xmrig | a02f14ea8da25709d02b736e28cd4635036ee662bce4b8ea92d265ae2a5b4f88

Analysis

max time kernel
68s
max time network
45s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 02:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
Size

1.9MB
MD5

06aa3e2c21301bf993ff6b179d2b1c92
SHA1

fba6bace3ee8bc693d499976b6d27114fff3359b
SHA256

a02f14ea8da25709d02b736e28cd4635036ee662bce4b8ea92d265ae2a5b4f88
SHA512

dcce3fb3980aa34b0fd567a05dd17af9f049489f1d189b068750ac449e3b84754db0417db16f096f33f5e023075e8e8c93baf1ba94031c1916b64501301f0334
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1F:NABo

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 42 IoCs

miner

resource	yara_rule
behavioral2/memory/2748-13-0x00007FF6860A0000-0x00007FF686492000-memory.dmp	xmrig
behavioral2/memory/680-196-0x00007FF771F50000-0x00007FF772342000-memory.dmp	xmrig
behavioral2/memory/6116-202-0x00007FF734760000-0x00007FF734B52000-memory.dmp	xmrig
behavioral2/memory/4040-220-0x00007FF7E5000000-0x00007FF7E53F2000-memory.dmp	xmrig
behavioral2/memory/2632-231-0x00007FF62A5D0000-0x00007FF62A9C2000-memory.dmp	xmrig
behavioral2/memory/5256-241-0x00007FF65F4E0000-0x00007FF65F8D2000-memory.dmp	xmrig
behavioral2/memory/5648-245-0x00007FF7538A0000-0x00007FF753C92000-memory.dmp	xmrig
behavioral2/memory/5148-244-0x00007FF7815F0000-0x00007FF7819E2000-memory.dmp	xmrig
behavioral2/memory/2496-243-0x00007FF7F2CD0000-0x00007FF7F30C2000-memory.dmp	xmrig
behavioral2/memory/3468-242-0x00007FF677E30000-0x00007FF678222000-memory.dmp	xmrig
behavioral2/memory/4816-240-0x00007FF7A21D0000-0x00007FF7A25C2000-memory.dmp	xmrig
behavioral2/memory/444-239-0x00007FF7C6970000-0x00007FF7C6D62000-memory.dmp	xmrig
behavioral2/memory/3696-238-0x00007FF7E5F70000-0x00007FF7E6362000-memory.dmp	xmrig
behavioral2/memory/948-237-0x00007FF7DFA20000-0x00007FF7DFE12000-memory.dmp	xmrig
behavioral2/memory/2240-234-0x00007FF788660000-0x00007FF788A52000-memory.dmp	xmrig
behavioral2/memory/4424-228-0x00007FF6E0A00000-0x00007FF6E0DF2000-memory.dmp	xmrig
behavioral2/memory/3232-219-0x00007FF789A60000-0x00007FF789E52000-memory.dmp	xmrig
behavioral2/memory/5036-197-0x00007FF610440000-0x00007FF610832000-memory.dmp	xmrig
behavioral2/memory/1080-177-0x00007FF7626F0000-0x00007FF762AE2000-memory.dmp	xmrig
behavioral2/memory/780-138-0x00007FF63E5F0000-0x00007FF63E9E2000-memory.dmp	xmrig
behavioral2/memory/4636-115-0x00007FF6B6910000-0x00007FF6B6D02000-memory.dmp	xmrig
behavioral2/memory/2748-2903-0x00007FF6860A0000-0x00007FF686492000-memory.dmp	xmrig
behavioral2/memory/4636-2907-0x00007FF6B6910000-0x00007FF6B6D02000-memory.dmp	xmrig
behavioral2/memory/5148-2906-0x00007FF7815F0000-0x00007FF7819E2000-memory.dmp	xmrig
behavioral2/memory/5036-2912-0x00007FF610440000-0x00007FF610832000-memory.dmp	xmrig
behavioral2/memory/5648-2910-0x00007FF7538A0000-0x00007FF753C92000-memory.dmp	xmrig
behavioral2/memory/1080-2915-0x00007FF7626F0000-0x00007FF762AE2000-memory.dmp	xmrig
behavioral2/memory/2240-2918-0x00007FF788660000-0x00007FF788A52000-memory.dmp	xmrig
behavioral2/memory/680-2919-0x00007FF771F50000-0x00007FF772342000-memory.dmp	xmrig
behavioral2/memory/780-2914-0x00007FF63E5F0000-0x00007FF63E9E2000-memory.dmp	xmrig
behavioral2/memory/6116-2930-0x00007FF734760000-0x00007FF734B52000-memory.dmp	xmrig
behavioral2/memory/3468-2928-0x00007FF677E30000-0x00007FF678222000-memory.dmp	xmrig
behavioral2/memory/3696-2933-0x00007FF7E5F70000-0x00007FF7E6362000-memory.dmp	xmrig
behavioral2/memory/2496-2938-0x00007FF7F2CD0000-0x00007FF7F30C2000-memory.dmp	xmrig
behavioral2/memory/2632-2941-0x00007FF62A5D0000-0x00007FF62A9C2000-memory.dmp	xmrig
behavioral2/memory/4816-2944-0x00007FF7A21D0000-0x00007FF7A25C2000-memory.dmp	xmrig
behavioral2/memory/444-2936-0x00007FF7C6970000-0x00007FF7C6D62000-memory.dmp	xmrig
behavioral2/memory/3232-2931-0x00007FF789A60000-0x00007FF789E52000-memory.dmp	xmrig
behavioral2/memory/4040-2924-0x00007FF7E5000000-0x00007FF7E53F2000-memory.dmp	xmrig
behavioral2/memory/948-2922-0x00007FF7DFA20000-0x00007FF7DFE12000-memory.dmp	xmrig
behavioral2/memory/4424-2926-0x00007FF6E0A00000-0x00007FF6E0DF2000-memory.dmp	xmrig
behavioral2/memory/5256-2951-0x00007FF65F4E0000-0x00007FF65F8D2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2748	tPsnAGs.exe
5148	GNHCKuf.exe
4636	KwFQKbk.exe
5648	autUURs.exe
780	uJYURZv.exe
1080	reZaugs.exe
680	EaJnqZl.exe
5036	UbCPsJi.exe
6116	qyOiJcs.exe
3232	SrcuoJz.exe
4040	lkzYaHI.exe
4424	lxOlWqz.exe
2632	LkFbQwe.exe
2240	gRTvnmS.exe
948	mqaGnTn.exe
3696	BNUiLdV.exe
444	TGnQToN.exe
4816	JuhfXgN.exe
5256	wqLoggJ.exe
3468	NEQnfpj.exe
2496	oJTIQse.exe
2720	Crzpeej.exe
5472	SuzNsiv.exe
3564	WlCkGZL.exe
5492	ZOQamzQ.exe
3828	bHPIOAY.exe
3860	hjHfCPV.exe
4292	BsnMxmO.exe
4332	aIIyLfr.exe
2416	LnXSVLK.exe
1104	nunHIFk.exe
1924	BGNUhLy.exe
660	bfaGouD.exe
1832	bRFypNL.exe
6132	zvERSeE.exe
1796	jQOsqbK.exe
6120	uxMdhPO.exe
3768	uwuhgyv.exe
2180	vGvphOs.exe
5428	wvukwtw.exe
5608	rRNYfnc.exe
2072	wrmkmFh.exe
1168	qpmMHFB.exe
6036	fmVnzMU.exe
5484	ROtCMUu.exe
3164	VALjbEu.exe
5928	uaPfzFJ.exe
4668	iSVRAAd.exe
4504	xFxrpHn.exe
3664	HXMUJSy.exe
1768	iBQefeh.exe
2000	ajuKpuy.exe
916	UylBrUu.exe
2672	FmKdebt.exe
2332	pbNpzOh.exe
5676	IaPHXdN.exe
2980	AlKnonJ.exe
5568	QACYttH.exe
1072	NlsFfKH.exe
6136	VSVGFhF.exe
4880	RPvDCTK.exe
4488	pVrUmfO.exe
5112	jyIYxwB.exe
6072	LRsCXfM.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1648-0-0x00007FF6C1B90000-0x00007FF6C1F82000-memory.dmp	upx
behavioral2/files/0x000a000000023b96-8.dat	upx
behavioral2/files/0x000a000000023b95-17.dat	upx
behavioral2/memory/2748-13-0x00007FF6860A0000-0x00007FF686492000-memory.dmp	upx
behavioral2/files/0x000b000000023b91-6.dat	upx
behavioral2/files/0x000a000000023b9a-51.dat	upx
behavioral2/files/0x000a000000023ba2-74.dat	upx
behavioral2/files/0x000a000000023bad-128.dat	upx
behavioral2/files/0x000a000000023ba8-158.dat	upx
behavioral2/memory/680-196-0x00007FF771F50000-0x00007FF772342000-memory.dmp	upx
behavioral2/memory/6116-202-0x00007FF734760000-0x00007FF734B52000-memory.dmp	upx
behavioral2/memory/4040-220-0x00007FF7E5000000-0x00007FF7E53F2000-memory.dmp	upx
behavioral2/memory/2632-231-0x00007FF62A5D0000-0x00007FF62A9C2000-memory.dmp	upx
behavioral2/memory/5256-241-0x00007FF65F4E0000-0x00007FF65F8D2000-memory.dmp	upx
behavioral2/memory/5648-245-0x00007FF7538A0000-0x00007FF753C92000-memory.dmp	upx
behavioral2/memory/5148-244-0x00007FF7815F0000-0x00007FF7819E2000-memory.dmp	upx
behavioral2/memory/2496-243-0x00007FF7F2CD0000-0x00007FF7F30C2000-memory.dmp	upx
behavioral2/memory/3468-242-0x00007FF677E30000-0x00007FF678222000-memory.dmp	upx
behavioral2/memory/4816-240-0x00007FF7A21D0000-0x00007FF7A25C2000-memory.dmp	upx
behavioral2/memory/444-239-0x00007FF7C6970000-0x00007FF7C6D62000-memory.dmp	upx
behavioral2/memory/3696-238-0x00007FF7E5F70000-0x00007FF7E6362000-memory.dmp	upx
behavioral2/memory/948-237-0x00007FF7DFA20000-0x00007FF7DFE12000-memory.dmp	upx
behavioral2/memory/2240-234-0x00007FF788660000-0x00007FF788A52000-memory.dmp	upx
behavioral2/memory/4424-228-0x00007FF6E0A00000-0x00007FF6E0DF2000-memory.dmp	upx
behavioral2/memory/3232-219-0x00007FF789A60000-0x00007FF789E52000-memory.dmp	upx
behavioral2/memory/5036-197-0x00007FF610440000-0x00007FF610832000-memory.dmp	upx
behavioral2/files/0x0031000000023bb7-193.dat	upx
behavioral2/files/0x0031000000023bb6-192.dat	upx
behavioral2/files/0x000a000000023bac-187.dat	upx
behavioral2/files/0x000a000000023bb5-185.dat	upx
behavioral2/files/0x000a000000023bb4-183.dat	upx
behavioral2/files/0x000a000000023bb3-182.dat	upx
behavioral2/files/0x000b000000023ba5-180.dat	upx
behavioral2/memory/1080-177-0x00007FF7626F0000-0x00007FF762AE2000-memory.dmp	upx
behavioral2/files/0x000a000000023bb2-171.dat	upx
behavioral2/files/0x000a000000023bb1-167.dat	upx
behavioral2/files/0x000a000000023bae-162.dat	upx
behavioral2/files/0x000a000000023bb0-161.dat	upx
behavioral2/files/0x000a000000023ba7-156.dat	upx
behavioral2/files/0x000b000000023ba6-145.dat	upx
behavioral2/files/0x000a000000023baf-142.dat	upx
behavioral2/files/0x000a000000023baa-131.dat	upx
behavioral2/files/0x000a000000023ba9-129.dat	upx
behavioral2/files/0x000a000000023b9f-125.dat	upx
behavioral2/files/0x000a000000023ba0-152.dat	upx
behavioral2/files/0x000a000000023ba4-120.dat	upx
behavioral2/files/0x000a000000023b9e-117.dat	upx
behavioral2/files/0x000a000000023bab-140.dat	upx
behavioral2/memory/780-138-0x00007FF63E5F0000-0x00007FF63E9E2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba3-107.dat	upx
behavioral2/files/0x000a000000023b9d-97.dat	upx
behavioral2/memory/4636-115-0x00007FF6B6910000-0x00007FF6B6D02000-memory.dmp	upx
behavioral2/files/0x000a000000023ba1-77.dat	upx
behavioral2/files/0x000a000000023b9b-70.dat	upx
behavioral2/files/0x000a000000023b9c-94.dat	upx
behavioral2/files/0x000a000000023b98-56.dat	upx
behavioral2/files/0x000a000000023b99-35.dat	upx
behavioral2/files/0x000a000000023b97-39.dat	upx
behavioral2/memory/2748-2903-0x00007FF6860A0000-0x00007FF686492000-memory.dmp	upx
behavioral2/memory/4636-2907-0x00007FF6B6910000-0x00007FF6B6D02000-memory.dmp	upx
behavioral2/memory/5148-2906-0x00007FF7815F0000-0x00007FF7819E2000-memory.dmp	upx
behavioral2/memory/5036-2912-0x00007FF610440000-0x00007FF610832000-memory.dmp	upx
behavioral2/memory/5648-2910-0x00007FF7538A0000-0x00007FF753C92000-memory.dmp	upx
behavioral2/memory/1080-2915-0x00007FF7626F0000-0x00007FF762AE2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\haZItzS.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\BGNUhLy.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\bBvGNQZ.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\geJFJEk.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\ErYhsOp.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\gVpFEpX.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\MytkwHR.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\CuGjTwx.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\IxCggpR.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\oJhTZjL.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\DFTFWOV.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\CVsdBKF.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\rCOcNdJ.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\nxzIVqd.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\kGyZKHw.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\xvnGsqL.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\baeSttM.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\kaQpZfC.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\JuhfXgN.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\xhflvEz.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\nJMtAgA.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\kRxIgct.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\jiNpYtb.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\XvePqMZ.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\okoBYWJ.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\fBLSaHd.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\hwSaIMQ.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\TByiTFk.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\QIBWtcc.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\qIPzCEr.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\VcTKlsv.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\FaewayU.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\KZYSiMP.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\ufPXTzC.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\XSpPRae.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\PdZbSAp.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\fBamREb.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\abUoDdn.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\YVZqgrk.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\VtfzSZF.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\hFjXmrZ.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\ATgVaND.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\lpJfpZd.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\tXvbjla.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\qLdwgMO.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\KWLLvqs.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\rkVXXIl.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\oaYXGYc.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\XRgoFbz.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\itMiZCl.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\zsMldzZ.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\lbzxdZl.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\RboNVWz.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\HHIFcGT.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\fjVSGMo.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\gorngYV.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\wemMImL.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\HlwbcKI.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\UwxeXZf.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\vajafWM.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\XrccZIh.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\NdprRRG.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\Silkemp.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
