xmrig | bdc4ab702989f58059b60e69c296c831f94efd19d67ba3f489f522f8ae8c9db5

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30-09-2024 07:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
Size

1.1MB
MD5

0037f01b8037018674f8edf2dc7d2aef
SHA1

233a9c43f07070b288445beacfbb87f753266b4c
SHA256

bdc4ab702989f58059b60e69c296c831f94efd19d67ba3f489f522f8ae8c9db5
SHA512

23124840e65b596a5145e5cfab43eef17a47fb3d1a11d29aa08d11dc35370dc2740d569c79ea97226997c0e4db01238f967d6d42df19233608f44331c77643cb
SSDEEP

24576:RVIl/WDGCi7/qkat6zqxG2/yJeUU0Vw0q0D2zLzdUvOln:ROdWCCi7/raWf/U0VZyf

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 59 IoCs

miner

resource	yara_rule
behavioral2/memory/4180-73-0x00007FF77A830000-0x00007FF77AB81000-memory.dmp	xmrig
behavioral2/memory/1372-344-0x00007FF6B0950000-0x00007FF6B0CA1000-memory.dmp	xmrig
behavioral2/memory/3244-350-0x00007FF660300000-0x00007FF660651000-memory.dmp	xmrig
behavioral2/memory/3112-356-0x00007FF622B60000-0x00007FF622EB1000-memory.dmp	xmrig
behavioral2/memory/400-2120-0x00007FF6988A0000-0x00007FF698BF1000-memory.dmp	xmrig
behavioral2/memory/4604-2119-0x00007FF781970000-0x00007FF781CC1000-memory.dmp	xmrig
behavioral2/memory/4596-2112-0x00007FF76EBF0000-0x00007FF76EF41000-memory.dmp	xmrig
behavioral2/memory/464-2110-0x00007FF674B80000-0x00007FF674ED1000-memory.dmp	xmrig
behavioral2/memory/968-357-0x00007FF62E5C0000-0x00007FF62E911000-memory.dmp	xmrig
behavioral2/memory/4220-355-0x00007FF65C830000-0x00007FF65CB81000-memory.dmp	xmrig
behavioral2/memory/3816-354-0x00007FF765980000-0x00007FF765CD1000-memory.dmp	xmrig
behavioral2/memory/2436-353-0x00007FF6C7430000-0x00007FF6C7781000-memory.dmp	xmrig
behavioral2/memory/1916-352-0x00007FF7E15C0000-0x00007FF7E1911000-memory.dmp	xmrig
behavioral2/memory/756-351-0x00007FF643EF0000-0x00007FF644241000-memory.dmp	xmrig
behavioral2/memory/4828-349-0x00007FF715340000-0x00007FF715691000-memory.dmp	xmrig
behavioral2/memory/4520-348-0x00007FF699400000-0x00007FF699751000-memory.dmp	xmrig
behavioral2/memory/2352-347-0x00007FF614670000-0x00007FF6149C1000-memory.dmp	xmrig
behavioral2/memory/4976-346-0x00007FF799100000-0x00007FF799451000-memory.dmp	xmrig
behavioral2/memory/5000-345-0x00007FF710380000-0x00007FF7106D1000-memory.dmp	xmrig
behavioral2/memory/2064-343-0x00007FF638610000-0x00007FF638961000-memory.dmp	xmrig
behavioral2/memory/2484-342-0x00007FF6F3B40000-0x00007FF6F3E91000-memory.dmp	xmrig
behavioral2/memory/5108-340-0x00007FF7B6850000-0x00007FF7B6BA1000-memory.dmp	xmrig
behavioral2/memory/4160-319-0x00007FF6440B0000-0x00007FF644401000-memory.dmp	xmrig
behavioral2/memory/4140-314-0x00007FF77D580000-0x00007FF77D8D1000-memory.dmp	xmrig
behavioral2/memory/3660-245-0x00007FF6BD580000-0x00007FF6BD8D1000-memory.dmp	xmrig
behavioral2/memory/2188-206-0x00007FF669E80000-0x00007FF66A1D1000-memory.dmp	xmrig
behavioral2/memory/3004-197-0x00007FF679F90000-0x00007FF67A2E1000-memory.dmp	xmrig
behavioral2/memory/1744-130-0x00007FF76E6F0000-0x00007FF76EA41000-memory.dmp	xmrig
behavioral2/memory/3672-2124-0x00007FF72A300000-0x00007FF72A651000-memory.dmp	xmrig
behavioral2/memory/2904-2125-0x00007FF6087D0000-0x00007FF608B21000-memory.dmp	xmrig
behavioral2/memory/4596-2207-0x00007FF76EBF0000-0x00007FF76EF41000-memory.dmp	xmrig
behavioral2/memory/4180-2209-0x00007FF77A830000-0x00007FF77AB81000-memory.dmp	xmrig
behavioral2/memory/4604-2211-0x00007FF781970000-0x00007FF781CC1000-memory.dmp	xmrig
behavioral2/memory/1744-2242-0x00007FF76E6F0000-0x00007FF76EA41000-memory.dmp	xmrig
behavioral2/memory/3004-2240-0x00007FF679F90000-0x00007FF67A2E1000-memory.dmp	xmrig
behavioral2/memory/2904-2244-0x00007FF6087D0000-0x00007FF608B21000-memory.dmp	xmrig
behavioral2/memory/3816-2238-0x00007FF765980000-0x00007FF765CD1000-memory.dmp	xmrig
behavioral2/memory/4220-2235-0x00007FF65C830000-0x00007FF65CB81000-memory.dmp	xmrig
behavioral2/memory/400-2232-0x00007FF6988A0000-0x00007FF698BF1000-memory.dmp	xmrig
behavioral2/memory/3672-2237-0x00007FF72A300000-0x00007FF72A651000-memory.dmp	xmrig
behavioral2/memory/4160-2258-0x00007FF6440B0000-0x00007FF644401000-memory.dmp	xmrig
behavioral2/memory/1916-2278-0x00007FF7E15C0000-0x00007FF7E1911000-memory.dmp	xmrig
behavioral2/memory/2436-2323-0x00007FF6C7430000-0x00007FF6C7781000-memory.dmp	xmrig
behavioral2/memory/3244-2302-0x00007FF660300000-0x00007FF660651000-memory.dmp	xmrig
behavioral2/memory/4828-2300-0x00007FF715340000-0x00007FF715691000-memory.dmp	xmrig
behavioral2/memory/968-2276-0x00007FF62E5C0000-0x00007FF62E911000-memory.dmp	xmrig
behavioral2/memory/3112-2275-0x00007FF622B60000-0x00007FF622EB1000-memory.dmp	xmrig
behavioral2/memory/3660-2273-0x00007FF6BD580000-0x00007FF6BD8D1000-memory.dmp	xmrig
behavioral2/memory/4976-2270-0x00007FF799100000-0x00007FF799451000-memory.dmp	xmrig
behavioral2/memory/2352-2268-0x00007FF614670000-0x00007FF6149C1000-memory.dmp	xmrig
behavioral2/memory/2064-2266-0x00007FF638610000-0x00007FF638961000-memory.dmp	xmrig
behavioral2/memory/756-2261-0x00007FF643EF0000-0x00007FF644241000-memory.dmp	xmrig
behavioral2/memory/5108-2260-0x00007FF7B6850000-0x00007FF7B6BA1000-memory.dmp	xmrig
behavioral2/memory/4520-2252-0x00007FF699400000-0x00007FF699751000-memory.dmp	xmrig
behavioral2/memory/2484-2249-0x00007FF6F3B40000-0x00007FF6F3E91000-memory.dmp	xmrig
behavioral2/memory/2188-2248-0x00007FF669E80000-0x00007FF66A1D1000-memory.dmp	xmrig
behavioral2/memory/4140-2264-0x00007FF77D580000-0x00007FF77D8D1000-memory.dmp	xmrig
behavioral2/memory/1372-2256-0x00007FF6B0950000-0x00007FF6B0CA1000-memory.dmp	xmrig
behavioral2/memory/5000-2254-0x00007FF710380000-0x00007FF7106D1000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4596	qgyZzKs.exe
4604	ytyHiAp.exe
3672	firZFrJ.exe
400	mfJsSAp.exe
4180	ghVpZuA.exe
3816	jGEprcR.exe
2904	ibdfzQR.exe
1744	XLdbEEF.exe
3004	JjCTuEG.exe
2188	pqPpRvq.exe
3660	sxIgLsS.exe
4140	CWGSyka.exe
4160	ByQjHzn.exe
5108	sbTcyux.exe
4220	uCqPova.exe
3112	opqQlsd.exe
2484	rJjQIdA.exe
2064	YbHzAtH.exe
1372	XfvyHBc.exe
5000	XwGDzRp.exe
4976	DHSUqVj.exe
2352	vtOHrUa.exe
968	IZcyRXR.exe
4520	wIqDEhk.exe
4828	VkCUhGr.exe
3244	EXJsqdB.exe
756	OcTGaoK.exe
1916	gFybLnk.exe
2436	nvYAzOO.exe
3636	xcqjBTe.exe
1692	sPnSHoQ.exe
3208	uyTwZwG.exe
220	mclfTAe.exe
5064	XNxksKb.exe
4532	EwoMQWi.exe
3792	FXNUQMa.exe
4012	IFDgecq.exe
3700	fKVpWVk.exe
2892	cdhZJGH.exe
1188	WBIVwBW.exe
3756	TglIJHM.exe
3796	usiwJYZ.exe
3976	DStWtVG.exe
3460	QoBLNEr.exe
852	XIBRVNh.exe
4588	hadxRRm.exe
2408	DUKRCsV.exe
2952	PNDBvPG.exe
4216	jIbDzCb.exe
1132	vLDQDrR.exe
2760	anpUoKq.exe
384	GsSvxwX.exe
3424	gyHvMqm.exe
2872	pdBhTeG.exe
2464	ADWCydD.exe
1092	ABcEBeH.exe
2176	zSXtIDh.exe
1272	fYsfqtb.exe
3972	gfWxNgu.exe
4576	aZbSpRt.exe
1732	qRmSPda.exe
1496	zVGxqAl.exe
2804	QTfTuAf.exe
3252	cJafVKO.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/464-0-0x00007FF674B80000-0x00007FF674ED1000-memory.dmp	upx
behavioral2/files/0x0008000000023418-5.dat	upx
behavioral2/memory/400-36-0x00007FF6988A0000-0x00007FF698BF1000-memory.dmp	upx
behavioral2/files/0x000700000002342a-92.dat	upx
behavioral2/files/0x0007000000023434-118.dat	upx
behavioral2/files/0x0007000000023423-86.dat	upx
behavioral2/files/0x0007000000023424-83.dat	upx
behavioral2/files/0x000700000002341f-77.dat	upx
behavioral2/memory/4180-73-0x00007FF77A830000-0x00007FF77AB81000-memory.dmp	upx
behavioral2/files/0x0007000000023429-72.dat	upx
behavioral2/memory/3672-70-0x00007FF72A300000-0x00007FF72A651000-memory.dmp	upx
behavioral2/files/0x0007000000023428-69.dat	upx
behavioral2/files/0x0007000000023430-99.dat	upx
behavioral2/files/0x0007000000023435-119.dat	upx
behavioral2/files/0x000700000002343e-188.dat	upx
behavioral2/memory/1372-344-0x00007FF6B0950000-0x00007FF6B0CA1000-memory.dmp	upx
behavioral2/memory/3244-350-0x00007FF660300000-0x00007FF660651000-memory.dmp	upx
behavioral2/memory/3112-356-0x00007FF622B60000-0x00007FF622EB1000-memory.dmp	upx
behavioral2/memory/400-2120-0x00007FF6988A0000-0x00007FF698BF1000-memory.dmp	upx
behavioral2/memory/4604-2119-0x00007FF781970000-0x00007FF781CC1000-memory.dmp	upx
behavioral2/memory/4596-2112-0x00007FF76EBF0000-0x00007FF76EF41000-memory.dmp	upx
behavioral2/memory/464-2110-0x00007FF674B80000-0x00007FF674ED1000-memory.dmp	upx
behavioral2/memory/968-357-0x00007FF62E5C0000-0x00007FF62E911000-memory.dmp	upx
behavioral2/memory/4220-355-0x00007FF65C830000-0x00007FF65CB81000-memory.dmp	upx
behavioral2/memory/3816-354-0x00007FF765980000-0x00007FF765CD1000-memory.dmp	upx
behavioral2/memory/2436-353-0x00007FF6C7430000-0x00007FF6C7781000-memory.dmp	upx
behavioral2/memory/1916-352-0x00007FF7E15C0000-0x00007FF7E1911000-memory.dmp	upx
behavioral2/memory/756-351-0x00007FF643EF0000-0x00007FF644241000-memory.dmp	upx
behavioral2/memory/4828-349-0x00007FF715340000-0x00007FF715691000-memory.dmp	upx
behavioral2/memory/4520-348-0x00007FF699400000-0x00007FF699751000-memory.dmp	upx
behavioral2/memory/2352-347-0x00007FF614670000-0x00007FF6149C1000-memory.dmp	upx
behavioral2/memory/4976-346-0x00007FF799100000-0x00007FF799451000-memory.dmp	upx
behavioral2/memory/5000-345-0x00007FF710380000-0x00007FF7106D1000-memory.dmp	upx
behavioral2/memory/2064-343-0x00007FF638610000-0x00007FF638961000-memory.dmp	upx
behavioral2/memory/2484-342-0x00007FF6F3B40000-0x00007FF6F3E91000-memory.dmp	upx
behavioral2/memory/5108-340-0x00007FF7B6850000-0x00007FF7B6BA1000-memory.dmp	upx
behavioral2/memory/4160-319-0x00007FF6440B0000-0x00007FF644401000-memory.dmp	upx
behavioral2/memory/4140-314-0x00007FF77D580000-0x00007FF77D8D1000-memory.dmp	upx
behavioral2/files/0x0007000000023440-216.dat	upx
behavioral2/memory/3660-245-0x00007FF6BD580000-0x00007FF6BD8D1000-memory.dmp	upx
behavioral2/memory/2188-206-0x00007FF669E80000-0x00007FF66A1D1000-memory.dmp	upx
behavioral2/memory/3004-197-0x00007FF679F90000-0x00007FF67A2E1000-memory.dmp	upx
behavioral2/files/0x000700000002343f-195.dat	upx
behavioral2/files/0x000700000002343d-185.dat	upx
behavioral2/files/0x000700000002343c-181.dat	upx
behavioral2/files/0x000700000002343b-180.dat	upx
behavioral2/files/0x0007000000023439-178.dat	upx
behavioral2/files/0x0007000000023433-176.dat	upx
behavioral2/files/0x000700000002342f-156.dat	upx
behavioral2/files/0x000700000002342c-212.dat	upx
behavioral2/files/0x0007000000023427-147.dat	upx
behavioral2/files/0x000700000002342b-145.dat	upx
behavioral2/files/0x000700000002343a-132.dat	upx
behavioral2/memory/1744-130-0x00007FF76E6F0000-0x00007FF76EA41000-memory.dmp	upx
behavioral2/files/0x0007000000023432-129.dat	upx
behavioral2/files/0x0007000000023438-128.dat	upx
behavioral2/files/0x0007000000023437-127.dat	upx
behavioral2/files/0x0007000000023436-126.dat	upx
behavioral2/files/0x0007000000023421-122.dat	upx
behavioral2/files/0x000700000002342e-154.dat	upx
behavioral2/files/0x000700000002342d-148.dat	upx
behavioral2/files/0x0007000000023426-120.dat	upx
behavioral2/files/0x0007000000023425-115.dat	upx
behavioral2/files/0x0007000000023422-103.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\oDGSfdJ.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\QhvzqUM.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\DHIvTPL.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\IoatQee.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\emhWSBp.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\QoBLNEr.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\ZAKpjfl.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\cCqRYYQ.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\wqAZbmv.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\vzCAxBI.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\Kmkixza.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\LrWpDEj.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\dayKkde.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\XkPIewt.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\QvYmlWj.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\EFlkYXu.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\XFsaGSf.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\dHAQaba.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\LMTJUEC.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\xLCSUfc.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\AoVyFYV.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\jREppsm.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\iZMfQXA.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\IhDYPdC.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\KyJfMMB.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\OvikRdZ.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\TfbYMTA.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\ofkOnFH.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\QEiMIHV.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\XwGDzRp.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\qzqJJpF.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\ccsIbTV.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\sIyiykq.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\WldbeHf.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\DepgFee.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\jIbDzCb.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\fYsfqtb.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\UGQIYmU.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\YuIDxUM.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\BmrtJif.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\BxhxtKm.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\CKmgTMx.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\bEoFZsU.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\GUJhlnH.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\RSIPYVv.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\IZzRrGi.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\OQVRNVh.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\YXgQIXd.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\gMgWFPt.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\jiogfRk.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\dEfGDlh.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\wOjuLrs.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\MkjUWfv.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\GSvNeKf.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\HKxEOqk.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\auOHpVi.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\OgJVhRm.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\SIOsKBQ.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\vgQqGqS.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\QuzLyUX.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\tGzlgfU.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\HOowaKf.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\kswldlg.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\xoUpCrx.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 464 wrote to memory of 4596	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	83
PID 464 wrote to memory of 4596	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	83
PID 464 wrote to memory of 4604	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	84
PID 464 wrote to memory of 4604	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	84
PID 464 wrote to memory of 3672	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	85
PID 464 wrote to memory of 3672	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	85
PID 464 wrote to memory of 400	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	86
PID 464 wrote to memory of 400	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	86
PID 464 wrote to memory of 3816	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	87
PID 464 wrote to memory of 3816	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	87
PID 464 wrote to memory of 4180	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	88
PID 464 wrote to memory of 4180	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	88
PID 464 wrote to memory of 4160	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	89
PID 464 wrote to memory of 4160	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	89
PID 464 wrote to memory of 2904	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	90
PID 464 wrote to memory of 2904	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	90
PID 464 wrote to memory of 1744	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	91
PID 464 wrote to memory of 1744	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	91
PID 464 wrote to memory of 3004	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	92
PID 464 wrote to memory of 3004	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	92
PID 464 wrote to memory of 2188	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	93
PID 464 wrote to memory of 2188	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	93
PID 464 wrote to memory of 3660	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	94
PID 464 wrote to memory of 3660	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	94
PID 464 wrote to memory of 4140	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	95
PID 464 wrote to memory of 4140	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	95
PID 464 wrote to memory of 5108	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	96
PID 464 wrote to memory of 5108	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	96
PID 464 wrote to memory of 4220	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	97
PID 464 wrote to memory of 4220	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	97
PID 464 wrote to memory of 3112	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	98
PID 464 wrote to memory of 3112	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	98
PID 464 wrote to memory of 2484	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	99
PID 464 wrote to memory of 2484	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	99
PID 464 wrote to memory of 2064	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	100
PID 464 wrote to memory of 2064	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	100
PID 464 wrote to memory of 1372	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	101
PID 464 wrote to memory of 1372	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	101
PID 464 wrote to memory of 5000	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	102
PID 464 wrote to memory of 5000	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	102
PID 464 wrote to memory of 4976	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	103
PID 464 wrote to memory of 4976	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	103
PID 464 wrote to memory of 2352	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	104
PID 464 wrote to memory of 2352	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	104
PID 464 wrote to memory of 756	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	105
PID 464 wrote to memory of 756	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	105
PID 464 wrote to memory of 968	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	106
PID 464 wrote to memory of 968	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	106
PID 464 wrote to memory of 4520	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	107
PID 464 wrote to memory of 4520	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	107
PID 464 wrote to memory of 4828	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	108
PID 464 wrote to memory of 4828	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	108
PID 464 wrote to memory of 3244	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	109
PID 464 wrote to memory of 3244	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	109
PID 464 wrote to memory of 1916	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	110
PID 464 wrote to memory of 1916	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	110
PID 464 wrote to memory of 2436	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	111
PID 464 wrote to memory of 2436	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	111
PID 464 wrote to memory of 3636	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	112
PID 464 wrote to memory of 3636	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	112
PID 464 wrote to memory of 3208	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	113
PID 464 wrote to memory of 3208	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	113
PID 464 wrote to memory of 1692	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	114
PID 464 wrote to memory of 1692	464	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	114

