xmrig | 6c31b6a5815edd4774b38a2806b0641b3e231de5633b9cbf95ebfd0448bcf78d

Analysis

max time kernel
150s
max time network
144s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/09/2024, 06:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
Size

2.0MB
MD5

dbf1685f4978ee693a05f0107eeb52e8
SHA1

d21485470fa8a9e181c81af451aeda77d97b3172
SHA256

6c31b6a5815edd4774b38a2806b0641b3e231de5633b9cbf95ebfd0448bcf78d
SHA512

3edc81bc27a3cd742825e16a9e75b204db8da1250a682e65671fd323c3b67ad14c09dea29d10b1b734b8070eedffcb7793a7e1506dd6ebe0c1091a7d942a9f47
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMB:NAB5

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 28 IoCs

miner

resource	yara_rule
behavioral1/memory/2712-13-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	xmrig
behavioral1/memory/2768-34-0x000000013F200000-0x000000013F5F2000-memory.dmp	xmrig
behavioral1/memory/2728-40-0x000000013F470000-0x000000013F862000-memory.dmp	xmrig
behavioral1/memory/1676-75-0x000000013F030000-0x000000013F422000-memory.dmp	xmrig
behavioral1/memory/1908-94-0x000000013F140000-0x000000013F532000-memory.dmp	xmrig
behavioral1/memory/2992-93-0x000000013FE50000-0x0000000140242000-memory.dmp	xmrig
behavioral1/memory/2244-320-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	xmrig
behavioral1/memory/2136-319-0x000000013F220000-0x000000013F612000-memory.dmp	xmrig
behavioral1/memory/1432-89-0x000000013F4A0000-0x000000013F892000-memory.dmp	xmrig
behavioral1/memory/3044-88-0x000000013F4A0000-0x000000013F892000-memory.dmp	xmrig
behavioral1/memory/1848-62-0x000000013FC00000-0x000000013FFF2000-memory.dmp	xmrig
behavioral1/memory/3044-87-0x000000013FF80000-0x0000000140372000-memory.dmp	xmrig
behavioral1/memory/2592-32-0x000000013F180000-0x000000013F572000-memory.dmp	xmrig
behavioral1/memory/1908-967-0x000000013F140000-0x000000013F532000-memory.dmp	xmrig
behavioral1/memory/3044-1235-0x000000013F360000-0x000000013F752000-memory.dmp	xmrig
behavioral1/memory/2320-1345-0x000000013F360000-0x000000013F752000-memory.dmp	xmrig
behavioral1/memory/2992-4795-0x000000013FE50000-0x0000000140242000-memory.dmp	xmrig
behavioral1/memory/2712-4797-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	xmrig
behavioral1/memory/2728-4798-0x000000013F470000-0x000000013F862000-memory.dmp	xmrig
behavioral1/memory/1848-4799-0x000000013FC00000-0x000000013FFF2000-memory.dmp	xmrig
behavioral1/memory/2136-4800-0x000000013F220000-0x000000013F612000-memory.dmp	xmrig
behavioral1/memory/2244-4802-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	xmrig
behavioral1/memory/2592-4810-0x000000013F180000-0x000000013F572000-memory.dmp	xmrig
behavioral1/memory/2768-4809-0x000000013F200000-0x000000013F5F2000-memory.dmp	xmrig
behavioral1/memory/1432-4811-0x000000013F4A0000-0x000000013F892000-memory.dmp	xmrig
behavioral1/memory/1908-4855-0x000000013F140000-0x000000013F532000-memory.dmp	xmrig
behavioral1/memory/2320-4834-0x000000013F360000-0x000000013F752000-memory.dmp	xmrig
behavioral1/memory/1676-4823-0x000000013F030000-0x000000013F422000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2764	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2712	AdNyzvR.exe
2592	cBiCsIa.exe
2768	wMCALnx.exe
2728	OutLEFC.exe
2992	CaPFNVQ.exe
1848	JDdNqaR.exe
2136	fJEsSkB.exe
2244	vCdMIoR.exe
1676	nbUaraP.exe
1432	vfMMplU.exe
1908	jckkYsB.exe
2320	CYhMJrF.exe
2616	fZhTTWJ.exe
2344	zHbffJB.exe
600	iDQVQkg.exe
2184	tGzrpqz.exe
2088	pOwxKvq.exe
1616	okEHWHv.exe
3064	vyqsZyJ.exe
1332	OowLLGs.exe
1560	tNQGBcK.exe
1612	qlKJWQU.exe
2280	ONgPnuT.exe
1664	tZvRUzG.exe
796	wSCssoj.exe
2144	qVkxIQS.exe
2460	mnJnhjI.exe
1012	JmSlmfg.exe
1324	hrybtLa.exe
2924	cuJEdOT.exe
2412	lnTPysk.exe
900	BZAFjwq.exe
1264	xvdCFUi.exe
1576	LJjraQH.exe
2752	aXFWjcH.exe
2888	oYSgaJh.exe
2600	ZzAnaip.exe
2276	BtUEXuR.exe
2364	vLUZMgL.exe
1928	ERTfZiU.exe
2168	LCSQjNq.exe
2072	jEicbiU.exe
912	yVjtFXw.exe
2816	TWsOGjQ.exe
1772	ceZxfuQ.exe
2120	fGuQvTa.exe
2696	NHXZwEN.exe
2252	FoBGbTh.exe
596	EjVGZRB.exe
3068	fMzYyjK.exe
3096	fEiELOv.exe
3128	anEcqgr.exe
3160	dUgumcP.exe
3192	bHGfVhs.exe
3224	EqnHvTe.exe
3256	syFvDry.exe
3296	HvDQmyt.exe
784	hACsIqx.exe
1476	riaYtrS.exe
1352	fhxqFKd.exe
3524	lnXXXOg.exe
2064	FLhiKnT.exe
1840	FppmPYV.exe
1944	oBdcrhK.exe

Loads dropped DLL 64 IoCs

pid	Process
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3044-0-0x000000013FF80000-0x0000000140372000-memory.dmp	upx
behavioral1/files/0x000e000000012014-5.dat	upx
behavioral1/memory/2712-13-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	upx
behavioral1/files/0x0008000000016688-19.dat	upx
behavioral1/files/0x000a000000016c88-24.dat	upx
behavioral1/files/0x000c00000000549e-23.dat	upx
behavioral1/files/0x0008000000016c9f-44.dat	upx
behavioral1/files/0x0007000000016d21-49.dat	upx
behavioral1/memory/2768-34-0x000000013F200000-0x000000013F5F2000-memory.dmp	upx
behavioral1/memory/2728-40-0x000000013F470000-0x000000013F862000-memory.dmp	upx
behavioral1/files/0x0009000000016d6e-66.dat	upx
behavioral1/memory/2992-55-0x000000013FE50000-0x0000000140242000-memory.dmp	upx
behavioral1/memory/1676-75-0x000000013F030000-0x000000013F422000-memory.dmp	upx
behavioral1/files/0x00070000000174f7-79.dat	upx
behavioral1/files/0x0007000000016d4b-65.dat	upx
behavioral1/files/0x0033000000016398-90.dat	upx
behavioral1/memory/1908-94-0x000000013F140000-0x000000013F532000-memory.dmp	upx
behavioral1/memory/2992-93-0x000000013FE50000-0x0000000140242000-memory.dmp	upx
behavioral1/files/0x000500000001871a-114.dat	upx
behavioral1/files/0x000500000001939d-163.dat	upx
behavioral1/files/0x00050000000193f7-170.dat	upx
behavioral1/files/0x00050000000194ab-177.dat	upx
behavioral1/files/0x0005000000019529-196.dat	upx
behavioral1/memory/2244-320-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	upx
behavioral1/memory/2136-319-0x000000013F220000-0x000000013F612000-memory.dmp	upx
behavioral1/files/0x000600000001756f-101.dat	upx
behavioral1/files/0x000500000001870a-107.dat	upx
behavioral1/files/0x00050000000187a7-116.dat	upx
behavioral1/files/0x00050000000187c0-123.dat	upx
behavioral1/memory/2320-102-0x000000013F360000-0x000000013F752000-memory.dmp	upx
behavioral1/files/0x0006000000018bf9-137.dat	upx
behavioral1/files/0x000500000001950e-186.dat	upx
behavioral1/files/0x0005000000019516-191.dat	upx
behavioral1/files/0x00050000000194df-184.dat	upx
behavioral1/files/0x0006000000019054-156.dat	upx
behavioral1/files/0x0006000000018c31-150.dat	upx
behavioral1/files/0x0006000000018c05-142.dat	upx
behavioral1/files/0x000500000001951e-193.dat	upx
behavioral1/files/0x00050000000194c1-179.dat	upx
behavioral1/files/0x0005000000019426-172.dat	upx
behavioral1/files/0x00050000000193da-165.dat	upx
behavioral1/files/0x000500000001938c-158.dat	upx
behavioral1/files/0x0006000000018c33-151.dat	upx
behavioral1/files/0x0006000000018c11-144.dat	upx
behavioral1/files/0x0006000000018bb0-130.dat	upx
behavioral1/files/0x0006000000018be5-135.dat	upx
behavioral1/files/0x0006000000018b7f-128.dat	upx
behavioral1/files/0x00050000000187ac-121.dat	upx
behavioral1/files/0x0005000000018708-106.dat	upx
behavioral1/memory/1432-89-0x000000013F4A0000-0x000000013F892000-memory.dmp	upx
behavioral1/memory/2136-64-0x000000013F220000-0x000000013F612000-memory.dmp	upx
behavioral1/files/0x0007000000016cef-63.dat	upx
behavioral1/memory/1848-62-0x000000013FC00000-0x000000013FFF2000-memory.dmp	upx
behavioral1/memory/3044-87-0x000000013FF80000-0x0000000140372000-memory.dmp	upx
behavioral1/memory/2244-69-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	upx
behavioral1/memory/2592-32-0x000000013F180000-0x000000013F572000-memory.dmp	upx
behavioral1/memory/1908-967-0x000000013F140000-0x000000013F532000-memory.dmp	upx
behavioral1/memory/2320-1345-0x000000013F360000-0x000000013F752000-memory.dmp	upx
behavioral1/memory/2992-4795-0x000000013FE50000-0x0000000140242000-memory.dmp	upx
behavioral1/memory/2712-4797-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	upx
behavioral1/memory/2728-4798-0x000000013F470000-0x000000013F862000-memory.dmp	upx
behavioral1/memory/1848-4799-0x000000013FC00000-0x000000013FFF2000-memory.dmp	upx
behavioral1/memory/2136-4800-0x000000013F220000-0x000000013F612000-memory.dmp	upx
behavioral1/memory/2244-4802-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\QvzEfFw.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\fGAYzno.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\oTkYldb.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\gOJwOoW.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\ObcpZpm.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\phRIlFO.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\rvYvYgZ.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\HjQYFzg.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\QtwPZGx.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\Rywbrei.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\EvsYGRO.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\fiYOCXY.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\uKsFYmD.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\qoFFefD.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\iIRTsQL.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\qVMEvpi.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\qzPTZbz.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\ISOgZup.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\lQGCmAm.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\DxuPzWw.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\SbyodbF.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\bxnPewK.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\AAfsKUp.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\CLdOsSW.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\mKsrDVe.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\OpAzBeJ.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\wfzOAhs.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\NgtkEWN.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\uVmYWpt.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\asvXANN.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\svtRxac.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\JaUvKQX.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\SYiIGfd.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\kYlfBQn.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\oMXySlN.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\zqwPIkS.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\iXnzUTb.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\vGTeVwM.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\SupaLIo.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\hOgnWfB.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\METMamM.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\LsXqlDE.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\wXHRLrL.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\STOUazA.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\QFTVhFZ.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\naZnRHJ.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\AUUDdvw.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\RqruNbV.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\uOcSxhz.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\kVZLbRq.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\TWOtSbf.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\jKSMWtq.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\hIRVEsX.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\LvOfdNf.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\qhZysiC.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\KMrWpYQ.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\POWnkdI.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\UWCwcdz.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\ZkAdBXD.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\rXkDvut.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\SKZJFvg.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\DIJIyVw.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\xMRmtUE.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
File created	C:\Windows\System\pFZrixW.exe	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2764	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
Token: SeDebugPrivilege	2764	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2764	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	31
PID 3044 wrote to memory of 2764	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	31
PID 3044 wrote to memory of 2764	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	31
PID 3044 wrote to memory of 2712	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	32
PID 3044 wrote to memory of 2712	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	32
PID 3044 wrote to memory of 2712	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	32
PID 3044 wrote to memory of 2592	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	33
PID 3044 wrote to memory of 2592	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	33
PID 3044 wrote to memory of 2592	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	33
PID 3044 wrote to memory of 2768	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	34
PID 3044 wrote to memory of 2768	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	34
PID 3044 wrote to memory of 2768	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	34
PID 3044 wrote to memory of 2728	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	35
PID 3044 wrote to memory of 2728	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	35
PID 3044 wrote to memory of 2728	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	35
PID 3044 wrote to memory of 2992	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	36
PID 3044 wrote to memory of 2992	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	36
PID 3044 wrote to memory of 2992	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	36
PID 3044 wrote to memory of 2136	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	37
PID 3044 wrote to memory of 2136	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	37
PID 3044 wrote to memory of 2136	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	37
PID 3044 wrote to memory of 1848	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	38
PID 3044 wrote to memory of 1848	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	38
PID 3044 wrote to memory of 1848	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	38
PID 3044 wrote to memory of 2244	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	39
PID 3044 wrote to memory of 2244	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	39
PID 3044 wrote to memory of 2244	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	39
PID 3044 wrote to memory of 1676	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	40
PID 3044 wrote to memory of 1676	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	40
PID 3044 wrote to memory of 1676	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	40
PID 3044 wrote to memory of 1908	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	41
PID 3044 wrote to memory of 1908	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	41
PID 3044 wrote to memory of 1908	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	41
PID 3044 wrote to memory of 1432	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	42
PID 3044 wrote to memory of 1432	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	42
PID 3044 wrote to memory of 1432	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	42
PID 3044 wrote to memory of 2320	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	43
PID 3044 wrote to memory of 2320	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	43
PID 3044 wrote to memory of 2320	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	43
PID 3044 wrote to memory of 2616	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	44
PID 3044 wrote to memory of 2616	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	44
PID 3044 wrote to memory of 2616	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	44
PID 3044 wrote to memory of 784	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	45
PID 3044 wrote to memory of 784	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	45
PID 3044 wrote to memory of 784	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	45
PID 3044 wrote to memory of 2344	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	46
PID 3044 wrote to memory of 2344	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	46
PID 3044 wrote to memory of 2344	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	46
PID 3044 wrote to memory of 1476	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	47
PID 3044 wrote to memory of 1476	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	47
PID 3044 wrote to memory of 1476	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	47
PID 3044 wrote to memory of 600	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	48
PID 3044 wrote to memory of 600	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	48
PID 3044 wrote to memory of 600	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	48
PID 3044 wrote to memory of 1352	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	49
PID 3044 wrote to memory of 1352	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	49
PID 3044 wrote to memory of 1352	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	49
PID 3044 wrote to memory of 2184	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	50
PID 3044 wrote to memory of 2184	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	50
PID 3044 wrote to memory of 2184	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	50
PID 3044 wrote to memory of 2064	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	51
PID 3044 wrote to memory of 2064	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	51
PID 3044 wrote to memory of 2064	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	51
PID 3044 wrote to memory of 2088	3044	dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe	52