File created	C:\Windows\System\EqgLWUQ.exe	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
5220	powershell.exe
5220	powershell.exe
5220	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
Token: SeDebugPrivilege	5220	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 5220	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	84
PID 1648 wrote to memory of 5220	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	84
PID 1648 wrote to memory of 2748	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	85
PID 1648 wrote to memory of 2748	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	85
PID 1648 wrote to memory of 4636	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	86
PID 1648 wrote to memory of 4636	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	86
PID 1648 wrote to memory of 5148	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	87
PID 1648 wrote to memory of 5148	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	87
PID 1648 wrote to memory of 1080	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	88
PID 1648 wrote to memory of 1080	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	88
PID 1648 wrote to memory of 5648	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	89
PID 1648 wrote to memory of 5648	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	89
PID 1648 wrote to memory of 780	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	90
PID 1648 wrote to memory of 780	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	90
PID 1648 wrote to memory of 5036	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	91
PID 1648 wrote to memory of 5036	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	91
PID 1648 wrote to memory of 680	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	92
PID 1648 wrote to memory of 680	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	92
PID 1648 wrote to memory of 6116	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	93
PID 1648 wrote to memory of 6116	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	93
PID 1648 wrote to memory of 3232	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	94
PID 1648 wrote to memory of 3232	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	94
PID 1648 wrote to memory of 4040	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	95
PID 1648 wrote to memory of 4040	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	95
PID 1648 wrote to memory of 4424	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	96
PID 1648 wrote to memory of 4424	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	96
PID 1648 wrote to memory of 2632	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	97
PID 1648 wrote to memory of 2632	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	97
PID 1648 wrote to memory of 2240	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	98
PID 1648 wrote to memory of 2240	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	98
PID 1648 wrote to memory of 948	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	99
PID 1648 wrote to memory of 948	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	99
PID 1648 wrote to memory of 3696	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	100
PID 1648 wrote to memory of 3696	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	100
PID 1648 wrote to memory of 444	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	101
PID 1648 wrote to memory of 444	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	101
PID 1648 wrote to memory of 4816	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	102
PID 1648 wrote to memory of 4816	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	102
PID 1648 wrote to memory of 5256	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	103
PID 1648 wrote to memory of 5256	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	103
PID 1648 wrote to memory of 3468	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	104
PID 1648 wrote to memory of 3468	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	104
PID 1648 wrote to memory of 2496	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	105
PID 1648 wrote to memory of 2496	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	105
PID 1648 wrote to memory of 2720	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	106
PID 1648 wrote to memory of 2720	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	106
PID 1648 wrote to memory of 5472	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	107
PID 1648 wrote to memory of 5472	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	107
PID 1648 wrote to memory of 3564	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	108
PID 1648 wrote to memory of 3564	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	108
PID 1648 wrote to memory of 5492	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	109
PID 1648 wrote to memory of 5492	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	109
PID 1648 wrote to memory of 3828	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	110
PID 1648 wrote to memory of 3828	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	110
PID 1648 wrote to memory of 3860	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	111
PID 1648 wrote to memory of 3860	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	111
PID 1648 wrote to memory of 4292	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	112
PID 1648 wrote to memory of 4292	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	112
PID 1648 wrote to memory of 4332	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	113
PID 1648 wrote to memory of 4332	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	113
PID 1648 wrote to memory of 2416	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	114
PID 1648 wrote to memory of 2416	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	114
PID 1648 wrote to memory of 1104	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	115
PID 1648 wrote to memory of 1104	1648	06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\06aa3e2c21301bf993ff6b179d2b1c92_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5220
- C:\Windows\System\tPsnAGs.exe
  C:\Windows\System\tPsnAGs.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\KwFQKbk.exe
  C:\Windows\System\KwFQKbk.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\GNHCKuf.exe
  C:\Windows\System\GNHCKuf.exe
  2⤵
  - Executes dropped EXE
  PID:5148
- C:\Windows\System\reZaugs.exe
  C:\Windows\System\reZaugs.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\autUURs.exe
  C:\Windows\System\autUURs.exe
  2⤵
  - Executes dropped EXE
  PID:5648
- C:\Windows\System\uJYURZv.exe
  C:\Windows\System\uJYURZv.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\UbCPsJi.exe
  C:\Windows\System\UbCPsJi.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\EaJnqZl.exe
  C:\Windows\System\EaJnqZl.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\qyOiJcs.exe
  C:\Windows\System\qyOiJcs.exe
  2⤵
  - Executes dropped EXE
  PID:6116
- C:\Windows\System\SrcuoJz.exe
  C:\Windows\System\SrcuoJz.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\lkzYaHI.exe
  C:\Windows\System\lkzYaHI.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\lxOlWqz.exe
  C:\Windows\System\lxOlWqz.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\LkFbQwe.exe
  C:\Windows\System\LkFbQwe.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\gRTvnmS.exe
  C:\Windows\System\gRTvnmS.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\mqaGnTn.exe
  C:\Windows\System\mqaGnTn.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\BNUiLdV.exe
  C:\Windows\System\BNUiLdV.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\TGnQToN.exe
  C:\Windows\System\TGnQToN.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System\JuhfXgN.exe
  C:\Windows\System\JuhfXgN.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\wqLoggJ.exe
  C:\Windows\System\wqLoggJ.exe
  2⤵
  - Executes dropped EXE
  PID:5256
- C:\Windows\System\NEQnfpj.exe
  C:\Windows\System\NEQnfpj.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\oJTIQse.exe
  C:\Windows\System\oJTIQse.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\Crzpeej.exe
  C:\Windows\System\Crzpeej.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\SuzNsiv.exe
  C:\Windows\System\SuzNsiv.exe
  2⤵
  - Executes dropped EXE
  PID:5472
- C:\Windows\System\WlCkGZL.exe
  C:\Windows\System\WlCkGZL.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\ZOQamzQ.exe
  C:\Windows\System\ZOQamzQ.exe
  2⤵
  - Executes dropped EXE
  PID:5492
- C:\Windows\System\bHPIOAY.exe
  C:\Windows\System\bHPIOAY.exe
  2⤵
  - Executes dropped EXE
  PID:3828
- C:\Windows\System\hjHfCPV.exe
  C:\Windows\System\hjHfCPV.exe
  2⤵
  - Executes dropped EXE
  PID:3860
- C:\Windows\System\BsnMxmO.exe
  C:\Windows\System\BsnMxmO.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\aIIyLfr.exe
  C:\Windows\System\aIIyLfr.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\LnXSVLK.exe
  C:\Windows\System\LnXSVLK.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\nunHIFk.exe
  C:\Windows\System\nunHIFk.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\BGNUhLy.exe
  C:\Windows\System\BGNUhLy.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\bfaGouD.exe
  C:\Windows\System\bfaGouD.exe
  2⤵
  - Executes dropped EXE
  PID:660
- C:\Windows\System\bRFypNL.exe
  C:\Windows\System\bRFypNL.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\zvERSeE.exe
  C:\Windows\System\zvERSeE.exe
  2⤵
  - Executes dropped EXE
  PID:6132
- C:\Windows\System\jQOsqbK.exe
  C:\Windows\System\jQOsqbK.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\uxMdhPO.exe
  C:\Windows\System\uxMdhPO.exe
  2⤵
  - Executes dropped EXE
  PID:6120
- C:\Windows\System\uwuhgyv.exe
  C:\Windows\System\uwuhgyv.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\vGvphOs.exe
  C:\Windows\System\vGvphOs.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\wvukwtw.exe
  C:\Windows\System\wvukwtw.exe
  2⤵
  - Executes dropped EXE
  PID:5428
- C:\Windows\System\rRNYfnc.exe
  C:\Windows\System\rRNYfnc.exe
  2⤵
  - Executes dropped EXE
  PID:5608
- C:\Windows\System\wrmkmFh.exe
  C:\Windows\System\wrmkmFh.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\qpmMHFB.exe
  C:\Windows\System\qpmMHFB.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\fmVnzMU.exe
  C:\Windows\System\fmVnzMU.exe
  2⤵
  - Executes dropped EXE
  PID:6036
- C:\Windows\System\ROtCMUu.exe
  C:\Windows\System\ROtCMUu.exe
  2⤵
  - Executes dropped EXE
  PID:5484
- C:\Windows\System\VALjbEu.exe
  C:\Windows\System\VALjbEu.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\uaPfzFJ.exe
  C:\Windows\System\uaPfzFJ.exe
  2⤵
  - Executes dropped EXE
  PID:5928
- C:\Windows\System\iSVRAAd.exe
  C:\Windows\System\iSVRAAd.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\xFxrpHn.exe
  C:\Windows\System\xFxrpHn.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\HXMUJSy.exe
  C:\Windows\System\HXMUJSy.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\iBQefeh.exe
  C:\Windows\System\iBQefeh.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\ajuKpuy.exe
  C:\Windows\System\ajuKpuy.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\UylBrUu.exe
  C:\Windows\System\UylBrUu.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\FmKdebt.exe
