xmrig | 89aa2636f404da59eec024847eea871b053e67d3e21d7362dee09713d36a895a

Analysis

max time kernel
70s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30-04-2024 21:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
Size

2.2MB
MD5

0a7bf12090cbd5142c9ecb87828cc52b
SHA1

75909b29d47db6a28ff91af018973145ccbd1cfb
SHA256

89aa2636f404da59eec024847eea871b053e67d3e21d7362dee09713d36a895a
SHA512

3810c4fd7811b3336847ac6af4cc351e548f91721c34199cdef9bd7226d257f2941f22d535b02a32542c48646fe83f24cd562fb3ea185a1834b943dae05ae750
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9cRbR:NAB7

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 42 IoCs

miner

resource	yara_rule
behavioral2/memory/4380-42-0x00007FF74AD70000-0x00007FF74B162000-memory.dmp	xmrig
behavioral2/memory/2900-189-0x00007FF74E7F0000-0x00007FF74EBE2000-memory.dmp	xmrig
behavioral2/memory/1252-228-0x00007FF7577D0000-0x00007FF757BC2000-memory.dmp	xmrig
behavioral2/memory/4476-235-0x00007FF616290000-0x00007FF616682000-memory.dmp	xmrig
behavioral2/memory/3344-243-0x00007FF78C960000-0x00007FF78CD52000-memory.dmp	xmrig
behavioral2/memory/4996-245-0x00007FF6C2150000-0x00007FF6C2542000-memory.dmp	xmrig
behavioral2/memory/4136-244-0x00007FF622AE0000-0x00007FF622ED2000-memory.dmp	xmrig
behavioral2/memory/2672-242-0x00007FF77CB60000-0x00007FF77CF52000-memory.dmp	xmrig
behavioral2/memory/1240-241-0x00007FF660D40000-0x00007FF661132000-memory.dmp	xmrig
behavioral2/memory/4872-240-0x00007FF6AD530000-0x00007FF6AD922000-memory.dmp	xmrig
behavioral2/memory/2312-239-0x00007FF668240000-0x00007FF668632000-memory.dmp	xmrig
behavioral2/memory/3832-238-0x00007FF6714D0000-0x00007FF6718C2000-memory.dmp	xmrig
behavioral2/memory/3204-225-0x00007FF619100000-0x00007FF6194F2000-memory.dmp	xmrig
behavioral2/memory/2424-213-0x00007FF7ECDB0000-0x00007FF7ED1A2000-memory.dmp	xmrig
behavioral2/memory/4356-188-0x00007FF6B9AB0000-0x00007FF6B9EA2000-memory.dmp	xmrig
behavioral2/memory/1620-179-0x00007FF768610000-0x00007FF768A02000-memory.dmp	xmrig
behavioral2/memory/1580-168-0x00007FF7149C0000-0x00007FF714DB2000-memory.dmp	xmrig
behavioral2/memory/5044-133-0x00007FF7DF0C0000-0x00007FF7DF4B2000-memory.dmp	xmrig
behavioral2/memory/3808-96-0x00007FF722E50000-0x00007FF723242000-memory.dmp	xmrig
behavioral2/memory/312-73-0x00007FF7BC140000-0x00007FF7BC532000-memory.dmp	xmrig
behavioral2/memory/3932-72-0x00007FF7859B0000-0x00007FF785DA2000-memory.dmp	xmrig
behavioral2/memory/3932-2668-0x00007FF7859B0000-0x00007FF785DA2000-memory.dmp	xmrig
behavioral2/memory/2672-2670-0x00007FF77CB60000-0x00007FF77CF52000-memory.dmp	xmrig
behavioral2/memory/4380-2672-0x00007FF74AD70000-0x00007FF74B162000-memory.dmp	xmrig
behavioral2/memory/1580-2674-0x00007FF7149C0000-0x00007FF714DB2000-memory.dmp	xmrig
behavioral2/memory/5044-2676-0x00007FF7DF0C0000-0x00007FF7DF4B2000-memory.dmp	xmrig
behavioral2/memory/312-2678-0x00007FF7BC140000-0x00007FF7BC532000-memory.dmp	xmrig
behavioral2/memory/2900-2692-0x00007FF74E7F0000-0x00007FF74EBE2000-memory.dmp	xmrig
behavioral2/memory/1252-2697-0x00007FF7577D0000-0x00007FF757BC2000-memory.dmp	xmrig
behavioral2/memory/1240-2700-0x00007FF660D40000-0x00007FF661132000-memory.dmp	xmrig
behavioral2/memory/4136-2702-0x00007FF622AE0000-0x00007FF622ED2000-memory.dmp	xmrig
behavioral2/memory/4996-2704-0x00007FF6C2150000-0x00007FF6C2542000-memory.dmp	xmrig
behavioral2/memory/2312-2699-0x00007FF668240000-0x00007FF668632000-memory.dmp	xmrig
behavioral2/memory/4872-2695-0x00007FF6AD530000-0x00007FF6AD922000-memory.dmp	xmrig
behavioral2/memory/2424-2690-0x00007FF7ECDB0000-0x00007FF7ED1A2000-memory.dmp	xmrig
behavioral2/memory/3204-2689-0x00007FF619100000-0x00007FF6194F2000-memory.dmp	xmrig
behavioral2/memory/3808-2686-0x00007FF722E50000-0x00007FF723242000-memory.dmp	xmrig
behavioral2/memory/1620-2685-0x00007FF768610000-0x00007FF768A02000-memory.dmp	xmrig
behavioral2/memory/3344-2682-0x00007FF78C960000-0x00007FF78CD52000-memory.dmp	xmrig
behavioral2/memory/4356-2681-0x00007FF6B9AB0000-0x00007FF6B9EA2000-memory.dmp	xmrig
behavioral2/memory/4476-2708-0x00007FF616290000-0x00007FF616682000-memory.dmp	xmrig
behavioral2/memory/3832-2735-0x00007FF6714D0000-0x00007FF6718C2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2672	BrgIfPE.exe
4380	MeFYVTe.exe
3932	BUbXRFM.exe
312	zWPadzD.exe
3808	faGRemw.exe
5044	famnMKm.exe
1580	aTNEjmI.exe
1620	cFUZzjH.exe
4356	IQCHwwM.exe
2900	glFnrVR.exe
3344	dQtaJnZ.exe
2424	VDGGdcZ.exe
3204	cAloXfm.exe
4136	dqnGLkl.exe
1252	HzPYjqd.exe
4476	ZNCCvxb.exe
3832	jbAjFPw.exe
2312	DsPggNs.exe
4872	gWDnyKs.exe
1240	EqOgavL.exe
4996	JzLKiwy.exe
816	SyOCJGh.exe
4308	TfFlTuj.exe
1508	GqHRRyB.exe
4656	huBJZYq.exe
4464	DmzBOKd.exe
768	SpKrXWL.exe
3768	FJQGUYR.exe
4904	mbNssUG.exe
2844	bKYEwIL.exe
888	FjnWoMI.exe
524	VzOAPvN.exe
3924	nigFFPe.exe
4600	dFOBSEd.exe
5000	eHHrOpW.exe
1084	PSnHIxK.exe
2352	KMKMwsB.exe
400	aqgPkVr.exe
1100	ibkqZms.exe
924	leBuddN.exe
4724	rkafCKM.exe
1600	QqweUXA.exe
4700	pNdCtBk.exe
3268	WwbFIhY.exe
1760	eUzQUNy.exe
2228	xUYPswr.exe
4104	IfUMeIx.exe
1688	zEdTZvB.exe
2624	GZgHFuc.exe
2736	ETUBLTN.exe
4244	RwMGyxN.exe
4368	NIEOGmy.exe
5112	xboVypm.exe
2648	xzBDFha.exe
2756	loEDMDV.exe
2808	tCpArKx.exe
1692	XgySWiC.exe
2440	oSXojqC.exe
2768	dacHvkP.exe
3456	DhNUyRO.exe
736	jXwVuHV.exe
1012	TLOjDta.exe
1192	bVBZYxk.exe
4452	PHJQSXZ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/224-0-0x00007FF60C130000-0x00007FF60C522000-memory.dmp	upx
behavioral2/files/0x000a000000023bb0-10.dat	upx
behavioral2/files/0x000b000000023bac-15.dat	upx
behavioral2/files/0x000a000000023bb3-19.dat	upx
behavioral2/files/0x000a000000023bb2-18.dat	upx
behavioral2/files/0x000a000000023bb1-14.dat	upx
behavioral2/memory/4380-42-0x00007FF74AD70000-0x00007FF74B162000-memory.dmp	upx
behavioral2/files/0x0031000000023bb8-40.dat	upx
behavioral2/files/0x0031000000023bb6-35.dat	upx
behavioral2/files/0x000a000000023bb5-31.dat	upx
behavioral2/files/0x000a000000023bb4-30.dat	upx
behavioral2/files/0x000a000000023bbf-83.dat	upx
behavioral2/files/0x000a000000023bc6-180.dat	upx
behavioral2/memory/2900-189-0x00007FF74E7F0000-0x00007FF74EBE2000-memory.dmp	upx
behavioral2/memory/1252-228-0x00007FF7577D0000-0x00007FF757BC2000-memory.dmp	upx
behavioral2/memory/4476-235-0x00007FF616290000-0x00007FF616682000-memory.dmp	upx
behavioral2/memory/3344-243-0x00007FF78C960000-0x00007FF78CD52000-memory.dmp	upx
behavioral2/memory/4996-245-0x00007FF6C2150000-0x00007FF6C2542000-memory.dmp	upx
behavioral2/memory/4136-244-0x00007FF622AE0000-0x00007FF622ED2000-memory.dmp	upx
behavioral2/memory/2672-242-0x00007FF77CB60000-0x00007FF77CF52000-memory.dmp	upx
behavioral2/memory/1240-241-0x00007FF660D40000-0x00007FF661132000-memory.dmp	upx
behavioral2/memory/4872-240-0x00007FF6AD530000-0x00007FF6AD922000-memory.dmp	upx
behavioral2/memory/2312-239-0x00007FF668240000-0x00007FF668632000-memory.dmp	upx
behavioral2/memory/3832-238-0x00007FF6714D0000-0x00007FF6718C2000-memory.dmp	upx
behavioral2/memory/3204-225-0x00007FF619100000-0x00007FF6194F2000-memory.dmp	upx
behavioral2/memory/2424-213-0x00007FF7ECDB0000-0x00007FF7ED1A2000-memory.dmp	upx
behavioral2/memory/4356-188-0x00007FF6B9AB0000-0x00007FF6B9EA2000-memory.dmp	upx
behavioral2/memory/1620-179-0x00007FF768610000-0x00007FF768A02000-memory.dmp	upx
behavioral2/files/0x000a000000023bc8-190.dat	upx
behavioral2/files/0x000a000000023bd5-178.dat	upx
behavioral2/files/0x000a000000023bd4-177.dat	upx
behavioral2/files/0x000a000000023bd3-176.dat	upx
behavioral2/files/0x000a000000023bc4-174.dat	upx
behavioral2/files/0x000a000000023bd2-173.dat	upx
behavioral2/files/0x000a000000023bcf-171.dat	upx
behavioral2/memory/1580-168-0x00007FF7149C0000-0x00007FF714DB2000-memory.dmp	upx
behavioral2/files/0x000a000000023bce-166.dat	upx
behavioral2/files/0x000a000000023bcd-165.dat	upx
behavioral2/files/0x000a000000023bcc-164.dat	upx
behavioral2/files/0x000a000000023bcb-162.dat	upx
behavioral2/files/0x000a000000023bc5-161.dat	upx
behavioral2/files/0x000a000000023bca-160.dat	upx
behavioral2/files/0x000a000000023bc9-156.dat	upx
behavioral2/files/0x000a000000023bc7-155.dat	upx
behavioral2/files/0x000a000000023bc3-150.dat	upx
behavioral2/files/0x000a000000023bbe-137.dat	upx
behavioral2/memory/5044-133-0x00007FF7DF0C0000-0x00007FF7DF4B2000-memory.dmp	upx
behavioral2/files/0x000a000000023bc2-130.dat	upx
behavioral2/files/0x000a000000023bbc-124.dat	upx
behavioral2/files/0x000a000000023bbd-118.dat	upx
behavioral2/files/0x000a000000023bc1-112.dat	upx
behavioral2/files/0x000a000000023bba-108.dat	upx
behavioral2/files/0x000a000000023bc0-107.dat	upx
behavioral2/memory/3808-96-0x00007FF722E50000-0x00007FF723242000-memory.dmp	upx
behavioral2/files/0x0031000000023bb7-86.dat	upx
behavioral2/files/0x000b000000023bad-103.dat	upx
behavioral2/files/0x000a000000023bbb-100.dat	upx
behavioral2/files/0x000a000000023bb9-80.dat	upx
behavioral2/memory/312-73-0x00007FF7BC140000-0x00007FF7BC532000-memory.dmp	upx
behavioral2/memory/3932-72-0x00007FF7859B0000-0x00007FF785DA2000-memory.dmp	upx
behavioral2/memory/3932-2668-0x00007FF7859B0000-0x00007FF785DA2000-memory.dmp	upx
behavioral2/memory/2672-2670-0x00007FF77CB60000-0x00007FF77CF52000-memory.dmp	upx
behavioral2/memory/4380-2672-0x00007FF74AD70000-0x00007FF74B162000-memory.dmp	upx
behavioral2/memory/1580-2674-0x00007FF7149C0000-0x00007FF714DB2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\xNoWTly.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\iNRMefB.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\QBMpJcw.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\qkefolo.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\NOwoVSf.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\ZNCCvxb.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\XgySWiC.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\MJJRuJR.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\GCONazB.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\pIryfEb.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\mTHUxdj.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\aPyzUyG.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\TfGinBC.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\kitkNvU.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\TndwatH.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\FjnWoMI.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\VzOAPvN.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\jBXWpgW.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\JgvkWRg.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\leBuddN.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\goEnyjZ.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\BiJFGts.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\NXBoEow.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\VUaWwSe.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\ehtCTtp.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\ybRqEKw.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\mohJmiA.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\ToaVpym.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\scePtAT.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\IknPaiG.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\TFGYHLY.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\TJovqad.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\QrjSvvJ.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\cAcwlsZ.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\BsnqDrc.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\iPtMZet.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\ZKYMRQm.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\TAkQNsx.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\gGLpIeQ.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\fbXeoLU.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\GAcVywV.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\zEdTZvB.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\gXomPfR.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\wAvgGBs.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\mbCJTrg.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\sySpEsW.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\lYHRfty.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\mbNssUG.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\aqgPkVr.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\vvCowGM.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\gBtIAdf.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\pKfrUsq.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\ZgKWjES.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\zMelvEG.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\hoCOzfG.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\JJDuumt.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\ZRFmXKV.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\sPdkejP.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\EmCTxoP.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\zWqYxXO.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\zHDLgwm.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\yaIFjib.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\jlylxDx.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\wWLNGhQ.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1248	powershell.exe
