  C:\Windows\System\zjgCKUX.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\ddQBwdx.exe
  C:\Windows\System\ddQBwdx.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\piEPrlh.exe
  C:\Windows\System\piEPrlh.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\YiYouqo.exe
  C:\Windows\System\YiYouqo.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\rwrvLWX.exe
  C:\Windows\System\rwrvLWX.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\pOfXAsV.exe
  C:\Windows\System\pOfXAsV.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\ScRmVRi.exe
  C:\Windows\System\ScRmVRi.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\VamoSkp.exe
  C:\Windows\System\VamoSkp.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\YtfoIej.exe
  C:\Windows\System\YtfoIej.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\sijBLcX.exe
  C:\Windows\System\sijBLcX.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\vmIeOvR.exe
  C:\Windows\System\vmIeOvR.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\uPnuPNf.exe
  C:\Windows\System\uPnuPNf.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\xJjjIjZ.exe
  C:\Windows\System\xJjjIjZ.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\gDsxAqY.exe
  C:\Windows\System\gDsxAqY.exe
  2⤵
  - Executes dropped EXE
  PID:720
- C:\Windows\System\IZfCyXE.exe
  C:\Windows\System\IZfCyXE.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\gFQQoNd.exe
  C:\Windows\System\gFQQoNd.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\cgCtOaS.exe
  C:\Windows\System\cgCtOaS.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\sHniTGf.exe
  C:\Windows\System\sHniTGf.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\mDYNZXB.exe
  C:\Windows\System\mDYNZXB.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\mEcdGEl.exe
  C:\Windows\System\mEcdGEl.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\omINfUV.exe
  C:\Windows\System\omINfUV.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\SXPjIzt.exe
  C:\Windows\System\SXPjIzt.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\MFgtOzD.exe
  C:\Windows\System\MFgtOzD.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\PwQIrAY.exe
  C:\Windows\System\PwQIrAY.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\DJYexRq.exe
  C:\Windows\System\DJYexRq.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\rWrgYkC.exe
  C:\Windows\System\rWrgYkC.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\BWuccQr.exe
  C:\Windows\System\BWuccQr.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\CzLZpWL.exe
  C:\Windows\System\CzLZpWL.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\ZyXbezY.exe
  C:\Windows\System\ZyXbezY.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\kKPGXAy.exe
  C:\Windows\System\kKPGXAy.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\dPbUtju.exe
  C:\Windows\System\dPbUtju.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\mkfJeUp.exe
  C:\Windows\System\mkfJeUp.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\vjGCPUR.exe
  C:\Windows\System\vjGCPUR.exe
  2⤵
  - Executes dropped EXE
  PID:312
- C:\Windows\System\BBmYjDK.exe
  C:\Windows\System\BBmYjDK.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\AginGOm.exe
  C:\Windows\System\AginGOm.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\QbAezLp.exe
  C:\Windows\System\QbAezLp.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\YEYpjkY.exe
  C:\Windows\System\YEYpjkY.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\pwobJZJ.exe
  C:\Windows\System\pwobJZJ.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\sqcRcRa.exe
  C:\Windows\System\sqcRcRa.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\ChiSijn.exe
  C:\Windows\System\ChiSijn.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\WwwiKKK.exe
  C:\Windows\System\WwwiKKK.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\yukKbSB.exe
  C:\Windows\System\yukKbSB.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\CkowdAY.exe
  C:\Windows\System\CkowdAY.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\qXnodGh.exe
  C:\Windows\System\qXnodGh.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\elJcQzj.exe
  C:\Windows\System\elJcQzj.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\ALUplmc.exe
  C:\Windows\System\ALUplmc.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\KeBDAJe.exe
  C:\Windows\System\KeBDAJe.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\mdyVUtQ.exe
  C:\Windows\System\mdyVUtQ.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\UMuFmLX.exe
  C:\Windows\System\UMuFmLX.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\fBjSFwn.exe
  C:\Windows\System\fBjSFwn.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\DpZlaGz.exe
  C:\Windows\System\DpZlaGz.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System\lVoQtoM.exe
  C:\Windows\System\lVoQtoM.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\oQnDWuf.exe
  C:\Windows\System\oQnDWuf.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\FhonseD.exe
  C:\Windows\System\FhonseD.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\kQfnttJ.exe
  C:\Windows\System\kQfnttJ.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\FgddgbD.exe
  C:\Windows\System\FgddgbD.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\BRaeBEm.exe
  C:\Windows\System\BRaeBEm.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\AVdzImy.exe
  C:\Windows\System\AVdzImy.exe
  2⤵
  PID:4448
- C:\Windows\System\iEPnfYK.exe
  C:\Windows\System\iEPnfYK.exe
  2⤵
  PID:3572
- C:\Windows\System\OLZbOFr.exe
  C:\Windows\System\OLZbOFr.exe
  2⤵
  PID:3812
- C:\Windows\System\esYwHnb.exe
  C:\Windows\System\esYwHnb.exe
  2⤵
  PID:5044
- C:\Windows\System\chmswRx.exe
  C:\Windows\System\chmswRx.exe
  2⤵
  PID:3600
- C:\Windows\System\hrLOJVr.exe
  C:\Windows\System\hrLOJVr.exe
  2⤵
  PID:4460
- C:\Windows\System\ASBPVgg.exe
  C:\Windows\System\ASBPVgg.exe
  2⤵
  PID:5136
- C:\Windows\System\jtaJdCU.exe
  C:\Windows\System\jtaJdCU.exe
  2⤵
  PID:5156
- C:\Windows\System\QGCZAmn.exe
  C:\Windows\System\QGCZAmn.exe
  2⤵
  PID:5176
- C:\Windows\System\xkAQigG.exe
  C:\Windows\System\xkAQigG.exe
  2⤵
  PID:5192
- C:\Windows\System\gbMgzIU.exe
  C:\Windows\System\gbMgzIU.exe
  2⤵
  PID:5588
- C:\Windows\System\kjMSHsl.exe
  C:\Windows\System\kjMSHsl.exe
  2⤵
  PID:5608
- C:\Windows\System\ZOYQNiP.exe
  C:\Windows\System\ZOYQNiP.exe
  2⤵
  PID:5624
- C:\Windows\System\fmBzIaa.exe
  C:\Windows\System\fmBzIaa.exe
  2⤵
  PID:5640
- C:\Windows\System\wJmCCZa.exe
  C:\Windows\System\wJmCCZa.exe
  2⤵
  PID:5656
- C:\Windows\System\qzSSUbY.exe
  C:\Windows\System\qzSSUbY.exe
  2⤵
  PID:5672
- C:\Windows\System\xIYzNBx.exe
  C:\Windows\System\xIYzNBx.exe
  2⤵
  PID:5692
- C:\Windows\System\wjBhWFn.exe
  C:\Windows\System\wjBhWFn.exe
  2⤵
  PID:5712
- C:\Windows\System\GpZVkdq.exe
  C:\Windows\System\GpZVkdq.exe
  2⤵
  PID:5732
- C:\Windows\System\vvSUAhm.exe
  C:\Windows\System\vvSUAhm.exe
  2⤵
  PID:5752
- C:\Windows\System\WFhbTtr.exe
  C:\Windows\System\WFhbTtr.exe
  2⤵
  PID:5768
- C:\Windows\System\kSvSPNG.exe
  C:\Windows\System\kSvSPNG.exe
  2⤵
  PID:5788
- C:\Windows\System\MpeUNFG.exe
  C:\Windows\System\MpeUNFG.exe
  2⤵
  PID:5812
- C:\Windows\System\uDRulVH.exe
  C:\Windows\System\uDRulVH.exe
  2⤵
  PID:5832
- C:\Windows\System\oysxTtG.exe
  C:\Windows\System\oysxTtG.exe
  2⤵
  PID:5860
- C:\Windows\System\VOFaWRO.exe
  C:\Windows\System\VOFaWRO.exe
  2⤵
  PID:5880
- C:\Windows\System\dbZQtZp.exe
  C:\Windows\System\dbZQtZp.exe
  2⤵
  PID:5904
- C:\Windows\System\ZLgfqod.exe
  C:\Windows\System\ZLgfqod.exe
  2⤵
  PID:5924
- C:\Windows\System\PEUnerl.exe
  C:\Windows\System\PEUnerl.exe
  2⤵
  PID:5952
- C:\Windows\System\ChvqQWV.exe
  C:\Windows\System\ChvqQWV.exe
  2⤵
  PID:5968
- C:\Windows\System\xkmwuaS.exe
  C:\Windows\System\xkmwuaS.exe
  2⤵
  PID:5996
- C:\Windows\System\PwbmRns.exe
  C:\Windows\System\PwbmRns.exe
  2⤵
  PID:6012
- C:\Windows\System\HDxKOIu.exe
  C:\Windows\System\HDxKOIu.exe
  2⤵
  PID:6036
- C:\Windows\System\Hypsvlu.exe
  C:\Windows\System\Hypsvlu.exe
  2⤵
  PID:6064
- C:\Windows\System\AmPuHYe.exe
  C:\Windows\System\AmPuHYe.exe
  2⤵
  PID:6084
- C:\Windows\System\SdvyQGq.exe
  C:\Windows\System\SdvyQGq.exe
  2⤵
  PID:6108
- C:\Windows\System\QXGbket.exe
  C:\Windows\System\QXGbket.exe
  2⤵
  PID:6140
- C:\Windows\System\HjgJLAL.exe
  C:\Windows\System\HjgJLAL.exe
  2⤵
  PID:2236
- C:\Windows\System\AbbCxgF.exe
  C:\Windows\System\AbbCxgF.exe
  2⤵
  PID:2712
- C:\Windows\System\KxLEtrX.exe
  C:\Windows\System\KxLEtrX.exe
  2⤵
  PID:2152
- C:\Windows\System\jXYsAah.exe
  C:\Windows\System\jXYsAah.exe
  2⤵
  PID:1656
- C:\Windows\System\kIrxvIx.exe
  C:\Windows\System\kIrxvIx.exe
  2⤵
  PID:1388
- C:\Windows\System\lbtSGgf.exe
  C:\Windows\System\lbtSGgf.exe
  2⤵
  PID:2384
- C:\Windows\System\lNpffQg.exe
  C:\Windows\System\lNpffQg.exe
  2⤵
  PID:3616
- C:\Windows\System\XIXjegq.exe
  C:\Windows\System\XIXjegq.exe
  2⤵
  PID:4516
- C:\Windows\System\BmwfDUX.exe
  C:\Windows\System\BmwfDUX.exe
  2⤵
  PID:5032
- C:\Windows\System\GjomJFc.exe
  C:\Windows\System\GjomJFc.exe
  2⤵
  PID:5124
- C:\Windows\System\hxZBciF.exe
