xmrig | a433e43ae8fc2a0215f02409bc1bf9cda6c751106ca9603127d06d75fd359ab8

Analysis

max time kernel
72s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 19:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
Size

1.9MB
MD5

018038a1c98f481f5fd563e4c3cf9737
SHA1

fa558cbac9f30b14b9f964845a590bc13e1f681e
SHA256

a433e43ae8fc2a0215f02409bc1bf9cda6c751106ca9603127d06d75fd359ab8
SHA512

0f966d7d4065df8291d455d07e191e4a10cc875ee832313411164da53cb62df67710346eb38d3da6caaf6177c19bdb8efbf9f357a4ddf5be63723e077dd330b7
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U4:NABr

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 43 IoCs

miner

resource	yara_rule
behavioral2/memory/2036-223-0x00007FF689F30000-0x00007FF68A322000-memory.dmp	xmrig
behavioral2/memory/4456-256-0x00007FF718C30000-0x00007FF719022000-memory.dmp	xmrig
behavioral2/memory/3856-280-0x00007FF7F22C0000-0x00007FF7F26B2000-memory.dmp	xmrig
behavioral2/memory/2748-328-0x00007FF607110000-0x00007FF607502000-memory.dmp	xmrig
behavioral2/memory/3756-369-0x00007FF7D3130000-0x00007FF7D3522000-memory.dmp	xmrig
behavioral2/memory/5112-386-0x00007FF7B3BE0000-0x00007FF7B3FD2000-memory.dmp	xmrig
behavioral2/memory/2032-401-0x00007FF6C3BD0000-0x00007FF6C3FC2000-memory.dmp	xmrig
behavioral2/memory/3688-368-0x00007FF6075E0000-0x00007FF6079D2000-memory.dmp	xmrig
behavioral2/memory/4512-367-0x00007FF647D60000-0x00007FF648152000-memory.dmp	xmrig
behavioral2/memory/2144-362-0x00007FF6F44A0000-0x00007FF6F4892000-memory.dmp	xmrig
behavioral2/memory/432-310-0x00007FF67E270000-0x00007FF67E662000-memory.dmp	xmrig
behavioral2/memory/3168-302-0x00007FF72CEA0000-0x00007FF72D292000-memory.dmp	xmrig
behavioral2/memory/212-283-0x00007FF7607F0000-0x00007FF760BE2000-memory.dmp	xmrig
behavioral2/memory/4704-239-0x00007FF62D8E0000-0x00007FF62DCD2000-memory.dmp	xmrig
behavioral2/memory/4992-229-0x00007FF76CA20000-0x00007FF76CE12000-memory.dmp	xmrig
behavioral2/memory/3588-224-0x00007FF62E5E0000-0x00007FF62E9D2000-memory.dmp	xmrig
behavioral2/memory/5060-202-0x00007FF751560000-0x00007FF751952000-memory.dmp	xmrig
behavioral2/memory/4384-149-0x00007FF6217C0000-0x00007FF621BB2000-memory.dmp	xmrig
behavioral2/memory/4612-120-0x00007FF68C570000-0x00007FF68C962000-memory.dmp	xmrig
behavioral2/memory/1524-87-0x00007FF787C90000-0x00007FF788082000-memory.dmp	xmrig
behavioral2/memory/4628-57-0x00007FF61BAC0000-0x00007FF61BEB2000-memory.dmp	xmrig
behavioral2/memory/3756-3700-0x00007FF7D3130000-0x00007FF7D3522000-memory.dmp	xmrig
behavioral2/memory/1524-3737-0x00007FF787C90000-0x00007FF788082000-memory.dmp	xmrig
behavioral2/memory/4628-3740-0x00007FF61BAC0000-0x00007FF61BEB2000-memory.dmp	xmrig
behavioral2/memory/4612-3739-0x00007FF68C570000-0x00007FF68C962000-memory.dmp	xmrig
behavioral2/memory/4628-3750-0x00007FF61BAC0000-0x00007FF61BEB2000-memory.dmp	xmrig
behavioral2/memory/5060-3754-0x00007FF751560000-0x00007FF751952000-memory.dmp	xmrig
behavioral2/memory/2032-3758-0x00007FF6C3BD0000-0x00007FF6C3FC2000-memory.dmp	xmrig
behavioral2/memory/4456-3762-0x00007FF718C30000-0x00007FF719022000-memory.dmp	xmrig
behavioral2/memory/4992-3766-0x00007FF76CA20000-0x00007FF76CE12000-memory.dmp	xmrig
behavioral2/memory/3856-3768-0x00007FF7F22C0000-0x00007FF7F26B2000-memory.dmp	xmrig
behavioral2/memory/3588-3764-0x00007FF62E5E0000-0x00007FF62E9D2000-memory.dmp	xmrig
behavioral2/memory/432-3761-0x00007FF67E270000-0x00007FF67E662000-memory.dmp	xmrig
behavioral2/memory/4704-3756-0x00007FF62D8E0000-0x00007FF62DCD2000-memory.dmp	xmrig
behavioral2/memory/4384-3753-0x00007FF6217C0000-0x00007FF621BB2000-memory.dmp	xmrig
behavioral2/memory/2144-3774-0x00007FF6F44A0000-0x00007FF6F4892000-memory.dmp	xmrig
behavioral2/memory/3688-3777-0x00007FF6075E0000-0x00007FF6079D2000-memory.dmp	xmrig
behavioral2/memory/4512-3791-0x00007FF647D60000-0x00007FF648152000-memory.dmp	xmrig
behavioral2/memory/2748-3790-0x00007FF607110000-0x00007FF607502000-memory.dmp	xmrig
behavioral2/memory/2036-3785-0x00007FF689F30000-0x00007FF68A322000-memory.dmp	xmrig
behavioral2/memory/3168-3776-0x00007FF72CEA0000-0x00007FF72D292000-memory.dmp	xmrig
behavioral2/memory/212-3788-0x00007FF7607F0000-0x00007FF760BE2000-memory.dmp	xmrig
behavioral2/memory/5112-3782-0x00007FF7B3BE0000-0x00007FF7B3FD2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3756	ejzBloN.exe
4628	YIzKydS.exe
1524	mfPYUHw.exe
4612	IYZjIuT.exe
4384	GDKidNK.exe
5060	LSZDQKO.exe
2036	Hrbibts.exe
3588	UiiSKRu.exe
4992	HUgHBpw.exe
4704	jdMWUjj.exe
5112	qVCAjBb.exe
4456	mbrzYsD.exe
3856	ZrCSLSx.exe
212	gLssxnp.exe
3168	BXkwMBc.exe
2032	hyUxAbJ.exe
432	FQwkbmX.exe
2748	rpMBUTl.exe
2144	BFkKpCq.exe
4512	LCZtTky.exe
3688	nCPJSfU.exe
3984	zCRUKrc.exe
3008	CddepgD.exe
436	NztKtRR.exe
3316	UzvnrtM.exe
532	pDqArAc.exe
3948	VnNEigo.exe
1616	dSfIWqz.exe
3612	lNotiFB.exe
4948	AobRuGR.exe
4760	EaWOlbM.exe
2068	PDTrzms.exe
2328	KHRXVYe.exe
116	iLHVBzD.exe
1700	BdNLTIs.exe
3560	RlvXVob.exe
4008	glyMNTu.exe
4864	FlPnokk.exe
2588	GdGjDgA.exe
3872	TfPcNsu.exe
1412	rZaHcpg.exe
5088	SGoevnV.exe
2076	CGDkNtl.exe
2596	hXkswWm.exe
2608	VXCqAEL.exe
400	UTWGnFu.exe
4716	wgWqJds.exe
864	RcKNFhi.exe
4472	ZcgLZHd.exe
4356	WHkTkcD.exe
3716	nbLEZHx.exe
3036	sCYIPTh.exe
4468	JYTBdZB.exe
3096	NyFYBYf.exe
1184	yafqOPs.exe
3448	Ifstrfr.exe
3132	IfXBawY.exe
4620	SoZwBnm.exe
4124	hyUQUpM.exe
1304	ThbAOEF.exe
3868	PNSaFoq.exe
2016	HhLjxaW.exe
4440	twqTeXV.exe
4636	qOiFDKb.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3092-0-0x00007FF666CC0000-0x00007FF6670B2000-memory.dmp	upx
behavioral2/files/0x000a000000023bc0-8.dat	upx
behavioral2/files/0x000a000000023bc9-59.dat	upx
behavioral2/files/0x000a000000023bd4-114.dat	upx
behavioral2/files/0x000a000000023bdb-145.dat	upx
behavioral2/files/0x000b000000023be0-192.dat	upx
behavioral2/memory/2036-223-0x00007FF689F30000-0x00007FF68A322000-memory.dmp	upx
behavioral2/memory/4456-256-0x00007FF718C30000-0x00007FF719022000-memory.dmp	upx
behavioral2/memory/3856-280-0x00007FF7F22C0000-0x00007FF7F26B2000-memory.dmp	upx
behavioral2/memory/2748-328-0x00007FF607110000-0x00007FF607502000-memory.dmp	upx
behavioral2/memory/3756-369-0x00007FF7D3130000-0x00007FF7D3522000-memory.dmp	upx
behavioral2/memory/5112-386-0x00007FF7B3BE0000-0x00007FF7B3FD2000-memory.dmp	upx
behavioral2/memory/2032-401-0x00007FF6C3BD0000-0x00007FF6C3FC2000-memory.dmp	upx
behavioral2/memory/3688-368-0x00007FF6075E0000-0x00007FF6079D2000-memory.dmp	upx
behavioral2/memory/4512-367-0x00007FF647D60000-0x00007FF648152000-memory.dmp	upx
behavioral2/memory/2144-362-0x00007FF6F44A0000-0x00007FF6F4892000-memory.dmp	upx
behavioral2/memory/432-310-0x00007FF67E270000-0x00007FF67E662000-memory.dmp	upx
behavioral2/memory/3168-302-0x00007FF72CEA0000-0x00007FF72D292000-memory.dmp	upx
behavioral2/memory/212-283-0x00007FF7607F0000-0x00007FF760BE2000-memory.dmp	upx
behavioral2/memory/4704-239-0x00007FF62D8E0000-0x00007FF62DCD2000-memory.dmp	upx
behavioral2/memory/4992-229-0x00007FF76CA20000-0x00007FF76CE12000-memory.dmp	upx
behavioral2/memory/3588-224-0x00007FF62E5E0000-0x00007FF62E9D2000-memory.dmp	upx
behavioral2/memory/5060-202-0x00007FF751560000-0x00007FF751952000-memory.dmp	upx
behavioral2/files/0x000a000000023bd9-187.dat	upx
behavioral2/files/0x000a000000023bd8-173.dat	upx
behavioral2/files/0x000a000000023bd7-171.dat	upx
behavioral2/files/0x000a000000023bdd-170.dat	upx
behavioral2/files/0x000a000000023bdc-166.dat	upx
behavioral2/files/0x000a000000023bd5-164.dat	upx
behavioral2/files/0x000d000000023bbb-162.dat	upx
behavioral2/files/0x000b000000023bdf-155.dat	upx
behavioral2/files/0x000a000000023bd1-152.dat	upx
behavioral2/files/0x000b000000023bde-151.dat	upx
behavioral2/files/0x000a000000023bd6-148.dat	upx
behavioral2/files/0x000a000000023bda-144.dat	upx
behavioral2/files/0x000a000000023bd3-143.dat	upx
behavioral2/files/0x000a000000023bd2-139.dat	upx
behavioral2/files/0x000a000000023bce-136.dat	upx
behavioral2/files/0x000a000000023bcb-128.dat	upx
behavioral2/memory/4384-149-0x00007FF6217C0000-0x00007FF621BB2000-memory.dmp	upx
behavioral2/files/0x000a000000023bd0-122.dat	upx
behavioral2/memory/4612-120-0x00007FF68C570000-0x00007FF68C962000-memory.dmp	upx
behavioral2/files/0x000a000000023bcd-105.dat	upx
behavioral2/files/0x000a000000023bcc-102.dat	upx
behavioral2/files/0x000a000000023bc5-93.dat	upx
behavioral2/files/0x000a000000023bca-89.dat	upx
behavioral2/files/0x000a000000023bc4-88.dat	upx
behavioral2/memory/1524-87-0x00007FF787C90000-0x00007FF788082000-memory.dmp	upx
behavioral2/files/0x000a000000023bcf-82.dat	upx
behavioral2/files/0x000a000000023bc8-79.dat	upx
behavioral2/files/0x000a000000023bc7-69.dat	upx
behavioral2/files/0x000a000000023bc6-99.dat	upx
behavioral2/files/0x000a000000023bc3-62.dat	upx
behavioral2/files/0x000a000000023bc2-47.dat	upx
behavioral2/files/0x000a000000023bc1-40.dat	upx
behavioral2/memory/4628-57-0x00007FF61BAC0000-0x00007FF61BEB2000-memory.dmp	upx
behavioral2/files/0x000a000000023bbf-30.dat	upx
behavioral2/files/0x0033000000023bb4-6.dat	upx
behavioral2/memory/3756-3700-0x00007FF7D3130000-0x00007FF7D3522000-memory.dmp	upx
behavioral2/memory/1524-3737-0x00007FF787C90000-0x00007FF788082000-memory.dmp	upx
behavioral2/memory/4628-3740-0x00007FF61BAC0000-0x00007FF61BEB2000-memory.dmp	upx
behavioral2/memory/4612-3739-0x00007FF68C570000-0x00007FF68C962000-memory.dmp	upx
behavioral2/memory/4628-3750-0x00007FF61BAC0000-0x00007FF61BEB2000-memory.dmp	upx
behavioral2/memory/5060-3754-0x00007FF751560000-0x00007FF751952000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\IAoJzyz.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\XnMpFBy.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\tFiiyjf.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\hqlVUek.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\idbxZEa.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\XqNYBMm.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\nbLEZHx.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\DgFFORc.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\XtyknHT.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\qQJDRmJ.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\uQPKkvN.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\DpwMwDb.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\qFfhPAp.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\cyVfjLz.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\qCHhZzK.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\kKfzXbn.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\nrIIMyL.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\wIcNvmU.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\oOrLiys.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\pAyMBNn.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\kxItSyx.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\CYbuUJz.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\ZvsQzeD.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\yJoSMMQ.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\gTImReX.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\XOnWNeP.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\pKjEZQd.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\SKWxDbI.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\NfNChXK.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\dzbKeQy.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\ADvlPdl.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\aelMLXc.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\lrttDoa.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\RJgAAvm.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\UsuKNPX.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\rpMBUTl.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\EFDfOKM.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\LHrOOVy.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\KYqHNFp.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\ukRnydY.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\STEduLp.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\XSVaFgY.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\TlEVLAh.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\lfQmVtT.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\uDyqCNU.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\TyVkWAS.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\FALfhQX.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\aVxTjeX.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\ilRFfut.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\zaUgPYW.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\JpLGlOn.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\LxpxxTe.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\UcGbxym.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\rfyIJmL.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\oKBJuFW.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\ayMBfYI.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\wdPKNxI.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\zHhLcvz.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\IJsWgBE.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\fgCXbLN.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\NOaaFNc.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\bJulZjS.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\IaWdUmF.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\VXCqAEL.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3776	powershell.exe
3776	powershell.exe
3776	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3776	powershell.exe
Token: SeLockMemoryPrivilege	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3092 wrote to memory of 3776	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	86
PID 3092 wrote to memory of 3776	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	86
PID 3092 wrote to memory of 3756	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	87
PID 3092 wrote to memory of 3756	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	87
PID 3092 wrote to memory of 4628	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	88
PID 3092 wrote to memory of 4628	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	88
PID 3092 wrote to memory of 1524	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	89
PID 3092 wrote to memory of 1524	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	89
PID 3092 wrote to memory of 4612	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	90
PID 3092 wrote to memory of 4612	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	90
PID 3092 wrote to memory of 4384	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	91
PID 3092 wrote to memory of 4384	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	91
PID 3092 wrote to memory of 5060	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	92
PID 3092 wrote to memory of 5060	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	92
PID 3092 wrote to memory of 2036	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	93
PID 3092 wrote to memory of 2036	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	93
PID 3092 wrote to memory of 3588	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	94
PID 3092 wrote to memory of 3588	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	94
PID 3092 wrote to memory of 4992	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	95
PID 3092 wrote to memory of 4992	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	95
PID 3092 wrote to memory of 4704	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	96
PID 3092 wrote to memory of 4704	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	96
PID 3092 wrote to memory of 2032	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	97
PID 3092 wrote to memory of 2032	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	97
PID 3092 wrote to memory of 5112	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	98
PID 3092 wrote to memory of 5112	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	98
PID 3092 wrote to memory of 4456	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	99
PID 3092 wrote to memory of 4456	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	99
PID 3092 wrote to memory of 2144	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	100
PID 3092 wrote to memory of 2144	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	100
PID 3092 wrote to memory of 3856	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	101
PID 3092 wrote to memory of 3856	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	101
PID 3092 wrote to memory of 212	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	102
PID 3092 wrote to memory of 212	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	102
PID 3092 wrote to memory of 3168	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	103
PID 3092 wrote to memory of 3168	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	103
PID 3092 wrote to memory of 432	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	104
PID 3092 wrote to memory of 432	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	104
PID 3092 wrote to memory of 2748	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	105
PID 3092 wrote to memory of 2748	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	105
PID 3092 wrote to memory of 4512	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	106
PID 3092 wrote to memory of 4512	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	106
PID 3092 wrote to memory of 3688	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	107
PID 3092 wrote to memory of 3688	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	107
PID 3092 wrote to memory of 1616	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	108
PID 3092 wrote to memory of 1616	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	108
PID 3092 wrote to memory of 3984	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	109
PID 3092 wrote to memory of 3984	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	109
PID 3092 wrote to memory of 3008	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	110
PID 3092 wrote to memory of 3008	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	110
PID 3092 wrote to memory of 436	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	111
PID 3092 wrote to memory of 436	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	111
PID 3092 wrote to memory of 3316	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	112
PID 3092 wrote to memory of 3316	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	112
PID 3092 wrote to memory of 532	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	113
PID 3092 wrote to memory of 532	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	113
PID 3092 wrote to memory of 3948	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	114
PID 3092 wrote to memory of 3948	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	114
PID 3092 wrote to memory of 3612	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	115
PID 3092 wrote to memory of 3612	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	115
PID 3092 wrote to memory of 4948	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	116
PID 3092 wrote to memory of 4948	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	116
PID 3092 wrote to memory of 4760	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	117
PID 3092 wrote to memory of 4760	3092	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	117

