xmrig | f547b254f3832b2d574d4440137896961ea166a354c8f4006795bfff3609ab35

Analysis

max time kernel
65s
max time network
50s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29-04-2024 06:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
Size

1.9MB
MD5

0709ad842e5bc61cbefb1505e6e9090d
SHA1

6de2ceae4ce6bc4248cc2fab233b4b0873444e9f
SHA256

f547b254f3832b2d574d4440137896961ea166a354c8f4006795bfff3609ab35
SHA512

7f663f634d61f1dcbdd9957365b6f1b2775667f390060228bc2abcaa5a0e9a701f46cb3e6c73da18953724100428ad33bc02b4c39b6f31b8f9ae43f584726623
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlT:NABo

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 42 IoCs

miner

resource	yara_rule
behavioral2/memory/4244-258-0x00007FF639AB0000-0x00007FF639EA2000-memory.dmp	xmrig
behavioral2/memory/3256-265-0x00007FF788F40000-0x00007FF789332000-memory.dmp	xmrig
behavioral2/memory/1184-326-0x00007FF71D7D0000-0x00007FF71DBC2000-memory.dmp	xmrig
behavioral2/memory/2440-348-0x00007FF7A4B30000-0x00007FF7A4F22000-memory.dmp	xmrig
behavioral2/memory/3696-362-0x00007FF611F70000-0x00007FF612362000-memory.dmp	xmrig
behavioral2/memory/1236-372-0x00007FF7A96E0000-0x00007FF7A9AD2000-memory.dmp	xmrig
behavioral2/memory/2820-370-0x00007FF646450000-0x00007FF646842000-memory.dmp	xmrig
behavioral2/memory/1188-369-0x00007FF69D590000-0x00007FF69D982000-memory.dmp	xmrig
behavioral2/memory/400-368-0x00007FF664940000-0x00007FF664D32000-memory.dmp	xmrig
behavioral2/memory/5072-361-0x00007FF6BF6C0000-0x00007FF6BFAB2000-memory.dmp	xmrig
behavioral2/memory/3552-357-0x00007FF6FCD30000-0x00007FF6FD122000-memory.dmp	xmrig
behavioral2/memory/4432-325-0x00007FF7845C0000-0x00007FF7849B2000-memory.dmp	xmrig
behavioral2/memory/3988-311-0x00007FF75A6C0000-0x00007FF75AAB2000-memory.dmp	xmrig
behavioral2/memory/4260-297-0x00007FF7B97B0000-0x00007FF7B9BA2000-memory.dmp	xmrig
behavioral2/memory/1600-257-0x00007FF787FC0000-0x00007FF7883B2000-memory.dmp	xmrig
behavioral2/memory/3448-226-0x00007FF664610000-0x00007FF664A02000-memory.dmp	xmrig
behavioral2/memory/3232-178-0x00007FF6674C0000-0x00007FF6678B2000-memory.dmp	xmrig
behavioral2/memory/5092-151-0x00007FF792D50000-0x00007FF793142000-memory.dmp	xmrig
behavioral2/memory/4428-121-0x00007FF7F74A0000-0x00007FF7F7892000-memory.dmp	xmrig
behavioral2/memory/4596-118-0x00007FF608C50000-0x00007FF609042000-memory.dmp	xmrig
behavioral2/memory/3520-86-0x00007FF706A70000-0x00007FF706E62000-memory.dmp	xmrig
behavioral2/memory/1188-3572-0x00007FF69D590000-0x00007FF69D982000-memory.dmp	xmrig
behavioral2/memory/5092-3574-0x00007FF792D50000-0x00007FF793142000-memory.dmp	xmrig
behavioral2/memory/4596-3576-0x00007FF608C50000-0x00007FF609042000-memory.dmp	xmrig
behavioral2/memory/3520-3578-0x00007FF706A70000-0x00007FF706E62000-memory.dmp	xmrig
behavioral2/memory/4428-3580-0x00007FF7F74A0000-0x00007FF7F7892000-memory.dmp	xmrig
behavioral2/memory/4244-3582-0x00007FF639AB0000-0x00007FF639EA2000-memory.dmp	xmrig
behavioral2/memory/3256-3584-0x00007FF788F40000-0x00007FF789332000-memory.dmp	xmrig
behavioral2/memory/3696-3595-0x00007FF611F70000-0x00007FF612362000-memory.dmp	xmrig
behavioral2/memory/4260-3599-0x00007FF7B97B0000-0x00007FF7B9BA2000-memory.dmp	xmrig
behavioral2/memory/1236-3619-0x00007FF7A96E0000-0x00007FF7A9AD2000-memory.dmp	xmrig
behavioral2/memory/1184-3610-0x00007FF71D7D0000-0x00007FF71DBC2000-memory.dmp	xmrig
behavioral2/memory/400-3609-0x00007FF664940000-0x00007FF664D32000-memory.dmp	xmrig
behavioral2/memory/3232-3606-0x00007FF6674C0000-0x00007FF6678B2000-memory.dmp	xmrig
behavioral2/memory/2820-3605-0x00007FF646450000-0x00007FF646842000-memory.dmp	xmrig
behavioral2/memory/1600-3603-0x00007FF787FC0000-0x00007FF7883B2000-memory.dmp	xmrig
behavioral2/memory/5072-3601-0x00007FF6BF6C0000-0x00007FF6BFAB2000-memory.dmp	xmrig
behavioral2/memory/3988-3597-0x00007FF75A6C0000-0x00007FF75AAB2000-memory.dmp	xmrig
behavioral2/memory/3552-3593-0x00007FF6FCD30000-0x00007FF6FD122000-memory.dmp	xmrig
behavioral2/memory/2440-3591-0x00007FF7A4B30000-0x00007FF7A4F22000-memory.dmp	xmrig
behavioral2/memory/4432-3587-0x00007FF7845C0000-0x00007FF7849B2000-memory.dmp	xmrig
behavioral2/memory/3448-3589-0x00007FF664610000-0x00007FF664A02000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1188	WQiBFjg.exe
3520	ZZGSVEn.exe
4596	JmNpYYy.exe
4428	tsyZmoq.exe
5092	jwmdRpx.exe
3232	gLTqyUa.exe
3448	GnPKyIQ.exe
1600	hShSqvu.exe
4244	EjFLaed.exe
3256	EbwzKvt.exe
2820	dfKHqkB.exe
4260	AfICndt.exe
3988	kmbZtoq.exe
4432	spSBwCU.exe
1184	JbdcbWp.exe
1236	wSRjjNo.exe
2440	rTyouRh.exe
3552	SlienZH.exe
5072	yFCpVPP.exe
3696	bqCparU.exe
400	ORdMVmJ.exe
1772	qFRjFwU.exe
4896	WewOxYP.exe
2560	yVgQwmK.exe
3820	MxDLGDP.exe
4464	qokNEvh.exe
1864	WmSNOWt.exe
2284	PHkAgqF.exe
4552	hHROVwl.exe
460	fxbHLUU.exe
2640	xlkdxAH.exe
1324	VMpPxjP.exe
4448	ecJYLpN.exe
2012	ycabDcF.exe
1252	CkUzitf.exe
1428	NgyfnYQ.exe
3656	CcKlxVU.exe
1168	IUQBDSa.exe
4648	LTBdxiD.exe
2064	SZmdEnL.exe
4456	lTZQouo.exe
428	SJHRMeW.exe
4480	lYirUGh.exe
4980	NAkTrbj.exe
3588	FCIyAph.exe
2724	oEbDidc.exe
3188	GQgbAJZ.exe
4532	MbDLFNe.exe
2088	MzyBtjY.exe
944	apGtxCL.exe
1224	jhttKav.exe
4368	KOXBklK.exe
652	GuxYLVK.exe
2580	kcFZWwF.exe
2244	xaTuhTR.exe
372	cSYXHyA.exe
3504	aiMzADV.exe
4716	VuSTLgd.exe
2080	jRYuJLx.exe
4284	UiwibxG.exe
2576	DlYIVOK.exe
1436	qYqrRYV.exe
2112	InyRLfi.exe
1908	ZgoHtAl.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/116-0-0x00007FF721670000-0x00007FF721A62000-memory.dmp	upx
behavioral2/files/0x000a000000023baf-6.dat	upx
behavioral2/files/0x000b000000023bae-8.dat	upx
behavioral2/files/0x000c000000023b4b-7.dat	upx
behavioral2/files/0x000a000000023bb0-18.dat	upx
behavioral2/files/0x000a000000023bb3-38.dat	upx
behavioral2/files/0x0031000000023bb8-89.dat	upx
behavioral2/files/0x000a000000023bb4-125.dat	upx
behavioral2/files/0x000a000000023bd4-184.dat	upx
behavioral2/memory/4244-258-0x00007FF639AB0000-0x00007FF639EA2000-memory.dmp	upx
behavioral2/memory/3256-265-0x00007FF788F40000-0x00007FF789332000-memory.dmp	upx
behavioral2/memory/1184-326-0x00007FF71D7D0000-0x00007FF71DBC2000-memory.dmp	upx
behavioral2/memory/2440-348-0x00007FF7A4B30000-0x00007FF7A4F22000-memory.dmp	upx
behavioral2/memory/3696-362-0x00007FF611F70000-0x00007FF612362000-memory.dmp	upx
behavioral2/memory/1236-372-0x00007FF7A96E0000-0x00007FF7A9AD2000-memory.dmp	upx
behavioral2/memory/2820-370-0x00007FF646450000-0x00007FF646842000-memory.dmp	upx
behavioral2/memory/1188-369-0x00007FF69D590000-0x00007FF69D982000-memory.dmp	upx
behavioral2/memory/400-368-0x00007FF664940000-0x00007FF664D32000-memory.dmp	upx
behavioral2/memory/5072-361-0x00007FF6BF6C0000-0x00007FF6BFAB2000-memory.dmp	upx
behavioral2/memory/3552-357-0x00007FF6FCD30000-0x00007FF6FD122000-memory.dmp	upx
behavioral2/memory/4432-325-0x00007FF7845C0000-0x00007FF7849B2000-memory.dmp	upx
behavioral2/memory/3988-311-0x00007FF75A6C0000-0x00007FF75AAB2000-memory.dmp	upx
behavioral2/memory/4260-297-0x00007FF7B97B0000-0x00007FF7B9BA2000-memory.dmp	upx
behavioral2/memory/1600-257-0x00007FF787FC0000-0x00007FF7883B2000-memory.dmp	upx
behavioral2/memory/3448-226-0x00007FF664610000-0x00007FF664A02000-memory.dmp	upx
behavioral2/files/0x000a000000023bca-197.dat	upx
behavioral2/files/0x000a000000023bd5-189.dat	upx
behavioral2/files/0x000a000000023bd3-181.dat	upx
behavioral2/files/0x000a000000023bc5-180.dat	upx
behavioral2/files/0x000a000000023bbf-175.dat	upx
behavioral2/files/0x000a000000023bd1-172.dat	upx
behavioral2/files/0x000a000000023bbe-170.dat	upx
behavioral2/files/0x000a000000023bc9-169.dat	upx
behavioral2/files/0x000a000000023bd0-167.dat	upx
behavioral2/files/0x000a000000023bcf-166.dat	upx
behavioral2/files/0x000a000000023bce-165.dat	upx
behavioral2/files/0x000a000000023bc8-192.dat	upx
behavioral2/files/0x000a000000023bb9-153.dat	upx
behavioral2/files/0x000a000000023bcd-152.dat	upx
behavioral2/memory/3232-178-0x00007FF6674C0000-0x00007FF6678B2000-memory.dmp	upx
behavioral2/files/0x000a000000023bd2-173.dat	upx
behavioral2/files/0x000a000000023bcc-148.dat	upx
behavioral2/files/0x000a000000023bc4-144.dat	upx
behavioral2/files/0x000a000000023bbd-139.dat	upx
behavioral2/files/0x000a000000023bbc-133.dat	upx
behavioral2/files/0x000a000000023bba-127.dat	upx
behavioral2/files/0x000a000000023bc7-124.dat	upx
behavioral2/files/0x000a000000023bc6-123.dat	upx
behavioral2/memory/5092-151-0x00007FF792D50000-0x00007FF793142000-memory.dmp	upx
behavioral2/memory/4428-121-0x00007FF7F74A0000-0x00007FF7F7892000-memory.dmp	upx
behavioral2/memory/4596-118-0x00007FF608C50000-0x00007FF609042000-memory.dmp	upx
behavioral2/files/0x000a000000023bcb-143.dat	upx
behavioral2/files/0x000a000000023bbb-108.dat	upx
behavioral2/files/0x000a000000023bc0-107.dat	upx
behavioral2/files/0x000a000000023bc3-103.dat	upx
behavioral2/files/0x000a000000023bb5-93.dat	upx
behavioral2/memory/3520-86-0x00007FF706A70000-0x00007FF706E62000-memory.dmp	upx
behavioral2/files/0x000a000000023bb2-77.dat	upx
behavioral2/files/0x0031000000023bb7-57.dat	upx
behavioral2/files/0x0031000000023bb6-50.dat	upx
behavioral2/files/0x000a000000023bb1-25.dat	upx
behavioral2/memory/1188-3572-0x00007FF69D590000-0x00007FF69D982000-memory.dmp	upx
behavioral2/memory/5092-3574-0x00007FF792D50000-0x00007FF793142000-memory.dmp	upx
behavioral2/memory/4596-3576-0x00007FF608C50000-0x00007FF609042000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\hhbiSfU.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\ZzIIFxu.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\skEfCwj.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\paHMdWp.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\LMutiWP.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\QmKREbH.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\AjwBrnu.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\DkVtdIw.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\pjyMqhx.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\WWPgwYF.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\RElhEaw.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\evuLoqG.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\KQKVgqi.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\FLVJbxO.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\MGgGIuy.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\ubUlGdZ.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\EwoJEIG.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\VnZYpfl.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\svfAmbO.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\XHQkBCF.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\gsdvoSJ.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\yZINwvX.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\IcJnpiz.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\AAjsopO.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\iVkqyMl.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\fifdpZQ.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\PrqMaWk.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\GjUYwgm.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\dlvjApO.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\eupMzYe.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\vIcnOPg.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\mIkMGXI.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\OwWvCuH.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\MiTUavI.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\UcdkaSY.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\aLdjCWN.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\NotNJRy.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\yfuXIrp.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\fxAWTzD.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\fhNbNai.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\oMKhfBV.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\IKRlDuI.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\uzrycgM.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\HxpuBkn.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\tVqVhDR.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\PBWkCXx.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\uAMPBhG.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\AwybbWw.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\PRmdDOM.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\DEuUjEV.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\vkzIrLx.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\haNPvGn.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\tRcLHFm.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\jloRYep.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\jKBLGXQ.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\EjGeXmk.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\FbMIPZX.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\GEXCmyl.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\iTvIYdH.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\VpRMIqA.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\kpODcZm.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\llwusZr.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\MTghrST.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\QPUDRXk.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1412	powershell.exe