1248	powershell.exe
1248	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1248	powershell.exe
Token: SeLockMemoryPrivilege	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 1248	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	84
PID 224 wrote to memory of 1248	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	84
PID 224 wrote to memory of 2672	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	85
PID 224 wrote to memory of 2672	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	85
PID 224 wrote to memory of 4380	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	86
PID 224 wrote to memory of 4380	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	86
PID 224 wrote to memory of 3932	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	87
PID 224 wrote to memory of 3932	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	87
PID 224 wrote to memory of 312	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	88
PID 224 wrote to memory of 312	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	88
PID 224 wrote to memory of 3808	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	89
PID 224 wrote to memory of 3808	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	89
PID 224 wrote to memory of 5044	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	90
PID 224 wrote to memory of 5044	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	90
PID 224 wrote to memory of 1580	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	91
PID 224 wrote to memory of 1580	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	91
PID 224 wrote to memory of 1620	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	92
PID 224 wrote to memory of 1620	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	92
PID 224 wrote to memory of 4356	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	93
PID 224 wrote to memory of 4356	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	93
PID 224 wrote to memory of 2900	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	94
PID 224 wrote to memory of 2900	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	94
PID 224 wrote to memory of 3344	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	95
PID 224 wrote to memory of 3344	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	95
PID 224 wrote to memory of 2424	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	96
PID 224 wrote to memory of 2424	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	96
PID 224 wrote to memory of 4872	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	97
PID 224 wrote to memory of 4872	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	97
PID 224 wrote to memory of 3204	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	98
PID 224 wrote to memory of 3204	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	98
PID 224 wrote to memory of 4136	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	99
PID 224 wrote to memory of 4136	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	99
PID 224 wrote to memory of 1252	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	100
PID 224 wrote to memory of 1252	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	100
PID 224 wrote to memory of 4476	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	101
PID 224 wrote to memory of 4476	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	101
PID 224 wrote to memory of 3832	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	102
PID 224 wrote to memory of 3832	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	102
PID 224 wrote to memory of 2312	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	103
PID 224 wrote to memory of 2312	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	103
PID 224 wrote to memory of 1240	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	104
PID 224 wrote to memory of 1240	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	104
PID 224 wrote to memory of 4996	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	105
PID 224 wrote to memory of 4996	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	105
PID 224 wrote to memory of 816	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	106
PID 224 wrote to memory of 816	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	106
PID 224 wrote to memory of 4308	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	107
PID 224 wrote to memory of 4308	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	107
PID 224 wrote to memory of 4904	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	108
PID 224 wrote to memory of 4904	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	108
PID 224 wrote to memory of 1508	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	109
PID 224 wrote to memory of 1508	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	109
PID 224 wrote to memory of 4656	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	110
PID 224 wrote to memory of 4656	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	110
PID 224 wrote to memory of 4464	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	111
PID 224 wrote to memory of 4464	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	111
PID 224 wrote to memory of 768	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	112
PID 224 wrote to memory of 768	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	112
PID 224 wrote to memory of 3768	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	113
PID 224 wrote to memory of 3768	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	113
PID 224 wrote to memory of 2844	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	114
PID 224 wrote to memory of 2844	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	114
PID 224 wrote to memory of 888	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	115
PID 224 wrote to memory of 888	224	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1248
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1248" "2580" "2528" "2584" "0" "0" "2588" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:12136
- C:\Windows\System\BrgIfPE.exe
  C:\Windows\System\BrgIfPE.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\MeFYVTe.exe
  C:\Windows\System\MeFYVTe.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\BUbXRFM.exe
  C:\Windows\System\BUbXRFM.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\zWPadzD.exe
  C:\Windows\System\zWPadzD.exe
  2⤵
  - Executes dropped EXE
  PID:312
- C:\Windows\System\faGRemw.exe
  C:\Windows\System\faGRemw.exe
  2⤵
  - Executes dropped EXE
  PID:3808
- C:\Windows\System\famnMKm.exe
  C:\Windows\System\famnMKm.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\aTNEjmI.exe
  C:\Windows\System\aTNEjmI.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\cFUZzjH.exe
  C:\Windows\System\cFUZzjH.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\IQCHwwM.exe
  C:\Windows\System\IQCHwwM.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\glFnrVR.exe
  C:\Windows\System\glFnrVR.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\dQtaJnZ.exe
  C:\Windows\System\dQtaJnZ.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System\VDGGdcZ.exe
  C:\Windows\System\VDGGdcZ.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\gWDnyKs.exe
  C:\Windows\System\gWDnyKs.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\cAloXfm.exe
  C:\Windows\System\cAloXfm.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\dqnGLkl.exe
  C:\Windows\System\dqnGLkl.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\HzPYjqd.exe
  C:\Windows\System\HzPYjqd.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\ZNCCvxb.exe
  C:\Windows\System\ZNCCvxb.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\jbAjFPw.exe
  C:\Windows\System\jbAjFPw.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System\DsPggNs.exe
  C:\Windows\System\DsPggNs.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\EqOgavL.exe
  C:\Windows\System\EqOgavL.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\JzLKiwy.exe
  C:\Windows\System\JzLKiwy.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\SyOCJGh.exe
  C:\Windows\System\SyOCJGh.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\TfFlTuj.exe
  C:\Windows\System\TfFlTuj.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\mbNssUG.exe
  C:\Windows\System\mbNssUG.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\GqHRRyB.exe
  C:\Windows\System\GqHRRyB.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\huBJZYq.exe
  C:\Windows\System\huBJZYq.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\DmzBOKd.exe
  C:\Windows\System\DmzBOKd.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\SpKrXWL.exe
  C:\Windows\System\SpKrXWL.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\FJQGUYR.exe
  C:\Windows\System\FJQGUYR.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\bKYEwIL.exe
  C:\Windows\System\bKYEwIL.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\FjnWoMI.exe
  C:\Windows\System\FjnWoMI.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\VzOAPvN.exe
  C:\Windows\System\VzOAPvN.exe
  2⤵
  - Executes dropped EXE
  PID:524
- C:\Windows\System\nigFFPe.exe
  C:\Windows\System\nigFFPe.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\dFOBSEd.exe
  C:\Windows\System\dFOBSEd.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\eHHrOpW.exe
  C:\Windows\System\eHHrOpW.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\PSnHIxK.exe
  C:\Windows\System\PSnHIxK.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\KMKMwsB.exe
  C:\Windows\System\KMKMwsB.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\aqgPkVr.exe
  C:\Windows\System\aqgPkVr.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\ibkqZms.exe
  C:\Windows\System\ibkqZms.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\leBuddN.exe
  C:\Windows\System\leBuddN.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\rkafCKM.exe
  C:\Windows\System\rkafCKM.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\QqweUXA.exe
  C:\Windows\System\QqweUXA.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\pNdCtBk.exe
  C:\Windows\System\pNdCtBk.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\WwbFIhY.exe
  C:\Windows\System\WwbFIhY.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\eUzQUNy.exe
  C:\Windows\System\eUzQUNy.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\xUYPswr.exe
  C:\Windows\System\xUYPswr.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\IfUMeIx.exe
  C:\Windows\System\IfUMeIx.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\zEdTZvB.exe
  C:\Windows\System\zEdTZvB.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\GZgHFuc.exe
  C:\Windows\System\GZgHFuc.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\ETUBLTN.exe
  C:\Windows\System\ETUBLTN.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\RwMGyxN.exe
  C:\Windows\System\RwMGyxN.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\NIEOGmy.exe
  C:\Windows\System\NIEOGmy.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\xboVypm.exe
