xmrig | ff7f5031a9dc5bfbb26e90138e907e0291175bd759041bd8982bbc8904881fcb

Analysis

max time kernel
90s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 12:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
Size

1.9MB
MD5

09c658577583f69a17395e0fa3fbcf28
SHA1

9e3e62984230a92340660997a5388ed3425d8333
SHA256

ff7f5031a9dc5bfbb26e90138e907e0291175bd759041bd8982bbc8904881fcb
SHA512

59a045f4bf0cde26c71b970497b29fad9398f40ed08d48a29ea18f0ec20dbde353263c5ef56081381e5b3f40514e451870d0a6cbf4927be38c32183026549298
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+Uj:NABC

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 41 IoCs

miner

resource	yara_rule
behavioral2/memory/1788-395-0x00007FF699110000-0x00007FF699502000-memory.dmp	xmrig
behavioral2/memory/4300-446-0x00007FF74E940000-0x00007FF74ED32000-memory.dmp	xmrig
behavioral2/memory/5076-504-0x00007FF669F30000-0x00007FF66A322000-memory.dmp	xmrig
behavioral2/memory/3536-505-0x00007FF6F8C30000-0x00007FF6F9022000-memory.dmp	xmrig
behavioral2/memory/2308-503-0x00007FF7C4B20000-0x00007FF7C4F12000-memory.dmp	xmrig
behavioral2/memory/1212-501-0x00007FF728380000-0x00007FF728772000-memory.dmp	xmrig
behavioral2/memory/2752-500-0x00007FF6B1EE0000-0x00007FF6B22D2000-memory.dmp	xmrig
behavioral2/memory/5108-368-0x00007FF687770000-0x00007FF687B62000-memory.dmp	xmrig
behavioral2/memory/1844-335-0x00007FF6CE330000-0x00007FF6CE722000-memory.dmp	xmrig
behavioral2/memory/964-285-0x00007FF794C90000-0x00007FF795082000-memory.dmp	xmrig
behavioral2/memory/1920-246-0x00007FF631390000-0x00007FF631782000-memory.dmp	xmrig
behavioral2/memory/4612-245-0x00007FF62A5D0000-0x00007FF62A9C2000-memory.dmp	xmrig
behavioral2/memory/748-222-0x00007FF77E350000-0x00007FF77E742000-memory.dmp	xmrig
behavioral2/memory/3624-173-0x00007FF6C9980000-0x00007FF6C9D72000-memory.dmp	xmrig
behavioral2/memory/3016-134-0x00007FF63F410000-0x00007FF63F802000-memory.dmp	xmrig
behavioral2/memory/1128-83-0x00007FF72B630000-0x00007FF72BA22000-memory.dmp	xmrig
behavioral2/memory/1588-3376-0x00007FF7E30A0000-0x00007FF7E3492000-memory.dmp	xmrig
behavioral2/memory/1352-3378-0x00007FF660130000-0x00007FF660522000-memory.dmp	xmrig
behavioral2/memory/2064-3379-0x00007FF793420000-0x00007FF793812000-memory.dmp	xmrig
behavioral2/memory/2976-3400-0x00007FF6D92B0000-0x00007FF6D96A2000-memory.dmp	xmrig
behavioral2/memory/1588-3402-0x00007FF7E30A0000-0x00007FF7E3492000-memory.dmp	xmrig
behavioral2/memory/2308-3404-0x00007FF7C4B20000-0x00007FF7C4F12000-memory.dmp	xmrig
behavioral2/memory/1128-3406-0x00007FF72B630000-0x00007FF72BA22000-memory.dmp	xmrig
behavioral2/memory/1396-3412-0x00007FF65B110000-0x00007FF65B502000-memory.dmp	xmrig
behavioral2/memory/748-3414-0x00007FF77E350000-0x00007FF77E742000-memory.dmp	xmrig
behavioral2/memory/5076-3416-0x00007FF669F30000-0x00007FF66A322000-memory.dmp	xmrig
behavioral2/memory/4612-3420-0x00007FF62A5D0000-0x00007FF62A9C2000-memory.dmp	xmrig
behavioral2/memory/2976-3422-0x00007FF6D92B0000-0x00007FF6D96A2000-memory.dmp	xmrig
behavioral2/memory/3016-3418-0x00007FF63F410000-0x00007FF63F802000-memory.dmp	xmrig
behavioral2/memory/1352-3410-0x00007FF660130000-0x00007FF660522000-memory.dmp	xmrig
behavioral2/memory/3624-3409-0x00007FF6C9980000-0x00007FF6C9D72000-memory.dmp	xmrig
behavioral2/memory/2064-3434-0x00007FF793420000-0x00007FF793812000-memory.dmp	xmrig
behavioral2/memory/1844-3435-0x00007FF6CE330000-0x00007FF6CE722000-memory.dmp	xmrig
behavioral2/memory/964-3438-0x00007FF794C90000-0x00007FF795082000-memory.dmp	xmrig
behavioral2/memory/3536-3445-0x00007FF6F8C30000-0x00007FF6F9022000-memory.dmp	xmrig
behavioral2/memory/1212-3437-0x00007FF728380000-0x00007FF728772000-memory.dmp	xmrig
behavioral2/memory/4300-3431-0x00007FF74E940000-0x00007FF74ED32000-memory.dmp	xmrig
behavioral2/memory/2752-3430-0x00007FF6B1EE0000-0x00007FF6B22D2000-memory.dmp	xmrig
behavioral2/memory/1788-3427-0x00007FF699110000-0x00007FF699502000-memory.dmp	xmrig
behavioral2/memory/1920-3424-0x00007FF631390000-0x00007FF631782000-memory.dmp	xmrig
behavioral2/memory/5108-3468-0x00007FF687770000-0x00007FF687B62000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1588	iqaorMD.exe
1352	TjQBQNG.exe
2308	NbxiRuE.exe
1396	YBJRKXS.exe
2064	JSkXEtV.exe
1128	NkTwEaO.exe
2976	TKOtIGV.exe
3016	gJmueqs.exe
3624	CsiZtBr.exe
748	HvkFuej.exe
5076	gxKkkdK.exe
4612	sHDGYEN.exe
1920	ubVlvQK.exe
964	BdhQvGx.exe
1844	lOCbQsv.exe
5108	jJZCPnv.exe
1788	BNNBbrZ.exe
3536	mebBmAV.exe
4300	vVFeZrN.exe
2752	SNTpQVN.exe
1212	PLQtxSU.exe
1492	VnkqWvd.exe
1868	UNHdWDc.exe
4840	LgXclNs.exe
4824	ENnAoKG.exe
4968	vwlqMas.exe
2972	IdyppPB.exe
1740	SlGBrKD.exe
4764	geiSyki.exe
1896	HcKFhDT.exe
4376	SeLWuOM.exe
2900	oMUaIQU.exe
436	fzrlBog.exe
1748	cntutYv.exe
3228	DBnSldT.exe
2068	wWIvHgD.exe
468	Qcffjsp.exe
5084	iGTnIur.exe
3516	iWDYsbx.exe
3892	oXRQEZI.exe
2004	CFlqewG.exe
3608	JUFpXmI.exe
2792	nbioYcs.exe
4316	IZEablc.exe
2920	gcmRCHW.exe
516	ECQVUcR.exe
3736	SRqMnQX.exe
3208	hiaxIHD.exe
1560	BYAisXm.exe
5080	muvipGX.exe
3632	toTXZhe.exe
3592	PtqFEjX.exe
3028	UHPeBZO.exe
384	sUQpjeT.exe
3472	MfFACnB.exe
4132	SbekakG.exe
1824	BIklODd.exe
2312	UqkVniu.exe
2032	ABeiXwl.exe
2416	IXcIHvc.exe
4304	SjCOfSw.exe
4392	akAQAGf.exe
2024	qnJvUig.exe
2608	XsNkSit.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3460-0-0x00007FF61C750000-0x00007FF61CB42000-memory.dmp	upx
behavioral2/files/0x000c000000023b7c-5.dat	upx
behavioral2/files/0x000a000000023bd1-49.dat	upx
behavioral2/files/0x000a000000023bd6-77.dat	upx
behavioral2/files/0x000a000000023bcc-107.dat	upx
behavioral2/memory/1788-395-0x00007FF699110000-0x00007FF699502000-memory.dmp	upx
behavioral2/memory/4300-446-0x00007FF74E940000-0x00007FF74ED32000-memory.dmp	upx
behavioral2/memory/5076-504-0x00007FF669F30000-0x00007FF66A322000-memory.dmp	upx
behavioral2/memory/3536-505-0x00007FF6F8C30000-0x00007FF6F9022000-memory.dmp	upx
behavioral2/memory/2308-503-0x00007FF7C4B20000-0x00007FF7C4F12000-memory.dmp	upx
behavioral2/memory/1212-501-0x00007FF728380000-0x00007FF728772000-memory.dmp	upx
behavioral2/memory/2752-500-0x00007FF6B1EE0000-0x00007FF6B22D2000-memory.dmp	upx
behavioral2/memory/5108-368-0x00007FF687770000-0x00007FF687B62000-memory.dmp	upx
behavioral2/memory/1844-335-0x00007FF6CE330000-0x00007FF6CE722000-memory.dmp	upx
behavioral2/memory/964-285-0x00007FF794C90000-0x00007FF795082000-memory.dmp	upx
behavioral2/memory/1920-246-0x00007FF631390000-0x00007FF631782000-memory.dmp	upx
behavioral2/memory/4612-245-0x00007FF62A5D0000-0x00007FF62A9C2000-memory.dmp	upx
behavioral2/memory/748-222-0x00007FF77E350000-0x00007FF77E742000-memory.dmp	upx
behavioral2/files/0x000b000000023bc7-199.dat	upx
behavioral2/files/0x0008000000023c08-194.dat	upx
behavioral2/files/0x000a000000023be8-188.dat	upx
behavioral2/files/0x000b000000023be0-184.dat	upx
behavioral2/files/0x000b000000023bdf-177.dat	upx
behavioral2/memory/3624-173-0x00007FF6C9980000-0x00007FF6C9D72000-memory.dmp	upx
behavioral2/files/0x0008000000023c05-170.dat	upx
behavioral2/files/0x000e000000023c03-165.dat	upx
behavioral2/files/0x000a000000023bdd-161.dat	upx
behavioral2/files/0x000b000000023bde-157.dat	upx
behavioral2/files/0x0009000000023bff-156.dat	upx
behavioral2/files/0x0009000000023bfe-152.dat	upx
behavioral2/files/0x0009000000023bfd-144.dat	upx
behavioral2/files/0x0008000000023c09-196.dat	upx
behavioral2/files/0x0008000000023bf8-141.dat	upx
behavioral2/files/0x000a000000023bd7-140.dat	upx
behavioral2/files/0x000a000000023bd8-127.dat	upx
behavioral2/files/0x000e000000023bef-126.dat	upx
behavioral2/files/0x000a000000023bdc-125.dat	upx
behavioral2/files/0x000a000000023bd5-121.dat	upx
behavioral2/files/0x000a000000023bdb-118.dat	upx
behavioral2/files/0x000a000000023bda-113.dat	upx
behavioral2/files/0x000a000000023bd9-139.dat	upx
behavioral2/memory/3016-134-0x00007FF63F410000-0x00007FF63F802000-memory.dmp	upx
behavioral2/memory/2976-110-0x00007FF6D92B0000-0x00007FF6D96A2000-memory.dmp	upx
behavioral2/files/0x000a000000023bd0-102.dat	upx
behavioral2/files/0x000a000000023bce-98.dat	upx
behavioral2/files/0x000a000000023bd4-94.dat	upx
behavioral2/memory/1128-83-0x00007FF72B630000-0x00007FF72BA22000-memory.dmp	upx
behavioral2/files/0x000b000000023bc6-68.dat	upx
behavioral2/files/0x000a000000023bcf-92.dat	upx
behavioral2/files/0x000a000000023bd3-86.dat	upx
behavioral2/memory/2064-57-0x00007FF793420000-0x00007FF793812000-memory.dmp	upx
behavioral2/files/0x000a000000023bd2-53.dat	upx
behavioral2/files/0x000a000000023bcd-42.dat	upx
behavioral2/files/0x000a000000023bcb-63.dat	upx
behavioral2/memory/1396-34-0x00007FF65B110000-0x00007FF65B502000-memory.dmp	upx
behavioral2/memory/1352-29-0x00007FF660130000-0x00007FF660522000-memory.dmp	upx
behavioral2/files/0x000a000000023bca-37.dat	upx
behavioral2/memory/1588-15-0x00007FF7E30A0000-0x00007FF7E3492000-memory.dmp	upx
behavioral2/memory/1588-3376-0x00007FF7E30A0000-0x00007FF7E3492000-memory.dmp	upx
behavioral2/memory/1352-3378-0x00007FF660130000-0x00007FF660522000-memory.dmp	upx
behavioral2/memory/2064-3379-0x00007FF793420000-0x00007FF793812000-memory.dmp	upx
behavioral2/memory/2976-3400-0x00007FF6D92B0000-0x00007FF6D96A2000-memory.dmp	upx
behavioral2/memory/1588-3402-0x00007FF7E30A0000-0x00007FF7E3492000-memory.dmp	upx
behavioral2/memory/2308-3404-0x00007FF7C4B20000-0x00007FF7C4F12000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\YFxZeEt.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\rkAHlyd.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\ZRUATvh.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\JCCzlPB.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\zaTdXBz.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\pEBCpKA.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\ibiLsiI.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\EzEZVOX.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\nDnACLc.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\hJFlZwA.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\WEgupOp.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\HWhOkJl.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\GYzLUpQ.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\QtPndwU.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\IocPoOO.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\ygtdrBK.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\OvVshnS.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\KvWqkCO.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\ZvoYpRn.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\ZYZmknw.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\vPcRFEf.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\PvPvfVN.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\aEZqZMH.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\XoykhKo.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\eIqcarZ.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\DCGpKEM.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\xlaCbLI.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\FoTFPIH.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\QmfNTza.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\UsuWYEI.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\gQSaAsT.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\zmEbqJo.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\UAycEMT.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\sOGqgZm.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\vhMuoGi.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\JrCXNEo.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\oQnnEer.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\HDZywyv.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\ViyFPTe.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\kJBwKjG.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\HmSxERG.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\ENnAoKG.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\OQhjKXC.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\xCriGcq.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\XspplaU.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\gOdmwbc.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\RbfgCYH.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\rqUNQDu.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\PdufRLc.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\TdMxZHH.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\jtCLYUs.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\HzQDtwh.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\phpKwsn.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\lAHXHKs.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\ErPcOUV.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\nomILCD.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\xDlHaAp.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\oxrqtva.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\DSnCXrW.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\fzrlBog.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\yTMslMe.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\isDktRA.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\AtBGhJo.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
