xmrig | 14c11681f0509a808f1fa646a7e46fe37066b642741ca3a63317d48759475d55

Analysis

max time kernel
121s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 07:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
Size

2.0MB
MD5

cefeedde6e58b860f67107d9d24d8d9b
SHA1

a6efab86dc6a20f644775dfbb0b76b9604cffd68
SHA256

14c11681f0509a808f1fa646a7e46fe37066b642741ca3a63317d48759475d55
SHA512

462fcf692fd1c88e453068b5f59d3b5be37b1d0309e6fbfdb52a29660a87428be14ea644915e4aca6e24acf7b7ba6e516f4e5640076574bb4ca793a67419b947
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMz:NAB7

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/2176-38-0x00007FF69A720000-0x00007FF69AB12000-memory.dmp	xmrig
behavioral2/memory/3800-215-0x00007FF652AA0000-0x00007FF652E92000-memory.dmp	xmrig
behavioral2/memory/2512-249-0x00007FF7B4770000-0x00007FF7B4B62000-memory.dmp	xmrig
behavioral2/memory/4164-256-0x00007FF7A8D50000-0x00007FF7A9142000-memory.dmp	xmrig
behavioral2/memory/5080-261-0x00007FF6C5D10000-0x00007FF6C6102000-memory.dmp	xmrig
behavioral2/memory/1956-265-0x00007FF6AF900000-0x00007FF6AFCF2000-memory.dmp	xmrig
behavioral2/memory/220-264-0x00007FF7D1230000-0x00007FF7D1622000-memory.dmp	xmrig
behavioral2/memory/2968-263-0x00007FF7F7D20000-0x00007FF7F8112000-memory.dmp	xmrig
behavioral2/memory/3576-262-0x00007FF6278B0000-0x00007FF627CA2000-memory.dmp	xmrig
behavioral2/memory/2076-260-0x00007FF645FF0000-0x00007FF6463E2000-memory.dmp	xmrig
behavioral2/memory/2980-259-0x00007FF777E20000-0x00007FF778212000-memory.dmp	xmrig
behavioral2/memory/2056-258-0x00007FF7F7DF0000-0x00007FF7F81E2000-memory.dmp	xmrig
behavioral2/memory/4404-257-0x00007FF6E8FA0000-0x00007FF6E9392000-memory.dmp	xmrig
behavioral2/memory/2044-255-0x00007FF70B4D0000-0x00007FF70B8C2000-memory.dmp	xmrig
behavioral2/memory/4860-254-0x00007FF6D9FD0000-0x00007FF6DA3C2000-memory.dmp	xmrig
behavioral2/memory/2684-253-0x00007FF742C90000-0x00007FF743082000-memory.dmp	xmrig
behavioral2/memory/4188-252-0x00007FF760800000-0x00007FF760BF2000-memory.dmp	xmrig
behavioral2/memory/3840-251-0x00007FF7FF3C0000-0x00007FF7FF7B2000-memory.dmp	xmrig
behavioral2/memory/2108-250-0x00007FF6124E0000-0x00007FF6128D2000-memory.dmp	xmrig
behavioral2/memory/2888-248-0x00007FF74EA20000-0x00007FF74EE12000-memory.dmp	xmrig
behavioral2/memory/1836-243-0x00007FF7AB080000-0x00007FF7AB472000-memory.dmp	xmrig
behavioral2/memory/2704-218-0x00007FF68A150000-0x00007FF68A542000-memory.dmp	xmrig
behavioral2/memory/3608-164-0x00007FF708B30000-0x00007FF708F22000-memory.dmp	xmrig
behavioral2/memory/2932-1742-0x00007FF6926A0000-0x00007FF692A92000-memory.dmp	xmrig
behavioral2/memory/552-2191-0x00007FF758B70000-0x00007FF758F62000-memory.dmp	xmrig
behavioral2/memory/2176-3320-0x00007FF69A720000-0x00007FF69AB12000-memory.dmp	xmrig
behavioral2/memory/552-3322-0x00007FF758B70000-0x00007FF758F62000-memory.dmp	xmrig
behavioral2/memory/2704-3324-0x00007FF68A150000-0x00007FF68A542000-memory.dmp	xmrig
behavioral2/memory/3608-3326-0x00007FF708B30000-0x00007FF708F22000-memory.dmp	xmrig
behavioral2/memory/4188-3328-0x00007FF760800000-0x00007FF760BF2000-memory.dmp	xmrig
behavioral2/memory/4164-3367-0x00007FF7A8D50000-0x00007FF7A9142000-memory.dmp	xmrig
behavioral2/memory/2056-3372-0x00007FF7F7DF0000-0x00007FF7F81E2000-memory.dmp	xmrig
behavioral2/memory/2076-3380-0x00007FF645FF0000-0x00007FF6463E2000-memory.dmp	xmrig
behavioral2/memory/3576-3382-0x00007FF6278B0000-0x00007FF627CA2000-memory.dmp	xmrig
behavioral2/memory/2980-3378-0x00007FF777E20000-0x00007FF778212000-memory.dmp	xmrig
behavioral2/memory/2968-3369-0x00007FF7F7D20000-0x00007FF7F8112000-memory.dmp	xmrig
behavioral2/memory/5080-3365-0x00007FF6C5D10000-0x00007FF6C6102000-memory.dmp	xmrig
behavioral2/memory/4404-3363-0x00007FF6E8FA0000-0x00007FF6E9392000-memory.dmp	xmrig
behavioral2/memory/2684-3359-0x00007FF742C90000-0x00007FF743082000-memory.dmp	xmrig
behavioral2/memory/2108-3356-0x00007FF6124E0000-0x00007FF6128D2000-memory.dmp	xmrig
behavioral2/memory/3840-3354-0x00007FF7FF3C0000-0x00007FF7FF7B2000-memory.dmp	xmrig
behavioral2/memory/1956-3351-0x00007FF6AF900000-0x00007FF6AFCF2000-memory.dmp	xmrig
behavioral2/memory/220-3349-0x00007FF7D1230000-0x00007FF7D1622000-memory.dmp	xmrig
behavioral2/memory/4860-3344-0x00007FF6D9FD0000-0x00007FF6DA3C2000-memory.dmp	xmrig
behavioral2/memory/2512-3343-0x00007FF7B4770000-0x00007FF7B4B62000-memory.dmp	xmrig
behavioral2/memory/2888-3341-0x00007FF74EA20000-0x00007FF74EE12000-memory.dmp	xmrig
behavioral2/memory/2044-3346-0x00007FF70B4D0000-0x00007FF70B8C2000-memory.dmp	xmrig
behavioral2/memory/3800-3340-0x00007FF652AA0000-0x00007FF652E92000-memory.dmp	xmrig
behavioral2/memory/1836-3330-0x00007FF7AB080000-0x00007FF7AB472000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
876	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
552	lCIeoMa.exe
2176	PMkKLTz.exe
220	KMgSjPq.exe
3608	JCFCQkm.exe
3800	IOLKFcA.exe
2704	dwDrRIG.exe
1956	HbbcICf.exe
1836	eJwmVtq.exe
2888	BgveFEs.exe
2512	NRYygEX.exe
2108	vyYHGiD.exe
3840	hMjssYN.exe
4188	XCxbvXP.exe
2684	YxXkoFl.exe
4860	DIUqBOq.exe
2044	XCGTxab.exe
4164	sZjDrXR.exe
4404	aLVepRE.exe
2056	ocAnqhp.exe
2980	ObMGKSE.exe
2076	JdHVkuW.exe
5080	FvGauxl.exe
3576	NTCVEXd.exe
2968	AvZoSBE.exe
4000	itTQkyi.exe
4580	gzzIQXC.exe
1760	kLjzscm.exe
116	klcMyGp.exe
1756	xzpzwsB.exe
4512	qHpjdbn.exe
5068	mtbYqrM.exe
4040	RRrmXOb.exe
2132	imHyKYR.exe
3064	VCbwfiC.exe
4904	ynRKRoH.exe
4632	mRyhUev.exe
840	Ipaekrk.exe
4380	KtCUfgD.exe
4908	aCiOvvA.exe
3200	FUKZDyN.exe
3080	SadrzxZ.exe
5108	bdNsAKm.exe
1548	YeDzywR.exe
344	gJSItfU.exe
1468	ADHOAGM.exe
1652	LsyEaif.exe
4500	gAHrlbw.exe
1952	zUDnIwN.exe
4536	yrYmckP.exe
2416	PNfxFoc.exe
2760	BRynwQS.exe
1372	xezHqnN.exe
1900	aSAeKTV.exe
412	hhtgJrJ.exe
5044	MrcBxZi.exe
2472	CqzUjCL.exe
5064	yRxbyaV.exe
4180	WBXoWJZ.exe
916	QXqrmyf.exe
3412	EUxGEnU.exe
4460	gcAngnB.exe
2428	nLqUMnj.exe
5096	IGhNoyY.exe
4808	HLgmWAM.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2932-0-0x00007FF6926A0000-0x00007FF692A92000-memory.dmp	upx
behavioral2/files/0x00070000000234e1-7.dat	upx
behavioral2/memory/552-16-0x00007FF758B70000-0x00007FF758F62000-memory.dmp	upx
behavioral2/files/0x000900000002347c-5.dat	upx
behavioral2/files/0x00070000000234e2-25.dat	upx
behavioral2/files/0x00070000000234e0-13.dat	upx
behavioral2/files/0x00070000000234e5-41.dat	upx
behavioral2/memory/2176-38-0x00007FF69A720000-0x00007FF69AB12000-memory.dmp	upx
behavioral2/files/0x00070000000234e4-34.dat	upx
behavioral2/files/0x00070000000234e3-29.dat	upx
behavioral2/files/0x00070000000234f0-131.dat	upx
behavioral2/files/0x00070000000234f1-132.dat	upx
behavioral2/memory/3800-215-0x00007FF652AA0000-0x00007FF652E92000-memory.dmp	upx
behavioral2/files/0x00070000000234f7-187.dat	upx
behavioral2/memory/2512-249-0x00007FF7B4770000-0x00007FF7B4B62000-memory.dmp	upx
behavioral2/memory/4164-256-0x00007FF7A8D50000-0x00007FF7A9142000-memory.dmp	upx
behavioral2/memory/5080-261-0x00007FF6C5D10000-0x00007FF6C6102000-memory.dmp	upx
behavioral2/memory/1956-265-0x00007FF6AF900000-0x00007FF6AFCF2000-memory.dmp	upx
behavioral2/memory/220-264-0x00007FF7D1230000-0x00007FF7D1622000-memory.dmp	upx
behavioral2/memory/2968-263-0x00007FF7F7D20000-0x00007FF7F8112000-memory.dmp	upx
behavioral2/memory/3576-262-0x00007FF6278B0000-0x00007FF627CA2000-memory.dmp	upx
behavioral2/memory/2076-260-0x00007FF645FF0000-0x00007FF6463E2000-memory.dmp	upx
behavioral2/memory/2980-259-0x00007FF777E20000-0x00007FF778212000-memory.dmp	upx
behavioral2/memory/2056-258-0x00007FF7F7DF0000-0x00007FF7F81E2000-memory.dmp	upx
behavioral2/memory/4404-257-0x00007FF6E8FA0000-0x00007FF6E9392000-memory.dmp	upx
behavioral2/memory/2044-255-0x00007FF70B4D0000-0x00007FF70B8C2000-memory.dmp	upx
behavioral2/memory/4860-254-0x00007FF6D9FD0000-0x00007FF6DA3C2000-memory.dmp	upx
behavioral2/memory/2684-253-0x00007FF742C90000-0x00007FF743082000-memory.dmp	upx
behavioral2/memory/4188-252-0x00007FF760800000-0x00007FF760BF2000-memory.dmp	upx
behavioral2/memory/3840-251-0x00007FF7FF3C0000-0x00007FF7FF7B2000-memory.dmp	upx
behavioral2/memory/2108-250-0x00007FF6124E0000-0x00007FF6128D2000-memory.dmp	upx
behavioral2/memory/2888-248-0x00007FF74EA20000-0x00007FF74EE12000-memory.dmp	upx
behavioral2/memory/1836-243-0x00007FF7AB080000-0x00007FF7AB472000-memory.dmp	upx
behavioral2/files/0x00070000000234ee-185.dat	upx
behavioral2/files/0x00070000000234f6-184.dat	upx
behavioral2/files/0x00070000000234f4-180.dat	upx
behavioral2/files/0x0007000000023503-176.dat	upx
behavioral2/files/0x00070000000234f3-175.dat	upx
behavioral2/files/0x0007000000023501-171.dat	upx
behavioral2/files/0x00070000000234f2-165.dat	upx
behavioral2/memory/2704-218-0x00007FF68A150000-0x00007FF68A542000-memory.dmp	upx
behavioral2/files/0x0007000000023500-157.dat	upx
behavioral2/files/0x00070000000234fe-152.dat	upx
behavioral2/files/0x00070000000234fd-149.dat	upx
behavioral2/files/0x00070000000234ec-141.dat	upx
behavioral2/files/0x0007000000023502-173.dat	upx
behavioral2/files/0x00070000000234fc-133.dat	upx
behavioral2/memory/3608-164-0x00007FF708B30000-0x00007FF708F22000-memory.dmp	upx
behavioral2/files/0x00070000000234fb-125.dat	upx
behavioral2/files/0x00070000000234ff-154.dat	upx
behavioral2/memory/2932-1742-0x00007FF6926A0000-0x00007FF692A92000-memory.dmp	upx
behavioral2/memory/552-2191-0x00007FF758B70000-0x00007FF758F62000-memory.dmp	upx
behavioral2/files/0x00070000000234fa-118.dat	upx
behavioral2/files/0x00070000000234f9-117.dat	upx
behavioral2/files/0x00070000000234f8-116.dat	upx
behavioral2/files/0x00070000000234ef-114.dat	upx
behavioral2/files/0x00070000000234e9-110.dat	upx
behavioral2/files/0x00070000000234f5-109.dat	upx
behavioral2/files/0x00070000000234ed-145.dat	upx
behavioral2/files/0x00070000000234ea-94.dat	upx
behavioral2/files/0x00070000000234e8-80.dat	upx
behavioral2/files/0x00070000000234e6-70.dat	upx
behavioral2/files/0x00070000000234eb-67.dat	upx
behavioral2/files/0x00070000000234e7-50.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\HyIzeto.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\SkaxgyP.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\yINmaTv.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\iVzbqdp.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\iwBvpXi.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\HGUZjzZ.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\MrcBxZi.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\TZuTGDJ.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\aOtOzVa.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\khOMmSn.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\HnmfEOn.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\CdVyNBj.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\CjaJzge.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\NTfesCK.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\ZMzUrSo.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\qJXrpZq.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\XsyxqKq.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\WxjToSS.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\YwRIZRj.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\FiHFMjb.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\XIDgqpH.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\Dvdzomo.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\rsLJqVi.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\OaTyUnD.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\AGDLdPW.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\MumlsPA.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\rjyCkzx.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\SqxJtIg.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\xVOEcXk.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\GpoqJob.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\GXXZcOF.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\vSdmfoa.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\DflrZqg.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\zccBhWY.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\kqHydLV.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\MsLvQPD.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\vajJizp.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\CwsnSWY.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\fYgDlyf.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\iYARAeq.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\AksAucH.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\SrabKlS.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\yAUkhoA.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\VXHWebJ.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\mtCjGKZ.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\osMAWkP.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\mHAkUao.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\ojZxZNY.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\sXHQzQo.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\ysYhQTv.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\xedKVMC.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\bSuFUXX.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\gPvGomq.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\SQkgjlJ.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\RqMFgce.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\bUlUbHv.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\szKQJQi.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\sSZunGR.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\LcDAybS.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\XqQifMD.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\reyqzfB.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\zefTTLt.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\sQOTCwP.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
