xmrig | 97f1e6601b4433c239b6b3c8121fd045d4a0fecd5a42b1c96a27e9d3fb77546c

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 09:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
Size

1.7MB
MD5

103710c3aa58bb82a2e3c93390dc2d13
SHA1

6cfa4e99ed09f69c991ef727d1a30d8ec13d17e9
SHA256

97f1e6601b4433c239b6b3c8121fd045d4a0fecd5a42b1c96a27e9d3fb77546c
SHA512

32cef3413358ce3c5079d41ab92bead74eaa692ed08b3a84c2ea9ab27dd2474219b4e4eec2959428bbc50e25ceabe9251ebda90ee5197f8b35e84dd8b4dac6d8
SSDEEP

49152:Lz071uv4BPMkibTIA5I4TNrpDGgDQvyyo5:NABs

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/2548-479-0x00007FF7A1990000-0x00007FF7A1D82000-memory.dmp	xmrig
behavioral2/memory/4924-585-0x00007FF6B5860000-0x00007FF6B5C52000-memory.dmp	xmrig
behavioral2/memory/872-617-0x00007FF7B3830000-0x00007FF7B3C22000-memory.dmp	xmrig
behavioral2/memory/3416-625-0x00007FF7EAB20000-0x00007FF7EAF12000-memory.dmp	xmrig
behavioral2/memory/2924-624-0x00007FF6D04B0000-0x00007FF6D08A2000-memory.dmp	xmrig
behavioral2/memory/2700-623-0x00007FF75C1D0000-0x00007FF75C5C2000-memory.dmp	xmrig
behavioral2/memory/640-622-0x00007FF7F2140000-0x00007FF7F2532000-memory.dmp	xmrig
behavioral2/memory/3660-621-0x00007FF7DEBF0000-0x00007FF7DEFE2000-memory.dmp	xmrig
behavioral2/memory/4980-620-0x00007FF668220000-0x00007FF668612000-memory.dmp	xmrig
behavioral2/memory/3192-619-0x00007FF6C3CE0000-0x00007FF6C40D2000-memory.dmp	xmrig
behavioral2/memory/1572-618-0x00007FF64E870000-0x00007FF64EC62000-memory.dmp	xmrig
behavioral2/memory/1952-616-0x00007FF650300000-0x00007FF6506F2000-memory.dmp	xmrig
behavioral2/memory/1424-613-0x00007FF602850000-0x00007FF602C42000-memory.dmp	xmrig
behavioral2/memory/2860-417-0x00007FF75C360000-0x00007FF75C752000-memory.dmp	xmrig
behavioral2/memory/4088-368-0x00007FF683D90000-0x00007FF684182000-memory.dmp	xmrig
behavioral2/memory/3860-364-0x00007FF62A020000-0x00007FF62A412000-memory.dmp	xmrig
behavioral2/memory/400-305-0x00007FF6E0760000-0x00007FF6E0B52000-memory.dmp	xmrig
behavioral2/memory/2420-238-0x00007FF70F4E0000-0x00007FF70F8D2000-memory.dmp	xmrig
behavioral2/memory/2484-210-0x00007FF796CD0000-0x00007FF7970C2000-memory.dmp	xmrig
behavioral2/memory/4256-167-0x00007FF6D5550000-0x00007FF6D5942000-memory.dmp	xmrig
behavioral2/memory/3624-110-0x00007FF6B55A0000-0x00007FF6B5992000-memory.dmp	xmrig
behavioral2/memory/3140-101-0x00007FF6CC810000-0x00007FF6CCC02000-memory.dmp	xmrig
behavioral2/memory/2868-2391-0x00007FF6A0920000-0x00007FF6A0D12000-memory.dmp	xmrig
behavioral2/memory/2996-2392-0x00007FF767140000-0x00007FF767532000-memory.dmp	xmrig
behavioral2/memory/2868-2426-0x00007FF6A0920000-0x00007FF6A0D12000-memory.dmp	xmrig
behavioral2/memory/2996-2432-0x00007FF767140000-0x00007FF767532000-memory.dmp	xmrig
behavioral2/memory/3624-2440-0x00007FF6B55A0000-0x00007FF6B5992000-memory.dmp	xmrig
behavioral2/memory/2484-2448-0x00007FF796CD0000-0x00007FF7970C2000-memory.dmp	xmrig
behavioral2/memory/400-2450-0x00007FF6E0760000-0x00007FF6E0B52000-memory.dmp	xmrig
behavioral2/memory/2700-2452-0x00007FF75C1D0000-0x00007FF75C5C2000-memory.dmp	xmrig
behavioral2/memory/4256-2443-0x00007FF6D5550000-0x00007FF6D5942000-memory.dmp	xmrig
behavioral2/memory/3140-2437-0x00007FF6CC810000-0x00007FF6CCC02000-memory.dmp	xmrig
behavioral2/memory/2924-2454-0x00007FF6D04B0000-0x00007FF6D08A2000-memory.dmp	xmrig
behavioral2/memory/3860-2482-0x00007FF62A020000-0x00007FF62A412000-memory.dmp	xmrig
behavioral2/memory/640-2490-0x00007FF7F2140000-0x00007FF7F2532000-memory.dmp	xmrig
behavioral2/memory/2420-2488-0x00007FF70F4E0000-0x00007FF70F8D2000-memory.dmp	xmrig
behavioral2/memory/2860-2483-0x00007FF75C360000-0x00007FF75C752000-memory.dmp	xmrig
behavioral2/memory/4088-2480-0x00007FF683D90000-0x00007FF684182000-memory.dmp	xmrig
behavioral2/memory/2548-2478-0x00007FF7A1990000-0x00007FF7A1D82000-memory.dmp	xmrig
behavioral2/memory/4924-2476-0x00007FF6B5860000-0x00007FF6B5C52000-memory.dmp	xmrig
behavioral2/memory/1424-2474-0x00007FF602850000-0x00007FF602C42000-memory.dmp	xmrig
behavioral2/memory/872-2470-0x00007FF7B3830000-0x00007FF7B3C22000-memory.dmp	xmrig
behavioral2/memory/4980-2462-0x00007FF668220000-0x00007FF668612000-memory.dmp	xmrig
behavioral2/memory/3416-2458-0x00007FF7EAB20000-0x00007FF7EAF12000-memory.dmp	xmrig
behavioral2/memory/1952-2472-0x00007FF650300000-0x00007FF6506F2000-memory.dmp	xmrig
behavioral2/memory/1572-2467-0x00007FF64E870000-0x00007FF64EC62000-memory.dmp	xmrig
behavioral2/memory/3192-2464-0x00007FF6C3CE0000-0x00007FF6C40D2000-memory.dmp	xmrig
behavioral2/memory/3660-2460-0x00007FF7DEBF0000-0x00007FF7DEFE2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3464	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2868	ZfWlGkZ.exe
2996	OClLJKz.exe
3140	xaiPyZL.exe
3624	sBEJVYl.exe
4256	kTaOWRZ.exe
2484	WtSDliW.exe
2700	lLnPpVC.exe
2420	UxmwaIf.exe
400	TxMFMwc.exe
3860	krsXVok.exe
4088	TberFCu.exe
2860	uLWjMfI.exe
2548	EiCuBCX.exe
4924	VMfjbPb.exe
1424	RPdfgfC.exe
1952	CFyJLvt.exe
872	URhVuxo.exe
1572	XcUiToq.exe
2924	IbLMoyN.exe
3192	tLXlWqm.exe
4980	SaqYWNa.exe
3660	jJqCZlR.exe
3416	MeArRbz.exe
640	CcdDRQm.exe
5064	SdRnYPP.exe
4816	SejroDd.exe
4956	lJVKEGI.exe
4568	AbhGMWM.exe
3664	KyweObr.exe
5000	gZeynME.exe
1688	PTnBZOl.exe
776	kQdDdYL.exe
3000	vUubkyt.exe
4380	TyhrvJP.exe
1800	NYZGkoh.exe
3204	FyQVwYA.exe
1224	TXIERuM.exe
4160	YnISlwo.exe
4352	vAKHHfI.exe
1096	Pdjesyu.exe
1672	ndQLrOU.exe
1484	jFswKyK.exe
2916	jfNoPEi.exe
3372	jccvHUY.exe
4336	eCZsfSh.exe
1948	kwWbTGg.exe
3092	xyyaKMB.exe
1808	YyqgUcy.exe
3440	wHgRNjp.exe
4184	yPlJNlb.exe
896	Gxbuwpi.exe
2208	gqYQPyn.exe
1556	VDRxJCF.exe
4604	zlvvGjo.exe
1608	BvWoxMh.exe
3928	aAnTwRn.exe
4552	IrRwcmM.exe
4572	eGRtVcH.exe
4220	gNVqmty.exe
1532	UuppyHM.exe
4276	csgtNQW.exe
4128	iQhIYGa.exe
4740	xvpmOzw.exe
1940	IIxtJdR.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3688-0-0x00007FF7182F0000-0x00007FF7186E2000-memory.dmp	upx
behavioral2/files/0x000a000000023b89-7.dat	upx
behavioral2/files/0x000a000000023b8d-85.dat	upx
behavioral2/files/0x000a000000023b94-122.dat	upx
behavioral2/files/0x000a000000023bab-176.dat	upx
behavioral2/memory/2548-479-0x00007FF7A1990000-0x00007FF7A1D82000-memory.dmp	upx
behavioral2/memory/4924-585-0x00007FF6B5860000-0x00007FF6B5C52000-memory.dmp	upx
behavioral2/memory/872-617-0x00007FF7B3830000-0x00007FF7B3C22000-memory.dmp	upx
behavioral2/memory/3416-625-0x00007FF7EAB20000-0x00007FF7EAF12000-memory.dmp	upx
behavioral2/memory/2924-624-0x00007FF6D04B0000-0x00007FF6D08A2000-memory.dmp	upx
behavioral2/memory/2700-623-0x00007FF75C1D0000-0x00007FF75C5C2000-memory.dmp	upx
behavioral2/memory/640-622-0x00007FF7F2140000-0x00007FF7F2532000-memory.dmp	upx
behavioral2/memory/3660-621-0x00007FF7DEBF0000-0x00007FF7DEFE2000-memory.dmp	upx
behavioral2/memory/4980-620-0x00007FF668220000-0x00007FF668612000-memory.dmp	upx
behavioral2/memory/3192-619-0x00007FF6C3CE0000-0x00007FF6C40D2000-memory.dmp	upx
behavioral2/memory/1572-618-0x00007FF64E870000-0x00007FF64EC62000-memory.dmp	upx
behavioral2/memory/1952-616-0x00007FF650300000-0x00007FF6506F2000-memory.dmp	upx
behavioral2/memory/1424-613-0x00007FF602850000-0x00007FF602C42000-memory.dmp	upx
behavioral2/memory/2860-417-0x00007FF75C360000-0x00007FF75C752000-memory.dmp	upx
behavioral2/memory/4088-368-0x00007FF683D90000-0x00007FF684182000-memory.dmp	upx
behavioral2/memory/3860-364-0x00007FF62A020000-0x00007FF62A412000-memory.dmp	upx
behavioral2/memory/400-305-0x00007FF6E0760000-0x00007FF6E0B52000-memory.dmp	upx
behavioral2/memory/2420-238-0x00007FF70F4E0000-0x00007FF70F8D2000-memory.dmp	upx
behavioral2/files/0x000a000000023bb0-199.dat	upx
behavioral2/files/0x000a000000023b9a-193.dat	upx
behavioral2/files/0x000a000000023baf-189.dat	upx
behavioral2/files/0x000a000000023b98-187.dat	upx
behavioral2/files/0x000a000000023bae-185.dat	upx
behavioral2/files/0x000a000000023bad-180.dat	upx
behavioral2/files/0x000a000000023bac-179.dat	upx
behavioral2/files/0x000a000000023b9f-177.dat	upx
behavioral2/files/0x000a000000023baa-175.dat	upx
behavioral2/files/0x000a000000023ba9-174.dat	upx
behavioral2/files/0x000a000000023ba8-173.dat	upx
behavioral2/files/0x000a000000023ba6-171.dat	upx
behavioral2/memory/2484-210-0x00007FF796CD0000-0x00007FF7970C2000-memory.dmp	upx
behavioral2/memory/4256-167-0x00007FF6D5550000-0x00007FF6D5942000-memory.dmp	upx
behavioral2/files/0x000a000000023b99-164.dat	upx
behavioral2/files/0x000a000000023ba4-162.dat	upx
behavioral2/files/0x000a000000023ba3-161.dat	upx
behavioral2/files/0x000a000000023b97-154.dat	upx
behavioral2/files/0x000a000000023ba1-151.dat	upx
behavioral2/files/0x000a000000023b8f-143.dat	upx
behavioral2/files/0x000a000000023b96-131.dat	upx
behavioral2/files/0x000a000000023b95-125.dat	upx
behavioral2/files/0x000a000000023b9e-121.dat	upx
behavioral2/files/0x000a000000023b9d-120.dat	upx
behavioral2/files/0x000a000000023b92-113.dat	upx
behavioral2/files/0x000a000000023ba7-172.dat	upx
behavioral2/files/0x000a000000023b93-112.dat	upx
behavioral2/files/0x000a000000023ba5-170.dat	upx
behavioral2/memory/3624-110-0x00007FF6B55A0000-0x00007FF6B5992000-memory.dmp	upx
behavioral2/files/0x000a000000023b91-103.dat	upx
behavioral2/memory/3140-101-0x00007FF6CC810000-0x00007FF6CCC02000-memory.dmp	upx
behavioral2/files/0x000a000000023b9c-100.dat	upx
behavioral2/files/0x000a000000023b9b-99.dat	upx
behavioral2/files/0x000a000000023ba2-160.dat	upx
behavioral2/files/0x000a000000023ba0-138.dat	upx
behavioral2/files/0x000a000000023b90-78.dat	upx
behavioral2/files/0x000a000000023b8e-91.dat	upx
behavioral2/memory/2996-61-0x00007FF767140000-0x00007FF767532000-memory.dmp	upx
behavioral2/files/0x000a000000023b8b-51.dat	upx
behavioral2/files/0x000a000000023b8c-28.dat	upx
behavioral2/files/0x000a000000023b8a-43.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\OSwiWdv.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\pHBUEEO.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\XOQLPYr.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\EnTrdym.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\XNjqyBe.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\ZevmeCW.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\qBCuEsm.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\auThdGn.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\vCGmozz.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\toZkZpr.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\TdDWVFV.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\COIwuZd.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\pVbeBIA.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\waVDzIJ.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\qVmYrKk.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\wrHuLNu.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\nDxuhGO.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\qMvBLyx.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\MbMRbtv.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\IektrfV.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\TberFCu.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\LMAcsdG.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\GxaGKwT.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\HDbySrN.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\BqYlDWX.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\BoytjMc.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\rqaOEcF.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\bTZtwlj.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\txbviKI.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\JKsAlZb.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\qIbpvcj.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\lrseVgf.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\sbBJjkb.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\MrKWTfT.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\SAIrwTI.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\XioBKva.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\DPLvqSw.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\oQvBzgs.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\dGatkLF.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\xXLXWpw.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\XlgHmzz.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\jksZjbO.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\JTiburg.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\quxtCNJ.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\jOnHoRK.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\oIYzTkg.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\vJjFKub.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\QPqmNvX.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\kOPgFta.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\ygQmTVk.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\GtvjCRg.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\NNcqlTx.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\vyqfkxH.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\EFzMOJZ.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\lJVKEGI.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\svuMLCd.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\ZjyPMKQ.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\yTBPtRH.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\RyjhMnp.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\AkMSRao.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\vpLvrMD.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\brXuqNo.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\bjXsnMi.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\fqowduq.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3464	powershell.exe