  C:\Windows\System\xboVypm.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\xzBDFha.exe
  C:\Windows\System\xzBDFha.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\loEDMDV.exe
  C:\Windows\System\loEDMDV.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\XgySWiC.exe
  C:\Windows\System\XgySWiC.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\tCpArKx.exe
  C:\Windows\System\tCpArKx.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\dacHvkP.exe
  C:\Windows\System\dacHvkP.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\oSXojqC.exe
  C:\Windows\System\oSXojqC.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\DhNUyRO.exe
  C:\Windows\System\DhNUyRO.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\jXwVuHV.exe
  C:\Windows\System\jXwVuHV.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\TLOjDta.exe
  C:\Windows\System\TLOjDta.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\bVBZYxk.exe
  C:\Windows\System\bVBZYxk.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\PHJQSXZ.exe
  C:\Windows\System\PHJQSXZ.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\xFIThJE.exe
  C:\Windows\System\xFIThJE.exe
  2⤵
  PID:3772
- C:\Windows\System\nyHJBBa.exe
  C:\Windows\System\nyHJBBa.exe
  2⤵
  PID:4720
- C:\Windows\System\QzASsgF.exe
  C:\Windows\System\QzASsgF.exe
  2⤵
  PID:2528
- C:\Windows\System\fxzVxwJ.exe
  C:\Windows\System\fxzVxwJ.exe
  2⤵
  PID:4460
- C:\Windows\System\MJJRuJR.exe
  C:\Windows\System\MJJRuJR.exe
  2⤵
  PID:2200
- C:\Windows\System\ixyUAVh.exe
  C:\Windows\System\ixyUAVh.exe
  2⤵
  PID:1892
- C:\Windows\System\BQnQPbb.exe
  C:\Windows\System\BQnQPbb.exe
  2⤵
  PID:1440
- C:\Windows\System\RDRdeJW.exe
  C:\Windows\System\RDRdeJW.exe
  2⤵
  PID:2688
- C:\Windows\System\rAqElre.exe
  C:\Windows\System\rAqElre.exe
  2⤵
  PID:4240
- C:\Windows\System\eGklwTF.exe
  C:\Windows\System\eGklwTF.exe
  2⤵
  PID:3124
- C:\Windows\System\xrMgdaW.exe
  C:\Windows\System\xrMgdaW.exe
  2⤵
  PID:3892
- C:\Windows\System\GzPomeW.exe
  C:\Windows\System\GzPomeW.exe
  2⤵
  PID:4988
- C:\Windows\System\MgslTMl.exe
  C:\Windows\System\MgslTMl.exe
  2⤵
  PID:4456
- C:\Windows\System\VvAAiTl.exe
  C:\Windows\System\VvAAiTl.exe
  2⤵
  PID:2524
- C:\Windows\System\GeOWkrg.exe
  C:\Windows\System\GeOWkrg.exe
  2⤵
  PID:2192
- C:\Windows\System\GzliqxD.exe
  C:\Windows\System\GzliqxD.exe
  2⤵
  PID:4936
- C:\Windows\System\aGHaDlY.exe
  C:\Windows\System\aGHaDlY.exe
  2⤵
  PID:4644
- C:\Windows\System\sqnZMmO.exe
  C:\Windows\System\sqnZMmO.exe
  2⤵
  PID:2460
- C:\Windows\System\mnLZXrc.exe
  C:\Windows\System\mnLZXrc.exe
  2⤵
  PID:4224
- C:\Windows\System\QDxMpoY.exe
  C:\Windows\System\QDxMpoY.exe
  2⤵
  PID:4496
- C:\Windows\System\reiNsbv.exe
  C:\Windows\System\reiNsbv.exe
  2⤵
  PID:1164
- C:\Windows\System\upfKvMt.exe
  C:\Windows\System\upfKvMt.exe
  2⤵
  PID:4832
- C:\Windows\System\AcwMmSF.exe
  C:\Windows\System\AcwMmSF.exe
  2⤵
  PID:408
- C:\Windows\System\ITTdhjb.exe
  C:\Windows\System\ITTdhjb.exe
  2⤵
  PID:1140
- C:\Windows\System\EDhuCIN.exe
  C:\Windows\System\EDhuCIN.exe
  2⤵
  PID:1312
- C:\Windows\System\aeqQNvc.exe
  C:\Windows\System\aeqQNvc.exe
  2⤵
  PID:448
- C:\Windows\System\iNRMefB.exe
  C:\Windows\System\iNRMefB.exe
  2⤵
  PID:4608
- C:\Windows\System\Fesjary.exe
  C:\Windows\System\Fesjary.exe
  2⤵
  PID:4864
- C:\Windows\System\TFGYHLY.exe
  C:\Windows\System\TFGYHLY.exe
  2⤵
  PID:984
- C:\Windows\System\DCorqjU.exe
  C:\Windows\System\DCorqjU.exe
  2⤵
  PID:3016
- C:\Windows\System\OPvBsqM.exe
  C:\Windows\System\OPvBsqM.exe
  2⤵
  PID:4884
- C:\Windows\System\NYvufzc.exe
  C:\Windows\System\NYvufzc.exe
  2⤵
  PID:4364
- C:\Windows\System\HaQihsP.exe
  C:\Windows\System\HaQihsP.exe
  2⤵
  PID:2644
- C:\Windows\System\WfZBCmX.exe
  C:\Windows\System\WfZBCmX.exe
  2⤵
  PID:2040
- C:\Windows\System\bRMgoAE.exe
  C:\Windows\System\bRMgoAE.exe
  2⤵
  PID:1076
- C:\Windows\System\srzFalw.exe
  C:\Windows\System\srzFalw.exe
  2⤵
  PID:4980
- C:\Windows\System\yLHAJVd.exe
  C:\Windows\System\yLHAJVd.exe
  2⤵
  PID:4012
- C:\Windows\System\quoXazS.exe
  C:\Windows\System\quoXazS.exe
  2⤵
  PID:4176
- C:\Windows\System\jeXxpDy.exe
  C:\Windows\System\jeXxpDy.exe
  2⤵
  PID:5132
- C:\Windows\System\EmXqrLx.exe
  C:\Windows\System\EmXqrLx.exe
  2⤵
  PID:5156
- C:\Windows\System\ljDsLSF.exe
  C:\Windows\System\ljDsLSF.exe
  2⤵
  PID:5184
- C:\Windows\System\yrZZCrr.exe
  C:\Windows\System\yrZZCrr.exe
  2⤵
  PID:5208
- C:\Windows\System\lyXBGqw.exe
  C:\Windows\System\lyXBGqw.exe
  2⤵
  PID:5228
- C:\Windows\System\lsJbozv.exe
  C:\Windows\System\lsJbozv.exe
  2⤵
  PID:5248
- C:\Windows\System\odwpwqd.exe
  C:\Windows\System\odwpwqd.exe
  2⤵
  PID:5272
- C:\Windows\System\yjYOWEA.exe
  C:\Windows\System\yjYOWEA.exe
  2⤵
  PID:5296
- C:\Windows\System\JlCXhqJ.exe
  C:\Windows\System\JlCXhqJ.exe
  2⤵
  PID:5336
- C:\Windows\System\XoNWttT.exe
  C:\Windows\System\XoNWttT.exe
  2⤵
  PID:5356
- C:\Windows\System\kMsprom.exe
  C:\Windows\System\kMsprom.exe
  2⤵
  PID:5380
- C:\Windows\System\XcwGtiA.exe
  C:\Windows\System\XcwGtiA.exe
  2⤵
  PID:5400
- C:\Windows\System\OKAqAnq.exe
  C:\Windows\System\OKAqAnq.exe
  2⤵
  PID:5424
- C:\Windows\System\JTCoLCw.exe
  C:\Windows\System\JTCoLCw.exe
  2⤵
  PID:5464
- C:\Windows\System\zMRRhBT.exe
  C:\Windows\System\zMRRhBT.exe
  2⤵
  PID:5484
- C:\Windows\System\GzyNoaC.exe
  C:\Windows\System\GzyNoaC.exe
  2⤵
  PID:5512
- C:\Windows\System\xkhOaAO.exe
  C:\Windows\System\xkhOaAO.exe
  2⤵
  PID:5532
- C:\Windows\System\Pngveow.exe
  C:\Windows\System\Pngveow.exe
  2⤵
  PID:5556
- C:\Windows\System\munoEtM.exe
  C:\Windows\System\munoEtM.exe
  2⤵
  PID:5632
- C:\Windows\System\eOULYlF.exe
  C:\Windows\System\eOULYlF.exe
  2⤵
  PID:5672
- C:\Windows\System\jijlUdG.exe
  C:\Windows\System\jijlUdG.exe
  2⤵
  PID:5696
- C:\Windows\System\FKsRVXz.exe
  C:\Windows\System\FKsRVXz.exe
  2⤵
  PID:5716
- C:\Windows\System\nOHyANl.exe
  C:\Windows\System\nOHyANl.exe
  2⤵
  PID:5736
- C:\Windows\System\KnMacta.exe
  C:\Windows\System\KnMacta.exe
  2⤵
  PID:5764
- C:\Windows\System\ejEJJJM.exe
  C:\Windows\System\ejEJJJM.exe
  2⤵
  PID:5784
- C:\Windows\System\UBRzXpv.exe
  C:\Windows\System\UBRzXpv.exe
  2⤵
  PID:5820
- C:\Windows\System\KODmjEh.exe
  C:\Windows\System\KODmjEh.exe
  2⤵
  PID:5840
- C:\Windows\System\dGOBLSh.exe
  C:\Windows\System\dGOBLSh.exe
  2⤵
  PID:5864
- C:\Windows\System\HUZKxvs.exe
  C:\Windows\System\HUZKxvs.exe
  2⤵
  PID:5892
- C:\Windows\System\xvWhcKU.exe
  C:\Windows\System\xvWhcKU.exe
  2⤵
  PID:5912
- C:\Windows\System\MpZSobp.exe
  C:\Windows\System\MpZSobp.exe
  2⤵
  PID:5932
- C:\Windows\System\ybRqEKw.exe
  C:\Windows\System\ybRqEKw.exe
  2⤵
  PID:5964
- C:\Windows\System\VHvzepr.exe
  C:\Windows\System\VHvzepr.exe
  2⤵
  PID:5984
- C:\Windows\System\pxCcbGr.exe
  C:\Windows\System\pxCcbGr.exe
  2⤵
  PID:6012
- C:\Windows\System\gXomPfR.exe
  C:\Windows\System\gXomPfR.exe
  2⤵
  PID:6036
- C:\Windows\System\czIdakv.exe
  C:\Windows\System\czIdakv.exe
  2⤵
  PID:6060
- C:\Windows\System\RswsMQm.exe
  C:\Windows\System\RswsMQm.exe
  2⤵
  PID:6080
- C:\Windows\System\xfSZGBw.exe
  C:\Windows\System\xfSZGBw.exe
  2⤵
  PID:6100
- C:\Windows\System\xTpZVlp.exe
  C:\Windows\System\xTpZVlp.exe
  2⤵
  PID:6128
- C:\Windows\System\kSRnoPZ.exe
  C:\Windows\System\kSRnoPZ.exe
  2⤵
  PID:3676
- C:\Windows\System\HZzudMf.exe
  C:\Windows\System\HZzudMf.exe
  2⤵
  PID:5196
- C:\Windows\System\qAnjCAk.exe
  C:\Windows\System\qAnjCAk.exe
  2⤵
  PID:5168
- C:\Windows\System\Yfbvenr.exe
  C:\Windows\System\Yfbvenr.exe
  2⤵
  PID:5268
- C:\Windows\System\UZmJBbK.exe
  C:\Windows\System\UZmJBbK.exe
  2⤵
  PID:5308
- C:\Windows\System\ckUdskX.exe
  C:\Windows\System\ckUdskX.exe
  2⤵
  PID:5392
- C:\Windows\System\FLGzUDm.exe
  C:\Windows\System\FLGzUDm.exe
  2⤵
  PID:5352
- C:\Windows\System\ETemoxs.exe
  C:\Windows\System\ETemoxs.exe
  2⤵
  PID:5540
- C:\Windows\System\APHOJPK.exe
  C:\Windows\System\APHOJPK.exe
  2⤵
  PID:5412
- C:\Windows\System\zQOuMoj.exe
  C:\Windows\System\zQOuMoj.exe
  2⤵
  PID:5456
- C:\Windows\System\LolcVlO.exe
  C:\Windows\System\LolcVlO.exe
  2⤵
  PID:5528
- C:\Windows\System\rCdHKPi.exe
  C:\Windows\System\rCdHKPi.exe
  2⤵
  PID:5684
- C:\Windows\System\LTIhvix.exe
  C:\Windows\System\LTIhvix.exe
  2⤵
  PID:5708
- C:\Windows\System\xdTWkbg.exe
  C:\Windows\System\xdTWkbg.exe
  2⤵
  PID:5904
- C:\Windows\System\GeFkKFS.exe
  C:\Windows\System\GeFkKFS.exe
  2⤵
  PID:5732
- C:\Windows\System\yWxhYVh.exe
  C:\Windows\System\yWxhYVh.exe
  2⤵
  PID:5752
- C:\Windows\System\MerBLnu.exe
  C:\Windows\System\MerBLnu.exe
  2⤵
  PID:5884
- C:\Windows\System\yFBLDFd.exe
  C:\Windows\System\yFBLDFd.exe
  2⤵
  PID:5832
- C:\Windows\System\OSKGIht.exe
  C:\Windows\System\OSKGIht.exe
  2⤵
  PID:5448
- C:\Windows\System\FdKvJZU.exe
  C:\Windows\System\FdKvJZU.exe
  2⤵
  PID:5860
- C:\Windows\System\aTgAjSL.exe
  C:\Windows\System\aTgAjSL.exe
  2⤵
  PID:5376
- C:\Windows\System\MUGMQuU.exe
  C:\Windows\System\MUGMQuU.exe
  2⤵
  PID:6156
- C:\Windows\System\uawinZv.exe
  C:\Windows\System\uawinZv.exe
  2⤵
  PID:6176
- C:\Windows\System\SvpjoBE.exe
  C:\Windows\System\SvpjoBE.exe
  2⤵
  PID:6204
- C:\Windows\System\XeLPbOK.exe
  C:\Windows\System\XeLPbOK.exe
  2⤵
  PID:6228
- C:\Windows\System\udRlgqA.exe
  C:\Windows\System\udRlgqA.exe
  2⤵
  PID:6260
- C:\Windows\System\iMwoubk.exe
  C:\Windows\System\iMwoubk.exe
  2⤵
  PID:6284
- C:\Windows\System\UWnSJWR.exe
  C:\Windows\System\UWnSJWR.exe
  2⤵
  PID:6304
- C:\Windows\System\sekWdpF.exe
  C:\Windows\System\sekWdpF.exe
  2⤵
  PID:6332
- C:\Windows\System\pTZqFFE.exe
  C:\Windows\System\pTZqFFE.exe
  2⤵
  PID:6352
- C:\Windows\System\bDqkwWf.exe
  C:\Windows\System\bDqkwWf.exe
  2⤵
  PID:6380
- C:\Windows\System\zWqYxXO.exe
  C:\Windows\System\zWqYxXO.exe
  2⤵
  PID:6456
- C:\Windows\System\jReOkJT.exe
  C:\Windows\System\jReOkJT.exe
  2⤵
  PID:6476
- C:\Windows\System\gGLpIeQ.exe
  C:\Windows\System\gGLpIeQ.exe
  2⤵
  PID:6504
- C:\Windows\System\uGqUCFj.exe
  C:\Windows\System\uGqUCFj.exe
  2⤵
  PID:6524
- C:\Windows\System\fPoQpIN.exe
  C:\Windows\System\fPoQpIN.exe
  2⤵
  PID:6544
- C:\Windows\System\gtQqQDe.exe
  C:\Windows\System\gtQqQDe.exe
  2⤵
  PID:6572
- C:\Windows\System\uZBUkLS.exe
  C:\Windows\System\uZBUkLS.exe
  2⤵
  PID:6596
- C:\Windows\System\zYnZsXa.exe
  C:\Windows\System\zYnZsXa.exe
  2⤵
  PID:6624
- C:\Windows\System\MxMjlhH.exe
  C:\Windows\System\MxMjlhH.exe
  2⤵
  PID:6644
- C:\Windows\System\ZrFfIHL.exe
  C:\Windows\System\ZrFfIHL.exe
  2⤵
  PID:6664
- C:\Windows\System\zAkhIeS.exe
  C:\Windows\System\zAkhIeS.exe
  2⤵
  PID:6688
- C:\Windows\System\baDZESR.exe
  C:\Windows\System\baDZESR.exe
  2⤵
  PID:6712
- C:\Windows\System\DpRpYZX.exe
  C:\Windows\System\DpRpYZX.exe
  2⤵
  PID:6744
- C:\Windows\System\bMwOuyZ.exe
  C:\Windows\System\bMwOuyZ.exe
  2⤵
  PID:6772
- C:\Windows\System\OiUUqic.exe
  C:\Windows\System\OiUUqic.exe
  2⤵
  PID:6792
- C:\Windows\System\pCiyQRN.exe
  C:\Windows\System\pCiyQRN.exe
  2⤵
  PID:6812
- C:\Windows\System\rKKCceo.exe
  C:\Windows\System\rKKCceo.exe
  2⤵
  PID:6832
- C:\Windows\System\OKAhNxG.exe
  C:\Windows\System\OKAhNxG.exe
  2⤵
  PID:6852
- C:\Windows\System\SnNquTZ.exe
  C:\Windows\System\SnNquTZ.exe
  2⤵
  PID:6876
- C:\Windows\System\kkKgWpn.exe
  C:\Windows\System\kkKgWpn.exe
  2⤵
  PID:6900
- C:\Windows\System\VeZhoQH.exe
  C:\Windows\System\VeZhoQH.exe
  2⤵
  PID:6920
- C:\Windows\System\bdBrfum.exe
  C:\Windows\System\bdBrfum.exe
  2⤵
  PID:6944
- C:\Windows\System\VNrdnlV.exe
  C:\Windows\System\VNrdnlV.exe
  2⤵
  PID:6968
- C:\Windows\System\EhTEGur.exe
  C:\Windows\System\EhTEGur.exe
  2⤵
  PID:6992
- C:\Windows\System\wVNKQdr.exe
  C:\Windows\System\wVNKQdr.exe
  2⤵
  PID:7016
- C:\Windows\System\soPxXsg.exe
  C:\Windows\System\soPxXsg.exe
  2⤵
  PID:7044
- C:\Windows\System\PaCLxwY.exe
  C:\Windows\System\PaCLxwY.exe
  2⤵
  PID:7064
- C:\Windows\System\RVpVlLk.exe
  C:\Windows\System\RVpVlLk.exe
  2⤵
  PID:7088
- C:\Windows\System\OgNAcws.exe
  C:\Windows\System\OgNAcws.exe
  2⤵
  PID:7108
- C:\Windows\System\mGxDaEk.exe
  C:\Windows\System\mGxDaEk.exe
  2⤵