File created	C:\Windows\System\KSuXwHK.exe	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
396	powershell.exe
396	powershell.exe
396	powershell.exe
396	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
Token: SeDebugPrivilege	396	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3460 wrote to memory of 396	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	84
PID 3460 wrote to memory of 396	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	84
PID 3460 wrote to memory of 1588	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	85
PID 3460 wrote to memory of 1588	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	85
PID 3460 wrote to memory of 1352	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	86
PID 3460 wrote to memory of 1352	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	86
PID 3460 wrote to memory of 2308	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	87
PID 3460 wrote to memory of 2308	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	87
PID 3460 wrote to memory of 1396	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	88
PID 3460 wrote to memory of 1396	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	88
PID 3460 wrote to memory of 2064	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	89
PID 3460 wrote to memory of 2064	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	89
PID 3460 wrote to memory of 1128	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	90
PID 3460 wrote to memory of 1128	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	90
PID 3460 wrote to memory of 2976	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	91
PID 3460 wrote to memory of 2976	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	91
PID 3460 wrote to memory of 3016	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	92
PID 3460 wrote to memory of 3016	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	92
PID 3460 wrote to memory of 1920	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	93
PID 3460 wrote to memory of 1920	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	93
PID 3460 wrote to memory of 3624	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	94
PID 3460 wrote to memory of 3624	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	94
PID 3460 wrote to memory of 748	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	95
PID 3460 wrote to memory of 748	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	95
PID 3460 wrote to memory of 5076	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	96
PID 3460 wrote to memory of 5076	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	96
PID 3460 wrote to memory of 4612	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	97
PID 3460 wrote to memory of 4612	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	97
PID 3460 wrote to memory of 964	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	98
PID 3460 wrote to memory of 964	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	98
PID 3460 wrote to memory of 1844	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	99
PID 3460 wrote to memory of 1844	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	99
PID 3460 wrote to memory of 5108	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	100
PID 3460 wrote to memory of 5108	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	100
PID 3460 wrote to memory of 1788	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	101
PID 3460 wrote to memory of 1788	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	101
PID 3460 wrote to memory of 3536	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	102
PID 3460 wrote to memory of 3536	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	102
PID 3460 wrote to memory of 4300	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	103
PID 3460 wrote to memory of 4300	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	103
PID 3460 wrote to memory of 2752	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	104
PID 3460 wrote to memory of 2752	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	104
PID 3460 wrote to memory of 1212	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	105
PID 3460 wrote to memory of 1212	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	105
PID 3460 wrote to memory of 2972	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	106
PID 3460 wrote to memory of 2972	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	106
PID 3460 wrote to memory of 1492	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	107
PID 3460 wrote to memory of 1492	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	107
PID 3460 wrote to memory of 1868	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	108
PID 3460 wrote to memory of 1868	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	108
PID 3460 wrote to memory of 4840	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	109
PID 3460 wrote to memory of 4840	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	109
PID 3460 wrote to memory of 4824	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	110
PID 3460 wrote to memory of 4824	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	110
PID 3460 wrote to memory of 4968	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	111
PID 3460 wrote to memory of 4968	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	111
PID 3460 wrote to memory of 1740	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	112
PID 3460 wrote to memory of 1740	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	112
PID 3460 wrote to memory of 4764	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	113
PID 3460 wrote to memory of 4764	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	113
PID 3460 wrote to memory of 1896	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	114
PID 3460 wrote to memory of 1896	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	114
PID 3460 wrote to memory of 4376	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	115
PID 3460 wrote to memory of 4376	3460	09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\09c658577583f69a17395e0fa3fbcf28_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:396
- C:\Windows\System\iqaorMD.exe
  C:\Windows\System\iqaorMD.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\TjQBQNG.exe
  C:\Windows\System\TjQBQNG.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\NbxiRuE.exe
  C:\Windows\System\NbxiRuE.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\YBJRKXS.exe
  C:\Windows\System\YBJRKXS.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\JSkXEtV.exe
  C:\Windows\System\JSkXEtV.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\NkTwEaO.exe
  C:\Windows\System\NkTwEaO.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\TKOtIGV.exe
  C:\Windows\System\TKOtIGV.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\gJmueqs.exe
  C:\Windows\System\gJmueqs.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\ubVlvQK.exe
  C:\Windows\System\ubVlvQK.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\CsiZtBr.exe
  C:\Windows\System\CsiZtBr.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\HvkFuej.exe
  C:\Windows\System\HvkFuej.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\gxKkkdK.exe
  C:\Windows\System\gxKkkdK.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\sHDGYEN.exe
  C:\Windows\System\sHDGYEN.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\BdhQvGx.exe
  C:\Windows\System\BdhQvGx.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\lOCbQsv.exe
  C:\Windows\System\lOCbQsv.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\jJZCPnv.exe
  C:\Windows\System\jJZCPnv.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\BNNBbrZ.exe
  C:\Windows\System\BNNBbrZ.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\mebBmAV.exe
  C:\Windows\System\mebBmAV.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\vVFeZrN.exe
  C:\Windows\System\vVFeZrN.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\SNTpQVN.exe
  C:\Windows\System\SNTpQVN.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\PLQtxSU.exe
  C:\Windows\System\PLQtxSU.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\IdyppPB.exe
  C:\Windows\System\IdyppPB.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\VnkqWvd.exe
  C:\Windows\System\VnkqWvd.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\UNHdWDc.exe
  C:\Windows\System\UNHdWDc.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\LgXclNs.exe
  C:\Windows\System\LgXclNs.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\ENnAoKG.exe
  C:\Windows\System\ENnAoKG.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\vwlqMas.exe
  C:\Windows\System\vwlqMas.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\SlGBrKD.exe
  C:\Windows\System\SlGBrKD.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\geiSyki.exe
  C:\Windows\System\geiSyki.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\HcKFhDT.exe
  C:\Windows\System\HcKFhDT.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\SeLWuOM.exe
  C:\Windows\System\SeLWuOM.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\oMUaIQU.exe
  C:\Windows\System\oMUaIQU.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\fzrlBog.exe
  C:\Windows\System\fzrlBog.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\cntutYv.exe
  C:\Windows\System\cntutYv.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\DBnSldT.exe
  C:\Windows\System\DBnSldT.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\wWIvHgD.exe
  C:\Windows\System\wWIvHgD.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\Qcffjsp.exe
  C:\Windows\System\Qcffjsp.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\iGTnIur.exe
  C:\Windows\System\iGTnIur.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\iWDYsbx.exe
  C:\Windows\System\iWDYsbx.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\oXRQEZI.exe
  C:\Windows\System\oXRQEZI.exe
  2⤵
  - Executes dropped EXE
  PID:3892
- C:\Windows\System\CFlqewG.exe
  C:\Windows\System\CFlqewG.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\JUFpXmI.exe
  C:\Windows\System\JUFpXmI.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\nbioYcs.exe
  C:\Windows\System\nbioYcs.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\IZEablc.exe
  C:\Windows\System\IZEablc.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\gcmRCHW.exe
  C:\Windows\System\gcmRCHW.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\ECQVUcR.exe
  C:\Windows\System\ECQVUcR.exe
  2⤵
  - Executes dropped EXE
  PID:516
- C:\Windows\System\SRqMnQX.exe
  C:\Windows\System\SRqMnQX.exe
  2⤵
  - Executes dropped EXE
  PID:3736
- C:\Windows\System\hiaxIHD.exe
  C:\Windows\System\hiaxIHD.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\BYAisXm.exe
  C:\Windows\System\BYAisXm.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\muvipGX.exe
  C:\Windows\System\muvipGX.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\toTXZhe.exe
  C:\Windows\System\toTXZhe.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\PtqFEjX.exe
  C:\Windows\System\PtqFEjX.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\UHPeBZO.exe
  C:\Windows\System\UHPeBZO.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\sUQpjeT.exe
  C:\Windows\System\sUQpjeT.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\MfFACnB.exe
  C:\Windows\System\MfFACnB.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System\SbekakG.exe
  C:\Windows\System\SbekakG.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System\BIklODd.exe