  C:\Windows\System\hxZBciF.exe
  2⤵
  PID:5164
- C:\Windows\System\hEPaXbG.exe
  C:\Windows\System\hEPaXbG.exe
  2⤵
  PID:5200
- C:\Windows\System\SZvGhXT.exe
  C:\Windows\System\SZvGhXT.exe
  2⤵
  PID:2568
- C:\Windows\System\FBxddfM.exe
  C:\Windows\System\FBxddfM.exe
  2⤵
  PID:3604
- C:\Windows\System\pepHHdD.exe
  C:\Windows\System\pepHHdD.exe
  2⤵
  PID:3956
- C:\Windows\System\ecrwdIq.exe
  C:\Windows\System\ecrwdIq.exe
  2⤵
  PID:4548
- C:\Windows\System\bzIlwHr.exe
  C:\Windows\System\bzIlwHr.exe
  2⤵
  PID:4268
- C:\Windows\System\aFQhBPe.exe
  C:\Windows\System\aFQhBPe.exe
  2⤵
  PID:1992
- C:\Windows\System\ZfoFVsA.exe
  C:\Windows\System\ZfoFVsA.exe
  2⤵
  PID:1796
- C:\Windows\System\vpUwppD.exe
  C:\Windows\System\vpUwppD.exe
  2⤵
  PID:3704
- C:\Windows\System\zLkLlUi.exe
  C:\Windows\System\zLkLlUi.exe
  2⤵
  PID:1484
- C:\Windows\System\BvLUqHB.exe
  C:\Windows\System\BvLUqHB.exe
  2⤵
  PID:5064
- C:\Windows\System\ZXfoFYo.exe
  C:\Windows\System\ZXfoFYo.exe
  2⤵
  PID:3388
- C:\Windows\System\tqtxGTI.exe
  C:\Windows\System\tqtxGTI.exe
  2⤵
  PID:2000
- C:\Windows\System\ilSkXGo.exe
  C:\Windows\System\ilSkXGo.exe
  2⤵
  PID:4788
- C:\Windows\System\VrFYlRg.exe
  C:\Windows\System\VrFYlRg.exe
  2⤵
  PID:3588
- C:\Windows\System\NiSrbtf.exe
  C:\Windows\System\NiSrbtf.exe
  2⤵
  PID:4440
- C:\Windows\System\AdhGBTm.exe
  C:\Windows\System\AdhGBTm.exe
  2⤵
  PID:3428
- C:\Windows\System\WRSnOfd.exe
  C:\Windows\System\WRSnOfd.exe
  2⤵
  PID:4352
- C:\Windows\System\fqIHfUS.exe
  C:\Windows\System\fqIHfUS.exe
  2⤵
  PID:2812
- C:\Windows\System\hhPRDSY.exe
  C:\Windows\System\hhPRDSY.exe
  2⤵
  PID:4808
- C:\Windows\System\xIOOSuL.exe
  C:\Windows\System\xIOOSuL.exe
  2⤵
  PID:5528
- C:\Windows\System\oqRcpDm.exe
  C:\Windows\System\oqRcpDm.exe
  2⤵
  PID:5552
- C:\Windows\System\SvIkQyN.exe
  C:\Windows\System\SvIkQyN.exe
  2⤵
  PID:5564
- C:\Windows\System\IbKqnDi.exe
  C:\Windows\System\IbKqnDi.exe
  2⤵
  PID:5544
- C:\Windows\System\ftQtacz.exe
  C:\Windows\System\ftQtacz.exe
  2⤵
  PID:5604
- C:\Windows\System\OhmjIOz.exe
  C:\Windows\System\OhmjIOz.exe
  2⤵
  PID:5724
- C:\Windows\System\lyVxwcD.exe
  C:\Windows\System\lyVxwcD.exe
  2⤵
  PID:5776
- C:\Windows\System\fRVEoLV.exe
  C:\Windows\System\fRVEoLV.exe
  2⤵
  PID:5784
- C:\Windows\System\ajmfWXI.exe
  C:\Windows\System\ajmfWXI.exe
  2⤵
  PID:5764
- C:\Windows\System\bbpsYMh.exe
  C:\Windows\System\bbpsYMh.exe
  2⤵
  PID:5872
- C:\Windows\System\JLONojq.exe
  C:\Windows\System\JLONojq.exe
  2⤵
  PID:5944
- C:\Windows\System\aTQeYjJ.exe
  C:\Windows\System\aTQeYjJ.exe
  2⤵
  PID:5800
- C:\Windows\System\Zpylcep.exe
  C:\Windows\System\Zpylcep.exe
  2⤵
  PID:6032
- C:\Windows\System\XxYXVJe.exe
  C:\Windows\System\XxYXVJe.exe
  2⤵
  PID:5888
- C:\Windows\System\PLGpIwq.exe
  C:\Windows\System\PLGpIwq.exe
  2⤵
  PID:6080
- C:\Windows\System\DDMtdkB.exe
  C:\Windows\System\DDMtdkB.exe
  2⤵
  PID:6008
- C:\Windows\System\YMRLEWv.exe
  C:\Windows\System\YMRLEWv.exe
  2⤵
  PID:336
- C:\Windows\System\PVPvxzi.exe
  C:\Windows\System\PVPvxzi.exe
  2⤵
  PID:1692
- C:\Windows\System\LTofzuF.exe
  C:\Windows\System\LTofzuF.exe
  2⤵
  PID:4304
- C:\Windows\System\xzWhonf.exe
  C:\Windows\System\xzWhonf.exe
  2⤵
  PID:5932
- C:\Windows\System\bzBkQhH.exe
  C:\Windows\System\bzBkQhH.exe
  2⤵
  PID:3436
- C:\Windows\System\BKpgOSf.exe
  C:\Windows\System\BKpgOSf.exe
  2⤵
  PID:3004
- C:\Windows\System\KQZFYwd.exe
  C:\Windows\System\KQZFYwd.exe
  2⤵
  PID:2332
- C:\Windows\System\abUwDVj.exe
  C:\Windows\System\abUwDVj.exe
  2⤵
  PID:4624
- C:\Windows\System\eWjUXii.exe
  C:\Windows\System\eWjUXii.exe
  2⤵
  PID:4568
- C:\Windows\System\LYGSrWB.exe
  C:\Windows\System\LYGSrWB.exe
  2⤵
  PID:4316
- C:\Windows\System\jSQMCRW.exe
  C:\Windows\System\jSQMCRW.exe
  2⤵
  PID:5568
- C:\Windows\System\YzYcIbX.exe
  C:\Windows\System\YzYcIbX.exe
  2⤵
  PID:4888
- C:\Windows\System\BXOwlVl.exe
  C:\Windows\System\BXOwlVl.exe
  2⤵
  PID:5868
- C:\Windows\System\qDiWEBC.exe
  C:\Windows\System\qDiWEBC.exe
  2⤵
  PID:5936
- C:\Windows\System\AekdbtF.exe
  C:\Windows\System\AekdbtF.exe
  2⤵
  PID:6168
- C:\Windows\System\iFoBzey.exe
  C:\Windows\System\iFoBzey.exe
  2⤵
  PID:6188
- C:\Windows\System\qczOXeZ.exe
  C:\Windows\System\qczOXeZ.exe
  2⤵
  PID:6208
- C:\Windows\System\QdURVSJ.exe
  C:\Windows\System\QdURVSJ.exe
  2⤵
  PID:6228
- C:\Windows\System\udmKIUw.exe
  C:\Windows\System\udmKIUw.exe
  2⤵
  PID:6256
- C:\Windows\System\FMPXGFt.exe
  C:\Windows\System\FMPXGFt.exe
  2⤵
  PID:6272
- C:\Windows\System\hsLAuOx.exe
  C:\Windows\System\hsLAuOx.exe
  2⤵
  PID:6296
- C:\Windows\System\uMOdDCv.exe
  C:\Windows\System\uMOdDCv.exe
  2⤵
  PID:6320
- C:\Windows\System\LDEFowB.exe
  C:\Windows\System\LDEFowB.exe
  2⤵
  PID:6344
- C:\Windows\System\ksSZRdN.exe
  C:\Windows\System\ksSZRdN.exe
  2⤵
  PID:6360
- C:\Windows\System\WJhcSfI.exe
  C:\Windows\System\WJhcSfI.exe
  2⤵
  PID:6384
- C:\Windows\System\dFMAHAH.exe
  C:\Windows\System\dFMAHAH.exe
  2⤵
  PID:6400
- C:\Windows\System\Noeidza.exe
  C:\Windows\System\Noeidza.exe
  2⤵
  PID:6428
- C:\Windows\System\FioyVtj.exe
  C:\Windows\System\FioyVtj.exe
  2⤵
  PID:6448
- C:\Windows\System\TQXOhcZ.exe
  C:\Windows\System\TQXOhcZ.exe
  2⤵
  PID:6468
- C:\Windows\System\bnFDElp.exe
  C:\Windows\System\bnFDElp.exe
  2⤵
  PID:6492
- C:\Windows\System\tQFodwU.exe
  C:\Windows\System\tQFodwU.exe
  2⤵
  PID:6508
- C:\Windows\System\feOCWIp.exe
  C:\Windows\System\feOCWIp.exe
  2⤵
  PID:6536
- C:\Windows\System\xVkgIds.exe
  C:\Windows\System\xVkgIds.exe
  2⤵
  PID:6552
- C:\Windows\System\wKGvlSy.exe
  C:\Windows\System\wKGvlSy.exe
  2⤵
  PID:6576
- C:\Windows\System\YdnQwGe.exe
  C:\Windows\System\YdnQwGe.exe
  2⤵
  PID:6596
- C:\Windows\System\rLbPTIR.exe
  C:\Windows\System\rLbPTIR.exe
  2⤵
  PID:6616
- C:\Windows\System\OniLKPF.exe
  C:\Windows\System\OniLKPF.exe
  2⤵
  PID:6636
- C:\Windows\System\kBxOKcl.exe
  C:\Windows\System\kBxOKcl.exe
  2⤵
  PID:6656
- C:\Windows\System\GibtiGr.exe
  C:\Windows\System\GibtiGr.exe
  2⤵
  PID:6680
- C:\Windows\System\iAbpiLD.exe
  C:\Windows\System\iAbpiLD.exe
  2⤵
  PID:6696
- C:\Windows\System\TAbJnvk.exe
  C:\Windows\System\TAbJnvk.exe
  2⤵
  PID:6720
- C:\Windows\System\KWWcvkh.exe
  C:\Windows\System\KWWcvkh.exe
  2⤵
  PID:6744
- C:\Windows\System\MIdyEsA.exe
  C:\Windows\System\MIdyEsA.exe
  2⤵
  PID:6764
- C:\Windows\System\GPRVzZc.exe
  C:\Windows\System\GPRVzZc.exe
  2⤵
  PID:6788
- C:\Windows\System\gYMSLPT.exe
  C:\Windows\System\gYMSLPT.exe
  2⤵
  PID:6808
- C:\Windows\System\biGnvkB.exe
  C:\Windows\System\biGnvkB.exe
  2⤵
  PID:6828
- C:\Windows\System\iuEAvaB.exe
  C:\Windows\System\iuEAvaB.exe
  2⤵
  PID:6852
- C:\Windows\System\nRaudfb.exe
  C:\Windows\System\nRaudfb.exe
  2⤵
  PID:6876
- C:\Windows\System\EfgifNF.exe
  C:\Windows\System\EfgifNF.exe
  2⤵
  PID:6900
- C:\Windows\System\XckDHVw.exe
  C:\Windows\System\XckDHVw.exe
  2⤵
  PID:6920
- C:\Windows\System\nuQssZh.exe
  C:\Windows\System\nuQssZh.exe
  2⤵
  PID:6940
- C:\Windows\System\yilQLiA.exe
  C:\Windows\System\yilQLiA.exe
  2⤵
  PID:6964
- C:\Windows\System\obnYpmY.exe
  C:\Windows\System\obnYpmY.exe
  2⤵
  PID:6988
- C:\Windows\System\ocGsOHz.exe
  C:\Windows\System\ocGsOHz.exe
  2⤵
  PID:7012
- C:\Windows\System\IYdEEfr.exe
  C:\Windows\System\IYdEEfr.exe
  2⤵
  PID:7032
- C:\Windows\System\SuSaeqz.exe
  C:\Windows\System\SuSaeqz.exe
  2⤵
  PID:7056
- C:\Windows\System\XEnTVHm.exe
  C:\Windows\System\XEnTVHm.exe
  2⤵
  PID:7072
- C:\Windows\System\mDJdNip.exe
  C:\Windows\System\mDJdNip.exe
  2⤵
  PID:7100
- C:\Windows\System\iLyTelg.exe
  C:\Windows\System\iLyTelg.exe
  2⤵
  PID:7120
- C:\Windows\System\afMoelB.exe
  C:\Windows\System\afMoelB.exe
  2⤵
  PID:7140
- C:\Windows\System\NNnmZtn.exe
  C:\Windows\System\NNnmZtn.exe
  2⤵
  PID:7164
- C:\Windows\System\jnIeIwl.exe
  C:\Windows\System\jnIeIwl.exe
  2⤵
  PID:4484
- C:\Windows\System\qDBfvSe.exe
  C:\Windows\System\qDBfvSe.exe
  2⤵
  PID:6076
- C:\Windows\System\XWbSPvP.exe
  C:\Windows\System\XWbSPvP.exe
  2⤵
  PID:6092
- C:\Windows\System\QDrMpav.exe
  C:\Windows\System\QDrMpav.exe
  2⤵
  PID:5112
- C:\Windows\System\iQwjEaY.exe
  C:\Windows\System\iQwjEaY.exe
  2⤵
  PID:1084
- C:\Windows\System\BALnCbb.exe
  C:\Windows\System\BALnCbb.exe
  2⤵
  PID:1896
- C:\Windows\System\WnxqFUw.exe
  C:\Windows\System\WnxqFUw.exe
  2⤵
  PID:4080
- C:\Windows\System\SmzSSVO.exe
  C:\Windows\System\SmzSSVO.exe
  2⤵
  PID:6160
- C:\Windows\System\LffVFGc.exe
  C:\Windows\System\LffVFGc.exe
  2⤵
  PID:6308
- C:\Windows\System\QlijVZg.exe
  C:\Windows\System\QlijVZg.exe
  2⤵
  PID:5524
- C:\Windows\System\xJAhUqH.exe
  C:\Windows\System\xJAhUqH.exe
  2⤵
  PID:6356
- C:\Windows\System\aQQKAHL.exe
  C:\Windows\System\aQQKAHL.exe
  2⤵
  PID:6408
- C:\Windows\System\TWNpYmL.exe
  C:\Windows\System\TWNpYmL.exe
  2⤵
  PID:5708
- C:\Windows\System\HjjEHwk.exe
  C:\Windows\System\HjjEHwk.exe
  2⤵
  PID:5740
- C:\Windows\System\urUfWWy.exe
  C:\Windows\System\urUfWWy.exe
  2⤵
  PID:5976
- C:\Windows\System\aREBaau.exe
  C:\Windows\System\aREBaau.exe
  2⤵
  PID:7172
- C:\Windows\System\qZtiBoi.exe