  PID:7132
- C:\Windows\System\lWtOHFV.exe
  C:\Windows\System\lWtOHFV.exe
  2⤵
  PID:7152
- C:\Windows\System\pJkzaAG.exe
  C:\Windows\System\pJkzaAG.exe
  2⤵
  PID:5640
- C:\Windows\System\pnzPyJX.exe
  C:\Windows\System\pnzPyJX.exe
  2⤵
  PID:5772
- C:\Windows\System\EUZTaNx.exe
  C:\Windows\System\EUZTaNx.exe
  2⤵
  PID:5480
- C:\Windows\System\fbvjmrs.exe
  C:\Windows\System\fbvjmrs.exe
  2⤵
  PID:5836
- C:\Windows\System\NOGpwCD.exe
  C:\Windows\System\NOGpwCD.exe
  2⤵
  PID:6192
- C:\Windows\System\UXiIala.exe
  C:\Windows\System\UXiIala.exe
  2⤵
  PID:5992
- C:\Windows\System\wdHMbwh.exe
  C:\Windows\System\wdHMbwh.exe
  2⤵
  PID:6344
- C:\Windows\System\ryJWnhM.exe
  C:\Windows\System\ryJWnhM.exe
  2⤵
  PID:6292
- C:\Windows\System\Hayfveg.exe
  C:\Windows\System\Hayfveg.exe
  2⤵
  PID:6324
- C:\Windows\System\ZRCZxOj.exe
  C:\Windows\System\ZRCZxOj.exe
  2⤵
  PID:6392
- C:\Windows\System\goFumDX.exe
  C:\Windows\System\goFumDX.exe
  2⤵
  PID:6444
- C:\Windows\System\YwCdSWe.exe
  C:\Windows\System\YwCdSWe.exe
  2⤵
  PID:6348
- C:\Windows\System\YqxaRDE.exe
  C:\Windows\System\YqxaRDE.exe
  2⤵
  PID:6540
- C:\Windows\System\DZfTmzT.exe
  C:\Windows\System\DZfTmzT.exe
  2⤵
  PID:6368
- C:\Windows\System\nJndycx.exe
  C:\Windows\System\nJndycx.exe
  2⤵
  PID:6464
- C:\Windows\System\cKOWDCp.exe
  C:\Windows\System\cKOWDCp.exe
  2⤵
  PID:6696
- C:\Windows\System\dhBpcIm.exe
  C:\Windows\System\dhBpcIm.exe
  2⤵
  PID:6728
- C:\Windows\System\UVUEnNl.exe
  C:\Windows\System\UVUEnNl.exe
  2⤵
  PID:3092
- C:\Windows\System\HNYQEIN.exe
  C:\Windows\System\HNYQEIN.exe
  2⤵
  PID:6820
- C:\Windows\System\mblKqKO.exe
  C:\Windows\System\mblKqKO.exe
  2⤵
  PID:7104
- C:\Windows\System\eiVIPzt.exe
  C:\Windows\System\eiVIPzt.exe
  2⤵
  PID:7160
- C:\Windows\System\VyksUcy.exe
  C:\Windows\System\VyksUcy.exe
  2⤵
  PID:6140
- C:\Windows\System\xYDxlKe.exe
  C:\Windows\System\xYDxlKe.exe
  2⤵
  PID:6108
- C:\Windows\System\MEUCpfv.exe
  C:\Windows\System\MEUCpfv.exe
  2⤵
  PID:6868
- C:\Windows\System\CxxUXTz.exe
  C:\Windows\System\CxxUXTz.exe
  2⤵
  PID:5980
- C:\Windows\System\KssHFri.exe
  C:\Windows\System\KssHFri.exe
  2⤵
  PID:6484
- C:\Windows\System\iRsDwfD.exe
  C:\Windows\System\iRsDwfD.exe
  2⤵
  PID:4556
- C:\Windows\System\nblJXmz.exe
  C:\Windows\System\nblJXmz.exe
  2⤵
  PID:6848
- C:\Windows\System\YaXkErC.exe
  C:\Windows\System\YaXkErC.exe
  2⤵
  PID:6408
- C:\Windows\System\NnRkZMP.exe
  C:\Windows\System\NnRkZMP.exe
  2⤵
  PID:6636
- C:\Windows\System\VhToBjt.exe
  C:\Windows\System\VhToBjt.exe
  2⤵
  PID:7188
- C:\Windows\System\MFUNiYO.exe
  C:\Windows\System\MFUNiYO.exe
  2⤵
  PID:7212
- C:\Windows\System\atxeEDE.exe
  C:\Windows\System\atxeEDE.exe
  2⤵
  PID:7228
- C:\Windows\System\URNKoHO.exe
  C:\Windows\System\URNKoHO.exe
  2⤵
  PID:7256
- C:\Windows\System\znAaWrF.exe
  C:\Windows\System\znAaWrF.exe
  2⤵
  PID:7276
- C:\Windows\System\QBSMvTZ.exe
  C:\Windows\System\QBSMvTZ.exe
  2⤵
  PID:7304
- C:\Windows\System\RhjLsNd.exe
  C:\Windows\System\RhjLsNd.exe
  2⤵
  PID:7332
- C:\Windows\System\IolUmtI.exe
  C:\Windows\System\IolUmtI.exe
  2⤵
  PID:7352
- C:\Windows\System\CIUbBTz.exe
  C:\Windows\System\CIUbBTz.exe
  2⤵
  PID:7376
- C:\Windows\System\GCONazB.exe
  C:\Windows\System\GCONazB.exe
  2⤵
  PID:7400
- C:\Windows\System\KhenNRZ.exe
  C:\Windows\System\KhenNRZ.exe
  2⤵
  PID:7424
- C:\Windows\System\IsyrLMZ.exe
  C:\Windows\System\IsyrLMZ.exe
  2⤵
  PID:7452
- C:\Windows\System\RRHJLid.exe
  C:\Windows\System\RRHJLid.exe
  2⤵
  PID:7472
- C:\Windows\System\yzKkOxH.exe
  C:\Windows\System\yzKkOxH.exe
  2⤵
  PID:7500
- C:\Windows\System\fbXeoLU.exe
  C:\Windows\System\fbXeoLU.exe
  2⤵
  PID:7524
- C:\Windows\System\DHgKgeG.exe
  C:\Windows\System\DHgKgeG.exe
  2⤵
  PID:7548
- C:\Windows\System\TjZKaVs.exe
  C:\Windows\System\TjZKaVs.exe
  2⤵
  PID:7580
- C:\Windows\System\kQhluzx.exe
  C:\Windows\System\kQhluzx.exe
  2⤵
  PID:7604
- C:\Windows\System\CdnnflU.exe
  C:\Windows\System\CdnnflU.exe
  2⤵
  PID:7624
- C:\Windows\System\vrFHNHh.exe
  C:\Windows\System\vrFHNHh.exe
  2⤵
  PID:7652
- C:\Windows\System\cJrMSGL.exe
  C:\Windows\System\cJrMSGL.exe
  2⤵
  PID:7672
- C:\Windows\System\vjZPySr.exe
  C:\Windows\System\vjZPySr.exe
  2⤵
  PID:7692
- C:\Windows\System\ggDzeUD.exe
  C:\Windows\System\ggDzeUD.exe
  2⤵
  PID:7716
- C:\Windows\System\BGCslBy.exe
  C:\Windows\System\BGCslBy.exe
  2⤵
  PID:7744
- C:\Windows\System\cYhnJdm.exe
  C:\Windows\System\cYhnJdm.exe
  2⤵
  PID:7764
- C:\Windows\System\jsZGndy.exe
  C:\Windows\System\jsZGndy.exe
  2⤵
  PID:7784
- C:\Windows\System\hNTwBab.exe
  C:\Windows\System\hNTwBab.exe
  2⤵
  PID:7808
- C:\Windows\System\wfinlFM.exe
  C:\Windows\System\wfinlFM.exe
  2⤵
  PID:7836
- C:\Windows\System\goEnyjZ.exe
  C:\Windows\System\goEnyjZ.exe
  2⤵
  PID:7856
- C:\Windows\System\zHDLgwm.exe
  C:\Windows\System\zHDLgwm.exe
  2⤵
  PID:7884
- C:\Windows\System\NWXlFKX.exe
  C:\Windows\System\NWXlFKX.exe
  2⤵
  PID:7900
- C:\Windows\System\qVtCZaj.exe
  C:\Windows\System\qVtCZaj.exe
  2⤵
  PID:7924
- C:\Windows\System\zCSjHnM.exe
  C:\Windows\System\zCSjHnM.exe
  2⤵
  PID:7960
- C:\Windows\System\MBGzZqn.exe
  C:\Windows\System\MBGzZqn.exe
  2⤵
  PID:7984
- C:\Windows\System\fvtteNR.exe
  C:\Windows\System\fvtteNR.exe
  2⤵
  PID:8004
- C:\Windows\System\BQmfjMR.exe
  C:\Windows\System\BQmfjMR.exe
  2⤵
  PID:8028
- C:\Windows\System\OdzvQMr.exe
  C:\Windows\System\OdzvQMr.exe
  2⤵
  PID:8048
- C:\Windows\System\AAqgPaE.exe
  C:\Windows\System\AAqgPaE.exe
  2⤵
  PID:8064
- C:\Windows\System\kFZuXgp.exe
  C:\Windows\System\kFZuXgp.exe
  2⤵
  PID:8088
- C:\Windows\System\yKruJRl.exe
  C:\Windows\System\yKruJRl.exe
  2⤵
  PID:6564
- C:\Windows\System\rPgMfMj.exe
  C:\Windows\System\rPgMfMj.exe
  2⤵
  PID:4352
- C:\Windows\System\EtOhzEQ.exe
  C:\Windows\System\EtOhzEQ.exe
  2⤵
  PID:7268
- C:\Windows\System\URwihDn.exe
  C:\Windows\System\URwihDn.exe
  2⤵
  PID:7320
- C:\Windows\System\tpLmcKl.exe
  C:\Windows\System\tpLmcKl.exe
  2⤵
  PID:6432
- C:\Windows\System\xAavngl.exe
  C:\Windows\System\xAavngl.exe
  2⤵
  PID:7464
- C:\Windows\System\GGuYceu.exe
  C:\Windows\System\GGuYceu.exe
  2⤵
  PID:6936
- C:\Windows\System\OZJGMzd.exe
  C:\Windows\System\OZJGMzd.exe
  2⤵
  PID:7348
- C:\Windows\System\eXEcOdJ.exe
  C:\Windows\System\eXEcOdJ.exe
  2⤵
  PID:7712
- C:\Windows\System\jJquvZD.exe
  C:\Windows\System\jJquvZD.exe
  2⤵
  PID:7780
- C:\Windows\System\WgBcgYR.exe
  C:\Windows\System\WgBcgYR.exe
  2⤵
  PID:6248
- C:\Windows\System\pIryfEb.exe
  C:\Windows\System\pIryfEb.exe
  2⤵
  PID:3212
- C:\Windows\System\iAIsrxU.exe
  C:\Windows\System\iAIsrxU.exe
  2⤵
  PID:8060
- C:\Windows\System\AGQLYGE.exe
  C:\Windows\System\AGQLYGE.exe
  2⤵
  PID:7688
- C:\Windows\System\hwMZofY.exe
  C:\Windows\System\hwMZofY.exe
  2⤵
  PID:7496
- C:\Windows\System\RORhgQE.exe
  C:\Windows\System\RORhgQE.exe
  2⤵
  PID:7896
- C:\Windows\System\CDPdjAt.exe
  C:\Windows\System\CDPdjAt.exe
  2⤵
  PID:3984
- C:\Windows\System\QlDAyIb.exe
  C:\Windows\System\QlDAyIb.exe
  2⤵
  PID:8204
- C:\Windows\System\DNfCbjB.exe
  C:\Windows\System\DNfCbjB.exe
  2⤵
  PID:8224
- C:\Windows\System\oMgljfn.exe
  C:\Windows\System\oMgljfn.exe
  2⤵
  PID:8248
- C:\Windows\System\JSTKjGm.exe
  C:\Windows\System\JSTKjGm.exe
  2⤵
  PID:8276
- C:\Windows\System\TfLTVcE.exe
  C:\Windows\System\TfLTVcE.exe
  2⤵
  PID:8304
- C:\Windows\System\eVMxdfj.exe
  C:\Windows\System\eVMxdfj.exe
  2⤵
  PID:8324
- C:\Windows\System\hheCSDm.exe
  C:\Windows\System\hheCSDm.exe
  2⤵
  PID:8352
- C:\Windows\System\EcWOuDl.exe
  C:\Windows\System\EcWOuDl.exe
  2⤵
  PID:8376
- C:\Windows\System\SGWuXYg.exe
  C:\Windows\System\SGWuXYg.exe
  2⤵
  PID:8400
- C:\Windows\System\nJQHseT.exe
  C:\Windows\System\nJQHseT.exe
  2⤵
  PID:8424
- C:\Windows\System\TGfQvgd.exe
  C:\Windows\System\TGfQvgd.exe
  2⤵
  PID:8448
- C:\Windows\System\ehMZgxg.exe
  C:\Windows\System\ehMZgxg.exe
  2⤵
  PID:8472
- C:\Windows\System\EnXSjXd.exe
  C:\Windows\System\EnXSjXd.exe
  2⤵
  PID:8488
- C:\Windows\System\mAcLFcO.exe
  C:\Windows\System\mAcLFcO.exe
  2⤵
  PID:8512
- C:\Windows\System\UUJNYrD.exe
  C:\Windows\System\UUJNYrD.exe
  2⤵
  PID:8536
- C:\Windows\System\XlefqYs.exe
  C:\Windows\System\XlefqYs.exe
  2⤵
  PID:8560
- C:\Windows\System\bUCLUPu.exe
  C:\Windows\System\bUCLUPu.exe
  2⤵
  PID:8584
- C:\Windows\System\iDsfpuW.exe
  C:\Windows\System\iDsfpuW.exe
  2⤵
  PID:8604
- C:\Windows\System\QBMpJcw.exe
  C:\Windows\System\QBMpJcw.exe
  2⤵
  PID:8628
- C:\Windows\System\tziKPCW.exe
  C:\Windows\System\tziKPCW.exe
  2⤵
  PID:8648
- C:\Windows\System\jLbXVxb.exe
  C:\Windows\System\jLbXVxb.exe
  2⤵
  PID:8672
- C:\Windows\System\PVqTUxJ.exe
  C:\Windows\System\PVqTUxJ.exe
  2⤵
  PID:8688
- C:\Windows\System\WJfhFPq.exe
  C:\Windows\System\WJfhFPq.exe
  2⤵
  PID:8712
- C:\Windows\System\cIPPsky.exe
  C:\Windows\System\cIPPsky.exe
  2⤵
  PID:8736
- C:\Windows\System\fnbpowO.exe
  C:\Windows\System\fnbpowO.exe
  2⤵
  PID:8760
- C:\Windows\System\SvbDIXw.exe
  C:\Windows\System\SvbDIXw.exe
  2⤵
  PID:8780
- C:\Windows\System\lPrwVVH.exe
  C:\Windows\System\lPrwVVH.exe
  2⤵
  PID:8804
- C:\Windows\System\rtlrEaJ.exe
  C:\Windows\System\rtlrEaJ.exe
  2⤵
  PID:8832
- C:\Windows\System\LKBTaBt.exe
  C:\Windows\System\LKBTaBt.exe
  2⤵
  PID:8848
- C:\Windows\System\TJovqad.exe
  C:\Windows\System\TJovqad.exe
  2⤵
  PID:8864
- C:\Windows\System\jRxNrzJ.exe
  C:\Windows\System\jRxNrzJ.exe
  2⤵
  PID:8884
- C:\Windows\System\nwZPSEV.exe
  C:\Windows\System\nwZPSEV.exe
  2⤵
  PID:8900
- C:\Windows\System\RwZxEzV.exe
  C:\Windows\System\RwZxEzV.exe
  2⤵
  PID:8916
- C:\Windows\System\NLIBptx.exe
  C:\Windows\System\NLIBptx.exe
  2⤵
  PID:8940
- C:\Windows\System\oFFonAM.exe
  C:\Windows\System\oFFonAM.exe
  2⤵
  PID:8964
- C:\Windows\System\fWcrspQ.exe
  C:\Windows\System\fWcrspQ.exe
  2⤵
  PID:8988
- C:\Windows\System\OszhRfD.exe
  C:\Windows\System\OszhRfD.exe
  2⤵
  PID:9012
- C:\Windows\System\gYzHyyA.exe
  C:\Windows\System\gYzHyyA.exe
  2⤵
  PID:9036
- C:\Windows\System\kYLyLRQ.exe
  C:\Windows\System\kYLyLRQ.exe
  2⤵
  PID:9060
- C:\Windows\System\fRbgpWc.exe
  C:\Windows\System\fRbgpWc.exe
  2⤵
  PID:9080
- C:\Windows\System\UIrpSCO.exe
  C:\Windows\System\UIrpSCO.exe
  2⤵
  PID:9104
- C:\Windows\System\nJQRoNf.exe
  C:\Windows\System\nJQRoNf.exe
  2⤵
  PID:9128
- C:\Windows\System\SgYzJXY.exe
  C:\Windows\System\SgYzJXY.exe
  2⤵
  PID:9152
- C:\Windows\System\YHKCvyM.exe
  C:\Windows\System\YHKCvyM.exe
  2⤵
  PID:9180
- C:\Windows\System\SdQHdks.exe
  C:\Windows\System\SdQHdks.exe
  2⤵
  PID:9200
- C:\Windows\System\HlLhzim.exe
  C:\Windows\System\HlLhzim.exe
  2⤵
  PID:7668
- C:\Windows\System\imKpMoW.exe
  C:\Windows\System\imKpMoW.exe
  2⤵
  PID:8124
- C:\Windows\System\VhGjjyB.exe
  C:\Windows\System\VhGjjyB.exe
  2⤵
  PID:8136
- C:\Windows\System\mVtPAHn.exe
  C:\Windows\System\mVtPAHn.exe
  2⤵
  PID:7120
- C:\Windows\System\SFFDhHv.exe
  C:\Windows\System\SFFDhHv.exe
  2⤵
  PID:7640
- C:\Windows\System\GeymrBb.exe
  C:\Windows\System\GeymrBb.exe
  2⤵
  PID:7824
- C:\Windows\System\WVZdsqh.exe
  C:\Windows\System\WVZdsqh.exe
  2⤵
  PID:7956
- C:\Windows\System\DnWTbSz.exe
  C:\Windows\System\DnWTbSz.exe
  2⤵
  PID:8012
- C:\Windows\System\ZArLFWe.exe
  C:\Windows\System\ZArLFWe.exe
  2⤵
  PID:7660
- C:\Windows\System\zdpfwmQ.exe
  C:\Windows\System\zdpfwmQ.exe
  2⤵
  PID:4844
- C:\Windows\System\pAoFhgz.exe
  C:\Windows\System\pAoFhgz.exe
  2⤵
  PID:6704
- C:\Windows\System\ztWyxZU.exe
  C:\Windows\System\ztWyxZU.exe
  2⤵
  PID:8216
- C:\Windows\System\DIKcayk.exe
  C:\Windows\System\DIKcayk.exe
  2⤵
  PID:8256
- C:\Windows\System\npbjZJk.exe
  C:\Windows\System\npbjZJk.exe
  2⤵
  PID:6488
- C:\Windows\System\LJZPJkd.exe
  C:\Windows\System\LJZPJkd.exe
  2⤵
  PID:8468
- C:\Windows\System\OvLqAJg.exe
  C:\Windows\System\OvLqAJg.exe
  2⤵
  PID:8496
- C:\Windows\System\hJKHKaz.exe
  C:\Windows\System\hJKHKaz.exe
  2⤵
  PID:8580
- C:\Windows\System\RMljDcd.exe
  C:\Windows\System\RMljDcd.exe
  2⤵
  PID:8388
- C:\Windows\System\NjKmpBc.exe
  C:\Windows\System\NjKmpBc.exe
  2⤵
  PID:8684
- C:\Windows\System\XQcxjGn.exe
  C:\Windows\System\XQcxjGn.exe
