xmrig | 89c2239fbf6b8c3ed3e9a6da55fe0138495dd09101aa1b58f2677357bd615503

Analysis

max time kernel
116s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04-05-2024 15:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
Size

2.4MB
MD5

13525010260f506b65997c2676fb19d3
SHA1

27a29e9e1f4d44fe7bcde633a35f0ee4862f53ff
SHA256

89c2239fbf6b8c3ed3e9a6da55fe0138495dd09101aa1b58f2677357bd615503
SHA512

9e73e4838525657b403db76757c551bbc0b02e9e419ba187327f96e32d1eebaedd15936f836c3f4edd16dfaa3278a9138256fdbc48ec184ebc676f5c77d73795
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9cRbsv:NAB2

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 47 IoCs

miner

resource	yara_rule
behavioral2/memory/1384-240-0x00007FF758C80000-0x00007FF759072000-memory.dmp	xmrig
behavioral2/memory/400-285-0x00007FF788500000-0x00007FF7888F2000-memory.dmp	xmrig
behavioral2/memory/2340-294-0x00007FF65D620000-0x00007FF65DA12000-memory.dmp	xmrig
behavioral2/memory/1868-316-0x00007FF7171A0000-0x00007FF717592000-memory.dmp	xmrig
behavioral2/memory/2008-338-0x00007FF627B20000-0x00007FF627F12000-memory.dmp	xmrig
behavioral2/memory/2680-346-0x00007FF73BD10000-0x00007FF73C102000-memory.dmp	xmrig
behavioral2/memory/1584-349-0x00007FF6EB820000-0x00007FF6EBC12000-memory.dmp	xmrig
behavioral2/memory/4820-348-0x00007FF749DC0000-0x00007FF74A1B2000-memory.dmp	xmrig
behavioral2/memory/1624-347-0x00007FF64D850000-0x00007FF64DC42000-memory.dmp	xmrig
behavioral2/memory/4560-345-0x00007FF6FAD10000-0x00007FF6FB102000-memory.dmp	xmrig
behavioral2/memory/4376-344-0x00007FF670BC0000-0x00007FF670FB2000-memory.dmp	xmrig
behavioral2/memory/2560-343-0x00007FF6E1820000-0x00007FF6E1C12000-memory.dmp	xmrig
behavioral2/memory/2000-342-0x00007FF707900000-0x00007FF707CF2000-memory.dmp	xmrig
behavioral2/memory/4332-340-0x00007FF69A1F0000-0x00007FF69A5E2000-memory.dmp	xmrig
behavioral2/memory/1044-311-0x00007FF7B5590000-0x00007FF7B5982000-memory.dmp	xmrig
behavioral2/memory/8-282-0x00007FF64D340000-0x00007FF64D732000-memory.dmp	xmrig
behavioral2/memory/4432-281-0x00007FF6A47C0000-0x00007FF6A4BB2000-memory.dmp	xmrig
behavioral2/memory/3988-266-0x00007FF64B4A0000-0x00007FF64B892000-memory.dmp	xmrig
behavioral2/memory/744-218-0x00007FF6AEA40000-0x00007FF6AEE32000-memory.dmp	xmrig
behavioral2/memory/1788-215-0x00007FF78E400000-0x00007FF78E7F2000-memory.dmp	xmrig
behavioral2/memory/924-208-0x00007FF7F8FE0000-0x00007FF7F93D2000-memory.dmp	xmrig
behavioral2/memory/4188-159-0x00007FF68EA70000-0x00007FF68EE62000-memory.dmp	xmrig
behavioral2/memory/3248-106-0x00007FF7154F0000-0x00007FF7158E2000-memory.dmp	xmrig
behavioral2/memory/4264-4123-0x00007FF62D780000-0x00007FF62DB72000-memory.dmp	xmrig
behavioral2/memory/4188-4127-0x00007FF68EA70000-0x00007FF68EE62000-memory.dmp	xmrig
behavioral2/memory/2680-4126-0x00007FF73BD10000-0x00007FF73C102000-memory.dmp	xmrig
behavioral2/memory/3248-4129-0x00007FF7154F0000-0x00007FF7158E2000-memory.dmp	xmrig
behavioral2/memory/924-4131-0x00007FF7F8FE0000-0x00007FF7F93D2000-memory.dmp	xmrig
behavioral2/memory/1788-4139-0x00007FF78E400000-0x00007FF78E7F2000-memory.dmp	xmrig
behavioral2/memory/1384-4144-0x00007FF758C80000-0x00007FF759072000-memory.dmp	xmrig
behavioral2/memory/4432-4151-0x00007FF6A47C0000-0x00007FF6A4BB2000-memory.dmp	xmrig
behavioral2/memory/4820-4155-0x00007FF749DC0000-0x00007FF74A1B2000-memory.dmp	xmrig
behavioral2/memory/2340-4153-0x00007FF65D620000-0x00007FF65DA12000-memory.dmp	xmrig
behavioral2/memory/1044-4149-0x00007FF7B5590000-0x00007FF7B5982000-memory.dmp	xmrig
behavioral2/memory/1868-4148-0x00007FF7171A0000-0x00007FF717592000-memory.dmp	xmrig
behavioral2/memory/1624-4143-0x00007FF64D850000-0x00007FF64DC42000-memory.dmp	xmrig
behavioral2/memory/3988-4141-0x00007FF64B4A0000-0x00007FF64B892000-memory.dmp	xmrig
behavioral2/memory/744-4137-0x00007FF6AEA40000-0x00007FF6AEE32000-memory.dmp	xmrig
behavioral2/memory/400-4146-0x00007FF788500000-0x00007FF7888F2000-memory.dmp	xmrig
behavioral2/memory/8-4135-0x00007FF64D340000-0x00007FF64D732000-memory.dmp	xmrig
behavioral2/memory/4560-4170-0x00007FF6FAD10000-0x00007FF6FB102000-memory.dmp	xmrig
behavioral2/memory/1584-4169-0x00007FF6EB820000-0x00007FF6EBC12000-memory.dmp	xmrig
behavioral2/memory/2008-4167-0x00007FF627B20000-0x00007FF627F12000-memory.dmp	xmrig
behavioral2/memory/2560-4163-0x00007FF6E1820000-0x00007FF6E1C12000-memory.dmp	xmrig
behavioral2/memory/4332-4165-0x00007FF69A1F0000-0x00007FF69A5E2000-memory.dmp	xmrig
behavioral2/memory/4376-4176-0x00007FF670BC0000-0x00007FF670FB2000-memory.dmp	xmrig
behavioral2/memory/2000-4174-0x00007FF707900000-0x00007FF707CF2000-memory.dmp	xmrig