  C:\Windows\System\BIklODd.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\UqkVniu.exe
  C:\Windows\System\UqkVniu.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\ABeiXwl.exe
  C:\Windows\System\ABeiXwl.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\IXcIHvc.exe
  C:\Windows\System\IXcIHvc.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\SjCOfSw.exe
  C:\Windows\System\SjCOfSw.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\akAQAGf.exe
  C:\Windows\System\akAQAGf.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\qnJvUig.exe
  C:\Windows\System\qnJvUig.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\YXtzmXd.exe
  C:\Windows\System\YXtzmXd.exe
  2⤵
  PID:3020
- C:\Windows\System\XsNkSit.exe
  C:\Windows\System\XsNkSit.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\jwVUOKD.exe
  C:\Windows\System\jwVUOKD.exe
  2⤵
  PID:2352
- C:\Windows\System\YBFzrpp.exe
  C:\Windows\System\YBFzrpp.exe
  2⤵
  PID:3924
- C:\Windows\System\DUVrPLc.exe
  C:\Windows\System\DUVrPLc.exe
  2⤵
  PID:4812
- C:\Windows\System\FbCPVgE.exe
  C:\Windows\System\FbCPVgE.exe
  2⤵
  PID:4972
- C:\Windows\System\CwopWGu.exe
  C:\Windows\System\CwopWGu.exe
  2⤵
  PID:1232
- C:\Windows\System\QRCgBhs.exe
  C:\Windows\System\QRCgBhs.exe
  2⤵
  PID:4476
- C:\Windows\System\EhiLRXu.exe
  C:\Windows\System\EhiLRXu.exe
  2⤵
  PID:2232
- C:\Windows\System\gVoJhon.exe
  C:\Windows\System\gVoJhon.exe
  2⤵
  PID:1968
- C:\Windows\System\mDVkXeE.exe
  C:\Windows\System\mDVkXeE.exe
  2⤵
  PID:3820
- C:\Windows\System\ZYFMjLL.exe
  C:\Windows\System\ZYFMjLL.exe
  2⤵
  PID:3044
- C:\Windows\System\vIrMPha.exe
  C:\Windows\System\vIrMPha.exe
  2⤵
  PID:4784
- C:\Windows\System\NuWvuUz.exe
  C:\Windows\System\NuWvuUz.exe
  2⤵
  PID:3904
- C:\Windows\System\ooyUQLn.exe
  C:\Windows\System\ooyUQLn.exe
  2⤵
  PID:2896
- C:\Windows\System\JDFdePu.exe
  C:\Windows\System\JDFdePu.exe
  2⤵
  PID:1988
- C:\Windows\System\HyBzelL.exe
  C:\Windows\System\HyBzelL.exe
  2⤵
  PID:3532
- C:\Windows\System\zRGzpzZ.exe
  C:\Windows\System\zRGzpzZ.exe
  2⤵
  PID:1904
- C:\Windows\System\ylNbmji.exe
  C:\Windows\System\ylNbmji.exe
  2⤵
  PID:5156
- C:\Windows\System\zvDUnfo.exe
  C:\Windows\System\zvDUnfo.exe
  2⤵
  PID:5176
- C:\Windows\System\ZvoYpRn.exe
  C:\Windows\System\ZvoYpRn.exe
  2⤵
  PID:5200
- C:\Windows\System\IZjXGzj.exe
  C:\Windows\System\IZjXGzj.exe
  2⤵
  PID:5240
- C:\Windows\System\pyFUitj.exe
  C:\Windows\System\pyFUitj.exe
  2⤵
  PID:5264
- C:\Windows\System\jxcBEpe.exe
  C:\Windows\System\jxcBEpe.exe
  2⤵
  PID:5284
- C:\Windows\System\qLpxiDX.exe
  C:\Windows\System\qLpxiDX.exe
  2⤵
  PID:5308
- C:\Windows\System\GQOTApK.exe
  C:\Windows\System\GQOTApK.exe
  2⤵
  PID:5328
- C:\Windows\System\svtAtGk.exe
  C:\Windows\System\svtAtGk.exe
  2⤵
  PID:5364
- C:\Windows\System\JMhNjnq.exe
  C:\Windows\System\JMhNjnq.exe
  2⤵
  PID:5388
- C:\Windows\System\fzmxblK.exe
  C:\Windows\System\fzmxblK.exe
  2⤵
  PID:5408
- C:\Windows\System\ITvHmTA.exe
  C:\Windows\System\ITvHmTA.exe
  2⤵
  PID:5424
- C:\Windows\System\tJXRtiX.exe
  C:\Windows\System\tJXRtiX.exe
  2⤵
  PID:5440
- C:\Windows\System\CYFmYTl.exe
  C:\Windows\System\CYFmYTl.exe
  2⤵
  PID:5460
- C:\Windows\System\myNZEPj.exe
  C:\Windows\System\myNZEPj.exe
  2⤵
  PID:5480
- C:\Windows\System\QqVcpZW.exe
  C:\Windows\System\QqVcpZW.exe
  2⤵
  PID:5524
- C:\Windows\System\FymBldK.exe
  C:\Windows\System\FymBldK.exe
  2⤵
  PID:5540
- C:\Windows\System\KxzftcK.exe
  C:\Windows\System\KxzftcK.exe
  2⤵
  PID:5560
- C:\Windows\System\rqUNQDu.exe
  C:\Windows\System\rqUNQDu.exe
  2⤵
  PID:5608
- C:\Windows\System\KRshLcE.exe
  C:\Windows\System\KRshLcE.exe
  2⤵
  PID:5644
- C:\Windows\System\SXPgqIR.exe
  C:\Windows\System\SXPgqIR.exe
  2⤵
  PID:5660
- C:\Windows\System\kQtuozT.exe
  C:\Windows\System\kQtuozT.exe
  2⤵
  PID:5688
- C:\Windows\System\kNmGoyB.exe
  C:\Windows\System\kNmGoyB.exe
  2⤵
  PID:5716
- C:\Windows\System\tSzTnBZ.exe
  C:\Windows\System\tSzTnBZ.exe
  2⤵
  PID:5752
- C:\Windows\System\LXrTclx.exe
  C:\Windows\System\LXrTclx.exe
  2⤵
  PID:5772
- C:\Windows\System\IxLWsnJ.exe
  C:\Windows\System\IxLWsnJ.exe
  2⤵
  PID:5836
- C:\Windows\System\JIWUtlY.exe
  C:\Windows\System\JIWUtlY.exe
  2⤵
  PID:5856
- C:\Windows\System\FNzfaKC.exe
  C:\Windows\System\FNzfaKC.exe
  2⤵
  PID:5876
- C:\Windows\System\JPqOrlm.exe
  C:\Windows\System\JPqOrlm.exe
  2⤵
  PID:5896
- C:\Windows\System\VzdayRI.exe
  C:\Windows\System\VzdayRI.exe
  2⤵
  PID:5936
- C:\Windows\System\kDuQCVP.exe
  C:\Windows\System\kDuQCVP.exe
  2⤵
  PID:5952
- C:\Windows\System\jphceaO.exe
  C:\Windows\System\jphceaO.exe
  2⤵
  PID:5968
- C:\Windows\System\mruZvku.exe
  C:\Windows\System\mruZvku.exe
  2⤵
  PID:5992
- C:\Windows\System\lNzycFj.exe
  C:\Windows\System\lNzycFj.exe
  2⤵
  PID:6016
- C:\Windows\System\xFXkLKm.exe
  C:\Windows\System\xFXkLKm.exe
  2⤵
  PID:6032
- C:\Windows\System\QZNryIc.exe
  C:\Windows\System\QZNryIc.exe
  2⤵
  PID:6108
- C:\Windows\System\BvvAJzB.exe
  C:\Windows\System\BvvAJzB.exe
  2⤵
  PID:6128
- C:\Windows\System\wwSdBNh.exe
  C:\Windows\System\wwSdBNh.exe
  2⤵
  PID:4616
- C:\Windows\System\RvJQgTX.exe
  C:\Windows\System\RvJQgTX.exe
  2⤵
  PID:5056
- C:\Windows\System\CcKuPLX.exe
  C:\Windows\System\CcKuPLX.exe
  2⤵
  PID:1876
- C:\Windows\System\yIdcuIU.exe
  C:\Windows\System\yIdcuIU.exe
  2⤵
  PID:4732
- C:\Windows\System\JCpURqb.exe
  C:\Windows\System\JCpURqb.exe
  2⤵
  PID:1220
- C:\Windows\System\yFXJxOG.exe
  C:\Windows\System\yFXJxOG.exe
  2⤵
  PID:3772
- C:\Windows\System\jePfEjs.exe
  C:\Windows\System\jePfEjs.exe
  2⤵
  PID:3708
- C:\Windows\System\hRvaDqa.exe
  C:\Windows\System\hRvaDqa.exe
  2⤵
  PID:2472
- C:\Windows\System\OSTwuFC.exe
  C:\Windows\System\OSTwuFC.exe
  2⤵
  PID:4696
- C:\Windows\System\RJpMpfA.exe
  C:\Windows\System\RJpMpfA.exe
  2⤵
  PID:5324
- C:\Windows\System\QBfDOxJ.exe
  C:\Windows\System\QBfDOxJ.exe
  2⤵
  PID:5376
- C:\Windows\System\pdEFFNc.exe
  C:\Windows\System\pdEFFNc.exe
  2⤵
  PID:264
- C:\Windows\System\MHiSgYS.exe
  C:\Windows\System\MHiSgYS.exe
  2⤵
  PID:4644
- C:\Windows\System\atcdssh.exe
  C:\Windows\System\atcdssh.exe
  2⤵
  PID:5040
- C:\Windows\System\RgqhZtj.exe
  C:\Windows\System\RgqhZtj.exe
  2⤵
  PID:3768
- C:\Windows\System\xOsZxvU.exe
  C:\Windows\System\xOsZxvU.exe
  2⤵
  PID:5320
- C:\Windows\System\snpkzJa.exe
  C:\Windows\System\snpkzJa.exe
  2⤵
  PID:4608
- C:\Windows\System\YFxZeEt.exe
  C:\Windows\System\YFxZeEt.exe
  2⤵
  PID:2488
- C:\Windows\System\gBsYYEV.exe
  C:\Windows\System\gBsYYEV.exe
  2⤵
  PID:4496
- C:\Windows\System\PSjVICR.exe
  C:\Windows\System\PSjVICR.exe
  2⤵
  PID:5136
- C:\Windows\System\IRoIqjs.exe
  C:\Windows\System\IRoIqjs.exe
  2⤵
  PID:5844
- C:\Windows\System\CrbAUdR.exe
  C:\Windows\System\CrbAUdR.exe
  2⤵
  PID:5184
- C:\Windows\System\oawJDys.exe
  C:\Windows\System\oawJDys.exe
  2⤵
  PID:5196
- C:\Windows\System\bJCYNgb.exe
  C:\Windows\System\bJCYNgb.exe
  2⤵
  PID:5448
- C:\Windows\System\bqoPqfA.exe
  C:\Windows\System\bqoPqfA.exe
  2⤵
  PID:5496
- C:\Windows\System\Erosswf.exe
  C:\Windows\System\Erosswf.exe
  2⤵
  PID:5580
- C:\Windows\System\cvAhIAK.exe
  C:\Windows\System\cvAhIAK.exe
  2⤵
  PID:5596
- C:\Windows\System\GgqLuFY.exe
  C:\Windows\System\GgqLuFY.exe
  2⤵
  PID:6152
- C:\Windows\System\spwMEOH.exe
  C:\Windows\System\spwMEOH.exe
  2⤵
  PID:6176
- C:\Windows\System\qspfQeT.exe
  C:\Windows\System\qspfQeT.exe
  2⤵
  PID:6200
- C:\Windows\System\zDAnvzl.exe
  C:\Windows\System\zDAnvzl.exe
  2⤵
  PID:6224
- C:\Windows\System\Wqdvwsn.exe
  C:\Windows\System\Wqdvwsn.exe
  2⤵
  PID:6248
- C:\Windows\System\ylIVuUq.exe
  C:\Windows\System\ylIVuUq.exe
  2⤵
  PID:6264
- C:\Windows\System\uRdeGSW.exe
  C:\Windows\System\uRdeGSW.exe
  2⤵
  PID:6280
- C:\Windows\System\ZLOWbdP.exe
  C:\Windows\System\ZLOWbdP.exe
  2⤵
  PID:6308
- C:\Windows\System\hKBBIiC.exe
  C:\Windows\System\hKBBIiC.exe
  2⤵
  PID:6424
- C:\Windows\System\EVjeJvL.exe
  C:\Windows\System\EVjeJvL.exe
  2⤵
  PID:6440
- C:\Windows\System\fcnBfFT.exe
  C:\Windows\System\fcnBfFT.exe
  2⤵
  PID:6456
- C:\Windows\System\GlyklgZ.exe
  C:\Windows\System\GlyklgZ.exe
  2⤵
  PID:6472
- C:\Windows\System\hssYzbB.exe
  C:\Windows\System\hssYzbB.exe
  2⤵
  PID:6488
- C:\Windows\System\GdzvjBk.exe
  C:\Windows\System\GdzvjBk.exe
  2⤵
  PID:6504
- C:\Windows\System\uZUJPUT.exe
  C:\Windows\System\uZUJPUT.exe
  2⤵
  PID:6520
- C:\Windows\System\AMQDtWn.exe
  C:\Windows\System\AMQDtWn.exe
  2⤵
  PID:6536
- C:\Windows\System\jSbvBDl.exe
  C:\Windows\System\jSbvBDl.exe
  2⤵
  PID:6552
- C:\Windows\System\HWhOkJl.exe
  C:\Windows\System\HWhOkJl.exe
  2⤵
  PID:6568
- C:\Windows\System\FofTmOU.exe
  C:\Windows\System\FofTmOU.exe
  2⤵
  PID:6592
- C:\Windows\System\lbkqXvg.exe
  C:\Windows\System\lbkqXvg.exe
  2⤵
  PID:6608
- C:\Windows\System\xrfsKHI.exe
  C:\Windows\System\xrfsKHI.exe
  2⤵
  PID:6636
- C:\Windows\System\yVrTorw.exe
  C:\Windows\System\yVrTorw.exe
  2⤵
  PID:6652
- C:\Windows\System\dQScHJi.exe
  C:\Windows\System\dQScHJi.exe
  2⤵
  PID:6676
- C:\Windows\System\MdssBaH.exe
  C:\Windows\System\MdssBaH.exe
  2⤵
  PID:6696
- C:\Windows\System\WjkPRSa.exe
  C:\Windows\System\WjkPRSa.exe
  2⤵
  PID:6712
- C:\Windows\System\pHtJDsJ.exe
  C:\Windows\System\pHtJDsJ.exe
  2⤵
  PID:6736
- C:\Windows\System\lpFJMCl.exe
  C:\Windows\System\lpFJMCl.exe
  2⤵
  PID:6752
- C:\Windows\System\kHJOBsO.exe
  C:\Windows\System\kHJOBsO.exe
  2⤵
  PID:6776
- C:\Windows\System\WctYzqZ.exe
  C:\Windows\System\WctYzqZ.exe
  2⤵
  PID:6792
- C:\Windows\System\rfQUmDH.exe
  C:\Windows\System\rfQUmDH.exe
  2⤵
  PID:6824
- C:\Windows\System\wVrxHKz.exe
  C:\Windows\System\wVrxHKz.exe
  2⤵
  PID:6848
- C:\Windows\System\osvuKtN.exe
  C:\Windows\System\osvuKtN.exe
  2⤵
  PID:6864
- C:\Windows\System\vhMuoGi.exe
  C:\Windows\System\vhMuoGi.exe
  2⤵
  PID:6888
- C:\Windows\System\DpBSLvQ.exe
  C:\Windows\System\DpBSLvQ.exe
  2⤵
  PID:6916
- C:\Windows\System\qrTCSyr.exe
  C:\Windows\System\qrTCSyr.exe
  2⤵
  PID:6932
- C:\Windows\System\xUdmjwm.exe
  C:\Windows\System\xUdmjwm.exe
  2⤵
  PID:6956
- C:\Windows\System\ZIjPIoy.exe
  C:\Windows\System\ZIjPIoy.exe
  2⤵
  PID:6984
- C:\Windows\System\AQobbBI.exe
  C:\Windows\System\AQobbBI.exe
  2⤵
  PID:7004
- C:\Windows\System\BAmupGI.exe
  C:\Windows\System\BAmupGI.exe
  2⤵
  PID:7028
- C:\Windows\System\eOsPtDT.exe
  C:\Windows\System\eOsPtDT.exe
  2⤵
  PID:7044
- C:\Windows\System\yTMslMe.exe
  C:\Windows\System\yTMslMe.exe
  2⤵
  PID:7140
- C:\Windows\System\zHWXzvk.exe
  C:\Windows\System\zHWXzvk.exe
  2⤵
  PID:7156
- C:\Windows\System\MRaXZOu.exe
  C:\Windows\System\MRaXZOu.exe
  2⤵
  PID:2720
- C:\Windows\System\pGTipUQ.exe
  C:\Windows\System\pGTipUQ.exe
  2⤵
  PID:4004
- C:\Windows\System\oPqTYbo.exe
  C:\Windows\System\oPqTYbo.exe
  2⤵
  PID:5272
- C:\Windows\System\NEpslxa.exe
  C:\Windows\System\NEpslxa.exe
  2⤵
  PID:5736
- C:\Windows\System\TQvHYuj.exe
  C:\Windows\System\TQvHYuj.exe
  2⤵
  PID:5816
- C:\Windows\System\goSpjEf.exe
  C:\Windows\System\goSpjEf.exe
  2⤵
  PID:5868
- C:\Windows\System\nMRbGbt.exe
  C:\Windows\System\nMRbGbt.exe
  2⤵
  PID:4452
- C:\Windows\System\hytOBRD.exe
  C:\Windows\System\hytOBRD.exe
  2⤵
  PID:6008
- C:\Windows\System\MNInbyX.exe
  C:\Windows\System\MNInbyX.exe
  2⤵
  PID:6096
- C:\Windows\System\aqRstCv.exe
  C:\Windows\System\aqRstCv.exe
  2⤵
  PID:6140
- C:\Windows\System\ozRRVsE.exe
  C:\Windows\System\ozRRVsE.exe
  2⤵
  PID:1780
- C:\Windows\System\PvVbbxd.exe
  C:\Windows\System\PvVbbxd.exe
  2⤵
  PID:4312
- C:\Windows\System\euuUHGI.exe
  C:\Windows\System\euuUHGI.exe
  2⤵
  PID:208
- C:\Windows\System\IUwvcqa.exe
  C:\Windows\System\IUwvcqa.exe
  2⤵
  PID:5216
- C:\Windows\System\xGDkDkC.exe
  C:\Windows\System\xGDkDkC.exe
  2⤵
  PID:5552
- C:\Windows\System\sEmiFqw.exe
  C:\Windows\System\sEmiFqw.exe
  2⤵
  PID:5532
- C:\Windows\System\rkAHlyd.exe
  C:\Windows\System\rkAHlyd.exe
  2⤵
  PID:6220
- C:\Windows\System\LKvJkfe.exe
  C:\Windows\System\LKvJkfe.exe
  2⤵
  PID:6908
- C:\Windows\System\lcTLoqQ.exe
  C:\Windows\System\lcTLoqQ.exe
  2⤵
  PID:7012
- C:\Windows\System\ZcDMDzQ.exe
  C:\Windows\System\ZcDMDzQ.exe
  2⤵
  PID:1448
- C:\Windows\System\yikkRPo.exe
  C:\Windows\System\yikkRPo.exe
  2⤵
  PID:5104
- C:\Windows\System\lUWnIim.exe
  C:\Windows\System\lUWnIim.exe
  2⤵
  PID:2988
- C:\Windows\System\oRsdBGJ.exe