C:\Users\Admin\AppData\Local\Temp\0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:464
- C:\Windows\System\qgyZzKs.exe
  C:\Windows\System\qgyZzKs.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\ytyHiAp.exe
  C:\Windows\System\ytyHiAp.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\firZFrJ.exe
  C:\Windows\System\firZFrJ.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\mfJsSAp.exe
  C:\Windows\System\mfJsSAp.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\jGEprcR.exe
  C:\Windows\System\jGEprcR.exe
  2⤵
  - Executes dropped EXE
  PID:3816
- C:\Windows\System\ghVpZuA.exe
  C:\Windows\System\ghVpZuA.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\ByQjHzn.exe
  C:\Windows\System\ByQjHzn.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System\ibdfzQR.exe
  C:\Windows\System\ibdfzQR.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\XLdbEEF.exe
  C:\Windows\System\XLdbEEF.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\JjCTuEG.exe
  C:\Windows\System\JjCTuEG.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\pqPpRvq.exe
  C:\Windows\System\pqPpRvq.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\sxIgLsS.exe
  C:\Windows\System\sxIgLsS.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\CWGSyka.exe
  C:\Windows\System\CWGSyka.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\sbTcyux.exe
  C:\Windows\System\sbTcyux.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\uCqPova.exe
  C:\Windows\System\uCqPova.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\opqQlsd.exe
  C:\Windows\System\opqQlsd.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\rJjQIdA.exe
  C:\Windows\System\rJjQIdA.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\YbHzAtH.exe
  C:\Windows\System\YbHzAtH.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\XfvyHBc.exe
  C:\Windows\System\XfvyHBc.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\XwGDzRp.exe
  C:\Windows\System\XwGDzRp.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\DHSUqVj.exe
  C:\Windows\System\DHSUqVj.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\vtOHrUa.exe
  C:\Windows\System\vtOHrUa.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\OcTGaoK.exe
  C:\Windows\System\OcTGaoK.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\IZcyRXR.exe
  C:\Windows\System\IZcyRXR.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\wIqDEhk.exe
  C:\Windows\System\wIqDEhk.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\VkCUhGr.exe
  C:\Windows\System\VkCUhGr.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\EXJsqdB.exe
  C:\Windows\System\EXJsqdB.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\gFybLnk.exe
  C:\Windows\System\gFybLnk.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\nvYAzOO.exe
  C:\Windows\System\nvYAzOO.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\xcqjBTe.exe
  C:\Windows\System\xcqjBTe.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\uyTwZwG.exe
  C:\Windows\System\uyTwZwG.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\sPnSHoQ.exe
  C:\Windows\System\sPnSHoQ.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\mclfTAe.exe
  C:\Windows\System\mclfTAe.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\XNxksKb.exe
  C:\Windows\System\XNxksKb.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\EwoMQWi.exe
  C:\Windows\System\EwoMQWi.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\FXNUQMa.exe
  C:\Windows\System\FXNUQMa.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System\IFDgecq.exe
  C:\Windows\System\IFDgecq.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\fKVpWVk.exe
  C:\Windows\System\fKVpWVk.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System\cdhZJGH.exe
  C:\Windows\System\cdhZJGH.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\WBIVwBW.exe
  C:\Windows\System\WBIVwBW.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\TglIJHM.exe
  C:\Windows\System\TglIJHM.exe
  2⤵
  - Executes dropped EXE
  PID:3756
- C:\Windows\System\usiwJYZ.exe
  C:\Windows\System\usiwJYZ.exe
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Windows\System\aZbSpRt.exe
  C:\Windows\System\aZbSpRt.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\DStWtVG.exe
  C:\Windows\System\DStWtVG.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\qRmSPda.exe
  C:\Windows\System\qRmSPda.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\QoBLNEr.exe
  C:\Windows\System\QoBLNEr.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\XIBRVNh.exe
  C:\Windows\System\XIBRVNh.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\hadxRRm.exe
  C:\Windows\System\hadxRRm.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\DUKRCsV.exe
  C:\Windows\System\DUKRCsV.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\PNDBvPG.exe
  C:\Windows\System\PNDBvPG.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\jIbDzCb.exe
  C:\Windows\System\jIbDzCb.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System\vLDQDrR.exe
  C:\Windows\System\vLDQDrR.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\anpUoKq.exe
  C:\Windows\System\anpUoKq.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\GsSvxwX.exe
  C:\Windows\System\GsSvxwX.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\gyHvMqm.exe
  C:\Windows\System\gyHvMqm.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System\pdBhTeG.exe
  C:\Windows\System\pdBhTeG.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\ADWCydD.exe
  C:\Windows\System\ADWCydD.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\ABcEBeH.exe
  C:\Windows\System\ABcEBeH.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\zSXtIDh.exe
  C:\Windows\System\zSXtIDh.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\fYsfqtb.exe
  C:\Windows\System\fYsfqtb.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\gfWxNgu.exe
  C:\Windows\System\gfWxNgu.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\zVGxqAl.exe
  C:\Windows\System\zVGxqAl.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\QTfTuAf.exe
  C:\Windows\System\QTfTuAf.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\cJafVKO.exe
  C:\Windows\System\cJafVKO.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\System\UfltzmG.exe
  C:\Windows\System\UfltzmG.exe
  2⤵
  PID:2984
- C:\Windows\System\UGQIYmU.exe
  C:\Windows\System\UGQIYmU.exe
  2⤵
  PID:1368
- C:\Windows\System\wKGiJol.exe
  C:\Windows\System\wKGiJol.exe
  2⤵
  PID:4552
- C:\Windows\System\OQVRNVh.exe
  C:\Windows\System\OQVRNVh.exe
  2⤵
  PID:3964
- C:\Windows\System\qHoOLZQ.exe
  C:\Windows\System\qHoOLZQ.exe
  2⤵
  PID:1576
- C:\Windows\System\stqBFUQ.exe
  C:\Windows\System\stqBFUQ.exe
  2⤵
  PID:4116
- C:\Windows\System\dFSCRpL.exe
  C:\Windows\System\dFSCRpL.exe
  2⤵
  PID:4440
- C:\Windows\System\XmmwZnw.exe
  C:\Windows\System\XmmwZnw.exe
  2⤵
  PID:2888
- C:\Windows\System\SdaZZja.exe
  C:\Windows\System\SdaZZja.exe
  2⤵
  PID:3876
- C:\Windows\System\bLAYsYP.exe
  C:\Windows\System\bLAYsYP.exe
  2⤵
  PID:4496
- C:\Windows\System\ccHdnFR.exe
  C:\Windows\System\ccHdnFR.exe
  2⤵
  PID:5008
- C:\Windows\System\mZbzQLr.exe
  C:\Windows\System\mZbzQLr.exe
  2⤵
  PID:4996
- C:\Windows\System\tkLxndM.exe
  C:\Windows\System\tkLxndM.exe
  2⤵
  PID:1040
- C:\Windows\System\ndxSmlA.exe
  C:\Windows\System\ndxSmlA.exe
  2⤵
  PID:4888
- C:\Windows\System\QvYmlWj.exe
  C:\Windows\System\QvYmlWj.exe
  2⤵
  PID:4404
- C:\Windows\System\tUfWkfF.exe
  C:\Windows\System\tUfWkfF.exe
  2⤵
  PID:856
- C:\Windows\System\fvwZMTI.exe
  C:\Windows\System\fvwZMTI.exe
  2⤵
  PID:2752
- C:\Windows\System\yGrAajh.exe
  C:\Windows\System\yGrAajh.exe
  2⤵
  PID:4528
- C:\Windows\System\mneVkUN.exe
  C:\Windows\System\mneVkUN.exe
  2⤵
  PID:3044
- C:\Windows\System\DyOnMpx.exe
  C:\Windows\System\DyOnMpx.exe
  2⤵
  PID:4436
- C:\Windows\System\ssHkBGg.exe
  C:\Windows\System\ssHkBGg.exe
  2⤵
  PID:5140
- C:\Windows\System\akdVjLg.exe
  C:\Windows\System\akdVjLg.exe
  2⤵
  PID:5164
- C:\Windows\System\GAcfVWl.exe
  C:\Windows\System\GAcfVWl.exe
  2⤵
  PID:5184
- C:\Windows\System\slcPjnS.exe
  C:\Windows\System\slcPjnS.exe
  2⤵
  PID:5200
- C:\Windows\System\ueOUZzl.exe
  C:\Windows\System\ueOUZzl.exe
  2⤵
  PID:5224
- C:\Windows\System\EKguAgU.exe
  C:\Windows\System\EKguAgU.exe
  2⤵
  PID:5240
- C:\Windows\System\kswldlg.exe
  C:\Windows\System\kswldlg.exe
  2⤵
  PID:5268
- C:\Windows\System\dpYlZJE.exe
  C:\Windows\System\dpYlZJE.exe
  2⤵
  PID:5284
- C:\Windows\System\iDjrkwK.exe
  C:\Windows\System\iDjrkwK.exe
  2⤵
  PID:5324
- C:\Windows\System\LrrLdhx.exe
  C:\Windows\System\LrrLdhx.exe
  2⤵
  PID:5344
- C:\Windows\System\weLJllq.exe
  C:\Windows\System\weLJllq.exe
  2⤵
  PID:5360
- C:\Windows\System\gndbJeS.exe
  C:\Windows\System\gndbJeS.exe
  2⤵
  PID:5384
- C:\Windows\System\wwzHMmP.exe
  C:\Windows\System\wwzHMmP.exe
  2⤵
  PID:5404
- C:\Windows\System\qoGkvqn.exe
  C:\Windows\System\qoGkvqn.exe
  2⤵
  PID:5420
- C:\Windows\System\ylFTSRy.exe
  C:\Windows\System\ylFTSRy.exe
  2⤵
  PID:5436
- C:\Windows\System\horCZTd.exe
  C:\Windows\System\horCZTd.exe
  2⤵
  PID:5460
- C:\Windows\System\FZVpGun.exe
  C:\Windows\System\FZVpGun.exe
  2⤵
  PID:5476
- C:\Windows\System\TTUyLwb.exe
  C:\Windows\System\TTUyLwb.exe
  2⤵
  PID:5504
- C:\Windows\System\PzEXWIL.exe
  C:\Windows\System\PzEXWIL.exe
  2⤵
  PID:5524
- C:\Windows\System\UNYMIfZ.exe
  C:\Windows\System\UNYMIfZ.exe
  2⤵
  PID:5552
- C:\Windows\System\nwixERH.exe
  C:\Windows\System\nwixERH.exe
  2⤵
  PID:5568
- C:\Windows\System\QjtBftU.exe
  C:\Windows\System\QjtBftU.exe
  2⤵
  PID:5588
- C:\Windows\System\IbcaDkz.exe
  C:\Windows\System\IbcaDkz.exe
  2⤵
  PID:5608
- C:\Windows\System\KMBkpYY.exe
  C:\Windows\System\KMBkpYY.exe
  2⤵
  PID:5760
- C:\Windows\System\jZZnKpH.exe
  C:\Windows\System\jZZnKpH.exe
  2⤵
  PID:5776
- C:\Windows\System\tdvfTPD.exe
  C:\Windows\System\tdvfTPD.exe
  2⤵
  PID:5792
- C:\Windows\System\uhZOCGV.exe
  C:\Windows\System\uhZOCGV.exe
  2⤵
  PID:5808
- C:\Windows\System\lZbXbxI.exe
  C:\Windows\System\lZbXbxI.exe
  2⤵
  PID:5824
- C:\Windows\System\YyJbaEM.exe
  C:\Windows\System\YyJbaEM.exe
  2⤵
  PID:5844
- C:\Windows\System\xdzAWUs.exe
  C:\Windows\System\xdzAWUs.exe
  2⤵
  PID:5860
- C:\Windows\System\ehFwDfU.exe
  C:\Windows\System\ehFwDfU.exe
  2⤵
  PID:5880
- C:\Windows\System\vJdJNlZ.exe
  C:\Windows\System\vJdJNlZ.exe
  2⤵
  PID:5896
- C:\Windows\System\mwcEOvB.exe
  C:\Windows\System\mwcEOvB.exe
  2⤵
  PID:5912
- C:\Windows\System\JwfmylB.exe
  C:\Windows\System\JwfmylB.exe
  2⤵
  PID:5932
- C:\Windows\System\HMowdfy.exe
  C:\Windows\System\HMowdfy.exe
  2⤵
  PID:5948
- C:\Windows\System\TPcEPkI.exe
  C:\Windows\System\TPcEPkI.exe
  2⤵
  PID:5964
- C:\Windows\System\Yvfxhil.exe
  C:\Windows\System\Yvfxhil.exe
  2⤵
  PID:5984
- C:\Windows\System\FbMSNQn.exe
  C:\Windows\System\FbMSNQn.exe
  2⤵
  PID:6004
- C:\Windows\System\pDwGHDH.exe
  C:\Windows\System\pDwGHDH.exe
  2⤵
  PID:6020
- C:\Windows\System\OuaXHDw.exe
  C:\Windows\System\OuaXHDw.exe
  2⤵
  PID:6040
- C:\Windows\System\kpUGYpb.exe
  C:\Windows\System\kpUGYpb.exe
  2⤵
  PID:920
- C:\Windows\System\siYteuN.exe
  C:\Windows\System\siYteuN.exe
  2⤵
  PID:5032
- C:\Windows\System\ivpdXCO.exe
  C:\Windows\System\ivpdXCO.exe
  2⤵
  PID:3184