C:\Users\Admin\AppData\Local\Temp\018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3776
- C:\Windows\System\ejzBloN.exe
  C:\Windows\System\ejzBloN.exe
  2⤵
  - Executes dropped EXE
  PID:3756
- C:\Windows\System\YIzKydS.exe
  C:\Windows\System\YIzKydS.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\mfPYUHw.exe
  C:\Windows\System\mfPYUHw.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\IYZjIuT.exe
  C:\Windows\System\IYZjIuT.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\GDKidNK.exe
  C:\Windows\System\GDKidNK.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\LSZDQKO.exe
  C:\Windows\System\LSZDQKO.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\Hrbibts.exe
  C:\Windows\System\Hrbibts.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\UiiSKRu.exe
  C:\Windows\System\UiiSKRu.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\HUgHBpw.exe
  C:\Windows\System\HUgHBpw.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\jdMWUjj.exe
  C:\Windows\System\jdMWUjj.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\hyUxAbJ.exe
  C:\Windows\System\hyUxAbJ.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\qVCAjBb.exe
  C:\Windows\System\qVCAjBb.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\mbrzYsD.exe
  C:\Windows\System\mbrzYsD.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\BFkKpCq.exe
  C:\Windows\System\BFkKpCq.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\ZrCSLSx.exe
  C:\Windows\System\ZrCSLSx.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\gLssxnp.exe
  C:\Windows\System\gLssxnp.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\BXkwMBc.exe
  C:\Windows\System\BXkwMBc.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\FQwkbmX.exe
  C:\Windows\System\FQwkbmX.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\rpMBUTl.exe
  C:\Windows\System\rpMBUTl.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\LCZtTky.exe
  C:\Windows\System\LCZtTky.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\nCPJSfU.exe
  C:\Windows\System\nCPJSfU.exe
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Windows\System\dSfIWqz.exe
  C:\Windows\System\dSfIWqz.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\zCRUKrc.exe
  C:\Windows\System\zCRUKrc.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\CddepgD.exe
  C:\Windows\System\CddepgD.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\NztKtRR.exe
  C:\Windows\System\NztKtRR.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\UzvnrtM.exe
  C:\Windows\System\UzvnrtM.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System\pDqArAc.exe
  C:\Windows\System\pDqArAc.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\VnNEigo.exe
  C:\Windows\System\VnNEigo.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\lNotiFB.exe
  C:\Windows\System\lNotiFB.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\AobRuGR.exe
  C:\Windows\System\AobRuGR.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\EaWOlbM.exe
  C:\Windows\System\EaWOlbM.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\BdNLTIs.exe
  C:\Windows\System\BdNLTIs.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\PDTrzms.exe
  C:\Windows\System\PDTrzms.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\KHRXVYe.exe
  C:\Windows\System\KHRXVYe.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\iLHVBzD.exe
  C:\Windows\System\iLHVBzD.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\RlvXVob.exe
  C:\Windows\System\RlvXVob.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\glyMNTu.exe
  C:\Windows\System\glyMNTu.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\FlPnokk.exe
  C:\Windows\System\FlPnokk.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\GdGjDgA.exe
  C:\Windows\System\GdGjDgA.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\TfPcNsu.exe
  C:\Windows\System\TfPcNsu.exe
  2⤵
  - Executes dropped EXE
  PID:3872
- C:\Windows\System\rZaHcpg.exe
  C:\Windows\System\rZaHcpg.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\SGoevnV.exe
  C:\Windows\System\SGoevnV.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\CGDkNtl.exe
  C:\Windows\System\CGDkNtl.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\hXkswWm.exe
  C:\Windows\System\hXkswWm.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\VXCqAEL.exe
  C:\Windows\System\VXCqAEL.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\UTWGnFu.exe
  C:\Windows\System\UTWGnFu.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\wgWqJds.exe
  C:\Windows\System\wgWqJds.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\RcKNFhi.exe
  C:\Windows\System\RcKNFhi.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\ZcgLZHd.exe
  C:\Windows\System\ZcgLZHd.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\WHkTkcD.exe
  C:\Windows\System\WHkTkcD.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\nbLEZHx.exe
  C:\Windows\System\nbLEZHx.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System\sCYIPTh.exe
  C:\Windows\System\sCYIPTh.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\JYTBdZB.exe
  C:\Windows\System\JYTBdZB.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\NyFYBYf.exe
  C:\Windows\System\NyFYBYf.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\yafqOPs.exe
  C:\Windows\System\yafqOPs.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\Ifstrfr.exe
  C:\Windows\System\Ifstrfr.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\IfXBawY.exe
  C:\Windows\System\IfXBawY.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\SoZwBnm.exe
  C:\Windows\System\SoZwBnm.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\hyUQUpM.exe
  C:\Windows\System\hyUQUpM.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\ThbAOEF.exe
  C:\Windows\System\ThbAOEF.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\PNSaFoq.exe
  C:\Windows\System\PNSaFoq.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\HhLjxaW.exe
  C:\Windows\System\HhLjxaW.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\twqTeXV.exe
  C:\Windows\System\twqTeXV.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\qOiFDKb.exe
  C:\Windows\System\qOiFDKb.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\mewEHiz.exe
  C:\Windows\System\mewEHiz.exe
  2⤵
  PID:3780
- C:\Windows\System\vMscebP.exe
  C:\Windows\System\vMscebP.exe
  2⤵
  PID:4032
- C:\Windows\System\hOUuxPY.exe
  C:\Windows\System\hOUuxPY.exe
  2⤵
  PID:4164
- C:\Windows\System\IxBCAcg.exe
  C:\Windows\System\IxBCAcg.exe
  2⤵
  PID:4316
- C:\Windows\System\jRiuJqG.exe
  C:\Windows\System\jRiuJqG.exe
  2⤵
  PID:4856
- C:\Windows\System\lHWqVgL.exe
  C:\Windows\System\lHWqVgL.exe
  2⤵
  PID:4980
- C:\Windows\System\JyGKPNA.exe
  C:\Windows\System\JyGKPNA.exe
  2⤵
  PID:3228
- C:\Windows\System\PUcfZdV.exe
  C:\Windows\System\PUcfZdV.exe
  2⤵
  PID:5164
- C:\Windows\System\OiKZqAS.exe
  C:\Windows\System\OiKZqAS.exe
  2⤵
  PID:5188
- C:\Windows\System\byCQWpW.exe
  C:\Windows\System\byCQWpW.exe
  2⤵
  PID:5204
- C:\Windows\System\EeejIjB.exe
  C:\Windows\System\EeejIjB.exe
  2⤵
  PID:5224
- C:\Windows\System\IxdumDm.exe
  C:\Windows\System\IxdumDm.exe
  2⤵
  PID:5256
- C:\Windows\System\qFfhPAp.exe
  C:\Windows\System\qFfhPAp.exe
  2⤵
  PID:5360
- C:\Windows\System\cXiGAUN.exe
  C:\Windows\System\cXiGAUN.exe
  2⤵
  PID:5380
- C:\Windows\System\TClbXwv.exe
  C:\Windows\System\TClbXwv.exe
  2⤵
  PID:5408
- C:\Windows\System\cwyPpaC.exe
  C:\Windows\System\cwyPpaC.exe
  2⤵
  PID:5428
- C:\Windows\System\gzaedOg.exe
  C:\Windows\System\gzaedOg.exe
  2⤵
  PID:5444
- C:\Windows\System\bPQsBBm.exe
  C:\Windows\System\bPQsBBm.exe
  2⤵
  PID:5460
- C:\Windows\System\DaxWmit.exe
  C:\Windows\System\DaxWmit.exe
  2⤵
  PID:5476
- C:\Windows\System\PjFCHuj.exe
  C:\Windows\System\PjFCHuj.exe
  2⤵
  PID:5496
- C:\Windows\System\yeFNElt.exe
  C:\Windows\System\yeFNElt.exe
  2⤵
  PID:5512
- C:\Windows\System\VAWtDqO.exe
  C:\Windows\System\VAWtDqO.exe
  2⤵
  PID:5528
- C:\Windows\System\MSSLSXX.exe
  C:\Windows\System\MSSLSXX.exe
  2⤵
  PID:5544
- C:\Windows\System\TDJQPfR.exe
  C:\Windows\System\TDJQPfR.exe
  2⤵
  PID:5560
- C:\Windows\System\jWOAlJa.exe
  C:\Windows\System\jWOAlJa.exe
  2⤵
  PID:5576
- C:\Windows\System\dpIkZyy.exe
  C:\Windows\System\dpIkZyy.exe
  2⤵
  PID:5624
- C:\Windows\System\oDPpQHb.exe
  C:\Windows\System\oDPpQHb.exe
  2⤵
  PID:5644
- C:\Windows\System\fMeCIvl.exe
  C:\Windows\System\fMeCIvl.exe
  2⤵
  PID:5664
- C:\Windows\System\EuXBdfe.exe
  C:\Windows\System\EuXBdfe.exe
  2⤵
  PID:5684
- C:\Windows\System\TIIuZoA.exe
  C:\Windows\System\TIIuZoA.exe
  2⤵
  PID:5700
- C:\Windows\System\wdPKNxI.exe
  C:\Windows\System\wdPKNxI.exe
  2⤵
  PID:5716
- C:\Windows\System\QAECBku.exe
  C:\Windows\System\QAECBku.exe
  2⤵
  PID:5732
- C:\Windows\System\XSVaFgY.exe
  C:\Windows\System\XSVaFgY.exe
  2⤵
  PID:5748
- C:\Windows\System\NfNChXK.exe
  C:\Windows\System\NfNChXK.exe
  2⤵
  PID:5768
- C:\Windows\System\lfKUqIe.exe
  C:\Windows\System\lfKUqIe.exe
  2⤵
  PID:5784
- C:\Windows\System\DaIbUmy.exe
  C:\Windows\System\DaIbUmy.exe
  2⤵
  PID:5912
- C:\Windows\System\uSPTfof.exe
  C:\Windows\System\uSPTfof.exe
  2⤵
  PID:5928
- C:\Windows\System\KBSWxOr.exe
  C:\Windows\System\KBSWxOr.exe
  2⤵
  PID:5968
- C:\Windows\System\UNptZOE.exe
  C:\Windows\System\UNptZOE.exe
  2⤵
  PID:6020
- C:\Windows\System\uusuUWg.exe
  C:\Windows\System\uusuUWg.exe
  2⤵
  PID:6048
- C:\Windows\System\SwQvaDy.exe
  C:\Windows\System\SwQvaDy.exe
  2⤵
  PID:2528
- C:\Windows\System\QxKkQxh.exe
  C:\Windows\System\QxKkQxh.exe
  2⤵
  PID:2432
- C:\Windows\System\HgdZQQx.exe
  C:\Windows\System\HgdZQQx.exe
  2⤵
  PID:2960
- C:\Windows\System\YEeFBTh.exe
  C:\Windows\System\YEeFBTh.exe
  2⤵
  PID:1004
- C:\Windows\System\pWVhESd.exe
  C:\Windows\System\pWVhESd.exe
  2⤵
  PID:3600
- C:\Windows\System\nrIBcaG.exe
  C:\Windows\System\nrIBcaG.exe
  2⤵
  PID:4880
- C:\Windows\System\ZyCzmkV.exe
  C:\Windows\System\ZyCzmkV.exe
  2⤵
  PID:5124
- C:\Windows\System\DIUroEk.exe
  C:\Windows\System\DIUroEk.exe
  2⤵
  PID:5160
- C:\Windows\System\iYbVSdj.exe
  C:\Windows\System\iYbVSdj.exe
  2⤵
  PID:5212
- C:\Windows\System\nHLfPNV.exe
  C:\Windows\System\nHLfPNV.exe
  2⤵
  PID:5240
- C:\Windows\System\KQabnEF.exe
  C:\Windows\System\KQabnEF.exe
  2⤵
  PID:5440
- C:\Windows\System\qOFsnOM.exe
  C:\Windows\System\qOFsnOM.exe
  2⤵
  PID:5368
- C:\Windows\System\hTRIGGf.exe
  C:\Windows\System\hTRIGGf.exe
  2⤵
  PID:5392
- C:\Windows\System\RTuqFNg.exe
  C:\Windows\System\RTuqFNg.exe
  2⤵
  PID:5436
- C:\Windows\System\NIUYYWI.exe
  C:\Windows\System\NIUYYWI.exe
  2⤵
  PID:5472
- C:\Windows\System\ZNXBlAk.exe
  C:\Windows\System\ZNXBlAk.exe
  2⤵
  PID:5508
- C:\Windows\System\uYIdFeB.exe
  C:\Windows\System\uYIdFeB.exe
  2⤵
  PID:5568
- C:\Windows\System\wAWImku.exe
  C:\Windows\System\wAWImku.exe
  2⤵
  PID:5608
