xmrig | e18d52f7f8cd8113c7af2056d4c4528e52ead13924c8ca049cdbb9d2d55df3cb

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/04/2024, 08:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
Size

2.1MB
MD5

006bb5643bd5b4eefdf153a43139634f
SHA1

f9a1f26f78b54deaf0c258d44cb3ed5cffd3db99
SHA256

e18d52f7f8cd8113c7af2056d4c4528e52ead13924c8ca049cdbb9d2d55df3cb
SHA512

dd9474b28c7d1376f6618ba2fbab60906c7e04e24b71ff209bbc77964362edd4da528d8bf8785d32a9b79021781f1504cd08cb89dc18c8637755cbba9fd8c150
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMH:NABP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 56 IoCs

miner

resource	yara_rule
behavioral1/memory/2032-34-0x000000013F930000-0x000000013FD22000-memory.dmp	xmrig
behavioral1/memory/2536-41-0x000000013F5C0000-0x000000013F9B2000-memory.dmp	xmrig
behavioral1/memory/2812-43-0x000000013FA30000-0x000000013FE22000-memory.dmp	xmrig
behavioral1/memory/2032-144-0x000000013F930000-0x000000013FD22000-memory.dmp	xmrig
behavioral1/memory/2444-160-0x000000013FA10000-0x000000013FE02000-memory.dmp	xmrig
behavioral1/memory/1652-142-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	xmrig
behavioral1/memory/1620-163-0x000000013FA60000-0x000000013FE52000-memory.dmp	xmrig
behavioral1/memory/1888-164-0x000000013FA20000-0x000000013FE12000-memory.dmp	xmrig
behavioral1/memory/2792-166-0x000000013F760000-0x000000013FB52000-memory.dmp	xmrig
behavioral1/memory/2732-172-0x000000013F090000-0x000000013F482000-memory.dmp	xmrig
behavioral1/memory/2772-173-0x000000013F0A0000-0x000000013F492000-memory.dmp	xmrig
behavioral1/memory/2912-174-0x000000013F850000-0x000000013FC42000-memory.dmp	xmrig
behavioral1/memory/1672-175-0x000000013F630000-0x000000013FA22000-memory.dmp	xmrig
behavioral1/memory/1560-176-0x000000013F370000-0x000000013F762000-memory.dmp	xmrig
behavioral1/memory/348-177-0x000000013F300000-0x000000013F6F2000-memory.dmp	xmrig
behavioral1/memory/2696-182-0x000000013FFD0000-0x00000001403C2000-memory.dmp	xmrig
behavioral1/memory/1576-178-0x000000013F9F0000-0x000000013FDE2000-memory.dmp	xmrig
behavioral1/memory/772-185-0x000000013FC70000-0x0000000140062000-memory.dmp	xmrig
behavioral1/memory/628-186-0x000000013F5E0000-0x000000013F9D2000-memory.dmp	xmrig
behavioral1/memory/1452-188-0x000000013F560000-0x000000013F952000-memory.dmp	xmrig
behavioral1/memory/1680-194-0x000000013FB30000-0x000000013FF22000-memory.dmp	xmrig
behavioral1/memory/1652-196-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	xmrig
behavioral1/memory/1436-187-0x000000013F920000-0x000000013FD12000-memory.dmp	xmrig
behavioral1/memory/1652-298-0x000000013FF80000-0x0000000140372000-memory.dmp	xmrig
behavioral1/memory/2728-165-0x000000013FF80000-0x0000000140372000-memory.dmp	xmrig
behavioral1/memory/2492-326-0x000000013F220000-0x000000013F612000-memory.dmp	xmrig
behavioral1/memory/2536-323-0x000000013F5C0000-0x000000013F9B2000-memory.dmp	xmrig
behavioral1/memory/2580-322-0x000000013FDA0000-0x0000000140192000-memory.dmp	xmrig
behavioral1/memory/2604-321-0x000000013FCD0000-0x00000001400C2000-memory.dmp	xmrig
behavioral1/memory/2444-347-0x000000013FA10000-0x000000013FE02000-memory.dmp	xmrig
behavioral1/memory/772-358-0x000000013FC70000-0x0000000140062000-memory.dmp	xmrig
behavioral1/memory/628-365-0x000000013F5E0000-0x000000013F9D2000-memory.dmp	xmrig
behavioral1/memory/2012-366-0x000000013F020000-0x000000013F412000-memory.dmp	xmrig
behavioral1/memory/1452-363-0x000000013F560000-0x000000013F952000-memory.dmp	xmrig
behavioral1/memory/2244-368-0x000000013FAA0000-0x000000013FE92000-memory.dmp	xmrig
behavioral1/memory/1680-362-0x000000013FB30000-0x000000013FF22000-memory.dmp	xmrig
behavioral1/memory/2836-373-0x000000013F240000-0x000000013F632000-memory.dmp	xmrig
behavioral1/memory/2696-360-0x000000013FFD0000-0x00000001403C2000-memory.dmp	xmrig
behavioral1/memory/1436-359-0x000000013F920000-0x000000013FD12000-memory.dmp	xmrig
behavioral1/memory/1576-357-0x000000013F9F0000-0x000000013FDE2000-memory.dmp	xmrig
behavioral1/memory/2772-352-0x000000013F0A0000-0x000000013F492000-memory.dmp	xmrig
behavioral1/memory/2252-378-0x000000013F060000-0x000000013F452000-memory.dmp	xmrig
behavioral1/memory/348-345-0x000000013F300000-0x000000013F6F2000-memory.dmp	xmrig
behavioral1/memory/1672-344-0x000000013F630000-0x000000013FA22000-memory.dmp	xmrig
behavioral1/memory/2576-383-0x000000013F770000-0x000000013FB62000-memory.dmp	xmrig
behavioral1/memory/1620-343-0x000000013FA60000-0x000000013FE52000-memory.dmp	xmrig
behavioral1/memory/2792-342-0x000000013F760000-0x000000013FB52000-memory.dmp	xmrig
behavioral1/memory/1560-341-0x000000013F370000-0x000000013F762000-memory.dmp	xmrig
behavioral1/memory/1888-340-0x000000013FA20000-0x000000013FE12000-memory.dmp	xmrig
behavioral1/memory/2912-339-0x000000013F850000-0x000000013FC42000-memory.dmp	xmrig
behavioral1/memory/2732-338-0x000000013F090000-0x000000013F482000-memory.dmp	xmrig
behavioral1/memory/2032-320-0x000000013F930000-0x000000013FD22000-memory.dmp	xmrig
behavioral1/memory/2812-314-0x000000013FA30000-0x000000013FE22000-memory.dmp	xmrig
behavioral1/memory/2580-47-0x000000013FDA0000-0x0000000140192000-memory.dmp	xmrig
behavioral1/memory/2492-46-0x000000013F220000-0x000000013F612000-memory.dmp	xmrig
behavioral1/memory/2604-44-0x000000013FCD0000-0x00000001400C2000-memory.dmp	xmrig

Executes dropped EXE 59 IoCs

pid	Process
2032	WWNygdC.exe
2536	AvSMBqt.exe
2812	LCLpzbc.exe
2604	ORUaZjF.exe
2492	wnxmJvO.exe
2580	RCcTSFF.exe
2444	VAwztJs.exe
1888	XFwuMwb.exe
2792	OuGioDj.exe
2772	xQlPQnX.exe
1672	tbRSIlS.exe
348	ApKbnlP.exe
1620	WSjgJYG.exe
2728	eTfPzss.exe
2732	xWAqilA.exe
2912	qzWWEtJ.exe
1560	HrNpxpH.exe
1576	EzSwUuA.exe
2696	ZVnKxWJ.exe
628	RNUuHQV.exe
1452	OytXMnw.exe
772	mOjYtdt.exe
1436	IfwVmRV.exe
1680	srkoaTs.exe
2012	KYrohba.exe
2244	CChIRrz.exe
2836	GwOlGOJ.exe
2252	rGXWEkH.exe
2576	UETyErX.exe
1460	pOSaWOR.exe
1908	qMIVVrI.exe
1728	NXUvBpS.exe
1312	fpxOtre.exe
896	BayzeFD.exe
1712	nzmjNmy.exe
2152	UUeHKxK.exe
1556	qFaVcLO.exe
1188	dACubnk.exe
2352	kboxQDT.exe
2804	dQoRGal.exe
344	sAlFXQa.exe
1112	vxORDPf.exe
1260	lBROsoE.exe
2056	iHKgElq.exe
2008	afBiTjk.exe
1148	dwygqAz.exe
884	BfWUYNf.exe
2980	nxFmDAp.exe
2440	JtHSPUJ.exe
2712	lvDxVKQ.exe
2764	wobQxmT.exe
1480	vhJGkab.exe
2896	DOPJzIC.exe
588	KwVncTf.exe
2596	YHGAiNM.exe
1632	UfdhLDq.exe
1604	HniesmG.exe
2992	havApdW.exe
836	zODuyra.exe