C:\Users\Admin\AppData\Local\Temp\dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dbf1685f4978ee693a05f0107eeb52e8_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2764
- C:\Windows\System\AdNyzvR.exe
  C:\Windows\System\AdNyzvR.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\cBiCsIa.exe
  C:\Windows\System\cBiCsIa.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\wMCALnx.exe
  C:\Windows\System\wMCALnx.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\OutLEFC.exe
  C:\Windows\System\OutLEFC.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\CaPFNVQ.exe
  C:\Windows\System\CaPFNVQ.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\fJEsSkB.exe
  C:\Windows\System\fJEsSkB.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\JDdNqaR.exe
  C:\Windows\System\JDdNqaR.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\vCdMIoR.exe
  C:\Windows\System\vCdMIoR.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\nbUaraP.exe
  C:\Windows\System\nbUaraP.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\jckkYsB.exe
  C:\Windows\System\jckkYsB.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\vfMMplU.exe
  C:\Windows\System\vfMMplU.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\CYhMJrF.exe
  C:\Windows\System\CYhMJrF.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\fZhTTWJ.exe
  C:\Windows\System\fZhTTWJ.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\hACsIqx.exe
  C:\Windows\System\hACsIqx.exe
  2⤵
  - Executes dropped EXE
  PID:784
- C:\Windows\System\zHbffJB.exe
  C:\Windows\System\zHbffJB.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\riaYtrS.exe
  C:\Windows\System\riaYtrS.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\iDQVQkg.exe
  C:\Windows\System\iDQVQkg.exe
  2⤵
  - Executes dropped EXE
  PID:600
- C:\Windows\System\fhxqFKd.exe
  C:\Windows\System\fhxqFKd.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\tGzrpqz.exe
  C:\Windows\System\tGzrpqz.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\FLhiKnT.exe
  C:\Windows\System\FLhiKnT.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\pOwxKvq.exe
  C:\Windows\System\pOwxKvq.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\FppmPYV.exe
  C:\Windows\System\FppmPYV.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\okEHWHv.exe
  C:\Windows\System\okEHWHv.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\oBdcrhK.exe
  C:\Windows\System\oBdcrhK.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\vyqsZyJ.exe
  C:\Windows\System\vyqsZyJ.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\GnXAtuK.exe
  C:\Windows\System\GnXAtuK.exe
  2⤵
  PID:2640
- C:\Windows\System\OowLLGs.exe
  C:\Windows\System\OowLLGs.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\SMlsZSI.exe
  C:\Windows\System\SMlsZSI.exe
  2⤵
  PID:2380
- C:\Windows\System\tNQGBcK.exe
  C:\Windows\System\tNQGBcK.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\pUnZgOy.exe
  C:\Windows\System\pUnZgOy.exe
  2⤵
  PID:956
- C:\Windows\System\qlKJWQU.exe
  C:\Windows\System\qlKJWQU.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\GXofrCa.exe
  C:\Windows\System\GXofrCa.exe
  2⤵
  PID:1028
- C:\Windows\System\ONgPnuT.exe
  C:\Windows\System\ONgPnuT.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\HuMvljD.exe
  C:\Windows\System\HuMvljD.exe
  2⤵
  PID:2776
- C:\Windows\System\tZvRUzG.exe
  C:\Windows\System\tZvRUzG.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\dYakQoU.exe
  C:\Windows\System\dYakQoU.exe
  2⤵
  PID:1552
- C:\Windows\System\wSCssoj.exe
  C:\Windows\System\wSCssoj.exe
  2⤵
  - Executes dropped EXE
  PID:796
- C:\Windows\System\UVbzPDe.exe
  C:\Windows\System\UVbzPDe.exe
  2⤵
  PID:1756
- C:\Windows\System\qVkxIQS.exe
  C:\Windows\System\qVkxIQS.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\ENLDRBE.exe
  C:\Windows\System\ENLDRBE.exe
  2⤵
  PID:2128
- C:\Windows\System\mnJnhjI.exe
  C:\Windows\System\mnJnhjI.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\sDRvVEp.exe
  C:\Windows\System\sDRvVEp.exe
  2⤵
  PID:2140
- C:\Windows\System\JmSlmfg.exe
  C:\Windows\System\JmSlmfg.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\dtUWWci.exe
  C:\Windows\System\dtUWWci.exe
  2⤵
  PID:2200
- C:\Windows\System\hrybtLa.exe
  C:\Windows\System\hrybtLa.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\UNdMWwU.exe
  C:\Windows\System\UNdMWwU.exe
  2⤵
  PID:1472
- C:\Windows\System\cuJEdOT.exe
  C:\Windows\System\cuJEdOT.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\ycJIWie.exe
  C:\Windows\System\ycJIWie.exe
  2⤵
  PID:2504
- C:\Windows\System\lnTPysk.exe
  C:\Windows\System\lnTPysk.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\knJvipk.exe
  C:\Windows\System\knJvipk.exe
  2⤵
  PID:1792
- C:\Windows\System\BZAFjwq.exe
  C:\Windows\System\BZAFjwq.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\aHfOhAM.exe
  C:\Windows\System\aHfOhAM.exe
  2⤵
  PID:304
- C:\Windows\System\xvdCFUi.exe
  C:\Windows\System\xvdCFUi.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\oJzYmLk.exe
  C:\Windows\System\oJzYmLk.exe
  2⤵
  PID:2328
- C:\Windows\System\LJjraQH.exe
  C:\Windows\System\LJjraQH.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\gNdfgGU.exe
  C:\Windows\System\gNdfgGU.exe
  2⤵
  PID:1912
- C:\Windows\System\aXFWjcH.exe
  C:\Windows\System\aXFWjcH.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\YnRkdYm.exe
  C:\Windows\System\YnRkdYm.exe
  2⤵
  PID:2564
- C:\Windows\System\oYSgaJh.exe
  C:\Windows\System\oYSgaJh.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\VCGsncD.exe
  C:\Windows\System\VCGsncD.exe
  2⤵
  PID:1720
- C:\Windows\System\ZzAnaip.exe
  C:\Windows\System\ZzAnaip.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\hDiilTB.exe
  C:\Windows\System\hDiilTB.exe
  2⤵
  PID:2020
- C:\Windows\System\BtUEXuR.exe
  C:\Windows\System\BtUEXuR.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\cXRhwfv.exe
  C:\Windows\System\cXRhwfv.exe
  2⤵
  PID:2552
- C:\Windows\System\vLUZMgL.exe
  C:\Windows\System\vLUZMgL.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\zNtJygp.exe
  C:\Windows\System\zNtJygp.exe
  2⤵
  PID:2084
- C:\Windows\System\ERTfZiU.exe
  C:\Windows\System\ERTfZiU.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\ksbxdaA.exe
  C:\Windows\System\ksbxdaA.exe
  2⤵
  PID:1144
- C:\Windows\System\LCSQjNq.exe
  C:\Windows\System\LCSQjNq.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\SGRwmMJ.exe
  C:\Windows\System\SGRwmMJ.exe
  2⤵
  PID:2232
- C:\Windows\System\jEicbiU.exe
  C:\Windows\System\jEicbiU.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\JMdetVu.exe
  C:\Windows\System\JMdetVu.exe
  2⤵
  PID:3056
- C:\Windows\System\yVjtFXw.exe
  C:\Windows\System\yVjtFXw.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\cRWBAca.exe
  C:\Windows\System\cRWBAca.exe
  2⤵
  PID:2500
- C:\Windows\System\TWsOGjQ.exe
  C:\Windows\System\TWsOGjQ.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\unHjIth.exe
  C:\Windows\System\unHjIth.exe
  2⤵
  PID:2296
- C:\Windows\System\ceZxfuQ.exe
  C:\Windows\System\ceZxfuQ.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\PotWDBb.exe
  C:\Windows\System\PotWDBb.exe
  2⤵
  PID:2688
- C:\Windows\System\fGuQvTa.exe
  C:\Windows\System\fGuQvTa.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\oUvyVwT.exe
  C:\Windows\System\oUvyVwT.exe
  2⤵
  PID:1920
- C:\Windows\System\NHXZwEN.exe
  C:\Windows\System\NHXZwEN.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\xYCMFZC.exe
  C:\Windows\System\xYCMFZC.exe
  2⤵
  PID:2576
- C:\Windows\System\FoBGbTh.exe
  C:\Windows\System\FoBGbTh.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\pWWsYsy.exe
  C:\Windows\System\pWWsYsy.exe
  2⤵
  PID:2652
- C:\Windows\System\EjVGZRB.exe
  C:\Windows\System\EjVGZRB.exe
  2⤵
  - Executes dropped EXE
  PID:596
- C:\Windows\System\IkPUpzg.exe
  C:\Windows\System\IkPUpzg.exe
  2⤵
  PID:1052
- C:\Windows\System\fMzYyjK.exe
  C:\Windows\System\fMzYyjK.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\GHgPlJW.exe
  C:\Windows\System\GHgPlJW.exe
  2⤵
  PID:3080
- C:\Windows\System\fEiELOv.exe
  C:\Windows\System\fEiELOv.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\HQMgMUm.exe
  C:\Windows\System\HQMgMUm.exe
  2⤵
  PID:3112
- C:\Windows\System\anEcqgr.exe
  C:\Windows\System\anEcqgr.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\BSNJUFo.exe
  C:\Windows\System\BSNJUFo.exe
  2⤵
  PID:3144
- C:\Windows\System\dUgumcP.exe
  C:\Windows\System\dUgumcP.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\YjkCLdR.exe
  C:\Windows\System\YjkCLdR.exe
  2⤵
  PID:3176
- C:\Windows\System\bHGfVhs.exe
  C:\Windows\System\bHGfVhs.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\ioMHspI.exe
  C:\Windows\System\ioMHspI.exe
  2⤵
  PID:3208
- C:\Windows\System\EqnHvTe.exe
  C:\Windows\System\EqnHvTe.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\uGTlXsf.exe
  C:\Windows\System\uGTlXsf.exe
  2⤵
  PID:3240
- C:\Windows\System\syFvDry.exe
  C:\Windows\System\syFvDry.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\itMbJxC.exe
  C:\Windows\System\itMbJxC.exe
  2⤵
  PID:3280
- C:\Windows\System\HvDQmyt.exe
  C:\Windows\System\HvDQmyt.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\Spfhufq.exe
  C:\Windows\System\Spfhufq.exe
  2⤵
  PID:3312
- C:\Windows\System\lnXXXOg.exe
  C:\Windows\System\lnXXXOg.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\fDIfXGr.exe
  C:\Windows\System\fDIfXGr.exe
  2⤵
  PID:3552
- C:\Windows\System\iBRoJak.exe
  C:\Windows\System\iBRoJak.exe
  2⤵
  PID:3732
- C:\Windows\System\uGpANIe.exe
  C:\Windows\System\uGpANIe.exe
  2⤵
  PID:3756
- C:\Windows\System\HjQYFzg.exe
  C:\Windows\System\HjQYFzg.exe
  2⤵
  PID:3776
- C:\Windows\System\HBEwDUB.exe
  C:\Windows\System\HBEwDUB.exe
  2⤵
  PID:3796
- C:\Windows\System\GCSPhkP.exe
  C:\Windows\System\GCSPhkP.exe
  2⤵
  PID:3816
- C:\Windows\System\HNmWrxV.exe
  C:\Windows\System\HNmWrxV.exe
  2⤵
  PID:3836
- C:\Windows\System\fgMapgE.exe
  C:\Windows\System\fgMapgE.exe
  2⤵
  PID:3856
- C:\Windows\System\VwQGBNv.exe
  C:\Windows\System\VwQGBNv.exe
  2⤵
  PID:3876
- C:\Windows\System\fqWBikG.exe
  C:\Windows\System\fqWBikG.exe
  2⤵
  PID:3896
- C:\Windows\System\quzvCOy.exe
  C:\Windows\System\quzvCOy.exe
  2⤵
  PID:3916
- C:\Windows\System\JDCnqiW.exe
  C:\Windows\System\JDCnqiW.exe
  2⤵
  PID:3936
- C:\Windows\System\VoYsMBL.exe
  C:\Windows\System\VoYsMBL.exe
  2⤵
  PID:3956
- C:\Windows\System\OKwrvFt.exe
  C:\Windows\System\OKwrvFt.exe
  2⤵
  PID:3976
- C:\Windows\System\ePgfgyE.exe
  C:\Windows\System\ePgfgyE.exe
  2⤵
  PID:3996
- C:\Windows\System\PaPPdSp.exe
  C:\Windows\System\PaPPdSp.exe
  2⤵
  PID:4020
- C:\Windows\System\BONQnvV.exe
  C:\Windows\System\BONQnvV.exe
  2⤵
  PID:4040
- C:\Windows\System\XxTiLKb.exe
  C:\Windows\System\XxTiLKb.exe
  2⤵
  PID:4060
- C:\Windows\System\itpUzMa.exe
  C:\Windows\System\itpUzMa.exe
  2⤵
  PID:4076
- C:\Windows\System\uMFDQeH.exe
  C:\Windows\System\uMFDQeH.exe
  2⤵
  PID:888
- C:\Windows\System\sZopool.exe
  C:\Windows\System\sZopool.exe
  2⤵
  PID:1696
- C:\Windows\System\xNwRknE.exe
  C:\Windows\System\xNwRknE.exe
  2⤵
  PID:592
- C:\Windows\System\KHFCCQe.exe
  C:\Windows\System\KHFCCQe.exe
  2⤵
  PID:3136
- C:\Windows\System\gGgrubx.exe
  C:\Windows\System\gGgrubx.exe
  2⤵
  PID:3204
- C:\Windows\System\VJPxQMh.exe
  C:\Windows\System\VJPxQMh.exe
  2⤵
  PID:776
- C:\Windows\System\QmpOEwm.exe
  C:\Windows\System\QmpOEwm.exe
  2⤵
  PID:3060
- C:\Windows\System\qlQRSCv.exe
  C:\Windows\System\qlQRSCv.exe
  2⤵
  PID:2368
- C:\Windows\System\nZhjGPt.exe
  C:\Windows\System\nZhjGPt.exe
  2⤵
  PID:2056
- C:\Windows\System\rrZevKu.exe
  C:\Windows\System\rrZevKu.exe
  2⤵
  PID:1588
- C:\Windows\System\stJQQmP.exe
  C:\Windows\System\stJQQmP.exe
  2⤵
  PID:1532
- C:\Windows\System\rNkyVgZ.exe
  C:\Windows\System\rNkyVgZ.exe
  2⤵
  PID:2228
- C:\Windows\System\vyuBAjY.exe
  C:\Windows\System\vyuBAjY.exe
  2⤵
  PID:3308
- C:\Windows\System\ouuDfvL.exe
  C:\Windows\System\ouuDfvL.exe
  2⤵
  PID:3516
- C:\Windows\System\XUoRnPP.exe
  C:\Windows\System\XUoRnPP.exe
  2⤵
  PID:1852
- C:\Windows\System\cZomXXL.exe
  C:\Windows\System\cZomXXL.exe
  2⤵
  PID:2384
- C:\Windows\System\zpVaYdk.exe
  C:\Windows\System\zpVaYdk.exe
  2⤵
  PID:1788
- C:\Windows\System\ZwAZyjW.exe
  C:\Windows\System\ZwAZyjW.exe
  2⤵
  PID:2772
- C:\Windows\System\JBuTokT.exe
  C:\Windows\System\JBuTokT.exe
  2⤵
  PID:2376
- C:\Windows\System\bdwArkq.exe
  C:\Windows\System\bdwArkq.exe
  2⤵
  PID:2220
- C:\Windows\System\ZCJmENn.exe
  C:\Windows\System\ZCJmENn.exe
  2⤵
  PID:1940
- C:\Windows\System\ReFRLOQ.exe
  C:\Windows\System\ReFRLOQ.exe
  2⤵
  PID:2636
- C:\Windows\System\DVWcITT.exe
  C:\Windows\System\DVWcITT.exe
  2⤵
  PID:3336
- C:\Windows\System\nfVaayZ.exe
  C:\Windows\System\nfVaayZ.exe
  2⤵
  PID:3356
- C:\Windows\System\lucSjVe.exe
  C:\Windows\System\lucSjVe.exe
  2⤵
  PID:3480
- C:\Windows\System\LpnwbGB.exe
  C:\Windows\System\LpnwbGB.exe
  2⤵
  PID:3504
- C:\Windows\System\XkqXqdX.exe
  C:\Windows\System\XkqXqdX.exe
  2⤵
  PID:3564
- C:\Windows\System\KGHQrZw.exe
  C:\Windows\System\KGHQrZw.exe
  2⤵
  PID:1032
- C:\Windows\System\wGxkjDP.exe
  C:\Windows\System\wGxkjDP.exe
  2⤵
  PID:3572
- C:\Windows\System\vcxXJDQ.exe
  C:\Windows\System\vcxXJDQ.exe
  2⤵
  PID:3592
- C:\Windows\System\WPWQRLN.exe
  C:\Windows\System\WPWQRLN.exe
  2⤵
  PID:3288
- C:\Windows\System\XcXFtex.exe
  C:\Windows\System\XcXFtex.exe
  2⤵
  PID:3216
- C:\Windows\System\udtLPrS.exe
  C:\Windows\System\udtLPrS.exe
  2⤵
  PID:3152
- C:\Windows\System\RCIqeTq.exe
  C:\Windows\System\RCIqeTq.exe
  2⤵
  PID:3088
- C:\Windows\System\VLUXZJD.exe
  C:\Windows\System\VLUXZJD.exe
  2⤵
  PID:2736
- C:\Windows\System\qYNaPEI.exe
  C:\Windows\System\qYNaPEI.exe
  2⤵
  PID:2492
- C:\Windows\System\hSBzILV.exe
  C:\Windows\System\hSBzILV.exe
  2⤵
  PID:2468
- C:\Windows\System\dHgTLha.exe
  C:\Windows\System\dHgTLha.exe
  2⤵
  PID:2024
- C:\Windows\System\kMEJMXR.exe
  C:\Windows\System\kMEJMXR.exe
  2⤵
  PID:2852
- C:\Windows\System\tWzDgWf.exe
  C:\Windows\System\tWzDgWf.exe
  2⤵
  PID:2872
- C:\Windows\System\ffEFNBl.exe
  C:\Windows\System\ffEFNBl.exe
  2⤵
  PID:2732
- C:\Windows\System\kTxNHBl.exe
  C:\Windows\System\kTxNHBl.exe
  2⤵
  PID:1548
- C:\Windows\System\WIFkdOm.exe
  C:\Windows\System\WIFkdOm.exe
  2⤵
  PID:2880
- C:\Windows\System\uSSBWSr.exe
  C:\Windows\System\uSSBWSr.exe
  2⤵
  PID:544
- C:\Windows\System\yeJTtQq.exe
  C:\Windows\System\yeJTtQq.exe
  2⤵
  PID:844
- C:\Windows\System\pFZrixW.exe
  C:\Windows\System\pFZrixW.exe
  2⤵
  PID:1700
- C:\Windows\System\cWNMlMh.exe
  C:\Windows\System\cWNMlMh.exe
  2⤵
  PID:3604
- C:\Windows\System\lonKOBi.exe
  C:\Windows\System\lonKOBi.exe
  2⤵
  PID:3632
- C:\Windows\System\VfYMLlA.exe
  C:\Windows\System\VfYMLlA.exe
  2⤵
  PID:3648
- C:\Windows\System\PfXlfMh.exe
  C:\Windows\System\PfXlfMh.exe
  2⤵
  PID:3664
- C:\Windows\System\XOUoQPv.exe
  C:\Windows\System\XOUoQPv.exe
  2⤵
  PID:3680
- C:\Windows\System\cYuLZVD.exe
  C:\Windows\System\cYuLZVD.exe
  2⤵
  PID:3696
- C:\Windows\System\wgnyiuH.exe
  C:\Windows\System\wgnyiuH.exe
  2⤵
  PID:3740
- C:\Windows\System\NbZOjmn.exe
  C:\Windows\System\NbZOjmn.exe
  2⤵
  PID:3716
- C:\Windows\System\AnsteHZ.exe
  C:\Windows\System\AnsteHZ.exe
  2⤵
  PID:3616
- C:\Windows\System\QdqgVET.exe
  C:\Windows\System\QdqgVET.exe
  2⤵
  PID:3784
- C:\Windows\System\NleFbpt.exe
  C:\Windows\System\NleFbpt.exe
  2⤵
  PID:3804
- C:\Windows\System\GuQyOms.exe
  C:\Windows\System\GuQyOms.exe
  2⤵
  PID:3808
- C:\Windows\System\fFodnLD.exe
  C:\Windows\System\fFodnLD.exe
  2⤵
  PID:3872
- C:\Windows\System\bXkAaMV.exe
  C:\Windows\System\bXkAaMV.exe
  2⤵
  PID:3884
- C:\Windows\System\uxnfMEg.exe
  C:\Windows\System\uxnfMEg.exe
  2⤵
  PID:3912
- C:\Windows\System\rjiXUJR.exe
  C:\Windows\System\rjiXUJR.exe
  2⤵
  PID:3944
- C:\Windows\System\HNQpHdd.exe
  C:\Windows\System\HNQpHdd.exe
  2⤵
  PID:3964
- C:\Windows\System\tXfNPqx.exe
  C:\Windows\System\tXfNPqx.exe
  2⤵
  PID:3968
- C:\Windows\System\wBxNYcJ.exe
  C:\Windows\System\wBxNYcJ.exe
  2⤵
  PID:4032
- C:\Windows\System\eeZMIAG.exe
  C:\Windows\System\eeZMIAG.exe
  2⤵
  PID:2532
- C:\Windows\System\xAZQAFF.exe
  C:\Windows\System\xAZQAFF.exe
  2⤵
  PID:884
- C:\Windows\System\sljagMI.exe
  C:\Windows\System\sljagMI.exe
  2⤵
  PID:2260
- C:\Windows\System\yAnNlgn.exe
  C:\Windows\System\yAnNlgn.exe
  2⤵
  PID:1508
- C:\Windows\System\uaeJuMm.exe
  C:\Windows\System\uaeJuMm.exe
  2⤵
  PID:3348
- C:\Windows\System\LMeKtQi.exe
  C:\Windows\System\LMeKtQi.exe
  2⤵
  PID:4012
- C:\Windows\System\NZgicRo.exe