- C:\Windows\System\ythAPHN.exe
  C:\Windows\System\ythAPHN.exe
  2⤵
  PID:5656
- C:\Windows\System\mIcAOJT.exe
  C:\Windows\System\mIcAOJT.exe
  2⤵
  PID:5680
- C:\Windows\System\tfLHkEK.exe
  C:\Windows\System\tfLHkEK.exe
  2⤵
  PID:6016
- C:\Windows\System\vfwCOnx.exe
  C:\Windows\System\vfwCOnx.exe
  2⤵
  PID:6100
- C:\Windows\System\ZiYPNGY.exe
  C:\Windows\System\ZiYPNGY.exe
  2⤵
  PID:6040
- C:\Windows\System\GQxPpiz.exe
  C:\Windows\System\GQxPpiz.exe
  2⤵
  PID:6148
- C:\Windows\System\YprHptF.exe
  C:\Windows\System\YprHptF.exe
  2⤵
  PID:6176
- C:\Windows\System\dZXILgj.exe
  C:\Windows\System\dZXILgj.exe
  2⤵
  PID:6192
- C:\Windows\System\IqCCzaT.exe
  C:\Windows\System\IqCCzaT.exe
  2⤵
  PID:6212
- C:\Windows\System\NqsCXLJ.exe
  C:\Windows\System\NqsCXLJ.exe
  2⤵
  PID:6236
- C:\Windows\System\nYfzHKU.exe
  C:\Windows\System\nYfzHKU.exe
  2⤵
  PID:6252
- C:\Windows\System\tEvYPvk.exe
  C:\Windows\System\tEvYPvk.exe
  2⤵
  PID:6276
- C:\Windows\System\ADvlPdl.exe
  C:\Windows\System\ADvlPdl.exe
  2⤵
  PID:6300
- C:\Windows\System\NkbjMxn.exe
  C:\Windows\System\NkbjMxn.exe
  2⤵
  PID:6316
- C:\Windows\System\iCPzKsw.exe
  C:\Windows\System\iCPzKsw.exe
  2⤵
  PID:6340
- C:\Windows\System\UAYRZqr.exe
  C:\Windows\System\UAYRZqr.exe
  2⤵
  PID:6372
- C:\Windows\System\OUxHWGb.exe
  C:\Windows\System\OUxHWGb.exe
  2⤵
  PID:6388
- C:\Windows\System\lfbgBTU.exe
  C:\Windows\System\lfbgBTU.exe
  2⤵
  PID:6408
- C:\Windows\System\BkpuzgK.exe
  C:\Windows\System\BkpuzgK.exe
  2⤵
  PID:6428
- C:\Windows\System\RhTbPjW.exe
  C:\Windows\System\RhTbPjW.exe
  2⤵
  PID:6600
- C:\Windows\System\yMaLkgh.exe
  C:\Windows\System\yMaLkgh.exe
  2⤵
  PID:6616
- C:\Windows\System\ZnggrYN.exe
  C:\Windows\System\ZnggrYN.exe
  2⤵
  PID:6640
- C:\Windows\System\EefcaQN.exe
  C:\Windows\System\EefcaQN.exe
  2⤵
  PID:6668
- C:\Windows\System\ITgiaPs.exe
  C:\Windows\System\ITgiaPs.exe
  2⤵
  PID:6684
- C:\Windows\System\yXuqhIU.exe
  C:\Windows\System\yXuqhIU.exe
  2⤵
  PID:6708
- C:\Windows\System\APfavyE.exe
  C:\Windows\System\APfavyE.exe
  2⤵
  PID:6728
- C:\Windows\System\YTbgkuF.exe
  C:\Windows\System\YTbgkuF.exe
  2⤵
  PID:6752
- C:\Windows\System\TpkPzYu.exe
  C:\Windows\System\TpkPzYu.exe
  2⤵
  PID:6772
- C:\Windows\System\ruvPCQL.exe
  C:\Windows\System\ruvPCQL.exe
  2⤵
  PID:6788
- C:\Windows\System\liWVCRR.exe
  C:\Windows\System\liWVCRR.exe
  2⤵
  PID:7028
- C:\Windows\System\ykxfFpE.exe
  C:\Windows\System\ykxfFpE.exe
  2⤵
  PID:7044
- C:\Windows\System\NUxrRWb.exe
  C:\Windows\System\NUxrRWb.exe
  2⤵
  PID:3344
- C:\Windows\System\edpgeAx.exe
  C:\Windows\System\edpgeAx.exe
  2⤵
  PID:5592
- C:\Windows\System\nVvlzLX.exe
  C:\Windows\System\nVvlzLX.exe
  2⤵
  PID:5652
- C:\Windows\System\iISkYEa.exe
  C:\Windows\System\iISkYEa.exe
  2⤵
  PID:6440
- C:\Windows\System\bgrzoYL.exe
  C:\Windows\System\bgrzoYL.exe
  2⤵
  PID:5860
- C:\Windows\System\moVCwhB.exe
  C:\Windows\System\moVCwhB.exe
  2⤵
  PID:5924
- C:\Windows\System\CxbYKDD.exe
  C:\Windows\System\CxbYKDD.exe
  2⤵
  PID:6864
- C:\Windows\System\UAadbTE.exe
  C:\Windows\System\UAadbTE.exe
  2⤵
  PID:6884
- C:\Windows\System\fxenHZR.exe
  C:\Windows\System\fxenHZR.exe
  2⤵
  PID:5992
- C:\Windows\System\cYydBYo.exe
  C:\Windows\System\cYydBYo.exe
  2⤵
  PID:4504
- C:\Windows\System\DfcCTJe.exe
  C:\Windows\System\DfcCTJe.exe
  2⤵
  PID:6184
- C:\Windows\System\pIsPXgy.exe
  C:\Windows\System\pIsPXgy.exe
  2⤵
  PID:6244
- C:\Windows\System\hxQpzVa.exe
  C:\Windows\System\hxQpzVa.exe
  2⤵
  PID:6284
- C:\Windows\System\xgKCnqm.exe
  C:\Windows\System\xgKCnqm.exe
  2⤵
  PID:6332
- C:\Windows\System\YqRCNTF.exe
  C:\Windows\System\YqRCNTF.exe
  2⤵
  PID:6364
- C:\Windows\System\PGAvwBB.exe
  C:\Windows\System\PGAvwBB.exe
  2⤵
  PID:6416
- C:\Windows\System\SiIsSyA.exe
  C:\Windows\System\SiIsSyA.exe
  2⤵
  PID:6536
- C:\Windows\System\fkUFVXF.exe
  C:\Windows\System\fkUFVXF.exe
  2⤵
  PID:6568
- C:\Windows\System\tZgFOto.exe
  C:\Windows\System\tZgFOto.exe
  2⤵
  PID:6636
- C:\Windows\System\jZlnVWF.exe
  C:\Windows\System\jZlnVWF.exe
  2⤵
  PID:6680
- C:\Windows\System\JDoQBnD.exe
  C:\Windows\System\JDoQBnD.exe
  2⤵
  PID:6720
- C:\Windows\System\LvRAiVW.exe
  C:\Windows\System\LvRAiVW.exe
  2⤵
  PID:6768
- C:\Windows\System\ttSTtxZ.exe
  C:\Windows\System\ttSTtxZ.exe
  2⤵
  PID:6800
- C:\Windows\System\huJLWzm.exe
  C:\Windows\System\huJLWzm.exe
  2⤵
  PID:6952
- C:\Windows\System\oghucBn.exe
  C:\Windows\System\oghucBn.exe
  2⤵
  PID:232
- C:\Windows\System\KnyEoIY.exe
  C:\Windows\System\KnyEoIY.exe
  2⤵
  PID:6992
- C:\Windows\System\aBoJrXk.exe
  C:\Windows\System\aBoJrXk.exe
  2⤵
  PID:7040
- C:\Windows\System\GrXltrZ.exe
  C:\Windows\System\GrXltrZ.exe
  2⤵
  PID:3056
- C:\Windows\System\eEdIuoO.exe
  C:\Windows\System\eEdIuoO.exe
  2⤵
  PID:4544
- C:\Windows\System\IhvlGJo.exe
  C:\Windows\System\IhvlGJo.exe
  2⤵
  PID:3364
- C:\Windows\System\PJySxDs.exe
  C:\Windows\System\PJySxDs.exe
  2⤵
  PID:3292
- C:\Windows\System\DgWhWdi.exe
  C:\Windows\System\DgWhWdi.exe
  2⤵
  PID:3324
- C:\Windows\System\GZIqljd.exe
  C:\Windows\System\GZIqljd.exe
  2⤵
  PID:4832
- C:\Windows\System\qBHVkkk.exe
  C:\Windows\System\qBHVkkk.exe
  2⤵
  PID:3440
- C:\Windows\System\yqrAnEZ.exe
  C:\Windows\System\yqrAnEZ.exe
  2⤵
  PID:1920
- C:\Windows\System\LmpXlWZ.exe
  C:\Windows\System\LmpXlWZ.exe
  2⤵
  PID:1460
- C:\Windows\System\gQSpjdR.exe
  C:\Windows\System\gQSpjdR.exe
  2⤵
  PID:3108
- C:\Windows\System\RVIfomz.exe
  C:\Windows\System\RVIfomz.exe
  2⤵
  PID:2924
- C:\Windows\System\WzJokUx.exe
  C:\Windows\System\WzJokUx.exe
  2⤵
  PID:4836
- C:\Windows\System\IGtuzUF.exe
  C:\Windows\System\IGtuzUF.exe
  2⤵
  PID:4632
- C:\Windows\System\avKzFHN.exe
  C:\Windows\System\avKzFHN.exe
  2⤵
  PID:4176
- C:\Windows\System\SEYNeXU.exe
  C:\Windows\System\SEYNeXU.exe
  2⤵
  PID:5824
- C:\Windows\System\bnJtles.exe
  C:\Windows\System\bnJtles.exe
  2⤵
  PID:3260
- C:\Windows\System\zMxruht.exe
  C:\Windows\System\zMxruht.exe
  2⤵
  PID:4200
- C:\Windows\System\GnlnIqC.exe
  C:\Windows\System\GnlnIqC.exe
  2⤵
  PID:5184
- C:\Windows\System\SogNTfW.exe
  C:\Windows\System\SogNTfW.exe
  2⤵
  PID:4060
- C:\Windows\System\ToqAWEH.exe
  C:\Windows\System\ToqAWEH.exe
  2⤵
  PID:5352
- C:\Windows\System\nmvGmFT.exe
  C:\Windows\System\nmvGmFT.exe
  2⤵
  PID:5420
- C:\Windows\System\UEfkCfE.exe
  C:\Windows\System\UEfkCfE.exe
  2⤵
  PID:5148
- C:\Windows\System\EOAWGrr.exe
  C:\Windows\System\EOAWGrr.exe
  2⤵
  PID:5552
- C:\Windows\System\fZAfHwQ.exe
  C:\Windows\System\fZAfHwQ.exe
  2⤵
  PID:6852
- C:\Windows\System\AYapBSa.exe
  C:\Windows\System\AYapBSa.exe
  2⤵
  PID:5908
- C:\Windows\System\vprseXK.exe
  C:\Windows\System\vprseXK.exe
  2⤵
  PID:6268
- C:\Windows\System\ANSgrZp.exe
  C:\Windows\System\ANSgrZp.exe
  2⤵
  PID:5712
- C:\Windows\System\FmnQWBb.exe
  C:\Windows\System\FmnQWBb.exe
  2⤵
  PID:6296
- C:\Windows\System\ygKmrfK.exe
  C:\Windows\System\ygKmrfK.exe
  2⤵
  PID:6584
- C:\Windows\System\UACdcRZ.exe
  C:\Windows\System\UACdcRZ.exe
  2⤵
  PID:3784
- C:\Windows\System\OqxoGqK.exe
  C:\Windows\System\OqxoGqK.exe
  2⤵
  PID:6912
- C:\Windows\System\TmoDHzi.exe
  C:\Windows\System\TmoDHzi.exe
  2⤵
  PID:4952
- C:\Windows\System\ueOYumj.exe
  C:\Windows\System\ueOYumj.exe
  2⤵
  PID:1456
- C:\Windows\System\nhxlAMy.exe
  C:\Windows\System\nhxlAMy.exe
  2⤵
  PID:6652
- C:\Windows\System\MAGPpmA.exe
  C:\Windows\System\MAGPpmA.exe
  2⤵
  PID:6740
- C:\Windows\System\iiAovCQ.exe
  C:\Windows\System\iiAovCQ.exe
  2⤵
  PID:3556
- C:\Windows\System\fOjtVyW.exe
  C:\Windows\System\fOjtVyW.exe
  2⤵
  PID:7016
- C:\Windows\System\xrLdyBf.exe
  C:\Windows\System\xrLdyBf.exe
  2⤵
  PID:2648
- C:\Windows\System\ocIVytB.exe
  C:\Windows\System\ocIVytB.exe
  2⤵
  PID:5416
- C:\Windows\System\IEmXVcd.exe
  C:\Windows\System\IEmXVcd.exe
  2⤵
  PID:4396
- C:\Windows\System\fAWYyck.exe
  C:\Windows\System\fAWYyck.exe
  2⤵
  PID:3116
- C:\Windows\System\RedIqAn.exe
  C:\Windows\System\RedIqAn.exe
  2⤵
  PID:2280
- C:\Windows\System\ihDuLJa.exe
  C:\Windows\System\ihDuLJa.exe
  2⤵
  PID:3656
- C:\Windows\System\wrXkTBv.exe
  C:\Windows\System\wrXkTBv.exe
  2⤵
  PID:5300
- C:\Windows\System\KFRsYsK.exe
  C:\Windows\System\KFRsYsK.exe
  2⤵
  PID:7184
- C:\Windows\System\oEXraCq.exe
  C:\Windows\System\oEXraCq.exe
  2⤵
  PID:7200
- C:\Windows\System\iuiduHB.exe
  C:\Windows\System\iuiduHB.exe
  2⤵
  PID:7228
- C:\Windows\System\oubmRqW.exe
  C:\Windows\System\oubmRqW.exe
  2⤵
  PID:7244
- C:\Windows\System\ruKmNyQ.exe
  C:\Windows\System\ruKmNyQ.exe
  2⤵
  PID:7268
- C:\Windows\System\hRgHMCX.exe
  C:\Windows\System\hRgHMCX.exe
  2⤵
  PID:7284
- C:\Windows\System\XftwgKr.exe
  C:\Windows\System\XftwgKr.exe
  2⤵
  PID:7312
- C:\Windows\System\KzKUrEh.exe
  C:\Windows\System\KzKUrEh.exe
  2⤵
  PID:7332
- C:\Windows\System\uDfzKdk.exe
  C:\Windows\System\uDfzKdk.exe
  2⤵
  PID:7352
- C:\Windows\System\AoUBOyy.exe
  C:\Windows\System\AoUBOyy.exe
  2⤵
  PID:7376
- C:\Windows\System\jFgywAj.exe
  C:\Windows\System\jFgywAj.exe
  2⤵
  PID:7396
- C:\Windows\System\wUbJGkk.exe
  C:\Windows\System\wUbJGkk.exe
  2⤵
  PID:7416
- C:\Windows\System\uKxfcKk.exe
  C:\Windows\System\uKxfcKk.exe
  2⤵
  PID:7432
- C:\Windows\System\kZTrtqE.exe
  C:\Windows\System\kZTrtqE.exe
  2⤵
  PID:7460
- C:\Windows\System\bEqxBCP.exe
  C:\Windows\System\bEqxBCP.exe
  2⤵
  PID:7480
- C:\Windows\System\bDFevao.exe
  C:\Windows\System\bDFevao.exe
  2⤵
  PID:7504
- C:\Windows\System\akulzvi.exe
  C:\Windows\System\akulzvi.exe
  2⤵
  PID:7524
- C:\Windows\System\ROBjzIz.exe
  C:\Windows\System\ROBjzIz.exe
  2⤵
  PID:7544
- C:\Windows\System\BWOrVPd.exe
  C:\Windows\System\BWOrVPd.exe
  2⤵
  PID:7568
- C:\Windows\System\gMjBWEo.exe
  C:\Windows\System\gMjBWEo.exe
  2⤵
  PID:7588
- C:\Windows\System\FgKwqOh.exe
  C:\Windows\System\FgKwqOh.exe
  2⤵
  PID:7608
- C:\Windows\System\EEvuxYh.exe
  C:\Windows\System\EEvuxYh.exe
  2⤵
  PID:7628
- C:\Windows\System\uZmrHdJ.exe
  C:\Windows\System\uZmrHdJ.exe
  2⤵
  PID:7656
- C:\Windows\System\IRGCvpG.exe
  C:\Windows\System\IRGCvpG.exe
  2⤵
  PID:7676
- C:\Windows\System\sLwWQth.exe
  C:\Windows\System\sLwWQth.exe
  2⤵
  PID:7704
- C:\Windows\System\YHTbtGe.exe
  C:\Windows\System\YHTbtGe.exe
  2⤵
  PID:7724
- C:\Windows\System\uySlTAx.exe
  C:\Windows\System\uySlTAx.exe
  2⤵
  PID:7748
- C:\Windows\System\IrGpbbQ.exe
  C:\Windows\System\IrGpbbQ.exe
  2⤵
  PID:7768
- C:\Windows\System\oGTQfQG.exe
  C:\Windows\System\oGTQfQG.exe
  2⤵
  PID:7788
- C:\Windows\System\WkwYjAp.exe
  C:\Windows\System\WkwYjAp.exe
  2⤵
  PID:7812
- C:\Windows\System\kKfzXbn.exe
  C:\Windows\System\kKfzXbn.exe
  2⤵
  PID:7836
- C:\Windows\System\qUxDImq.exe
  C:\Windows\System\qUxDImq.exe
  2⤵
  PID:7856
- C:\Windows\System\dXZpIxM.exe
  C:\Windows\System\dXZpIxM.exe
  2⤵
  PID:7876