  2⤵
  PID:8728
- C:\Windows\System\zXukgvx.exe
  C:\Windows\System\zXukgvx.exe
  2⤵
  PID:7916
- C:\Windows\System\oNmnfTA.exe
  C:\Windows\System\oNmnfTA.exe
  2⤵
  PID:5032
- C:\Windows\System\YijnirR.exe
  C:\Windows\System\YijnirR.exe
  2⤵
  PID:8544
- C:\Windows\System\ZgGkZvK.exe
  C:\Windows\System\ZgGkZvK.exe
  2⤵
  PID:8824
- C:\Windows\System\KBFBHFY.exe
  C:\Windows\System\KBFBHFY.exe
  2⤵
  PID:8912
- C:\Windows\System\yqKHjJp.exe
  C:\Windows\System\yqKHjJp.exe
  2⤵
  PID:8316
- C:\Windows\System\sHVUeLk.exe
  C:\Windows\System\sHVUeLk.exe
  2⤵
  PID:8348
- C:\Windows\System\zMelvEG.exe
  C:\Windows\System\zMelvEG.exe
  2⤵
  PID:9028
- C:\Windows\System\OyouUDa.exe
  C:\Windows\System\OyouUDa.exe
  2⤵
  PID:8664
- C:\Windows\System\VzLzanS.exe
  C:\Windows\System\VzLzanS.exe
  2⤵
  PID:9212
- C:\Windows\System\bafCDfV.exe
  C:\Windows\System\bafCDfV.exe
  2⤵
  PID:8732
- C:\Windows\System\SLGqMjp.exe
  C:\Windows\System\SLGqMjp.exe
  2⤵
  PID:7968
- C:\Windows\System\mKwFbbY.exe
  C:\Windows\System\mKwFbbY.exe
  2⤵
  PID:9236
- C:\Windows\System\iZctilr.exe
  C:\Windows\System\iZctilr.exe
  2⤵
  PID:9260
- C:\Windows\System\LFhSfPJ.exe
  C:\Windows\System\LFhSfPJ.exe
  2⤵
  PID:9292
- C:\Windows\System\AyXNcpH.exe
  C:\Windows\System\AyXNcpH.exe
  2⤵
  PID:9316
- C:\Windows\System\FWXglRu.exe
  C:\Windows\System\FWXglRu.exe
  2⤵
  PID:9336
- C:\Windows\System\OodPEhM.exe
  C:\Windows\System\OodPEhM.exe
  2⤵
  PID:9364
- C:\Windows\System\cUOaUaC.exe
  C:\Windows\System\cUOaUaC.exe
  2⤵
  PID:9384
- C:\Windows\System\aYamwma.exe
  C:\Windows\System\aYamwma.exe
  2⤵
  PID:9404
- C:\Windows\System\xiJydSo.exe
  C:\Windows\System\xiJydSo.exe
  2⤵
  PID:9428
- C:\Windows\System\FnwWAyT.exe
  C:\Windows\System\FnwWAyT.exe
  2⤵
  PID:9456
- C:\Windows\System\PxwYbvP.exe
  C:\Windows\System\PxwYbvP.exe
  2⤵
  PID:9476
- C:\Windows\System\vkBmjOq.exe
  C:\Windows\System\vkBmjOq.exe
  2⤵
  PID:9500
- C:\Windows\System\DPRhLpq.exe
  C:\Windows\System\DPRhLpq.exe
  2⤵
  PID:9520
- C:\Windows\System\iodprzf.exe
  C:\Windows\System\iodprzf.exe
  2⤵
  PID:9536
- C:\Windows\System\SYaxtNE.exe
  C:\Windows\System\SYaxtNE.exe
  2⤵
  PID:9556
- C:\Windows\System\oiZGexn.exe
  C:\Windows\System\oiZGexn.exe
  2⤵
  PID:9572
- C:\Windows\System\oTtMiXM.exe
  C:\Windows\System\oTtMiXM.exe
  2⤵
  PID:9588
- C:\Windows\System\mrEAfAt.exe
  C:\Windows\System\mrEAfAt.exe
  2⤵
  PID:9604
- C:\Windows\System\TyKXKYg.exe
  C:\Windows\System\TyKXKYg.exe
  2⤵
  PID:9624
- C:\Windows\System\aWLhstS.exe
  C:\Windows\System\aWLhstS.exe
  2⤵
  PID:9644
- C:\Windows\System\iEsuIEq.exe
  C:\Windows\System\iEsuIEq.exe
  2⤵
  PID:9664
- C:\Windows\System\csnYcPB.exe
  C:\Windows\System\csnYcPB.exe
  2⤵
  PID:9688
- C:\Windows\System\COyBtze.exe
  C:\Windows\System\COyBtze.exe
  2⤵
  PID:9704
- C:\Windows\System\ZGEMTcF.exe
  C:\Windows\System\ZGEMTcF.exe
  2⤵
  PID:9728
- C:\Windows\System\LQebwgy.exe
  C:\Windows\System\LQebwgy.exe
  2⤵
  PID:9752
- C:\Windows\System\vLnVCTE.exe
  C:\Windows\System\vLnVCTE.exe
  2⤵
  PID:9772
- C:\Windows\System\fpwOVCB.exe
  C:\Windows\System\fpwOVCB.exe
  2⤵
  PID:9792
- C:\Windows\System\gKWxTvz.exe
  C:\Windows\System\gKWxTvz.exe
  2⤵
  PID:9820
- C:\Windows\System\FHTaAsh.exe
  C:\Windows\System\FHTaAsh.exe
  2⤵
  PID:9844
- C:\Windows\System\QIiSoWg.exe
  C:\Windows\System\QIiSoWg.exe
  2⤵
  PID:9868
- C:\Windows\System\HeOKEsv.exe
  C:\Windows\System\HeOKEsv.exe
  2⤵
  PID:9900
- C:\Windows\System\sskMWdf.exe
  C:\Windows\System\sskMWdf.exe
  2⤵
  PID:9924
- C:\Windows\System\DAfJmQk.exe
  C:\Windows\System\DAfJmQk.exe
  2⤵
  PID:9952
- C:\Windows\System\QrjSvvJ.exe
  C:\Windows\System\QrjSvvJ.exe
  2⤵
  PID:9972
- C:\Windows\System\viFsJze.exe
  C:\Windows\System\viFsJze.exe
  2⤵
  PID:9996
- C:\Windows\System\tVQoPti.exe
  C:\Windows\System\tVQoPti.exe
  2⤵
  PID:10016
- C:\Windows\System\jWAaFAU.exe
  C:\Windows\System\jWAaFAU.exe
  2⤵
  PID:10036
- C:\Windows\System\uTxOUIX.exe
  C:\Windows\System\uTxOUIX.exe
  2⤵
  PID:10060
- C:\Windows\System\laDDqgE.exe
  C:\Windows\System\laDDqgE.exe
  2⤵
  PID:10088
- C:\Windows\System\geUMDyu.exe
  C:\Windows\System\geUMDyu.exe
  2⤵
  PID:10108
- C:\Windows\System\OgozusH.exe
  C:\Windows\System\OgozusH.exe
  2⤵
  PID:10128
- C:\Windows\System\AfCjVRm.exe
  C:\Windows\System\AfCjVRm.exe
  2⤵
  PID:10156
- C:\Windows\System\PUfjMHC.exe
  C:\Windows\System\PUfjMHC.exe
  2⤵
  PID:10180
- C:\Windows\System\mTHUxdj.exe
  C:\Windows\System\mTHUxdj.exe
  2⤵
  PID:10208
- C:\Windows\System\BAeSiWC.exe
  C:\Windows\System\BAeSiWC.exe
  2⤵
  PID:10228
- C:\Windows\System\faPoHUX.exe
  C:\Windows\System\faPoHUX.exe
  2⤵
  PID:7196
- C:\Windows\System\cnqAcDN.exe
  C:\Windows\System\cnqAcDN.exe
  2⤵
  PID:8840
- C:\Windows\System\CHZWoJR.exe
  C:\Windows\System\CHZWoJR.exe
  2⤵
  PID:8620
- C:\Windows\System\nUrKHSe.exe
  C:\Windows\System\nUrKHSe.exe
  2⤵
  PID:8752
- C:\Windows\System\nzWfHTx.exe
  C:\Windows\System\nzWfHTx.exe
  2⤵
  PID:9136
- C:\Windows\System\pjrAnHI.exe
  C:\Windows\System\pjrAnHI.exe
  2⤵
  PID:9144
- C:\Windows\System\ekltbny.exe
  C:\Windows\System\ekltbny.exe
  2⤵
  PID:7312
- C:\Windows\System\iHGguto.exe
  C:\Windows\System\iHGguto.exe
  2⤵
  PID:8184
- C:\Windows\System\xxrhCQq.exe
  C:\Windows\System\xxrhCQq.exe
  2⤵
  PID:8660
- C:\Windows\System\rfoyMvr.exe
  C:\Windows\System\rfoyMvr.exe
  2⤵
  PID:9268
- C:\Windows\System\FEDEBKc.exe
  C:\Windows\System\FEDEBKc.exe
  2⤵
  PID:8288
- C:\Windows\System\DxipRwN.exe
  C:\Windows\System\DxipRwN.exe
  2⤵
  PID:6580
- C:\Windows\System\ToaVpym.exe
  C:\Windows\System\ToaVpym.exe
  2⤵
  PID:9412
- C:\Windows\System\OOrGSsX.exe
  C:\Windows\System\OOrGSsX.exe
  2⤵
  PID:9472
- C:\Windows\System\TPXKNPi.exe
  C:\Windows\System\TPXKNPi.exe
  2⤵
  PID:4704
- C:\Windows\System\oUhgBvU.exe
  C:\Windows\System\oUhgBvU.exe
  2⤵
  PID:8792
- C:\Windows\System\FqeNRCh.exe
  C:\Windows\System\FqeNRCh.exe
  2⤵
  PID:9192
- C:\Windows\System\cAsGfcR.exe
  C:\Windows\System\cAsGfcR.exe
  2⤵
  PID:9712
- C:\Windows\System\CmfDtdp.exe
  C:\Windows\System\CmfDtdp.exe
  2⤵
  PID:10252
- C:\Windows\System\HfgYZXK.exe
  C:\Windows\System\HfgYZXK.exe
  2⤵
  PID:10280
- C:\Windows\System\UkjvSyZ.exe
  C:\Windows\System\UkjvSyZ.exe
  2⤵
  PID:10296
- C:\Windows\System\hoCOzfG.exe
  C:\Windows\System\hoCOzfG.exe
  2⤵
  PID:10320
- C:\Windows\System\AoSBWLz.exe
  C:\Windows\System\AoSBWLz.exe
  2⤵
  PID:10340
- C:\Windows\System\AqGekeU.exe
  C:\Windows\System\AqGekeU.exe
  2⤵
  PID:10364
- C:\Windows\System\bWARUqF.exe
  C:\Windows\System\bWARUqF.exe
  2⤵
  PID:10388
- C:\Windows\System\MiiJffE.exe
  C:\Windows\System\MiiJffE.exe
  2⤵
  PID:10408
- C:\Windows\System\cAcwlsZ.exe
  C:\Windows\System\cAcwlsZ.exe
  2⤵
  PID:10432
- C:\Windows\System\JyrJlxH.exe
  C:\Windows\System\JyrJlxH.exe
  2⤵
  PID:10464
- C:\Windows\System\XTlpUIi.exe
  C:\Windows\System\XTlpUIi.exe
  2⤵
  PID:10480
- C:\Windows\System\fMwZtgd.exe
  C:\Windows\System\fMwZtgd.exe
  2⤵
  PID:10496
- C:\Windows\System\uGQlcvV.exe
  C:\Windows\System\uGQlcvV.exe
  2⤵
  PID:10512
- C:\Windows\System\EkBUIvv.exe
  C:\Windows\System\EkBUIvv.exe
  2⤵
  PID:10532
- C:\Windows\System\pwWeEGH.exe
  C:\Windows\System\pwWeEGH.exe
  2⤵
  PID:10548
- C:\Windows\System\NswdPaV.exe
  C:\Windows\System\NswdPaV.exe
  2⤵
  PID:10568
- C:\Windows\System\HuLZOWi.exe
  C:\Windows\System\HuLZOWi.exe
  2⤵
  PID:10596
- C:\Windows\System\mohJmiA.exe
  C:\Windows\System\mohJmiA.exe
  2⤵
  PID:10616
- C:\Windows\System\FbDFElZ.exe
  C:\Windows\System\FbDFElZ.exe
  2⤵
  PID:10636
- C:\Windows\System\gynSuAN.exe
  C:\Windows\System\gynSuAN.exe
  2⤵
  PID:10664
- C:\Windows\System\OQIorNK.exe
  C:\Windows\System\OQIorNK.exe
  2⤵
  PID:10696
- C:\Windows\System\vyFRNKX.exe
  C:\Windows\System\vyFRNKX.exe
  2⤵
  PID:10720
- C:\Windows\System\uRmQlfH.exe
  C:\Windows\System\uRmQlfH.exe
  2⤵
  PID:10740
- C:\Windows\System\UvdpTJz.exe
  C:\Windows\System\UvdpTJz.exe
  2⤵
  PID:10760
- C:\Windows\System\NUNyYKr.exe
  C:\Windows\System\NUNyYKr.exe
  2⤵
  PID:10788
- C:\Windows\System\nrkYuAu.exe
  C:\Windows\System\nrkYuAu.exe
  2⤵
  PID:10808
- C:\Windows\System\pkjXnLD.exe
  C:\Windows\System\pkjXnLD.exe
  2⤵
  PID:10836
- C:\Windows\System\nXnohYe.exe
  C:\Windows\System\nXnohYe.exe
  2⤵
  PID:10860
- C:\Windows\System\guNARgG.exe
  C:\Windows\System\guNARgG.exe
  2⤵
  PID:10884
- C:\Windows\System\rRehXav.exe
  C:\Windows\System\rRehXav.exe
  2⤵
  PID:10900
- C:\Windows\System\KDaYaXh.exe
  C:\Windows\System\KDaYaXh.exe
  2⤵
  PID:10928
- C:\Windows\System\qHeNPow.exe
  C:\Windows\System\qHeNPow.exe
  2⤵
  PID:10948
- C:\Windows\System\rvOkGnS.exe
  C:\Windows\System\rvOkGnS.exe
  2⤵
  PID:10968
- C:\Windows\System\lHizCWK.exe
  C:\Windows\System\lHizCWK.exe
  2⤵
  PID:10996
- C:\Windows\System\yaIFjib.exe
  C:\Windows\System\yaIFjib.exe
  2⤵
  PID:11020
- C:\Windows\System\FCGuLjU.exe
  C:\Windows\System\FCGuLjU.exe
  2⤵
  PID:11048
- C:\Windows\System\TaPjEvk.exe
  C:\Windows\System\TaPjEvk.exe
  2⤵
  PID:11068
- C:\Windows\System\wAvgGBs.exe
  C:\Windows\System\wAvgGBs.exe
  2⤵
  PID:11092
- C:\Windows\System\vOgSick.exe
  C:\Windows\System\vOgSick.exe
  2⤵
  PID:11116
- C:\Windows\System\dJOXSOZ.exe
  C:\Windows\System\dJOXSOZ.exe
  2⤵
  PID:11136
- C:\Windows\System\iPJQLWG.exe
  C:\Windows\System\iPJQLWG.exe
  2⤵
  PID:11164
- C:\Windows\System\BsnqDrc.exe
  C:\Windows\System\BsnqDrc.exe
  2⤵
  PID:11188
- C:\Windows\System\sZwVtyC.exe
  C:\Windows\System\sZwVtyC.exe
  2⤵
  PID:11208
- C:\Windows\System\ODwwjYa.exe
  C:\Windows\System\ODwwjYa.exe
  2⤵
  PID:11224
- C:\Windows\System\pycMPfC.exe
  C:\Windows\System\pycMPfC.exe
  2⤵
  PID:11240
- C:\Windows\System\uOoSohZ.exe
  C:\Windows\System\uOoSohZ.exe
  2⤵
  PID:8948
- C:\Windows\System\IqNmQzh.exe
  C:\Windows\System\IqNmQzh.exe
  2⤵
  PID:9856
- C:\Windows\System\ASsHtMQ.exe
  C:\Windows\System\ASsHtMQ.exe
  2⤵
  PID:7980
- C:\Windows\System\nGpBDXG.exe
  C:\Windows\System\nGpBDXG.exe
  2⤵
  PID:10008
- C:\Windows\System\qaGRlnG.exe
  C:\Windows\System\qaGRlnG.exe
  2⤵
  PID:10044
- C:\Windows\System\CTseVmw.exe
  C:\Windows\System\CTseVmw.exe
  2⤵
  PID:9328
- C:\Windows\System\jlylxDx.exe
  C:\Windows\System\jlylxDx.exe
  2⤵
  PID:9380
- C:\Windows\System\UpLGIzT.exe
  C:\Windows\System\UpLGIzT.exe
  2⤵
  PID:8532
- C:\Windows\System\cnjuFzu.exe
  C:\Windows\System\cnjuFzu.exe
  2⤵
  PID:9488
- C:\Windows\System\nFOgxiA.exe
  C:\Windows\System\nFOgxiA.exe
  2⤵
  PID:1512
- C:\Windows\System\ZMlXPCj.exe
  C:\Windows\System\ZMlXPCj.exe
  2⤵
  PID:7300
- C:\Windows\System\ijShFzD.exe
  C:\Windows\System\ijShFzD.exe
  2⤵
  PID:8984
- C:\Windows\System\nnwmrcG.exe
  C:\Windows\System\nnwmrcG.exe
  2⤵
  PID:9660
- C:\Windows\System\TTzKVPb.exe
  C:\Windows\System\TTzKVPb.exe
  2⤵
  PID:9044
- C:\Windows\System\GAkZJyP.exe
  C:\Windows\System\GAkZJyP.exe
  2⤵
  PID:9564
- C:\Windows\System\rrUewhd.exe
  C:\Windows\System\rrUewhd.exe
  2⤵
  PID:10304
- C:\Windows\System\efPAAbd.exe
  C:\Windows\System\efPAAbd.exe
  2⤵
  PID:9876
- C:\Windows\System\jhYvTrQ.exe
  C:\Windows\System\jhYvTrQ.exe
  2⤵
  PID:10440
- C:\Windows\System\UrVDcgD.exe
  C:\Windows\System\UrVDcgD.exe
  2⤵
  PID:10476
- C:\Windows\System\MwXztTT.exe
  C:\Windows\System\MwXztTT.exe
  2⤵
  PID:10540
- C:\Windows\System\pINYupN.exe
  C:\Windows\System\pINYupN.exe
  2⤵
  PID:10576
- C:\Windows\System\NDWvnmS.exe
  C:\Windows\System\NDWvnmS.exe
  2⤵
  PID:9252
- C:\Windows\System\wWLNGhQ.exe
  C:\Windows\System\wWLNGhQ.exe
  2⤵
  PID:10584
- C:\Windows\System\QHFqJAG.exe
  C:\Windows\System\QHFqJAG.exe
  2⤵
  PID:11268
- C:\Windows\System\aPyzUyG.exe
  C:\Windows\System\aPyzUyG.exe
  2⤵
  PID:11284
- C:\Windows\System\hzKXqZq.exe
  C:\Windows\System\hzKXqZq.exe
  2⤵
  PID:11304
- C:\Windows\System\nZoxHWd.exe
  C:\Windows\System\nZoxHWd.exe
  2⤵
  PID:11320
- C:\Windows\System\WnUzjft.exe
  C:\Windows\System\WnUzjft.exe
  2⤵
  PID:11336
- C:\Windows\System\TSnFyEX.exe
  C:\Windows\System\TSnFyEX.exe
  2⤵
  PID:11356
- C:\Windows\System\JBPKyxT.exe
  C:\Windows\System\JBPKyxT.exe
  2⤵
  PID:11376
- C:\Windows\System\RzyHEdj.exe