- C:\Windows\System\OkNxTsb.exe
  C:\Windows\System\OkNxTsb.exe
  2⤵
  PID:3812
- C:\Windows\System\SntSoOW.exe
  C:\Windows\System\SntSoOW.exe
  2⤵
  PID:3160
- C:\Windows\System\jWdWVyr.exe
  C:\Windows\System\jWdWVyr.exe
  2⤵
  PID:2100
- C:\Windows\System\PxvvVOB.exe
  C:\Windows\System\PxvvVOB.exe
  2⤵
  PID:4704
- C:\Windows\System\FORPrdK.exe
  C:\Windows\System\FORPrdK.exe
  2⤵
  PID:4260
- C:\Windows\System\qPifWof.exe
  C:\Windows\System\qPifWof.exe
  2⤵
  PID:4068
- C:\Windows\System\gTjMwpH.exe
  C:\Windows\System\gTjMwpH.exe
  2⤵
  PID:4928
- C:\Windows\System\RVJvxfY.exe
  C:\Windows\System\RVJvxfY.exe
  2⤵
  PID:4064
- C:\Windows\System\GkCJYoj.exe
  C:\Windows\System\GkCJYoj.exe
  2⤵
  PID:3572
- C:\Windows\System\LMItDJi.exe
  C:\Windows\System\LMItDJi.exe
  2⤵
  PID:4680
- C:\Windows\System\IephKtl.exe
  C:\Windows\System\IephKtl.exe
  2⤵
  PID:2916
- C:\Windows\System\huiRJNC.exe
  C:\Windows\System\huiRJNC.exe
  2⤵
  PID:2304
- C:\Windows\System\XlaIUxq.exe
  C:\Windows\System\XlaIUxq.exe
  2⤵
  PID:4632
- C:\Windows\System\ORuggUR.exe
  C:\Windows\System\ORuggUR.exe
  2⤵
  PID:4584
- C:\Windows\System\uhgiYAu.exe
  C:\Windows\System\uhgiYAu.exe
  2⤵
  PID:5292
- C:\Windows\System\rkyYfgb.exe
  C:\Windows\System\rkyYfgb.exe
  2⤵
  PID:5532
- C:\Windows\System\APCZzrq.exe
  C:\Windows\System\APCZzrq.exe
  2⤵
  PID:5152
- C:\Windows\System\cqpgBEX.exe
  C:\Windows\System\cqpgBEX.exe
  2⤵
  PID:5212
- C:\Windows\System\dEPNvLj.exe
  C:\Windows\System\dEPNvLj.exe
  2⤵
  PID:5276
- C:\Windows\System\bmkEesr.exe
  C:\Windows\System\bmkEesr.exe
  2⤵
  PID:5352
- C:\Windows\System\kRKJTxQ.exe
  C:\Windows\System\kRKJTxQ.exe
  2⤵
  PID:5428
- C:\Windows\System\LxIojYp.exe
  C:\Windows\System\LxIojYp.exe
  2⤵
  PID:5468
- C:\Windows\System\slllxGK.exe
  C:\Windows\System\slllxGK.exe
  2⤵
  PID:5548
- C:\Windows\System\eYeCRay.exe
  C:\Windows\System\eYeCRay.exe
  2⤵
  PID:5600
- C:\Windows\System\fJaIqAZ.exe
  C:\Windows\System\fJaIqAZ.exe
  2⤵
  PID:6172
- C:\Windows\System\fiLuzQJ.exe
  C:\Windows\System\fiLuzQJ.exe
  2⤵
  PID:6252
- C:\Windows\System\gwwcrOO.exe
  C:\Windows\System\gwwcrOO.exe
  2⤵
  PID:6268
- C:\Windows\System\acLzMhh.exe
  C:\Windows\System\acLzMhh.exe
  2⤵
  PID:6296
- C:\Windows\System\aqDEBaz.exe
  C:\Windows\System\aqDEBaz.exe
  2⤵
  PID:6316
- C:\Windows\System\mGxXdrP.exe
  C:\Windows\System\mGxXdrP.exe
  2⤵
  PID:6332
- C:\Windows\System\yjBuLnS.exe
  C:\Windows\System\yjBuLnS.exe
  2⤵
  PID:6356
- C:\Windows\System\tmYkDls.exe
  C:\Windows\System\tmYkDls.exe
  2⤵
  PID:6372
- C:\Windows\System\CNesilN.exe
  C:\Windows\System\CNesilN.exe
  2⤵
  PID:6400
- C:\Windows\System\ZAhOXLW.exe
  C:\Windows\System\ZAhOXLW.exe
  2⤵
  PID:6416
- C:\Windows\System\DeODzYH.exe
  C:\Windows\System\DeODzYH.exe
  2⤵
  PID:6460
- C:\Windows\System\SiWGbyq.exe
  C:\Windows\System\SiWGbyq.exe
  2⤵
  PID:6480
- C:\Windows\System\kiFaDQq.exe
  C:\Windows\System\kiFaDQq.exe
  2⤵
  PID:6500
- C:\Windows\System\IVcWtdc.exe
  C:\Windows\System\IVcWtdc.exe
  2⤵
  PID:6524
- C:\Windows\System\yVACqnV.exe
  C:\Windows\System\yVACqnV.exe
  2⤵
  PID:6540
- C:\Windows\System\lFCTFpe.exe
  C:\Windows\System\lFCTFpe.exe
  2⤵
  PID:6564
- C:\Windows\System\QFvLUmJ.exe
  C:\Windows\System\QFvLUmJ.exe
  2⤵
  PID:6584
- C:\Windows\System\rKPwdzg.exe
  C:\Windows\System\rKPwdzg.exe
  2⤵
  PID:6620
- C:\Windows\System\XSPeFyh.exe
  C:\Windows\System\XSPeFyh.exe
  2⤵
  PID:6644
- C:\Windows\System\AYUqZcB.exe
  C:\Windows\System\AYUqZcB.exe
  2⤵
  PID:6664
- C:\Windows\System\lowrnld.exe
  C:\Windows\System\lowrnld.exe
  2⤵
  PID:6684
- C:\Windows\System\YXgQIXd.exe
  C:\Windows\System\YXgQIXd.exe
  2⤵
  PID:6708
- C:\Windows\System\FzGaAWy.exe
  C:\Windows\System\FzGaAWy.exe
  2⤵
  PID:6768
- C:\Windows\System\kLuApxt.exe
  C:\Windows\System\kLuApxt.exe
  2⤵
  PID:6792
- C:\Windows\System\zavqOZA.exe
  C:\Windows\System\zavqOZA.exe
  2⤵
  PID:6808
- C:\Windows\System\EFlkYXu.exe
  C:\Windows\System\EFlkYXu.exe
  2⤵
  PID:6828
- C:\Windows\System\dRSghPH.exe
  C:\Windows\System\dRSghPH.exe
  2⤵
  PID:6848
- C:\Windows\System\EBGNqWK.exe
  C:\Windows\System\EBGNqWK.exe
  2⤵
  PID:6892
- C:\Windows\System\vBPslDW.exe
  C:\Windows\System\vBPslDW.exe
  2⤵
  PID:6908
- C:\Windows\System\vEuQYpY.exe
  C:\Windows\System\vEuQYpY.exe
  2⤵
  PID:6932
- C:\Windows\System\flJDwCS.exe
  C:\Windows\System\flJDwCS.exe
  2⤵
  PID:6952
- C:\Windows\System\QjqWIDh.exe
  C:\Windows\System\QjqWIDh.exe
  2⤵
  PID:6972
- C:\Windows\System\ugZLTMn.exe
  C:\Windows\System\ugZLTMn.exe
  2⤵
  PID:6988
- C:\Windows\System\QRAHPaG.exe
  C:\Windows\System\QRAHPaG.exe
  2⤵
  PID:7012
- C:\Windows\System\tIFArzX.exe
  C:\Windows\System\tIFArzX.exe
  2⤵
  PID:7036
- C:\Windows\System\aOQvdsF.exe
  C:\Windows\System\aOQvdsF.exe
  2⤵
  PID:7060
- C:\Windows\System\VKlCdTV.exe
  C:\Windows\System\VKlCdTV.exe
  2⤵
  PID:7076
- C:\Windows\System\ZRqgqec.exe
  C:\Windows\System\ZRqgqec.exe
  2⤵
  PID:7100
- C:\Windows\System\VdaiKTo.exe
  C:\Windows\System\VdaiKTo.exe
  2⤵
  PID:7116
- C:\Windows\System\bEoFZsU.exe
  C:\Windows\System\bEoFZsU.exe
  2⤵
  PID:7140
- C:\Windows\System\rPfaQIJ.exe
  C:\Windows\System\rPfaQIJ.exe
  2⤵
  PID:7164
- C:\Windows\System\rDxqQhs.exe
  C:\Windows\System\rDxqQhs.exe
  2⤵
  PID:1376
- C:\Windows\System\hyBHbOY.exe
  C:\Windows\System\hyBHbOY.exe
  2⤵
  PID:3996
- C:\Windows\System\cfnMMla.exe
  C:\Windows\System\cfnMMla.exe
  2⤵
  PID:876
- C:\Windows\System\cJSsVgb.exe
  C:\Windows\System\cJSsVgb.exe
  2⤵
  PID:5128
- C:\Windows\System\QKvkZYe.exe
  C:\Windows\System\QKvkZYe.exe
  2⤵
  PID:5432
- C:\Windows\System\zFqMnRU.exe
  C:\Windows\System\zFqMnRU.exe
  2⤵
  PID:5260
- C:\Windows\System\leoOywR.exe
  C:\Windows\System\leoOywR.exe
  2⤵
  PID:5768
- C:\Windows\System\XFsaGSf.exe
  C:\Windows\System\XFsaGSf.exe
  2⤵
  PID:5800
- C:\Windows\System\ZgGEbjd.exe
  C:\Windows\System\ZgGEbjd.exe
  2⤵
  PID:5820
- C:\Windows\System\twofwAj.exe
  C:\Windows\System\twofwAj.exe
  2⤵
  PID:5852
- C:\Windows\System\oiPdCJG.exe
  C:\Windows\System\oiPdCJG.exe
  2⤵
  PID:5876
- C:\Windows\System\jDbjkqc.exe
  C:\Windows\System\jDbjkqc.exe
  2⤵
  PID:5904
- C:\Windows\System\dyrYEAQ.exe
  C:\Windows\System\dyrYEAQ.exe
  2⤵
  PID:5940
- C:\Windows\System\IhDYPdC.exe
  C:\Windows\System\IhDYPdC.exe
  2⤵
  PID:5976
- C:\Windows\System\BeZPPpW.exe
  C:\Windows\System\BeZPPpW.exe
  2⤵
  PID:6028
- C:\Windows\System\VgEDpEc.exe
  C:\Windows\System\VgEDpEc.exe
  2⤵
  PID:6072
- C:\Windows\System\ISYVsUw.exe
  C:\Windows\System\ISYVsUw.exe
  2⤵
  PID:1456
- C:\Windows\System\hZVbsoD.exe
  C:\Windows\System\hZVbsoD.exe
  2⤵
  PID:6516
- C:\Windows\System\FQQzDKR.exe
  C:\Windows\System\FQQzDKR.exe
  2⤵
  PID:2812
- C:\Windows\System\jFHSLjx.exe
  C:\Windows\System\jFHSLjx.exe
  2⤵
  PID:7176
- C:\Windows\System\HxOgdrn.exe
  C:\Windows\System\HxOgdrn.exe
  2⤵
  PID:7196
- C:\Windows\System\KyJfMMB.exe
  C:\Windows\System\KyJfMMB.exe
  2⤵
  PID:7220
- C:\Windows\System\aZQcqNG.exe
  C:\Windows\System\aZQcqNG.exe
  2⤵
  PID:7240
- C:\Windows\System\LsiJjKg.exe
  C:\Windows\System\LsiJjKg.exe
  2⤵
  PID:7260
- C:\Windows\System\NekzvMw.exe
  C:\Windows\System\NekzvMw.exe
  2⤵
  PID:7280
- C:\Windows\System\vFvOaGl.exe
  C:\Windows\System\vFvOaGl.exe
  2⤵
  PID:7300
- C:\Windows\System\dHAQaba.exe
  C:\Windows\System\dHAQaba.exe
  2⤵
  PID:7316
- C:\Windows\System\KkOBCCZ.exe
  C:\Windows\System\KkOBCCZ.exe
  2⤵
  PID:7340
- C:\Windows\System\cgGudzx.exe
  C:\Windows\System\cgGudzx.exe
  2⤵
  PID:7356
- C:\Windows\System\MAfObTS.exe
  C:\Windows\System\MAfObTS.exe
  2⤵
  PID:7380
- C:\Windows\System\ukZpWYV.exe
  C:\Windows\System\ukZpWYV.exe
  2⤵
  PID:7400
- C:\Windows\System\tURKLKV.exe
  C:\Windows\System\tURKLKV.exe
  2⤵
  PID:7424
- C:\Windows\System\uxjbfvA.exe
  C:\Windows\System\uxjbfvA.exe
  2⤵
  PID:7448
- C:\Windows\System\JrJnZbj.exe
  C:\Windows\System\JrJnZbj.exe
  2⤵
  PID:7464
- C:\Windows\System\wyJdMQY.exe
  C:\Windows\System\wyJdMQY.exe
  2⤵
  PID:7496
- C:\Windows\System\mRUwyly.exe
  C:\Windows\System\mRUwyly.exe
  2⤵
  PID:7520
- C:\Windows\System\FrjUYpK.exe
  C:\Windows\System\FrjUYpK.exe
  2⤵
  PID:7544
- C:\Windows\System\RAVLzBN.exe
  C:\Windows\System\RAVLzBN.exe
  2⤵
  PID:7568
- C:\Windows\System\GVKlJKk.exe
  C:\Windows\System\GVKlJKk.exe
  2⤵
  PID:7588
- C:\Windows\System\CjQKIHR.exe
  C:\Windows\System\CjQKIHR.exe
  2⤵
  PID:7612
- C:\Windows\System\SNipgYQ.exe
  C:\Windows\System\SNipgYQ.exe
  2⤵
  PID:7640
- C:\Windows\System\XXIHDpN.exe
  C:\Windows\System\XXIHDpN.exe
  2⤵
  PID:7656
- C:\Windows\System\lornaFI.exe
  C:\Windows\System\lornaFI.exe
  2⤵
  PID:7680
- C:\Windows\System\rkpRjOw.exe
  C:\Windows\System\rkpRjOw.exe
  2⤵
  PID:7696
- C:\Windows\System\gpVqCto.exe
  C:\Windows\System\gpVqCto.exe
  2⤵
  PID:7712
- C:\Windows\System\JDSMOPM.exe
  C:\Windows\System\JDSMOPM.exe
  2⤵
  PID:7728
- C:\Windows\System\amvFVQy.exe
  C:\Windows\System\amvFVQy.exe
  2⤵
  PID:7744
- C:\Windows\System\qPCAYPk.exe
  C:\Windows\System\qPCAYPk.exe
  2⤵
  PID:7760
- C:\Windows\System\MGOKgVi.exe
  C:\Windows\System\MGOKgVi.exe
  2⤵
  PID:7776
- C:\Windows\System\KIPrYuX.exe
  C:\Windows\System\KIPrYuX.exe
  2⤵
  PID:7796
- C:\Windows\System\XpmyZmk.exe
  C:\Windows\System\XpmyZmk.exe
  2⤵
  PID:7820
- C:\Windows\System\fizKqbr.exe
  C:\Windows\System\fizKqbr.exe
  2⤵
  PID:7836
- C:\Windows\System\SIOsKBQ.exe
  C:\Windows\System\SIOsKBQ.exe
  2⤵
  PID:7852
- C:\Windows\System\RgQGcxV.exe
  C:\Windows\System\RgQGcxV.exe
  2⤵
  PID:7868
- C:\Windows\System\qfUrkeG.exe
  C:\Windows\System\qfUrkeG.exe
  2⤵
  PID:7896
- C:\Windows\System\nRlKnAG.exe
  C:\Windows\System\nRlKnAG.exe
  2⤵
  PID:7912
- C:\Windows\System\bQZPGCe.exe
  C:\Windows\System\bQZPGCe.exe
  2⤵
  PID:7928
- C:\Windows\System\OhGWOPk.exe
  C:\Windows\System\OhGWOPk.exe
  2⤵
  PID:7952
- C:\Windows\System\DFeljHZ.exe
  C:\Windows\System\DFeljHZ.exe
  2⤵
  PID:7968
- C:\Windows\System\XyFSFqI.exe
  C:\Windows\System\XyFSFqI.exe
  2⤵
  PID:7992
- C:\Windows\System\YVhhQNa.exe
  C:\Windows\System\YVhhQNa.exe
  2⤵
  PID:8008
- C:\Windows\System\gMgWFPt.exe
  C:\Windows\System\gMgWFPt.exe
  2⤵
  PID:8028
- C:\Windows\System\DmzPlcc.exe
  C:\Windows\System\DmzPlcc.exe
  2⤵
  PID:8056
- C:\Windows\System\dsoExub.exe
  C:\Windows\System\dsoExub.exe
  2⤵
  PID:6548
- C:\Windows\System\wlaAkKy.exe
  C:\Windows\System\wlaAkKy.exe
  2⤵
  PID:1524
- C:\Windows\System\QIaBTcM.exe
  C:\Windows\System\QIaBTcM.exe
  2⤵
  PID:7432
- C:\Windows\System\mplZbJM.exe
  C:\Windows\System\mplZbJM.exe
  2⤵
  PID:4732
- C:\Windows\System\PxwriOC.exe
  C:\Windows\System\PxwriOC.exe
  2⤵
  PID:2256
- C:\Windows\System\LMTJUEC.exe
  C:\Windows\System\LMTJUEC.exe
  2⤵
  PID:7608
- C:\Windows\System\ZptbBNo.exe
  C:\Windows\System\ZptbBNo.exe
  2⤵
  PID:6260
- C:\Windows\System\MJwTVDg.exe
  C:\Windows\System\MJwTVDg.exe
  2⤵
  PID:6304
- C:\Windows\System\hdZvHND.exe
  C:\Windows\System\hdZvHND.exe
  2⤵
  PID:6352
- C:\Windows\System\GZocoTq.exe
  C:\Windows\System\GZocoTq.exe
  2⤵
  PID:6388
- C:\Windows\System\phisxLj.exe
  C:\Windows\System\phisxLj.exe
  2⤵
  PID:6488
- C:\Windows\System\wOjuLrs.exe
  C:\Windows\System\wOjuLrs.exe
  2⤵
  PID:6556
- C:\Windows\System\TKTgHmR.exe