File created	C:\Windows\System\TqIjvav.exe	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
876	powershell.exe
876	powershell.exe
876	powershell.exe
876	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	876	powershell.exe
Token: SeLockMemoryPrivilege	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 876	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	84
PID 2932 wrote to memory of 876	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	84
PID 2932 wrote to memory of 552	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	85
PID 2932 wrote to memory of 552	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	85
PID 2932 wrote to memory of 2176	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	86
PID 2932 wrote to memory of 2176	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	86
PID 2932 wrote to memory of 220	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	87
PID 2932 wrote to memory of 220	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	87
PID 2932 wrote to memory of 3608	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	88
PID 2932 wrote to memory of 3608	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	88
PID 2932 wrote to memory of 3800	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	89
PID 2932 wrote to memory of 3800	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	89
PID 2932 wrote to memory of 2704	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	90
PID 2932 wrote to memory of 2704	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	90
PID 2932 wrote to memory of 1956	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	91
PID 2932 wrote to memory of 1956	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	91
PID 2932 wrote to memory of 1836	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	92
PID 2932 wrote to memory of 1836	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	92
PID 2932 wrote to memory of 2888	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	93
PID 2932 wrote to memory of 2888	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	93
PID 2932 wrote to memory of 2512	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	94
PID 2932 wrote to memory of 2512	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	94
PID 2932 wrote to memory of 2108	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	95
PID 2932 wrote to memory of 2108	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	95
PID 2932 wrote to memory of 3840	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	96
PID 2932 wrote to memory of 3840	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	96
PID 2932 wrote to memory of 4188	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	97
PID 2932 wrote to memory of 4188	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	97
PID 2932 wrote to memory of 2684	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	98
PID 2932 wrote to memory of 2684	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	98
PID 2932 wrote to memory of 4860	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	99
PID 2932 wrote to memory of 4860	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	99
PID 2932 wrote to memory of 5080	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	100
PID 2932 wrote to memory of 5080	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	100
PID 2932 wrote to memory of 3576	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	101
PID 2932 wrote to memory of 3576	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	101
PID 2932 wrote to memory of 2044	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	102
PID 2932 wrote to memory of 2044	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	102
PID 2932 wrote to memory of 1756	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	103
PID 2932 wrote to memory of 1756	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	103
PID 2932 wrote to memory of 4164	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	104
PID 2932 wrote to memory of 4164	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	104
PID 2932 wrote to memory of 4404	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	105
PID 2932 wrote to memory of 4404	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	105
PID 2932 wrote to memory of 2056	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	106
PID 2932 wrote to memory of 2056	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	106
PID 2932 wrote to memory of 2980	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	107
PID 2932 wrote to memory of 2980	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	107
PID 2932 wrote to memory of 2076	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	108
PID 2932 wrote to memory of 2076	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	108
PID 2932 wrote to memory of 2968	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	109
PID 2932 wrote to memory of 2968	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	109
PID 2932 wrote to memory of 4000	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	110
PID 2932 wrote to memory of 4000	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	110
PID 2932 wrote to memory of 4580	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	111
PID 2932 wrote to memory of 4580	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	111
PID 2932 wrote to memory of 1760	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	112
PID 2932 wrote to memory of 1760	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	112
PID 2932 wrote to memory of 116	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	113
PID 2932 wrote to memory of 116	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	113
PID 2932 wrote to memory of 4512	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	114
PID 2932 wrote to memory of 4512	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	114
PID 2932 wrote to memory of 5068	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	115
PID 2932 wrote to memory of 5068	2932	cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\cefeedde6e58b860f67107d9d24d8d9b_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:876
- C:\Windows\System\lCIeoMa.exe
  C:\Windows\System\lCIeoMa.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\PMkKLTz.exe
  C:\Windows\System\PMkKLTz.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\KMgSjPq.exe
  C:\Windows\System\KMgSjPq.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\JCFCQkm.exe
  C:\Windows\System\JCFCQkm.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\IOLKFcA.exe
  C:\Windows\System\IOLKFcA.exe
  2⤵
  - Executes dropped EXE
  PID:3800
- C:\Windows\System\dwDrRIG.exe
  C:\Windows\System\dwDrRIG.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\HbbcICf.exe
  C:\Windows\System\HbbcICf.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\eJwmVtq.exe
  C:\Windows\System\eJwmVtq.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\BgveFEs.exe
  C:\Windows\System\BgveFEs.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\NRYygEX.exe
  C:\Windows\System\NRYygEX.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\vyYHGiD.exe
  C:\Windows\System\vyYHGiD.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\hMjssYN.exe
  C:\Windows\System\hMjssYN.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\XCxbvXP.exe
  C:\Windows\System\XCxbvXP.exe
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Windows\System\YxXkoFl.exe
  C:\Windows\System\YxXkoFl.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\DIUqBOq.exe
  C:\Windows\System\DIUqBOq.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\FvGauxl.exe
  C:\Windows\System\FvGauxl.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\NTCVEXd.exe
  C:\Windows\System\NTCVEXd.exe
  2⤵
  - Executes dropped EXE
  PID:3576
- C:\Windows\System\XCGTxab.exe
  C:\Windows\System\XCGTxab.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\xzpzwsB.exe
  C:\Windows\System\xzpzwsB.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\sZjDrXR.exe
  C:\Windows\System\sZjDrXR.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\aLVepRE.exe
  C:\Windows\System\aLVepRE.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\ocAnqhp.exe
  C:\Windows\System\ocAnqhp.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\ObMGKSE.exe
  C:\Windows\System\ObMGKSE.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\JdHVkuW.exe
  C:\Windows\System\JdHVkuW.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\AvZoSBE.exe
  C:\Windows\System\AvZoSBE.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\itTQkyi.exe
  C:\Windows\System\itTQkyi.exe
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Windows\System\gzzIQXC.exe
  C:\Windows\System\gzzIQXC.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\kLjzscm.exe
  C:\Windows\System\kLjzscm.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\klcMyGp.exe
  C:\Windows\System\klcMyGp.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\qHpjdbn.exe
  C:\Windows\System\qHpjdbn.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\mtbYqrM.exe
  C:\Windows\System\mtbYqrM.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\RRrmXOb.exe
  C:\Windows\System\RRrmXOb.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\imHyKYR.exe
  C:\Windows\System\imHyKYR.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\VCbwfiC.exe
  C:\Windows\System\VCbwfiC.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\ynRKRoH.exe
  C:\Windows\System\ynRKRoH.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\mRyhUev.exe
  C:\Windows\System\mRyhUev.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\Ipaekrk.exe
  C:\Windows\System\Ipaekrk.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\KtCUfgD.exe
  C:\Windows\System\KtCUfgD.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\aCiOvvA.exe
  C:\Windows\System\aCiOvvA.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\FUKZDyN.exe
  C:\Windows\System\FUKZDyN.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\SadrzxZ.exe
  C:\Windows\System\SadrzxZ.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\bdNsAKm.exe
  C:\Windows\System\bdNsAKm.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\YeDzywR.exe
  C:\Windows\System\YeDzywR.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\gJSItfU.exe
  C:\Windows\System\gJSItfU.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System\ADHOAGM.exe
  C:\Windows\System\ADHOAGM.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\LsyEaif.exe
  C:\Windows\System\LsyEaif.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\gAHrlbw.exe
  C:\Windows\System\gAHrlbw.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\zUDnIwN.exe
  C:\Windows\System\zUDnIwN.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\yrYmckP.exe
  C:\Windows\System\yrYmckP.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\PNfxFoc.exe
  C:\Windows\System\PNfxFoc.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\BRynwQS.exe
  C:\Windows\System\BRynwQS.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\xezHqnN.exe
  C:\Windows\System\xezHqnN.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\aSAeKTV.exe
  C:\Windows\System\aSAeKTV.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\hhtgJrJ.exe
  C:\Windows\System\hhtgJrJ.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\MrcBxZi.exe
  C:\Windows\System\MrcBxZi.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\CqzUjCL.exe
  C:\Windows\System\CqzUjCL.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\yRxbyaV.exe
  C:\Windows\System\yRxbyaV.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\WBXoWJZ.exe