- C:\Windows\System\UuOTFix.exe
  C:\Windows\System\UuOTFix.exe
  2⤵
  PID:7900
- C:\Windows\System\kuuxLUz.exe
  C:\Windows\System\kuuxLUz.exe
  2⤵
  PID:7920
- C:\Windows\System\rOVFnTG.exe
  C:\Windows\System\rOVFnTG.exe
  2⤵
  PID:7948
- C:\Windows\System\PujNmPV.exe
  C:\Windows\System\PujNmPV.exe
  2⤵
  PID:7968
- C:\Windows\System\xOHmNHF.exe
  C:\Windows\System\xOHmNHF.exe
  2⤵
  PID:7984
- C:\Windows\System\BAWICGE.exe
  C:\Windows\System\BAWICGE.exe
  2⤵
  PID:8004
- C:\Windows\System\BCuvdzq.exe
  C:\Windows\System\BCuvdzq.exe
  2⤵
  PID:8028
- C:\Windows\System\mtlkhkb.exe
  C:\Windows\System\mtlkhkb.exe
  2⤵
  PID:8048
- C:\Windows\System\HcCpxTW.exe
  C:\Windows\System\HcCpxTW.exe
  2⤵
  PID:8068
- C:\Windows\System\yNAuDVT.exe
  C:\Windows\System\yNAuDVT.exe
  2⤵
  PID:8092
- C:\Windows\System\aaDZFWc.exe
  C:\Windows\System\aaDZFWc.exe
  2⤵
  PID:8112
- C:\Windows\System\quRutjo.exe
  C:\Windows\System\quRutjo.exe
  2⤵
  PID:8136
- C:\Windows\System\LNhpYto.exe
  C:\Windows\System\LNhpYto.exe
  2⤵
  PID:8160
- C:\Windows\System\uhldjMV.exe
  C:\Windows\System\uhldjMV.exe
  2⤵
  PID:8188
- C:\Windows\System\cvORnhn.exe
  C:\Windows\System\cvORnhn.exe
  2⤵
  PID:3700
- C:\Windows\System\aelMLXc.exe
  C:\Windows\System\aelMLXc.exe
  2⤵
  PID:1704
- C:\Windows\System\xbwjbGg.exe
  C:\Windows\System\xbwjbGg.exe
  2⤵
  PID:6660
- C:\Windows\System\IqnUZLf.exe
  C:\Windows\System\IqnUZLf.exe
  2⤵
  PID:3624
- C:\Windows\System\oUYESuR.exe
  C:\Windows\System\oUYESuR.exe
  2⤵
  PID:5964
- C:\Windows\System\QGxSxZZ.exe
  C:\Windows\System\QGxSxZZ.exe
  2⤵
  PID:2976
- C:\Windows\System\AZEHbMr.exe
  C:\Windows\System\AZEHbMr.exe
  2⤵
  PID:7172
- C:\Windows\System\eWDqQFl.exe
  C:\Windows\System\eWDqQFl.exe
  2⤵
  PID:7056
- C:\Windows\System\XHyxhSB.exe
  C:\Windows\System\XHyxhSB.exe
  2⤵
  PID:7384
- C:\Windows\System\WmwroZA.exe
  C:\Windows\System\WmwroZA.exe
  2⤵
  PID:7440
- C:\Windows\System\sQeEZnl.exe
  C:\Windows\System\sQeEZnl.exe
  2⤵
  PID:3100
- C:\Windows\System\WTfAAls.exe
  C:\Windows\System\WTfAAls.exe
  2⤵
  PID:6552
- C:\Windows\System\TLLebWZ.exe
  C:\Windows\System\TLLebWZ.exe
  2⤵
  PID:7684
- C:\Windows\System\lcTKVTM.exe
  C:\Windows\System\lcTKVTM.exe
  2⤵
  PID:7696
- C:\Windows\System\IQWZEeQ.exe
  C:\Windows\System\IQWZEeQ.exe
  2⤵
  PID:7304
- C:\Windows\System\rSfaFHo.exe
  C:\Windows\System\rSfaFHo.exe
  2⤵
  PID:7344
- C:\Windows\System\NSTmrGZ.exe
  C:\Windows\System\NSTmrGZ.exe
  2⤵
  PID:7736
- C:\Windows\System\aVOnttc.exe
  C:\Windows\System\aVOnttc.exe
  2⤵
  PID:7848
- C:\Windows\System\dkRYPLa.exe
  C:\Windows\System\dkRYPLa.exe
  2⤵
  PID:7492
- C:\Windows\System\kBLGwGA.exe
  C:\Windows\System\kBLGwGA.exe
  2⤵
  PID:7928
- C:\Windows\System\DlMOHrL.exe
  C:\Windows\System\DlMOHrL.exe
  2⤵
  PID:7992
- C:\Windows\System\QWojxEV.exe
  C:\Windows\System\QWojxEV.exe
  2⤵
  PID:7192
- C:\Windows\System\XXruYvs.exe
  C:\Windows\System\XXruYvs.exe
  2⤵
  PID:7644
- C:\Windows\System\XMrutfy.exe
  C:\Windows\System\XMrutfy.exe
  2⤵
  PID:8200
- C:\Windows\System\waFtLUf.exe
  C:\Windows\System\waFtLUf.exe
  2⤵
  PID:8228
- C:\Windows\System\uvMcLSw.exe
  C:\Windows\System\uvMcLSw.exe
  2⤵
  PID:8248
- C:\Windows\System\mwjJwNa.exe
  C:\Windows\System\mwjJwNa.exe
  2⤵
  PID:8272
- C:\Windows\System\KbMubBL.exe
  C:\Windows\System\KbMubBL.exe
  2⤵
  PID:8292
- C:\Windows\System\wmCuFQk.exe
  C:\Windows\System\wmCuFQk.exe
  2⤵
  PID:8312
- C:\Windows\System\gkaRAdR.exe
  C:\Windows\System\gkaRAdR.exe
  2⤵
  PID:8340
- C:\Windows\System\lWUPxma.exe
  C:\Windows\System\lWUPxma.exe
  2⤵
  PID:8360
- C:\Windows\System\BjyWYhh.exe
  C:\Windows\System\BjyWYhh.exe
  2⤵
  PID:8376
- C:\Windows\System\VuBeDWC.exe
  C:\Windows\System\VuBeDWC.exe
  2⤵
  PID:8404
- C:\Windows\System\RlOfnYi.exe
  C:\Windows\System\RlOfnYi.exe
  2⤵
  PID:8424
- C:\Windows\System\VllKkSl.exe
  C:\Windows\System\VllKkSl.exe
  2⤵
  PID:8444
- C:\Windows\System\wiIItho.exe
  C:\Windows\System\wiIItho.exe
  2⤵
  PID:8472
- C:\Windows\System\TBkWlPl.exe
  C:\Windows\System\TBkWlPl.exe
  2⤵
  PID:8492
- C:\Windows\System\xPqKTlf.exe
  C:\Windows\System\xPqKTlf.exe
  2⤵
  PID:8512
- C:\Windows\System\Ubkgpos.exe
  C:\Windows\System\Ubkgpos.exe
  2⤵
  PID:8532
- C:\Windows\System\VcXFAfn.exe
  C:\Windows\System\VcXFAfn.exe
  2⤵
  PID:8556
- C:\Windows\System\QvDMOHL.exe
  C:\Windows\System\QvDMOHL.exe
  2⤵
  PID:8584
- C:\Windows\System\wlUetCA.exe
  C:\Windows\System\wlUetCA.exe
  2⤵
  PID:8604
- C:\Windows\System\lrttDoa.exe
  C:\Windows\System\lrttDoa.exe
  2⤵
  PID:8628
- C:\Windows\System\RwezAIy.exe
  C:\Windows\System\RwezAIy.exe
  2⤵
  PID:8648
- C:\Windows\System\QnbCiAP.exe
  C:\Windows\System\QnbCiAP.exe
  2⤵
  PID:8672
- C:\Windows\System\RPqHPNK.exe
  C:\Windows\System\RPqHPNK.exe
  2⤵
  PID:8696
- C:\Windows\System\mjEcHQS.exe
  C:\Windows\System\mjEcHQS.exe
  2⤵
  PID:8716
- C:\Windows\System\IOwzVdf.exe
  C:\Windows\System\IOwzVdf.exe
  2⤵
  PID:8736
- C:\Windows\System\ZRWknmJ.exe
  C:\Windows\System\ZRWknmJ.exe
  2⤵
  PID:8768
- C:\Windows\System\kfYkdTh.exe
  C:\Windows\System\kfYkdTh.exe
  2⤵
  PID:8788
- C:\Windows\System\xniuPcV.exe
  C:\Windows\System\xniuPcV.exe
  2⤵
  PID:8812
- C:\Windows\System\yKOMygi.exe
  C:\Windows\System\yKOMygi.exe
  2⤵
  PID:8832
- C:\Windows\System\toMJlpm.exe
  C:\Windows\System\toMJlpm.exe
  2⤵
  PID:8852
- C:\Windows\System\mUCxxNf.exe
  C:\Windows\System\mUCxxNf.exe
  2⤵
  PID:8876
- C:\Windows\System\SkrdKpA.exe
  C:\Windows\System\SkrdKpA.exe
  2⤵
  PID:8896
- C:\Windows\System\VXoUJir.exe
  C:\Windows\System\VXoUJir.exe
  2⤵
  PID:8920
- C:\Windows\System\vdnFSwo.exe
  C:\Windows\System\vdnFSwo.exe
  2⤵
  PID:8944
- C:\Windows\System\zHhLcvz.exe
  C:\Windows\System\zHhLcvz.exe
  2⤵
  PID:8964
- C:\Windows\System\rmnYZlE.exe
  C:\Windows\System\rmnYZlE.exe
  2⤵
  PID:8988
- C:\Windows\System\fChdWdp.exe
  C:\Windows\System\fChdWdp.exe
  2⤵
  PID:9012
- C:\Windows\System\jGkUfMY.exe
  C:\Windows\System\jGkUfMY.exe
  2⤵
  PID:9036
- C:\Windows\System\IoYpWkA.exe
  C:\Windows\System\IoYpWkA.exe
  2⤵
  PID:9056
- C:\Windows\System\ZoSfVDm.exe
  C:\Windows\System\ZoSfVDm.exe
  2⤵
  PID:9072
- C:\Windows\System\LIKOyrJ.exe
  C:\Windows\System\LIKOyrJ.exe
  2⤵
  PID:9088
- C:\Windows\System\AdCdilj.exe
  C:\Windows\System\AdCdilj.exe
  2⤵
  PID:9112
- C:\Windows\System\rKVSCtz.exe
  C:\Windows\System\rKVSCtz.exe
  2⤵
  PID:9132
- C:\Windows\System\lPGLYKq.exe
  C:\Windows\System\lPGLYKq.exe
  2⤵
  PID:9152
- C:\Windows\System\DTvaxLK.exe
  C:\Windows\System\DTvaxLK.exe
  2⤵
  PID:9168
- C:\Windows\System\OpStgdh.exe
  C:\Windows\System\OpStgdh.exe
  2⤵
  PID:9192
- C:\Windows\System\FzJDafk.exe
  C:\Windows\System\FzJDafk.exe
  2⤵
  PID:8120
- C:\Windows\System\XzqhDNY.exe
  C:\Windows\System\XzqhDNY.exe
  2⤵
  PID:8148
- C:\Windows\System\mzfKPhv.exe
  C:\Windows\System\mzfKPhv.exe
  2⤵
  PID:5488
- C:\Windows\System\HxRsBRq.exe
  C:\Windows\System\HxRsBRq.exe
  2⤵
  PID:7796
- C:\Windows\System\iOnODps.exe
  C:\Windows\System\iOnODps.exe
  2⤵
  PID:7404
- C:\Windows\System\zqxmKJe.exe
  C:\Windows\System\zqxmKJe.exe
  2⤵
  PID:7264
- C:\Windows\System\LQbFjci.exe
  C:\Windows\System\LQbFjci.exe
  2⤵
  PID:7552
- C:\Windows\System\IJUscVM.exe
  C:\Windows\System\IJUscVM.exe
  2⤵
  PID:7980
- C:\Windows\System\umkvyVs.exe
  C:\Windows\System\umkvyVs.exe
  2⤵
  PID:7372
- C:\Windows\System\BAxnKQh.exe
  C:\Windows\System\BAxnKQh.exe
  2⤵
  PID:8020
- C:\Windows\System\qSGmDlL.exe
  C:\Windows\System\qSGmDlL.exe
  2⤵
  PID:7620
- C:\Windows\System\ayMaMOW.exe
  C:\Windows\System\ayMaMOW.exe
  2⤵
  PID:8196
- C:\Windows\System\kcTzmsC.exe
  C:\Windows\System\kcTzmsC.exe
  2⤵
  PID:8264
- C:\Windows\System\iAEAqvF.exe
  C:\Windows\System\iAEAqvF.exe
  2⤵
  PID:8168
- C:\Windows\System\BttKnbp.exe
  C:\Windows\System\BttKnbp.exe
  2⤵
  PID:7740
- C:\Windows\System\AbECVyp.exe
  C:\Windows\System\AbECVyp.exe
  2⤵
  PID:7764
- C:\Windows\System\VcDiWdJ.exe
  C:\Windows\System\VcDiWdJ.exe
  2⤵
  PID:7392
- C:\Windows\System\OgEVZeN.exe
  C:\Windows\System\OgEVZeN.exe
  2⤵
  PID:6324
- C:\Windows\System\YdgMySV.exe
  C:\Windows\System\YdgMySV.exe
  2⤵
  PID:8616
- C:\Windows\System\RZcktbM.exe
  C:\Windows\System\RZcktbM.exe
  2⤵
  PID:9224
- C:\Windows\System\PLsMAwM.exe
  C:\Windows\System\PLsMAwM.exe
  2⤵
  PID:9248
- C:\Windows\System\vMgMLDo.exe
  C:\Windows\System\vMgMLDo.exe
  2⤵
  PID:9272
- C:\Windows\System\NKtnJBX.exe
  C:\Windows\System\NKtnJBX.exe
  2⤵
  PID:9300
- C:\Windows\System\eQybZSV.exe
  C:\Windows\System\eQybZSV.exe
  2⤵
  PID:9316
- C:\Windows\System\evrhGDZ.exe
  C:\Windows\System\evrhGDZ.exe
  2⤵
  PID:9336
- C:\Windows\System\HHoOgLk.exe
  C:\Windows\System\HHoOgLk.exe
  2⤵
  PID:9360
- C:\Windows\System\wWIHXJA.exe
  C:\Windows\System\wWIHXJA.exe
  2⤵
  PID:9380
- C:\Windows\System\KftNgRy.exe
  C:\Windows\System\KftNgRy.exe
  2⤵
  PID:9404
- C:\Windows\System\FZUZeif.exe
  C:\Windows\System\FZUZeif.exe
  2⤵
  PID:9424
- C:\Windows\System\cNWrusf.exe
  C:\Windows\System\cNWrusf.exe
  2⤵
  PID:9452
- C:\Windows\System\KAxfunb.exe
  C:\Windows\System\KAxfunb.exe
  2⤵
  PID:9472
- C:\Windows\System\MunHsjv.exe
  C:\Windows\System\MunHsjv.exe
  2⤵
  PID:9500
- C:\Windows\System\MqieTTY.exe
  C:\Windows\System\MqieTTY.exe
  2⤵
  PID:9520
- C:\Windows\System\eRDusqA.exe
  C:\Windows\System\eRDusqA.exe
  2⤵
  PID:9536
- C:\Windows\System\uyWbJuh.exe
  C:\Windows\System\uyWbJuh.exe
  2⤵
  PID:9556
- C:\Windows\System\QOMpLnm.exe
  C:\Windows\System\QOMpLnm.exe
  2⤵
  PID:9580
- C:\Windows\System\xWKriRX.exe
  C:\Windows\System\xWKriRX.exe
  2⤵
  PID:9604
- C:\Windows\System\OLVymps.exe
  C:\Windows\System\OLVymps.exe
  2⤵
  PID:9620
- C:\Windows\System\McOQKWp.exe
  C:\Windows\System\McOQKWp.exe
  2⤵
  PID:9644
- C:\Windows\System\FbaCpyn.exe
  C:\Windows\System\FbaCpyn.exe
  2⤵
  PID:9668
- C:\Windows\System\OdulBlZ.exe
  C:\Windows\System\OdulBlZ.exe
  2⤵
  PID:9688
- C:\Windows\System\EFDfOKM.exe
  C:\Windows\System\EFDfOKM.exe
  2⤵
  PID:9704
- C:\Windows\System\pKMDzAQ.exe
  C:\Windows\System\pKMDzAQ.exe
  2⤵
  PID:9724
- C:\Windows\System\IwXvXWD.exe
  C:\Windows\System\IwXvXWD.exe
  2⤵
  PID:9740
- C:\Windows\System\FyKvxDZ.exe
  C:\Windows\System\FyKvxDZ.exe
  2⤵
  PID:9764
- C:\Windows\System\SgbajyK.exe
  C:\Windows\System\SgbajyK.exe
  2⤵
  PID:9788
- C:\Windows\System\HXaQzPr.exe
  C:\Windows\System\HXaQzPr.exe
  2⤵
  PID:9812
- C:\Windows\System\kZFpHVZ.exe
  C:\Windows\System\kZFpHVZ.exe
  2⤵
  PID:9832
- C:\Windows\System\BANPtZD.exe
  C:\Windows\System\BANPtZD.exe
  2⤵
  PID:9852
- C:\Windows\System\YAmEupA.exe
  C:\Windows\System\YAmEupA.exe
  2⤵
  PID:9888
- C:\Windows\System\DhcEsne.exe
  C:\Windows\System\DhcEsne.exe
  2⤵
  PID:9908
- C:\Windows\System\QdotEYs.exe
  C:\Windows\System\QdotEYs.exe
  2⤵
  PID:9932