  C:\Windows\System\TKTgHmR.exe
  2⤵
  PID:6616
- C:\Windows\System\ZNADbKr.exe
  C:\Windows\System\ZNADbKr.exe
  2⤵
  PID:6660
- C:\Windows\System\SrHAMuF.exe
  C:\Windows\System\SrHAMuF.exe
  2⤵
  PID:6700
- C:\Windows\System\SuphYWr.exe
  C:\Windows\System\SuphYWr.exe
  2⤵
  PID:8048
- C:\Windows\System\vgQqGqS.exe
  C:\Windows\System\vgQqGqS.exe
  2⤵
  PID:8080
- C:\Windows\System\cPLpEsA.exe
  C:\Windows\System\cPLpEsA.exe
  2⤵
  PID:2312
- C:\Windows\System\IhVVlZL.exe
  C:\Windows\System\IhVVlZL.exe
  2⤵
  PID:2976
- C:\Windows\System\BxHGjoL.exe
  C:\Windows\System\BxHGjoL.exe
  2⤵
  PID:5788
- C:\Windows\System\TChYlhV.exe
  C:\Windows\System\TChYlhV.exe
  2⤵
  PID:1612
- C:\Windows\System\xoUpCrx.exe
  C:\Windows\System\xoUpCrx.exe
  2⤵
  PID:7336
- C:\Windows\System\HJWYBJI.exe
  C:\Windows\System\HJWYBJI.exe
  2⤵
  PID:8296
- C:\Windows\System\pwbMOkx.exe
  C:\Windows\System\pwbMOkx.exe
  2⤵
  PID:8312
- C:\Windows\System\tOaGhWz.exe
  C:\Windows\System\tOaGhWz.exe
  2⤵
  PID:8328
- C:\Windows\System\iIiiFjM.exe
  C:\Windows\System\iIiiFjM.exe
  2⤵
  PID:8348
- C:\Windows\System\LBZZsrE.exe
  C:\Windows\System\LBZZsrE.exe
  2⤵
  PID:8364
- C:\Windows\System\uhHSYOD.exe
  C:\Windows\System\uhHSYOD.exe
  2⤵
  PID:8396
- C:\Windows\System\qzqJJpF.exe
  C:\Windows\System\qzqJJpF.exe
  2⤵
  PID:8416
- C:\Windows\System\olweAZb.exe
  C:\Windows\System\olweAZb.exe
  2⤵
  PID:8432
- C:\Windows\System\iKOlkLp.exe
  C:\Windows\System\iKOlkLp.exe
  2⤵
  PID:8448
- C:\Windows\System\PfHBmSt.exe
  C:\Windows\System\PfHBmSt.exe
  2⤵
  PID:8464
- C:\Windows\System\adXDoMu.exe
  C:\Windows\System\adXDoMu.exe
  2⤵
  PID:8484
- C:\Windows\System\PfimVWp.exe
  C:\Windows\System\PfimVWp.exe
  2⤵
  PID:8504
- C:\Windows\System\xLCSUfc.exe
  C:\Windows\System\xLCSUfc.exe
  2⤵
  PID:8532
- C:\Windows\System\HFbEYKq.exe
  C:\Windows\System\HFbEYKq.exe
  2⤵
  PID:8548
- C:\Windows\System\VScksYc.exe
  C:\Windows\System\VScksYc.exe
  2⤵
  PID:8572
- C:\Windows\System\rtIJWmE.exe
  C:\Windows\System\rtIJWmE.exe
  2⤵
  PID:8588
- C:\Windows\System\zYizBRV.exe
  C:\Windows\System\zYizBRV.exe
  2⤵
  PID:8612
- C:\Windows\System\QyehihY.exe
  C:\Windows\System\QyehihY.exe
  2⤵
  PID:8628
- C:\Windows\System\JhEZXwu.exe
  C:\Windows\System\JhEZXwu.exe
  2⤵
  PID:8652
- C:\Windows\System\ZxJRwcr.exe
  C:\Windows\System\ZxJRwcr.exe
  2⤵
  PID:8676
- C:\Windows\System\uQrVwxr.exe
  C:\Windows\System\uQrVwxr.exe
  2⤵
  PID:8696
- C:\Windows\System\xXAbLHc.exe
  C:\Windows\System\xXAbLHc.exe
  2⤵
  PID:8720
- C:\Windows\System\tBqVIWm.exe
  C:\Windows\System\tBqVIWm.exe
  2⤵
  PID:8740
- C:\Windows\System\VacskVP.exe
  C:\Windows\System\VacskVP.exe
  2⤵
  PID:8760
- C:\Windows\System\xTSDurs.exe
  C:\Windows\System\xTSDurs.exe
  2⤵
  PID:8780
- C:\Windows\System\nGdgzmj.exe
  C:\Windows\System\nGdgzmj.exe
  2⤵
  PID:8800
- C:\Windows\System\EPUXtyo.exe
  C:\Windows\System\EPUXtyo.exe
  2⤵
  PID:8824
- C:\Windows\System\woPKRWS.exe
  C:\Windows\System\woPKRWS.exe
  2⤵
  PID:8840
- C:\Windows\System\CCzbnyb.exe
  C:\Windows\System\CCzbnyb.exe
  2⤵
  PID:8864
- C:\Windows\System\zwFXvrT.exe
  C:\Windows\System\zwFXvrT.exe
  2⤵
  PID:8888
- C:\Windows\System\KjPRYyO.exe
  C:\Windows\System\KjPRYyO.exe
  2⤵
  PID:8904
- C:\Windows\System\bOkJvRZ.exe
  C:\Windows\System\bOkJvRZ.exe
  2⤵
  PID:8924
- C:\Windows\System\yXgHuYr.exe
  C:\Windows\System\yXgHuYr.exe
  2⤵
  PID:8944
- C:\Windows\System\nEQuOAu.exe
  C:\Windows\System\nEQuOAu.exe
  2⤵
  PID:8972
- C:\Windows\System\KEQyCam.exe
  C:\Windows\System\KEQyCam.exe
  2⤵
  PID:8992
- C:\Windows\System\acjBetM.exe
  C:\Windows\System\acjBetM.exe
  2⤵
  PID:9012
- C:\Windows\System\dAJtMYp.exe
  C:\Windows\System\dAJtMYp.exe
  2⤵
  PID:9036
- C:\Windows\System\bXfqFyZ.exe
  C:\Windows\System\bXfqFyZ.exe
  2⤵
  PID:9052
- C:\Windows\System\VUdRzlu.exe
  C:\Windows\System\VUdRzlu.exe
  2⤵
  PID:9076
- C:\Windows\System\tgnfeNI.exe
  C:\Windows\System\tgnfeNI.exe
  2⤵
  PID:9096
- C:\Windows\System\UZXchaN.exe
  C:\Windows\System\UZXchaN.exe
  2⤵
  PID:9120
- C:\Windows\System\QuzLyUX.exe
  C:\Windows\System\QuzLyUX.exe
  2⤵
  PID:9148
- C:\Windows\System\kNvVVUq.exe
  C:\Windows\System\kNvVVUq.exe
  2⤵
  PID:9164
- C:\Windows\System\ccsIbTV.exe
  C:\Windows\System\ccsIbTV.exe
  2⤵
  PID:9184
- C:\Windows\System\IyLTbyS.exe
  C:\Windows\System\IyLTbyS.exe
  2⤵
  PID:7844
- C:\Windows\System\CFKPlHW.exe
  C:\Windows\System\CFKPlHW.exe
  2⤵
  PID:6880
- C:\Windows\System\xyKksbk.exe
  C:\Windows\System\xyKksbk.exe
  2⤵
  PID:8020
- C:\Windows\System\gmNbWOz.exe
  C:\Windows\System\gmNbWOz.exe
  2⤵
  PID:7020
- C:\Windows\System\URgUMTn.exe
  C:\Windows\System\URgUMTn.exe
  2⤵
  PID:640
- C:\Windows\System\PIYHFii.exe
  C:\Windows\System\PIYHFii.exe
  2⤵
  PID:5088
- C:\Windows\System\FQUlsZt.exe
  C:\Windows\System\FQUlsZt.exe
  2⤵
  PID:7136
- C:\Windows\System\PncTHba.exe
  C:\Windows\System\PncTHba.exe
  2⤵
  PID:7604
- C:\Windows\System\WpbdGIi.exe
  C:\Windows\System\WpbdGIi.exe
  2⤵
  PID:2324
- C:\Windows\System\aAybQaq.exe
  C:\Windows\System\aAybQaq.exe
  2⤵
  PID:4696
- C:\Windows\System\jKFbnKA.exe
  C:\Windows\System\jKFbnKA.exe
  2⤵
  PID:6368
- C:\Windows\System\XszDfYO.exe
  C:\Windows\System\XszDfYO.exe
  2⤵
  PID:6180
- C:\Windows\System\TmDLreD.exe
  C:\Windows\System\TmDLreD.exe
  2⤵
  PID:7848
- C:\Windows\System\QTdVHVy.exe
  C:\Windows\System\QTdVHVy.exe
  2⤵
  PID:7236
- C:\Windows\System\TYXYQGN.exe
  C:\Windows\System\TYXYQGN.exe
  2⤵
  PID:4112
- C:\Windows\System\fxrWarb.exe
  C:\Windows\System\fxrWarb.exe
  2⤵
  PID:7288
- C:\Windows\System\QFNOxIv.exe
  C:\Windows\System\QFNOxIv.exe
  2⤵
  PID:3800
- C:\Windows\System\yJxOgAz.exe
  C:\Windows\System\yJxOgAz.exe
  2⤵
  PID:3328
- C:\Windows\System\OhzVImj.exe
  C:\Windows\System\OhzVImj.exe
  2⤵
  PID:7460
- C:\Windows\System\cqAhUkM.exe
  C:\Windows\System\cqAhUkM.exe
  2⤵
  PID:1864
- C:\Windows\System\ZZgmntN.exe
  C:\Windows\System\ZZgmntN.exe
  2⤵
  PID:7540
- C:\Windows\System\InXiLaG.exe
  C:\Windows\System\InXiLaG.exe
  2⤵
  PID:7576
- C:\Windows\System\IPsQOqY.exe
  C:\Windows\System\IPsQOqY.exe
  2⤵
  PID:7672
- C:\Windows\System\mOFrhGg.exe
  C:\Windows\System\mOFrhGg.exe
  2⤵
  PID:7984
- C:\Windows\System\EMNTOQY.exe
  C:\Windows\System\EMNTOQY.exe
  2⤵
  PID:7936
- C:\Windows\System\MeKbhyR.exe
  C:\Windows\System\MeKbhyR.exe
  2⤵
  PID:4912
- C:\Windows\System\CwruVDk.exe
  C:\Windows\System\CwruVDk.exe
  2⤵
  PID:7812
- C:\Windows\System\upmdkHa.exe
  C:\Windows\System\upmdkHa.exe
  2⤵
  PID:1068
- C:\Windows\System\HxFmztu.exe
  C:\Windows\System\HxFmztu.exe
  2⤵
  PID:7752
- C:\Windows\System\fvRmhTv.exe
  C:\Windows\System\fvRmhTv.exe
  2⤵
  PID:7704
- C:\Windows\System\QBTBkab.exe
  C:\Windows\System\QBTBkab.exe
  2⤵
  PID:8624
- C:\Windows\System\vrKrMFc.exe
  C:\Windows\System\vrKrMFc.exe
  2⤵
  PID:6560
- C:\Windows\System\myqWidm.exe
  C:\Windows\System\myqWidm.exe
  2⤵
  PID:8836
- C:\Windows\System\ULfMQeE.exe
  C:\Windows\System\ULfMQeE.exe
  2⤵
  PID:2136
- C:\Windows\System\DgZqTLV.exe
  C:\Windows\System\DgZqTLV.exe
  2⤵
  PID:8876
- C:\Windows\System\DuoTIZH.exe
  C:\Windows\System\DuoTIZH.exe
  2⤵
  PID:8912
- C:\Windows\System\CVwJVhm.exe
  C:\Windows\System\CVwJVhm.exe
  2⤵
  PID:9228
- C:\Windows\System\MkjUWfv.exe
  C:\Windows\System\MkjUWfv.exe
  2⤵
  PID:9244
- C:\Windows\System\SyzpOLf.exe
  C:\Windows\System\SyzpOLf.exe
  2⤵
  PID:9264
- C:\Windows\System\fGhKVXU.exe
  C:\Windows\System\fGhKVXU.exe
  2⤵
  PID:9292
- C:\Windows\System\mYlqpnF.exe
  C:\Windows\System\mYlqpnF.exe
  2⤵
  PID:9308
- C:\Windows\System\ZdEMfjJ.exe
  C:\Windows\System\ZdEMfjJ.exe
  2⤵
  PID:9328
- C:\Windows\System\zMMwnxX.exe
  C:\Windows\System\zMMwnxX.exe
  2⤵
  PID:9344
- C:\Windows\System\IaHBVyD.exe
  C:\Windows\System\IaHBVyD.exe
  2⤵
  PID:9364
- C:\Windows\System\MlbUjrb.exe
  C:\Windows\System\MlbUjrb.exe
  2⤵
  PID:9388
- C:\Windows\System\oQUJrTi.exe
  C:\Windows\System\oQUJrTi.exe
  2⤵
  PID:9408
- C:\Windows\System\CKQiKCS.exe
  C:\Windows\System\CKQiKCS.exe
  2⤵
  PID:9424
- C:\Windows\System\LTdxvqj.exe
  C:\Windows\System\LTdxvqj.exe
  2⤵
  PID:9464
- C:\Windows\System\qbyHNMk.exe
  C:\Windows\System\qbyHNMk.exe
  2⤵
  PID:9484
- C:\Windows\System\VhSlder.exe
  C:\Windows\System\VhSlder.exe
  2⤵
  PID:9512
- C:\Windows\System\Jubjlxs.exe
  C:\Windows\System\Jubjlxs.exe
  2⤵
  PID:9532
- C:\Windows\System\hUGlUnC.exe
  C:\Windows\System\hUGlUnC.exe
  2⤵
  PID:9552
- C:\Windows\System\PjIzhVn.exe
  C:\Windows\System\PjIzhVn.exe
  2⤵
  PID:9572
- C:\Windows\System\gikDWht.exe
  C:\Windows\System\gikDWht.exe
  2⤵
  PID:9600
- C:\Windows\System\CLtZJFP.exe
  C:\Windows\System\CLtZJFP.exe
  2⤵
  PID:9620
- C:\Windows\System\AmiVkHl.exe
  C:\Windows\System\AmiVkHl.exe
  2⤵
  PID:9636
- C:\Windows\System\VfuHKHg.exe
  C:\Windows\System\VfuHKHg.exe
  2⤵
  PID:9656
- C:\Windows\System\UQDImjl.exe
  C:\Windows\System\UQDImjl.exe
  2⤵
  PID:9688
- C:\Windows\System\afiqGvm.exe
  C:\Windows\System\afiqGvm.exe
  2⤵
  PID:9704
- C:\Windows\System\DxwNjyk.exe
  C:\Windows\System\DxwNjyk.exe
  2⤵
  PID:9724
- C:\Windows\System\DDvAnxL.exe
  C:\Windows\System\DDvAnxL.exe
  2⤵
  PID:9748
- C:\Windows\System\EGUyyHN.exe
  C:\Windows\System\EGUyyHN.exe
  2⤵
  PID:9776
- C:\Windows\System\yNBrZzx.exe
  C:\Windows\System\yNBrZzx.exe
  2⤵
  PID:9796
- C:\Windows\System\cceujjU.exe
  C:\Windows\System\cceujjU.exe
  2⤵
  PID:9812
- C:\Windows\System\zHqpXio.exe
  C:\Windows\System\zHqpXio.exe
  2⤵
  PID:9836
- C:\Windows\System\EFGcTpl.exe
  C:\Windows\System\EFGcTpl.exe
  2⤵
  PID:9856
- C:\Windows\System\zQNAMok.exe
  C:\Windows\System\zQNAMok.exe
  2⤵
  PID:9876
- C:\Windows\System\LmKAklF.exe
  C:\Windows\System\LmKAklF.exe
  2⤵
  PID:9896
- C:\Windows\System\dLQbZAk.exe
  C:\Windows\System\dLQbZAk.exe
  2⤵
  PID:9916
- C:\Windows\System\qAtcvIy.exe
  C:\Windows\System\qAtcvIy.exe
  2⤵
  PID:9936
- C:\Windows\System\zbaWVSy.exe
  C:\Windows\System\zbaWVSy.exe
  2⤵
  PID:9956
- C:\Windows\System\fDkrQlt.exe
  C:\Windows\System\fDkrQlt.exe
  2⤵
  PID:9976
- C:\Windows\System\VdWDDij.exe
  C:\Windows\System\VdWDDij.exe
  2⤵
  PID:9992
- C:\Windows\System\SCHHcCw.exe
  C:\Windows\System\SCHHcCw.exe
  2⤵
  PID:10016
- C:\Windows\System\HPHsIYi.exe
  C:\Windows\System\HPHsIYi.exe
  2⤵
  PID:10040
- C:\Windows\System\jxovWXH.exe
  C:\Windows\System\jxovWXH.exe
  2⤵
  PID:10056
- C:\Windows\System\sbsDntb.exe
  C:\Windows\System\sbsDntb.exe
  2⤵
  PID:10080
- C:\Windows\System\BFeXkAB.exe
  C:\Windows\System\BFeXkAB.exe
  2⤵
  PID:10104
- C:\Windows\System\FucbxzN.exe
  C:\Windows\System\FucbxzN.exe
  2⤵
  PID:10128
- C:\Windows\System\mgbGdUw.exe
  C:\Windows\System\mgbGdUw.exe
  2⤵
  PID:10144
- C:\Windows\System\OvikRdZ.exe
  C:\Windows\System\OvikRdZ.exe
  2⤵
  PID:10160
- C:\Windows\System\RxxJEZT.exe
  C:\Windows\System\RxxJEZT.exe
  2⤵
  PID:10176
- C:\Windows\System\wYaglPM.exe
  C:\Windows\System\wYaglPM.exe
  2⤵
  PID:10192
- C:\Windows\System\JUKmsmH.exe
  C:\Windows\System\JUKmsmH.exe
  2⤵
  PID:10212
- C:\Windows\System\hSSWgcJ.exe
  C:\Windows\System\hSSWgcJ.exe
  2⤵
  PID:7056
- C:\Windows\System\jgjedXO.exe
  C:\Windows\System\jgjedXO.exe
  2⤵
  PID:9004
- C:\Windows\System\SroJisl.exe
  C:\Windows\System\SroJisl.exe