Loads dropped DLL 64 IoCs

pid	Process
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1652-0-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/files/0x000d00000001224f-5.dat	upx
behavioral1/files/0x0008000000014e51-13.dat	upx
behavioral1/memory/2032-34-0x000000013F930000-0x000000013FD22000-memory.dmp	upx
behavioral1/memory/2536-41-0x000000013F5C0000-0x000000013F9B2000-memory.dmp	upx
behavioral1/memory/2812-43-0x000000013FA30000-0x000000013FE22000-memory.dmp	upx
behavioral1/files/0x000a00000001566b-83.dat	upx
behavioral1/files/0x0006000000015eaf-87.dat	upx
behavioral1/files/0x0006000000015d9b-86.dat	upx
behavioral1/files/0x0006000000015e3a-76.dat	upx
behavioral1/files/0x0006000000015d8f-70.dat	upx
behavioral1/files/0x0006000000015fe9-108.dat	upx
behavioral1/files/0x0006000000015f6d-106.dat	upx
behavioral1/files/0x0006000000016572-126.dat	upx
behavioral1/files/0x000600000001630b-136.dat	upx
behavioral1/files/0x000600000001661c-148.dat	upx
behavioral1/memory/2032-144-0x000000013F930000-0x000000013FD22000-memory.dmp	upx
behavioral1/files/0x0006000000016843-157.dat	upx
behavioral1/memory/2444-160-0x000000013FA10000-0x000000013FE02000-memory.dmp	upx
behavioral1/memory/1652-142-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/memory/1620-163-0x000000013FA60000-0x000000013FE52000-memory.dmp	upx
behavioral1/memory/1888-164-0x000000013FA20000-0x000000013FE12000-memory.dmp	upx
behavioral1/memory/2792-166-0x000000013F760000-0x000000013FB52000-memory.dmp	upx
behavioral1/files/0x0006000000016a9a-167.dat	upx
behavioral1/memory/2732-172-0x000000013F090000-0x000000013F482000-memory.dmp	upx
behavioral1/memory/2772-173-0x000000013F0A0000-0x000000013F492000-memory.dmp	upx
behavioral1/memory/2912-174-0x000000013F850000-0x000000013FC42000-memory.dmp	upx
behavioral1/memory/1672-175-0x000000013F630000-0x000000013FA22000-memory.dmp	upx
behavioral1/memory/1560-176-0x000000013F370000-0x000000013F762000-memory.dmp	upx
behavioral1/memory/348-177-0x000000013F300000-0x000000013F6F2000-memory.dmp	upx
behavioral1/files/0x0006000000016c4a-179.dat	upx
behavioral1/memory/2696-182-0x000000013FFD0000-0x00000001403C2000-memory.dmp	upx
behavioral1/memory/1576-178-0x000000013F9F0000-0x000000013FDE2000-memory.dmp	upx
behavioral1/memory/772-185-0x000000013FC70000-0x0000000140062000-memory.dmp	upx
behavioral1/memory/628-186-0x000000013F5E0000-0x000000013F9D2000-memory.dmp	upx
behavioral1/memory/1452-188-0x000000013F560000-0x000000013F952000-memory.dmp	upx
behavioral1/files/0x0006000000016c63-189.dat	upx
behavioral1/memory/1680-194-0x000000013FB30000-0x000000013FF22000-memory.dmp	upx
behavioral1/memory/1652-196-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/memory/1436-187-0x000000013F920000-0x000000013FD12000-memory.dmp	upx
behavioral1/files/0x0006000000016c6b-202.dat	upx
behavioral1/files/0x0006000000016d1e-215.dat	upx
behavioral1/files/0x0006000000016d26-218.dat	upx
behavioral1/files/0x0006000000016d0d-211.dat	upx
behavioral1/files/0x0006000000016cb7-205.dat	upx
behavioral1/files/0x0006000000016ce4-208.dat	upx
behavioral1/memory/1652-298-0x000000013FF80000-0x0000000140372000-memory.dmp	upx
behavioral1/memory/2728-165-0x000000013FF80000-0x0000000140372000-memory.dmp	upx
behavioral1/files/0x0006000000016117-133.dat	upx
behavioral1/files/0x00060000000164b2-131.dat	upx
behavioral1/files/0x00060000000161e7-130.dat	upx
behavioral1/memory/2492-326-0x000000013F220000-0x000000013F612000-memory.dmp	upx
behavioral1/memory/2536-323-0x000000013F5C0000-0x000000013F9B2000-memory.dmp	upx
behavioral1/memory/2580-322-0x000000013FDA0000-0x0000000140192000-memory.dmp	upx
behavioral1/memory/2604-321-0x000000013FCD0000-0x00000001400C2000-memory.dmp	upx
behavioral1/memory/2444-347-0x000000013FA10000-0x000000013FE02000-memory.dmp	upx
behavioral1/memory/772-358-0x000000013FC70000-0x0000000140062000-memory.dmp	upx
behavioral1/memory/628-365-0x000000013F5E0000-0x000000013F9D2000-memory.dmp	upx
behavioral1/memory/2012-366-0x000000013F020000-0x000000013F412000-memory.dmp	upx
behavioral1/memory/1452-363-0x000000013F560000-0x000000013F952000-memory.dmp	upx
behavioral1/memory/2244-368-0x000000013FAA0000-0x000000013FE92000-memory.dmp	upx
behavioral1/memory/1680-362-0x000000013FB30000-0x000000013FF22000-memory.dmp	upx
behavioral1/memory/2836-373-0x000000013F240000-0x000000013F632000-memory.dmp	upx
behavioral1/memory/2696-360-0x000000013FFD0000-0x00000001403C2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\mOjYtdt.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\pOSaWOR.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\afBiTjk.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\HniesmG.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\pLlkfyg.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\nMpIrhp.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\LSuUPrG.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\XFwuMwb.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\xQlPQnX.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\qMIVVrI.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\BfWUYNf.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\dQoRGal.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\WWNygdC.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\ORUaZjF.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\qzWWEtJ.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\sAlFXQa.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\ctaWLaF.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\dcnACHf.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\JtHSPUJ.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\LCLpzbc.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\eTfPzss.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\KYrohba.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\GwOlGOJ.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\NXUvBpS.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\fpxOtre.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\havApdW.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\MKRRvEG.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\IpZiPVD.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\sOalrxM.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\wobQxmT.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\HpoubfJ.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\xYsuqKU.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\AvSMBqt.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\EzSwUuA.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\RNUuHQV.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\rGXWEkH.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\vxORDPf.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\tjMQRYs.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\vhJGkab.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\zODuyra.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\XMmHaJu.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\VAwztJs.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\OytXMnw.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\CChIRrz.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\BayzeFD.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\kboxQDT.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\RCcTSFF.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\OuGioDj.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\KwVncTf.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\iISnznR.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\rOwhPdj.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\iHChRvt.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\srkoaTs.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\UETyErX.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\nzmjNmy.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\DOPJzIC.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\gCbnbcp.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\BlJaIXb.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\ApKbnlP.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\UfdhLDq.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\IvcBmuY.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\CvuRJnS.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\QjApHjQ.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
File created	C:\Windows\System\PEHXkGB.exe	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1944	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
Token: SeDebugPrivilege	1944	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 1944	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	29
PID 1652 wrote to memory of 1944	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	29
PID 1652 wrote to memory of 1944	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	29
PID 1652 wrote to memory of 2032	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	30
PID 1652 wrote to memory of 2032	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	30
PID 1652 wrote to memory of 2032	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	30
PID 1652 wrote to memory of 2812	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	31
PID 1652 wrote to memory of 2812	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	31
PID 1652 wrote to memory of 2812	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	31
PID 1652 wrote to memory of 2536	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	32
PID 1652 wrote to memory of 2536	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	32