  C:\Windows\System\WBXoWJZ.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\QXqrmyf.exe
  C:\Windows\System\QXqrmyf.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\EUxGEnU.exe
  C:\Windows\System\EUxGEnU.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\gcAngnB.exe
  C:\Windows\System\gcAngnB.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\nLqUMnj.exe
  C:\Windows\System\nLqUMnj.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\IGhNoyY.exe
  C:\Windows\System\IGhNoyY.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\HLgmWAM.exe
  C:\Windows\System\HLgmWAM.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\XfXlmcC.exe
  C:\Windows\System\XfXlmcC.exe
  2⤵
  PID:1500
- C:\Windows\System\khIftRU.exe
  C:\Windows\System\khIftRU.exe
  2⤵
  PID:5052
- C:\Windows\System\XLJyiEP.exe
  C:\Windows\System\XLJyiEP.exe
  2⤵
  PID:5100
- C:\Windows\System\rjMuxBq.exe
  C:\Windows\System\rjMuxBq.exe
  2⤵
  PID:2656
- C:\Windows\System\ImSWbkX.exe
  C:\Windows\System\ImSWbkX.exe
  2⤵
  PID:4612
- C:\Windows\System\kzjfNIb.exe
  C:\Windows\System\kzjfNIb.exe
  2⤵
  PID:1036
- C:\Windows\System\FmBBlTe.exe
  C:\Windows\System\FmBBlTe.exe
  2⤵
  PID:2784
- C:\Windows\System\oyAMmlA.exe
  C:\Windows\System\oyAMmlA.exe
  2⤵
  PID:3452
- C:\Windows\System\xsZyKAO.exe
  C:\Windows\System\xsZyKAO.exe
  2⤵
  PID:2712
- C:\Windows\System\ajWYEkF.exe
  C:\Windows\System\ajWYEkF.exe
  2⤵
  PID:4484
- C:\Windows\System\qdczIcJ.exe
  C:\Windows\System\qdczIcJ.exe
  2⤵
  PID:560
- C:\Windows\System\mPRSqlh.exe
  C:\Windows\System\mPRSqlh.exe
  2⤵
  PID:1920
- C:\Windows\System\bdrCzDd.exe
  C:\Windows\System\bdrCzDd.exe
  2⤵
  PID:4288
- C:\Windows\System\HugfSwg.exe
  C:\Windows\System\HugfSwg.exe
  2⤵
  PID:4928
- C:\Windows\System\kIOMIGK.exe
  C:\Windows\System\kIOMIGK.exe
  2⤵
  PID:4544
- C:\Windows\System\XOHyFkw.exe
  C:\Windows\System\XOHyFkw.exe
  2⤵
  PID:880
- C:\Windows\System\Rftfwot.exe
  C:\Windows\System\Rftfwot.exe
  2⤵
  PID:4052
- C:\Windows\System\CYxmhQL.exe
  C:\Windows\System\CYxmhQL.exe
  2⤵
  PID:3416
- C:\Windows\System\PuHmkyM.exe
  C:\Windows\System\PuHmkyM.exe
  2⤵
  PID:2556
- C:\Windows\System\aLeoIvW.exe
  C:\Windows\System\aLeoIvW.exe
  2⤵
  PID:4532
- C:\Windows\System\ArafkMC.exe
  C:\Windows\System\ArafkMC.exe
  2⤵
  PID:4528
- C:\Windows\System\oCjqIXe.exe
  C:\Windows\System\oCjqIXe.exe
  2⤵
  PID:4200
- C:\Windows\System\TVqMOyf.exe
  C:\Windows\System\TVqMOyf.exe
  2⤵
  PID:212
- C:\Windows\System\NLKEQWb.exe
  C:\Windows\System\NLKEQWb.exe
  2⤵
  PID:3156
- C:\Windows\System\bEuwKrD.exe
  C:\Windows\System\bEuwKrD.exe
  2⤵
  PID:1136
- C:\Windows\System\uVplIaC.exe
  C:\Windows\System\uVplIaC.exe
  2⤵
  PID:468
- C:\Windows\System\uVUzONV.exe
  C:\Windows\System\uVUzONV.exe
  2⤵
  PID:5008
- C:\Windows\System\AjpAVDm.exe
  C:\Windows\System\AjpAVDm.exe
  2⤵
  PID:4832
- C:\Windows\System\rNhNZOj.exe
  C:\Windows\System\rNhNZOj.exe
  2⤵
  PID:4912
- C:\Windows\System\scXjDpz.exe
  C:\Windows\System\scXjDpz.exe
  2⤵
  PID:5128
- C:\Windows\System\FAVMfZD.exe
  C:\Windows\System\FAVMfZD.exe
  2⤵
  PID:5152
- C:\Windows\System\EgLuzNS.exe
  C:\Windows\System\EgLuzNS.exe
  2⤵
  PID:5168
- C:\Windows\System\SHKaiki.exe
  C:\Windows\System\SHKaiki.exe
  2⤵
  PID:5192
- C:\Windows\System\kgXXcyY.exe
  C:\Windows\System\kgXXcyY.exe
  2⤵
  PID:5216
- C:\Windows\System\uYWTviu.exe
  C:\Windows\System\uYWTviu.exe
  2⤵
  PID:5232
- C:\Windows\System\pGoZTcX.exe
  C:\Windows\System\pGoZTcX.exe
  2⤵
  PID:5256
- C:\Windows\System\RIXqTrf.exe
  C:\Windows\System\RIXqTrf.exe
  2⤵
  PID:5276
- C:\Windows\System\qEOglpO.exe
  C:\Windows\System\qEOglpO.exe
  2⤵
  PID:5304
- C:\Windows\System\wjGuwDN.exe
  C:\Windows\System\wjGuwDN.exe
  2⤵
  PID:5328
- C:\Windows\System\ueWgMkE.exe
  C:\Windows\System\ueWgMkE.exe
  2⤵
  PID:5344
- C:\Windows\System\KZYtgUH.exe
  C:\Windows\System\KZYtgUH.exe
  2⤵
  PID:5368
- C:\Windows\System\EFSKuNV.exe
  C:\Windows\System\EFSKuNV.exe
  2⤵
  PID:5384
- C:\Windows\System\oYqmOmj.exe
  C:\Windows\System\oYqmOmj.exe
  2⤵
  PID:5408
- C:\Windows\System\UTGMrye.exe
  C:\Windows\System\UTGMrye.exe
  2⤵
  PID:5432
- C:\Windows\System\jTSLfoE.exe
  C:\Windows\System\jTSLfoE.exe
  2⤵
  PID:5452
- C:\Windows\System\GHpeVMB.exe
  C:\Windows\System\GHpeVMB.exe
  2⤵
  PID:5472
- C:\Windows\System\vAhhrkg.exe
  C:\Windows\System\vAhhrkg.exe
  2⤵
  PID:5496
- C:\Windows\System\BGfWIsk.exe
  C:\Windows\System\BGfWIsk.exe
  2⤵
  PID:5520
- C:\Windows\System\nHFVfOX.exe
  C:\Windows\System\nHFVfOX.exe
  2⤵
  PID:5544
- C:\Windows\System\lNbGNAS.exe
  C:\Windows\System\lNbGNAS.exe
  2⤵
  PID:5560
- C:\Windows\System\JFgofRf.exe
  C:\Windows\System\JFgofRf.exe
  2⤵
  PID:5588
- C:\Windows\System\gwWVmZT.exe
  C:\Windows\System\gwWVmZT.exe
  2⤵
  PID:5604
- C:\Windows\System\MmLGiqz.exe
  C:\Windows\System\MmLGiqz.exe
  2⤵
  PID:5628
- C:\Windows\System\fTwvxNv.exe
  C:\Windows\System\fTwvxNv.exe
  2⤵
  PID:5656
- C:\Windows\System\DXouikQ.exe
  C:\Windows\System\DXouikQ.exe
  2⤵
  PID:5680
- C:\Windows\System\pJvtKJK.exe
  C:\Windows\System\pJvtKJK.exe
  2⤵
  PID:5696
- C:\Windows\System\UYoajoD.exe
  C:\Windows\System\UYoajoD.exe
  2⤵
  PID:5724
- C:\Windows\System\CkIxHKg.exe
  C:\Windows\System\CkIxHKg.exe
  2⤵
  PID:5756
- C:\Windows\System\mIFBJJK.exe
  C:\Windows\System\mIFBJJK.exe
  2⤵
  PID:5776
- C:\Windows\System\PeFFFRf.exe
  C:\Windows\System\PeFFFRf.exe
  2⤵
  PID:5800
- C:\Windows\System\ZJeKCdZ.exe
  C:\Windows\System\ZJeKCdZ.exe
  2⤵
  PID:5824
- C:\Windows\System\dqFPech.exe
  C:\Windows\System\dqFPech.exe
  2⤵
  PID:5844
- C:\Windows\System\EBeGDcM.exe
  C:\Windows\System\EBeGDcM.exe
  2⤵
  PID:5864
- C:\Windows\System\CdjacDq.exe
  C:\Windows\System\CdjacDq.exe
  2⤵
  PID:5888
- C:\Windows\System\RJKlYRw.exe
  C:\Windows\System\RJKlYRw.exe
  2⤵
  PID:5904
- C:\Windows\System\yHdUZCb.exe
  C:\Windows\System\yHdUZCb.exe
  2⤵
  PID:5928
- C:\Windows\System\atuxnIg.exe
  C:\Windows\System\atuxnIg.exe
  2⤵
  PID:5960
- C:\Windows\System\sQOTCwP.exe
  C:\Windows\System\sQOTCwP.exe
  2⤵
  PID:5980
- C:\Windows\System\BUauzYF.exe
  C:\Windows\System\BUauzYF.exe
  2⤵
  PID:5996
- C:\Windows\System\VXrLCCf.exe
  C:\Windows\System\VXrLCCf.exe
  2⤵
  PID:6020
- C:\Windows\System\KVnQLjq.exe
  C:\Windows\System\KVnQLjq.exe
  2⤵
  PID:6048
- C:\Windows\System\DFdAmNt.exe
  C:\Windows\System\DFdAmNt.exe
  2⤵
  PID:6068
- C:\Windows\System\sRyMoKW.exe
  C:\Windows\System\sRyMoKW.exe
  2⤵
  PID:6088
- C:\Windows\System\ruyhGrY.exe
  C:\Windows\System\ruyhGrY.exe
  2⤵
  PID:6108
- C:\Windows\System\yvGaJuv.exe
  C:\Windows\System\yvGaJuv.exe
  2⤵
  PID:6136
- C:\Windows\System\aHDopsm.exe
  C:\Windows\System\aHDopsm.exe
  2⤵
  PID:1832
- C:\Windows\System\kGSROQa.exe
  C:\Windows\System\kGSROQa.exe
  2⤵
  PID:4492
- C:\Windows\System\RAhAOSR.exe
  C:\Windows\System\RAhAOSR.exe
  2⤵
  PID:872
- C:\Windows\System\wsMKEkm.exe
  C:\Windows\System\wsMKEkm.exe
  2⤵
  PID:2620
- C:\Windows\System\pjKoabQ.exe
  C:\Windows\System\pjKoabQ.exe
  2⤵
  PID:2768
- C:\Windows\System\oDGqgXW.exe
  C:\Windows\System\oDGqgXW.exe
  2⤵
  PID:5048
- C:\Windows\System\yApQwei.exe
  C:\Windows\System\yApQwei.exe
  2⤵
  PID:5176
- C:\Windows\System\KnCZawz.exe
  C:\Windows\System\KnCZawz.exe
  2⤵
  PID:5284
- C:\Windows\System\mlxXGRw.exe
  C:\Windows\System\mlxXGRw.exe
  2⤵
  PID:2604
- C:\Windows\System\CyZDuXv.exe
  C:\Windows\System\CyZDuXv.exe
  2⤵
  PID:5012
- C:\Windows\System\zhBpqqp.exe
  C:\Windows\System\zhBpqqp.exe
  2⤵
  PID:2588
- C:\Windows\System\OQUvHoA.exe
  C:\Windows\System\OQUvHoA.exe
  2⤵
  PID:3596
- C:\Windows\System\iXqPuug.exe
  C:\Windows\System\iXqPuug.exe
  2⤵
  PID:2852
- C:\Windows\System\ooTmwwI.exe
  C:\Windows\System\ooTmwwI.exe
  2⤵
  PID:5488
- C:\Windows\System\GnRAabt.exe
  C:\Windows\System\GnRAabt.exe
  2⤵
  PID:4660
- C:\Windows\System\URCRjof.exe
  C:\Windows\System\URCRjof.exe
  2⤵
  PID:5704
- C:\Windows\System\bvHysxP.exe
  C:\Windows\System\bvHysxP.exe
  2⤵
  PID:5268
- C:\Windows\System\qwLaTiY.exe
  C:\Windows\System\qwLaTiY.exe
  2⤵
  PID:5400
- C:\Windows\System\JKLghZA.exe
  C:\Windows\System\JKLghZA.exe
  2⤵
  PID:5772
- C:\Windows\System\zPumgwr.exe
  C:\Windows\System\zPumgwr.exe
  2⤵
  PID:5816
- C:\Windows\System\LVouKvM.exe
  C:\Windows\System\LVouKvM.exe
  2⤵
  PID:5840
- C:\Windows\System\cIMybvN.exe
  C:\Windows\System\cIMybvN.exe
  2⤵
  PID:5552
- C:\Windows\System\sUlxAKB.exe
  C:\Windows\System\sUlxAKB.exe
  2⤵
  PID:5924
- C:\Windows\System\PCpoQFx.exe
  C:\Windows\System\PCpoQFx.exe
  2⤵
  PID:5160
- C:\Windows\System\fcuDLEZ.exe
  C:\Windows\System\fcuDLEZ.exe
  2⤵
  PID:6016
- C:\Windows\System\apjJMjh.exe
  C:\Windows\System\apjJMjh.exe
  2⤵
  PID:5200
- C:\Windows\System\ZfZlgUC.exe
  C:\Windows\System\ZfZlgUC.exe
  2⤵
  PID:6064
- C:\Windows\System\voawaqs.exe
  C:\Windows\System\voawaqs.exe
  2⤵
  PID:5716
- C:\Windows\System\TqIjvav.exe
  C:\Windows\System\TqIjvav.exe
  2⤵
  PID:6160
- C:\Windows\System\UzPNfxK.exe
  C:\Windows\System\UzPNfxK.exe
  2⤵
  PID:6180
- C:\Windows\System\pkwSNJD.exe
  C:\Windows\System\pkwSNJD.exe
  2⤵
  PID:6200
- C:\Windows\System\YNHJAEg.exe
  C:\Windows\System\YNHJAEg.exe
  2⤵
  PID:6220
- C:\Windows\System\vdtBzcO.exe
  C:\Windows\System\vdtBzcO.exe
  2⤵
  PID:6244
- C:\Windows\System\TtiHJqA.exe
  C:\Windows\System\TtiHJqA.exe
  2⤵
  PID:6268
- C:\Windows\System\vjIFJxs.exe
  C:\Windows\System\vjIFJxs.exe
  2⤵
  PID:6284
- C:\Windows\System\EAbXkah.exe
  C:\Windows\System\EAbXkah.exe
  2⤵
  PID:6308
- C:\Windows\System\MSJknPb.exe
  C:\Windows\System\MSJknPb.exe
  2⤵
  PID:6328
- C:\Windows\System\bMrdtiK.exe
  C:\Windows\System\bMrdtiK.exe
  2⤵
  PID:6356
- C:\Windows\System\XqQifMD.exe
  C:\Windows\System\XqQifMD.exe
  2⤵
  PID:6380
- C:\Windows\System\Kvkhsxc.exe
  C:\Windows\System\Kvkhsxc.exe
  2⤵
  PID:6408
- C:\Windows\System\uGRwGUe.exe
  C:\Windows\System\uGRwGUe.exe
  2⤵
  PID:6428
- C:\Windows\System\WvBeJpA.exe
  C:\Windows\System\WvBeJpA.exe
  2⤵
  PID:6452
- C:\Windows\System\nyPUWav.exe
  C:\Windows\System\nyPUWav.exe
  2⤵
  PID:6468
- C:\Windows\System\uArcLpH.exe
  C:\Windows\System\uArcLpH.exe
  2⤵
  PID:6500
- C:\Windows\System\xaUpILZ.exe
  C:\Windows\System\xaUpILZ.exe
  2⤵
  PID:6528
- C:\Windows\System\AGDLdPW.exe
  C:\Windows\System\AGDLdPW.exe
  2⤵
  PID:6552
- C:\Windows\System\DhTwuGo.exe
  C:\Windows\System\DhTwuGo.exe
  2⤵
  PID:6580
- C:\Windows\System\BzCynXA.exe
  C:\Windows\System\BzCynXA.exe
  2⤵
  PID:6596
- C:\Windows\System\VgYnwmX.exe
  C:\Windows\System\VgYnwmX.exe
  2⤵
  PID:6620
- C:\Windows\System\mNNEDIx.exe
  C:\Windows\System\mNNEDIx.exe
  2⤵
  PID:6644
- C:\Windows\System\kqHydLV.exe
  C:\Windows\System\kqHydLV.exe
  2⤵
  PID:6668
- C:\Windows\System\DMfMndB.exe
  C:\Windows\System\DMfMndB.exe
  2⤵
  PID:6696
- C:\Windows\System\lhDNgNc.exe
  C:\Windows\System\lhDNgNc.exe
  2⤵
  PID:6712
- C:\Windows\System\gChKXZA.exe
  C:\Windows\System\gChKXZA.exe
  2⤵
  PID:6736
- C:\Windows\System\AsQfZwL.exe
  C:\Windows\System\AsQfZwL.exe
  2⤵
  PID:6760
- C:\Windows\System\pdmjHxJ.exe
  C:\Windows\System\pdmjHxJ.exe
  2⤵
  PID:6796
- C:\Windows\System\kNIuplR.exe
  C:\Windows\System\kNIuplR.exe
  2⤵
  PID:6820
- C:\Windows\System\zNQMWsj.exe
  C:\Windows\System\zNQMWsj.exe
  2⤵
  PID:6844
- C:\Windows\System\ReKofeQ.exe
  C:\Windows\System\ReKofeQ.exe
  2⤵
  PID:6864
- C:\Windows\System\xUNMRcY.exe
  C:\Windows\System\xUNMRcY.exe
  2⤵
  PID:6884
- C:\Windows\System\SODEINS.exe
  C:\Windows\System\SODEINS.exe
  2⤵
  PID:6908
- C:\Windows\System\tNSePSE.exe
  C:\Windows\System\tNSePSE.exe
  2⤵
  PID:6928
- C:\Windows\System\hrXNrDu.exe
  C:\Windows\System\hrXNrDu.exe
  2⤵
  PID:6948
- C:\Windows\System\mnRMMHE.exe
  C:\Windows\System\mnRMMHE.exe
  2⤵
  PID:6972
- C:\Windows\System\MDYTgcw.exe
  C:\Windows\System\MDYTgcw.exe
  2⤵
  PID:6988
- C:\Windows\System\uVHSXIA.exe
  C:\Windows\System\uVHSXIA.exe
  2⤵
  PID:7008
- C:\Windows\System\aRuKadz.exe
  C:\Windows\System\aRuKadz.exe
  2⤵
  PID:7032
- C:\Windows\System\bEmpYgJ.exe
  C:\Windows\System\bEmpYgJ.exe
  2⤵
  PID:7052
- C:\Windows\System\oqTumHD.exe
  C:\Windows\System\oqTumHD.exe
  2⤵
  PID:7072
- C:\Windows\System\NsozVEx.exe
  C:\Windows\System\NsozVEx.exe
  2⤵
  PID:7096
- C:\Windows\System\SfnCOEV.exe
  C:\Windows\System\SfnCOEV.exe
  2⤵
  PID:7116
- C:\Windows\System\VuXjiPq.exe
  C:\Windows\System\VuXjiPq.exe
  2⤵
  PID:7136
- C:\Windows\System\JYYiBeQ.exe
  C:\Windows\System\JYYiBeQ.exe
  2⤵
  PID:7164
- C:\Windows\System\ofxLfKE.exe
  C:\Windows\System\ofxLfKE.exe
  2⤵
  PID:5480
- C:\Windows\System\dbQKVsK.exe
  C:\Windows\System\dbQKVsK.exe
  2⤵
  PID:3940
- C:\Windows\System\szKQJQi.exe
  C:\Windows\System\szKQJQi.exe
  2⤵
  PID:3128
- C:\Windows\System\gmcwLqN.exe