1412	powershell.exe
1412	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1412	powershell.exe
Token: SeLockMemoryPrivilege	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 116 wrote to memory of 1412	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	84
PID 116 wrote to memory of 1412	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	84
PID 116 wrote to memory of 1188	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	85
PID 116 wrote to memory of 1188	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	85
PID 116 wrote to memory of 3520	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	86
PID 116 wrote to memory of 3520	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	86
PID 116 wrote to memory of 4596	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	87
PID 116 wrote to memory of 4596	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	87
PID 116 wrote to memory of 4428	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	88
PID 116 wrote to memory of 4428	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	88
PID 116 wrote to memory of 5092	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	89
PID 116 wrote to memory of 5092	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	89
PID 116 wrote to memory of 3232	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	90
PID 116 wrote to memory of 3232	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	90
PID 116 wrote to memory of 3448	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	91
PID 116 wrote to memory of 3448	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	91
PID 116 wrote to memory of 4260	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	92
PID 116 wrote to memory of 4260	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	92
PID 116 wrote to memory of 1600	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	93
PID 116 wrote to memory of 1600	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	93
PID 116 wrote to memory of 4244	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	94
PID 116 wrote to memory of 4244	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	94
PID 116 wrote to memory of 3256	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	95
PID 116 wrote to memory of 3256	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	95
PID 116 wrote to memory of 2820	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	96
PID 116 wrote to memory of 2820	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	96
PID 116 wrote to memory of 2440	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	97
PID 116 wrote to memory of 2440	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	97
PID 116 wrote to memory of 3988	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	98
PID 116 wrote to memory of 3988	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	98
PID 116 wrote to memory of 4432	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	99
PID 116 wrote to memory of 4432	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	99
PID 116 wrote to memory of 3696	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	100
PID 116 wrote to memory of 3696	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	100
PID 116 wrote to memory of 1184	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	101
PID 116 wrote to memory of 1184	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	101
PID 116 wrote to memory of 400	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	102
PID 116 wrote to memory of 400	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	102
PID 116 wrote to memory of 1236	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	103
PID 116 wrote to memory of 1236	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	103
PID 116 wrote to memory of 3552	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	104
PID 116 wrote to memory of 3552	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	104
PID 116 wrote to memory of 5072	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	105
PID 116 wrote to memory of 5072	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	105
PID 116 wrote to memory of 1772	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	106
PID 116 wrote to memory of 1772	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	106
PID 116 wrote to memory of 4896	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	107
PID 116 wrote to memory of 4896	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	107
PID 116 wrote to memory of 2560	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	108
PID 116 wrote to memory of 2560	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	108
PID 116 wrote to memory of 3820	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	109
PID 116 wrote to memory of 3820	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	109
PID 116 wrote to memory of 4464	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	110
PID 116 wrote to memory of 4464	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	110
PID 116 wrote to memory of 2012	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	111
PID 116 wrote to memory of 2012	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	111
PID 116 wrote to memory of 1864	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	112
PID 116 wrote to memory of 1864	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	112
PID 116 wrote to memory of 2284	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	113
PID 116 wrote to memory of 2284	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	113
PID 116 wrote to memory of 4552	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	114
PID 116 wrote to memory of 4552	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	114
PID 116 wrote to memory of 460	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	115
PID 116 wrote to memory of 460	116	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1412
- C:\Windows\System\WQiBFjg.exe
  C:\Windows\System\WQiBFjg.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\ZZGSVEn.exe
  C:\Windows\System\ZZGSVEn.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\JmNpYYy.exe
  C:\Windows\System\JmNpYYy.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\tsyZmoq.exe
  C:\Windows\System\tsyZmoq.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\jwmdRpx.exe
  C:\Windows\System\jwmdRpx.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\gLTqyUa.exe
  C:\Windows\System\gLTqyUa.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\GnPKyIQ.exe
  C:\Windows\System\GnPKyIQ.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\AfICndt.exe
  C:\Windows\System\AfICndt.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\hShSqvu.exe
  C:\Windows\System\hShSqvu.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\EjFLaed.exe
  C:\Windows\System\EjFLaed.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\EbwzKvt.exe
  C:\Windows\System\EbwzKvt.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\dfKHqkB.exe
  C:\Windows\System\dfKHqkB.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\rTyouRh.exe
  C:\Windows\System\rTyouRh.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\kmbZtoq.exe
  C:\Windows\System\kmbZtoq.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\spSBwCU.exe
  C:\Windows\System\spSBwCU.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\bqCparU.exe
  C:\Windows\System\bqCparU.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\JbdcbWp.exe
  C:\Windows\System\JbdcbWp.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\ORdMVmJ.exe
  C:\Windows\System\ORdMVmJ.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\wSRjjNo.exe
  C:\Windows\System\wSRjjNo.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\SlienZH.exe
  C:\Windows\System\SlienZH.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\yFCpVPP.exe
  C:\Windows\System\yFCpVPP.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\qFRjFwU.exe
  C:\Windows\System\qFRjFwU.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\WewOxYP.exe
  C:\Windows\System\WewOxYP.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\yVgQwmK.exe
  C:\Windows\System\yVgQwmK.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\MxDLGDP.exe
  C:\Windows\System\MxDLGDP.exe
  2⤵
  - Executes dropped EXE
  PID:3820
- C:\Windows\System\qokNEvh.exe
  C:\Windows\System\qokNEvh.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\ycabDcF.exe
  C:\Windows\System\ycabDcF.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\WmSNOWt.exe
  C:\Windows\System\WmSNOWt.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\PHkAgqF.exe
  C:\Windows\System\PHkAgqF.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\hHROVwl.exe
  C:\Windows\System\hHROVwl.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\fxbHLUU.exe
  C:\Windows\System\fxbHLUU.exe
  2⤵
  - Executes dropped EXE
  PID:460
- C:\Windows\System\xlkdxAH.exe
  C:\Windows\System\xlkdxAH.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\VMpPxjP.exe
  C:\Windows\System\VMpPxjP.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\ecJYLpN.exe
  C:\Windows\System\ecJYLpN.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\CkUzitf.exe
  C:\Windows\System\CkUzitf.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\NgyfnYQ.exe
  C:\Windows\System\NgyfnYQ.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\CcKlxVU.exe
  C:\Windows\System\CcKlxVU.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\IUQBDSa.exe
  C:\Windows\System\IUQBDSa.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\LTBdxiD.exe
  C:\Windows\System\LTBdxiD.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\SZmdEnL.exe
  C:\Windows\System\SZmdEnL.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\lTZQouo.exe
  C:\Windows\System\lTZQouo.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\SJHRMeW.exe
  C:\Windows\System\SJHRMeW.exe
  2⤵
  - Executes dropped EXE
  PID:428
- C:\Windows\System\lYirUGh.exe
  C:\Windows\System\lYirUGh.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\NAkTrbj.exe
  C:\Windows\System\NAkTrbj.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\FCIyAph.exe
  C:\Windows\System\FCIyAph.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\cSYXHyA.exe
  C:\Windows\System\cSYXHyA.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\oEbDidc.exe
  C:\Windows\System\oEbDidc.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\GQgbAJZ.exe
  C:\Windows\System\GQgbAJZ.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System\MbDLFNe.exe
  C:\Windows\System\MbDLFNe.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\MzyBtjY.exe
  C:\Windows\System\MzyBtjY.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\apGtxCL.exe
  C:\Windows\System\apGtxCL.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\jhttKav.exe
  C:\Windows\System\jhttKav.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\KOXBklK.exe
  C:\Windows\System\KOXBklK.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\GuxYLVK.exe
  C:\Windows\System\GuxYLVK.exe
  2⤵
  - Executes dropped EXE
  PID:652
- C:\Windows\System\kcFZWwF.exe
  C:\Windows\System\kcFZWwF.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\xaTuhTR.exe
  C:\Windows\System\xaTuhTR.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\aiMzADV.exe
  C:\Windows\System\aiMzADV.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\VuSTLgd.exe
  C:\Windows\System\VuSTLgd.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\jRYuJLx.exe
  C:\Windows\System\jRYuJLx.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\UiwibxG.exe