  C:\Windows\System\NZgicRo.exe
  2⤵
  PID:3048
- C:\Windows\System\GWcgYiq.exe
  C:\Windows\System\GWcgYiq.exe
  2⤵
  PID:1636
- C:\Windows\System\BgZhFKi.exe
  C:\Windows\System\BgZhFKi.exe
  2⤵
  PID:4052
- C:\Windows\System\hLOpios.exe
  C:\Windows\System\hLOpios.exe
  2⤵
  PID:3500
- C:\Windows\System\ixrowbX.exe
  C:\Windows\System\ixrowbX.exe
  2⤵
  PID:3248
- C:\Windows\System\dbKpUeS.exe
  C:\Windows\System\dbKpUeS.exe
  2⤵
  PID:2744
- C:\Windows\System\SghSsnv.exe
  C:\Windows\System\SghSsnv.exe
  2⤵
  PID:2760
- C:\Windows\System\iqZRZEC.exe
  C:\Windows\System\iqZRZEC.exe
  2⤵
  PID:2352
- C:\Windows\System\oJEZDrv.exe
  C:\Windows\System\oJEZDrv.exe
  2⤵
  PID:3624
- C:\Windows\System\IbUmJqD.exe
  C:\Windows\System\IbUmJqD.exe
  2⤵
  PID:3032
- C:\Windows\System\aecBpRc.exe
  C:\Windows\System\aecBpRc.exe
  2⤵
  PID:3824
- C:\Windows\System\yNlWQok.exe
  C:\Windows\System\yNlWQok.exe
  2⤵
  PID:3932
- C:\Windows\System\lNCHOSL.exe
  C:\Windows\System\lNCHOSL.exe
  2⤵
  PID:568
- C:\Windows\System\hJCkkzS.exe
  C:\Windows\System\hJCkkzS.exe
  2⤵
  PID:2404
- C:\Windows\System\nQIJEiA.exe
  C:\Windows\System\nQIJEiA.exe
  2⤵
  PID:3400
- C:\Windows\System\exoZLSD.exe
  C:\Windows\System\exoZLSD.exe
  2⤵
  PID:3324
- C:\Windows\System\xqEQepQ.exe
  C:\Windows\System\xqEQepQ.exe
  2⤵
  PID:3412
- C:\Windows\System\yPpLlpz.exe
  C:\Windows\System\yPpLlpz.exe
  2⤵
  PID:480
- C:\Windows\System\rzqPCzu.exe
  C:\Windows\System\rzqPCzu.exe
  2⤵
  PID:3432
- C:\Windows\System\PsRFGCc.exe
  C:\Windows\System\PsRFGCc.exe
  2⤵
  PID:2556
- C:\Windows\System\tEyjWLu.exe
  C:\Windows\System\tEyjWLu.exe
  2⤵
  PID:3476
- C:\Windows\System\ImaTMTh.exe
  C:\Windows\System\ImaTMTh.exe
  2⤵
  PID:2560
- C:\Windows\System\lMGnXqe.exe
  C:\Windows\System\lMGnXqe.exe
  2⤵
  PID:768
- C:\Windows\System\WvZijrh.exe
  C:\Windows\System\WvZijrh.exe
  2⤵
  PID:3788
- C:\Windows\System\MgLawzw.exe
  C:\Windows\System\MgLawzw.exe
  2⤵
  PID:1644
- C:\Windows\System\WbcKGUT.exe
  C:\Windows\System\WbcKGUT.exe
  2⤵
  PID:2480
- C:\Windows\System\wYKNlgR.exe
  C:\Windows\System\wYKNlgR.exe
  2⤵
  PID:2336
- C:\Windows\System\VZWkeQj.exe
  C:\Windows\System\VZWkeQj.exe
  2⤵
  PID:3644
- C:\Windows\System\tbspail.exe
  C:\Windows\System\tbspail.exe
  2⤵
  PID:3708
- C:\Windows\System\mfgjUbz.exe
  C:\Windows\System\mfgjUbz.exe
  2⤵
  PID:3888
- C:\Windows\System\oyusgEm.exe
  C:\Windows\System\oyusgEm.exe
  2⤵
  PID:3236
- C:\Windows\System\agIbZLO.exe
  C:\Windows\System\agIbZLO.exe
  2⤵
  PID:3536
- C:\Windows\System\MSIGLXp.exe
  C:\Windows\System\MSIGLXp.exe
  2⤵
  PID:2256
- C:\Windows\System\bbrYZpz.exe
  C:\Windows\System\bbrYZpz.exe
  2⤵
  PID:2884
- C:\Windows\System\VfSRxpJ.exe
  C:\Windows\System\VfSRxpJ.exe
  2⤵
  PID:2340
- C:\Windows\System\WMoJDom.exe
  C:\Windows\System\WMoJDom.exe
  2⤵
  PID:3304
- C:\Windows\System\sFITtRG.exe
  C:\Windows\System\sFITtRG.exe
  2⤵
  PID:2800
- C:\Windows\System\JPOTIlP.exe
  C:\Windows\System\JPOTIlP.exe
  2⤵
  PID:2316
- C:\Windows\System\cjsvcCb.exe
  C:\Windows\System\cjsvcCb.exe
  2⤵
  PID:1604
- C:\Windows\System\QAjbtGP.exe
  C:\Windows\System\QAjbtGP.exe
  2⤵
  PID:3328
- C:\Windows\System\jNJtegd.exe
  C:\Windows\System\jNJtegd.exe
  2⤵
  PID:3372
- C:\Windows\System\bLpwnQC.exe
  C:\Windows\System\bLpwnQC.exe
  2⤵
  PID:532
- C:\Windows\System\RGhtEbS.exe
  C:\Windows\System\RGhtEbS.exe
  2⤵
  PID:3560
- C:\Windows\System\wJHtBrK.exe
  C:\Windows\System\wJHtBrK.exe
  2⤵
  PID:3588
- C:\Windows\System\XUCeTxq.exe
  C:\Windows\System\XUCeTxq.exe
  2⤵
  PID:3584
- C:\Windows\System\bZoMSEa.exe
  C:\Windows\System\bZoMSEa.exe
  2⤵
  PID:2240
- C:\Windows\System\gTvarRT.exe
  C:\Windows\System\gTvarRT.exe
  2⤵
  PID:3752
- C:\Windows\System\qZVANGt.exe
  C:\Windows\System\qZVANGt.exe
  2⤵
  PID:3092
- C:\Windows\System\iHzUFvI.exe
  C:\Windows\System\iHzUFvI.exe
  2⤵
  PID:3924
- C:\Windows\System\WSYQymX.exe
  C:\Windows\System\WSYQymX.exe
  2⤵
  PID:3388
- C:\Windows\System\RqruNbV.exe
  C:\Windows\System\RqruNbV.exe
  2⤵
  PID:3168
- C:\Windows\System\dLOPdjD.exe
  C:\Windows\System\dLOPdjD.exe
  2⤵
  PID:2508
- C:\Windows\System\ZRfhJmb.exe
  C:\Windows\System\ZRfhJmb.exe
  2⤵
  PID:1692
- C:\Windows\System\PmuQvZp.exe
  C:\Windows\System\PmuQvZp.exe
  2⤵
  PID:1292
- C:\Windows\System\FXgNzOQ.exe
  C:\Windows\System\FXgNzOQ.exe
  2⤵
  PID:4104
- C:\Windows\System\wqIHrDj.exe
  C:\Windows\System\wqIHrDj.exe
  2⤵
  PID:4188
- C:\Windows\System\EBdHtxL.exe
  C:\Windows\System\EBdHtxL.exe
  2⤵
  PID:4304
- C:\Windows\System\Tgilasb.exe
  C:\Windows\System\Tgilasb.exe
  2⤵
  PID:4324
- C:\Windows\System\iNQLhED.exe
  C:\Windows\System\iNQLhED.exe
  2⤵
  PID:4340
- C:\Windows\System\RWzXCxC.exe
  C:\Windows\System\RWzXCxC.exe
  2⤵
  PID:4356
- C:\Windows\System\JxIIyZL.exe
  C:\Windows\System\JxIIyZL.exe
  2⤵
  PID:4372
- C:\Windows\System\NrJpEtp.exe
  C:\Windows\System\NrJpEtp.exe
  2⤵
  PID:4388
- C:\Windows\System\kYeSati.exe
  C:\Windows\System\kYeSati.exe
  2⤵
  PID:4404
- C:\Windows\System\AGCMqgY.exe
  C:\Windows\System\AGCMqgY.exe
  2⤵
  PID:4428
- C:\Windows\System\VUaHsiA.exe
  C:\Windows\System\VUaHsiA.exe
  2⤵
  PID:4444
- C:\Windows\System\qOtxNuR.exe
  C:\Windows\System\qOtxNuR.exe
  2⤵
  PID:4460
- C:\Windows\System\QzZrDWK.exe
  C:\Windows\System\QzZrDWK.exe
  2⤵
  PID:4476
- C:\Windows\System\HqkSHxY.exe
  C:\Windows\System\HqkSHxY.exe
  2⤵
  PID:4492
- C:\Windows\System\DPRAwyb.exe
  C:\Windows\System\DPRAwyb.exe
  2⤵
  PID:4512
- C:\Windows\System\tpEIeZM.exe
  C:\Windows\System\tpEIeZM.exe
  2⤵
  PID:4528
- C:\Windows\System\xmwNSVO.exe
  C:\Windows\System\xmwNSVO.exe
  2⤵
  PID:4544
- C:\Windows\System\HQWrXEf.exe
  C:\Windows\System\HQWrXEf.exe
  2⤵
  PID:4560
- C:\Windows\System\NBRsmEd.exe
  C:\Windows\System\NBRsmEd.exe
  2⤵
  PID:4576
- C:\Windows\System\ckrykot.exe
  C:\Windows\System\ckrykot.exe
  2⤵
  PID:4592
- C:\Windows\System\umEAsPw.exe
  C:\Windows\System\umEAsPw.exe
  2⤵
  PID:4608
- C:\Windows\System\vwEeqJZ.exe
  C:\Windows\System\vwEeqJZ.exe
  2⤵
  PID:4676
- C:\Windows\System\ZpDeycc.exe
  C:\Windows\System\ZpDeycc.exe
  2⤵
  PID:4704
- C:\Windows\System\nBjMolG.exe
  C:\Windows\System\nBjMolG.exe
  2⤵
  PID:4728
- C:\Windows\System\ohNRzHL.exe
  C:\Windows\System\ohNRzHL.exe
  2⤵
  PID:4744
- C:\Windows\System\IqIeXVL.exe
  C:\Windows\System\IqIeXVL.exe
  2⤵
  PID:4764
- C:\Windows\System\wERwrue.exe
  C:\Windows\System\wERwrue.exe
  2⤵
  PID:4780
- C:\Windows\System\aEbkhHi.exe
  C:\Windows\System\aEbkhHi.exe
  2⤵
  PID:4796
- C:\Windows\System\JZFwpXA.exe
  C:\Windows\System\JZFwpXA.exe
  2⤵
  PID:4812
- C:\Windows\System\ytVvXsV.exe
  C:\Windows\System\ytVvXsV.exe
  2⤵
  PID:4828
- C:\Windows\System\HkVJUlE.exe
  C:\Windows\System\HkVJUlE.exe
  2⤵
  PID:4844
- C:\Windows\System\SQrYtSw.exe
  C:\Windows\System\SQrYtSw.exe
  2⤵
  PID:4860
- C:\Windows\System\XNNULHq.exe
  C:\Windows\System\XNNULHq.exe
  2⤵
  PID:4876
- C:\Windows\System\xZDXtzm.exe
  C:\Windows\System\xZDXtzm.exe
  2⤵
  PID:4892
- C:\Windows\System\oXQQdZt.exe
  C:\Windows\System\oXQQdZt.exe
  2⤵
  PID:4908
- C:\Windows\System\edHKLjg.exe
  C:\Windows\System\edHKLjg.exe
  2⤵
  PID:4928
- C:\Windows\System\QozyIew.exe
  C:\Windows\System\QozyIew.exe
  2⤵
  PID:4948
- C:\Windows\System\hntmldl.exe
  C:\Windows\System\hntmldl.exe
  2⤵
  PID:5012
- C:\Windows\System\HzHWikH.exe
  C:\Windows\System\HzHWikH.exe
  2⤵
  PID:5036
- C:\Windows\System\lNZkjIG.exe
  C:\Windows\System\lNZkjIG.exe
  2⤵
  PID:5052
- C:\Windows\System\wZkJDce.exe
  C:\Windows\System\wZkJDce.exe
  2⤵
  PID:5068
- C:\Windows\System\WqUiiXA.exe
  C:\Windows\System\WqUiiXA.exe
  2⤵
  PID:5084
- C:\Windows\System\gJalVMT.exe
  C:\Windows\System\gJalVMT.exe
  2⤵
  PID:5100
- C:\Windows\System\WbwDmqw.exe
  C:\Windows\System\WbwDmqw.exe
  2⤵
  PID:3660
- C:\Windows\System\bkFtzwK.exe
  C:\Windows\System\bkFtzwK.exe
  2⤵
  PID:2676
- C:\Windows\System\VUZHXPV.exe
  C:\Windows\System\VUZHXPV.exe
  2⤵
  PID:264
- C:\Windows\System\xSKtZwO.exe
  C:\Windows\System\xSKtZwO.exe
  2⤵
  PID:3676
- C:\Windows\System\vaGEkCI.exe
  C:\Windows\System\vaGEkCI.exe
  2⤵
  PID:3172
- C:\Windows\System\jsoNXUX.exe
  C:\Windows\System\jsoNXUX.exe
  2⤵
  PID:2624
- C:\Windows\System\qDFFpoG.exe
  C:\Windows\System\qDFFpoG.exe
  2⤵
  PID:3184
- C:\Windows\System\yvosbQD.exe
  C:\Windows\System\yvosbQD.exe
  2⤵
  PID:3688
- C:\Windows\System\ZjCtcFz.exe
  C:\Windows\System\ZjCtcFz.exe
  2⤵
  PID:988
- C:\Windows\System\JDiLEfs.exe
  C:\Windows\System\JDiLEfs.exe
  2⤵
  PID:708
- C:\Windows\System\VggXPxp.exe
  C:\Windows\System\VggXPxp.exe
  2⤵
  PID:4204
- C:\Windows\System\MRQQdtu.exe
  C:\Windows\System\MRQQdtu.exe
  2⤵
  PID:4216
- C:\Windows\System\gUcSaBD.exe
  C:\Windows\System\gUcSaBD.exe
  2⤵
  PID:4228
- C:\Windows\System\MBCeoNl.exe
  C:\Windows\System\MBCeoNl.exe
  2⤵
  PID:4248
- C:\Windows\System\LiNmZMS.exe
  C:\Windows\System\LiNmZMS.exe
  2⤵
  PID:2148
- C:\Windows\System\ZhAqIFv.exe
  C:\Windows\System\ZhAqIFv.exe
  2⤵
  PID:3268
- C:\Windows\System\eTSwngM.exe
  C:\Windows\System\eTSwngM.exe
  2⤵
  PID:2824
- C:\Windows\System\GgttwrL.exe
  C:\Windows\System\GgttwrL.exe
  2⤵
  PID:2896
- C:\Windows\System\OZoZWdT.exe
  C:\Windows\System\OZoZWdT.exe
  2⤵
  PID:1936
- C:\Windows\System\WEZQoTC.exe
  C:\Windows\System\WEZQoTC.exe
  2⤵
  PID:4056
- C:\Windows\System\BMcZKOm.exe
  C:\Windows\System\BMcZKOm.exe
  2⤵
  PID:4124
- C:\Windows\System\uwopsLe.exe
  C:\Windows\System\uwopsLe.exe
  2⤵
  PID:4136
- C:\Windows\System\YNAPAkL.exe
  C:\Windows\System\YNAPAkL.exe
  2⤵
  PID:4144
- C:\Windows\System\uuROFCc.exe
  C:\Windows\System\uuROFCc.exe
  2⤵
  PID:4160
- C:\Windows\System\ZUkRmhP.exe
  C:\Windows\System\ZUkRmhP.exe
  2⤵
  PID:4176
- C:\Windows\System\vFXzObd.exe
  C:\Windows\System\vFXzObd.exe
  2⤵
  PID:4264
- C:\Windows\System\JLbTDiX.exe
  C:\Windows\System\JLbTDiX.exe
  2⤵
  PID:4280
- C:\Windows\System\cWZMMgk.exe
  C:\Windows\System\cWZMMgk.exe
  2⤵
  PID:3728
- C:\Windows\System\PoOskZp.exe
  C:\Windows\System\PoOskZp.exe
  2⤵
  PID:1036
- C:\Windows\System\pgPksMq.exe
  C:\Windows\System\pgPksMq.exe
  2⤵
  PID:336
- C:\Windows\System\kPpBbvu.exe
  C:\Windows\System\kPpBbvu.exe
  2⤵
  PID:3416
- C:\Windows\System\MbohWRX.exe
  C:\Windows\System\MbohWRX.exe
  2⤵
  PID:4312
- C:\Windows\System\lemnwkQ.exe
  C:\Windows\System\lemnwkQ.exe
  2⤵
  PID:4416
- C:\Windows\System\ufoHpRI.exe
  C:\Windows\System\ufoHpRI.exe
  2⤵
  PID:4588
- C:\Windows\System\kYHIevu.exe
  C:\Windows\System\kYHIevu.exe
  2⤵
  PID:4628
- C:\Windows\System\WCOWUYf.exe
  C:\Windows\System\WCOWUYf.exe
  2⤵
  PID:4684
- C:\Windows\System\zUGBfIc.exe
  C:\Windows\System\zUGBfIc.exe
  2⤵
  PID:4644
- C:\Windows\System\EWVAPMw.exe
  C:\Windows\System\EWVAPMw.exe
  2⤵
  PID:4380
- C:\Windows\System\CJRAKvI.exe
  C:\Windows\System\CJRAKvI.exe
  2⤵
  PID:2620
- C:\Windows\System\ycfPLTf.exe
  C:\Windows\System\ycfPLTf.exe
  2⤵
  PID:4776
- C:\Windows\System\ICrodMW.exe
  C:\Windows\System\ICrodMW.exe
  2⤵
  PID:4724
- C:\Windows\System\zoXNOvR.exe
  C:\Windows\System\zoXNOvR.exe
  2⤵
  PID:4872
- C:\Windows\System\latqKwh.exe
  C:\Windows\System\latqKwh.exe
  2⤵
  PID:4760
- C:\Windows\System\sMnXGZr.exe
  C:\Windows\System\sMnXGZr.exe
  2⤵
  PID:444
- C:\Windows\System\najilOT.exe
  C:\Windows\System\najilOT.exe
  2⤵
  PID:5000
- C:\Windows\System\CdGCLzZ.exe
  C:\Windows\System\CdGCLzZ.exe
  2⤵
  PID:3520
- C:\Windows\System\ItAYofF.exe
  C:\Windows\System\ItAYofF.exe
  2⤵
  PID:5024
- C:\Windows\System\aeHkPUH.exe
  C:\Windows\System\aeHkPUH.exe
  2⤵
  PID:5076
- C:\Windows\System\TdtiUOl.exe
  C:\Windows\System\TdtiUOl.exe
  2⤵
  PID:3408
- C:\Windows\System\VeTcYvT.exe
  C:\Windows\System\VeTcYvT.exe
  2⤵
  PID:2164
- C:\Windows\System\usCimVs.exe
  C:\Windows\System\usCimVs.exe
  2⤵
  PID:4196
- C:\Windows\System\PujNTCs.exe
  C:\Windows\System\PujNTCs.exe
  2⤵
  PID:4252
- C:\Windows\System\iTCcmFc.exe
  C:\Windows\System\iTCcmFc.exe
  2⤵
  PID:1860
- C:\Windows\System\YYpCWSm.exe
  C:\Windows\System\YYpCWSm.exe
  2⤵
  PID:4116
- C:\Windows\System\mxMeHjg.exe
  C:\Windows\System\mxMeHjg.exe
  2⤵
  PID:4168
- C:\Windows\System\tuTrcwq.exe
  C:\Windows\System\tuTrcwq.exe
  2⤵
  PID:2456
- C:\Windows\System\rqcmrPI.exe
  C:\Windows\System\rqcmrPI.exe
  2⤵
  PID:1652
- C:\Windows\System\btAWLPl.exe
  C:\Windows\System\btAWLPl.exe
  2⤵
  PID:4212
- C:\Windows\System\xktMnLD.exe
  C:\Windows\System\xktMnLD.exe
  2⤵
  PID:4244
- C:\Windows\System\XJZCuFW.exe
  C:\Windows\System\XJZCuFW.exe
  2⤵
  PID:1856
- C:\Windows\System\tVGpaQr.exe
  C:\Windows\System\tVGpaQr.exe
  2⤵
  PID:4152
- C:\Windows\System\DcsbENp.exe
  C:\Windows\System\DcsbENp.exe
  2⤵
  PID:4300
- C:\Windows\System\tZXRLij.exe
  C:\Windows\System\tZXRLij.exe
  2⤵
  PID:5092
- C:\Windows\System\ngRtoIk.exe
  C:\Windows\System\ngRtoIk.exe
  2⤵
  PID:4276
- C:\Windows\System\SOPgaIx.exe
  C:\Windows\System\SOPgaIx.exe
  2⤵
  PID:3508
- C:\Windows\System\YLwmVUU.exe
  C:\Windows\System\YLwmVUU.exe
  2⤵
  PID:4400
- C:\Windows\System\tciZNcn.exe
  C:\Windows\System\tciZNcn.exe
  2⤵
  PID:4088
- C:\Windows\System\XomtYyq.exe
  C:\Windows\System\XomtYyq.exe
  2⤵
  PID:4320
- C:\Windows\System\KzdtTXS.exe
  C:\Windows\System\KzdtTXS.exe
  2⤵
  PID:4620
- C:\Windows\System\dlmnhIf.exe
  C:\Windows\System\dlmnhIf.exe
  2⤵
  PID:4584
- C:\Windows\System\jhOxFBe.exe
  C:\Windows\System\jhOxFBe.exe
  2⤵
  PID:4692
- C:\Windows\System\doJMzKJ.exe
  C:\Windows\System\doJMzKJ.exe
  2⤵
  PID:4648
- C:\Windows\System\QKtywsg.exe
  C:\Windows\System\QKtywsg.exe
  2⤵
  PID:4664
- C:\Windows\System\rdiEJZH.exe
  C:\Windows\System\rdiEJZH.exe
  2⤵
  PID:4720
- C:\Windows\System\uCVCAVK.exe
  C:\Windows\System\uCVCAVK.exe
  2⤵
  PID:4904
- C:\Windows\System\stqUzZT.exe
  C:\Windows\System\stqUzZT.exe
  2⤵
  PID:4956
- C:\Windows\System\sIomHuU.exe
  C:\Windows\System\sIomHuU.exe
  2⤵
  PID:4940
- C:\Windows\System\nQWbcvD.exe
  C:\Windows\System\nQWbcvD.exe
  2⤵
  PID:4960
- C:\Windows\System\aDByius.exe
  C:\Windows\System\aDByius.exe
  2⤵
  PID:4972
- C:\Windows\System\kXiElIa.exe
  C:\Windows\System\kXiElIa.exe
  2⤵
  PID:4984
- C:\Windows\System\rDlgHkY.exe
  C:\Windows\System\rDlgHkY.exe
  2⤵
  PID:5116
- C:\Windows\System\CTqqorX.exe
  C:\Windows\System\CTqqorX.exe
  2⤵
  PID:4996
- C:\Windows\System\wzQlEUb.exe
  C:\Windows\System\wzQlEUb.exe
  2⤵
  PID:4292
- C:\Windows\System\JcqFGNe.exe
  C:\Windows\System\JcqFGNe.exe
  2⤵
  PID:4384
- C:\Windows\System\CkZkOPV.exe
  C:\Windows\System\CkZkOPV.exe
  2⤵
  PID:4240
- C:\Windows\System\gzwVQPr.exe
  C:\Windows\System\gzwVQPr.exe
  2⤵
  PID:3868
- C:\Windows\System\WOvZsmP.exe
  C:\Windows\System\WOvZsmP.exe
  2⤵
  PID:4092
- C:\Windows\System\NPCBrUI.exe
  C:\Windows\System\NPCBrUI.exe
  2⤵
  PID:5004
- C:\Windows\System\TzDeRUK.exe
  C:\Windows\System\TzDeRUK.exe
  2⤵
  PID:5064
- C:\Windows\System\HrhbnpB.exe
  C:\Windows\System\HrhbnpB.exe
  2⤵
  PID:3108
- C:\Windows\System\KFLwRdO.exe
  C:\Windows\System\KFLwRdO.exe
  2⤵
  PID:4224
- C:\Windows\System\dQAnekF.exe
  C:\Windows\System\dQAnekF.exe
  2⤵
  PID:3380
- C:\Windows\System\nzuCPBu.exe
  C:\Windows\System\nzuCPBu.exe
  2⤵
  PID:4172
- C:\Windows\System\vNyOgUY.exe
  C:\Windows\System\vNyOgUY.exe
  2⤵
  PID:4484
- C:\Windows\System\JxIpwiq.exe
  C:\Windows\System\JxIpwiq.exe
  2⤵
  PID:4468
- C:\Windows\System\oWozKRS.exe
  C:\Windows\System\oWozKRS.exe
  2⤵
  PID:4540
- C:\Windows\System\FJtOxTq.exe
  C:\Windows\System\FJtOxTq.exe
  2⤵
  PID:4600
- C:\Windows\System\idPuDoz.exe
  C:\Windows\System\idPuDoz.exe
  2⤵
  PID:4804
- C:\Windows\System\Opbuvqs.exe
  C:\Windows\System\Opbuvqs.exe
  2⤵
  PID:4624
- C:\Windows\System\wIKgzmE.exe
  C:\Windows\System\wIKgzmE.exe
  2⤵
  PID:4840
- C:\Windows\System\wFPMoLV.exe
  C:\Windows\System\wFPMoLV.exe
  2⤵
  PID:4884
- C:\Windows\System\XzLEiRd.exe
  C:\Windows\System\XzLEiRd.exe
  2⤵
  PID:4916
- C:\Windows\System\gzbfcGz.exe
  C:\Windows\System\gzbfcGz.exe
  2⤵
  PID:3024
- C:\Windows\System\bLaPVwo.exe
  C:\Windows\System\bLaPVwo.exe
  2⤵
  PID:4852
- C:\Windows\System\hzVZAmy.exe
  C:\Windows\System\hzVZAmy.exe
  2⤵
  PID:4936
- C:\Windows\System\WXYGJga.exe
  C:\Windows\System\WXYGJga.exe
  2⤵
  PID:4336
- C:\Windows\System\aQDnwkA.exe
  C:\Windows\System\aQDnwkA.exe
  2⤵
  PID:3992
- C:\Windows\System\YECHuXj.exe
  C:\Windows\System\YECHuXj.exe
  2⤵
  PID:4452
- C:\Windows\System\ylGMNbm.exe
  C:\Windows\System\ylGMNbm.exe
  2⤵
  PID:5108
- C:\Windows\System\YypDqPG.exe
  C:\Windows\System\YypDqPG.exe
  2⤵
  PID:4112
- C:\Windows\System\eFbKAVI.exe
  C:\Windows\System\eFbKAVI.exe
  2⤵
  PID:2628