  C:\Windows\System\FmKdebt.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\pbNpzOh.exe
  C:\Windows\System\pbNpzOh.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\IaPHXdN.exe
  C:\Windows\System\IaPHXdN.exe
  2⤵
  - Executes dropped EXE
  PID:5676
- C:\Windows\System\AlKnonJ.exe
  C:\Windows\System\AlKnonJ.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\QACYttH.exe
  C:\Windows\System\QACYttH.exe
  2⤵
  - Executes dropped EXE
  PID:5568
- C:\Windows\System\NlsFfKH.exe
  C:\Windows\System\NlsFfKH.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\VSVGFhF.exe
  C:\Windows\System\VSVGFhF.exe
  2⤵
  - Executes dropped EXE
  PID:6136
- C:\Windows\System\RPvDCTK.exe
  C:\Windows\System\RPvDCTK.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\pVrUmfO.exe
  C:\Windows\System\pVrUmfO.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\jyIYxwB.exe
  C:\Windows\System\jyIYxwB.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\LRsCXfM.exe
  C:\Windows\System\LRsCXfM.exe
  2⤵
  - Executes dropped EXE
  PID:6072
- C:\Windows\System\ujgZsOp.exe
  C:\Windows\System\ujgZsOp.exe
  2⤵
  PID:116
- C:\Windows\System\qbZujRM.exe
  C:\Windows\System\qbZujRM.exe
  2⤵
  PID:4956
- C:\Windows\System\jmYxnde.exe
  C:\Windows\System\jmYxnde.exe
  2⤵
  PID:2732
- C:\Windows\System\MzcChYE.exe
  C:\Windows\System\MzcChYE.exe
  2⤵
  PID:5780
- C:\Windows\System\URCzPud.exe
  C:\Windows\System\URCzPud.exe
  2⤵
  PID:1956
- C:\Windows\System\WvhhCEa.exe
  C:\Windows\System\WvhhCEa.exe
  2⤵
  PID:4552
- C:\Windows\System\aRVlMcl.exe
  C:\Windows\System\aRVlMcl.exe
  2⤵
  PID:3092
- C:\Windows\System\yjtMuRX.exe
  C:\Windows\System\yjtMuRX.exe
  2⤵
  PID:3580
- C:\Windows\System\CVrOaQd.exe
  C:\Windows\System\CVrOaQd.exe
  2⤵
  PID:2704
- C:\Windows\System\qmcojrS.exe
  C:\Windows\System\qmcojrS.exe
  2⤵
  PID:3960
- C:\Windows\System\VWErkEO.exe
  C:\Windows\System\VWErkEO.exe
  2⤵
  PID:3936
- C:\Windows\System\ZQFcFzn.exe
  C:\Windows\System\ZQFcFzn.exe
  2⤵
  PID:3064
- C:\Windows\System\vnhGzKo.exe
  C:\Windows\System\vnhGzKo.exe
  2⤵
  PID:4408
- C:\Windows\System\VNMEbQr.exe
  C:\Windows\System\VNMEbQr.exe
  2⤵
  PID:4384
- C:\Windows\System\sOQLFIV.exe
  C:\Windows\System\sOQLFIV.exe
  2⤵
  PID:3484
- C:\Windows\System\FGuKjlo.exe
  C:\Windows\System\FGuKjlo.exe
  2⤵
  PID:1456
- C:\Windows\System\estoECu.exe
  C:\Windows\System\estoECu.exe
  2⤵
  PID:5420
- C:\Windows\System\NrZTTBM.exe
  C:\Windows\System\NrZTTBM.exe
  2⤵
  PID:1916
- C:\Windows\System\XTnmKkG.exe
  C:\Windows\System\XTnmKkG.exe
  2⤵
  PID:1780
- C:\Windows\System\mGDyRyq.exe
  C:\Windows\System\mGDyRyq.exe
  2⤵
  PID:5452
- C:\Windows\System\ElsIZHB.exe
  C:\Windows\System\ElsIZHB.exe
  2⤵
  PID:2344
- C:\Windows\System\AfbPvju.exe
  C:\Windows\System\AfbPvju.exe
  2⤵
  PID:1092
- C:\Windows\System\GKFRCIg.exe
  C:\Windows\System\GKFRCIg.exe
  2⤵
  PID:2716
- C:\Windows\System\FIPHdQY.exe
  C:\Windows\System\FIPHdQY.exe
  2⤵
  PID:1584
- C:\Windows\System\AkUoBeG.exe
  C:\Windows\System\AkUoBeG.exe
  2⤵
  PID:3644
- C:\Windows\System\YNNokrn.exe
  C:\Windows\System\YNNokrn.exe
  2⤵
  PID:5456
- C:\Windows\System\aVWBYkz.exe
  C:\Windows\System\aVWBYkz.exe
  2⤵
  PID:5424
- C:\Windows\System\oFGVqfs.exe
  C:\Windows\System\oFGVqfs.exe
  2⤵
  PID:4928
- C:\Windows\System\ytNftEJ.exe
  C:\Windows\System\ytNftEJ.exe
  2⤵
  PID:6128
- C:\Windows\System\QTMdmsN.exe
  C:\Windows\System\QTMdmsN.exe
  2⤵
  PID:1492
- C:\Windows\System\zLbNqwK.exe
  C:\Windows\System\zLbNqwK.exe
  2⤵
  PID:1276
- C:\Windows\System\VQXgmln.exe
  C:\Windows\System\VQXgmln.exe
  2⤵
  PID:4100
- C:\Windows\System\GZEpQgb.exe
  C:\Windows\System\GZEpQgb.exe
  2⤵
  PID:5292
- C:\Windows\System\dSVerkT.exe
  C:\Windows\System\dSVerkT.exe
  2⤵
  PID:3380
- C:\Windows\System\mKBFrVn.exe
  C:\Windows\System\mKBFrVn.exe
  2⤵
  PID:5508
- C:\Windows\System\TjPUIZu.exe
  C:\Windows\System\TjPUIZu.exe
  2⤵
  PID:1688
- C:\Windows\System\AQDsKCR.exe
  C:\Windows\System\AQDsKCR.exe
  2⤵
  PID:5540
- C:\Windows\System\QbueYcl.exe
  C:\Windows\System\QbueYcl.exe
  2⤵
  PID:1136
- C:\Windows\System\gvfgueh.exe
  C:\Windows\System\gvfgueh.exe
  2⤵
  PID:3552
- C:\Windows\System\ebmWVBD.exe
  C:\Windows\System\ebmWVBD.exe
  2⤵
  PID:1068
- C:\Windows\System\HcnaJwG.exe
  C:\Windows\System\HcnaJwG.exe
  2⤵
  PID:5516
- C:\Windows\System\ATgVaND.exe
  C:\Windows\System\ATgVaND.exe
  2⤵
  PID:4072
- C:\Windows\System\rkVXXIl.exe
  C:\Windows\System\rkVXXIl.exe
  2⤵
  PID:4804
- C:\Windows\System\GtSwqSe.exe
  C:\Windows\System\GtSwqSe.exe
  2⤵
  PID:3460
- C:\Windows\System\sQtObeR.exe
  C:\Windows\System\sQtObeR.exe
  2⤵
  PID:4124
- C:\Windows\System\DlIzgnd.exe
  C:\Windows\System\DlIzgnd.exe
  2⤵
  PID:1608
- C:\Windows\System\KgsQgFq.exe
  C:\Windows\System\KgsQgFq.exe
  2⤵
  PID:2484
- C:\Windows\System\QTsBZCH.exe
  C:\Windows\System\QTsBZCH.exe
  2⤵
  PID:1720
- C:\Windows\System\iROrRsg.exe
  C:\Windows\System\iROrRsg.exe
  2⤵
  PID:5076
- C:\Windows\System\eiwdloO.exe
  C:\Windows\System\eiwdloO.exe
  2⤵
  PID:1232
- C:\Windows\System\FVwdNGS.exe
  C:\Windows\System\FVwdNGS.exe
  2⤵
  PID:5384
- C:\Windows\System\RXgNeFp.exe
  C:\Windows\System\RXgNeFp.exe
  2⤵
  PID:5832
- C:\Windows\System\OLIYfpb.exe
  C:\Windows\System\OLIYfpb.exe
  2⤵
  PID:2488
- C:\Windows\System\dkkbifk.exe
  C:\Windows\System\dkkbifk.exe
  2⤵
  PID:5296
- C:\Windows\System\SYbDhdD.exe
  C:\Windows\System\SYbDhdD.exe
  2⤵
  PID:3356
- C:\Windows\System\qIPzCEr.exe
  C:\Windows\System\qIPzCEr.exe
  2⤵
  PID:4680
- C:\Windows\System\XQTvorR.exe
  C:\Windows\System\XQTvorR.exe
  2⤵
  PID:1696
- C:\Windows\System\rCOcNdJ.exe
  C:\Windows\System\rCOcNdJ.exe
  2⤵
  PID:5008
- C:\Windows\System\UwxeXZf.exe
  C:\Windows\System\UwxeXZf.exe
  2⤵
  PID:4876
- C:\Windows\System\ALQJHyg.exe
  C:\Windows\System\ALQJHyg.exe
  2⤵
  PID:448
- C:\Windows\System\NzEtgko.exe
  C:\Windows\System\NzEtgko.exe
  2⤵
  PID:2768
- C:\Windows\System\qwtNNFn.exe
  C:\Windows\System\qwtNNFn.exe
  2⤵
  PID:5716
- C:\Windows\System\NynfPyL.exe
  C:\Windows\System\NynfPyL.exe
  2⤵
  PID:5236
- C:\Windows\System\AYrqTzo.exe
  C:\Windows\System\AYrqTzo.exe
  2⤵
  PID:4336
- C:\Windows\System\bnuMfUF.exe
  C:\Windows\System\bnuMfUF.exe
  2⤵
  PID:1748
- C:\Windows\System\snUbsgN.exe
  C:\Windows\System\snUbsgN.exe
  2⤵
  PID:2828
- C:\Windows\System\hQduJAC.exe
  C:\Windows\System\hQduJAC.exe
  2⤵
  PID:4508
- C:\Windows\System\mQMXqVU.exe
  C:\Windows\System\mQMXqVU.exe
  2⤵
  PID:452
- C:\Windows\System\LhCkmLa.exe
  C:\Windows\System\LhCkmLa.exe
  2⤵
  PID:4632
- C:\Windows\System\apInRFH.exe
  C:\Windows\System\apInRFH.exe
  2⤵
  PID:5212
- C:\Windows\System\fehfGYE.exe
  C:\Windows\System\fehfGYE.exe
  2⤵
  PID:5756
- C:\Windows\System\vmBkPJu.exe
  C:\Windows\System\vmBkPJu.exe
  2⤵
  PID:5768
- C:\Windows\System\ZdpHtCp.exe
  C:\Windows\System\ZdpHtCp.exe
  2⤵
  PID:5760
- C:\Windows\System\jWrEhar.exe
  C:\Windows\System\jWrEhar.exe
  2⤵
  PID:1640
- C:\Windows\System\fCIiGtx.exe
  C:\Windows\System\fCIiGtx.exe
  2⤵
  PID:4088
- C:\Windows\System\IiCXOKv.exe
  C:\Windows\System\IiCXOKv.exe
  2⤵
  PID:1736
- C:\Windows\System\tzgEaLw.exe
  C:\Windows\System\tzgEaLw.exe
  2⤵
  PID:384
- C:\Windows\System\fmzuZgM.exe
  C:\Windows\System\fmzuZgM.exe
  2⤵
  PID:5592
- C:\Windows\System\nxzIVqd.exe
  C:\Windows\System\nxzIVqd.exe
  2⤵
  PID:3416
- C:\Windows\System\TMLpypU.exe
  C:\Windows\System\TMLpypU.exe
  2⤵
  PID:3648
- C:\Windows\System\JidMcWz.exe
  C:\Windows\System\JidMcWz.exe
  2⤵
  PID:2656
- C:\Windows\System\cxllnOl.exe
  C:\Windows\System\cxllnOl.exe
  2⤵
  PID:3024
- C:\Windows\System\IenLJYv.exe
  C:\Windows\System\IenLJYv.exe
  2⤵
  PID:3172
- C:\Windows\System\IPkiRbl.exe
  C:\Windows\System\IPkiRbl.exe
  2⤵
  PID:3944
- C:\Windows\System\LPwajaB.exe
  C:\Windows\System\LPwajaB.exe
  2⤵
  PID:1592
- C:\Windows\System\iDYRnSU.exe
  C:\Windows\System\iDYRnSU.exe
  2⤵
  PID:3776
- C:\Windows\System\vfcFZAU.exe
  C:\Windows\System\vfcFZAU.exe
  2⤵
  PID:1236
- C:\Windows\System\LFHoZrj.exe
  C:\Windows\System\LFHoZrj.exe
  2⤵
  PID:5340
- C:\Windows\System\mThmBXs.exe
  C:\Windows\System\mThmBXs.exe
  2⤵
  PID:1028
- C:\Windows\System\kslrjxE.exe
  C:\Windows\System\kslrjxE.exe
  2⤵
  PID:2660
- C:\Windows\System\eNAaOVb.exe
  C:\Windows\System\eNAaOVb.exe
  2⤵
  PID:4028
- C:\Windows\System\SfuvMBp.exe
  C:\Windows\System\SfuvMBp.exe
  2⤵
  PID:2776
- C:\Windows\System\VUgOzgL.exe
  C:\Windows\System\VUgOzgL.exe
  2⤵
  PID:5656
- C:\Windows\System\kGyZKHw.exe
  C:\Windows\System\kGyZKHw.exe
  2⤵
  PID:392
- C:\Windows\System\gdQMXZf.exe
  C:\Windows\System\gdQMXZf.exe
  2⤵
  PID:3280
- C:\Windows\System\TMPAQLy.exe
  C:\Windows\System\TMPAQLy.exe
  2⤵
  PID:1644
- C:\Windows\System\JDUQKJy.exe
  C:\Windows\System\JDUQKJy.exe
  2⤵
  PID:4148
- C:\Windows\System\mtjwMdF.exe
  C:\Windows\System\mtjwMdF.exe
  2⤵
  PID:4948
- C:\Windows\System\YohjUEY.exe
  C:\Windows\System\YohjUEY.exe
  2⤵
  PID:752
- C:\Windows\System\eiqhsSa.exe
  C:\Windows\System\eiqhsSa.exe
  2⤵
  PID:2064
- C:\Windows\System\VhkBvFd.exe
  C:\Windows\System\VhkBvFd.exe
  2⤵
  PID:6148
- C:\Windows\System\CbvoeUG.exe
  C:\Windows\System\CbvoeUG.exe
  2⤵
  PID:6172
- C:\Windows\System\iJvFFrd.exe
  C:\Windows\System\iJvFFrd.exe
  2⤵
  PID:6192
- C:\Windows\System\eRNbdxO.exe
  C:\Windows\System\eRNbdxO.exe
  2⤵
  PID:6212
- C:\Windows\System\aglZJKI.exe
  C:\Windows\System\aglZJKI.exe
  2⤵
  PID:6232
- C:\Windows\System\TEIhzhO.exe
  C:\Windows\System\TEIhzhO.exe
  2⤵
  PID:6252
- C:\Windows\System\ChbgHyL.exe
  C:\Windows\System\ChbgHyL.exe
  2⤵
  PID:6272
- C:\Windows\System\yXvuACH.exe
  C:\Windows\System\yXvuACH.exe
  2⤵
  PID:6296
- C:\Windows\System\lwvyqHp.exe
  C:\Windows\System\lwvyqHp.exe
  2⤵
  PID:6316
- C:\Windows\System\FlgzzfE.exe
  C:\Windows\System\FlgzzfE.exe
  2⤵
  PID:6336
- C:\Windows\System\WtFeLnq.exe
  C:\Windows\System\WtFeLnq.exe
  2⤵
  PID:6360
- C:\Windows\System\Dqqvevt.exe
  C:\Windows\System\Dqqvevt.exe
  2⤵
  PID:6376
- C:\Windows\System\rhknMTo.exe
  C:\Windows\System\rhknMTo.exe
  2⤵
  PID:6400
- C:\Windows\System\vEndyMz.exe
  C:\Windows\System\vEndyMz.exe
  2⤵
  PID:6424
- C:\Windows\System\djbbkWo.exe
  C:\Windows\System\djbbkWo.exe
  2⤵
  PID:6440
- C:\Windows\System\BVXdlla.exe
  C:\Windows\System\BVXdlla.exe
  2⤵
  PID:6468
- C:\Windows\System\qRByWWF.exe
  C:\Windows\System\qRByWWF.exe
  2⤵
  PID:6484
- C:\Windows\System\htfmFRu.exe
  C:\Windows\System\htfmFRu.exe
  2⤵
  PID:6504
- C:\Windows\System\eUzFmyR.exe
  C:\Windows\System\eUzFmyR.exe
  2⤵
  PID:6528
- C:\Windows\System\bMnSCbi.exe
  C:\Windows\System\bMnSCbi.exe
  2⤵
  PID:6548
- C:\Windows\System\yascpcJ.exe
  C:\Windows\System\yascpcJ.exe
  2⤵
  PID:6564
- C:\Windows\System\TfYOeJR.exe
  C:\Windows\System\TfYOeJR.exe
  2⤵
  PID:6588
- C:\Windows\System\YQQbgbZ.exe
  C:\Windows\System\YQQbgbZ.exe
  2⤵
  PID:6624
- C:\Windows\System\HYVRKpT.exe
  C:\Windows\System\HYVRKpT.exe
  2⤵
  PID:6640
- C:\Windows\System\jRnmusT.exe
  C:\Windows\System\jRnmusT.exe
  2⤵
  PID:6668
- C:\Windows\System\rfTIRxT.exe
  C:\Windows\System\rfTIRxT.exe
  2⤵
  PID:6688
- C:\Windows\System\kgnmumT.exe
  C:\Windows\System\kgnmumT.exe
  2⤵
  PID:6720
- C:\Windows\System\zweNyPF.exe
  C:\Windows\System\zweNyPF.exe
  2⤵
  PID:6740
- C:\Windows\System\gvwclbU.exe
  C:\Windows\System\gvwclbU.exe
  2⤵
  PID:6760
- C:\Windows\System\AtaOptT.exe
  C:\Windows\System\AtaOptT.exe
  2⤵
  PID:6792
- C:\Windows\System\GlthWeU.exe
  C:\Windows\System\GlthWeU.exe
  2⤵
  PID:6816
- C:\Windows\System\LhyUeUr.exe
  C:\Windows\System\LhyUeUr.exe
  2⤵
  PID:6840
- C:\Windows\System\VmpFdcJ.exe
  C:\Windows\System\VmpFdcJ.exe
  2⤵
  PID:6948
- C:\Windows\System\uqstSXQ.exe
  C:\Windows\System\uqstSXQ.exe
  2⤵
  PID:6980
- C:\Windows\System\FjOSKTZ.exe
  C:\Windows\System\FjOSKTZ.exe
  2⤵
  PID:7004
- C:\Windows\System\uHHCARH.exe
  C:\Windows\System\uHHCARH.exe
  2⤵
  PID:7032
- C:\Windows\System\dIkIeJg.exe
  C:\Windows\System\dIkIeJg.exe
  2⤵
  PID:7048
- C:\Windows\System\HcWPMIl.exe
  C:\Windows\System\HcWPMIl.exe
  2⤵
  PID:7068
- C:\Windows\System\EEQuQpK.exe
  C:\Windows\System\EEQuQpK.exe
  2⤵
  PID:7092
- C:\Windows\System\QgofhCl.exe
  C:\Windows\System\QgofhCl.exe
  2⤵
  PID:7108