  C:\Windows\System\UiwibxG.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\DlYIVOK.exe
  C:\Windows\System\DlYIVOK.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\qYqrRYV.exe
  C:\Windows\System\qYqrRYV.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\InyRLfi.exe
  C:\Windows\System\InyRLfi.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\ZgoHtAl.exe
  C:\Windows\System\ZgoHtAl.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\OEWUyHf.exe
  C:\Windows\System\OEWUyHf.exe
  2⤵
  PID:4016
- C:\Windows\System\HmUdanS.exe
  C:\Windows\System\HmUdanS.exe
  2⤵
  PID:2884
- C:\Windows\System\iDesvBb.exe
  C:\Windows\System\iDesvBb.exe
  2⤵
  PID:5116
- C:\Windows\System\qTMbolu.exe
  C:\Windows\System\qTMbolu.exe
  2⤵
  PID:2324
- C:\Windows\System\sHyGrmw.exe
  C:\Windows\System\sHyGrmw.exe
  2⤵
  PID:1480
- C:\Windows\System\JpiMUsG.exe
  C:\Windows\System\JpiMUsG.exe
  2⤵
  PID:2916
- C:\Windows\System\otYKrHi.exe
  C:\Windows\System\otYKrHi.exe
  2⤵
  PID:2288
- C:\Windows\System\ZoixbrZ.exe
  C:\Windows\System\ZoixbrZ.exe
  2⤵
  PID:4708
- C:\Windows\System\stwbbPz.exe
  C:\Windows\System\stwbbPz.exe
  2⤵
  PID:3452
- C:\Windows\System\yTqrdoO.exe
  C:\Windows\System\yTqrdoO.exe
  2⤵
  PID:2032
- C:\Windows\System\ksLNrFY.exe
  C:\Windows\System\ksLNrFY.exe
  2⤵
  PID:3124
- C:\Windows\System\sraVztf.exe
  C:\Windows\System\sraVztf.exe
  2⤵
  PID:5048
- C:\Windows\System\HVOrMNX.exe
  C:\Windows\System\HVOrMNX.exe
  2⤵
  PID:5108
- C:\Windows\System\fjZAimD.exe
  C:\Windows\System\fjZAimD.exe
  2⤵
  PID:4360
- C:\Windows\System\kJECbnr.exe
  C:\Windows\System\kJECbnr.exe
  2⤵
  PID:4468
- C:\Windows\System\SfEQVsb.exe
  C:\Windows\System\SfEQVsb.exe
  2⤵
  PID:3952
- C:\Windows\System\rwoCtHd.exe
  C:\Windows\System\rwoCtHd.exe
  2⤵
  PID:2680
- C:\Windows\System\krVLmCc.exe
  C:\Windows\System\krVLmCc.exe
  2⤵
  PID:3012
- C:\Windows\System\vixgIVL.exe
  C:\Windows\System\vixgIVL.exe
  2⤵
  PID:5128
- C:\Windows\System\YLgizlq.exe
  C:\Windows\System\YLgizlq.exe
  2⤵
  PID:5144
- C:\Windows\System\EwVZiIR.exe
  C:\Windows\System\EwVZiIR.exe
  2⤵
  PID:5164
- C:\Windows\System\lUERQNR.exe
  C:\Windows\System\lUERQNR.exe
  2⤵
  PID:5276
- C:\Windows\System\BCxjExI.exe
  C:\Windows\System\BCxjExI.exe
  2⤵
  PID:5296
- C:\Windows\System\kvPTYty.exe
  C:\Windows\System\kvPTYty.exe
  2⤵
  PID:5320
- C:\Windows\System\GamJhpb.exe
  C:\Windows\System\GamJhpb.exe
  2⤵
  PID:5344
- C:\Windows\System\OKzXHAH.exe
  C:\Windows\System\OKzXHAH.exe
  2⤵
  PID:5368
- C:\Windows\System\EbDpTUp.exe
  C:\Windows\System\EbDpTUp.exe
  2⤵
  PID:5384
- C:\Windows\System\RbJANZR.exe
  C:\Windows\System\RbJANZR.exe
  2⤵
  PID:5528
- C:\Windows\System\AySCSQz.exe
  C:\Windows\System\AySCSQz.exe
  2⤵
  PID:5780
- C:\Windows\System\PdnuIkR.exe
  C:\Windows\System\PdnuIkR.exe
  2⤵
  PID:5800
- C:\Windows\System\OFPHApA.exe
  C:\Windows\System\OFPHApA.exe
  2⤵
  PID:5824
- C:\Windows\System\sNbvCml.exe
  C:\Windows\System\sNbvCml.exe
  2⤵
  PID:5852
- C:\Windows\System\MnRbGsH.exe
  C:\Windows\System\MnRbGsH.exe
  2⤵
  PID:5876
- C:\Windows\System\YUMKVRm.exe
  C:\Windows\System\YUMKVRm.exe
  2⤵
  PID:5900
- C:\Windows\System\OVBQnCH.exe
  C:\Windows\System\OVBQnCH.exe
  2⤵
  PID:5928
- C:\Windows\System\cGrKpNB.exe
  C:\Windows\System\cGrKpNB.exe
  2⤵
  PID:5948
- C:\Windows\System\RpcuCpG.exe
  C:\Windows\System\RpcuCpG.exe
  2⤵
  PID:5984
- C:\Windows\System\YCLwxtO.exe
  C:\Windows\System\YCLwxtO.exe
  2⤵
  PID:6000
- C:\Windows\System\uKwoJbU.exe
  C:\Windows\System\uKwoJbU.exe
  2⤵
  PID:6020
- C:\Windows\System\TSduhOk.exe
  C:\Windows\System\TSduhOk.exe
  2⤵
  PID:6048
- C:\Windows\System\dvyRnAk.exe
  C:\Windows\System\dvyRnAk.exe
  2⤵
  PID:6068
- C:\Windows\System\ymSFVzS.exe
  C:\Windows\System\ymSFVzS.exe
  2⤵
  PID:6088
- C:\Windows\System\LAUFvPs.exe
  C:\Windows\System\LAUFvPs.exe
  2⤵
  PID:6108
- C:\Windows\System\VYZombA.exe
  C:\Windows\System\VYZombA.exe
  2⤵
  PID:6136
- C:\Windows\System\JpVyXGd.exe
  C:\Windows\System\JpVyXGd.exe
  2⤵
  PID:3596
- C:\Windows\System\obMOWqw.exe
  C:\Windows\System\obMOWqw.exe
  2⤵
  PID:3660
- C:\Windows\System\PPlJiOT.exe
  C:\Windows\System\PPlJiOT.exe
  2⤵
  PID:4028
- C:\Windows\System\TTVStlE.exe
  C:\Windows\System\TTVStlE.exe
  2⤵
  PID:4852
- C:\Windows\System\pypOnzr.exe
  C:\Windows\System\pypOnzr.exe
  2⤵
  PID:4312
- C:\Windows\System\vAiTDkV.exe
  C:\Windows\System\vAiTDkV.exe
  2⤵
  PID:2328
- C:\Windows\System\eFTVrvB.exe
  C:\Windows\System\eFTVrvB.exe
  2⤵
  PID:4884
- C:\Windows\System\HiHSTCA.exe
  C:\Windows\System\HiHSTCA.exe
  2⤵
  PID:4476
- C:\Windows\System\SjddfRT.exe
  C:\Windows\System\SjddfRT.exe
  2⤵
  PID:3356
- C:\Windows\System\UUXTKWn.exe
  C:\Windows\System\UUXTKWn.exe
  2⤵
  PID:1880
- C:\Windows\System\nFbhDXI.exe
  C:\Windows\System\nFbhDXI.exe
  2⤵
  PID:1008
- C:\Windows\System\zErLhYW.exe
  C:\Windows\System\zErLhYW.exe
  2⤵
  PID:5124
- C:\Windows\System\REFJFKj.exe
  C:\Windows\System\REFJFKj.exe
  2⤵
  PID:5172
- C:\Windows\System\HJzxlnW.exe
  C:\Windows\System\HJzxlnW.exe
  2⤵
  PID:5236
- C:\Windows\System\bbohBmg.exe
  C:\Windows\System\bbohBmg.exe
  2⤵
  PID:5284
- C:\Windows\System\QIdlxXq.exe
  C:\Windows\System\QIdlxXq.exe
  2⤵
  PID:5328
- C:\Windows\System\sBaVPRa.exe
  C:\Windows\System\sBaVPRa.exe
  2⤵
  PID:5360
- C:\Windows\System\xDtnnqT.exe
  C:\Windows\System\xDtnnqT.exe
  2⤵
  PID:5460
- C:\Windows\System\JWjDooa.exe
  C:\Windows\System\JWjDooa.exe
  2⤵
  PID:5492
- C:\Windows\System\eGFFNEP.exe
  C:\Windows\System\eGFFNEP.exe
  2⤵
  PID:5536
- C:\Windows\System\zOhNDUL.exe
  C:\Windows\System\zOhNDUL.exe
  2⤵
  PID:5664
- C:\Windows\System\xyfRBDQ.exe
  C:\Windows\System\xyfRBDQ.exe
  2⤵
  PID:2548
- C:\Windows\System\CURYpsZ.exe
  C:\Windows\System\CURYpsZ.exe
  2⤵
  PID:1056
- C:\Windows\System\pIUcBFb.exe
  C:\Windows\System\pIUcBFb.exe
  2⤵
  PID:1068
- C:\Windows\System\xqWgHoq.exe
  C:\Windows\System\xqWgHoq.exe
  2⤵
  PID:1912
- C:\Windows\System\oeBgWjD.exe
  C:\Windows\System\oeBgWjD.exe
  2⤵
  PID:2456
- C:\Windows\System\lSEElCG.exe
  C:\Windows\System\lSEElCG.exe
  2⤵
  PID:2628
- C:\Windows\System\nqVIwfo.exe
  C:\Windows\System\nqVIwfo.exe
  2⤵
  PID:4416
- C:\Windows\System\kifTYqt.exe
  C:\Windows\System\kifTYqt.exe
  2⤵
  PID:2044
- C:\Windows\System\ESnYpsu.exe
  C:\Windows\System\ESnYpsu.exe
  2⤵
  PID:3100
- C:\Windows\System\dqjvBEa.exe
  C:\Windows\System\dqjvBEa.exe
  2⤵
  PID:2504
- C:\Windows\System\qEBOgfD.exe
  C:\Windows\System\qEBOgfD.exe
  2⤵
  PID:3584
- C:\Windows\System\DAbtMkZ.exe
  C:\Windows\System\DAbtMkZ.exe
  2⤵
  PID:3680
- C:\Windows\System\kdSuMAO.exe
  C:\Windows\System\kdSuMAO.exe
  2⤵
  PID:5216
- C:\Windows\System\qSJtjDW.exe
  C:\Windows\System\qSJtjDW.exe
  2⤵
  PID:5576
- C:\Windows\System\FrngmPd.exe
  C:\Windows\System\FrngmPd.exe
  2⤵
  PID:5540
- C:\Windows\System\vqGHvoD.exe
  C:\Windows\System\vqGHvoD.exe
  2⤵
  PID:5772
- C:\Windows\System\LEdYUEG.exe
  C:\Windows\System\LEdYUEG.exe
  2⤵
  PID:5836
- C:\Windows\System\zqXKzve.exe
  C:\Windows\System\zqXKzve.exe
  2⤵
  PID:5884
- C:\Windows\System\TrVwktj.exe
  C:\Windows\System\TrVwktj.exe
  2⤵
  PID:5936
- C:\Windows\System\dnSiIzV.exe
  C:\Windows\System\dnSiIzV.exe
  2⤵
  PID:5992
- C:\Windows\System\DFWdzhg.exe
  C:\Windows\System\DFWdzhg.exe
  2⤵
  PID:6060
- C:\Windows\System\BIkGjmi.exe
  C:\Windows\System\BIkGjmi.exe
  2⤵
  PID:4864
- C:\Windows\System\rdQDBzJ.exe
  C:\Windows\System\rdQDBzJ.exe
  2⤵
  PID:4932
- C:\Windows\System\agMWkOH.exe
  C:\Windows\System\agMWkOH.exe
  2⤵
  PID:6128
- C:\Windows\System\qnDVgyn.exe
  C:\Windows\System\qnDVgyn.exe
  2⤵
  PID:3788
- C:\Windows\System\PrqMaWk.exe
  C:\Windows\System\PrqMaWk.exe
  2⤵
  PID:1820
- C:\Windows\System\miwVpBT.exe
  C:\Windows\System\miwVpBT.exe
  2⤵
  PID:5152
- C:\Windows\System\NygdtcN.exe
  C:\Windows\System\NygdtcN.exe
  2⤵
  PID:408
- C:\Windows\System\YoQFgbp.exe
  C:\Windows\System\YoQFgbp.exe
  2⤵
  PID:4840
- C:\Windows\System\OmHhkup.exe
  C:\Windows\System\OmHhkup.exe
  2⤵
  PID:5396
- C:\Windows\System\DJuSxGG.exe
  C:\Windows\System\DJuSxGG.exe
  2⤵
  PID:1440
- C:\Windows\System\EYEOrQn.exe
  C:\Windows\System\EYEOrQn.exe
  2⤵
  PID:5484
- C:\Windows\System\GojIBOK.exe
  C:\Windows\System\GojIBOK.exe
  2⤵
  PID:5524
- C:\Windows\System\viMKdSV.exe
  C:\Windows\System\viMKdSV.exe
  2⤵
  PID:5252
- C:\Windows\System\earkqlz.exe
  C:\Windows\System\earkqlz.exe
  2⤵
  PID:3244
- C:\Windows\System\EifMlen.exe
  C:\Windows\System\EifMlen.exe
  2⤵
  PID:4812
- C:\Windows\System\mZOyLBY.exe
  C:\Windows\System\mZOyLBY.exe
  2⤵
  PID:3652
- C:\Windows\System\sPJKwQC.exe
  C:\Windows\System\sPJKwQC.exe
  2⤵
  PID:536
- C:\Windows\System\oLhzcvN.exe
  C:\Windows\System\oLhzcvN.exe
  2⤵
  PID:388
- C:\Windows\System\CxisiNg.exe
  C:\Windows\System\CxisiNg.exe
  2⤵
  PID:6164
- C:\Windows\System\qjSTNqC.exe
  C:\Windows\System\qjSTNqC.exe
  2⤵
  PID:6192
- C:\Windows\System\xjmnYZe.exe
  C:\Windows\System\xjmnYZe.exe
  2⤵
  PID:6208
- C:\Windows\System\bjiwKuN.exe
  C:\Windows\System\bjiwKuN.exe
  2⤵
  PID:6228
- C:\Windows\System\VDqAotk.exe
  C:\Windows\System\VDqAotk.exe
  2⤵
  PID:6252
- C:\Windows\System\bCrXiGh.exe
  C:\Windows\System\bCrXiGh.exe
  2⤵
  PID:6276
- C:\Windows\System\MLKxBKc.exe
  C:\Windows\System\MLKxBKc.exe
  2⤵
  PID:6300
- C:\Windows\System\IEPitji.exe
  C:\Windows\System\IEPitji.exe
  2⤵
  PID:6324
- C:\Windows\System\AXvFUgk.exe
  C:\Windows\System\AXvFUgk.exe
  2⤵
  PID:6348
- C:\Windows\System\ehvdDPc.exe
  C:\Windows\System\ehvdDPc.exe
  2⤵
  PID:6368
- C:\Windows\System\OlJdHZR.exe
  C:\Windows\System\OlJdHZR.exe
  2⤵
  PID:6388
- C:\Windows\System\mcISzdV.exe
  C:\Windows\System\mcISzdV.exe
  2⤵
  PID:6412
- C:\Windows\System\xgUqBev.exe
  C:\Windows\System\xgUqBev.exe
  2⤵
  PID:6428
- C:\Windows\System\FbMQROu.exe
  C:\Windows\System\FbMQROu.exe
  2⤵
  PID:6452
- C:\Windows\System\VjIvsaR.exe
  C:\Windows\System\VjIvsaR.exe
  2⤵
  PID:6480
- C:\Windows\System\aSNRHCz.exe
  C:\Windows\System\aSNRHCz.exe
  2⤵
  PID:6500
- C:\Windows\System\SnMsCxG.exe
  C:\Windows\System\SnMsCxG.exe
  2⤵
  PID:6524
- C:\Windows\System\xQGHhsW.exe
  C:\Windows\System\xQGHhsW.exe
  2⤵
  PID:6548
- C:\Windows\System\sIlUbvX.exe
  C:\Windows\System\sIlUbvX.exe
  2⤵
  PID:6564
- C:\Windows\System\CIKdWUa.exe
  C:\Windows\System\CIKdWUa.exe
  2⤵
  PID:6588
- C:\Windows\System\BANqQxx.exe
  C:\Windows\System\BANqQxx.exe
  2⤵
  PID:6612
- C:\Windows\System\jgARsEe.exe
  C:\Windows\System\jgARsEe.exe
  2⤵
  PID:6628
- C:\Windows\System\oqqXsBA.exe
  C:\Windows\System\oqqXsBA.exe
  2⤵
  PID:6652
- C:\Windows\System\HYjAHKf.exe
  C:\Windows\System\HYjAHKf.exe
  2⤵
  PID:6668
- C:\Windows\System\fJMZTvs.exe
  C:\Windows\System\fJMZTvs.exe
  2⤵
  PID:6692
- C:\Windows\System\basibRK.exe
  C:\Windows\System\basibRK.exe
  2⤵
  PID:6712
- C:\Windows\System\jsUsocV.exe
  C:\Windows\System\jsUsocV.exe
  2⤵
  PID:6732
- C:\Windows\System\dLPvHeK.exe
  C:\Windows\System\dLPvHeK.exe
  2⤵
  PID:6760
- C:\Windows\System\SdLuxsf.exe
  C:\Windows\System\SdLuxsf.exe
  2⤵
  PID:6776
- C:\Windows\System\uPAboGd.exe
  C:\Windows\System\uPAboGd.exe
  2⤵
  PID:6808
- C:\Windows\System\EnDlaZe.exe
  C:\Windows\System\EnDlaZe.exe
  2⤵
  PID:6824
- C:\Windows\System\cTSYcVj.exe
  C:\Windows\System\cTSYcVj.exe
  2⤵
  PID:6852
- C:\Windows\System\PQERxRp.exe
  C:\Windows\System\PQERxRp.exe
  2⤵
  PID:6872
- C:\Windows\System\eZGGAFl.exe
  C:\Windows\System\eZGGAFl.exe
  2⤵
  PID:6892
- C:\Windows\System\dTFNZZT.exe
  C:\Windows\System\dTFNZZT.exe
  2⤵
  PID:6916
- C:\Windows\System\RQTJWgv.exe
  C:\Windows\System\RQTJWgv.exe
  2⤵
  PID:6936
- C:\Windows\System\rOedvHG.exe
  C:\Windows\System\rOedvHG.exe
  2⤵
  PID:6964
- C:\Windows\System\PAyHhdx.exe
  C:\Windows\System\PAyHhdx.exe
  2⤵
  PID:6984
- C:\Windows\System\RROSGvT.exe
  C:\Windows\System\RROSGvT.exe
  2⤵
  PID:7008
- C:\Windows\System\cLEUpMP.exe
  C:\Windows\System\cLEUpMP.exe
  2⤵
  PID:7028
- C:\Windows\System\hyTfUlF.exe
  C:\Windows\System\hyTfUlF.exe
  2⤵
  PID:7048
- C:\Windows\System\WEvRJMT.exe
  C:\Windows\System\WEvRJMT.exe
  2⤵
  PID:7076
- C:\Windows\System\jBdNoSs.exe
  C:\Windows\System\jBdNoSs.exe
  2⤵
  PID:7092
- C:\Windows\System\QwKZRgd.exe
  C:\Windows\System\QwKZRgd.exe
  2⤵
  PID:7116
- C:\Windows\System\GhEDRvx.exe
  C:\Windows\System\GhEDRvx.exe
  2⤵
  PID:7136
- C:\Windows\System\jHCQeRr.exe
  C:\Windows\System\jHCQeRr.exe