  C:\Windows\System\oRsdBGJ.exe
  2⤵
  PID:5620
- C:\Windows\System\fhvhJIO.exe
  C:\Windows\System\fhvhJIO.exe
  2⤵
  PID:5208
- C:\Windows\System\rAqCkQR.exe
  C:\Windows\System\rAqCkQR.exe
  2⤵
  PID:6948
- C:\Windows\System\LurkEtP.exe
  C:\Windows\System\LurkEtP.exe
  2⤵
  PID:6996
- C:\Windows\System\qJMiEfs.exe
  C:\Windows\System\qJMiEfs.exe
  2⤵
  PID:7040
- C:\Windows\System\zIoEaYE.exe
  C:\Windows\System\zIoEaYE.exe
  2⤵
  PID:7184
- C:\Windows\System\PojVsvJ.exe
  C:\Windows\System\PojVsvJ.exe
  2⤵
  PID:7208
- C:\Windows\System\WhOxIlG.exe
  C:\Windows\System\WhOxIlG.exe
  2⤵
  PID:7232
- C:\Windows\System\vJjcrXk.exe
  C:\Windows\System\vJjcrXk.exe
  2⤵
  PID:7248
- C:\Windows\System\kHroPJJ.exe
  C:\Windows\System\kHroPJJ.exe
  2⤵
  PID:7272
- C:\Windows\System\SvPMtZS.exe
  C:\Windows\System\SvPMtZS.exe
  2⤵
  PID:7296
- C:\Windows\System\BnPUMLn.exe
  C:\Windows\System\BnPUMLn.exe
  2⤵
  PID:7312
- C:\Windows\System\lGNjyYa.exe
  C:\Windows\System\lGNjyYa.exe
  2⤵
  PID:7336
- C:\Windows\System\MMhPHjN.exe
  C:\Windows\System\MMhPHjN.exe
  2⤵
  PID:7360
- C:\Windows\System\KcRPEwi.exe
  C:\Windows\System\KcRPEwi.exe
  2⤵
  PID:7384
- C:\Windows\System\roKpjUe.exe
  C:\Windows\System\roKpjUe.exe
  2⤵
  PID:7400
- C:\Windows\System\WahWPJR.exe
  C:\Windows\System\WahWPJR.exe
  2⤵
  PID:7416
- C:\Windows\System\tbqHKup.exe
  C:\Windows\System\tbqHKup.exe
  2⤵
  PID:7440
- C:\Windows\System\GarEtug.exe
  C:\Windows\System\GarEtug.exe
  2⤵
  PID:7464
- C:\Windows\System\hlFvOBz.exe
  C:\Windows\System\hlFvOBz.exe
  2⤵
  PID:7488
- C:\Windows\System\PNEDbKJ.exe
  C:\Windows\System\PNEDbKJ.exe
  2⤵
  PID:7504
- C:\Windows\System\LtBoOoO.exe
  C:\Windows\System\LtBoOoO.exe
  2⤵
  PID:7528
- C:\Windows\System\TPEVOnH.exe
  C:\Windows\System\TPEVOnH.exe
  2⤵
  PID:7548
- C:\Windows\System\JMeMIYi.exe
  C:\Windows\System\JMeMIYi.exe
  2⤵
  PID:7568
- C:\Windows\System\ODDwYFP.exe
  C:\Windows\System\ODDwYFP.exe
  2⤵
  PID:7588
- C:\Windows\System\wdWqyEe.exe
  C:\Windows\System\wdWqyEe.exe
  2⤵
  PID:7612
- C:\Windows\System\ouACQTl.exe
  C:\Windows\System\ouACQTl.exe
  2⤵
  PID:7632
- C:\Windows\System\MWGrnIp.exe
  C:\Windows\System\MWGrnIp.exe
  2⤵
  PID:7652
- C:\Windows\System\VCgsEYO.exe
  C:\Windows\System\VCgsEYO.exe
  2⤵
  PID:7672
- C:\Windows\System\MbrNHis.exe
  C:\Windows\System\MbrNHis.exe
  2⤵
  PID:7704
- C:\Windows\System\NQLXUuU.exe
  C:\Windows\System\NQLXUuU.exe
  2⤵
  PID:7736
- C:\Windows\System\UfxDTZx.exe
  C:\Windows\System\UfxDTZx.exe
  2⤵
  PID:7752
- C:\Windows\System\tHDspeh.exe
  C:\Windows\System\tHDspeh.exe
  2⤵
  PID:7776
- C:\Windows\System\mzJdBIa.exe
  C:\Windows\System\mzJdBIa.exe
  2⤵
  PID:7804
- C:\Windows\System\OEQpCea.exe
  C:\Windows\System\OEQpCea.exe
  2⤵
  PID:7820
- C:\Windows\System\oTfaGcd.exe
  C:\Windows\System\oTfaGcd.exe
  2⤵
  PID:7844
- C:\Windows\System\EsyhUFh.exe
  C:\Windows\System\EsyhUFh.exe
  2⤵
  PID:7868
- C:\Windows\System\rSGTZVJ.exe
  C:\Windows\System\rSGTZVJ.exe
  2⤵
  PID:7936
- C:\Windows\System\bGFetqx.exe
  C:\Windows\System\bGFetqx.exe
  2⤵
  PID:7952
- C:\Windows\System\RHSPoUN.exe
  C:\Windows\System\RHSPoUN.exe
  2⤵
  PID:7972
- C:\Windows\System\CneWAnQ.exe
  C:\Windows\System\CneWAnQ.exe
  2⤵
  PID:7992
- C:\Windows\System\KRdYkqa.exe
  C:\Windows\System\KRdYkqa.exe
  2⤵
  PID:8008
- C:\Windows\System\xcEgpeE.exe
  C:\Windows\System\xcEgpeE.exe
  2⤵
  PID:8036
- C:\Windows\System\gzqGhaX.exe
  C:\Windows\System\gzqGhaX.exe
  2⤵
  PID:8056
- C:\Windows\System\NVkstlH.exe
  C:\Windows\System\NVkstlH.exe
  2⤵
  PID:8072
- C:\Windows\System\LFPEquN.exe
  C:\Windows\System\LFPEquN.exe
  2⤵
  PID:8096
- C:\Windows\System\LkXUdzX.exe
  C:\Windows\System\LkXUdzX.exe
  2⤵
  PID:8116
- C:\Windows\System\XmhLhRz.exe
  C:\Windows\System\XmhLhRz.exe
  2⤵
  PID:8144
- C:\Windows\System\DKpPeEz.exe
  C:\Windows\System\DKpPeEz.exe
  2⤵
  PID:8164
- C:\Windows\System\zWjXQcR.exe
  C:\Windows\System\zWjXQcR.exe
  2⤵
  PID:8180
- C:\Windows\System\VflAXow.exe
  C:\Windows\System\VflAXow.exe
  2⤵
  PID:6420
- C:\Windows\System\BReozde.exe
  C:\Windows\System\BReozde.exe
  2⤵
  PID:6480
- C:\Windows\System\CblgeVz.exe
  C:\Windows\System\CblgeVz.exe
  2⤵
  PID:6528
- C:\Windows\System\mapWTqS.exe
  C:\Windows\System\mapWTqS.exe
  2⤵
  PID:6580
- C:\Windows\System\oDANLQr.exe
  C:\Windows\System\oDANLQr.exe
  2⤵
  PID:6628
- C:\Windows\System\fholmUM.exe
  C:\Windows\System\fholmUM.exe
  2⤵
  PID:6668
- C:\Windows\System\sOIMqRr.exe
  C:\Windows\System\sOIMqRr.exe
  2⤵
  PID:5588
- C:\Windows\System\RDxiSzR.exe
  C:\Windows\System\RDxiSzR.exe
  2⤵
  PID:6744
- C:\Windows\System\krJqggE.exe
  C:\Windows\System\krJqggE.exe
  2⤵
  PID:6924
- C:\Windows\System\sLFnbHA.exe
  C:\Windows\System\sLFnbHA.exe
  2⤵
  PID:4172
- C:\Windows\System\yKoxztg.exe
  C:\Windows\System\yKoxztg.exe
  2⤵
  PID:7228
- C:\Windows\System\VAaFsAy.exe
  C:\Windows\System\VAaFsAy.exe
  2⤵
  PID:8200
- C:\Windows\System\ioTVRQc.exe
  C:\Windows\System\ioTVRQc.exe
  2⤵
  PID:8220
- C:\Windows\System\poIQiYn.exe
  C:\Windows\System\poIQiYn.exe
  2⤵
  PID:8244
- C:\Windows\System\fpdMbBq.exe
  C:\Windows\System\fpdMbBq.exe
  2⤵
  PID:8268
- C:\Windows\System\CoBoccW.exe
  C:\Windows\System\CoBoccW.exe
  2⤵
  PID:8284
- C:\Windows\System\rezQhPh.exe
  C:\Windows\System\rezQhPh.exe
  2⤵
  PID:8312
- C:\Windows\System\EGkzPBu.exe
  C:\Windows\System\EGkzPBu.exe
  2⤵
  PID:8336
- C:\Windows\System\YCAQkjY.exe
  C:\Windows\System\YCAQkjY.exe
  2⤵
  PID:8360
- C:\Windows\System\XxAqTcY.exe
  C:\Windows\System\XxAqTcY.exe
  2⤵
  PID:8380
- C:\Windows\System\pUnqCXw.exe
  C:\Windows\System\pUnqCXw.exe
  2⤵
  PID:8404
- C:\Windows\System\TxijmeE.exe
  C:\Windows\System\TxijmeE.exe
  2⤵
  PID:8428
- C:\Windows\System\DFXNUsW.exe
  C:\Windows\System\DFXNUsW.exe
  2⤵
  PID:8452
- C:\Windows\System\SJdwLSD.exe
  C:\Windows\System\SJdwLSD.exe
  2⤵
  PID:8480
- C:\Windows\System\JiQbgqk.exe
  C:\Windows\System\JiQbgqk.exe
  2⤵
  PID:8496
- C:\Windows\System\sWSNhtp.exe
  C:\Windows\System\sWSNhtp.exe
  2⤵
  PID:8536
- C:\Windows\System\IrChGdc.exe
  C:\Windows\System\IrChGdc.exe
  2⤵
  PID:8560
- C:\Windows\System\NPjjoWZ.exe
  C:\Windows\System\NPjjoWZ.exe
  2⤵
  PID:8580
- C:\Windows\System\MgYGBnJ.exe
  C:\Windows\System\MgYGBnJ.exe
  2⤵
  PID:8600
- C:\Windows\System\GINrpOP.exe
  C:\Windows\System\GINrpOP.exe
  2⤵
  PID:8636
- C:\Windows\System\GftOJts.exe
  C:\Windows\System\GftOJts.exe
  2⤵
  PID:8660
- C:\Windows\System\IBBWDBs.exe
  C:\Windows\System\IBBWDBs.exe
  2⤵
  PID:8696
- C:\Windows\System\zNIiCXt.exe
  C:\Windows\System\zNIiCXt.exe
  2⤵
  PID:8712
- C:\Windows\System\OwNjkRj.exe
  C:\Windows\System\OwNjkRj.exe
  2⤵
  PID:8728
- C:\Windows\System\BaNXAax.exe
  C:\Windows\System\BaNXAax.exe
  2⤵
  PID:8744
- C:\Windows\System\LfjIVpa.exe
  C:\Windows\System\LfjIVpa.exe
  2⤵
  PID:8760
- C:\Windows\System\SHALHIU.exe
  C:\Windows\System\SHALHIU.exe
  2⤵
  PID:8804
- C:\Windows\System\ygZQMGE.exe
  C:\Windows\System\ygZQMGE.exe
  2⤵
  PID:8824
- C:\Windows\System\ogvnCPE.exe
  C:\Windows\System\ogvnCPE.exe
  2⤵
  PID:8840
- C:\Windows\System\QUVAzyD.exe
  C:\Windows\System\QUVAzyD.exe
  2⤵
  PID:8868
- C:\Windows\System\mEXTRlX.exe
  C:\Windows\System\mEXTRlX.exe
  2⤵
  PID:8892
- C:\Windows\System\lVEJoDR.exe
  C:\Windows\System\lVEJoDR.exe
  2⤵
  PID:8912
- C:\Windows\System\wUDFajJ.exe
  C:\Windows\System\wUDFajJ.exe
  2⤵
  PID:8932
- C:\Windows\System\coOhuhf.exe
  C:\Windows\System\coOhuhf.exe
  2⤵
  PID:8948
- C:\Windows\System\rnBnIkg.exe
  C:\Windows\System\rnBnIkg.exe
  2⤵
  PID:8972
- C:\Windows\System\XoykhKo.exe
  C:\Windows\System\XoykhKo.exe
  2⤵
  PID:9000
- C:\Windows\System\ZTtgIJo.exe
  C:\Windows\System\ZTtgIJo.exe
  2⤵
  PID:9016
- C:\Windows\System\SBfEuMj.exe
  C:\Windows\System\SBfEuMj.exe
  2⤵
  PID:9036
- C:\Windows\System\VHmDQzr.exe
  C:\Windows\System\VHmDQzr.exe
  2⤵
  PID:9060
- C:\Windows\System\nTDsVdT.exe
  C:\Windows\System\nTDsVdT.exe
  2⤵
  PID:9076
- C:\Windows\System\WPWfZbK.exe
  C:\Windows\System\WPWfZbK.exe
  2⤵
  PID:9100
- C:\Windows\System\gXUkYVc.exe
  C:\Windows\System\gXUkYVc.exe
  2⤵
  PID:9116
- C:\Windows\System\NQOkQaC.exe
  C:\Windows\System\NQOkQaC.exe
  2⤵
  PID:9156
- C:\Windows\System\ASQMwtR.exe
  C:\Windows\System\ASQMwtR.exe
  2⤵
  PID:9172
- C:\Windows\System\ozdFddK.exe
  C:\Windows\System\ozdFddK.exe
  2⤵
  PID:9200
- C:\Windows\System\qvnjQhY.exe
  C:\Windows\System\qvnjQhY.exe
  2⤵
  PID:7448
- C:\Windows\System\FljJfLd.exe
  C:\Windows\System\FljJfLd.exe
  2⤵
  PID:7540
- C:\Windows\System\lxqAYsf.exe
  C:\Windows\System\lxqAYsf.exe
  2⤵
  PID:7604
- C:\Windows\System\ZRUATvh.exe
  C:\Windows\System\ZRUATvh.exe
  2⤵
  PID:7696
- C:\Windows\System\UhZMEbd.exe
  C:\Windows\System\UhZMEbd.exe
  2⤵
  PID:7796
- C:\Windows\System\jEheBfy.exe
  C:\Windows\System\jEheBfy.exe
  2⤵
  PID:8000
- C:\Windows\System\lywtEVh.exe
  C:\Windows\System\lywtEVh.exe
  2⤵
  PID:8024
- C:\Windows\System\jySQhHo.exe
  C:\Windows\System\jySQhHo.exe
  2⤵
  PID:7128
- C:\Windows\System\GGDGPXb.exe
  C:\Windows\System\GGDGPXb.exe
  2⤵
  PID:5672
- C:\Windows\System\RgVRvjX.exe
  C:\Windows\System\RgVRvjX.exe
  2⤵
  PID:5708
- C:\Windows\System\hoUvxuG.exe
  C:\Windows\System\hoUvxuG.exe
  2⤵
  PID:5864
- C:\Windows\System\HxarRYH.exe
  C:\Windows\System\HxarRYH.exe
  2⤵
  PID:6004
- C:\Windows\System\EAtsZMW.exe
  C:\Windows\System\EAtsZMW.exe
  2⤵
  PID:6136
- C:\Windows\System\cehkOMq.exe
  C:\Windows\System\cehkOMq.exe
  2⤵
  PID:3248
- C:\Windows\System\llwbBWF.exe
  C:\Windows\System\llwbBWF.exe
  2⤵
  PID:5456
- C:\Windows\System\cEEiMwo.exe
  C:\Windows\System\cEEiMwo.exe
  2⤵
  PID:7220
- C:\Windows\System\LCTXfHu.exe
  C:\Windows\System\LCTXfHu.exe
  2⤵
  PID:6660
- C:\Windows\System\YhWFMWJ.exe
  C:\Windows\System\YhWFMWJ.exe
  2⤵
  PID:7264
- C:\Windows\System\hVdCyNq.exe
  C:\Windows\System\hVdCyNq.exe
  2⤵
  PID:7356
- C:\Windows\System\TvxLkwG.exe
  C:\Windows\System\TvxLkwG.exe
  2⤵
  PID:7332
- C:\Windows\System\ZDCOnly.exe
  C:\Windows\System\ZDCOnly.exe
  2⤵
  PID:8196
- C:\Windows\System\PQogwwQ.exe
  C:\Windows\System\PQogwwQ.exe
  2⤵
  PID:8260
- C:\Windows\System\XClAkHD.exe
  C:\Windows\System\XClAkHD.exe
  2⤵
  PID:7472
- C:\Windows\System\TvMlAjk.exe
  C:\Windows\System\TvMlAjk.exe
  2⤵
  PID:7688
- C:\Windows\System\LRclrPG.exe
  C:\Windows\System\LRclrPG.exe
  2⤵
  PID:7748
- C:\Windows\System\iPUKrWE.exe
  C:\Windows\System\iPUKrWE.exe
  2⤵
  PID:8556
- C:\Windows\System\mHHIBox.exe
  C:\Windows\System\mHHIBox.exe
  2⤵
  PID:7812
- C:\Windows\System\GKUOuPz.exe
  C:\Windows\System\GKUOuPz.exe
  2⤵
  PID:9240
- C:\Windows\System\Dtcotwm.exe
  C:\Windows\System\Dtcotwm.exe
  2⤵
  PID:9256
- C:\Windows\System\EMeIvmb.exe
  C:\Windows\System\EMeIvmb.exe
  2⤵
  PID:9272
- C:\Windows\System\rMOpNgj.exe
  C:\Windows\System\rMOpNgj.exe
  2⤵
  PID:9296
- C:\Windows\System\PdufRLc.exe
  C:\Windows\System\PdufRLc.exe
  2⤵
  PID:9328
- C:\Windows\System\UEaCPKV.exe
  C:\Windows\System\UEaCPKV.exe
  2⤵
  PID:9364
- C:\Windows\System\uChpsXT.exe
  C:\Windows\System\uChpsXT.exe
  2⤵
  PID:9384
- C:\Windows\System\BaQjGGn.exe
  C:\Windows\System\BaQjGGn.exe
  2⤵
  PID:9400
- C:\Windows\System\qTzLTcR.exe
  C:\Windows\System\qTzLTcR.exe
  2⤵
  PID:9420
- C:\Windows\System\CvhyyyK.exe
  C:\Windows\System\CvhyyyK.exe
  2⤵
  PID:9444
- C:\Windows\System\HFuHNEN.exe
  C:\Windows\System\HFuHNEN.exe
  2⤵
  PID:9460
- C:\Windows\System\TxchZRf.exe
  C:\Windows\System\TxchZRf.exe
  2⤵
  PID:9484
- C:\Windows\System\bNPMiHg.exe
  C:\Windows\System\bNPMiHg.exe
  2⤵
  PID:9504
- C:\Windows\System\gsGWMSc.exe
  C:\Windows\System\gsGWMSc.exe
  2⤵
  PID:9524
- C:\Windows\System\nkMqDQF.exe
  C:\Windows\System\nkMqDQF.exe
  2⤵
  PID:9552
- C:\Windows\System\NUzsJsH.exe
  C:\Windows\System\NUzsJsH.exe
  2⤵
  PID:9580
- C:\Windows\System\uxqFDHa.exe
  C:\Windows\System\uxqFDHa.exe
  2⤵
  PID:9600
- C:\Windows\System\bYxoRXF.exe
  C:\Windows\System\bYxoRXF.exe
  2⤵
  PID:9628
- C:\Windows\System\KYuacMa.exe
  C:\Windows\System\KYuacMa.exe
  2⤵
  PID:9652
- C:\Windows\System\isDktRA.exe
  C:\Windows\System\isDktRA.exe
  2⤵
  PID:9676
- C:\Windows\System\XRecsMV.exe
  C:\Windows\System\XRecsMV.exe
  2⤵
  PID:9716
- C:\Windows\System\gghUnoM.exe
  C:\Windows\System\gghUnoM.exe
  2⤵
  PID:9732
- C:\Windows\System\IqSTUTH.exe
  C:\Windows\System\IqSTUTH.exe
  2⤵
  PID:9764