3464	powershell.exe
3464	powershell.exe
3464	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3464	powershell.exe
Token: SeLockMemoryPrivilege	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3688 wrote to memory of 3464	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	85
PID 3688 wrote to memory of 3464	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	85
PID 3688 wrote to memory of 2868	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	86
PID 3688 wrote to memory of 2868	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	86
PID 3688 wrote to memory of 2996	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	87
PID 3688 wrote to memory of 2996	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	87
PID 3688 wrote to memory of 3140	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	88
PID 3688 wrote to memory of 3140	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	88
PID 3688 wrote to memory of 3624	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	89
PID 3688 wrote to memory of 3624	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	89
PID 3688 wrote to memory of 4256	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	90
PID 3688 wrote to memory of 4256	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	90
PID 3688 wrote to memory of 2484	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	91
PID 3688 wrote to memory of 2484	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	91
PID 3688 wrote to memory of 2700	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	92
PID 3688 wrote to memory of 2700	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	92
PID 3688 wrote to memory of 2420	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	93
PID 3688 wrote to memory of 2420	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	93
PID 3688 wrote to memory of 1952	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	94
PID 3688 wrote to memory of 1952	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	94
PID 3688 wrote to memory of 400	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	95
PID 3688 wrote to memory of 400	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	95
PID 3688 wrote to memory of 3860	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	96
PID 3688 wrote to memory of 3860	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	96
PID 3688 wrote to memory of 4088	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	97
PID 3688 wrote to memory of 4088	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	97
PID 3688 wrote to memory of 2860	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	98
PID 3688 wrote to memory of 2860	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	98
PID 3688 wrote to memory of 2548	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	99
PID 3688 wrote to memory of 2548	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	99
PID 3688 wrote to memory of 4924	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	100
PID 3688 wrote to memory of 4924	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	100
PID 3688 wrote to memory of 1424	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	101
PID 3688 wrote to memory of 1424	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	101
PID 3688 wrote to memory of 872	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	102
PID 3688 wrote to memory of 872	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	102
PID 3688 wrote to memory of 1572	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	103
PID 3688 wrote to memory of 1572	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	103
PID 3688 wrote to memory of 2924	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	104
PID 3688 wrote to memory of 2924	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	104
PID 3688 wrote to memory of 3192	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	105
PID 3688 wrote to memory of 3192	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	105
PID 3688 wrote to memory of 4980	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	106
PID 3688 wrote to memory of 4980	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	106
PID 3688 wrote to memory of 3660	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	107
PID 3688 wrote to memory of 3660	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	107
PID 3688 wrote to memory of 3416	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	108
PID 3688 wrote to memory of 3416	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	108
PID 3688 wrote to memory of 640	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	109
PID 3688 wrote to memory of 640	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	109
PID 3688 wrote to memory of 5064	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	110
PID 3688 wrote to memory of 5064	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	110
PID 3688 wrote to memory of 4816	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	111
PID 3688 wrote to memory of 4816	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	111
PID 3688 wrote to memory of 4956	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	112
PID 3688 wrote to memory of 4956	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	112
PID 3688 wrote to memory of 4568	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	113
PID 3688 wrote to memory of 4568	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	113
PID 3688 wrote to memory of 3664	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	114
PID 3688 wrote to memory of 3664	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	114
PID 3688 wrote to memory of 5000	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	115
PID 3688 wrote to memory of 5000	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	115
PID 3688 wrote to memory of 1688	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	116
PID 3688 wrote to memory of 1688	3688	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3464
- C:\Windows\System\ZfWlGkZ.exe
  C:\Windows\System\ZfWlGkZ.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\OClLJKz.exe
  C:\Windows\System\OClLJKz.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\xaiPyZL.exe
  C:\Windows\System\xaiPyZL.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\sBEJVYl.exe
  C:\Windows\System\sBEJVYl.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\kTaOWRZ.exe
  C:\Windows\System\kTaOWRZ.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\WtSDliW.exe
  C:\Windows\System\WtSDliW.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\lLnPpVC.exe
  C:\Windows\System\lLnPpVC.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\UxmwaIf.exe
  C:\Windows\System\UxmwaIf.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\CFyJLvt.exe
  C:\Windows\System\CFyJLvt.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\TxMFMwc.exe
  C:\Windows\System\TxMFMwc.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\krsXVok.exe
  C:\Windows\System\krsXVok.exe
  2⤵
  - Executes dropped EXE
  PID:3860
- C:\Windows\System\TberFCu.exe
  C:\Windows\System\TberFCu.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\uLWjMfI.exe
  C:\Windows\System\uLWjMfI.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\EiCuBCX.exe
  C:\Windows\System\EiCuBCX.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\VMfjbPb.exe
  C:\Windows\System\VMfjbPb.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\RPdfgfC.exe
  C:\Windows\System\RPdfgfC.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\URhVuxo.exe
  C:\Windows\System\URhVuxo.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\XcUiToq.exe
  C:\Windows\System\XcUiToq.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\IbLMoyN.exe
  C:\Windows\System\IbLMoyN.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\tLXlWqm.exe
  C:\Windows\System\tLXlWqm.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\SaqYWNa.exe
  C:\Windows\System\SaqYWNa.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\jJqCZlR.exe
  C:\Windows\System\jJqCZlR.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\MeArRbz.exe
  C:\Windows\System\MeArRbz.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\CcdDRQm.exe
  C:\Windows\System\CcdDRQm.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\SdRnYPP.exe
  C:\Windows\System\SdRnYPP.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\SejroDd.exe
  C:\Windows\System\SejroDd.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\lJVKEGI.exe
  C:\Windows\System\lJVKEGI.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\AbhGMWM.exe
  C:\Windows\System\AbhGMWM.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\KyweObr.exe
  C:\Windows\System\KyweObr.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\gZeynME.exe
  C:\Windows\System\gZeynME.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\PTnBZOl.exe
  C:\Windows\System\PTnBZOl.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\kQdDdYL.exe
  C:\Windows\System\kQdDdYL.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\vUubkyt.exe
  C:\Windows\System\vUubkyt.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\TyhrvJP.exe
  C:\Windows\System\TyhrvJP.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\NYZGkoh.exe
  C:\Windows\System\NYZGkoh.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\FyQVwYA.exe
  C:\Windows\System\FyQVwYA.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\TXIERuM.exe
  C:\Windows\System\TXIERuM.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\YnISlwo.exe
  C:\Windows\System\YnISlwo.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System\vAKHHfI.exe
  C:\Windows\System\vAKHHfI.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\Pdjesyu.exe
  C:\Windows\System\Pdjesyu.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\ndQLrOU.exe
  C:\Windows\System\ndQLrOU.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\jFswKyK.exe
  C:\Windows\System\jFswKyK.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\jfNoPEi.exe
  C:\Windows\System\jfNoPEi.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\jccvHUY.exe
  C:\Windows\System\jccvHUY.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\eCZsfSh.exe
  C:\Windows\System\eCZsfSh.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\kwWbTGg.exe
  C:\Windows\System\kwWbTGg.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\xyyaKMB.exe
  C:\Windows\System\xyyaKMB.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\YyqgUcy.exe
  C:\Windows\System\YyqgUcy.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\wHgRNjp.exe
  C:\Windows\System\wHgRNjp.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\yPlJNlb.exe
  C:\Windows\System\yPlJNlb.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\Gxbuwpi.exe