  2⤵
  PID:7160
- C:\Windows\System\XjPQCrV.exe
  C:\Windows\System\XjPQCrV.exe
  2⤵
  PID:5916
- C:\Windows\System\hnGfMyb.exe
  C:\Windows\System\hnGfMyb.exe
  2⤵
  PID:5260
- C:\Windows\System\woRloHN.exe
  C:\Windows\System\woRloHN.exe
  2⤵
  PID:1284
- C:\Windows\System\LoYAXyn.exe
  C:\Windows\System\LoYAXyn.exe
  2⤵
  PID:5512
- C:\Windows\System\hWVwzpG.exe
  C:\Windows\System\hWVwzpG.exe
  2⤵
  PID:6040
- C:\Windows\System\hfqdsIC.exe
  C:\Windows\System\hfqdsIC.exe
  2⤵
  PID:3764
- C:\Windows\System\iwggHpm.exe
  C:\Windows\System\iwggHpm.exe
  2⤵
  PID:2484
- C:\Windows\System\fJoiDnj.exe
  C:\Windows\System\fJoiDnj.exe
  2⤵
  PID:4544
- C:\Windows\System\AmaLlbn.exe
  C:\Windows\System\AmaLlbn.exe
  2⤵
  PID:5888
- C:\Windows\System\ClTpDvC.exe
  C:\Windows\System\ClTpDvC.exe
  2⤵
  PID:5336
- C:\Windows\System\bKJnsTU.exe
  C:\Windows\System\bKJnsTU.exe
  2⤵
  PID:368
- C:\Windows\System\wXMTnJZ.exe
  C:\Windows\System\wXMTnJZ.exe
  2⤵
  PID:6436
- C:\Windows\System\fuARyuf.exe
  C:\Windows\System\fuARyuf.exe
  2⤵
  PID:6236
- C:\Windows\System\KQKVgqi.exe
  C:\Windows\System\KQKVgqi.exe
  2⤵
  PID:6264
- C:\Windows\System\wGDarlI.exe
  C:\Windows\System\wGDarlI.exe
  2⤵
  PID:6240
- C:\Windows\System\rVvzBAe.exe
  C:\Windows\System\rVvzBAe.exe
  2⤵
  PID:6572
- C:\Windows\System\IymKHcd.exe
  C:\Windows\System\IymKHcd.exe
  2⤵
  PID:6644
- C:\Windows\System\iEeRFNN.exe
  C:\Windows\System\iEeRFNN.exe
  2⤵
  PID:6676
- C:\Windows\System\ectaBCC.exe
  C:\Windows\System\ectaBCC.exe
  2⤵
  PID:6772
- C:\Windows\System\LUzdnGk.exe
  C:\Windows\System\LUzdnGk.exe
  2⤵
  PID:6404
- C:\Windows\System\kuuaIxH.exe
  C:\Windows\System\kuuaIxH.exe
  2⤵
  PID:6424
- C:\Windows\System\QrFPFVp.exe
  C:\Windows\System\QrFPFVp.exe
  2⤵
  PID:6868
- C:\Windows\System\JRRREiD.exe
  C:\Windows\System\JRRREiD.exe
  2⤵
  PID:6944
- C:\Windows\System\HLMrlNu.exe
  C:\Windows\System\HLMrlNu.exe
  2⤵
  PID:6980
- C:\Windows\System\XQycliR.exe
  C:\Windows\System\XQycliR.exe
  2⤵
  PID:6492
- C:\Windows\System\KieCXOD.exe
  C:\Windows\System\KieCXOD.exe
  2⤵
  PID:6512
- C:\Windows\System\ayXxWID.exe
  C:\Windows\System\ayXxWID.exe
  2⤵
  PID:7184
- C:\Windows\System\NaRRoTX.exe
  C:\Windows\System\NaRRoTX.exe
  2⤵
  PID:7204
- C:\Windows\System\JIwKpyc.exe
  C:\Windows\System\JIwKpyc.exe
  2⤵
  PID:7224
- C:\Windows\System\eEHQAUc.exe
  C:\Windows\System\eEHQAUc.exe
  2⤵
  PID:7252
- C:\Windows\System\hUYQBpm.exe
  C:\Windows\System\hUYQBpm.exe
  2⤵
  PID:7268
- C:\Windows\System\gsFsdmq.exe
  C:\Windows\System\gsFsdmq.exe
  2⤵
  PID:7296
- C:\Windows\System\sLlcyhe.exe
  C:\Windows\System\sLlcyhe.exe
  2⤵
  PID:7312
- C:\Windows\System\oszHkGW.exe
  C:\Windows\System\oszHkGW.exe
  2⤵
  PID:7332
- C:\Windows\System\mnXfswu.exe
  C:\Windows\System\mnXfswu.exe
  2⤵
  PID:7352
- C:\Windows\System\PzxWzTW.exe
  C:\Windows\System\PzxWzTW.exe
  2⤵
  PID:7380
- C:\Windows\System\Qhbknhh.exe
  C:\Windows\System\Qhbknhh.exe
  2⤵
  PID:7396
- C:\Windows\System\CltIcwL.exe
  C:\Windows\System\CltIcwL.exe
  2⤵
  PID:7420
- C:\Windows\System\SLJsXrz.exe
  C:\Windows\System\SLJsXrz.exe
  2⤵
  PID:7436
- C:\Windows\System\vJhWVRz.exe
  C:\Windows\System\vJhWVRz.exe
  2⤵
  PID:7464
- C:\Windows\System\CcVhJRP.exe
  C:\Windows\System\CcVhJRP.exe
  2⤵
  PID:7480
- C:\Windows\System\kxaMMGL.exe
  C:\Windows\System\kxaMMGL.exe
  2⤵
  PID:7508
- C:\Windows\System\BSlUIje.exe
  C:\Windows\System\BSlUIje.exe
  2⤵
  PID:7524
- C:\Windows\System\hVtsSJK.exe
  C:\Windows\System\hVtsSJK.exe
  2⤵
  PID:7548
- C:\Windows\System\gkEdCSA.exe
  C:\Windows\System\gkEdCSA.exe
  2⤵
  PID:7572
- C:\Windows\System\dnWBRxC.exe
  C:\Windows\System\dnWBRxC.exe
  2⤵
  PID:7592
- C:\Windows\System\ouqZylT.exe
  C:\Windows\System\ouqZylT.exe
  2⤵
  PID:7616
- C:\Windows\System\RvVFCtY.exe
  C:\Windows\System\RvVFCtY.exe
  2⤵
  PID:7640
- C:\Windows\System\JPSNrfk.exe
  C:\Windows\System\JPSNrfk.exe
  2⤵
  PID:7660
- C:\Windows\System\SPQImUA.exe
  C:\Windows\System\SPQImUA.exe
  2⤵
  PID:7680
- C:\Windows\System\oksqngx.exe
  C:\Windows\System\oksqngx.exe
  2⤵
  PID:7704
- C:\Windows\System\ocGQFEf.exe
  C:\Windows\System\ocGQFEf.exe
  2⤵
  PID:7724
- C:\Windows\System\iAHVUIQ.exe
  C:\Windows\System\iAHVUIQ.exe
  2⤵
  PID:7748
- C:\Windows\System\fsIXsMd.exe
  C:\Windows\System\fsIXsMd.exe
  2⤵
  PID:7768
- C:\Windows\System\brBBTRa.exe
  C:\Windows\System\brBBTRa.exe
  2⤵
  PID:7784
- C:\Windows\System\VaiHimx.exe
  C:\Windows\System\VaiHimx.exe
  2⤵
  PID:7808
- C:\Windows\System\khdGWWe.exe
  C:\Windows\System\khdGWWe.exe
  2⤵
  PID:7832
- C:\Windows\System\YOFJuKE.exe
  C:\Windows\System\YOFJuKE.exe
  2⤵
  PID:7848
- C:\Windows\System\CDTxDlM.exe
  C:\Windows\System\CDTxDlM.exe
  2⤵
  PID:7872
- C:\Windows\System\VhxaYhU.exe
  C:\Windows\System\VhxaYhU.exe
  2⤵
  PID:7888
- C:\Windows\System\yAZgPfx.exe
  C:\Windows\System\yAZgPfx.exe
  2⤵
  PID:7916
- C:\Windows\System\sqNIifI.exe
  C:\Windows\System\sqNIifI.exe
  2⤵
  PID:7944
- C:\Windows\System\IreRMlL.exe
  C:\Windows\System\IreRMlL.exe
  2⤵
  PID:7960
- C:\Windows\System\hPzBhxL.exe
  C:\Windows\System\hPzBhxL.exe
  2⤵
  PID:7984
- C:\Windows\System\QctAKjZ.exe
  C:\Windows\System\QctAKjZ.exe
  2⤵
  PID:8000
- C:\Windows\System\ItpXGfZ.exe
  C:\Windows\System\ItpXGfZ.exe
  2⤵
  PID:8024
- C:\Windows\System\YpxCDIv.exe
  C:\Windows\System\YpxCDIv.exe
  2⤵
  PID:8044
- C:\Windows\System\LJiDEMm.exe
  C:\Windows\System\LJiDEMm.exe
  2⤵
  PID:8068
- C:\Windows\System\sEGJGCD.exe
  C:\Windows\System\sEGJGCD.exe
  2⤵
  PID:8088
- C:\Windows\System\qtncMem.exe
  C:\Windows\System\qtncMem.exe
  2⤵
  PID:8112
- C:\Windows\System\IvIVTQi.exe
  C:\Windows\System\IvIVTQi.exe
  2⤵
  PID:8132
- C:\Windows\System\TcfijKG.exe
  C:\Windows\System\TcfijKG.exe
  2⤵
  PID:8156
- C:\Windows\System\NepXpkT.exe
  C:\Windows\System\NepXpkT.exe
  2⤵
  PID:8176
- C:\Windows\System\msdNKBW.exe
  C:\Windows\System\msdNKBW.exe
  2⤵
  PID:6292
- C:\Windows\System\kSGbdmP.exe
  C:\Windows\System\kSGbdmP.exe
  2⤵
  PID:1488
- C:\Windows\System\azWrfRL.exe
  C:\Windows\System\azWrfRL.exe
  2⤵
  PID:5668
- C:\Windows\System\cGpgcZE.exe
  C:\Windows\System\cGpgcZE.exe
  2⤵
  PID:6360
- C:\Windows\System\YXsMCdC.exe
  C:\Windows\System\YXsMCdC.exe
  2⤵
  PID:3148
- C:\Windows\System\HaktuVf.exe
  C:\Windows\System\HaktuVf.exe
  2⤵
  PID:6768
- C:\Windows\System\VsMunaa.exe
  C:\Windows\System\VsMunaa.exe
  2⤵
  PID:6860
- C:\Windows\System\WKyhzYe.exe
  C:\Windows\System\WKyhzYe.exe
  2⤵
  PID:6900
- C:\Windows\System\QwgoYls.exe
  C:\Windows\System\QwgoYls.exe
  2⤵
  PID:6336
- C:\Windows\System\wRviZqp.exe
  C:\Windows\System\wRviZqp.exe
  2⤵
  PID:6864
- C:\Windows\System\fIKXmgi.exe
  C:\Windows\System\fIKXmgi.exe
  2⤵
  PID:6216
- C:\Windows\System\ioLmKiT.exe
  C:\Windows\System\ioLmKiT.exe
  2⤵
  PID:7196
- C:\Windows\System\CUAQhfB.exe
  C:\Windows\System\CUAQhfB.exe
  2⤵
  PID:7124
- C:\Windows\System\dCNcdcF.exe
  C:\Windows\System\dCNcdcF.exe
  2⤵
  PID:4652
- C:\Windows\System\FpFupIx.exe
  C:\Windows\System\FpFupIx.exe
  2⤵
  PID:7344
- C:\Windows\System\ATJKRFs.exe
  C:\Windows\System\ATJKRFs.exe
  2⤵
  PID:7416
- C:\Windows\System\PXybXTk.exe
  C:\Windows\System\PXybXTk.exe
  2⤵
  PID:4984
- C:\Windows\System\hSrJlQP.exe
  C:\Windows\System\hSrJlQP.exe
  2⤵
  PID:6104
- C:\Windows\System\EaUJoRJ.exe
  C:\Windows\System\EaUJoRJ.exe
  2⤵
  PID:8204
- C:\Windows\System\lmcrlkX.exe
  C:\Windows\System\lmcrlkX.exe
  2⤵
  PID:8232
- C:\Windows\System\NmCBhvL.exe
  C:\Windows\System\NmCBhvL.exe
  2⤵
  PID:8252
- C:\Windows\System\sfyOjmd.exe
  C:\Windows\System\sfyOjmd.exe
  2⤵
  PID:8276
- C:\Windows\System\tTEfIen.exe
  C:\Windows\System\tTEfIen.exe
  2⤵
  PID:8300
- C:\Windows\System\eJBcDmN.exe
  C:\Windows\System\eJBcDmN.exe
  2⤵
  PID:8324
- C:\Windows\System\rVryTIl.exe
  C:\Windows\System\rVryTIl.exe
  2⤵
  PID:8344
- C:\Windows\System\zOZMxOs.exe
  C:\Windows\System\zOZMxOs.exe
  2⤵
  PID:8368
- C:\Windows\System\mpymvHY.exe
  C:\Windows\System\mpymvHY.exe
  2⤵
  PID:8388
- C:\Windows\System\pVWNNpy.exe
  C:\Windows\System\pVWNNpy.exe
  2⤵
  PID:8412
- C:\Windows\System\csbWNJe.exe
  C:\Windows\System\csbWNJe.exe
  2⤵
  PID:8432
- C:\Windows\System\PNiqcXJ.exe
  C:\Windows\System\PNiqcXJ.exe
  2⤵
  PID:8460
- C:\Windows\System\xtupjho.exe
  C:\Windows\System\xtupjho.exe
  2⤵
  PID:8480
- C:\Windows\System\WEuXWWz.exe
  C:\Windows\System\WEuXWWz.exe
  2⤵
  PID:8504
- C:\Windows\System\yqjkKEy.exe
  C:\Windows\System\yqjkKEy.exe
  2⤵
  PID:8524
- C:\Windows\System\xlJtOGh.exe
  C:\Windows\System\xlJtOGh.exe
  2⤵
  PID:8548
- C:\Windows\System\jsjurmq.exe
  C:\Windows\System\jsjurmq.exe
  2⤵
  PID:8572
- C:\Windows\System\NMyjJlT.exe
  C:\Windows\System\NMyjJlT.exe
  2⤵
  PID:8596
- C:\Windows\System\SVotDhD.exe
  C:\Windows\System\SVotDhD.exe
  2⤵
  PID:8624
- C:\Windows\System\lUyQkoG.exe
  C:\Windows\System\lUyQkoG.exe
  2⤵
  PID:8640
- C:\Windows\System\DkVtdIw.exe
  C:\Windows\System\DkVtdIw.exe
  2⤵
  PID:8660
- C:\Windows\System\wMfTtlX.exe
  C:\Windows\System\wMfTtlX.exe
  2⤵
  PID:8684
- C:\Windows\System\oMKhfBV.exe
  C:\Windows\System\oMKhfBV.exe
  2⤵
  PID:8708
- C:\Windows\System\vCEusOH.exe
  C:\Windows\System\vCEusOH.exe
  2⤵
  PID:8728
- C:\Windows\System\XSbnAFJ.exe
  C:\Windows\System\XSbnAFJ.exe
  2⤵
  PID:8752
- C:\Windows\System\KcmZRcn.exe
  C:\Windows\System\KcmZRcn.exe
  2⤵
  PID:8776
- C:\Windows\System\bHdrNtw.exe
  C:\Windows\System\bHdrNtw.exe
  2⤵
  PID:8800
- C:\Windows\System\cRWiiku.exe
  C:\Windows\System\cRWiiku.exe
  2⤵
  PID:8816
- C:\Windows\System\wZIcILf.exe
  C:\Windows\System\wZIcILf.exe
  2⤵
  PID:8844
- C:\Windows\System\ojQtGxx.exe
  C:\Windows\System\ojQtGxx.exe
  2⤵
  PID:8864
- C:\Windows\System\XBcWJCb.exe
  C:\Windows\System\XBcWJCb.exe
  2⤵
  PID:8888
- C:\Windows\System\siWKhxJ.exe
  C:\Windows\System\siWKhxJ.exe
  2⤵
  PID:8916
- C:\Windows\System\cdhcxbL.exe
  C:\Windows\System\cdhcxbL.exe
  2⤵
  PID:8936
- C:\Windows\System\Srmkgqa.exe
  C:\Windows\System\Srmkgqa.exe
  2⤵
  PID:8952
- C:\Windows\System\mrXyzxA.exe
  C:\Windows\System\mrXyzxA.exe
  2⤵
  PID:8968
- C:\Windows\System\RJijpQZ.exe
  C:\Windows\System\RJijpQZ.exe
  2⤵
  PID:8996
- C:\Windows\System\VkiZdcp.exe
  C:\Windows\System\VkiZdcp.exe
  2⤵
  PID:9016
- C:\Windows\System\bCPvRfe.exe
  C:\Windows\System\bCPvRfe.exe
  2⤵
  PID:9044
- C:\Windows\System\aCRoytl.exe
  C:\Windows\System\aCRoytl.exe
  2⤵
  PID:9064
- C:\Windows\System\botHmcv.exe
  C:\Windows\System\botHmcv.exe
  2⤵
  PID:9088
- C:\Windows\System\TxFzUnc.exe
  C:\Windows\System\TxFzUnc.exe
  2⤵
  PID:9112
- C:\Windows\System\LzUekRo.exe
  C:\Windows\System\LzUekRo.exe
  2⤵
  PID:9132
- C:\Windows\System\xljVYMj.exe
  C:\Windows\System\xljVYMj.exe
  2⤵
  PID:9152
- C:\Windows\System\JRCtJYd.exe
  C:\Windows\System\JRCtJYd.exe
  2⤵
  PID:9168
- C:\Windows\System\fwadikV.exe
  C:\Windows\System\fwadikV.exe
  2⤵
  PID:9188
- C:\Windows\System\ItSViED.exe
  C:\Windows\System\ItSViED.exe
  2⤵
  PID:9204
- C:\Windows\System\tfsNwKo.exe
  C:\Windows\System\tfsNwKo.exe
  2⤵
  PID:5868
- C:\Windows\System\bUedOZT.exe
  C:\Windows\System\bUedOZT.exe
  2⤵
  PID:7740
- C:\Windows\System\shtbeHU.exe
  C:\Windows\System\shtbeHU.exe
  2⤵
  PID:6560
- C:\Windows\System\txTQpho.exe
  C:\Windows\System\txTQpho.exe
  2⤵
  PID:7880
- C:\Windows\System\VTtysdA.exe
  C:\Windows\System\VTtysdA.exe
  2⤵
  PID:6384
- C:\Windows\System\TtvtYDa.exe
  C:\Windows\System\TtvtYDa.exe
  2⤵
  PID:7980
- C:\Windows\System\OzwTShj.exe
  C:\Windows\System\OzwTShj.exe
  2⤵
  PID:6912
- C:\Windows\System\bQdHGIb.exe
  C:\Windows\System\bQdHGIb.exe
  2⤵
  PID:7180
- C:\Windows\System\ZkvrprP.exe
  C:\Windows\System\ZkvrprP.exe
  2⤵
  PID:7244
- C:\Windows\System\IHwtMuu.exe
  C:\Windows\System\IHwtMuu.exe
  2⤵
  PID:8184
- C:\Windows\System\EwlisTX.exe
  C:\Windows\System\EwlisTX.exe
  2⤵
  PID:3956
- C:\Windows\System\lOhGVlS.exe
  C:\Windows\System\lOhGVlS.exe
  2⤵
  PID:6364
- C:\Windows\System\XMiMdJi.exe
  C:\Windows\System\XMiMdJi.exe
  2⤵
  PID:7496
- C:\Windows\System\aPjrlMh.exe
  C:\Windows\System\aPjrlMh.exe
  2⤵
  PID:7560
- C:\Windows\System\GFRHsWK.exe
  C:\Windows\System\GFRHsWK.exe
  2⤵
  PID:8284
- C:\Windows\System\bknutkQ.exe
  C:\Windows\System\bknutkQ.exe
  2⤵
  PID:7672
- C:\Windows\System\BMPRCqD.exe
  C:\Windows\System\BMPRCqD.exe
  2⤵
  PID:7712
- C:\Windows\System\vUqzfsE.exe
  C:\Windows\System\vUqzfsE.exe