- C:\Windows\System\OMZBzME.exe
  C:\Windows\System\OMZBzME.exe
  2⤵
  PID:9952
- C:\Windows\System\JRPBvrk.exe
  C:\Windows\System\JRPBvrk.exe
  2⤵
  PID:9976
- C:\Windows\System\IcylWYR.exe
  C:\Windows\System\IcylWYR.exe
  2⤵
  PID:9996
- C:\Windows\System\eVorcpi.exe
  C:\Windows\System\eVorcpi.exe
  2⤵
  PID:10016
- C:\Windows\System\eowmxkw.exe
  C:\Windows\System\eowmxkw.exe
  2⤵
  PID:10040
- C:\Windows\System\Ymdkvzx.exe
  C:\Windows\System\Ymdkvzx.exe
  2⤵
  PID:10060
- C:\Windows\System\xOxEJna.exe
  C:\Windows\System\xOxEJna.exe
  2⤵
  PID:10092
- C:\Windows\System\icWruLE.exe
  C:\Windows\System\icWruLE.exe
  2⤵
  PID:10116
- C:\Windows\System\yORJyHK.exe
  C:\Windows\System\yORJyHK.exe
  2⤵
  PID:10140
- C:\Windows\System\ULtuXZn.exe
  C:\Windows\System\ULtuXZn.exe
  2⤵
  PID:10164
- C:\Windows\System\lpXizBH.exe
  C:\Windows\System\lpXizBH.exe
  2⤵
  PID:10192
- C:\Windows\System\utniPyx.exe
  C:\Windows\System\utniPyx.exe
  2⤵
  PID:10212
- C:\Windows\System\qxRqYsH.exe
  C:\Windows\System\qxRqYsH.exe
  2⤵
  PID:10228
- C:\Windows\System\otWzmsu.exe
  C:\Windows\System\otWzmsu.exe
  2⤵
  PID:8756
- C:\Windows\System\cHqqxSR.exe
  C:\Windows\System\cHqqxSR.exe
  2⤵
  PID:8076
- C:\Windows\System\ntENPXs.exe
  C:\Windows\System\ntENPXs.exe
  2⤵
  PID:8216
- C:\Windows\System\EBdciKH.exe
  C:\Windows\System\EBdciKH.exe
  2⤵
  PID:9048
- C:\Windows\System\WWpZABW.exe
  C:\Windows\System\WWpZABW.exe
  2⤵
  PID:9108
- C:\Windows\System\gSHIwyC.exe
  C:\Windows\System\gSHIwyC.exe
  2⤵
  PID:6960
- C:\Windows\System\qJGPZmJ.exe
  C:\Windows\System\qJGPZmJ.exe
  2⤵
  PID:8412
- C:\Windows\System\iFumofC.exe
  C:\Windows\System\iFumofC.exe
  2⤵
  PID:1476
- C:\Windows\System\zUDgXYr.exe
  C:\Windows\System\zUDgXYr.exe
  2⤵
  PID:9164
- C:\Windows\System\WdzyoNq.exe
  C:\Windows\System\WdzyoNq.exe
  2⤵
  PID:7828
- C:\Windows\System\ffKcDeN.exe
  C:\Windows\System\ffKcDeN.exe
  2⤵
  PID:8044
- C:\Windows\System\PzKeWQW.exe
  C:\Windows\System\PzKeWQW.exe
  2⤵
  PID:7636
- C:\Windows\System\LHrOOVy.exe
  C:\Windows\System\LHrOOVy.exe
  2⤵
  PID:6204
- C:\Windows\System\yLLYoEy.exe
  C:\Windows\System\yLLYoEy.exe
  2⤵
  PID:8552
- C:\Windows\System\KQOmWGH.exe
  C:\Windows\System\KQOmWGH.exe
  2⤵
  PID:9264
- C:\Windows\System\KWXMVpX.exe
  C:\Windows\System\KWXMVpX.exe
  2⤵
  PID:8728
- C:\Windows\System\DxgBRuf.exe
  C:\Windows\System\DxgBRuf.exe
  2⤵
  PID:9372
- C:\Windows\System\nEwyCZc.exe
  C:\Windows\System\nEwyCZc.exe
  2⤵
  PID:3472
- C:\Windows\System\CCfggZj.exe
  C:\Windows\System\CCfggZj.exe
  2⤵
  PID:9464
- C:\Windows\System\jqTtMbp.exe
  C:\Windows\System\jqTtMbp.exe
  2⤵
  PID:8868
- C:\Windows\System\bOBcHJa.exe
  C:\Windows\System\bOBcHJa.exe
  2⤵
  PID:8916
- C:\Windows\System\cvbzcDd.exe
  C:\Windows\System\cvbzcDd.exe
  2⤵
  PID:8236
- C:\Windows\System\OUiIAFu.exe
  C:\Windows\System\OUiIAFu.exe
  2⤵
  PID:8952
- C:\Windows\System\oHFbKZg.exe
  C:\Windows\System\oHFbKZg.exe
  2⤵
  PID:9020
- C:\Windows\System\vqbNQFr.exe
  C:\Windows\System\vqbNQFr.exe
  2⤵
  PID:8356
- C:\Windows\System\dAlIeWk.exe
  C:\Windows\System\dAlIeWk.exe
  2⤵
  PID:9772
- C:\Windows\System\eAaObLp.exe
  C:\Windows\System\eAaObLp.exe
  2⤵
  PID:10252
- C:\Windows\System\LdwEthY.exe
  C:\Windows\System\LdwEthY.exe
  2⤵
  PID:10276
- C:\Windows\System\oWLfZEC.exe
  C:\Windows\System\oWLfZEC.exe
  2⤵
  PID:10296
- C:\Windows\System\wLwYBjs.exe
  C:\Windows\System\wLwYBjs.exe
  2⤵
  PID:10324
- C:\Windows\System\TyVkWAS.exe
  C:\Windows\System\TyVkWAS.exe
  2⤵
  PID:10344
- C:\Windows\System\umnrsIc.exe
  C:\Windows\System\umnrsIc.exe
  2⤵
  PID:10364
- C:\Windows\System\VGwMHpw.exe
  C:\Windows\System\VGwMHpw.exe
  2⤵
  PID:10384
- C:\Windows\System\AUsRxao.exe
  C:\Windows\System\AUsRxao.exe
  2⤵
  PID:10408
- C:\Windows\System\ImdbKPs.exe
  C:\Windows\System\ImdbKPs.exe
  2⤵
  PID:10428
- C:\Windows\System\QawbWMA.exe
  C:\Windows\System\QawbWMA.exe
  2⤵
  PID:10448
- C:\Windows\System\fxRRftt.exe
  C:\Windows\System\fxRRftt.exe
  2⤵
  PID:10472
- C:\Windows\System\ngXCJcK.exe
  C:\Windows\System\ngXCJcK.exe
  2⤵
  PID:10496
- C:\Windows\System\YJAbgtM.exe
  C:\Windows\System\YJAbgtM.exe
  2⤵
  PID:10516
- C:\Windows\System\yJCpIEO.exe
  C:\Windows\System\yJCpIEO.exe
  2⤵
  PID:10536
- C:\Windows\System\jyAuRgG.exe
  C:\Windows\System\jyAuRgG.exe
  2⤵
  PID:10556
- C:\Windows\System\NETTksO.exe
  C:\Windows\System\NETTksO.exe
  2⤵
  PID:10584
- C:\Windows\System\HchxkdQ.exe
  C:\Windows\System\HchxkdQ.exe
  2⤵
  PID:10608
- C:\Windows\System\jMujZjb.exe
  C:\Windows\System\jMujZjb.exe
  2⤵
  PID:10624
- C:\Windows\System\SDktkur.exe
  C:\Windows\System\SDktkur.exe
  2⤵
  PID:10652
- C:\Windows\System\sRSDBiS.exe
  C:\Windows\System\sRSDBiS.exe
  2⤵
  PID:10668
- C:\Windows\System\JiRFENC.exe
  C:\Windows\System\JiRFENC.exe
  2⤵
  PID:10692
- C:\Windows\System\QdJAKZL.exe
  C:\Windows\System\QdJAKZL.exe
  2⤵
  PID:10716
- C:\Windows\System\QUTTxpM.exe
  C:\Windows\System\QUTTxpM.exe
  2⤵
  PID:10744
- C:\Windows\System\DCzwmdC.exe
  C:\Windows\System\DCzwmdC.exe
  2⤵
  PID:10764
- C:\Windows\System\limvUEr.exe
  C:\Windows\System\limvUEr.exe
  2⤵
  PID:10788
- C:\Windows\System\ekPYRFJ.exe
  C:\Windows\System\ekPYRFJ.exe
  2⤵
  PID:10812
- C:\Windows\System\glBwbwG.exe
  C:\Windows\System\glBwbwG.exe
  2⤵
  PID:10832
- C:\Windows\System\JDMscqU.exe
  C:\Windows\System\JDMscqU.exe
  2⤵
  PID:10864
- C:\Windows\System\vbDWpWL.exe
  C:\Windows\System\vbDWpWL.exe
  2⤵
  PID:10880
- C:\Windows\System\TEkRGeW.exe
  C:\Windows\System\TEkRGeW.exe
  2⤵
  PID:10900
- C:\Windows\System\NbjGDrs.exe
  C:\Windows\System\NbjGDrs.exe
  2⤵
  PID:10924
- C:\Windows\System\ZLgpfhg.exe
  C:\Windows\System\ZLgpfhg.exe
  2⤵
  PID:10948
- C:\Windows\System\RAcqUdh.exe
  C:\Windows\System\RAcqUdh.exe
  2⤵
  PID:10972
- C:\Windows\System\HxDrxzh.exe
  C:\Windows\System\HxDrxzh.exe
  2⤵
  PID:10992
- C:\Windows\System\nZdaYzi.exe
  C:\Windows\System\nZdaYzi.exe
  2⤵
  PID:11020
- C:\Windows\System\bgoZqQY.exe
  C:\Windows\System\bgoZqQY.exe
  2⤵
  PID:11044
- C:\Windows\System\XIWXRje.exe
  C:\Windows\System\XIWXRje.exe
  2⤵
  PID:11064
- C:\Windows\System\mcjbMlY.exe
  C:\Windows\System\mcjbMlY.exe
  2⤵
  PID:11084
- C:\Windows\System\GWRtsLp.exe
  C:\Windows\System\GWRtsLp.exe
  2⤵
  PID:11104
- C:\Windows\System\zqEejFU.exe
  C:\Windows\System\zqEejFU.exe
  2⤵
  PID:11120
- C:\Windows\System\PVIxPgO.exe
  C:\Windows\System\PVIxPgO.exe
  2⤵
  PID:11136
- C:\Windows\System\UHaPAIk.exe
  C:\Windows\System\UHaPAIk.exe
  2⤵
  PID:11152
- C:\Windows\System\tmePEpg.exe
  C:\Windows\System\tmePEpg.exe
  2⤵
  PID:11172
- C:\Windows\System\IJkpenx.exe
  C:\Windows\System\IJkpenx.exe
  2⤵
  PID:11196
- C:\Windows\System\SJcquvG.exe
  C:\Windows\System\SJcquvG.exe
  2⤵
  PID:11224
- C:\Windows\System\mdNDwXv.exe
  C:\Windows\System\mdNDwXv.exe
  2⤵
  PID:11248
- C:\Windows\System\QnYSAFR.exe
  C:\Windows\System\QnYSAFR.exe
  2⤵
  PID:9848
- C:\Windows\System\VvbrOma.exe
  C:\Windows\System\VvbrOma.exe
  2⤵
  PID:9900
- C:\Windows\System\omFFnQD.exe
  C:\Windows\System\omFFnQD.exe
  2⤵
  PID:7292
- C:\Windows\System\gJMOCwS.exe
  C:\Windows\System\gJMOCwS.exe
  2⤵
  PID:9940
- C:\Windows\System\vmHBAza.exe
  C:\Windows\System\vmHBAza.exe
  2⤵
  PID:9968
- C:\Windows\System\fhCnXcN.exe
  C:\Windows\System\fhCnXcN.exe
  2⤵
  PID:7824
- C:\Windows\System\qUUOviS.exe
  C:\Windows\System\qUUOviS.exe
  2⤵
  PID:7240
- C:\Windows\System\udkXlFY.exe
  C:\Windows\System\udkXlFY.exe
  2⤵
  PID:7280
- C:\Windows\System\mgncQzG.exe
  C:\Windows\System\mgncQzG.exe
  2⤵
  PID:8644
- C:\Windows\System\bXqIWOl.exe
  C:\Windows\System\bXqIWOl.exe
  2⤵
  PID:8220
- C:\Windows\System\jrnPtmi.exe
  C:\Windows\System\jrnPtmi.exe
  2⤵
  PID:9220
- C:\Windows\System\gvIWlTf.exe
  C:\Windows\System\gvIWlTf.exe
  2⤵
  PID:7912
- C:\Windows\System\kozGCVZ.exe
  C:\Windows\System\kozGCVZ.exe
  2⤵
  PID:8388
- C:\Windows\System\qQRVVJp.exe
  C:\Windows\System\qQRVVJp.exe
  2⤵
  PID:6676
- C:\Windows\System\PospSsN.exe
  C:\Windows\System\PospSsN.exe
  2⤵
  PID:9148
- C:\Windows\System\ZAskQBV.exe
  C:\Windows\System\ZAskQBV.exe
  2⤵
  PID:8600
- C:\Windows\System\hRUhCtr.exe
  C:\Windows\System\hRUhCtr.exe
  2⤵
  PID:9572
- C:\Windows\System\sltOQAo.exe
  C:\Windows\System\sltOQAo.exe
  2⤵
  PID:11280
- C:\Windows\System\TLfRsNr.exe
  C:\Windows\System\TLfRsNr.exe
  2⤵
  PID:11304
- C:\Windows\System\mPgiMFm.exe
  C:\Windows\System\mPgiMFm.exe
  2⤵
  PID:11328
- C:\Windows\System\PBpYfwd.exe
  C:\Windows\System\PBpYfwd.exe
  2⤵
  PID:11348
- C:\Windows\System\pnPEBnz.exe
  C:\Windows\System\pnPEBnz.exe
  2⤵
  PID:11368
- C:\Windows\System\rNamMuB.exe
  C:\Windows\System\rNamMuB.exe
  2⤵
  PID:11392
- C:\Windows\System\BEFvbQa.exe
  C:\Windows\System\BEFvbQa.exe
  2⤵
  PID:11416
- C:\Windows\System\zfJOhlV.exe
  C:\Windows\System\zfJOhlV.exe
  2⤵
  PID:11436
- C:\Windows\System\QkxzZrH.exe
  C:\Windows\System\QkxzZrH.exe
  2⤵
  PID:11460
- C:\Windows\System\ITIHqON.exe
  C:\Windows\System\ITIHqON.exe
  2⤵
  PID:11484
- C:\Windows\System\gqscatx.exe
  C:\Windows\System\gqscatx.exe
  2⤵
  PID:11508
- C:\Windows\System\DQKyipo.exe
  C:\Windows\System\DQKyipo.exe
  2⤵
  PID:11524
- C:\Windows\System\pmMSecy.exe
  C:\Windows\System\pmMSecy.exe
  2⤵
  PID:11548
- C:\Windows\System\trNQbli.exe
  C:\Windows\System\trNQbli.exe
  2⤵
  PID:11568
- C:\Windows\System\mFHHlaq.exe
  C:\Windows\System\mFHHlaq.exe
  2⤵
  PID:11592
- C:\Windows\System\wPASsEx.exe
  C:\Windows\System\wPASsEx.exe
  2⤵
  PID:11608
- C:\Windows\System\qGUIleE.exe
  C:\Windows\System\qGUIleE.exe
  2⤵
  PID:11628
- C:\Windows\System\txYsHHT.exe
  C:\Windows\System\txYsHHT.exe
  2⤵
  PID:11652
- C:\Windows\System\fptyBIl.exe
  C:\Windows\System\fptyBIl.exe
  2⤵
  PID:11676
- C:\Windows\System\qbneKlW.exe
  C:\Windows\System\qbneKlW.exe
  2⤵
  PID:11696
- C:\Windows\System\wwfQwHl.exe
  C:\Windows\System\wwfQwHl.exe
  2⤵
  PID:11716
- C:\Windows\System\YSrZcWH.exe
  C:\Windows\System\YSrZcWH.exe
  2⤵
  PID:11740
- C:\Windows\System\uraGyMF.exe
  C:\Windows\System\uraGyMF.exe
  2⤵
  PID:11764
- C:\Windows\System\lILvJOh.exe
  C:\Windows\System\lILvJOh.exe
  2⤵
  PID:11784
- C:\Windows\System\orcdfUr.exe
  C:\Windows\System\orcdfUr.exe
  2⤵
  PID:11808
- C:\Windows\System\BNgmCrQ.exe
  C:\Windows\System\BNgmCrQ.exe
  2⤵
  PID:11832
- C:\Windows\System\gDnXTcj.exe
  C:\Windows\System\gDnXTcj.exe
  2⤵
  PID:9352
- C:\Windows\System\mKTOUwT.exe
  C:\Windows\System\mKTOUwT.exe
  2⤵
  PID:8976
- C:\Windows\System\RHStccK.exe
  C:\Windows\System\RHStccK.exe
  2⤵
  PID:8064
- C:\Windows\System\twJdRUy.exe
  C:\Windows\System\twJdRUy.exe
  2⤵
  PID:9612
- C:\Windows\System\AKtLwMy.exe
  C:\Windows\System\AKtLwMy.exe
  2⤵
  PID:8828
- C:\Windows\System\XzzDUtI.exe
  C:\Windows\System\XzzDUtI.exe
  2⤵
  PID:11580