  C:\Windows\System\Gxbuwpi.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\gqYQPyn.exe
  C:\Windows\System\gqYQPyn.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\VDRxJCF.exe
  C:\Windows\System\VDRxJCF.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\zlvvGjo.exe
  C:\Windows\System\zlvvGjo.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\BvWoxMh.exe
  C:\Windows\System\BvWoxMh.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\aAnTwRn.exe
  C:\Windows\System\aAnTwRn.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\IrRwcmM.exe
  C:\Windows\System\IrRwcmM.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\eGRtVcH.exe
  C:\Windows\System\eGRtVcH.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\gNVqmty.exe
  C:\Windows\System\gNVqmty.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\UuppyHM.exe
  C:\Windows\System\UuppyHM.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\csgtNQW.exe
  C:\Windows\System\csgtNQW.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\iQhIYGa.exe
  C:\Windows\System\iQhIYGa.exe
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\Windows\System\xvpmOzw.exe
  C:\Windows\System\xvpmOzw.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\IIxtJdR.exe
  C:\Windows\System\IIxtJdR.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\jRdyyJL.exe
  C:\Windows\System\jRdyyJL.exe
  2⤵
  PID:4492
- C:\Windows\System\MvbNyMD.exe
  C:\Windows\System\MvbNyMD.exe
  2⤵
  PID:2256
- C:\Windows\System\wKOboRH.exe
  C:\Windows\System\wKOboRH.exe
  2⤵
  PID:2356
- C:\Windows\System\OSBfbcd.exe
  C:\Windows\System\OSBfbcd.exe
  2⤵
  PID:1328
- C:\Windows\System\MHguGLq.exe
  C:\Windows\System\MHguGLq.exe
  2⤵
  PID:4948
- C:\Windows\System\nZKXpmx.exe
  C:\Windows\System\nZKXpmx.exe
  2⤵
  PID:1268
- C:\Windows\System\vvvQgpW.exe
  C:\Windows\System\vvvQgpW.exe
  2⤵
  PID:2152
- C:\Windows\System\cbhIXcb.exe
  C:\Windows\System\cbhIXcb.exe
  2⤵
  PID:468
- C:\Windows\System\uWbQASi.exe
  C:\Windows\System\uWbQASi.exe
  2⤵
  PID:736
- C:\Windows\System\TDeFzvF.exe
  C:\Windows\System\TDeFzvF.exe
  2⤵
  PID:4324
- C:\Windows\System\RmumINs.exe
  C:\Windows\System\RmumINs.exe
  2⤵
  PID:4692
- C:\Windows\System\LMAcsdG.exe
  C:\Windows\System\LMAcsdG.exe
  2⤵
  PID:5136
- C:\Windows\System\yBeasGT.exe
  C:\Windows\System\yBeasGT.exe
  2⤵
  PID:5160
- C:\Windows\System\yYinTfc.exe
  C:\Windows\System\yYinTfc.exe
  2⤵
  PID:5184
- C:\Windows\System\camseHX.exe
  C:\Windows\System\camseHX.exe
  2⤵
  PID:5200
- C:\Windows\System\MbpckWk.exe
  C:\Windows\System\MbpckWk.exe
  2⤵
  PID:5224
- C:\Windows\System\oMYxefp.exe
  C:\Windows\System\oMYxefp.exe
  2⤵
  PID:5244
- C:\Windows\System\CidjLZb.exe
  C:\Windows\System\CidjLZb.exe
  2⤵
  PID:5260
- C:\Windows\System\SnAEAeR.exe
  C:\Windows\System\SnAEAeR.exe
  2⤵
  PID:5296
- C:\Windows\System\eXjnzpo.exe
  C:\Windows\System\eXjnzpo.exe
  2⤵
  PID:5312
- C:\Windows\System\ViXmAxD.exe
  C:\Windows\System\ViXmAxD.exe
  2⤵
  PID:5328
- C:\Windows\System\qTOgKnW.exe
  C:\Windows\System\qTOgKnW.exe
  2⤵
  PID:5356
- C:\Windows\System\ttNfeqK.exe
  C:\Windows\System\ttNfeqK.exe
  2⤵
  PID:5408
- C:\Windows\System\mhrVdSU.exe
  C:\Windows\System\mhrVdSU.exe
  2⤵
  PID:5448
- C:\Windows\System\egfqvoj.exe
  C:\Windows\System\egfqvoj.exe
  2⤵
  PID:5468
- C:\Windows\System\AmYYbVA.exe
  C:\Windows\System\AmYYbVA.exe
  2⤵
  PID:5500
- C:\Windows\System\EvctfLm.exe
  C:\Windows\System\EvctfLm.exe
  2⤵
  PID:5540
- C:\Windows\System\nzRWNfX.exe
  C:\Windows\System\nzRWNfX.exe
  2⤵
  PID:5568
- C:\Windows\System\PdjwlNE.exe
  C:\Windows\System\PdjwlNE.exe
  2⤵
  PID:5596
- C:\Windows\System\RFfCXIh.exe
  C:\Windows\System\RFfCXIh.exe
  2⤵
  PID:5616
- C:\Windows\System\kGDkGAF.exe
  C:\Windows\System\kGDkGAF.exe
  2⤵
  PID:5636
- C:\Windows\System\rMLLmhu.exe
  C:\Windows\System\rMLLmhu.exe
  2⤵
  PID:5660
- C:\Windows\System\XOQLPYr.exe
  C:\Windows\System\XOQLPYr.exe
  2⤵
  PID:5680
- C:\Windows\System\gEbVMVg.exe
  C:\Windows\System\gEbVMVg.exe
  2⤵
  PID:5700
- C:\Windows\System\wZplmzu.exe
  C:\Windows\System\wZplmzu.exe
  2⤵
  PID:5724
- C:\Windows\System\hLRKWNp.exe
  C:\Windows\System\hLRKWNp.exe
  2⤵
  PID:5744
- C:\Windows\System\wOIKXZz.exe
  C:\Windows\System\wOIKXZz.exe
  2⤵
  PID:5764
- C:\Windows\System\vjqtFlP.exe
  C:\Windows\System\vjqtFlP.exe
  2⤵
  PID:5796
- C:\Windows\System\umaMwHR.exe
  C:\Windows\System\umaMwHR.exe
  2⤵
  PID:5812
- C:\Windows\System\mhXyRYX.exe
  C:\Windows\System\mhXyRYX.exe
  2⤵
  PID:5828
- C:\Windows\System\EMukOQT.exe
  C:\Windows\System\EMukOQT.exe
  2⤵
  PID:5844
- C:\Windows\System\EzwGnZN.exe
  C:\Windows\System\EzwGnZN.exe
  2⤵
  PID:5860
- C:\Windows\System\GdFpxqV.exe
  C:\Windows\System\GdFpxqV.exe
  2⤵
  PID:5876
- C:\Windows\System\UEPhICF.exe
  C:\Windows\System\UEPhICF.exe
  2⤵
  PID:5892
- C:\Windows\System\GhpavQG.exe
  C:\Windows\System\GhpavQG.exe
  2⤵
  PID:5912
- C:\Windows\System\vJjFKub.exe
  C:\Windows\System\vJjFKub.exe
  2⤵
  PID:5936
- C:\Windows\System\jkUFdxe.exe
  C:\Windows\System\jkUFdxe.exe
  2⤵
  PID:5956
- C:\Windows\System\dFgjqHY.exe
  C:\Windows\System\dFgjqHY.exe
  2⤵
  PID:5976
- C:\Windows\System\aHKkdnx.exe
  C:\Windows\System\aHKkdnx.exe
  2⤵
  PID:6000
- C:\Windows\System\obmumQW.exe
  C:\Windows\System\obmumQW.exe
  2⤵
  PID:6016
- C:\Windows\System\wroOUzK.exe
  C:\Windows\System\wroOUzK.exe
  2⤵
  PID:6040
- C:\Windows\System\YyrtobY.exe
  C:\Windows\System\YyrtobY.exe
  2⤵
  PID:6116
- C:\Windows\System\GzjNCCd.exe
  C:\Windows\System\GzjNCCd.exe
  2⤵
  PID:6140
- C:\Windows\System\svuMLCd.exe
  C:\Windows\System\svuMLCd.exe
  2⤵
  PID:2052
- C:\Windows\System\HAswoGD.exe
  C:\Windows\System\HAswoGD.exe
  2⤵
  PID:4464
- C:\Windows\System\KqxpItW.exe
  C:\Windows\System\KqxpItW.exe
  2⤵
  PID:4900
- C:\Windows\System\UJIYJuD.exe
  C:\Windows\System\UJIYJuD.exe
  2⤵
  PID:4596
- C:\Windows\System\lmhfuWl.exe
  C:\Windows\System\lmhfuWl.exe
  2⤵
  PID:784
- C:\Windows\System\ZjyPMKQ.exe
  C:\Windows\System\ZjyPMKQ.exe
  2⤵
  PID:3148
- C:\Windows\System\UMmeBwq.exe
  C:\Windows\System\UMmeBwq.exe
  2⤵
  PID:2664
- C:\Windows\System\pVbeBIA.exe
  C:\Windows\System\pVbeBIA.exe
  2⤵
  PID:3484
- C:\Windows\System\knwwcZh.exe
  C:\Windows\System\knwwcZh.exe
  2⤵
  PID:2476
- C:\Windows\System\tOkDtio.exe
  C:\Windows\System\tOkDtio.exe
  2⤵
  PID:5032
- C:\Windows\System\dQlKVdX.exe
  C:\Windows\System\dQlKVdX.exe
  2⤵
  PID:972
- C:\Windows\System\tzaasJF.exe
  C:\Windows\System\tzaasJF.exe
  2⤵
  PID:4264
- C:\Windows\System\AGKrdPi.exe
  C:\Windows\System\AGKrdPi.exe
  2⤵
  PID:4240
- C:\Windows\System\XBKejyF.exe
  C:\Windows\System\XBKejyF.exe
  2⤵
  PID:5084
- C:\Windows\System\JgguAKO.exe
  C:\Windows\System\JgguAKO.exe
  2⤵
  PID:5368
- C:\Windows\System\bReiXXo.exe
  C:\Windows\System\bReiXXo.exe
  2⤵
  PID:2648
- C:\Windows\System\ImjYBdE.exe
  C:\Windows\System\ImjYBdE.exe
  2⤵
  PID:1856
- C:\Windows\System\GAIiTAh.exe
  C:\Windows\System\GAIiTAh.exe
  2⤵
  PID:4648
- C:\Windows\System\jNEjcse.exe
  C:\Windows\System\jNEjcse.exe
  2⤵
  PID:3328
- C:\Windows\System\EkKqFrP.exe
  C:\Windows\System\EkKqFrP.exe
  2⤵
  PID:5952
- C:\Windows\System\akQxKFc.exe
  C:\Windows\System\akQxKFc.exe
  2⤵
  PID:2096
- C:\Windows\System\lMJNAfa.exe
  C:\Windows\System\lMJNAfa.exe
  2⤵
  PID:6160
- C:\Windows\System\wuprzPR.exe
  C:\Windows\System\wuprzPR.exe
  2⤵
  PID:6184
- C:\Windows\System\CFudxyF.exe
  C:\Windows\System\CFudxyF.exe
  2⤵
  PID:6204
- C:\Windows\System\VXRlHud.exe
  C:\Windows\System\VXRlHud.exe
  2⤵
  PID:6224
- C:\Windows\System\AkMSRao.exe
  C:\Windows\System\AkMSRao.exe
  2⤵
  PID:6248
- C:\Windows\System\mlJtICh.exe
  C:\Windows\System\mlJtICh.exe
  2⤵
  PID:6268
- C:\Windows\System\FvaXhde.exe
  C:\Windows\System\FvaXhde.exe
  2⤵
  PID:6288
- C:\Windows\System\DCbElKP.exe
  C:\Windows\System\DCbElKP.exe
  2⤵
  PID:6304
- C:\Windows\System\XpNYoDK.exe
  C:\Windows\System\XpNYoDK.exe
  2⤵
  PID:6328
- C:\Windows\System\VYMLODR.exe
  C:\Windows\System\VYMLODR.exe
  2⤵
  PID:6352
- C:\Windows\System\sNHwPCG.exe
  C:\Windows\System\sNHwPCG.exe
  2⤵
  PID:6372
- C:\Windows\System\yZkQCzM.exe
  C:\Windows\System\yZkQCzM.exe
  2⤵
  PID:6392
- C:\Windows\System\gIoQiEy.exe
  C:\Windows\System\gIoQiEy.exe
  2⤵
  PID:6500
- C:\Windows\System\aoBfKBs.exe
  C:\Windows\System\aoBfKBs.exe
  2⤵
  PID:6520
- C:\Windows\System\vMofaoE.exe
  C:\Windows\System\vMofaoE.exe
  2⤵
  PID:6536
- C:\Windows\System\RqOcDPq.exe
  C:\Windows\System\RqOcDPq.exe
  2⤵
  PID:6552
- C:\Windows\System\SkuwUgv.exe
  C:\Windows\System\SkuwUgv.exe
  2⤵
  PID:6572
- C:\Windows\System\YnUhuzH.exe
  C:\Windows\System\YnUhuzH.exe
  2⤵
  PID:6596
- C:\Windows\System\QfipdWX.exe
  C:\Windows\System\QfipdWX.exe
  2⤵
  PID:6620
- C:\Windows\System\EnTrdym.exe
  C:\Windows\System\EnTrdym.exe
  2⤵
  PID:6636
- C:\Windows\System\LuhElQY.exe
  C:\Windows\System\LuhElQY.exe
  2⤵
  PID:6664
- C:\Windows\System\VYNutmf.exe
  C:\Windows\System\VYNutmf.exe
  2⤵
  PID:6684
- C:\Windows\System\BBkiZhR.exe
  C:\Windows\System\BBkiZhR.exe
  2⤵
  PID:6712
- C:\Windows\System\xgqrbnY.exe
  C:\Windows\System\xgqrbnY.exe
  2⤵
  PID:6740
- C:\Windows\System\OlhwqCJ.exe
  C:\Windows\System\OlhwqCJ.exe
  2⤵
  PID:6760
- C:\Windows\System\eAbguMx.exe
  C:\Windows\System\eAbguMx.exe
  2⤵
  PID:6788
- C:\Windows\System\kTtbfQd.exe
  C:\Windows\System\kTtbfQd.exe
  2⤵
  PID:6808
- C:\Windows\System\nMTtQGG.exe
  C:\Windows\System\nMTtQGG.exe
  2⤵
  PID:6824
- C:\Windows\System\GmVzElO.exe
  C:\Windows\System\GmVzElO.exe
  2⤵
  PID:6848
- C:\Windows\System\BDqZAXn.exe
  C:\Windows\System\BDqZAXn.exe
  2⤵
  PID:6864
- C:\Windows\System\qBCuEsm.exe
  C:\Windows\System\qBCuEsm.exe
  2⤵
  PID:6896
- C:\Windows\System\lSEoZMX.exe
  C:\Windows\System\lSEoZMX.exe
  2⤵
  PID:6912
- C:\Windows\System\DTWVohW.exe
  C:\Windows\System\DTWVohW.exe
  2⤵
  PID:6936
- C:\Windows\System\FoJVlLC.exe
  C:\Windows\System\FoJVlLC.exe
  2⤵
  PID:6956
- C:\Windows\System\ZOlFBeI.exe
  C:\Windows\System\ZOlFBeI.exe
  2⤵
  PID:6976
- C:\Windows\System\TijcFda.exe
  C:\Windows\System\TijcFda.exe
  2⤵
  PID:6996
- C:\Windows\System\NGFijVm.exe
  C:\Windows\System\NGFijVm.exe
  2⤵
  PID:7016
- C:\Windows\System\QPqmNvX.exe
  C:\Windows\System\QPqmNvX.exe
  2⤵
  PID:7040
- C:\Windows\System\abHRbha.exe
  C:\Windows\System\abHRbha.exe
  2⤵
  PID:7064
- C:\Windows\System\lRoqsAn.exe
  C:\Windows\System\lRoqsAn.exe
  2⤵
  PID:7080
- C:\Windows\System\dnJipvl.exe
  C:\Windows\System\dnJipvl.exe
  2⤵
  PID:7104
- C:\Windows\System\uzYAjee.exe
  C:\Windows\System\uzYAjee.exe
  2⤵
  PID:7140
- C:\Windows\System\SNmJIfE.exe
  C:\Windows\System\SNmJIfE.exe
  2⤵
  PID:7164
- C:\Windows\System\vpLvrMD.exe
  C:\Windows\System\vpLvrMD.exe
  2⤵
  PID:3644
- C:\Windows\System\yRUCaDI.exe
  C:\Windows\System\yRUCaDI.exe
  2⤵
  PID:4436
- C:\Windows\System\NycTmCb.exe
  C:\Windows\System\NycTmCb.exe
  2⤵
  PID:4908
- C:\Windows\System\WzGiNqj.exe
  C:\Windows\System\WzGiNqj.exe
  2⤵
  PID:5168
- C:\Windows\System\rpFxFAK.exe
  C:\Windows\System\rpFxFAK.exe
  2⤵
  PID:5212
- C:\Windows\System\EmCDHUn.exe
  C:\Windows\System\EmCDHUn.exe
  2⤵
  PID:5252
- C:\Windows\System\VTmxzjz.exe
  C:\Windows\System\VTmxzjz.exe
  2⤵
  PID:5304
- C:\Windows\System\MMacmME.exe
  C:\Windows\System\MMacmME.exe
  2⤵
  PID:5336
- C:\Windows\System\kSBDInc.exe
  C:\Windows\System\kSBDInc.exe
  2⤵
  PID:5440
- C:\Windows\System\iKxGEjj.exe
  C:\Windows\System\iKxGEjj.exe
  2⤵
  PID:4548
- C:\Windows\System\RTCWjaD.exe
  C:\Windows\System\RTCWjaD.exe
  2⤵
  PID:5492
- C:\Windows\System\xfWHVzO.exe
  C:\Windows\System\xfWHVzO.exe
  2⤵
  PID:6260
- C:\Windows\System\sbQpUPy.exe
  C:\Windows\System\sbQpUPy.exe
  2⤵
  PID:6300
- C:\Windows\System\MamkjPh.exe
  C:\Windows\System\MamkjPh.exe
  2⤵
  PID:6336
- C:\Windows\System\MCaLwLX.exe
  C:\Windows\System\MCaLwLX.exe
  2⤵
  PID:5536
- C:\Windows\System\NJURhDl.exe
  C:\Windows\System\NJURhDl.exe
  2⤵
  PID:5576
- C:\Windows\System\XHCDgDi.exe
  C:\Windows\System\XHCDgDi.exe
  2⤵
  PID:5612
- C:\Windows\System\yuolYeV.exe
  C:\Windows\System\yuolYeV.exe
  2⤵
  PID:5648
- C:\Windows\System\sBsyflm.exe
  C:\Windows\System\sBsyflm.exe
  2⤵
  PID:5676
- C:\Windows\System\yCPtUTI.exe
  C:\Windows\System\yCPtUTI.exe
  2⤵