- C:\Windows\System\txegRds.exe
  C:\Windows\System\txegRds.exe
  2⤵
  PID:7128
- C:\Windows\System\RCzpBxc.exe
  C:\Windows\System\RCzpBxc.exe
  2⤵
  PID:7148
- C:\Windows\System\lvPibCN.exe
  C:\Windows\System\lvPibCN.exe
  2⤵
  PID:7164
- C:\Windows\System\sYHKBBS.exe
  C:\Windows\System\sYHKBBS.exe
  2⤵
  PID:3656
- C:\Windows\System\krphNIa.exe
  C:\Windows\System\krphNIa.exe
  2⤵
  PID:1816
- C:\Windows\System\ICcmkHC.exe
  C:\Windows\System\ICcmkHC.exe
  2⤵
  PID:1740
- C:\Windows\System\HrhWDLq.exe
  C:\Windows\System\HrhWDLq.exe
  2⤵
  PID:4132
- C:\Windows\System\JLBfLjy.exe
  C:\Windows\System\JLBfLjy.exe
  2⤵
  PID:1460
- C:\Windows\System\lerjcgN.exe
  C:\Windows\System\lerjcgN.exe
  2⤵
  PID:2228
- C:\Windows\System\Yamxwbq.exe
  C:\Windows\System\Yamxwbq.exe
  2⤵
  PID:4896
- C:\Windows\System\UjpmXWn.exe
  C:\Windows\System\UjpmXWn.exe
  2⤵
  PID:6200
- C:\Windows\System\eYPgcRr.exe
  C:\Windows\System\eYPgcRr.exe
  2⤵
  PID:6268
- C:\Windows\System\RRImses.exe
  C:\Windows\System\RRImses.exe
  2⤵
  PID:6480
- C:\Windows\System\lKFtRTy.exe
  C:\Windows\System\lKFtRTy.exe
  2⤵
  PID:5392
- C:\Windows\System\jiNpYtb.exe
  C:\Windows\System\jiNpYtb.exe
  2⤵
  PID:6856
- C:\Windows\System\lbzxdZl.exe
  C:\Windows\System\lbzxdZl.exe
  2⤵
  PID:6392
- C:\Windows\System\eNrJFQD.exe
  C:\Windows\System\eNrJFQD.exe
  2⤵
  PID:6476
- C:\Windows\System\lVdGAcZ.exe
  C:\Windows\System\lVdGAcZ.exe
  2⤵
  PID:6600
- C:\Windows\System\pNTLtQg.exe
  C:\Windows\System\pNTLtQg.exe
  2⤵
  PID:6384
- C:\Windows\System\bBvGNQZ.exe
  C:\Windows\System\bBvGNQZ.exe
  2⤵
  PID:6512
- C:\Windows\System\kIVEGnN.exe
  C:\Windows\System\kIVEGnN.exe
  2⤵
  PID:6584
- C:\Windows\System\JCJJJnw.exe
  C:\Windows\System\JCJJJnw.exe
  2⤵
  PID:6924
- C:\Windows\System\cjEYOWa.exe
  C:\Windows\System\cjEYOWa.exe
  2⤵
  PID:976
- C:\Windows\System\mxufDHc.exe
  C:\Windows\System\mxufDHc.exe
  2⤵
  PID:2988
- C:\Windows\System\jspZcYC.exe
  C:\Windows\System\jspZcYC.exe
  2⤵
  PID:6632
- C:\Windows\System\YWdOqZi.exe
  C:\Windows\System\YWdOqZi.exe
  2⤵
  PID:6332
- C:\Windows\System\MKxuuic.exe
  C:\Windows\System\MKxuuic.exe
  2⤵
  PID:7180
- C:\Windows\System\kYfLexv.exe
  C:\Windows\System\kYfLexv.exe
  2⤵
  PID:7200
- C:\Windows\System\Wipsjac.exe
  C:\Windows\System\Wipsjac.exe
  2⤵
  PID:7220
- C:\Windows\System\cCkPrZW.exe
  C:\Windows\System\cCkPrZW.exe
  2⤵
  PID:7240
- C:\Windows\System\QffovwC.exe
  C:\Windows\System\QffovwC.exe
  2⤵
  PID:7264
- C:\Windows\System\ShBAcbS.exe
  C:\Windows\System\ShBAcbS.exe
  2⤵
  PID:7280
- C:\Windows\System\oAJvNwS.exe
  C:\Windows\System\oAJvNwS.exe
  2⤵
  PID:7448
- C:\Windows\System\TNADgRV.exe
  C:\Windows\System\TNADgRV.exe
  2⤵
  PID:7472
- C:\Windows\System\bZsZguF.exe
  C:\Windows\System\bZsZguF.exe
  2⤵
  PID:7492
- C:\Windows\System\FDoXPZR.exe
  C:\Windows\System\FDoXPZR.exe
  2⤵
  PID:7516
- C:\Windows\System\QgnlUvr.exe
  C:\Windows\System\QgnlUvr.exe
  2⤵
  PID:7536
- C:\Windows\System\XHSbKJV.exe
  C:\Windows\System\XHSbKJV.exe
  2⤵
  PID:7560
- C:\Windows\System\fWNoiFD.exe
  C:\Windows\System\fWNoiFD.exe
  2⤵
  PID:7576
- C:\Windows\System\JIbuCDs.exe
  C:\Windows\System\JIbuCDs.exe
  2⤵
  PID:7612
- C:\Windows\System\UBqOxeh.exe
  C:\Windows\System\UBqOxeh.exe
  2⤵
  PID:7648
- C:\Windows\System\tmkmdAr.exe
  C:\Windows\System\tmkmdAr.exe
  2⤵
  PID:7672
- C:\Windows\System\TkYdEky.exe
  C:\Windows\System\TkYdEky.exe
  2⤵
  PID:7692
- C:\Windows\System\JBSbhmW.exe
  C:\Windows\System\JBSbhmW.exe
  2⤵
  PID:7708
- C:\Windows\System\VcTKlsv.exe
  C:\Windows\System\VcTKlsv.exe
  2⤵
  PID:7732
- C:\Windows\System\BhGLOVp.exe
  C:\Windows\System\BhGLOVp.exe
  2⤵
  PID:7752
- C:\Windows\System\fijhEtk.exe
  C:\Windows\System\fijhEtk.exe
  2⤵
  PID:7768
- C:\Windows\System\GtbuMSw.exe
  C:\Windows\System\GtbuMSw.exe
  2⤵
  PID:7792
- C:\Windows\System\WMZOcUH.exe
  C:\Windows\System\WMZOcUH.exe
  2⤵
  PID:7812
- C:\Windows\System\AObLknu.exe
  C:\Windows\System\AObLknu.exe
  2⤵
  PID:7828
- C:\Windows\System\mbAdQTf.exe
  C:\Windows\System\mbAdQTf.exe
  2⤵
  PID:7852
- C:\Windows\System\wCrKNqX.exe
  C:\Windows\System\wCrKNqX.exe
  2⤵
  PID:7876
- C:\Windows\System\hmvxUIe.exe
  C:\Windows\System\hmvxUIe.exe
  2⤵
  PID:7904
- C:\Windows\System\WEvEfjv.exe
  C:\Windows\System\WEvEfjv.exe
  2⤵
  PID:7936
- C:\Windows\System\NzbcAoi.exe
  C:\Windows\System\NzbcAoi.exe
  2⤵
  PID:7960
- C:\Windows\System\lFESIkB.exe
  C:\Windows\System\lFESIkB.exe
  2⤵
  PID:7976
- C:\Windows\System\VKAwRcQ.exe
  C:\Windows\System\VKAwRcQ.exe
  2⤵
  PID:8000
- C:\Windows\System\mrJoxbo.exe
  C:\Windows\System\mrJoxbo.exe
  2⤵
  PID:8016
- C:\Windows\System\vAANUrK.exe
  C:\Windows\System\vAANUrK.exe
  2⤵
  PID:8040
- C:\Windows\System\YMJzskQ.exe
  C:\Windows\System\YMJzskQ.exe
  2⤵
  PID:8056
- C:\Windows\System\xbMKBea.exe
  C:\Windows\System\xbMKBea.exe
  2⤵
  PID:8076
- C:\Windows\System\NDDQOVr.exe
  C:\Windows\System\NDDQOVr.exe
  2⤵
  PID:8096
- C:\Windows\System\CzGmqgb.exe
  C:\Windows\System\CzGmqgb.exe
  2⤵
  PID:8120
- C:\Windows\System\kRXQyUL.exe
  C:\Windows\System\kRXQyUL.exe
  2⤵
  PID:8136
- C:\Windows\System\jZzbQCu.exe
  C:\Windows\System\jZzbQCu.exe
  2⤵
  PID:8160
- C:\Windows\System\jtTovQn.exe
  C:\Windows\System\jtTovQn.exe
  2⤵
  PID:8180
- C:\Windows\System\gyApXoo.exe
  C:\Windows\System\gyApXoo.exe
  2⤵
  PID:7088
- C:\Windows\System\jhyKxYo.exe
  C:\Windows\System\jhyKxYo.exe
  2⤵
  PID:7124
- C:\Windows\System\zgHStHB.exe
  C:\Windows\System\zgHStHB.exe
  2⤵
  PID:1712
- C:\Windows\System\DEGKkPJ.exe
  C:\Windows\System\DEGKkPJ.exe
  2⤵
  PID:6696
- C:\Windows\System\hpvEVCd.exe
  C:\Windows\System\hpvEVCd.exe
  2⤵
  PID:2168
- C:\Windows\System\XLwUbMb.exe
  C:\Windows\System\XLwUbMb.exe
  2⤵
  PID:6612
- C:\Windows\System\wXePZCj.exe
  C:\Windows\System\wXePZCj.exe
  2⤵
  PID:6220
- C:\Windows\System\WNNJcVm.exe
  C:\Windows\System\WNNJcVm.exe
  2⤵
  PID:6520
- C:\Windows\System\xWuYzFe.exe
  C:\Windows\System\xWuYzFe.exe
  2⤵
  PID:4376
- C:\Windows\System\oIBPskf.exe
  C:\Windows\System\oIBPskf.exe
  2⤵
  PID:6356
- C:\Windows\System\kCvRxqE.exe
  C:\Windows\System\kCvRxqE.exe
  2⤵
  PID:7056
- C:\Windows\System\VcYFsAx.exe
  C:\Windows\System\VcYFsAx.exe
  2⤵
  PID:3020
- C:\Windows\System\PdZbSAp.exe
  C:\Windows\System\PdZbSAp.exe
  2⤵
  PID:5684
- C:\Windows\System\kMREHaU.exe
  C:\Windows\System\kMREHaU.exe
  2⤵
  PID:6676
- C:\Windows\System\MHlhvMc.exe
  C:\Windows\System\MHlhvMc.exe
  2⤵
  PID:7320
- C:\Windows\System\CrFfnau.exe
  C:\Windows\System\CrFfnau.exe
  2⤵
  PID:6324
- C:\Windows\System\BCSPmQj.exe
  C:\Windows\System\BCSPmQj.exe
  2⤵
  PID:6616
- C:\Windows\System\JQWiblu.exe
  C:\Windows\System\JQWiblu.exe
  2⤵
  PID:7260
- C:\Windows\System\fRXplDe.exe
  C:\Windows\System\fRXplDe.exe
  2⤵
  PID:7256
- C:\Windows\System\uwhAHUg.exe
  C:\Windows\System\uwhAHUg.exe
  2⤵
  PID:6560
- C:\Windows\System\OMusHUN.exe
  C:\Windows\System\OMusHUN.exe
  2⤵
  PID:7552
- C:\Windows\System\GnntUvJ.exe
  C:\Windows\System\GnntUvJ.exe
  2⤵
  PID:7368
- C:\Windows\System\ooFjWas.exe
  C:\Windows\System\ooFjWas.exe
  2⤵
  PID:7404
- C:\Windows\System\KNJdczB.exe
  C:\Windows\System\KNJdczB.exe
  2⤵
  PID:7640
- C:\Windows\System\qWYExHH.exe
  C:\Windows\System\qWYExHH.exe
  2⤵
  PID:7808
- C:\Windows\System\UFsVzwZ.exe
  C:\Windows\System\UFsVzwZ.exe
  2⤵
  PID:7892
- C:\Windows\System\OlWMcYE.exe
  C:\Windows\System\OlWMcYE.exe
  2⤵
  PID:7920
- C:\Windows\System\TPvIEwE.exe
  C:\Windows\System\TPvIEwE.exe
  2⤵
  PID:8200
- C:\Windows\System\DcbLfSN.exe
  C:\Windows\System\DcbLfSN.exe
  2⤵
  PID:8240
- C:\Windows\System\OWpzjmW.exe
  C:\Windows\System\OWpzjmW.exe
  2⤵
  PID:8268
- C:\Windows\System\lTVUBpA.exe
  C:\Windows\System\lTVUBpA.exe
  2⤵
  PID:8288
- C:\Windows\System\pMtVvxC.exe
  C:\Windows\System\pMtVvxC.exe
  2⤵
  PID:8308
- C:\Windows\System\gFQYTGE.exe
  C:\Windows\System\gFQYTGE.exe
  2⤵
  PID:8332
- C:\Windows\System\NdprRRG.exe
  C:\Windows\System\NdprRRG.exe
  2⤵
  PID:8356
- C:\Windows\System\dnPDTiN.exe
  C:\Windows\System\dnPDTiN.exe
  2⤵
  PID:8372
- C:\Windows\System\EEjIClF.exe
  C:\Windows\System\EEjIClF.exe
  2⤵
  PID:8396
- C:\Windows\System\QEGvhjg.exe
  C:\Windows\System\QEGvhjg.exe
  2⤵
  PID:8420
- C:\Windows\System\cWNIhbg.exe
  C:\Windows\System\cWNIhbg.exe
  2⤵
  PID:8444
- C:\Windows\System\MfmNRah.exe
  C:\Windows\System\MfmNRah.exe
  2⤵
  PID:8464
- C:\Windows\System\enKyUij.exe
  C:\Windows\System\enKyUij.exe
  2⤵
  PID:8484
- C:\Windows\System\gnPodQW.exe
  C:\Windows\System\gnPodQW.exe
  2⤵
  PID:8508
- C:\Windows\System\GtILNQv.exe
  C:\Windows\System\GtILNQv.exe
  2⤵
  PID:8532
- C:\Windows\System\UNYsPBR.exe
  C:\Windows\System\UNYsPBR.exe
  2⤵
  PID:8556
- C:\Windows\System\mgeHjUT.exe
  C:\Windows\System\mgeHjUT.exe
  2⤵
  PID:8576
- C:\Windows\System\AaUXgyc.exe
  C:\Windows\System\AaUXgyc.exe
  2⤵
  PID:8600
- C:\Windows\System\JdZfMEx.exe
  C:\Windows\System\JdZfMEx.exe
  2⤵
  PID:8620
- C:\Windows\System\MpDgykh.exe
  C:\Windows\System\MpDgykh.exe
  2⤵
  PID:8644
- C:\Windows\System\dEfStqE.exe
  C:\Windows\System\dEfStqE.exe
  2⤵
  PID:8668
- C:\Windows\System\dJueASX.exe
  C:\Windows\System\dJueASX.exe
  2⤵
  PID:8692
- C:\Windows\System\IWAKxRy.exe
  C:\Windows\System\IWAKxRy.exe
  2⤵
  PID:8716
- C:\Windows\System\iEkWZyr.exe
  C:\Windows\System\iEkWZyr.exe
  2⤵
  PID:8732
- C:\Windows\System\eJvlMMn.exe
  C:\Windows\System\eJvlMMn.exe
  2⤵
  PID:8756
- C:\Windows\System\mSRBxqu.exe
  C:\Windows\System\mSRBxqu.exe
  2⤵
  PID:8776
- C:\Windows\System\zNcwjSe.exe
  C:\Windows\System\zNcwjSe.exe
  2⤵
  PID:8800
- C:\Windows\System\GrOiEUF.exe
  C:\Windows\System\GrOiEUF.exe
  2⤵
  PID:8824
- C:\Windows\System\PjDHvNf.exe
  C:\Windows\System\PjDHvNf.exe
  2⤵
  PID:8852
- C:\Windows\System\ZoQlIoC.exe
  C:\Windows\System\ZoQlIoC.exe
  2⤵
  PID:8868
- C:\Windows\System\HYZSVvL.exe
  C:\Windows\System\HYZSVvL.exe
  2⤵
  PID:8896
- C:\Windows\System\VtpwjYT.exe
  C:\Windows\System\VtpwjYT.exe
  2⤵
  PID:8920
- C:\Windows\System\qQbxhyP.exe
  C:\Windows\System\qQbxhyP.exe
  2⤵
  PID:8940
- C:\Windows\System\uIvQpEl.exe
  C:\Windows\System\uIvQpEl.exe
  2⤵
  PID:8956
- C:\Windows\System\kSfiiYb.exe
  C:\Windows\System\kSfiiYb.exe
  2⤵
  PID:8980
- C:\Windows\System\vuLhXid.exe
  C:\Windows\System\vuLhXid.exe
  2⤵
  PID:9000
- C:\Windows\System\VMpXzch.exe
  C:\Windows\System\VMpXzch.exe
  2⤵
  PID:9032
- C:\Windows\System\LQrEpMe.exe
  C:\Windows\System\LQrEpMe.exe
  2⤵
  PID:9052
- C:\Windows\System\TUIJYqQ.exe
  C:\Windows\System\TUIJYqQ.exe
  2⤵
  PID:9080
- C:\Windows\System\XEqhXcn.exe
  C:\Windows\System\XEqhXcn.exe
  2⤵
  PID:9100
- C:\Windows\System\HjPARjV.exe
  C:\Windows\System\HjPARjV.exe
  2⤵
  PID:9120
- C:\Windows\System\YNvVEpK.exe
  C:\Windows\System\YNvVEpK.exe
  2⤵
  PID:9140
- C:\Windows\System\RboNVWz.exe
  C:\Windows\System\RboNVWz.exe
  2⤵
  PID:9160
- C:\Windows\System\xhflvEz.exe
  C:\Windows\System\xhflvEz.exe
  2⤵
  PID:9176
- C:\Windows\System\gXOBexW.exe
  C:\Windows\System\gXOBexW.exe
  2⤵
  PID:9200
- C:\Windows\System\CSNyMGP.exe
  C:\Windows\System\CSNyMGP.exe
  2⤵
  PID:7468
- C:\Windows\System\QCeMgqB.exe
  C:\Windows\System\QCeMgqB.exe
  2⤵
  PID:7500
- C:\Windows\System\rckiwEn.exe
  C:\Windows\System\rckiwEn.exe
  2⤵
  PID:7044
- C:\Windows\System\CZzYztK.exe
  C:\Windows\System\CZzYztK.exe
  2⤵
  PID:7840
- C:\Windows\System\lFkIVjH.exe
  C:\Windows\System\lFkIVjH.exe
  2⤵
  PID:7684
- C:\Windows\System\McUAQZH.exe
  C:\Windows\System\McUAQZH.exe
  2⤵
  PID:6680
- C:\Windows\System\lrahikG.exe
  C:\Windows\System\lrahikG.exe
  2⤵
  PID:6308
- C:\Windows\System\nZOZJSC.exe
  C:\Windows\System\nZOZJSC.exe
  2⤵
  PID:2796
- C:\Windows\System\GyHQRuW.exe
  C:\Windows\System\GyHQRuW.exe
  2⤵
  PID:7460
- C:\Windows\System\hIoWkFE.exe
  C:\Windows\System\hIoWkFE.exe
  2⤵
  PID:8036
- C:\Windows\System\fBamREb.exe
  C:\Windows\System\fBamREb.exe
  2⤵
  PID:7764
- C:\Windows\System\pUNOIBt.exe
  C:\Windows\System\pUNOIBt.exe
  2⤵
  PID:876
- C:\Windows\System\iSsKRhh.exe
  C:\Windows\System\iSsKRhh.exe
  2⤵
  PID:7120
- C:\Windows\System\xxhMDAi.exe
  C:\Windows\System\xxhMDAi.exe
  2⤵
  PID:8280
- C:\Windows\System\XOxYkzY.exe
  C:\Windows\System\XOxYkzY.exe
  2⤵
  PID:8328
- C:\Windows\System\drpldgA.exe
  C:\Windows\System\drpldgA.exe
  2⤵