Blocklisted process makes network request 7 IoCs

flow	pid	Process
5	4000	powershell.exe
9	4000	powershell.exe
11	4000	powershell.exe
12	4000	powershell.exe
14	4000	powershell.exe
15	4000	powershell.exe
16	4000	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4000	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4264	MkCSkkh.exe
2680	DthxCMd.exe
3248	RPYZOBL.exe
4188	xSYkeEp.exe
924	OiQnYHf.exe
1788	EQZxnjm.exe
744	kwvOwBC.exe
1384	SFZFviC.exe
3988	qqSkFop.exe
4432	GGzMEgy.exe
1624	vELiQIU.exe
8	LnYRyrq.exe
400	NMSMjWH.exe
2340	vSniujc.exe
1044	VblaGcF.exe
1868	xaNyiUb.exe
4820	UppxEFd.exe
2008	qZJDJjJ.exe
4332	OAZQmvl.exe
2000	kGYVifv.exe
2560	gtieoPe.exe
4376	GxPKoml.exe
1584	LDhtEVf.exe
4560	PMhhZHo.exe
460	RdXlSOw.exe
4960	qiOjavD.exe
760	GfONrjz.exe
1240	ztbWEgF.exe
4100	lEiJOAT.exe
3100	MHBviIe.exe
1284	DnhHabj.exe
3656	IWweZit.exe
2032	DIQqVrJ.exe
3124	DTRAfNi.exe
3536	tJswDwS.exe
3484	PeHaFAB.exe
3788	OJUmWSm.exe
4476	PZdHxTC.exe
2504	aNVdkxE.exe
3736	LcKroHg.exe
4812	AKntztc.exe
1320	gfxMels.exe
5020	cIEXGIB.exe
4152	VdnFOQG.exe
4340	fcixPnB.exe
548	wizlmDU.exe
3020	enKffYq.exe
3632	tTZEsSb.exe
2700	AuIQooI.exe
4368	OFmffMB.exe
624	cZTHATt.exe
4668	AorYERP.exe
4556	oXTNjgk.exe
4284	CVRlOKw.exe
1392	GhmOSJu.exe
1600	wnIOkBF.exe
1236	PwthCjG.exe
2308	PoqGGDU.exe
2628	pQQSjam.exe
532	sGqhqaa.exe
4972	HBFKUkp.exe
1428	gypTqZV.exe
748	ORonuIq.exe
1692	HdodDJg.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2928-0-0x00007FF701C50000-0x00007FF702042000-memory.dmp	upx
behavioral2/files/0x000c000000023ba8-5.dat	upx
behavioral2/files/0x000a000000023bb0-9.dat	upx
behavioral2/memory/4264-12-0x00007FF62D780000-0x00007FF62DB72000-memory.dmp	upx
behavioral2/files/0x000a000000023bb2-21.dat	upx
behavioral2/files/0x000a000000023bba-58.dat	upx
behavioral2/files/0x000a000000023bb4-57.dat	upx
behavioral2/files/0x0031000000023bb7-76.dat	upx
behavioral2/files/0x000a000000023bc4-125.dat	upx
behavioral2/files/0x000a000000023bcd-164.dat	upx
behavioral2/files/0x000a000000023bca-197.dat	upx
behavioral2/memory/1384-240-0x00007FF758C80000-0x00007FF759072000-memory.dmp	upx
behavioral2/memory/400-285-0x00007FF788500000-0x00007FF7888F2000-memory.dmp	upx
behavioral2/memory/2340-294-0x00007FF65D620000-0x00007FF65DA12000-memory.dmp	upx
behavioral2/memory/1868-316-0x00007FF7171A0000-0x00007FF717592000-memory.dmp	upx
behavioral2/memory/2008-338-0x00007FF627B20000-0x00007FF627F12000-memory.dmp	upx
behavioral2/memory/2680-346-0x00007FF73BD10000-0x00007FF73C102000-memory.dmp	upx
behavioral2/memory/1584-349-0x00007FF6EB820000-0x00007FF6EBC12000-memory.dmp	upx
behavioral2/memory/4820-348-0x00007FF749DC0000-0x00007FF74A1B2000-memory.dmp	upx
behavioral2/memory/1624-347-0x00007FF64D850000-0x00007FF64DC42000-memory.dmp	upx
behavioral2/memory/4560-345-0x00007FF6FAD10000-0x00007FF6FB102000-memory.dmp	upx
behavioral2/memory/4376-344-0x00007FF670BC0000-0x00007FF670FB2000-memory.dmp	upx
behavioral2/memory/2560-343-0x00007FF6E1820000-0x00007FF6E1C12000-memory.dmp	upx
behavioral2/memory/2000-342-0x00007FF707900000-0x00007FF707CF2000-memory.dmp	upx
behavioral2/memory/4332-340-0x00007FF69A1F0000-0x00007FF69A5E2000-memory.dmp	upx
behavioral2/memory/1044-311-0x00007FF7B5590000-0x00007FF7B5982000-memory.dmp	upx
behavioral2/memory/8-282-0x00007FF64D340000-0x00007FF64D732000-memory.dmp	upx
behavioral2/memory/4432-281-0x00007FF6A47C0000-0x00007FF6A4BB2000-memory.dmp	upx
behavioral2/memory/3988-266-0x00007FF64B4A0000-0x00007FF64B892000-memory.dmp	upx
behavioral2/memory/744-218-0x00007FF6AEA40000-0x00007FF6AEE32000-memory.dmp	upx
behavioral2/memory/1788-215-0x00007FF78E400000-0x00007FF78E7F2000-memory.dmp	upx
behavioral2/memory/924-208-0x00007FF7F8FE0000-0x00007FF7F93D2000-memory.dmp	upx
behavioral2/files/0x000a000000023bcc-194.dat	upx
behavioral2/files/0x000a000000023bc7-192.dat	upx
behavioral2/files/0x000a000000023bd2-186.dat	upx
behavioral2/files/0x000a000000023bc5-184.dat	upx
behavioral2/files/0x000a000000023bd1-183.dat	upx
behavioral2/files/0x000a000000023bd0-182.dat	upx
behavioral2/files/0x000a000000023bcf-181.dat	upx
behavioral2/files/0x000a000000023bc6-176.dat	upx
behavioral2/files/0x000a000000023bc2-175.dat	upx
behavioral2/files/0x000a000000023bce-167.dat	upx
behavioral2/files/0x000b000000023bc9-161.dat	upx
behavioral2/files/0x000c000000023bac-155.dat	upx
behavioral2/files/0x000a000000023bc3-147.dat	upx
behavioral2/files/0x000a000000023bc1-146.dat	upx
behavioral2/files/0x000a000000023bcb-143.dat	upx
behavioral2/memory/4188-159-0x00007FF68EA70000-0x00007FF68EE62000-memory.dmp	upx
behavioral2/files/0x000a000000023bbf-132.dat	upx