  2⤵
  PID:7208
- C:\Windows\System\zWASGjq.exe
  C:\Windows\System\zWASGjq.exe
  2⤵
  PID:4372
- C:\Windows\System\rGQeXDx.exe
  C:\Windows\System\rGQeXDx.exe
  2⤵
  PID:4244
- C:\Windows\System\QfHNGYA.exe
  C:\Windows\System\QfHNGYA.exe
  2⤵
  PID:4736
- C:\Windows\System\pVECzcm.exe
  C:\Windows\System\pVECzcm.exe
  2⤵
  PID:6208
- C:\Windows\System\ZAKpjfl.exe
  C:\Windows\System\ZAKpjfl.exe
  2⤵
  PID:6240
- C:\Windows\System\QWZNYrS.exe
  C:\Windows\System\QWZNYrS.exe
  2⤵
  PID:6340
- C:\Windows\System\qEMOdIh.exe
  C:\Windows\System\qEMOdIh.exe
  2⤵
  PID:2900
- C:\Windows\System\QETnkGJ.exe
  C:\Windows\System\QETnkGJ.exe
  2⤵
  PID:5680
- C:\Windows\System\TgDidCy.exe
  C:\Windows\System\TgDidCy.exe
  2⤵
  PID:5236
- C:\Windows\System\REEaMvw.exe
  C:\Windows\System\REEaMvw.exe
  2⤵
  PID:6900
- C:\Windows\System\qcOHgwD.exe
  C:\Windows\System\qcOHgwD.exe
  2⤵
  PID:6980
- C:\Windows\System\oDGSfdJ.exe
  C:\Windows\System\oDGSfdJ.exe
  2⤵
  PID:6128
- C:\Windows\System\QiyIysj.exe
  C:\Windows\System\QiyIysj.exe
  2⤵
  PID:7364
- C:\Windows\System\TvyJHYP.exe
  C:\Windows\System\TvyJHYP.exe
  2⤵
  PID:8776
- C:\Windows\System\xfMArRx.exe
  C:\Windows\System\xfMArRx.exe
  2⤵
  PID:7904
- C:\Windows\System\hGsFdPB.exe
  C:\Windows\System\hGsFdPB.exe
  2⤵
  PID:10252
- C:\Windows\System\RQNKlxM.exe
  C:\Windows\System\RQNKlxM.exe
  2⤵
  PID:10268
- C:\Windows\System\vzCAxBI.exe
  C:\Windows\System\vzCAxBI.exe
  2⤵
  PID:10296
- C:\Windows\System\cDTtfDW.exe
  C:\Windows\System\cDTtfDW.exe
  2⤵
  PID:10316
- C:\Windows\System\MQeEzzy.exe
  C:\Windows\System\MQeEzzy.exe
  2⤵
  PID:10336
- C:\Windows\System\QhvzqUM.exe
  C:\Windows\System\QhvzqUM.exe
  2⤵
  PID:10356
- C:\Windows\System\XIQsuZx.exe
  C:\Windows\System\XIQsuZx.exe
  2⤵
  PID:10376
- C:\Windows\System\lSLYdkU.exe
  C:\Windows\System\lSLYdkU.exe
  2⤵
  PID:10396
- C:\Windows\System\DYfJHPs.exe
  C:\Windows\System\DYfJHPs.exe
  2⤵
  PID:10420
- C:\Windows\System\CvoWclU.exe
  C:\Windows\System\CvoWclU.exe
  2⤵
  PID:10444
- C:\Windows\System\NLLfauN.exe
  C:\Windows\System\NLLfauN.exe
  2⤵
  PID:10464
- C:\Windows\System\RmhWHRT.exe
  C:\Windows\System\RmhWHRT.exe
  2⤵
  PID:10480
- C:\Windows\System\MWIbCzE.exe
  C:\Windows\System\MWIbCzE.exe
  2⤵
  PID:10504
- C:\Windows\System\xZOqcek.exe
  C:\Windows\System\xZOqcek.exe
  2⤵
  PID:10524
- C:\Windows\System\ghMYuOS.exe
  C:\Windows\System\ghMYuOS.exe
  2⤵
  PID:10544
- C:\Windows\System\EtImLOa.exe
  C:\Windows\System\EtImLOa.exe
  2⤵
  PID:10564
- C:\Windows\System\YVVVDxA.exe
  C:\Windows\System\YVVVDxA.exe
  2⤵
  PID:10580
- C:\Windows\System\SkRvUQM.exe
  C:\Windows\System\SkRvUQM.exe
  2⤵
  PID:10596
- C:\Windows\System\fVvmTeH.exe
  C:\Windows\System\fVvmTeH.exe
  2⤵
  PID:10612
- C:\Windows\System\rMZOvFG.exe
  C:\Windows\System\rMZOvFG.exe
  2⤵
  PID:10628
- C:\Windows\System\LvEVLUJ.exe
  C:\Windows\System\LvEVLUJ.exe
  2⤵
  PID:10648
- C:\Windows\System\veobkNn.exe
  C:\Windows\System\veobkNn.exe
  2⤵
  PID:10672
- C:\Windows\System\iSIaiCR.exe
  C:\Windows\System\iSIaiCR.exe
  2⤵
  PID:10688
- C:\Windows\System\vUFimha.exe
  C:\Windows\System\vUFimha.exe
  2⤵
  PID:10712
- C:\Windows\System\gURhpEV.exe
  C:\Windows\System\gURhpEV.exe
  2⤵
  PID:10732
- C:\Windows\System\YNZORCJ.exe
  C:\Windows\System\YNZORCJ.exe
  2⤵
  PID:10752
- C:\Windows\System\DHIvTPL.exe
  C:\Windows\System\DHIvTPL.exe
  2⤵
  PID:10768
- C:\Windows\System\TkUaplQ.exe
  C:\Windows\System\TkUaplQ.exe
  2⤵
  PID:10792
- C:\Windows\System\MvIRlTn.exe
  C:\Windows\System\MvIRlTn.exe
  2⤵
  PID:10816
- C:\Windows\System\zWuyNlH.exe
  C:\Windows\System\zWuyNlH.exe
  2⤵
  PID:10840
- C:\Windows\System\zqdsHhM.exe
  C:\Windows\System\zqdsHhM.exe
  2⤵
  PID:10860
- C:\Windows\System\AizALGl.exe
  C:\Windows\System\AizALGl.exe
  2⤵
  PID:10880
- C:\Windows\System\OUvwtVN.exe
  C:\Windows\System\OUvwtVN.exe
  2⤵
  PID:10900
- C:\Windows\System\zsUmane.exe
  C:\Windows\System\zsUmane.exe
  2⤵
  PID:10924
- C:\Windows\System\NfwNXMs.exe
  C:\Windows\System\NfwNXMs.exe
  2⤵
  PID:10948
- C:\Windows\System\TfbYMTA.exe
  C:\Windows\System\TfbYMTA.exe
  2⤵
  PID:10972
- C:\Windows\System\qemrEKD.exe
  C:\Windows\System\qemrEKD.exe
  2⤵
  PID:10996
- C:\Windows\System\YuIDxUM.exe
  C:\Windows\System\YuIDxUM.exe
  2⤵
  PID:11016
- C:\Windows\System\VYOGVHu.exe
  C:\Windows\System\VYOGVHu.exe
  2⤵
  PID:11032
- C:\Windows\System\xgLXaCC.exe
  C:\Windows\System\xgLXaCC.exe
  2⤵
  PID:11052
- C:\Windows\System\AoVyFYV.exe
  C:\Windows\System\AoVyFYV.exe
  2⤵
  PID:11080
- C:\Windows\System\hZkErpc.exe
  C:\Windows\System\hZkErpc.exe
  2⤵
  PID:11100
- C:\Windows\System\dlPiIaC.exe
  C:\Windows\System\dlPiIaC.exe
  2⤵
  PID:11124
- C:\Windows\System\qjEVLnT.exe
  C:\Windows\System\qjEVLnT.exe
  2⤵
  PID:11140
- C:\Windows\System\bJypQuc.exe
  C:\Windows\System\bJypQuc.exe
  2⤵
  PID:11160
- C:\Windows\System\UkAGZKQ.exe
  C:\Windows\System\UkAGZKQ.exe
  2⤵
  PID:11180
- C:\Windows\System\GUJhlnH.exe
  C:\Windows\System\GUJhlnH.exe
  2⤵
  PID:11200
- C:\Windows\System\FWIgdOF.exe
  C:\Windows\System\FWIgdOF.exe
  2⤵
  PID:11216
- C:\Windows\System\gnMnTia.exe
  C:\Windows\System\gnMnTia.exe
  2⤵
  PID:11240
- C:\Windows\System\SLrrckT.exe
  C:\Windows\System\SLrrckT.exe
  2⤵
  PID:11260
- C:\Windows\System\crixAoO.exe
  C:\Windows\System\crixAoO.exe
  2⤵
  PID:8684
- C:\Windows\System\tzKvzOw.exe
  C:\Windows\System\tzKvzOw.exe
  2⤵
  PID:6472
- C:\Windows\System\UkaIrFa.exe
  C:\Windows\System\UkaIrFa.exe
  2⤵
  PID:8900
- C:\Windows\System\ZPdJZUd.exe
  C:\Windows\System\ZPdJZUd.exe
  2⤵
  PID:6628
- C:\Windows\System\pwKmSQM.exe
  C:\Windows\System\pwKmSQM.exe
  2⤵
  PID:9356
- C:\Windows\System\aaQfGHk.exe
  C:\Windows\System\aaQfGHk.exe
  2⤵
  PID:9420
- C:\Windows\System\yjZJwff.exe
  C:\Windows\System\yjZJwff.exe
  2⤵
  PID:9480
- C:\Windows\System\HaIzLPO.exe
  C:\Windows\System\HaIzLPO.exe
  2⤵
  PID:9092
- C:\Windows\System\OmamxXP.exe
  C:\Windows\System\OmamxXP.exe
  2⤵
  PID:9580
- C:\Windows\System\ikkHIej.exe
  C:\Windows\System\ikkHIej.exe
  2⤵
  PID:7352
- C:\Windows\System\BmrtJif.exe
  C:\Windows\System\BmrtJif.exe
  2⤵
  PID:9196
- C:\Windows\System\wdPizxE.exe
  C:\Windows\System\wdPizxE.exe
  2⤵
  PID:9804
- C:\Windows\System\xLpfiSq.exe
  C:\Windows\System\xLpfiSq.exe
  2⤵
  PID:9832
- C:\Windows\System\djeTdKF.exe
  C:\Windows\System\djeTdKF.exe
  2⤵
  PID:7408
- C:\Windows\System\dpcwLwk.exe
  C:\Windows\System\dpcwLwk.exe
  2⤵
  PID:4228
- C:\Windows\System\zLWUaia.exe
  C:\Windows\System\zLWUaia.exe
  2⤵
  PID:2196
- C:\Windows\System\eJVmRkD.exe
  C:\Windows\System\eJVmRkD.exe
  2⤵
  PID:10220
- C:\Windows\System\ofkOnFH.exe
  C:\Windows\System\ofkOnFH.exe
  2⤵
  PID:8308
- C:\Windows\System\dVJWSAU.exe
  C:\Windows\System\dVJWSAU.exe
  2⤵
  PID:8344
- C:\Windows\System\PcflGfR.exe
  C:\Windows\System\PcflGfR.exe
  2⤵
  PID:8388
- C:\Windows\System\GbGtLjJ.exe
  C:\Windows\System\GbGtLjJ.exe
  2⤵
  PID:8444
- C:\Windows\System\tGzlgfU.exe
  C:\Windows\System\tGzlgfU.exe
  2⤵
  PID:8492
- C:\Windows\System\JClEzyq.exe
  C:\Windows\System\JClEzyq.exe
  2⤵
  PID:8524
- C:\Windows\System\wkPkWIH.exe
  C:\Windows\System\wkPkWIH.exe
  2⤵
  PID:8580
- C:\Windows\System\xOHzzek.exe
  C:\Windows\System\xOHzzek.exe
  2⤵
  PID:8620
- C:\Windows\System\rTbcMWI.exe
  C:\Windows\System\rTbcMWI.exe
  2⤵
  PID:11272
- C:\Windows\System\mwWhOYH.exe
  C:\Windows\System\mwWhOYH.exe
  2⤵
  PID:11296
- C:\Windows\System\WtAfFiH.exe
  C:\Windows\System\WtAfFiH.exe
  2⤵
  PID:11320
- C:\Windows\System\UUiclGQ.exe
  C:\Windows\System\UUiclGQ.exe
  2⤵
  PID:11336
- C:\Windows\System\YudHWpW.exe
  C:\Windows\System\YudHWpW.exe
  2⤵
  PID:11356
- C:\Windows\System\TaAdlWi.exe
  C:\Windows\System\TaAdlWi.exe
  2⤵
  PID:11376
- C:\Windows\System\ojefeUT.exe
  C:\Windows\System\ojefeUT.exe
  2⤵
  PID:11404
- C:\Windows\System\ihiFEvK.exe
  C:\Windows\System\ihiFEvK.exe
  2⤵
  PID:11428
- C:\Windows\System\nHOkbPA.exe
  C:\Windows\System\nHOkbPA.exe
  2⤵
  PID:11448
- C:\Windows\System\sIyiykq.exe
  C:\Windows\System\sIyiykq.exe
  2⤵
  PID:11476
- C:\Windows\System\cCqRYYQ.exe
  C:\Windows\System\cCqRYYQ.exe
  2⤵
  PID:11492
- C:\Windows\System\NmVGPTd.exe
  C:\Windows\System\NmVGPTd.exe
  2⤵
  PID:11512
- C:\Windows\System\avflJuQ.exe
  C:\Windows\System\avflJuQ.exe
  2⤵
  PID:11532
- C:\Windows\System\BGYPkpe.exe
  C:\Windows\System\BGYPkpe.exe
  2⤵
  PID:11564
- C:\Windows\System\MMEZQdt.exe
  C:\Windows\System\MMEZQdt.exe
  2⤵
  PID:11588
- C:\Windows\System\AChNeVS.exe
  C:\Windows\System\AChNeVS.exe
  2⤵
  PID:11604
- C:\Windows\System\kSpbCus.exe
  C:\Windows\System\kSpbCus.exe
  2⤵
  PID:11628
- C:\Windows\System\hcQhgul.exe
  C:\Windows\System\hcQhgul.exe
  2⤵
  PID:11648
- C:\Windows\System\NdkkqTN.exe
  C:\Windows\System\NdkkqTN.exe
  2⤵
  PID:11668
- C:\Windows\System\UqXbzJO.exe
  C:\Windows\System\UqXbzJO.exe
  2⤵
  PID:11684
- C:\Windows\System\qRxWdCO.exe
  C:\Windows\System\qRxWdCO.exe
  2⤵
  PID:11700
- C:\Windows\System\vhemREg.exe
  C:\Windows\System\vhemREg.exe
  2⤵
  PID:11716
- C:\Windows\System\GlNDucq.exe
  C:\Windows\System\GlNDucq.exe
  2⤵
  PID:11732
- C:\Windows\System\zBZTXcl.exe
  C:\Windows\System\zBZTXcl.exe
  2⤵
  PID:11752
- C:\Windows\System\OPxpnxg.exe
  C:\Windows\System\OPxpnxg.exe
  2⤵
  PID:11776
- C:\Windows\System\BxhxtKm.exe
  C:\Windows\System\BxhxtKm.exe
  2⤵
  PID:11800
- C:\Windows\System\juLjbVF.exe
  C:\Windows\System\juLjbVF.exe
  2⤵
  PID:11816
- C:\Windows\System\RSIPYVv.exe
  C:\Windows\System\RSIPYVv.exe
  2⤵
  PID:11844
- C:\Windows\System\xwpRyTu.exe
  C:\Windows\System\xwpRyTu.exe
  2⤵
  PID:11868
- C:\Windows\System\ttjVBfu.exe
  C:\Windows\System\ttjVBfu.exe
  2⤵
  PID:11888
- C:\Windows\System\nbRgJFe.exe
  C:\Windows\System\nbRgJFe.exe
  2⤵
  PID:11916
- C:\Windows\System\CKmgTMx.exe
  C:\Windows\System\CKmgTMx.exe
  2⤵
  PID:11936
- C:\Windows\System\IFyRqaR.exe
  C:\Windows\System\IFyRqaR.exe
  2⤵
  PID:11960
- C:\Windows\System\Jnekksy.exe
  C:\Windows\System\Jnekksy.exe
  2⤵
  PID:11980
- C:\Windows\System\QDTDBmt.exe
  C:\Windows\System\QDTDBmt.exe
  2⤵
  PID:12004
- C:\Windows\System\uAdOxoA.exe
  C:\Windows\System\uAdOxoA.exe
  2⤵
  PID:12024
- C:\Windows\System\jVRIHGu.exe
  C:\Windows\System\jVRIHGu.exe
  2⤵
  PID:12040
- C:\Windows\System\BhCJDWA.exe
  C:\Windows\System\BhCJDWA.exe
  2⤵
  PID:12060
- C:\Windows\System\yFMzIPj.exe
  C:\Windows\System\yFMzIPj.exe
  2⤵
  PID:12084
- C:\Windows\System\SkCjxRL.exe
  C:\Windows\System\SkCjxRL.exe
  2⤵
  PID:12104
- C:\Windows\System\ZFoRAJQ.exe
  C:\Windows\System\ZFoRAJQ.exe
  2⤵
  PID:12128
- C:\Windows\System\bbQwwUN.exe
  C:\Windows\System\bbQwwUN.exe
  2⤵
  PID:12148
- C:\Windows\System\IZzRrGi.exe
  C:\Windows\System\IZzRrGi.exe
  2⤵
  PID:12172
- C:\Windows\System\ligtGcx.exe
  C:\Windows\System\ligtGcx.exe
  2⤵
  PID:12192
- C:\Windows\System\JWMrSmm.exe
  C:\Windows\System\JWMrSmm.exe
  2⤵
  PID:12216
- C:\Windows\System\lhtjrdG.exe
  C:\Windows\System\lhtjrdG.exe
  2⤵
  PID:12236
- C:\Windows\System\esJKwHx.exe
  C:\Windows\System\esJKwHx.exe
  2⤵
  PID:12260
- C:\Windows\System\UyhmGPv.exe
  C:\Windows\System\UyhmGPv.exe
  2⤵
  PID:12276
- C:\Windows\System\gAMHfFb.exe
  C:\Windows\System\gAMHfFb.exe