  PID:5716
- C:\Windows\System\QrqdDht.exe
  C:\Windows\System\QrqdDht.exe
  2⤵
  PID:5804
- C:\Windows\System\UtULFmO.exe
  C:\Windows\System\UtULFmO.exe
  2⤵
  PID:5852
- C:\Windows\System\zlgspjt.exe
  C:\Windows\System\zlgspjt.exe
  2⤵
  PID:5900
- C:\Windows\System\EcWLjCA.exe
  C:\Windows\System\EcWLjCA.exe
  2⤵
  PID:6008
- C:\Windows\System\mLRhPEW.exe
  C:\Windows\System\mLRhPEW.exe
  2⤵
  PID:6264
- C:\Windows\System\yHftrzJ.exe
  C:\Windows\System\yHftrzJ.exe
  2⤵
  PID:7720
- C:\Windows\System\AyuiSib.exe
  C:\Windows\System\AyuiSib.exe
  2⤵
  PID:7736
- C:\Windows\System\DUpSXRS.exe
  C:\Windows\System\DUpSXRS.exe
  2⤵
  PID:7752
- C:\Windows\System\gWZkDMt.exe
  C:\Windows\System\gWZkDMt.exe
  2⤵
  PID:7768
- C:\Windows\System\smigqxK.exe
  C:\Windows\System\smigqxK.exe
  2⤵
  PID:7784
- C:\Windows\System\BpwwlUX.exe
  C:\Windows\System\BpwwlUX.exe
  2⤵
  PID:7800
- C:\Windows\System\SCTxorj.exe
  C:\Windows\System\SCTxorj.exe
  2⤵
  PID:8096
- C:\Windows\System\jbkJFPq.exe
  C:\Windows\System\jbkJFPq.exe
  2⤵
  PID:8116
- C:\Windows\System\XwRzSIJ.exe
  C:\Windows\System\XwRzSIJ.exe
  2⤵
  PID:8132
- C:\Windows\System\UqoFoMm.exe
  C:\Windows\System\UqoFoMm.exe
  2⤵
  PID:5944
- C:\Windows\System\RBmJPLu.exe
  C:\Windows\System\RBmJPLu.exe
  2⤵
  PID:6156
- C:\Windows\System\lfgrwFZ.exe
  C:\Windows\System\lfgrwFZ.exe
  2⤵
  PID:6192
- C:\Windows\System\nDxuhGO.exe
  C:\Windows\System\nDxuhGO.exe
  2⤵
  PID:6368
- C:\Windows\System\ZYUdZaC.exe
  C:\Windows\System\ZYUdZaC.exe
  2⤵
  PID:6384
- C:\Windows\System\LvRqjJc.exe
  C:\Windows\System\LvRqjJc.exe
  2⤵
  PID:6448
- C:\Windows\System\MwBbDPj.exe
  C:\Windows\System\MwBbDPj.exe
  2⤵
  PID:6492
- C:\Windows\System\yGVucrg.exe
  C:\Windows\System\yGVucrg.exe
  2⤵
  PID:6516
- C:\Windows\System\DVHYFXO.exe
  C:\Windows\System\DVHYFXO.exe
  2⤵
  PID:6568
- C:\Windows\System\XomhqZG.exe
  C:\Windows\System\XomhqZG.exe
  2⤵
  PID:6632
- C:\Windows\System\UbRUjpR.exe
  C:\Windows\System\UbRUjpR.exe
  2⤵
  PID:6672
- C:\Windows\System\XolPLei.exe
  C:\Windows\System\XolPLei.exe
  2⤵
  PID:6728
- C:\Windows\System\YfosiGW.exe
  C:\Windows\System\YfosiGW.exe
  2⤵
  PID:6772
- C:\Windows\System\gjRMYNM.exe
  C:\Windows\System\gjRMYNM.exe
  2⤵
  PID:6820
- C:\Windows\System\waVDzIJ.exe
  C:\Windows\System\waVDzIJ.exe
  2⤵
  PID:6908
- C:\Windows\System\DWWYTeE.exe
  C:\Windows\System\DWWYTeE.exe
  2⤵
  PID:6944
- C:\Windows\System\qVmYrKk.exe
  C:\Windows\System\qVmYrKk.exe
  2⤵
  PID:6984
- C:\Windows\System\NNcqlTx.exe
  C:\Windows\System\NNcqlTx.exe
  2⤵
  PID:7024
- C:\Windows\System\lpclEMb.exe
  C:\Windows\System\lpclEMb.exe
  2⤵
  PID:7060
- C:\Windows\System\UbKGvku.exe
  C:\Windows\System\UbKGvku.exe
  2⤵
  PID:7100
- C:\Windows\System\oVhaMKQ.exe
  C:\Windows\System\oVhaMKQ.exe
  2⤵
  PID:7148
- C:\Windows\System\XqJrfYV.exe
  C:\Windows\System\XqJrfYV.exe
  2⤵
  PID:1592
- C:\Windows\System\wgsBSyB.exe
  C:\Windows\System\wgsBSyB.exe
  2⤵
  PID:2292
- C:\Windows\System\lyzoAjz.exe
  C:\Windows\System\lyzoAjz.exe
  2⤵
  PID:5192
- C:\Windows\System\gfoNaUp.exe
  C:\Windows\System\gfoNaUp.exe
  2⤵
  PID:5276
- C:\Windows\System\HjJDpGb.exe
  C:\Windows\System\HjJDpGb.exe
  2⤵
  PID:5348
- C:\Windows\System\FpyqXMm.exe
  C:\Windows\System\FpyqXMm.exe
  2⤵
  PID:5972
- C:\Windows\System\ZlSuHma.exe
  C:\Windows\System\ZlSuHma.exe
  2⤵
  PID:2276
- C:\Windows\System\ctrwmkk.exe
  C:\Windows\System\ctrwmkk.exe
  2⤵
  PID:6320
- C:\Windows\System\CBcInJY.exe
  C:\Windows\System\CBcInJY.exe
  2⤵
  PID:5556
- C:\Windows\System\qYCnGQZ.exe
  C:\Windows\System\qYCnGQZ.exe
  2⤵
  PID:5644
- C:\Windows\System\ejPibHW.exe
  C:\Windows\System\ejPibHW.exe
  2⤵
  PID:5736
- C:\Windows\System\vxqNlfm.exe
  C:\Windows\System\vxqNlfm.exe
  2⤵
  PID:5836
- C:\Windows\System\gWtBIby.exe
  C:\Windows\System\gWtBIby.exe
  2⤵
  PID:3488
- C:\Windows\System\NOlmEDQ.exe
  C:\Windows\System\NOlmEDQ.exe
  2⤵
  PID:5888
- C:\Windows\System\nhrEruB.exe
  C:\Windows\System\nhrEruB.exe
  2⤵
  PID:7604
- C:\Windows\System\XyrSYxx.exe
  C:\Windows\System\XyrSYxx.exe
  2⤵
  PID:7656
- C:\Windows\System\jhlpQJu.exe
  C:\Windows\System\jhlpQJu.exe
  2⤵
  PID:7680
- C:\Windows\System\cqMjUvD.exe
  C:\Windows\System\cqMjUvD.exe
  2⤵
  PID:8196
- C:\Windows\System\USIbbkT.exe
  C:\Windows\System\USIbbkT.exe
  2⤵
  PID:8240
- C:\Windows\System\YIqDVsN.exe
  C:\Windows\System\YIqDVsN.exe
  2⤵
  PID:8372
- C:\Windows\System\uWLNyks.exe
  C:\Windows\System\uWLNyks.exe
  2⤵
  PID:8392
- C:\Windows\System\srHCIrt.exe
  C:\Windows\System\srHCIrt.exe
  2⤵
  PID:8412
- C:\Windows\System\ZjqHlpw.exe
  C:\Windows\System\ZjqHlpw.exe
  2⤵
  PID:8908
- C:\Windows\System\JAJeMTA.exe
  C:\Windows\System\JAJeMTA.exe
  2⤵
  PID:8924
- C:\Windows\System\mhjYMzE.exe
  C:\Windows\System\mhjYMzE.exe
  2⤵
  PID:8940
- C:\Windows\System\jZgAFXN.exe
  C:\Windows\System\jZgAFXN.exe
  2⤵
  PID:8960
- C:\Windows\System\cQmnFqQ.exe
  C:\Windows\System\cQmnFqQ.exe
  2⤵
  PID:8976
- C:\Windows\System\xHQxbXV.exe
  C:\Windows\System\xHQxbXV.exe
  2⤵
  PID:8992
- C:\Windows\System\GpmFLlV.exe
  C:\Windows\System\GpmFLlV.exe
  2⤵
  PID:9016
- C:\Windows\System\mtYAFBg.exe
  C:\Windows\System\mtYAFBg.exe
  2⤵
  PID:9032
- C:\Windows\System\PASpPmE.exe
  C:\Windows\System\PASpPmE.exe
  2⤵
  PID:9052
- C:\Windows\System\SdlamZU.exe
  C:\Windows\System\SdlamZU.exe
  2⤵
  PID:9072
- C:\Windows\System\ihrsmLi.exe
  C:\Windows\System\ihrsmLi.exe
  2⤵
  PID:9092
- C:\Windows\System\sHEDWdX.exe
  C:\Windows\System\sHEDWdX.exe
  2⤵
  PID:9112
- C:\Windows\System\cnhyQPC.exe
  C:\Windows\System\cnhyQPC.exe
  2⤵
  PID:9132
- C:\Windows\System\MKCWpzo.exe
  C:\Windows\System\MKCWpzo.exe
  2⤵
  PID:9148
- C:\Windows\System\CRrvVDj.exe
  C:\Windows\System\CRrvVDj.exe
  2⤵
  PID:9172
- C:\Windows\System\kQKkvvh.exe
  C:\Windows\System\kQKkvvh.exe
  2⤵
  PID:9188
- C:\Windows\System\jSDHJPw.exe
  C:\Windows\System\jSDHJPw.exe
  2⤵
  PID:9204
- C:\Windows\System\ffPrMjB.exe
  C:\Windows\System\ffPrMjB.exe
  2⤵
  PID:7608
- C:\Windows\System\bmQiFde.exe
  C:\Windows\System\bmQiFde.exe
  2⤵
  PID:7708
- C:\Windows\System\ZOqsEJQ.exe
  C:\Windows\System\ZOqsEJQ.exe
  2⤵
  PID:2404
- C:\Windows\System\ccwskbR.exe
  C:\Windows\System\ccwskbR.exe
  2⤵
  PID:7620
- C:\Windows\System\iqbTngy.exe
  C:\Windows\System\iqbTngy.exe
  2⤵
  PID:7652
- C:\Windows\System\IibtLAT.exe
  C:\Windows\System\IibtLAT.exe
  2⤵
  PID:7716
- C:\Windows\System\oQquCNL.exe
  C:\Windows\System\oQquCNL.exe
  2⤵
  PID:7760
- C:\Windows\System\DBAEgEm.exe
  C:\Windows\System\DBAEgEm.exe
  2⤵
  PID:7796
- C:\Windows\System\oevOcbC.exe
  C:\Windows\System\oevOcbC.exe
  2⤵
  PID:7864
- C:\Windows\System\xmBTJMP.exe
  C:\Windows\System\xmBTJMP.exe
  2⤵
  PID:7904
- C:\Windows\System\xjiUfis.exe
  C:\Windows\System\xjiUfis.exe
  2⤵
  PID:7944
- C:\Windows\System\DDjSFpk.exe
  C:\Windows\System\DDjSFpk.exe
  2⤵
  PID:7984
- C:\Windows\System\HOmiSlz.exe
  C:\Windows\System\HOmiSlz.exe
  2⤵
  PID:8024
- C:\Windows\System\eIfrSHx.exe
  C:\Windows\System\eIfrSHx.exe
  2⤵
  PID:8060
- C:\Windows\System\XMURAPV.exe
  C:\Windows\System\XMURAPV.exe
  2⤵
  PID:8124
- C:\Windows\System\HeJppCS.exe
  C:\Windows\System\HeJppCS.exe
  2⤵
  PID:6152
- C:\Windows\System\sqyylDv.exe
  C:\Windows\System\sqyylDv.exe
  2⤵
  PID:6360
- C:\Windows\System\rSypuiS.exe
  C:\Windows\System\rSypuiS.exe
  2⤵
  PID:6476
- C:\Windows\System\jYGGcmQ.exe
  C:\Windows\System\jYGGcmQ.exe
  2⤵
  PID:6564
- C:\Windows\System\lmYuGOa.exe
  C:\Windows\System\lmYuGOa.exe
  2⤵
  PID:6656
- C:\Windows\System\PlFOXeo.exe
  C:\Windows\System\PlFOXeo.exe
  2⤵
  PID:6748
- C:\Windows\System\eTxbhhs.exe
  C:\Windows\System\eTxbhhs.exe
  2⤵
  PID:6844
- C:\Windows\System\fyICwEd.exe
  C:\Windows\System\fyICwEd.exe
  2⤵
  PID:6964
- C:\Windows\System\wNPeYkn.exe
  C:\Windows\System\wNPeYkn.exe
  2⤵
  PID:6988
- C:\Windows\System\gnEFCMq.exe
  C:\Windows\System\gnEFCMq.exe
  2⤵
  PID:5268
- C:\Windows\System\cRqsnzg.exe
  C:\Windows\System\cRqsnzg.exe
  2⤵
  PID:5396
- C:\Windows\System\mvcnTmM.exe
  C:\Windows\System\mvcnTmM.exe
  2⤵
  PID:6240
- C:\Windows\System\qasoBpI.exe
  C:\Windows\System\qasoBpI.exe
  2⤵
  PID:5524
- C:\Windows\System\uKfHTRk.exe
  C:\Windows\System\uKfHTRk.exe
  2⤵
  PID:5632
- C:\Windows\System\oECHSWg.exe
  C:\Windows\System\oECHSWg.exe
  2⤵
  PID:5824
- C:\Windows\System\xMfqntn.exe
  C:\Windows\System\xMfqntn.exe
  2⤵
  PID:5868
- C:\Windows\System\AGTBGXh.exe
  C:\Windows\System\AGTBGXh.exe
  2⤵
  PID:7628
- C:\Windows\System\ovkODRC.exe
  C:\Windows\System\ovkODRC.exe
  2⤵
  PID:7688
- C:\Windows\System\gRTjbve.exe
  C:\Windows\System\gRTjbve.exe
  2⤵
  PID:8360
- C:\Windows\System\XTXpArL.exe
  C:\Windows\System\XTXpArL.exe
  2⤵
  PID:8388
- C:\Windows\System\UmPYnRz.exe
  C:\Windows\System\UmPYnRz.exe
  2⤵
  PID:9144
- C:\Windows\System\RXdCwtn.exe
  C:\Windows\System\RXdCwtn.exe
  2⤵
  PID:9168
- C:\Windows\System\wVXiigp.exe
  C:\Windows\System\wVXiigp.exe
  2⤵
  PID:7696
- C:\Windows\System\JCpbZnZ.exe
  C:\Windows\System\JCpbZnZ.exe
  2⤵
  PID:7820
- C:\Windows\System\luMzwNd.exe
  C:\Windows\System\luMzwNd.exe
  2⤵
  PID:8112
- C:\Windows\System\auThdGn.exe
  C:\Windows\System\auThdGn.exe
  2⤵
  PID:6032
- C:\Windows\System\BqYlDWX.exe
  C:\Windows\System\BqYlDWX.exe
  2⤵
  PID:6416
- C:\Windows\System\CnlFule.exe
  C:\Windows\System\CnlFule.exe
  2⤵
  PID:9232
- C:\Windows\System\HbCmwiX.exe
  C:\Windows\System\HbCmwiX.exe
  2⤵
  PID:9248
- C:\Windows\System\ljHzBPx.exe
  C:\Windows\System\ljHzBPx.exe
  2⤵
  PID:9264
- C:\Windows\System\UPmSabH.exe
  C:\Windows\System\UPmSabH.exe
  2⤵
  PID:9280
- C:\Windows\System\iWmyykR.exe
  C:\Windows\System\iWmyykR.exe
  2⤵
  PID:9296
- C:\Windows\System\VtShUEE.exe
  C:\Windows\System\VtShUEE.exe
  2⤵
  PID:9316
- C:\Windows\System\EjruGBN.exe
  C:\Windows\System\EjruGBN.exe
  2⤵
  PID:9336
- C:\Windows\System\aLFnJwt.exe
  C:\Windows\System\aLFnJwt.exe
  2⤵
  PID:9368
- C:\Windows\System\UzMCaKp.exe
  C:\Windows\System\UzMCaKp.exe
  2⤵
  PID:9384
- C:\Windows\System\ijuhhxs.exe
  C:\Windows\System\ijuhhxs.exe
  2⤵
  PID:9404
- C:\Windows\System\tILjwVN.exe
  C:\Windows\System\tILjwVN.exe
  2⤵
  PID:9428
- C:\Windows\System\XVsUByG.exe
  C:\Windows\System\XVsUByG.exe
  2⤵
  PID:9448
- C:\Windows\System\mJOvLad.exe
  C:\Windows\System\mJOvLad.exe
  2⤵
  PID:9468
- C:\Windows\System\UCdDTaR.exe
  C:\Windows\System\UCdDTaR.exe
  2⤵
  PID:9492
- C:\Windows\System\KVoWGqE.exe
  C:\Windows\System\KVoWGqE.exe
  2⤵
  PID:9516
- C:\Windows\System\XNjqyBe.exe
  C:\Windows\System\XNjqyBe.exe
  2⤵
  PID:9532
- C:\Windows\System\zkRqwRJ.exe
  C:\Windows\System\zkRqwRJ.exe
  2⤵
  PID:9560
- C:\Windows\System\bTZtwlj.exe
  C:\Windows\System\bTZtwlj.exe
  2⤵
  PID:9576
- C:\Windows\System\IwrKZtC.exe
  C:\Windows\System\IwrKZtC.exe
  2⤵
  PID:9608
- C:\Windows\System\yCLadMZ.exe
  C:\Windows\System\yCLadMZ.exe
  2⤵
  PID:9624
- C:\Windows\System\rMcYMCo.exe
  C:\Windows\System\rMcYMCo.exe
  2⤵
  PID:9640
- C:\Windows\System\ypoyAuQ.exe
  C:\Windows\System\ypoyAuQ.exe
  2⤵
  PID:9660
- C:\Windows\System\xRDUdZv.exe
  C:\Windows\System\xRDUdZv.exe
  2⤵
  PID:9676
- C:\Windows\System\LtEfYzU.exe
  C:\Windows\System\LtEfYzU.exe
  2⤵
  PID:9692
- C:\Windows\System\kWGNypW.exe
  C:\Windows\System\kWGNypW.exe
  2⤵
  PID:9708
- C:\Windows\System\aBGeGlx.exe
  C:\Windows\System\aBGeGlx.exe
  2⤵
  PID:9724
- C:\Windows\System\DNmAkks.exe
  C:\Windows\System\DNmAkks.exe
  2⤵
  PID:9740
- C:\Windows\System\csmTDzw.exe
  C:\Windows\System\csmTDzw.exe
  2⤵
  PID:9756
- C:\Windows\System\anQRVhO.exe
  C:\Windows\System\anQRVhO.exe
  2⤵
  PID:9772
- C:\Windows\System\fFHmgHJ.exe
  C:\Windows\System\fFHmgHJ.exe
  2⤵
  PID:9788
- C:\Windows\System\UgkFqDW.exe
  C:\Windows\System\UgkFqDW.exe
  2⤵
  PID:9804
- C:\Windows\System\bskzxPJ.exe
  C:\Windows\System\bskzxPJ.exe
  2⤵
  PID:9820
- C:\Windows\System\bCAevUa.exe
  C:\Windows\System\bCAevUa.exe
  2⤵
  PID:9840
- C:\Windows\System\sAszORw.exe
  C:\Windows\System\sAszORw.exe
  2⤵
  PID:9860
- C:\Windows\System\jVQYhki.exe
  C:\Windows\System\jVQYhki.exe
  2⤵
  PID:9880
- C:\Windows\System\HFZaRwD.exe
  C:\Windows\System\HFZaRwD.exe
  2⤵
  PID:9908
- C:\Windows\System\xVXhiny.exe
  C:\Windows\System\xVXhiny.exe