PID 1652 wrote to memory of 2536	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	32
PID 1652 wrote to memory of 2604	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	33
PID 1652 wrote to memory of 2604	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	33
PID 1652 wrote to memory of 2604	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	33
PID 1652 wrote to memory of 2492	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	34
PID 1652 wrote to memory of 2492	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	34
PID 1652 wrote to memory of 2492	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	34
PID 1652 wrote to memory of 2580	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	35
PID 1652 wrote to memory of 2580	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	35
PID 1652 wrote to memory of 2580	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	35
PID 1652 wrote to memory of 2444	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	36
PID 1652 wrote to memory of 2444	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	36
PID 1652 wrote to memory of 2444	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	36
PID 1652 wrote to memory of 1620	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	37
PID 1652 wrote to memory of 1620	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	37
PID 1652 wrote to memory of 1620	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	37
PID 1652 wrote to memory of 1888	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	38
PID 1652 wrote to memory of 1888	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	38
PID 1652 wrote to memory of 1888	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	38
PID 1652 wrote to memory of 2728	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	39
PID 1652 wrote to memory of 2728	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	39
PID 1652 wrote to memory of 2728	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	39
PID 1652 wrote to memory of 2792	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	40
PID 1652 wrote to memory of 2792	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	40
PID 1652 wrote to memory of 2792	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	40
PID 1652 wrote to memory of 2732	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	41
PID 1652 wrote to memory of 2732	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	41
PID 1652 wrote to memory of 2732	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	41
PID 1652 wrote to memory of 2772	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	42
PID 1652 wrote to memory of 2772	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	42
PID 1652 wrote to memory of 2772	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	42
PID 1652 wrote to memory of 2912	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	43
PID 1652 wrote to memory of 2912	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	43
PID 1652 wrote to memory of 2912	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	43
PID 1652 wrote to memory of 1672	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	44
PID 1652 wrote to memory of 1672	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	44
PID 1652 wrote to memory of 1672	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	44
PID 1652 wrote to memory of 1560	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	45
PID 1652 wrote to memory of 1560	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	45
PID 1652 wrote to memory of 1560	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	45
PID 1652 wrote to memory of 348	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	46
PID 1652 wrote to memory of 348	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	46
PID 1652 wrote to memory of 348	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	46
PID 1652 wrote to memory of 1576	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	47
PID 1652 wrote to memory of 1576	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	47
PID 1652 wrote to memory of 1576	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	47
PID 1652 wrote to memory of 2696	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	48
PID 1652 wrote to memory of 2696	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	48
PID 1652 wrote to memory of 2696	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	48
PID 1652 wrote to memory of 772	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	49
PID 1652 wrote to memory of 772	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	49
PID 1652 wrote to memory of 772	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	49
PID 1652 wrote to memory of 628	1652	006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\006bb5643bd5b4eefdf153a43139634f_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1944
- C:\Windows\System\WWNygdC.exe
  C:\Windows\System\WWNygdC.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\LCLpzbc.exe
  C:\Windows\System\LCLpzbc.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\AvSMBqt.exe
  C:\Windows\System\AvSMBqt.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\ORUaZjF.exe
  C:\Windows\System\ORUaZjF.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\wnxmJvO.exe
  C:\Windows\System\wnxmJvO.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\RCcTSFF.exe
  C:\Windows\System\RCcTSFF.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\VAwztJs.exe
  C:\Windows\System\VAwztJs.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\WSjgJYG.exe
  C:\Windows\System\WSjgJYG.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\XFwuMwb.exe
  C:\Windows\System\XFwuMwb.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\eTfPzss.exe
  C:\Windows\System\eTfPzss.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\OuGioDj.exe
  C:\Windows\System\OuGioDj.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\xWAqilA.exe
  C:\Windows\System\xWAqilA.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\xQlPQnX.exe
  C:\Windows\System\xQlPQnX.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\qzWWEtJ.exe
  C:\Windows\System\qzWWEtJ.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\tbRSIlS.exe
  C:\Windows\System\tbRSIlS.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\HrNpxpH.exe
  C:\Windows\System\HrNpxpH.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\ApKbnlP.exe
  C:\Windows\System\ApKbnlP.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\EzSwUuA.exe
  C:\Windows\System\EzSwUuA.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\ZVnKxWJ.exe
  C:\Windows\System\ZVnKxWJ.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\mOjYtdt.exe
  C:\Windows\System\mOjYtdt.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\RNUuHQV.exe
  C:\Windows\System\RNUuHQV.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\IfwVmRV.exe
  C:\Windows\System\IfwVmRV.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\OytXMnw.exe
  C:\Windows\System\OytXMnw.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\srkoaTs.exe
  C:\Windows\System\srkoaTs.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\KYrohba.exe
  C:\Windows\System\KYrohba.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\CChIRrz.exe
  C:\Windows\System\CChIRrz.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\GwOlGOJ.exe
  C:\Windows\System\GwOlGOJ.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\rGXWEkH.exe
  C:\Windows\System\rGXWEkH.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\UETyErX.exe
  C:\Windows\System\UETyErX.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\pOSaWOR.exe
  C:\Windows\System\pOSaWOR.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\qMIVVrI.exe
  C:\Windows\System\qMIVVrI.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\fpxOtre.exe
  C:\Windows\System\fpxOtre.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\NXUvBpS.exe
  C:\Windows\System\NXUvBpS.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\sAlFXQa.exe
  C:\Windows\System\sAlFXQa.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System\BayzeFD.exe
  C:\Windows\System\BayzeFD.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\vxORDPf.exe
  C:\Windows\System\vxORDPf.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\nzmjNmy.exe
  C:\Windows\System\nzmjNmy.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\lBROsoE.exe
  C:\Windows\System\lBROsoE.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\UUeHKxK.exe
  C:\Windows\System\UUeHKxK.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\iHKgElq.exe
  C:\Windows\System\iHKgElq.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\qFaVcLO.exe
  C:\Windows\System\qFaVcLO.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\afBiTjk.exe
  C:\Windows\System\afBiTjk.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\dACubnk.exe
  C:\Windows\System\dACubnk.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\dwygqAz.exe
  C:\Windows\System\dwygqAz.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\kboxQDT.exe
  C:\Windows\System\kboxQDT.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\BfWUYNf.exe
  C:\Windows\System\BfWUYNf.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\dQoRGal.exe
  C:\Windows\System\dQoRGal.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\nxFmDAp.exe
  C:\Windows\System\nxFmDAp.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\JtHSPUJ.exe
  C:\Windows\System\JtHSPUJ.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\lvDxVKQ.exe
  C:\Windows\System\lvDxVKQ.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\wobQxmT.exe