  C:\Windows\System\RzyHEdj.exe
  2⤵
  PID:11396
- C:\Windows\System\Ytvuujq.exe
  C:\Windows\System\Ytvuujq.exe
  2⤵
  PID:11420
- C:\Windows\System\NWspWAK.exe
  C:\Windows\System\NWspWAK.exe
  2⤵
  PID:11444
- C:\Windows\System\NHBsJCp.exe
  C:\Windows\System\NHBsJCp.exe
  2⤵
  PID:11464
- C:\Windows\System\vaavjbJ.exe
  C:\Windows\System\vaavjbJ.exe
  2⤵
  PID:11492
- C:\Windows\System\fJJtxcx.exe
  C:\Windows\System\fJJtxcx.exe
  2⤵
  PID:11512
- C:\Windows\System\SwbDxBE.exe
  C:\Windows\System\SwbDxBE.exe
  2⤵
  PID:11532
- C:\Windows\System\TLndWNS.exe
  C:\Windows\System\TLndWNS.exe
  2⤵
  PID:11556
- C:\Windows\System\vmGudGi.exe
  C:\Windows\System\vmGudGi.exe
  2⤵
  PID:11580
- C:\Windows\System\GArQLpM.exe
  C:\Windows\System\GArQLpM.exe
  2⤵
  PID:11600
- C:\Windows\System\DqevTnp.exe
  C:\Windows\System\DqevTnp.exe
  2⤵
  PID:11620
- C:\Windows\System\xetkqMV.exe
  C:\Windows\System\xetkqMV.exe
  2⤵
  PID:11640
- C:\Windows\System\iWIXXWH.exe
  C:\Windows\System\iWIXXWH.exe
  2⤵
  PID:11668
- C:\Windows\System\HdMNuWf.exe
  C:\Windows\System\HdMNuWf.exe
  2⤵
  PID:11696
- C:\Windows\System\NZYUPZe.exe
  C:\Windows\System\NZYUPZe.exe
  2⤵
  PID:11716
- C:\Windows\System\DNZyyTx.exe
  C:\Windows\System\DNZyyTx.exe
  2⤵
  PID:11736
- C:\Windows\System\GVJTImR.exe
  C:\Windows\System\GVJTImR.exe
  2⤵
  PID:11760
- C:\Windows\System\YmJEZYc.exe
  C:\Windows\System\YmJEZYc.exe
  2⤵
  PID:11788
- C:\Windows\System\xheaCKn.exe
  C:\Windows\System\xheaCKn.exe
  2⤵
  PID:11808
- C:\Windows\System\TJFTMAC.exe
  C:\Windows\System\TJFTMAC.exe
  2⤵
  PID:11828
- C:\Windows\System\MRzivgP.exe
  C:\Windows\System\MRzivgP.exe
  2⤵
  PID:11856
- C:\Windows\System\LoPISyR.exe
  C:\Windows\System\LoPISyR.exe
  2⤵
  PID:11876
- C:\Windows\System\kNTUZqe.exe
  C:\Windows\System\kNTUZqe.exe
  2⤵
  PID:11900
- C:\Windows\System\TWWWxUX.exe
  C:\Windows\System\TWWWxUX.exe
  2⤵
  PID:11924
- C:\Windows\System\VeholDS.exe
  C:\Windows\System\VeholDS.exe
  2⤵
  PID:11948
- C:\Windows\System\JoKAmDY.exe
  C:\Windows\System\JoKAmDY.exe
  2⤵
  PID:9760
- C:\Windows\System\AkLQFtC.exe
  C:\Windows\System\AkLQFtC.exe
  2⤵
  PID:7236
- C:\Windows\System\iFFPGdW.exe
  C:\Windows\System\iFFPGdW.exe
  2⤵
  PID:9324
- C:\Windows\System\PcqIHHe.exe
  C:\Windows\System\PcqIHHe.exe
  2⤵
  PID:9656
- C:\Windows\System\hEZBGcH.exe
  C:\Windows\System\hEZBGcH.exe
  2⤵
  PID:10628
- C:\Windows\System\yjRZPsO.exe
  C:\Windows\System\yjRZPsO.exe
  2⤵
  PID:10068
- C:\Windows\System\AZHmKTd.exe
  C:\Windows\System\AZHmKTd.exe
  2⤵
  PID:10136
- C:\Windows\System\vNnppGD.exe
  C:\Windows\System\vNnppGD.exe
  2⤵
  PID:11568
- C:\Windows\System\wKmmaxu.exe
  C:\Windows\System\wKmmaxu.exe
  2⤵
  PID:11636
- C:\Windows\System\epGVnYU.exe
  C:\Windows\System\epGVnYU.exe
  2⤵
  PID:11780
- C:\Windows\System\LZindQx.exe
  C:\Windows\System\LZindQx.exe
  2⤵
  PID:11824
- C:\Windows\System\IqOBcgh.exe
  C:\Windows\System\IqOBcgh.exe
  2⤵
  PID:10988
- C:\Windows\System\uZHkKlA.exe
  C:\Windows\System\uZHkKlA.exe
  2⤵
  PID:9228
- C:\Windows\System\TIIhxFu.exe
  C:\Windows\System\TIIhxFu.exe
  2⤵
  PID:11916
- C:\Windows\System\sUWXIHl.exe
  C:\Windows\System\sUWXIHl.exe
  2⤵
  PID:11944
- C:\Windows\System\faBjPfG.exe
  C:\Windows\System\faBjPfG.exe
  2⤵
  PID:11112
- C:\Windows\System\isyeTjT.exe
  C:\Windows\System\isyeTjT.exe
  2⤵
  PID:11172
- C:\Windows\System\LdNvzIu.exe
  C:\Windows\System\LdNvzIu.exe
  2⤵
  PID:3880
- C:\Windows\System\wPMCwmP.exe
  C:\Windows\System\wPMCwmP.exe
  2⤵
  PID:11204
- C:\Windows\System\TfGinBC.exe
  C:\Windows\System\TfGinBC.exe
  2⤵
  PID:9888
- C:\Windows\System\xmViUVG.exe
  C:\Windows\System\xmViUVG.exe
  2⤵
  PID:10104
- C:\Windows\System\MFyGgOU.exe
  C:\Windows\System\MFyGgOU.exe
  2⤵
  PID:12108
- C:\Windows\System\jTpJKeN.exe
  C:\Windows\System\jTpJKeN.exe
  2⤵
  PID:10604
- C:\Windows\System\jlfLRlw.exe
  C:\Windows\System\jlfLRlw.exe
  2⤵
  PID:10672
- C:\Windows\System\OwuDpry.exe
  C:\Windows\System\OwuDpry.exe
  2⤵
  PID:11388
- C:\Windows\System\LHFuxpk.exe
  C:\Windows\System\LHFuxpk.exe
  2⤵
  PID:11460
- C:\Windows\System\CjkillX.exe
  C:\Windows\System\CjkillX.exe
  2⤵
  PID:10800
- C:\Windows\System\tDqzTzU.exe
  C:\Windows\System\tDqzTzU.exe
  2⤵
  PID:11576
- C:\Windows\System\sBNUtvB.exe
  C:\Windows\System\sBNUtvB.exe
  2⤵
  PID:10916
- C:\Windows\System\WDiLCzY.exe
  C:\Windows\System\WDiLCzY.exe
  2⤵
  PID:11732
- C:\Windows\System\OnjNmqq.exe
  C:\Windows\System\OnjNmqq.exe
  2⤵
  PID:11132
- C:\Windows\System\BXChmQi.exe
  C:\Windows\System\BXChmQi.exe
  2⤵
  PID:12312
- C:\Windows\System\QghrXko.exe
  C:\Windows\System\QghrXko.exe
  2⤵
  PID:12340
- C:\Windows\System\JJDuumt.exe
  C:\Windows\System\JJDuumt.exe
  2⤵
  PID:12364
- C:\Windows\System\FAiNltA.exe
  C:\Windows\System\FAiNltA.exe
  2⤵
  PID:12380
- C:\Windows\System\uaKgtgs.exe
  C:\Windows\System\uaKgtgs.exe
  2⤵
  PID:12404
- C:\Windows\System\vxTugwK.exe
  C:\Windows\System\vxTugwK.exe
  2⤵
  PID:12424
- C:\Windows\System\uwaAuZn.exe
  C:\Windows\System\uwaAuZn.exe
  2⤵
  PID:12448
- C:\Windows\System\DnmhWxY.exe
  C:\Windows\System\DnmhWxY.exe
  2⤵
  PID:12468
- C:\Windows\System\kpnsqsK.exe
  C:\Windows\System\kpnsqsK.exe
  2⤵
  PID:12488
- C:\Windows\System\HiIBvai.exe
  C:\Windows\System\HiIBvai.exe
  2⤵
  PID:12508
- C:\Windows\System\BiJFGts.exe
  C:\Windows\System\BiJFGts.exe
  2⤵
  PID:12524
- C:\Windows\System\mKfZqIa.exe
  C:\Windows\System\mKfZqIa.exe
  2⤵
  PID:12544
- C:\Windows\System\BIBUZfM.exe
  C:\Windows\System\BIBUZfM.exe
  2⤵
  PID:12560
- C:\Windows\System\hHBIAXV.exe
  C:\Windows\System\hHBIAXV.exe
  2⤵
  PID:12576
- C:\Windows\System\EPwkLqI.exe
  C:\Windows\System\EPwkLqI.exe
  2⤵
  PID:12592
- C:\Windows\System\pBkbykf.exe
  C:\Windows\System\pBkbykf.exe
  2⤵
  PID:12608
- C:\Windows\System\flnGphL.exe
  C:\Windows\System\flnGphL.exe
  2⤵
  PID:12624
- C:\Windows\System\GpyzsYi.exe
  C:\Windows\System\GpyzsYi.exe
  2⤵
  PID:12648
- C:\Windows\System\HerGXMv.exe
  C:\Windows\System\HerGXMv.exe
  2⤵
  PID:12676
- C:\Windows\System\yraNLGI.exe
  C:\Windows\System\yraNLGI.exe
  2⤵
  PID:12704
- C:\Windows\System\gNIQIuV.exe
  C:\Windows\System\gNIQIuV.exe
  2⤵
  PID:12724
- C:\Windows\System\jRBArae.exe
  C:\Windows\System\jRBArae.exe
  2⤵
  PID:12744
- C:\Windows\System\VumtMvi.exe
  C:\Windows\System\VumtMvi.exe
  2⤵
  PID:12768
- C:\Windows\System\dLrMeXZ.exe
  C:\Windows\System\dLrMeXZ.exe
  2⤵
  PID:12788
- C:\Windows\System\GtihniY.exe
  C:\Windows\System\GtihniY.exe
  2⤵
  PID:12816
- C:\Windows\System\DctHrel.exe
  C:\Windows\System\DctHrel.exe
  2⤵
  PID:12840
- C:\Windows\System\KNjBYSt.exe
  C:\Windows\System\KNjBYSt.exe
  2⤵
  PID:12864
- C:\Windows\System\RmXNmLY.exe
  C:\Windows\System\RmXNmLY.exe
  2⤵
  PID:12880
- C:\Windows\System\iPtMZet.exe
  C:\Windows\System\iPtMZet.exe
  2⤵
  PID:12916
- C:\Windows\System\ylXxSTl.exe
  C:\Windows\System\ylXxSTl.exe
  2⤵
  PID:12940
- C:\Windows\System\aSytLDB.exe
  C:\Windows\System\aSytLDB.exe
  2⤵
  PID:12964
- C:\Windows\System\zrBmDRc.exe
  C:\Windows\System\zrBmDRc.exe
  2⤵
  PID:8244
- C:\Windows\System\yetQcGB.exe
  C:\Windows\System\yetQcGB.exe
  2⤵
  PID:13308
- C:\Windows\System\NuRTYuH.exe
  C:\Windows\System\NuRTYuH.exe
  2⤵
  PID:13068
- C:\Windows\System\RwBmPbt.exe
  C:\Windows\System\RwBmPbt.exe
  2⤵
  PID:9548
- C:\Windows\System\KfGTeDG.exe
  C:\Windows\System\KfGTeDG.exe
  2⤵
  PID:9992
- C:\Windows\System\bcOTaxB.exe
  C:\Windows\System\bcOTaxB.exe
  2⤵
  PID:10380
- C:\Windows\System\fSMNnGC.exe
  C:\Windows\System\fSMNnGC.exe
  2⤵
  PID:11312
- C:\Windows\System\YFgIjab.exe
  C:\Windows\System\YFgIjab.exe
  2⤵
  PID:10200
- C:\Windows\System\tSHPDgK.exe
  C:\Windows\System\tSHPDgK.exe
  2⤵
  PID:11756
- C:\Windows\System\dziwnkb.exe
  C:\Windows\System\dziwnkb.exe
  2⤵
  PID:12280
- C:\Windows\System\RgItLOi.exe
  C:\Windows\System\RgItLOi.exe
  2⤵
  PID:11296
- C:\Windows\System\jxUdNTE.exe
  C:\Windows\System\jxUdNTE.exe
  2⤵
  PID:11372
- C:\Windows\System\ZfYnLEl.exe
  C:\Windows\System\ZfYnLEl.exe
  2⤵
  PID:11836
- C:\Windows\System\TRYnIsD.exe
  C:\Windows\System\TRYnIsD.exe
  2⤵
  PID:10216
- C:\Windows\System\UvcxujJ.exe
  C:\Windows\System\UvcxujJ.exe
  2⤵
  PID:11364
- C:\Windows\System\HRNwZij.exe
  C:\Windows\System\HRNwZij.exe
  2⤵
  PID:11612
- C:\Windows\System\fatHAHh.exe
  C:\Windows\System\fatHAHh.exe
  2⤵
  PID:12776
- C:\Windows\System\CxzFURA.exe
  C:\Windows\System\CxzFURA.exe
  2⤵
  PID:12872
- C:\Windows\System\GwddZbI.exe
  C:\Windows\System\GwddZbI.exe
  2⤵
  PID:13020
- C:\Windows\System\SuNoDdM.exe
  C:\Windows\System\SuNoDdM.exe
  2⤵
  PID:12256
- C:\Windows\System\YhGAsIM.exe
  C:\Windows\System\YhGAsIM.exe
  2⤵
  PID:9300
- C:\Windows\System\GfQqLMq.exe
  C:\Windows\System\GfQqLMq.exe
  2⤵
  PID:7972
- C:\Windows\System\wbbuEHu.exe
  C:\Windows\System\wbbuEHu.exe
  2⤵
  PID:12948
- C:\Windows\System\QJnKALj.exe
  C:\Windows\System\QJnKALj.exe
  2⤵
  PID:12036
- C:\Windows\System\fiLCQcs.exe
  C:\Windows\System\fiLCQcs.exe
  2⤵
  PID:13012
- C:\Windows\System\ueSvdiI.exe
  C:\Windows\System\ueSvdiI.exe
  2⤵
  PID:12852
- C:\Windows\System\BFduLLJ.exe
  C:\Windows\System\BFduLLJ.exe
  2⤵
  PID:11596
- C:\Windows\System\lYHRfty.exe
  C:\Windows\System\lYHRfty.exe
  2⤵
  PID:10612
- C:\Windows\System\TVZmLWc.exe
  C:\Windows\System\TVZmLWc.exe
  2⤵
  PID:5712
- C:\Windows\System\BkzTNpU.exe
  C:\Windows\System\BkzTNpU.exe
  2⤵
  PID:13268
- C:\Windows\System\PDlnIeh.exe
  C:\Windows\System\PDlnIeh.exe
  2⤵
  PID:12692
- C:\Windows\System\KpiuFEe.exe
  C:\Windows\System\KpiuFEe.exe
  2⤵
  PID:12572
- C:\Windows\System\VAcNUMp.exe
  C:\Windows\System\VAcNUMp.exe
  2⤵
  PID:13160
- C:\Windows\System\VVCYZcp.exe
  C:\Windows\System\VVCYZcp.exe
  2⤵
  PID:9220
- C:\Windows\System\uxSIUTR.exe
  C:\Windows\System\uxSIUTR.exe
  2⤵
  PID:12952
- C:\Windows\System\FMOmjSB.exe
  C:\Windows\System\FMOmjSB.exe
  2⤵
  PID:10608
- C:\Windows\System\dKEstac.exe
  C:\Windows\System\dKEstac.exe
  2⤵
  PID:12760
- C:\Windows\System\oOOrbaI.exe
  C:\Windows\System\oOOrbaI.exe
  2⤵
  PID:12604
- C:\Windows\System\WTiTvsg.exe
  C:\Windows\System\WTiTvsg.exe
  2⤵
  PID:9444
- C:\Windows\System\XloLkkP.exe
  C:\Windows\System\XloLkkP.exe
  2⤵
  PID:10492
- C:\Windows\System\xqHvcqF.exe
  C:\Windows\System\xqHvcqF.exe
  2⤵
  PID:11456
- C:\Windows\System\bgUGuLB.exe
  C:\Windows\System\bgUGuLB.exe
  2⤵
  PID:8368
- C:\Windows\System\GHJRgsa.exe
  C:\Windows\System\GHJRgsa.exe
  2⤵
  PID:12076
- C:\Windows\System\ayIfHDy.exe
  C:\Windows\System\ayIfHDy.exe
  2⤵
  PID:12756
- C:\Windows\System\aCZchzN.exe
  C:\Windows\System\aCZchzN.exe
  2⤵
  PID:11128
- C:\Windows\System\InhvBvC.exe
  C:\Windows\System\InhvBvC.exe
  2⤵
  PID:11260
- C:\Windows\System\HLgrtAx.exe
  C:\Windows\System\HLgrtAx.exe
  2⤵
  PID:13236
- C:\Windows\System\CdLTAqj.exe
  C:\Windows\System\CdLTAqj.exe
  2⤵
  PID:3868
- C:\Windows\System\BAPNguA.exe
  C:\Windows\System\BAPNguA.exe
  2⤵
  PID:12876
- C:\Windows\System\rQdkYed.exe
  C:\Windows\System\rQdkYed.exe
  2⤵
  PID:13212
- C:\Windows\System\BIlCSnt.exe
  C:\Windows\System\BIlCSnt.exe
  2⤵
  PID:11656
- C:\Windows\System\lmZEmID.exe
  C:\Windows\System\lmZEmID.exe
  2⤵
  PID:12352
- C:\Windows\System\fCzfwsa.exe
  C:\Windows\System\fCzfwsa.exe
  2⤵
  PID:12752
- C:\Windows\System\QXZBtew.exe
  C:\Windows\System\QXZBtew.exe
  2⤵
  PID:12904
- C:\Windows\System\JqjRijt.exe
  C:\Windows\System\JqjRijt.exe
  2⤵
  PID:11544
- C:\Windows\System\abRpxsm.exe
  C:\Windows\System\abRpxsm.exe
  2⤵
  PID:2028
- C:\Windows\System\UuOuBCc.exe
  C:\Windows\System\UuOuBCc.exe
  2⤵
  PID:4480
- C:\Windows\System\KohHCyZ.exe
  C:\Windows\System\KohHCyZ.exe
  2⤵
  PID:2296
- C:\Windows\System\ffYLXYU.exe
  C:\Windows\System\ffYLXYU.exe
  2⤵
  PID:7516
- C:\Windows\System\isNiFxr.exe
  C:\Windows\System\isNiFxr.exe
  2⤵
  PID:12348
- C:\Windows\System\nThUQoL.exe
  C:\Windows\System\nThUQoL.exe
  2⤵
  PID:13036
- C:\Windows\System\EGmJUqT.exe
  C:\Windows\System\EGmJUqT.exe
  2⤵
  PID:3396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lk3qjpjo.mce.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BUbXRFM.exe