  PID:9236
- C:\Windows\System\UuAKKuQ.exe
  C:\Windows\System\UuAKKuQ.exe
  2⤵
  PID:9256
- C:\Windows\System\HzsyQGR.exe
  C:\Windows\System\HzsyQGR.exe
  2⤵
  PID:9280
- C:\Windows\System\KHolavD.exe
  C:\Windows\System\KHolavD.exe
  2⤵
  PID:9296
- C:\Windows\System\YAJrtvy.exe
  C:\Windows\System\YAJrtvy.exe
  2⤵
  PID:9320
- C:\Windows\System\xFegUPa.exe
  C:\Windows\System\xFegUPa.exe
  2⤵
  PID:9344
- C:\Windows\System\qvZrTSI.exe
  C:\Windows\System\qvZrTSI.exe
  2⤵
  PID:9368
- C:\Windows\System\FbZPwJb.exe
  C:\Windows\System\FbZPwJb.exe
  2⤵
  PID:9388
- C:\Windows\System\jPoDYOV.exe
  C:\Windows\System\jPoDYOV.exe
  2⤵
  PID:9412
- C:\Windows\System\lpJfpZd.exe
  C:\Windows\System\lpJfpZd.exe
  2⤵
  PID:9436
- C:\Windows\System\TxRVbeQ.exe
  C:\Windows\System\TxRVbeQ.exe
  2⤵
  PID:9456
- C:\Windows\System\PNUhMlb.exe
  C:\Windows\System\PNUhMlb.exe
  2⤵
  PID:9484
- C:\Windows\System\UKQAPpx.exe
  C:\Windows\System\UKQAPpx.exe
  2⤵
  PID:9508
- C:\Windows\System\qmSxriB.exe
  C:\Windows\System\qmSxriB.exe
  2⤵
  PID:9536
- C:\Windows\System\QMPCvsD.exe
  C:\Windows\System\QMPCvsD.exe
  2⤵
  PID:9556
- C:\Windows\System\fiNzAWz.exe
  C:\Windows\System\fiNzAWz.exe
  2⤵
  PID:9576
- C:\Windows\System\mnZrtwv.exe
  C:\Windows\System\mnZrtwv.exe
  2⤵
  PID:9600
- C:\Windows\System\RquFwml.exe
  C:\Windows\System\RquFwml.exe
  2⤵
  PID:9620
- C:\Windows\System\halBhti.exe
  C:\Windows\System\halBhti.exe
  2⤵
  PID:9644
- C:\Windows\System\XiBTffp.exe
  C:\Windows\System\XiBTffp.exe
  2⤵
  PID:9664
- C:\Windows\System\leyVkTa.exe
  C:\Windows\System\leyVkTa.exe
  2⤵
  PID:9688
- C:\Windows\System\bPxDtTK.exe
  C:\Windows\System\bPxDtTK.exe
  2⤵
  PID:9708
- C:\Windows\System\oxllpkl.exe
  C:\Windows\System\oxllpkl.exe
  2⤵
  PID:9728
- C:\Windows\System\QUrYdvb.exe
  C:\Windows\System\QUrYdvb.exe
  2⤵
  PID:9752
- C:\Windows\System\WedOQGS.exe
  C:\Windows\System\WedOQGS.exe
  2⤵
  PID:9772
- C:\Windows\System\sbBGybl.exe
  C:\Windows\System\sbBGybl.exe
  2⤵
  PID:9796
- C:\Windows\System\pfbtlfv.exe
  C:\Windows\System\pfbtlfv.exe
  2⤵
  PID:9820
- C:\Windows\System\ITVHNbf.exe
  C:\Windows\System\ITVHNbf.exe
  2⤵
  PID:9844
- C:\Windows\System\McLomMJ.exe
  C:\Windows\System\McLomMJ.exe
  2⤵
  PID:9864
- C:\Windows\System\ZXKUjju.exe
  C:\Windows\System\ZXKUjju.exe
  2⤵
  PID:9880
- C:\Windows\System\lRMExWG.exe
  C:\Windows\System\lRMExWG.exe
  2⤵
  PID:9900
- C:\Windows\System\KhGaMTP.exe
  C:\Windows\System\KhGaMTP.exe
  2⤵
  PID:9928
- C:\Windows\System\XvePqMZ.exe
  C:\Windows\System\XvePqMZ.exe
  2⤵
  PID:9948
- C:\Windows\System\LMwmTjt.exe
  C:\Windows\System\LMwmTjt.exe
  2⤵
  PID:9968
- C:\Windows\System\QhVpSqj.exe
  C:\Windows\System\QhVpSqj.exe
  2⤵
  PID:9992
- C:\Windows\System\xXQreAT.exe
  C:\Windows\System\xXQreAT.exe
  2⤵
  PID:10012
- C:\Windows\System\obLYwPB.exe
  C:\Windows\System\obLYwPB.exe
  2⤵
  PID:10032
- C:\Windows\System\pfgRrnx.exe
  C:\Windows\System\pfgRrnx.exe
  2⤵
  PID:10052
- C:\Windows\System\wHokPRb.exe
  C:\Windows\System\wHokPRb.exe
  2⤵
  PID:10068
- C:\Windows\System\CaXZnSA.exe
  C:\Windows\System\CaXZnSA.exe
  2⤵
  PID:10084
- C:\Windows\System\rrAUqDq.exe
  C:\Windows\System\rrAUqDq.exe
  2⤵
  PID:10100
- C:\Windows\System\GOeJKZf.exe
  C:\Windows\System\GOeJKZf.exe
  2⤵
  PID:10120
- C:\Windows\System\yRWSEME.exe
  C:\Windows\System\yRWSEME.exe
  2⤵
  PID:10144
- C:\Windows\System\mNagHuM.exe
  C:\Windows\System\mNagHuM.exe
  2⤵
  PID:10164
- C:\Windows\System\ykPhBSG.exe
  C:\Windows\System\ykPhBSG.exe
  2⤵
  PID:10196
- C:\Windows\System\iLnojbU.exe
  C:\Windows\System\iLnojbU.exe
  2⤵
  PID:10220
- C:\Windows\System\XDFEGmq.exe
  C:\Windows\System\XDFEGmq.exe
  2⤵
  PID:8392
- C:\Windows\System\BhDmluf.exe
  C:\Windows\System\BhDmluf.exe
  2⤵
  PID:8492
- C:\Windows\System\rVfGCvV.exe
  C:\Windows\System\rVfGCvV.exe
  2⤵
  PID:8552
- C:\Windows\System\jcdRwdM.exe
  C:\Windows\System\jcdRwdM.exe
  2⤵
  PID:8596
- C:\Windows\System\OqzIoXA.exe
  C:\Windows\System\OqzIoXA.exe
  2⤵
  PID:8652
- C:\Windows\System\yBSvxby.exe
  C:\Windows\System\yBSvxby.exe
  2⤵
  PID:6808
- C:\Windows\System\OrYCyWj.exe
  C:\Windows\System\OrYCyWj.exe
  2⤵
  PID:6956
- C:\Windows\System\STrrryX.exe
  C:\Windows\System\STrrryX.exe
  2⤵
  PID:8728
- C:\Windows\System\rcxQPCM.exe
  C:\Windows\System\rcxQPCM.exe
  2⤵
  PID:8860
- C:\Windows\System\goCXkTZ.exe
  C:\Windows\System\goCXkTZ.exe
  2⤵
  PID:8912
- C:\Windows\System\RHwDpDh.exe
  C:\Windows\System\RHwDpDh.exe
  2⤵
  PID:6780
- C:\Windows\System\bVRBayE.exe
  C:\Windows\System\bVRBayE.exe
  2⤵
  PID:9060
- C:\Windows\System\MqhQeqX.exe
  C:\Windows\System\MqhQeqX.exe
  2⤵
  PID:7172
- C:\Windows\System\eVyUgXX.exe
  C:\Windows\System\eVyUgXX.exe
  2⤵
  PID:9132
- C:\Windows\System\rRcTShb.exe
  C:\Windows\System\rRcTShb.exe
  2⤵
  PID:9172
- C:\Windows\System\YCUnHrG.exe
  C:\Windows\System\YCUnHrG.exe
  2⤵
  PID:7716
- C:\Windows\System\WaZnsKa.exe
  C:\Windows\System\WaZnsKa.exe
  2⤵
  PID:7588
- C:\Windows\System\QpDDhpM.exe
  C:\Windows\System\QpDDhpM.exe
  2⤵
  PID:7788
- C:\Windows\System\nVjlzau.exe
  C:\Windows\System\nVjlzau.exe
  2⤵
  PID:8144
- C:\Windows\System\KmVdOiM.exe
  C:\Windows\System\KmVdOiM.exe
  2⤵
  PID:7700
- C:\Windows\System\TLsWNNx.exe
  C:\Windows\System\TLsWNNx.exe
  2⤵
  PID:8252
- C:\Windows\System\eNHqHEx.exe
  C:\Windows\System\eNHqHEx.exe
  2⤵
  PID:7748
- C:\Windows\System\QoiaGeW.exe
  C:\Windows\System\QoiaGeW.exe
  2⤵
  PID:8368
- C:\Windows\System\AFFsAoh.exe
  C:\Windows\System\AFFsAoh.exe
  2⤵
  PID:8432
- C:\Windows\System\rbnjWwd.exe
  C:\Windows\System\rbnjWwd.exe
  2⤵
  PID:8528
- C:\Windows\System\OJsZbto.exe
  C:\Windows\System\OJsZbto.exe
  2⤵
  PID:9428
- C:\Windows\System\BKrCgtE.exe
  C:\Windows\System\BKrCgtE.exe
  2⤵
  PID:9500
- C:\Windows\System\mBXoIpm.exe
  C:\Windows\System\mBXoIpm.exe
  2⤵
  PID:7276
- C:\Windows\System\HHIFcGT.exe
  C:\Windows\System\HHIFcGT.exe
  2⤵
  PID:9612
- C:\Windows\System\oTfYTTf.exe
  C:\Windows\System\oTfYTTf.exe
  2⤵
  PID:6996
- C:\Windows\System\eWAugUP.exe
  C:\Windows\System\eWAugUP.exe
  2⤵
  PID:9672
- C:\Windows\System\fjVSGMo.exe
  C:\Windows\System\fjVSGMo.exe
  2⤵
  PID:7288
- C:\Windows\System\MVDwmLC.exe
  C:\Windows\System\MVDwmLC.exe
  2⤵
  PID:9768
- C:\Windows\System\LHXTItu.exe
  C:\Windows\System\LHXTItu.exe
  2⤵
  PID:9836
- C:\Windows\System\nvlQUtF.exe
  C:\Windows\System\nvlQUtF.exe
  2⤵
  PID:10252
- C:\Windows\System\bpKuZSw.exe
  C:\Windows\System\bpKuZSw.exe
  2⤵
  PID:10276
- C:\Windows\System\SAZmBjF.exe
  C:\Windows\System\SAZmBjF.exe
  2⤵
  PID:10300
- C:\Windows\System\eLfSFkx.exe
  C:\Windows\System\eLfSFkx.exe
  2⤵
  PID:10324
- C:\Windows\System\Godqlqe.exe
  C:\Windows\System\Godqlqe.exe
  2⤵
  PID:10348
- C:\Windows\System\geJFJEk.exe
  C:\Windows\System\geJFJEk.exe
  2⤵
  PID:10368
- C:\Windows\System\kwCYamk.exe
  C:\Windows\System\kwCYamk.exe
  2⤵
  PID:10388
- C:\Windows\System\SAPojKD.exe
  C:\Windows\System\SAPojKD.exe
  2⤵
  PID:10416
- C:\Windows\System\XgIvBJT.exe
  C:\Windows\System\XgIvBJT.exe
  2⤵
  PID:10436
- C:\Windows\System\TwuMWum.exe
  C:\Windows\System\TwuMWum.exe
  2⤵
  PID:10460
- C:\Windows\System\JyqaFBw.exe
  C:\Windows\System\JyqaFBw.exe
  2⤵
  PID:10480
- C:\Windows\System\BZgCKEK.exe
  C:\Windows\System\BZgCKEK.exe
  2⤵
  PID:10504
- C:\Windows\System\hYJeUIs.exe
  C:\Windows\System\hYJeUIs.exe
  2⤵
  PID:10532
- C:\Windows\System\yiGadYY.exe
  C:\Windows\System\yiGadYY.exe
  2⤵
  PID:10552
- C:\Windows\System\TYWHxUx.exe
  C:\Windows\System\TYWHxUx.exe
  2⤵
  PID:10576
- C:\Windows\System\wOmtkHW.exe
  C:\Windows\System\wOmtkHW.exe
  2⤵
  PID:10600
- C:\Windows\System\UDGwMVy.exe
  C:\Windows\System\UDGwMVy.exe
  2⤵
  PID:10616
- C:\Windows\System\KQiLDQP.exe
  C:\Windows\System\KQiLDQP.exe
  2⤵
  PID:10640
- C:\Windows\System\UwQdvoX.exe
  C:\Windows\System\UwQdvoX.exe
  2⤵
  PID:10660
- C:\Windows\System\CdQTwaz.exe
  C:\Windows\System\CdQTwaz.exe
  2⤵
  PID:10684
- C:\Windows\System\kPqRDgb.exe
  C:\Windows\System\kPqRDgb.exe
  2⤵
  PID:10700
- C:\Windows\System\mjYYeJe.exe
  C:\Windows\System\mjYYeJe.exe
  2⤵
  PID:10716
- C:\Windows\System\ZIayHku.exe
  C:\Windows\System\ZIayHku.exe
  2⤵
  PID:10732
- C:\Windows\System\Silkemp.exe
  C:\Windows\System\Silkemp.exe
  2⤵
  PID:10748
- C:\Windows\System\BSNBPir.exe
  C:\Windows\System\BSNBPir.exe
  2⤵
  PID:10768
- C:\Windows\System\JfHdAYL.exe
  C:\Windows\System\JfHdAYL.exe
  2⤵
  PID:10792
- C:\Windows\System\HrKKUKe.exe
  C:\Windows\System\HrKKUKe.exe
  2⤵
  PID:10816
- C:\Windows\System\qwPfBGc.exe
  C:\Windows\System\qwPfBGc.exe
  2⤵
  PID:10836
- C:\Windows\System\bXelGpc.exe
  C:\Windows\System\bXelGpc.exe
  2⤵
  PID:10856
- C:\Windows\System\hqeyqhn.exe
  C:\Windows\System\hqeyqhn.exe
  2⤵
  PID:10876
- C:\Windows\System\tGPjgsQ.exe
  C:\Windows\System\tGPjgsQ.exe
  2⤵
  PID:10896
- C:\Windows\System\ujHxHjw.exe
  C:\Windows\System\ujHxHjw.exe
  2⤵
  PID:10916
- C:\Windows\System\BzeAsuz.exe
  C:\Windows\System\BzeAsuz.exe
  2⤵
  PID:10940
- C:\Windows\System\MnyoGho.exe
  C:\Windows\System\MnyoGho.exe
  2⤵
  PID:10960
- C:\Windows\System\SLPqMIV.exe
  C:\Windows\System\SLPqMIV.exe
  2⤵
  PID:10984
- C:\Windows\System\aNBpgIH.exe
  C:\Windows\System\aNBpgIH.exe
  2⤵
  PID:11004
- C:\Windows\System\AbsmJay.exe
  C:\Windows\System\AbsmJay.exe
  2⤵
  PID:11024
- C:\Windows\System\UvgtKNY.exe
  C:\Windows\System\UvgtKNY.exe
  2⤵
  PID:11048
- C:\Windows\System\yjWZEsJ.exe
  C:\Windows\System\yjWZEsJ.exe
  2⤵
  PID:11076
- C:\Windows\System\NvNfPKp.exe
  C:\Windows\System\NvNfPKp.exe
  2⤵
  PID:11100
- C:\Windows\System\ewMODyT.exe
  C:\Windows\System\ewMODyT.exe
  2⤵
  PID:11120
- C:\Windows\System\gQkHRPt.exe
  C:\Windows\System\gQkHRPt.exe
  2⤵
  PID:11140
- C:\Windows\System\EGykgNP.exe
  C:\Windows\System\EGykgNP.exe
  2⤵
  PID:11164
- C:\Windows\System\itzjgXW.exe
  C:\Windows\System\itzjgXW.exe
  2⤵
  PID:11184
- C:\Windows\System\SgGycZD.exe
  C:\Windows\System\SgGycZD.exe
  2⤵
  PID:11208
- C:\Windows\System\wEwXRHM.exe
  C:\Windows\System\wEwXRHM.exe
  2⤵
  PID:11228
- C:\Windows\System\WblIjyE.exe
  C:\Windows\System\WblIjyE.exe
  2⤵
  PID:11252
- C:\Windows\System\bGQOHeK.exe
  C:\Windows\System\bGQOHeK.exe
  2⤵
  PID:9896
- C:\Windows\System\uaiKEtu.exe
  C:\Windows\System\uaiKEtu.exe
  2⤵
  PID:8088
- C:\Windows\System\JyzlAfc.exe
  C:\Windows\System\JyzlAfc.exe
  2⤵
  PID:10024
- C:\Windows\System\GJCACzC.exe
  C:\Windows\System\GJCACzC.exe
  2⤵
  PID:6860
- C:\Windows\System\PKbUtOC.exe
  C:\Windows\System\PKbUtOC.exe
  2⤵
  PID:10136
- C:\Windows\System\NZamncH.exe
  C:\Windows\System\NZamncH.exe
  2⤵
  PID:8264
- C:\Windows\System\yuOXVss.exe
  C:\Windows\System\yuOXVss.exe
  2⤵
  PID:8404
- C:\Windows\System\vIKYiMC.exe
  C:\Windows\System\vIKYiMC.exe
  2⤵
  PID:9288
- C:\Windows\System\apKhjFJ.exe
  C:\Windows\System\apKhjFJ.exe
  2⤵
  PID:8700
- C:\Windows\System\wUMNeGG.exe
  C:\Windows\System\wUMNeGG.exe
  2⤵
  PID:8772
- C:\Windows\System\HcWtemK.exe
  C:\Windows\System\HcWtemK.exe
  2⤵
  PID:9012
- C:\Windows\System\FaewayU.exe
  C:\Windows\System\FaewayU.exe
  2⤵
  PID:11272
- C:\Windows\System\GxyAMJH.exe
  C:\Windows\System\GxyAMJH.exe
  2⤵
  PID:11296
- C:\Windows\System\ynCvlXZ.exe
  C:\Windows\System\ynCvlXZ.exe
  2⤵
  PID:11312
- C:\Windows\System\ylgxJVL.exe
  C:\Windows\System\ylgxJVL.exe
  2⤵
  PID:11332
- C:\Windows\System\BenYcQf.exe
  C:\Windows\System\BenYcQf.exe
  2⤵
  PID:11356
- C:\Windows\System\KVIGYsC.exe
  C:\Windows\System\KVIGYsC.exe
  2⤵
  PID:11384
- C:\Windows\System\LCCidrj.exe
  C:\Windows\System\LCCidrj.exe
  2⤵
  PID:11404
- C:\Windows\System\wfYIEnN.exe
  C:\Windows\System\wfYIEnN.exe
  2⤵
  PID:11424
- C:\Windows\System\FEIuBUa.exe
  C:\Windows\System\FEIuBUa.exe
  2⤵
  PID:11448
- C:\Windows\System\ZjrDJuk.exe
  C:\Windows\System\ZjrDJuk.exe
  2⤵
  PID:11476
- C:\Windows\System\xpLFOQj.exe
  C:\Windows\System\xpLFOQj.exe
  2⤵
  PID:11500
- C:\Windows\System\oaYXGYc.exe
  C:\Windows\System\oaYXGYc.exe
  2⤵
  PID:11516
- C:\Windows\System\DbczoZv.exe
  C:\Windows\System\DbczoZv.exe
  2⤵
  PID:11540
- C:\Windows\System\WySqORw.exe
  C:\Windows\System\WySqORw.exe
  2⤵
  PID:11564
- C:\Windows\System\RVMhMhO.exe
  C:\Windows\System\RVMhMhO.exe
  2⤵
  PID:11600
- C:\Windows\System\mZTOQGz.exe