  2⤵
  PID:9924
- C:\Windows\System\vWJTgDH.exe
  C:\Windows\System\vWJTgDH.exe
  2⤵
  PID:9948
- C:\Windows\System\whzlnbA.exe
  C:\Windows\System\whzlnbA.exe
  2⤵
  PID:9972
- C:\Windows\System\wDaWVHC.exe
  C:\Windows\System\wDaWVHC.exe
  2⤵
  PID:9988
- C:\Windows\System\yvBDUmT.exe
  C:\Windows\System\yvBDUmT.exe
  2⤵
  PID:10012
- C:\Windows\System\sbBJjkb.exe
  C:\Windows\System\sbBJjkb.exe
  2⤵
  PID:10028
- C:\Windows\System\iftQdbe.exe
  C:\Windows\System\iftQdbe.exe
  2⤵
  PID:10052
- C:\Windows\System\nBjqtlg.exe
  C:\Windows\System\nBjqtlg.exe
  2⤵
  PID:10084
- C:\Windows\System\ZyofaqG.exe
  C:\Windows\System\ZyofaqG.exe
  2⤵
  PID:10108
- C:\Windows\System\XqYNSga.exe
  C:\Windows\System\XqYNSga.exe
  2⤵
  PID:10128
- C:\Windows\System\dugOQtU.exe
  C:\Windows\System\dugOQtU.exe
  2⤵
  PID:10148
- C:\Windows\System\dGatkLF.exe
  C:\Windows\System\dGatkLF.exe
  2⤵
  PID:10168
- C:\Windows\System\qWGPaVM.exe
  C:\Windows\System\qWGPaVM.exe
  2⤵
  PID:10188
- C:\Windows\System\QOTGogh.exe
  C:\Windows\System\QOTGogh.exe
  2⤵
  PID:10208
- C:\Windows\System\bwBIaDm.exe
  C:\Windows\System\bwBIaDm.exe
  2⤵
  PID:10232
- C:\Windows\System\jKtQaNt.exe
  C:\Windows\System\jKtQaNt.exe
  2⤵
  PID:7136
- C:\Windows\System\PGRqlSz.exe
  C:\Windows\System\PGRqlSz.exe
  2⤵
  PID:8896
- C:\Windows\System\aigfrwC.exe
  C:\Windows\System\aigfrwC.exe
  2⤵
  PID:8936
- C:\Windows\System\FmLCUww.exe
  C:\Windows\System\FmLCUww.exe
  2⤵
  PID:8972
- C:\Windows\System\mmNpkRj.exe
  C:\Windows\System\mmNpkRj.exe
  2⤵
  PID:9028
- C:\Windows\System\FXjUdVV.exe
  C:\Windows\System\FXjUdVV.exe
  2⤵
  PID:9064
- C:\Windows\System\SNlrKmF.exe
  C:\Windows\System\SNlrKmF.exe
  2⤵
  PID:9108
- C:\Windows\System\VjgHREy.exe
  C:\Windows\System\VjgHREy.exe
  2⤵
  PID:9184
- C:\Windows\System\deTATnp.exe
  C:\Windows\System\deTATnp.exe
  2⤵
  PID:7596
- C:\Windows\System\VoxsODE.exe
  C:\Windows\System\VoxsODE.exe
  2⤵
  PID:7580
- C:\Windows\System\mKRXeQz.exe
  C:\Windows\System\mKRXeQz.exe
  2⤵
  PID:7632
- C:\Windows\System\XfFtkRU.exe
  C:\Windows\System\XfFtkRU.exe
  2⤵
  PID:7712
- C:\Windows\System\uxwBXMp.exe
  C:\Windows\System\uxwBXMp.exe
  2⤵
  PID:7856
- C:\Windows\System\tAlArLm.exe
  C:\Windows\System\tAlArLm.exe
  2⤵
  PID:7936
- C:\Windows\System\HNxuMMD.exe
  C:\Windows\System\HNxuMMD.exe
  2⤵
  PID:8052
- C:\Windows\System\jevOqmD.exe
  C:\Windows\System\jevOqmD.exe
  2⤵
  PID:6804
- C:\Windows\System\HUYUYJt.exe
  C:\Windows\System\HUYUYJt.exe
  2⤵
  PID:9260
- C:\Windows\System\PkNTUKQ.exe
  C:\Windows\System\PkNTUKQ.exe
  2⤵
  PID:2812
- C:\Windows\System\MrKWTfT.exe
  C:\Windows\System\MrKWTfT.exe
  2⤵
  PID:9444
- C:\Windows\System\PDbYEmO.exe
  C:\Windows\System\PDbYEmO.exe
  2⤵
  PID:10252
- C:\Windows\System\dfsRqGM.exe
  C:\Windows\System\dfsRqGM.exe
  2⤵
  PID:10420
- C:\Windows\System\WHqyqjU.exe
  C:\Windows\System\WHqyqjU.exe
  2⤵
  PID:10444
- C:\Windows\System\uXAKAHs.exe
  C:\Windows\System\uXAKAHs.exe
  2⤵
  PID:10464
- C:\Windows\System\BQTBeck.exe
  C:\Windows\System\BQTBeck.exe
  2⤵
  PID:10484
- C:\Windows\System\txbviKI.exe
  C:\Windows\System\txbviKI.exe
  2⤵
  PID:10508
- C:\Windows\System\BANSfHI.exe
  C:\Windows\System\BANSfHI.exe
  2⤵
  PID:10528
- C:\Windows\System\dmgkvqj.exe
  C:\Windows\System\dmgkvqj.exe
  2⤵
  PID:10548
- C:\Windows\System\EdenFiI.exe
  C:\Windows\System\EdenFiI.exe
  2⤵
  PID:10568
- C:\Windows\System\bgnvYbQ.exe
  C:\Windows\System\bgnvYbQ.exe
  2⤵
  PID:10596
- C:\Windows\System\jFTyRXy.exe
  C:\Windows\System\jFTyRXy.exe
  2⤵
  PID:10616
- C:\Windows\System\AwjqjqM.exe
  C:\Windows\System\AwjqjqM.exe
  2⤵
  PID:10644
- C:\Windows\System\ztDNaDX.exe
  C:\Windows\System\ztDNaDX.exe
  2⤵
  PID:10660
- C:\Windows\System\MYFyBYW.exe
  C:\Windows\System\MYFyBYW.exe
  2⤵
  PID:10680
- C:\Windows\System\xXLXWpw.exe
  C:\Windows\System\xXLXWpw.exe
  2⤵
  PID:10696
- C:\Windows\System\oyVdBpC.exe
  C:\Windows\System\oyVdBpC.exe
  2⤵
  PID:10712
- C:\Windows\System\poZPhZl.exe
  C:\Windows\System\poZPhZl.exe
  2⤵
  PID:10732
- C:\Windows\System\euVLUOX.exe
  C:\Windows\System\euVLUOX.exe
  2⤵
  PID:10748
- C:\Windows\System\pGVjvwV.exe
  C:\Windows\System\pGVjvwV.exe
  2⤵
  PID:10768
- C:\Windows\System\NfxmntF.exe
  C:\Windows\System\NfxmntF.exe
  2⤵
  PID:10796
- C:\Windows\System\zOkctBB.exe
  C:\Windows\System\zOkctBB.exe
  2⤵
  PID:10816
- C:\Windows\System\ZevmeCW.exe
  C:\Windows\System\ZevmeCW.exe
  2⤵
  PID:10932
- C:\Windows\System\XhnrBho.exe
  C:\Windows\System\XhnrBho.exe
  2⤵
  PID:10948
- C:\Windows\System\dImjRDH.exe
  C:\Windows\System\dImjRDH.exe
  2⤵
  PID:10980
- C:\Windows\System\wrHuLNu.exe
  C:\Windows\System\wrHuLNu.exe
  2⤵
  PID:11000
- C:\Windows\System\MwkTpYQ.exe
  C:\Windows\System\MwkTpYQ.exe
  2⤵
  PID:11016
- C:\Windows\System\OSwiWdv.exe
  C:\Windows\System\OSwiWdv.exe
  2⤵
  PID:11036
- C:\Windows\System\vuqCaUc.exe
  C:\Windows\System\vuqCaUc.exe
  2⤵
  PID:11052
- C:\Windows\System\BOXJcbM.exe
  C:\Windows\System\BOXJcbM.exe
  2⤵
  PID:11068
- C:\Windows\System\hqmbrnB.exe
  C:\Windows\System\hqmbrnB.exe
  2⤵
  PID:11084
- C:\Windows\System\xzmWlei.exe
  C:\Windows\System\xzmWlei.exe
  2⤵
  PID:11108
- C:\Windows\System\toZkZpr.exe
  C:\Windows\System\toZkZpr.exe
  2⤵
  PID:11144
- C:\Windows\System\qeWOYVx.exe
  C:\Windows\System\qeWOYVx.exe
  2⤵
  PID:11164
- C:\Windows\System\ZDDSllQ.exe
  C:\Windows\System\ZDDSllQ.exe
  2⤵
  PID:11192
- C:\Windows\System\rimGgtG.exe
  C:\Windows\System\rimGgtG.exe
  2⤵
  PID:11212
- C:\Windows\System\cdoHgFV.exe
  C:\Windows\System\cdoHgFV.exe
  2⤵
  PID:11228
- C:\Windows\System\FYpNYwV.exe
  C:\Windows\System\FYpNYwV.exe
  2⤵
  PID:11248
- C:\Windows\System\ybQTrYn.exe
  C:\Windows\System\ybQTrYn.exe
  2⤵
  PID:5152
- C:\Windows\System\SAIrwTI.exe
  C:\Windows\System\SAIrwTI.exe
  2⤵
  PID:5324
- C:\Windows\System\WGZUmJM.exe
  C:\Windows\System\WGZUmJM.exe
  2⤵
  PID:6296
- C:\Windows\System\LhagBga.exe
  C:\Windows\System\LhagBga.exe
  2⤵
  PID:7220
- C:\Windows\System\cKXiCoI.exe
  C:\Windows\System\cKXiCoI.exe
  2⤵
  PID:7672
- C:\Windows\System\KeiQhew.exe
  C:\Windows\System\KeiQhew.exe
  2⤵
  PID:8384
- C:\Windows\System\PPwprDC.exe
  C:\Windows\System\PPwprDC.exe
  2⤵
  PID:9164
- C:\Windows\System\HkIKFGG.exe
  C:\Windows\System\HkIKFGG.exe
  2⤵
  PID:8092
- C:\Windows\System\nxSXNeP.exe
  C:\Windows\System\nxSXNeP.exe
  2⤵
  PID:10036
- C:\Windows\System\xvMNHEk.exe
  C:\Windows\System\xvMNHEk.exe
  2⤵
  PID:10136
- C:\Windows\System\wkGGsGd.exe
  C:\Windows\System\wkGGsGd.exe
  2⤵
  PID:6400
- C:\Windows\System\DdRvceW.exe
  C:\Windows\System\DdRvceW.exe
  2⤵
  PID:9084
- C:\Windows\System\ansLjNV.exe
  C:\Windows\System\ansLjNV.exe
  2⤵
  PID:1404
- C:\Windows\System\UkcFSWw.exe
  C:\Windows\System\UkcFSWw.exe
  2⤵
  PID:9548
- C:\Windows\System\hZyIsCj.exe
  C:\Windows\System\hZyIsCj.exe
  2⤵
  PID:9440
- C:\Windows\System\kWfnfPo.exe
  C:\Windows\System\kWfnfPo.exe
  2⤵
  PID:6904
- C:\Windows\System\XOaovEY.exe
  C:\Windows\System\XOaovEY.exe
  2⤵
  PID:9224
- C:\Windows\System\wROElAU.exe
  C:\Windows\System\wROElAU.exe
  2⤵
  PID:4796
- C:\Windows\System\GxaGKwT.exe
  C:\Windows\System\GxaGKwT.exe
  2⤵
  PID:10176
- C:\Windows\System\EktSbvq.exe
  C:\Windows\System\EktSbvq.exe
  2⤵
  PID:10524
- C:\Windows\System\TiDBYja.exe
  C:\Windows\System\TiDBYja.exe
  2⤵
  PID:10576
- C:\Windows\System\smqdkra.exe
  C:\Windows\System\smqdkra.exe
  2⤵
  PID:8904
- C:\Windows\System\VzTPQgo.exe
  C:\Windows\System\VzTPQgo.exe
  2⤵
  PID:9332
- C:\Windows\System\DeMpApU.exe
  C:\Windows\System\DeMpApU.exe
  2⤵
  PID:9376
- C:\Windows\System\kxLfeyn.exe
  C:\Windows\System\kxLfeyn.exe
  2⤵
  PID:9464
- C:\Windows\System\UIsOYoV.exe
  C:\Windows\System\UIsOYoV.exe
  2⤵
  PID:9484
- C:\Windows\System\qfCrEbj.exe
  C:\Windows\System\qfCrEbj.exe
  2⤵
  PID:9568
- C:\Windows\System\vwlIshf.exe
  C:\Windows\System\vwlIshf.exe
  2⤵
  PID:4420
- C:\Windows\System\QWfjpZB.exe
  C:\Windows\System\QWfjpZB.exe
  2⤵
  PID:11268
- C:\Windows\System\Nqyvivf.exe
  C:\Windows\System\Nqyvivf.exe
  2⤵
  PID:11292
- C:\Windows\System\jbsYCHE.exe
  C:\Windows\System\jbsYCHE.exe
  2⤵
  PID:11312
- C:\Windows\System\HDbySrN.exe
  C:\Windows\System\HDbySrN.exe
  2⤵
  PID:11332
- C:\Windows\System\YyZRecF.exe
  C:\Windows\System\YyZRecF.exe
  2⤵
  PID:11356
- C:\Windows\System\kOPgFta.exe
  C:\Windows\System\kOPgFta.exe
  2⤵
  PID:11380
- C:\Windows\System\tJoZhQQ.exe
  C:\Windows\System\tJoZhQQ.exe
  2⤵
  PID:11408
- C:\Windows\System\zzZeblw.exe
  C:\Windows\System\zzZeblw.exe
  2⤵
  PID:11428
- C:\Windows\System\uBcLSmE.exe
  C:\Windows\System\uBcLSmE.exe
  2⤵
  PID:11448
- C:\Windows\System\ojZNxns.exe
  C:\Windows\System\ojZNxns.exe
  2⤵
  PID:11468
- C:\Windows\System\SFXIJeN.exe
  C:\Windows\System\SFXIJeN.exe
  2⤵
  PID:11496
- C:\Windows\System\NpQVsmK.exe
  C:\Windows\System\NpQVsmK.exe
  2⤵
  PID:11524
- C:\Windows\System\mbNQrGr.exe
  C:\Windows\System\mbNQrGr.exe
  2⤵
  PID:11544
- C:\Windows\System\KRhWNuC.exe
  C:\Windows\System\KRhWNuC.exe
  2⤵
  PID:11568
- C:\Windows\System\dtvjYii.exe
  C:\Windows\System\dtvjYii.exe
  2⤵
  PID:11588
- C:\Windows\System\pYuXxkP.exe
  C:\Windows\System\pYuXxkP.exe
  2⤵
  PID:11604
- C:\Windows\System\IOOztGZ.exe
  C:\Windows\System\IOOztGZ.exe
  2⤵
  PID:11624
- C:\Windows\System\SLJnqeb.exe
  C:\Windows\System\SLJnqeb.exe
  2⤵
  PID:11700
- C:\Windows\System\JxPMncF.exe
  C:\Windows\System\JxPMncF.exe
  2⤵
  PID:11716
- C:\Windows\System\WyYVMDf.exe
  C:\Windows\System\WyYVMDf.exe
  2⤵
  PID:11732
- C:\Windows\System\kSqfMXD.exe
  C:\Windows\System\kSqfMXD.exe
  2⤵
  PID:11752
- C:\Windows\System\TZZVrug.exe
  C:\Windows\System\TZZVrug.exe
  2⤵
  PID:11768
- C:\Windows\System\vWRIHYC.exe
  C:\Windows\System\vWRIHYC.exe
  2⤵
  PID:11788
- C:\Windows\System\SSUBveW.exe
  C:\Windows\System\SSUBveW.exe
  2⤵
  PID:11808
- C:\Windows\System\wbbHHRC.exe
  C:\Windows\System\wbbHHRC.exe
  2⤵
  PID:11828
- C:\Windows\System\nCHggQp.exe
  C:\Windows\System\nCHggQp.exe
  2⤵
  PID:11844
- C:\Windows\System\TdDWVFV.exe
  C:\Windows\System\TdDWVFV.exe
  2⤵
  PID:11868
- C:\Windows\System\vCGmozz.exe
  C:\Windows\System\vCGmozz.exe
  2⤵
  PID:11888
- C:\Windows\System\gsNhpBr.exe
  C:\Windows\System\gsNhpBr.exe
  2⤵
  PID:11908
- C:\Windows\System\VhZZhPk.exe
  C:\Windows\System\VhZZhPk.exe
  2⤵
  PID:11928
- C:\Windows\System\LGKlCjw.exe
  C:\Windows\System\LGKlCjw.exe
  2⤵
  PID:11948
- C:\Windows\System\lajAkqL.exe
  C:\Windows\System\lajAkqL.exe
  2⤵
  PID:11968
- C:\Windows\System\VSMOugt.exe
  C:\Windows\System\VSMOugt.exe
  2⤵
  PID:11988
- C:\Windows\System\dLdqLmC.exe
  C:\Windows\System\dLdqLmC.exe
  2⤵
  PID:12008
- C:\Windows\System\RcqifEv.exe
  C:\Windows\System\RcqifEv.exe
  2⤵
  PID:12032
- C:\Windows\System\TkZfkaX.exe
  C:\Windows\System\TkZfkaX.exe
  2⤵
  PID:12056
- C:\Windows\System\ljztdeP.exe
  C:\Windows\System\ljztdeP.exe
  2⤵
  PID:12076
- C:\Windows\System\DJpfYiB.exe
  C:\Windows\System\DJpfYiB.exe
  2⤵
  PID:12108
- C:\Windows\System\TMnzyuI.exe
  C:\Windows\System\TMnzyuI.exe
  2⤵
  PID:12128
- C:\Windows\System\TsnYZhs.exe
  C:\Windows\System\TsnYZhs.exe
  2⤵
  PID:12144
- C:\Windows\System\HhDzJZF.exe
  C:\Windows\System\HhDzJZF.exe
  2⤵
  PID:12168
- C:\Windows\System\sWAoDaP.exe
  C:\Windows\System\sWAoDaP.exe
  2⤵
  PID:12184
- C:\Windows\System\fxHGtkc.exe
  C:\Windows\System\fxHGtkc.exe
  2⤵
  PID:12208
- C:\Windows\System\brXuqNo.exe
  C:\Windows\System\brXuqNo.exe
  2⤵
  PID:12232
- C:\Windows\System\wUSEXlo.exe
  C:\Windows\System\wUSEXlo.exe
  2⤵
  PID:12256
- C:\Windows\System\WWGjXLb.exe
  C:\Windows\System\WWGjXLb.exe
  2⤵
  PID:12272
- C:\Windows\System\cZzwfgC.exe
  C:\Windows\System\cZzwfgC.exe
  2⤵
  PID:1100
- C:\Windows\System\ahkavSl.exe
  C:\Windows\System\ahkavSl.exe
  2⤵
  PID:4056
- C:\Windows\System\eSDRKxK.exe
  C:\Windows\System\eSDRKxK.exe
  2⤵
  PID:9700
- C:\Windows\System\ctwQRBq.exe
  C:\Windows\System\ctwQRBq.exe
  2⤵
  PID:9748
- C:\Windows\System\euNaKkV.exe
  C:\Windows\System\euNaKkV.exe
  2⤵
  PID:8064
- C:\Windows\System\PbSoTjT.exe
  C:\Windows\System\PbSoTjT.exe
  2⤵
  PID:9828
- C:\Windows\System\KMmKvFI.exe
  C:\Windows\System\KMmKvFI.exe
  2⤵
  PID:9856
- C:\Windows\System\WFGgVdg.exe