  C:\Windows\System\gmcwLqN.exe
  2⤵
  PID:4972
- C:\Windows\System\slYdajK.exe
  C:\Windows\System\slYdajK.exe
  2⤵
  PID:5320
- C:\Windows\System\oPmfvwE.exe
  C:\Windows\System\oPmfvwE.exe
  2⤵
  PID:6028
- C:\Windows\System\ULGqyzd.exe
  C:\Windows\System\ULGqyzd.exe
  2⤵
  PID:5392
- C:\Windows\System\AbkWecG.exe
  C:\Windows\System\AbkWecG.exe
  2⤵
  PID:5508
- C:\Windows\System\uYsdPKS.exe
  C:\Windows\System\uYsdPKS.exe
  2⤵
  PID:5720
- C:\Windows\System\UTkikfb.exe
  C:\Windows\System\UTkikfb.exe
  2⤵
  PID:6036
- C:\Windows\System\UbidrWJ.exe
  C:\Windows\System\UbidrWJ.exe
  2⤵
  PID:6060
- C:\Windows\System\fhzQYmC.exe
  C:\Windows\System\fhzQYmC.exe
  2⤵
  PID:6236
- C:\Windows\System\FezUcgx.exe
  C:\Windows\System\FezUcgx.exe
  2⤵
  PID:6292
- C:\Windows\System\ZCdCPeH.exe
  C:\Windows\System\ZCdCPeH.exe
  2⤵
  PID:6320
- C:\Windows\System\wLlHvzY.exe
  C:\Windows\System\wLlHvzY.exe
  2⤵
  PID:6364
- C:\Windows\System\IJrmruA.exe
  C:\Windows\System\IJrmruA.exe
  2⤵
  PID:5224
- C:\Windows\System\MsLvQPD.exe
  C:\Windows\System\MsLvQPD.exe
  2⤵
  PID:3004
- C:\Windows\System\eLEnDtA.exe
  C:\Windows\System\eLEnDtA.exe
  2⤵
  PID:6484
- C:\Windows\System\WVpWFaZ.exe
  C:\Windows\System\WVpWFaZ.exe
  2⤵
  PID:5380
- C:\Windows\System\tkvshJF.exe
  C:\Windows\System\tkvshJF.exe
  2⤵
  PID:5532
- C:\Windows\System\cqBHWhL.exe
  C:\Windows\System\cqBHWhL.exe
  2⤵
  PID:6628
- C:\Windows\System\sEsWEZZ.exe
  C:\Windows\System\sEsWEZZ.exe
  2⤵
  PID:5952
- C:\Windows\System\AgRfVdV.exe
  C:\Windows\System\AgRfVdV.exe
  2⤵
  PID:6720
- C:\Windows\System\pvZHaQA.exe
  C:\Windows\System\pvZHaQA.exe
  2⤵
  PID:6172
- C:\Windows\System\jJDqKxj.exe
  C:\Windows\System\jJDqKxj.exe
  2⤵
  PID:6192
- C:\Windows\System\XDiuZfy.exe
  C:\Windows\System\XDiuZfy.exe
  2⤵
  PID:6840
- C:\Windows\System\MhwLXYp.exe
  C:\Windows\System\MhwLXYp.exe
  2⤵
  PID:6340
- C:\Windows\System\zgACcvS.exe
  C:\Windows\System\zgACcvS.exe
  2⤵
  PID:1968
- C:\Windows\System\CYgGFVt.exe
  C:\Windows\System\CYgGFVt.exe
  2⤵
  PID:6980
- C:\Windows\System\FCHINYs.exe
  C:\Windows\System\FCHINYs.exe
  2⤵
  PID:7184
- C:\Windows\System\PLSYoOt.exe
  C:\Windows\System\PLSYoOt.exe
  2⤵
  PID:7208
- C:\Windows\System\XhXBeWL.exe
  C:\Windows\System\XhXBeWL.exe
  2⤵
  PID:7228
- C:\Windows\System\lvANTgR.exe
  C:\Windows\System\lvANTgR.exe
  2⤵
  PID:7256
- C:\Windows\System\uMthYJl.exe
  C:\Windows\System\uMthYJl.exe
  2⤵
  PID:7276
- C:\Windows\System\nFvbZoM.exe
  C:\Windows\System\nFvbZoM.exe
  2⤵
  PID:7300
- C:\Windows\System\ViDcotn.exe
  C:\Windows\System\ViDcotn.exe
  2⤵
  PID:7316
- C:\Windows\System\ENBgrFA.exe
  C:\Windows\System\ENBgrFA.exe
  2⤵
  PID:7340
- C:\Windows\System\wgPutTu.exe
  C:\Windows\System\wgPutTu.exe
  2⤵
  PID:7364
- C:\Windows\System\ZhxnLim.exe
  C:\Windows\System\ZhxnLim.exe
  2⤵
  PID:7388
- C:\Windows\System\piXBvot.exe
  C:\Windows\System\piXBvot.exe
  2⤵
  PID:7404
- C:\Windows\System\RfjZyqk.exe
  C:\Windows\System\RfjZyqk.exe
  2⤵
  PID:7432
- C:\Windows\System\LKxrsUT.exe
  C:\Windows\System\LKxrsUT.exe
  2⤵
  PID:7448
- C:\Windows\System\lHcTIvT.exe
  C:\Windows\System\lHcTIvT.exe
  2⤵
  PID:7468
- C:\Windows\System\CsdHPAG.exe
  C:\Windows\System\CsdHPAG.exe
  2⤵
  PID:7496
- C:\Windows\System\XfTYmLp.exe
  C:\Windows\System\XfTYmLp.exe
  2⤵
  PID:7516
- C:\Windows\System\PvQOaPV.exe
  C:\Windows\System\PvQOaPV.exe
  2⤵
  PID:7536
- C:\Windows\System\MeThyVd.exe
  C:\Windows\System\MeThyVd.exe
  2⤵
  PID:7556
- C:\Windows\System\enJJLES.exe
  C:\Windows\System\enJJLES.exe
  2⤵
  PID:7580
- C:\Windows\System\hvAObkZ.exe
  C:\Windows\System\hvAObkZ.exe
  2⤵
  PID:7604
- C:\Windows\System\siJbEFT.exe
  C:\Windows\System\siJbEFT.exe
  2⤵
  PID:7624
- C:\Windows\System\zPmOsAv.exe
  C:\Windows\System\zPmOsAv.exe
  2⤵
  PID:7656
- C:\Windows\System\qJXrpZq.exe
  C:\Windows\System\qJXrpZq.exe
  2⤵
  PID:7676
- C:\Windows\System\hqbOvFM.exe
  C:\Windows\System\hqbOvFM.exe
  2⤵
  PID:7696
- C:\Windows\System\YLlljTb.exe
  C:\Windows\System\YLlljTb.exe
  2⤵
  PID:7720
- C:\Windows\System\ntOGfpI.exe
  C:\Windows\System\ntOGfpI.exe
  2⤵
  PID:7744
- C:\Windows\System\tfxcFYk.exe
  C:\Windows\System\tfxcFYk.exe
  2⤵
  PID:7768
- C:\Windows\System\wOWDDpl.exe
  C:\Windows\System\wOWDDpl.exe
  2⤵
  PID:7784
- C:\Windows\System\lvWZKLg.exe
  C:\Windows\System\lvWZKLg.exe
  2⤵
  PID:7800
- C:\Windows\System\ANvGFCJ.exe
  C:\Windows\System\ANvGFCJ.exe
  2⤵
  PID:7816
- C:\Windows\System\ATtXNnl.exe
  C:\Windows\System\ATtXNnl.exe
  2⤵
  PID:7832
- C:\Windows\System\xoFtrfu.exe
  C:\Windows\System\xoFtrfu.exe
  2⤵
  PID:7848
- C:\Windows\System\rfTqzuM.exe
  C:\Windows\System\rfTqzuM.exe
  2⤵
  PID:7868
- C:\Windows\System\ZnZYJCk.exe
  C:\Windows\System\ZnZYJCk.exe
  2⤵
  PID:7884
- C:\Windows\System\nCSfsMW.exe
  C:\Windows\System\nCSfsMW.exe
  2⤵
  PID:7904
- C:\Windows\System\YFTtyGp.exe
  C:\Windows\System\YFTtyGp.exe
  2⤵
  PID:7920
- C:\Windows\System\tmWwtsc.exe
  C:\Windows\System\tmWwtsc.exe
  2⤵
  PID:7984
- C:\Windows\System\knPtjay.exe
  C:\Windows\System\knPtjay.exe
  2⤵
  PID:8040
- C:\Windows\System\OrUBfPd.exe
  C:\Windows\System\OrUBfPd.exe
  2⤵
  PID:8056
- C:\Windows\System\rKERkby.exe
  C:\Windows\System\rKERkby.exe
  2⤵
  PID:8076
- C:\Windows\System\JRCpjlf.exe
  C:\Windows\System\JRCpjlf.exe
  2⤵
  PID:8100
- C:\Windows\System\gPvGomq.exe
  C:\Windows\System\gPvGomq.exe
  2⤵
  PID:8124
- C:\Windows\System\AbxXxCv.exe
  C:\Windows\System\AbxXxCv.exe
  2⤵
  PID:8156
- C:\Windows\System\KrqIZDu.exe
  C:\Windows\System\KrqIZDu.exe
  2⤵
  PID:8180
- C:\Windows\System\ChoVMkE.exe
  C:\Windows\System\ChoVMkE.exe
  2⤵
  PID:780
- C:\Windows\System\zanAuVk.exe
  C:\Windows\System\zanAuVk.exe
  2⤵
  PID:7128
- C:\Windows\System\sKoyEIz.exe
  C:\Windows\System\sKoyEIz.exe
  2⤵
  PID:4100
- C:\Windows\System\tvwDOPr.exe
  C:\Windows\System\tvwDOPr.exe
  2⤵
  PID:6652
- C:\Windows\System\SOqWsSv.exe
  C:\Windows\System\SOqWsSv.exe
  2⤵
  PID:5448
- C:\Windows\System\eeXyhOK.exe
  C:\Windows\System\eeXyhOK.exe
  2⤵
  PID:5424
- C:\Windows\System\QmkWIKx.exe
  C:\Windows\System\QmkWIKx.exe
  2⤵
  PID:6012
- C:\Windows\System\CxKRnfV.exe
  C:\Windows\System\CxKRnfV.exe
  2⤵
  PID:5784
- C:\Windows\System\yKnWfpw.exe
  C:\Windows\System\yKnWfpw.exe
  2⤵
  PID:6212
- C:\Windows\System\PaIWgxz.exe
  C:\Windows\System\PaIWgxz.exe
  2⤵
  PID:6572
- C:\Windows\System\LsAchXD.exe
  C:\Windows\System\LsAchXD.exe
  2⤵
  PID:6704
- C:\Windows\System\PRvpSap.exe
  C:\Windows\System\PRvpSap.exe
  2⤵
  PID:8212
- C:\Windows\System\rTeBphK.exe
  C:\Windows\System\rTeBphK.exe
  2⤵
  PID:8228
- C:\Windows\System\GtFkdrl.exe
  C:\Windows\System\GtFkdrl.exe
  2⤵
  PID:8248
- C:\Windows\System\OJPOPSz.exe
  C:\Windows\System\OJPOPSz.exe
  2⤵
  PID:8280
- C:\Windows\System\HEnRpPW.exe
  C:\Windows\System\HEnRpPW.exe
  2⤵
  PID:8304
- C:\Windows\System\JOQPegp.exe
  C:\Windows\System\JOQPegp.exe
  2⤵
  PID:8320
- C:\Windows\System\TlKZSLJ.exe
  C:\Windows\System\TlKZSLJ.exe
  2⤵
  PID:8348
- C:\Windows\System\TYZiUGo.exe
  C:\Windows\System\TYZiUGo.exe
  2⤵
  PID:8372
- C:\Windows\System\jJNsxVb.exe
  C:\Windows\System\jJNsxVb.exe
  2⤵
  PID:8400
- C:\Windows\System\UXLGkBx.exe
  C:\Windows\System\UXLGkBx.exe
  2⤵
  PID:8420
- C:\Windows\System\lqNHHLJ.exe
  C:\Windows\System\lqNHHLJ.exe
  2⤵
  PID:8444
- C:\Windows\System\eHZOQth.exe
  C:\Windows\System\eHZOQth.exe
  2⤵
  PID:8464
- C:\Windows\System\MVxLLjB.exe
  C:\Windows\System\MVxLLjB.exe
  2⤵
  PID:8484
- C:\Windows\System\kHuniWH.exe
  C:\Windows\System\kHuniWH.exe
  2⤵
  PID:8504
- C:\Windows\System\jnxTLZz.exe
  C:\Windows\System\jnxTLZz.exe
  2⤵
  PID:8524
- C:\Windows\System\JQPWHMR.exe
  C:\Windows\System\JQPWHMR.exe
  2⤵
  PID:8552
- C:\Windows\System\icHvSxW.exe
  C:\Windows\System\icHvSxW.exe
  2⤵
  PID:8568
- C:\Windows\System\yBNoRop.exe
  C:\Windows\System\yBNoRop.exe
  2⤵
  PID:8588
- C:\Windows\System\xUtjDNv.exe
  C:\Windows\System\xUtjDNv.exe
  2⤵
  PID:8608
- C:\Windows\System\IwaEmFs.exe
  C:\Windows\System\IwaEmFs.exe
  2⤵
  PID:8640
- C:\Windows\System\LWZloRi.exe
  C:\Windows\System\LWZloRi.exe
  2⤵
  PID:8656
- C:\Windows\System\sarVMTK.exe
  C:\Windows\System\sarVMTK.exe
  2⤵
  PID:8680
- C:\Windows\System\BTwQZoA.exe
  C:\Windows\System\BTwQZoA.exe
  2⤵
  PID:8700
- C:\Windows\System\HxEZJzT.exe
  C:\Windows\System\HxEZJzT.exe
  2⤵
  PID:8724
- C:\Windows\System\IdMcvvD.exe
  C:\Windows\System\IdMcvvD.exe
  2⤵
  PID:8748
- C:\Windows\System\eRqvTVw.exe
  C:\Windows\System\eRqvTVw.exe
  2⤵
  PID:8772
- C:\Windows\System\QWexDmt.exe
  C:\Windows\System\QWexDmt.exe
  2⤵
  PID:8792
- C:\Windows\System\WwCafZL.exe
  C:\Windows\System\WwCafZL.exe
  2⤵
  PID:8812
- C:\Windows\System\rbxTzsf.exe
  C:\Windows\System\rbxTzsf.exe
  2⤵
  PID:8832
- C:\Windows\System\ddYPPhf.exe
  C:\Windows\System\ddYPPhf.exe
  2⤵
  PID:8856
- C:\Windows\System\DmzQIeB.exe
  C:\Windows\System\DmzQIeB.exe
  2⤵
  PID:8876
- C:\Windows\System\jaFNBuG.exe
  C:\Windows\System\jaFNBuG.exe
  2⤵
  PID:8896
- C:\Windows\System\ELLbjxl.exe
  C:\Windows\System\ELLbjxl.exe
  2⤵
  PID:8920
- C:\Windows\System\TZuTGDJ.exe
  C:\Windows\System\TZuTGDJ.exe
  2⤵
  PID:8936
- C:\Windows\System\ExhWHnM.exe
  C:\Windows\System\ExhWHnM.exe
  2⤵
  PID:8956
- C:\Windows\System\hMWBxxu.exe
  C:\Windows\System\hMWBxxu.exe
  2⤵
  PID:8976
- C:\Windows\System\byWPmBV.exe
  C:\Windows\System\byWPmBV.exe
  2⤵
  PID:9000
- C:\Windows\System\HlSxoXJ.exe
  C:\Windows\System\HlSxoXJ.exe
  2⤵
  PID:9020
- C:\Windows\System\spEUKiy.exe
  C:\Windows\System\spEUKiy.exe
  2⤵
  PID:9044
- C:\Windows\System\UelDWuX.exe
  C:\Windows\System\UelDWuX.exe
  2⤵
  PID:9072
- C:\Windows\System\IppLuBc.exe
  C:\Windows\System\IppLuBc.exe
  2⤵
  PID:9092
- C:\Windows\System\FukJCcj.exe
  C:\Windows\System\FukJCcj.exe
  2⤵
  PID:9112
- C:\Windows\System\JfGEnRe.exe
  C:\Windows\System\JfGEnRe.exe
  2⤵
  PID:9140
- C:\Windows\System\rhMBjJJ.exe
  C:\Windows\System\rhMBjJJ.exe
  2⤵
  PID:9164
- C:\Windows\System\rizjAxt.exe
  C:\Windows\System\rizjAxt.exe
  2⤵
  PID:9184
- C:\Windows\System\EMXLSqg.exe
  C:\Windows\System\EMXLSqg.exe
  2⤵
  PID:2032
- C:\Windows\System\TOnktik.exe
  C:\Windows\System\TOnktik.exe
  2⤵
  PID:7952
- C:\Windows\System\hZpZljl.exe
  C:\Windows\System\hZpZljl.exe
  2⤵
  PID:5296
- C:\Windows\System\MXcOXeM.exe
  C:\Windows\System\MXcOXeM.exe
  2⤵
  PID:5896
- C:\Windows\System\gJiuxOB.exe
  C:\Windows\System\gJiuxOB.exe
  2⤵
  PID:7840
- C:\Windows\System\BGOZshz.exe
  C:\Windows\System\BGOZshz.exe
  2⤵
  PID:8948
- C:\Windows\System\SMapJaF.exe
  C:\Windows\System\SMapJaF.exe
  2⤵
  PID:8804
- C:\Windows\System\wQVtXsL.exe
  C:\Windows\System\wQVtXsL.exe
  2⤵
  PID:8580
- C:\Windows\System\WLcqYaK.exe
  C:\Windows\System\WLcqYaK.exe
  2⤵
  PID:8496
- C:\Windows\System\wqiZlvt.exe
  C:\Windows\System\wqiZlvt.exe
  2⤵
  PID:6724
- C:\Windows\System\dKSHLjs.exe
  C:\Windows\System\dKSHLjs.exe
  2⤵
  PID:6176
- C:\Windows\System\fhWPEAK.exe
  C:\Windows\System\fhWPEAK.exe
  2⤵
  PID:9220
- C:\Windows\System\DkUZjnw.exe
  C:\Windows\System\DkUZjnw.exe
  2⤵
  PID:9244
- C:\Windows\System\MPHwWZA.exe
  C:\Windows\System\MPHwWZA.exe
  2⤵
  PID:9280
- C:\Windows\System\aAhoelE.exe
  C:\Windows\System\aAhoelE.exe
  2⤵
  PID:9300
- C:\Windows\System\NpWBQMi.exe
  C:\Windows\System\NpWBQMi.exe
  2⤵
  PID:9316
- C:\Windows\System\VymWUaV.exe
  C:\Windows\System\VymWUaV.exe
  2⤵
  PID:9340
- C:\Windows\System\HnmfEOn.exe
  C:\Windows\System\HnmfEOn.exe
  2⤵
  PID:9360
- C:\Windows\System\avvMMOF.exe
  C:\Windows\System\avvMMOF.exe
  2⤵
  PID:9380
- C:\Windows\System\BAlEqmV.exe
  C:\Windows\System\BAlEqmV.exe
  2⤵
  PID:9404
- C:\Windows\System\eERjBpj.exe
  C:\Windows\System\eERjBpj.exe
  2⤵
  PID:9424
- C:\Windows\System\fYmcbyR.exe
  C:\Windows\System\fYmcbyR.exe
  2⤵
  PID:9456
- C:\Windows\System\dLyeQbz.exe
  C:\Windows\System\dLyeQbz.exe
  2⤵
  PID:9480
- C:\Windows\System\JsQGTes.exe
  C:\Windows\System\JsQGTes.exe
  2⤵
  PID:9500
- C:\Windows\System\reyqzfB.exe
  C:\Windows\System\reyqzfB.exe
  2⤵
  PID:9524
- C:\Windows\System\UienKAg.exe
  C:\Windows\System\UienKAg.exe
  2⤵
  PID:9548
- C:\Windows\System\bOoCTGK.exe
  C:\Windows\System\bOoCTGK.exe
  2⤵
  PID:9568
- C:\Windows\System\rVJTlfN.exe
  C:\Windows\System\rVJTlfN.exe
  2⤵
  PID:9592
- C:\Windows\System\oTlLnhB.exe
  C:\Windows\System\oTlLnhB.exe
  2⤵
  PID:9620
- C:\Windows\System\MumlsPA.exe
  C:\Windows\System\MumlsPA.exe
  2⤵
  PID:9644
- C:\Windows\System\vajJizp.exe
  C:\Windows\System\vajJizp.exe
  2⤵
  PID:9664
- C:\Windows\System\VpTwOrl.exe
  C:\Windows\System\VpTwOrl.exe
  2⤵
  PID:9688
- C:\Windows\System\gOIXdgo.exe
  C:\Windows\System\gOIXdgo.exe
  2⤵
  PID:9708
- C:\Windows\System\lIQMGlQ.exe