  C:\Windows\System\qZtiBoi.exe
  2⤵
  PID:7196
- C:\Windows\System\pOPRfgY.exe
  C:\Windows\System\pOPRfgY.exe
  2⤵
  PID:7216
- C:\Windows\System\yFBrQrM.exe
  C:\Windows\System\yFBrQrM.exe
  2⤵
  PID:7240
- C:\Windows\System\FOLzOpF.exe
  C:\Windows\System\FOLzOpF.exe
  2⤵
  PID:7264
- C:\Windows\System\MWgFJQS.exe
  C:\Windows\System\MWgFJQS.exe
  2⤵
  PID:7284
- C:\Windows\System\eFFGQBB.exe
  C:\Windows\System\eFFGQBB.exe
  2⤵
  PID:7308
- C:\Windows\System\eLcgSuv.exe
  C:\Windows\System\eLcgSuv.exe
  2⤵
  PID:7328
- C:\Windows\System\GLFvKvQ.exe
  C:\Windows\System\GLFvKvQ.exe
  2⤵
  PID:7348
- C:\Windows\System\xFTKeKe.exe
  C:\Windows\System\xFTKeKe.exe
  2⤵
  PID:7368
- C:\Windows\System\CZNUGuv.exe
  C:\Windows\System\CZNUGuv.exe
  2⤵
  PID:7392
- C:\Windows\System\auPLEWJ.exe
  C:\Windows\System\auPLEWJ.exe
  2⤵
  PID:7408
- C:\Windows\System\eHVHBgC.exe
  C:\Windows\System\eHVHBgC.exe
  2⤵
  PID:7432
- C:\Windows\System\UWkkNxU.exe
  C:\Windows\System\UWkkNxU.exe
  2⤵
  PID:7460
- C:\Windows\System\YjhSTtz.exe
  C:\Windows\System\YjhSTtz.exe
  2⤵
  PID:7484
- C:\Windows\System\GgVNknW.exe
  C:\Windows\System\GgVNknW.exe
  2⤵
  PID:7500
- C:\Windows\System\AjTZgDv.exe
  C:\Windows\System\AjTZgDv.exe
  2⤵
  PID:7524
- C:\Windows\System\ulRdJZY.exe
  C:\Windows\System\ulRdJZY.exe
  2⤵
  PID:7552
- C:\Windows\System\GXDBHyA.exe
  C:\Windows\System\GXDBHyA.exe
  2⤵
  PID:7568
- C:\Windows\System\gMLETsC.exe
  C:\Windows\System\gMLETsC.exe
  2⤵
  PID:7592
- C:\Windows\System\xLuebFS.exe
  C:\Windows\System\xLuebFS.exe
  2⤵
  PID:7616
- C:\Windows\System\YXtxjJv.exe
  C:\Windows\System\YXtxjJv.exe
  2⤵
  PID:7652
- C:\Windows\System\NrVHjFo.exe
  C:\Windows\System\NrVHjFo.exe
  2⤵
  PID:7676
- C:\Windows\System\KzVWEuO.exe
  C:\Windows\System\KzVWEuO.exe
  2⤵
  PID:7696
- C:\Windows\System\PojhVaO.exe
  C:\Windows\System\PojhVaO.exe
  2⤵
  PID:7712
- C:\Windows\System\aEEfjbs.exe
  C:\Windows\System\aEEfjbs.exe
  2⤵
  PID:7736
- C:\Windows\System\UJFklnF.exe
  C:\Windows\System\UJFklnF.exe
  2⤵
  PID:7760
- C:\Windows\System\FzfKUuk.exe
  C:\Windows\System\FzfKUuk.exe
  2⤵
  PID:7784
- C:\Windows\System\dDrnPap.exe
  C:\Windows\System\dDrnPap.exe
  2⤵
  PID:7804
- C:\Windows\System\iQZHozA.exe
  C:\Windows\System\iQZHozA.exe
  2⤵
  PID:7824
- C:\Windows\System\aQJvLEl.exe
  C:\Windows\System\aQJvLEl.exe
  2⤵
  PID:7852
- C:\Windows\System\dSJdjbt.exe
  C:\Windows\System\dSJdjbt.exe
  2⤵
  PID:7876
- C:\Windows\System\zWcpehT.exe
  C:\Windows\System\zWcpehT.exe
  2⤵
  PID:7896
- C:\Windows\System\CsAKAUI.exe
  C:\Windows\System\CsAKAUI.exe
  2⤵
  PID:7916
- C:\Windows\System\NLObjLo.exe
  C:\Windows\System\NLObjLo.exe
  2⤵
  PID:7940
- C:\Windows\System\codCovc.exe
  C:\Windows\System\codCovc.exe
  2⤵
  PID:7960
- C:\Windows\System\HHEMDwb.exe
  C:\Windows\System\HHEMDwb.exe
  2⤵
  PID:7984
- C:\Windows\System\cgykJXP.exe
  C:\Windows\System\cgykJXP.exe
  2⤵
  PID:8012
- C:\Windows\System\vzboRpP.exe
  C:\Windows\System\vzboRpP.exe
  2⤵
  PID:8032
- C:\Windows\System\VaJMDYW.exe
  C:\Windows\System\VaJMDYW.exe
  2⤵
  PID:8052
- C:\Windows\System\xUtzpVQ.exe
  C:\Windows\System\xUtzpVQ.exe
  2⤵
  PID:8076
- C:\Windows\System\sLRumbc.exe
  C:\Windows\System\sLRumbc.exe
  2⤵
  PID:8092
- C:\Windows\System\sQLpjNr.exe
  C:\Windows\System\sQLpjNr.exe
  2⤵
  PID:8108
- C:\Windows\System\UpYDBlU.exe
  C:\Windows\System\UpYDBlU.exe
  2⤵
  PID:8132
- C:\Windows\System\uSylUdc.exe
  C:\Windows\System\uSylUdc.exe
  2⤵
  PID:8152
- C:\Windows\System\JdGiLJI.exe
  C:\Windows\System\JdGiLJI.exe
  2⤵
  PID:8176
- C:\Windows\System\GOOYCAw.exe
  C:\Windows\System\GOOYCAw.exe
  2⤵
  PID:6864
- C:\Windows\System\YbmTUee.exe
  C:\Windows\System\YbmTUee.exe
  2⤵
  PID:6892
- C:\Windows\System\sbtryfs.exe
  C:\Windows\System\sbtryfs.exe
  2⤵
  PID:6288
- C:\Windows\System\kaXfJRv.exe
  C:\Windows\System\kaXfJRv.exe
  2⤵
  PID:4680
- C:\Windows\System\VGKOtaH.exe
  C:\Windows\System\VGKOtaH.exe
  2⤵
  PID:6488
- C:\Windows\System\VvfeSTi.exe
  C:\Windows\System\VvfeSTi.exe
  2⤵
  PID:7132
- C:\Windows\System\xADztFn.exe
  C:\Windows\System\xADztFn.exe
  2⤵
  PID:4216
- C:\Windows\System\DlAbZyI.exe
  C:\Windows\System\DlAbZyI.exe
  2⤵
  PID:5912
- C:\Windows\System\mPlBrMe.exe
  C:\Windows\System\mPlBrMe.exe
  2⤵
  PID:6332
- C:\Windows\System\fAmoqAy.exe
  C:\Windows\System\fAmoqAy.exe
  2⤵
  PID:6592
- C:\Windows\System\bhQERKc.exe
  C:\Windows\System\bhQERKc.exe
  2⤵
  PID:6760
- C:\Windows\System\icDqUkx.exe
  C:\Windows\System\icDqUkx.exe
  2⤵
  PID:6800
- C:\Windows\System\PTxniOw.exe
  C:\Windows\System\PTxniOw.exe
  2⤵
  PID:6204
- C:\Windows\System\sKopLsZ.exe
  C:\Windows\System\sKopLsZ.exe
  2⤵
  PID:7364
- C:\Windows\System\DzYvfTI.exe
  C:\Windows\System\DzYvfTI.exe
  2⤵
  PID:7404
- C:\Windows\System\iaNpRTH.exe
  C:\Windows\System\iaNpRTH.exe
  2⤵
  PID:6960
- C:\Windows\System\LqxYRsV.exe
  C:\Windows\System\LqxYRsV.exe
  2⤵
  PID:6416
- C:\Windows\System\UsJIPgx.exe
  C:\Windows\System\UsJIPgx.exe
  2⤵
  PID:7472
- C:\Windows\System\ryqWHkd.exe
  C:\Windows\System\ryqWHkd.exe
  2⤵
  PID:7560
- C:\Windows\System\bHPPuZt.exe
  C:\Windows\System\bHPPuZt.exe
  2⤵
  PID:7052
- C:\Windows\System\GPlrier.exe
  C:\Windows\System\GPlrier.exe
  2⤵
  PID:7612
- C:\Windows\System\Evmhxwk.exe
  C:\Windows\System\Evmhxwk.exe
  2⤵
  PID:6028
- C:\Windows\System\tcEtLKV.exe
  C:\Windows\System\tcEtLKV.exe
  2⤵
  PID:6500
- C:\Windows\System\EaZsqDo.exe
  C:\Windows\System\EaZsqDo.exe
  2⤵
  PID:7692
- C:\Windows\System\qEluOfj.exe
  C:\Windows\System\qEluOfj.exe
  2⤵
  PID:6624
- C:\Windows\System\QrwbWll.exe
  C:\Windows\System\QrwbWll.exe
  2⤵
  PID:7780
- C:\Windows\System\LtohuAN.exe
  C:\Windows\System\LtohuAN.exe
  2⤵
  PID:6672
- C:\Windows\System\xSTlkxi.exe
  C:\Windows\System\xSTlkxi.exe
  2⤵
  PID:6716
- C:\Windows\System\iSIiyzt.exe
  C:\Windows\System\iSIiyzt.exe
  2⤵
  PID:7820
- C:\Windows\System\IroMTwC.exe
  C:\Windows\System\IroMTwC.exe
  2⤵
  PID:6756
- C:\Windows\System\slPEnns.exe
  C:\Windows\System\slPEnns.exe
  2⤵
  PID:8204
- C:\Windows\System\dKpRQuA.exe
  C:\Windows\System\dKpRQuA.exe
  2⤵
  PID:8228
- C:\Windows\System\VFrhNti.exe
  C:\Windows\System\VFrhNti.exe
  2⤵
  PID:8248
- C:\Windows\System\gHUJYLx.exe
  C:\Windows\System\gHUJYLx.exe
  2⤵
  PID:8272
- C:\Windows\System\wNDsHqO.exe
  C:\Windows\System\wNDsHqO.exe
  2⤵
  PID:8292
- C:\Windows\System\xhnkSAj.exe
  C:\Windows\System\xhnkSAj.exe
  2⤵
  PID:8320
- C:\Windows\System\MQrfFkR.exe
  C:\Windows\System\MQrfFkR.exe
  2⤵
  PID:8336
- C:\Windows\System\YtBiFQQ.exe
  C:\Windows\System\YtBiFQQ.exe
  2⤵
  PID:8360
- C:\Windows\System\DxvCcHQ.exe
  C:\Windows\System\DxvCcHQ.exe
  2⤵
  PID:8380
- C:\Windows\System\boLTmZi.exe
  C:\Windows\System\boLTmZi.exe
  2⤵
  PID:8404
- C:\Windows\System\GLkGoVg.exe
  C:\Windows\System\GLkGoVg.exe
  2⤵
  PID:8420
- C:\Windows\System\mUSIoKj.exe
  C:\Windows\System\mUSIoKj.exe
  2⤵
  PID:8440
- C:\Windows\System\ochmRhU.exe
  C:\Windows\System\ochmRhU.exe
  2⤵
  PID:8464
- C:\Windows\System\aTtKTwv.exe
  C:\Windows\System\aTtKTwv.exe
  2⤵
  PID:8488
- C:\Windows\System\wdGRkGL.exe
  C:\Windows\System\wdGRkGL.exe
  2⤵
  PID:8504
- C:\Windows\System\HWkmfnP.exe
  C:\Windows\System\HWkmfnP.exe
  2⤵
  PID:8528
- C:\Windows\System\lCKOWjK.exe
  C:\Windows\System\lCKOWjK.exe
  2⤵
  PID:8552
- C:\Windows\System\pGQWuXZ.exe
  C:\Windows\System\pGQWuXZ.exe
  2⤵
  PID:8568
- C:\Windows\System\PXeZwEs.exe
  C:\Windows\System\PXeZwEs.exe
  2⤵
  PID:8592
- C:\Windows\System\UFsTecu.exe
  C:\Windows\System\UFsTecu.exe
  2⤵
  PID:8612
- C:\Windows\System\BeQAind.exe
  C:\Windows\System\BeQAind.exe
  2⤵
  PID:8636
- C:\Windows\System\GSJmLiM.exe
  C:\Windows\System\GSJmLiM.exe
  2⤵
  PID:8652
- C:\Windows\System\ZojsVWH.exe
  C:\Windows\System\ZojsVWH.exe
  2⤵
  PID:8676
- C:\Windows\System\gWdGElz.exe
  C:\Windows\System\gWdGElz.exe
  2⤵
  PID:8696
- C:\Windows\System\YAjDucV.exe
  C:\Windows\System\YAjDucV.exe
  2⤵
  PID:8720
- C:\Windows\System\ZvFCMXR.exe
  C:\Windows\System\ZvFCMXR.exe
  2⤵
  PID:8744
- C:\Windows\System\jcnArdH.exe
  C:\Windows\System\jcnArdH.exe
  2⤵
  PID:8764
- C:\Windows\System\OigdGIV.exe
  C:\Windows\System\OigdGIV.exe
  2⤵
  PID:8792
- C:\Windows\System\gDAhWgK.exe
  C:\Windows\System\gDAhWgK.exe
  2⤵
  PID:8808
- C:\Windows\System\MaNqeVK.exe
  C:\Windows\System\MaNqeVK.exe
  2⤵
  PID:8840
- C:\Windows\System\oATnRhb.exe
  C:\Windows\System\oATnRhb.exe
  2⤵
  PID:8856
- C:\Windows\System\JTdgGKv.exe
  C:\Windows\System\JTdgGKv.exe
  2⤵
  PID:8876
- C:\Windows\System\ikThGeG.exe
  C:\Windows\System\ikThGeG.exe
  2⤵
  PID:8896
- C:\Windows\System\KueiTxM.exe
  C:\Windows\System\KueiTxM.exe
  2⤵
  PID:8916
- C:\Windows\System\xjXNPjO.exe
  C:\Windows\System\xjXNPjO.exe
  2⤵
  PID:8940
- C:\Windows\System\vUqQwOL.exe
  C:\Windows\System\vUqQwOL.exe
  2⤵
  PID:8960
- C:\Windows\System\mMfYEfy.exe
  C:\Windows\System\mMfYEfy.exe
  2⤵
  PID:8984
- C:\Windows\System\yNwZBue.exe
  C:\Windows\System\yNwZBue.exe
  2⤵
  PID:9008
- C:\Windows\System\yfpDudv.exe
  C:\Windows\System\yfpDudv.exe
  2⤵
  PID:9028
- C:\Windows\System\rfONmEo.exe
  C:\Windows\System\rfONmEo.exe