Filesize
2.2MB

MD5
0d9d9f4cda8b4e87137ae84395caf44b

SHA1
048ecf707c8134281e7f0799d044838df836025b

SHA256
0751fc9146534d164012c09d150d6e551dbf65c094d9c89d1d337b2efbaa45c0

SHA512
d3ca49f3494aa1fd78cfca0c3b7deba33597261fac209b37a57dfb9f28724e5515cabd25ec4dad488f5bf64b5ed35ca3754ef18b541264b414d05f2de0107f49

Download Submit
C:\Windows\System\BrgIfPE.exe

Filesize
2.2MB

MD5
7c50414f9584bae91ec440d0da729edb

SHA1
296e8143bf33681431e01be58ac86531e2c269c9

SHA256
08c9b03b05d47bf7a0d4f357a4c1c8b5467ed1a817e4e3be336709ec8282750c

SHA512
3b36bdcca2ad7ff389bd6ee6f3b38d761425880daf4b70c0148aa67fc21a219379e9eab92b12a1a219851fdaf3d5c978be3a857420feb7a3c03a745d1eae3f70

Download Submit
C:\Windows\System\DmzBOKd.exe

Filesize
2.2MB

MD5
e179b6c6b38975d0d0d1e1ad93fe8d78

SHA1
27a3f813616e1680dff9936e381e9ebc076462de

SHA256
0e983b49ed166d413143431b86320f4ed31f7a43788288cb86a728b7da098a3c

SHA512
cd887220e00ad2d5c5331ae3f564b42a05ed89d02c758eb5af7a7cc19d3d488082e6894b153bf71340e47e8d7421404941ee63b7a4afae33efcc66e917b09149

Download Submit
C:\Windows\System\DsPggNs.exe

Filesize
2.2MB

MD5
62bf789794b53b06eb5d240eeb3c323a

SHA1
c47eaf268548225169fa5d6b5ecc450dd785fd52

SHA256
8af35f783f6fe613265ec010ee048443ef30659ab8128d53b9850490ea256c69

SHA512
544c618f695a1564b9e38033d4280b0c25015a9462c8a50dba3c264ff4a311597f4978905cc330ce856d50d5da98a1a47546b233088cd0e4b2ef17c159b9978d

Download Submit
C:\Windows\System\EqOgavL.exe

Filesize
2.2MB

MD5
53ddcb52012e7510c6832b9ac816f2f0

SHA1
600132f72198c4ac4d0999edc012054057ef0256

SHA256
a71faee3bba25e4781a2c874302c0d08115504a8167ab43e853b5195df70025b

SHA512
25639a9c6ce6afcd09d795fe367cd0ae74f95a13a1c5e4e80ce192f9e195b7428eba455cb3c3db08ac2b17a0c8ca610195dfedc7e6176f7792b089a57ffc2a45

Download Submit
C:\Windows\System\FJQGUYR.exe

Filesize
2.2MB

MD5
11495f0cc3c817dfaa7de17847d23257

SHA1
72d315d68cebd3573029e3fbe3cb408ec16cb12b

SHA256
a630f459fed6cd88bbafea64651eaaa05a83e50143362072269d1b8e6f634760

SHA512
4e6ec644b4617f4ef68c9d86fcd43cdd826859ff75cb2ea5e2600dce78d75ae4177af56d791d4262bb01d30bc2bcb4a9f7087535a01001ef74aa8bace8c6d40d

Download Submit
C:\Windows\System\FjnWoMI.exe

Filesize
2.2MB

MD5
403e506448b8094c1d33e7c463e47ebe

SHA1
1d235526cf9dbb14f34da9d98f065a55a622aa2c

SHA256
a6ab9b6cc3ece4fbfa0f1f76ed279f90c6847e62f046379ffabd89f48aee00a4

SHA512
dd99de1181a581b53d8ea3bc99b6277bb257bf028224e853884f0c199f0728035b31a1c6b767b74fe2e5ecef7d87bd60d579effd78e933ee96b2dafaa6bc138b

Download Submit
C:\Windows\System\GqHRRyB.exe

Filesize
2.2MB

MD5
211445271fbba4b42ad3697b3c32cc81

SHA1
108faa8fa442df57167b30173a2d025616c1d1b6

SHA256
e740f1fd96ee55171ff3446a1400f7fa42baff8666e8e3544a9503e6862d5731

SHA512
57e6ddf58bf5c3ee6e58101884f26e4c7433706140c5003b8c25ed7dd1946187470c475275e406930714561c19ff1c43441cc553f46a523f6c48b1a2e90f408e

Download Submit
C:\Windows\System\HzPYjqd.exe

Filesize
2.2MB

MD5
4c3dbffe6835ce26ff10ea60366b877d

SHA1
2a087ab1b9615d733f8a193217ab06eb68a9c87d

SHA256
581d8b3978554ca66296ae9be863f611eb8b4abfd507abd643a40fe794c21304

SHA512
df80ec6ae7b5d83ed816d7b3eda1f4899cdbf4688d7e98020b65489f9a2466702e098efd4e19f398ecd48d0c79a25b1e54cd0f1e63482687a243d80451ae569d

Download Submit
C:\Windows\System\IQCHwwM.exe

Filesize
2.2MB

MD5
c728ac014eecdc286186bae5d490ff9c

SHA1
9b8a94e060a0095d1d25bb1fad71acc9de80b85f

SHA256
9cf908dc2424940498ce4aec7c397bedc0af8ec39dfe87167fd9cd5ef6e56ede

SHA512
f01c48ca52683d629a830cf9f82d369a8b17a9f669e4cf4dd4e7ffe307d800bd13625637dbac455b02fe11aecbcd69154a248388a35ef5d377efc40aea3f6272

Download Submit
C:\Windows\System\JzLKiwy.exe

Filesize
2.2MB

MD5
419963ab5434aca79b83c5bd5e0252c0

SHA1
00911b1f9ebc68fb862df89d961b0cccb79fdd58

SHA256
16d212026d3a8f7921980446223ea20f863553a6bd9dd859e82f270dbabbab77

SHA512
9aa96d1c61b009818096b015b246a88d8998ddfd7f8ac689501eaf99076f173fbd99c62eafeb1ff21667458197b5f7f4551b6032a2f36df34ce7a6bb5ac5cdc9

Download Submit
C:\Windows\System\KMKMwsB.exe

Filesize
2.2MB

MD5
0812ef5979a014327b0c00cc18c759ce

SHA1
e0b084ec0b1f76a56277d060fcf7e0426f4f45bf

SHA256
f15bf4c86cd808fe9c1872a96edfa3aff339cb1903f099902b4b48c05a2ab0f8

SHA512
4cec339ced652a0077e7f5cfa64eb731017334f4d787768613b0651c7644396e75bacb2dfa3b214612fec1d0908c85c794a75bdda7c71c1e55541e9677c8d86b

Download Submit
C:\Windows\System\MeFYVTe.exe

Filesize
2.2MB

MD5
6a65ea6c1809f67015bf2fc1d524f91a

SHA1
2fc4e07cbc50f85448554c6264a74ff4333f9e0e

SHA256
dc0e0e8ebf6f66eef1f927a55681c6bfb133b3efb7bea9c8ff52f0c36ddf1f9c

SHA512
d9c50bd75e19b9b3084703d6ed4f16333a3278848696ebd6547871fe1cf6ebe5acb473e9ae7d8c19040cd078810d8b987ba7792eb7f2077cf51de98a819293b2

Download Submit
C:\Windows\System\PSnHIxK.exe

Filesize
2.2MB

MD5
e35cd8ee68ef2b8ca964ef24ffd57ae3

SHA1
84c20fe1eaf570a07f6c139775bfbad156d1387d

SHA256
6dbf1a03c6f2e7390c5fdeb783c5125f01e73f7b382be79ba87d025a1ec0fa3a

SHA512
69c93eecf600c92604147ff803d643b4fbf9daef9899052774595651653bcb1e3199637f7d16c7b27ec10d885c6b293cc1ff4b7c0ac20b2c8478dc8bcee5c5be

Download Submit
C:\Windows\System\SpKrXWL.exe

Filesize
2.2MB

MD5
3657d1d0e833336b8771212d65acdce9

SHA1
9061f58234113d40c08a4b0eb74af6b875d14922

SHA256
80fbadcb9533932d522f21f8f9e47ae1cbc68f9c6f597daa42eacbfcac1e4dfb

SHA512
27323cd06a812408f9cf69d602876817f38f92cf7362bd7a528c50982aaad09c78e4db156e26ac599387b7b11fce18c8b433a4cf9367b39c6f8eba9f6b436dfe

Download Submit
C:\Windows\System\SyOCJGh.exe

Filesize
2.2MB

MD5
3fdc105df2c585f3f6020b3b391ca79b

SHA1
1e704040af8cfb833c1d8c61e0e4548f44b72fbf

SHA256
e0e59fc711fb902e7b39d5834df50a614638a0b3af79ed6c9eb4fc10960f1f20

SHA512
0555b69e7296f225bf27e74a7786c7d60b613e00c7dbfc35e518c98279e64ca63e27e22adfef8ec0013adb75bbfa8f38e6c62ca4173c0d742c3bc80a9e23a44e

Download Submit
C:\Windows\System\TfFlTuj.exe

Filesize
2.2MB

MD5
99927b69e46a4c0fbf19ba7d30438da4

SHA1
5c02d565cdaafb4a8be77aaed1a9b42846eeee5b

SHA256
47c7b404a37884a1802859a7cd82eb0362872d3149475d70ce005bf9c29efa07

SHA512
0f0d8f435d8fc7aa1f6fc1e3aed4dc9b77b38c9644afe8932e06b83434de66e7c5ce438540a537bcad8d5b906e31f6b634bdf88d76705a6ae948f58c53aa6415

Download Submit
C:\Windows\System\VDGGdcZ.exe

Filesize
2.2MB

MD5
7452309c032fdb2786cf4ce76aef27b4

SHA1
2e6a1c26858d3e68270dffae8115f9734df5f80b

SHA256
516ae93cd93cc35dc2849be60527ed4ec0a2ef108627f1412951ac97a11603da

SHA512
0830c9307877246b9e1597b927f64fc23545c3e1b0e0985636bd3655b6575d57464a4af96ac6ef207abf0e0b8c7e2194c706b0dce530a6ed2faad403e03cc986

Download Submit
C:\Windows\System\VzOAPvN.exe

Filesize
2.2MB

MD5
457a34d9ede82255858474a613033f01

SHA1
1d9880fd0df3296d5b54b2deb178a05aac023c26

SHA256
a3abb68374a649833b4f2d18933cd23e3b36283ec5f4ecc2ab99bd83b809243d

SHA512
ba005b526506f391b4a7f7be221ebe3d6928fdcf24d20df0889731837045d87ba27ff777b4907a05e220260f563df30d784d7adaa569fcca4a28876d3aa8eb8f

Download Submit
C:\Windows\System\ZNCCvxb.exe

Filesize
2.2MB

MD5
3d6102c5673e405e8d23dcb50fdc6fc1

SHA1
6d7ae32e8c74a498f2c089858897bceffa285b7a

SHA256
bc4da65b90dceddf9b9892a7773f116915a4065ade945f29b8e945648ac62ee5

SHA512
7ccd34d6e57ed0d1c51d5e0a3fbd582fb698b990da039557e9f1c8129d5a479f18293ae8d92e5e8103ee0461e0559fede84abf784f952af74bb971c4abd20d3b

Download Submit
C:\Windows\System\aTNEjmI.exe

Filesize
2.2MB

MD5
a3aa7c65c21c8469c48bd74580573a44

SHA1
766a7e0146a1e9bfdf6d92f11c7ac1d23db40aef

SHA256
5345ce5bae5aabdef4b68b6ebacbf68273599e6845a95e6a4299c3e2c8eb2791

SHA512
08fa64b134a3f9ea6431cfe3514b55917a84a46f4573771184136def35e33c0abce301885555904c33fa3107baa85495176902f8fbab5acadf758fb44582f396