  C:\Windows\System\lIQMGlQ.exe
  2⤵
  PID:9740
- C:\Windows\System\ijpsVar.exe
  C:\Windows\System\ijpsVar.exe
  2⤵
  PID:9764
- C:\Windows\System\mvluNbz.exe
  C:\Windows\System\mvluNbz.exe
  2⤵
  PID:9796
- C:\Windows\System\JNRZtCH.exe
  C:\Windows\System\JNRZtCH.exe
  2⤵
  PID:9836
- C:\Windows\System\OlHmkBM.exe
  C:\Windows\System\OlHmkBM.exe
  2⤵
  PID:9868
- C:\Windows\System\SOownUi.exe
  C:\Windows\System\SOownUi.exe
  2⤵
  PID:9884
- C:\Windows\System\HQGUtbx.exe
  C:\Windows\System\HQGUtbx.exe
  2⤵
  PID:9908
- C:\Windows\System\YCZQxdI.exe
  C:\Windows\System\YCZQxdI.exe
  2⤵
  PID:9948
- C:\Windows\System\QLXVvjx.exe
  C:\Windows\System\QLXVvjx.exe
  2⤵
  PID:9968
- C:\Windows\System\ojZxZNY.exe
  C:\Windows\System\ojZxZNY.exe
  2⤵
  PID:9988
- C:\Windows\System\PHikfRs.exe
  C:\Windows\System\PHikfRs.exe
  2⤵
  PID:10008
- C:\Windows\System\akNoWDe.exe
  C:\Windows\System\akNoWDe.exe
  2⤵
  PID:10028
- C:\Windows\System\JsmBPbd.exe
  C:\Windows\System\JsmBPbd.exe
  2⤵
  PID:10056
- C:\Windows\System\GmyYPAH.exe
  C:\Windows\System\GmyYPAH.exe
  2⤵
  PID:10076
- C:\Windows\System\HyIzeto.exe
  C:\Windows\System\HyIzeto.exe
  2⤵
  PID:10096
- C:\Windows\System\VhOwCQN.exe
  C:\Windows\System\VhOwCQN.exe
  2⤵
  PID:10168
- C:\Windows\System\qGDXkJH.exe
  C:\Windows\System\qGDXkJH.exe
  2⤵
  PID:10204
- C:\Windows\System\BZdWDvl.exe
  C:\Windows\System\BZdWDvl.exe
  2⤵
  PID:10228
- C:\Windows\System\dAmFbMI.exe
  C:\Windows\System\dAmFbMI.exe
  2⤵
  PID:7252
- C:\Windows\System\PMgkvvG.exe
  C:\Windows\System\PMgkvvG.exe
  2⤵
  PID:7588
- C:\Windows\System\bbZCrGg.exe
  C:\Windows\System\bbZCrGg.exe
  2⤵
  PID:7348
- C:\Windows\System\EAaEXAu.exe
  C:\Windows\System\EAaEXAu.exe
  2⤵
  PID:8480
- C:\Windows\System\XHIafmd.exe
  C:\Windows\System\XHIafmd.exe
  2⤵
  PID:8584
- C:\Windows\System\sjdqZZt.exe
  C:\Windows\System\sjdqZZt.exe
  2⤵
  PID:7612
- C:\Windows\System\XuNmMNG.exe
  C:\Windows\System\XuNmMNG.exe
  2⤵
  PID:3316
- C:\Windows\System\QAmeKil.exe
  C:\Windows\System\QAmeKil.exe
  2⤵
  PID:8868
- C:\Windows\System\hONjBwQ.exe
  C:\Windows\System\hONjBwQ.exe
  2⤵
  PID:7760
- C:\Windows\System\HXzsnvB.exe
  C:\Windows\System\HXzsnvB.exe
  2⤵
  PID:7892
- C:\Windows\System\WozQcEg.exe
  C:\Windows\System\WozQcEg.exe
  2⤵
  PID:4140
- C:\Windows\System\ObqEfca.exe
  C:\Windows\System\ObqEfca.exe
  2⤵
  PID:7996
- C:\Windows\System\URIQgZR.exe
  C:\Windows\System\URIQgZR.exe
  2⤵
  PID:8096
- C:\Windows\System\yzsvnql.exe
  C:\Windows\System\yzsvnql.exe
  2⤵
  PID:6728
- C:\Windows\System\tZbzxZD.exe
  C:\Windows\System\tZbzxZD.exe
  2⤵
  PID:9060
- C:\Windows\System\xuUjSww.exe
  C:\Windows\System\xuUjSww.exe
  2⤵
  PID:8932
- C:\Windows\System\MYjIzrT.exe
  C:\Windows\System\MYjIzrT.exe
  2⤵
  PID:7808
- C:\Windows\System\zgRzOLP.exe
  C:\Windows\System\zgRzOLP.exe
  2⤵
  PID:8084
- C:\Windows\System\aTjUbgY.exe
  C:\Windows\System\aTjUbgY.exe
  2⤵
  PID:10248
- C:\Windows\System\LICkSnt.exe
  C:\Windows\System\LICkSnt.exe
  2⤵
  PID:10264
- C:\Windows\System\FTnqOcj.exe
  C:\Windows\System\FTnqOcj.exe
  2⤵
  PID:10288
- C:\Windows\System\iFvTFTO.exe
  C:\Windows\System\iFvTFTO.exe
  2⤵
  PID:10312
- C:\Windows\System\BRyUlrA.exe
  C:\Windows\System\BRyUlrA.exe
  2⤵
  PID:10328
- C:\Windows\System\fMefwGJ.exe
  C:\Windows\System\fMefwGJ.exe
  2⤵
  PID:10348
- C:\Windows\System\EzfEAnw.exe
  C:\Windows\System\EzfEAnw.exe
  2⤵
  PID:10364
- C:\Windows\System\ywRAyDI.exe
  C:\Windows\System\ywRAyDI.exe
  2⤵
  PID:10380
- C:\Windows\System\jmkFtQR.exe
  C:\Windows\System\jmkFtQR.exe
  2⤵
  PID:10396
- C:\Windows\System\qCiqpBE.exe
  C:\Windows\System\qCiqpBE.exe
  2⤵
  PID:10412
- C:\Windows\System\RawJYor.exe
  C:\Windows\System\RawJYor.exe
  2⤵
  PID:10432
- C:\Windows\System\meULZaw.exe
  C:\Windows\System\meULZaw.exe
  2⤵
  PID:10456
- C:\Windows\System\ZtVVMBJ.exe
  C:\Windows\System\ZtVVMBJ.exe
  2⤵
  PID:10476
- C:\Windows\System\azTWOwb.exe
  C:\Windows\System\azTWOwb.exe
  2⤵
  PID:10496
- C:\Windows\System\GTWlrne.exe
  C:\Windows\System\GTWlrne.exe
  2⤵
  PID:10516
- C:\Windows\System\WDWoDJY.exe
  C:\Windows\System\WDWoDJY.exe
  2⤵
  PID:10540
- C:\Windows\System\SRRPvQx.exe
  C:\Windows\System\SRRPvQx.exe
  2⤵
  PID:10560
- C:\Windows\System\SaYDCNu.exe
  C:\Windows\System\SaYDCNu.exe
  2⤵
  PID:10588
- C:\Windows\System\Trqzchu.exe
  C:\Windows\System\Trqzchu.exe
  2⤵
  PID:10612
- C:\Windows\System\ivfmZkk.exe
  C:\Windows\System\ivfmZkk.exe
  2⤵
  PID:10652
- C:\Windows\System\QurCigE.exe
  C:\Windows\System\QurCigE.exe
  2⤵
  PID:10668
- C:\Windows\System\APsFUKA.exe
  C:\Windows\System\APsFUKA.exe
  2⤵
  PID:10692
- C:\Windows\System\iadzngC.exe
  C:\Windows\System\iadzngC.exe
  2⤵
  PID:10724
- C:\Windows\System\xhlUoFR.exe
  C:\Windows\System\xhlUoFR.exe
  2⤵
  PID:10744
- C:\Windows\System\fJtZkdk.exe
  C:\Windows\System\fJtZkdk.exe
  2⤵
  PID:10760
- C:\Windows\System\TNgksXz.exe
  C:\Windows\System\TNgksXz.exe
  2⤵
  PID:10788
- C:\Windows\System\NvkZQex.exe
  C:\Windows\System\NvkZQex.exe
  2⤵
  PID:10812
- C:\Windows\System\LANbQmq.exe
  C:\Windows\System\LANbQmq.exe
  2⤵
  PID:10836
- C:\Windows\System\WGSeqCG.exe
  C:\Windows\System\WGSeqCG.exe
  2⤵
  PID:10864
- C:\Windows\System\ERNwVpI.exe
  C:\Windows\System\ERNwVpI.exe
  2⤵
  PID:10880
- C:\Windows\System\ZeqfBHF.exe
  C:\Windows\System\ZeqfBHF.exe
  2⤵
  PID:10916
- C:\Windows\System\leaAnDk.exe
  C:\Windows\System\leaAnDk.exe
  2⤵
  PID:10944
- C:\Windows\System\IBSIZsY.exe
  C:\Windows\System\IBSIZsY.exe
  2⤵
  PID:10980
- C:\Windows\System\qZiOTpI.exe
  C:\Windows\System\qZiOTpI.exe
  2⤵
  PID:11000
- C:\Windows\System\rhkbcCD.exe
  C:\Windows\System\rhkbcCD.exe
  2⤵
  PID:11028
- C:\Windows\System\jyukesm.exe
  C:\Windows\System\jyukesm.exe
  2⤵
  PID:11048
- C:\Windows\System\WCaUZkp.exe
  C:\Windows\System\WCaUZkp.exe
  2⤵
  PID:11072
- C:\Windows\System\eAQlYpQ.exe
  C:\Windows\System\eAQlYpQ.exe
  2⤵
  PID:11096
- C:\Windows\System\JlLiBti.exe
  C:\Windows\System\JlLiBti.exe
  2⤵
  PID:11116
- C:\Windows\System\LpvIfSs.exe
  C:\Windows\System\LpvIfSs.exe
  2⤵
  PID:11144
- C:\Windows\System\XxQnRkU.exe
  C:\Windows\System\XxQnRkU.exe
  2⤵
  PID:11164
- C:\Windows\System\fAHrQyo.exe
  C:\Windows\System\fAHrQyo.exe
  2⤵
  PID:11184
- C:\Windows\System\rTwaPNU.exe
  C:\Windows\System\rTwaPNU.exe
  2⤵
  PID:11204
- C:\Windows\System\sVkKpMB.exe
  C:\Windows\System\sVkKpMB.exe
  2⤵
  PID:11224
- C:\Windows\System\shvUlHc.exe
  C:\Windows\System\shvUlHc.exe
  2⤵
  PID:11240
- C:\Windows\System\rjyCkzx.exe
  C:\Windows\System\rjyCkzx.exe
  2⤵
  PID:8848
- C:\Windows\System\xFFgRII.exe
  C:\Windows\System\xFFgRII.exe
  2⤵
  PID:6816
- C:\Windows\System\YmjdDsy.exe
  C:\Windows\System\YmjdDsy.exe
  2⤵
  PID:9240
- C:\Windows\System\ZvLldkM.exe
  C:\Windows\System\ZvLldkM.exe
  2⤵
  PID:9376
- C:\Windows\System\JFmINCP.exe
  C:\Windows\System\JFmINCP.exe
  2⤵
  PID:9532
- C:\Windows\System\rvfUvPV.exe
  C:\Windows\System\rvfUvPV.exe
  2⤵
  PID:8516
- C:\Windows\System\bxsoQFK.exe
  C:\Windows\System\bxsoQFK.exe
  2⤵
  PID:9660
- C:\Windows\System\onVafFr.exe
  C:\Windows\System\onVafFr.exe
  2⤵
  PID:9760
- C:\Windows\System\yjVZAGy.exe
  C:\Windows\System\yjVZAGy.exe
  2⤵
  PID:9852
- C:\Windows\System\hrxUASN.exe
  C:\Windows\System\hrxUASN.exe
  2⤵
  PID:9932
- C:\Windows\System\yCAOsNr.exe
  C:\Windows\System\yCAOsNr.exe
  2⤵
  PID:10104
- C:\Windows\System\AAfOnLV.exe
  C:\Windows\System\AAfOnLV.exe
  2⤵
  PID:9176
- C:\Windows\System\MePxIBF.exe
  C:\Windows\System\MePxIBF.exe
  2⤵
  PID:8968
- C:\Windows\System\RjvTPIF.exe
  C:\Windows\System\RjvTPIF.exe
  2⤵
  PID:7356
- C:\Windows\System\SWVIFQQ.exe
  C:\Windows\System\SWVIFQQ.exe
  2⤵
  PID:7552
- C:\Windows\System\dBLQpBc.exe
  C:\Windows\System\dBLQpBc.exe
  2⤵
  PID:9560
- C:\Windows\System\hRddGxH.exe
  C:\Windows\System\hRddGxH.exe
  2⤵
  PID:8844
- C:\Windows\System\GRWosTw.exe
  C:\Windows\System\GRWosTw.exe
  2⤵
  PID:7456
- C:\Windows\System\SARyhJk.exe
  C:\Windows\System\SARyhJk.exe
  2⤵
  PID:10216
- C:\Windows\System\MRZipoV.exe
  C:\Windows\System\MRZipoV.exe
  2⤵
  PID:10068
- C:\Windows\System\LZigXvv.exe
  C:\Windows\System\LZigXvv.exe
  2⤵
  PID:9936
- C:\Windows\System\MIBeNRr.exe
  C:\Windows\System\MIBeNRr.exe
  2⤵
  PID:9516
- C:\Windows\System\zPaqLxU.exe
  C:\Windows\System\zPaqLxU.exe
  2⤵
  PID:10340
- C:\Windows\System\TFBjiFE.exe
  C:\Windows\System\TFBjiFE.exe
  2⤵
  PID:10392
- C:\Windows\System\uEXKsxx.exe
  C:\Windows\System\uEXKsxx.exe
  2⤵
  PID:10444
- C:\Windows\System\cVsGPga.exe
  C:\Windows\System\cVsGPga.exe
  2⤵
  PID:7844
- C:\Windows\System\RDvxTYb.exe
  C:\Windows\System\RDvxTYb.exe
  2⤵
  PID:11320
- C:\Windows\System\vHyyfDC.exe
  C:\Windows\System\vHyyfDC.exe
  2⤵
  PID:11336
- C:\Windows\System\ZYqCwzS.exe
  C:\Windows\System\ZYqCwzS.exe
  2⤵
  PID:11352
- C:\Windows\System\JGHLTlr.exe
  C:\Windows\System\JGHLTlr.exe
  2⤵
  PID:11372
- C:\Windows\System\OChOvfo.exe
  C:\Windows\System\OChOvfo.exe
  2⤵
  PID:11404
- C:\Windows\System\qOqoxGg.exe
  C:\Windows\System\qOqoxGg.exe
  2⤵
  PID:11428
- C:\Windows\System\ClhYyvE.exe
  C:\Windows\System\ClhYyvE.exe
  2⤵
  PID:11444
- C:\Windows\System\VWXqYPe.exe
  C:\Windows\System\VWXqYPe.exe
  2⤵
  PID:11464
- C:\Windows\System\voEwEmc.exe
  C:\Windows\System\voEwEmc.exe
  2⤵
  PID:11480
- C:\Windows\System\dsCqrus.exe
  C:\Windows\System\dsCqrus.exe
  2⤵
  PID:11500
- C:\Windows\System\HsSOEOt.exe
  C:\Windows\System\HsSOEOt.exe
  2⤵
  PID:11520
- C:\Windows\System\VQbLfso.exe
  C:\Windows\System\VQbLfso.exe
  2⤵
  PID:11592
- C:\Windows\System\NDwygIQ.exe
  C:\Windows\System\NDwygIQ.exe
  2⤵
  PID:11608
- C:\Windows\System\Xnvzjtu.exe
  C:\Windows\System\Xnvzjtu.exe
  2⤵
  PID:11624
- C:\Windows\System\udizICR.exe
  C:\Windows\System\udizICR.exe
  2⤵
  PID:11640
- C:\Windows\System\fDRJNTg.exe
  C:\Windows\System\fDRJNTg.exe
  2⤵
  PID:11656
- C:\Windows\System\eRDnLGN.exe
  C:\Windows\System\eRDnLGN.exe
  2⤵
  PID:11676
- C:\Windows\System\fihRGGX.exe
  C:\Windows\System\fihRGGX.exe
  2⤵
  PID:11692
- C:\Windows\System\KERJfJf.exe
  C:\Windows\System\KERJfJf.exe
  2⤵
  PID:11712
- C:\Windows\System\rktcYSd.exe
  C:\Windows\System\rktcYSd.exe
  2⤵
  PID:11736
- C:\Windows\System\gnpJQBq.exe
  C:\Windows\System\gnpJQBq.exe
  2⤵
  PID:11824
- C:\Windows\System\WnERiKt.exe
  C:\Windows\System\WnERiKt.exe
  2⤵
  PID:11848
- C:\Windows\System\XZOYwkl.exe
  C:\Windows\System\XZOYwkl.exe
  2⤵
  PID:11872
- C:\Windows\System\LJbleSY.exe
  C:\Windows\System\LJbleSY.exe
  2⤵
  PID:11896
- C:\Windows\System\VCdnUYm.exe
  C:\Windows\System\VCdnUYm.exe
  2⤵
  PID:12140
- C:\Windows\System\qbbVkHh.exe
  C:\Windows\System\qbbVkHh.exe
  2⤵
  PID:7532
- C:\Windows\System\Jkoxlsd.exe
  C:\Windows\System\Jkoxlsd.exe
  2⤵
  PID:9120
- C:\Windows\System\ofrkydA.exe
  C:\Windows\System\ofrkydA.exe
  2⤵
  PID:7200
- C:\Windows\System\IyfpUeu.exe
  C:\Windows\System\IyfpUeu.exe
  2⤵
  PID:11232
- C:\Windows\System\ayhEEzW.exe
  C:\Windows\System\ayhEEzW.exe
  2⤵
  PID:8820
- C:\Windows\System\NTIzNwk.exe
  C:\Windows\System\NTIzNwk.exe
  2⤵
  PID:9232
- C:\Windows\System\yTDVnHd.exe
  C:\Windows\System\yTDVnHd.exe
  2⤵
  PID:9652
- C:\Windows\System\AJlfcpG.exe
  C:\Windows\System\AJlfcpG.exe
  2⤵
  PID:9440
- C:\Windows\System\xTjBehb.exe
  C:\Windows\System\xTjBehb.exe
  2⤵
  PID:10256
- C:\Windows\System\UaaLxOD.exe
  C:\Windows\System\UaaLxOD.exe
  2⤵
  PID:10296
- C:\Windows\System\TNfwreh.exe
  C:\Windows\System\TNfwreh.exe
  2⤵
  PID:10280
- C:\Windows\System\hxxlGzq.exe
  C:\Windows\System\hxxlGzq.exe
  2⤵
  PID:10360
- C:\Windows\System\ApHGSkW.exe
  C:\Windows\System\ApHGSkW.exe
  2⤵
  PID:8740
- C:\Windows\System\xHxtXgj.exe
  C:\Windows\System\xHxtXgj.exe
  2⤵
  PID:10532
- C:\Windows\System\LCMIuvW.exe
  C:\Windows\System\LCMIuvW.exe
  2⤵
  PID:10472
- C:\Windows\System\hahRtMO.exe
  C:\Windows\System\hahRtMO.exe
  2⤵
  PID:8048
- C:\Windows\System\pNWDpaL.exe
  C:\Windows\System\pNWDpaL.exe
  2⤵
  PID:6924
- C:\Windows\System\UdKBTBx.exe
  C:\Windows\System\UdKBTBx.exe
  2⤵
  PID:11396
- C:\Windows\System\cZMOtMZ.exe
  C:\Windows\System\cZMOtMZ.exe
  2⤵
  PID:7060
- C:\Windows\System\MjrkTXl.exe
  C:\Windows\System\MjrkTXl.exe
  2⤵
  PID:11452
- C:\Windows\System\MINzOwt.exe
  C:\Windows\System\MINzOwt.exe
  2⤵
  PID:11492
- C:\Windows\System\sdiOVKf.exe
  C:\Windows\System\sdiOVKf.exe
  2⤵
  PID:7400
- C:\Windows\System\sktqEuM.exe
  C:\Windows\System\sktqEuM.exe
  2⤵
  PID:10584
- C:\Windows\System\FXifPEw.exe
  C:\Windows\System\FXifPEw.exe
  2⤵
  PID:10556
- C:\Windows\System\SegcNGq.exe
  C:\Windows\System\SegcNGq.exe
  2⤵
  PID:10620
- C:\Windows\System\QNfeSgR.exe
  C:\Windows\System\QNfeSgR.exe
  2⤵
  PID:10660