  C:\Windows\System\WFGgVdg.exe
  2⤵
  PID:9904
- C:\Windows\System\NinIbZy.exe
  C:\Windows\System\NinIbZy.exe
  2⤵
  PID:9960
- C:\Windows\System\HOfOYXl.exe
  C:\Windows\System\HOfOYXl.exe
  2⤵
  PID:10060
- C:\Windows\System\GHXsXuh.exe
  C:\Windows\System\GHXsXuh.exe
  2⤵
  PID:11008
- C:\Windows\System\JRSQTFV.exe
  C:\Windows\System\JRSQTFV.exe
  2⤵
  PID:11076
- C:\Windows\System\LyWrifQ.exe
  C:\Windows\System\LyWrifQ.exe
  2⤵
  PID:10432
- C:\Windows\System\yWVcnKK.exe
  C:\Windows\System\yWVcnKK.exe
  2⤵
  PID:10472
- C:\Windows\System\NAJEjBW.exe
  C:\Windows\System\NAJEjBW.exe
  2⤵
  PID:10224
- C:\Windows\System\TeIKFfA.exe
  C:\Windows\System\TeIKFfA.exe
  2⤵
  PID:8968
- C:\Windows\System\slLwOAm.exe
  C:\Windows\System\slLwOAm.exe
  2⤵
  PID:9060
- C:\Windows\System\ARBBwLJ.exe
  C:\Windows\System\ARBBwLJ.exe
  2⤵
  PID:6024
- C:\Windows\System\NkKtRAE.exe
  C:\Windows\System\NkKtRAE.exe
  2⤵
  PID:7644
- C:\Windows\System\aTkSMqj.exe
  C:\Windows\System\aTkSMqj.exe
  2⤵
  PID:7776
- C:\Windows\System\oEywnGQ.exe
  C:\Windows\System\oEywnGQ.exe
  2⤵
  PID:7668
- C:\Windows\System\YEzzOHs.exe
  C:\Windows\System\YEzzOHs.exe
  2⤵
  PID:3244
- C:\Windows\System\lIJghtr.exe
  C:\Windows\System\lIJghtr.exe
  2⤵
  PID:10184
- C:\Windows\System\uSKifgN.exe
  C:\Windows\System\uSKifgN.exe
  2⤵
  PID:8888
- C:\Windows\System\gPLGgNr.exe
  C:\Windows\System\gPLGgNr.exe
  2⤵
  PID:7036
- C:\Windows\System\XBzjdOI.exe
  C:\Windows\System\XBzjdOI.exe
  2⤵
  PID:4076
- C:\Windows\System\AZBkGZz.exe
  C:\Windows\System\AZBkGZz.exe
  2⤵
  PID:10744
- C:\Windows\System\eKAdxuq.exe
  C:\Windows\System\eKAdxuq.exe
  2⤵
  PID:10656
- C:\Windows\System\UTpkSEL.exe
  C:\Windows\System\UTpkSEL.exe
  2⤵
  PID:9588
- C:\Windows\System\mbdjzlT.exe
  C:\Windows\System\mbdjzlT.exe
  2⤵
  PID:12312
- C:\Windows\System\OmUghfF.exe
  C:\Windows\System\OmUghfF.exe
  2⤵
  PID:12332
- C:\Windows\System\HxXcdHf.exe
  C:\Windows\System\HxXcdHf.exe
  2⤵
  PID:12352
- C:\Windows\System\ZAoInCY.exe
  C:\Windows\System\ZAoInCY.exe
  2⤵
  PID:12372
- C:\Windows\System\LoYoDuq.exe
  C:\Windows\System\LoYoDuq.exe
  2⤵
  PID:12388
- C:\Windows\System\xwLyzWV.exe
  C:\Windows\System\xwLyzWV.exe
  2⤵
  PID:12404
- C:\Windows\System\FlsghSi.exe
  C:\Windows\System\FlsghSi.exe
  2⤵
  PID:12420
- C:\Windows\System\GAHXmVx.exe
  C:\Windows\System\GAHXmVx.exe
  2⤵
  PID:12436
- C:\Windows\System\YFzkwZo.exe
  C:\Windows\System\YFzkwZo.exe
  2⤵
  PID:12456
- C:\Windows\System\sJkiQGd.exe
  C:\Windows\System\sJkiQGd.exe
  2⤵
  PID:12472
- C:\Windows\System\XsEXxYa.exe
  C:\Windows\System\XsEXxYa.exe
  2⤵
  PID:12488
- C:\Windows\System\nPFsShL.exe
  C:\Windows\System\nPFsShL.exe
  2⤵
  PID:12516
- C:\Windows\System\GKbhSye.exe
  C:\Windows\System\GKbhSye.exe
  2⤵
  PID:12552
- C:\Windows\System\vVTeyCa.exe
  C:\Windows\System\vVTeyCa.exe
  2⤵
  PID:12576
- C:\Windows\System\APEIleL.exe
  C:\Windows\System\APEIleL.exe
  2⤵
  PID:12596
- C:\Windows\System\UwyUDFJ.exe
  C:\Windows\System\UwyUDFJ.exe
  2⤵
  PID:12616
- C:\Windows\System\UNtLysl.exe
  C:\Windows\System\UNtLysl.exe
  2⤵
  PID:12632
- C:\Windows\System\YjtRyWe.exe
  C:\Windows\System\YjtRyWe.exe
  2⤵
  PID:12668
- C:\Windows\System\JBlRfkg.exe
  C:\Windows\System\JBlRfkg.exe
  2⤵
  PID:12684
- C:\Windows\System\AeqqteI.exe
  C:\Windows\System\AeqqteI.exe
  2⤵
  PID:12700
- C:\Windows\System\dcSAcVs.exe
  C:\Windows\System\dcSAcVs.exe
  2⤵
  PID:12716
- C:\Windows\System\gLxRYnb.exe
  C:\Windows\System\gLxRYnb.exe
  2⤵
  PID:12732
- C:\Windows\System\MLKUJea.exe
  C:\Windows\System\MLKUJea.exe
  2⤵
  PID:12748
- C:\Windows\System\EvdCyvS.exe
  C:\Windows\System\EvdCyvS.exe
  2⤵
  PID:12776
- C:\Windows\System\gmOfVgI.exe
  C:\Windows\System\gmOfVgI.exe
  2⤵
  PID:12800
- C:\Windows\System\uKfhmaf.exe
  C:\Windows\System\uKfhmaf.exe
  2⤵
  PID:12824
- C:\Windows\System\aVKDBgP.exe
  C:\Windows\System\aVKDBgP.exe
  2⤵
  PID:12848
- C:\Windows\System\TqgVrJG.exe
  C:\Windows\System\TqgVrJG.exe
  2⤵
  PID:12864
- C:\Windows\System\fBOuEme.exe
  C:\Windows\System\fBOuEme.exe
  2⤵
  PID:12884
- C:\Windows\System\FKsLVex.exe
  C:\Windows\System\FKsLVex.exe
  2⤵
  PID:12912
- C:\Windows\System\XDItMIv.exe
  C:\Windows\System\XDItMIv.exe
  2⤵
  PID:12928
- C:\Windows\System\NDtxCwR.exe
  C:\Windows\System\NDtxCwR.exe
  2⤵
  PID:12948
- C:\Windows\System\GRinsEo.exe
  C:\Windows\System\GRinsEo.exe
  2⤵
  PID:12964
- C:\Windows\System\HTLjxQK.exe
  C:\Windows\System\HTLjxQK.exe
  2⤵
  PID:12992
- C:\Windows\System\WAcVTOd.exe
  C:\Windows\System\WAcVTOd.exe
  2⤵
  PID:13016
- C:\Windows\System\oFdZXvx.exe
  C:\Windows\System\oFdZXvx.exe
  2⤵
  PID:13032
- C:\Windows\System\jyqGBNb.exe
  C:\Windows\System\jyqGBNb.exe
  2⤵
  PID:13052
- C:\Windows\System\ZQSmjFx.exe
  C:\Windows\System\ZQSmjFx.exe
  2⤵
  PID:13072
- C:\Windows\System\xjWMsel.exe
  C:\Windows\System\xjWMsel.exe
  2⤵
  PID:13100
- C:\Windows\System\MreGqNI.exe
  C:\Windows\System\MreGqNI.exe
  2⤵
  PID:13124
- C:\Windows\System\VctHzEt.exe
  C:\Windows\System\VctHzEt.exe
  2⤵
  PID:13148
- C:\Windows\System\WWwthkU.exe
  C:\Windows\System\WWwthkU.exe
  2⤵
  PID:13168
- C:\Windows\System\jXTTrfZ.exe
  C:\Windows\System\jXTTrfZ.exe
  2⤵
  PID:13192
- C:\Windows\System\LlNzkSm.exe
  C:\Windows\System\LlNzkSm.exe
  2⤵
  PID:13216
- C:\Windows\System\ysjblTr.exe
  C:\Windows\System\ysjblTr.exe
  2⤵
  PID:13244
- C:\Windows\System\VmLXueO.exe
  C:\Windows\System\VmLXueO.exe
  2⤵
  PID:13260
- C:\Windows\System\XwkoyiV.exe
  C:\Windows\System\XwkoyiV.exe
  2⤵
  PID:13288
- C:\Windows\System\DiUgowQ.exe
  C:\Windows\System\DiUgowQ.exe
  2⤵
  PID:11320
- C:\Windows\System\AIKbrHH.exe
  C:\Windows\System\AIKbrHH.exe
  2⤵
  PID:11552
- C:\Windows\System\MitboPc.exe
  C:\Windows\System\MitboPc.exe
  2⤵
  PID:2016
- C:\Windows\System\qMvBLyx.exe
  C:\Windows\System\qMvBLyx.exe
  2⤵
  PID:10292
- C:\Windows\System\MHglhBT.exe
  C:\Windows\System\MHglhBT.exe
  2⤵
  PID:10312
- C:\Windows\System\bjXsnMi.exe
  C:\Windows\System\bjXsnMi.exe
  2⤵
  PID:10996
- C:\Windows\System\ixJGeDG.exe
  C:\Windows\System\ixJGeDG.exe
  2⤵
  PID:11836
- C:\Windows\System\DcEfhbe.exe
  C:\Windows\System\DcEfhbe.exe
  2⤵
  PID:10460
- C:\Windows\System\mYjuRPI.exe
  C:\Windows\System\mYjuRPI.exe
  2⤵
  PID:12484
- C:\Windows\System\DXzbyup.exe
  C:\Windows\System\DXzbyup.exe
  2⤵
  PID:13176
- C:\Windows\System\WGnZdBf.exe
  C:\Windows\System\WGnZdBf.exe
  2⤵
  PID:5176
- C:\Windows\System\wgCXDqX.exe
  C:\Windows\System\wgCXDqX.exe
  2⤵
  PID:10824
- C:\Windows\System\IrGqffV.exe
  C:\Windows\System\IrGqffV.exe
  2⤵
  PID:12544
- C:\Windows\System\MiFbtnW.exe
  C:\Windows\System\MiFbtnW.exe
  2⤵
  PID:2300
- C:\Windows\System\qiekrBU.exe
  C:\Windows\System\qiekrBU.exe
  2⤵
  PID:12220
- C:\Windows\System\uenYnnW.exe
  C:\Windows\System\uenYnnW.exe
  2⤵
  PID:12360
- C:\Windows\System\XPWEdXh.exe
  C:\Windows\System\XPWEdXh.exe
  2⤵
  PID:11120
- C:\Windows\System\lLeJuvy.exe
  C:\Windows\System\lLeJuvy.exe
  2⤵
  PID:11176
- C:\Windows\System\JXUtLNn.exe
  C:\Windows\System\JXUtLNn.exe
  2⤵
  PID:13092
- C:\Windows\System\JHBJwWb.exe
  C:\Windows\System\JHBJwWb.exe
  2⤵
  PID:11516
- C:\Windows\System\wRNEYqY.exe
  C:\Windows\System\wRNEYqY.exe
  2⤵
  PID:236
- C:\Windows\System\WkYuhVe.exe
  C:\Windows\System\WkYuhVe.exe
  2⤵
  PID:13108
- C:\Windows\System\IfERKVk.exe
  C:\Windows\System\IfERKVk.exe
  2⤵
  PID:1380
- C:\Windows\System\cnSMwkS.exe
  C:\Windows\System\cnSMwkS.exe
  2⤵
  PID:13180
- C:\Windows\System\qHLohrm.exe
  C:\Windows\System\qHLohrm.exe
  2⤵
  PID:13252
- C:\Windows\System\ztAtEAj.exe
  C:\Windows\System\ztAtEAj.exe
  2⤵
  PID:4476
- C:\Windows\System\rmUaZXP.exe
  C:\Windows\System\rmUaZXP.exe
  2⤵
  PID:12504
- C:\Windows\System\JODovrE.exe
  C:\Windows\System\JODovrE.exe
  2⤵
  PID:11464
- C:\Windows\System\PAmIxXb.exe
  C:\Windows\System\PAmIxXb.exe
  2⤵
  PID:8040
- C:\Windows\System\QFHvMWI.exe
  C:\Windows\System\QFHvMWI.exe
  2⤵
  PID:11632
- C:\Windows\System\BJDYPFK.exe
  C:\Windows\System\BJDYPFK.exe
  2⤵
  PID:13284
- C:\Windows\System\lUPVJew.exe
  C:\Windows\System\lUPVJew.exe
  2⤵
  PID:10900
- C:\Windows\System\JzQNwnd.exe
  C:\Windows\System\JzQNwnd.exe
  2⤵
  PID:12896
- C:\Windows\System\nOTIXSC.exe
  C:\Windows\System\nOTIXSC.exe
  2⤵
  PID:2644
- C:\Windows\System\wVFPUVu.exe
  C:\Windows\System\wVFPUVu.exe
  2⤵
  PID:4068
- C:\Windows\System\GGJBVTB.exe
  C:\Windows\System\GGJBVTB.exe
  2⤵
  PID:7848
- C:\Windows\System\rZnyBiQ.exe
  C:\Windows\System\rZnyBiQ.exe
  2⤵
  PID:7792
- C:\Windows\System\hTAHHEt.exe
  C:\Windows\System\hTAHHEt.exe
  2⤵
  PID:10516
- C:\Windows\System\wldvsOd.exe
  C:\Windows\System\wldvsOd.exe
  2⤵
  PID:1824
- C:\Windows\System\kuYoIUi.exe
  C:\Windows\System\kuYoIUi.exe
  2⤵
  PID:11424
- C:\Windows\System\FNnKOGY.exe
  C:\Windows\System\FNnKOGY.exe
  2⤵
  PID:2660
- C:\Windows\System\ZWMCRMc.exe
  C:\Windows\System\ZWMCRMc.exe
  2⤵
  PID:11092
- C:\Windows\System\gItHyOY.exe
  C:\Windows\System\gItHyOY.exe
  2⤵
  PID:11512
- C:\Windows\System\quxuIKC.exe
  C:\Windows\System\quxuIKC.exe
  2⤵
  PID:10216
- C:\Windows\System\ADbftsD.exe
  C:\Windows\System\ADbftsD.exe
  2⤵
  PID:11456
- C:\Windows\System\AhDkojh.exe
  C:\Windows\System\AhDkojh.exe
  2⤵
  PID:12924
- C:\Windows\System\pXEpcXY.exe
  C:\Windows\System\pXEpcXY.exe
  2⤵
  PID:12944
- C:\Windows\System\WrznrtI.exe
  C:\Windows\System\WrznrtI.exe
  2⤵
  PID:12604
- C:\Windows\System\aKmRiBD.exe
  C:\Windows\System\aKmRiBD.exe
  2⤵
  PID:13132
- C:\Windows\System\QDceAPn.exe
  C:\Windows\System\QDceAPn.exe
  2⤵
  PID:1612
- C:\Windows\System\FPQbLBE.exe
  C:\Windows\System\FPQbLBE.exe
  2⤵
  PID:11492
- C:\Windows\System\JTiburg.exe
  C:\Windows\System\JTiburg.exe
  2⤵
  PID:5992
- C:\Windows\System\JObBPtn.exe
  C:\Windows\System\JObBPtn.exe
  2⤵
  PID:2252
- C:\Windows\System\uGhFmpz.exe
  C:\Windows\System\uGhFmpz.exe
  2⤵
  PID:10804
- C:\Windows\System\qbNEEyG.exe
  C:\Windows\System\qbNEEyG.exe
  2⤵
  PID:2756
- C:\Windows\System\IJhkVAs.exe
  C:\Windows\System\IJhkVAs.exe
  2⤵
  PID:3300
- C:\Windows\System\MYgasxa.exe
  C:\Windows\System\MYgasxa.exe
  2⤵
  PID:2904
- C:\Windows\System\vuySXhz.exe
  C:\Windows\System\vuySXhz.exe
  2⤵
  PID:13236
- C:\Windows\System\DmFWTXZ.exe
  C:\Windows\System\DmFWTXZ.exe
  2⤵
  PID:3164
- C:\Windows\System\rqaOEcF.exe
  C:\Windows\System\rqaOEcF.exe
  2⤵
  PID:4196
- C:\Windows\System\BzumOwK.exe
  C:\Windows\System\BzumOwK.exe
  2⤵
  PID:1420
- C:\Windows\System\JPutyVu.exe
  C:\Windows\System\JPutyVu.exe
  2⤵
  PID:1304
- C:\Windows\System\UplcAFn.exe
  C:\Windows\System\UplcAFn.exe
  2⤵
  PID:12536
- C:\Windows\System\xyNTUlk.exe
  C:\Windows\System\xyNTUlk.exe
  2⤵
  PID:11440
- C:\Windows\System\VuoiuTq.exe
  C:\Windows\System\VuoiuTq.exe
  2⤵
  PID:3268
- C:\Windows\System\YQVsiEj.exe
  C:\Windows\System\YQVsiEj.exe
  2⤵
  PID:12304
- C:\Windows\System\yfoPXXR.exe
  C:\Windows\System\yfoPXXR.exe
  2⤵
  PID:4340
- C:\Windows\System\tpPfNxW.exe
  C:\Windows\System\tpPfNxW.exe
  2⤵
  PID:900
- C:\Windows\System\gRLoFqJ.exe
  C:\Windows\System\gRLoFqJ.exe
  2⤵
  PID:10392
- C:\Windows\System\cJKaWtX.exe
  C:\Windows\System\cJKaWtX.exe
  2⤵
  PID:10788
- C:\Windows\System\VkUTRNz.exe
  C:\Windows\System\VkUTRNz.exe
  2⤵
  PID:2800
- C:\Windows\System\rjCKCns.exe
  C:\Windows\System\rjCKCns.exe
  2⤵
  PID:7288
- C:\Windows\System\kCTnxJL.exe
  C:\Windows\System\kCTnxJL.exe
  2⤵
  PID:10720
- C:\Windows\System\QHPcTXT.exe
  C:\Windows\System\QHPcTXT.exe
  2⤵
  PID:7968
- C:\Windows\System\TAjjZuc.exe
  C:\Windows\System\TAjjZuc.exe
  2⤵
  PID:2472
- C:\Windows\System\fxTBSkM.exe
  C:\Windows\System\fxTBSkM.exe
  2⤵
  PID:1944
- C:\Windows\System\YGoglmQ.exe
  C:\Windows\System\YGoglmQ.exe
  2⤵
  PID:8072
- C:\Windows\System\sxVMMRK.exe
  C:\Windows\System\sxVMMRK.exe
  2⤵
  PID:11460
- C:\Windows\System\GAnjYmO.exe
  C:\Windows\System\GAnjYmO.exe
  2⤵
  PID:12664
- C:\Windows\System\JoHwMyn.exe
  C:\Windows\System\JoHwMyn.exe
  2⤵
  PID:13344
- C:\Windows\System\jgUctio.exe
  C:\Windows\System\jgUctio.exe
  2⤵
  PID:13368
- C:\Windows\System\dCtjlSy.exe
  C:\Windows\System\dCtjlSy.exe
  2⤵
  PID:13492
- C:\Windows\System\wVpYxCP.exe
  C:\Windows\System\wVpYxCP.exe
  2⤵
  PID:13508