- C:\Windows\System\zFFtxtV.exe
  C:\Windows\System\zFFtxtV.exe
  2⤵
  PID:9784
- C:\Windows\System\SkyFxni.exe
  C:\Windows\System\SkyFxni.exe
  2⤵
  PID:9812
- C:\Windows\System\AtBGhJo.exe
  C:\Windows\System\AtBGhJo.exe
  2⤵
  PID:9832
- C:\Windows\System\eXhgLFh.exe
  C:\Windows\System\eXhgLFh.exe
  2⤵
  PID:9848
- C:\Windows\System\BDkVMjl.exe
  C:\Windows\System\BDkVMjl.exe
  2⤵
  PID:9880
- C:\Windows\System\VzNuLig.exe
  C:\Windows\System\VzNuLig.exe
  2⤵
  PID:9908
- C:\Windows\System\UInmGKh.exe
  C:\Windows\System\UInmGKh.exe
  2⤵
  PID:9924
- C:\Windows\System\QNXMjEf.exe
  C:\Windows\System\QNXMjEf.exe
  2⤵
  PID:9944
- C:\Windows\System\ccBnbSm.exe
  C:\Windows\System\ccBnbSm.exe
  2⤵
  PID:9964
- C:\Windows\System\gkKlrKd.exe
  C:\Windows\System\gkKlrKd.exe
  2⤵
  PID:9980
- C:\Windows\System\lWWkFyR.exe
  C:\Windows\System\lWWkFyR.exe
  2⤵
  PID:9996
- C:\Windows\System\BayHjAH.exe
  C:\Windows\System\BayHjAH.exe
  2⤵
  PID:10016
- C:\Windows\System\FQGfyTE.exe
  C:\Windows\System\FQGfyTE.exe
  2⤵
  PID:10032
- C:\Windows\System\nLayFRI.exe
  C:\Windows\System\nLayFRI.exe
  2⤵
  PID:10056
- C:\Windows\System\vCqUgye.exe
  C:\Windows\System\vCqUgye.exe
  2⤵
  PID:10076
- C:\Windows\System\cBatpZL.exe
  C:\Windows\System\cBatpZL.exe
  2⤵
  PID:10096
- C:\Windows\System\iXgvuMn.exe
  C:\Windows\System\iXgvuMn.exe
  2⤵
  PID:10120
- C:\Windows\System\JcXIHFI.exe
  C:\Windows\System\JcXIHFI.exe
  2⤵
  PID:10140
- C:\Windows\System\sTHLTFY.exe
  C:\Windows\System\sTHLTFY.exe
  2⤵
  PID:10164
- C:\Windows\System\Uhealaa.exe
  C:\Windows\System\Uhealaa.exe
  2⤵
  PID:10184
- C:\Windows\System\KtDqpDx.exe
  C:\Windows\System\KtDqpDx.exe
  2⤵
  PID:10204
- C:\Windows\System\liNvIRy.exe
  C:\Windows\System\liNvIRy.exe
  2⤵
  PID:10232
- C:\Windows\System\HjtrBsY.exe
  C:\Windows\System\HjtrBsY.exe
  2⤵
  PID:6772
- C:\Windows\System\AIlxpSo.exe
  C:\Windows\System\AIlxpSo.exe
  2⤵
  PID:8924
- C:\Windows\System\OQhjKXC.exe
  C:\Windows\System\OQhjKXC.exe
  2⤵
  PID:8944
- C:\Windows\System\MWjiQPS.exe
  C:\Windows\System\MWjiQPS.exe
  2⤵
  PID:9024
- C:\Windows\System\soZqcKA.exe
  C:\Windows\System\soZqcKA.exe
  2⤵
  PID:6164
- C:\Windows\System\NNARdju.exe
  C:\Windows\System\NNARdju.exe
  2⤵
  PID:3944
- C:\Windows\System\vkQgolI.exe
  C:\Windows\System\vkQgolI.exe
  2⤵
  PID:9188
- C:\Windows\System\VxShdyW.exe
  C:\Windows\System\VxShdyW.exe
  2⤵
  PID:5128
- C:\Windows\System\nXvyfxb.exe
  C:\Windows\System\nXvyfxb.exe
  2⤵
  PID:5592
- C:\Windows\System\LyLftFc.exe
  C:\Windows\System\LyLftFc.exe
  2⤵
  PID:7644
- C:\Windows\System\EnTjQmU.exe
  C:\Windows\System\EnTjQmU.exe
  2⤵
  PID:8016
- C:\Windows\System\OTitqwn.exe
  C:\Windows\System\OTitqwn.exe
  2⤵
  PID:7200
- C:\Windows\System\YRhyobM.exe
  C:\Windows\System\YRhyobM.exe
  2⤵
  PID:5016
- C:\Windows\System\MEPAzyp.exe
  C:\Windows\System\MEPAzyp.exe
  2⤵
  PID:7372
- C:\Windows\System\trQpszJ.exe
  C:\Windows\System\trQpszJ.exe
  2⤵
  PID:7432
- C:\Windows\System\wRFLpwF.exe
  C:\Windows\System\wRFLpwF.exe
  2⤵
  PID:7256
- C:\Windows\System\laNfktR.exe
  C:\Windows\System\laNfktR.exe
  2⤵
  PID:7624
- C:\Windows\System\gGCrrNY.exe
  C:\Windows\System\gGCrrNY.exe
  2⤵
  PID:7944
- C:\Windows\System\FAVqbGE.exe
  C:\Windows\System\FAVqbGE.exe
  2⤵
  PID:7984
- C:\Windows\System\nQQMJsP.exe
  C:\Windows\System\nQQMJsP.exe
  2⤵
  PID:8132
- C:\Windows\System\pgwGcKm.exe
  C:\Windows\System\pgwGcKm.exe
  2⤵
  PID:9696
- C:\Windows\System\ohCoHnK.exe
  C:\Windows\System\ohCoHnK.exe
  2⤵
  PID:9724
- C:\Windows\System\aJDiNuA.exe
  C:\Windows\System\aJDiNuA.exe
  2⤵
  PID:10256
- C:\Windows\System\piKjxdO.exe
  C:\Windows\System\piKjxdO.exe
  2⤵
  PID:10280
- C:\Windows\System\EXkdSQb.exe
  C:\Windows\System\EXkdSQb.exe
  2⤵
  PID:10300
- C:\Windows\System\bWmvBxx.exe
  C:\Windows\System\bWmvBxx.exe
  2⤵
  PID:10316
- C:\Windows\System\TqPwBWh.exe
  C:\Windows\System\TqPwBWh.exe
  2⤵
  PID:10340
- C:\Windows\System\TdMxZHH.exe
  C:\Windows\System\TdMxZHH.exe
  2⤵
  PID:10368
- C:\Windows\System\angFWSy.exe
  C:\Windows\System\angFWSy.exe
  2⤵
  PID:10384
- C:\Windows\System\jCaOJUY.exe
  C:\Windows\System\jCaOJUY.exe
  2⤵
  PID:10408
- C:\Windows\System\YSTuKVM.exe
  C:\Windows\System\YSTuKVM.exe
  2⤵
  PID:10440
- C:\Windows\System\iXYsOdb.exe
  C:\Windows\System\iXYsOdb.exe
  2⤵
  PID:10460
- C:\Windows\System\xPcbHPg.exe
  C:\Windows\System\xPcbHPg.exe
  2⤵
  PID:10488
- C:\Windows\System\SBkXGqX.exe
  C:\Windows\System\SBkXGqX.exe
  2⤵
  PID:10504
- C:\Windows\System\cIzLear.exe
  C:\Windows\System\cIzLear.exe
  2⤵
  PID:10520
- C:\Windows\System\xDDwzou.exe
  C:\Windows\System\xDDwzou.exe
  2⤵
  PID:10536
- C:\Windows\System\hTTAbdm.exe
  C:\Windows\System\hTTAbdm.exe
  2⤵
  PID:10556
- C:\Windows\System\cpCnAmL.exe
  C:\Windows\System\cpCnAmL.exe
  2⤵
  PID:10572
- C:\Windows\System\IOBEbMy.exe
  C:\Windows\System\IOBEbMy.exe
  2⤵
  PID:11108
- C:\Windows\System\mwcelDb.exe
  C:\Windows\System\mwcelDb.exe
  2⤵
  PID:11196
- C:\Windows\System\WVQSrTl.exe
  C:\Windows\System\WVQSrTl.exe
  2⤵
  PID:11212
- C:\Windows\System\MClLrrh.exe
  C:\Windows\System\MClLrrh.exe
  2⤵
  PID:11240
- C:\Windows\System\DuQXIpd.exe
  C:\Windows\System\DuQXIpd.exe
  2⤵
  PID:11260
- C:\Windows\System\DLyRuDV.exe
  C:\Windows\System\DLyRuDV.exe
  2⤵
  PID:9840
- C:\Windows\System\OkReCJP.exe
  C:\Windows\System\OkReCJP.exe
  2⤵
  PID:6560
- C:\Windows\System\CzfDoNl.exe
  C:\Windows\System\CzfDoNl.exe
  2⤵
  PID:6120
- C:\Windows\System\ntLdUVs.exe
  C:\Windows\System\ntLdUVs.exe
  2⤵
  PID:10128
- C:\Windows\System\PjHdhis.exe
  C:\Windows\System\PjHdhis.exe
  2⤵
  PID:7284
- C:\Windows\System\SXetVrX.exe
  C:\Windows\System\SXetVrX.exe
  2⤵
  PID:8396
- C:\Windows\System\BKYOTuc.exe
  C:\Windows\System\BKYOTuc.exe
  2⤵
  PID:1132
- C:\Windows\System\ZVusUNl.exe
  C:\Windows\System\ZVusUNl.exe
  2⤵
  PID:8476
- C:\Windows\System\kcyiHab.exe
  C:\Windows\System\kcyiHab.exe
  2⤵
  PID:7772
- C:\Windows\System\GcBHyoY.exe
  C:\Windows\System\GcBHyoY.exe
  2⤵
  PID:8644
- C:\Windows\System\yukHUxR.exe
  C:\Windows\System\yukHUxR.exe
  2⤵
  PID:8688
- C:\Windows\System\mBwqhKk.exe
  C:\Windows\System\mBwqhKk.exe
  2⤵
  PID:8724
- C:\Windows\System\HJCdVoP.exe
  C:\Windows\System\HJCdVoP.exe
  2⤵
  PID:8756
- C:\Windows\System\VOMySNA.exe
  C:\Windows\System\VOMySNA.exe
  2⤵
  PID:8792
- C:\Windows\System\OMmxhPY.exe
  C:\Windows\System\OMmxhPY.exe
  2⤵
  PID:8836
- C:\Windows\System\tlJYPLg.exe
  C:\Windows\System\tlJYPLg.exe
  2⤵
  PID:8884
- C:\Windows\System\gdWEYkq.exe
  C:\Windows\System\gdWEYkq.exe
  2⤵
  PID:8956
- C:\Windows\System\nDqyLwl.exe
  C:\Windows\System\nDqyLwl.exe
  2⤵
  PID:9044
- C:\Windows\System\fLREEzl.exe
  C:\Windows\System\fLREEzl.exe
  2⤵
  PID:9112
- C:\Windows\System\qXiraVM.exe
  C:\Windows\System\qXiraVM.exe
  2⤵
  PID:7500
- C:\Windows\System\weTsJOU.exe
  C:\Windows\System\weTsJOU.exe
  2⤵
  PID:5988
- C:\Windows\System\ZslKSDa.exe
  C:\Windows\System\ZslKSDa.exe
  2⤵
  PID:10416
- C:\Windows\System\PaeiNPH.exe
  C:\Windows\System\PaeiNPH.exe
  2⤵
  PID:10040
- C:\Windows\System\cYIAZNW.exe
  C:\Windows\System\cYIAZNW.exe
  2⤵
  PID:9672
- C:\Windows\System\fWYMdOP.exe
  C:\Windows\System\fWYMdOP.exe
  2⤵
  PID:8080
- C:\Windows\System\MGmfDBk.exe
  C:\Windows\System\MGmfDBk.exe
  2⤵
  PID:9124
- C:\Windows\System\DwyrKIF.exe
  C:\Windows\System\DwyrKIF.exe
  2⤵
  PID:5468
- C:\Windows\System\fFROthV.exe
  C:\Windows\System\fFROthV.exe
  2⤵
  PID:5600
- C:\Windows\System\fAiiePf.exe
  C:\Windows\System\fAiiePf.exe
  2⤵
  PID:9284
- C:\Windows\System\PjpLiCs.exe
  C:\Windows\System\PjpLiCs.exe
  2⤵
  PID:9336
- C:\Windows\System\RGERjYh.exe
  C:\Windows\System\RGERjYh.exe
  2⤵
  PID:9396
- C:\Windows\System\ICnVFlG.exe
  C:\Windows\System\ICnVFlG.exe
  2⤵
  PID:9476
- C:\Windows\System\cRwHtsN.exe
  C:\Windows\System\cRwHtsN.exe
  2⤵
  PID:9520
- C:\Windows\System\qBRVpCd.exe
  C:\Windows\System\qBRVpCd.exe
  2⤵
  PID:9612
- C:\Windows\System\bhYGMXK.exe
  C:\Windows\System\bhYGMXK.exe
  2⤵
  PID:10956
- C:\Windows\System\WCOpBHd.exe
  C:\Windows\System\WCOpBHd.exe
  2⤵
  PID:10972
- C:\Windows\System\qgMDEPP.exe
  C:\Windows\System\qgMDEPP.exe
  2⤵
  PID:9792
- C:\Windows\System\ITNLlpN.exe
  C:\Windows\System\ITNLlpN.exe
  2⤵
  PID:11004
- C:\Windows\System\VcjgziP.exe
  C:\Windows\System\VcjgziP.exe
  2⤵
  PID:11288
- C:\Windows\System\RBUGMPP.exe
  C:\Windows\System\RBUGMPP.exe
  2⤵
  PID:11316
- C:\Windows\System\zKolFyd.exe
  C:\Windows\System\zKolFyd.exe
  2⤵
  PID:11348
- C:\Windows\System\PSosMgk.exe
  C:\Windows\System\PSosMgk.exe
  2⤵
  PID:11368
- C:\Windows\System\xfhpibu.exe
  C:\Windows\System\xfhpibu.exe
  2⤵
  PID:11388
- C:\Windows\System\YxjDOFo.exe
  C:\Windows\System\YxjDOFo.exe
  2⤵
  PID:11416
- C:\Windows\System\jAdggNt.exe
  C:\Windows\System\jAdggNt.exe
  2⤵
  PID:11440
- C:\Windows\System\lTlSgJl.exe
  C:\Windows\System\lTlSgJl.exe
  2⤵
  PID:11468
- C:\Windows\System\fUYFIAM.exe
  C:\Windows\System\fUYFIAM.exe
  2⤵
  PID:11496
- C:\Windows\System\znRWEoP.exe
  C:\Windows\System\znRWEoP.exe
  2⤵
  PID:11512
- C:\Windows\System\XJJbQuM.exe
  C:\Windows\System\XJJbQuM.exe
  2⤵
  PID:11536
- C:\Windows\System\VdCkGHs.exe
  C:\Windows\System\VdCkGHs.exe
  2⤵
  PID:11564
- C:\Windows\System\soLDfjA.exe
  C:\Windows\System\soLDfjA.exe
  2⤵
  PID:11588
- C:\Windows\System\UtjjshE.exe
  C:\Windows\System\UtjjshE.exe
  2⤵
  PID:11612
- C:\Windows\System\lKDehxT.exe
  C:\Windows\System\lKDehxT.exe
  2⤵
  PID:11628
- C:\Windows\System\bzqvaVw.exe
  C:\Windows\System\bzqvaVw.exe
  2⤵
  PID:11656
- C:\Windows\System\soNuBEk.exe
  C:\Windows\System\soNuBEk.exe
  2⤵
  PID:11676
- C:\Windows\System\hFxrJCv.exe
  C:\Windows\System\hFxrJCv.exe
  2⤵
  PID:11704
- C:\Windows\System\EUQuNaw.exe
  C:\Windows\System\EUQuNaw.exe
  2⤵
  PID:11724
- C:\Windows\System\CBtfRFZ.exe
  C:\Windows\System\CBtfRFZ.exe
  2⤵
  PID:11740
- C:\Windows\System\KaUGHOI.exe
  C:\Windows\System\KaUGHOI.exe
  2⤵
  PID:11764
- C:\Windows\System\GPYjzYO.exe
  C:\Windows\System\GPYjzYO.exe
  2⤵
  PID:11788
- C:\Windows\System\HKHiAhs.exe
  C:\Windows\System\HKHiAhs.exe
  2⤵
  PID:11804
- C:\Windows\System\aWBRGuW.exe
  C:\Windows\System\aWBRGuW.exe
  2⤵
  PID:11824
- C:\Windows\System\UVIXYWl.exe
  C:\Windows\System\UVIXYWl.exe
  2⤵
  PID:11840
- C:\Windows\System\zbtCHvC.exe
  C:\Windows\System\zbtCHvC.exe
  2⤵
  PID:11856
- C:\Windows\System\DEBUgnq.exe
  C:\Windows\System\DEBUgnq.exe
  2⤵
  PID:11876
- C:\Windows\System\UFRVcqB.exe
  C:\Windows\System\UFRVcqB.exe
  2⤵
  PID:11892
- C:\Windows\System\skXgKvu.exe
  C:\Windows\System\skXgKvu.exe
  2⤵
  PID:11912
- C:\Windows\System\TStEJIJ.exe
  C:\Windows\System\TStEJIJ.exe
  2⤵
  PID:11932
- C:\Windows\System\OIDCiwg.exe
  C:\Windows\System\OIDCiwg.exe
  2⤵
  PID:11952
- C:\Windows\System\KjGikKh.exe
  C:\Windows\System\KjGikKh.exe
  2⤵
  PID:11976
- C:\Windows\System\KpSWEEs.exe
  C:\Windows\System\KpSWEEs.exe
  2⤵
  PID:11992
- C:\Windows\System\oLkfVTs.exe
  C:\Windows\System\oLkfVTs.exe
  2⤵
  PID:12024
- C:\Windows\System\UWSjLGC.exe
  C:\Windows\System\UWSjLGC.exe
  2⤵
  PID:12064
- C:\Windows\System\lhnPZey.exe
  C:\Windows\System\lhnPZey.exe
  2⤵
  PID:12084
- C:\Windows\System\zyrNdwi.exe
  C:\Windows\System\zyrNdwi.exe
  2⤵
  PID:12108
- C:\Windows\System\eoHJExT.exe
  C:\Windows\System\eoHJExT.exe
  2⤵
  PID:12132
- C:\Windows\System\QLchXOF.exe
  C:\Windows\System\QLchXOF.exe
  2⤵
  PID:12152
- C:\Windows\System\QmfNTza.exe
  C:\Windows\System\QmfNTza.exe
  2⤵
  PID:12176
- C:\Windows\System\AONgCmv.exe
  C:\Windows\System\AONgCmv.exe
  2⤵
  PID:12204
- C:\Windows\System\pJbDYMI.exe
  C:\Windows\System\pJbDYMI.exe
  2⤵
  PID:12224
- C:\Windows\System\OdtTqcO.exe
  C:\Windows\System\OdtTqcO.exe
  2⤵
  PID:12244
- C:\Windows\System\qXlgMLM.exe
  C:\Windows\System\qXlgMLM.exe
  2⤵
  PID:12272
- C:\Windows\System\nthHifd.exe
  C:\Windows\System\nthHifd.exe
  2⤵
  PID:5028
- C:\Windows\System\BsxQtXc.exe
  C:\Windows\System\BsxQtXc.exe
  2⤵
  PID:9940
- C:\Windows\System\QgbOKlR.exe
  C:\Windows\System\QgbOKlR.exe
  2⤵
  PID:10568
- C:\Windows\System\zyTuaZE.exe
  C:\Windows\System\zyTuaZE.exe
  2⤵
  PID:10072
- C:\Windows\System\sPGNxvk.exe
  C:\Windows\System\sPGNxvk.exe
  2⤵
  PID:10176
- C:\Windows\System\LtJXsTS.exe
  C:\Windows\System\LtJXsTS.exe
  2⤵
  PID:7836
- C:\Windows\System\BEpGzma.exe