behavioral2/files/0x000a000000023bbe-129.dat	upx
behavioral2/files/0x000a000000023bc0-134.dat	upx
behavioral2/files/0x000a000000023bbb-107.dat	upx
behavioral2/memory/3248-106-0x00007FF7154F0000-0x00007FF7158E2000-memory.dmp	upx
behavioral2/files/0x000a000000023bbd-102.dat	upx
behavioral2/files/0x000a000000023bb9-90.dat	upx
behavioral2/files/0x000a000000023bbc-84.dat	upx
behavioral2/files/0x0031000000023bb6-71.dat	upx
behavioral2/files/0x000a000000023bb5-67.dat	upx
behavioral2/files/0x0031000000023bb8-62.dat	upx
behavioral2/files/0x000a000000023bb3-56.dat	upx
behavioral2/files/0x000a000000023bb1-25.dat	upx
behavioral2/files/0x000a000000023baf-22.dat	upx
behavioral2/memory/4264-4123-0x00007FF62D780000-0x00007FF62DB72000-memory.dmp	upx
behavioral2/memory/4188-4127-0x00007FF68EA70000-0x00007FF68EE62000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
5	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\OAWpRgW.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\FnmJZeU.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\XbjNMWG.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\NqHxFhD.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\BxzWKUG.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\UFDcYFD.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\mYUnDaF.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\JOxohNX.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\BXdYzif.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\sQtXxXL.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\GfHrDpp.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\iUgvDBA.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\isnARwX.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\sXbCtoq.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\TmkujAG.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\zJPnBUT.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\HYyOLwt.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\AxsncVM.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\FjWkVQU.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\zXjSyDN.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\ksFDxFf.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\tAurxEE.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\ZZUNlDE.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\ZaRNCot.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\YOcosSj.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\jlhGUTA.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\MNfwOYM.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\wEmcAoJ.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\eXldHtB.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\VjvgtDO.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\BygTaqp.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\CxDwYvW.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\cXQsgJP.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\CRaApuS.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\zYkNRyn.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\AnIKLxA.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\BYbHrIG.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\DSEwwBt.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\UEASSiF.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\vaehVlP.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\JpJppan.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\kWOFPUA.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\BpQRDNc.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\xfPvoxJ.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\ifjtcqV.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\cNIJHos.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\wmZuJrX.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\dfiwkYX.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\huFfzcf.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\qqwQVCd.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\XVjHbKM.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\plznCSA.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\BAYfJle.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\LhDtazg.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\XubvemZ.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\HboXAXZ.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\Vgwaenu.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\ZzWTzed.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\kueCXYr.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\LHQgnSg.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\ixAtjZZ.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\aSvJBXP.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\sQFGSjL.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\KlAWrjm.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4000	powershell.exe