- C:\Windows\System\nCDyIIo.exe
  C:\Windows\System\nCDyIIo.exe
  2⤵
  PID:10700
- C:\Windows\System\JVtHjYl.exe
  C:\Windows\System\JVtHjYl.exe
  2⤵
  PID:10752
- C:\Windows\System\gUfyVoC.exe
  C:\Windows\System\gUfyVoC.exe
  2⤵
  PID:10804
- C:\Windows\System\uyrKUqu.exe
  C:\Windows\System\uyrKUqu.exe
  2⤵
  PID:10852
- C:\Windows\System\bmNsRAS.exe
  C:\Windows\System\bmNsRAS.exe
  2⤵
  PID:10896
- C:\Windows\System\bnKAnCl.exe
  C:\Windows\System\bnKAnCl.exe
  2⤵
  PID:10968
- C:\Windows\System\GaBqxvB.exe
  C:\Windows\System\GaBqxvB.exe
  2⤵
  PID:11040
- C:\Windows\System\FlhZZiq.exe
  C:\Windows\System\FlhZZiq.exe
  2⤵
  PID:11080
- C:\Windows\System\XsyxqKq.exe
  C:\Windows\System\XsyxqKq.exe
  2⤵
  PID:11112
- C:\Windows\System\MuFyRCf.exe
  C:\Windows\System\MuFyRCf.exe
  2⤵
  PID:11172
- C:\Windows\System\pxELYdO.exe
  C:\Windows\System\pxELYdO.exe
  2⤵
  PID:11912
- C:\Windows\System\tSWcHkJ.exe
  C:\Windows\System\tSWcHkJ.exe
  2⤵
  PID:11368
- C:\Windows\System\qrwOwHH.exe
  C:\Windows\System\qrwOwHH.exe
  2⤵
  PID:9432
- C:\Windows\System\QnyeulD.exe
  C:\Windows\System\QnyeulD.exe
  2⤵
  PID:11952
- C:\Windows\System\ETnZLDH.exe
  C:\Windows\System\ETnZLDH.exe
  2⤵
  PID:9160
- C:\Windows\System\vSdmfoa.exe
  C:\Windows\System\vSdmfoa.exe
  2⤵
  PID:11616
- C:\Windows\System\mIsBwSY.exe
  C:\Windows\System\mIsBwSY.exe
  2⤵
  PID:11700
- C:\Windows\System\dSfquDO.exe
  C:\Windows\System\dSfquDO.exe
  2⤵
  PID:7916
- C:\Windows\System\SQkgjlJ.exe
  C:\Windows\System\SQkgjlJ.exe
  2⤵
  PID:10160
- C:\Windows\System\LqdNxas.exe
  C:\Windows\System\LqdNxas.exe
  2⤵
  PID:9956
- C:\Windows\System\bNchrFb.exe
  C:\Windows\System\bNchrFb.exe
  2⤵
  PID:9844
- C:\Windows\System\JjYHUOI.exe
  C:\Windows\System\JjYHUOI.exe
  2⤵
  PID:10388
- C:\Windows\System\FmoPVlf.exe
  C:\Windows\System\FmoPVlf.exe
  2⤵
  PID:12304
- C:\Windows\System\BXTtzAv.exe
  C:\Windows\System\BXTtzAv.exe
  2⤵
  PID:12336
- C:\Windows\System\kXNOFnJ.exe
  C:\Windows\System\kXNOFnJ.exe
  2⤵
  PID:12352
- C:\Windows\System\enhhctd.exe
  C:\Windows\System\enhhctd.exe
  2⤵
  PID:12376
- C:\Windows\System\YYiIhJt.exe
  C:\Windows\System\YYiIhJt.exe
  2⤵
  PID:12400
- C:\Windows\System\QCFQCrS.exe
  C:\Windows\System\QCFQCrS.exe
  2⤵
  PID:12424
- C:\Windows\System\HMMEXAA.exe
  C:\Windows\System\HMMEXAA.exe
  2⤵
  PID:12448
- C:\Windows\System\UTaZKTc.exe
  C:\Windows\System\UTaZKTc.exe
  2⤵
  PID:12472
- C:\Windows\System\spPZfnN.exe
  C:\Windows\System\spPZfnN.exe
  2⤵
  PID:12492
- C:\Windows\System\MDKPDlA.exe
  C:\Windows\System\MDKPDlA.exe
  2⤵
  PID:12516
- C:\Windows\System\padKXaU.exe
  C:\Windows\System\padKXaU.exe
  2⤵
  PID:12540
- C:\Windows\System\wHVAtCk.exe
  C:\Windows\System\wHVAtCk.exe
  2⤵
  PID:12564
- C:\Windows\System\UZJezMb.exe
  C:\Windows\System\UZJezMb.exe
  2⤵
  PID:12588
- C:\Windows\System\WERedPS.exe
  C:\Windows\System\WERedPS.exe
  2⤵
  PID:12612
- C:\Windows\System\HErgzOa.exe
  C:\Windows\System\HErgzOa.exe
  2⤵
  PID:12636
- C:\Windows\System\xjRhfaa.exe
  C:\Windows\System\xjRhfaa.exe
  2⤵
  PID:12656
- C:\Windows\System\xvOhJnA.exe
  C:\Windows\System\xvOhJnA.exe
  2⤵
  PID:12680
- C:\Windows\System\rCVQjdS.exe
  C:\Windows\System\rCVQjdS.exe
  2⤵
  PID:12744
- C:\Windows\System\RPJZawx.exe
  C:\Windows\System\RPJZawx.exe
  2⤵
  PID:12760
- C:\Windows\System\saSRyvY.exe
  C:\Windows\System\saSRyvY.exe
  2⤵
  PID:12812
- C:\Windows\System\pdilPgJ.exe
  C:\Windows\System\pdilPgJ.exe
  2⤵
  PID:12836
- C:\Windows\System\LUKokCC.exe
  C:\Windows\System\LUKokCC.exe
  2⤵
  PID:12860
- C:\Windows\System\AgmBdUm.exe
  C:\Windows\System\AgmBdUm.exe
  2⤵
  PID:12896
- C:\Windows\System\aAcvxBg.exe
  C:\Windows\System\aAcvxBg.exe
  2⤵
  PID:13280
- C:\Windows\System\WykytUK.exe
  C:\Windows\System\WykytUK.exe
  2⤵
  PID:12232
- C:\Windows\System\WmqpFdG.exe
  C:\Windows\System\WmqpFdG.exe
  2⤵
  PID:11364
- C:\Windows\System\HsdygTs.exe
  C:\Windows\System\HsdygTs.exe
  2⤵
  PID:11152
- C:\Windows\System\FjErSYX.exe
  C:\Windows\System\FjErSYX.exe
  2⤵
  PID:11904
- C:\Windows\System\IeVIYFu.exe
  C:\Windows\System\IeVIYFu.exe
  2⤵
  PID:12216
- C:\Windows\System\DBNHLCE.exe
  C:\Windows\System\DBNHLCE.exe
  2⤵
  PID:12740
- C:\Windows\System\UmUiDYU.exe
  C:\Windows\System\UmUiDYU.exe
  2⤵
  PID:9700
- C:\Windows\System\YcrBNNu.exe
  C:\Windows\System\YcrBNNu.exe
  2⤵
  PID:12384
- C:\Windows\System\gsXqEvV.exe
  C:\Windows\System\gsXqEvV.exe
  2⤵
  PID:2776
- C:\Windows\System\wgKATbE.exe
  C:\Windows\System\wgKATbE.exe
  2⤵
  PID:13196
- C:\Windows\System\hVwrzPC.exe
  C:\Windows\System\hVwrzPC.exe
  2⤵
  PID:13224
- C:\Windows\System\wYpStFE.exe
  C:\Windows\System\wYpStFE.exe
  2⤵
  PID:11920
- C:\Windows\System\sFepnjE.exe
  C:\Windows\System\sFepnjE.exe
  2⤵
  PID:9996
- C:\Windows\System\VvNkxhW.exe
  C:\Windows\System\VvNkxhW.exe
  2⤵
  PID:4600
- C:\Windows\System\Bexksog.exe
  C:\Windows\System\Bexksog.exe
  2⤵
  PID:12244
- C:\Windows\System\ambEYCf.exe
  C:\Windows\System\ambEYCf.exe
  2⤵
  PID:13244
- C:\Windows\System\LQmVmsD.exe
  C:\Windows\System\LQmVmsD.exe
  2⤵
  PID:9080
- C:\Windows\System\PlSUDXI.exe
  C:\Windows\System\PlSUDXI.exe
  2⤵
  PID:12136
- C:\Windows\System\blLyCrL.exe
  C:\Windows\System\blLyCrL.exe
  2⤵
  PID:10464
- C:\Windows\System\ZAEjBPs.exe
  C:\Windows\System\ZAEjBPs.exe
  2⤵
  PID:7668
- C:\Windows\System\otvHyLR.exe
  C:\Windows\System\otvHyLR.exe
  2⤵
  PID:11216
- C:\Windows\System\XYNqONs.exe
  C:\Windows\System\XYNqONs.exe
  2⤵
  PID:10632
- C:\Windows\System\HotOnWj.exe
  C:\Windows\System\HotOnWj.exe
  2⤵
  PID:10780
- C:\Windows\System\IuwdAbG.exe
  C:\Windows\System\IuwdAbG.exe
  2⤵
  PID:13240
- C:\Windows\System\nzgqfam.exe
  C:\Windows\System\nzgqfam.exe
  2⤵
  PID:12620
- C:\Windows\System\cQSmXGB.exe
  C:\Windows\System\cQSmXGB.exe
  2⤵
  PID:12280
- C:\Windows\System\tGtcAns.exe
  C:\Windows\System\tGtcAns.exe
  2⤵
  PID:10996
- C:\Windows\System\SlNBvCl.exe
  C:\Windows\System\SlNBvCl.exe
  2⤵
  PID:13052
- C:\Windows\System\SSUduMs.exe
  C:\Windows\System\SSUduMs.exe
  2⤵
  PID:12188
- C:\Windows\System\NRUZMWB.exe
  C:\Windows\System\NRUZMWB.exe
  2⤵
  PID:11472
- C:\Windows\System\vTGZzQP.exe
  C:\Windows\System\vTGZzQP.exe
  2⤵
  PID:12236
- C:\Windows\System\Cexhsiu.exe
  C:\Windows\System\Cexhsiu.exe
  2⤵
  PID:9356
- C:\Windows\System\aSHSFLP.exe
  C:\Windows\System\aSHSFLP.exe
  2⤵
  PID:10420
- C:\Windows\System\YOtGlsi.exe
  C:\Windows\System\YOtGlsi.exe
  2⤵
  PID:9372
- C:\Windows\System\aEuuPsT.exe
  C:\Windows\System\aEuuPsT.exe
  2⤵
  PID:11664
- C:\Windows\System\NyUiyoE.exe
  C:\Windows\System\NyUiyoE.exe
  2⤵
  PID:9812
- C:\Windows\System\nefCvCQ.exe
  C:\Windows\System\nefCvCQ.exe
  2⤵
  PID:12804
- C:\Windows\System\SXmIrNh.exe
  C:\Windows\System\SXmIrNh.exe
  2⤵
  PID:4488
- C:\Windows\System\FbMbQYj.exe
  C:\Windows\System\FbMbQYj.exe
  2⤵
  PID:11068
- C:\Windows\System\SZOmPdS.exe
  C:\Windows\System\SZOmPdS.exe
  2⤵
  PID:8264
- C:\Windows\System\wuxBuiB.exe
  C:\Windows\System\wuxBuiB.exe
  2⤵
  PID:11488
- C:\Windows\System\VzcXEIU.exe
  C:\Windows\System\VzcXEIU.exe
  2⤵
  PID:10684
- C:\Windows\System\MwqIHsd.exe
  C:\Windows\System\MwqIHsd.exe
  2⤵
  PID:12324
- C:\Windows\System\PCwellW.exe
  C:\Windows\System\PCwellW.exe
  2⤵
  PID:12192
- C:\Windows\System\ykzdkzk.exe
  C:\Windows\System\ykzdkzk.exe
  2⤵
  PID:13064
- C:\Windows\System\tMnZmeD.exe
  C:\Windows\System\tMnZmeD.exe
  2⤵
  PID:12756
- C:\Windows\System\tQGGbPv.exe
  C:\Windows\System\tQGGbPv.exe
  2⤵
  PID:13212
- C:\Windows\System\hhTRomT.exe
  C:\Windows\System\hhTRomT.exe
  2⤵
  PID:9588
- C:\Windows\System\SwtAgTF.exe
  C:\Windows\System\SwtAgTF.exe
  2⤵
  PID:1492
- C:\Windows\System\kVCbVRr.exe
  C:\Windows\System\kVCbVRr.exe
  2⤵
  PID:6568
- C:\Windows\System\mHAkUao.exe
  C:\Windows\System\mHAkUao.exe
  2⤵
  PID:2856
- C:\Windows\System\cqadnfq.exe
  C:\Windows\System\cqadnfq.exe
  2⤵
  PID:13252
- C:\Windows\System\MFBxCZW.exe
  C:\Windows\System\MFBxCZW.exe
  2⤵
  PID:12904
- C:\Windows\System\UZfWCki.exe
  C:\Windows\System\UZfWCki.exe
  2⤵
  PID:12392
- C:\Windows\System\LRUbjAL.exe
  C:\Windows\System\LRUbjAL.exe
  2⤵
  PID:13016
- C:\Windows\System\GHUBWca.exe
  C:\Windows\System\GHUBWca.exe
  2⤵
  PID:9536
- C:\Windows\System\MmtyUXb.exe
  C:\Windows\System\MmtyUXb.exe
  2⤵
  PID:1664
- C:\Windows\System\zgcjuOl.exe
  C:\Windows\System\zgcjuOl.exe
  2⤵
  PID:10888
- C:\Windows\System\oLlpDCW.exe
  C:\Windows\System\oLlpDCW.exe
  2⤵
  PID:12252
- C:\Windows\System\bqLsfCW.exe
  C:\Windows\System\bqLsfCW.exe
  2⤵
  PID:12196
- C:\Windows\System\seRkcLV.exe
  C:\Windows\System\seRkcLV.exe
  2⤵
  PID:4120
- C:\Windows\System\NUozHAM.exe
  C:\Windows\System\NUozHAM.exe
  2⤵
  PID:12780
- C:\Windows\System\XzAjuhg.exe
  C:\Windows\System\XzAjuhg.exe
  2⤵
  PID:13144
- C:\Windows\System\UsVPWyc.exe
  C:\Windows\System\UsVPWyc.exe
  2⤵
  PID:12776
- C:\Windows\System\cZcWDXa.exe
  C:\Windows\System\cZcWDXa.exe
  2⤵
  PID:11344
- C:\Windows\System\RBNcPTC.exe
  C:\Windows\System\RBNcPTC.exe
  2⤵
  PID:12168
- C:\Windows\System\lKrGPVN.exe
  C:\Windows\System\lKrGPVN.exe
  2⤵
  PID:12548
- C:\Windows\System\rlzbAPQ.exe
  C:\Windows\System\rlzbAPQ.exe
  2⤵
  PID:12524
- C:\Windows\System\VXxMQeL.exe
  C:\Windows\System\VXxMQeL.exe
  2⤵
  PID:4376
- C:\Windows\System\ReELZzS.exe
  C:\Windows\System\ReELZzS.exe
  2⤵
  PID:11008
- C:\Windows\System\bauRbhK.exe
  C:\Windows\System\bauRbhK.exe
  2⤵
  PID:10740
- C:\Windows\System\mcgcuxw.exe
  C:\Windows\System\mcgcuxw.exe
  2⤵
  PID:12296
- C:\Windows\System\sQOQIiu.exe
  C:\Windows\System\sQOQIiu.exe
  2⤵
  PID:8316
- C:\Windows\System\Dpnhyrp.exe
  C:\Windows\System\Dpnhyrp.exe
  2⤵
  PID:1432
- C:\Windows\System\JBMSgXx.exe
  C:\Windows\System\JBMSgXx.exe
  2⤵
  PID:13264
- C:\Windows\System\lwUzoRO.exe
  C:\Windows\System\lwUzoRO.exe
  2⤵
  PID:13320
- C:\Windows\System\ULBoqja.exe
  C:\Windows\System\ULBoqja.exe
  2⤵
  PID:13336
- C:\Windows\System\LEJqJCA.exe
  C:\Windows\System\LEJqJCA.exe
  2⤵
  PID:13356
- C:\Windows\System\HOtFOFH.exe
  C:\Windows\System\HOtFOFH.exe
  2⤵
  PID:13384
- C:\Windows\System\ELtfiEU.exe
  C:\Windows\System\ELtfiEU.exe
  2⤵
  PID:13408
- C:\Windows\System\vzEnaMP.exe
  C:\Windows\System\vzEnaMP.exe
  2⤵
  PID:13428
- C:\Windows\System\MdqhQdn.exe
  C:\Windows\System\MdqhQdn.exe
  2⤵
  PID:13448
- C:\Windows\System\PypiXzX.exe
  C:\Windows\System\PypiXzX.exe
  2⤵
  PID:13472
- C:\Windows\System\GxtpcfH.exe
  C:\Windows\System\GxtpcfH.exe
  2⤵
  PID:13492
- C:\Windows\System\yHYECzv.exe
  C:\Windows\System\yHYECzv.exe
  2⤵
  PID:13512
- C:\Windows\System\PMxsHhp.exe
  C:\Windows\System\PMxsHhp.exe
  2⤵
  PID:13532
- C:\Windows\System\NhGgcHu.exe
  C:\Windows\System\NhGgcHu.exe
  2⤵
  PID:13552
- C:\Windows\System\bbAfgss.exe
  C:\Windows\System\bbAfgss.exe
  2⤵
  PID:13568
- C:\Windows\System\AcjYNeR.exe
  C:\Windows\System\AcjYNeR.exe
  2⤵
  PID:13588
- C:\Windows\System\iVzbqdp.exe
  C:\Windows\System\iVzbqdp.exe
  2⤵
  PID:13624
- C:\Windows\System\Tichikn.exe
  C:\Windows\System\Tichikn.exe
  2⤵
  PID:13648
- C:\Windows\System\KpzsVDD.exe
  C:\Windows\System\KpzsVDD.exe
  2⤵
  PID:13736
- C:\Windows\System\ejvZkZB.exe
  C:\Windows\System\ejvZkZB.exe
  2⤵
  PID:13760
- C:\Windows\System\mJcyoDb.exe
  C:\Windows\System\mJcyoDb.exe
  2⤵
  PID:13780
- C:\Windows\System\FPGtEpf.exe
  C:\Windows\System\FPGtEpf.exe
  2⤵
  PID:13848
- C:\Windows\System\XReFEoW.exe
  C:\Windows\System\XReFEoW.exe
  2⤵
  PID:13932
- C:\Windows\System\NbjKSdo.exe
  C:\Windows\System\NbjKSdo.exe
  2⤵
  PID:14148
- C:\Windows\System\mwkYwlk.exe
  C:\Windows\System\mwkYwlk.exe
  2⤵
  PID:14208
- C:\Windows\System\WcDXVyD.exe
  C:\Windows\System\WcDXVyD.exe
  2⤵
  PID:14236
- C:\Windows\System\cmqwCjv.exe
  C:\Windows\System\cmqwCjv.exe
  2⤵
  PID:13136
- C:\Windows\System\GriaJip.exe
  C:\Windows\System\GriaJip.exe
  2⤵
  PID:13308
- C:\Windows\System\JHyuGan.exe
  C:\Windows\System\JHyuGan.exe
  2⤵
  PID:9900
- C:\Windows\System\KzpAiun.exe
  C:\Windows\System\KzpAiun.exe
  2⤵
  PID:13348
- C:\Windows\System\LIpZdph.exe
  C:\Windows\System\LIpZdph.exe
  2⤵
  PID:13456
- C:\Windows\System\jHpSimG.exe
  C:\Windows\System\jHpSimG.exe
  2⤵
  PID:13640
- C:\Windows\System\VRUdcnk.exe
  C:\Windows\System\VRUdcnk.exe
  2⤵
  PID:13820
- C:\Windows\System\kiAYhtw.exe
  C:\Windows\System\kiAYhtw.exe
  2⤵
  PID:13928
- C:\Windows\System\NzQNjnK.exe
  C:\Windows\System\NzQNjnK.exe
  2⤵
  PID:13864
- C:\Windows\System\JhlwraX.exe
  C:\Windows\System\JhlwraX.exe
  2⤵
  PID:14008
- C:\Windows\System\ZmiBjqI.exe
  C:\Windows\System\ZmiBjqI.exe
  2⤵
  PID:14244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0sctesvr.qff.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AvZoSBE.exe