  C:\Windows\System\BEpGzma.exe
  2⤵
  PID:10196
- C:\Windows\System\TAaFcEB.exe
  C:\Windows\System\TAaFcEB.exe
  2⤵
  PID:8980
- C:\Windows\System\CEteqwh.exe
  C:\Windows\System\CEteqwh.exe
  2⤵
  PID:9136
- C:\Windows\System\mhVabCY.exe
  C:\Windows\System\mhVabCY.exe
  2⤵
  PID:7020
- C:\Windows\System\HbZFFCJ.exe
  C:\Windows\System\HbZFFCJ.exe
  2⤵
  PID:8044
- C:\Windows\System\JBlxZSO.exe
  C:\Windows\System\JBlxZSO.exe
  2⤵
  PID:5100
- C:\Windows\System\CkBiKsc.exe
  C:\Windows\System\CkBiKsc.exe
  2⤵
  PID:8784
- C:\Windows\System\RdhhJnM.exe
  C:\Windows\System\RdhhJnM.exe
  2⤵
  PID:8876
- C:\Windows\System\SBFkVJZ.exe
  C:\Windows\System\SBFkVJZ.exe
  2⤵
  PID:9008
- C:\Windows\System\vgkdPhf.exe
  C:\Windows\System\vgkdPhf.exe
  2⤵
  PID:7584
- C:\Windows\System\bCUGlyf.exe
  C:\Windows\System\bCUGlyf.exe
  2⤵
  PID:12308
- C:\Windows\System\qogkfsn.exe
  C:\Windows\System\qogkfsn.exe
  2⤵
  PID:12332
- C:\Windows\System\yPRRjZh.exe
  C:\Windows\System\yPRRjZh.exe
  2⤵
  PID:12356
- C:\Windows\System\weeNhwp.exe
  C:\Windows\System\weeNhwp.exe
  2⤵
  PID:12384
- C:\Windows\System\tJBhkmE.exe
  C:\Windows\System\tJBhkmE.exe
  2⤵
  PID:12408
- C:\Windows\System\voSQLmm.exe
  C:\Windows\System\voSQLmm.exe
  2⤵
  PID:12424
- C:\Windows\System\XBYqGIq.exe
  C:\Windows\System\XBYqGIq.exe
  2⤵
  PID:12448
- C:\Windows\System\YexpVzd.exe
  C:\Windows\System\YexpVzd.exe
  2⤵
  PID:12468
- C:\Windows\System\MJiIRiy.exe
  C:\Windows\System\MJiIRiy.exe
  2⤵
  PID:12492
- C:\Windows\System\yAoIkpV.exe
  C:\Windows\System\yAoIkpV.exe
  2⤵
  PID:12512
- C:\Windows\System\nCOrGkQ.exe
  C:\Windows\System\nCOrGkQ.exe
  2⤵
  PID:12532
- C:\Windows\System\zYLkVMD.exe
  C:\Windows\System\zYLkVMD.exe
  2⤵
  PID:12548
- C:\Windows\System\qZFOnTS.exe
  C:\Windows\System\qZFOnTS.exe
  2⤵
  PID:12576
- C:\Windows\System\TFUJKtW.exe
  C:\Windows\System\TFUJKtW.exe
  2⤵
  PID:12600
- C:\Windows\System\rFvIVOL.exe
  C:\Windows\System\rFvIVOL.exe
  2⤵
  PID:12620
- C:\Windows\System\HppCkEs.exe
  C:\Windows\System\HppCkEs.exe
  2⤵
  PID:12648
- C:\Windows\System\fHzBgAQ.exe
  C:\Windows\System\fHzBgAQ.exe
  2⤵
  PID:12668
- C:\Windows\System\LXOXnSd.exe
  C:\Windows\System\LXOXnSd.exe
  2⤵
  PID:12684
- C:\Windows\System\aikZErr.exe
  C:\Windows\System\aikZErr.exe
  2⤵
  PID:12700
- C:\Windows\System\iLxYLbs.exe
  C:\Windows\System\iLxYLbs.exe
  2⤵
  PID:12716
- C:\Windows\System\tjJyivS.exe
  C:\Windows\System\tjJyivS.exe
  2⤵
  PID:12736
- C:\Windows\System\CmNNUhT.exe
  C:\Windows\System\CmNNUhT.exe
  2⤵
  PID:12752
- C:\Windows\System\qwxkPkk.exe
  C:\Windows\System\qwxkPkk.exe
  2⤵
  PID:12768
- C:\Windows\System\nCMalAy.exe
  C:\Windows\System\nCMalAy.exe
  2⤵
  PID:12788
- C:\Windows\System\iFwjJmi.exe
  C:\Windows\System\iFwjJmi.exe
  2⤵
  PID:12804
- C:\Windows\System\PKCxbpQ.exe
  C:\Windows\System\PKCxbpQ.exe
  2⤵
  PID:12820
- C:\Windows\System\leYfTyW.exe
  C:\Windows\System\leYfTyW.exe
  2⤵
  PID:12840
- C:\Windows\System\qMlWvLD.exe
  C:\Windows\System\qMlWvLD.exe
  2⤵
  PID:12864
- C:\Windows\System\jicORXL.exe
  C:\Windows\System\jicORXL.exe
  2⤵
  PID:12888
- C:\Windows\System\xtZHRdu.exe
  C:\Windows\System\xtZHRdu.exe
  2⤵
  PID:12912
- C:\Windows\System\qEMfKVS.exe
  C:\Windows\System\qEMfKVS.exe
  2⤵
  PID:12940
- C:\Windows\System\hBccLkw.exe
  C:\Windows\System\hBccLkw.exe
  2⤵
  PID:12960
- C:\Windows\System\aGFvSIf.exe
  C:\Windows\System\aGFvSIf.exe
  2⤵
  PID:12984
- C:\Windows\System\LNXYkzQ.exe
  C:\Windows\System\LNXYkzQ.exe
  2⤵
  PID:13004
- C:\Windows\System\uaCEmxc.exe
  C:\Windows\System\uaCEmxc.exe
  2⤵
  PID:13028
- C:\Windows\System\ioFYVxD.exe
  C:\Windows\System\ioFYVxD.exe
  2⤵
  PID:13052
- C:\Windows\System\evMPmQW.exe
  C:\Windows\System\evMPmQW.exe
  2⤵
  PID:13072
- C:\Windows\System\wyNMYIv.exe
  C:\Windows\System\wyNMYIv.exe
  2⤵
  PID:13096
- C:\Windows\System\jjqsVOc.exe
  C:\Windows\System\jjqsVOc.exe
  2⤵
  PID:13116
- C:\Windows\System\XQBmlxt.exe
  C:\Windows\System\XQBmlxt.exe
  2⤵
  PID:13136
- C:\Windows\System\aSxZRKM.exe
  C:\Windows\System\aSxZRKM.exe
  2⤵
  PID:13160
- C:\Windows\System\MKesxVI.exe
  C:\Windows\System\MKesxVI.exe
  2⤵
  PID:13176
- C:\Windows\System\LJUfxSw.exe
  C:\Windows\System\LJUfxSw.exe
  2⤵
  PID:13192
- C:\Windows\System\BrlTogR.exe
  C:\Windows\System\BrlTogR.exe
  2⤵
  PID:13216
- C:\Windows\System\wawToSv.exe
  C:\Windows\System\wawToSv.exe
  2⤵
  PID:13232
- C:\Windows\System\hEQEPoE.exe
  C:\Windows\System\hEQEPoE.exe
  2⤵
  PID:13252
- C:\Windows\System\LoFCdVE.exe
  C:\Windows\System\LoFCdVE.exe
  2⤵
  PID:13276
- C:\Windows\System\nwYGmrt.exe
  C:\Windows\System\nwYGmrt.exe
  2⤵
  PID:13296
- C:\Windows\System\wEIMfGN.exe
  C:\Windows\System\wEIMfGN.exe
  2⤵
  PID:10948
- C:\Windows\System\QbFgQrv.exe
  C:\Windows\System\QbFgQrv.exe
  2⤵
  PID:9492
- C:\Windows\System\OVRaCzf.exe
  C:\Windows\System\OVRaCzf.exe
  2⤵
  PID:9704
- C:\Windows\System\DBDUdGW.exe
  C:\Windows\System\DBDUdGW.exe
  2⤵
  PID:9596
- C:\Windows\System\dfzZeJs.exe
  C:\Windows\System\dfzZeJs.exe
  2⤵
  PID:9828
- C:\Windows\System\HrMkLnC.exe
  C:\Windows\System\HrMkLnC.exe
  2⤵
  PID:11324
- C:\Windows\System\fAbPSnX.exe
  C:\Windows\System\fAbPSnX.exe
  2⤵
  PID:10336
- C:\Windows\System\ucrpOlW.exe
  C:\Windows\System\ucrpOlW.exe
  2⤵
  PID:11344
- C:\Windows\System\uJGwmfF.exe
  C:\Windows\System\uJGwmfF.exe
  2⤵
  PID:10392
- C:\Windows\System\swQqAXB.exe
  C:\Windows\System\swQqAXB.exe
  2⤵
  PID:12708
- C:\Windows\System\ILgAuIr.exe
  C:\Windows\System\ILgAuIr.exe
  2⤵
  PID:12456
- C:\Windows\System\FdtWePj.exe
  C:\Windows\System\FdtWePj.exe
  2⤵
  PID:12504
- C:\Windows\System\iVRTfPX.exe
  C:\Windows\System\iVRTfPX.exe
  2⤵
  PID:12640
- C:\Windows\System\PGFhSPc.exe
  C:\Windows\System\PGFhSPc.exe
  2⤵
  PID:12848
- C:\Windows\System\IkHodkB.exe
  C:\Windows\System\IkHodkB.exe
  2⤵
  PID:12976
- C:\Windows\System\kHXYHgK.exe
  C:\Windows\System\kHXYHgK.exe
  2⤵
  PID:13152
- C:\Windows\System\HbTJykW.exe
  C:\Windows\System\HbTJykW.exe
  2⤵
  PID:13260
- C:\Windows\System\qySncYP.exe
  C:\Windows\System\qySncYP.exe
  2⤵
  PID:11020
- C:\Windows\System\KVToaGF.exe
  C:\Windows\System\KVToaGF.exe
  2⤵
  PID:11752
- C:\Windows\System\NeKcsjC.exe
  C:\Windows\System\NeKcsjC.exe
  2⤵
  PID:11888
- C:\Windows\System\KGHSIMZ.exe
  C:\Windows\System\KGHSIMZ.exe
  2⤵
  PID:7392
- C:\Windows\System\CKEhuFV.exe
  C:\Windows\System\CKEhuFV.exe
  2⤵
  PID:3940
- C:\Windows\System\IrEexKZ.exe
  C:\Windows\System\IrEexKZ.exe
  2⤵
  PID:10808
- C:\Windows\System\xcTnSJo.exe
  C:\Windows\System\xcTnSJo.exe
  2⤵
  PID:10892
- C:\Windows\System\YjXyIVn.exe
  C:\Windows\System\YjXyIVn.exe
  2⤵
  PID:11280
- C:\Windows\System\wGaNrDl.exe
  C:\Windows\System\wGaNrDl.exe
  2⤵
  PID:2964
- C:\Windows\System\eYdHpWs.exe
  C:\Windows\System\eYdHpWs.exe
  2⤵
  PID:11092
- C:\Windows\System\wtAiXKt.exe
  C:\Windows\System\wtAiXKt.exe
  2⤵
  PID:8832
- C:\Windows\System\Trhyhzq.exe
  C:\Windows\System\Trhyhzq.exe
  2⤵
  PID:8668
- C:\Windows\System\UzYEixO.exe
  C:\Windows\System\UzYEixO.exe
  2⤵
  PID:12776
- C:\Windows\System\CiBaDHv.exe
  C:\Windows\System\CiBaDHv.exe
  2⤵
  PID:12724
- C:\Windows\System\kOzbVBh.exe
  C:\Windows\System\kOzbVBh.exe
  2⤵
  PID:10564
- C:\Windows\System\IOWGmpI.exe
  C:\Windows\System\IOWGmpI.exe
  2⤵
  PID:10064
- C:\Windows\System\yPHDhAP.exe
  C:\Windows\System\yPHDhAP.exe
  2⤵
  PID:11192
- C:\Windows\System\SiEAYWd.exe
  C:\Windows\System\SiEAYWd.exe
  2⤵
  PID:11380
- C:\Windows\System\mreyySV.exe
  C:\Windows\System\mreyySV.exe
  2⤵
  PID:8740
- C:\Windows\System\FaZLzMd.exe
  C:\Windows\System\FaZLzMd.exe
  2⤵
  PID:11904
- C:\Windows\System\DnjdaqT.exe
  C:\Windows\System\DnjdaqT.exe
  2⤵
  PID:10868
- C:\Windows\System\OuEZLcN.exe
  C:\Windows\System\OuEZLcN.exe
  2⤵
  PID:2776
- C:\Windows\System\UNbZVDw.exe
  C:\Windows\System\UNbZVDw.exe
  2⤵
  PID:7932
- C:\Windows\System\igSfCsh.exe
  C:\Windows\System\igSfCsh.exe
  2⤵
  PID:3512
- C:\Windows\System\YreXcuM.exe
  C:\Windows\System\YreXcuM.exe
  2⤵
  PID:1472
- C:\Windows\System\zhTfQrS.exe
  C:\Windows\System\zhTfQrS.exe
  2⤵
  PID:3280
- C:\Windows\System\PBKjtLW.exe
  C:\Windows\System\PBKjtLW.exe
  2⤵
  PID:12076
- C:\Windows\System\inmTqvX.exe
  C:\Windows\System\inmTqvX.exe
  2⤵
  PID:11920
- C:\Windows\System\nyEBQRL.exe
  C:\Windows\System\nyEBQRL.exe
  2⤵
  PID:7412
- C:\Windows\System\uzRCutY.exe
  C:\Windows\System\uzRCutY.exe
  2⤵
  PID:1668
- C:\Windows\System\cAHZbXB.exe
  C:\Windows\System\cAHZbXB.exe
  2⤵
  PID:11668
- C:\Windows\System\fbwSVXf.exe
  C:\Windows\System\fbwSVXf.exe
  2⤵
  PID:12436
- C:\Windows\System\nDlZkVI.exe
  C:\Windows\System\nDlZkVI.exe
  2⤵
  PID:12568
- C:\Windows\System\pjCIbJv.exe
  C:\Windows\System\pjCIbJv.exe
  2⤵
  PID:2960
- C:\Windows\System\zzGkKnq.exe
  C:\Windows\System\zzGkKnq.exe
  2⤵
  PID:11528
- C:\Windows\System\wZtleCT.exe
  C:\Windows\System\wZtleCT.exe
  2⤵
  PID:12252
- C:\Windows\System\RMTCxMW.exe
  C:\Windows\System\RMTCxMW.exe
  2⤵
  PID:12680
- C:\Windows\System\DtlQJXA.exe
  C:\Windows\System\DtlQJXA.exe
  2⤵
  PID:11812
- C:\Windows\System\CvNzcRT.exe
  C:\Windows\System\CvNzcRT.exe
  2⤵
  PID:4064
- C:\Windows\System\GKJodQJ.exe
  C:\Windows\System\GKJodQJ.exe
  2⤵
  PID:4780
- C:\Windows\System\aZCghhF.exe
  C:\Windows\System\aZCghhF.exe
  2⤵
  PID:9592
- C:\Windows\System\mwJbpuC.exe
  C:\Windows\System\mwJbpuC.exe
  2⤵
  PID:2892
- C:\Windows\System\SnBivkv.exe
  C:\Windows\System\SnBivkv.exe
  2⤵
  PID:4416
- C:\Windows\System\OaAcYJA.exe
  C:\Windows\System\OaAcYJA.exe
  2⤵
  PID:4724
- C:\Windows\System\rKijnnQ.exe
  C:\Windows\System\rKijnnQ.exe
  2⤵
  PID:3384
- C:\Windows\System\jNCKfBn.exe
  C:\Windows\System\jNCKfBn.exe
  2⤵
  PID:3368
- C:\Windows\System\BnQdIka.exe
  C:\Windows\System\BnQdIka.exe
  2⤵
  PID:9168
- C:\Windows\System\RpHVbQM.exe
  C:\Windows\System\RpHVbQM.exe
  2⤵
  PID:388
- C:\Windows\System\ZJcXMZH.exe
  C:\Windows\System\ZJcXMZH.exe
  2⤵
  PID:8908
- C:\Windows\System\lNXZVUm.exe
  C:\Windows\System\lNXZVUm.exe
  2⤵
  PID:684
- C:\Windows\System\UEngPos.exe
  C:\Windows\System\UEngPos.exe
  2⤵
  PID:3588
- C:\Windows\System\pfGnFfq.exe
  C:\Windows\System\pfGnFfq.exe
  2⤵
  PID:2656
- C:\Windows\System\UCcOthp.exe
  C:\Windows\System\UCcOthp.exe
  2⤵
  PID:1444
- C:\Windows\System\zEQQIEe.exe
  C:\Windows\System\zEQQIEe.exe
  2⤵
  PID:4288
- C:\Windows\System\hVZepGm.exe
  C:\Windows\System\hVZepGm.exe
  2⤵
  PID:12400
- C:\Windows\System\oQnnEer.exe
  C:\Windows\System\oQnnEer.exe
  2⤵
  PID:10212
- C:\Windows\System\CKSTlaG.exe
  C:\Windows\System\CKSTlaG.exe
  2⤵
  PID:5548
- C:\Windows\System\bWWcylT.exe
  C:\Windows\System\bWWcylT.exe
  2⤵
  PID:12172
- C:\Windows\System\LQwrNmE.exe
  C:\Windows\System\LQwrNmE.exe
  2⤵
  PID:3612
- C:\Windows\System\GyIapvk.exe
  C:\Windows\System\GyIapvk.exe
  2⤵
  PID:8176
- C:\Windows\System\eyNaSFN.exe
  C:\Windows\System\eyNaSFN.exe
  2⤵
  PID:9576
- C:\Windows\System\ktWLBOg.exe
  C:\Windows\System\ktWLBOg.exe
  2⤵
  PID:2448
- C:\Windows\System\SonvkrZ.exe
  C:\Windows\System\SonvkrZ.exe
  2⤵
  PID:11012
- C:\Windows\System\LLdIdnZ.exe
  C:\Windows\System\LLdIdnZ.exe
  2⤵
  PID:11236
- C:\Windows\System\qNkMeXi.exe
  C:\Windows\System\qNkMeXi.exe
  2⤵
  PID:704
- C:\Windows\System\fwAehtj.exe
  C:\Windows\System\fwAehtj.exe
  2⤵
  PID:1604
- C:\Windows\System\MSLhdYc.exe
  C:\Windows\System\MSLhdYc.exe
  2⤵
  PID:4788
- C:\Windows\System\sypXbCW.exe
  C:\Windows\System\sypXbCW.exe
  2⤵
  PID:13128
- C:\Windows\System\ebkkFqw.exe
  C:\Windows\System\ebkkFqw.exe
  2⤵
  PID:13392
- C:\Windows\System\tyIcCuh.exe
  C:\Windows\System\tyIcCuh.exe
  2⤵
  PID:13412
- C:\Windows\System\dSrolHk.exe
  C:\Windows\System\dSrolHk.exe
  2⤵
  PID:13612
- C:\Windows\System\vEyVAKf.exe
  C:\Windows\System\vEyVAKf.exe
  2⤵
  PID:13672
- C:\Windows\System\ajJMFFA.exe
  C:\Windows\System\ajJMFFA.exe
  2⤵
  PID:13688
- C:\Windows\System\WRctcQp.exe
  C:\Windows\System\WRctcQp.exe
  2⤵
  PID:13704
- C:\Windows\System\qLmgiBQ.exe
  C:\Windows\System\qLmgiBQ.exe
  2⤵
  PID:13724
- C:\Windows\System\QvzGixt.exe
  C:\Windows\System\QvzGixt.exe
  2⤵
  PID:13748
- C:\Windows\System\ODcJbQK.exe
  C:\Windows\System\ODcJbQK.exe
  2⤵
  PID:13964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4h0t2j5e.cys.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BNNBbrZ.exe