- C:\Windows\System\BICsdwj.exe
  C:\Windows\System\BICsdwj.exe
  2⤵
  PID:4500
- C:\Windows\System\rJFZITm.exe
  C:\Windows\System\rJFZITm.exe
  2⤵
  PID:4672
- C:\Windows\System\wsMLLrH.exe
  C:\Windows\System\wsMLLrH.exe
  2⤵
  PID:5112
- C:\Windows\System\NIdyoLz.exe
  C:\Windows\System\NIdyoLz.exe
  2⤵
  PID:4656
- C:\Windows\System\RWYsyHE.exe
  C:\Windows\System\RWYsyHE.exe
  2⤵
  PID:5060
- C:\Windows\System\gjhWsDp.exe
  C:\Windows\System\gjhWsDp.exe
  2⤵
  PID:4424
- C:\Windows\System\msSZemh.exe
  C:\Windows\System\msSZemh.exe
  2⤵
  PID:4504
- C:\Windows\System\xnoQGaT.exe
  C:\Windows\System\xnoQGaT.exe
  2⤵
  PID:4920
- C:\Windows\System\WdabyNW.exe
  C:\Windows\System\WdabyNW.exe
  2⤵
  PID:4028
- C:\Windows\System\LDWTYJq.exe
  C:\Windows\System\LDWTYJq.exe
  2⤵
  PID:4824
- C:\Windows\System\oTjdGLH.exe
  C:\Windows\System\oTjdGLH.exe
  2⤵
  PID:2264
- C:\Windows\System\OhODKrQ.exe
  C:\Windows\System\OhODKrQ.exe
  2⤵
  PID:1704
- C:\Windows\System\RUWQCXK.exe
  C:\Windows\System\RUWQCXK.exe
  2⤵
  PID:4260
- C:\Windows\System\wyeAGbM.exe
  C:\Windows\System\wyeAGbM.exe
  2⤵
  PID:2332
- C:\Windows\System\jGleMgT.exe
  C:\Windows\System\jGleMgT.exe
  2⤵
  PID:5140
- C:\Windows\System\NecaIVn.exe
  C:\Windows\System\NecaIVn.exe
  2⤵
  PID:5156
- C:\Windows\System\vaByVxA.exe
  C:\Windows\System\vaByVxA.exe
  2⤵
  PID:5172
- C:\Windows\System\uNSkkdw.exe
  C:\Windows\System\uNSkkdw.exe
  2⤵
  PID:5188
- C:\Windows\System\rwRzXuM.exe
  C:\Windows\System\rwRzXuM.exe
  2⤵
  PID:5252
- C:\Windows\System\gTdclqB.exe
  C:\Windows\System\gTdclqB.exe
  2⤵
  PID:5268
- C:\Windows\System\cEWDcAA.exe
  C:\Windows\System\cEWDcAA.exe
  2⤵
  PID:5284
- C:\Windows\System\kRwwSIp.exe
  C:\Windows\System\kRwwSIp.exe
  2⤵
  PID:5300
- C:\Windows\System\opotJyq.exe
  C:\Windows\System\opotJyq.exe
  2⤵
  PID:5316
- C:\Windows\System\dnaPKGU.exe
  C:\Windows\System\dnaPKGU.exe
  2⤵
  PID:5332
- C:\Windows\System\UcqlFiO.exe
  C:\Windows\System\UcqlFiO.exe
  2⤵
  PID:5348
- C:\Windows\System\uxOVisE.exe
  C:\Windows\System\uxOVisE.exe
  2⤵
  PID:5368
- C:\Windows\System\UBKviQf.exe
  C:\Windows\System\UBKviQf.exe
  2⤵
  PID:5384
- C:\Windows\System\EMbVrWf.exe
  C:\Windows\System\EMbVrWf.exe
  2⤵
  PID:5400
- C:\Windows\System\NiXXJgF.exe
  C:\Windows\System\NiXXJgF.exe
  2⤵
  PID:5424
- C:\Windows\System\RquEnDP.exe
  C:\Windows\System\RquEnDP.exe
  2⤵
  PID:5444
- C:\Windows\System\neLdGnE.exe
  C:\Windows\System\neLdGnE.exe
  2⤵
  PID:5460
- C:\Windows\System\bqzEuYz.exe
  C:\Windows\System\bqzEuYz.exe
  2⤵
  PID:5476
- C:\Windows\System\qEWPMUI.exe
  C:\Windows\System\qEWPMUI.exe
  2⤵
  PID:5492
- C:\Windows\System\AruNIiA.exe
  C:\Windows\System\AruNIiA.exe
  2⤵
  PID:5508
- C:\Windows\System\rETvTfw.exe
  C:\Windows\System\rETvTfw.exe
  2⤵
  PID:5524
- C:\Windows\System\qkxRRBp.exe
  C:\Windows\System\qkxRRBp.exe
  2⤵
  PID:5540
- C:\Windows\System\OfTWBVL.exe
  C:\Windows\System\OfTWBVL.exe
  2⤵
  PID:5560
- C:\Windows\System\hJRSpDA.exe
  C:\Windows\System\hJRSpDA.exe
  2⤵
  PID:5576
- C:\Windows\System\DmOdJYQ.exe
  C:\Windows\System\DmOdJYQ.exe
  2⤵
  PID:5592
- C:\Windows\System\qgYrFnN.exe
  C:\Windows\System\qgYrFnN.exe
  2⤵
  PID:5608
- C:\Windows\System\MUUoUMU.exe
  C:\Windows\System\MUUoUMU.exe
  2⤵
  PID:5624
- C:\Windows\System\GWsfBNJ.exe
  C:\Windows\System\GWsfBNJ.exe
  2⤵
  PID:5640
- C:\Windows\System\tqClkUN.exe
  C:\Windows\System\tqClkUN.exe
  2⤵
  PID:5656
- C:\Windows\System\WqBBaiY.exe
  C:\Windows\System\WqBBaiY.exe
  2⤵
  PID:5672
- C:\Windows\System\EhXZUjQ.exe
  C:\Windows\System\EhXZUjQ.exe
  2⤵
  PID:5692
- C:\Windows\System\JPRWDUU.exe
  C:\Windows\System\JPRWDUU.exe
  2⤵
  PID:5712
- C:\Windows\System\VVVFLKe.exe
  C:\Windows\System\VVVFLKe.exe
  2⤵
  PID:5728
- C:\Windows\System\RlVYCBq.exe
  C:\Windows\System\RlVYCBq.exe
  2⤵
  PID:5744
- C:\Windows\System\YkxeVrP.exe
  C:\Windows\System\YkxeVrP.exe
  2⤵
  PID:5760
- C:\Windows\System\hIRVEsX.exe
  C:\Windows\System\hIRVEsX.exe
  2⤵
  PID:5776
- C:\Windows\System\YQIAOyP.exe
  C:\Windows\System\YQIAOyP.exe
  2⤵
  PID:5792
- C:\Windows\System\EWcRazh.exe
  C:\Windows\System\EWcRazh.exe
  2⤵
  PID:5808
- C:\Windows\System\TaxjTIj.exe
  C:\Windows\System\TaxjTIj.exe
  2⤵
  PID:5824
- C:\Windows\System\mUDfGNP.exe
  C:\Windows\System\mUDfGNP.exe
  2⤵
  PID:5840
- C:\Windows\System\OLyhnrx.exe
  C:\Windows\System\OLyhnrx.exe
  2⤵
  PID:5856
- C:\Windows\System\sWRdnhH.exe
  C:\Windows\System\sWRdnhH.exe
  2⤵
  PID:5872
- C:\Windows\System\kduAuXN.exe
  C:\Windows\System\kduAuXN.exe
  2⤵
  PID:5888
- C:\Windows\System\lLEcBdV.exe
  C:\Windows\System\lLEcBdV.exe
  2⤵
  PID:5904
- C:\Windows\System\QgJQNsx.exe
  C:\Windows\System\QgJQNsx.exe
  2⤵
  PID:5920
- C:\Windows\System\kOCQwHa.exe
  C:\Windows\System\kOCQwHa.exe
  2⤵
  PID:5936
- C:\Windows\System\ruIhqIA.exe
  C:\Windows\System\ruIhqIA.exe
  2⤵
  PID:5952
- C:\Windows\System\KmMgWzN.exe
  C:\Windows\System\KmMgWzN.exe
  2⤵
  PID:5968
- C:\Windows\System\SNldfOb.exe
  C:\Windows\System\SNldfOb.exe
  2⤵
  PID:5984
- C:\Windows\System\aHFSwbH.exe
  C:\Windows\System\aHFSwbH.exe
  2⤵
  PID:6000
- C:\Windows\System\oxGhVRP.exe
  C:\Windows\System\oxGhVRP.exe
  2⤵
  PID:6016
- C:\Windows\System\kxOkjFX.exe
  C:\Windows\System\kxOkjFX.exe
  2⤵
  PID:6032
- C:\Windows\System\cssVnaA.exe
  C:\Windows\System\cssVnaA.exe
  2⤵
  PID:6048
- C:\Windows\System\BrYaHeR.exe
  C:\Windows\System\BrYaHeR.exe
  2⤵
  PID:6076
- C:\Windows\System\BDgWlwS.exe
  C:\Windows\System\BDgWlwS.exe
  2⤵
  PID:6092
- C:\Windows\System\YhrLFlz.exe
  C:\Windows\System\YhrLFlz.exe
  2⤵
  PID:6112
- C:\Windows\System\JfEIhUn.exe
  C:\Windows\System\JfEIhUn.exe
  2⤵
  PID:6128
- C:\Windows\System\KmXJAxM.exe
  C:\Windows\System\KmXJAxM.exe
  2⤵
  PID:4524
- C:\Windows\System\HHjSJAh.exe
  C:\Windows\System\HHjSJAh.exe
  2⤵
  PID:4792
- C:\Windows\System\YrdRAho.exe
  C:\Windows\System\YrdRAho.exe
  2⤵
  PID:4568
- C:\Windows\System\LQCflDr.exe
  C:\Windows\System\LQCflDr.exe
  2⤵
  PID:4944
- C:\Windows\System\ruMrgps.exe
  C:\Windows\System\ruMrgps.exe
  2⤵
  PID:5152
- C:\Windows\System\FhaVvXj.exe
  C:\Windows\System\FhaVvXj.exe
  2⤵
  PID:5124
- C:\Windows\System\pmNBmvr.exe
  C:\Windows\System\pmNBmvr.exe
  2⤵
  PID:5196
- C:\Windows\System\LAnptZY.exe
  C:\Windows\System\LAnptZY.exe
  2⤵
  PID:5132
- C:\Windows\System\kVpyhzU.exe
  C:\Windows\System\kVpyhzU.exe
  2⤵
  PID:5204
- C:\Windows\System\vwSjloP.exe
  C:\Windows\System\vwSjloP.exe
  2⤵
  PID:5364
- C:\Windows\System\iAaWFXD.exe
  C:\Windows\System\iAaWFXD.exe
  2⤵
  PID:5436
- C:\Windows\System\cGeGOJQ.exe
  C:\Windows\System\cGeGOJQ.exe
  2⤵
  PID:5500
- C:\Windows\System\AuIrvuB.exe
  C:\Windows\System\AuIrvuB.exe
  2⤵
  PID:5568
- C:\Windows\System\uGJMkVj.exe
  C:\Windows\System\uGJMkVj.exe
  2⤵
  PID:5632
- C:\Windows\System\LAhdukS.exe
  C:\Windows\System\LAhdukS.exe
  2⤵
  PID:5324
- C:\Windows\System\sFLAzlX.exe
  C:\Windows\System\sFLAzlX.exe
  2⤵
  PID:5704
- C:\Windows\System\yExxjrq.exe
  C:\Windows\System\yExxjrq.exe
  2⤵
  PID:5340
- C:\Windows\System\bJFCZrN.exe
  C:\Windows\System\bJFCZrN.exe
  2⤵
  PID:5224
- C:\Windows\System\BbPnjmu.exe
  C:\Windows\System\BbPnjmu.exe
  2⤵
  PID:5248
- C:\Windows\System\aDwhoKp.exe
  C:\Windows\System\aDwhoKp.exe
  2⤵
  PID:5416
- C:\Windows\System\hOftJlT.exe
  C:\Windows\System\hOftJlT.exe
  2⤵
  PID:5804
- C:\Windows\System\tEntjWF.exe
  C:\Windows\System\tEntjWF.exe
  2⤵
  PID:5264
- C:\Windows\System\RRUeIbr.exe
  C:\Windows\System\RRUeIbr.exe
  2⤵
  PID:5720
- C:\Windows\System\vUaQaok.exe
  C:\Windows\System\vUaQaok.exe
  2⤵
  PID:5412
- C:\Windows\System\erBieNM.exe
  C:\Windows\System\erBieNM.exe
  2⤵
  PID:5928
- C:\Windows\System\NhrbhvZ.exe
  C:\Windows\System\NhrbhvZ.exe
  2⤵
  PID:5280
- C:\Windows\System\pzTvcVa.exe
  C:\Windows\System\pzTvcVa.exe
  2⤵
  PID:5556
- C:\Windows\System\nfWpWCa.exe
  C:\Windows\System\nfWpWCa.exe
  2⤵
  PID:5620
- C:\Windows\System\wZTZfnG.exe
  C:\Windows\System\wZTZfnG.exe
  2⤵
  PID:5684
- C:\Windows\System\ZnKAEqZ.exe
  C:\Windows\System\ZnKAEqZ.exe
  2⤵
  PID:5756
- C:\Windows\System\SYRuNzF.exe
  C:\Windows\System\SYRuNzF.exe
  2⤵
  PID:5820
- C:\Windows\System\xlRPheb.exe
  C:\Windows\System\xlRPheb.exe
  2⤵
  PID:5880
- C:\Windows\System\AEpXRnw.exe
  C:\Windows\System\AEpXRnw.exe
  2⤵
  PID:5944
- C:\Windows\System\rMPhSme.exe
  C:\Windows\System\rMPhSme.exe
  2⤵
  PID:6008
- C:\Windows\System\NEhBMTa.exe
  C:\Windows\System\NEhBMTa.exe
  2⤵
  PID:6044
- C:\Windows\System\djrWhij.exe
  C:\Windows\System\djrWhij.exe
  2⤵
  PID:6028
- C:\Windows\System\zqwPIkS.exe
  C:\Windows\System\zqwPIkS.exe
  2⤵
  PID:6068
- C:\Windows\System\ZbhVGdY.exe
  C:\Windows\System\ZbhVGdY.exe
  2⤵
  PID:6108
- C:\Windows\System\RVMRrzE.exe
  C:\Windows\System\RVMRrzE.exe
  2⤵
  PID:4968
- C:\Windows\System\rwWlraP.exe
  C:\Windows\System\rwWlraP.exe
  2⤵
  PID:5216
- C:\Windows\System\uelBvLo.exe
  C:\Windows\System\uelBvLo.exe
  2⤵
  PID:5396
- C:\Windows\System\ECjGVTI.exe
  C:\Windows\System\ECjGVTI.exe
  2⤵
  PID:6124
- C:\Windows\System\RSWMtPM.exe
  C:\Windows\System\RSWMtPM.exe
  2⤵
  PID:5344
- C:\Windows\System\wtkkAVM.exe
  C:\Windows\System\wtkkAVM.exe
  2⤵
  PID:6120
- C:\Windows\System\KfqFPax.exe
  C:\Windows\System\KfqFPax.exe
  2⤵
  PID:4988
- C:\Windows\System\tXsKzxa.exe
  C:\Windows\System\tXsKzxa.exe
  2⤵
  PID:5228
- C:\Windows\System\vlKgbfi.exe
  C:\Windows\System\vlKgbfi.exe
  2⤵
  PID:5136
- C:\Windows\System\FXuDWfY.exe
  C:\Windows\System\FXuDWfY.exe
  2⤵
  PID:5600
- C:\Windows\System\ZoJOhod.exe
  C:\Windows\System\ZoJOhod.exe
  2⤵
  PID:5220
- C:\Windows\System\tfIeCzc.exe
  C:\Windows\System\tfIeCzc.exe
  2⤵
  PID:5900
- C:\Windows\System\iEnXgFv.exe
  C:\Windows\System\iEnXgFv.exe
  2⤵
  PID:5488
- C:\Windows\System\wqxGMYx.exe
  C:\Windows\System\wqxGMYx.exe
  2⤵
  PID:5816
- C:\Windows\System\FEiKKyk.exe
  C:\Windows\System\FEiKKyk.exe
  2⤵
  PID:5772
- C:\Windows\System\LJiurkC.exe
  C:\Windows\System\LJiurkC.exe
  2⤵
  PID:5960
- C:\Windows\System\VAumnTC.exe
  C:\Windows\System\VAumnTC.exe
  2⤵
  PID:5832
- C:\Windows\System\QVegfaq.exe
  C:\Windows\System\QVegfaq.exe
  2⤵
  PID:5520
- C:\Windows\System\oPbVEIc.exe
  C:\Windows\System\oPbVEIc.exe
  2⤵
  PID:5616
- C:\Windows\System\rRrjnEF.exe
  C:\Windows\System\rRrjnEF.exe
  2⤵
  PID:4820
- C:\Windows\System\JQdsYiL.exe
  C:\Windows\System\JQdsYiL.exe
  2⤵
  PID:5664
- C:\Windows\System\LFbZuCz.exe
  C:\Windows\System\LFbZuCz.exe
  2⤵
  PID:6104
- C:\Windows\System\FFxbRjh.exe
  C:\Windows\System\FFxbRjh.exe
  2⤵
  PID:5536
- C:\Windows\System\zOnesQB.exe
  C:\Windows\System\zOnesQB.exe
  2⤵
  PID:4236
- C:\Windows\System\StsnHjv.exe
  C:\Windows\System\StsnHjv.exe
  2⤵
  PID:6088
- C:\Windows\System\benfRbU.exe
  C:\Windows\System\benfRbU.exe
  2⤵
  PID:5768
- C:\Windows\System\JiKIjjx.exe
  C:\Windows\System\JiKIjjx.exe
  2⤵
  PID:5864
- C:\Windows\System\sxgjvpD.exe
  C:\Windows\System\sxgjvpD.exe
  2⤵
  PID:6064
- C:\Windows\System\xvFzueq.exe
  C:\Windows\System\xvFzueq.exe
  2⤵
  PID:5212
- C:\Windows\System\otUTMLD.exe
  C:\Windows\System\otUTMLD.exe
  2⤵
  PID:6024
- C:\Windows\System\raQrUEP.exe
  C:\Windows\System\raQrUEP.exe
  2⤵
  PID:5680
- C:\Windows\System\DwSdvEp.exe
  C:\Windows\System\DwSdvEp.exe
  2⤵
  PID:5548
- C:\Windows\System\xWPJiSb.exe
  C:\Windows\System\xWPJiSb.exe
  2⤵
  PID:5380
- C:\Windows\System\HxCpNzh.exe
  C:\Windows\System\HxCpNzh.exe
  2⤵
  PID:5356
- C:\Windows\System\RRNQDdW.exe
  C:\Windows\System\RRNQDdW.exe
  2⤵
  PID:5852
- C:\Windows\System\fCRdTMV.exe
  C:\Windows\System\fCRdTMV.exe
  2⤵
  PID:6084
- C:\Windows\System\CqIsTSt.exe
  C:\Windows\System\CqIsTSt.exe
  2⤵
  PID:5848
- C:\Windows\System\vKuvgWa.exe
  C:\Windows\System\vKuvgWa.exe
  2⤵
  PID:6156
- C:\Windows\System\kVlfnst.exe
  C:\Windows\System\kVlfnst.exe
  2⤵
  PID:6172
- C:\Windows\System\zViMVOY.exe
  C:\Windows\System\zViMVOY.exe
  2⤵
  PID:6188
- C:\Windows\System\tJquJnc.exe
  C:\Windows\System\tJquJnc.exe
  2⤵
  PID:6204
- C:\Windows\System\rxscQyE.exe
  C:\Windows\System\rxscQyE.exe
  2⤵
  PID:6220
- C:\Windows\System\NWnknHe.exe
  C:\Windows\System\NWnknHe.exe
  2⤵
  PID:6240
- C:\Windows\System\SRFQvOQ.exe
  C:\Windows\System\SRFQvOQ.exe
  2⤵
  PID:6260
- C:\Windows\System\UxVDZKs.exe
  C:\Windows\System\UxVDZKs.exe
  2⤵
  PID:6280
- C:\Windows\System\jymahbD.exe
  C:\Windows\System\jymahbD.exe
  2⤵
  PID:6296
- C:\Windows\System\rjspUGR.exe
  C:\Windows\System\rjspUGR.exe
  2⤵
  PID:6312
- C:\Windows\System\nkWNOpq.exe
  C:\Windows\System\nkWNOpq.exe
  2⤵
  PID:6328
- C:\Windows\System\ePBmRTk.exe
  C:\Windows\System\ePBmRTk.exe
  2⤵
  PID:6344
- C:\Windows\System\PtFDMDP.exe
  C:\Windows\System\PtFDMDP.exe
  2⤵
  PID:6360
- C:\Windows\System\MyeafGR.exe
  C:\Windows\System\MyeafGR.exe
  2⤵
  PID:6376
- C:\Windows\System\YawbgaY.exe
  C:\Windows\System\YawbgaY.exe
  2⤵
  PID:6392
- C:\Windows\System\aOyFmiw.exe
  C:\Windows\System\aOyFmiw.exe
  2⤵
  PID:6416
- C:\Windows\System\VbVPmJs.exe
  C:\Windows\System\VbVPmJs.exe
  2⤵
  PID:6432
- C:\Windows\System\ypSLcTz.exe
  C:\Windows\System\ypSLcTz.exe
  2⤵
  PID:6452
- C:\Windows\System\zUtGACN.exe
  C:\Windows\System\zUtGACN.exe
  2⤵
  PID:6468
- C:\Windows\System\eZHdEer.exe
  C:\Windows\System\eZHdEer.exe
  2⤵
  PID:6484
- C:\Windows\System\DwNFiPy.exe
  C:\Windows\System\DwNFiPy.exe
  2⤵
  PID:6500
- C:\Windows\System\BBRJyHI.exe
  C:\Windows\System\BBRJyHI.exe
  2⤵
  PID:6516
- C:\Windows\System\vkDarxI.exe
  C:\Windows\System\vkDarxI.exe
  2⤵
  PID:6532
- C:\Windows\System\EiYzJPv.exe
  C:\Windows\System\EiYzJPv.exe
  2⤵
  PID:6548
- C:\Windows\System\YWyBuba.exe
  C:\Windows\System\YWyBuba.exe
  2⤵
  PID:6568
- C:\Windows\System\wKUehoS.exe
  C:\Windows\System\wKUehoS.exe
  2⤵
  PID:6584
- C:\Windows\System\ciRAFTA.exe
  C:\Windows\System\ciRAFTA.exe
  2⤵
  PID:6600
- C:\Windows\System\UJaabmI.exe
  C:\Windows\System\UJaabmI.exe
  2⤵
  PID:6616
- C:\Windows\System\VAAJCfS.exe
  C:\Windows\System\VAAJCfS.exe
  2⤵
  PID:6632
- C:\Windows\System\GppYNBj.exe
  C:\Windows\System\GppYNBj.exe
  2⤵
  PID:6648
- C:\Windows\System\knuqUEX.exe
  C:\Windows\System\knuqUEX.exe
  2⤵
  PID:6664
- C:\Windows\System\ZkAdBXD.exe
  C:\Windows\System\ZkAdBXD.exe
  2⤵
  PID:6680
- C:\Windows\System\mgMTjCG.exe
  C:\Windows\System\mgMTjCG.exe
  2⤵
  PID:6696
- C:\Windows\System\MjllLWx.exe
  C:\Windows\System\MjllLWx.exe
  2⤵
  PID:6716
- C:\Windows\System\BVhHUSv.exe
  C:\Windows\System\BVhHUSv.exe
  2⤵
  PID:6732
- C:\Windows\System\WLFnpke.exe
  C:\Windows\System\WLFnpke.exe
  2⤵
  PID:6748
- C:\Windows\System\lzvxbVP.exe
  C:\Windows\System\lzvxbVP.exe
  2⤵
  PID:6764
- C:\Windows\System\dvxVsSz.exe
  C:\Windows\System\dvxVsSz.exe
  2⤵
  PID:6780
- C:\Windows\System\elukPFe.exe
  C:\Windows\System\elukPFe.exe
  2⤵
  PID:6796
- C:\Windows\System\HfoztcJ.exe
  C:\Windows\System\HfoztcJ.exe
  2⤵
  PID:6812
- C:\Windows\System\RyRmjcy.exe
  C:\Windows\System\RyRmjcy.exe
  2⤵
  PID:6828
- C:\Windows\System\zxzhKYA.exe
  C:\Windows\System\zxzhKYA.exe
  2⤵
  PID:6844
- C:\Windows\System\SKrCjAR.exe
  C:\Windows\System\SKrCjAR.exe
  2⤵
  PID:6868
- C:\Windows\System\KQCfADL.exe
  C:\Windows\System\KQCfADL.exe
  2⤵
  PID:6884
- C:\Windows\System\SgcIQnF.exe
  C:\Windows\System\SgcIQnF.exe
  2⤵
  PID:6900
- C:\Windows\System\ZUHuFpz.exe
  C:\Windows\System\ZUHuFpz.exe
  2⤵
  PID:6916
- C:\Windows\System\WKmJPdz.exe
  C:\Windows\System\WKmJPdz.exe
  2⤵
  PID:6932
- C:\Windows\System\rrYBHvj.exe
  C:\Windows\System\rrYBHvj.exe
  2⤵
  PID:6948
- C:\Windows\System\wNVHCQe.exe
  C:\Windows\System\wNVHCQe.exe
  2⤵
  PID:6964
- C:\Windows\System\NcCYpea.exe
  C:\Windows\System\NcCYpea.exe
  2⤵
  PID:6980
- C:\Windows\System\MaRYbgN.exe
  C:\Windows\System\MaRYbgN.exe
  2⤵
  PID:6996
- C:\Windows\System\GHcZxxf.exe
  C:\Windows\System\GHcZxxf.exe
  2⤵
  PID:7012
- C:\Windows\System\NwoLgkZ.exe
  C:\Windows\System\NwoLgkZ.exe
  2⤵
  PID:7028
- C:\Windows\System\TRPeSpQ.exe
  C:\Windows\System\TRPeSpQ.exe
  2⤵
  PID:7044
- C:\Windows\System\mbTIfzE.exe
  C:\Windows\System\mbTIfzE.exe
  2⤵
  PID:7060
- C:\Windows\System\GjCOmsS.exe
  C:\Windows\System\GjCOmsS.exe
  2⤵
  PID:7076
- C:\Windows\System\AldtTGA.exe
  C:\Windows\System\AldtTGA.exe
  2⤵
  PID:7100
- C:\Windows\System\EuQgmld.exe
  C:\Windows\System\EuQgmld.exe
  2⤵
  PID:7116
- C:\Windows\System\goUnoEl.exe
  C:\Windows\System\goUnoEl.exe
  2⤵
  PID:7132
- C:\Windows\System\StUAWgz.exe
  C:\Windows\System\StUAWgz.exe
  2⤵
  PID:7152
- C:\Windows\System\fSDyXoI.exe
  C:\Windows\System\fSDyXoI.exe
  2⤵
  PID:5484
- C:\Windows\System\DnkFcju.exe