  C:\Windows\System\wobQxmT.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\vhJGkab.exe
  C:\Windows\System\vhJGkab.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\DOPJzIC.exe
  C:\Windows\System\DOPJzIC.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\KwVncTf.exe
  C:\Windows\System\KwVncTf.exe
  2⤵
  - Executes dropped EXE
  PID:588
- C:\Windows\System\YHGAiNM.exe
  C:\Windows\System\YHGAiNM.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\UfdhLDq.exe
  C:\Windows\System\UfdhLDq.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\HniesmG.exe
  C:\Windows\System\HniesmG.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\havApdW.exe
  C:\Windows\System\havApdW.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\zODuyra.exe
  C:\Windows\System\zODuyra.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\FLnvaSW.exe
  C:\Windows\System\FLnvaSW.exe
  2⤵
  PID:2432
- C:\Windows\System\IvcBmuY.exe
  C:\Windows\System\IvcBmuY.exe
  2⤵
  PID:2248
- C:\Windows\System\MKRRvEG.exe
  C:\Windows\System\MKRRvEG.exe
  2⤵
  PID:616
- C:\Windows\System\iISnznR.exe
  C:\Windows\System\iISnznR.exe
  2⤵
  PID:1956
- C:\Windows\System\CvuRJnS.exe
  C:\Windows\System\CvuRJnS.exe
  2⤵
  PID:3060
- C:\Windows\System\zuxCTIM.exe
  C:\Windows\System\zuxCTIM.exe
  2⤵
  PID:296
- C:\Windows\System\nMpIrhp.exe
  C:\Windows\System\nMpIrhp.exe
  2⤵
  PID:2816
- C:\Windows\System\IpZiPVD.exe
  C:\Windows\System\IpZiPVD.exe
  2⤵
  PID:1524
- C:\Windows\System\QjApHjQ.exe
  C:\Windows\System\QjApHjQ.exe
  2⤵
  PID:2800
- C:\Windows\System\HpoubfJ.exe
  C:\Windows\System\HpoubfJ.exe
  2⤵
  PID:2108
- C:\Windows\System\LSuUPrG.exe
  C:\Windows\System\LSuUPrG.exe
  2⤵
  PID:1664
- C:\Windows\System\AGiwLww.exe
  C:\Windows\System\AGiwLww.exe
  2⤵
  PID:2852
- C:\Windows\System\iuMgpsF.exe
  C:\Windows\System\iuMgpsF.exe
  2⤵
  PID:1276
- C:\Windows\System\xYsuqKU.exe
  C:\Windows\System\xYsuqKU.exe
  2⤵
  PID:1520
- C:\Windows\System\pLlkfyg.exe
  C:\Windows\System\pLlkfyg.exe
  2⤵
  PID:1432
- C:\Windows\System\VAbEuDn.exe
  C:\Windows\System\VAbEuDn.exe
  2⤵
  PID:1960
- C:\Windows\System\XMmHaJu.exe
  C:\Windows\System\XMmHaJu.exe
  2⤵
  PID:1836
- C:\Windows\System\BlJaIXb.exe
  C:\Windows\System\BlJaIXb.exe
  2⤵
  PID:2192
- C:\Windows\System\gSCeXRM.exe
  C:\Windows\System\gSCeXRM.exe
  2⤵
  PID:2612
- C:\Windows\System\rOwhPdj.exe
  C:\Windows\System\rOwhPdj.exe
  2⤵
  PID:2544
- C:\Windows\System\gCbnbcp.exe
  C:\Windows\System\gCbnbcp.exe
  2⤵
  PID:1736
- C:\Windows\System\sOalrxM.exe
  C:\Windows\System\sOalrxM.exe
  2⤵
  PID:700
- C:\Windows\System\GdPWdVG.exe
  C:\Windows\System\GdPWdVG.exe
  2⤵
  PID:2704
- C:\Windows\System\KZfuWke.exe
  C:\Windows\System\KZfuWke.exe
  2⤵
  PID:568
- C:\Windows\System\xKpwfoV.exe
  C:\Windows\System\xKpwfoV.exe
  2⤵
  PID:1772
- C:\Windows\System\tjMQRYs.exe
  C:\Windows\System\tjMQRYs.exe
  2⤵
  PID:1496
- C:\Windows\System\iHChRvt.exe
  C:\Windows\System\iHChRvt.exe
  2⤵
  PID:2724
- C:\Windows\System\OdIseMf.exe
  C:\Windows\System\OdIseMf.exe
  2⤵
  PID:792
- C:\Windows\System\qgJoAco.exe
  C:\Windows\System\qgJoAco.exe
  2⤵
  PID:2228
- C:\Windows\System\dcnACHf.exe
  C:\Windows\System\dcnACHf.exe
  2⤵
  PID:2756
- C:\Windows\System\ctaWLaF.exe
  C:\Windows\System\ctaWLaF.exe
  2⤵
  PID:332
- C:\Windows\System\UATYawQ.exe
  C:\Windows\System\UATYawQ.exe
  2⤵
  PID:1512
- C:\Windows\System\PEHXkGB.exe
  C:\Windows\System\PEHXkGB.exe
  2⤵
  PID:3044
- C:\Windows\System\XeqsWUo.exe
  C:\Windows\System\XeqsWUo.exe
  2⤵
  PID:2076
- C:\Windows\System\NpHawEY.exe
  C:\Windows\System\NpHawEY.exe
  2⤵
  PID:976
- C:\Windows\System\cvAPnbM.exe
  C:\Windows\System\cvAPnbM.exe
  2⤵
  PID:1572
- C:\Windows\System\enhWTyV.exe
  C:\Windows\System\enhWTyV.exe
  2⤵
  PID:1192
- C:\Windows\System\ztuberQ.exe
  C:\Windows\System\ztuberQ.exe
  2⤵
  PID:756
- C:\Windows\System\fIHtnOg.exe
  C:\Windows\System\fIHtnOg.exe
  2⤵
  PID:3028
- C:\Windows\System\pbRvZRK.exe
  C:\Windows\System\pbRvZRK.exe
  2⤵
  PID:2916
- C:\Windows\System\nosocGy.exe
  C:\Windows\System\nosocGy.exe
  2⤵
  PID:1416
- C:\Windows\System\rCKiZEU.exe
  C:\Windows\System\rCKiZEU.exe
  2⤵
  PID:1144
- C:\Windows\System\gjZPsBF.exe
  C:\Windows\System\gjZPsBF.exe
  2⤵
  PID:2340
- C:\Windows\System\TShSxBb.exe
  C:\Windows\System\TShSxBb.exe
  2⤵
  PID:2324
- C:\Windows\System\ifnxklx.exe
  C:\Windows\System\ifnxklx.exe
  2⤵
  PID:1968
- C:\Windows\System\gIOruyJ.exe
  C:\Windows\System\gIOruyJ.exe
  2⤵
  PID:1540
- C:\Windows\System\qAwedqW.exe
  C:\Windows\System\qAwedqW.exe
  2⤵
  PID:2892
- C:\Windows\System\FLZfHla.exe
  C:\Windows\System\FLZfHla.exe
  2⤵
  PID:2784
- C:\Windows\System\shVAbtS.exe
  C:\Windows\System\shVAbtS.exe
  2⤵
  PID:1568
- C:\Windows\System\YTAZFPf.exe
  C:\Windows\System\YTAZFPf.exe
  2⤵
  PID:2488
- C:\Windows\System\AhHiNSM.exe
  C:\Windows\System\AhHiNSM.exe
  2⤵
  PID:828
- C:\Windows\System\CxCYwVB.exe
  C:\Windows\System\CxCYwVB.exe
  2⤵
  PID:2268
- C:\Windows\System\UYVDbMC.exe
  C:\Windows\System\UYVDbMC.exe
  2⤵
  PID:2540
- C:\Windows\System\cHGBHLO.exe
  C:\Windows\System\cHGBHLO.exe
  2⤵
  PID:2952
- C:\Windows\System\rIoAGVv.exe
  C:\Windows\System\rIoAGVv.exe
  2⤵
  PID:2936
- C:\Windows\System\IfChKcd.exe
  C:\Windows\System\IfChKcd.exe
  2⤵
  PID:384
- C:\Windows\System\ErejJHb.exe
  C:\Windows\System\ErejJHb.exe
  2⤵
  PID:2052
- C:\Windows\System\hgwPPOk.exe
  C:\Windows\System\hgwPPOk.exe
  2⤵
  PID:3084
- C:\Windows\System\CzJzqlH.exe
  C:\Windows\System\CzJzqlH.exe
  2⤵
  PID:3100
- C:\Windows\System\oGCjFmZ.exe
  C:\Windows\System\oGCjFmZ.exe
  2⤵
  PID:3116
- C:\Windows\System\mvWZssO.exe
  C:\Windows\System\mvWZssO.exe
  2⤵
  PID:3132
- C:\Windows\System\ejjIpGA.exe
  C:\Windows\System\ejjIpGA.exe
  2⤵
  PID:3148
- C:\Windows\System\olmpJar.exe
  C:\Windows\System\olmpJar.exe
  2⤵
  PID:3164
- C:\Windows\System\zCiEIDb.exe
  C:\Windows\System\zCiEIDb.exe
  2⤵
  PID:3180
- C:\Windows\System\RBkurhK.exe
  C:\Windows\System\RBkurhK.exe
  2⤵
  PID:3196
- C:\Windows\System\GzfNMfa.exe
  C:\Windows\System\GzfNMfa.exe
  2⤵
  PID:3212
- C:\Windows\System\zhEEuyv.exe
  C:\Windows\System\zhEEuyv.exe
  2⤵
  PID:3228
- C:\Windows\System\ClNZNyE.exe
  C:\Windows\System\ClNZNyE.exe
  2⤵
  PID:3244
- C:\Windows\System\KioBJAf.exe
  C:\Windows\System\KioBJAf.exe
  2⤵
  PID:3260
- C:\Windows\System\byWOnKl.exe
  C:\Windows\System\byWOnKl.exe
  2⤵
  PID:3276
- C:\Windows\System\FcWNTzH.exe
  C:\Windows\System\FcWNTzH.exe
  2⤵
  PID:3292
- C:\Windows\System\rsveyIu.exe
  C:\Windows\System\rsveyIu.exe
  2⤵
  PID:3308
- C:\Windows\System\JYEdTtK.exe
  C:\Windows\System\JYEdTtK.exe
  2⤵
  PID:3324
- C:\Windows\System\gRBEuDm.exe
  C:\Windows\System\gRBEuDm.exe
  2⤵
  PID:3340
- C:\Windows\System\xPwVWve.exe
  C:\Windows\System\xPwVWve.exe
  2⤵
  PID:3356
- C:\Windows\System\HwRdIwr.exe
  C:\Windows\System\HwRdIwr.exe
  2⤵
  PID:3372
- C:\Windows\System\pomqpwQ.exe
  C:\Windows\System\pomqpwQ.exe
  2⤵
  PID:3388
- C:\Windows\System\ULULZSM.exe
  C:\Windows\System\ULULZSM.exe
  2⤵
  PID:3404
- C:\Windows\System\KCpEzDF.exe
  C:\Windows\System\KCpEzDF.exe
  2⤵
  PID:3420
- C:\Windows\System\pcYZYzc.exe
  C:\Windows\System\pcYZYzc.exe
  2⤵
  PID:3436
- C:\Windows\System\GhuJInL.exe
  C:\Windows\System\GhuJInL.exe
  2⤵
  PID:3452
- C:\Windows\System\cAELljU.exe
  C:\Windows\System\cAELljU.exe
  2⤵
  PID:3468
- C:\Windows\System\vAEOwrz.exe
  C:\Windows\System\vAEOwrz.exe
  2⤵
  PID:3484
- C:\Windows\System\SpRkJWz.exe
  C:\Windows\System\SpRkJWz.exe
  2⤵
  PID:3500
- C:\Windows\System\DbpnVyB.exe
  C:\Windows\System\DbpnVyB.exe
  2⤵
  PID:3516
- C:\Windows\System\lBLYOSj.exe
  C:\Windows\System\lBLYOSj.exe
  2⤵
  PID:3532
- C:\Windows\System\XFYDSXp.exe
  C:\Windows\System\XFYDSXp.exe
  2⤵
  PID:3548
- C:\Windows\System\FPesQWR.exe
  C:\Windows\System\FPesQWR.exe
  2⤵
  PID:3564
- C:\Windows\System\NwslzYo.exe
  C:\Windows\System\NwslzYo.exe
  2⤵
  PID:3580
- C:\Windows\System\baHhnoE.exe
  C:\Windows\System\baHhnoE.exe
  2⤵
  PID:3596
- C:\Windows\System\HPparTA.exe
  C:\Windows\System\HPparTA.exe
  2⤵
  PID:3612
- C:\Windows\System\OUwxzKi.exe
  C:\Windows\System\OUwxzKi.exe
  2⤵
  PID:3628
- C:\Windows\System\fisCxhl.exe
  C:\Windows\System\fisCxhl.exe
  2⤵
  PID:3644
- C:\Windows\System\RrBtZcy.exe
  C:\Windows\System\RrBtZcy.exe
  2⤵
  PID:3660
- C:\Windows\System\FQeuhho.exe
  C:\Windows\System\FQeuhho.exe
  2⤵
  PID:3676
- C:\Windows\System\kpLFzOr.exe
  C:\Windows\System\kpLFzOr.exe
  2⤵
  PID:3696
- C:\Windows\System\PiIpKJB.exe
  C:\Windows\System\PiIpKJB.exe
  2⤵
  PID:3712
- C:\Windows\System\YSfZEYK.exe
  C:\Windows\System\YSfZEYK.exe
  2⤵
  PID:3728
- C:\Windows\System\skevtrO.exe
  C:\Windows\System\skevtrO.exe
  2⤵
  PID:3744
- C:\Windows\System\DVBGzhH.exe
  C:\Windows\System\DVBGzhH.exe
  2⤵
  PID:3760
- C:\Windows\System\afUlFMt.exe
  C:\Windows\System\afUlFMt.exe
  2⤵
  PID:3776
- C:\Windows\System\ibpLGPg.exe
  C:\Windows\System\ibpLGPg.exe
  2⤵
  PID:3792
- C:\Windows\System\IykUjUf.exe
  C:\Windows\System\IykUjUf.exe
  2⤵
  PID:3808
- C:\Windows\System\WtORLIy.exe
  C:\Windows\System\WtORLIy.exe
  2⤵
  PID:3824
- C:\Windows\System\yHTIzTM.exe
  C:\Windows\System\yHTIzTM.exe
  2⤵
  PID:3840
- C:\Windows\System\NaFvpaH.exe
  C:\Windows\System\NaFvpaH.exe
  2⤵
  PID:3856
- C:\Windows\System\EtLBuks.exe
  C:\Windows\System\EtLBuks.exe
  2⤵
  PID:3872
- C:\Windows\System\eIQWDyM.exe
  C:\Windows\System\eIQWDyM.exe
  2⤵
  PID:3888
- C:\Windows\System\DQEUVVV.exe
  C:\Windows\System\DQEUVVV.exe