  2⤵
  PID:9048
- C:\Windows\System\PUZgYzv.exe
  C:\Windows\System\PUZgYzv.exe
  2⤵
  PID:9068
- C:\Windows\System\AwROfvm.exe
  C:\Windows\System\AwROfvm.exe
  2⤵
  PID:9092
- C:\Windows\System\CpMoQjD.exe
  C:\Windows\System\CpMoQjD.exe
  2⤵
  PID:9112
- C:\Windows\System\udpsWKv.exe
  C:\Windows\System\udpsWKv.exe
  2⤵
  PID:9132
- C:\Windows\System\zOmFFQD.exe
  C:\Windows\System\zOmFFQD.exe
  2⤵
  PID:9156
- C:\Windows\System\OqlixVG.exe
  C:\Windows\System\OqlixVG.exe
  2⤵
  PID:9172
- C:\Windows\System\nNXxqQM.exe
  C:\Windows\System\nNXxqQM.exe
  2⤵
  PID:9196
- C:\Windows\System\KmxVuOh.exe
  C:\Windows\System\KmxVuOh.exe
  2⤵
  PID:7228
- C:\Windows\System\eTFRuhd.exe
  C:\Windows\System\eTFRuhd.exe
  2⤵
  PID:7256
- C:\Windows\System\RwkgANJ.exe
  C:\Windows\System\RwkgANJ.exe
  2⤵
  PID:7952
- C:\Windows\System\acbLMdf.exe
  C:\Windows\System\acbLMdf.exe
  2⤵
  PID:8040
- C:\Windows\System\BVhmogQ.exe
  C:\Windows\System\BVhmogQ.exe
  2⤵
  PID:8064
- C:\Windows\System\qCkPKji.exe
  C:\Windows\System\qCkPKji.exe
  2⤵
  PID:8104
- C:\Windows\System\RhCmRFB.exe
  C:\Windows\System\RhCmRFB.exe
  2⤵
  PID:8184
- C:\Windows\System\tFdmguy.exe
  C:\Windows\System\tFdmguy.exe
  2⤵
  PID:6820
- C:\Windows\System\WoYbYGi.exe
  C:\Windows\System\WoYbYGi.exe
  2⤵
  PID:4660
- C:\Windows\System\uLoRUCO.exe
  C:\Windows\System\uLoRUCO.exe
  2⤵
  PID:3508
- C:\Windows\System\WwikgmR.exe
  C:\Windows\System\WwikgmR.exe
  2⤵
  PID:3016
- C:\Windows\System\lSBNkeY.exe
  C:\Windows\System\lSBNkeY.exe
  2⤵
  PID:884
- C:\Windows\System\nUqDhCY.exe
  C:\Windows\System\nUqDhCY.exe
  2⤵
  PID:7720
- C:\Windows\System\OmSQsuE.exe
  C:\Windows\System\OmSQsuE.exe
  2⤵
  PID:872
- C:\Windows\System\aoMeJGh.exe
  C:\Windows\System\aoMeJGh.exe
  2⤵
  PID:5744
- C:\Windows\System\LBBBmaT.exe
  C:\Windows\System\LBBBmaT.exe
  2⤵
  PID:3684
- C:\Windows\System\VeaFQiK.exe
  C:\Windows\System\VeaFQiK.exe
  2⤵
  PID:5760
- C:\Windows\System\usvOFJG.exe
  C:\Windows\System\usvOFJG.exe
  2⤵
  PID:9236
- C:\Windows\System\jwZJMYG.exe
  C:\Windows\System\jwZJMYG.exe
  2⤵
  PID:9252
- C:\Windows\System\uqJYVQv.exe
  C:\Windows\System\uqJYVQv.exe
  2⤵
  PID:9272
- C:\Windows\System\wKZHOyM.exe
  C:\Windows\System\wKZHOyM.exe
  2⤵
  PID:9292
- C:\Windows\System\ktXXQJE.exe
  C:\Windows\System\ktXXQJE.exe
  2⤵
  PID:9320
- C:\Windows\System\ykHBiSu.exe
  C:\Windows\System\ykHBiSu.exe
  2⤵
  PID:9340
- C:\Windows\System\rslzykJ.exe
  C:\Windows\System\rslzykJ.exe
  2⤵
  PID:9356
- C:\Windows\System\XwWUwVx.exe
  C:\Windows\System\XwWUwVx.exe
  2⤵
  PID:9384
- C:\Windows\System\ppiXxQO.exe
  C:\Windows\System\ppiXxQO.exe
  2⤵
  PID:9408
- C:\Windows\System\qvusruw.exe
  C:\Windows\System\qvusruw.exe
  2⤵
  PID:9424
- C:\Windows\System\urTgOyL.exe
  C:\Windows\System\urTgOyL.exe
  2⤵
  PID:9452
- C:\Windows\System\DyMyoix.exe
  C:\Windows\System\DyMyoix.exe
  2⤵
  PID:9472
- C:\Windows\System\IiPgmdV.exe
  C:\Windows\System\IiPgmdV.exe
  2⤵
  PID:9492
- C:\Windows\System\ePEWmNa.exe
  C:\Windows\System\ePEWmNa.exe
  2⤵
  PID:9512
- C:\Windows\System\ASljZIF.exe
  C:\Windows\System\ASljZIF.exe
  2⤵
  PID:9532
- C:\Windows\System\RfMGQfo.exe
  C:\Windows\System\RfMGQfo.exe
  2⤵
  PID:9556
- C:\Windows\System\ayKrcjz.exe
  C:\Windows\System\ayKrcjz.exe
  2⤵
  PID:9580
- C:\Windows\System\yWMxdfc.exe
  C:\Windows\System\yWMxdfc.exe
  2⤵
  PID:9604
- C:\Windows\System\PFCKilK.exe
  C:\Windows\System\PFCKilK.exe
  2⤵
  PID:9624
- C:\Windows\System\VMNagDn.exe
  C:\Windows\System\VMNagDn.exe
  2⤵
  PID:9652
- C:\Windows\System\ClMmjiN.exe
  C:\Windows\System\ClMmjiN.exe
  2⤵
  PID:9672
- C:\Windows\System\vFDXOjw.exe
  C:\Windows\System\vFDXOjw.exe
  2⤵
  PID:9692
- C:\Windows\System\HSKmTnz.exe
  C:\Windows\System\HSKmTnz.exe
  2⤵
  PID:9712
- C:\Windows\System\PmohtbN.exe
  C:\Windows\System\PmohtbN.exe
  2⤵
  PID:9732
- C:\Windows\System\NZrABMb.exe
  C:\Windows\System\NZrABMb.exe
  2⤵
  PID:9756
- C:\Windows\System\NtUHpaB.exe
  C:\Windows\System\NtUHpaB.exe
  2⤵
  PID:9784
- C:\Windows\System\JvHLGmZ.exe
  C:\Windows\System\JvHLGmZ.exe
  2⤵
  PID:9804
- C:\Windows\System\rXBhhPn.exe
  C:\Windows\System\rXBhhPn.exe
  2⤵
  PID:9824
- C:\Windows\System\fJLYQdu.exe
  C:\Windows\System\fJLYQdu.exe
  2⤵
  PID:9848
- C:\Windows\System\GHsUtqv.exe
  C:\Windows\System\GHsUtqv.exe
  2⤵
  PID:9876
- C:\Windows\System\qpiDCEz.exe
  C:\Windows\System\qpiDCEz.exe
  2⤵
  PID:9896
- C:\Windows\System\CknlPCY.exe
  C:\Windows\System\CknlPCY.exe
  2⤵
  PID:9916
- C:\Windows\System\HvqGPxc.exe
  C:\Windows\System\HvqGPxc.exe
  2⤵
  PID:9936
- C:\Windows\System\jiXhrBH.exe
  C:\Windows\System\jiXhrBH.exe
  2⤵
  PID:9964
- C:\Windows\System\rLjqRAO.exe
  C:\Windows\System\rLjqRAO.exe
  2⤵
  PID:9988
- C:\Windows\System\XiFzcYA.exe
  C:\Windows\System\XiFzcYA.exe
  2⤵
  PID:10008
- C:\Windows\System\TIZYgjb.exe
  C:\Windows\System\TIZYgjb.exe
  2⤵
  PID:10024
- C:\Windows\System\txcZBcN.exe
  C:\Windows\System\txcZBcN.exe
  2⤵
  PID:10040
- C:\Windows\System\sAWObuz.exe
  C:\Windows\System\sAWObuz.exe
  2⤵
  PID:10056
- C:\Windows\System\EaZFYtQ.exe
  C:\Windows\System\EaZFYtQ.exe
  2⤵
  PID:10072
- C:\Windows\System\KetOGnY.exe
  C:\Windows\System\KetOGnY.exe
  2⤵
  PID:10100
- C:\Windows\System\MTCJGgP.exe
  C:\Windows\System\MTCJGgP.exe
  2⤵
  PID:10120
- C:\Windows\System\ZNTuaCP.exe
  C:\Windows\System\ZNTuaCP.exe
  2⤵
  PID:10136
- C:\Windows\System\WHyalOg.exe
  C:\Windows\System\WHyalOg.exe
  2⤵
  PID:10160
- C:\Windows\System\LpcSayV.exe
  C:\Windows\System\LpcSayV.exe
  2⤵
  PID:10184
- C:\Windows\System\jklemkj.exe
  C:\Windows\System\jklemkj.exe
  2⤵
  PID:10204
- C:\Windows\System\UkjYVWd.exe
  C:\Windows\System\UkjYVWd.exe
  2⤵
  PID:10228
- C:\Windows\System\jciIbdQ.exe
  C:\Windows\System\jciIbdQ.exe
  2⤵
  PID:7836
- C:\Windows\System\NHVYUiC.exe
  C:\Windows\System\NHVYUiC.exe
  2⤵
  PID:7884
- C:\Windows\System\emgWjLG.exe
  C:\Windows\System\emgWjLG.exe
  2⤵
  PID:7292
- C:\Windows\System\YtCBpWI.exe
  C:\Windows\System\YtCBpWI.exe
  2⤵
  PID:8312
- C:\Windows\System\GjjSjiX.exe
  C:\Windows\System\GjjSjiX.exe
  2⤵
  PID:7956
- C:\Windows\System\lUCPuOt.exe
  C:\Windows\System\lUCPuOt.exe
  2⤵
  PID:7980
- C:\Windows\System\dRoWHzt.exe
  C:\Windows\System\dRoWHzt.exe
  2⤵
  PID:8456
- C:\Windows\System\NrKLlpi.exe
  C:\Windows\System\NrKLlpi.exe
  2⤵
  PID:8144
- C:\Windows\System\TbpgMEn.exe
  C:\Windows\System\TbpgMEn.exe
  2⤵
  PID:6236
- C:\Windows\System\lbVScVS.exe
  C:\Windows\System\lbVScVS.exe
  2⤵
  PID:8728
- C:\Windows\System\ThDqTLk.exe
  C:\Windows\System\ThDqTLk.exe
  2⤵
  PID:8800
- C:\Windows\System\nidcEtY.exe
  C:\Windows\System\nidcEtY.exe
  2⤵
  PID:8832
- C:\Windows\System\XlaFavG.exe
  C:\Windows\System\XlaFavG.exe
  2⤵
  PID:6268
- C:\Windows\System\EtBmegl.exe
  C:\Windows\System\EtBmegl.exe
  2⤵
  PID:8992
- C:\Windows\System\IzIkuCA.exe
  C:\Windows\System\IzIkuCA.exe
  2⤵
  PID:7684
- C:\Windows\System\qQctlop.exe
  C:\Windows\System\qQctlop.exe
  2⤵
  PID:9152
- C:\Windows\System\NModqWI.exe
  C:\Windows\System\NModqWI.exe
  2⤵
  PID:7248
- C:\Windows\System\CzRqBOw.exe
  C:\Windows\System\CzRqBOw.exe
  2⤵
  PID:7516
- C:\Windows\System\jhCUlDe.exe
  C:\Windows\System\jhCUlDe.exe
  2⤵
  PID:7080
- C:\Windows\System\aJcLVBC.exe
  C:\Windows\System\aJcLVBC.exe
  2⤵
  PID:10264
- C:\Windows\System\oCdabLP.exe
  C:\Windows\System\oCdabLP.exe
  2⤵
  PID:10284
- C:\Windows\System\akblmuT.exe
  C:\Windows\System\akblmuT.exe
  2⤵
  PID:10304
- C:\Windows\System\vdBANel.exe
  C:\Windows\System\vdBANel.exe
  2⤵
  PID:10324
- C:\Windows\System\EqhsqfV.exe
  C:\Windows\System\EqhsqfV.exe
  2⤵
  PID:10352
- C:\Windows\System\SSjFTXs.exe
  C:\Windows\System\SSjFTXs.exe
  2⤵
  PID:10368
- C:\Windows\System\RgYOQvE.exe
  C:\Windows\System\RgYOQvE.exe
  2⤵
  PID:10396
- C:\Windows\System\PkRwIUf.exe
  C:\Windows\System\PkRwIUf.exe
  2⤵
  PID:10420
- C:\Windows\System\VhdalXg.exe
  C:\Windows\System\VhdalXg.exe
  2⤵
  PID:10440
- C:\Windows\System\toAPyse.exe
  C:\Windows\System\toAPyse.exe
  2⤵
  PID:10464
- C:\Windows\System\wnpsMyP.exe
  C:\Windows\System\wnpsMyP.exe
  2⤵
  PID:10488
- C:\Windows\System\wkNQhvW.exe
  C:\Windows\System\wkNQhvW.exe
  2⤵
  PID:10508
- C:\Windows\System\CXqPmhn.exe
  C:\Windows\System\CXqPmhn.exe
  2⤵
  PID:10528
- C:\Windows\System\hWFthBX.exe
  C:\Windows\System\hWFthBX.exe
  2⤵
  PID:10556
- C:\Windows\System\srxhJpg.exe
  C:\Windows\System\srxhJpg.exe
  2⤵
  PID:10576
- C:\Windows\System\XgonWPO.exe
  C:\Windows\System\XgonWPO.exe
  2⤵
  PID:10600
- C:\Windows\System\TUzmZXN.exe
  C:\Windows\System\TUzmZXN.exe
  2⤵
  PID:10616
- C:\Windows\System\PAjGhtg.exe
  C:\Windows\System\PAjGhtg.exe
  2⤵
  PID:10636
- C:\Windows\System\LKwQCZk.exe
  C:\Windows\System\LKwQCZk.exe
  2⤵
  PID:10664
- C:\Windows\System\ZEICYnE.exe
  C:\Windows\System\ZEICYnE.exe
  2⤵
  PID:10684
- C:\Windows\System\BFLCrAO.exe
  C:\Windows\System\BFLCrAO.exe
  2⤵
  PID:10708
- C:\Windows\System\JgXUjCo.exe
  C:\Windows\System\JgXUjCo.exe
  2⤵
  PID:10728
- C:\Windows\System\UvOCGeK.exe
  C:\Windows\System\UvOCGeK.exe
  2⤵
  PID:10760
- C:\Windows\System\sBTvvff.exe