  C:\Windows\System\DnkFcju.exe
  2⤵
  PID:6152
- C:\Windows\System\fXxkSLP.exe
  C:\Windows\System\fXxkSLP.exe
  2⤵
  PID:6228
- C:\Windows\System\eoePbnW.exe
  C:\Windows\System\eoePbnW.exe
  2⤵
  PID:5472
- C:\Windows\System\BTJsTYN.exe
  C:\Windows\System\BTJsTYN.exe
  2⤵
  PID:5788
- C:\Windows\System\cbvASvw.exe
  C:\Windows\System\cbvASvw.exe
  2⤵
  PID:6212
- C:\Windows\System\WCXbNjh.exe
  C:\Windows\System\WCXbNjh.exe
  2⤵
  PID:6268
- C:\Windows\System\NQqdNOq.exe
  C:\Windows\System\NQqdNOq.exe
  2⤵
  PID:6288
- C:\Windows\System\iEagWUo.exe
  C:\Windows\System\iEagWUo.exe
  2⤵
  PID:6340
- C:\Windows\System\mSMfoXb.exe
  C:\Windows\System\mSMfoXb.exe
  2⤵
  PID:6292
- C:\Windows\System\lYWegHG.exe
  C:\Windows\System\lYWegHG.exe
  2⤵
  PID:6356
- C:\Windows\System\bzxPxzN.exe
  C:\Windows\System\bzxPxzN.exe
  2⤵
  PID:6412
- C:\Windows\System\WPqJaVj.exe
  C:\Windows\System\WPqJaVj.exe
  2⤵
  PID:6476
- C:\Windows\System\RYtGdEf.exe
  C:\Windows\System\RYtGdEf.exe
  2⤵
  PID:6540
- C:\Windows\System\LmwAwTz.exe
  C:\Windows\System\LmwAwTz.exe
  2⤵
  PID:6608
- C:\Windows\System\WRBUGOm.exe
  C:\Windows\System\WRBUGOm.exe
  2⤵
  PID:6640
- C:\Windows\System\PSGLBbh.exe
  C:\Windows\System\PSGLBbh.exe
  2⤵
  PID:6708
- C:\Windows\System\XeCEzPY.exe
  C:\Windows\System\XeCEzPY.exe
  2⤵
  PID:6524
- C:\Windows\System\nWLLVQc.exe
  C:\Windows\System\nWLLVQc.exe
  2⤵
  PID:6564
- C:\Windows\System\DtGomtk.exe
  C:\Windows\System\DtGomtk.exe
  2⤵
  PID:6776
- C:\Windows\System\tZTyqbt.exe
  C:\Windows\System\tZTyqbt.exe
  2⤵
  PID:6840
- C:\Windows\System\oVekXhG.exe
  C:\Windows\System\oVekXhG.exe
  2⤵
  PID:6908
- C:\Windows\System\WETCzdy.exe
  C:\Windows\System\WETCzdy.exe
  2⤵
  PID:6940
- C:\Windows\System\frhiAyS.exe
  C:\Windows\System\frhiAyS.exe
  2⤵
  PID:6464
- C:\Windows\System\tiyniQY.exe
  C:\Windows\System\tiyniQY.exe
  2⤵
  PID:6976
- C:\Windows\System\vAcinrZ.exe
  C:\Windows\System\vAcinrZ.exe
  2⤵
  PID:7008
- C:\Windows\System\ubcXCeU.exe
  C:\Windows\System\ubcXCeU.exe
  2⤵
  PID:7072
- C:\Windows\System\fTULARn.exe
  C:\Windows\System\fTULARn.exe
  2⤵
  PID:6824
- C:\Windows\System\AOYHsIy.exe
  C:\Windows\System\AOYHsIy.exe
  2⤵
  PID:7148
- C:\Windows\System\taxNwOK.exe
  C:\Windows\System\taxNwOK.exe
  2⤵
  PID:5588
- C:\Windows\System\WvRqbZu.exe
  C:\Windows\System\WvRqbZu.exe
  2⤵
  PID:6276
- C:\Windows\System\kyazXMB.exe
  C:\Windows\System\kyazXMB.exe
  2⤵
  PID:6408
- C:\Windows\System\buPiXeZ.exe
  C:\Windows\System\buPiXeZ.exe
  2⤵
  PID:6856
- C:\Windows\System\oGoHaPT.exe
  C:\Windows\System\oGoHaPT.exe
  2⤵
  PID:6992
- C:\Windows\System\QFmvRvq.exe
  C:\Windows\System\QFmvRvq.exe
  2⤵
  PID:6512
- C:\Windows\System\JmzqaZB.exe
  C:\Windows\System\JmzqaZB.exe
  2⤵
  PID:6928
- C:\Windows\System\LAeJVIq.exe
  C:\Windows\System\LAeJVIq.exe
  2⤵
  PID:6988
- C:\Windows\System\yreGIYj.exe
  C:\Windows\System\yreGIYj.exe
  2⤵
  PID:6196
- C:\Windows\System\jAyXQWx.exe
  C:\Windows\System\jAyXQWx.exe
  2⤵
  PID:6308
- C:\Windows\System\bKyWndg.exe
  C:\Windows\System\bKyWndg.exe
  2⤵
  PID:7088
- C:\Windows\System\YmxXnIp.exe
  C:\Windows\System\YmxXnIp.exe
  2⤵
  PID:7164
- C:\Windows\System\rbgHDXK.exe
  C:\Windows\System\rbgHDXK.exe
  2⤵
  PID:6336
- C:\Windows\System\keOaqcc.exe
  C:\Windows\System\keOaqcc.exe
  2⤵
  PID:6448
- C:\Windows\System\sHqLNgy.exe
  C:\Windows\System\sHqLNgy.exe
  2⤵
  PID:6676
- C:\Windows\System\NUjJLzR.exe
  C:\Windows\System\NUjJLzR.exe
  2⤵
  PID:6744
- C:\Windows\System\lJmMNzz.exe
  C:\Windows\System\lJmMNzz.exe
  2⤵
  PID:6660
- C:\Windows\System\HJycwcB.exe
  C:\Windows\System\HJycwcB.exe
  2⤵
  PID:6400
- C:\Windows\System\FGKThGa.exe
  C:\Windows\System\FGKThGa.exe
  2⤵
  PID:6820
- C:\Windows\System\gPPQPmb.exe
  C:\Windows\System\gPPQPmb.exe
  2⤵
  PID:6864
- C:\Windows\System\rTPCCVe.exe
  C:\Windows\System\rTPCCVe.exe
  2⤵
  PID:6492
- C:\Windows\System\VeBZmLr.exe
  C:\Windows\System\VeBZmLr.exe
  2⤵
  PID:6960
- C:\Windows\System\QqwWITp.exe
  C:\Windows\System\QqwWITp.exe
  2⤵
  PID:6972
- C:\Windows\System\zFTUtiT.exe
  C:\Windows\System\zFTUtiT.exe
  2⤵
  PID:7144
- C:\Windows\System\VGFTrbB.exe
  C:\Windows\System\VGFTrbB.exe
  2⤵
  PID:7096
- C:\Windows\System\qEWevna.exe
  C:\Windows\System\qEWevna.exe
  2⤵
  PID:6788
- C:\Windows\System\tCDOmxp.exe
  C:\Windows\System\tCDOmxp.exe
  2⤵
  PID:7052
- C:\Windows\System\IGBIFDA.exe
  C:\Windows\System\IGBIFDA.exe
  2⤵
  PID:6672
- C:\Windows\System\yVULlev.exe
  C:\Windows\System\yVULlev.exe
  2⤵
  PID:7084
- C:\Windows\System\LsXqlDE.exe
  C:\Windows\System\LsXqlDE.exe
  2⤵
  PID:6596
- C:\Windows\System\fPAVoNF.exe
  C:\Windows\System\fPAVoNF.exe
  2⤵
  PID:5240
- C:\Windows\System\hydfnpz.exe
  C:\Windows\System\hydfnpz.exe
  2⤵
  PID:7112
- C:\Windows\System\RWaFuXy.exe
  C:\Windows\System\RWaFuXy.exe
  2⤵
  PID:6508
- C:\Windows\System\SClEkDN.exe
  C:\Windows\System\SClEkDN.exe
  2⤵
  PID:6180
- C:\Windows\System\yRgyOqi.exe
  C:\Windows\System\yRgyOqi.exe
  2⤵
  PID:7128
- C:\Windows\System\ovUbjtP.exe
  C:\Windows\System\ovUbjtP.exe
  2⤵
  PID:6912
- C:\Windows\System\xqLtSoW.exe
  C:\Windows\System\xqLtSoW.exe
  2⤵
  PID:6580
- C:\Windows\System\TspPQqT.exe
  C:\Windows\System\TspPQqT.exe
  2⤵
  PID:7140
- C:\Windows\System\WKaieeu.exe
  C:\Windows\System\WKaieeu.exe
  2⤵
  PID:7172
- C:\Windows\System\cqjHGFN.exe
  C:\Windows\System\cqjHGFN.exe
  2⤵
  PID:7188
- C:\Windows\System\NZatGEG.exe
  C:\Windows\System\NZatGEG.exe
  2⤵
  PID:7204
- C:\Windows\System\XkAgxsX.exe
  C:\Windows\System\XkAgxsX.exe
  2⤵
  PID:7220
- C:\Windows\System\TVRapRq.exe
  C:\Windows\System\TVRapRq.exe
  2⤵
  PID:7324
- C:\Windows\System\mfEFOAw.exe
  C:\Windows\System\mfEFOAw.exe
  2⤵
  PID:7340
- C:\Windows\System\JXxghjJ.exe
  C:\Windows\System\JXxghjJ.exe
  2⤵
  PID:7356
- C:\Windows\System\hzYheJX.exe
  C:\Windows\System\hzYheJX.exe
  2⤵
  PID:7372
- C:\Windows\System\mAFfESq.exe
  C:\Windows\System\mAFfESq.exe
  2⤵
  PID:7388
- C:\Windows\System\LqmjMyk.exe
  C:\Windows\System\LqmjMyk.exe
  2⤵
  PID:7404
- C:\Windows\System\ThoQxUA.exe
  C:\Windows\System\ThoQxUA.exe
  2⤵
  PID:7420
- C:\Windows\System\hNlyTsC.exe
  C:\Windows\System\hNlyTsC.exe
  2⤵
  PID:7436
- C:\Windows\System\MuMxPRW.exe
  C:\Windows\System\MuMxPRW.exe
  2⤵
  PID:7452
- C:\Windows\System\sfLbLBq.exe
  C:\Windows\System\sfLbLBq.exe
  2⤵
  PID:7472
- C:\Windows\System\RYdKYTo.exe
  C:\Windows\System\RYdKYTo.exe
  2⤵
  PID:7488
- C:\Windows\System\CaTNZre.exe
  C:\Windows\System\CaTNZre.exe
  2⤵
  PID:7504
- C:\Windows\System\UTTPolM.exe
  C:\Windows\System\UTTPolM.exe
  2⤵
  PID:7524
- C:\Windows\System\PBMFxte.exe
  C:\Windows\System\PBMFxte.exe
  2⤵
  PID:7540
- C:\Windows\System\ClTfQEN.exe
  C:\Windows\System\ClTfQEN.exe
  2⤵
  PID:7556
- C:\Windows\System\YssJSBv.exe
  C:\Windows\System\YssJSBv.exe
  2⤵
  PID:7572
- C:\Windows\System\HPGzgIW.exe
  C:\Windows\System\HPGzgIW.exe
  2⤵
  PID:7588
- C:\Windows\System\AkgOYwJ.exe
  C:\Windows\System\AkgOYwJ.exe
  2⤵
  PID:7604
- C:\Windows\System\MRmyojn.exe
  C:\Windows\System\MRmyojn.exe
  2⤵
  PID:7620
- C:\Windows\System\dWjxzVA.exe
  C:\Windows\System\dWjxzVA.exe
  2⤵
  PID:7636
- C:\Windows\System\mpQytkK.exe
  C:\Windows\System\mpQytkK.exe
  2⤵
  PID:7652
- C:\Windows\System\zACURVP.exe
  C:\Windows\System\zACURVP.exe
  2⤵
  PID:7672
- C:\Windows\System\mmTxJJh.exe
  C:\Windows\System\mmTxJJh.exe
  2⤵
  PID:7688
- C:\Windows\System\RqcWSna.exe
  C:\Windows\System\RqcWSna.exe
  2⤵
  PID:7704
- C:\Windows\System\DZGRfOs.exe
  C:\Windows\System\DZGRfOs.exe
  2⤵
  PID:7720
- C:\Windows\System\xlzsOKI.exe
  C:\Windows\System\xlzsOKI.exe
  2⤵
  PID:7740
- C:\Windows\System\wkKDccc.exe
  C:\Windows\System\wkKDccc.exe
  2⤵
  PID:7756
- C:\Windows\System\YJvYQIU.exe
  C:\Windows\System\YJvYQIU.exe
  2⤵
  PID:7772
- C:\Windows\System\awrfilr.exe
  C:\Windows\System\awrfilr.exe
  2⤵
  PID:7788
- C:\Windows\System\tKgFQZW.exe
  C:\Windows\System\tKgFQZW.exe
  2⤵
  PID:7804
- C:\Windows\System\ILfwogI.exe
  C:\Windows\System\ILfwogI.exe
  2⤵
  PID:7820
- C:\Windows\System\LGZNcHk.exe
  C:\Windows\System\LGZNcHk.exe
  2⤵
  PID:7836
- C:\Windows\System\qcrupae.exe
  C:\Windows\System\qcrupae.exe
  2⤵
  PID:7852
- C:\Windows\System\AEQzgFF.exe
  C:\Windows\System\AEQzgFF.exe
  2⤵
  PID:7868
- C:\Windows\System\bRKvuVb.exe
  C:\Windows\System\bRKvuVb.exe
  2⤵
  PID:7884
- C:\Windows\System\xPamkdM.exe
  C:\Windows\System\xPamkdM.exe
  2⤵
  PID:7900
- C:\Windows\System\VexEfhl.exe
  C:\Windows\System\VexEfhl.exe
  2⤵
  PID:7916
- C:\Windows\System\vQceuZk.exe
  C:\Windows\System\vQceuZk.exe
  2⤵
  PID:7932
- C:\Windows\System\TOhACTq.exe
  C:\Windows\System\TOhACTq.exe
  2⤵
  PID:7948
- C:\Windows\System\mJBFpvW.exe
  C:\Windows\System\mJBFpvW.exe
  2⤵
  PID:7964
- C:\Windows\System\itMmKFq.exe
  C:\Windows\System\itMmKFq.exe
  2⤵
  PID:7980
- C:\Windows\System\WVbgxzc.exe
  C:\Windows\System\WVbgxzc.exe
  2⤵
  PID:8000
- C:\Windows\System\gsBAbFa.exe
  C:\Windows\System\gsBAbFa.exe
  2⤵
  PID:8016
- C:\Windows\System\gZKYiPH.exe
  C:\Windows\System\gZKYiPH.exe
  2⤵
  PID:8032
- C:\Windows\System\FYWAnYq.exe
  C:\Windows\System\FYWAnYq.exe
  2⤵
  PID:8048
- C:\Windows\System\MMbkRYl.exe
  C:\Windows\System\MMbkRYl.exe
  2⤵
  PID:8064
- C:\Windows\System\mHtdXtf.exe
  C:\Windows\System\mHtdXtf.exe
  2⤵
  PID:8080
- C:\Windows\System\LIneCul.exe
  C:\Windows\System\LIneCul.exe
  2⤵
  PID:8096
- C:\Windows\System\JKBVIWX.exe
  C:\Windows\System\JKBVIWX.exe
  2⤵
  PID:8112
- C:\Windows\System\SwgOMvv.exe
  C:\Windows\System\SwgOMvv.exe
  2⤵
  PID:8128
- C:\Windows\System\YOoGkMU.exe
  C:\Windows\System\YOoGkMU.exe
  2⤵
  PID:8144
- C:\Windows\System\dBYRJwc.exe
  C:\Windows\System\dBYRJwc.exe
  2⤵
  PID:8160
- C:\Windows\System\AOotUPY.exe
  C:\Windows\System\AOotUPY.exe
  2⤵
  PID:8176
- C:\Windows\System\VBEPuYy.exe
  C:\Windows\System\VBEPuYy.exe
  2⤵
  PID:6248
- C:\Windows\System\KVdngLX.exe
  C:\Windows\System\KVdngLX.exe
  2⤵
  PID:7200
- C:\Windows\System\fGmUJbD.exe
  C:\Windows\System\fGmUJbD.exe
  2⤵
  PID:7004
- C:\Windows\System\TGYGiMp.exe
  C:\Windows\System\TGYGiMp.exe
  2⤵
  PID:6836
- C:\Windows\System\YXLhlUs.exe
  C:\Windows\System\YXLhlUs.exe
  2⤵
  PID:7212
- C:\Windows\System\kbMXQJo.exe
  C:\Windows\System\kbMXQJo.exe
  2⤵
  PID:7252
- C:\Windows\System\PALXIwb.exe
  C:\Windows\System\PALXIwb.exe
  2⤵
  PID:7264
- C:\Windows\System\njHOXPN.exe
  C:\Windows\System\njHOXPN.exe
  2⤵
  PID:7280
- C:\Windows\System\WTJIdui.exe
  C:\Windows\System\WTJIdui.exe
  2⤵
  PID:7296
- C:\Windows\System\JaKPlaj.exe
  C:\Windows\System\JaKPlaj.exe
  2⤵
  PID:7312
- C:\Windows\System\GQnrOcP.exe
  C:\Windows\System\GQnrOcP.exe
  2⤵
  PID:7352
- C:\Windows\System\nPbWlQf.exe
  C:\Windows\System\nPbWlQf.exe
  2⤵
  PID:7444
- C:\Windows\System\aCQLRWG.exe
  C:\Windows\System\aCQLRWG.exe
  2⤵
  PID:7512
- C:\Windows\System\uuskSqM.exe
  C:\Windows\System\uuskSqM.exe
  2⤵
  PID:7548
- C:\Windows\System\AaYxbUv.exe
  C:\Windows\System\AaYxbUv.exe
  2⤵
  PID:7580
- C:\Windows\System\ZZblhmd.exe
  C:\Windows\System\ZZblhmd.exe
  2⤵
  PID:7496
- C:\Windows\System\OiVYNCK.exe
  C:\Windows\System\OiVYNCK.exe
  2⤵
  PID:6628
- C:\Windows\System\lFsmXxR.exe
  C:\Windows\System\lFsmXxR.exe
  2⤵
  PID:7712
- C:\Windows\System\FKuaBZS.exe
  C:\Windows\System\FKuaBZS.exe
  2⤵
  PID:7628
- C:\Windows\System\xQiFJgS.exe
  C:\Windows\System\xQiFJgS.exe
  2⤵
  PID:7668
- C:\Windows\System\AjmQcNX.exe
  C:\Windows\System\AjmQcNX.exe
  2⤵
  PID:7732
- C:\Windows\System\AfTuxLd.exe
  C:\Windows\System\AfTuxLd.exe
  2⤵
  PID:7764
- C:\Windows\System\eZgvyAX.exe
  C:\Windows\System\eZgvyAX.exe
  2⤵
  PID:7800
- C:\Windows\System\CRhPwTf.exe
  C:\Windows\System\CRhPwTf.exe
  2⤵
  PID:7864
- C:\Windows\System\nCoSVbc.exe
  C:\Windows\System\nCoSVbc.exe
  2⤵
  PID:7876
- C:\Windows\System\AwOmQdH.exe
  C:\Windows\System\AwOmQdH.exe
  2⤵
  PID:7816
- C:\Windows\System\jzwKGjS.exe
  C:\Windows\System\jzwKGjS.exe
  2⤵
  PID:8012
- C:\Windows\System\UASZkPQ.exe
  C:\Windows\System\UASZkPQ.exe
  2⤵
  PID:8104
- C:\Windows\System\fxzCQZR.exe
  C:\Windows\System\fxzCQZR.exe
  2⤵
  PID:8168
- C:\Windows\System\CIUJJaK.exe
  C:\Windows\System\CIUJJaK.exe
  2⤵
  PID:5752
- C:\Windows\System\BluwaFT.exe
  C:\Windows\System\BluwaFT.exe
  2⤵
  PID:6896
- C:\Windows\System\laOrcVM.exe
  C:\Windows\System\laOrcVM.exe
  2⤵
  PID:7248
- C:\Windows\System\jobbfJF.exe
  C:\Windows\System\jobbfJF.exe
  2⤵
  PID:7308
- C:\Windows\System\zlnhVav.exe
  C:\Windows\System\zlnhVav.exe
  2⤵
  PID:8024
- C:\Windows\System\TvzplUa.exe
  C:\Windows\System\TvzplUa.exe
  2⤵
  PID:8088
- C:\Windows\System\nhZXvYg.exe
  C:\Windows\System\nhZXvYg.exe
  2⤵
  PID:7288
- C:\Windows\System\obMyXQJ.exe
  C:\Windows\System\obMyXQJ.exe
  2⤵
  PID:8092
- C:\Windows\System\nwfLake.exe
  C:\Windows\System\nwfLake.exe
  2⤵
  PID:8156
- C:\Windows\System\gqSeFOe.exe
  C:\Windows\System\gqSeFOe.exe
  2⤵
  PID:7520
- C:\Windows\System\qhlOcqI.exe
  C:\Windows\System\qhlOcqI.exe
  2⤵
  PID:6852
- C:\Windows\System\meREbJs.exe
  C:\Windows\System\meREbJs.exe
  2⤵
  PID:7484
- C:\Windows\System\zWqqSJh.exe
  C:\Windows\System\zWqqSJh.exe
  2⤵
  PID:7380
- C:\Windows\System\xIouZKk.exe
  C:\Windows\System\xIouZKk.exe
  2⤵
  PID:7616
- C:\Windows\System\XTGOjSq.exe
  C:\Windows\System\XTGOjSq.exe
  2⤵
  PID:7396
- C:\Windows\System\TnxfkwB.exe
  C:\Windows\System\TnxfkwB.exe
  2⤵
  PID:7500
- C:\Windows\System\FpDqdSc.exe
  C:\Windows\System\FpDqdSc.exe
  2⤵
  PID:7600
- C:\Windows\System\rUkmHfY.exe
  C:\Windows\System\rUkmHfY.exe
  2⤵
  PID:7664
- C:\Windows\System\OhaZOEI.exe
  C:\Windows\System\OhaZOEI.exe
  2⤵
  PID:7908
- C:\Windows\System\jxlmKgF.exe
  C:\Windows\System\jxlmKgF.exe
  2⤵
  PID:8072
- C:\Windows\System\JGORkOc.exe
  C:\Windows\System\JGORkOc.exe
  2⤵
  PID:7928
- C:\Windows\System\sHvRdeZ.exe
  C:\Windows\System\sHvRdeZ.exe
  2⤵
  PID:7260
- C:\Windows\System\RuWHXnn.exe
  C:\Windows\System\RuWHXnn.exe
  2⤵
  PID:7364
- C:\Windows\System\ZXhCpaI.exe
  C:\Windows\System\ZXhCpaI.exe
  2⤵
  PID:7996
- C:\Windows\System\DarFYpw.exe
  C:\Windows\System\DarFYpw.exe
  2⤵
  PID:7596
- C:\Windows\System\cVvQVZm.exe
  C:\Windows\System\cVvQVZm.exe
  2⤵
  PID:7564
- C:\Windows\System\jyZaICb.exe
  C:\Windows\System\jyZaICb.exe
  2⤵
  PID:7660
- C:\Windows\System\zMXjFas.exe
  C:\Windows\System\zMXjFas.exe
  2⤵
  PID:7568
- C:\Windows\System\yUCVhgU.exe
  C:\Windows\System\yUCVhgU.exe
  2⤵
  PID:7468
- C:\Windows\System\ltrFeRw.exe
  C:\Windows\System\ltrFeRw.exe
  2⤵
  PID:7992
- C:\Windows\System\wpDHTan.exe
  C:\Windows\System\wpDHTan.exe
  2⤵
  PID:7316
- C:\Windows\System\JlsohBk.exe
  C:\Windows\System\JlsohBk.exe
  2⤵
  PID:7432
- C:\Windows\System\EdXrjZC.exe
  C:\Windows\System\EdXrjZC.exe
  2⤵
  PID:7276
- C:\Windows\System\qJmELnG.exe
  C:\Windows\System\qJmELnG.exe
  2⤵
  PID:7304
- C:\Windows\System\BgkmWeu.exe
  C:\Windows\System\BgkmWeu.exe
  2⤵
  PID:7972
- C:\Windows\System\WhaBWCr.exe
  C:\Windows\System\WhaBWCr.exe
  2⤵
  PID:7124
- C:\Windows\System\PIVGAdq.exe
  C:\Windows\System\PIVGAdq.exe
  2⤵
  PID:7240
- C:\Windows\System\ljGOCCu.exe
  C:\Windows\System\ljGOCCu.exe
  2⤵
  PID:7336
- C:\Windows\System\fmeQOal.exe
  C:\Windows\System\fmeQOal.exe
  2⤵
  PID:8136
- C:\Windows\System\kfGzRBx.exe
  C:\Windows\System\kfGzRBx.exe
  2⤵
  PID:7180
- C:\Windows\System\tqVYSWX.exe
  C:\Windows\System\tqVYSWX.exe
  2⤵
  PID:7940
- C:\Windows\System\oBKDzap.exe
  C:\Windows\System\oBKDzap.exe
  2⤵
  PID:8208
- C:\Windows\System\PUNWthP.exe
  C:\Windows\System\PUNWthP.exe
  2⤵
  PID:8224
- C:\Windows\System\SFNwsWA.exe
  C:\Windows\System\SFNwsWA.exe
  2⤵
  PID:8240
- C:\Windows\System\lnQuuiD.exe
  C:\Windows\System\lnQuuiD.exe
  2⤵
  PID:8256
- C:\Windows\System\vqZWqTs.exe
  C:\Windows\System\vqZWqTs.exe
  2⤵
  PID:8272
- C:\Windows\System\tzkxhie.exe
  C:\Windows\System\tzkxhie.exe
  2⤵
  PID:8288
- C:\Windows\System\lESVuWv.exe
  C:\Windows\System\lESVuWv.exe
  2⤵
  PID:8304
- C:\Windows\System\hvbmsdo.exe
  C:\Windows\System\hvbmsdo.exe
  2⤵
  PID:8320
- C:\Windows\System\YosNumv.exe
  C:\Windows\System\YosNumv.exe
  2⤵
  PID:8336
- C:\Windows\System\kqSGTUj.exe
  C:\Windows\System\kqSGTUj.exe
  2⤵
  PID:8352
- C:\Windows\System\fsDPnex.exe
  C:\Windows\System\fsDPnex.exe
  2⤵
  PID:8368
- C:\Windows\System\vgmpyQw.exe
  C:\Windows\System\vgmpyQw.exe
  2⤵
  PID:8388
- C:\Windows\System\vhhZUqv.exe
  C:\Windows\System\vhhZUqv.exe
  2⤵
  PID:8404
- C:\Windows\System\jcgfOCY.exe
  C:\Windows\System\jcgfOCY.exe
  2⤵
  PID:8420
- C:\Windows\System\dHaFnaW.exe
  C:\Windows\System\dHaFnaW.exe