  2⤵
  PID:3904
- C:\Windows\System\fqfFjDv.exe
  C:\Windows\System\fqfFjDv.exe
  2⤵
  PID:3920
- C:\Windows\System\pDGpbFt.exe
  C:\Windows\System\pDGpbFt.exe
  2⤵
  PID:3936
- C:\Windows\System\LfnHwvC.exe
  C:\Windows\System\LfnHwvC.exe
  2⤵
  PID:3952
- C:\Windows\System\LyCIaQR.exe
  C:\Windows\System\LyCIaQR.exe
  2⤵
  PID:3972
- C:\Windows\System\lpfcqbF.exe
  C:\Windows\System\lpfcqbF.exe
  2⤵
  PID:3988
- C:\Windows\System\WiRyzAc.exe
  C:\Windows\System\WiRyzAc.exe
  2⤵
  PID:4004
- C:\Windows\System\vhSkVxB.exe
  C:\Windows\System\vhSkVxB.exe
  2⤵
  PID:4020
- C:\Windows\System\oKgvkxo.exe
  C:\Windows\System\oKgvkxo.exe
  2⤵
  PID:4036
- C:\Windows\System\HVaQljF.exe
  C:\Windows\System\HVaQljF.exe
  2⤵
  PID:4052
- C:\Windows\System\qXjijTf.exe
  C:\Windows\System\qXjijTf.exe
  2⤵
  PID:4068
- C:\Windows\System\KYlILCQ.exe
  C:\Windows\System\KYlILCQ.exe
  2⤵
  PID:4084
- C:\Windows\System\eTbABqy.exe
  C:\Windows\System\eTbABqy.exe
  2⤵
  PID:2524
- C:\Windows\System\QIxrHcT.exe
  C:\Windows\System\QIxrHcT.exe
  2⤵
  PID:4104
- C:\Windows\System\WlLETQN.exe
  C:\Windows\System\WlLETQN.exe
  2⤵
  PID:4120
- C:\Windows\System\UpzvipS.exe
  C:\Windows\System\UpzvipS.exe
  2⤵
  PID:4136
- C:\Windows\System\qpBlqpA.exe
  C:\Windows\System\qpBlqpA.exe
  2⤵
  PID:4152
- C:\Windows\System\uqGnxxy.exe
  C:\Windows\System\uqGnxxy.exe
  2⤵
  PID:4168
- C:\Windows\System\myUBNzg.exe
  C:\Windows\System\myUBNzg.exe
  2⤵
  PID:4184
- C:\Windows\System\IQohqCM.exe
  C:\Windows\System\IQohqCM.exe
  2⤵
  PID:4200
- C:\Windows\System\VLlPCKs.exe
  C:\Windows\System\VLlPCKs.exe
  2⤵
  PID:4216
- C:\Windows\System\auQnOMF.exe
  C:\Windows\System\auQnOMF.exe
  2⤵
  PID:4232
- C:\Windows\System\jkTTYWS.exe
  C:\Windows\System\jkTTYWS.exe
  2⤵
  PID:4248
- C:\Windows\System\XFRAcjz.exe
  C:\Windows\System\XFRAcjz.exe
  2⤵
  PID:4264
- C:\Windows\System\jvxfRcp.exe
  C:\Windows\System\jvxfRcp.exe
  2⤵
  PID:4280
- C:\Windows\System\wWwaOMZ.exe
  C:\Windows\System\wWwaOMZ.exe
  2⤵
  PID:4296
- C:\Windows\System\xVLhrYW.exe
  C:\Windows\System\xVLhrYW.exe
  2⤵
  PID:4312
- C:\Windows\System\LNsmInq.exe
  C:\Windows\System\LNsmInq.exe
  2⤵
  PID:4328
- C:\Windows\System\HEGKZoo.exe
  C:\Windows\System\HEGKZoo.exe
  2⤵
  PID:4344
- C:\Windows\System\nWSpUTf.exe
  C:\Windows\System\nWSpUTf.exe
  2⤵
  PID:4364
- C:\Windows\System\fjUjUsZ.exe
  C:\Windows\System\fjUjUsZ.exe
  2⤵
  PID:4380
- C:\Windows\System\yWtHbSt.exe
  C:\Windows\System\yWtHbSt.exe
  2⤵
  PID:4396
- C:\Windows\System\VsKjawl.exe
  C:\Windows\System\VsKjawl.exe
  2⤵
  PID:4412
- C:\Windows\System\CtOgzQk.exe
  C:\Windows\System\CtOgzQk.exe
  2⤵
  PID:4428
- C:\Windows\System\BaluYfu.exe
  C:\Windows\System\BaluYfu.exe
  2⤵
  PID:4444
- C:\Windows\System\YVsgquC.exe
  C:\Windows\System\YVsgquC.exe
  2⤵
  PID:4460
- C:\Windows\System\VifbNXH.exe
  C:\Windows\System\VifbNXH.exe
  2⤵
  PID:4476
- C:\Windows\System\MZnrGLi.exe
  C:\Windows\System\MZnrGLi.exe
  2⤵
  PID:4492
- C:\Windows\System\ZZrggGA.exe
  C:\Windows\System\ZZrggGA.exe
  2⤵
  PID:4508
- C:\Windows\System\VXvpRme.exe
  C:\Windows\System\VXvpRme.exe
  2⤵
  PID:4524
- C:\Windows\System\AFOiDBJ.exe
  C:\Windows\System\AFOiDBJ.exe
  2⤵
  PID:4540
- C:\Windows\System\GZFAgCe.exe
  C:\Windows\System\GZFAgCe.exe
  2⤵
  PID:4556
- C:\Windows\System\ZKzSHii.exe
  C:\Windows\System\ZKzSHii.exe
  2⤵
  PID:4572
- C:\Windows\System\yKTthUE.exe
  C:\Windows\System\yKTthUE.exe
  2⤵
  PID:4588
- C:\Windows\System\IvQrCOr.exe
  C:\Windows\System\IvQrCOr.exe
  2⤵
  PID:4604
- C:\Windows\System\YeeJlEq.exe
  C:\Windows\System\YeeJlEq.exe
  2⤵
  PID:4620
- C:\Windows\System\BjZLjpy.exe
  C:\Windows\System\BjZLjpy.exe
  2⤵
  PID:4636
- C:\Windows\System\eqCfNhs.exe
  C:\Windows\System\eqCfNhs.exe
  2⤵
  PID:4652
- C:\Windows\System\SaryDdj.exe
  C:\Windows\System\SaryDdj.exe
  2⤵
  PID:4668
- C:\Windows\System\BSVuOcB.exe
  C:\Windows\System\BSVuOcB.exe
  2⤵
  PID:4684
- C:\Windows\System\YOmpsIs.exe
  C:\Windows\System\YOmpsIs.exe
  2⤵
  PID:4700
- C:\Windows\System\zQnVXzH.exe
  C:\Windows\System\zQnVXzH.exe
  2⤵
  PID:4716
- C:\Windows\System\jIHHymh.exe
  C:\Windows\System\jIHHymh.exe
  2⤵
  PID:4732
- C:\Windows\System\nzhlmFe.exe
  C:\Windows\System\nzhlmFe.exe
  2⤵
  PID:4748
- C:\Windows\System\YyKUkcr.exe
  C:\Windows\System\YyKUkcr.exe
  2⤵
  PID:4764
- C:\Windows\System\CXMFKcR.exe
  C:\Windows\System\CXMFKcR.exe
  2⤵
  PID:4780
- C:\Windows\System\VhnbMmB.exe
  C:\Windows\System\VhnbMmB.exe
  2⤵
  PID:4796
- C:\Windows\System\FwasfZM.exe
  C:\Windows\System\FwasfZM.exe
  2⤵
  PID:4812
- C:\Windows\System\TysNLte.exe
  C:\Windows\System\TysNLte.exe
  2⤵
  PID:4828
- C:\Windows\System\iNnZmen.exe
  C:\Windows\System\iNnZmen.exe
  2⤵
  PID:4844
- C:\Windows\System\qBkBwVB.exe
  C:\Windows\System\qBkBwVB.exe
  2⤵
  PID:4860
- C:\Windows\System\lwPnxXb.exe
  C:\Windows\System\lwPnxXb.exe
  2⤵
  PID:4876
- C:\Windows\System\UnJvfwH.exe
  C:\Windows\System\UnJvfwH.exe
  2⤵
  PID:4892
- C:\Windows\System\lRpuPZn.exe
  C:\Windows\System\lRpuPZn.exe
  2⤵
  PID:4908
- C:\Windows\System\zSjaZJT.exe
  C:\Windows\System\zSjaZJT.exe
  2⤵
  PID:4924
- C:\Windows\System\OYeFluL.exe
  C:\Windows\System\OYeFluL.exe
  2⤵
  PID:4940
- C:\Windows\System\tgvXBrR.exe
  C:\Windows\System\tgvXBrR.exe
  2⤵
  PID:4956
- C:\Windows\System\bmlGQEy.exe
  C:\Windows\System\bmlGQEy.exe
  2⤵
  PID:4972
- C:\Windows\System\ivvgcxC.exe
  C:\Windows\System\ivvgcxC.exe
  2⤵
  PID:4988
- C:\Windows\System\BoQNHSc.exe
  C:\Windows\System\BoQNHSc.exe
  2⤵
  PID:5004
- C:\Windows\System\dkNhLIf.exe
  C:\Windows\System\dkNhLIf.exe
  2⤵
  PID:5020
- C:\Windows\System\gBmJgzT.exe
  C:\Windows\System\gBmJgzT.exe
  2⤵
  PID:5036
- C:\Windows\System\PxSpMxP.exe
  C:\Windows\System\PxSpMxP.exe
  2⤵
  PID:5052
- C:\Windows\System\aiuoFtb.exe
  C:\Windows\System\aiuoFtb.exe
  2⤵
  PID:5068
- C:\Windows\System\Yfqjkug.exe
  C:\Windows\System\Yfqjkug.exe
  2⤵
  PID:5084
- C:\Windows\System\WGmLJQc.exe
  C:\Windows\System\WGmLJQc.exe
  2⤵
  PID:5100
- C:\Windows\System\UIqGDjX.exe
  C:\Windows\System\UIqGDjX.exe
  2⤵
  PID:5116
- C:\Windows\System\OBhiotv.exe
  C:\Windows\System\OBhiotv.exe
  2⤵
  PID:5128
- C:\Windows\System\KOxiCQv.exe
  C:\Windows\System\KOxiCQv.exe
  2⤵
  PID:5144
- C:\Windows\System\IXJPGmt.exe
  C:\Windows\System\IXJPGmt.exe
  2⤵
  PID:5160
- C:\Windows\System\UQQXwxC.exe
  C:\Windows\System\UQQXwxC.exe
  2⤵
  PID:5176
- C:\Windows\System\qlimoBS.exe
  C:\Windows\System\qlimoBS.exe
  2⤵
  PID:5192
- C:\Windows\System\ukZXNHT.exe
  C:\Windows\System\ukZXNHT.exe
  2⤵
  PID:5208
- C:\Windows\System\cMxRBtX.exe
  C:\Windows\System\cMxRBtX.exe
  2⤵
  PID:5224
- C:\Windows\System\NpMjIwC.exe
  C:\Windows\System\NpMjIwC.exe
  2⤵
  PID:5240
- C:\Windows\System\cWJwMMR.exe
  C:\Windows\System\cWJwMMR.exe
  2⤵
  PID:5256
- C:\Windows\System\beATAsd.exe
  C:\Windows\System\beATAsd.exe
  2⤵
  PID:5272
- C:\Windows\System\AVWoRts.exe
  C:\Windows\System\AVWoRts.exe
  2⤵
  PID:5288
- C:\Windows\System\bxpsmcp.exe
  C:\Windows\System\bxpsmcp.exe
  2⤵
  PID:5304
- C:\Windows\System\aVjEOpx.exe
  C:\Windows\System\aVjEOpx.exe
  2⤵
  PID:5320
- C:\Windows\System\nDzjPaf.exe
  C:\Windows\System\nDzjPaf.exe
  2⤵
  PID:5336
- C:\Windows\System\uEMLDFb.exe
  C:\Windows\System\uEMLDFb.exe
  2⤵
  PID:5352
- C:\Windows\System\sJxLlJU.exe
  C:\Windows\System\sJxLlJU.exe
  2⤵
  PID:5368
- C:\Windows\System\EppAKSV.exe
  C:\Windows\System\EppAKSV.exe
  2⤵
  PID:5384
- C:\Windows\System\xiNmXfz.exe
  C:\Windows\System\xiNmXfz.exe
  2⤵
  PID:5400
- C:\Windows\System\tLbykuS.exe
  C:\Windows\System\tLbykuS.exe
  2⤵
  PID:5416
- C:\Windows\System\MyZbDLb.exe
  C:\Windows\System\MyZbDLb.exe
  2⤵
  PID:5432
- C:\Windows\System\tTBJujq.exe
  C:\Windows\System\tTBJujq.exe
  2⤵
  PID:5448
- C:\Windows\System\XnsPMst.exe
  C:\Windows\System\XnsPMst.exe
  2⤵
  PID:5464
- C:\Windows\System\FhXqdNa.exe
  C:\Windows\System\FhXqdNa.exe
  2⤵
  PID:5480
- C:\Windows\System\AyWGgZi.exe
  C:\Windows\System\AyWGgZi.exe
  2⤵
  PID:5496
- C:\Windows\System\HLUNvqN.exe
  C:\Windows\System\HLUNvqN.exe
  2⤵
  PID:5512
- C:\Windows\System\QuLeZnw.exe
  C:\Windows\System\QuLeZnw.exe
  2⤵
  PID:5528
- C:\Windows\System\olnNbSo.exe
  C:\Windows\System\olnNbSo.exe
  2⤵
  PID:5544
- C:\Windows\System\bhecyvn.exe
  C:\Windows\System\bhecyvn.exe
  2⤵
  PID:5560
- C:\Windows\System\DsFQPOc.exe
  C:\Windows\System\DsFQPOc.exe
  2⤵
  PID:5584
- C:\Windows\System\KdNtQTU.exe
  C:\Windows\System\KdNtQTU.exe
  2⤵
  PID:5624
- C:\Windows\System\tUEBPpt.exe
  C:\Windows\System\tUEBPpt.exe
  2⤵
  PID:5988
- C:\Windows\System\AOsGRJB.exe
  C:\Windows\System\AOsGRJB.exe
  2⤵
  PID:1076
- C:\Windows\System\qUsejUB.exe
  C:\Windows\System\qUsejUB.exe
  2⤵
  PID:8108
- C:\Windows\System\VErDrjB.exe
  C:\Windows\System\VErDrjB.exe
  2⤵
  PID:9732
- C:\Windows\System\vaOhqOA.exe
  C:\Windows\System\vaOhqOA.exe
  2⤵
  PID:18448
- C:\Windows\System\FHxyGtl.exe
  C:\Windows\System\FHxyGtl.exe
  2⤵
  PID:19268
- C:\Windows\System\rZKNtxH.exe
  C:\Windows\System\rZKNtxH.exe
  2⤵
  PID:5412
- C:\Windows\System\oLPqQUI.exe
  C:\Windows\System\oLPqQUI.exe
  2⤵
  PID:5580
- C:\Windows\System\nWTCIES.exe
  C:\Windows\System\nWTCIES.exe
  2⤵
  PID:3608
- C:\Windows\System\CHWnAkq.exe
  C:\Windows\System\CHWnAkq.exe
  2⤵
  PID:5660
- C:\Windows\System\xHNNDYD.exe
  C:\Windows\System\xHNNDYD.exe
  2⤵
  PID:5724
- C:\Windows\System\ONjLJET.exe
  C:\Windows\System\ONjLJET.exe
  2⤵
  PID:5896
- C:\Windows\System\qUbrxTT.exe
  C:\Windows\System\qUbrxTT.exe
  2⤵
  PID:18088