  C:\Windows\System\mZTOQGz.exe
  2⤵
  PID:11624
- C:\Windows\System\OisSgPH.exe
  C:\Windows\System\OisSgPH.exe
  2⤵
  PID:11648
- C:\Windows\System\PWAQykh.exe
  C:\Windows\System\PWAQykh.exe
  2⤵
  PID:11668
- C:\Windows\System\fCPuOkg.exe
  C:\Windows\System\fCPuOkg.exe
  2⤵
  PID:11688
- C:\Windows\System\uHBjnJD.exe
  C:\Windows\System\uHBjnJD.exe
  2⤵
  PID:11708
- C:\Windows\System\ZbVAYDU.exe
  C:\Windows\System\ZbVAYDU.exe
  2⤵
  PID:11732
- C:\Windows\System\xnZmcBP.exe
  C:\Windows\System\xnZmcBP.exe
  2⤵
  PID:11748
- C:\Windows\System\ZSjJTLa.exe
  C:\Windows\System\ZSjJTLa.exe
  2⤵
  PID:11780
- C:\Windows\System\svttuzw.exe
  C:\Windows\System\svttuzw.exe
  2⤵
  PID:11796
- C:\Windows\System\FNSFYOG.exe
  C:\Windows\System\FNSFYOG.exe
  2⤵
  PID:11812
- C:\Windows\System\ueUfQtZ.exe
  C:\Windows\System\ueUfQtZ.exe
  2⤵
  PID:11828
- C:\Windows\System\DdflOUK.exe
  C:\Windows\System\DdflOUK.exe
  2⤵
  PID:11844
- C:\Windows\System\pFHWNkj.exe
  C:\Windows\System\pFHWNkj.exe
  2⤵
  PID:11860
- C:\Windows\System\hwSaIMQ.exe
  C:\Windows\System\hwSaIMQ.exe
  2⤵
  PID:11876
- C:\Windows\System\BQveiKg.exe
  C:\Windows\System\BQveiKg.exe
  2⤵
  PID:11904
- C:\Windows\System\MIuWVoS.exe
  C:\Windows\System\MIuWVoS.exe
  2⤵
  PID:11924
- C:\Windows\System\QwcOhoO.exe
  C:\Windows\System\QwcOhoO.exe
  2⤵
  PID:11948
- C:\Windows\System\zPCksgJ.exe
  C:\Windows\System\zPCksgJ.exe
  2⤵
  PID:11972
- C:\Windows\System\JoFLxkn.exe
  C:\Windows\System\JoFLxkn.exe
  2⤵
  PID:12000
- C:\Windows\System\iPBTjUr.exe
  C:\Windows\System\iPBTjUr.exe
  2⤵
  PID:12020
- C:\Windows\System\TvELlCn.exe
  C:\Windows\System\TvELlCn.exe
  2⤵
  PID:12036
- C:\Windows\System\nNfSBQx.exe
  C:\Windows\System\nNfSBQx.exe
  2⤵
  PID:12052
- C:\Windows\System\aOawEbP.exe
  C:\Windows\System\aOawEbP.exe
  2⤵
  PID:12080
- C:\Windows\System\gARXobA.exe
  C:\Windows\System\gARXobA.exe
  2⤵
  PID:12100
- C:\Windows\System\aFoNzzH.exe
  C:\Windows\System\aFoNzzH.exe
  2⤵
  PID:12124
- C:\Windows\System\IeZzgZG.exe
  C:\Windows\System\IeZzgZG.exe
  2⤵
  PID:12144
- C:\Windows\System\RxtfhvL.exe
  C:\Windows\System\RxtfhvL.exe
  2⤵
  PID:12168
- C:\Windows\System\okoBYWJ.exe
  C:\Windows\System\okoBYWJ.exe
  2⤵
  PID:12188
- C:\Windows\System\cgNOBXa.exe
  C:\Windows\System\cgNOBXa.exe
  2⤵
  PID:12212
- C:\Windows\System\uqJWgQx.exe
  C:\Windows\System\uqJWgQx.exe
  2⤵
  PID:12232
- C:\Windows\System\pwkDRof.exe
  C:\Windows\System\pwkDRof.exe
  2⤵
  PID:12252
- C:\Windows\System\gpEOInk.exe
  C:\Windows\System\gpEOInk.exe
  2⤵
  PID:12276
- C:\Windows\System\hvYNGih.exe
  C:\Windows\System\hvYNGih.exe
  2⤵
  PID:7984
- C:\Windows\System\DLNHGNA.exe
  C:\Windows\System\DLNHGNA.exe
  2⤵
  PID:8904
- C:\Windows\System\dQyqbpc.exe
  C:\Windows\System\dQyqbpc.exe
  2⤵
  PID:8932
- C:\Windows\System\UlQIeVv.exe
  C:\Windows\System\UlQIeVv.exe
  2⤵
  PID:8236
- C:\Windows\System\PzrJXwE.exe
  C:\Windows\System\PzrJXwE.exe
  2⤵
  PID:8112
- C:\Windows\System\qQXUksi.exe
  C:\Windows\System\qQXUksi.exe
  2⤵
  PID:8792
- C:\Windows\System\dJRDRGV.exe
  C:\Windows\System\dJRDRGV.exe
  2⤵
  PID:4360
- C:\Windows\System\EbuInWW.exe
  C:\Windows\System\EbuInWW.exe
  2⤵
  PID:9148
- C:\Windows\System\HNLxXLH.exe
  C:\Windows\System\HNLxXLH.exe
  2⤵
  PID:9816
- C:\Windows\System\bkMdvxB.exe
  C:\Windows\System\bkMdvxB.exe
  2⤵
  PID:10296
- C:\Windows\System\LUwXOqi.exe
  C:\Windows\System\LUwXOqi.exe
  2⤵
  PID:10404
- C:\Windows\System\dcxeIat.exe
  C:\Windows\System\dcxeIat.exe
  2⤵
  PID:10496
- C:\Windows\System\axKMGUo.exe
  C:\Windows\System\axKMGUo.exe
  2⤵
  PID:10540
- C:\Windows\System\grqWlVV.exe
  C:\Windows\System\grqWlVV.exe
  2⤵
  PID:10028
- C:\Windows\System\AarUvEQ.exe
  C:\Windows\System\AarUvEQ.exe
  2⤵
  PID:10708
- C:\Windows\System\iSCNdkj.exe
  C:\Windows\System\iSCNdkj.exe
  2⤵
  PID:10116
- C:\Windows\System\wbuuGRk.exe
  C:\Windows\System\wbuuGRk.exe
  2⤵
  PID:12312
- C:\Windows\System\hnDeEpJ.exe
  C:\Windows\System\hnDeEpJ.exe
  2⤵
  PID:12328
- C:\Windows\System\YGXQMKi.exe
  C:\Windows\System\YGXQMKi.exe
  2⤵
  PID:12352
- C:\Windows\System\syAeWRF.exe
  C:\Windows\System\syAeWRF.exe
  2⤵
  PID:12372
- C:\Windows\System\HwJnYfQ.exe
  C:\Windows\System\HwJnYfQ.exe
  2⤵
  PID:12400
- C:\Windows\System\FChngCs.exe
  C:\Windows\System\FChngCs.exe
  2⤵
  PID:12420
- C:\Windows\System\PBYnwGL.exe
  C:\Windows\System\PBYnwGL.exe
  2⤵
  PID:12452
- C:\Windows\System\QBMllar.exe
  C:\Windows\System\QBMllar.exe
  2⤵
  PID:12480
- C:\Windows\System\CBbqatO.exe
  C:\Windows\System\CBbqatO.exe
  2⤵
  PID:12500
- C:\Windows\System\CWmlOsQ.exe
  C:\Windows\System\CWmlOsQ.exe
  2⤵
  PID:12520
- C:\Windows\System\tXvbjla.exe
  C:\Windows\System\tXvbjla.exe
  2⤵
  PID:12544
- C:\Windows\System\qvsvbCF.exe
  C:\Windows\System\qvsvbCF.exe
  2⤵
  PID:12588
- C:\Windows\System\tAWKjck.exe
  C:\Windows\System\tAWKjck.exe
  2⤵
  PID:12608
- C:\Windows\System\bWgGANY.exe
  C:\Windows\System\bWgGANY.exe
  2⤵
  PID:12632
- C:\Windows\System\hmYGNbm.exe
  C:\Windows\System\hmYGNbm.exe
  2⤵
  PID:12648
- C:\Windows\System\yaRvlSd.exe
  C:\Windows\System\yaRvlSd.exe
  2⤵
  PID:12668
- C:\Windows\System\Squxgvj.exe
  C:\Windows\System\Squxgvj.exe
  2⤵
  PID:12696
- C:\Windows\System\qltgVcC.exe
  C:\Windows\System\qltgVcC.exe
  2⤵
  PID:12716
- C:\Windows\System\tfFMUlu.exe
  C:\Windows\System\tfFMUlu.exe
  2⤵
  PID:12740
- C:\Windows\System\AOMmYAN.exe
  C:\Windows\System\AOMmYAN.exe
  2⤵
  PID:12756
- C:\Windows\System\fxAftVb.exe
  C:\Windows\System\fxAftVb.exe
  2⤵
  PID:12772
- C:\Windows\System\MlFxszd.exe
  C:\Windows\System\MlFxszd.exe
  2⤵
  PID:12788
- C:\Windows\System\TLTykYE.exe
  C:\Windows\System\TLTykYE.exe
  2⤵
  PID:12804
- C:\Windows\System\pJmHtHm.exe
  C:\Windows\System\pJmHtHm.exe
  2⤵
  PID:12820
- C:\Windows\System\vadgbzI.exe
  C:\Windows\System\vadgbzI.exe
  2⤵
  PID:12840
- C:\Windows\System\tTXXGfx.exe
  C:\Windows\System\tTXXGfx.exe
  2⤵
  PID:12868
- C:\Windows\System\zniEtCn.exe
  C:\Windows\System\zniEtCn.exe
  2⤵
  PID:12892
- C:\Windows\System\XRgoFbz.exe
  C:\Windows\System\XRgoFbz.exe
  2⤵
  PID:12916
- C:\Windows\System\mpZekZe.exe
  C:\Windows\System\mpZekZe.exe
  2⤵
  PID:12932
- C:\Windows\System\SLKVoeR.exe
  C:\Windows\System\SLKVoeR.exe
  2⤵
  PID:12972
- C:\Windows\System\SYEiaVT.exe
  C:\Windows\System\SYEiaVT.exe
  2⤵
  PID:12992
- C:\Windows\System\WhEwunN.exe
  C:\Windows\System\WhEwunN.exe
  2⤵
  PID:13012
- C:\Windows\System\PcPkUKp.exe
  C:\Windows\System\PcPkUKp.exe
  2⤵
  PID:13032
- C:\Windows\System\QdxygVh.exe
  C:\Windows\System\QdxygVh.exe
  2⤵
  PID:13060
- C:\Windows\System\hbQksHq.exe
  C:\Windows\System\hbQksHq.exe
  2⤵
  PID:13092
- C:\Windows\System\HdqEEHr.exe
  C:\Windows\System\HdqEEHr.exe
  2⤵
  PID:13112
- C:\Windows\System\DZZGoHh.exe
  C:\Windows\System\DZZGoHh.exe
  2⤵
  PID:13132
- C:\Windows\System\KTvvsld.exe
  C:\Windows\System\KTvvsld.exe
  2⤵
  PID:13152
- C:\Windows\System\YPYkTAm.exe
  C:\Windows\System\YPYkTAm.exe
  2⤵
  PID:13172
- C:\Windows\System\TByiTFk.exe
  C:\Windows\System\TByiTFk.exe
  2⤵
  PID:13200
- C:\Windows\System\PzDFZSt.exe
  C:\Windows\System\PzDFZSt.exe
  2⤵
  PID:13228
- C:\Windows\System\wPDLtls.exe
  C:\Windows\System\wPDLtls.exe
  2⤵
  PID:13248
- C:\Windows\System\tpeqgTj.exe
  C:\Windows\System\tpeqgTj.exe
  2⤵
  PID:13268
- C:\Windows\System\kGXvLEK.exe
  C:\Windows\System\kGXvLEK.exe
  2⤵
  PID:11944
- C:\Windows\System\JXkWhKM.exe
  C:\Windows\System\JXkWhKM.exe
  2⤵
  PID:10336
- C:\Windows\System\kEBhIyX.exe
  C:\Windows\System\kEBhIyX.exe
  2⤵
  PID:13300
- C:\Windows\System\MayYxSk.exe
  C:\Windows\System\MayYxSk.exe
  2⤵
  PID:12924
- C:\Windows\System\YVZqgrk.exe
  C:\Windows\System\YVZqgrk.exe
  2⤵
  PID:12796
- C:\Windows\System\GRURBcN.exe
  C:\Windows\System\GRURBcN.exe
  2⤵
  PID:8968
- C:\Windows\System\StehPKp.exe
  C:\Windows\System\StehPKp.exe
  2⤵
  PID:12836
- C:\Windows\System\ERuYcsc.exe
  C:\Windows\System\ERuYcsc.exe
  2⤵
  PID:12752
- C:\Windows\System\FlRnEeA.exe
  C:\Windows\System\FlRnEeA.exe
  2⤵
  PID:12344
- C:\Windows\System\oTXyJZY.exe
  C:\Windows\System\oTXyJZY.exe
  2⤵
  PID:11000
- C:\Windows\System\osnnSFG.exe
  C:\Windows\System\osnnSFG.exe
  2⤵
  PID:13024
- C:\Windows\System\dOwqgbr.exe
  C:\Windows\System\dOwqgbr.exe
  2⤵
  PID:10928
- C:\Windows\System\naUdEYj.exe
  C:\Windows\System\naUdEYj.exe
  2⤵
  PID:12072
- C:\Windows\System\BpGSMLA.exe
  C:\Windows\System\BpGSMLA.exe
  2⤵
  PID:6976
- C:\Windows\System\XZzXfJv.exe
  C:\Windows\System\XZzXfJv.exe
  2⤵
  PID:12264
- C:\Windows\System\VWvxUhb.exe
  C:\Windows\System\VWvxUhb.exe
  2⤵
  PID:7100
- C:\Windows\System\vtKKUDT.exe
  C:\Windows\System\vtKKUDT.exe
  2⤵
  PID:11992
- C:\Windows\System\tRzikPk.exe
  C:\Windows\System\tRzikPk.exe
  2⤵
  PID:10804
- C:\Windows\System\xxotzXQ.exe
  C:\Windows\System\xxotzXQ.exe
  2⤵
  PID:8324
- C:\Windows\System\zLHbOoZ.exe
  C:\Windows\System\zLHbOoZ.exe
  2⤵
  PID:11744
- C:\Windows\System\lbSCmai.exe
  C:\Windows\System\lbSCmai.exe
  2⤵
  PID:11980
- C:\Windows\System\yTjsyQn.exe
  C:\Windows\System\yTjsyQn.exe
  2⤵
  PID:11340
- C:\Windows\System\BmieuAB.exe
  C:\Windows\System\BmieuAB.exe
  2⤵
  PID:9220
- C:\Windows\System\LcFGaHJ.exe
  C:\Windows\System\LcFGaHJ.exe
  2⤵
  PID:8440
- C:\Windows\System\kEQWepL.exe
  C:\Windows\System\kEQWepL.exe
  2⤵
  PID:11328
- C:\Windows\System\uZGvPAO.exe
  C:\Windows\System\uZGvPAO.exe
  2⤵
  PID:10868
- C:\Windows\System\weItIKx.exe
  C:\Windows\System\weItIKx.exe
  2⤵
  PID:11756
- C:\Windows\System\aFNCymG.exe
  C:\Windows\System\aFNCymG.exe
  2⤵
  PID:11160
- C:\Windows\System\cjvXAxn.exe
  C:\Windows\System\cjvXAxn.exe
  2⤵
  PID:13164
- C:\Windows\System\vmYGFkv.exe
  C:\Windows\System\vmYGFkv.exe
  2⤵
  PID:13048
- C:\Windows\System\tbXqOEQ.exe
  C:\Windows\System\tbXqOEQ.exe
  2⤵
  PID:12944
- C:\Windows\System\tcRxkOW.exe
  C:\Windows\System\tcRxkOW.exe
  2⤵
  PID:11772
- C:\Windows\System\ECHxImC.exe
  C:\Windows\System\ECHxImC.exe
  2⤵
  PID:12436
- C:\Windows\System\oPpeUWn.exe
  C:\Windows\System\oPpeUWn.exe
  2⤵
  PID:10588
- C:\Windows\System\eSQwWwS.exe
  C:\Windows\System\eSQwWwS.exe
  2⤵
  PID:11068
- C:\Windows\System\pIiNEBb.exe
  C:\Windows\System\pIiNEBb.exe
  2⤵
  PID:10076
- C:\Windows\System\DtcMMtL.exe
  C:\Windows\System\DtcMMtL.exe
  2⤵
  PID:11932
- C:\Windows\System\thggahp.exe
  C:\Windows\System\thggahp.exe
  2⤵
  PID:11820
- C:\Windows\System\RhWlGiT.exe
  C:\Windows\System\RhWlGiT.exe
  2⤵
  PID:8212
- C:\Windows\System\SxXZYkg.exe
  C:\Windows\System\SxXZYkg.exe
  2⤵
  PID:13148
- C:\Windows\System\qlinZCf.exe
  C:\Windows\System\qlinZCf.exe
  2⤵
  PID:11840
- C:\Windows\System\fhdhala.exe
  C:\Windows\System\fhdhala.exe
  2⤵
  PID:11116
- C:\Windows\System\vQSEKqU.exe
  C:\Windows\System\vQSEKqU.exe
  2⤵
  PID:9092
- C:\Windows\System\msmwHjI.exe
  C:\Windows\System\msmwHjI.exe
  2⤵
  PID:13120
- C:\Windows\System\HzitFhi.exe
  C:\Windows\System\HzitFhi.exe
  2⤵
  PID:12800
- C:\Windows\System\gVbUbok.exe
  C:\Windows\System\gVbUbok.exe
  2⤵
  PID:10696
- C:\Windows\System\vHfdYWm.exe
  C:\Windows\System\vHfdYWm.exe
  2⤵
  PID:12180
- C:\Windows\System\FwrlCKj.exe
  C:\Windows\System\FwrlCKj.exe
  2⤵
  PID:4572
- C:\Windows\System\QHLufHm.exe
  C:\Windows\System\QHLufHm.exe
  2⤵
  PID:8572
- C:\Windows\System\IOMxTIx.exe
  C:\Windows\System\IOMxTIx.exe
  2⤵
  PID:7272
- C:\Windows\System\CEWBvqv.exe
  C:\Windows\System\CEWBvqv.exe
  2⤵
  PID:6028
- C:\Windows\System\NCtprob.exe
  C:\Windows\System\NCtprob.exe
  2⤵
  PID:5732
- C:\Windows\System\rYLFPNh.exe
  C:\Windows\System\rYLFPNh.exe
  2⤵
  PID:11112
- C:\Windows\System\lOmkfjc.exe
  C:\Windows\System\lOmkfjc.exe
  2⤵
  PID:12676
- C:\Windows\System\gPsqugI.exe
  C:\Windows\System\gPsqugI.exe
  2⤵
  PID:11280
- C:\Windows\System\YKdrdkq.exe
  C:\Windows\System\YKdrdkq.exe
  2⤵
  PID:8996
- C:\Windows\System\qnYoCXu.exe
  C:\Windows\System\qnYoCXu.exe
  2⤵
  PID:8248
- C:\Windows\System\OqDyhQM.exe
  C:\Windows\System\OqDyhQM.exe
  2⤵
  PID:2708
- C:\Windows\System\RhfJvjE.exe
  C:\Windows\System\RhfJvjE.exe
  2⤵
  PID:11456
- C:\Windows\System\pWEmDjQ.exe
  C:\Windows\System\pWEmDjQ.exe
  2⤵
  PID:13180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tdhkaoru.w40.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BGNUhLy.exe