  2⤵
  PID:9224
- C:\Windows\System\jFYRuoS.exe
  C:\Windows\System\jFYRuoS.exe
  2⤵
  PID:9248
- C:\Windows\System\VtKJHLR.exe
  C:\Windows\System\VtKJHLR.exe
  2⤵
  PID:9268
- C:\Windows\System\eBolSts.exe
  C:\Windows\System\eBolSts.exe
  2⤵
  PID:9292
- C:\Windows\System\wLEtLgq.exe
  C:\Windows\System\wLEtLgq.exe
  2⤵
  PID:9312
- C:\Windows\System\sPfwHdd.exe
  C:\Windows\System\sPfwHdd.exe
  2⤵
  PID:9332
- C:\Windows\System\WITyNEE.exe
  C:\Windows\System\WITyNEE.exe
  2⤵
  PID:9356
- C:\Windows\System\iCHSLnb.exe
  C:\Windows\System\iCHSLnb.exe
  2⤵
  PID:9376
- C:\Windows\System\rVygDUy.exe
  C:\Windows\System\rVygDUy.exe
  2⤵
  PID:9396
- C:\Windows\System\QzrbeZS.exe
  C:\Windows\System\QzrbeZS.exe
  2⤵
  PID:9420
- C:\Windows\System\OlOXmrN.exe
  C:\Windows\System\OlOXmrN.exe
  2⤵
  PID:9448
- C:\Windows\System\klFLztN.exe
  C:\Windows\System\klFLztN.exe
  2⤵
  PID:9472
- C:\Windows\System\hXBqfMq.exe
  C:\Windows\System\hXBqfMq.exe
  2⤵
  PID:9496
- C:\Windows\System\pWWHtiS.exe
  C:\Windows\System\pWWHtiS.exe
  2⤵
  PID:9516
- C:\Windows\System\vJDbTNA.exe
  C:\Windows\System\vJDbTNA.exe
  2⤵
  PID:9532
- C:\Windows\System\fXINPvM.exe
  C:\Windows\System\fXINPvM.exe
  2⤵
  PID:9552
- C:\Windows\System\jlVlPxp.exe
  C:\Windows\System\jlVlPxp.exe
  2⤵
  PID:9572
- C:\Windows\System\ZXbYPZt.exe
  C:\Windows\System\ZXbYPZt.exe
  2⤵
  PID:9592
- C:\Windows\System\GTFxPmE.exe
  C:\Windows\System\GTFxPmE.exe
  2⤵
  PID:9620
- C:\Windows\System\RRApFMV.exe
  C:\Windows\System\RRApFMV.exe
  2⤵
  PID:9640
- C:\Windows\System\XJrUltg.exe
  C:\Windows\System\XJrUltg.exe
  2⤵
  PID:9660
- C:\Windows\System\iPpszCF.exe
  C:\Windows\System\iPpszCF.exe
  2⤵
  PID:9688
- C:\Windows\System\FOsEjqL.exe
  C:\Windows\System\FOsEjqL.exe
  2⤵
  PID:9708
- C:\Windows\System\VfezRwl.exe
  C:\Windows\System\VfezRwl.exe
  2⤵
  PID:9732
- C:\Windows\System\kFfUCsG.exe
  C:\Windows\System\kFfUCsG.exe
  2⤵
  PID:9768
- C:\Windows\System\hcpyVbJ.exe
  C:\Windows\System\hcpyVbJ.exe
  2⤵
  PID:9788
- C:\Windows\System\TYjFwCe.exe
  C:\Windows\System\TYjFwCe.exe
  2⤵
  PID:9808
- C:\Windows\System\wnAnPcU.exe
  C:\Windows\System\wnAnPcU.exe
  2⤵
  PID:9836
- C:\Windows\System\YyMDOtM.exe
  C:\Windows\System\YyMDOtM.exe
  2⤵
  PID:9852
- C:\Windows\System\iNWZira.exe
  C:\Windows\System\iNWZira.exe
  2⤵
  PID:9880
- C:\Windows\System\uHZDiwJ.exe
  C:\Windows\System\uHZDiwJ.exe
  2⤵
  PID:9900
- C:\Windows\System\zDAQKwu.exe
  C:\Windows\System\zDAQKwu.exe
  2⤵
  PID:9928
- C:\Windows\System\FLVJbxO.exe
  C:\Windows\System\FLVJbxO.exe
  2⤵
  PID:9944
- C:\Windows\System\cQGjYoC.exe
  C:\Windows\System\cQGjYoC.exe
  2⤵
  PID:9972
- C:\Windows\System\WBwIPjR.exe
  C:\Windows\System\WBwIPjR.exe
  2⤵
  PID:9988
- C:\Windows\System\aBpLoTS.exe
  C:\Windows\System\aBpLoTS.exe
  2⤵
  PID:10016
- C:\Windows\System\nasaEyW.exe
  C:\Windows\System\nasaEyW.exe
  2⤵
  PID:10040
- C:\Windows\System\rHccYXb.exe
  C:\Windows\System\rHccYXb.exe
  2⤵
  PID:10060
- C:\Windows\System\ryPJNWc.exe
  C:\Windows\System\ryPJNWc.exe
  2⤵
  PID:10080
- C:\Windows\System\VfqioRN.exe
  C:\Windows\System\VfqioRN.exe
  2⤵
  PID:10104
- C:\Windows\System\rBbWekQ.exe
  C:\Windows\System\rBbWekQ.exe
  2⤵
  PID:10120
- C:\Windows\System\UsBQdgN.exe
  C:\Windows\System\UsBQdgN.exe
  2⤵
  PID:10144
- C:\Windows\System\ucDPXtH.exe
  C:\Windows\System\ucDPXtH.exe
  2⤵
  PID:10164
- C:\Windows\System\aWKRQOx.exe
  C:\Windows\System\aWKRQOx.exe
  2⤵
  PID:10180
- C:\Windows\System\DrxHZqT.exe
  C:\Windows\System\DrxHZqT.exe
  2⤵
  PID:10196
- C:\Windows\System\sHrOyGC.exe
  C:\Windows\System\sHrOyGC.exe
  2⤵
  PID:10216
- C:\Windows\System\NpaWHTN.exe
  C:\Windows\System\NpaWHTN.exe
  2⤵
  PID:8420
- C:\Windows\System\hdAnYom.exe
  C:\Windows\System\hdAnYom.exe
  2⤵
  PID:7760
- C:\Windows\System\QXdCUok.exe
  C:\Windows\System\QXdCUok.exe
  2⤵
  PID:6536
- C:\Windows\System\SAdQOfs.exe
  C:\Windows\System\SAdQOfs.exe
  2⤵
  PID:8560
- C:\Windows\System\rgzZEPr.exe
  C:\Windows\System\rgzZEPr.exe
  2⤵
  PID:7884
- C:\Windows\System\fqJOWYi.exe
  C:\Windows\System\fqJOWYi.exe
  2⤵
  PID:1692
- C:\Windows\System\nQyNnrI.exe
  C:\Windows\System\nQyNnrI.exe
  2⤵
  PID:9184
- C:\Windows\System\UNbwEWc.exe
  C:\Windows\System\UNbwEWc.exe
  2⤵
  PID:2416
- C:\Windows\System\FPrbabi.exe
  C:\Windows\System\FPrbabi.exe
  2⤵
  PID:7504
- C:\Windows\System\LAkANfk.exe
  C:\Windows\System\LAkANfk.exe
  2⤵
  PID:7932
- C:\Windows\System\mbwzYaj.exe
  C:\Windows\System\mbwzYaj.exe
  2⤵
  PID:8244
- C:\Windows\System\kAOadhP.exe
  C:\Windows\System\kAOadhP.exe
  2⤵
  PID:8352
- C:\Windows\System\kcQnbyc.exe
  C:\Windows\System\kcQnbyc.exe
  2⤵
  PID:7408
- C:\Windows\System\SkbPlXJ.exe
  C:\Windows\System\SkbPlXJ.exe
  2⤵
  PID:8452
- C:\Windows\System\ugFiWWt.exe
  C:\Windows\System\ugFiWWt.exe
  2⤵
  PID:7828
- C:\Windows\System\lOtvkAP.exe
  C:\Windows\System\lOtvkAP.exe
  2⤵
  PID:9460
- C:\Windows\System\kfYdded.exe
  C:\Windows\System\kfYdded.exe
  2⤵
  PID:9504
- C:\Windows\System\uAyUuuN.exe
  C:\Windows\System\uAyUuuN.exe
  2⤵
  PID:9540
- C:\Windows\System\ajYoxwi.exe
  C:\Windows\System\ajYoxwi.exe
  2⤵
  PID:8608
- C:\Windows\System\GNaSOFq.exe
  C:\Windows\System\GNaSOFq.exe
  2⤵
  PID:8012
- C:\Windows\System\GjUYwgm.exe
  C:\Windows\System\GjUYwgm.exe
  2⤵
  PID:9608
- C:\Windows\System\hKNDbfi.exe
  C:\Windows\System\hKNDbfi.exe
  2⤵
  PID:9636
- C:\Windows\System\IWAoFkD.exe
  C:\Windows\System\IWAoFkD.exe
  2⤵
  PID:9728
- C:\Windows\System\NBpQPYs.exe
  C:\Windows\System\NBpQPYs.exe
  2⤵
  PID:8792
- C:\Windows\System\QhlriVJ.exe
  C:\Windows\System\QhlriVJ.exe
  2⤵
  PID:8144
- C:\Windows\System\xbNKKAp.exe
  C:\Windows\System\xbNKKAp.exe
  2⤵
  PID:9868
- C:\Windows\System\YHaiYCq.exe
  C:\Windows\System\YHaiYCq.exe
  2⤵
  PID:10260
- C:\Windows\System\LtyvDpv.exe
  C:\Windows\System\LtyvDpv.exe
  2⤵
  PID:10280
- C:\Windows\System\jloRYep.exe
  C:\Windows\System\jloRYep.exe
  2⤵
  PID:10304
- C:\Windows\System\PDCadAO.exe
  C:\Windows\System\PDCadAO.exe
  2⤵
  PID:10324
- C:\Windows\System\StItIHF.exe
  C:\Windows\System\StItIHF.exe
  2⤵
  PID:10348
- C:\Windows\System\LhxvXGm.exe
  C:\Windows\System\LhxvXGm.exe
  2⤵
  PID:10372
- C:\Windows\System\nkrZsFW.exe
  C:\Windows\System\nkrZsFW.exe
  2⤵
  PID:10392
- C:\Windows\System\BLnmuQC.exe
  C:\Windows\System\BLnmuQC.exe
  2⤵
  PID:10412
- C:\Windows\System\vvYfwvz.exe
  C:\Windows\System\vvYfwvz.exe
  2⤵
  PID:10436
- C:\Windows\System\EJQfYNf.exe
  C:\Windows\System\EJQfYNf.exe
  2⤵
  PID:10460
- C:\Windows\System\DqxgXcJ.exe
  C:\Windows\System\DqxgXcJ.exe
  2⤵
  PID:10480
- C:\Windows\System\auISfnY.exe
  C:\Windows\System\auISfnY.exe
  2⤵
  PID:10500
- C:\Windows\System\JWJUDzV.exe
  C:\Windows\System\JWJUDzV.exe
  2⤵
  PID:10520
- C:\Windows\System\IrXGWnM.exe
  C:\Windows\System\IrXGWnM.exe
  2⤵
  PID:10544
- C:\Windows\System\tnTgAvY.exe
  C:\Windows\System\tnTgAvY.exe
  2⤵
  PID:10564
- C:\Windows\System\PzDhlYE.exe
  C:\Windows\System\PzDhlYE.exe
  2⤵
  PID:10584
- C:\Windows\System\fmlZrVZ.exe
  C:\Windows\System\fmlZrVZ.exe
  2⤵
  PID:10608
- C:\Windows\System\wZIKYLR.exe
  C:\Windows\System\wZIKYLR.exe
  2⤵
  PID:10636
- C:\Windows\System\IzpWdys.exe
  C:\Windows\System\IzpWdys.exe
  2⤵
  PID:10652
- C:\Windows\System\gcbcJoV.exe
  C:\Windows\System\gcbcJoV.exe
  2⤵
  PID:10676
- C:\Windows\System\NWqVFnZ.exe
  C:\Windows\System\NWqVFnZ.exe
  2⤵
  PID:10700
- C:\Windows\System\OIyYoPl.exe
  C:\Windows\System\OIyYoPl.exe
  2⤵
  PID:10724
- C:\Windows\System\OwWvCuH.exe
  C:\Windows\System\OwWvCuH.exe
  2⤵
  PID:10740
- C:\Windows\System\jKBLGXQ.exe
  C:\Windows\System\jKBLGXQ.exe
  2⤵
  PID:10764
- C:\Windows\System\LBGjJop.exe
  C:\Windows\System\LBGjJop.exe
  2⤵
  PID:10788
- C:\Windows\System\rXwzZyL.exe
  C:\Windows\System\rXwzZyL.exe
  2⤵
  PID:10808
- C:\Windows\System\fTTVRRk.exe
  C:\Windows\System\fTTVRRk.exe
  2⤵
  PID:10836
- C:\Windows\System\YYyrthk.exe
  C:\Windows\System\YYyrthk.exe
  2⤵
  PID:10864
- C:\Windows\System\hmeGlYH.exe
  C:\Windows\System\hmeGlYH.exe
  2⤵
  PID:10880
- C:\Windows\System\HotFUWf.exe
  C:\Windows\System\HotFUWf.exe
  2⤵
  PID:10900
- C:\Windows\System\yYaZxBr.exe
  C:\Windows\System\yYaZxBr.exe
  2⤵
  PID:10916
- C:\Windows\System\kPgtUXP.exe
  C:\Windows\System\kPgtUXP.exe
  2⤵
  PID:10932
- C:\Windows\System\abNbmDX.exe
  C:\Windows\System\abNbmDX.exe
  2⤵
  PID:10956
- C:\Windows\System\FgjVxSa.exe
  C:\Windows\System\FgjVxSa.exe
  2⤵
  PID:10980
- C:\Windows\System\xaTypjC.exe
  C:\Windows\System\xaTypjC.exe
  2⤵
  PID:11012
- C:\Windows\System\utEPIjI.exe
  C:\Windows\System\utEPIjI.exe
  2⤵
  PID:11036
- C:\Windows\System\EpKRvio.exe
  C:\Windows\System\EpKRvio.exe
  2⤵
  PID:11052
- C:\Windows\System\rmoqeIc.exe
  C:\Windows\System\rmoqeIc.exe
  2⤵
  PID:11076
- C:\Windows\System\fuOeAyQ.exe
  C:\Windows\System\fuOeAyQ.exe
  2⤵
  PID:11100
- C:\Windows\System\hcpsSTj.exe
  C:\Windows\System\hcpsSTj.exe
  2⤵
  PID:11120
- C:\Windows\System\jvwedWm.exe
  C:\Windows\System\jvwedWm.exe
  2⤵
  PID:11148
- C:\Windows\System\xCLmxoU.exe
  C:\Windows\System\xCLmxoU.exe
  2⤵
  PID:11172
- C:\Windows\System\YXzexix.exe
  C:\Windows\System\YXzexix.exe
  2⤵
  PID:11196
- C:\Windows\System\nqNJMue.exe
  C:\Windows\System\nqNJMue.exe
  2⤵
  PID:11224
- C:\Windows\System\PTGSJsh.exe
  C:\Windows\System\PTGSJsh.exe
  2⤵
  PID:11244
- C:\Windows\System\hIRDrAL.exe
  C:\Windows\System\hIRDrAL.exe
  2⤵
  PID:8908
- C:\Windows\System\hkwOeaB.exe
  C:\Windows\System\hkwOeaB.exe
  2⤵
  PID:8948
- C:\Windows\System\FTxMaYs.exe
  C:\Windows\System\FTxMaYs.exe
  2⤵
  PID:10000
- C:\Windows\System\mFoXMeJ.exe
  C:\Windows\System\mFoXMeJ.exe
  2⤵
  PID:10112
- C:\Windows\System\RPDPLHi.exe
  C:\Windows\System\RPDPLHi.exe
  2⤵
  PID:10188
- C:\Windows\System\DSxAPAq.exe
  C:\Windows\System\DSxAPAq.exe
  2⤵
  PID:10228
- C:\Windows\System\HXfQtkE.exe
  C:\Windows\System\HXfQtkE.exe
  2⤵
  PID:7804
- C:\Windows\System\bcYfaNQ.exe
  C:\Windows\System\bcYfaNQ.exe
  2⤵
  PID:7192
- C:\Windows\System\JZjNEad.exe
  C:\Windows\System\JZjNEad.exe
  2⤵
  PID:7792
- C:\Windows\System\wbsCJgX.exe
  C:\Windows\System\wbsCJgX.exe
  2⤵
  PID:8056
- C:\Windows\System\IYpbBsb.exe
  C:\Windows\System\IYpbBsb.exe
  2⤵
  PID:8268
- C:\Windows\System\QwVDcLO.exe
  C:\Windows\System\QwVDcLO.exe
  2⤵
  PID:7112
- C:\Windows\System\iooIVYp.exe
  C:\Windows\System\iooIVYp.exe
  2⤵
  PID:7304
- C:\Windows\System\GEoLCfW.exe
  C:\Windows\System\GEoLCfW.exe
  2⤵
  PID:8468
- C:\Windows\System\GcGnJhB.exe
  C:\Windows\System\GcGnJhB.exe
  2⤵
  PID:9368
- C:\Windows\System\kwpMVOW.exe
  C:\Windows\System\kwpMVOW.exe
  2⤵
  PID:9412
- C:\Windows\System\AwybbWw.exe
  C:\Windows\System\AwybbWw.exe
  2⤵
  PID:2384
- C:\Windows\System\IEGnIyv.exe
  C:\Windows\System\IEGnIyv.exe
  2⤵
  PID:11280
- C:\Windows\System\cXUzLWB.exe
  C:\Windows\System\cXUzLWB.exe
  2⤵
  PID:11304
- C:\Windows\System\guVzeLL.exe
  C:\Windows\System\guVzeLL.exe
  2⤵
  PID:11328
- C:\Windows\System\uaqdlST.exe
  C:\Windows\System\uaqdlST.exe
  2⤵
  PID:11348
- C:\Windows\System\wYrPhSX.exe
  C:\Windows\System\wYrPhSX.exe
  2⤵
  PID:11368
- C:\Windows\System\PbygvHg.exe
  C:\Windows\System\PbygvHg.exe
  2⤵
  PID:11384
- C:\Windows\System\wuNCnUw.exe
  C:\Windows\System\wuNCnUw.exe
  2⤵
  PID:11408
- C:\Windows\System\ryXjMpK.exe
  C:\Windows\System\ryXjMpK.exe
  2⤵
  PID:11432
- C:\Windows\System\VEuulgF.exe
  C:\Windows\System\VEuulgF.exe
  2⤵
  PID:11456
- C:\Windows\System\XfHFTuy.exe
  C:\Windows\System\XfHFTuy.exe
  2⤵
  PID:11480
- C:\Windows\System\pjyMqhx.exe
  C:\Windows\System\pjyMqhx.exe
  2⤵
  PID:11500
- C:\Windows\System\ubCjgMg.exe
  C:\Windows\System\ubCjgMg.exe
  2⤵
  PID:11520
- C:\Windows\System\AguPZxl.exe
  C:\Windows\System\AguPZxl.exe
  2⤵
  PID:11544
- C:\Windows\System\ylfjStU.exe
  C:\Windows\System\ylfjStU.exe
  2⤵
  PID:11568
- C:\Windows\System\zDkOInG.exe
  C:\Windows\System\zDkOInG.exe
  2⤵
  PID:11584
- C:\Windows\System\gxpasFL.exe
  C:\Windows\System\gxpasFL.exe
  2⤵
  PID:11624
- C:\Windows\System\eJiqCki.exe
  C:\Windows\System\eJiqCki.exe
  2⤵
  PID:11640
- C:\Windows\System\meCIcCC.exe
  C:\Windows\System\meCIcCC.exe
  2⤵
  PID:11668
- C:\Windows\System\QRGhtnC.exe
  C:\Windows\System\QRGhtnC.exe
  2⤵
  PID:11684
- C:\Windows\System\HqkrZFb.exe
  C:\Windows\System\HqkrZFb.exe
  2⤵
  PID:11708
- C:\Windows\System\BfQgwLR.exe
  C:\Windows\System\BfQgwLR.exe
  2⤵
  PID:11732