  2⤵
  PID:8436
- C:\Windows\System\OkZciSj.exe
  C:\Windows\System\OkZciSj.exe
  2⤵
  PID:8452
- C:\Windows\System\tAXpyCs.exe
  C:\Windows\System\tAXpyCs.exe
  2⤵
  PID:8468
- C:\Windows\System\cjckvud.exe
  C:\Windows\System\cjckvud.exe
  2⤵
  PID:8484
- C:\Windows\System\xRneZBA.exe
  C:\Windows\System\xRneZBA.exe
  2⤵
  PID:8500
- C:\Windows\System\LTNidDQ.exe
  C:\Windows\System\LTNidDQ.exe
  2⤵
  PID:8516
- C:\Windows\System\hTzKZmS.exe
  C:\Windows\System\hTzKZmS.exe
  2⤵
  PID:8532
- C:\Windows\System\AYVrgxa.exe
  C:\Windows\System\AYVrgxa.exe
  2⤵
  PID:8548
- C:\Windows\System\yqnPvQE.exe
  C:\Windows\System\yqnPvQE.exe
  2⤵
  PID:8564
- C:\Windows\System\fcYyCwT.exe
  C:\Windows\System\fcYyCwT.exe
  2⤵
  PID:8580
- C:\Windows\System\xDDcTHp.exe
  C:\Windows\System\xDDcTHp.exe
  2⤵
  PID:8596
- C:\Windows\System\oKqYqTF.exe
  C:\Windows\System\oKqYqTF.exe
  2⤵
  PID:8612
- C:\Windows\System\mFHNRqh.exe
  C:\Windows\System\mFHNRqh.exe
  2⤵
  PID:8628
- C:\Windows\System\MbLmOAQ.exe
  C:\Windows\System\MbLmOAQ.exe
  2⤵
  PID:8644
- C:\Windows\System\jVITIon.exe
  C:\Windows\System\jVITIon.exe
  2⤵
  PID:8660
- C:\Windows\System\asvXANN.exe
  C:\Windows\System\asvXANN.exe
  2⤵
  PID:8676
- C:\Windows\System\mtWQXYd.exe
  C:\Windows\System\mtWQXYd.exe
  2⤵
  PID:8692
- C:\Windows\System\fljVopJ.exe
  C:\Windows\System\fljVopJ.exe
  2⤵
  PID:8708
- C:\Windows\System\dGhJEWO.exe
  C:\Windows\System\dGhJEWO.exe
  2⤵
  PID:8724
- C:\Windows\System\HJjNMFY.exe
  C:\Windows\System\HJjNMFY.exe
  2⤵
  PID:8740
- C:\Windows\System\tDNBiaW.exe
  C:\Windows\System\tDNBiaW.exe
  2⤵
  PID:8756
- C:\Windows\System\tVOJhwZ.exe
  C:\Windows\System\tVOJhwZ.exe
  2⤵
  PID:8772
- C:\Windows\System\JlGSSOy.exe
  C:\Windows\System\JlGSSOy.exe
  2⤵
  PID:8788
- C:\Windows\System\qDZUNqf.exe
  C:\Windows\System\qDZUNqf.exe
  2⤵
  PID:8804
- C:\Windows\System\DdyPCoU.exe
  C:\Windows\System\DdyPCoU.exe
  2⤵
  PID:8820
- C:\Windows\System\GTDoVSf.exe
  C:\Windows\System\GTDoVSf.exe
  2⤵
  PID:8836
- C:\Windows\System\dgjCdor.exe
  C:\Windows\System\dgjCdor.exe
  2⤵
  PID:8852
- C:\Windows\System\kTPwghS.exe
  C:\Windows\System\kTPwghS.exe
  2⤵
  PID:8868
- C:\Windows\System\KXMMCya.exe
  C:\Windows\System\KXMMCya.exe
  2⤵
  PID:8884
- C:\Windows\System\wZoypxR.exe
  C:\Windows\System\wZoypxR.exe
  2⤵
  PID:8900
- C:\Windows\System\jyIXelx.exe
  C:\Windows\System\jyIXelx.exe
  2⤵
  PID:8916
- C:\Windows\System\yJPaBBl.exe
  C:\Windows\System\yJPaBBl.exe
  2⤵
  PID:8932
- C:\Windows\System\XBPkmCj.exe
  C:\Windows\System\XBPkmCj.exe
  2⤵
  PID:8948
- C:\Windows\System\fWIptQb.exe
  C:\Windows\System\fWIptQb.exe
  2⤵
  PID:8964
- C:\Windows\System\DAeZKIs.exe
  C:\Windows\System\DAeZKIs.exe
  2⤵
  PID:8984
- C:\Windows\System\EEYlMvK.exe
  C:\Windows\System\EEYlMvK.exe
  2⤵
  PID:9000
- C:\Windows\System\gNqcpTI.exe
  C:\Windows\System\gNqcpTI.exe
  2⤵
  PID:9016
- C:\Windows\System\PFUJWOZ.exe
  C:\Windows\System\PFUJWOZ.exe
  2⤵
  PID:9032
- C:\Windows\System\ewFSRLl.exe
  C:\Windows\System\ewFSRLl.exe
  2⤵
  PID:9048
- C:\Windows\System\RNjwduQ.exe
  C:\Windows\System\RNjwduQ.exe
  2⤵
  PID:9064
- C:\Windows\System\oCFXRpt.exe
  C:\Windows\System\oCFXRpt.exe
  2⤵
  PID:9080
- C:\Windows\System\aydEHVJ.exe
  C:\Windows\System\aydEHVJ.exe
  2⤵
  PID:9096
- C:\Windows\System\AxZgjYM.exe
  C:\Windows\System\AxZgjYM.exe
  2⤵
  PID:9112
- C:\Windows\System\CHKYDcK.exe
  C:\Windows\System\CHKYDcK.exe
  2⤵
  PID:9128
- C:\Windows\System\GzcjWcV.exe
  C:\Windows\System\GzcjWcV.exe
  2⤵
  PID:9152
- C:\Windows\System\xPmNaAt.exe
  C:\Windows\System\xPmNaAt.exe
  2⤵
  PID:9168
- C:\Windows\System\iiBPbgG.exe
  C:\Windows\System\iiBPbgG.exe
  2⤵
  PID:9184
- C:\Windows\System\BzUybLS.exe
  C:\Windows\System\BzUybLS.exe
  2⤵
  PID:9208
- C:\Windows\System\RHjyHEN.exe
  C:\Windows\System\RHjyHEN.exe
  2⤵
  PID:8216
- C:\Windows\System\wOAbIGj.exe
  C:\Windows\System\wOAbIGj.exe
  2⤵
  PID:8252
- C:\Windows\System\oYSwfrj.exe
  C:\Windows\System\oYSwfrj.exe
  2⤵
  PID:8312
- C:\Windows\System\IocYWYp.exe
  C:\Windows\System\IocYWYp.exe
  2⤵
  PID:7844
- C:\Windows\System\fRlnbDH.exe
  C:\Windows\System\fRlnbDH.exe
  2⤵
  PID:7068
- C:\Windows\System\OMaRhgS.exe
  C:\Windows\System\OMaRhgS.exe
  2⤵
  PID:7944
- C:\Windows\System\LNnKXGO.exe
  C:\Windows\System\LNnKXGO.exe
  2⤵
  PID:8264
- C:\Windows\System\uIFPFQN.exe
  C:\Windows\System\uIFPFQN.exe
  2⤵
  PID:8328
- C:\Windows\System\JBkkETY.exe
  C:\Windows\System\JBkkETY.exe
  2⤵
  PID:8396
- C:\Windows\System\HVZPhjJ.exe
  C:\Windows\System\HVZPhjJ.exe
  2⤵
  PID:8380
- C:\Windows\System\cyimelp.exe
  C:\Windows\System\cyimelp.exe
  2⤵
  PID:8444
- C:\Windows\System\gyGlcQJ.exe
  C:\Windows\System\gyGlcQJ.exe
  2⤵
  PID:8508
- C:\Windows\System\XzgNlCd.exe
  C:\Windows\System\XzgNlCd.exe
  2⤵
  PID:8496
- C:\Windows\System\OocoIZW.exe
  C:\Windows\System\OocoIZW.exe
  2⤵
  PID:8492
- C:\Windows\System\DJsbzDB.exe
  C:\Windows\System\DJsbzDB.exe
  2⤵
  PID:8572
- C:\Windows\System\PxAIrkO.exe
  C:\Windows\System\PxAIrkO.exe
  2⤵
  PID:8604
- C:\Windows\System\FqjsTdh.exe
  C:\Windows\System\FqjsTdh.exe
  2⤵
  PID:8636
- C:\Windows\System\ibpJLVG.exe
  C:\Windows\System\ibpJLVG.exe
  2⤵
  PID:8588
- C:\Windows\System\FbqFkOb.exe
  C:\Windows\System\FbqFkOb.exe
  2⤵
  PID:8732
- C:\Windows\System\ZZpNbfi.exe
  C:\Windows\System\ZZpNbfi.exe
  2⤵
  PID:8768
- C:\Windows\System\hViMyNA.exe
  C:\Windows\System\hViMyNA.exe
  2⤵
  PID:8652
- C:\Windows\System\uCWygLM.exe
  C:\Windows\System\uCWygLM.exe
  2⤵
  PID:8748
- C:\Windows\System\NxxAFID.exe
  C:\Windows\System\NxxAFID.exe
  2⤵
  PID:8688
- C:\Windows\System\ygrzgKm.exe
  C:\Windows\System\ygrzgKm.exe
  2⤵
  PID:8752
- C:\Windows\System\EPdAHcT.exe
  C:\Windows\System\EPdAHcT.exe
  2⤵
  PID:8924
- C:\Windows\System\SNsZUPR.exe
  C:\Windows\System\SNsZUPR.exe
  2⤵
  PID:8992
- C:\Windows\System\BZdcLmX.exe
  C:\Windows\System\BZdcLmX.exe
  2⤵
  PID:9024
- C:\Windows\System\wSidJXV.exe
  C:\Windows\System\wSidJXV.exe
  2⤵
  PID:8940
- C:\Windows\System\roeyXFR.exe
  C:\Windows\System\roeyXFR.exe
  2⤵
  PID:8944
- C:\Windows\System\hqJAhYE.exe
  C:\Windows\System\hqJAhYE.exe
  2⤵
  PID:9040
- C:\Windows\System\pckvfRu.exe
  C:\Windows\System\pckvfRu.exe
  2⤵
  PID:9072
- C:\Windows\System\TzZBkyb.exe
  C:\Windows\System\TzZBkyb.exe
  2⤵
  PID:9120
- C:\Windows\System\ZuVosFl.exe
  C:\Windows\System\ZuVosFl.exe
  2⤵
  PID:9136
- C:\Windows\System\BMqaaZe.exe
  C:\Windows\System\BMqaaZe.exe
  2⤵
  PID:8980
- C:\Windows\System\atSlOnh.exe
  C:\Windows\System\atSlOnh.exe
  2⤵
  PID:9192
- C:\Windows\System\naTcWyL.exe
  C:\Windows\System\naTcWyL.exe
  2⤵
  PID:9176
- C:\Windows\System\WZwSdRC.exe
  C:\Windows\System\WZwSdRC.exe
  2⤵
  PID:8140
- C:\Windows\System\AkbZrxg.exe
  C:\Windows\System\AkbZrxg.exe
  2⤵
  PID:8200
- C:\Windows\System\QvzEfFw.exe
  C:\Windows\System\QvzEfFw.exe
  2⤵
  PID:7728
- C:\Windows\System\kprJDeJ.exe
  C:\Windows\System\kprJDeJ.exe
  2⤵
  PID:8560
- C:\Windows\System\jyBgCyy.exe
  C:\Windows\System\jyBgCyy.exe
  2⤵
  PID:8416
- C:\Windows\System\UOfgYDr.exe
  C:\Windows\System\UOfgYDr.exe
  2⤵
  PID:8528
- C:\Windows\System\jUPDxJt.exe
  C:\Windows\System\jUPDxJt.exe
  2⤵
  PID:8672
- C:\Windows\System\JJWqEof.exe
  C:\Windows\System\JJWqEof.exe
  2⤵
  PID:8400
- C:\Windows\System\qrLqWjR.exe
  C:\Windows\System\qrLqWjR.exe
  2⤵
  PID:8464
- C:\Windows\System\aUrwQjF.exe
  C:\Windows\System\aUrwQjF.exe
  2⤵
  PID:8800
- C:\Windows\System\cPwgnfh.exe
  C:\Windows\System\cPwgnfh.exe
  2⤵
  PID:8784
- C:\Windows\System\GljBerM.exe
  C:\Windows\System\GljBerM.exe
  2⤵
  PID:9044
- C:\Windows\System\CKXOuMp.exe
  C:\Windows\System\CKXOuMp.exe
  2⤵
  PID:9104
- C:\Windows\System\SUQIiLO.exe
  C:\Windows\System\SUQIiLO.exe
  2⤵
  PID:8764
- C:\Windows\System\PmqPNtx.exe
  C:\Windows\System\PmqPNtx.exe
  2⤵
  PID:8956
- C:\Windows\System\mpdVNNN.exe
  C:\Windows\System\mpdVNNN.exe
  2⤵
  PID:9008
- C:\Windows\System\IAzsyYV.exe
  C:\Windows\System\IAzsyYV.exe
  2⤵
  PID:9092
- C:\Windows\System\jiPNgVd.exe
  C:\Windows\System\jiPNgVd.exe
  2⤵
  PID:9148
- C:\Windows\System\VZDillC.exe
  C:\Windows\System\VZDillC.exe
  2⤵
  PID:7464
- C:\Windows\System\seXbjFT.exe
  C:\Windows\System\seXbjFT.exe
  2⤵
  PID:8348
- C:\Windows\System\HuDyeWx.exe
  C:\Windows\System\HuDyeWx.exe
  2⤵
  PID:8844
- C:\Windows\System\qJyHedx.exe
  C:\Windows\System\qJyHedx.exe
  2⤵
  PID:8912
- C:\Windows\System\yJyIeuZ.exe
  C:\Windows\System\yJyIeuZ.exe
  2⤵
  PID:8736
- C:\Windows\System\ModSBGi.exe
  C:\Windows\System\ModSBGi.exe
  2⤵
  PID:8864
- C:\Windows\System\gncuKJE.exe
  C:\Windows\System\gncuKJE.exe
  2⤵
  PID:6760
- C:\Windows\System\WJspLBH.exe
  C:\Windows\System\WJspLBH.exe
  2⤵
  PID:8848
- C:\Windows\System\tXDKUWH.exe
  C:\Windows\System\tXDKUWH.exe
  2⤵
  PID:8480
- C:\Windows\System\xBJWrLx.exe
  C:\Windows\System\xBJWrLx.exe
  2⤵
  PID:9060
- C:\Windows\System\mGhugsU.exe
  C:\Windows\System\mGhugsU.exe
  2⤵
  PID:7196
- C:\Windows\System\OwTtKmk.exe
  C:\Windows\System\OwTtKmk.exe
  2⤵
  PID:8908
- C:\Windows\System\ZggiltI.exe
  C:\Windows\System\ZggiltI.exe
  2⤵
  PID:8812
- C:\Windows\System\BdMRpeN.exe
  C:\Windows\System\BdMRpeN.exe
  2⤵
  PID:8364
- C:\Windows\System\nLjxmyQ.exe
  C:\Windows\System\nLjxmyQ.exe
  2⤵
  PID:9228
- C:\Windows\System\ncqJWXt.exe
  C:\Windows\System\ncqJWXt.exe
  2⤵
  PID:9244
- C:\Windows\System\UWDOENJ.exe
  C:\Windows\System\UWDOENJ.exe
  2⤵
  PID:9260
- C:\Windows\System\QTgnKBF.exe
  C:\Windows\System\QTgnKBF.exe
  2⤵
  PID:9276
- C:\Windows\System\RbjQVps.exe
  C:\Windows\System\RbjQVps.exe
  2⤵
  PID:9292
- C:\Windows\System\qlGLShc.exe
  C:\Windows\System\qlGLShc.exe
  2⤵
  PID:9308
- C:\Windows\System\wIEzlhn.exe
  C:\Windows\System\wIEzlhn.exe
  2⤵
  PID:9324
- C:\Windows\System\nJnsHVy.exe
  C:\Windows\System\nJnsHVy.exe
  2⤵
  PID:9340
- C:\Windows\System\QstCzNq.exe
  C:\Windows\System\QstCzNq.exe
  2⤵
  PID:9356
- C:\Windows\System\ADDdYXE.exe
  C:\Windows\System\ADDdYXE.exe
  2⤵
  PID:9372
- C:\Windows\System\afaXnXZ.exe
  C:\Windows\System\afaXnXZ.exe
  2⤵
  PID:9388
- C:\Windows\System\mYwMRCi.exe
  C:\Windows\System\mYwMRCi.exe
  2⤵
  PID:9404
- C:\Windows\System\WBazKaP.exe
  C:\Windows\System\WBazKaP.exe
  2⤵
  PID:9420
- C:\Windows\System\wTtxscX.exe
  C:\Windows\System\wTtxscX.exe
  2⤵
  PID:9436
- C:\Windows\System\dhHEUMy.exe
  C:\Windows\System\dhHEUMy.exe
  2⤵
  PID:9452
- C:\Windows\System\LCePGOz.exe
  C:\Windows\System\LCePGOz.exe
  2⤵
  PID:9468
- C:\Windows\System\cbvyqma.exe
  C:\Windows\System\cbvyqma.exe
  2⤵
  PID:9484
- C:\Windows\System\wcEjaxP.exe
  C:\Windows\System\wcEjaxP.exe
  2⤵
  PID:9500
- C:\Windows\System\HYzGFOR.exe
  C:\Windows\System\HYzGFOR.exe
  2⤵
  PID:9516
- C:\Windows\System\arQyBMH.exe
  C:\Windows\System\arQyBMH.exe
  2⤵
  PID:9532
- C:\Windows\System\sTnBOqI.exe
  C:\Windows\System\sTnBOqI.exe
  2⤵
  PID:9548
- C:\Windows\System\rQbwpNP.exe
  C:\Windows\System\rQbwpNP.exe
  2⤵
  PID:9564
- C:\Windows\System\tSswUTb.exe
  C:\Windows\System\tSswUTb.exe
  2⤵
  PID:9580
- C:\Windows\System\fuzUbNJ.exe
  C:\Windows\System\fuzUbNJ.exe
  2⤵
  PID:9596
- C:\Windows\System\eEEFRQj.exe
  C:\Windows\System\eEEFRQj.exe
  2⤵
  PID:9612
- C:\Windows\System\jwIWvOM.exe
  C:\Windows\System\jwIWvOM.exe
  2⤵
  PID:9628
- C:\Windows\System\heMWSph.exe
  C:\Windows\System\heMWSph.exe
  2⤵
  PID:9644
- C:\Windows\System\SJVTNuG.exe
  C:\Windows\System\SJVTNuG.exe
  2⤵
  PID:9660
- C:\Windows\System\gvWUPAf.exe
  C:\Windows\System\gvWUPAf.exe
  2⤵
  PID:9676
- C:\Windows\System\GBwhhkA.exe
  C:\Windows\System\GBwhhkA.exe
  2⤵
  PID:9692
- C:\Windows\System\aYkFpyU.exe
  C:\Windows\System\aYkFpyU.exe
  2⤵
  PID:9708
- C:\Windows\System\QtoIqUh.exe
  C:\Windows\System\QtoIqUh.exe
  2⤵
  PID:9724
- C:\Windows\System\BemAttv.exe
  C:\Windows\System\BemAttv.exe
  2⤵
  PID:9740
- C:\Windows\System\bGZdDvO.exe
  C:\Windows\System\bGZdDvO.exe
  2⤵
  PID:9756
- C:\Windows\System\wXHRLrL.exe
  C:\Windows\System\wXHRLrL.exe
  2⤵
  PID:9772
- C:\Windows\System\DhkYCRg.exe
  C:\Windows\System\DhkYCRg.exe
  2⤵
  PID:9788
- C:\Windows\System\bvxyoNY.exe
  C:\Windows\System\bvxyoNY.exe
  2⤵
  PID:9804
- C:\Windows\System\JeBLwWU.exe
  C:\Windows\System\JeBLwWU.exe
  2⤵
  PID:9820
- C:\Windows\System\tHQJvxG.exe
  C:\Windows\System\tHQJvxG.exe
  2⤵
  PID:9836
- C:\Windows\System\XbhaWAw.exe
  C:\Windows\System\XbhaWAw.exe
  2⤵
  PID:9852
- C:\Windows\System\BtNxOQV.exe
  C:\Windows\System\BtNxOQV.exe
  2⤵
  PID:9868
- C:\Windows\System\ljPuZqU.exe
  C:\Windows\System\ljPuZqU.exe
  2⤵
  PID:9884
- C:\Windows\System\YeULBNX.exe
  C:\Windows\System\YeULBNX.exe
  2⤵
  PID:9900
- C:\Windows\System\LbKuMoR.exe
  C:\Windows\System\LbKuMoR.exe
  2⤵
  PID:9916
- C:\Windows\System\xboBIPb.exe
  C:\Windows\System\xboBIPb.exe
  2⤵
  PID:9932
- C:\Windows\System\QLPlbFn.exe
  C:\Windows\System\QLPlbFn.exe
  2⤵
  PID:9948
- C:\Windows\System\vAXdeTK.exe
  C:\Windows\System\vAXdeTK.exe
  2⤵
  PID:9964
- C:\Windows\System\YuotdsX.exe
  C:\Windows\System\YuotdsX.exe
  2⤵
  PID:9980
- C:\Windows\System\hFdWesb.exe
  C:\Windows\System\hFdWesb.exe
  2⤵
  PID:9996
- C:\Windows\System\YuUXhNT.exe
  C:\Windows\System\YuUXhNT.exe
  2⤵
  PID:10012
- C:\Windows\System\avowRbF.exe
  C:\Windows\System\avowRbF.exe
  2⤵
  PID:10028
- C:\Windows\System\pyaNuBO.exe
  C:\Windows\System\pyaNuBO.exe
  2⤵
  PID:10044
- C:\Windows\System\GeqmexU.exe
  C:\Windows\System\GeqmexU.exe
  2⤵
  PID:10060
- C:\Windows\System\kpiYKRT.exe
  C:\Windows\System\kpiYKRT.exe
  2⤵
  PID:10076
- C:\Windows\System\YQHFSit.exe
  C:\Windows\System\YQHFSit.exe
  2⤵
  PID:10092
- C:\Windows\System\CKxAynJ.exe
  C:\Windows\System\CKxAynJ.exe
  2⤵
  PID:10108
- C:\Windows\System\ssgJqKc.exe
  C:\Windows\System\ssgJqKc.exe
  2⤵
  PID:10124
- C:\Windows\System\ESPeOoD.exe
  C:\Windows\System\ESPeOoD.exe
  2⤵
  PID:10140
- C:\Windows\System\uFAxRYF.exe
  C:\Windows\System\uFAxRYF.exe
  2⤵
  PID:10156
- C:\Windows\System\rlNgEzJ.exe
  C:\Windows\System\rlNgEzJ.exe
  2⤵
  PID:10172
- C:\Windows\System\XFMmSOC.exe
  C:\Windows\System\XFMmSOC.exe
  2⤵
  PID:10188
- C:\Windows\System\KrpuJxu.exe
  C:\Windows\System\KrpuJxu.exe
  2⤵
  PID:10204
- C:\Windows\System\iHSsylg.exe
  C:\Windows\System\iHSsylg.exe
  2⤵
  PID:10220
- C:\Windows\System\WAVwHZN.exe
  C:\Windows\System\WAVwHZN.exe
  2⤵
  PID:9236
- C:\Windows\System\xiplNOB.exe
  C:\Windows\System\xiplNOB.exe
  2⤵
  PID:9300
- C:\Windows\System\coelVAS.exe
  C:\Windows\System\coelVAS.exe
  2⤵
  PID:9332
- C:\Windows\System\opfghER.exe
  C:\Windows\System\opfghER.exe
  2⤵
  PID:9252
- C:\Windows\System\xAzliyX.exe
  C:\Windows\System\xAzliyX.exe
  2⤵
  PID:9396
- C:\Windows\System\RQMAdlC.exe
  C:\Windows\System\RQMAdlC.exe
  2⤵
  PID:7536
- C:\Windows\System\UKqZczn.exe
  C:\Windows\System\UKqZczn.exe
  2⤵
  PID:9320
- C:\Windows\System\YBgtqMn.exe
  C:\Windows\System\YBgtqMn.exe
  2⤵
  PID:9384
- C:\Windows\System\XRNgBcp.exe
  C:\Windows\System\XRNgBcp.exe
  2⤵
  PID:9448
- C:\Windows\System\QzcRdQJ.exe
  C:\Windows\System\QzcRdQJ.exe
  2⤵
  PID:9200
- C:\Windows\System\XykBjrB.exe
  C:\Windows\System\XykBjrB.exe
  2⤵
  PID:9528
- C:\Windows\System\jLLuGeR.exe
  C:\Windows\System\jLLuGeR.exe
  2⤵
  PID:9588
- C:\Windows\System\WtvSXrv.exe
  C:\Windows\System\WtvSXrv.exe
  2⤵
  PID:9508
- C:\Windows\System\zUxKAcw.exe
  C:\Windows\System\zUxKAcw.exe
  2⤵
  PID:9604
- C:\Windows\System\YpnXmGI.exe
  C:\Windows\System\YpnXmGI.exe
  2⤵
  PID:9716
- C:\Windows\System\sTshavc.exe
  C:\Windows\System\sTshavc.exe
  2⤵
  PID:9640
- C:\Windows\System\hmNWenW.exe
  C:\Windows\System\hmNWenW.exe
  2⤵
  PID:9636
- C:\Windows\System\wXspyyN.exe
  C:\Windows\System\wXspyyN.exe
  2⤵
  PID:9544
- C:\Windows\System\fOjZWZh.exe
  C:\Windows\System\fOjZWZh.exe
  2⤵
  PID:9736
- C:\Windows\System\rdvRtXp.exe
  C:\Windows\System\rdvRtXp.exe
  2⤵
  PID:9812
- C:\Windows\System\UvAfxog.exe
  C:\Windows\System\UvAfxog.exe
  2⤵
  PID:9876
- C:\Windows\System\LjjIKSF.exe
  C:\Windows\System\LjjIKSF.exe
  2⤵
  PID:9940
- C:\Windows\System\DFQRzuD.exe
  C:\Windows\System\DFQRzuD.exe
  2⤵
  PID:9800
- C:\Windows\System\xbomgyj.exe
  C:\Windows\System\xbomgyj.exe
  2⤵
  PID:9924
- C:\Windows\System\zNSHyQf.exe
  C:\Windows\System\zNSHyQf.exe
  2⤵
  PID:9976
- C:\Windows\System\jftznnV.exe
  C:\Windows\System\jftznnV.exe
  2⤵
  PID:10008
- C:\Windows\System\JlTtfFi.exe
  C:\Windows\System\JlTtfFi.exe
  2⤵
  PID:10036
- C:\Windows\System\jMjrNMG.exe
  C:\Windows\System\jMjrNMG.exe
  2⤵
  PID:10068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AdNyzvR.exe