  2⤵
  PID:8704
- C:\Windows\System\SISNxyw.exe
  C:\Windows\System\SISNxyw.exe
  2⤵
  PID:9116
- C:\Windows\System\QEiMIHV.exe
  C:\Windows\System\QEiMIHV.exe
  2⤵
  PID:4504
- C:\Windows\System\SXBPagk.exe
  C:\Windows\System\SXBPagk.exe
  2⤵
  PID:7600
- C:\Windows\System\FEQIJCI.exe
  C:\Windows\System\FEQIJCI.exe
  2⤵
  PID:7512
- C:\Windows\System\yIbspqv.exe
  C:\Windows\System\yIbspqv.exe
  2⤵
  PID:7908
- C:\Windows\System\FvHMtLU.exe
  C:\Windows\System\FvHMtLU.exe
  2⤵
  PID:10284
- C:\Windows\System\LeDkhVH.exe
  C:\Windows\System\LeDkhVH.exe
  2⤵
  PID:10384
- C:\Windows\System\BnoDqEt.exe
  C:\Windows\System\BnoDqEt.exe
  2⤵
  PID:1872
- C:\Windows\System\xDRnhtV.exe
  C:\Windows\System\xDRnhtV.exe
  2⤵
  PID:6448
- C:\Windows\System\WldbeHf.exe
  C:\Windows\System\WldbeHf.exe
  2⤵
  PID:9260
- C:\Windows\System\gcwBBMU.exe
  C:\Windows\System\gcwBBMU.exe
  2⤵
  PID:9324
- C:\Windows\System\FebcIKH.exe
  C:\Windows\System\FebcIKH.exe
  2⤵
  PID:10760
- C:\Windows\System\hSBnLRh.exe
  C:\Windows\System\hSBnLRh.exe
  2⤵
  PID:9032
- C:\Windows\System\WmPRJOx.exe
  C:\Windows\System\WmPRJOx.exe
  2⤵
  PID:12292
- C:\Windows\System\fMVrwPq.exe
  C:\Windows\System\fMVrwPq.exe
  2⤵
  PID:12316
- C:\Windows\System\Kmkixza.exe
  C:\Windows\System\Kmkixza.exe
  2⤵
  PID:12336
- C:\Windows\System\HSdJrgt.exe
  C:\Windows\System\HSdJrgt.exe
  2⤵
  PID:12356
- C:\Windows\System\yctEkHy.exe
  C:\Windows\System\yctEkHy.exe
  2⤵
  PID:12376
- C:\Windows\System\gYTalBE.exe
  C:\Windows\System\gYTalBE.exe
  2⤵
  PID:12396
- C:\Windows\System\gHLWHoZ.exe
  C:\Windows\System\gHLWHoZ.exe
  2⤵
  PID:12416
- C:\Windows\System\UuVxrNx.exe
  C:\Windows\System\UuVxrNx.exe
  2⤵
  PID:12436
- C:\Windows\System\ZMSaxrf.exe
  C:\Windows\System\ZMSaxrf.exe
  2⤵
  PID:12456
- C:\Windows\System\LZXQUBS.exe
  C:\Windows\System\LZXQUBS.exe
  2⤵
  PID:12480
- C:\Windows\System\JKxWQoG.exe
  C:\Windows\System\JKxWQoG.exe
  2⤵
  PID:12496
- C:\Windows\System\ZCxtGjD.exe
  C:\Windows\System\ZCxtGjD.exe
  2⤵
  PID:12532
- C:\Windows\System\fqHPsRh.exe
  C:\Windows\System\fqHPsRh.exe
  2⤵
  PID:12552
- C:\Windows\System\TjTQOWH.exe
  C:\Windows\System\TjTQOWH.exe
  2⤵
  PID:12572
- C:\Windows\System\NTqCJvi.exe
  C:\Windows\System\NTqCJvi.exe
  2⤵
  PID:12592
- C:\Windows\System\LrWpDEj.exe
  C:\Windows\System\LrWpDEj.exe
  2⤵
  PID:12616
- C:\Windows\System\rHgdVOr.exe
  C:\Windows\System\rHgdVOr.exe
  2⤵
  PID:12632
- C:\Windows\System\bowTJwm.exe
  C:\Windows\System\bowTJwm.exe
  2⤵
  PID:12656
- C:\Windows\System\XvNpXYp.exe
  C:\Windows\System\XvNpXYp.exe
  2⤵
  PID:12680
- C:\Windows\System\ayBKRUB.exe
  C:\Windows\System\ayBKRUB.exe
  2⤵
  PID:12696
- C:\Windows\System\pzVCDxZ.exe
  C:\Windows\System\pzVCDxZ.exe
  2⤵
  PID:12720
- C:\Windows\System\lvFUEzz.exe
  C:\Windows\System\lvFUEzz.exe
  2⤵
  PID:12740
- C:\Windows\System\IVIFQxj.exe
  C:\Windows\System\IVIFQxj.exe
  2⤵
  PID:12756
- C:\Windows\System\yRMUZpD.exe
  C:\Windows\System\yRMUZpD.exe
  2⤵
  PID:12772
- C:\Windows\System\GsbWXUk.exe
  C:\Windows\System\GsbWXUk.exe
  2⤵
  PID:12788
- C:\Windows\System\GyApflA.exe
  C:\Windows\System\GyApflA.exe
  2⤵
  PID:12808
- C:\Windows\System\yOHuGwE.exe
  C:\Windows\System\yOHuGwE.exe
  2⤵
  PID:12836
- C:\Windows\System\XJtNPqU.exe
  C:\Windows\System\XJtNPqU.exe
  2⤵
  PID:12856
- C:\Windows\System\MpZDlwD.exe
  C:\Windows\System\MpZDlwD.exe
  2⤵
  PID:12872
- C:\Windows\System\FOrlBhb.exe
  C:\Windows\System\FOrlBhb.exe
  2⤵
  PID:12896
- C:\Windows\System\BBkNXXY.exe
  C:\Windows\System\BBkNXXY.exe
  2⤵
  PID:12920
- C:\Windows\System\UtxsVrz.exe
  C:\Windows\System\UtxsVrz.exe
  2⤵
  PID:12940
- C:\Windows\System\NdfGGFP.exe
  C:\Windows\System\NdfGGFP.exe
  2⤵
  PID:12956
- C:\Windows\System\geYLicA.exe
  C:\Windows\System\geYLicA.exe
  2⤵
  PID:12972
- C:\Windows\System\wWKMdCL.exe
  C:\Windows\System\wWKMdCL.exe
  2⤵
  PID:12988
- C:\Windows\System\GSvNeKf.exe
  C:\Windows\System\GSvNeKf.exe
  2⤵
  PID:13004
- C:\Windows\System\yOyQcQS.exe
  C:\Windows\System\yOyQcQS.exe
  2⤵
  PID:13020
- C:\Windows\System\WklRWpk.exe
  C:\Windows\System\WklRWpk.exe
  2⤵
  PID:13040
- C:\Windows\System\sVrevgu.exe
  C:\Windows\System\sVrevgu.exe
  2⤵
  PID:13060
- C:\Windows\System\TDOXCzD.exe
  C:\Windows\System\TDOXCzD.exe
  2⤵
  PID:13080
- C:\Windows\System\VMlMeat.exe
  C:\Windows\System\VMlMeat.exe
  2⤵
  PID:13104
- C:\Windows\System\KXhmWLW.exe
  C:\Windows\System\KXhmWLW.exe
  2⤵
  PID:13120
- C:\Windows\System\ODVjDas.exe
  C:\Windows\System\ODVjDas.exe
  2⤵
  PID:13144
- C:\Windows\System\NkTGrzL.exe
  C:\Windows\System\NkTGrzL.exe
  2⤵
  PID:13168
- C:\Windows\System\gKPCJBz.exe
  C:\Windows\System\gKPCJBz.exe
  2⤵
  PID:13188
- C:\Windows\System\deCnrkF.exe
  C:\Windows\System\deCnrkF.exe
  2⤵
  PID:13212
- C:\Windows\System\EiRlbQH.exe
  C:\Windows\System\EiRlbQH.exe
  2⤵
  PID:13240
- C:\Windows\System\qtMSJVW.exe
  C:\Windows\System\qtMSJVW.exe
  2⤵
  PID:13256
- C:\Windows\System\ZFsoyGH.exe
  C:\Windows\System\ZFsoyGH.exe
  2⤵
  PID:13280
- C:\Windows\System\MOAHeln.exe
  C:\Windows\System\MOAHeln.exe
  2⤵
  PID:13300
- C:\Windows\System\nqnDNqw.exe
  C:\Windows\System\nqnDNqw.exe
  2⤵
  PID:9492
- C:\Windows\System\HKxEOqk.exe
  C:\Windows\System\HKxEOqk.exe
  2⤵
  PID:11028
- C:\Windows\System\fVVacCq.exe
  C:\Windows\System\fVVacCq.exe
  2⤵
  PID:9136
- C:\Windows\System\KZJylck.exe
  C:\Windows\System\KZJylck.exe
  2⤵
  PID:9612
- C:\Windows\System\EfIXnti.exe
  C:\Windows\System\EfIXnti.exe
  2⤵
  PID:1816
- C:\Windows\System\ClEUqlr.exe
  C:\Windows\System\ClEUqlr.exe
  2⤵
  PID:11152
- C:\Windows\System\WpdqNLX.exe
  C:\Windows\System\WpdqNLX.exe
  2⤵
  PID:9740
- C:\Windows\System\hXgWoiH.exe
  C:\Windows\System\hXgWoiH.exe
  2⤵
  PID:4476
- C:\Windows\System\dFmsRUs.exe
  C:\Windows\System\dFmsRUs.exe
  2⤵
  PID:3336
- C:\Windows\System\hOpePAA.exe
  C:\Windows\System\hOpePAA.exe
  2⤵
  PID:8980
- C:\Windows\System\XyOeKpS.exe
  C:\Windows\System\XyOeKpS.exe
  2⤵
  PID:9564
- C:\Windows\System\KjkDVoB.exe
  C:\Windows\System\KjkDVoB.exe
  2⤵
  PID:7252
- C:\Windows\System\FMgxTHk.exe
  C:\Windows\System\FMgxTHk.exe
  2⤵
  PID:7272
- C:\Windows\System\yKgynip.exe
  C:\Windows\System\yKgynip.exe
  2⤵
  PID:8528
- C:\Windows\System\QlLxzml.exe
  C:\Windows\System\QlLxzml.exe
  2⤵
  PID:13320
- C:\Windows\System\auOHpVi.exe
  C:\Windows\System\auOHpVi.exe
  2⤵
  PID:13340
- C:\Windows\System\ToAQmWM.exe
  C:\Windows\System\ToAQmWM.exe
  2⤵
  PID:13356
- C:\Windows\System\hBMnOjJ.exe
  C:\Windows\System\hBMnOjJ.exe
  2⤵
  PID:13380
- C:\Windows\System\OaJNkda.exe
  C:\Windows\System\OaJNkda.exe
  2⤵
  PID:13404
- C:\Windows\System\fdSCHjn.exe
  C:\Windows\System\fdSCHjn.exe
  2⤵
  PID:13428
- C:\Windows\System\DepgFee.exe
  C:\Windows\System\DepgFee.exe
  2⤵
  PID:13452
- C:\Windows\System\vNhlsgM.exe
  C:\Windows\System\vNhlsgM.exe
  2⤵
  PID:13472
- C:\Windows\System\SOAaJJf.exe
  C:\Windows\System\SOAaJJf.exe
  2⤵
  PID:13488
- C:\Windows\System\aNfXREX.exe
  C:\Windows\System\aNfXREX.exe
  2⤵
  PID:13508
- C:\Windows\System\tvPwzZp.exe
  C:\Windows\System\tvPwzZp.exe
  2⤵
  PID:13528
- C:\Windows\System\JVwWkdd.exe
  C:\Windows\System\JVwWkdd.exe
  2⤵
  PID:13548
- C:\Windows\System\IoatQee.exe
  C:\Windows\System\IoatQee.exe
  2⤵
  PID:13580
- C:\Windows\System\EKhpaVw.exe
  C:\Windows\System\EKhpaVw.exe
  2⤵
  PID:13604
- C:\Windows\System\codFrea.exe
  C:\Windows\System\codFrea.exe
  2⤵
  PID:13624
- C:\Windows\System\XkPIewt.exe
  C:\Windows\System\XkPIewt.exe
  2⤵
  PID:13648
- C:\Windows\System\pwdUMqY.exe
  C:\Windows\System\pwdUMqY.exe
  2⤵
  PID:13664
- C:\Windows\System\UpFFrtu.exe
  C:\Windows\System\UpFFrtu.exe
  2⤵
  PID:13684
- C:\Windows\System\nXDffbe.exe
  C:\Windows\System\nXDffbe.exe
  2⤵
  PID:13704
- C:\Windows\System\yYWGDEQ.exe
  C:\Windows\System\yYWGDEQ.exe
  2⤵
  PID:13724
- C:\Windows\System\qQtAfVV.exe
  C:\Windows\System\qQtAfVV.exe
  2⤵
  PID:13740
- C:\Windows\System\NlXcMhP.exe
  C:\Windows\System\NlXcMhP.exe
  2⤵
  PID:13760
- C:\Windows\System\ZCXfkQh.exe
  C:\Windows\System\ZCXfkQh.exe
  2⤵
  PID:13776
- C:\Windows\System\qIYOQKY.exe
  C:\Windows\System\qIYOQKY.exe
  2⤵
  PID:13792
- C:\Windows\System\scebWfR.exe
  C:\Windows\System\scebWfR.exe
  2⤵
  PID:13816
- C:\Windows\System\kdWjuIK.exe
  C:\Windows\System\kdWjuIK.exe
  2⤵
  PID:13836
- C:\Windows\System\kwukxNl.exe
  C:\Windows\System\kwukxNl.exe
  2⤵
  PID:13860
- C:\Windows\System\RDOeDBJ.exe
  C:\Windows\System\RDOeDBJ.exe
  2⤵
  PID:13880
- C:\Windows\System\KjZvioW.exe
  C:\Windows\System\KjZvioW.exe
  2⤵
  PID:13900
- C:\Windows\System\dCyGIpK.exe
  C:\Windows\System\dCyGIpK.exe
  2⤵
  PID:13920
- C:\Windows\System\skDEmCR.exe
  C:\Windows\System\skDEmCR.exe
  2⤵
  PID:13944
- C:\Windows\System\cwpAlAa.exe
  C:\Windows\System\cwpAlAa.exe
  2⤵
  PID:13960
- C:\Windows\System\ThOeQjb.exe
  C:\Windows\System\ThOeQjb.exe
  2⤵
  PID:13984
- C:\Windows\System\IRgZgMM.exe
  C:\Windows\System\IRgZgMM.exe
  2⤵
  PID:14000
- C:\Windows\System\uxdgTjB.exe
  C:\Windows\System\uxdgTjB.exe
  2⤵
  PID:14020
- C:\Windows\System\HOowaKf.exe
  C:\Windows\System\HOowaKf.exe
  2⤵
  PID:14044
- C:\Windows\System\OITxXfU.exe
  C:\Windows\System\OITxXfU.exe
  2⤵
  PID:14064
- C:\Windows\System\dayKkde.exe
  C:\Windows\System\dayKkde.exe
  2⤵
  PID:14084
- C:\Windows\System\dWiDopE.exe
  C:\Windows\System\dWiDopE.exe
  2⤵
  PID:14100
- C:\Windows\System\OgJVhRm.exe
  C:\Windows\System\OgJVhRm.exe
  2⤵
  PID:14116
- C:\Windows\System\cpakqIV.exe
  C:\Windows\System\cpakqIV.exe
  2⤵
  PID:14132
- C:\Windows\System\oKmqyXZ.exe
  C:\Windows\System\oKmqyXZ.exe
  2⤵
  PID:14148
- C:\Windows\System\gIstbgq.exe
  C:\Windows\System\gIstbgq.exe
  2⤵
  PID:14164
- C:\Windows\System\DqrnYNL.exe
  C:\Windows\System\DqrnYNL.exe
  2⤵
  PID:14180
- C:\Windows\System\dNlWrNx.exe
  C:\Windows\System\dNlWrNx.exe
  2⤵
  PID:14200
- C:\Windows\System\RTcqqmE.exe
  C:\Windows\System\RTcqqmE.exe
  2⤵
  PID:14216
- C:\Windows\System\mkGFplb.exe
  C:\Windows\System\mkGFplb.exe
  2⤵
  PID:14236
- C:\Windows\System\hxiEUVe.exe
  C:\Windows\System\hxiEUVe.exe
  2⤵
  PID:14252
- C:\Windows\System\HmXEpEv.exe
  C:\Windows\System\HmXEpEv.exe
  2⤵
  PID:14276
- C:\Windows\System\iZlPjwo.exe
  C:\Windows\System\iZlPjwo.exe
  2⤵
  PID:14296
- C:\Windows\System\owgfkba.exe
  C:\Windows\System\owgfkba.exe
  2⤵
  PID:14320
- C:\Windows\System\jREppsm.exe
  C:\Windows\System\jREppsm.exe
  2⤵
  PID:9064
- C:\Windows\System\rWJkkSI.exe
  C:\Windows\System\rWJkkSI.exe
  2⤵
  PID:6836
- C:\Windows\System\OwWCFLD.exe
  C:\Windows\System\OwWCFLD.exe
  2⤵
  PID:6348
- C:\Windows\System\DebETXu.exe
  C:\Windows\System\DebETXu.exe
  2⤵
  PID:11548
- C:\Windows\System\jiogfRk.exe
  C:\Windows\System\jiogfRk.exe
  2⤵
  PID:3632
- C:\Windows\System\evYOjhi.exe
  C:\Windows\System\evYOjhi.exe
  2⤵
  PID:11660
- C:\Windows\System\RKjMHtl.exe
  C:\Windows\System\RKjMHtl.exe
  2⤵
  PID:8004
- C:\Windows\System\SHjJXFY.exe
  C:\Windows\System\SHjJXFY.exe
  2⤵
  PID:7964
- C:\Windows\System\dWqTuza.exe
  C:\Windows\System\dWqTuza.exe
  2⤵
  PID:11812
- C:\Windows\System\qJBkNnF.exe
  C:\Windows\System\qJBkNnF.exe
  2⤵
  PID:11900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\ByQjHzn.exe