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ApKbnlP.exe

Filesize
2.1MB

MD5
a508e2b071a16dba1790fa17839047a5

SHA1
e03d97da88de8da96b7d6e983d679c9c1c6e54f4

SHA256
57ef5ce2adcdff66659c8eea02848e9b18eff886a3801e0f7f878bb3342db73e

SHA512
3a6a18457baf11e3951dc0e7426387416c3149b3e318f232f93ca8880856c7f4fd5aed2ca158f8b62918b4f8696fd30878fecd89f6958a58245a2a9728953686

Download Submit
C:\Windows\system\AvSMBqt.exe

Filesize
2.1MB

MD5
4eac95da7a83240bfd15920fe8cc0c21

SHA1
2d43588f97c11eba79af4b6d09f980c78be44c69

SHA256
da48fe4e977fb69fe0c0649620039a4626f15d5b9198e5d21fddb3668f8df79c

SHA512
460c3293f550ae8618910cba3f2bb4660916ea48b2a0984472481f9a8dd6f9f6103f87f43b017b72f74964e891d4e2a28d7f208185de3d085d80afc5c4ae2661

Download Submit
C:\Windows\system\EzSwUuA.exe

Filesize
2.1MB

MD5
65990f481d3cea84f8fe22c23c62bba0

SHA1
7eb228e04faab36abbaf7dab34ffd27876519af1

SHA256
a03353c734b96d9f6a7425a8c40e2ebdbadcf7fbcebf3774d27849ea424c67c1

SHA512
4ba7ad5bd435ab3318893abf6d09aff5e7080179319cfaa849c71b06b52cba1f69f97b51515914b03774fddda27b88f80c2290a4c9ee1260bae6f47ff4539942

Download Submit
C:\Windows\system\IfwVmRV.exe

Filesize
2.1MB

MD5
e2cc716e33490aa437fb51198a8a8d45

SHA1
ab75b23aeb2324278e03166a593a4406189b60fe

SHA256
ff5f158419a4e22b147957769ee82d38515f379649db25132526156c7a4c0bf8

SHA512
8c963ff1a517061f01c03c22afabdefa2221897499fe18f0ba62b83108e1e6ebd76382e0e8eb97b617f179f009f0c06bde27fc771116b4d01cce2237af36666d

Download Submit
C:\Windows\system\KYrohba.exe

Filesize
2.1MB

MD5
a919d5aef0c3a1b1f546477a1a0f59b6

SHA1
6df97deff68b5585152ea28c5919766fa2e61075

SHA256
fffd72b8207687ac92fb1f39030d7d632b854a093c257d01f60b2862d2acc1fb

SHA512
934e763b655b1a5582be45fd276408691a10f9a04bd3bc07dbfdb7b8535f7c2b76a18460250700ad07e28fe0661cc3746d5b75b5ce328676c319d99eacf5daac

Download Submit
C:\Windows\system\LCLpzbc.exe

Filesize
2.1MB

MD5
c4c4c3604554ad574ad9a5ee6f46ca7e

SHA1
ee5f34ddc14ef985de033f6db16e5ac3221e472c

SHA256
9dc1c8bd5870157908f6f0e715b6b5cbe9223eb595d1dd7a84818dd57800acb0

SHA512
601608eed2deee98f5c9ae3e0b80f0e26ab0d9f61e2f9e4c3fabda2805620ab8f62ca6b4f5d0b8f4beda166b7598d2680af0e96fd72c5379a7e6e0d21a5b62c1

Download Submit
C:\Windows\system\OuGioDj.exe

Filesize
2.1MB

MD5
22d48c32fe9c5ee8a4274f7a49f1d6e8

SHA1
9742e22f38e00bb70df14280a2a1f7c350fd7c8d

SHA256
713b1d19a5f684b76adeda9f5ba8a17294de8bda60e9c7352d3b8f944af66108

SHA512
864ee45e266fcab735a7e10f488aa7d203e816a039761facadf3e9c95e8ad2b1592d72a48ea599d79e2802b619cb9de8370ad93ba2b614047886731d8f604207

Download Submit
C:\Windows\system\OytXMnw.exe

Filesize
2.1MB

MD5
8fae405e39c9b27c1eb969ae004fd146

SHA1
874b3a5c8f3af880857ab8f55c0590850c51cc1c

SHA256
63bf89d643ca816a7fa15d53568e1dc09c67d13eb1e2cfc9163d2f3242bf7731

SHA512
d393c669bb35f639930bd092fb64883822c4d20c080df8292f8e301210c18e7670c6e5404dc7560f251a3faae093ef56c3aaea071a27d81da1bc01b91e2e9fe2

Download Submit
C:\Windows\system\RCcTSFF.exe

Filesize
2.1MB

MD5
16d8605b15d78a102be74b9eb21f19eb

SHA1
be89316a2ab53412f718bca9c78a46cbce9f2901

SHA256
ac79f04c84be2a0e6960a8660f9edfc154bc2e9f5372facf31da1a24a5d781f2

SHA512
ed005ecd1871fd44752f185e7dbdbf833ba1555a7a7b1c71df23310a25f8e0c3b9af7e37b76750e04ced6daa269a560b785215a59b9f5a098d2d5cfbf8f53035

Download Submit
C:\Windows\system\RNUuHQV.exe

Filesize
2.1MB

MD5
949ded1403af2eacdaee1be166ea24b6

SHA1
00985ed88cae2d709121af4e0f3495f7f52b9e35

SHA256
2fbacab5c5dbee18824dc69402c92d5910b3a77b8b4a7812d963974d97ecc1cc

SHA512
b79edf76cb104e0e9a01cb12a6cc4ceb367465db1cd4a029459403d2cf34522a6789c08723263a997b6121a487cdcdba9fe1f95b005bc97d150bb24937313cba

Download Submit
C:\Windows\system\VAwztJs.exe

Filesize
2.1MB

MD5
3f0dc54580f623214db8271a75ff7fab

SHA1
133f3aba1330b01e841c0a0cf3a73c2e3fb91d24

SHA256
6ee653a8ba77dc25963ff2ca63c9a3bd0191fd07ede95677bea39845b5d01bcd

SHA512
00ecd9832cbd2052f0df119f448f44e06053918ef839d93fd11321a117a3bc7e12b57559e1b4728f78d74ad6c9659e31accb2dbc4b06648f6b3a73cf5928e315