Filesize
2.0MB

MD5
88f67b8bbf9badd791b020e875333358

SHA1
95d762a8a519487a98658cd7c3c01f91d79310e4

SHA256
0f923cce8f62a03461411004dcbce964a250d4091bf0ede50cfbe2ab27a75a22

SHA512
8f0e5c28d6612f0aff2402b213821ecdfd55fc165c1fc8bc11d81cef23afa52d07afa67d634395a5f885509e7bd3fccf965432d6dc1097e8534d680415367a5c

Download Submit
C:\Windows\system\CYhMJrF.exe

Filesize
2.1MB

MD5
0680708a43ff375c4ed6e53bf2f0cfa9

SHA1
e6726d3941e6d5fffd394025de7979f6e89d8a15

SHA256
234b485eec0c78317196bee68e8491579e8c5976d2d69c7f8cd2193791e86080

SHA512
0259ba6d8976396d1190269172faed5f3c34528653edfa25e83679c21d9dcd767dfb17d43bd4fb5b63a81189930b3142e4a63516d4af765b437a7472a4395db8

Download Submit
C:\Windows\system\CaPFNVQ.exe

Filesize
2.0MB

MD5
9415558c5f83aea229c2a90f4245a4be

SHA1
7adc95460e23c87aa4a2eefbcc9efddd1a904232

SHA256
433b7ab58644876bf1560f84cad9bd829a4f9bcfe4805bb90e1e1bfd845279cd

SHA512
7155714cb52bb8a0324de3eda7bb449611ab9edad360c1437f0023d8e5beaa017a82454ff3c9770e8d74808948c08b05fb48c7e494600efc00f219acbac788ae

Download Submit
C:\Windows\system\KCzmjbV.exe

Filesize
18B

MD5
ef758e56e906b9892f08e5e0fd0f13b2

SHA1
5d91983aa1bb61c5754ee9a01242f0bb098e7d43

SHA256
55949f339b372645d839eaa0847f4e244396f7e39c4586ddc776fb793deda110

SHA512
efd8bb7ef71cf583c97f5d0eac4e2fae239c80d85643b80c586971498ace127bb0c9565e46052e55211bb3dead5ae54145b84fc68e9ff4a6be2a5f6b0f086760

Download Submit
C:\Windows\system\ONgPnuT.exe

Filesize
2.1MB

MD5
600cbc75e6b8194ad4be69191e6432be

SHA1
ebe7887c2d33745828a9584d27c3dc9bb5912bf1

SHA256
88dc99aad40cf38ea297056b07c277555b56f9168d3fbda4f6edd02cce4d0d7b

SHA512
83ca4eaf1d0a7bd9dc2f9867c61dff6d065db215c98ee5e6066c9250dacbfae42a759c0930b81a322e4230065df33c4b0a86853ae8fba52cd873c21268c16944

Download Submit
C:\Windows\system\OowLLGs.exe

Filesize
2.1MB

MD5
3db7e2a8f55b99033099b1c58b142e72

SHA1
d2275ec6ab2a24bae6368927fd8daf96a3ae0fdc

SHA256
8994987f2db0a0feed09efaa27f1ee49ae1d709aa251a079299667cf18744643

SHA512
9877dcbf4598dc996081ce25b8f71b8ea7b8b088fb6a4e58c802e3aae2dfe324eea3c91803c9eff3c9f84995cf943c8c950f8bbe218d2d5cf2a6bc30c1eaa463

Download Submit
C:\Windows\system\cBiCsIa.exe

Filesize
2.0MB

MD5
5e88190dbbf8902d38981d718a7aebad

SHA1
11991cee1fb4ad2e2e3cfa19a396aa03fe1b070b

SHA256
0a5c11081e2de4aa3182fc1d76cfe026d31474ed6a93aa8cf5f3e4b7cc62cf06

SHA512
f1ccd4ed8206757f499150887ec6c8c81b46213b5e67a00183400cb04c1b1ea04028acacf8d699bed834f5a06c648692ae63d9c76788f5387e11a3a69f6f06e0

Download Submit
C:\Windows\system\fJEsSkB.exe

Filesize
2.0MB

MD5
41aef1e93efcaa62ea2100fbb571f1e5

SHA1
a206395be1cd29a9d84c08398ccd05bad58bbbd8

SHA256
bd6ad439b96ccf7405bc2bbb17baae233a60be0b0d0fcc777e078228ff493e24

SHA512
afc834263965745cb285232bf0bfbbfcd3ac4990d9ed56547500938e40775271b0868ac1bfa856818ab74a4faf38bb686bedd30764abb6ae731614c502e3b0f1

Download Submit
C:\Windows\system\fZhTTWJ.exe

Filesize
2.1MB

MD5
c2e6c1820145da0e11edd9976eded9ae

SHA1
ed53603541d8700a5f00fc89ce8cc8ad2328b07e

SHA256
2095db4a64daca62d4a1655b76597c60ac864ff1bd04a92a3e571950b73dc6ba

SHA512
215286a3cb321b2f7aaf35fee3ba78ec014dfed1bd3e60a9788b2f029cadeb3f6d4791f81b9d7671c62fc1265d586c1bdd4aab7ecb18ff427737456d224f8779

Download Submit
C:\Windows\system\iDQVQkg.exe

Filesize
2.1MB

MD5
cec7afa649f0f001d47a90c395790c9d

SHA1
3741bbec807cd466b5601dfa594800d369a3eac6

SHA256
1733d816bb1b8625aff8ae517f0e2bb290d4ccd990c117eed264bcb2106cc2f3

SHA512
9a715ecd5defa02809ab3e89368fe56770bd914ab833c7b992be7b82497df0c68c672806324dcb17426dd96c86a4615a23b5a0ea4a6a3c41af48b9287ac0d9cf