Filesize
1.9MB

MD5
bb148289abe392202357c044024b9f70

SHA1
e7e993e6c63f5df8b04df8219c49ac67c7310055

SHA256
322edace66324d5c2ba462954645e9688d9b8a7ec22ccb109928fb6062535b6c

SHA512
69fbe86f307cb1c41ad7b7c5a7592f0321b67d263344f4997fa51fc8e686214ceb91b950c9ceb6af78c68279e5a5974d64865bf109f3f869cfd3362d24b3d7a2

Download Submit
C:\Windows\System\BNUiLdV.exe

Filesize
1.9MB

MD5
64250f9925eb581c5737024489b23294

SHA1
1387d73c8f699a54a4efa670670615a943fb16c7

SHA256
7fc83801f67949f79d8fe7af03548d4d1c5ae2ff0b3df4a645c906fd11cc6073

SHA512
981b0f709edff15282fb3a420e707abc7fca97387806dcba1c80a45b605e45234ea4eb318ff08bfd49f85d40a020a43f8d449c2be6121524c65defc008fcd961

Download Submit
C:\Windows\System\BsnMxmO.exe

Filesize
1.9MB

MD5
d0cc23a9074a12ca40aadfaa56162a4d

SHA1
e54a8fd05735c4704cb9d63a5f482595b41f4868

SHA256
39860e9a479898a77abb93d81ef03cf2d54e34ee49d6247d2b2bd43a7c10685d

SHA512
aecb6bd3c565e5865aa302bdebb7537d51f8ee08edd74e9e3dcf9a424b5d3c94db008a0e388a1895527c936987783d17c072589580fa84fa21d67d25c5d47ba4

Download Submit
C:\Windows\System\Crzpeej.exe

Filesize
1.9MB

MD5
432357d1a09ab89399ebcb456af2bc89

SHA1
6d1770fed40cb9321b2e7f6f2fb730fab540d86b

SHA256
e9983e35410bebea1caaea498767d5bb7bb6d0d63bfe0b90e217ee73ebdad3fb

SHA512
7005ffb89bfbe4d8d3e410b85046f9e587c8ceccad87d2eb3ec09a3620eea5171fa6881c029b2d2761e6192dc2db75e044fdebd872bada91dd58a616299f0c4c

Download Submit
C:\Windows\System\EaJnqZl.exe

Filesize
1.9MB

MD5
578b07ab13082e23d7f19c799fe573e2

SHA1
d50eb24cb722500545aa08a8c25e378b005f1d4b

SHA256
71d8d499525e238dacd8ec1cfddfb503afdc2a9b66378d977a33d55a269b083f

SHA512
e9736ca50c828ca11c01cada939435c1b0269bbfd82521c5105a46476973b0491a763965c988aae351fd5a5b935a44e654be7224d96d42271ab666d46a97ed7c

Download Submit
C:\Windows\System\GNHCKuf.exe

Filesize
1.9MB

MD5
e2c6d4fdcf1c812fe55a6f337200bb37

SHA1
f1ef0902d712b3ee60f51137a475e1aa9872366f

SHA256
3144674a5e782cfbc1b09e09be993f8f8c82a6a64d3678dd256a39be157f95a9

SHA512
96b62f352dbbfde5801f6d40a9507f2d230a90aa535703af8741589ef8e22efd0d5e0da0e68c03854f8b0ec66975495554ea2ee0269d25f0714013ee2a2d8e67

Download Submit
C:\Windows\System\JuhfXgN.exe

Filesize
1.9MB

MD5
011d02be6ca199f0aaabf7dca0b73410

SHA1
086fd082eef2322ba2c9063ed55484fd2dd0cc90

SHA256
2746cf8dd1a6db19d0c72207839f03201ce8a47c4155453dc9b09dfc990708ee

SHA512
020cb9bbebe6a6d55672274933602cdd66e921f80ba5b71372219f274b295d2033e17946b803142036243ce3ff856a0aaceae06330e20302255df5dda1afb03b

Download Submit
C:\Windows\System\KwFQKbk.exe

Filesize
1.9MB

MD5
904d440c25def721fd89592cb40104c2

SHA1
97a41981cbb325c0d45e53b2988533f48fecb8b8

SHA256
0be4abc5234288b46539b7e3bb31555da5f9354c4d814f5cfe31ca13dea82e89

SHA512
2727f0dee7a52fbc484ed1a30f32356e6dbc1376b28df4f97b39efa705de480e9409cb5e02b617ff8240ec50279f0d676b92c99024d27d5025ff1ea16f804afc

Download Submit
C:\Windows\System\LTJLhEa.exe

Filesize
8B

MD5
9e16362b7eef9ff59cf4576b688fec20

SHA1
58714a79316bdda8b345ca47c2a7e8087e024871

SHA256
cb157cd47cb9ddacb8fa194262e9cc1364ca68490d93ad041938e77ef90ead7c

SHA512
53056e2e9a952538e1c61538c2bad2166adaf2d4a03d0e97e211329cd7f80967988343aa21690b08c2f1ad6d3fabfdc6095392f57b127d575de79d724d1a09de

Download Submit
C:\Windows\System\LkFbQwe.exe

Filesize
1.9MB

MD5
75daefff257a797398a718fb7899115e

SHA1
5aab686e8130c31302ebaadea5219c0a8f003a72

SHA256
691aaea72f1284be24067e712fbf4ed978a41a037a8ae4314c7560d086d2cb1f

SHA512
e31595d2b600a99f99594af1eee45fabf1b2f2e7992d588675fff6e660c8c9dd06e1f70fd29feb750c5cb0b09f382b555b702f94822a720d7d01ddded75dc67e

Download Submit
C:\Windows\System\LnXSVLK.exe

Filesize
1.9MB

MD5
f7701a077779df4b832b11b12581c84b

SHA1
ffbafd68a50ea55c79b857afd0d0becdc61eed11

SHA256
1bdf2a8e43276638bfeb90da7fd2919266239fc376d8a0dd42c85638b6a96f07

SHA512
19c3c33623835ba2328b20e3d6b01200bb7a36bbefcbb0499c707d3fb86fcd88ee2dc9ef94c43d9d8077aa608ac261a3cd2e06472c7a6b7ff98daf035f19894e

Download Submit
C:\Windows\System\NEQnfpj.exe

Filesize
1.9MB

MD5
46ccf3a95d87577eca1feedf181221a7

SHA1
d961ad4a015e644752fcb88831f778b67396e9ff

SHA256
aaf976d457b54eb4e6f14e8b0840b1cfaaf688004b426a2e0f7656c1da1171c8

SHA512
f5154677229b1efa1fdfe0562c52bca15f2292b686354b7e59c8f58a1f37e8bb4c0c2e79fe60685544bd056810fc97abc5003e4e33b69e1caa4f4a15a4fef7af

Download Submit
C:\Windows\System\SrcuoJz.exe

Filesize
1.9MB

MD5
27d4f63ca69df6120fcf2441620a46de

SHA1
982928d3fb20510aa5d371877e3b48a88f6b445b

SHA256
9c69d87f363e2cf2976024f686f81410462a57d1a6ab2c9322ea670414eaf581

SHA512
5743045a2e858b5b2d2ba1d2e3130ed83704cca3221042e34e15ed966d00a9666f4f364d80d9d165b0c1c10644b45b9cf76207cf3c6edd7a2703376556a95554

Download Submit
C:\Windows\System\SuzNsiv.exe

Filesize
1.9MB

MD5
dec5b70969a9be41ffd6dbf6007e03c3

SHA1
6335257d1641da547b40248c492f9eb04cfa70ad

SHA256
9bd90214ac73055a53d15e3c61cadaa6c5ebafb2263f3508ab87e491786a8ce4

SHA512
71a3f83fc4d9eb95b04d9dde0065b193c9e5a3eadf254567917fb858f6b668ba657d5bc88d9144ae992ed820d2d5624ee51659f4c4883f29d50d5bb38ead5a9a

Download Submit
C:\Windows\System\TGnQToN.exe

Filesize
1.9MB

MD5
f99985bf0ad368e12ec524680a2518d7

SHA1
9a7d00e28dc95270569072a0feb9a8d375f3e6d2

SHA256
71ced4b959f3b234dbf05cd6076058628ce4c8020c51fb6612100878cb096cc4

SHA512
8695ab961172374719a3e04474d6df879945edca0854c9c1c7ca3beb17d1929284210430c52690dfc4464c258d48530b0e20a9254c05130236a1e7c8e30c8c1e

Download Submit
C:\Windows\System\UbCPsJi.exe

Filesize
1.9MB

MD5
47242ce2bfb39bfd095543c563fe5051

SHA1
fba0c0c14b276d0433f4f73b7c57b80103930ef2

SHA256
ec8f885d20196123bc971ad9f4ab236256bd4fc93d3997e9de068e52d2df6d30

SHA512
1d5a6a680693b3e00fb3e145079a03189fedd55f1bfc03a15d7f55552891f929dfc953b98cef9c1109e41e749e57befb77d996b2c497422603b005c32a31a9e3

Download Submit
C:\Windows\System\WlCkGZL.exe

Filesize
1.9MB

MD5
939f57f03f7ca23a448e2ad679ea0c56

SHA1
b1d9bd6e701f4ae67ea9fd486cb97edc8c953ffd

SHA256
ca228866112082beeb52995c917c05eeffd48143b4020555789bd696ece0114e

SHA512
e090d5f0ee0a15636bd84d987d5f259ba24a752dea3fdeb93fafbedb7e396704e90af3820c32f45cc868895cb27e4ef6ea4f0dc5e4d0e9053e656655b1b84614

Download Submit
C:\Windows\System\ZOQamzQ.exe

Filesize
1.9MB

MD5
731546acf1a2d60247fe944e0c17c21d

SHA1
0c4fa3b656006820bc227b5a97fe60dc8ae404e0

SHA256
2d28ea14c97eddb55543e6af0fa6ad4f8ae8b21de6300e57580d051c5e446924

SHA512
c96e052611aa457bc72aea40140a69176a7d35c07dfa2ff65a46dc4befeca2cadd9bc2c1559165cb27ac939c5a9766a8ac6818fcb2a3487bfacf3273408e2843

Download Submit
C:\Windows\System\aIIyLfr.exe

Filesize
1.9MB

MD5
dda6240871a1f09f81ba1b37dc5298eb

SHA1
25c2a2927ada8e8d9448e2ef11d625761697ebf9

SHA256
f7fbc99aa5d290f1b5655dfa70e85681fafc5356d76357fb3740b3167a3b2ad6

SHA512
96f35503dc687dbc8143918f983bd9474615e2e661f2423b02db587353695a83d709641c456cfd87d004faa8b602970d0f2413fb93a284d21b35195c8636c340