  C:\Windows\System\sBTvvff.exe
  2⤵
  PID:10780
- C:\Windows\System\DULxvTt.exe
  C:\Windows\System\DULxvTt.exe
  2⤵
  PID:10800
- C:\Windows\System\CxERGhR.exe
  C:\Windows\System\CxERGhR.exe
  2⤵
  PID:10824
- C:\Windows\System\pOqdLJx.exe
  C:\Windows\System\pOqdLJx.exe
  2⤵
  PID:10844
- C:\Windows\System\tYhfblI.exe
  C:\Windows\System\tYhfblI.exe
  2⤵
  PID:10868
- C:\Windows\System\tWqEmBf.exe
  C:\Windows\System\tWqEmBf.exe
  2⤵
  PID:10888
- C:\Windows\System\NXlhOQm.exe
  C:\Windows\System\NXlhOQm.exe
  2⤵
  PID:10908
- C:\Windows\System\SHPhbAK.exe
  C:\Windows\System\SHPhbAK.exe
  2⤵
  PID:10928
- C:\Windows\System\esftVGs.exe
  C:\Windows\System\esftVGs.exe
  2⤵
  PID:10948
- C:\Windows\System\xBILxYU.exe
  C:\Windows\System\xBILxYU.exe
  2⤵
  PID:10972
- C:\Windows\System\QYVnzUl.exe
  C:\Windows\System\QYVnzUl.exe
  2⤵
  PID:10996
- C:\Windows\System\DajoQLO.exe
  C:\Windows\System\DajoQLO.exe
  2⤵
  PID:11012
- C:\Windows\System\hahffSw.exe
  C:\Windows\System\hahffSw.exe
  2⤵
  PID:11036
- C:\Windows\System\zCKqaSY.exe
  C:\Windows\System\zCKqaSY.exe
  2⤵
  PID:11060
- C:\Windows\System\MXFcSbm.exe
  C:\Windows\System\MXFcSbm.exe
  2⤵
  PID:11088
- C:\Windows\System\OcbVbNk.exe
  C:\Windows\System\OcbVbNk.exe
  2⤵
  PID:11108
- C:\Windows\System\PzjvOBV.exe
  C:\Windows\System\PzjvOBV.exe
  2⤵
  PID:11132
- C:\Windows\System\cwqbKZh.exe
  C:\Windows\System\cwqbKZh.exe
  2⤵
  PID:11156
- C:\Windows\System\XKGRDiK.exe
  C:\Windows\System\XKGRDiK.exe
  2⤵
  PID:8196
- C:\Windows\System\aPyrFNt.exe
  C:\Windows\System\aPyrFNt.exe
  2⤵
  PID:10472
- C:\Windows\System\dHjxiCV.exe
  C:\Windows\System\dHjxiCV.exe
  2⤵
  PID:8284
- C:\Windows\System\nrhpbCV.exe
  C:\Windows\System\nrhpbCV.exe
  2⤵
  PID:9468
- C:\Windows\System\rVyQtFw.exe
  C:\Windows\System\rVyQtFw.exe
  2⤵
  PID:10704
- C:\Windows\System\OAKxNib.exe
  C:\Windows\System\OAKxNib.exe
  2⤵
  PID:10752
- C:\Windows\System\HpUUEuE.exe
  C:\Windows\System\HpUUEuE.exe
  2⤵
  PID:8476
- C:\Windows\System\RMhYCQv.exe
  C:\Windows\System\RMhYCQv.exe
  2⤵
  PID:10812
- C:\Windows\System\khfzeoO.exe
  C:\Windows\System\khfzeoO.exe
  2⤵
  PID:10916
- C:\Windows\System\fZgLPNO.exe
  C:\Windows\System\fZgLPNO.exe
  2⤵
  PID:10988
- C:\Windows\System\JgUYxoi.exe
  C:\Windows\System\JgUYxoi.exe
  2⤵
  PID:11008
- C:\Windows\System\niKqxHV.exe
  C:\Windows\System\niKqxHV.exe
  2⤵
  PID:4188
- C:\Windows\System\WRXRozh.exe
  C:\Windows\System\WRXRozh.exe
  2⤵
  PID:10016
- C:\Windows\System\gLtOnOC.exe
  C:\Windows\System\gLtOnOC.exe
  2⤵
  PID:8892
- C:\Windows\System\IgIJXXp.exe
  C:\Windows\System\IgIJXXp.exe
  2⤵
  PID:8952
- C:\Windows\System\dltLBRp.exe
  C:\Windows\System\dltLBRp.exe
  2⤵
  PID:8344
- C:\Windows\System\cvEZDqV.exe
  C:\Windows\System\cvEZDqV.exe
  2⤵
  PID:9084
- C:\Windows\System\ejofqXQ.exe
  C:\Windows\System\ejofqXQ.exe
  2⤵
  PID:9140
- C:\Windows\System\YemkRFM.exe
  C:\Windows\System\YemkRFM.exe
  2⤵
  PID:8772
- C:\Windows\System\JUmvDFj.exe
  C:\Windows\System\JUmvDFj.exe
  2⤵
  PID:11284
- C:\Windows\System\IhqNydM.exe
  C:\Windows\System\IhqNydM.exe
  2⤵
  PID:11308
- C:\Windows\System\zrZkZOS.exe
  C:\Windows\System\zrZkZOS.exe
  2⤵
  PID:11332
- C:\Windows\System\ucDzXGA.exe
  C:\Windows\System\ucDzXGA.exe
  2⤵
  PID:11356
- C:\Windows\System\hTjhvCL.exe
  C:\Windows\System\hTjhvCL.exe
  2⤵
  PID:11376
- C:\Windows\System\uPuHsvP.exe
  C:\Windows\System\uPuHsvP.exe
  2⤵
  PID:11396
- C:\Windows\System\gtvTKvB.exe
  C:\Windows\System\gtvTKvB.exe
  2⤵
  PID:11420
- C:\Windows\System\iWaJIpk.exe
  C:\Windows\System\iWaJIpk.exe
  2⤵
  PID:11444
- C:\Windows\System\RkkrNIq.exe
  C:\Windows\System\RkkrNIq.exe
  2⤵
  PID:11468
- C:\Windows\System\HbxaRJB.exe
  C:\Windows\System\HbxaRJB.exe
  2⤵
  PID:11492
- C:\Windows\System\lFnzLRH.exe
  C:\Windows\System\lFnzLRH.exe
  2⤵
  PID:11516
- C:\Windows\System\foIBuNB.exe
  C:\Windows\System\foIBuNB.exe
  2⤵
  PID:11544
- C:\Windows\System\PVsrpRq.exe
  C:\Windows\System\PVsrpRq.exe
  2⤵
  PID:11576
- C:\Windows\System\pPHNMMs.exe
  C:\Windows\System\pPHNMMs.exe
  2⤵
  PID:11596
- C:\Windows\System\anfRXfk.exe
  C:\Windows\System\anfRXfk.exe
  2⤵
  PID:11620
- C:\Windows\System\CqEfONd.exe
  C:\Windows\System\CqEfONd.exe
  2⤵
  PID:11648
- C:\Windows\System\FpRVFAS.exe
  C:\Windows\System\FpRVFAS.exe
  2⤵
  PID:11672
- C:\Windows\System\ZBegXfF.exe
  C:\Windows\System\ZBegXfF.exe
  2⤵
  PID:11696
- C:\Windows\System\PcKVOCC.exe
  C:\Windows\System\PcKVOCC.exe
  2⤵
  PID:11728
- C:\Windows\System\LJAxLxl.exe
  C:\Windows\System\LJAxLxl.exe
  2⤵
  PID:11748
- C:\Windows\System\qXAixFf.exe
  C:\Windows\System\qXAixFf.exe
  2⤵
  PID:11780
- C:\Windows\System\SlwlOiR.exe
  C:\Windows\System\SlwlOiR.exe
  2⤵
  PID:11812
- C:\Windows\System\yOpOpBI.exe
  C:\Windows\System\yOpOpBI.exe
  2⤵
  PID:11832
- C:\Windows\System\QxjXxWB.exe
  C:\Windows\System\QxjXxWB.exe
  2⤵
  PID:11856
- C:\Windows\System\dsWkjfi.exe
  C:\Windows\System\dsWkjfi.exe
  2⤵
  PID:11884
- C:\Windows\System\PiHbnli.exe
  C:\Windows\System\PiHbnli.exe
  2⤵
  PID:11924
- C:\Windows\System\wizaHGA.exe
  C:\Windows\System\wizaHGA.exe
  2⤵
  PID:11948
- C:\Windows\System\vsOHFUj.exe
  C:\Windows\System\vsOHFUj.exe
  2⤵
  PID:11972
- C:\Windows\System\MofYIxT.exe
  C:\Windows\System\MofYIxT.exe
  2⤵
  PID:12004
- C:\Windows\System\ODZgKBA.exe
  C:\Windows\System\ODZgKBA.exe
  2⤵
  PID:12032
- C:\Windows\System\yBVDXHZ.exe
  C:\Windows\System\yBVDXHZ.exe
  2⤵
  PID:12056
- C:\Windows\System\VtIwkrm.exe
  C:\Windows\System\VtIwkrm.exe
  2⤵
  PID:12072
- C:\Windows\System\OIoPSZw.exe
  C:\Windows\System\OIoPSZw.exe
  2⤵
  PID:12096
- C:\Windows\System\sJCluWT.exe
  C:\Windows\System\sJCluWT.exe
  2⤵
  PID:12120
- C:\Windows\System\tfTxCMA.exe
  C:\Windows\System\tfTxCMA.exe
  2⤵
  PID:12144
- C:\Windows\System\VpMEPHT.exe
  C:\Windows\System\VpMEPHT.exe
  2⤵
  PID:12164
- C:\Windows\System\VndTRSA.exe
  C:\Windows\System\VndTRSA.exe
  2⤵
  PID:12188
- C:\Windows\System\qvoFNEf.exe
  C:\Windows\System\qvoFNEf.exe
  2⤵
  PID:12220
- C:\Windows\System\iqesysW.exe
  C:\Windows\System\iqesysW.exe
  2⤵
  PID:12244
- C:\Windows\System\WsoelGU.exe
  C:\Windows\System\WsoelGU.exe
  2⤵
  PID:12264
- C:\Windows\System\bcHkJRA.exe
  C:\Windows\System\bcHkJRA.exe
  2⤵
  PID:6572
- C:\Windows\System\rLcmOpm.exe
  C:\Windows\System\rLcmOpm.exe
  2⤵
  PID:8124
- C:\Windows\System\TTvXofN.exe
  C:\Windows\System\TTvXofN.exe
  2⤵
  PID:9212
- C:\Windows\System\lvItTYG.exe
  C:\Windows\System\lvItTYG.exe
  2⤵
  PID:7756
- C:\Windows\System\ZGpJXGt.exe
  C:\Windows\System\ZGpJXGt.exe
  2⤵
  PID:6528
- C:\Windows\System\pBnuoMH.exe
  C:\Windows\System\pBnuoMH.exe
  2⤵
  PID:9288
- C:\Windows\System\AAQLFkT.exe
  C:\Windows\System\AAQLFkT.exe
  2⤵
  PID:10504
- C:\Windows\System\IHcxVfq.exe
  C:\Windows\System\IHcxVfq.exe
  2⤵
  PID:10536
- C:\Windows\System\WbZHgFV.exe
  C:\Windows\System\WbZHgFV.exe
  2⤵
  PID:9416
- C:\Windows\System\btfysND.exe
  C:\Windows\System\btfysND.exe
  2⤵
  PID:10656
- C:\Windows\System\zWuAlFI.exe
  C:\Windows\System\zWuAlFI.exe
  2⤵
  PID:9488
- C:\Windows\System\ysfKSip.exe
  C:\Windows\System\ysfKSip.exe
  2⤵
  PID:9548
- C:\Windows\System\pCACtff.exe
  C:\Windows\System\pCACtff.exe
  2⤵
  PID:8784
- C:\Windows\System\ccBXYwd.exe
  C:\Windows\System\ccBXYwd.exe
  2⤵
  PID:10900
- C:\Windows\System\koeSpGN.exe
  C:\Windows\System\koeSpGN.exe
  2⤵
  PID:12304
- C:\Windows\System\flGINcu.exe
  C:\Windows\System\flGINcu.exe
  2⤵
  PID:12324
- C:\Windows\System\ZeUjlPx.exe
  C:\Windows\System\ZeUjlPx.exe
  2⤵
  PID:12344
- C:\Windows\System\VqUmCPO.exe
  C:\Windows\System\VqUmCPO.exe
  2⤵
  PID:12360
- C:\Windows\System\JQzSRKv.exe
  C:\Windows\System\JQzSRKv.exe
  2⤵
  PID:12376
- C:\Windows\System\YahbdBE.exe
  C:\Windows\System\YahbdBE.exe
  2⤵
  PID:12396
- C:\Windows\System\RqVlndY.exe
  C:\Windows\System\RqVlndY.exe
  2⤵
  PID:12412
- C:\Windows\System\XNsSTTH.exe
  C:\Windows\System\XNsSTTH.exe
  2⤵
  PID:12432
- C:\Windows\System\bHfcDTi.exe
  C:\Windows\System\bHfcDTi.exe
  2⤵
  PID:12448
- C:\Windows\System\cmCaQOD.exe
  C:\Windows\System\cmCaQOD.exe
  2⤵
  PID:12476
- C:\Windows\System\KEtTIZu.exe
  C:\Windows\System\KEtTIZu.exe
  2⤵
  PID:12496
- C:\Windows\System\igftSiS.exe
  C:\Windows\System\igftSiS.exe
  2⤵
  PID:12516
- C:\Windows\System\BYsfgQg.exe
  C:\Windows\System\BYsfgQg.exe
  2⤵
  PID:12540
- C:\Windows\System\ojcqCuI.exe
  C:\Windows\System\ojcqCuI.exe
  2⤵
  PID:12564
- C:\Windows\System\roKHGkT.exe
  C:\Windows\System\roKHGkT.exe
  2⤵
  PID:12588
- C:\Windows\System\IwKSfuu.exe
  C:\Windows\System\IwKSfuu.exe
  2⤵
  PID:12624
- C:\Windows\System\NRXgOUx.exe
  C:\Windows\System\NRXgOUx.exe
  2⤵
  PID:12644
- C:\Windows\System\WfkrFWT.exe
  C:\Windows\System\WfkrFWT.exe
  2⤵
  PID:12676
- C:\Windows\System\cKUIzkr.exe
  C:\Windows\System\cKUIzkr.exe
  2⤵
  PID:12700
- C:\Windows\System\siPKfcU.exe
  C:\Windows\System\siPKfcU.exe
  2⤵
  PID:12732
- C:\Windows\System\HKAFFaq.exe
  C:\Windows\System\HKAFFaq.exe
  2⤵
  PID:12764
- C:\Windows\System\TTnRCEk.exe
  C:\Windows\System\TTnRCEk.exe
  2⤵
  PID:12804
- C:\Windows\System\AAAIjPb.exe