Download Submit
C:\Windows\system\WSjgJYG.exe

Filesize
2.1MB

MD5
9c81185c21b4281a396f0b371d0a7ffa

SHA1
bfa76043fd9a90952073c826cab8a88fa9108f41

SHA256
f221374205f8d242ac3bd09b7a95e80cc4bfae1c37cfb2bcd41dff70e98cc6a4

SHA512
1a16b4ae54334b185cb3701c37e4f6ae85d3b45fb90636df25d010c6bb883f83939c651e672b45310f0b2ca223f16416421f81eabebbb3c06d3b0fc0dff0eac6

Download Submit
C:\Windows\system\WWNygdC.exe

Filesize
2.1MB

MD5
98a49005025d8dcf41d6559dbf2dc982

SHA1
1b954a0ed135ba8b7ad7ff95143e5ac429dccbd2

SHA256
b5d559649dea28493533698bdef7a346e4c0a4c528c36d8cffe9c6943ec0ac2e

SHA512
ee705808155c6c452e201b2f41167a78b6254f572abfbb49d299423ec1ec988876b17cf76dac983b500d6022a7341e4ea78dc8d13e8671e370ab743fa6d7be61

Download Submit
C:\Windows\system\XFwuMwb.exe

Filesize
2.1MB

MD5
af6d9b2c1c29465848fd7334f80d29c8

SHA1
05162e0600d5b7722d6aede87663e48bcce15f77

SHA256
1ff5fcfc6032a09799ad29d990b203d89a7d339f41076224089e85554dd2c413

SHA512
16ee9d36c5021330071222b2d4c27c001af3ffc7ad015f66f262ee089e9fbf31b6a4ab908ad30ad12ee344eebfb77824f758be61bc2efdacb33d851f7ce3a7ba

Download Submit
C:\Windows\system\eTfPzss.exe

Filesize
2.1MB

MD5
aa7719fc3baeef29eadd105a742e40ac

SHA1
e43ce6e81368d0e5c7bcb333b11eaabcffeee4f5

SHA256
f8b358e23f7b78930d8a70f22c5895c9c7bf87e9350f06665b979779d63568c4

SHA512
8078ffc0f88be22ffae26e1467357420caca4c43129e42ff0dc399ca0404e1c95ea8913ef7215602b0aff4ff0dc67758e72bcb568bb8052822153b3c75a82fd3

Download Submit
C:\Windows\system\mOjYtdt.exe

Filesize
2.1MB

MD5
451f5100c86b19fd9c34199a8137e3fe

SHA1
5f678fe0cf5074827c1dc5f36c3791c40e8a5367

SHA256
2b54f51a1ad97e27b06911645d3023b4d740ada85f34856b712617048ee4db13

SHA512
c448188bad1c17acafb410225b93dea30f3c64fa1de8dafdf8ab4c06ac0c107f91915077b45ca80e427cfa6038f02209a29985017a5f18186f9955a72df3d5a9

Download Submit
C:\Windows\system\tbRSIlS.exe

Filesize
2.1MB

MD5
3fc4504c17dee752e9ace33960415df7

SHA1
b1b2ba10782c53c6458d6c66613dd45871827c7a

SHA256
f7b66814d45370783676a0d0e77114f42d3aa635fb29fa78d75d60945ee9c33a

SHA512
a81d8037f4aa3639cd1847fa2700f8e947c4f83035438b1bed3f420e4937dcfaaa5ec53f4b3649871c0e63b49b2411371aa2b15edc9e9e685867f530bfc104a8

Download Submit
C:\Windows\system\xQlPQnX.exe

Filesize
2.1MB

MD5
a8f416505d58d511875abd410b9c32f5

SHA1
b830c10e119066925e603eb43fd0dca991d02894

SHA256
54ca34f2d636308b9264a955c395bb95458a9cfa81830e00808d40cf365863ef

SHA512
17acb96685106766f58f953cbab2ac3a6f34c643bd0968018791a5234cfb03a9df1f8eb62c38647677f50b1fe5aac49fb4d4f70ce291aaf48b16168982fb891f

Download Submit
C:\Windows\system\xWAqilA.exe

Filesize
2.1MB

MD5
ea12c6872935e11c272091caf0ae9e0c

SHA1
5f45042416043e81c18c0e192690937df8dbe93a

SHA256
b817e5865303f3b29ab648415e0bd2b2ffbf82645c2a4672a7a8aa219033673a

SHA512
767d9604b321ed258230ff306559e35c58452b86473fab2c818c05ced4e0ef2c1352a338b1971ad31ddfd680662993304b12badd2065501aa9a29f67d6472903

Download Submit
\Windows\system\BayzeFD.exe

Filesize
2.1MB

MD5
73ceac9e02f4075db9d90472992a4966

SHA1
632abbaa4e2d761bdab3b8e882053f40f4f5ad52

SHA256
84a60781e52311ddf683e6c4b8685fcc83de83ec4986c169d8c81dc776c1037a

SHA512
f5d749f2867fbf7c5b5c3cdc5769c5d064373425c13127f5014b40895343eb3830ee8133cd7d02a6e6321acb1ac736c41d77e0a8ee497bd3f12755a3a6b032ac

Download Submit
\Windows\system\CChIRrz.exe

Filesize
2.1MB

MD5
47df9058edd9e0d8f98e1f855b26813a

SHA1
c3a4f489f72c6b26141580f35849b85127267ffd

SHA256
2d10ddb0aa1af3328346471c066c09805b1d42bc86e7dbcc62854586763e80ad

SHA512
6849457e123076897a663d4a6b9d15f65dd162b3d643cbd4b4f7f9c05164a0a30fbccf5ba79427ee2937558000a22023977d89b77b38fecae03a41943cf815db

Download Submit
\Windows\system\GwOlGOJ.exe

Filesize
2.1MB

MD5
47488f22ff7887028e0c75a648cb7271

SHA1
eae01b995c5759f069236e7405b09ea832a34c41

SHA256
06844dacae8b59e969ac653c821f905846fcc9932e38a2b5b5c394e86617dc47

SHA512
73e640da49059d8c5d10d923e4af7f5e47ba49566b946322d13697b76f094226df9b2f08f9eb7e26d77e2c6f3b12e5b473fcb849c70fbf33403c9df8e57fdfad

Download Submit
\Windows\system\HrNpxpH.exe

Filesize
2.1MB

MD5
13e6cc6bf9a0c91a774f84d2ffc1752d

SHA1
5ce74b9377ece7e76ffd2975dfbfdcfd91f10c88

SHA256
c11abb13d19f09050a9934d203213412aee61970884783dbb69a9fd32bba0037

SHA512
4ab891d4e671a54514d92e9b9e2682d3a59267f3e962c0fd3efb55de5b483078329da338c20e31d44b5febd3cacb6e43b3afd6f9840c361010da8ff01d524ccf

Download Submit
\Windows\system\NXUvBpS.exe

Filesize
2.1MB

MD5
b3be85af6c58a3e2400f41d78220ba6e

SHA1
96ebe13e0fd4794744610472ff28cf32fdc95c75

SHA256
8afa9dcb7dc17234d1a57d52012ae33df46606664cc4ed2a2588a59a81c0d20e

SHA512
fabf340ef9e854b257175bea969f266e1627725807cab83d24fa33ef1d92165143c44819601e627dd3da524c59b873c2061a2d4fc91c6213892184ea8f2b42ac

Download Submit
\Windows\system\ORUaZjF.exe

Filesize
2.1MB

MD5
eecd979623e3ee970e84358355eb99e6

SHA1
85c60c22b3dfccd149b8e6842bbd1b5167915df2

SHA256
d55ab6378b407ce49755b302870b374b96c3b9d459363117978227770b90f3d0

SHA512
887bad8f0e2be4b4aaa49f619df73c2e8306e5f180a19e9e79a605857732f2d9551cab426c8142fcfe8127bd42b471613963d2f0d4748eaea72907d933315d7a

Download Submit
\Windows\system\UETyErX.exe

Filesize
2.1MB

MD5
a1eaa83b67e305e35c427bc5669c3fa9

SHA1
bad7a4d5017c64a3f5928f5ad912a4bc120f862c

SHA256
a1d5fee650a7b45bf0b93821ffd2ad031b22151e7ee83e121ba62a15fa11396c

SHA512
22a1ac372b225f9975eea011a406b192a6175d06358a21379dd8ea22610f001c2d02aa01874cce699a18689db7f98013af174362a702e5d88a7e8bad7b72eb60

Download Submit
\Windows\system\ZVnKxWJ.exe

Filesize
2.1MB

MD5
d75cb288381a10524465e7cf84503695

SHA1
b6a3dd9ef672e230806c041253dc43a01fe85cf6

SHA256
439b176592cf3beafd241dfbb2e4c4c28c0f3e4c8e8074e78a6b78b36dd955f1

SHA512
0f73443299282d80d6f4400e086b69e5f02e2547e97aad3351395b6e661c61418f4c51da3c43edfca0f51e8da832ab089bc171726b7118f31ec72630b69719c9

Download Submit
\Windows\system\fpxOtre.exe

Filesize
2.1MB

MD5
a45f8f60eafcc2033f3fb133bcd7af49

SHA1
bb83cb57b5bcb774bc341acbe2cb1cf915ad2ff9

SHA256
a8a9e6d334a2edf0254b42aade3f30364a6c86a87a2d18db2d31d952e76a6260

SHA512
df1160a196cc4b51a0a2304ddc98fca476d33b8155233f41192baa85973e536376d1722823ecd7dcf3471bf4cffbc30dc0e0237d79c45843d9dc8862420bc259

Download Submit
\Windows\system\pOSaWOR.exe

Filesize
2.1MB

MD5
5185ab9403ff96519727f40da68bec67

SHA1
71ce64be7cdfb47513b05342ac663d683eba9bdf

SHA256
9f11b395ab8916ef62c762d46bb24b1b76d8693255b50d00600d5584546b00a4

SHA512
eaeb2fdbb07b1c717364961b7172387a360b0c7f245a886a15cf5ca8ed4127d7a908308d905a5c3573f08d01c6571620c661aad29af843a8b9c3f00c9af9db42