- C:\Windows\System\qwEdfLL.exe
  C:\Windows\System\qwEdfLL.exe
  2⤵
  PID:11752
- C:\Windows\System\imKDava.exe
  C:\Windows\System\imKDava.exe
  2⤵
  PID:11776
- C:\Windows\System\YHiWyya.exe
  C:\Windows\System\YHiWyya.exe
  2⤵
  PID:11808
- C:\Windows\System\RXWmiQx.exe
  C:\Windows\System\RXWmiQx.exe
  2⤵
  PID:11836
- C:\Windows\System\bfDmXjC.exe
  C:\Windows\System\bfDmXjC.exe
  2⤵
  PID:11860
- C:\Windows\System\oRPgsXx.exe
  C:\Windows\System\oRPgsXx.exe
  2⤵
  PID:11888
- C:\Windows\System\nOHroFA.exe
  C:\Windows\System\nOHroFA.exe
  2⤵
  PID:11908
- C:\Windows\System\DMnjBsJ.exe
  C:\Windows\System\DMnjBsJ.exe
  2⤵
  PID:11928
- C:\Windows\System\IKRlDuI.exe
  C:\Windows\System\IKRlDuI.exe
  2⤵
  PID:11956
- C:\Windows\System\DTVTRtO.exe
  C:\Windows\System\DTVTRtO.exe
  2⤵
  PID:11976
- C:\Windows\System\FuCdToE.exe
  C:\Windows\System\FuCdToE.exe
  2⤵
  PID:12012
- C:\Windows\System\HrZkpMw.exe
  C:\Windows\System\HrZkpMw.exe
  2⤵
  PID:12028
- C:\Windows\System\ELscqqB.exe
  C:\Windows\System\ELscqqB.exe
  2⤵
  PID:12064
- C:\Windows\System\zbakhSu.exe
  C:\Windows\System\zbakhSu.exe
  2⤵
  PID:12080
- C:\Windows\System\VztLzmV.exe
  C:\Windows\System\VztLzmV.exe
  2⤵
  PID:12096
- C:\Windows\System\QPwNUbs.exe
  C:\Windows\System\QPwNUbs.exe
  2⤵
  PID:12112
- C:\Windows\System\TGiwIMN.exe
  C:\Windows\System\TGiwIMN.exe
  2⤵
  PID:12128
- C:\Windows\System\WWPgwYF.exe
  C:\Windows\System\WWPgwYF.exe
  2⤵
  PID:12148
- C:\Windows\System\oTfFCKA.exe
  C:\Windows\System\oTfFCKA.exe
  2⤵
  PID:12164
- C:\Windows\System\NyVlNVE.exe
  C:\Windows\System\NyVlNVE.exe
  2⤵
  PID:12184
- C:\Windows\System\ABjHaYn.exe
  C:\Windows\System\ABjHaYn.exe
  2⤵
  PID:12200
- C:\Windows\System\heRELcN.exe
  C:\Windows\System\heRELcN.exe
  2⤵
  PID:12220
- C:\Windows\System\QsNYirH.exe
  C:\Windows\System\QsNYirH.exe
  2⤵
  PID:12240
- C:\Windows\System\ZplkELv.exe
  C:\Windows\System\ZplkELv.exe
  2⤵
  PID:12260
- C:\Windows\System\asrjjAX.exe
  C:\Windows\System\asrjjAX.exe
  2⤵
  PID:12280
- C:\Windows\System\PJkspnh.exe
  C:\Windows\System\PJkspnh.exe
  2⤵
  PID:9656
- C:\Windows\System\oZzwSFM.exe
  C:\Windows\System\oZzwSFM.exe
  2⤵
  PID:8196
- C:\Windows\System\QjwwCta.exe
  C:\Windows\System\QjwwCta.exe
  2⤵
  PID:9436
- C:\Windows\System\sagFWCY.exe
  C:\Windows\System\sagFWCY.exe
  2⤵
  PID:9548
- C:\Windows\System\tsWmbFh.exe
  C:\Windows\System\tsWmbFh.exe
  2⤵
  PID:9816
- C:\Windows\System\yamATQM.exe
  C:\Windows\System\yamATQM.exe
  2⤵
  PID:9820
- C:\Windows\System\eDWyaUi.exe
  C:\Windows\System\eDWyaUi.exe
  2⤵
  PID:8152
- C:\Windows\System\qXeYNRF.exe
  C:\Windows\System\qXeYNRF.exe
  2⤵
  PID:8860
- C:\Windows\System\AURHEaG.exe
  C:\Windows\System\AURHEaG.exe
  2⤵
  PID:10316
- C:\Windows\System\sCQTkMh.exe
  C:\Windows\System\sCQTkMh.exe
  2⤵
  PID:10368
- C:\Windows\System\yIgqlqm.exe
  C:\Windows\System\yIgqlqm.exe
  2⤵
  PID:8964
- C:\Windows\System\uMmOhYo.exe
  C:\Windows\System\uMmOhYo.exe
  2⤵
  PID:10468
- C:\Windows\System\cTNBuZy.exe
  C:\Windows\System\cTNBuZy.exe
  2⤵
  PID:10052
- C:\Windows\System\xWsqZFE.exe
  C:\Windows\System\xWsqZFE.exe
  2⤵
  PID:10076
- C:\Windows\System\KOxTHYt.exe
  C:\Windows\System\KOxTHYt.exe
  2⤵
  PID:10152
- C:\Windows\System\FExXKCt.exe
  C:\Windows\System\FExXKCt.exe
  2⤵
  PID:10616
- C:\Windows\System\UuHdPRR.exe
  C:\Windows\System\UuHdPRR.exe
  2⤵
  PID:10668
- C:\Windows\System\OxeASwt.exe
  C:\Windows\System\OxeASwt.exe
  2⤵
  PID:8036
- C:\Windows\System\iQiNqLW.exe
  C:\Windows\System\iQiNqLW.exe
  2⤵
  PID:7780
- C:\Windows\System\rbkkumk.exe
  C:\Windows\System\rbkkumk.exe
  2⤵
  PID:2508
- C:\Windows\System\uzrycgM.exe
  C:\Windows\System\uzrycgM.exe
  2⤵
  PID:11004
- C:\Windows\System\gLTHGNS.exe
  C:\Windows\System\gLTHGNS.exe
  2⤵
  PID:11088
- C:\Windows\System\NrmOXVU.exe
  C:\Windows\System\NrmOXVU.exe
  2⤵
  PID:11180
- C:\Windows\System\SFZQmmz.exe
  C:\Windows\System\SFZQmmz.exe
  2⤵
  PID:7280
- C:\Windows\System\SDnrxqK.exe
  C:\Windows\System\SDnrxqK.exe
  2⤵
  PID:7648
- C:\Windows\System\SIscTtc.exe
  C:\Windows\System\SIscTtc.exe
  2⤵
  PID:8384
- C:\Windows\System\tSFKmDK.exe
  C:\Windows\System\tSFKmDK.exe
  2⤵
  PID:9260
- C:\Windows\System\FuEfqWu.exe
  C:\Windows\System\FuEfqWu.exe
  2⤵
  PID:10172
- C:\Windows\System\WISwPHB.exe
  C:\Windows\System\WISwPHB.exe
  2⤵
  PID:12312
- C:\Windows\System\lAVEGDw.exe
  C:\Windows\System\lAVEGDw.exe
  2⤵
  PID:12332
- C:\Windows\System\OKYfdmY.exe
  C:\Windows\System\OKYfdmY.exe
  2⤵
  PID:12352
- C:\Windows\System\sFJOILW.exe
  C:\Windows\System\sFJOILW.exe
  2⤵
  PID:12384
- C:\Windows\System\pPsQnxF.exe
  C:\Windows\System\pPsQnxF.exe
  2⤵
  PID:12408
- C:\Windows\System\iQihXyo.exe
  C:\Windows\System\iQihXyo.exe
  2⤵
  PID:12424
- C:\Windows\System\uEEXABt.exe
  C:\Windows\System\uEEXABt.exe
  2⤵
  PID:12448
- C:\Windows\System\cVxwlhn.exe
  C:\Windows\System\cVxwlhn.exe
  2⤵
  PID:12472
- C:\Windows\System\ApafTTF.exe
  C:\Windows\System\ApafTTF.exe
  2⤵
  PID:12492
- C:\Windows\System\eXlgxQd.exe
  C:\Windows\System\eXlgxQd.exe
  2⤵
  PID:12516
- C:\Windows\System\KCIjtGt.exe
  C:\Windows\System\KCIjtGt.exe
  2⤵
  PID:12544
- C:\Windows\System\PhtoyyO.exe
  C:\Windows\System\PhtoyyO.exe
  2⤵
  PID:12564
- C:\Windows\System\HuXHBJe.exe
  C:\Windows\System\HuXHBJe.exe
  2⤵
  PID:12584
- C:\Windows\System\cNRfges.exe
  C:\Windows\System\cNRfges.exe
  2⤵
  PID:12604
- C:\Windows\System\CXlfOeV.exe
  C:\Windows\System\CXlfOeV.exe
  2⤵
  PID:12636
- C:\Windows\System\rlaKnum.exe
  C:\Windows\System\rlaKnum.exe
  2⤵
  PID:12656
- C:\Windows\System\LvXDbqq.exe
  C:\Windows\System\LvXDbqq.exe
  2⤵
  PID:12680
- C:\Windows\System\SILreaU.exe
  C:\Windows\System\SILreaU.exe
  2⤵
  PID:12700
- C:\Windows\System\sxttyNi.exe
  C:\Windows\System\sxttyNi.exe
  2⤵
  PID:12724
- C:\Windows\System\WcodUHg.exe
  C:\Windows\System\WcodUHg.exe
  2⤵
  PID:12744
- C:\Windows\System\xviIifg.exe
  C:\Windows\System\xviIifg.exe
  2⤵
  PID:12764
- C:\Windows\System\WSCULqC.exe
  C:\Windows\System\WSCULqC.exe
  2⤵
  PID:12784
- C:\Windows\System\HUfBVmB.exe
  C:\Windows\System\HUfBVmB.exe
  2⤵
  PID:12804
- C:\Windows\System\DvkEWbK.exe
  C:\Windows\System\DvkEWbK.exe
  2⤵
  PID:12824
- C:\Windows\System\SZWPJpG.exe
  C:\Windows\System\SZWPJpG.exe
  2⤵
  PID:12848
- C:\Windows\System\qRpyXYU.exe
  C:\Windows\System\qRpyXYU.exe
  2⤵
  PID:12864
- C:\Windows\System\rICQeEQ.exe
  C:\Windows\System\rICQeEQ.exe
  2⤵
  PID:12880
- C:\Windows\System\LoLIklq.exe
  C:\Windows\System\LoLIklq.exe
  2⤵
  PID:12896
- C:\Windows\System\ECdvqPk.exe
  C:\Windows\System\ECdvqPk.exe
  2⤵
  PID:12912
- C:\Windows\System\ASyiOfc.exe
  C:\Windows\System\ASyiOfc.exe
  2⤵
  PID:12928
- C:\Windows\System\xHNlyyz.exe
  C:\Windows\System\xHNlyyz.exe
  2⤵
  PID:10800
- C:\Windows\System\kpODcZm.exe
  C:\Windows\System\kpODcZm.exe
  2⤵
  PID:12272
- C:\Windows\System\WXREoME.exe
  C:\Windows\System\WXREoME.exe
  2⤵
  PID:10552
- C:\Windows\System\LnGDibx.exe
  C:\Windows\System\LnGDibx.exe
  2⤵
  PID:11492
- C:\Windows\System\aCAFOUN.exe
  C:\Windows\System\aCAFOUN.exe
  2⤵
  PID:10760
- C:\Windows\System\dGVcaxN.exe
  C:\Windows\System\dGVcaxN.exe
  2⤵
  PID:12236
- C:\Windows\System\xLCQqzL.exe
  C:\Windows\System\xLCQqzL.exe
  2⤵
  PID:9676
- C:\Windows\System\HbjbpzI.exe
  C:\Windows\System\HbjbpzI.exe
  2⤵
  PID:9800
- C:\Windows\System\HxpuBkn.exe
  C:\Windows\System\HxpuBkn.exe
  2⤵
  PID:12908
- C:\Windows\System\hObjQPm.exe
  C:\Windows\System\hObjQPm.exe
  2⤵
  PID:11536
- C:\Windows\System\RDLrYUU.exe
  C:\Windows\System\RDLrYUU.exe
  2⤵
  PID:12552
- C:\Windows\System\tfiFglt.exe
  C:\Windows\System\tfiFglt.exe
  2⤵
  PID:11160
- C:\Windows\System\ShBRKpI.exe
  C:\Windows\System\ShBRKpI.exe
  2⤵
  PID:12056
- C:\Windows\System\RxeQicW.exe
  C:\Windows\System\RxeQicW.exe
  2⤵
  PID:10976
- C:\Windows\System\CfsSjCw.exe
  C:\Windows\System\CfsSjCw.exe
  2⤵
  PID:9584
- C:\Windows\System\xtChwOg.exe
  C:\Windows\System\xtChwOg.exe
  2⤵
  PID:12888
- C:\Windows\System\lAURTVK.exe
  C:\Windows\System\lAURTVK.exe
  2⤵
  PID:10592
- C:\Windows\System\sHhWgaD.exe
  C:\Windows\System\sHhWgaD.exe
  2⤵
  PID:8904
- C:\Windows\System\bMDjbdk.exe
  C:\Windows\System\bMDjbdk.exe
  2⤵
  PID:312
- C:\Windows\System\KLPCHvU.exe
  C:\Windows\System\KLPCHvU.exe
  2⤵
  PID:13224
- C:\Windows\System\tkBYNJk.exe
  C:\Windows\System\tkBYNJk.exe
  2⤵
  PID:12376
- C:\Windows\System\idavMNT.exe
  C:\Windows\System\idavMNT.exe
  2⤵
  PID:12460
- C:\Windows\System\gackEao.exe
  C:\Windows\System\gackEao.exe
  2⤵
  PID:11872
- C:\Windows\System\kXCUSjK.exe
  C:\Windows\System\kXCUSjK.exe
  2⤵
  PID:11832
- C:\Windows\System\ACANTEp.exe
  C:\Windows\System\ACANTEp.exe
  2⤵
  PID:13212
- C:\Windows\System\NmdOabj.exe
  C:\Windows\System\NmdOabj.exe
  2⤵
  PID:8320
- C:\Windows\System\aBSyPhG.exe
  C:\Windows\System\aBSyPhG.exe
  2⤵
  PID:11324
- C:\Windows\System\yYSuMRV.exe
  C:\Windows\System\yYSuMRV.exe
  2⤵
  PID:12844
- C:\Windows\System\boiuVrP.exe
  C:\Windows\System\boiuVrP.exe
  2⤵
  PID:12948
- C:\Windows\System\SUVySHG.exe
  C:\Windows\System\SUVySHG.exe
  2⤵
  PID:12708
- C:\Windows\System\MsXqiKZ.exe
  C:\Windows\System\MsXqiKZ.exe
  2⤵
  PID:9508
- C:\Windows\System\zooMcEz.exe
  C:\Windows\System\zooMcEz.exe
  2⤵
  PID:8040
- C:\Windows\System\IavfNOP.exe
  C:\Windows\System\IavfNOP.exe
  2⤵
  PID:11476
- C:\Windows\System\LsgDBtV.exe
  C:\Windows\System\LsgDBtV.exe
  2⤵
  PID:13200
- C:\Windows\System\tHTRjLC.exe
  C:\Windows\System\tHTRjLC.exe
  2⤵
  PID:8496
- C:\Windows\System\HZPOJTS.exe
  C:\Windows\System\HZPOJTS.exe
  2⤵
  PID:2956
- C:\Windows\System\PUhrtZh.exe
  C:\Windows\System\PUhrtZh.exe
  2⤵
  PID:11532
- C:\Windows\System\PTEmqFf.exe
  C:\Windows\System\PTEmqFf.exe
  2⤵
  PID:10824
- C:\Windows\System\apBWouR.exe
  C:\Windows\System\apBWouR.exe
  2⤵
  PID:13036
- C:\Windows\System\juiGEUW.exe
  C:\Windows\System\juiGEUW.exe
  2⤵
  PID:13192
- C:\Windows\System\jRshTLj.exe
  C:\Windows\System\jRshTLj.exe
  2⤵
  PID:12136
- C:\Windows\System\UtuxIAK.exe
  C:\Windows\System\UtuxIAK.exe
  2⤵
  PID:11560
- C:\Windows\System\LkbENdj.exe
  C:\Windows\System\LkbENdj.exe
  2⤵
  PID:9872
- C:\Windows\System\gEilydR.exe
  C:\Windows\System\gEilydR.exe
  2⤵
  PID:11848
- C:\Windows\System\tYgmRcY.exe
  C:\Windows\System\tYgmRcY.exe
  2⤵
  PID:10248
- C:\Windows\System\dYPQaTt.exe
  C:\Windows\System\dYPQaTt.exe
  2⤵
  PID:4844
- C:\Windows\System\NpYusMg.exe
  C:\Windows\System\NpYusMg.exe
  2⤵
  PID:11768
- C:\Windows\System\dmXqSGS.exe
  C:\Windows\System\dmXqSGS.exe
  2⤵
  PID:12400
- C:\Windows\System\LMutiWP.exe
  C:\Windows\System\LMutiWP.exe
  2⤵
  PID:11800
- C:\Windows\System\SLxMcbc.exe
  C:\Windows\System\SLxMcbc.exe
  2⤵
  PID:13188
- C:\Windows\System\KweqGeX.exe
  C:\Windows\System\KweqGeX.exe
  2⤵
  PID:12180
- C:\Windows\System\ubUlGdZ.exe
  C:\Windows\System\ubUlGdZ.exe
  2⤵
  PID:13096
- C:\Windows\System\THhsOrF.exe
  C:\Windows\System\THhsOrF.exe
  2⤵
  PID:12120
- C:\Windows\System\UdQyueQ.exe
  C:\Windows\System\UdQyueQ.exe
  2⤵
  PID:10012
- C:\Windows\System\yOSuXUU.exe
  C:\Windows\System\yOSuXUU.exe
  2⤵
  PID:13112
- C:\Windows\System\QWYQdUD.exe
  C:\Windows\System\QWYQdUD.exe
  2⤵
  PID:1956
- C:\Windows\System\flAcbSf.exe
  C:\Windows\System\flAcbSf.exe
  2⤵
  PID:4584
- C:\Windows\System\llwusZr.exe
  C:\Windows\System\llwusZr.exe
  2⤵
  PID:11356
- C:\Windows\System\WReWnDg.exe
  C:\Windows\System\WReWnDg.exe
  2⤵
  PID:3204
- C:\Windows\System\nbvxSub.exe
  C:\Windows\System\nbvxSub.exe
  2⤵
  PID:2732
- C:\Windows\System\LKZtUJg.exe
  C:\Windows\System\LKZtUJg.exe
  2⤵
  PID:5684
- C:\Windows\System\gObJmPw.exe
  C:\Windows\System\gObJmPw.exe
  2⤵
  PID:12892
- C:\Windows\System\ysMbEpU.exe
  C:\Windows\System\ysMbEpU.exe
  2⤵
  PID:13304
- C:\Windows\System\FkDixkj.exe
  C:\Windows\System\FkDixkj.exe
  2⤵
  PID:10344
- C:\Windows\System\VZyzpHr.exe
  C:\Windows\System\VZyzpHr.exe
  2⤵
  PID:4600
- C:\Windows\System\jPwedpZ.exe
  C:\Windows\System\jPwedpZ.exe
  2⤵
  PID:13476
- C:\Windows\System\UnVPnGS.exe
  C:\Windows\System\UnVPnGS.exe
  2⤵
  PID:13500
- C:\Windows\System\KjnlJXL.exe
  C:\Windows\System\KjnlJXL.exe
  2⤵
  PID:13604
- C:\Windows\System\WTjFygA.exe
  C:\Windows\System\WTjFygA.exe
  2⤵
  PID:13628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dvutq3tk.w2u.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AfICndt.exe