  C:\Windows\System\AAAIjPb.exe
  2⤵
  PID:12832
- C:\Windows\System\CbLQgUF.exe
  C:\Windows\System\CbLQgUF.exe
  2⤵
  PID:12860
- C:\Windows\System\nRVxbNP.exe
  C:\Windows\System\nRVxbNP.exe
  2⤵
  PID:12888
- C:\Windows\System\mIWQPVp.exe
  C:\Windows\System\mIWQPVp.exe
  2⤵
  PID:12912
- C:\Windows\System\hPyMkuI.exe
  C:\Windows\System\hPyMkuI.exe
  2⤵
  PID:12940
- C:\Windows\System\cBvbXFt.exe
  C:\Windows\System\cBvbXFt.exe
  2⤵
  PID:12976
- C:\Windows\System\XeVXSST.exe
  C:\Windows\System\XeVXSST.exe
  2⤵
  PID:12996
- C:\Windows\System\fJTPZDv.exe
  C:\Windows\System\fJTPZDv.exe
  2⤵
  PID:13016
- C:\Windows\System\TwdSuIb.exe
  C:\Windows\System\TwdSuIb.exe
  2⤵
  PID:13040
- C:\Windows\System\ObYBBFn.exe
  C:\Windows\System\ObYBBFn.exe
  2⤵
  PID:13060
- C:\Windows\System\BxNruue.exe
  C:\Windows\System\BxNruue.exe
  2⤵
  PID:13084
- C:\Windows\System\UhQuFbh.exe
  C:\Windows\System\UhQuFbh.exe
  2⤵
  PID:13108
- C:\Windows\System\KgzDOsC.exe
  C:\Windows\System\KgzDOsC.exe
  2⤵
  PID:13124
- C:\Windows\System\navtPBB.exe
  C:\Windows\System\navtPBB.exe
  2⤵
  PID:13144
- C:\Windows\System\NRiPmWX.exe
  C:\Windows\System\NRiPmWX.exe
  2⤵
  PID:13172
- C:\Windows\System\YFVnFaN.exe
  C:\Windows\System\YFVnFaN.exe
  2⤵
  PID:13196
- C:\Windows\System\MLnOvcY.exe
  C:\Windows\System\MLnOvcY.exe
  2⤵
  PID:13216
- C:\Windows\System\PygAWAX.exe
  C:\Windows\System\PygAWAX.exe
  2⤵
  PID:13240
- C:\Windows\System\nfAchJD.exe
  C:\Windows\System\nfAchJD.exe
  2⤵
  PID:13260
- C:\Windows\System\uvduhkj.exe
  C:\Windows\System\uvduhkj.exe
  2⤵
  PID:13284
- C:\Windows\System\jfVElYM.exe
  C:\Windows\System\jfVElYM.exe
  2⤵
  PID:13308
- C:\Windows\System\pKQRHJL.exe
  C:\Windows\System\pKQRHJL.exe
  2⤵
  PID:11028
- C:\Windows\System\lMsXZoD.exe
  C:\Windows\System\lMsXZoD.exe
  2⤵
  PID:9752
- C:\Windows\System\vBJKnpp.exe
  C:\Windows\System\vBJKnpp.exe
  2⤵
  PID:11140
- C:\Windows\System\cwVEjDS.exe
  C:\Windows\System\cwVEjDS.exe
  2⤵
  PID:9020
- C:\Windows\System\AlaVtKQ.exe
  C:\Windows\System\AlaVtKQ.exe
  2⤵
  PID:8212
- C:\Windows\System\VbYOJZX.exe
  C:\Windows\System\VbYOJZX.exe
  2⤵
  PID:1212
- C:\Windows\System\WdJCKlw.exe
  C:\Windows\System\WdJCKlw.exe
  2⤵
  PID:8460
- C:\Windows\System\mAPBfXB.exe
  C:\Windows\System\mAPBfXB.exe
  2⤵
  PID:11896
- C:\Windows\System\ZYFBAqc.exe
  C:\Windows\System\ZYFBAqc.exe
  2⤵
  PID:11280
- C:\Windows\System\HNtVdQi.exe
  C:\Windows\System\HNtVdQi.exe
  2⤵
  PID:2320
- C:\Windows\System\rgXxImQ.exe
  C:\Windows\System\rgXxImQ.exe
  2⤵
  PID:13136
- C:\Windows\System\IQPeAtI.exe
  C:\Windows\System\IQPeAtI.exe
  2⤵
  PID:13024
- C:\Windows\System\QkVLBqz.exe
  C:\Windows\System\QkVLBqz.exe
  2⤵
  PID:12880
- C:\Windows\System\HOejbfA.exe
  C:\Windows\System\HOejbfA.exe
  2⤵
  PID:12656
- C:\Windows\System\aENScIG.exe
  C:\Windows\System\aENScIG.exe
  2⤵
  PID:12508
- C:\Windows\System\AULQWlc.exe
  C:\Windows\System\AULQWlc.exe
  2⤵
  PID:12384
- C:\Windows\System\yHLftjZ.exe
  C:\Windows\System\yHLftjZ.exe
  2⤵
  PID:9648
- C:\Windows\System\zKKGzWL.exe
  C:\Windows\System\zKKGzWL.exe
  2⤵
  PID:10568
- C:\Windows\System\oELgKsA.exe
  C:\Windows\System\oELgKsA.exe
  2⤵
  PID:10836
- C:\Windows\System\qkGlRjo.exe
  C:\Windows\System\qkGlRjo.exe
  2⤵
  PID:12688
- C:\Windows\System\jIvwEgj.exe
  C:\Windows\System\jIvwEgj.exe
  2⤵
  PID:9188
- C:\Windows\System\DCeZBxN.exe
  C:\Windows\System\DCeZBxN.exe
  2⤵
  PID:9464
- C:\Windows\System\XVvzAJC.exe
  C:\Windows\System\XVvzAJC.exe
  2⤵
  PID:11224
- C:\Windows\System\vCPUTmY.exe
  C:\Windows\System\vCPUTmY.exe
  2⤵
  PID:2516
- C:\Windows\System\qNMpnec.exe
  C:\Windows\System\qNMpnec.exe
  2⤵
  PID:12104
- C:\Windows\System\WxraYGa.exe
  C:\Windows\System\WxraYGa.exe
  2⤵
  PID:11980
- C:\Windows\System\iWDCAAT.exe
  C:\Windows\System\iWDCAAT.exe
  2⤵
  PID:11792
- C:\Windows\System\rOglyTH.exe
  C:\Windows\System\rOglyTH.exe
  2⤵
  PID:7344
- C:\Windows\System\gnzoMgZ.exe
  C:\Windows\System\gnzoMgZ.exe
  2⤵
  PID:12232
- C:\Windows\System\HVyRaGE.exe
  C:\Windows\System\HVyRaGE.exe
  2⤵
  PID:8288
- C:\Windows\System\QXBEtxa.exe
  C:\Windows\System\QXBEtxa.exe
  2⤵
  PID:11232
- C:\Windows\System\netnply.exe
  C:\Windows\System\netnply.exe
  2⤵
  PID:11944
- C:\Windows\System\gQVvHUT.exe
  C:\Windows\System\gQVvHUT.exe
  2⤵
  PID:11440
- C:\Windows\System\YRnysvE.exe
  C:\Windows\System\YRnysvE.exe
  2⤵
  PID:9336
- C:\Windows\System\axkAktD.exe
  C:\Windows\System\axkAktD.exe
  2⤵
  PID:12320
- C:\Windows\System\rZDnhEw.exe
  C:\Windows\System\rZDnhEw.exe
  2⤵
  PID:9724
- C:\Windows\System\uZCXAvA.exe
  C:\Windows\System\uZCXAvA.exe
  2⤵
  PID:11248
- C:\Windows\System\NWmFySF.exe
  C:\Windows\System\NWmFySF.exe
  2⤵
  PID:12716
- C:\Windows\System\iCowkWt.exe
  C:\Windows\System\iCowkWt.exe
  2⤵
  PID:11508
- C:\Windows\System\nvNdXAj.exe
  C:\Windows\System\nvNdXAj.exe
  2⤵
  PID:12664
- C:\Windows\System\MWxegBQ.exe
  C:\Windows\System\MWxegBQ.exe
  2⤵
  PID:11268
- C:\Windows\System\Hiqwcrb.exe
  C:\Windows\System\Hiqwcrb.exe
  2⤵
  PID:12080
- C:\Windows\System\UNGferO.exe
  C:\Windows\System\UNGferO.exe
  2⤵
  PID:11712
- C:\Windows\System\MhtbxYJ.exe
  C:\Windows\System\MhtbxYJ.exe
  2⤵
  PID:11588
- C:\Windows\System\pYcCCAq.exe
  C:\Windows\System\pYcCCAq.exe
  2⤵
  PID:4792
- C:\Windows\System\dOBTOjH.exe
  C:\Windows\System\dOBTOjH.exe
  2⤵
  PID:7416
- C:\Windows\System\cvabFZi.exe
  C:\Windows\System\cvabFZi.exe
  2⤵
  PID:12532
- C:\Windows\System\ndfkhYr.exe
  C:\Windows\System\ndfkhYr.exe
  2⤵
  PID:12200
- C:\Windows\System\WREJhER.exe
  C:\Windows\System\WREJhER.exe
  2⤵
  PID:1144
- C:\Windows\System\usANAeL.exe
  C:\Windows\System\usANAeL.exe
  2⤵
  PID:6196
- C:\Windows\System\lVvayhv.exe
  C:\Windows\System\lVvayhv.exe
  2⤵
  PID:12620
- C:\Windows\System\AwdtsxD.exe
  C:\Windows\System\AwdtsxD.exe
  2⤵
  PID:12904
- C:\Windows\System\qJRnsDO.exe
  C:\Windows\System\qJRnsDO.exe
  2⤵
  PID:12332
- C:\Windows\System\VyJZiyr.exe
  C:\Windows\System\VyJZiyr.exe
  2⤵
  PID:3964
- C:\Windows\System\xdXCCzp.exe
  C:\Windows\System\xdXCCzp.exe
  2⤵
  PID:10968
- C:\Windows\System\uvMyMrv.exe
  C:\Windows\System\uvMyMrv.exe
  2⤵
  PID:6688
- C:\Windows\System\RtYQAWy.exe
  C:\Windows\System\RtYQAWy.exe
  2⤵
  PID:11656
- C:\Windows\System\PWEVxBU.exe
  C:\Windows\System\PWEVxBU.exe
  2⤵
  PID:12708
- C:\Windows\System\TNFjdTK.exe
  C:\Windows\System\TNFjdTK.exe
  2⤵
  PID:12928
- C:\Windows\System\CQXnvas.exe
  C:\Windows\System\CQXnvas.exe
  2⤵
  PID:9908
- C:\Windows\System\GSSWwoA.exe
  C:\Windows\System\GSSWwoA.exe
  2⤵
  PID:12092
- C:\Windows\System\yrcoEJQ.exe
  C:\Windows\System\yrcoEJQ.exe
  2⤵
  PID:11076
- C:\Windows\System\IFgOyjm.exe
  C:\Windows\System\IFgOyjm.exe
  2⤵
  PID:7340
- C:\Windows\System\SpvDbtF.exe
  C:\Windows\System\SpvDbtF.exe
  2⤵
  PID:10980
- C:\Windows\System\uBbeBxo.exe
  C:\Windows\System\uBbeBxo.exe
  2⤵
  PID:12984
- C:\Windows\System\wAQlVtA.exe
  C:\Windows\System\wAQlVtA.exe
  2⤵
  PID:12460
- C:\Windows\System\jnWGCTE.exe
  C:\Windows\System\jnWGCTE.exe
  2⤵
  PID:7864
- C:\Windows\System\fQXbpxZ.exe
  C:\Windows\System\fQXbpxZ.exe
  2⤵
  PID:3960
- C:\Windows\System\PnbHIum.exe
  C:\Windows\System\PnbHIum.exe
  2⤵
  PID:10156
- C:\Windows\System\uxwcsXE.exe
  C:\Windows\System\uxwcsXE.exe
  2⤵
  PID:10884
- C:\Windows\System\EcNCTXn.exe
  C:\Windows\System\EcNCTXn.exe
  2⤵
  PID:13328
- C:\Windows\System\hjNRbHH.exe
  C:\Windows\System\hjNRbHH.exe
  2⤵
  PID:13432
- C:\Windows\System\bqBUTgz.exe
  C:\Windows\System\bqBUTgz.exe
  2⤵
  PID:13452
- C:\Windows\System\jDBUGnO.exe
  C:\Windows\System\jDBUGnO.exe
  2⤵
  PID:13476
- C:\Windows\System\EnoLVNA.exe
  C:\Windows\System\EnoLVNA.exe
  2⤵
  PID:13504
- C:\Windows\System\GSoSgCp.exe
  C:\Windows\System\GSoSgCp.exe
  2⤵
  PID:13528
- C:\Windows\System\xzdFKRl.exe
  C:\Windows\System\xzdFKRl.exe
  2⤵
  PID:13548
- C:\Windows\System\PmUMOIt.exe
  C:\Windows\System\PmUMOIt.exe
  2⤵
  PID:13780
- C:\Windows\System\fTCVYHn.exe
  C:\Windows\System\fTCVYHn.exe
  2⤵
  PID:13808
- C:\Windows\System\aOAocnR.exe
  C:\Windows\System\aOAocnR.exe
  2⤵
  PID:13828
- C:\Windows\System\QnHUqxH.exe
  C:\Windows\System\QnHUqxH.exe
  2⤵
  PID:13848
- C:\Windows\System\GaZJCwj.exe
  C:\Windows\System\GaZJCwj.exe
  2⤵
  PID:13876
- C:\Windows\System\DEyYMnJ.exe
  C:\Windows\System\DEyYMnJ.exe
  2⤵
  PID:14220
- C:\Windows\System\DSvKXHI.exe
  C:\Windows\System\DSvKXHI.exe
  2⤵
  PID:14244
- C:\Windows\System\ZIcZUeL.exe
  C:\Windows\System\ZIcZUeL.exe
  2⤵
  PID:7492
- C:\Windows\System\fdyZWHK.exe
  C:\Windows\System\fdyZWHK.exe
  2⤵
  PID:13472
- C:\Windows\System\FxFgfVN.exe
  C:\Windows\System\FxFgfVN.exe
  2⤵
  PID:13992
- C:\Windows\System\IXpzxLs.exe
  C:\Windows\System\IXpzxLs.exe
  2⤵
  PID:13692
- C:\Windows\System\JvOBGqc.exe
  C:\Windows\System\JvOBGqc.exe
  2⤵
  PID:13636
- C:\Windows\System\MMHoMqS.exe
  C:\Windows\System\MMHoMqS.exe
  2⤵
  PID:13556
- C:\Windows\System\sharulj.exe
  C:\Windows\System\sharulj.exe
  2⤵
  PID:13920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4ijntnqn.khl.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BWuccQr.exe