Download Submit
C:\Windows\System\aqgPkVr.exe

Filesize
2.2MB

MD5
f3a4d132c9f35a427dd0b2416c5d17b7

SHA1
cfbbaadfbb180b948a5cf19cf67b5b6a26f3a56d

SHA256
fbaa02483989362aa1ecf01062a1617523ad0dbdad28510c1a862ddfedbb96d1

SHA512
aea524ea1266f577b2c42f5bb021aaee781aed29f70a78eff0129e6c47de137363c4b19e194b9822398753ae81308bd14f81c1e72f341b5a4c6c62fd10c535eb

Download Submit
C:\Windows\System\bKYEwIL.exe

Filesize
2.2MB

MD5
6be406423a57ce773b73224ed0d61d0c

SHA1
5764dcfbf57798973e601f061401ce94fadfdc32

SHA256
b6239ba690784ed5ca8c26cd3c3456e47c3945ccb2bb834632f8a6a107408fc4

SHA512
0fbe94f4e6ceed8b57d9d87ff48cc5d15d3d586ccbbf86cb767cc9a7cb9c2533644cba06ef0eab2b1b36883c64126084d83b579719c0c380b827913bf191cb24

Download Submit
C:\Windows\System\cAloXfm.exe

Filesize
2.2MB

MD5
49fa7b995a88b5e6eb9b0c428330da4f

SHA1
b180e92fe96b40afc849ca1c85c525a896ada842

SHA256
8fe0657be57389c3ba0efc1623c05db1a726cfde2595ca15e36c302bbc68d9f3

SHA512
0190ea1d88e09302f2363759b4cb88082fc390b30934c63251bbdeceb9a9180b9538fc233b29ee3550bfd67fe1c1e1f63bb9ffffeac8ead3423ebcd811c1e5e8

Download Submit
C:\Windows\System\cFUZzjH.exe

Filesize
2.2MB

MD5
61f4a617cd8e44dba0eb0fd46504a635

SHA1
2a7063c9ec7f450f6c368895acf901e00c48b7a7

SHA256
72a468e70853ba8bd5b5479daefbea80d183c5a7ed928b9e04c3a38c5a7d3c70

SHA512
52de11d6c1e04ac9042265a822e57cd76f5c898754ca03ac787982aa459640ddcb04301641523ec03ed1e70bc28c89365fd1a7268cb026d5c1db358af5667992

Download Submit
C:\Windows\System\dFOBSEd.exe

Filesize
2.2MB

MD5
ee2eac382531d705c984658606eb3a6f

SHA1
b3d152c453e3715adde11fb7650e5a498b62d587

SHA256
4e08cf3619035d3da81ee1211d3bd1df0b347a4c977ef586a80c31fc97ad9b0d

SHA512
1c0f9e07c3c453699758aab63a6919539750b47a5acc90f4fc7cce3129287d13486115b7bdf6b3745598c84a3c1f0ad16ffe93bf968f809c1f0bbda3d16f87a4

Download Submit
C:\Windows\System\dQtaJnZ.exe

Filesize
2.2MB

MD5
a70c5b6c6ca3405170af577d6591ddee

SHA1
a47113951091ed0295d939bfd5d855874bb55713

SHA256
9e85addc6f4dce79ddb882938d48653088ceb0666142526931b6a76158149d4f

SHA512
6c79bddab3c4f043f5d37007779f82c69d6a55a91de33ef04b2ee5f4743c70b9fb858ab800141c29a8451e6dca5007ddf2515517eba66557c505de9bf6ee0b60

Download Submit
C:\Windows\System\dqnGLkl.exe

Filesize
2.2MB

MD5
689f72dc8df16504ff3680c49cf1e156

SHA1
6b3b80fd7515cdebb621b40e2b3f49d39df7ad4c

SHA256
7f47abf5efbe6d10de3ab2110ae2c5cf1e1cd13cc80f7d703eaa8147ed8372ad

SHA512
86a44e05f41ce16163bdae8354fa072df299b111933289d99619a6db04c32e3f48525cc85d0be65902f46ff2102ea385c0a2b7a0ec37751074c8a4e95e3fea7d

Download Submit
C:\Windows\System\eHHrOpW.exe

Filesize
2.2MB

MD5
cc0df8c44332455aa20961403da707a1

SHA1
7910a40654ef3bf4a5b8a474ac4ea06a6fe42b6c

SHA256
0b744d8ef44a0a0fd0718461093855de4f3b4fbfc086f192ea81364957a1e43c

SHA512
4c8ce463fa71ab9622d8c063361ad260d72837ede7ae3c86975336c4b7405fc63202b298cf004e7473679dfe908d8f9bd9ef1a933c69982cc7d7be5ae1a931c4

Download Submit
C:\Windows\System\faGRemw.exe

Filesize
2.2MB

MD5
e0711c818fc2c4a0a473574122b652e8

SHA1
489238270a691039175bf741b08fd1b2d76b45cb

SHA256
f86ebbbe901c43aa6548d7642afefd4e3c98608aebca19ab9d4ad05c0bd45924

SHA512
e75b2f1b0106ebff488fb0caddd475680084328ebea9d215aa565888abfe8b728dfad83255f9ea8b439042edf45129e0a2c5197c71886058a46883db62229067

Download Submit
C:\Windows\System\famnMKm.exe

Filesize
2.2MB

MD5
2fd574a7a8de30aea11300f45d5f129c

SHA1
457c4d5671b5b0aba2413b803161db60c0539e14

SHA256
b6f7fdd9a8080050b646d0dd87811f2591d3e9db337919c439e8f7b5ff3b7c57

SHA512
add129ac98e987bdc308de3ecdbef82863da9401b8257ad72e01628db37c78d8a55616611180033513150a87c6ba55f40dfbf5c9550e1765fcb163df16a0310a

Download Submit
C:\Windows\System\gWDnyKs.exe

Filesize
2.2MB

MD5
5baad8e9c3f98feafe56dfe0a82c030c

SHA1
ce25ab0739e88e26e4705f5196b5bb3394ef96cb

SHA256
43b890aebadb03ff794f89dc116eec28afeb2a45057284290040353bd65afbda

SHA512
5b7b8c41a93fa1f25c79c39694ef2abaf1f49be24fd79acf15753d5ba657d4bf010f2459407369dad5d62239a8bdd8d8d6aae807a17fca14029b42028ec61ab7

Download Submit
C:\Windows\System\glFnrVR.exe

Filesize
2.2MB

MD5
55b9b6c1d8f958911d78c8bffe68c39c

SHA1
c7357480550bd1e4e0e37f3e6a4c1a7c8a129b8c

SHA256
0fefc8e6dc03de2d9ad204df727f74e6dbb9467a06908ff6054d5b81ff2a46dc

SHA512
8346cdea70eafe76dc2c07e9c69f7e6efca1a12152c3f75ff3428fa7fcc1a494204eb392bd7094c8a888d352b4e59482184b98ccbb82e2833109ee2e3c14eb9a

Download Submit
C:\Windows\System\huBJZYq.exe

Filesize
2.2MB

MD5
4e1a2e98faea09fb120c3cf991053410

SHA1
7b822c8ce92229d69ea7f76a67937a694263bdbf

SHA256
c133217b9bc90405b0440061aeb554e120a5e556ac72c09400262d3eb2b63adc

SHA512
9f2dc3c5b5c26ed20673c0e020fbb5b33c544d5fce08a0ea5a47faf5bb3d8e107290ec1684cf364510b3290409bd9dbf8d1c8af852ad244458f94a415a6c6f80

Download Submit
C:\Windows\System\jbAjFPw.exe

Filesize
2.2MB

MD5
b97a9c340bd8e59667f0ad9043c8fc7a

SHA1
c90752304edd5b6c07bce98314442faf3b265352

SHA256
bc27137f733dc3e360dcc4ff883abd87007e2384369b67468a33f9c863c7cd4c

SHA512
776d52edb156d4a7f4d7040db96a344b894aed77e99db3bbab1b96f46ce3b6b764d91b059cc7930f114496d7b903e41ff2ab98a818abe3a6f86d8faf593dcb75

Download Submit
C:\Windows\System\mbNssUG.exe

Filesize
2.2MB

MD5
750fbc3c3b8bccdea5d834dce66e6c09

SHA1
5a43f48f3b8d7b9f337ebaa73104d19f460776f2

SHA256
5eb2cfe8ec652a796341a741d4cc7e812d98a3c3e46fb546363b3d749e59fe62

SHA512
1f78fc98c15c542ff09efa74e8221a73f45a106c455e6b3be5a74f7c9864cded118813d7ba94ace436b6c2529952330c74f8a0fe7f2cf057628b7be0ce08219e

Download Submit
C:\Windows\System\nigFFPe.exe

Filesize
2.2MB

MD5
2dabbb8348443c441b6620f2bda9b1fc

SHA1
adcd6d9a2440bcde146cfb97253c07c995d703d3

SHA256
cf96c14a92ff41b859d0132aa3f0afca4f021afb7e4c486bfeab88724f4b8713

SHA512
f4117806db2ed8886c2615ad4364e427bed2e274ab9a28170e23a6ade6af126daa69ca858bdf91bddcef691ed4d9e05ca3b5bd3f6824727ba03f64fb0aad780f

Download Submit
C:\Windows\System\pZxyeqI.exe

Filesize
8B

MD5
d6349613f683bded6d69a7d02ace4275

SHA1
1627fabfdfae3cac338500241f4e9e969ee50ac5

SHA256
4a54b14258d08729a6205b09d8643680d1fcbeb6eaed5e636cae813e537ac662

SHA512
d83aa606a1ca4c9ad32d8a91f5b2cf833fc395e62b938477a618ca3509fa52443c5e33121c0988fd90e65d2855a59276136a584d3f8258054273372e5fbf3292

Download Submit
C:\Windows\System\zWPadzD.exe

Filesize
2.2MB

MD5
7bfacf44fead1ccf18f9cec9d9355840

SHA1
b38c52aa3828b917de0acfea68101a986c6454d8

SHA256
dab33fb2558d3a54ed708e69bf5842273a209372309f75e5a493c8b3819f7566

SHA512
e639de5bbaddd4f1f8e6a2699b8a5e1e1c92bc560b0f5d6a7b6956119ef8c1a8e46e75a00f139580914c06f80b0a05b1e3b4595e40242a146dd91c9fcceb9f21

Download Submit
memory/224-0-0x00007FF60C130000-0x00007FF60C522000-memory.dmp

Filesize
3.9MB

Download
memory/224-1-0x0000024D93890000-0x0000024D938A0000-memory.dmp

Filesize
64KB

Download
memory/312-73-0x00007FF7BC140000-0x00007FF7BC532000-memory.dmp

Filesize
3.9MB

Download
memory/312-2678-0x00007FF7BC140000-0x00007FF7BC532000-memory.dmp

Filesize
3.9MB

Download
memory/1240-2700-0x00007FF660D40000-0x00007FF661132000-memory.dmp

Filesize
3.9MB

Download
memory/1240-241-0x00007FF660D40000-0x00007FF661132000-memory.dmp

Filesize
3.9MB

Download
memory/1248-187-0x0000024B77A20000-0x0000024B77A42000-memory.dmp

Filesize
136KB

Download
memory/1248-43-0x0000024B77A80000-0x0000024B77A90000-memory.dmp

Filesize
64KB

Download
memory/1248-34-0x00007FFAE6EB0000-0x00007FFAE7971000-memory.dmp

Filesize
10.8MB

Download
memory/1252-228-0x00007FF7577D0000-0x00007FF757BC2000-memory.dmp

Filesize
3.9MB

Download
memory/1252-2697-0x00007FF7577D0000-0x00007FF757BC2000-memory.dmp

Filesize
3.9MB

Download
memory/1580-168-0x00007FF7149C0000-0x00007FF714DB2000-memory.dmp

Filesize
3.9MB

Download
memory/1580-2674-0x00007FF7149C0000-0x00007FF714DB2000-memory.dmp

Filesize
3.9MB

Download
memory/1620-2685-0x00007FF768610000-0x00007FF768A02000-memory.dmp

Filesize
3.9MB

Download
memory/1620-179-0x00007FF768610000-0x00007FF768A02000-memory.dmp

Filesize
3.9MB

Download
memory/2312-239-0x00007FF668240000-0x00007FF668632000-memory.dmp

Filesize
3.9MB

Download
memory/2312-2699-0x00007FF668240000-0x00007FF668632000-memory.dmp

Filesize
3.9MB

Download
memory/2424-213-0x00007FF7ECDB0000-0x00007FF7ED1A2000-memory.dmp

Filesize
3.9MB

Download
memory/2424-2690-0x00007FF7ECDB0000-0x00007FF7ED1A2000-memory.dmp

Filesize
3.9MB

Download
memory/2672-2670-0x00007FF77CB60000-0x00007FF77CF52000-memory.dmp

Filesize
3.9MB

Download
memory/2672-242-0x00007FF77CB60000-0x00007FF77CF52000-memory.dmp

Filesize
3.9MB

Download
memory/2900-189-0x00007FF74E7F0000-0x00007FF74EBE2000-memory.dmp

Filesize
3.9MB

Download
memory/2900-2692-0x00007FF74E7F0000-0x00007FF74EBE2000-memory.dmp

Filesize
3.9MB

Download
memory/3204-225-0x00007FF619100000-0x00007FF6194F2000-memory.dmp

Filesize
3.9MB

Download
memory/3204-2689-0x00007FF619100000-0x00007FF6194F2000-memory.dmp

Filesize
3.9MB

Download
memory/3344-243-0x00007FF78C960000-0x00007FF78CD52000-memory.dmp

Filesize
3.9MB

Download
memory/3344-2682-0x00007FF78C960000-0x00007FF78CD52000-memory.dmp

Filesize
3.9MB

Download
memory/3808-2686-0x00007FF722E50000-0x00007FF723242000-memory.dmp

Filesize
3.9MB

Download
memory/3808-96-0x00007FF722E50000-0x00007FF723242000-memory.dmp

Filesize
3.9MB

Download
memory/3832-2735-0x00007FF6714D0000-0x00007FF6718C2000-memory.dmp

Filesize
3.9MB

Download
memory/3832-238-0x00007FF6714D0000-0x00007FF6718C2000-memory.dmp

Filesize
3.9MB

Download
memory/3932-2668-0x00007FF7859B0000-0x00007FF785DA2000-memory.dmp

Filesize
3.9MB

Download
memory/3932-72-0x00007FF7859B0000-0x00007FF785DA2000-memory.dmp

Filesize
3.9MB

Download
memory/4136-244-0x00007FF622AE0000-0x00007FF622ED2000-memory.dmp

Filesize
3.9MB

Download
memory/4136-2702-0x00007FF622AE0000-0x00007FF622ED2000-memory.dmp

Filesize
3.9MB

Download
memory/4356-2681-0x00007FF6B9AB0000-0x00007FF6B9EA2000-memory.dmp

Filesize
3.9MB

Download
memory/4356-188-0x00007FF6B9AB0000-0x00007FF6B9EA2000-memory.dmp

Filesize
3.9MB

Download
memory/4380-42-0x00007FF74AD70000-0x00007FF74B162000-memory.dmp

Filesize
3.9MB

Download
memory/4380-2672-0x00007FF74AD70000-0x00007FF74B162000-memory.dmp

Filesize
3.9MB

Download
memory/4476-235-0x00007FF616290000-0x00007FF616682000-memory.dmp

Filesize
3.9MB

Download
memory/4476-2708-0x00007FF616290000-0x00007FF616682000-memory.dmp

Filesize
3.9MB

Download
memory/4872-2695-0x00007FF6AD530000-0x00007FF6AD922000-memory.dmp

Filesize
3.9MB

Download
memory/4872-240-0x00007FF6AD530000-0x00007FF6AD922000-memory.dmp

Filesize
3.9MB

Download
memory/4996-2704-0x00007FF6C2150000-0x00007FF6C2542000-memory.dmp

Filesize
3.9MB

Download
memory/4996-245-0x00007FF6C2150000-0x00007FF6C2542000-memory.dmp

Filesize
3.9MB

Download
memory/5044-2676-0x00007FF7DF0C0000-0x00007FF7DF4B2000-memory.dmp

Filesize
3.9MB

Download
memory/5044-133-0x00007FF7DF0C0000-0x00007FF7DF4B2000-memory.dmp

Filesize
3.9MB

Download