Filesize
1.9MB

MD5
6caabb0fc4f20a79e37f09abbe0521b8

SHA1
2ee42105a4c0103b67527dcbf1654990501fceae

SHA256
d2940348a439e33ffa028583bcf92cd9347a8fa5d4488cfb3f061c7676bef14e

SHA512
6f0b36c60b32fa59b0afda3ac1ba119194fdb05edf33613782d400f45bcbefb3453fe949a7e387ddf3d642813373fe372ff8325d6c125fff2c1374ef9809bed6

Download Submit
C:\Windows\System\CcKlxVU.exe

Filesize
1.9MB

MD5
9b67aef98f3b2eedf6ee28926d0921b1

SHA1
18fcd678bdebf9743863bf242cb093ed30066bc8

SHA256
1763ca2b8e00679ab54b1b21b7437e2e8ba4fa5d59f004d74829171305167b7e

SHA512
4543ecdc0890e5855e3cd9d14221f3d94da133bb97923799201c6e41d27e90f0e0e4a1726aea314de227be157a38cd12396dbb78e381b7f654ffdf98734cb77b

Download Submit
C:\Windows\System\CkUzitf.exe

Filesize
1.9MB

MD5
6beb0a1cf1380400392aeb1a01e96fe9

SHA1
67eeba0fa85ae74eb685344e3eb0e6ce4ba2a59d

SHA256
0c77ced5e953fb6ab26129635130bf6b6a077ebdc59918821e90ee9f0a81b12f

SHA512
f8ce70233c6902aff6f3e64ecb3969eaab40205f61fa06622193dacfc7b3adaa4f164b7345d54743afd2332e7553401609a725ed22dfbd2f829691402ce03927

Download Submit
C:\Windows\System\EbwzKvt.exe

Filesize
1.9MB

MD5
75e789b7594816b8ba6fd2696e521114

SHA1
f5d78b3c32c1170058563bb649d44f7e2cc04519

SHA256
ab4c567e0c5aaa36c94913427302af22aab455aea075f14bbaed404376f51909

SHA512
71fc4ea365089861b53e8bd1451a7f370a2dbbbc93e6a3fa2cb915f1677e2a659aae6874a4d84a889e5bea8e0735beaf78fe771586248861075efa4cc06eb303

Download Submit
C:\Windows\System\EjFLaed.exe

Filesize
1.9MB

MD5
70c6d9664106546d3ac16204d82e248d

SHA1
f2b0909174a1d7b6ccca30f7385f6fa5b5d4734b

SHA256
00f8309627cbf2c18797b465f30e8c5f679bd8e80a024471e1ce066884b05e43

SHA512
4369f974728678bc725acfe21b4b35f57ebc06372e3a908e810fd05ad185ace3c6f54bd57b5a5fc204e3e67d78c2fc72eea1a412c2af54043826027f5190cfc8

Download Submit
C:\Windows\System\GnPKyIQ.exe

Filesize
1.9MB

MD5
824c65bdd9a3f15a86f8b8294ffa42df

SHA1
8bdf0de34dfeb28b224146c38cef7e709b236973

SHA256
ad555ad084849d174d9fa13e78fb1deb46025db79ca9a7b6519b1fbdb74682a2

SHA512
268041947c62bf68e12dda16245dfe0ff2bcd83dfad217b6ec97a40f9b6eb621274a52b2c85cc9453ac6052ffbad0bebc6f73ba76995cfd52f6004a3a823e8e3

Download Submit
C:\Windows\System\IUQBDSa.exe

Filesize
1.9MB

MD5
c0ab2831211a77fb8753a69c814fa1c6

SHA1
725c064a6d01f83a0c33fb6be416d76b91b9cf5d

SHA256
9539036a1597b67d9a3efec135bf34a7e6bc8d9c5745371578757d5c1959f708

SHA512
3a08edb4e5100163993e6a2583547dc439c7c259ef1370e5c114f92cadee9983d8a32b0836cde076da22d95fc1161dbdf9b5d21969e134b56afe7f125fba2ff0

Download Submit
C:\Windows\System\JbdcbWp.exe

Filesize
1.9MB

MD5
0ccda791ded8a3a433475faee277700e

SHA1
42d307846b8decefc688c51557c32ad74d6f0bc3

SHA256
0e66dde8955475298247f00ae14c751dd663a0fc575d2327a2271e5e552abe7e

SHA512
b24d3d72bd75faeeab41bbfc01e5e0766fe749fd477fda915f3c5243bfe97040321f34fca5c58842e1500edc20d98197eb91f17a7e5fa5a29a76c41c7420179c

Download Submit
C:\Windows\System\JmNpYYy.exe

Filesize
1.9MB

MD5
611b24fb8f646fdee8c32024b339c262

SHA1
a7adc47bd16aea22bffa2ac5c506a0014c7f0064

SHA256
214f8d229a8d55a878ab8d2176f318af01cfe2d970f3b314629f08d9d5266730

SHA512
7407ff8518e2adbba6822f6885f0c3f41f5ab3ab2db25cd2b6af3eba6777b65588761f45df442467cfbaf1d4fd903ff08e3f53240fe36aa5c0f9a2e331fb6227

Download Submit
C:\Windows\System\LTBdxiD.exe

Filesize
1.9MB

MD5
f25c17e6434afcdc6a9d6a8af3f324a8

SHA1
37c4673e30ff5230d8544911dde1fb4249bc2486

SHA256
969d37fab9de33584fc5a72bde2c26f00dfada39ac69e8a3b925fc7db7a37af8

SHA512
e28e4065ce0bed2907b1ec79405bac60755ac4d377e2aacec6a48e5aa517eae42d03f4640fa62c32bcb010e40cc464612d6b3137a00af1c2dcaf0bfce72b7abf

Download Submit
C:\Windows\System\MxDLGDP.exe

Filesize
1.9MB

MD5
8d3a995848f7e26bd0cf13a3e26dba37

SHA1
179dc41743d87d87ac28b5f51ca848f662e396cb

SHA256
0b7fd1b05791532e8c8ca5986af5c930719ddf19b0a118acc938e19760134528

SHA512
9f25143d7c4d0779e81973797bbc945e7a4868b6ed6b267b348591b1a0da4b148018a906d20d39c35b08b809f62a2d7220aed113a3cf0b196a886767b600fe47

Download Submit
C:\Windows\System\NgyfnYQ.exe

Filesize
1.9MB

MD5
3064219dd402d46d32a34ac947727a3c

SHA1
bbc556cd35884a6ee5c1568f13ca4b78e9b6f84c

SHA256
a91af41d3c5ef575a7292642aa74083fc9c720e13485aaa73774bd1708b6dbf6

SHA512
5aad553b311818d94027da13e663f74a2ec0ce2af739a380793fc4f4b82775360384b07fac19a8ade1fefefc47e10f683790aed7e9684b37af3239b284672a9d

Download Submit
C:\Windows\System\ORdMVmJ.exe

Filesize
1.9MB

MD5
5258da836e125ed38f95489e1f3b8e9b

SHA1
4d8ee6b8ae976704f168a402485366861316dce2

SHA256
1566d86ae6257712e3bf98f9ecf4e34056c7e11910955246b847fed2bf18886d

SHA512
b35cb476ee8718771a510a53cfc805c12a3308fc00943bcecc6c446970ac27f0cf67e38a79238e17ead18e32ec698032ac93244d1231966379f9eb9504a17302

Download Submit
C:\Windows\System\PHkAgqF.exe

Filesize
1.9MB

MD5
b4420d00034384e041239edf2ed4c380

SHA1
c7ab4d7957e8cbd6b422736e3b2a35f0b6fc6537

SHA256
a6b527ea27c562c7d7bcc416f1daf9247b9f6ea1f81e9629b7bf0f0db6fb0f76

SHA512
6d1e144e5c45bb399cb4f7ad5fccafa1ebe3da1aa4a4837a82823ba5d0064c21a2b255fbfabce81f7246e0d2495ab061de64ad8156ceac9aebb4e8d9c645cde0

Download Submit
C:\Windows\System\SlienZH.exe

Filesize
1.9MB

MD5
a9e7a4b308dea765991ecd6fedf3fc01

SHA1
d079108f6fc121ebbf14999ee3f75ef374d5a124

SHA256
2892d32ffc8f902b543ace7ecb1377ae59ff4e7dfb975ec6a8595564696712cf

SHA512
94a56ef520eb211a3d177775ce8f3eeb95c641fd4612e33be69eacb0dcc5d2ccd656ba3c6341a22d0a2fe6cd45b70404ff261d08ff1e712e123ee2e0b667da3e

Download Submit
C:\Windows\System\VMpPxjP.exe

Filesize
1.9MB

MD5
2939f236dc7aa1703991811c7bc4eb81

SHA1
c5d5211aa393ea988afb0815480010045ae78f37

SHA256
b0b3bf3c39c9d2b8eefdac0d76fcbce6f0062d4ee36be9d695fcc6b58aa13020

SHA512
4a21a960f52c9ebbaa6a87937063194f172b09dfc07ff2e8b09241e792508f230abbecd67bc61c3d91c8c861ed045517fe858a40dc909f41844f25f68754b359

Download Submit
C:\Windows\System\WQiBFjg.exe

Filesize
1.9MB

MD5
4de2af48177a024ccf5b939e91945a9e

SHA1
764dac28cbcbc25c4fa86e57fa164e407a060119

SHA256
53051d3f7f4b14bbcbc031f4b30e2b3b44841bfacacaa6993fac1bfcdb4e516a

SHA512
045a35dac29814075778ee95e91eada3b4587c8472b78e27fb1eba59d0236b72496f3f99f7247fc328c81488c277833293d5a6b7c5d6b5dd33ccc912336039b0

Download Submit
C:\Windows\System\WewOxYP.exe

Filesize
1.9MB

MD5
854fd7c5f0e147bbadcca47b3ac3ac3d

SHA1
7466216c780b17000e449b3b7a5a221b20159c73

SHA256
2a475b173b1192d33d27e464ddb2b286f2bdcf789ac546814dd474561d4bac54

SHA512
775eae92de8285e13acfd7ffd20b35e0d154ad317c47c8216ddd29d0a0d6e4c1600a69b2a3b4ac241e8ef19b243dd3879dc1dff346d49f2bbb3b4c777f24e509

Download Submit
C:\Windows\System\WmSNOWt.exe

Filesize
1.9MB

MD5
a17e7e5d16a9c58002a5986303f8b72a

SHA1
aea6be19c373f5a52341adfc3f2832530806676c

SHA256
598828a553190f160c6ae606915eca7c8aff9bf7d6c561deea1c8a6a1eeb23ed

SHA512
46a4972b6ba15da8c285468556d0371c50ca691fec57b7a291a34b58aea40ee572b2b5087b803492cfc87a9fcfc78fa15f47b96fa67fc62ac6fc314bfa0936d7

Download Submit
C:\Windows\System\ZZGSVEn.exe

Filesize
1.9MB

MD5
8935931fdc82375f884b2cca1249f5d9

SHA1
62dadd27f6740215e68090bdf239f23d7ae8af68

SHA256
b1d17eafd11529d447106ab170fec3d24d96a2576c0235e904bc3e4ee58e1a74

SHA512
ee612771a4e546db64a43982f94e22ba5bc14f1e59349f82dd562419649de3af472eb37e9f8a81e481a35f16896b369298685495064296b624bdfaa0b93ee16f

Download Submit
C:\Windows\System\bqCparU.exe

Filesize
1.9MB

MD5
8def7c2651e8b8b4bd1a24a63dd49fe9

SHA1
6647379ec325420cfc7c896855e4045b4ac2401d

SHA256
9a947d82d247cf53b8626ae39efbc8e907cbcd3b5a81bdb22a0c4ac2d449dc21

SHA512
cfdc87e299133ab9ea212258b2f07eb6bc745eaa26c409b975dfaaa02b9228bef1dce74daa2baa7674d29445436633e68e83a38318b48b58be99313f8756e88c