Filesize
1.9MB

MD5
35b59af676949154d04832a8379b462e

SHA1
84eeeb66284721fb0e05abd02d57f0cd1cb85f9e

SHA256
513e1031e0917fe8d348cb001440a4e46a0431282632ca3398dc28ddf352d355

SHA512
e2f9668060839df25c887ae13e5de01a112c4e1140352ad49e9c3d112ca3430e9edb80c02c82476faad157c70328ad8675db71e15391934f1df783e3761e5a8f

Download Submit
C:\Windows\System\DJYexRq.exe

Filesize
1.9MB

MD5
229aa6d98ee1aba4e5afc4477d9d78de

SHA1
cc38906e858685681623ffba98e3a0bd30179922

SHA256
80072d52ff3a227641b2cf17a452cb1bf0252ba2001c3ef4da96f3ae5268f79c

SHA512
c74b4ed7c6254142ad61f3a42aea3730c44ccc871fc73a1cd481b24880c7f8cee3fb166b52f45862389b002918bdfffe097cda494562209a0e41c737b22bab54

Download Submit
C:\Windows\System\IZfCyXE.exe

Filesize
1.9MB

MD5
296f9c4edacecf8fe0ee989cf85d93ea

SHA1
f1a077d655a7b4797c07c2bfa44cf81871bf5047

SHA256
14907109fb5a8a175158c79d810a46ffbf14b4301c0a0afafc56f86f65794fca

SHA512
5f950be2716ee618041ff30dbab739cc4e5b99f8456716f4647e80aee819e4cdfe88a8669426d6eaf4b5583b7e37c056b046018d9fc6c72e727f0e80f2a5c9d9

Download Submit
C:\Windows\System\MFgtOzD.exe

Filesize
1.9MB

MD5
65f9b09a0a8525ba459d304fd3c96a00

SHA1
871abfe4983531759c301913f4217fe4682e4ad0

SHA256
6a71764c4f0222ed9351b395e2e644bbd2f9d137b04d06cc4439f4453e0be9da

SHA512
54164ff4ef51dac64f1e808932b4c805e6c0f3916047d46bb8df0efd45a9839439dbc06834d70b7571ed7fd3f4d11fc38d86e98b71a1a847cbe4970e977e0436

Download Submit
C:\Windows\System\MXZTnoC.exe

Filesize
1.9MB

MD5
aea1a57c8b07f9c33a35b8dc7ed67d86

SHA1
c2277c29b2458573b9703f5b9e28a0a6d733bfba

SHA256
e43d036c18670ee47f24607947b8cbebf5a7b37c568336c7ee92709276118d08

SHA512
3a4233fb106654689b93a9bec399fae520970bf052bc085f320d4d370c0d92636771c98d47b96d0b61df1d386e342be49c3d0daeb05dff88f70137d3372cce25

Download Submit
C:\Windows\System\MnMERjT.exe

Filesize
1.9MB

MD5
a45669dd0bad74632bdbf6504fc02ead

SHA1
f5db729bada76545835367d19147e8855f1692c9

SHA256
07dbb2a3cc62fe068f80c0abffdf44db52ce92aff9e8657df75f42dc92be8288

SHA512
a5d826ef9e958568fc55c8676e86c9106bf4e1525b53c4a02e9e540ef9e4279344eb38d7abde3836ea3ab4a070eecfe7119c43b6afa82029971bce18582b1730

Download Submit
C:\Windows\System\PwQIrAY.exe

Filesize
1.9MB

MD5
544341167631d30d0ff2eb1c1d90b6de

SHA1
3009b1aaaf6ce6c9a36bea8b274b37a1d1ae954b

SHA256
a3d76697a898780ea475bc022f2642a9589309b21a4e76b82fddebe2406b1929

SHA512
95414622bfb9c7c781b16ca090966ba1ae988b8cf9afcec368eb0a1da01bef9e843263da83efb96f253e6dfe6f91d31646af397ef0e7f4f351aa37494de60145

Download Submit
C:\Windows\System\SXOGNjV.exe

Filesize
1.9MB

MD5
14be9f0c69c4a70d20b3ea26b30154a5

SHA1
467b65b91bb648d77e531d20da04314df97901c1

SHA256
f4d3a0dea0ae3158d4ed2eb2da143ab06bb3de53704047bf2a55cceff821212f

SHA512
3a539e4736b4114f716707c6216541dc854afd9b53ff78a19cd76c25ba0547a385fc1ce08f30dcbbca27fa93d8b481518fd6113ddfb949e5c92a5244e27b6488

Download Submit
C:\Windows\System\SXPjIzt.exe

Filesize
1.9MB

MD5
a30b2bea7422f494034b386c1beae7ba

SHA1
54c6f69c8f9677ccb09707a74d3d9fbe7d6898d3

SHA256
23a77e2c796107044839ddb9c7f460c5f754252e7cbcfdb1f6a1a04de146bbc5

SHA512
17a63df9e0e7fb9d68e527901a872fd5471467ea876e2007ce7182b6fa7f62e1ca845056ccdc022849e55b1de556d5c180d8aed368451bfc3db3a7f3c8e41f2e

Download Submit
C:\Windows\System\ScRmVRi.exe

Filesize
1.9MB

MD5
1e39678be28ad71d272dfb82b721753a

SHA1
c90df757911b209ccaf951e230a8635ed035ceb0

SHA256
aa6a5fc746b315f3629463791ade1feb059dd741248fdd73b7f93229843b1fd9

SHA512
4801dd096a8ca7ec9d30526762da19b50363a91da8a8efbdc24823e74ccfcfeaa9224298e0685f8a39a40b85448f658794ceb80c27a1eacfca5e0e42b51ef66b

Download Submit
C:\Windows\System\StXicsO.exe

Filesize
1.9MB

MD5
e785f2df94546c66da3da4309fa66ece

SHA1
0c60975847df2c906656cd4a98d83b5caf009819

SHA256
8e7f3cc6dbe9265fa1d2dc208498f1029eab60ec46f351c49e314795bf3c3f74

SHA512
18330551da01fe26756fc7b0572615271d3facd2fe67c400d4449e46a7480513179fc97094698f5bf25a4c2969cd6d5b55a69cfcb11e71b90af8924308159132

Download Submit
C:\Windows\System\TYNBsEk.exe

Filesize
1.9MB

MD5
9f521904b29abea571d51a5edc381123

SHA1
8a3b1e85b509def39f0c6e9a2aa1bc8d63f8ed67

SHA256
5f1232899510f998163d1a039f4740c7838d278a15519a07baa7ed8ec7d72715

SHA512
27069011d2ca3c33a5c7152472068a81bfeaa74bfb414e31517f4f3c9bd8ba820b9cf82f3fd5387c895a290a57f42cfce77e705741f335c1ab1601399567a868

Download Submit
C:\Windows\System\VamoSkp.exe

Filesize
1.9MB

MD5
be6eb1d395b7c088ca852bc0a4868d4d

SHA1
7ddf10eb37eb2f1e2c9e8e327588242ea3bb7415

SHA256
6d58636d7b60a8692afed98b7ea730d14d00a7bb63a50919e72c40c3bcca4e36

SHA512
a5599e5107b391b7a7c115c45d473b8eb31aee6462f01ca714c6edde65d806801cb582c7a55436861366130a2d14bee26c04cf644b29899f946c624c6a5e7d8c

Download Submit
C:\Windows\System\YiYouqo.exe

Filesize
1.9MB

MD5
7744051338ff0243ca20b6de3db221a2

SHA1
7e25c8ac782f6441674b105cb74608160b737dab

SHA256
6397a2707700b83e3bd285ca6ddb0f3fa2e6a2b934f3b4eb0fe46ef59afadd48

SHA512
a7386b34f239d3a27f8fe2a66f7bb0c8c02f76076c1bc10c604e488b35b423e5078ee607ed80699b08bd663dd2202995431298edd245e6404513647e635342af

Download Submit
C:\Windows\System\YtfoIej.exe

Filesize
1.9MB

MD5
60e51f623375b45817a61e8f2008aaad

SHA1
cbd2860720e9b19f8e3159d4011d3da5f6ef4a4b

SHA256
f549120f3241ed836a0647baf7015e664e567b48159f7652c2f1a7a76bd71302

SHA512
f6f1106f0208e548f6cb87a7f81cb70a39306c1fdc4a51aa24a7ae85f6f90a1ab902ba6befb54aaf971a8a7864923c197140d3587180dc18246870a3415bbdb6

Download Submit
C:\Windows\System\cgCtOaS.exe

Filesize
1.9MB

MD5
2fb0cab924061a0976a05d77efdd029a

SHA1
a957496e10573614018249f7c4671b512d7cf441

SHA256
69db6fb1c3ad4e1452577c201754700d91bc6a39a388d7498efac100885ee6cf

SHA512
a231882a6561cada30253007db91c717864fc548ac2aefc7529951531f79c4f4122d8dd2410a265e40cf207dec00d8331e66062ba04a9b22d6b217957ad52de2

Download Submit
C:\Windows\System\ddQBwdx.exe

Filesize
1.9MB

MD5
799f0c1b8b52a8f9f718608a4e0a4036

SHA1
3eab7cad2fa1a718679ca1f17f6859d1004629fa

SHA256
b23970efe09af0f8d2b632031a18223b7173ebe8d5d4dc5a1736d4b186e1f706

SHA512
e2bfa1fe0e15af8eaca2b90bf87ad416dcbd0a1c7d2d3057426815389afafb3e7e2c61f36ee807434cd74f623b23aaae829a4339329ed6002a37fc0183f56acf

Download Submit
C:\Windows\System\eCvQioj.exe

Filesize
8B

MD5
30a9dfceb37577cb23b97b50ee0ca790

SHA1
b56360a546aafbfa7ce003cd05916a7ab7239259

SHA256
44dda0d0cfe87b066fcb3ae3e2b0cbc86f86ca0fdd14c7ce736c7a63fedce1f4

SHA512
f1ae1743e6029aabc9e7387b476be46b30f000874bca6e0907b605cfb329a40abfc7d4eb3d891027c469be0356b370267e0531be7c50ab8183a5aad8ce1cbe57

Download Submit
C:\Windows\System\gDsxAqY.exe

Filesize
1.9MB

MD5
1dbd3e62fafb19a9c9f46142c81211bf

SHA1
1e3c09a226c679d12cc69d7a7f37108f1ee19727

SHA256
738ed33fb1ac772f7c17039c8014125aaf764f5cbe24e4ba92d2aa5ffc4eb53c

SHA512
8fa95191fbc83d51909213cc873d2b8e88fd6d270bbcec04e29ee0fb74cd298a954f6defc05679a3d8ad6eeb8b47b4bd7c51f9c5953ac8319856ce770a919f99

Download Submit
C:\Windows\System\gFQQoNd.exe

Filesize
1.9MB

MD5
b5f890ec405f76a76429de2e86ef472f

SHA1
e8a09a3f8aa109cd215626bec6c974a5f1b98476

SHA256
5b2fb48b970a3c3fedbdbd09bfc23dad1b08b55172464c54c013c7a0c91b497b

SHA512
a723b15bd02197f8ef2a4d5c62edbbc7d97db0535c34eddf04ee8bb7e0e44263273f0a73453d4e525584c2f6ea72d88a2e22c425026015799c8823739e909410

Download Submit
C:\Windows\System\jlazDQp.exe

Filesize
1.9MB

MD5
19313bc5431f2bc053e08fb5046b46bc

SHA1
befc77e7953f1369b216c1bc9130522b690e40bc

SHA256
ef8fb70f36cb7b81a4c5cd744b6cb5709e0c2a966a4d32769d2fa34362935d9f

SHA512
783e0cda0f54de826628363d85c3618ec9e4edfa98df4b7537ed6e322c4aaa3d38c384197326f48efc6f25df46a9f36c5576598a8b0a2ae1ee79574489a8c473

Download Submit
C:\Windows\System\mDYNZXB.exe

Filesize
1.9MB

MD5
1706fa0797039a0634eaa82732635384

SHA1
30df15d08479d2fdc69a702141a5e776662d28e2

SHA256
ee83efbd3e7ef79a14c65a6b711def86f70ae31eb8a8111663f866b53483a8dc

SHA512
a570d3787e23f755c141c566519ef37f8f9125c1a97555c833e0990c4ef30e7d4714113e512b09dd026dcd7202681818912119e01141161f875adf432717266a

Download Submit
C:\Windows\System\mEcdGEl.exe

Filesize
1.9MB

MD5
9b4c936dd339fb9913321b146e838226

SHA1
d31dc95f1070686ed3e7620dc6e1b3ce49d315e6

SHA256
e220ec2677f63d90c72285a8e22c806456dce18b1d07bcfc97a4c61544abfed1

SHA512
36cd881e7c66a324999a188e4c80a8f8c0c1e37970889cf13149ad38268bce0005b6d6e5f89102586368e1b25cb31edc9732deb8d8aca9cd2b55835a21db7356