Filesize
1.1MB

MD5
5bc04e64d1145575b92d6e2e395e22a1

SHA1
e4c80d14d0d3d4da26f2307a99d12efde5aac2cd

SHA256
d24d359a56df23ccff4037ca0dc529a1036453d53fafc5923f2e272bf9c1a862

SHA512
eea6c88865079263d68edd94c2a11108d3936be218be4e1a2e1ef7b465119e2953b2eecfc0d68c1a0b0afd0f096bddd9827b0590b1119829de72540ebf969944

Download Submit
C:\Windows\System\CWGSyka.exe

Filesize
1.1MB

MD5
12882a7cb964fc4f7140874ac83778d4

SHA1
46167d4b8030e1f261683e03ce3a6a8f9782d391

SHA256
0840b4c4da7c1a99c7b5772a8daf0c8e0a1a1ffcf249e651820a7ab26d6f26ce

SHA512
23a79c9cbf3a4f8cd960bd094d7dc86b49c6b872ab317a4ff51bef0eabadf284f352190d532641d64181c8437f0346def69acfd8fb69ce7602a0c40a3b83fa5c

Download Submit
C:\Windows\System\DHSUqVj.exe

Filesize
1.1MB

MD5
141cee311b56d5a339d2ad6d8276a09b

SHA1
0925b7c5ab85f8e00e8ab8633ccc083141162c9e

SHA256
bd63c836713de98e233950eeec0dfb365692504a1e5002337b4cbaf0a771a66c

SHA512
6500eb8e6464c4c6eb534d4913d0d2f4ed116f2dde31c1391015f8f373d15f902ea643b0b1dc5034899484e648b3f464d8822f797c37a25a2831831662933a43

Download Submit
C:\Windows\System\EXJsqdB.exe

Filesize
1.1MB

MD5
149f92a9d6d45db864dbed91cf169441

SHA1
7d87042085da5f4d587f485e4299b2e8236955b3

SHA256
24910716c3d26dbbcf4946075b5a025b83d54e2d53ea209115f065a03dc47ac4

SHA512
0be75d536b8b221278f26835ce9b3623507de1882ab4bb42951480319ea86fcdfacabada0a5c1ee48be3337e38b004a2b05a323623e520c8c28b68336255ff30

Download Submit
C:\Windows\System\EwoMQWi.exe

Filesize
1.1MB

MD5
f5b3ed9f6f7185ec384558202b18aa7d

SHA1
0e0e080819203ccb78201fe29f4e319274d50114

SHA256
6bbcc0410a552e185aa30431cbf10920b6afc64069225fd262b5501a60d1317d

SHA512
2cef9f46e13532239aebc2819c5208ae42c31865145ede602a0d170ac5665e4ab7c97e8d1e078b33baa4bac7e704aab914582d319fe57c0d17ef69768131fc55

Download Submit
C:\Windows\System\FXNUQMa.exe

Filesize
1.1MB

MD5
bfe4a36750dd7fb81b4f4419d65df885

SHA1
506e6536b85ac879e4a0b94ecad217f5a7978d89

SHA256
242848aad0d4e61d52a6bd3b034e3a92d52908d847c04348ff6eb73e7d039c15

SHA512
8ab9d5c3267280bdf89f675cf054e3301ce1704ac91c2914fdca58b05b1a6b17590050ee49bc90b18daad4c6293d2c9d40c41e9d2f119e0fce82f9d4bce21e07

Download Submit
C:\Windows\System\IFDgecq.exe

Filesize
1.1MB

MD5
84a24de45cab9a33880fdb1a3b3821b6

SHA1
d957818f4da6c16e10cc7bf4c9079ea9ab9bc05e

SHA256
d8efcf37d29374cba653787f70f43ca9530cfdf007c0b95d40e0ca2e537bf0ef

SHA512
dc34998f33d7752b9852b2556bba998c8911b14a384a8083776ec39168e6f2d61fe74da0fd2c508bd57560a45d7b6a9b98b37691d163e837850b8d0ccb4d602d

Download Submit
C:\Windows\System\IZcyRXR.exe

Filesize
1.1MB

MD5
d1436a35a339f713eadc0458650b3188

SHA1
82d3636b179ce023e1f283f44627b828b98c9309

SHA256
86cb45d8d336b4814585f184bbaedf3658de35102239f67fb4bd1ec32494c12c

SHA512
8933eb6e1818a7baebe3470f41fd8b8c6cd674705207c400e0bb9c5d9a1748eea47b85e0f004b9e919e52b118856ff079800b5c026aea14b92539906bec5c417

Download Submit
C:\Windows\System\JjCTuEG.exe

Filesize
1.1MB

MD5
c597b29f602bad6ecbc5b0afed3d7f66

SHA1
35293114b1a0c43815bf2e95f1c44ea3a87c851f

SHA256
918bcf9b7af9a65a8bd725a1aecb7613a447de8a7332c6332449e94ae66b6f50

SHA512
d6eef1d3e70aac64ce1690f18a84872ea03ce3ffd2b613d3e5337f0b938e2ac24135664cbb5e11f0933cf05bf284e25a7d1ef7503e25b051f6a383c5963ecb6c

Download Submit
C:\Windows\System\OcTGaoK.exe

Filesize
1.1MB

MD5
e0646ff9f36842bb30a5c23b19eeb0d9

SHA1
71b611508591da8aeeb4b718c8b8dc09ca2f76c2

SHA256
731c97757839678b4b3f2bc0544faf762f73968b5b96cf54b5f5c346f089269f

SHA512
2aaa24d21877763cf7a1f0e5fa1f3c2332c5757e07f3b03fb9ab28917582fe238ba29228a04775edd2c4f601d6c76b75a2a3ea82100897a023e373d909745279

Download Submit
C:\Windows\System\VkCUhGr.exe

Filesize
1.1MB

MD5
105db07df365bdbe349e70ef61d70c87

SHA1
cbab5eae4d82ee20fe08e89938c7c891b4ff30e8

SHA256
70ad886e28b8ba7bd0f5315c2a0eca21b15d83ca1f7cf4e26adfa52ab4444722

SHA512
92a818a2829ec9bb2656a712b3305e157602b9d72b3658c4ecadf1e4f82dd0dbc2061ff337678c7bc83ceaa9248eb20e741ab78be766623826b35e6c8722038f

Download Submit
C:\Windows\System\XLdbEEF.exe

Filesize
1.1MB

MD5
7fc02f1a2973bebce7dfc552e738d454

SHA1
da6897268c68b2173b7cbeaba8702d04858d5a06

SHA256
aca83cad29de1934794cec170b67fd1234959e4b67025a73183252e96b9674ee

SHA512
ce25c8512f25a7b33c09fbe0035a971c18f8493015defed2aa6538a2eefa0597da1389ae343392c464abf53abf69c7ae96e8f6746e99ca9e2742a9b22d768206

Download Submit
C:\Windows\System\XNxksKb.exe

Filesize
1.1MB

MD5
fc89007074c73b5bf300be5b5da38d1c

SHA1
f158bb80ce732ffbbff7501d27b5683840454aa3

SHA256
41be9dcc640d781ff4a6410121628d0d2cdfa19a24f030abe66bc24c55092c82

SHA512
23a54ec31d30afc2b279340b9ab0583ad5f563852d7556427073836a5c3002ea8cccb1d8ee20880e520eeba1c14bb965aa89c2674018987f7675e6e62fff9f28

Download Submit
C:\Windows\System\XfvyHBc.exe

Filesize
1.1MB

MD5
c570c3833a868bce47972c2b0fc1a27b

SHA1
26901b65b53d593cbe80886d3b83e11d224a934a

SHA256
ddfaff4e54dfaaa8db874750c69c55a141ca957fc0e29075aa3b57185afd5cda

SHA512
bb630c82d3c9e4eb94ebf19f02aaf0cbafaae31f8f5b78e5c24684223a7065657abddc5f8051fd9c53d12286a2ae9491bb04f8528187249c1d486f00c06d0c8b

Download Submit
C:\Windows\System\XwGDzRp.exe

Filesize
1.1MB

MD5
b41bf5eb7bf70ed088b5329ce43f3581

SHA1
9002617c84fa6609359b1a84d8f120a84ccc7419

SHA256
ea095fc6482dfb24cfebb67e74caac3092f80b15ef091e8e624da0e39643a995

SHA512
917cad9440f34eba89ad412289cffc8210c2ba6c1e8f51094e930a8621871c6df72012661fbc38a92d9d30c04170fe21c4a1341cedd7cbf5c89c9bc6ebd9534d

Download Submit
C:\Windows\System\YbHzAtH.exe

Filesize
1.1MB

MD5
6d829e620244a3c27021659666c3799e

SHA1
469c1b3da062a191e724e80b34453a9c3b79f979

SHA256
0ceb3f51bba00b79d06d5d581c8e3519a596c4ee9b9734849357dbb253e398d3

SHA512
df46f0115b9997ac0ae6d8e5306a3d77978709bf885cd66284f65add21171760ebabfa6950f23ec81b0635903ab55dc73263d0279cf6ee8740d94cadf61e9e6a

Download Submit
C:\Windows\System\fKVpWVk.exe

Filesize
1.1MB

MD5
1d585dff735801da3bc46738c0892984

SHA1
41711632b8e8bca58885a5ea8f899a2cb4d9fbaf

SHA256
208c7a814ef30005f4f5cc9c97b9b487a661abe5250dcb96700946063100800c

SHA512
2fe6d40714e04ed2a64d611a34bb43b5d7370f66974c3e2ce2a2b5122db6ce58bf010376fbd2fb31e41be576ac17b68e31bdc9f0b51622dc729edb4aed1f99f9

Download Submit
C:\Windows\System\firZFrJ.exe

Filesize
1.1MB

MD5
c89ec7eec54760c4ef0296442fa741f3

SHA1
7a7ba4cc2ec37d29fe6ca699c910e263a2eccd21

SHA256
b0cb5fd9c8527985c62590a0269e53d7ac13466148d1a56c58689757a47ec112

SHA512
3d68b48715df300ccdbd9625efeb3737a59f9428a3dff6c691c789a4d6177c6fbd2299dba15c189c8993949a97dc521dc43ed952aac997031cc3d7c04fa24942

Download Submit
C:\Windows\System\gFybLnk.exe

Filesize
1.1MB

MD5
197553123874ed5ccd14116cc25d86e6

SHA1
f80692d96bec058a73e7dcd018630d2db47282c1

SHA256
d7126cd4c1c878e72eb8c415a90b16396f3108986007ef68a3c458abdd440805

SHA512
d2e76abdf73ae92b618fc7f57ddd0a9a933e570b5e85f0c12c80d64492c1c48be091c30a96734bbb49b407f5d9307efdb97abfde06018874b470ff2cb3170cd5

Download Submit
C:\Windows\System\ghVpZuA.exe

Filesize
1.1MB

MD5
b5a375a6f775a7d25dd363b38395c7d2

SHA1
ed1c8c64bb28ab255d76c2fab8f595ac41c34873

SHA256
7ac8fd0fd3613794ec7fd894195bb1adf82af27fbd6bc3523287c9439db1492a

SHA512
29e414ff860381f950abf7bd11f19ae5e7657f43db7746625f236dcad3357cb0beb1ddfd7691218dd6ef0fad2c9a10a7347625e065a5451cf550a42374d956e3

Download Submit
C:\Windows\System\ibdfzQR.exe

Filesize
1.1MB

MD5
a211a820ae7d3d5530ddc17bef08906b

SHA1
2f16cfa16132b54a82fe51de971b1cd1776a1b9c

SHA256
eac2a1962c02c608491953094ddcc249cce6445205922b61def2491a69733ad8

SHA512
70a5d2405fadb8a39f9a4669b4822e16b06ce737d35236c249b1a50a2cf58dcefbe319b70841815c9dd30d87e27d8010c166695bb314876681c2cd8daacdcf33

Download Submit
C:\Windows\System\jGEprcR.exe

Filesize
1.1MB

MD5
afad81b40c3a1e22fa565226c96415b9

SHA1
0ae01b9884c254c431881a9831f80305bc787619

SHA256
a1125d84c0a47f0f6303c3b800ac5b58e4416df0550692e861e74bf00d581af5

SHA512
5c77156770f28a7158eec7fe70de042bbf4edd35c5b864f8bb7767ba94b06662ffac415ed66ba604881fd0308a01fe1aff3c0e508af034da150847662ae83b9a