Download Submit
C:\Windows\System\dfKHqkB.exe

Filesize
1.9MB

MD5
602e4155fc7b41e2732ed065b1270897

SHA1
fee8c7405983f21442a711311edddf8d8a4fad55

SHA256
5621f53f5424f51c60630af133dfefe22b98a0864c25db6c3b4d5952065cd2bf

SHA512
9e074a4cf4501b60c42788c595a2e22c43f242420b528d3aa449ca8069e20180344ef87e83beebe62295252b19b0bd322289e3f6d84bebd23e0fae4950de2d56

Download Submit
C:\Windows\System\ecJYLpN.exe

Filesize
1.9MB

MD5
5b91ee8fbca0f8c4fb8522d4c61560ab

SHA1
7b0ed1200d3908a9e13b506ab924d04e103801dd

SHA256
a1cf5d6244157f9ea6dc2117946af94b9937b1f2a69345081a917b02bd17a330

SHA512
50ddf46d52eb4a4f4289570a04d4712bc4856fa99517160a0d9b80de545eddbceb6f3e512ef97373bd9867c14ba2015e5418172b0cd7e588ce1e363d0b1f080f

Download Submit
C:\Windows\System\fxbHLUU.exe

Filesize
1.9MB

MD5
6ba026917c366bb7b9d7e3d0b79961e6

SHA1
7249855cda30457e393158b977fd37911017924a

SHA256
a86a983b5ed6969e008deac5e68eb676e1a82e3e222f4d061fc2c5a696aabb7f

SHA512
0588b12f9859230564e89668c23b06cc03da11fed3025ef302d770f3494acd00e6b172d1ce2c3516b7eb282ca769c1e323548d3e7ac2aecf0094cc56a231deef

Download Submit
C:\Windows\System\gLTqyUa.exe

Filesize
1.9MB

MD5
87b55be07f6993bc295fd68fab238219

SHA1
0429fbe12407de88946157812ca3f93b9d49cf6f

SHA256
804c0b9c85776c9bb054e96c697871f71514233587025e9612f53c83db451fec

SHA512
1fed89d2c9160dfeb44ea03019d3874f5539481fceab240945a1fe6d7991c6b6a857ed58cf7932b5bdc44df48324405525ed878fb608432a86588e56ed8af41c

Download Submit
C:\Windows\System\hHROVwl.exe

Filesize
1.9MB

MD5
39da31d8e5a96957444c7c761d531590

SHA1
0fc0dd714b87199865bb9de42243b19422525d2f

SHA256
1fb16d61c8f9279d8a81a33e34868569db036706a76d9778a2d055beac516f46

SHA512
85a2fa1c68f5fb546408cc4deef62eff17a3887069793faf2a627fd1d3d74900809b09365014b4a2066018b6471f7902e1c26c41b2eb42f7508e2049134c8779

Download Submit
C:\Windows\System\hShSqvu.exe

Filesize
1.9MB

MD5
f80017d35aaff866cef3e87e0c2f08a8

SHA1
dbe372ef711881828076ea466fb5372016b5edb3

SHA256
1b40f946b3e8b10fc5d1f6c24464ffee39a7990d4b59e513b7d72f43449ef3ca

SHA512
f6188270da8773d6334d96f0feee5353b0f0e36400dee6caa4a8d875639737f86853309d445cc8aaebb4c69120fe6a10ebaa1be606017b004943c2ce675d921d

Download Submit
C:\Windows\System\jwmdRpx.exe

Filesize
1.9MB

MD5
7b61c7c0f17c8caed8c2c648b364b9fd

SHA1
ed685bd3e41f520c7ac3fee0ad475a72cc36a31d

SHA256
d783c6b3e516cf55f814fa6269f7caffb7bb92161a6e090e925bd93c31db265c

SHA512
b2263aa17f605fae929413bac7420ac104d4e33e9aab692bb1d471e8909e59f1c16c5afe1f1b584320dc9658642920c484ee0459fb749f3ca6a76c1662bc7daf

Download Submit
C:\Windows\System\kmbZtoq.exe

Filesize
1.9MB

MD5
6d4f60392add5550e3caf1d030947abd

SHA1
798b132916a794e990f3f1f524782c13a736e1cf

SHA256
eedc095222efd1353bc6c9eb9d6f3f08a061979eb9dad29a4c6cdf707436c36b

SHA512
e2ac4b7996bbb28d9962682ec79802653c670c8a37fc65cd8f671be1d728d30da9d057741a8d42843f2be330f405d3238b6eeec40532cea9cec5e7795b4ad823

Download Submit
C:\Windows\System\nlKAiLR.exe

Filesize
8B

MD5
3277aa72bb7d7f1eb1043502fbd1c406

SHA1
8712dca2f3fbc82bf0cbbeecdc5d6a26c87f443c

SHA256
e94b62f30c9ce8b0b5cea14d4367a52fe08005d1bd56ca932a1fd7fc15c61bc9

SHA512
9fb0369549dba8937fb796cbc4ade6bacf540f10f98e02675f1b04c615cbb49e396cdbd25cd29de56c7bfb889c8464199939a84fa31434a75c020caeb4f9f503

Download Submit
C:\Windows\System\qFRjFwU.exe

Filesize
1.9MB

MD5
dc0ab216486ef6ed72609b7382f7475b

SHA1
12b9d27fe80c404e4e6dc79455749437a3482409

SHA256
b0441e52e9b3f7a10afb28bec1c43cda8824ea5dcec541339ba4b34a715436fa

SHA512
8cd9a7c8debdf9aecf820cadfc3f2272e83e3525c8e2e963f4a8810a899f02a01532fda3f991f5c78e34042d29214622e0796a47f120b66a835e5d96d39ef2f7

Download Submit
C:\Windows\System\qokNEvh.exe

Filesize
1.9MB

MD5
acbd723e549e66b39701881abb71fdf9

SHA1
6915d9b4c3947d792200e4529194ce5374212705

SHA256
7727a350fd8ba536b00942385422e129b4be718ed1e5901bb39ff3a5a370ff61

SHA512
5bfd4c408184076932c62483794441f13c177299ffb4aeddc82e967bb7c21e5981ff13b7db1b6dbaed2cbddec42668236e54ce2946ccd2fdc7d3f47838a3fd32

Download Submit
C:\Windows\System\rTyouRh.exe

Filesize
1.9MB

MD5
6845cbe6fc05b877a895c0f38ae6ee64

SHA1
81077c570b32f3291a944848080a9e67db695006

SHA256
6abb92121b4d0ae9576126e9e6f1ff9ae53a1a7393897501e95cbc1f6ccaa36e

SHA512
7592ad2d935d39efef2807128a534f39dea491a2d1366a5cd087142b009ae95f0c6be9316850c26e881e7261ce884c075c7e9509d3f7276d4e31e5344cca49a8

Download Submit
C:\Windows\System\spSBwCU.exe

Filesize
1.9MB

MD5
66cc79ac33da7cf2c1eff2a63dfc4d8c

SHA1
4477ffd477c3dcefd28095321cd38907d6d1b91a

SHA256
137b602a193666527a14468c50e90088a5f5f8593bbaf78e0f658de96fc494fa

SHA512
ac9d7d0770e36346222f847ea6d0437b9ad9af7c817eeb6ec6bbf138ddbae8220283ca09d14dcfef94f957c0090c586d7fee2d87bf6ddeed44da206f1b95b54a

Download Submit
C:\Windows\System\tsyZmoq.exe

Filesize
1.9MB

MD5
7bceb6eb984da1dd4dffa2fe966b5b3a

SHA1
3fe5bf91c99b5c56be9ea396287aa65987b6355f

SHA256
345711b4a3d80aaf29f86e7888e40a90861f33da9b1cc70d01dab49351ca3f93

SHA512
524fadb45ebe22e71399aa4f6cc3c00a1a5fe408c912616d70e2936147d0c3ea6290a2df0aafb88cd9d443931ce15c697edf2dc60c49d15bdd06c115e07f2ed7

Download Submit
C:\Windows\System\wSRjjNo.exe

Filesize
1.9MB

MD5
3591696abbc7cc79da383ad09e9c5360

SHA1
420422e0ae19c319c61e786fa27112726d4a1e6f

SHA256
72b76e8e7c1e2ade00e5f5e9e45740663ddd7704c1ec9b7c6d446c3f04871330

SHA512
b2be03edc8c57f4f7e4c21152b54fc9446ce9e288145b8747a9d10b817b6e64593e3de2e8a08a8d0ff99648d7d3b478310afe6c91713d970a1fe596ba140866e

Download Submit
C:\Windows\System\xlkdxAH.exe

Filesize
1.9MB

MD5
ba53ae3f5cfd22db05f3b43da3919bd8

SHA1
98388c8bf556b57115fce01784314a75fdbd32f2

SHA256
dccd7a4f183a9d162f9b32053678c707b54ccc89efef8cdc97f9ee6efdca5253

SHA512
56487e4d9362f7321975ae551e1c54b45c8b2e496b7837c055144978a88eb9900a8752c94b68c0dc4e4231480774602c5140b75502f1881248fbe88628838422

Download Submit
C:\Windows\System\yFCpVPP.exe

Filesize
1.9MB

MD5
32c9cd5063c34e94dd131c475bda7efe

SHA1
6b05a03fcf4767367d73362e30281b9420dcc306

SHA256
e16562e393058d37c44b3c67df86a45f1fe17aba32818178fcf6b08d97295a53

SHA512
d7d12d9a00de9d6190d4df6495bf56ea52ac3de9b067d0b0ff51abd1af0e77b079b6912936a5d6772c9bc2a98a1c9fee2f7a60fc618364227524cb4fde880eae

Download Submit
C:\Windows\System\yVgQwmK.exe

Filesize
1.9MB

MD5
71bf28904c63556ae20a72c87f88033a

SHA1
ebd2e193000a6ed71dc4e97621fc5d26918dfa65

SHA256
4779a7ecef28802cd3a0f9fa910e0670125fecdb60d5ee960f82febae0c0843a

SHA512
f5eedfee92672b94919ae9f67117885373b9b84fcb6b5819ac86be9bb314e40c4fdb0b7440ae70d0348e8849a24f0be07dd9411bdad8c738270d60b622ac1b54

Download Submit
C:\Windows\System\ycabDcF.exe

Filesize
1.9MB

MD5
7d960e28c8f4aa4158bdcc230a1be9ad

SHA1
4638b45169666590dd58d3b5f2baca8d93b5a76b

SHA256
d508dba774f635af0444d328f9ba4e957b6268a0dd0b827121d874ce41013754

SHA512
9f4ff31164c330c1246e96101c1097be643c7fe9740cf3037061f85330fdc5b3e869b75fe28eb336190d8920941923889f19ee8470ad4d03a1acb8708890db86

Download Submit
memory/116-0-0x00007FF721670000-0x00007FF721A62000-memory.dmp

Filesize
3.9MB

Download
memory/116-1-0x00000276EBF00000-0x00000276EBF10000-memory.dmp

Filesize
64KB

Download
memory/400-3609-0x00007FF664940000-0x00007FF664D32000-memory.dmp

Filesize
3.9MB

Download
memory/400-368-0x00007FF664940000-0x00007FF664D32000-memory.dmp

Filesize
3.9MB

Download
memory/1184-3610-0x00007FF71D7D0000-0x00007FF71DBC2000-memory.dmp

Filesize
3.9MB

Download
memory/1184-326-0x00007FF71D7D0000-0x00007FF71DBC2000-memory.dmp

Filesize
3.9MB

Download
memory/1188-369-0x00007FF69D590000-0x00007FF69D982000-memory.dmp

Filesize
3.9MB

Download
memory/1188-3572-0x00007FF69D590000-0x00007FF69D982000-memory.dmp

Filesize
3.9MB

Download
memory/1236-3619-0x00007FF7A96E0000-0x00007FF7A9AD2000-memory.dmp

Filesize
3.9MB

Download
memory/1236-372-0x00007FF7A96E0000-0x00007FF7A9AD2000-memory.dmp

Filesize
3.9MB

Download
memory/1412-58-0x00007FFF36220000-0x00007FFF36CE1000-memory.dmp

Filesize
10.8MB

Download
memory/1412-193-0x000001E06C2B0000-0x000001E06C2D2000-memory.dmp

Filesize
136KB

Download
memory/1412-62-0x000001E06BE00000-0x000001E06BE10000-memory.dmp

Filesize
64KB

Download
memory/1600-3603-0x00007FF787FC0000-0x00007FF7883B2000-memory.dmp

Filesize
3.9MB

Download
memory/1600-257-0x00007FF787FC0000-0x00007FF7883B2000-memory.dmp

Filesize
3.9MB

Download
memory/2440-3591-0x00007FF7A4B30000-0x00007FF7A4F22000-memory.dmp

Filesize
3.9MB

Download
memory/2440-348-0x00007FF7A4B30000-0x00007FF7A4F22000-memory.dmp

Filesize
3.9MB

Download
memory/2820-3605-0x00007FF646450000-0x00007FF646842000-memory.dmp

Filesize
3.9MB

Download
memory/2820-370-0x00007FF646450000-0x00007FF646842000-memory.dmp

Filesize
3.9MB

Download
memory/3232-3606-0x00007FF6674C0000-0x00007FF6678B2000-memory.dmp

Filesize
3.9MB

Download
memory/3232-178-0x00007FF6674C0000-0x00007FF6678B2000-memory.dmp

Filesize
3.9MB

Download
memory/3256-265-0x00007FF788F40000-0x00007FF789332000-memory.dmp

Filesize
3.9MB

Download
memory/3256-3584-0x00007FF788F40000-0x00007FF789332000-memory.dmp

Filesize
3.9MB

Download
memory/3448-3589-0x00007FF664610000-0x00007FF664A02000-memory.dmp

Filesize
3.9MB

Download
memory/3448-226-0x00007FF664610000-0x00007FF664A02000-memory.dmp

Filesize
3.9MB

Download
memory/3520-86-0x00007FF706A70000-0x00007FF706E62000-memory.dmp

Filesize
3.9MB

Download
memory/3520-3578-0x00007FF706A70000-0x00007FF706E62000-memory.dmp

Filesize
3.9MB

Download
memory/3552-3593-0x00007FF6FCD30000-0x00007FF6FD122000-memory.dmp

Filesize
3.9MB

Download
memory/3552-357-0x00007FF6FCD30000-0x00007FF6FD122000-memory.dmp

Filesize
3.9MB

Download
memory/3696-362-0x00007FF611F70000-0x00007FF612362000-memory.dmp

Filesize
3.9MB

Download
memory/3696-3595-0x00007FF611F70000-0x00007FF612362000-memory.dmp

Filesize
3.9MB

Download
memory/3988-3597-0x00007FF75A6C0000-0x00007FF75AAB2000-memory.dmp

Filesize
3.9MB

Download
memory/3988-311-0x00007FF75A6C0000-0x00007FF75AAB2000-memory.dmp

Filesize
3.9MB

Download
memory/4244-3582-0x00007FF639AB0000-0x00007FF639EA2000-memory.dmp

Filesize
3.9MB

Download
memory/4244-258-0x00007FF639AB0000-0x00007FF639EA2000-memory.dmp

Filesize
3.9MB

Download
memory/4260-297-0x00007FF7B97B0000-0x00007FF7B9BA2000-memory.dmp

Filesize
3.9MB

Download
memory/4260-3599-0x00007FF7B97B0000-0x00007FF7B9BA2000-memory.dmp

Filesize
3.9MB

Download
memory/4428-3580-0x00007FF7F74A0000-0x00007FF7F7892000-memory.dmp

Filesize
3.9MB

Download
memory/4428-121-0x00007FF7F74A0000-0x00007FF7F7892000-memory.dmp

Filesize
3.9MB

Download
memory/4432-325-0x00007FF7845C0000-0x00007FF7849B2000-memory.dmp

Filesize
3.9MB

Download
memory/4432-3587-0x00007FF7845C0000-0x00007FF7849B2000-memory.dmp

Filesize
3.9MB

Download
memory/4596-3576-0x00007FF608C50000-0x00007FF609042000-memory.dmp

Filesize
3.9MB

Download
memory/4596-118-0x00007FF608C50000-0x00007FF609042000-memory.dmp

Filesize
3.9MB

Download
memory/5072-361-0x00007FF6BF6C0000-0x00007FF6BFAB2000-memory.dmp

Filesize
3.9MB

Download
memory/5072-3601-0x00007FF6BF6C0000-0x00007FF6BFAB2000-memory.dmp

Filesize
3.9MB

Download
memory/5092-151-0x00007FF792D50000-0x00007FF793142000-memory.dmp

Filesize
3.9MB

Download
memory/5092-3574-0x00007FF792D50000-0x00007FF793142000-memory.dmp

Filesize
3.9MB

Download