- C:\Windows\System\iMdrlkX.exe
  C:\Windows\System\iMdrlkX.exe
  2⤵
  PID:10248
- C:\Windows\System\zZBEkeY.exe
  C:\Windows\System\zZBEkeY.exe
  2⤵
  PID:11668
- C:\Windows\System\pjrGbLi.exe
  C:\Windows\System\pjrGbLi.exe
  2⤵
  PID:10380
- C:\Windows\System\CgVdWME.exe
  C:\Windows\System\CgVdWME.exe
  2⤵
  PID:11776
- C:\Windows\System\wxFVIJW.exe
  C:\Windows\System\wxFVIJW.exe
  2⤵
  PID:11820
- C:\Windows\System\uPIIiKj.exe
  C:\Windows\System\uPIIiKj.exe
  2⤵
  PID:10492
- C:\Windows\System\ScZqSgU.exe
  C:\Windows\System\ScZqSgU.exe
  2⤵
  PID:10572
- C:\Windows\System\SFjkPcI.exe
  C:\Windows\System\SFjkPcI.exe
  2⤵
  PID:10708
- C:\Windows\System\YwIrVgc.exe
  C:\Windows\System\YwIrVgc.exe
  2⤵
  PID:12016
- C:\Windows\System\KLBqslC.exe
  C:\Windows\System\KLBqslC.exe
  2⤵
  PID:12092
- C:\Windows\System\FYduxbZ.exe
  C:\Windows\System\FYduxbZ.exe
  2⤵
  PID:12144
- C:\Windows\System\DXXDusV.exe
  C:\Windows\System\DXXDusV.exe
  2⤵
  PID:7716
- C:\Windows\System\QuGNeYq.exe
  C:\Windows\System\QuGNeYq.exe
  2⤵
  PID:12176
- C:\Windows\System\TpAFiur.exe
  C:\Windows\System\TpAFiur.exe
  2⤵
  PID:7540
- C:\Windows\System\OaImSnG.exe
  C:\Windows\System\OaImSnG.exe
  2⤵
  PID:6436
- C:\Windows\System\ZdPbInU.exe
  C:\Windows\System\ZdPbInU.exe
  2⤵
  PID:7884
- C:\Windows\System\EMOfSMP.exe
  C:\Windows\System\EMOfSMP.exe
  2⤵
  PID:8612
- C:\Windows\System\sFcvFug.exe
  C:\Windows\System\sFcvFug.exe
  2⤵
  PID:12300
- C:\Windows\System\jVsZuiG.exe
  C:\Windows\System\jVsZuiG.exe
  2⤵
  PID:12316
- C:\Windows\System\najTDkM.exe
  C:\Windows\System\najTDkM.exe
  2⤵
  PID:12332
- C:\Windows\System\TtqVATC.exe
  C:\Windows\System\TtqVATC.exe
  2⤵
  PID:12348
- C:\Windows\System\DXrSnUC.exe
  C:\Windows\System\DXrSnUC.exe
  2⤵
  PID:12368
- C:\Windows\System\uSFsrLH.exe
  C:\Windows\System\uSFsrLH.exe
  2⤵
  PID:12408
- C:\Windows\System\CTEvDRe.exe
  C:\Windows\System\CTEvDRe.exe
  2⤵
  PID:12444
- C:\Windows\System\CVHeWUp.exe
  C:\Windows\System\CVHeWUp.exe
  2⤵
  PID:12488
- C:\Windows\System\PicgvOK.exe
  C:\Windows\System\PicgvOK.exe
  2⤵
  PID:12512
- C:\Windows\System\mEMTsdd.exe
  C:\Windows\System\mEMTsdd.exe
  2⤵
  PID:12536
- C:\Windows\System\TEBrmZY.exe
  C:\Windows\System\TEBrmZY.exe
  2⤵
  PID:12560
- C:\Windows\System\YzQJsLM.exe
  C:\Windows\System\YzQJsLM.exe
  2⤵
  PID:12576
- C:\Windows\System\inZaFZH.exe
  C:\Windows\System\inZaFZH.exe
  2⤵
  PID:12600
- C:\Windows\System\hTsqTRp.exe
  C:\Windows\System\hTsqTRp.exe
  2⤵
  PID:12620
- C:\Windows\System\EjwhxFb.exe
  C:\Windows\System\EjwhxFb.exe
  2⤵
  PID:12644
- C:\Windows\System\wZfHifU.exe
  C:\Windows\System\wZfHifU.exe
  2⤵
  PID:12664
- C:\Windows\System\yfqyHFD.exe
  C:\Windows\System\yfqyHFD.exe
  2⤵
  PID:12688
- C:\Windows\System\rxepymJ.exe
  C:\Windows\System\rxepymJ.exe
  2⤵
  PID:12712
- C:\Windows\System\hQEMZnO.exe
  C:\Windows\System\hQEMZnO.exe
  2⤵
  PID:12736
- C:\Windows\System\nzyZHSB.exe
  C:\Windows\System\nzyZHSB.exe
  2⤵
  PID:12752
- C:\Windows\System\dnJXxqc.exe
  C:\Windows\System\dnJXxqc.exe
  2⤵
  PID:12776
- C:\Windows\System\fnfVDPP.exe
  C:\Windows\System\fnfVDPP.exe
  2⤵
  PID:12804
- C:\Windows\System\BeMBknG.exe
  C:\Windows\System\BeMBknG.exe
  2⤵
  PID:12828
- C:\Windows\System\iQkZElb.exe
  C:\Windows\System\iQkZElb.exe
  2⤵
  PID:12860
- C:\Windows\System\DBHagAc.exe
  C:\Windows\System\DBHagAc.exe
  2⤵
  PID:12880
- C:\Windows\System\CRyZeWC.exe
  C:\Windows\System\CRyZeWC.exe
  2⤵
  PID:12900
- C:\Windows\System\jAEBezr.exe
  C:\Windows\System\jAEBezr.exe
  2⤵
  PID:12920
- C:\Windows\System\DRiNJEV.exe
  C:\Windows\System\DRiNJEV.exe
  2⤵
  PID:12948
- C:\Windows\System\zDxpNqA.exe
  C:\Windows\System\zDxpNqA.exe
  2⤵
  PID:12972
- C:\Windows\System\ePMLHvB.exe
  C:\Windows\System\ePMLHvB.exe
  2⤵
  PID:13000
- C:\Windows\System\vyveeIE.exe
  C:\Windows\System\vyveeIE.exe
  2⤵
  PID:13028
- C:\Windows\System\MTIReMj.exe
  C:\Windows\System\MTIReMj.exe
  2⤵
  PID:13044
- C:\Windows\System\zbfeIQd.exe
  C:\Windows\System\zbfeIQd.exe
  2⤵
  PID:13064
- C:\Windows\System\UdPKILc.exe
  C:\Windows\System\UdPKILc.exe
  2⤵
  PID:13092
- C:\Windows\System\ZYZBboY.exe
  C:\Windows\System\ZYZBboY.exe
  2⤵
  PID:13112
- C:\Windows\System\ksVjSEV.exe
  C:\Windows\System\ksVjSEV.exe
  2⤵
  PID:13136
- C:\Windows\System\IJAGdtJ.exe
  C:\Windows\System\IJAGdtJ.exe
  2⤵
  PID:13156
- C:\Windows\System\ciPmmKS.exe
  C:\Windows\System\ciPmmKS.exe
  2⤵
  PID:13176
- C:\Windows\System\UKiistD.exe
  C:\Windows\System\UKiistD.exe
  2⤵
  PID:13200
- C:\Windows\System\zSYdtRY.exe
  C:\Windows\System\zSYdtRY.exe
  2⤵
  PID:13228
- C:\Windows\System\ZIzNVss.exe
  C:\Windows\System\ZIzNVss.exe
  2⤵
  PID:13252
- C:\Windows\System\HmCOwce.exe
  C:\Windows\System\HmCOwce.exe
  2⤵
  PID:13272
- C:\Windows\System\wxhVbzj.exe
  C:\Windows\System\wxhVbzj.exe
  2⤵
  PID:13296
- C:\Windows\System\BsOQVpr.exe
  C:\Windows\System\BsOQVpr.exe
  2⤵
  PID:8180
- C:\Windows\System\ExRsFoZ.exe
  C:\Windows\System\ExRsFoZ.exe
  2⤵
  PID:8848
- C:\Windows\System\dJnGsdG.exe
  C:\Windows\System\dJnGsdG.exe
  2⤵
  PID:11268
- C:\Windows\System\TfPJcMs.exe
  C:\Windows\System\TfPJcMs.exe
  2⤵
  PID:9480
- C:\Windows\System\HXtBpNP.exe
  C:\Windows\System\HXtBpNP.exe
  2⤵
  PID:10336
- C:\Windows\System\MZbFvXR.exe
  C:\Windows\System\MZbFvXR.exe
  2⤵
  PID:11240
- C:\Windows\System\JxSYLrO.exe
  C:\Windows\System\JxSYLrO.exe
  2⤵
  PID:9824
- C:\Windows\System\VVXCoJj.exe
  C:\Windows\System\VVXCoJj.exe
  2⤵
  PID:9904
- C:\Windows\System\iQNeyZj.exe
  C:\Windows\System\iQNeyZj.exe
  2⤵
  PID:11816
- C:\Windows\System\jrPTEyZ.exe
  C:\Windows\System\jrPTEyZ.exe
  2⤵
  PID:10480
- C:\Windows\System\VusNmkG.exe
  C:\Windows\System\VusNmkG.exe
  2⤵
  PID:10760
- C:\Windows\System\PSjjwKp.exe
  C:\Windows\System\PSjjwKp.exe
  2⤵
  PID:9652
- C:\Windows\System\RXkRKSj.exe
  C:\Windows\System\RXkRKSj.exe
  2⤵
  PID:10304
- C:\Windows\System\PjUVjAh.exe
  C:\Windows\System\PjUVjAh.exe
  2⤵
  PID:10664
- C:\Windows\System\TBIYIqV.exe
  C:\Windows\System\TBIYIqV.exe
  2⤵
  PID:10756
- C:\Windows\System\yBMXqfG.exe
  C:\Windows\System\yBMXqfG.exe
  2⤵
  PID:10796
- C:\Windows\System\aUgUUmJ.exe
  C:\Windows\System\aUgUUmJ.exe
  2⤵
  PID:4900
- C:\Windows\System\sguPYnO.exe
  C:\Windows\System\sguPYnO.exe
  2⤵
  PID:10908
- C:\Windows\System\ygCMYjD.exe
  C:\Windows\System\ygCMYjD.exe
  2⤵
  PID:8104
- C:\Windows\System\KYqHNFp.exe
  C:\Windows\System\KYqHNFp.exe
  2⤵
  PID:12364
- C:\Windows\System\UXawjOn.exe
  C:\Windows\System\UXawjOn.exe
  2⤵
  PID:13292
- C:\Windows\System\Mtsnohj.exe
  C:\Windows\System\Mtsnohj.exe
  2⤵
  PID:12388
- C:\Windows\System\saavBmF.exe
  C:\Windows\System\saavBmF.exe
  2⤵
  PID:10780
- C:\Windows\System\ayrrjMl.exe
  C:\Windows\System\ayrrjMl.exe
  2⤵
  PID:12356
- C:\Windows\System\vFDPtHJ.exe
  C:\Windows\System\vFDPtHJ.exe
  2⤵
  PID:10800
- C:\Windows\System\pIKXQiZ.exe
  C:\Windows\System\pIKXQiZ.exe
  2⤵
  PID:9096
- C:\Windows\System\hOycdGX.exe
  C:\Windows\System\hOycdGX.exe
  2⤵
  PID:11432
- C:\Windows\System\nCPAPOP.exe
  C:\Windows\System\nCPAPOP.exe
  2⤵
  PID:12868
- C:\Windows\System\MYabBRk.exe
  C:\Windows\System\MYabBRk.exe
  2⤵
  PID:12820
- C:\Windows\System\CfeCzXE.exe
  C:\Windows\System\CfeCzXE.exe
  2⤵
  PID:11404
- C:\Windows\System\KommEyG.exe
  C:\Windows\System\KommEyG.exe
  2⤵
  PID:11360
- C:\Windows\System\UeFoJMd.exe
  C:\Windows\System\UeFoJMd.exe
  2⤵
  PID:11620
- C:\Windows\System\MqEFvwe.exe
  C:\Windows\System\MqEFvwe.exe
  2⤵
  PID:9368
- C:\Windows\System\azEZEGy.exe
  C:\Windows\System\azEZEGy.exe
  2⤵
  PID:11192
- C:\Windows\System\lvMTONC.exe
  C:\Windows\System\lvMTONC.exe
  2⤵
  PID:1532
- C:\Windows\System\vqVPfqj.exe
  C:\Windows\System\vqVPfqj.exe
  2⤵
  PID:12240
- C:\Windows\System\SkYMzvo.exe
  C:\Windows\System\SkYMzvo.exe
  2⤵
  PID:11092
- C:\Windows\System\IMnOrSw.exe
  C:\Windows\System\IMnOrSw.exe
  2⤵
  PID:13268
- C:\Windows\System\qQJDRmJ.exe
  C:\Windows\System\qQJDRmJ.exe
  2⤵
  PID:10772
- C:\Windows\System\DWOvpMp.exe
  C:\Windows\System\DWOvpMp.exe
  2⤵
  PID:3964
- C:\Windows\System\CqGoSKA.exe
  C:\Windows\System\CqGoSKA.exe
  2⤵
  PID:12124
- C:\Windows\System\akEqRGU.exe
  C:\Windows\System\akEqRGU.exe
  2⤵
  PID:9332
- C:\Windows\System\vDKbHSZ.exe
  C:\Windows\System\vDKbHSZ.exe
  2⤵
  PID:2912
- C:\Windows\System\JUFpEPo.exe
  C:\Windows\System\JUFpEPo.exe
  2⤵
  PID:11016
- C:\Windows\System\xgbIFxs.exe
  C:\Windows\System\xgbIFxs.exe
  2⤵
  PID:6796
- C:\Windows\System\icKLYxt.exe
  C:\Windows\System\icKLYxt.exe
  2⤵
  PID:3508
- C:\Windows\System\GCOzuFh.exe
  C:\Windows\System\GCOzuFh.exe
  2⤵
  PID:12152
- C:\Windows\System\gWhbxRE.exe
  C:\Windows\System\gWhbxRE.exe
  2⤵
  PID:11576
- C:\Windows\System\knpIuKM.exe
  C:\Windows\System\knpIuKM.exe
  2⤵
  PID:8084
- C:\Windows\System\hbJRaHY.exe
  C:\Windows\System\hbJRaHY.exe
  2⤵
  PID:10848
- C:\Windows\System\xOwbfyU.exe
  C:\Windows\System\xOwbfyU.exe
  2⤵
  PID:11952
- C:\Windows\System\ycLqbdI.exe
  C:\Windows\System\ycLqbdI.exe
  2⤵
  PID:4564
- C:\Windows\System\gJfiCSl.exe
  C:\Windows\System\gJfiCSl.exe
  2⤵
  PID:384
- C:\Windows\System\SzHfEUM.exe
  C:\Windows\System\SzHfEUM.exe
  2⤵
  PID:9588
- C:\Windows\System\hHKKZOr.exe
  C:\Windows\System\hHKKZOr.exe
  2⤵
  PID:12340
- C:\Windows\System\hlltMmA.exe
  C:\Windows\System\hlltMmA.exe
  2⤵
  PID:12292
- C:\Windows\System\WIPWbHx.exe
  C:\Windows\System\WIPWbHx.exe
  2⤵
  PID:13500
- C:\Windows\System\vOpCtrf.exe
  C:\Windows\System\vOpCtrf.exe
  2⤵
  PID:13632
- C:\Windows\System\VaJICTf.exe
  C:\Windows\System\VaJICTf.exe
  2⤵
  PID:13652
- C:\Windows\System\fEumRkz.exe
  C:\Windows\System\fEumRkz.exe
  2⤵
  PID:13716
- C:\Windows\System\ksvtnAB.exe
  C:\Windows\System\ksvtnAB.exe
  2⤵
  PID:11056
- C:\Windows\System\iExhOho.exe
  C:\Windows\System\iExhOho.exe
  2⤵
  PID:12308
- C:\Windows\System\sxRYvGl.exe
  C:\Windows\System\sxRYvGl.exe
  2⤵
  PID:12872
- C:\Windows\System\oOwruAj.exe
  C:\Windows\System\oOwruAj.exe
  2⤵
  PID:9508
- C:\Windows\System\vmSOgYg.exe
  C:\Windows\System\vmSOgYg.exe
  2⤵
  PID:13328
- C:\Windows\System\pslVWHI.exe
  C:\Windows\System\pslVWHI.exe
  2⤵
  PID:1760
- C:\Windows\System\zplAscY.exe
  C:\Windows\System\zplAscY.exe
  2⤵
  PID:13388
- C:\Windows\System\ZOdorvt.exe
  C:\Windows\System\ZOdorvt.exe
  2⤵
  PID:13540
- C:\Windows\System\WmZSooS.exe
  C:\Windows\System\WmZSooS.exe
  2⤵
  PID:13604
- C:\Windows\System\PWSnYtN.exe
  C:\Windows\System\PWSnYtN.exe
  2⤵
  PID:13580
- C:\Windows\System\unSrjNa.exe
  C:\Windows\System\unSrjNa.exe
  2⤵
  PID:13796
- C:\Windows\System\FpJRSrm.exe
  C:\Windows\System\FpJRSrm.exe
  2⤵
  PID:13828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1lqzetzi.2sq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AobRuGR.exe