Filesize
1.9MB

MD5
f0b4f808c9ddab450ba347370e5ab86b

SHA1
740a2f2deceded6112365dd92094d0fe356a19db

SHA256
13b62545c43f3f7ad1f331c43c4d00706cba92171ac93d04f95faa2d160bf957

SHA512
be59b0d79f3ba00967595ba2b9c2c430581441dd242ecd0012421ae1824edb5b3827eb393ef773b0fdf921b4e55e9ac22d895dba176a3cf767b95e2169cff9ee

Download Submit
C:\Windows\System\BdhQvGx.exe

Filesize
1.9MB

MD5
eba4821ed8329585eee02445e6c1adb0

SHA1
a75866bddfcb38c63232d332872ea39b21ad5e11

SHA256
9867ed63e319b8a84b49456feaf4e7c56479f3bb977ed05d428fb9439dc6dcfc

SHA512
4547a6ec46c05117ec6c7192dc2c619efb2af2b888032a88c05074a79bc6355f252e66e1d2ffd56c13f417b105ca461dd519510875fdd15b76e3db6b203dc525

Download Submit
C:\Windows\System\CsiZtBr.exe

Filesize
1.9MB

MD5
c284e392102d5686f26517aa8075fdb9

SHA1
d2cbbec36c4fc2005fcd48afb6b1e89d085cebfe

SHA256
fdf397a21125cad67cb5ee247265613290bc698d5a33ef4d6e7a57c4dea6e703

SHA512
2378732434bdfbeae548e977319671ead86fed59e72b3014bc965751a8f53668b1315fcbe72583ee03d8c6c0ed8556add5b71ad258330d10218314c40b77d595

Download Submit
C:\Windows\System\DBnSldT.exe

Filesize
1.9MB

MD5
66163d13c709e7c332d079990bfa8c31

SHA1
28ea22c8d81f4d40d323e97fccc676df5d74bdd6

SHA256
7dcdde08480b9d6e9b4ff5785a892b6f1973a85c5c1e2f4aae0ab7520653b5e8

SHA512
61b028b94900f04a6614a71ecaac4948abcb164be66d8fb69b7154878a3a42a4f8a799044c50338537a384279131f7499957a293ef011504e9cddbe2a1e615f9

Download Submit
C:\Windows\System\ENnAoKG.exe

Filesize
1.9MB

MD5
f5e4cd6615018ea6ebf2c3d0b9a4268a

SHA1
e075e3aec91f39085458652ff603078872a5d768

SHA256
7d55a709b3b101f1732790dea7838d319154e880c4ee12ecbc9703dd2ab55a3f

SHA512
a17f6e9b9356928705c10452e5d66bf3a70f5b475a0551f2078135ab482aae624c970b83b0aab2cf123e2d8e5af62bd4fa6a08661dcc96ea6a0cf18c0b1a0f5e

Download Submit
C:\Windows\System\HcKFhDT.exe

Filesize
1.9MB

MD5
0039014845919b7c293211a740bad021

SHA1
f7ff9b3cccf006b3607986dc3f8ec732c24af037

SHA256
8d247a66b958e951fb9d50696797e6ee52b7184ff6d8bd931b541d9ba73107d6

SHA512
277bf267da70f6700761f0226abfdec199f9895e3f3a13f84fe5993aeb7008e79d72b42c2757f471a078c32b7108501ba7b2386f8be234e3efb9feb7a2855533

Download Submit
C:\Windows\System\HvkFuej.exe

Filesize
1.9MB

MD5
904365d7ade32d2dbc889ca398da5a0f

SHA1
7ed9f593487885f49d30bbb0235ea0a983f881b0

SHA256
f5350ae97f88e8f83010cd09d896e6e127bb7f22e2a5cc338d4fdcb873fca3b6

SHA512
8fa68c6b3f56ef59859c25e9eebdc966bb804515fea536b91c69d96efde4bbdb62a2ec25287a7bd79796e0135162ab54984c7d2d182dca0b982cd0ee34729ce2

Download Submit
C:\Windows\System\IdyppPB.exe

Filesize
1.9MB

MD5
25a50be0a350d39633f29d8d7fa68af8

SHA1
32de540e29ce554889dcfb66a79282a8d8c55607

SHA256
dc8cb314a045e9dbabf54d2a10bb3a9f6469a8b651afc75b6b2db4cbc746626d

SHA512
91b2b9b55bf065d42f58f638f3872948f7df153418b7bb8b611e1879a4df1aca380f5177136e3c1c392a9634eb29f0a1ab3d6d257b367c8c47742e4621dd76d8

Download Submit
C:\Windows\System\JSkXEtV.exe

Filesize
1.9MB

MD5
348fb7894e30982c14f4b0fc55718161

SHA1
0090f064cf7b8a7de84101a553f5034ba9ba9f41

SHA256
ae0df2898572909359cd25e15594799425b4a360f1f99be2fa9513fd9e541424

SHA512
81e6476099bf59130ab749a71b01116c3ce61a67f92d09ce3262401871d7d13851d74e577d11052ba3c8788f12ac537989dc9cf55f5b23fbdde9ecea0a20098e

Download Submit
C:\Windows\System\LgXclNs.exe

Filesize
1.9MB

MD5
6372813ef1ef46cc8d369f4752c16717

SHA1
dc9556f5cf9815cb3e69d507499c1ed44094ef23

SHA256
7033f9f0c4d8ea556f4432fb91fdf31e2ff38514eaca8a419f39b9f6ed533a09

SHA512
a8dc686dc13ca6051d59dc9dedc72b69513aada0caef0b77b9fc157222104096e119fb2aacb7dfa626316061af063a8d9ffcdf5f2fda2a6d9f76722a095379df

Download Submit
C:\Windows\System\NbxiRuE.exe

Filesize
1.9MB

MD5
1855fbbc35d37a8fe2aac2226fa1891f

SHA1
56c0c5356ad91f0f64dbca25616bb0177437ca73

SHA256
e9e69647c7772a01434032b058bd92cf4edefc26fb62af36f6a50486ef014d04

SHA512
e529e6e2ff6bfa37a734bbb01e67c6d56fd6e4eeee2ea915da91a2ad57e356323fce24b8b9b3fefae7cf6b1c9d989795ed9c3a196a372f11231338ea157e1cb6

Download Submit
C:\Windows\System\NkTwEaO.exe

Filesize
1.9MB

MD5
76f1d0da3841ed0709b8eff223d4168a

SHA1
cce465948a11fd6cea038463e3843c758195aca6

SHA256
3f8e24e84ee46d9ef58e02e1952e7328e620a8e8c074f6df2f35855c8c8a685b

SHA512
b34619650c97f1f8316e8c8cdb583c45d8458482fcb665d82c63558112b72c1b03241092e1cc4818b4850c01ae2f90d3d85f708cbefac432d1ec4c643d70a909

Download Submit
C:\Windows\System\PLQtxSU.exe

Filesize
1.9MB

MD5
d3dd1297f188d3dc05adf931f6536c9d

SHA1
925aacaa12d3d40f53b5f1b4156ae6b1edb0973f

SHA256
721b9d9c0c509711b22e2403ac42add7502cac2e41f21c3d65c532a1be08c060

SHA512
661926cb2f4a3c68785cf909b609d2d42fb6ec5458b56cecb71f94c607721dd9ef32203245d560be601d6881a305b820777557ef4f82775b12e572e7870177c4

Download Submit
C:\Windows\System\SNTpQVN.exe

Filesize
1.9MB

MD5
4eff16fd48f736cd9e396d2fd3b2af4c

SHA1
46ac58cb49eab1508dc4f30f39c2699b7e183ed0

SHA256
0774362a15b8aaa8927e1eb2c783e750291e44690facfacdada732bfe09ae777

SHA512
f802b8622d33024be31eccef8dec08975fc346d41dc62a9c0b037fc220e57e2721d3bcaa54403ed83728087fd59f4fe1c9562303cfbdff48baacdb67913f07e7

Download Submit
C:\Windows\System\SeLWuOM.exe

Filesize
1.9MB

MD5
1b9b3918e24c931f883150a7c332aedd

SHA1
eb40df1e6a91fa604648bb4f37a2f412295b6adc

SHA256
ddca35538159865abaadca6b518909427e83520f63faacaec2487d03ec99cadb

SHA512
0fcba79763927229329d045a741513506e57565a27c1d1cdfd5b0cce3cc177575171f5ac79b9434fcade680fdc70855a37d16d4330888f4e9058dc6e21ff83fd

Download Submit
C:\Windows\System\SlGBrKD.exe

Filesize
1.9MB

MD5
1da357c8d6dedf8b7535696f44ea2797

SHA1
a6cfec540d78654283f52199be1a58f2543e29ac

SHA256
eff92ddb4c4efb08aac67a4fedd86ec9f4a818c772340ffef598752307dfdd06

SHA512
c99d6370a04022945184a27b082731f66dc2540491e1529bd9cf1202c1cfd7ed828f47503c92d1e6d433a044ec441b3589740d94276c6f652c3b6823917167c9

Download Submit
C:\Windows\System\TKOtIGV.exe

Filesize
1.9MB

MD5
f321c1837c60a744fa1b175233b6a757

SHA1
6a96a1e431fc320c62eb0f08e72654f8152e56f5

SHA256
07cea85d720a4bcc104fcc7f938ba771bc22d894f254bbb49fe2fd30e04fae59

SHA512
3cd92bd824a113e8ef7b50bac3ad92fd479bc1b14a668a3c093dd9e3095345ff9c687643c25538b25663c333cbca27d671a0c24b6362190d86609c0f58a7e370

Download Submit
C:\Windows\System\TjQBQNG.exe

Filesize
1.9MB

MD5
4aae67d0f8db3cfb83720449bb722303

SHA1
cb37a542d04025430367bf2d7560edf3a4e0520e

SHA256
5f45d381268245e99e576ff6f48c92120bb0edbbb32d44cf1e78ab628fb1fa17

SHA512
2914e5fbab1512db96fc32d110b2bc43c1d0476bacf448cb4629b35f98046db4429a016fbebd1e8c54b35e1659b3fada5af0a900941826ea66ac705d177ed579

Download Submit
C:\Windows\System\UAJlfck.exe

Filesize
8B

MD5
a8f2921c80c15a3d426e5fdff8a56196

SHA1
4dc21bf95e22427a9dafcd4930e81b62e77d5fda

SHA256
7e9bbeeba45dae16f8c444596ee4180d7313e899e46fa6263fde6904f32d92a1

SHA512
996666f646b1878ee129a778184f9520541ee458797b8bfaefed6e1f152a5436e0ff19d28744463b706ffe3e24e429f5af102aa1e7733dbeeb6210754c828802

Download Submit
C:\Windows\System\UNHdWDc.exe

Filesize
1.9MB

MD5
ff9d302e96d25627233d56bf814b940c

SHA1
44bc35dc50e54a6d1be3deea4d0a712cda3dd87b

SHA256
e0ef8f0836ebb365af1e31d7980de2e81e9ccb8474b40f45fe0d46b254f4d41a

SHA512
9b465cb9e5b4ee0d2fc167efa184c277ae2343e99d252f491555720cf133a4065e8b3f9aba58ac5573670b1a60685c44601e9441aa44ab819028f790fe5f3dbe