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 488 -p 11408 -ip 11408
1⤵
PID:11492

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 548 -p 4420 -ip 4420
1⤵
PID:11456

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 644 -p 11176 -ip 11176
1⤵
PID:10804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xmaocawq.r25.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AbhGMWM.exe

Filesize
1.7MB

MD5
c448892ff4f51662e74b37e55ce6c2bb

SHA1
0ffe753cabe8bfa951cf361c64e351c2193bdef1

SHA256
c92345d5e0b48431ec9f156635d1644d6baba93088b4c04900f371ddc7527d1f

SHA512
a0aabc870226a1d09fbf3eeb8c70f2b10b27bc9e0f72d471ca2daf2c0e71d5263cafd31c848d624d53541b0b61db89ca6791ced85b680c451d08c3a9aafa0619

Download Submit
C:\Windows\System\CFyJLvt.exe

Filesize
1.7MB

MD5
d06ed4d1a98e78069db1147861f60959

SHA1
24ad001040411c8a5d44cde3985c2837c96955e6

SHA256
84302fb90aa388d044ac6cca0bb265564a1d12a44079e7b91935ccdec24a0ea2

SHA512
4d51741b81f0a000de4f6c8337b4430e18ff07a71b12e1be754355c6fc4f94f6e9eee5b50948bbeac6828143323f86462f3533c14df1cddf5f0e070f0f5319fc

Download Submit
C:\Windows\System\CcdDRQm.exe

Filesize
1.7MB

MD5
553a5b3baee23d2899203c492e1e0022

SHA1
709b9c7f6e082cc808d1b85c72165b6749c35e28

SHA256
025b33afdfe0a892c8d82ad537897104ea2649eaf6e91f32e278ea4a182e5c43

SHA512
3c91559fbf825aa89bc1659221dc674f7228e2d71f167a3523a0150b623d772bdd751c81a1b9445b58bba4fe02cde15579d95190af5fea51e96f5a8ae6613f42

Download Submit
C:\Windows\System\EiCuBCX.exe

Filesize
1.7MB

MD5
7b6cebd601a951eaee732115844cd2e0

SHA1
384e529337637e11c647bae09b2d423eb67c53eb

SHA256
cffb53c95f7025d7be3e92452be74614004061b6bc2c41df3f62d3962e2da37a

SHA512
bde66f94406b50ad6f5c56ec85b09693ec58eb5e4b44ab2290a897329cb1643e5e4d857d452db1115b85d132fb0a80d4e6ac67e9366f0c6793ed6b6093112238

Download Submit
C:\Windows\System\FyQVwYA.exe

Filesize
1.7MB

MD5
5d59cc1871438f0c9ffb32e2285f0465

SHA1
7b7760f3fb5d31b82eddf120828d35739fbb99a4

SHA256
93d54aff36798234a00f44cb1c6091d580d3998b141cec859b892870af56e143

SHA512
3ff5fcd96b7df7005aba1481bdb5874b1996892a0b21f9cc95a91e53625f9c70dbaf28d7d0d71eca7a653ca9979ccfa12a0e504f3ec4043b08209d4b1e6898de

Download Submit
C:\Windows\System\IbLMoyN.exe

Filesize
1.7MB

MD5
442d2792f8fe03d905dfb46f31dce63b

SHA1
aa51908a9736aeafe7ddde4e1a4a9ba0c65de70f

SHA256
8d2c7b74b7eb606a0d4e6fb3bececb3d6d4bab6c8e61542c01ac5818e3161a6b

SHA512
ad563a8f745794cc98be02b5883b628139bef506b878393711b0a9e62543dbf25eb3db295ccdc67ee65fc240b6ed2d3c43c7cd0cade8effb4b77878f88e52593

Download Submit
C:\Windows\System\KyweObr.exe

Filesize
1.7MB

MD5
0cf1c91d219824582769d5b1451a58b5

SHA1
a6cf2ea4af78f3e10e0ba284920470a1462f857a

SHA256
3a08ad0ae8138bbd982c110da05449152faa4f6ec3983f1e8281f4640f8e63f8

SHA512
c64790967495a045ac38b5b2812eea43ae8509bedde0ae0c42a4107b9a0496b52807a57e86c365facfeaec729f22df5c1874167c78375881a24e641dd982d3d1

Download Submit
C:\Windows\System\MeArRbz.exe

Filesize
1.7MB

MD5
b2c323481247a5752fd87bb26bb8ec53

SHA1
b2e69d61ad643b94ceccc2dc3608025c370a91b0

SHA256
284da2ef92fd8549de295a1ece33123b9074da1f417e42562ebe36cc0442fcca

SHA512
143c56fddf01870d63c797eca3f49c0c6aa5fcef18e2433c391f4cd9ba96be949a16ce02ca030c80088f48bb616c7e575d2cbfda9b9815643c5f19c568eff938

Download Submit
C:\Windows\System\NYZGkoh.exe

Filesize
1.7MB

MD5
8620030cb43e780d3d660f1c4164c584

SHA1
b6fdad23bbae9c3bcc307f27859770b26cf1ad7d

SHA256
ca585b98e807e2f731ce2550f195da12f37ef95e99e9c87104e984027ab96651

SHA512
dc5008335c5ea2a5b49244f653e0f6672d0c1d1a23f7b32e2bd706e9d813b5c4abd5209089ccd878399c901eade872e76821a9c3841c986cdf79f97b8311805c

Download Submit
C:\Windows\System\OClLJKz.exe

Filesize
1.7MB

MD5
e8e0cab9a3be9921d7ed4fa7ef429007

SHA1
eeb347f2426da5567abb9a83f07510be7918de00

SHA256
9ea8f389563ecc587779d23bde863b8752f98611942b57d7d8f6045cdfd15eae

SHA512
581b0589785e0079ea5c5bd0db074e8179ea2a40eb0a1be0054551111c74e15bddfaaeb25bb678399d61b9c3adfd68226084ca8684bcd1ef38238e34d6b6a9b6

Download Submit
C:\Windows\System\PTnBZOl.exe

Filesize
1.7MB

MD5
8741de2d8e6dea0f8f0cea1a07bce022

SHA1
a4446b093ad83aa08b63ee9cb55cf2f31a27bc2c

SHA256
cf68bf180617eb66c0a2dd2a384aaba5bbb0205c31edb1d8bdef8725316a24f4

SHA512
7b7ffcba8177e268bcf06dc00c6451d8e03c3e66e0899523dde2b986692d85995c9a6c39a688cb063b67a8e3be2fe41220ec7c725c021edbb0fa19bf2d4594f8

Download Submit
C:\Windows\System\Pdjesyu.exe

Filesize
1.7MB

MD5
c0a5dfc612a00a6df7081bf00e0cb537

SHA1
b076a43282d73192d63307d1470bc21ae0835184

SHA256
df02a25cfbe04926764f91c5ccb39453cbcf63bf32f943338fcc00b4f4a6a580

SHA512
83d02eb1e2a03c2cfd48e276bd939181ceb2f091cc801e699ddb14fa88426f4e7d3acbcd770108eb636c6bb18f51977c51349a8374a129d49648f00469591329

Download Submit
C:\Windows\System\RPdfgfC.exe

Filesize
1.7MB

MD5
67c9780d2375f3427954a171acea7cd1

SHA1
69516dea5ee88cca7d5b642343ada15a77772301

SHA256
3cfa29b3d5b7bf186749dc11976b425968598935e768a8183086d6cfcfbb89d8

SHA512
43a92551986281b5002336f1d19a822bcf829ac9505851d03948e80225dfbc970abf0e765cbb1c0af4d636bc02aad6113b5f8b5da2f1d0696fd859e78351adc4

Download Submit
C:\Windows\System\SaqYWNa.exe

Filesize
1.7MB

MD5
e5beab2ec6b78a5208e72b5ed5e67231

SHA1
d6d36507ede272df53ed7799ccf02d4381eef8a7

SHA256
c1a6c0b54d2d94f962e7ab7f52afb2a42013782e9de607ca286a13c7d7d79ee1

SHA512
2cb838b6b6ea62f083cc3913601c32dc99b6a448e8038b14c47cc2357fcc493d1ec932ff62600149e02e6e3b865ff4cf6e24aaecdc95a276ee4c363d8306b42f

Download Submit
C:\Windows\System\SdRnYPP.exe

Filesize
1.7MB

MD5
9cd1f445032811a602fea2a591118078

SHA1
4ad6803c499e3970bcb6728bc880ff24b1124086

SHA256
53cf95c6223efe6676d85784ff3d3a5039bace7eeaba11319a49a8c4ceebce01

SHA512
95aeec9a0f44399c2f700928df19efff56ed547d0e804a49de557a079cda4fddb84f28019d842ef131a11726a2f46148f7fabc886bce1d595fd6a2d564ebc83c

Download Submit
C:\Windows\System\SejroDd.exe

Filesize
1.7MB

MD5
4d7c1703fa3b0b06c9a5d2c62f8dc4d4

SHA1
db99e9d494d2eee7600761d2f9764274e659bca0

SHA256
43c99071f6bd934f901adca0ab776b391b001225b8bdc48a38c8c3a6ed6de436

SHA512
ca0ee75f68e5ebc30e174e5a5f3e356f51053fb6e933573a65a5aceaf8b3609dfec3c9fb2be367f06a0a3134833be70830403826dd495905a0bdc5b6e5da8764

Download Submit
C:\Windows\System\TXIERuM.exe

Filesize
1.7MB

MD5
32101775031bed9d21ee4304fab03972

SHA1
07aa4fcaee87fe8f22f982862f1908cd3fcfc3f5

SHA256
fc82ce05df5e572a4fe7c12f4dc43630fb605a4d3f9805c3f232c88ed6dd18f8

SHA512
e8d9b3a25e2c3f8499c33a58aaddf3f2dac005b853b9cc308dcc78225951119abea15f0cc5a701f28d6a9480afccf4d0adb94c1a489f30255e3af55758a2673f

Download Submit
C:\Windows\System\TberFCu.exe

Filesize
1.7MB

MD5
b9e7e905ffa12350c35895ef35a7e42b

SHA1
bcba846e6dcab1578ab2f2bd2b803389c191c5af

SHA256
072626cbca5ec7004d4fe281fffdd4db32a351cc08fae9b2bdf02c64857e1c02

SHA512
79e1301d9baf6088ee43d7d2c6f2bbd6b2c08c8cd60e3ecfce8707bd8de153e8b77886ee3623ed8ce351c8d6c7d2626b6147a0ebf3105cb328aff2d1b81844d9

Download Submit
C:\Windows\System\TxMFMwc.exe

Filesize
1.7MB

MD5
988826639cce66931a04087d856109ff

SHA1
5792e951b3c527ffc1f346b9d9c4ebbf84842512

SHA256
44065e8d51258711e98e52466fa64ed65969a1e00b3961ec0e7bd32bffa497bd

SHA512
427daeac4c294301c7d7a64082821bd38e714ef1df9319e4a58e49432a3d0201c0fe3415357bbff2055c3d1dba8cb93732b011b4d6e06b110584ee4452401a83

Download Submit
C:\Windows\System\TyhrvJP.exe

Filesize
1.7MB

MD5
d5ec7f996673b216adec751b8faa83dd

SHA1
559b7ba5f15d97df3dfc201fafc2dcebde5e400f

SHA256
9e866bf73b4704125454d2eae9fb5bf0bc921a8eb918a74f6e4f36bfe9594e5f

SHA512
e659f1463f315955774d4330807f3be843c254b4ee73fd9defe9eec3dc0023dc2dfa00a29752e032e600472befc5e5bce5b12eed475e73b477aab97d8e0bc52d

Download Submit
C:\Windows\System\URhVuxo.exe

Filesize
1.7MB

MD5
a10bc4666843c3c85f26bf9cf149f7cd

SHA1
07e49701bca9ecc7690e20cca3929e78848abd21

SHA256
d433102cd31584d253f88c57e1d4245e25cacaa81e666ea9ee588e9594dd9942

SHA512
c8a90fc4e359db07896da3f655979cd9b59b317d71fe67dc807dbb039f4afe982e62a7331559d3adc249e870a128332ca961dbda047f0e7f0ec65224b2b91c23

Download Submit
C:\Windows\System\UxmwaIf.exe

Filesize
1.7MB

MD5
31e609ebfec7aaefeb4eb4033efbae75

SHA1
6fbcde7745542fc9ffbbdbbef5d309d19020366c

SHA256
0c58320c0f9d623d979361a424757a90f5c4d6933ea1154a1e5c84d81d3c167d

SHA512
a02ec41b6934e22d0a3609d2b1ed375827c83c50ecfe48c98b0fdc3ea3c881374dcecec7b9256306857aba5e598505a58ae8c7b5fb7ada73ab71de33330ed76f

Download Submit
C:\Windows\System\VMfjbPb.exe

Filesize
1.7MB

MD5
b78cf3fa4b140b23b40778229dd71ddb

SHA1
3f0e35fcbdf90093e3e4266db3e57fc988f2b1bc

SHA256
11b19a0ff45a568f22846815139dcc7c1f17e2277641f69e9080bbdc94ac423f

SHA512
c0324d61d17d69a47b4b7a37e903a64f9d4522ac1e8d5fda257ab77856b6635178bd46ee2fcfde5457ac4765eef8689fc12691765003889ff821b53e52c0a2fd

Download Submit
C:\Windows\System\WtSDliW.exe

Filesize
1.7MB

MD5
9ec43dfa5bc3756f5895f18c476ad072

SHA1
5d64390c3034f21f1a6d2be6ac62823af0005ec1

SHA256
3d4fa3b0a3f4878938cea9b8c4a7013a32130aee51655f8aaee926cc9ddf1262

SHA512
4cdb6f61eb94ed1376ddc274283d8a9ff5182c9a6e29dab8d2ddae70a8fa95f489638107f455b8a06b1eef89215c68cdb11fb542395cbe783516b11f8d903248

Download Submit
C:\Windows\System\XcUiToq.exe

Filesize
1.7MB

MD5
57c57234eedc8e863cbf4d190c127a2e

SHA1
ebd568e2741af3a9d82843bd6bd1c51157884f52

SHA256
117b726a57d55d4f14373d4f860fa1ce1867ee0a1c6fdf40f7d68bfea67aaaeb

SHA512
78e9a264ed1387b33b8dfd221e17ee1c37961f07d7bb827ed02ab2ea60674a173881a5d28cba35618f018a3dde49ef2faf3d6577eadf9317dda9d00204e235a3

Download Submit
C:\Windows\System\YnISlwo.exe

Filesize
1.7MB

MD5
6bcc3dc205cfcd09072abbd807823343

SHA1
14c593123ffb064c10eec56883869f41a23dee13

SHA256
ba9d057756ea7f11c95d4a51cc31d7661336d6e4c46b956cd944ab7c656d2c8d

SHA512
4d58fe67093515f448374314e9bbf6293e157237aaebfdb72dfda6364cf32b3131c8537bb5395610f59f662a3ebde68488775508a6d0a75a729df22d3586d824