Filesize
1.9MB

MD5
0c16803807d39cfd6b0145b79cfb58e5

SHA1
fd512cdbb6ba0dd8e26ba1bc2dc0338de49177ae

SHA256
458dec6810ca9dba020e1e02d294ddc1f3d75ea5a66478911c444472d6b21353

SHA512
e45427ec1ffb37563d7a40be26477c82970180876b7bced55e9856be7f444475a117b9d95bb83c6a892f4f6dc79dab8ed1427ae895cd8e7c05140b3b97a0fc86

Download Submit
C:\Windows\System\BFkKpCq.exe

Filesize
1.9MB

MD5
8fdfede24a7d18ca2153db3a0a76d234

SHA1
392fd8d52e317590eff27f61f947b26c0366694b

SHA256
59d8d86083419a2f17f76da00a4adb99686d8881a0b72debdfa1d6915185414f

SHA512
35ebe219ba28757a313ea92ead1b4cfe5b79469528ec7c18b675d1e9e32f66aa98df015ece664f10733b9f6cdc13078f054f1ddf75bb73cd0509cc4da533154d

Download Submit
C:\Windows\System\BXkwMBc.exe

Filesize
1.9MB

MD5
08d4e02992cc62d04aca0903c0c47ad5

SHA1
e60aa5bda8ac8c2a2111b2fb74dd5ee1ff282fb3

SHA256
d549aa36fc665a55ba88529d34a1da4b2b43782895d2f67e884fa58f7f66936f

SHA512
1bc1898cc77b53912f7209bbfcfce61ca541a538abcdf3a3f0162e833edbef87251f5e0a6488dccb7ff295a90e8d0de5d4a6348185025693b189002115b39b28

Download Submit
C:\Windows\System\BdNLTIs.exe

Filesize
1.9MB

MD5
a7496bf2a8188fbe26e52feae4bf02a8

SHA1
b3345d2a2e242d656e52cfcea1381f799367d5d3

SHA256
31858eebdf7ce408a70c3c3e3e68d34aef1cf09eb37f500bc84edee155144bed

SHA512
ca87b7ac6ce97814b644f3e4917759bb2c76e7b6cc5da35b252b4ff82bad5baa21f96b55fcf92c44e63d77e55bd2f6d414ee3bfecca75de63d2b2594adfc00a7

Download Submit
C:\Windows\System\CddepgD.exe

Filesize
1.9MB

MD5
6be7b15fe6339bc1581b7782af01d086

SHA1
5c337d2242bad19f11aec555095791be5b39f764

SHA256
d7f14346e677327df1fd698345664660e80d7431f88152b8c578633e21c0dfb9

SHA512
1750524825890b3663b730c8a1085c168c5a905af71f7acd252258d3d2d704762d9a43e2e745cbba93a940c87a626748b353ccef2306e77b423ac862f66af917

Download Submit
C:\Windows\System\EaWOlbM.exe

Filesize
1.9MB

MD5
adddd093913c35b7efbfd2f3ef771a9e

SHA1
5ddc2bce71a3153e66aca3d56e3f1319ed5982aa

SHA256
86e3b6472b4b489c6d282e6d1cab234acd2d1a06646057a9c74f4a97e5f81390

SHA512
b2e120c94c9b64eac67c7d9c2178d403131ffdf2ad29b43c9fd01654028dfc99870a2f5b5d1badb3ad25eb1f24d106480fc6d775125772d510d1108b6f2984a4

Download Submit
C:\Windows\System\FQwkbmX.exe

Filesize
1.9MB

MD5
1c71435033dc2438fe3bca2db978b02c

SHA1
7d074d88155c4fff6b53668ab94abd5c225c5be6

SHA256
b5ef42d5e3b47cbca52d33ee6c013f4bbe0dabff97b9107e2e34700a2bb3f72d

SHA512
43b6ecca5c478f524f8f82a05b48330ec1b7657840740f410e058eed8d922e15eff30c8c4ec8eed88626512566ceafb55ccac9e24d21b78090504e45da73194d

Download Submit
C:\Windows\System\GDKidNK.exe

Filesize
1.9MB

MD5
1fb8b064c1b6c7aede366ad72b899623

SHA1
661ef8f2b36e230fc179e1d2817e05ec49b9e5d7

SHA256
0f69714770f6caf6d537a2842931c7434aa10652734a7156cec62f79e2a8e7ac

SHA512
de4c7945656ae4f4a9d9995b50ef7be282171bc7e3adab60f5d16670f62b10d01a81eeca0c35077eb8ecdc239d2eb95cadfcf1488d69bf4b426c527d707b1852

Download Submit
C:\Windows\System\HUgHBpw.exe

Filesize
1.9MB

MD5
927ac93f489717679120b2bf8657c878

SHA1
5aa06dabdfb88db40c02ffecc87ab722837d7f24

SHA256
4cb36aa78151653f4c97c9d7d90a2272ea422dc0f3592e068747268dee921186

SHA512
06f1f5553acf40f121d8317f88a09684b3a7a74c8bc4e5ba9d6d7fb63660757d87ac4133fcc11253da99b3b5af66330046dbe730887b68839dcfc250374dc0a9

Download Submit
C:\Windows\System\Hrbibts.exe

Filesize
1.9MB

MD5
4c8047efe20e080b88d2a77d49b0e3d9

SHA1
d731b86e4f758cc1e55d0a07e44443c515f58a8c

SHA256
e4f3b95f90f146805c5d0dd69e67db5a7b1d5e63cd7958adc98e43a8c39a0602

SHA512
d65a29c2a47408936d675a1cdc3b12d639567ea424083eaf22dd3159a414472e2e7d34c7c9e8e2f9d09b560f087a794967edd6b7baed0927b007ab4cf1bfa1ee

Download Submit
C:\Windows\System\IYZjIuT.exe

Filesize
1.9MB

MD5
a7c0c3f7a42f3c866af27b27190b8ae2

SHA1
5a08eae8e90000b7e325a96775282ff3d53942be

SHA256
d1f0ad2dc6eb3bb69de7ff2e8e4e7763062dc15a8983a7d235e4300d4f1d2b64

SHA512
8731a155b8d47ed483a699ba30a2205ae6265edabb0e1ed51525a1183a9f1103fa37ce481d3ea9013e248331a20fe91d33f05953d9551cc26b732a7174e63663

Download Submit
C:\Windows\System\KHRXVYe.exe

Filesize
1.9MB

MD5
fed83d38bf31e40a11db8913d5afb053

SHA1
b4adf7242283e3b89bb7d4c9a6a0b6a92021cf20

SHA256
0f66a3a2806c16ec2e1241ec7273e08d2e0c4b48fe28fdb9edd58a447653eb0a

SHA512
70b45e2b544c031950846a06f3506fb521292a9c548ba6283e8fc87baa1cbf9674304ed3649fc729717d4774a3c42cbb0b36b55921d0f55156630bc6cbdc0304

Download Submit
C:\Windows\System\LCZtTky.exe

Filesize
1.9MB

MD5
daca1dca5612b0e327707c05aafa662a

SHA1
e7a9006185ffe70fbb6261b8b228344de845cbe1

SHA256
4ba03e93fdc1d275723b99226ff5c4444e1f9f88b4ba929ee95df264c541cd5d

SHA512
8e34c2d8e65ab0afba990450e39a5eb61b70d8bb5787a3774ed5f084c2baaa904a0fb1dc076076bf9960e42fbb6a876d0315456b03b78e4a8ec4cbb0bbccdaab

Download Submit
C:\Windows\System\LSZDQKO.exe

Filesize
1.9MB

MD5
2f8dc0c3eff463821d1b48969a6ee95c

SHA1
19535a4a8da25ca55f0c0bde9eb3fee7fcd4a952

SHA256
7a118cce23e0ddf958c7fdb56d74a46b05d858b6aa9d10b305d8fa831dc89c45

SHA512
7a3da7976e5ff6c96ac4867553be880c3113ce85ec3584c5cb220dbd1893437a43c3c9bb13d7972722b287ebf456fa5a30bf4b064b9b963b02276cf2350a09fa

Download Submit
C:\Windows\System\NztKtRR.exe

Filesize
1.9MB

MD5
d748191e368aae11b71cdf9adfab869b

SHA1
4223ff7fc019e7a00f0a16d00dabd4b22977d15e

SHA256
9c0774d6a606dbc023ba0eb0cca26b96a57b576eaeaaf1341a9becb4c58c3d24

SHA512
242aab7b13444ccd275b9b7771fd916a473306f259e1b08147a521bc445f3813879924edd4376c81ba024307e642717bf1bdd77028bab68f78bb123c75537a5f

Download Submit
C:\Windows\System\PDTrzms.exe

Filesize
1.9MB

MD5
7f38c7a47286c16681cc117118eb7ebd

SHA1
c238885f276705364afa1197acd8475212be584c

SHA256
3e57a7636e5e38a2ccabadea74268af2b1965a864210b3b08a52986794303a6e

SHA512
5d8b781cf73fdb536c489a80ab7c122fa23e6fdc1454cba60e016eac1affe6592ebfd27e7f2fbc0617f40d7a61d51262e7ce363a09fa8fe766c51754b9a74c49

Download Submit
C:\Windows\System\RlvXVob.exe

Filesize
1.9MB

MD5
6b9c59515d1bceacbe5c58917c865687

SHA1
c8590c63fdd960d50f7b95ddd70fff4da506e96f

SHA256
63e8a361a1a132dc7e4b6eaecc6b644d7f6bcfae0d73e06caa57eb376356d963

SHA512
89c1b77322803195aae023fc79dff5caae03755c156b3e4b316a6b9a80e1db589073d19c3dfa63ccb198231f68061674a6551ad8c757d80a9ca7ec187cc96b8b

Download Submit
C:\Windows\System\UiiSKRu.exe

Filesize
1.9MB

MD5
fba95eda14a33bb2e96a08e7f24c26cc

SHA1
8aa5a3586ef75a79642590a6ca1eda57f2d48802

SHA256
fe1f3eed64a18778da563dcfb68438df20df6cf979ab004e9f421d20a9b92d23

SHA512
0b1bd5a02553b6f3ceee202ee7208956c52223547bc4e305cbdcb6b0a43d9af207cb6f2bbf5042a95e4157e06560cbcf7c420e407ef24f525a3a8d096f72f215

Download Submit
C:\Windows\System\UzvnrtM.exe

Filesize
1.9MB

MD5
a82ef878a23e98cffd36a19ce4a5f3b6

SHA1
da0190fc3ccd411ddb9aabac14999c7f5f123ca2

SHA256
ff95d89f35e8dc3e459bf430e5825130f2cd3b73cde4e0b415ba5567cceec602

SHA512
29adc752766889d35ca16d681935a8a3d9c8f01b37ade575c9094427df723765e47d42b4c8f2ef395e99d0fe3428e01eac3d86c13b24e3bfaefce2895a74421c