Download Submit
C:\Windows\System\omINfUV.exe

Filesize
1.9MB

MD5
fe1b8620b6cfb382fa0f34fbcf7cb85f

SHA1
4c645bd84ca081a1521ec84e31c24dcebabdbb8a

SHA256
9f540687272cf227cac02c6e4812664aa1b0c0a12f8983627316390bcc289748

SHA512
d0ec741243beaf333f980428e1674ace970f7e46ddfa924ef6cfeaea04a3de8cdc9f13984a3435bfb0823554c2ba45628aafb108f73b48d4d39d2cb9579d4186

Download Submit
C:\Windows\System\pOfXAsV.exe

Filesize
1.9MB

MD5
e82618b4e53734904b035277844818ea

SHA1
b296d5bffa3805a6da3e433a65551528639ccb96

SHA256
b07456f6afc46e84fc60f730b3fc721fa5fafa3888100829655a96b02b4693bb

SHA512
4f7964f174556fe1eadf1533407bd4f149afce8a0f166b72d5b4a79ca80720a2ece4586fd31a62bdea5d9e8c0353d63e34b858924d09c490089dc48c31c91db3

Download Submit
C:\Windows\System\piEPrlh.exe

Filesize
1.9MB

MD5
df80a2efe17ac910574cdee131f939fe

SHA1
5280288832633feba843097f5113a7c34a33c4b7

SHA256
ac54db254f1c45d886604b53f53cb6d61cee785d3fb2d9bd8e217e162743b7e7

SHA512
b77776fb76a4c2a1a97cde945a89fcf9cbce56418b9b66f19c4ec7dd985211e1b5a372647ae1455479b9d603e5bd650c009d52a8f61ea47a26814cdab61128ce

Download Submit
C:\Windows\System\pxmrIWc.exe

Filesize
1.9MB

MD5
3c510c5f62f1f4b9dade3a39665f7d79

SHA1
776ba1ee4bbc301dd15c6216fd30c2c33358e015

SHA256
949cccc81ed7c652c61972928941e94bf8d5d62378cf9ef9b71d19d5dc75428b

SHA512
dec88fc902cdcb0cbb1340e3826f8011a019eb4a267edde6661fb3a7dd554a9b77a2f1cad28af4f37c9f7b6ca2974331b4fa92e3a48bd0059ac31fffd340e38f

Download Submit
C:\Windows\System\rWrgYkC.exe

Filesize
1.9MB

MD5
95a73103494bb67891ce3177f9c43f1b

SHA1
2b008da921b3b856d26f7533367264e38004a2b0

SHA256
f1928bc25e5b28a496eb26928a7d7c1d417771ab90ff0e4e6474195c3ab426bc

SHA512
9b9326b4c88f59b22d568abe5ecca37012370e580e6d23adc3dee3b9fa03ed07bd94e0bdeee0a0f621faab82fa52d09cc112ddb9dcf8d722e1e5f72e7e7b23ea

Download Submit
C:\Windows\System\rwrvLWX.exe

Filesize
1.9MB

MD5
6fed8bf9441d8d89860fe472e6af4924

SHA1
3cd963d2aef6e5cd707c39c84863c8b218a310e2

SHA256
ef20d998e3ec3df76b5c045f53dd350964f31e33f439f5a6cfbe5e7b8fe459bf

SHA512
f010348e978ed0c8b02ca86128105506a6343203a72d7c85324e66eb2f53c386084a5d69459a38f94ef602f2d9dad66723a066178e25a322bbcfefac150f5ec4

Download Submit
C:\Windows\System\sHniTGf.exe

Filesize
1.9MB

MD5
0c23e69228eb0553dfc810e4de814d36

SHA1
b98aa090fef95f65b6ed23b35cf7bb19fa9135d3

SHA256
606878e5ea7f05ac175ff07522fe9fe4561b77e904e30e86b24e5bf164c2d101

SHA512
b3b950dcd2c23750cfd98870b988b263137c42a6c33d9c0616c0c2b268c27b7901920325a3b24219970a33c559efa8adc51e22ad90c5d565d1d9f5b0007e8e28

Download Submit
C:\Windows\System\sijBLcX.exe

Filesize
1.9MB

MD5
00c6ba423de69d6bbc2b43f9cc500ce9

SHA1
1793dc3ebdb1f35f2c12632e7205a8b2be3b9277

SHA256
7b2ca1f92c406996860e74820cca1d0d29c406588bc59d0d3068ff4d7906bd4b

SHA512
26edf2834df42eaef56ec85f75d8d8b4c9cc5378f657927dd4d95e767ad0f1022435d6331fbac1d38c1f02f386b3ed3e7e4a73770bb1a7e17f84bd6435206e89

Download Submit
C:\Windows\System\uPnuPNf.exe

Filesize
1.9MB

MD5
6f133b32ebec71d334de7a40451bf3d8

SHA1
172e304569b3ad70e87af80172c1fd8e1606452a

SHA256
29f0fbebfe84a263c8b4dfbe271df45ad817412dd1c2b5f599ca14bc1f979e86

SHA512
b7013e2906010472156c5aed5aeb08a76eef88bd04607e2d01c3821eb8a6f082a633e2b062f5c00d3a72a00a70752a824b8cabee6617002d0eb15da16961238b

Download Submit
C:\Windows\System\vmIeOvR.exe

Filesize
1.9MB

MD5
0248b8c7e45ef3a153bbb3e78130d5ca

SHA1
287b8c7b3510efd4e927f235727b93992054258e

SHA256
e75b09e797d598bcc62cae0e318a2adc2e1689e38f48094f138ccadd55cecf4e

SHA512
3e24d88c7c6cf18dc64281f14b2d57319442c2e8a9594ba9fa71f9e651a03cdac676711a9699361185d2262791ec6301312d43d076bbba3498b4645405eb0312

Download Submit
C:\Windows\System\xJjjIjZ.exe

Filesize
1.9MB

MD5
e5b14a3b7247f5d20a9b44b706e02380

SHA1
1c2bd5865e7dc97bf63a6487af33e45ea89b12a9

SHA256
fd746b2089f20fdd07e6d0ae8066d3279b2df3da039aa93d563cd829481b3341

SHA512
e4cca353c288e241562176629d98d2edb93be738f85603192bb24af2bc2a019ecf5eebb4c3f20c5dd5a005d6b782f18567924ea3fe4d7c2d1b91c35c579969b6

Download Submit
C:\Windows\System\zjgCKUX.exe

Filesize
1.9MB

MD5
4900802d84b8e5148174e3c5ea0047cc

SHA1
42d7889ea0f74cb0863f4176dd32277bc80574d0

SHA256
8b19f146a31531e8414f3f59d70df0c6596a11826bd29b603365d0cf92a568c3

SHA512
63dd7184a3f427d6b286e92100d23dca8641316dfa1657058410c07bbed46a1b1cbc297b9f8253340564d937696c317cbd6ede347342101be2d1debf2f260bc7

Download Submit
memory/380-160-0x00007FF63E9A0000-0x00007FF63ED92000-memory.dmp

Filesize
3.9MB

Download
memory/380-3010-0x00007FF63E9A0000-0x00007FF63ED92000-memory.dmp

Filesize
3.9MB

Download
memory/432-199-0x00007FF6E6AB0000-0x00007FF6E6EA2000-memory.dmp

Filesize
3.9MB

Download
memory/432-2991-0x00007FF6E6AB0000-0x00007FF6E6EA2000-memory.dmp

Filesize
3.9MB

Download
memory/664-2982-0x00007FF6209F0000-0x00007FF620DE2000-memory.dmp

Filesize
3.9MB

Download
memory/664-106-0x00007FF6209F0000-0x00007FF620DE2000-memory.dmp

Filesize
3.9MB

Download
memory/720-3020-0x00007FF653FE0000-0x00007FF6543D2000-memory.dmp

Filesize
3.9MB

Download
memory/720-229-0x00007FF653FE0000-0x00007FF6543D2000-memory.dmp

Filesize
3.9MB

Download
memory/1016-40-0x00007FFA71310000-0x00007FFA715D9000-memory.dmp

Filesize
2.8MB

Download
memory/1016-197-0x000001A82FE00000-0x000001A82FE22000-memory.dmp

Filesize
136KB

Download
memory/1016-2913-0x00007FFA71310000-0x00007FFA715D9000-memory.dmp

Filesize
2.8MB

Download
memory/1016-45-0x00007FFA71310000-0x00007FFA715D9000-memory.dmp

Filesize
2.8MB

Download
memory/1016-8-0x00007FFA71310000-0x00007FFA715D9000-memory.dmp

Filesize
2.8MB

Download
memory/1016-336-0x000001A830D80000-0x000001A831526000-memory.dmp

Filesize
7.6MB

Download
memory/1156-2999-0x00007FF6F11F0000-0x00007FF6F15E2000-memory.dmp

Filesize
3.9MB

Download
memory/1156-243-0x00007FF6F11F0000-0x00007FF6F15E2000-memory.dmp

Filesize
3.9MB

Download
memory/1224-85-0x00007FF6C2A30000-0x00007FF6C2E22000-memory.dmp

Filesize
3.9MB

Download
memory/1224-2980-0x00007FF6C2A30000-0x00007FF6C2E22000-memory.dmp

Filesize
3.9MB

Download
memory/1544-2978-0x00007FF77FC80000-0x00007FF780072000-memory.dmp

Filesize
3.9MB

Download
memory/1544-2970-0x00007FF77FC80000-0x00007FF780072000-memory.dmp

Filesize
3.9MB

Download
memory/1544-19-0x00007FF77FC80000-0x00007FF780072000-memory.dmp

Filesize
3.9MB

Download
memory/1552-3003-0x00007FF7EB4D0000-0x00007FF7EB8C2000-memory.dmp

Filesize
3.9MB

Download
memory/1552-206-0x00007FF7EB4D0000-0x00007FF7EB8C2000-memory.dmp

Filesize
3.9MB

Download
memory/1704-2992-0x00007FF67E2A0000-0x00007FF67E692000-memory.dmp

Filesize
3.9MB

Download
memory/1704-187-0x00007FF67E2A0000-0x00007FF67E692000-memory.dmp

Filesize
3.9MB

Download
memory/1728-2969-0x00007FF75C210000-0x00007FF75C602000-memory.dmp

Filesize
3.9MB

Download
memory/1728-2974-0x00007FF75C210000-0x00007FF75C602000-memory.dmp

Filesize
3.9MB

Download
memory/1728-15-0x00007FF75C210000-0x00007FF75C602000-memory.dmp

Filesize
3.9MB

Download
memory/1788-3006-0x00007FF669C70000-0x00007FF66A062000-memory.dmp

Filesize
3.9MB

Download
memory/1788-227-0x00007FF669C70000-0x00007FF66A062000-memory.dmp

Filesize
3.9MB

Download
memory/2232-3004-0x00007FF67C860000-0x00007FF67CC52000-memory.dmp

Filesize
3.9MB

Download
memory/2232-205-0x00007FF67C860000-0x00007FF67CC52000-memory.dmp

Filesize
3.9MB

Download
memory/2764-238-0x00007FF75D940000-0x00007FF75DD32000-memory.dmp

Filesize
3.9MB

Download
memory/2764-3016-0x00007FF75D940000-0x00007FF75DD32000-memory.dmp

Filesize
3.9MB

Download
memory/2780-2995-0x00007FF6CFD20000-0x00007FF6D0112000-memory.dmp

Filesize
3.9MB

Download
memory/2780-132-0x00007FF6CFD20000-0x00007FF6D0112000-memory.dmp

Filesize
3.9MB

Download
memory/2968-0-0x00007FF678CF0000-0x00007FF6790E2000-memory.dmp

Filesize
3.9MB

Download
memory/2968-1-0x0000020F29440000-0x0000020F29450000-memory.dmp

Filesize
64KB

Download
memory/3116-142-0x00007FF76A440000-0x00007FF76A832000-memory.dmp

Filesize
3.9MB

Download
memory/3116-2987-0x00007FF76A440000-0x00007FF76A832000-memory.dmp

Filesize
3.9MB

Download
memory/3468-217-0x00007FF77F210000-0x00007FF77F602000-memory.dmp

Filesize
3.9MB

Download
memory/3468-3000-0x00007FF77F210000-0x00007FF77F602000-memory.dmp

Filesize
3.9MB

Download
memory/3580-133-0x00007FF680B80000-0x00007FF680F72000-memory.dmp

Filesize
3.9MB

Download
memory/3580-3008-0x00007FF680B80000-0x00007FF680F72000-memory.dmp

Filesize
3.9MB

Download
memory/3916-3018-0x00007FF712AB0000-0x00007FF712EA2000-memory.dmp

Filesize
3.9MB

Download
memory/3916-239-0x00007FF712AB0000-0x00007FF712EA2000-memory.dmp

Filesize
3.9MB

Download
memory/4056-2988-0x00007FF75B870000-0x00007FF75BC62000-memory.dmp

Filesize
3.9MB

Download
memory/4056-244-0x00007FF75B870000-0x00007FF75BC62000-memory.dmp

Filesize
3.9MB

Download
memory/4092-247-0x00007FF6D9EE0000-0x00007FF6DA2D2000-memory.dmp

Filesize
3.9MB

Download
memory/4092-3014-0x00007FF6D9EE0000-0x00007FF6DA2D2000-memory.dmp

Filesize
3.9MB

Download
memory/4228-2996-0x00007FF7A0C90000-0x00007FF7A1082000-memory.dmp

Filesize
3.9MB

Download
memory/4228-241-0x00007FF7A0C90000-0x00007FF7A1082000-memory.dmp

Filesize
3.9MB

Download
memory/4512-3012-0x00007FF675500000-0x00007FF6758F2000-memory.dmp

Filesize
3.9MB

Download
memory/4512-228-0x00007FF675500000-0x00007FF6758F2000-memory.dmp

Filesize
3.9MB

Download
memory/4544-246-0x00007FF7D4F20000-0x00007FF7D5312000-memory.dmp

Filesize
3.9MB

Download
memory/4544-2984-0x00007FF7D4F20000-0x00007FF7D5312000-memory.dmp

Filesize
3.9MB

Download
memory/4764-64-0x00007FF6C1B80000-0x00007FF6C1F72000-memory.dmp

Filesize
3.9MB

Download
memory/4764-2976-0x00007FF6C1B80000-0x00007FF6C1F72000-memory.dmp

Filesize
3.9MB

Download