Filesize
2.0MB

MD5
8e8c1e4a56537ed9618bb1d928471fa1

SHA1
59ff197d79bc9eb57ee72e269368654d807f0be2

SHA256
ba10e9c11a2148e9289ab71cbcd8a4ce4c226b027840cd51613371f9f73e1f7d

SHA512
74569f6d894d8ec6f04fc58f4edbc743a665b9ecf4c7313172b0cff026d5c0042ac057ece6974014bd683fb2f40d142a08b735b6bcf4c4ce91a46fbbdd496668

Download Submit
C:\Windows\System\BgveFEs.exe

Filesize
2.0MB

MD5
be7cd7b600cde3bd6146b2aeb4372610

SHA1
664a5117b630a4e23348f0fc32c1b3376bb8fd21

SHA256
9e335bb0cb2f7e0908b460a0ce14cf74341ebc873fd14b6de80b5577f6b004b3

SHA512
bcd8238ab8304906fd6521a8fff1657379fade9b50ccc3e335c8af8a4aa518d43504f0e5a43745515c7fd219abe07ba061a519d381f9da544ec7943b497cc3fc

Download Submit
C:\Windows\System\DIUqBOq.exe

Filesize
2.0MB

MD5
5e17bc112a7766e500e9ebef85ca5e92

SHA1
6be7b780d6ffb6861319ebf7fd1604ac921cd801

SHA256
438dc423ecb1348a1188b85546fc308d398c6166361c311ff62f8d4a1dd9cd28

SHA512
0210896ea954e89282f29d264a8e893c94dd7542acb49c77b2d748481489433edd4be6b2001cfd17528e7052fe6c072ae42ea6b8d655d0fde3e8ef5d1a4f27e0

Download Submit
C:\Windows\System\FvGauxl.exe

Filesize
2.0MB

MD5
4392f7b7a6ec633d6127859126599281

SHA1
db350af8d11ff23237febb490c66bc8d51745805

SHA256
320e9978cb5eb4c515cc4bcdb8d1c87cddaf7f35e2855746013458f1c6f213ed

SHA512
a4a7c79c10a3970e731fcf3e4652e31ddfeb59f53b94005122eb953ba1ae73a092f78a7f75e6368f62003f9db0549a5a8a6093961681f2544c792aab7ad8170f

Download Submit
C:\Windows\System\HbbcICf.exe

Filesize
2.0MB

MD5
de739b1fd0503a4bf1a208e06dea2ba1

SHA1
feb7ea131950afc701412c866c14d1ed8527049a

SHA256
3f0330c84688ee04e6c148bf40b0a50861b20e9a37394248f3fe7b1f1ffa4f8b

SHA512
17ee4d44eddb77e899fabaedc13573eda03cfbc467f5cd6c64b5f9d93f81d6ec347c3651d776c3037badb08863d856cbac45130566d6c002464e167b0e82c56f

Download Submit
C:\Windows\System\IOLKFcA.exe

Filesize
2.0MB

MD5
07d29d32aabd5b247c021a6e361ea30b

SHA1
fb8b168bd147fbe58194136c0d4051ea3a833db1

SHA256
8e5df3c3755a3149b0dd8a571e36f069adc269182f494cc085554bfcb747ec87

SHA512
d558f6ee01a3ee8aa50215ca67c260a9d92dcf05dd034dd4be45c5a740ad1533ad235861631d41ce6346bf19e38b24e41b2299f02e589072efd966b2f7eeb2b5

Download Submit
C:\Windows\System\Ipaekrk.exe

Filesize
2.1MB

MD5
f31046ab2ef599b8a784961eb47b749c

SHA1
f7b67b057b8c0996a7b87b611bd90cec9ab11971

SHA256
85e586986fbcd90720f639d933759ffaa91220e88e5506eae21120bc11217f77

SHA512
bbb9dec6b76b5df4e1f1a6a8a49929a2e62365ffc3d904da5a81613da6fe2c667213fdc8095e76c683784f4da39ea162669e87901d8172d3a8e3e4d38ff6b069

Download Submit
C:\Windows\System\JCFCQkm.exe

Filesize
2.0MB

MD5
badc5e82b6413e4ee64a8d0664e62552

SHA1
206a3b481fc1b23003912c2b6689f5517570ace5

SHA256
80f6cae8abd34b450fbe8a7740286ffc4261086349deaa7ff232e74be360f6e8

SHA512
2236ee68d4a4f469ff7367172c614c4b3748583c428640299ede7d9e54eb9048504469a847e5ff3f097c75904e5c9c0f0ef63d6f3e75fb4646bc686f0170696b

Download Submit
C:\Windows\System\JdHVkuW.exe

Filesize
2.0MB

MD5
ffd260d29db9dc08addb2c6141a0e0e3

SHA1
ba209364e9f36c63a976a97aa3547fe0c089d105

SHA256
00af8bf3d8ac872a70046835308197510495c0782488792475461359ca07aca4

SHA512
04da449fcecaf1266417f0c6d72f4409878dbb677f1ef07f2d3154d150c43293d8c9f64d56516d6b206022df2b6152480152defcb90acb0c4fc6899756ea5483

Download Submit
C:\Windows\System\KMgSjPq.exe

Filesize
2.0MB

MD5
948b364cd99481b5cb350ceb44d5e805

SHA1
4647681a1428415819e6cf828f4236eb665a9496

SHA256
07285218c6d3b658ec35e17c8f52c1b306fb88e4eeef02f5d4e038ed1cc191f2

SHA512
623a9c3cae5e13bec064e016579298a8d5912194196a082ab7f6c4b224a3d79feffce52eddecc2fe662a15b7e2955afc74a645a09f6577ce735f21651d6933d1

Download Submit
C:\Windows\System\NRYygEX.exe

Filesize
2.0MB

MD5
03082a97a9dfb3f27bdd67f9c190f4d8

SHA1
9cdedbbe0da828e092cecdee9f818f5773bbd4ec

SHA256
506dee228fcf22018eb70d7b6acb1f9c81475b16e07de269364b55e49c66af03

SHA512
ebf9654efba8d15f5636a35459beecd8b6c8e2e95b64c80ea19cf6e632151585d5f15bd7a2e5f0b8d9a56ba5f02d12da624392490967c1457676d8b7fb270746

Download Submit
C:\Windows\System\NTCVEXd.exe

Filesize
2.0MB

MD5
42b7b9853052f1a2f864da93d2ef8a27

SHA1
94c5c328f76daa7d4f452a444be1c0ef383cf902

SHA256
6313149b4bd513bee32e6c20727bb0b59aa0847c6e45f3a23b82aeeaa11a2097

SHA512
bc1b049f204cccb0edf1704708c6e96373537e75a1136d71c6a55334893441f091654f27af855698cb5c3a8dacb2faf659145421250053e0bb3707dde802e743

Download Submit
C:\Windows\System\ObMGKSE.exe

Filesize
2.0MB

MD5
84191a8523aa595094798e9f9586661a

SHA1
b05b5ccfa8ea0a5abbe0f29108076575f602b9ed

SHA256
52c3d77d354d80a6754910acce47f52b47f4b0e9b1bade93ae306ded77975281

SHA512
4891ebd5df4649832dd8347874b66882e22362e2a2bbab300646538b3edf3d48f4f3548be4c8ebfea054985fa3df06a07be8d612714356cfb5559c0998e16611

Download Submit
C:\Windows\System\PMkKLTz.exe

Filesize
2.0MB

MD5
0deba0c228836a4c8bb6662f2b969243

SHA1
0a45e9aa8b0e4c7676ae9d017fc07ee1b869b5fb

SHA256
c93c5c5d8ed983b5bf8c496cdd2523207786274e5eaf122e38f3af8701ca26d2

SHA512
1aaf43a583c7fbc79630850d52e11a0145826948b63df450bb56e41ac22322c691a7bc3bdb6b476dd97181d73abf47515c6d06deb8d25a778f655fca708fd103

Download Submit
C:\Windows\System\RRrmXOb.exe

Filesize
2.0MB

MD5
14684e66ee07408abf28f3550d5f662a

SHA1
0670118f2eadff2f21560382fcba9e993d9c8b7c

SHA256
a0a752a947df54b12f47af328d73345c97e2c9bc237bf5c9bdda785ca1d6be15

SHA512
da78a424e4d8d49b6fe8f6d571fd4de94eabfdd2a41a97e3c4a4a668131ef17711c68cdc9256e24da02b2a9891962f0d02cbf36348cbaa6ea00a302c52210ef7

Download Submit
C:\Windows\System\VCbwfiC.exe

Filesize
2.0MB

MD5
3b28b995a80e78faca68d5621990a62f

SHA1
ac9217e0abdb2023590b66ed32c8ce0a7c80f305

SHA256
8e01289bc40bd1bad00b962d0af63cd912aa461d02ac28bac9a9627cad1aec5d

SHA512
cbda4a18f3b036c0607ed25715ac4132bb8a5cd68ddff0ea418f58ec45fbed4da43ec7ab71e14b45a4ab7eceaea323e79121838c82b3efc7ebc45f44c39357ae

Download Submit
C:\Windows\System\XCGTxab.exe

Filesize
2.0MB

MD5
3ee0e90fa0147a8aa85ff28232b51457

SHA1
3e6074e8c53326ce3c8b30f09d3f6f675070dee4

SHA256
e084fbd26f258d36cb61ace054aa60209c2572b1fc4258f467f30b4f4b82a157

SHA512
0e4e354d8681389315f34e6fcffcbddae80167e9a2c37560362e4fb2dfbe392e93322d1b98a1866f8956443c9062478900910cddd14fb95037c5417a7cb3848d

Download Submit
C:\Windows\System\XCxbvXP.exe

Filesize
2.0MB

MD5
97c1b088eb4fbf35e5401b2673e012c8

SHA1
cba34a52439116acec61399c786b5dcb9b1d515e

SHA256
698b8b724133bdbc5377348f492a83f2afc586e041cc8e34cb64faa42d933bc2

SHA512
44aa11b80dbaf56ee34ade3a4e05897d700f4eb62b46f7424710d2e002f6eae4621e312fd2717d5b555575c87d1a200a82ed056687b5462ee746e2481a3c6525

Download Submit
C:\Windows\System\YxXkoFl.exe

Filesize
2.0MB

MD5
f5e797e5bf7c566dbd3ade6b05a8d6c2

SHA1
7e69076d2d1f517711665edadec8b7415f61732f

SHA256
8af561ff2d8a38218f7f7aa9b21ec2336e6a1e06b95b5b5936e3f79e3cd8b64f

SHA512
c0069d534d5ad925b2163ce78b5ffe6ce1c62bed551e62f7a4723d6730de3e109cbbfae6c6eab101e1462299a8ef308adde48213e14d535da11c70bbebaf2a0c

Download Submit
C:\Windows\System\aLVepRE.exe

Filesize
2.0MB

MD5
7ad4517af7648e318a8fb55e8cbfaaf0

SHA1
241aca392e65699be7a37f70b6496bbdc9005136

SHA256
f42620ae1a52f4865dca3e0c7de4eebd3cc9b69e07d2d7e427c6f68b12e9c7bc

SHA512
1e242ba7918fa0f1365440dd84dd972a100771201db8380b87f259f144f8e871ea810a8425cabda4e5c86ec50eee03ab8a07c9b87fee926c497ed64c4f5520fd