Download Submit
C:\Windows\System\VnNEigo.exe

Filesize
1.9MB

MD5
cee1b6d0a39898c782248f872bde32ee

SHA1
8445fa8c254c9d3d275898a31c709c80f776b792

SHA256
75cec137f7a7d97c68324c0bf1ba78bafe2c887b8282571b54e0bd8f8740520e

SHA512
8ca872d4787a57c6d31aadee57c5a4bbf364cb3f816e5dd6caa86639ac508d8fd3e2ed9311cf4cc955df68093471560a54fda0436f09e159e0166af2f5c4d358

Download Submit
C:\Windows\System\YIzKydS.exe

Filesize
1.9MB

MD5
c631d65e59adda378b0491b6933a0e8c

SHA1
450b8e89eb5259f48c55d2e4e6c2c2c045d58922

SHA256
292fa28512008dfd8d7ba7d620e6d6d9012fd4ca833a72bd4cf8e87108180130

SHA512
9fd09c70a655c897c7ae960994d403903cbdd927741c5a7946b54927b0d5559a9314312c5ef14384c311c2d0b51cd146969f15db14692984c82b2990cbd6f486

Download Submit
C:\Windows\System\ZrCSLSx.exe

Filesize
1.9MB

MD5
77a3c9aedb81f1144cd2231aadf34575

SHA1
303442fe71883973820ee0e10c8351e80ecfe427

SHA256
e96b8781822ebca521752c4ec33288b6dd3c350975cc3e7b8edb05a8e0385319

SHA512
0d8bb95a51739399233148b8360ad2648628b9397f96d16b477419ac9202a3d2b4f957047ceb9938967c7367ddc26f8cdbdee9fdf223d1780791ab7a13699f73

Download Submit
C:\Windows\System\dSfIWqz.exe

Filesize
1.9MB

MD5
df1e6ed569f3ece67cdf06f066d223a8

SHA1
43214e82ada4d501c7d0d25a28782103b90cf693

SHA256
0cd4117bb2a8a65780cba9b89a4e60a74a9d72ec2d5e6de94903306a7e4433a1

SHA512
08c19de895a5025daf8cb4e70b3800a4301145188adc4f423fbed92225b3bf99a320a81cfd691ae54f0717bc5216fd4dcb1559368128942e337821254bae9d50

Download Submit
C:\Windows\System\ejzBloN.exe

Filesize
1.9MB

MD5
5e30699310b9a2c18e1b469258a3844a

SHA1
6e8079095fb01e42d605704857f287d17f4089f6

SHA256
ce767827328238c2248c4d4a734504c7413d34559e73a422ae97504f2d7a21b2

SHA512
e542239c19069b8be720359dc0dccefcea1cde7b4168e0028e9a3febba07d95aef35f85a5f92bffca18df4059ee7ee5e471350dd95b65a51a4b577a9a61bee81

Download Submit
C:\Windows\System\gJVGRVI.exe

Filesize
8B

MD5
a8f2921c80c15a3d426e5fdff8a56196

SHA1
4dc21bf95e22427a9dafcd4930e81b62e77d5fda

SHA256
7e9bbeeba45dae16f8c444596ee4180d7313e899e46fa6263fde6904f32d92a1

SHA512
996666f646b1878ee129a778184f9520541ee458797b8bfaefed6e1f152a5436e0ff19d28744463b706ffe3e24e429f5af102aa1e7733dbeeb6210754c828802

Download Submit
C:\Windows\System\gLssxnp.exe

Filesize
1.9MB

MD5
5925b72298dc2999708e74111e4c645b

SHA1
6f2b20ee8617c52990b8ce556fe81278433c7d88

SHA256
cadcc3cfb4a727c28267d4e42e8c079f4d2e93b4a64911495a4c4ed410dbed66

SHA512
add1b979c48c005b5c276619bef1bb52da07e632b0c351279d9bb4d36d581f938c5d92340bb5ffb92b9d7bd9762f192c6514b713e7232acbafa0bee487e0837a

Download Submit
C:\Windows\System\hyUxAbJ.exe

Filesize
1.9MB

MD5
4b774b4759b1eb6284a4929f522508d7

SHA1
e8ca6bd3d199a5534f0ee07284bdffd5bbed3ec1

SHA256
7539e1f42530f6be6bfa863629abd76a8f3e40cea622442f04f8fed2f2c365f2

SHA512
7185499ac79a7d169ee1c215803e108b8ab48d6a6738a625ee44e623d1f025d549a9912d132d640ff90c329e165e4cecf39d4c8b95bce2f9a34904c628d62d20

Download Submit
C:\Windows\System\iLHVBzD.exe

Filesize
1.9MB

MD5
2173acafb63957a28e9f8297b49fa420

SHA1
2a9b070e543d8a074de900a1a1587372ae08cbe2

SHA256
ebafa2344676d9b22593adb6d24d5f1dad1d49631596d46c9209247eccf9658f

SHA512
cc2ac78d15f09cfe3407f865a88123053d6195cb31e4af24186cfe074aa90791e00b286f79b18d0ccfbcc94c7c3e8875510d1ef00f99fefc0cca751955b27869

Download Submit
C:\Windows\System\jdMWUjj.exe

Filesize
1.9MB

MD5
97797dadd1875e3149262735b51699aa

SHA1
3276f855096cfd83f428985e1adeff112e6cefea

SHA256
e87d30c21c124897a7eb356af6f4769ed3ae4edf6efb24a20b2a85d4d7840446

SHA512
dc733e5ed2139a1756305f8ad905a1d6067ea54be363d2830234c5bd7e4a0f3f769e58120a96759beb92e721c9c13e74f040496285fa6a79d86e83914cf642f6

Download Submit
C:\Windows\System\lNotiFB.exe

Filesize
1.9MB

MD5
33dc773a95b6b15a66cd9258902d0802

SHA1
e1253f1ccab5109269a9cbc4db18e7db83925194

SHA256
9b48d95d54f9eab2bf810cbca0c3474c52a885f4a26fcf88be70cd8afb61020d

SHA512
c33b5ca33cd6cffd058aeb904ba98c399c53a7f2bfb1df4f440a9cd0bcad9c81fc30faa99a36b63e8a400ef85397eeac175199dca8f67d3837abfb3ca76de9b7

Download Submit
C:\Windows\System\mbrzYsD.exe

Filesize
1.9MB

MD5
e743d2bc0b0df27fb6feca379f6202d3

SHA1
9a8b5d7eafb6f66b7d4dc1c2de87e768027471dd

SHA256
21afae74f20f4c3738eb6ff59c792ee53fe111b33cd650661c2a97d7968c8579

SHA512
306ed4d33bea112c4a1fcb77a790f323b41809cb1a2370a433aa7f17445dc0efe55455eae9e8bc2eab965f2d3f8ee92a2c7dc78ca998bd10e90e5032a74a384c

Download Submit
C:\Windows\System\mfPYUHw.exe

Filesize
1.9MB

MD5
36818b77736cd2570c865e741d60d593

SHA1
ef0402cc7cffbe465dcda33d982adf4809f7f1b9

SHA256
c3a452be265e3bd8ea878ce37e98417bd37b2199134ecc822ac69677aa96701e

SHA512
b8a5229540103b4fd9157dc07d28f6ac959556bb4eb56c154685241924ce6fd4dc7c500eff45f949222aadaabc3446f50d84fb1f05ec9bd88c7b7b454013adc1

Download Submit
C:\Windows\System\nCPJSfU.exe

Filesize
1.9MB

MD5
14925772ab5eeb6ae44768cc8f55f3ee

SHA1
f7491f6c118477fff0c49f1b905914998122595e

SHA256
f024287f590aaac9825b88ac3c57971eab1add8e82aa6e4e7375673658184062

SHA512
cff0dbf891dd4dc82f19af8e12a295296863dfe8520d94a3513bdb978e0a5d9cf5d4bc4c0c6f3bb6936b1d52ca95b68835b6e906d32b325abf88fcc1f7ce5496

Download Submit
C:\Windows\System\pDqArAc.exe

Filesize
1.9MB

MD5
39a4e9a3ab670e47c79d9dec37c2595e

SHA1
c33ba7e5c9df892284cd32fe19c1efbde3d2d623

SHA256
579d218860cf62ef42d556a8eb32428e277ec5e7917cfe31ef8152d5cf2a48d5

SHA512
2b3134b81a80d306ff620fb38f560e44c0e56971f2f90d6adf2d5dc15ebba400413c67cc9fba94606d99b8a4ed652ca3b9a58b541c43ed9c03bd5b7ef38a41b0

Download Submit
C:\Windows\System\qVCAjBb.exe

Filesize
1.9MB

MD5
ef5c2598f3432ea548d8213df67a4125

SHA1
0ab1aa68b91c75ceab6020f5edf75d6c35f2ca33

SHA256
7fca4ac33b95cbe688c81b1a516641106f51b4d15cc053f888ce8eb9ccebec08

SHA512
da32da1b93148d0026272c89b9b94b118a0d1a195cb3aad9bd75fb4265642524289a333e8a57df32ee26a69e7021dce0ace24c983aea2e76b7151818aa7bcb75

Download Submit
C:\Windows\System\rpMBUTl.exe

Filesize
1.9MB

MD5
863c64161ef80eabb8a675dba343686a

SHA1
90e37b19abcb46645a0d8278f033b676da25f70e

SHA256
75d319cda0a1c0b1e0cceb582220e63d4636f9eb408330dd21496041e79736c4

SHA512
e60dd3de68ba10b35a197514874c30a6d5c9e91b633372212668fa62c05291d67e63ce2c9dd4b54b1592523916cce6ce0022692b7c0ed31fecf74d1285186228

Download Submit
C:\Windows\System\zCRUKrc.exe

Filesize
1.9MB

MD5
914ebf19b1aff2f10f6177be0d35a585

SHA1
4ea94f1b848dfa63944e3538a84d1872d893fe3d

SHA256
e6bd229311c8fae64034b20819b078e2342c4a9924378137bda0e84ea0d2484b

SHA512
3439bc9addf2bd00d65a1f29715d72b97ea99ee5f32670911f4e6921b887080106fc21eeeb4c5a247aa694af43aa75416ce854b52143742b910114422de9bac2

Download Submit
memory/212-3788-0x00007FF7607F0000-0x00007FF760BE2000-memory.dmp

Filesize
3.9MB

Download
memory/212-283-0x00007FF7607F0000-0x00007FF760BE2000-memory.dmp

Filesize
3.9MB

Download
memory/432-3761-0x00007FF67E270000-0x00007FF67E662000-memory.dmp

Filesize
3.9MB

Download
memory/432-310-0x00007FF67E270000-0x00007FF67E662000-memory.dmp

Filesize
3.9MB

Download
memory/1524-3737-0x00007FF787C90000-0x00007FF788082000-memory.dmp

Filesize
3.9MB

Download
memory/1524-87-0x00007FF787C90000-0x00007FF788082000-memory.dmp

Filesize
3.9MB

Download
memory/2032-401-0x00007FF6C3BD0000-0x00007FF6C3FC2000-memory.dmp

Filesize
3.9MB

Download
memory/2032-3758-0x00007FF6C3BD0000-0x00007FF6C3FC2000-memory.dmp

Filesize
3.9MB

Download
memory/2036-223-0x00007FF689F30000-0x00007FF68A322000-memory.dmp

Filesize
3.9MB

Download
memory/2036-3785-0x00007FF689F30000-0x00007FF68A322000-memory.dmp

Filesize
3.9MB

Download
memory/2144-362-0x00007FF6F44A0000-0x00007FF6F4892000-memory.dmp

Filesize
3.9MB

Download
memory/2144-3774-0x00007FF6F44A0000-0x00007FF6F4892000-memory.dmp

Filesize
3.9MB

Download
memory/2748-3790-0x00007FF607110000-0x00007FF607502000-memory.dmp

Filesize
3.9MB

Download
memory/2748-328-0x00007FF607110000-0x00007FF607502000-memory.dmp

Filesize
3.9MB

Download
memory/3092-0-0x00007FF666CC0000-0x00007FF6670B2000-memory.dmp

Filesize
3.9MB

Download
memory/3092-1-0x000002600C550000-0x000002600C560000-memory.dmp

Filesize
64KB

Download
memory/3168-3776-0x00007FF72CEA0000-0x00007FF72D292000-memory.dmp

Filesize
3.9MB

Download
memory/3168-302-0x00007FF72CEA0000-0x00007FF72D292000-memory.dmp

Filesize
3.9MB

Download
memory/3588-3764-0x00007FF62E5E0000-0x00007FF62E9D2000-memory.dmp

Filesize
3.9MB

Download
memory/3588-224-0x00007FF62E5E0000-0x00007FF62E9D2000-memory.dmp

Filesize
3.9MB

Download
memory/3688-3777-0x00007FF6075E0000-0x00007FF6079D2000-memory.dmp

Filesize
3.9MB

Download
memory/3688-368-0x00007FF6075E0000-0x00007FF6079D2000-memory.dmp

Filesize
3.9MB

Download
memory/3756-369-0x00007FF7D3130000-0x00007FF7D3522000-memory.dmp

Filesize
3.9MB

Download
memory/3756-3700-0x00007FF7D3130000-0x00007FF7D3522000-memory.dmp

Filesize
3.9MB

Download
memory/3776-52-0x000002C4F0860000-0x000002C4F0870000-memory.dmp

Filesize
64KB

Download
memory/3776-384-0x000002C4F0860000-0x000002C4F0870000-memory.dmp

Filesize
64KB

Download
memory/3776-189-0x000002C4F07D0000-0x000002C4F07F2000-memory.dmp

Filesize
136KB

Download
memory/3776-28-0x00007FFFD2C90000-0x00007FFFD3751000-memory.dmp

Filesize
10.8MB

Download
memory/3856-3768-0x00007FF7F22C0000-0x00007FF7F26B2000-memory.dmp

Filesize
3.9MB

Download
memory/3856-280-0x00007FF7F22C0000-0x00007FF7F26B2000-memory.dmp

Filesize
3.9MB

Download
memory/4384-3753-0x00007FF6217C0000-0x00007FF621BB2000-memory.dmp

Filesize
3.9MB

Download
memory/4384-149-0x00007FF6217C0000-0x00007FF621BB2000-memory.dmp

Filesize
3.9MB

Download
memory/4456-256-0x00007FF718C30000-0x00007FF719022000-memory.dmp

Filesize
3.9MB

Download
memory/4456-3762-0x00007FF718C30000-0x00007FF719022000-memory.dmp

Filesize
3.9MB

Download
memory/4512-3791-0x00007FF647D60000-0x00007FF648152000-memory.dmp

Filesize
3.9MB

Download
memory/4512-367-0x00007FF647D60000-0x00007FF648152000-memory.dmp

Filesize
3.9MB

Download
memory/4612-3739-0x00007FF68C570000-0x00007FF68C962000-memory.dmp

Filesize
3.9MB

Download
memory/4612-120-0x00007FF68C570000-0x00007FF68C962000-memory.dmp

Filesize
3.9MB

Download
memory/4628-3750-0x00007FF61BAC0000-0x00007FF61BEB2000-memory.dmp

Filesize
3.9MB

Download
memory/4628-3740-0x00007FF61BAC0000-0x00007FF61BEB2000-memory.dmp

Filesize
3.9MB

Download
memory/4628-57-0x00007FF61BAC0000-0x00007FF61BEB2000-memory.dmp

Filesize
3.9MB

Download
memory/4704-3756-0x00007FF62D8E0000-0x00007FF62DCD2000-memory.dmp

Filesize
3.9MB

Download
memory/4704-239-0x00007FF62D8E0000-0x00007FF62DCD2000-memory.dmp

Filesize
3.9MB

Download
memory/4992-3766-0x00007FF76CA20000-0x00007FF76CE12000-memory.dmp

Filesize
3.9MB

Download
memory/4992-229-0x00007FF76CA20000-0x00007FF76CE12000-memory.dmp

Filesize
3.9MB

Download
memory/5060-3754-0x00007FF751560000-0x00007FF751952000-memory.dmp

Filesize
3.9MB

Download
memory/5060-202-0x00007FF751560000-0x00007FF751952000-memory.dmp

Filesize
3.9MB

Download
memory/5112-386-0x00007FF7B3BE0000-0x00007FF7B3FD2000-memory.dmp

Filesize
3.9MB

Download
memory/5112-3782-0x00007FF7B3BE0000-0x00007FF7B3FD2000-memory.dmp

Filesize
3.9MB

Download