Download Submit
C:\Windows\System\mclfTAe.exe

Filesize
1.1MB

MD5
83ee01f7c7dc62ac15b38b9c64ef7f27

SHA1
584a12d25622caee419beb806d37316c3687e42b

SHA256
f877f2f0a8d26ad9e52eb21a8ee8c8111c729afa026b530b343a749baba02049

SHA512
b5ca534e29050d8bb7442369ea3b4ebdc69adcab2cb2a6c66e0d58c3f44fa364188b22f71d2a072737493a9387e446ed6091548eace9ec9860b4574cdb0ffa67

Download Submit
C:\Windows\System\mfJsSAp.exe

Filesize
1.1MB

MD5
e0163b34821c54cabb91fab74d5378b7

SHA1
c1bba0e20aee619bd559e2a93f00e5cba780510f

SHA256
f1a7a15f5d54b0d3a2c30efd4d7154a07d69c27eaafe480ee332d28ea95bbd77

SHA512
079fd2662a3a9702727935c6ffdecfe82555519fd28993573fe600e7979afc8a0fbf619ae45f3ed9a93e53a5729dd0ea42a71293ce76a2f1df32c678f9f3dc56

Download Submit
C:\Windows\System\nvYAzOO.exe

Filesize
1.1MB

MD5
6a8f8826ee32f137fb923fb5453d9801

SHA1
cc129880ea6d4dab8c3479581a8fa6a3a100bce1

SHA256
b993fbe00f3cc4b3ae209a6bf1678220410cde681af5afb00c5a419eefefc468

SHA512
66ebc6e6a879b8d6e03197aad90263b7282d901854d7bf961ba95e59b5afeabb5d90f0fa8cdf835e2d968ba539668625ed4d0d20507b4413ca9075a853437802

Download Submit
C:\Windows\System\opqQlsd.exe

Filesize
1.1MB

MD5
145d6011f8bcb914469f26e31ac65fac

SHA1
8141ca59c2462949b98dfde8cb23515ca9cbff46

SHA256
c9cdd72cb4ace34800c65accf805734dd83402fa45ebf6f27d00b566522d51d8

SHA512
5f5af335bfced715f657e9b572a4f9333a9af8f9a9bfc6a34b8a0c4d43c6d7429f701d3d224076908637ab6fffeb3eedc81aa685e0a7a22a1c1b0e2225c5d812

Download Submit
C:\Windows\System\pqPpRvq.exe

Filesize
1.1MB

MD5
e4e92223ee60bea998a6ccc018d4f47c

SHA1
c6ccc138217abb365e1820247f8b7d3c90abe8c4

SHA256
c0e66e6935e9c085d28bea662c1d8e06593fbaa6d26715cf5f0a9a29503e84e0

SHA512
aba527a300053dddd611f4a2f79806d30d7221f914e5d94429d3ea8fa52cda78198ad7fb119c8051677bfd3b93fac7025b159bd0196235c7f8582bc2eb9d18c6

Download Submit
C:\Windows\System\qgyZzKs.exe

Filesize
1.1MB

MD5
203e3424e731815565c236c903d66fca

SHA1
10205efdd49061813cde2a77148037f98442228b

SHA256
caf32110b81eab36a43b29d9646466118094478d7bf4d107929aa0b01ed21da4

SHA512
34ea286180d8b090e3fc1732fbe3ca0e4b84808d36e7d5331873afc68e184409d048a5033aa5bc20b5dbbef22eba32515b278a07c15fdd5c05149d9b2d3684b6

Download Submit
C:\Windows\System\rJjQIdA.exe

Filesize
1.1MB

MD5
23023c56b0fc59fa0b6c88d508786fcd

SHA1
8d499537e77616cafd47bd92d25d64f04dcb4b2b

SHA256
5ba24b3805947b1211244feae0d1ea65411463c996d3b31fd12a89eb9fb74b07

SHA512
358d45fcf2b91b7a2eb202b6d26852d5d93e257382e3c6770c3eb06e2f9e501b49aecf5e04be3692187490d589914365f04c4f0c16e89397ac9aae0fe55c331c

Download Submit
C:\Windows\System\sPnSHoQ.exe

Filesize
1.1MB

MD5
fb627e0b9b21ec69d5913417b3d5086d

SHA1
52329e1c1bc794180cb7b112baabdb073688dab7

SHA256
b73bf2a8b03df5f150fa7d14ed275f5e7cd250b54c10a0c19a479d9324f84368

SHA512
464270ae3fa3f8c20967bf55f205fe10fa09505e25e26c7523c8114f689dce3710508f6b715063529273a9df4b427fca1b6bb62a8adb630e237573a6ce0d1499

Download Submit
C:\Windows\System\sbTcyux.exe

Filesize
1.1MB

MD5
174d70ce291653793596d92b7623f62e

SHA1
786d77e06fedb69d19a1d328019c954e7e77b680

SHA256
3061cbc4a68f7d834475828b47656cafb7f2a83c94eb2bad74efbf8b1bb25f89

SHA512
5fc6ecdbfd2b71187d1692217584f50c2522fb8f53eeeebc8ba5f5d3a92ac9d0b20da5aceef981d174b174efe9c5e7c54f1f36bf6532c082a10a579290ae5a39

Download Submit
C:\Windows\System\sxIgLsS.exe

Filesize
1.1MB

MD5
277a2c61929003e969b7e03600856ac4

SHA1
233621e8c31c810b12daf5e83022d47d341134a4

SHA256
70409e171422e8c5badded4880e33298638253da1417310669b8160c45c3a9f9

SHA512
f741862752eb76d68481c2de0537c0b00e717e1358d3aaa3cd02b3d7b2aa46890b228f78279044f977882c0aebd1ac05d2a5a783f9d0e04d817bf4512c02dda0

Download Submit
C:\Windows\System\uCqPova.exe

Filesize
1.1MB

MD5
60405ed3641437b56510b15edb3b01ff

SHA1
7f2a9e55e4375e552f7a66e01908a8bd5677c7eb

SHA256
329e0b97d5fb1aa98a1bf6d7d2cf5577f58555f15346169ffde853c5fde068d7

SHA512
717e73a96953234759dd934871ee221059c31e22154671eeaa219f2764545e2e756cc6021945da89dd2f120bee9ef0c04523734fe8554a94fd3154090b5f4139

Download Submit
C:\Windows\System\uyTwZwG.exe

Filesize
1.1MB

MD5
e4c5b9f5d47d1aa1d264e20281d58476

SHA1
e12e06c757d027d9f95fb8d95ab1cac0fcfeb760

SHA256
c67271bb3524458bc36386ecec437305493516e416dccfd5bd4be8ea292f6ba1

SHA512
08c6609955c98f41540de1b0270304347cf26443bc3bdda34f401317cc1265882a6aeb93ba48eca415b4d9e91bbcfe457d626d1a63d141354e2b06719f2d37a6

Download Submit
C:\Windows\System\vtOHrUa.exe

Filesize
1.1MB

MD5
e36ca5bd2f86412b950c5c02be8a5aac

SHA1
cdec49618efcefa35f3ae2a28d204d05d9e39b6d

SHA256
267daf01c040ddb8707afcb3faa1c053d2a0f9c25bc7b3c48411737cc5853fee

SHA512
ab4e452befc530cf20cf1d02cf93543ed835914735e038c2118cac7d63413fa486e4521de08c547a2ec7b2d2f9505e66cf6fa937eda37de1e339135e4086d6a5

Download Submit
C:\Windows\System\wIqDEhk.exe

Filesize
1.1MB

MD5
2b45a807a69473c00aa8e47e47cbab5f

SHA1
2537ee882f670aa055c46a50a19416f08207ea39

SHA256
2ab83ddcefe625add24d61a8839ad03ec1b11b3c1b4c83fb90ac555b062f0439

SHA512
eeb2144c8a2b26fad2c0def37db3042e67c51911bd3d3f75b88a569e631f120ad2c87c8532bba9fbab37d3e6882cb4f29d5abb906094ec395cdd688c22f6d1ce

Download Submit
C:\Windows\System\xcqjBTe.exe

Filesize
1.1MB

MD5
7b4a24ce495c153369f520d7f32624c2

SHA1
276efcf194301afa727f174af93c1b7de82d9727

SHA256
3fba308ef9bb0fdde464119c84e3b9b9651af61af04c0a426c1ae375c7139323

SHA512
9104d65fec1d380279c8438bceb7bfcfc9941090ef8d655082c13382fa4dce5f6c112c646b9ccfd5bc5702fcf03fec35f5ba66881a437ef11d604235ec23afa0

Download Submit
C:\Windows\System\ytyHiAp.exe

Filesize
1.1MB

MD5
32c322b495977be4e7a9b23f1e370335

SHA1
ade7fa650b7bd6f66a5e10ff28f5e116fcb51e08

SHA256
52256a749f2beac8b463cd79f57a462186664c68198d200aae691c237d3e2929

SHA512
6b1e98e4d5e70fa4dacc3d72e483e09b429a191f3dbd89d5c21d7ccb16874fec9b55cc38874075486af77628b76d340c4d43d6808fef30a45a13cc922c32986e

Download Submit
memory/400-2120-0x00007FF6988A0000-0x00007FF698BF1000-memory.dmp

Filesize
3.3MB

Download
memory/400-36-0x00007FF6988A0000-0x00007FF698BF1000-memory.dmp

Filesize
3.3MB

Download
memory/400-2232-0x00007FF6988A0000-0x00007FF698BF1000-memory.dmp

Filesize
3.3MB

Download
memory/464-2110-0x00007FF674B80000-0x00007FF674ED1000-memory.dmp

Filesize
3.3MB

Download
memory/464-0-0x00007FF674B80000-0x00007FF674ED1000-memory.dmp

Filesize
3.3MB

Download
memory/464-1-0x000001B204DD0000-0x000001B204DE0000-memory.dmp

Filesize
64KB

Download
memory/756-351-0x00007FF643EF0000-0x00007FF644241000-memory.dmp

Filesize
3.3MB

Download
memory/756-2261-0x00007FF643EF0000-0x00007FF644241000-memory.dmp

Filesize
3.3MB

Download
memory/968-357-0x00007FF62E5C0000-0x00007FF62E911000-memory.dmp

Filesize
3.3MB

Download
memory/968-2276-0x00007FF62E5C0000-0x00007FF62E911000-memory.dmp

Filesize
3.3MB

Download
memory/1372-344-0x00007FF6B0950000-0x00007FF6B0CA1000-memory.dmp

Filesize
3.3MB

Download
memory/1372-2256-0x00007FF6B0950000-0x00007FF6B0CA1000-memory.dmp

Filesize
3.3MB

Download
memory/1744-2242-0x00007FF76E6F0000-0x00007FF76EA41000-memory.dmp

Filesize
3.3MB

Download
memory/1744-130-0x00007FF76E6F0000-0x00007FF76EA41000-memory.dmp

Filesize
3.3MB

Download
memory/1916-352-0x00007FF7E15C0000-0x00007FF7E1911000-memory.dmp

Filesize
3.3MB

Download
memory/1916-2278-0x00007FF7E15C0000-0x00007FF7E1911000-memory.dmp

Filesize
3.3MB

Download
memory/2064-2266-0x00007FF638610000-0x00007FF638961000-memory.dmp

Filesize
3.3MB

Download
memory/2064-343-0x00007FF638610000-0x00007FF638961000-memory.dmp

Filesize
3.3MB

Download
memory/2188-206-0x00007FF669E80000-0x00007FF66A1D1000-memory.dmp

Filesize
3.3MB

Download
memory/2188-2248-0x00007FF669E80000-0x00007FF66A1D1000-memory.dmp

Filesize
3.3MB

Download
memory/2352-2268-0x00007FF614670000-0x00007FF6149C1000-memory.dmp

Filesize
3.3MB

Download
memory/2352-347-0x00007FF614670000-0x00007FF6149C1000-memory.dmp

Filesize
3.3MB

Download
memory/2436-353-0x00007FF6C7430000-0x00007FF6C7781000-memory.dmp

Filesize
3.3MB

Download
memory/2436-2323-0x00007FF6C7430000-0x00007FF6C7781000-memory.dmp

Filesize
3.3MB

Download
memory/2484-2249-0x00007FF6F3B40000-0x00007FF6F3E91000-memory.dmp

Filesize
3.3MB

Download
memory/2484-342-0x00007FF6F3B40000-0x00007FF6F3E91000-memory.dmp

Filesize
3.3MB

Download
memory/2904-2125-0x00007FF6087D0000-0x00007FF608B21000-memory.dmp

Filesize
3.3MB

Download
memory/2904-2244-0x00007FF6087D0000-0x00007FF608B21000-memory.dmp

Filesize
3.3MB

Download
memory/2904-100-0x00007FF6087D0000-0x00007FF608B21000-memory.dmp

Filesize
3.3MB

Download
memory/3004-197-0x00007FF679F90000-0x00007FF67A2E1000-memory.dmp

Filesize
3.3MB

Download
memory/3004-2240-0x00007FF679F90000-0x00007FF67A2E1000-memory.dmp

Filesize
3.3MB

Download
memory/3112-356-0x00007FF622B60000-0x00007FF622EB1000-memory.dmp

Filesize
3.3MB

Download
memory/3112-2275-0x00007FF622B60000-0x00007FF622EB1000-memory.dmp

Filesize
3.3MB

Download
memory/3244-350-0x00007FF660300000-0x00007FF660651000-memory.dmp

Filesize
3.3MB

Download
memory/3244-2302-0x00007FF660300000-0x00007FF660651000-memory.dmp

Filesize
3.3MB

Download
memory/3660-2273-0x00007FF6BD580000-0x00007FF6BD8D1000-memory.dmp

Filesize
3.3MB

Download
memory/3660-245-0x00007FF6BD580000-0x00007FF6BD8D1000-memory.dmp

Filesize
3.3MB

Download
memory/3672-2124-0x00007FF72A300000-0x00007FF72A651000-memory.dmp

Filesize
3.3MB

Download
memory/3672-2237-0x00007FF72A300000-0x00007FF72A651000-memory.dmp

Filesize
3.3MB

Download
memory/3672-70-0x00007FF72A300000-0x00007FF72A651000-memory.dmp

Filesize
3.3MB

Download
memory/3816-2238-0x00007FF765980000-0x00007FF765CD1000-memory.dmp

Filesize
3.3MB

Download
memory/3816-354-0x00007FF765980000-0x00007FF765CD1000-memory.dmp

Filesize
3.3MB

Download
memory/4140-2264-0x00007FF77D580000-0x00007FF77D8D1000-memory.dmp

Filesize
3.3MB

Download
memory/4140-314-0x00007FF77D580000-0x00007FF77D8D1000-memory.dmp

Filesize
3.3MB

Download
memory/4160-319-0x00007FF6440B0000-0x00007FF644401000-memory.dmp

Filesize
3.3MB

Download
memory/4160-2258-0x00007FF6440B0000-0x00007FF644401000-memory.dmp

Filesize
3.3MB

Download
memory/4180-73-0x00007FF77A830000-0x00007FF77AB81000-memory.dmp

Filesize
3.3MB

Download
memory/4180-2209-0x00007FF77A830000-0x00007FF77AB81000-memory.dmp

Filesize
3.3MB

Download
memory/4220-2235-0x00007FF65C830000-0x00007FF65CB81000-memory.dmp

Filesize
3.3MB

Download
memory/4220-355-0x00007FF65C830000-0x00007FF65CB81000-memory.dmp

Filesize
3.3MB

Download
memory/4520-348-0x00007FF699400000-0x00007FF699751000-memory.dmp

Filesize
3.3MB

Download
memory/4520-2252-0x00007FF699400000-0x00007FF699751000-memory.dmp

Filesize
3.3MB

Download
memory/4596-2112-0x00007FF76EBF0000-0x00007FF76EF41000-memory.dmp

Filesize
3.3MB

Download
memory/4596-2207-0x00007FF76EBF0000-0x00007FF76EF41000-memory.dmp

Filesize
3.3MB

Download
memory/4596-12-0x00007FF76EBF0000-0x00007FF76EF41000-memory.dmp

Filesize
3.3MB

Download
memory/4604-2211-0x00007FF781970000-0x00007FF781CC1000-memory.dmp

Filesize
3.3MB

Download
memory/4604-2119-0x00007FF781970000-0x00007FF781CC1000-memory.dmp

Filesize
3.3MB

Download
memory/4604-24-0x00007FF781970000-0x00007FF781CC1000-memory.dmp

Filesize
3.3MB

Download
memory/4828-349-0x00007FF715340000-0x00007FF715691000-memory.dmp

Filesize
3.3MB

Download
memory/4828-2300-0x00007FF715340000-0x00007FF715691000-memory.dmp

Filesize
3.3MB

Download
memory/4976-346-0x00007FF799100000-0x00007FF799451000-memory.dmp

Filesize
3.3MB

Download
memory/4976-2270-0x00007FF799100000-0x00007FF799451000-memory.dmp

Filesize
3.3MB

Download
memory/5000-345-0x00007FF710380000-0x00007FF7106D1000-memory.dmp

Filesize
3.3MB

Download
memory/5000-2254-0x00007FF710380000-0x00007FF7106D1000-memory.dmp

Filesize
3.3MB

Download
memory/5108-2260-0x00007FF7B6850000-0x00007FF7B6BA1000-memory.dmp

Filesize
3.3MB

Download
memory/5108-340-0x00007FF7B6850000-0x00007FF7B6BA1000-memory.dmp

Filesize
3.3MB

Download