Download Submit
C:\Windows\System\VnkqWvd.exe

Filesize
1.9MB

MD5
008a7e3577b42a7ca7eb3d04b13fd739

SHA1
175acc1c0ee5e21bc806e6174fab82ebcc67ac0c

SHA256
8464e0650000ceca99d77eaebef9fa70838f30c102ae771bea14fab26005c508

SHA512
9fa7858f75f58f93dc59180dbecfe8bf6160bc11181babbe6e6b4350880d2447baaf615778a14dc2d199875e9ca8f1790e23a07ca856c3bd5b91376af71521aa

Download Submit
C:\Windows\System\YBJRKXS.exe

Filesize
1.9MB

MD5
c8785297bfd4968af9ec5cf949a042bb

SHA1
a47a3c7e12653f168b04a3a516af5602657f71a9

SHA256
9884c89bf9c481c0a651e7f9abd3de0129006b9dd1dcb01585307f400eaeec47

SHA512
2b776c58948230f3871fa4e5e0c2346cfb1f937caa5faf9294fed0ede2fa96af594b9e8aff10792bf5c385006a3562d6b0bced3aa6ed645177087ad28fe32391

Download Submit
C:\Windows\System\cntutYv.exe

Filesize
1.9MB

MD5
9e0fcfd1aa7d782d3c71e695c415821c

SHA1
a3bc9aa9b65863f7fdf5b522361c948e5441f671

SHA256
58eec93d43e9cf5cd82933a8492b6c4a842c012dcf660eafdc34f92bc0b78ed3

SHA512
ac52a5ed61151f7a79e1e41c4f5d00a2f6148c0359637037886d619d66e888cf0f6ad1ad145425b903b16a4c53ad3b645d74c523449d74a37c7726374926a216

Download Submit
C:\Windows\System\fzrlBog.exe

Filesize
1.9MB

MD5
e748acb6c938800bf58ed993ecff29f1

SHA1
cca6b7ece0afa43525a022a63792f216cbbc90a7

SHA256
5e6d09d36d91d5a268cc2cf8ea035f38d267326d15f4aca13f46925038d66ade

SHA512
2c03302d86f0025b62af0adb5ebc2592563cded327830c4abe89179fe5e7e80483edc1f6a0571eec3b975cdbc3927aaae17fd76444bb16c3b6468318b75c8d9d

Download Submit
C:\Windows\System\gJmueqs.exe

Filesize
1.9MB

MD5
283df13aa266960a70d843b0217eace9

SHA1
c71dc3f39a1bc6561f3f540cb33de177df63b460

SHA256
0a738328059198c95e23cd2ad0102473a1ec689cf6a78f90cf537bf2cdcb932c

SHA512
5a8c787cca6b1e702a04be17a624fb3de198c41f35239fb8cd03da527e1de0b582b85e4faf6630fb816425d01dc18edb3c7883a3783630807113a1f22fe64c3f

Download Submit
C:\Windows\System\geiSyki.exe

Filesize
1.9MB

MD5
107976cc92b796744c18ace998f02887

SHA1
1d72c748fd8caf425e880984d243fce54e1a03ad

SHA256
4b87b8fff4700d8cf258dad49eb34503a683af5d9a1e807b21afa4ab0497dc64

SHA512
f0c8401130f94834198c37564cbe2e99e10d26fb675a0f35452b6883924b7be1f63611a4cd14a8fd09d1ea3c43fc6724db8d1f18a482872bbdbccfef508ccb34

Download Submit
C:\Windows\System\gxKkkdK.exe

Filesize
1.9MB

MD5
63563c77e462c4b792430481f404794a

SHA1
43784c2d3716bffe877580306fa624c375c3d791

SHA256
875d64789bdc2dd649661d9fec2e6cc857c7bfa99c11993a177c19b1f341307c

SHA512
a4e7729fcad30540d3a07fbf01eb75f4c0ef97c8017c13e6a526ded44379707f014dcf932fb533bb294b76402bff5eeafed5c533a10f3459f7e06ede9a7d7129

Download Submit
C:\Windows\System\iqaorMD.exe

Filesize
1.9MB

MD5
3d55a76c77170522485feff6dc3e4e63

SHA1
99baa8febb935c4a49683aa87e5267cb6b86191e

SHA256
5fe6e0b69098425c406e829e62a7125e33b52e14bfc33200785603953c4f52f6

SHA512
59f475a78e00f0cdc8440ed3b9253f03103413bbb525891348f7384569adb76955efc8abe289293ae44bd09589588586b943258a70d3efdce5edf75956256bb1

Download Submit
C:\Windows\System\jJZCPnv.exe

Filesize
1.9MB

MD5
474fd99897749b7efba9df9d60e5c792

SHA1
2881e80d0c5f9f98c0c88721d9ea7889244ccdf9

SHA256
e1b8acef3fdfc1a81ab7e29e6e1dd55aa17e1fae6934e20cbc6deafb3df5a7ce

SHA512
8124a10296d7229290bc036e67b61df077e6274ed93c5ad9d840a80d6a84f9f6981ab6e47bee9ca7d8dec5567705b30bcc4c2be751045f9bab93aa8133cd234f

Download Submit
C:\Windows\System\lOCbQsv.exe

Filesize
1.9MB

MD5
55ba992a38f0324524ba4f6ce533939a

SHA1
f0ceaaa51e0da8b00a33e6ba8ed6f8e560782624

SHA256
57f864d8176c88b1829fb2beaf496277fe301a3ef69383b83a978730e96724fa

SHA512
f33345009091d5f3e3d369b554f8ab5616e58b2c7660d6abbd44bc42dd80f0774849fca587f3da75f5142a64fbec63f713783f1003378d7b7da2ef193e7f5e21

Download Submit
C:\Windows\System\mebBmAV.exe

Filesize
1.9MB

MD5
29f43f8136d070ee4a4cedc7fb31c494

SHA1
89d4af48aac8418d27853dcce3d5f4fa35a765fa

SHA256
8e44b2153f416891ff2d75aed4e501a1a976941cdd8de03d47034daf69a8c7d2

SHA512
66a70f374f4eb84b65125a8c5a23c58ef64fa2ce507b7477bdcd698f1432bfd63336d7ec60dc7344a00955eb078a044edcd2ffe2d08ec6d85bf0049ee476c781

Download Submit
C:\Windows\System\oMUaIQU.exe

Filesize
1.9MB

MD5
253105a48d94e905a845c814e2128bc0

SHA1
a49a4ea5e356ca5e8bfe7f5f8b6deeae878e897b

SHA256
30bc36b7770473b4218eaa1a74e6f298032435024af41072a32d242975423fd0

SHA512
72a6360f4b42f4057035f0014cce4ea67763cb4e69ec9ea251b8c5225ea869dec4ef79622872b7cfa61e5a9627549035af6d74a0f01110f1e81684e5fef52ba9

Download Submit
C:\Windows\System\sHDGYEN.exe

Filesize
1.9MB

MD5
7512a000c431f8ea57d3ee74ff6c3ed6

SHA1
f3c378b2ccf787fb574f1cc090288fc4e5e7bbd5

SHA256
41e89934f899810c82e6d1fb515ce765e6f2557dbb2d00b4924c92df37150bc7

SHA512
deafa71767bdd55b996d56c327fba5d60ad94622e5a3582ca843de1b830c6c2182942516b06206a5d635e98dffc53d9116a65a5e704ae25c81e4750e72c52b46

Download Submit
C:\Windows\System\ubVlvQK.exe

Filesize
1.9MB

MD5
4a804ff45826c1306c519e9b7efad303

SHA1
a175f2f73f612840f16ef4a5b307d4c45635b98b

SHA256
e02dd489b2e8767ca73243d467ca38e08ba6caa71e03643b10e65ad55ee40906

SHA512
04225cdf1f487a559561c6efb30109a2fc6e3a517edfde9ecf5562e94029af9ad43330f590ba78825b749ccd01d41c42925e73e646b3b105a4c98d1bbd39e4ff

Download Submit
C:\Windows\System\vVFeZrN.exe

Filesize
1.9MB

MD5
4544b24603dda193199a187ea8ca4091

SHA1
911a1a1640f3db51f86d73410ba6c8b042820077

SHA256
3bbf5669289fe74148bf3441dadfe20cf6d5464578f959641961103629afa6fb

SHA512
02d22bb0253fb3668d237f60d8d9e872ebd6abb3f43af4c4d35cd86d95a9626c4d7fe209eca9aaf2364815aa9ed66e82b93038908ff17116920bff8afe7cbc36

Download Submit
C:\Windows\System\vwlqMas.exe

Filesize
1.9MB

MD5
b19c5a638d9eb13ddc030f009c385b0e

SHA1
6f928eecf2e924bcc99555e8255cf96cae21a8c5

SHA256
2d70ffb346ea0de8856398aea91968aefd48dac879a0660bed5890d690b6087a

SHA512
18891af319cfc531fa8153803bfc8d7f0e82ce13a4562af76b43e5021cea15faf0025be0dc3d3259b9220382b19d0f87cc90eb0d32e387c0bcb5a00ce49ee655

Download Submit
C:\Windows\System\wWIvHgD.exe

Filesize
1.9MB

MD5
ffb90a57459a989d9732e167f197aa44

SHA1
fd24a539aa3c34c13af6004a630eb89224577bbb

SHA256
58e78d83e34e2cd38a5ca36aa310e9a320f876e9e887221d1ae21a00ebd5be88

SHA512
61ac194fd2b19f9a268809fb0e8490fb402a1d1fadd535a1ae82ec2a8fc5c4320f313a062a85c9748ce30ed2edb8bae811e08b2b7b7d8c392b8ba30c89ec20b0

Download Submit
memory/396-502-0x00007FFC6E4F0000-0x00007FFC6EFB1000-memory.dmp

Filesize
10.8MB

Download
memory/396-531-0x00000262E9AD0000-0x00000262E9AF2000-memory.dmp

Filesize
136KB

Download
memory/396-2269-0x00007FFC6E4F0000-0x00007FFC6EFB1000-memory.dmp

Filesize
10.8MB

Download
memory/396-17-0x00000262E9B30000-0x00000262E9B40000-memory.dmp

Filesize
64KB

Download
memory/748-222-0x00007FF77E350000-0x00007FF77E742000-memory.dmp

Filesize
3.9MB

Download
memory/748-3414-0x00007FF77E350000-0x00007FF77E742000-memory.dmp

Filesize
3.9MB

Download
memory/964-3438-0x00007FF794C90000-0x00007FF795082000-memory.dmp

Filesize
3.9MB

Download
memory/964-285-0x00007FF794C90000-0x00007FF795082000-memory.dmp

Filesize
3.9MB

Download
memory/1128-3406-0x00007FF72B630000-0x00007FF72BA22000-memory.dmp

Filesize
3.9MB

Download
memory/1128-83-0x00007FF72B630000-0x00007FF72BA22000-memory.dmp

Filesize
3.9MB

Download
memory/1212-3437-0x00007FF728380000-0x00007FF728772000-memory.dmp

Filesize
3.9MB

Download
memory/1212-501-0x00007FF728380000-0x00007FF728772000-memory.dmp

Filesize
3.9MB

Download
memory/1352-3410-0x00007FF660130000-0x00007FF660522000-memory.dmp

Filesize
3.9MB

Download
memory/1352-3378-0x00007FF660130000-0x00007FF660522000-memory.dmp

Filesize
3.9MB

Download
memory/1352-29-0x00007FF660130000-0x00007FF660522000-memory.dmp

Filesize
3.9MB

Download
memory/1396-34-0x00007FF65B110000-0x00007FF65B502000-memory.dmp

Filesize
3.9MB

Download
memory/1396-3412-0x00007FF65B110000-0x00007FF65B502000-memory.dmp

Filesize
3.9MB

Download
memory/1588-3376-0x00007FF7E30A0000-0x00007FF7E3492000-memory.dmp

Filesize
3.9MB

Download
memory/1588-3402-0x00007FF7E30A0000-0x00007FF7E3492000-memory.dmp

Filesize
3.9MB

Download
memory/1588-15-0x00007FF7E30A0000-0x00007FF7E3492000-memory.dmp

Filesize
3.9MB

Download
memory/1788-3427-0x00007FF699110000-0x00007FF699502000-memory.dmp

Filesize
3.9MB

Download
memory/1788-395-0x00007FF699110000-0x00007FF699502000-memory.dmp

Filesize
3.9MB

Download
memory/1844-3435-0x00007FF6CE330000-0x00007FF6CE722000-memory.dmp

Filesize
3.9MB

Download
memory/1844-335-0x00007FF6CE330000-0x00007FF6CE722000-memory.dmp

Filesize
3.9MB

Download
memory/1920-3424-0x00007FF631390000-0x00007FF631782000-memory.dmp

Filesize
3.9MB

Download
memory/1920-246-0x00007FF631390000-0x00007FF631782000-memory.dmp

Filesize
3.9MB

Download
memory/2064-3434-0x00007FF793420000-0x00007FF793812000-memory.dmp

Filesize
3.9MB

Download
memory/2064-3379-0x00007FF793420000-0x00007FF793812000-memory.dmp

Filesize
3.9MB

Download
memory/2064-57-0x00007FF793420000-0x00007FF793812000-memory.dmp

Filesize
3.9MB

Download
memory/2308-503-0x00007FF7C4B20000-0x00007FF7C4F12000-memory.dmp

Filesize
3.9MB

Download
memory/2308-3404-0x00007FF7C4B20000-0x00007FF7C4F12000-memory.dmp

Filesize
3.9MB

Download
memory/2752-500-0x00007FF6B1EE0000-0x00007FF6B22D2000-memory.dmp

Filesize
3.9MB

Download
memory/2752-3430-0x00007FF6B1EE0000-0x00007FF6B22D2000-memory.dmp

Filesize
3.9MB

Download
memory/2976-3400-0x00007FF6D92B0000-0x00007FF6D96A2000-memory.dmp

Filesize
3.9MB

Download
memory/2976-110-0x00007FF6D92B0000-0x00007FF6D96A2000-memory.dmp

Filesize
3.9MB

Download
memory/2976-3422-0x00007FF6D92B0000-0x00007FF6D96A2000-memory.dmp

Filesize
3.9MB

Download
memory/3016-134-0x00007FF63F410000-0x00007FF63F802000-memory.dmp

Filesize
3.9MB

Download
memory/3016-3418-0x00007FF63F410000-0x00007FF63F802000-memory.dmp

Filesize
3.9MB

Download
memory/3460-0-0x00007FF61C750000-0x00007FF61CB42000-memory.dmp

Filesize
3.9MB

Download
memory/3460-1-0x0000017AA3660000-0x0000017AA3670000-memory.dmp

Filesize
64KB

Download
memory/3536-3445-0x00007FF6F8C30000-0x00007FF6F9022000-memory.dmp

Filesize
3.9MB

Download
memory/3536-505-0x00007FF6F8C30000-0x00007FF6F9022000-memory.dmp

Filesize
3.9MB

Download
memory/3624-3409-0x00007FF6C9980000-0x00007FF6C9D72000-memory.dmp

Filesize
3.9MB

Download
memory/3624-173-0x00007FF6C9980000-0x00007FF6C9D72000-memory.dmp

Filesize
3.9MB

Download
memory/4300-446-0x00007FF74E940000-0x00007FF74ED32000-memory.dmp

Filesize
3.9MB

Download
memory/4300-3431-0x00007FF74E940000-0x00007FF74ED32000-memory.dmp

Filesize
3.9MB

Download
memory/4612-3420-0x00007FF62A5D0000-0x00007FF62A9C2000-memory.dmp

Filesize
3.9MB

Download
memory/4612-245-0x00007FF62A5D0000-0x00007FF62A9C2000-memory.dmp

Filesize
3.9MB

Download
memory/5076-3416-0x00007FF669F30000-0x00007FF66A322000-memory.dmp

Filesize
3.9MB

Download
memory/5076-504-0x00007FF669F30000-0x00007FF66A322000-memory.dmp

Filesize
3.9MB

Download
memory/5108-368-0x00007FF687770000-0x00007FF687B62000-memory.dmp

Filesize
3.9MB

Download
memory/5108-3468-0x00007FF687770000-0x00007FF687B62000-memory.dmp

Filesize
3.9MB

Download