Download Submit
C:\Windows\System\ZfWlGkZ.exe

Filesize
1.7MB

MD5
e627ee20b35e831bab5b2e0027020d68

SHA1
89ca908aa3a9868cad3e88c20b871b3a2c89603c

SHA256
12f4c691617bad08732dd1ae48e64f1007d6a2ff33afc674ddbd0e8ab59d9125

SHA512
62407ce5c61314088a3a2ffdb8fb0b1b13c63c38510ef3b078edbc3f362a548cd8b56195161d44b32c10cfca9c033b71d31a39e641b47220fa7e3cd9a9e5483e

Download Submit
C:\Windows\System\gZeynME.exe

Filesize
1.7MB

MD5
db2e96d414d12ab939f0a417dfc339c3

SHA1
5e1020bdafcf32cbab15d6dd6a1cb0dba140afff

SHA256
007ed7e10c7a2c9d08c9db0d2e4b9abf70fc0f716f3e9c456a86089fe705a79c

SHA512
b57e3e5383eb29f31ed68a9dfa9741da2aca7591bc06a1062dbb99a70769e3bb74bd34f44a731328e1b1662b0ddb0809f1fdf6184c3938321d043486a35258b4

Download Submit
C:\Windows\System\jFswKyK.exe

Filesize
1.7MB

MD5
bf237b8e300b7358aa5ba4f4e4c12b72

SHA1
95cdcd329f227f8005107fe9eb63be6e3446e1f0

SHA256
a0813cff8ed4a6d7789a3574e4e3a61db3453857498eca9bbb19a71fb4c2d92b

SHA512
59227467fc3a2dd8017c102dd998d7a627c51a49e02ea3c4af9556cd0a63d21bf9829a3495ce79a6c0ab3222c1de1d3518070b9b6d65b3bd8065893cfacb6465

Download Submit
C:\Windows\System\jJqCZlR.exe

Filesize
1.7MB

MD5
828a60a72853df387d2685f8d17bddf2

SHA1
eb775d8c7a41faa481be971d1b308093995340f5

SHA256
f0698c7f836cc816f729807c9df52de3379a16422d5a65356cfee01668991fa7

SHA512
e08db29db8cf0fa122ab0ccdd782375fb86099cb25bf68e9b3d2ae959f7228615a0e1ecb8bd18fa805225fa1e18ebd780bb996badbd1a0928b0b0ab186579378

Download Submit
C:\Windows\System\kQdDdYL.exe

Filesize
1.7MB

MD5
9efce92b9549026cc4db8cf531509805

SHA1
c22fe1e923b38276bd4c2032d85b756d8603a0af

SHA256
cd4e6dd157917c990f857789931af8a30ace52cfd143057b60ae293da458cb6c

SHA512
6c7f0138aa6c2be4c5b1b8730b7d070154bc41ce1de036d653b14fcb9ba6e23be043b6b99fe3b4c1b9b4bc74f65878d254f39537d22ac89dc37018db3c02ced8

Download Submit
C:\Windows\System\kTaOWRZ.exe

Filesize
1.7MB

MD5
24bdb3d290ee911464ee70d2fb44a1b6

SHA1
d966b19cc68d24daae853c76fdbf6e5b5ace1636

SHA256
bc602c706a27edf5c1f800d5e75d2505186babd254f14cbc8267bfd1f8b6d556

SHA512
fa1850cd10ac8e4ed7947d82ede4625449d99343123986f28c7952ea014205e5c49660aafe6d270ddf24103f2304b346b33395648b6e1f97075ec07dd66a4c8f

Download Submit
C:\Windows\System\krsXVok.exe

Filesize
1.7MB

MD5
b2987b3094cdeb0377ee097373ff6616

SHA1
3a26e14d23c6480ff9ceaa45c5508f55f9fcfbcf

SHA256
5dcb7376bb057aae79e8d4e4d5c74a235ec5388c18442f8ad27f1138fd64db43

SHA512
19504adf10883bd242cc28803f557271692d2a0e3434402eea4c0677b26f255eed43563d7465fb90ca0ae11ea0943437b1d42cfd7755d494ff6bb05dbf61421d

Download Submit
C:\Windows\System\lJVKEGI.exe

Filesize
1.7MB

MD5
e85752a9139d8eb932b6bf56955b8829

SHA1
49f6cebaf04ab4d23365171b940194a6d7c128ef

SHA256
efafc1ddc1c784664cb73b05ebe9437dc63dff8ae2f98b10fb01758a9632ff2a

SHA512
61fe037e8a142c37fdf04505812787285dd63af47f9e10208d8d71b3d5eab8747af32c5e200d12ac1476559c9bf6cdc966d120125e15ec8b252e66f5cd433a02

Download Submit
C:\Windows\System\lLnPpVC.exe

Filesize
1.7MB

MD5
1c57639db82300fe3e3a3039e712f145

SHA1
bfaff5b4db09db1f5ee369ae66fe6d8d2936fd51

SHA256
c9225a5e2be0b4e2ff0b5b191795ecaa5c6ffc0caf29a63043dc5b06b6563d8f

SHA512
f12677643151b6a9c80cfe25105a6ce215c07c57351e46330d8dfea76a533c87dc1ba1c11297459f131eb4d5165950ce8689a4b00a111ea721c0b96995ddb8c5

Download Submit
C:\Windows\System\ndQLrOU.exe

Filesize
1.7MB

MD5
2c38108e2850da5fe89485d2508148df

SHA1
911c819ce52ba96d2b396e6fe725e45a224ade30

SHA256
ca11b49ac35397888a03261a2f031ca0b4141afa20f1b3f084e57dc7d4cb271b

SHA512
c5f0d006296ed87a6753f81ec93049f130eae1d25454c64ce326d03f52b49a870292f1f22c3c14a654af58cc858e82b1949914f09f177a4f914b4e1dd4f0f562

Download Submit
C:\Windows\System\sBEJVYl.exe

Filesize
1.7MB

MD5
bf282b615ecf172ce43f0570898389a9

SHA1
27e0c1850770d7586b218520bda7c03ed7d38fda

SHA256
cc649df4932e5ae1a572000fd44615e5dec1f5b155391c3766300a0855d4edce

SHA512
1d8020c8edefa358d02ce36a94901ed469dbb65b9861c7bf65a77c0f3b20cc2951ee2a430faf18fd715bb33ad7909f59d8c68dfa557c97b32d2037ea12c100fd

Download Submit
C:\Windows\System\tLXlWqm.exe

Filesize
1.7MB

MD5
6cc7df1ef35d7be975fdce8dbc718691

SHA1
d1759b9140a5a50e6949adf1c9da012b675c8a3c

SHA256
fa8c6058bb646c8b29c52123110924e345c1c6eb124d9bc98fccb95fe0b6c7d7

SHA512
dab6238872317ee9672b28bbb8bd7a8eba10f9b87f699a23f7d988897231543beb698fa41f02aedb50db577591a2cec2339e4b66ca4549171db22e089b3500e5

Download Submit
C:\Windows\System\uLWjMfI.exe

Filesize
1.7MB

MD5
82ac3e2fda95b1e08c7becb07c38ec0e

SHA1
ce2739a2570fd090c3492f471cf73eb9b58a1eeb

SHA256
fdce0a33aa981975a83bb3b9eb3d488df2c3bf8bc44f30f8f98b1daba44b7f4f

SHA512
2bed5e9b51f8d9c3ea94de89927b3ec983f35fb31464d1ab8f468cefea52f7c2fe1ba6e7bccf0fca8179aa193c82c935ba2881ef44437fa78a3d6b647549befc

Download Submit
C:\Windows\System\vAKHHfI.exe

Filesize
1.7MB

MD5
09c554302ef953f0fb3e85835bc908fa

SHA1
6d7a42c866e4eadcaf5f46d67b424259531cad36

SHA256
16f53a37bd8fedf0c23e5b15843d12c56b5db29767256501f87bded4f2177034

SHA512
17e2bec8ba8d48e44566b6fea11e2e20943a9ad07b212a84a9cc897a7a99024228f34a21bcd4025fde448b3ef38f8121b9f4f1bab9503e2b34a8caaf4608edd8

Download Submit
C:\Windows\System\vUubkyt.exe

Filesize
1.7MB

MD5
244fef53b97d02c3912c7ca472624281

SHA1
a242d09cccba056781bfad6d2f60966fdc445285

SHA256
5b6e407f18261110d549e2d6c8e73ff226ed968c831fbf83ab8c66d3dd8567a4

SHA512
f2f21432c4467871f9caeb6b458e28889c642350e159c1a2af7cd1d348b1d3ab44d050510fc3af5d8284fa898faef51d7553a06d089632d2e6e904fc3830293a

Download Submit
C:\Windows\System\xaiPyZL.exe

Filesize
1.7MB

MD5
f9c1b6905ab3448c4642ade77b7e6ee9

SHA1
a8905a39bbbae6e1ff2f82843b22fa07fd1167ef

SHA256
da4eadde099d7ada9c819fb4ad5a5abb58df4597bd3ac6214891e2afa6a8693f

SHA512
1ed5ffa8cc07c9bc90d05ce41bd039e7faabc19a76d42174703f3549251901c64219f1ab177cadcfe7a8b3fa02c7f16b7b5d64d85a649898703f8d4cadc6fd9a

Download Submit
C:\Windows\System\ybYlKIe.exe

Filesize
8B

MD5
20f50227b408431507e9e4298a89a7d5

SHA1
021be5cef03ca413a261257f3fa674d51e4eaecb

SHA256
f053af72ebaae8c20b4aa760dccbaa50d5e8c1b0612207e6dff562e592b0ee16

SHA512
a69e9f155961cdfb2c580f410cf1f9148255cadde0f420c64800ffc84ebbf2c4fc4d8c24eda7cee14ae357ad0398853cbe4f84f9db0bb9573e1f43351f2da9c0

Download Submit
memory/400-305-0x00007FF6E0760000-0x00007FF6E0B52000-memory.dmp

Filesize
3.9MB

Download
memory/400-2450-0x00007FF6E0760000-0x00007FF6E0B52000-memory.dmp

Filesize
3.9MB

Download
memory/640-2490-0x00007FF7F2140000-0x00007FF7F2532000-memory.dmp

Filesize
3.9MB

Download
memory/640-622-0x00007FF7F2140000-0x00007FF7F2532000-memory.dmp

Filesize
3.9MB

Download
memory/872-2470-0x00007FF7B3830000-0x00007FF7B3C22000-memory.dmp

Filesize
3.9MB

Download
memory/872-617-0x00007FF7B3830000-0x00007FF7B3C22000-memory.dmp

Filesize
3.9MB

Download
memory/1424-613-0x00007FF602850000-0x00007FF602C42000-memory.dmp

Filesize
3.9MB

Download
memory/1424-2474-0x00007FF602850000-0x00007FF602C42000-memory.dmp

Filesize
3.9MB

Download
memory/1572-2467-0x00007FF64E870000-0x00007FF64EC62000-memory.dmp

Filesize
3.9MB

Download
memory/1572-618-0x00007FF64E870000-0x00007FF64EC62000-memory.dmp

Filesize
3.9MB

Download
memory/1952-2472-0x00007FF650300000-0x00007FF6506F2000-memory.dmp

Filesize
3.9MB

Download
memory/1952-616-0x00007FF650300000-0x00007FF6506F2000-memory.dmp

Filesize
3.9MB

Download
memory/2420-2488-0x00007FF70F4E0000-0x00007FF70F8D2000-memory.dmp

Filesize
3.9MB

Download
memory/2420-238-0x00007FF70F4E0000-0x00007FF70F8D2000-memory.dmp

Filesize
3.9MB

Download
memory/2484-2448-0x00007FF796CD0000-0x00007FF7970C2000-memory.dmp

Filesize
3.9MB

Download
memory/2484-210-0x00007FF796CD0000-0x00007FF7970C2000-memory.dmp

Filesize
3.9MB

Download
memory/2548-2478-0x00007FF7A1990000-0x00007FF7A1D82000-memory.dmp

Filesize
3.9MB

Download
memory/2548-479-0x00007FF7A1990000-0x00007FF7A1D82000-memory.dmp

Filesize
3.9MB

Download
memory/2700-2452-0x00007FF75C1D0000-0x00007FF75C5C2000-memory.dmp

Filesize
3.9MB

Download
memory/2700-623-0x00007FF75C1D0000-0x00007FF75C5C2000-memory.dmp

Filesize
3.9MB

Download
memory/2860-417-0x00007FF75C360000-0x00007FF75C752000-memory.dmp

Filesize
3.9MB

Download
memory/2860-2483-0x00007FF75C360000-0x00007FF75C752000-memory.dmp

Filesize
3.9MB

Download
memory/2868-14-0x00007FF6A0920000-0x00007FF6A0D12000-memory.dmp

Filesize
3.9MB

Download
memory/2868-2391-0x00007FF6A0920000-0x00007FF6A0D12000-memory.dmp

Filesize
3.9MB

Download
memory/2868-2426-0x00007FF6A0920000-0x00007FF6A0D12000-memory.dmp

Filesize
3.9MB

Download
memory/2924-624-0x00007FF6D04B0000-0x00007FF6D08A2000-memory.dmp

Filesize
3.9MB

Download
memory/2924-2454-0x00007FF6D04B0000-0x00007FF6D08A2000-memory.dmp

Filesize
3.9MB

Download
memory/2996-61-0x00007FF767140000-0x00007FF767532000-memory.dmp

Filesize
3.9MB

Download
memory/2996-2392-0x00007FF767140000-0x00007FF767532000-memory.dmp

Filesize
3.9MB

Download
memory/2996-2432-0x00007FF767140000-0x00007FF767532000-memory.dmp

Filesize
3.9MB

Download
memory/3140-2437-0x00007FF6CC810000-0x00007FF6CCC02000-memory.dmp

Filesize
3.9MB

Download
memory/3140-101-0x00007FF6CC810000-0x00007FF6CCC02000-memory.dmp

Filesize
3.9MB

Download
memory/3192-2464-0x00007FF6C3CE0000-0x00007FF6C40D2000-memory.dmp

Filesize
3.9MB

Download
memory/3192-619-0x00007FF6C3CE0000-0x00007FF6C40D2000-memory.dmp

Filesize
3.9MB

Download
memory/3416-625-0x00007FF7EAB20000-0x00007FF7EAF12000-memory.dmp

Filesize
3.9MB

Download
memory/3416-2458-0x00007FF7EAB20000-0x00007FF7EAF12000-memory.dmp

Filesize
3.9MB

Download
memory/3464-16-0x000001A35E460000-0x000001A35E470000-memory.dmp

Filesize
64KB

Download
memory/3464-15-0x000001A35E460000-0x000001A35E470000-memory.dmp

Filesize
64KB

Download
memory/3464-17-0x00007FFE009D3000-0x00007FFE009D5000-memory.dmp

Filesize
8KB

Download
memory/3464-260-0x000001A35E3A0000-0x000001A35E3C2000-memory.dmp

Filesize
136KB

Download
memory/3624-2440-0x00007FF6B55A0000-0x00007FF6B5992000-memory.dmp

Filesize
3.9MB

Download
memory/3624-110-0x00007FF6B55A0000-0x00007FF6B5992000-memory.dmp

Filesize
3.9MB

Download
memory/3660-621-0x00007FF7DEBF0000-0x00007FF7DEFE2000-memory.dmp

Filesize
3.9MB

Download
memory/3660-2460-0x00007FF7DEBF0000-0x00007FF7DEFE2000-memory.dmp

Filesize
3.9MB

Download
memory/3688-1-0x000001EA6A980000-0x000001EA6A990000-memory.dmp

Filesize
64KB

Download
memory/3688-0-0x00007FF7182F0000-0x00007FF7186E2000-memory.dmp

Filesize
3.9MB

Download
memory/3860-2482-0x00007FF62A020000-0x00007FF62A412000-memory.dmp

Filesize
3.9MB

Download
memory/3860-364-0x00007FF62A020000-0x00007FF62A412000-memory.dmp

Filesize
3.9MB

Download
memory/4088-2480-0x00007FF683D90000-0x00007FF684182000-memory.dmp

Filesize
3.9MB

Download
memory/4088-368-0x00007FF683D90000-0x00007FF684182000-memory.dmp

Filesize
3.9MB

Download
memory/4256-167-0x00007FF6D5550000-0x00007FF6D5942000-memory.dmp

Filesize
3.9MB

Download
memory/4256-2443-0x00007FF6D5550000-0x00007FF6D5942000-memory.dmp

Filesize
3.9MB

Download
memory/4924-2476-0x00007FF6B5860000-0x00007FF6B5C52000-memory.dmp

Filesize
3.9MB

Download
memory/4924-585-0x00007FF6B5860000-0x00007FF6B5C52000-memory.dmp

Filesize
3.9MB

Download
memory/4980-620-0x00007FF668220000-0x00007FF668612000-memory.dmp

Filesize
3.9MB

Download
memory/4980-2462-0x00007FF668220000-0x00007FF668612000-memory.dmp

Filesize
3.9MB

Download