Download Submit
\Windows\system\qMIVVrI.exe

Filesize
2.1MB

MD5
f1533312cf81fddaa8f7485efe9006ec

SHA1
63b86e6750c3eea3ac6049549b7177482410db39

SHA256
58558d6a74d601635864b5790ec33d4e7b0d6946a7caf1134adcc0aa7739f4bf

SHA512
c08ac8d57ce4fe22ff9767b6ccccbff17543c1c40bb1f2d3fdeab9c1b55781e5d0da8e47637f3cf4130491d538db30bbbc6e3231762b0da1cdda433aa620fe91

Download Submit
\Windows\system\qzWWEtJ.exe

Filesize
2.1MB

MD5
3a61812fb3a967f69268ffdc8427a2fa

SHA1
e5811cf5341571a0ffcffe58de4af2d5452322b4

SHA256
ac0fbf2db383861e7b607266b993582f73235b34a18985433b0a63f2dc1c8199

SHA512
b25b7e58fdf054df8d82aed98f711e41df7c465d072d1f1637c2b632305f0a25c5df748086e98cd0786a8326005fbcfa8af080752f7f0006992ab1f14ef8ba38

Download Submit
\Windows\system\rGXWEkH.exe

Filesize
2.1MB

MD5
66665019417408ec1eb9f06163b59483

SHA1
f5043fa9fb7a0ae666cab160a031a6219b9bf9a7

SHA256
623dc9dbd0dcc9624283a468d821bf9b71d0a95f02aab180be525960319df0e7

SHA512
3fde58b33405a5d8b7d1603bcb68c37d52ef958d14cac0d8f7c0ee80b8786d7734929d10e8d06f6d52038bf64c91fa15c8de28b67b0032581148ed28662802c5

Download Submit
\Windows\system\sAlFXQa.exe

Filesize
2.1MB

MD5
dfc2683ebba466732bd10473b2eb5c6c

SHA1
53ae40a1dd5f6a62d8c2718d4216a147840203f5

SHA256
169a84f800b23e53574de3dc32ed0a34817d3940b3a95de7a5d6821f3d45bf52

SHA512
c96b9c1fe190e1699a0aa3229fe246ba511f56ed824c88c154c0969cc3e59499858f2315706b09ed61f39eb81721f01d4f8a0eda3a51c3f589e5fa101846a468

Download Submit
\Windows\system\srkoaTs.exe

Filesize
2.1MB

MD5
e1f40ebe327eef1af104605d343168f6

SHA1
4f04a1bc64c0f03b6b29ed921dfac471690319e3

SHA256
35c9e5c3c0b8f2268065b3f6750d30144b6c5a36166fb31ec1657efefa04d323

SHA512
eecb3a48597becbbbd2ca9ea1952d8952c8b3921bb06d7fe9ab42516ffe77f54c3468978935947a8113eb017f34f921f0c2866f22f3a0499c921d0c17475486a

Download Submit
\Windows\system\wnxmJvO.exe

Filesize
2.1MB

MD5
e5434fcd5a39c8ebd8d456374d83d1b0

SHA1
59f184dd99c2e2e1f278ccf2c341d98fe8d93b9e

SHA256
fc8ae4a1e25a9228177684dc0513fc8034c981a37afe481744c735565792098e

SHA512
6b2da8cd95072a26c10052eaec12e5e94e34776a9a23103b0cfdd7520c03aaf88122b266dda18a53c9ea39516dacab00ee70bb6805b1bdfc111bd8b2ff99520d

Download Submit
memory/348-177-0x000000013F300000-0x000000013F6F2000-memory.dmp

Filesize
3.9MB

Download
memory/348-345-0x000000013F300000-0x000000013F6F2000-memory.dmp

Filesize
3.9MB

Download
memory/628-365-0x000000013F5E0000-0x000000013F9D2000-memory.dmp

Filesize
3.9MB

Download
memory/628-186-0x000000013F5E0000-0x000000013F9D2000-memory.dmp

Filesize
3.9MB

Download
memory/772-358-0x000000013FC70000-0x0000000140062000-memory.dmp

Filesize
3.9MB

Download
memory/772-185-0x000000013FC70000-0x0000000140062000-memory.dmp

Filesize
3.9MB

Download
memory/1436-359-0x000000013F920000-0x000000013FD12000-memory.dmp

Filesize
3.9MB

Download
memory/1436-187-0x000000013F920000-0x000000013FD12000-memory.dmp

Filesize
3.9MB

Download
memory/1452-363-0x000000013F560000-0x000000013F952000-memory.dmp

Filesize
3.9MB

Download
memory/1452-188-0x000000013F560000-0x000000013F952000-memory.dmp

Filesize
3.9MB

Download
memory/1560-176-0x000000013F370000-0x000000013F762000-memory.dmp

Filesize
3.9MB

Download
memory/1560-341-0x000000013F370000-0x000000013F762000-memory.dmp

Filesize
3.9MB

Download
memory/1576-357-0x000000013F9F0000-0x000000013FDE2000-memory.dmp

Filesize
3.9MB

Download
memory/1576-178-0x000000013F9F0000-0x000000013FDE2000-memory.dmp

Filesize
3.9MB

Download
memory/1620-163-0x000000013FA60000-0x000000013FE52000-memory.dmp

Filesize
3.9MB

Download
memory/1620-343-0x000000013FA60000-0x000000013FE52000-memory.dmp

Filesize
3.9MB

Download
memory/1652-142-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/1652-36-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/1652-195-0x000000013FA20000-0x000000013FE12000-memory.dmp

Filesize
3.9MB

Download
memory/1652-196-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/1652-298-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/1652-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/1652-23-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/1652-35-0x000000013F5C0000-0x000000013F9B2000-memory.dmp

Filesize
3.9MB

Download
memory/1652-141-0x000000013FA60000-0x000000013FE52000-memory.dmp

Filesize
3.9MB

Download
memory/1652-0-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/1672-344-0x000000013F630000-0x000000013FA22000-memory.dmp

Filesize
3.9MB

Download
memory/1672-175-0x000000013F630000-0x000000013FA22000-memory.dmp

Filesize
3.9MB

Download
memory/1680-194-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/1680-362-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/1888-164-0x000000013FA20000-0x000000013FE12000-memory.dmp

Filesize
3.9MB

Download
memory/1888-340-0x000000013FA20000-0x000000013FE12000-memory.dmp

Filesize
3.9MB

Download
memory/1944-68-0x0000000002220000-0x00000000022A0000-memory.dmp

Filesize
512KB

Download
memory/1944-143-0x000007FEF5C30000-0x000007FEF65CD000-memory.dmp

Filesize
9.6MB

Download
memory/1944-151-0x000000000222B000-0x0000000002292000-memory.dmp

Filesize
412KB

Download
memory/1944-138-0x0000000002220000-0x00000000022A0000-memory.dmp

Filesize
512KB

Download
memory/1944-150-0x0000000002224000-0x0000000002227000-memory.dmp

Filesize
12KB

Download
memory/1944-45-0x0000000001DA0000-0x0000000001DA8000-memory.dmp

Filesize
32KB

Download
memory/1944-42-0x000000001B670000-0x000000001B952000-memory.dmp

Filesize
2.9MB

Download
memory/1944-113-0x000007FEF5C30000-0x000007FEF65CD000-memory.dmp

Filesize
9.6MB

Download
memory/2012-366-0x000000013F020000-0x000000013F412000-memory.dmp

Filesize
3.9MB

Download
memory/2032-34-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/2032-320-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/2032-144-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/2244-368-0x000000013FAA0000-0x000000013FE92000-memory.dmp

Filesize
3.9MB

Download
memory/2252-378-0x000000013F060000-0x000000013F452000-memory.dmp

Filesize
3.9MB

Download
memory/2444-347-0x000000013FA10000-0x000000013FE02000-memory.dmp

Filesize
3.9MB

Download
memory/2444-160-0x000000013FA10000-0x000000013FE02000-memory.dmp

Filesize
3.9MB

Download
memory/2492-326-0x000000013F220000-0x000000013F612000-memory.dmp

Filesize
3.9MB

Download
memory/2492-46-0x000000013F220000-0x000000013F612000-memory.dmp

Filesize
3.9MB

Download
memory/2536-41-0x000000013F5C0000-0x000000013F9B2000-memory.dmp

Filesize
3.9MB

Download
memory/2536-323-0x000000013F5C0000-0x000000013F9B2000-memory.dmp

Filesize
3.9MB

Download
memory/2576-383-0x000000013F770000-0x000000013FB62000-memory.dmp

Filesize
3.9MB

Download
memory/2580-322-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/2580-47-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/2604-44-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/2604-321-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/2696-360-0x000000013FFD0000-0x00000001403C2000-memory.dmp

Filesize
3.9MB

Download
memory/2696-182-0x000000013FFD0000-0x00000001403C2000-memory.dmp

Filesize
3.9MB

Download
memory/2728-165-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/2732-172-0x000000013F090000-0x000000013F482000-memory.dmp

Filesize
3.9MB

Download
memory/2732-338-0x000000013F090000-0x000000013F482000-memory.dmp

Filesize
3.9MB

Download
memory/2772-352-0x000000013F0A0000-0x000000013F492000-memory.dmp

Filesize
3.9MB

Download
memory/2772-173-0x000000013F0A0000-0x000000013F492000-memory.dmp

Filesize
3.9MB

Download
memory/2792-342-0x000000013F760000-0x000000013FB52000-memory.dmp

Filesize
3.9MB

Download
memory/2792-166-0x000000013F760000-0x000000013FB52000-memory.dmp

Filesize
3.9MB

Download
memory/2812-43-0x000000013FA30000-0x000000013FE22000-memory.dmp

Filesize
3.9MB

Download
memory/2812-314-0x000000013FA30000-0x000000013FE22000-memory.dmp

Filesize
3.9MB

Download
memory/2836-373-0x000000013F240000-0x000000013F632000-memory.dmp

Filesize
3.9MB

Download
memory/2912-339-0x000000013F850000-0x000000013FC42000-memory.dmp

Filesize
3.9MB

Download
memory/2912-174-0x000000013F850000-0x000000013FC42000-memory.dmp

Filesize
3.9MB

Download