Download Submit
C:\Windows\System\autUURs.exe

Filesize
1.9MB

MD5
d562e987971a589e459783792ae634c9

SHA1
d2032483b1f522d251345ffaf66ed8f57180f7a7

SHA256
5ea5e4fcfc088cb3a4ca74de56c0cf58486337e882107a4e37096247e96c8518

SHA512
6487b89e210e1772db79565d31412d1b66adb7c34d36fe5df524e477ead293d168d5ede94f6461457792320bce5969ea8a92e54ff033d466f9b8d576dab238ec

Download Submit
C:\Windows\System\bHPIOAY.exe

Filesize
1.9MB

MD5
f9f4fdeaad60c1e9026bb5df107b777c

SHA1
c8b8ebb0d5592c4f813f185aeda9f84bf30c2870

SHA256
e8e7e5a7231b3ef1a84fd514e002b6de5c962d43ed8a6523d05e69ba88060cf3

SHA512
d7c5f95cdd2644f5a2c5e700858c797cb7f153d18597f16f0abdb3871e97a600f4dfc9d157b5747763f566460c37b1603448ffb0220bdaa0d0c6073856952dbd

Download Submit
C:\Windows\System\bRFypNL.exe

Filesize
1.9MB

MD5
d28494061147b06bbbaf7cf96378801f

SHA1
a914f323848b80b042726d8b2118e780320fa154

SHA256
314a8f9833a139f0dd41b7eccc418a1c8c053ea5c0fd90d72425f5e61d2773db

SHA512
118a71a4ea613783c98af04c7edde75d930c296ece11fbcc5c239736f93840ea4cd81824a97f11f7afa2bdd8d7cb22b551ffea5ac665516705c5f7d49da31d4e

Download Submit
C:\Windows\System\bfaGouD.exe

Filesize
1.9MB

MD5
f3301ba9179da8d3d3d4664ec88932af

SHA1
f00fd17c913616e3cd0bb0aac4ae4a0a1b442a0b

SHA256
b976932a27bc529e6a1423ba7923e23be6c90302e51613cc64e25194abf1ad71

SHA512
f8d9f428caef40a08027702b97f03e42982456e7ea9fa93110e9971078afa447bb5a566a958dc4583ae56b77691a378277acf1578844261c72046120def383d6

Download Submit
C:\Windows\System\gRTvnmS.exe

Filesize
1.9MB

MD5
54c0ac76c2e9c001134fb09b659c0a98

SHA1
2bdb980d708dbfdfff6057eac067280443b2e745

SHA256
2c2fbacee7c25de5e53849cc7f4187c0f083dc8c4937ee28d9e7635d9c219835

SHA512
57244134303fc78c4e278dc5d8f35b31522f8797b31c93e615f27d207e3005abeb045a2d5cd0117839fb117ce528a9825e7eac0aa597bcdeef881855f4197a22

Download Submit
C:\Windows\System\hjHfCPV.exe

Filesize
1.9MB

MD5
793487f50d6883671f8feea95ee4120d

SHA1
24ca5dc94a8a62c3b2fb2322017de92d30c5420e

SHA256
8525dffcafa7d7546a0f2b035a935745b786132883be2321e5e57bbccbd0305e

SHA512
89e5ec94cc641cd2a44b61c1022896aa1e5914c0783badeb2028f72f40a31d04ab1d5372a8bea45ad11815e0e66df97ce4c34f142f16b597bb686fa190dd2161

Download Submit
C:\Windows\System\jQOsqbK.exe

Filesize
1.9MB

MD5
73bda31f3e7c69dffb388db5e60c4f6c

SHA1
0e2ed2094a807ba84f1d513fe0aa85fca2a9b74b

SHA256
acaa8e9bddb65672b10d85f973332847e230e57168c0bcc5f3c4cc025ef2de37

SHA512
33bfc37e62f6d5b8aa764af3fdabf0b47c5182e66418b2f80248722af9d4ee82913de47b4bf19b32699ab3f4156b9d3a9780736052ed21f24c4439c4c2a0010d

Download Submit
C:\Windows\System\lkzYaHI.exe

Filesize
1.9MB

MD5
c1a1214d5362d59e072f606f4ad639fe

SHA1
b06efe7d316363c47eeddfadda6e80335e15c41c

SHA256
49fb3f919335e76788376e33609c895f93cbf29e67fb5337c64823bdaeb64b31

SHA512
8f8028b1282155ce1e3d8ecbeb868885a7b07765be65f05de342a88eb7ebaea1ffcdc598763522f678613cebeb25ce3e72d2f1b6b8664ab2da262762ec036bc6

Download Submit
C:\Windows\System\lxOlWqz.exe

Filesize
1.9MB

MD5
9489fd918016a61bb74f61ba1ccf6ebb

SHA1
e2e73f8890427fe18ed297431e010cb5cf6af83f

SHA256
38b792da0c82f89bf7cebaf646f476ac62ec3b8002f08ca6d49a97b09e052251

SHA512
21d6cb1a83cc3e7f850512b3d7428dd0929f75a8abb702d9c86f0bf2a8ec3efdaa385fc12813f9366eee8815046ebfd9223451eeb97e1d363f1b61705b9bebff

Download Submit
C:\Windows\System\mqaGnTn.exe

Filesize
1.9MB

MD5
3cf99d31f23fda435e912f74521787e2

SHA1
66e9af68f60dad58e7dec592bb33eaf058f95388

SHA256
82fe473310b24252d6067377653b7dff69d9dba6beaa8bfc652dbdbe5f46b231

SHA512
66bcdb751f0bdaf114a7d730d17ef846d0b16d5bdbb90133fac3f71beb63b1f521afae17b0db62959924adcb573c57828a5ccf3f29666b5b9fdecb443224fe3b

Download Submit
C:\Windows\System\nunHIFk.exe

Filesize
1.9MB

MD5
c8225744ef7150da116205f1d7d70f73

SHA1
6c61db2a7005886ce2439c9069510afb09bf7b5d

SHA256
d731606d0aecb92dfc0c4bfebbc73ec0032b0391ff6db103d1ca55af81aa86a5

SHA512
2c0c3fc999bc48a2a835e7eb0c0dcb5a1e071b31e23c42abe1a6d4c5175205d384b2b28de44945e8debb9b33e972e73d0fb1219a2c9a79c3a6f7fd872c4d84e4

Download Submit
C:\Windows\System\oJTIQse.exe

Filesize
1.9MB

MD5
92a15f989ad4518a28bd2d658f37cea3

SHA1
bf251d621bbe084e0fcb1bb7051616aa9bb81e6f

SHA256
a33e2c1a2a69ab4be0a4ceb2cc4fc3b4883a15b3cfd46706033de2b9fb00058e

SHA512
586124810f65855b91eeedc960e1593e1b099cf635eb06950c9dbd764e03e1777c45584e317617de18157bb2a7e2fb57c99907ce3c1d0d1514da7629abd0479e

Download Submit
C:\Windows\System\qyOiJcs.exe

Filesize
1.9MB

MD5
f5e265e5ddee5bcf4cc0fbcf3e1b74f7

SHA1
c712430ef9deaaa8585e4943a78fb62665e7919d

SHA256
c773eab953ecfd4f586c1298474c34e025065b1e8c5fb749fecec9093761e151

SHA512
3b8bb6546c695cd07bc03b5d0718814f44ee6c0fdde53021e2eaa4a205528c1e0cff74650dbe5e04480751dd66bac16325629d1543f5ad21e283fccb67e454af

Download Submit
C:\Windows\System\reZaugs.exe

Filesize
1.9MB

MD5
f6f8fc5d706968adbd2799b8f56a3056

SHA1
08704fff9a0cd576bed0e7b32a9cae2faa94b2d7

SHA256
2d05055ddf75fa290fbfd07dfcf7e46ebb297589c6dccf3391433134e2e3dc25

SHA512
281eb1d6f18f088b1a3666fb64b7a5e51cc20d6b242b63c0c7913a729ad53edc7e7e57604b82ab273a4fbfbc408b65eff9d7a50a0a85c42e305c402e28eeec05

Download Submit
C:\Windows\System\tPsnAGs.exe

Filesize
1.9MB

MD5
72dcbab5c03ce44729e7685e5e6b2251

SHA1
974ee2d3b16b7089567a5bf386a9ebdd41e8721b

SHA256
7e861300bb63bfea9355992191a6b447b8856bf7208e5c3890326bfce448ba7f

SHA512
4f2f085b8e30037a0b5901afb9224a46e61b7ef4d6498dd6032d47b1dff7d5bbf3be915ef9293d86fc2e11e26b507c5e0460bdd21330a076b8f285d61186e2f3

Download Submit
C:\Windows\System\uJYURZv.exe

Filesize
1.9MB

MD5
d76cddd32e02295ae965e669320dd023

SHA1
7ee8afe37c4a9f2bd86331a9d47c20b735ceda90

SHA256
73c0d7a13063a827baad9f4b238e20940da60c86dcf20cda7ebad284ebdb030d

SHA512
6c349ded370a9d71fde08f1387277af505f71ebb015045f4232945c028d2b669bfe9990fb8fc480f698462563ead0a842319866e6186bb84f5199e6c7409a733

Download Submit
C:\Windows\System\wqLoggJ.exe

Filesize
1.9MB

MD5
8f744cb36f1345f4ad3c3bd0d386b67f

SHA1
6fffa47ecb8d8dea2e82ff3174b30f12b9f8d631

SHA256
d69200bf6d209fa865cc3a777c709c20ea40eff8b5ccdad4eedbc5b5700216b0

SHA512
9aea223c3c0c28ed75ae7ac4946213bc3b7056a0b165122cee56848e68a33a0646ebc3129bbe7240f3e7d1c2d18307ae13a6b60f22f0157ec9f234801ac57f76

Download Submit
C:\Windows\System\zvERSeE.exe

Filesize
1.9MB

MD5
d6d2e93bbccfc98a8130a3054dada81d

SHA1
f778988b6ba626bf1a8bd9f87d95660799bcb305

SHA256
7ace9c47a9d8f358e4e63c54c118dea122bcf331e682469e65b76b6b8c105bec

SHA512
fd605d57c5cba9d371b9204df9a7d3cc5384cc59118f5fda5d20f40dbb1f43853c303d677069e61188a9108f0a83b95fea62fb51624adcd6d9987e4cf69a674a

Download Submit
memory/444-2936-0x00007FF7C6970000-0x00007FF7C6D62000-memory.dmp

Filesize
3.9MB

Download
memory/444-239-0x00007FF7C6970000-0x00007FF7C6D62000-memory.dmp

Filesize
3.9MB

Download
memory/680-2919-0x00007FF771F50000-0x00007FF772342000-memory.dmp

Filesize
3.9MB

Download
memory/680-196-0x00007FF771F50000-0x00007FF772342000-memory.dmp

Filesize
3.9MB

Download
memory/780-138-0x00007FF63E5F0000-0x00007FF63E9E2000-memory.dmp

Filesize
3.9MB

Download
memory/780-2914-0x00007FF63E5F0000-0x00007FF63E9E2000-memory.dmp

Filesize
3.9MB

Download
memory/948-2922-0x00007FF7DFA20000-0x00007FF7DFE12000-memory.dmp

Filesize
3.9MB

Download
memory/948-237-0x00007FF7DFA20000-0x00007FF7DFE12000-memory.dmp

Filesize
3.9MB

Download
memory/1080-2915-0x00007FF7626F0000-0x00007FF762AE2000-memory.dmp

Filesize
3.9MB

Download
memory/1080-177-0x00007FF7626F0000-0x00007FF762AE2000-memory.dmp

Filesize
3.9MB

Download
memory/1648-0-0x00007FF6C1B90000-0x00007FF6C1F82000-memory.dmp

Filesize
3.9MB

Download
memory/1648-1-0x000001A272F80000-0x000001A272F90000-memory.dmp

Filesize
64KB

Download
memory/2240-234-0x00007FF788660000-0x00007FF788A52000-memory.dmp

Filesize
3.9MB

Download
memory/2240-2918-0x00007FF788660000-0x00007FF788A52000-memory.dmp

Filesize
3.9MB

Download
memory/2496-243-0x00007FF7F2CD0000-0x00007FF7F30C2000-memory.dmp

Filesize
3.9MB

Download
memory/2496-2938-0x00007FF7F2CD0000-0x00007FF7F30C2000-memory.dmp

Filesize
3.9MB

Download
memory/2632-231-0x00007FF62A5D0000-0x00007FF62A9C2000-memory.dmp

Filesize
3.9MB

Download
memory/2632-2941-0x00007FF62A5D0000-0x00007FF62A9C2000-memory.dmp

Filesize
3.9MB

Download
memory/2748-13-0x00007FF6860A0000-0x00007FF686492000-memory.dmp

Filesize
3.9MB

Download
memory/2748-2903-0x00007FF6860A0000-0x00007FF686492000-memory.dmp

Filesize
3.9MB

Download
memory/3232-219-0x00007FF789A60000-0x00007FF789E52000-memory.dmp

Filesize
3.9MB

Download
memory/3232-2931-0x00007FF789A60000-0x00007FF789E52000-memory.dmp

Filesize
3.9MB

Download
memory/3468-2928-0x00007FF677E30000-0x00007FF678222000-memory.dmp

Filesize
3.9MB

Download
memory/3468-242-0x00007FF677E30000-0x00007FF678222000-memory.dmp

Filesize
3.9MB

Download
memory/3696-2933-0x00007FF7E5F70000-0x00007FF7E6362000-memory.dmp

Filesize
3.9MB

Download
memory/3696-238-0x00007FF7E5F70000-0x00007FF7E6362000-memory.dmp

Filesize
3.9MB

Download
memory/4040-2924-0x00007FF7E5000000-0x00007FF7E53F2000-memory.dmp

Filesize
3.9MB

Download
memory/4040-220-0x00007FF7E5000000-0x00007FF7E53F2000-memory.dmp

Filesize
3.9MB

Download
memory/4424-2926-0x00007FF6E0A00000-0x00007FF6E0DF2000-memory.dmp

Filesize
3.9MB

Download
memory/4424-228-0x00007FF6E0A00000-0x00007FF6E0DF2000-memory.dmp

Filesize
3.9MB

Download
memory/4636-115-0x00007FF6B6910000-0x00007FF6B6D02000-memory.dmp

Filesize
3.9MB

Download
memory/4636-2907-0x00007FF6B6910000-0x00007FF6B6D02000-memory.dmp

Filesize
3.9MB

Download
memory/4816-2944-0x00007FF7A21D0000-0x00007FF7A25C2000-memory.dmp

Filesize
3.9MB

Download
memory/4816-240-0x00007FF7A21D0000-0x00007FF7A25C2000-memory.dmp

Filesize
3.9MB

Download
memory/5036-2912-0x00007FF610440000-0x00007FF610832000-memory.dmp

Filesize
3.9MB

Download
memory/5036-197-0x00007FF610440000-0x00007FF610832000-memory.dmp

Filesize
3.9MB

Download
memory/5148-244-0x00007FF7815F0000-0x00007FF7819E2000-memory.dmp

Filesize
3.9MB

Download
memory/5148-2906-0x00007FF7815F0000-0x00007FF7819E2000-memory.dmp

Filesize
3.9MB

Download
memory/5220-112-0x00000233A8360000-0x00000233A8370000-memory.dmp

Filesize
64KB

Download
memory/5220-91-0x00000233C27D0000-0x00000233C27F2000-memory.dmp

Filesize
136KB

Download
memory/5220-85-0x00007FFB62550000-0x00007FFB63011000-memory.dmp

Filesize
10.8MB

Download
memory/5256-241-0x00007FF65F4E0000-0x00007FF65F8D2000-memory.dmp

Filesize
3.9MB

Download
memory/5256-2951-0x00007FF65F4E0000-0x00007FF65F8D2000-memory.dmp

Filesize
3.9MB

Download
memory/5648-245-0x00007FF7538A0000-0x00007FF753C92000-memory.dmp

Filesize
3.9MB

Download
memory/5648-2910-0x00007FF7538A0000-0x00007FF753C92000-memory.dmp

Filesize
3.9MB

Download
memory/6116-2930-0x00007FF734760000-0x00007FF734B52000-memory.dmp

Filesize
3.9MB

Download
memory/6116-202-0x00007FF734760000-0x00007FF734B52000-memory.dmp

Filesize
3.9MB

Download