Download Submit
C:\Windows\system\jckkYsB.exe

Filesize
2.1MB

MD5
c985e77ea2ae70c60c097d823bde70b2

SHA1
9c7fdbfab0326c6eb9bb4e87d8cf1b3af83762d6

SHA256
2ed4e57fa007795f9c2f12a0619abf6e39af2ce4e5c183bd8297fb49cbf503b6

SHA512
e9f0e849827ab11d09cc42c4737deb1c66678c736618e63e9abb7741822bc355af3006b5041c96fc5898331cbbe2bace9afb02f8ad933a6bfd639f25c7bac097

Download Submit
C:\Windows\system\okEHWHv.exe

Filesize
2.1MB

MD5
9eebd155bc8e0fe49e8d58a51962e4b3

SHA1
2377d96c5b7ee79418410dfa258fb0f23b866d6f

SHA256
5d8fe7be108760fc2ec8b37b2e370da72f90611c1f25fa1c1c7825cdcc292aea

SHA512
e5a7a1c4fbe8a08257d165386bdc627dc46d1d22d8f7b08944ed05aa42ac2d462c248e912fb48b6acb8423be7f322d0d813aebe73cae6fbb1709c10cac8484f9

Download Submit
C:\Windows\system\pOwxKvq.exe

Filesize
2.1MB

MD5
6ea8eeb42875e5bb456251ca96a8f8ab

SHA1
87658cc3a0367eac31f95f00cdd8f38efb5ae5e9

SHA256
c0faa3253a7fd88046c64b7d783fbf6c11c3fe5e2a952e9e8387abec7bd9eeaa

SHA512
b6a8ee68ea0478283ac4a024b0a94b386859079f31097bb02fb61eb47a9b3517a354bec4ff9a8c19a4b2c98b6fe9626147c68decb959f089248f11db4b11faae

Download Submit
C:\Windows\system\qlKJWQU.exe

Filesize
2.1MB

MD5
caf00d585f6c8d068ff87c3e0e0b5f1c

SHA1
43a77158307f790de214fbdd87b1aa4dd281970a

SHA256
bb50153776e66d70e632ce83c4d94b8e5958b7a3cd705758165f027f825da5cb

SHA512
c0c34092339b88ad837009247116244aa0cfbb2d5146badec21a018a94194e2f1771d6b886abeaec93ecc68564289a3adf01e9cb360ba9f6be27485b3a4f8270

Download Submit
C:\Windows\system\tGzrpqz.exe

Filesize
2.1MB

MD5
cc50a6de59cba592231f79891e06ca26

SHA1
5e1468cc7bd9074f1058971d38e010564bad7af6

SHA256
5b296a574de68cd799fc15b09bd7b80377ba074fbaab99322cde56e5587ed496

SHA512
648748ff6088363f16214c8ce83b8ffc1cdf7267096ef8d584c21656c9775fdc9fc74bc0957791c6ae10494d0a26d5260f857b1bcab7ffac8621516effe2df78

Download Submit
C:\Windows\system\tNQGBcK.exe

Filesize
2.1MB

MD5
e9a02d6449067807216c4b32cad66521

SHA1
40d0a487f6ebc3871f6262eb7ad7e60288ec2d05

SHA256
16ed98942b2c711adde711c82cc7efc1d950584659d5dfd6aed57cf68372360c

SHA512
eca74c8f8ae86f608029f94e957ad80ec55a2c7b8db36cf7027743f98ccba496fe1a0548519482d84f28d36952d7b7233972b98b8edff20554aeee0f0fbbcb9e

Download Submit
C:\Windows\system\tZvRUzG.exe

Filesize
2.1MB

MD5
93b3976be21131e3db2e39f61f8411cd

SHA1
14b2eb9953b4bea436d4b59f684db704ba97680b

SHA256
6e18ee11e4e6bc9e8bdfc769efe02e3c0839c5580cf81a6f7a6f779c149a75d3

SHA512
13e842550f1aea3305a712597c1149776ecbaf0a2fad956128982d2781a01e3f1e84217c2cc45d1978b2079b808ab40d7ad8c2d19996ef1e649392374baf2e52

Download Submit
C:\Windows\system\vCdMIoR.exe

Filesize
2.0MB

MD5
a3189645ec2f3bb15d4091c5d8e8a955

SHA1
9d04bfea5c4f2116c75390e65889760114a60eec

SHA256
9f65ecdd9a3bebbe3a8f42b60adeeb1bc4a14162c4adc9374f7fe08005da544d

SHA512
383c915b1c284f6a1395a455ebf7796da1ffdb187f1a5fcf5d452a4cdbb2583ab3df88b2850ef40e88a2f2eaa997d055c899d84c58d002a145f1e26a6e411834

Download Submit
C:\Windows\system\vyqsZyJ.exe

Filesize
2.1MB

MD5
91367324b8f326d80794a745b8f237d9

SHA1
a5798a2d1315318ca25a42da99ac8186ecd0ff23

SHA256
39ccdafacb36994d653c91e7503ab7267327e6600ba1da7d62ef037fbd6b80eb

SHA512
87b4448aa218790080c277effe0bf6f033607f142f3b8370fe7706ad64d05ea4f2b62b86019356d92bc34745ad58cb82fabad1ecfd69a5f352b7d1c190e5b4dc

Download Submit
C:\Windows\system\wMCALnx.exe

Filesize
2.0MB

MD5
041b862988cdb14e791d8435876ff642

SHA1
026eb3c39fc7556535a047354a5a1217bf29ce6c

SHA256
5132c3126ef1a2a40f7317f3f2140031b8d2a0627a88562931a23b0842e7dc28

SHA512
5fd83127f74ba8f1c038c9dde58e78206d632cb4a78b75dd2a87873c1a9f48df57c39fbfb17e4709be9d7525d7b46cf83b87258cd35643273ed0b35a6bbbe820

Download Submit
C:\Windows\system\wSCssoj.exe

Filesize
2.1MB

MD5
ea7e7436a644b1b2c59bf55cf5f5553a

SHA1
87543abf8dbd9793f1808e43df98ae802db22fd6

SHA256
23c266c1b849dd049c3def68e3855f760f1554cf98b14acefceac476e17831b6

SHA512
9b11783d9052ea677a60e7d75e72c065d1c1e7e94abd17a3868fbd3ae62a1150c77ec072db3223c1a31589227f5857b848e9c6bed0fc59d10091cee5476ae726

Download Submit
C:\Windows\system\zHbffJB.exe

Filesize
2.1MB

MD5
72757cc1a8fd13d2badf1b04d7bafa86

SHA1
abd7e4955c9b46652a5a1c7d4d5146fc66ee50fb

SHA256
943e9e109bc25cb723d0bedfcafd933d984b068f7facdad7d6f68ab0b6568f7f

SHA512
b1e539c0c707a607537613a7c5958bae9fb9f86d028c6d5f6fd3aa9e6ee9941275caffde26f9d98f4820154fd6013016f0e91019735154665c42dc543b02d556

Download Submit
\Windows\system\FLhiKnT.exe

Filesize
2.1MB

MD5
c24f176f6b4e7f50ff3afbf4ff595ac5

SHA1
289d73d8e6a1a66de951680ddc5850d8474813de

SHA256
5eb536aa1bea284015182ce4d69baf5ffb961f052056bfe8f389b35b29a2128b

SHA512
db2e9b5d8c541b00e8c9f834ac2d49c7216c49ad6e5e6dad59af61d35645b9e1fc50c8e21ff991ee5a9a93d2c81380eaa3c5bfc4f93484ea21d83c4e5dfc5d61

Download Submit
\Windows\system\FppmPYV.exe

Filesize
2.1MB

MD5
793c6d9f2e677fbf8752e03a90c91251

SHA1
029543ddf67019e056ff502d3dd3a4f617b453ea

SHA256
79c242afdc5f91d5fa2d35975898ddc8a22e0004287f4fc7c21e6b49d3fb10ae

SHA512
1b5c7905e25826f875f9227216e33ee71c693f6083d54446542b2ff015d7c06a363cd09e9ce54ae11316a7bc956c6df9a287c84ce12744737f477b1f59f19eab

Download Submit
\Windows\system\GXofrCa.exe

Filesize
2.1MB

MD5
8f84171bc879da973a4a6d3fabc2013f

SHA1
5b0a5a324e05b53fb99e690784b8430e4a6eafb1

SHA256
e62c49b2843250d95d940b9dac43f1a3d78fc54d5f5ffd0db552420d7b62f991

SHA512
a50f7e3ce8a12d021e893dead5c719e7a44c35f4b9388300bfbc54c2e400367b1edac8809aa66069d46df1e34cfecb7e47ff226ba3d4ee37cb0ccdd8e4cd7e1a

Download Submit
\Windows\system\GnXAtuK.exe

Filesize
2.1MB

MD5
9ee8bfc7bf3a11c7233f9cb6a5fac866

SHA1
4a53e6107986c53917c6f25b2a4447e3b143bfce

SHA256
39bc15049eb73a8239d5c8a0b9dfe667ed4eafd6ea4cf21302724d7ae72df73e

SHA512
af629faa30079e065dce1240e0c28e9519629366bde49a6e8b82898100531857ee00ae2ef3644e1ac0a5825dfc1fa49468ed1d29896495507cab4736579af314

Download Submit
\Windows\system\HuMvljD.exe

Filesize
2.1MB

MD5
c39fe3ebbd131fc87d51d17e62db409a

SHA1
3c5994c64205de17310b781fd991a40a4b59b5d4

SHA256
2123ea9f806e4112e6addfb7e85a8f0e3a37e4f2b087817b7b3fd557b956bc0e

SHA512
1ab95cc9eab75a4f9cb210cbd5cdb96bec28f7b6558f4bf91b73dacabf4f546828ce59342e529ead6ef97f0995dcc58cfa81b8e0575aff69d88699b9e342423e

Download Submit
\Windows\system\JDdNqaR.exe

Filesize
2.0MB

MD5
7c422869911eb7c1181c8e768287220e

SHA1
1d17f083f00b7f7dd036706083852d568554b44e

SHA256
68ac1f275019be2bb55b1ae90e3b697bf632914753b2f0986fff5ecccfcb563f

SHA512
1bd8f7036146c8a2e94e5f6b8fa30bb39c91459ad7b6d4c6ed48763225fb9a3282ce829b1d4fa2043fa8458ab30e818e20ab280da1d2830414a5ad298e3f3dee

Download Submit
\Windows\system\OutLEFC.exe

Filesize
2.0MB

MD5
a59afdd3abe93a8728a120d3805c6996

SHA1
0eb7e37ce0c72d1e935a9bb23745b4073c0f540a

SHA256
f42515028ea01328e685989063e77f7d27d35e55dff323ab0cecdd435262c3a8

SHA512
51052ca6c3f2204c8f98a74cb57e0af58e97bf61f1e64c3d4b3b49072640fc8f4af325fef8e48fd083235e720020d755e9cb7cc7e22ecca79fcf05f435b2b5a8

Download Submit
\Windows\system\SMlsZSI.exe

Filesize
2.1MB

MD5
9c68d866055a6f4db4c373b56f2d7da4

SHA1
c9c9125838cec29e43e2be700742c3c5794b7cf4

SHA256
1c44d84e679f5584f25f69e6442aa0a8b580f18afa2f77303e0020800a8d7045

SHA512
81e48fe7e2ac88fe857719f7a736dd444d440fe332844252b72afd150ef2961f55da8c09a89da05383d1b8ff71df3eedaaaa4c900decda245d54b355ab093c21

Download Submit
\Windows\system\UVbzPDe.exe

Filesize
2.1MB

MD5
b5a895f12d1bf141e5b4f430ebbeb3e8

SHA1
b8719a66bb9c047fbc7d9bfe245a45271029ca6b

SHA256
da82e309f60b19cafff39785214e2755cd7bde17668a619ae7520d63fe09a246

SHA512
6f04f9aa1a92804e439ed342630541ac9cded4b8478c401463a035e7edb6f51106050b1ae201934e63c9e8f331a8087f2dc38f85eea38de710f0a8106e6c68ba

Download Submit
\Windows\system\dYakQoU.exe

Filesize
2.1MB

MD5
440f358caaa3746b200e6bf0f97b057e

SHA1
f0c6aa4af1bad31fee734597a8eaca3b6b52d0f0

SHA256
9c8db07a1037ddef24d771ffb15e2372c356b34cec4b8d128a801e99ba231dd7

SHA512
7bfb306b84d0faac36a61ef5c4c230f5d4f3b458779d7555cd71d28b05324c99d60a390cd6129cbb3207f0d5c0471129300bfae61fe10ea42fc7640900e9ce3a

Download Submit
\Windows\system\fhxqFKd.exe

Filesize
2.1MB

MD5
c96e8d79f5d0d9992cf6faba75618752

SHA1
cb50c0e90a99a560078a3d81e6accaa704619397

SHA256
dc31b8c6a589589200ed1f4c1ada95234c1f169f04fbc236a892ee5c585f764a

SHA512
9a325e5d034989f87d121483d38b954095e6d4acba630fb11437959ae82b06a6251c72ab5444894b70f7998fdcbf16b0c5e854f4ea5f89a18e3c84ad71c2a119

Download Submit
\Windows\system\hACsIqx.exe

Filesize
2.1MB

MD5
17f72e9e444a718798289f5647929f77

SHA1
4e06fdb43cb3bb16d17b79db4df17739479a19da

SHA256
6685f1786932b9b69a7faeb427b843b7918a62ded92775c8de74cc5d52d4d825

SHA512
fbc239de83319b9bd06e949b41cf0742be53853341fea2ded0319d7102e72a43eafd82dc0d8987b3bf73aea4331544e7bac6ddbc6802802bd40c0db2d6e0741e

Download Submit
\Windows\system\nbUaraP.exe

Filesize
2.1MB

MD5
cfb59c07c56a84e90ae72b0a6ece9d30

SHA1
4e760166a3863665a38c244ab27da798e6025937

SHA256
d376c3713c629868d10a9b1f5f4749bf4cd8569844ed2ea376ad4463a6332879

SHA512
1a08b750dfe8ea57a8800747f9aa1090f86d870e2a0bd71936d102750cf87dc45ab2973d28dfca1457b27dd84ba29f74831d12c3a4149d49292348a766615fcb

Download Submit
\Windows\system\oBdcrhK.exe

Filesize
2.1MB

MD5
56d81d89d967d972db3e324bec9a6467

SHA1
b029dde6a07cccd1b623483c3abf03abf288e6d9

SHA256
06204465ca7df3579e40d0d6d975e91b0640eefa28c602db3e67de3f46a754c6

SHA512
5d4336b30472a0abecbecc956bf0c8ebec2418a3482d8f70b49d922d51005bf7742763d8123008f04ef1b7120625021d84eca6cafb9bbd8c3c9f78e9fb5a654e

Download Submit
\Windows\system\pUnZgOy.exe

Filesize
2.1MB

MD5
0bac674446692f1ca886cdd68976aa45

SHA1
a8ca4038e538e989e7ab80d434624313108653f5

SHA256
ee2fdeac9dd12831a92d746fc4da5732931ae7d419e45eef6aa9633636b73108

SHA512
6b07466114f929911253b10ced8e8a278c6fae6b0ca88ea60a197ba9b1843e520020a17ed0c518ab86914c180f9d61858b2ee28cce097607f120abbf71c682bd

Download Submit
\Windows\system\qVkxIQS.exe

Filesize
2.1MB

MD5
b5bbe66627c8df333f2e1146f9a216e8

SHA1
b1469ad94147d0e7e8ce224b438b75209d62a20a

SHA256
654e8f459f2b87b2329755f5511e45be7f2bae07e4d66ce274e607dfc72d0eb3

SHA512
9b97c72d3b77dde91f597b0e9b9e4b27fae841847143759fea843a003b9467f8ad914ddbeecbcaa74146040d8f01fd5d20d81feebf7458a013fb8e3b27fbe2d4

Download Submit
\Windows\system\riaYtrS.exe

Filesize
2.1MB

MD5
32911db05ad25ce14959b6c669d3ce67

SHA1
477655cc6ac7eb0b02bc54dbe5c4e7017a2b3df6

SHA256
f8fc328e3d43673e58815f46a521000228f493060402635091c9972bb535f63b

SHA512
55a976019c7ecac6862ad370bd85840d4d736b22a279af8c42dc4b9e83153247709bd01d11debab1ffb8003ec4d8069ae2992dfe50d01596101bfdda80951863

Download Submit
\Windows\system\vfMMplU.exe

Filesize
2.1MB

MD5
44b23b03edb1061ee2b007bd6947bf1d

SHA1
8afa6aa94e9539cd936d9da38124301715ef1199

SHA256
c3206a787240eabb53e81783f2185328fe375ec385832c18a043780491b1d8ba

SHA512
a8fc48b194e39c866e5ff52ff6699436e86c04d7506df9083099b7e95ed48cceba469e1e6688918b5420a6473100906bd1f336a44e9f9db1bba5e1ea45df7a58

Download Submit
memory/1432-4811-0x000000013F4A0000-0x000000013F892000-memory.dmp

Filesize
3.9MB

Download
memory/1432-89-0x000000013F4A0000-0x000000013F892000-memory.dmp

Filesize
3.9MB

Download
memory/1676-75-0x000000013F030000-0x000000013F422000-memory.dmp

Filesize
3.9MB

Download
memory/1676-4823-0x000000013F030000-0x000000013F422000-memory.dmp

Filesize
3.9MB

Download
memory/1848-4799-0x000000013FC00000-0x000000013FFF2000-memory.dmp

Filesize
3.9MB

Download
memory/1848-62-0x000000013FC00000-0x000000013FFF2000-memory.dmp

Filesize
3.9MB

Download
memory/1908-94-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download
memory/1908-967-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download
memory/1908-4855-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download
memory/2136-319-0x000000013F220000-0x000000013F612000-memory.dmp

Filesize
3.9MB

Download
memory/2136-64-0x000000013F220000-0x000000013F612000-memory.dmp

Filesize
3.9MB

Download
memory/2136-4800-0x000000013F220000-0x000000013F612000-memory.dmp

Filesize
3.9MB

Download
memory/2244-4802-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/2244-69-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/2244-320-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/2320-1345-0x000000013F360000-0x000000013F752000-memory.dmp

Filesize
3.9MB

Download
memory/2320-102-0x000000013F360000-0x000000013F752000-memory.dmp

Filesize
3.9MB

Download
memory/2320-4834-0x000000013F360000-0x000000013F752000-memory.dmp

Filesize
3.9MB

Download
memory/2592-4810-0x000000013F180000-0x000000013F572000-memory.dmp

Filesize
3.9MB

Download
memory/2592-32-0x000000013F180000-0x000000013F572000-memory.dmp

Filesize
3.9MB

Download
memory/2712-4797-0x000000013FBB0000-0x000000013FFA2000-memory.dmp

Filesize
3.9MB

Download
memory/2712-13-0x000000013FBB0000-0x000000013FFA2000-memory.dmp

Filesize
3.9MB

Download
memory/2728-40-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/2728-4798-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/2764-98-0x000007FEF4530000-0x000007FEF4ECD000-memory.dmp

Filesize
9.6MB

Download
memory/2764-82-0x000007FEF4530000-0x000007FEF4ECD000-memory.dmp

Filesize
9.6MB

Download
memory/2764-14-0x0000000002C30000-0x0000000002CB0000-memory.dmp

Filesize
512KB

Download
memory/2764-15-0x000007FEF47EE000-0x000007FEF47EF000-memory.dmp

Filesize
4KB

Download
memory/2764-37-0x000007FEF4530000-0x000007FEF4ECD000-memory.dmp

Filesize
9.6MB

Download
memory/2764-31-0x000007FEF4530000-0x000007FEF4ECD000-memory.dmp

Filesize
9.6MB

Download
memory/2764-86-0x000007FEF4530000-0x000007FEF4ECD000-memory.dmp

Filesize
9.6MB

Download
memory/2764-92-0x0000000002C30000-0x0000000002CB0000-memory.dmp

Filesize
512KB

Download
memory/2764-373-0x000007FEF4530000-0x000007FEF4ECD000-memory.dmp

Filesize
9.6MB

Download
memory/2764-29-0x0000000001EE0000-0x0000000001EE8000-memory.dmp

Filesize
32KB

Download
memory/2764-25-0x000000001B610000-0x000000001B8F2000-memory.dmp

Filesize
2.9MB

Download
memory/2768-34-0x000000013F200000-0x000000013F5F2000-memory.dmp

Filesize
3.9MB

Download
memory/2768-4809-0x000000013F200000-0x000000013F5F2000-memory.dmp

Filesize
3.9MB

Download
memory/2992-4795-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/2992-93-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/2992-55-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/3044-714-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download
memory/3044-91-0x0000000002F30000-0x0000000003322000-memory.dmp

Filesize
3.9MB

Download
memory/3044-39-0x000000013F180000-0x000000013F572000-memory.dmp

Filesize
3.9MB

Download
memory/3044-1235-0x000000013F360000-0x000000013F752000-memory.dmp

Filesize
3.9MB

Download
memory/3044-100-0x000000013F360000-0x000000013F752000-memory.dmp

Filesize
3.9MB

Download
memory/3044-48-0x0000000003310000-0x0000000003702000-memory.dmp

Filesize
3.9MB

Download
memory/3044-73-0x000000013F030000-0x000000013F422000-memory.dmp

Filesize
3.9MB

Download
memory/3044-35-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/3044-57-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/3044-88-0x000000013F4A0000-0x000000013F892000-memory.dmp

Filesize
3.9MB

Download
memory/3044-60-0x000000013F220000-0x000000013F612000-memory.dmp

Filesize
3.9MB

Download
memory/3044-84-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download
memory/3044-87-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/3044-33-0x000000013F200000-0x000000013F5F2000-memory.dmp

Filesize
3.9MB

Download
memory/3044-0-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/3044-61-0x0000000003310000-0x0000000003702000-memory.dmp

Filesize
3.9MB

Download
memory/3044-8-0x0000000002F30000-0x0000000003322000-memory.dmp

Filesize
3.9MB

Download
memory/3044-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download