Download Submit
C:\Windows\System\dwDrRIG.exe

Filesize
2.0MB

MD5
ca7ac453867e98647561e20cba40aad4

SHA1
1078baf7ba021c2f9e6e59b1252d019a177bcd2f

SHA256
a5ba6069209506344dfa17bbca81a604fb9b139e765088cc22922a94d6ce23f9

SHA512
4356935b1024b0c65f6722a612f97921391930622260bd0f621f81ffdebdd2fa76a1dbdaef41edd9628725676cb1614995f63c4b1a793e9d86036f04dcbe6c84

Download Submit
C:\Windows\System\eJwmVtq.exe

Filesize
2.0MB

MD5
ee3b1fe34ed1d42cbfa8df16c7059e24

SHA1
f2c0fe5ed8990f5169669dd4b372d44eba866412

SHA256
c41e926102bafc6d61b9ad555c49fee7f9a55bd6f6772a2f1c4f445f4c259c2e

SHA512
d462c230ce3fb5496fee740a283f3127881de192758abcf68015fe2af73559f2502f00e9e911d977cc8683fe86dc5186c8d4ef780aa5e6b7f6cdb9659ac31e9b

Download Submit
C:\Windows\System\gzzIQXC.exe

Filesize
2.0MB

MD5
b2b7f7103fce91fa38aaa09b9bcad29f

SHA1
1460a654fc9358b4b97a7835773981971b3f36bd

SHA256
fdf67b176d50a0961c6967791b0c7b129718bec5500baf9e7b0bd968e11a30bb

SHA512
321d0268267d25fd851d7fd66d5777703b10da1b735458687e6d6092129c3760343236c1904c171fcb35ccc8910ac731f5a8d852a3165d9ccfe0d9d1d8700729

Download Submit
C:\Windows\System\hMjssYN.exe

Filesize
2.0MB

MD5
306aa1c0f706282cd1a75dd66b33d919

SHA1
19cc79c184d3acf7504628f5eafd9fb7aae8d808

SHA256
fcefd1331f02362cb64659e1059f80ef043b5fa96b0546cd748d5784a43ad729

SHA512
345f317f01b68ac7754da089575de31b9de9e89601f03eb2cd92e2c939a0804a77e60853d2fc506121f0d0baeecbd7d3d636649e5cd573101ee27f459599ecdf

Download Submit
C:\Windows\System\imHyKYR.exe

Filesize
2.0MB

MD5
a15417ace7d7a3def97f82914c19606c

SHA1
59fab1009fcb09a7fc5b8a0d366c8a3417a91dc8

SHA256
bd746ff281285b47010e3d06bb6d10779a0c79afae8eb9c88f6fb5c3e1e706e7

SHA512
3908a5000a8b5bf34fa6aa425f66a10d245535748949f853c2efa1d9503830fa1f78a9195662c485a47631d336d8a7b926a557dadf23ca94bb09b7556522bfa2

Download Submit
C:\Windows\System\itTQkyi.exe

Filesize
2.0MB

MD5
2ee09b543949bb4ee0162417c9dfee27

SHA1
95c2b8d79528ec5bfae272617e4a38bb43ad19c1

SHA256
2a433149292fc25916f89669a8e8d2254e2f0aacfbe3cf10962500e01f4b9109

SHA512
ee969b61d8cdffa07de40c8e8ac40f4e14c13b98e0647faabfe9878cd71815cf2939e7b3773ff0f48582562b3c79ec5b69309d01952b67ef40444cf6628f22c8

Download Submit
C:\Windows\System\kLjzscm.exe

Filesize
2.0MB

MD5
f6dedf06ccfeefc00a58948586e694d3

SHA1
ef58b39afa8d29e036967f328ad0d042ca2ba1c8

SHA256
b5355bbdeb5f35698c40de4e7f0f4ea6f443eea6707a62712d3357736ed83a80

SHA512
795e345c0f5672acea22332c40e1a75a66663c0e59349dade860df18e8a35350997b3c01cef3b05ba8ba9c3d79677a2e3e3443d17fddd9ec0feb9281a3c2425c

Download Submit
C:\Windows\System\klcMyGp.exe

Filesize
2.0MB

MD5
d21b6293deaae78bced1d12e9ae79de1

SHA1
9caa802f1b44fabae6d5bf537c168d36ca4c94ad

SHA256
0a0453e0210032bf7d275181bed19c30c5c81d55a3bee2323ed7536f3d9d8680

SHA512
c908228024aff3c2355b8e0f9dc47d296c45c7e331c4c0f520e46dedf1cec6040a2ca9c1a4f1846e989d2283f2cd3d4f5347a796ed6488a3ba2317599c5a866d

Download Submit
C:\Windows\System\lCIeoMa.exe

Filesize
2.0MB

MD5
ac523ee82409bc814fdefd41d98c5579

SHA1
963f9268ad4b2efee5b7a5978f919a75fcee5ae6

SHA256
cd949a8788d609410987efa47ea2076513866de15e350691ef109ee27ca74c12

SHA512
b9a6def253aeb1e1209bb092f04175a974a3c2ff3d00350866ccbfe121ea62bf2079787bba3cd543aa1c93674f2f467b023d4a943a9e5c585af7a7f9f98b36d0

Download Submit
C:\Windows\System\mRyhUev.exe

Filesize
2.1MB

MD5
8dce970330371021c349725154649db0

SHA1
9b0177609d00a07df925acf23c84fed556b7f855

SHA256
208d53c21c7dac1012a320bfd63cd1b7d579872d371a482669f20945142d1f09

SHA512
239fd43a4d6320cb78e340c2d1d694ddfa78857b632c11f299c3d9c4e4a8795e859dc2244fe15aaca779a54cea63b633cdf3eb991e0e09284d68defa8ae8d543

Download Submit
C:\Windows\System\mtbYqrM.exe

Filesize
2.0MB

MD5
83c724b0aee9b129b0cbb144a9b705d4

SHA1
05664f9f4744e5a5801cb6caf574b27ffaacff60

SHA256
ca70afaa0e54d0c68df37a14139a7954e582a997335676e102864ae4e83296f3

SHA512
df3fca32ebb5bf995ec69b7b188d280cdbc809fcfd9956851c79508a7512d82230c3c68f3f3afd335ac365830f9fbde58149b269266f9fad1d9e81dfbb150b56

Download Submit
C:\Windows\System\ocAnqhp.exe

Filesize
2.0MB

MD5
877c1818846838386499819b0fa791e3

SHA1
44c12e19bed8dfff9b58522c92247e469c72b2c1

SHA256
cb1dc44c4e76f54b548f5673712d96a51fb9b743093496a4a214cb7a13c4e27e

SHA512
8da30f975aaad7e86d71dd03eb13478d01bf0ab283de557f60a60fa974ef566a0bb9528e7fc227bf9a9f8fb01ac05c10fed3dcffef75b3b0e10980ec4a7c0fea

Download Submit
C:\Windows\System\qHpjdbn.exe

Filesize
2.0MB

MD5
3bc9a8c7643c5090b03b91737a7a690d

SHA1
d0e487f97646497398fa5894431cc7c86abdb219

SHA256
422eef3232a850503bba9270f31e70ff3190282c472edfaf41dedb6bce47984d

SHA512
12d4c6462496d0aa32f4e51fe2354849fa5f7b70a1dff686fb445078b898ecb6957f4d19d87357f5e504dd158dc1707add05a75308e4b77ebb66b97e472401bb

Download Submit
C:\Windows\System\sZjDrXR.exe

Filesize
2.0MB

MD5
44f2894815ad26f7ef18a64c35d17f2d

SHA1
06e58309d5be9b48bc3b0f2e24873b21177b0bc4

SHA256
e2e59baacddd881223e9240e609ff0d60b73b1e079780702e2e12e0f982d1107

SHA512
ebaf9ea2f8f1dae00b247811be8b389d0be295305c8720b639fb641b647cd4db5d2017922ce1f7df2af3aac2372fad654587aa8dc4258515dc83f3f63da44796

Download Submit
C:\Windows\System\vyYHGiD.exe

Filesize
2.0MB

MD5
04c1fd1dd68399f579b435dea4f3851e

SHA1
4e6574d47dce6cb129528ef7a28ddb10ff6545df

SHA256
07f290159c96fd4b224ad54b9497f44f30b5ba123970a5fde36a99a7b4fc6192

SHA512
4917c62db3a8b9792df7be172b61dfc390bfaa3a00ad13f6cdac1b3ea4bf2d071441a80ef59987982049f9ee2e8a5d599d628145b88e8e53bf5c55701e1650a7

Download Submit
C:\Windows\System\xzpzwsB.exe

Filesize
2.0MB

MD5
6bfb66375886085b711dd32e01148c8b

SHA1
ea55e9b4ed274268259088d46d2ac44aeb6f67c4

SHA256
778b5568c6d7ef196c3d5bff4d244fc8a271b9cfd5c3defcc9128ab53b9fd360

SHA512
eed504fa41291e152ee3ca39e3728987d6fcaffb741a4d56d435fbf884b61f9dd90fdf74c5ef72f8359a479ab6af743b66ad5e2e4366697683e3b44dc69557b2

Download Submit
C:\Windows\System\ynRKRoH.exe

Filesize
2.1MB

MD5
3f9844805c101c5603b0ea1f83be79c5

SHA1
15f06629d50f794a3c6bc8669a8c3c79e6027b14

SHA256
17d275ddf743b2780ff50d4a73317a8516aaa1c77e9499bb757ffedaf8e0494b

SHA512
b530b6d052a3a8c0ae47bf2f3b67ae2b2b6679ed446e4ae5c486b7da222a807961129818f21587781ab569ed2e57fda849e355790386de5852e448db57477ee0

Download Submit
memory/220-3349-0x00007FF7D1230000-0x00007FF7D1622000-memory.dmp

Filesize
3.9MB

Download
memory/220-264-0x00007FF7D1230000-0x00007FF7D1622000-memory.dmp

Filesize
3.9MB

Download
memory/552-2191-0x00007FF758B70000-0x00007FF758F62000-memory.dmp

Filesize
3.9MB

Download
memory/552-16-0x00007FF758B70000-0x00007FF758F62000-memory.dmp

Filesize
3.9MB

Download
memory/552-3322-0x00007FF758B70000-0x00007FF758F62000-memory.dmp

Filesize
3.9MB

Download
memory/876-290-0x0000021468BE0000-0x0000021468C02000-memory.dmp

Filesize
136KB

Download
memory/876-19-0x00007FFF9EEC3000-0x00007FFF9EEC5000-memory.dmp

Filesize
8KB

Download
memory/876-122-0x00007FFF9EEC0000-0x00007FFF9F981000-memory.dmp

Filesize
10.8MB

Download
memory/876-18-0x0000021468C80000-0x0000021468C90000-memory.dmp

Filesize
64KB

Download
memory/1836-243-0x00007FF7AB080000-0x00007FF7AB472000-memory.dmp

Filesize
3.9MB

Download
memory/1836-3330-0x00007FF7AB080000-0x00007FF7AB472000-memory.dmp

Filesize
3.9MB

Download
memory/1956-3351-0x00007FF6AF900000-0x00007FF6AFCF2000-memory.dmp

Filesize
3.9MB

Download
memory/1956-265-0x00007FF6AF900000-0x00007FF6AFCF2000-memory.dmp

Filesize
3.9MB

Download
memory/2044-255-0x00007FF70B4D0000-0x00007FF70B8C2000-memory.dmp

Filesize
3.9MB

Download
memory/2044-3346-0x00007FF70B4D0000-0x00007FF70B8C2000-memory.dmp

Filesize
3.9MB

Download
memory/2056-258-0x00007FF7F7DF0000-0x00007FF7F81E2000-memory.dmp

Filesize
3.9MB

Download
memory/2056-3372-0x00007FF7F7DF0000-0x00007FF7F81E2000-memory.dmp

Filesize
3.9MB

Download
memory/2076-3380-0x00007FF645FF0000-0x00007FF6463E2000-memory.dmp

Filesize
3.9MB

Download
memory/2076-260-0x00007FF645FF0000-0x00007FF6463E2000-memory.dmp

Filesize
3.9MB

Download
memory/2108-3356-0x00007FF6124E0000-0x00007FF6128D2000-memory.dmp

Filesize
3.9MB

Download
memory/2108-250-0x00007FF6124E0000-0x00007FF6128D2000-memory.dmp

Filesize
3.9MB

Download
memory/2176-38-0x00007FF69A720000-0x00007FF69AB12000-memory.dmp

Filesize
3.9MB

Download
memory/2176-3320-0x00007FF69A720000-0x00007FF69AB12000-memory.dmp

Filesize
3.9MB

Download
memory/2512-249-0x00007FF7B4770000-0x00007FF7B4B62000-memory.dmp

Filesize
3.9MB

Download
memory/2512-3343-0x00007FF7B4770000-0x00007FF7B4B62000-memory.dmp

Filesize
3.9MB

Download
memory/2684-3359-0x00007FF742C90000-0x00007FF743082000-memory.dmp

Filesize
3.9MB

Download
memory/2684-253-0x00007FF742C90000-0x00007FF743082000-memory.dmp

Filesize
3.9MB

Download
memory/2704-3324-0x00007FF68A150000-0x00007FF68A542000-memory.dmp

Filesize
3.9MB

Download
memory/2704-218-0x00007FF68A150000-0x00007FF68A542000-memory.dmp

Filesize
3.9MB

Download
memory/2888-3341-0x00007FF74EA20000-0x00007FF74EE12000-memory.dmp

Filesize
3.9MB

Download
memory/2888-248-0x00007FF74EA20000-0x00007FF74EE12000-memory.dmp

Filesize
3.9MB

Download
memory/2932-1-0x00000246DC3D0000-0x00000246DC3E0000-memory.dmp

Filesize
64KB

Download
memory/2932-0-0x00007FF6926A0000-0x00007FF692A92000-memory.dmp

Filesize
3.9MB

Download
memory/2932-1742-0x00007FF6926A0000-0x00007FF692A92000-memory.dmp

Filesize
3.9MB

Download
memory/2968-263-0x00007FF7F7D20000-0x00007FF7F8112000-memory.dmp

Filesize
3.9MB

Download
memory/2968-3369-0x00007FF7F7D20000-0x00007FF7F8112000-memory.dmp

Filesize
3.9MB

Download
memory/2980-259-0x00007FF777E20000-0x00007FF778212000-memory.dmp

Filesize
3.9MB

Download
memory/2980-3378-0x00007FF777E20000-0x00007FF778212000-memory.dmp

Filesize
3.9MB

Download
memory/3576-3382-0x00007FF6278B0000-0x00007FF627CA2000-memory.dmp

Filesize
3.9MB

Download
memory/3576-262-0x00007FF6278B0000-0x00007FF627CA2000-memory.dmp

Filesize
3.9MB

Download
memory/3608-164-0x00007FF708B30000-0x00007FF708F22000-memory.dmp

Filesize
3.9MB

Download
memory/3608-3326-0x00007FF708B30000-0x00007FF708F22000-memory.dmp

Filesize
3.9MB

Download
memory/3800-3340-0x00007FF652AA0000-0x00007FF652E92000-memory.dmp

Filesize
3.9MB

Download
memory/3800-215-0x00007FF652AA0000-0x00007FF652E92000-memory.dmp

Filesize
3.9MB

Download
memory/3840-3354-0x00007FF7FF3C0000-0x00007FF7FF7B2000-memory.dmp

Filesize
3.9MB

Download
memory/3840-251-0x00007FF7FF3C0000-0x00007FF7FF7B2000-memory.dmp

Filesize
3.9MB

Download
memory/4164-256-0x00007FF7A8D50000-0x00007FF7A9142000-memory.dmp

Filesize
3.9MB

Download
memory/4164-3367-0x00007FF7A8D50000-0x00007FF7A9142000-memory.dmp

Filesize
3.9MB

Download
memory/4188-252-0x00007FF760800000-0x00007FF760BF2000-memory.dmp

Filesize
3.9MB

Download
memory/4188-3328-0x00007FF760800000-0x00007FF760BF2000-memory.dmp

Filesize
3.9MB

Download
memory/4404-257-0x00007FF6E8FA0000-0x00007FF6E9392000-memory.dmp

Filesize
3.9MB

Download
memory/4404-3363-0x00007FF6E8FA0000-0x00007FF6E9392000-memory.dmp

Filesize
3.9MB

Download
memory/4860-254-0x00007FF6D9FD0000-0x00007FF6DA3C2000-memory.dmp

Filesize
3.9MB

Download
memory/4860-3344-0x00007FF6D9FD0000-0x00007FF6DA3C2000-memory.dmp

Filesize
3.9MB

Download
memory/5080-261-0x00007FF6C5D10000-0x00007FF6C6102000-memory.dmp

Filesize
3.9MB

Download
memory/5080-3365-0x00007FF6C5D10000-0x00007FF6C6102000-memory.dmp

Filesize
3.9MB

Download