4000	powershell.exe
4000	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
Token: SeDebugPrivilege	4000	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 4000	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	84
PID 2928 wrote to memory of 4000	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	84
PID 2928 wrote to memory of 4264	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	85
PID 2928 wrote to memory of 4264	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	85
PID 2928 wrote to memory of 2680	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	86
PID 2928 wrote to memory of 2680	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	86
PID 2928 wrote to memory of 3248	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	87
PID 2928 wrote to memory of 3248	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	87
PID 2928 wrote to memory of 4188	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	88
PID 2928 wrote to memory of 4188	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	88
PID 2928 wrote to memory of 924	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	89
PID 2928 wrote to memory of 924	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	89
PID 2928 wrote to memory of 1788	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	90
PID 2928 wrote to memory of 1788	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	90
PID 2928 wrote to memory of 744	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	91
PID 2928 wrote to memory of 744	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	91
PID 2928 wrote to memory of 1384	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	92
PID 2928 wrote to memory of 1384	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	92
PID 2928 wrote to memory of 3988	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	93
PID 2928 wrote to memory of 3988	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	93
PID 2928 wrote to memory of 4432	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	94
PID 2928 wrote to memory of 4432	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	94
PID 2928 wrote to memory of 1624	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	95
PID 2928 wrote to memory of 1624	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	95
PID 2928 wrote to memory of 8	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	96
PID 2928 wrote to memory of 8	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	96
PID 2928 wrote to memory of 400	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	97
PID 2928 wrote to memory of 400	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	97
PID 2928 wrote to memory of 2340	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	98
PID 2928 wrote to memory of 2340	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	98
PID 2928 wrote to memory of 1044	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	99
PID 2928 wrote to memory of 1044	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	99
PID 2928 wrote to memory of 1868	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	100
PID 2928 wrote to memory of 1868	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	100
PID 2928 wrote to memory of 4820	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	101
PID 2928 wrote to memory of 4820	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	101
PID 2928 wrote to memory of 2008	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	102
PID 2928 wrote to memory of 2008	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	102
PID 2928 wrote to memory of 4332	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	103
PID 2928 wrote to memory of 4332	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	103
PID 2928 wrote to memory of 2000	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	104
PID 2928 wrote to memory of 2000	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	104
PID 2928 wrote to memory of 2560	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	105
PID 2928 wrote to memory of 2560	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	105
PID 2928 wrote to memory of 4376	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	106
PID 2928 wrote to memory of 4376	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	106
PID 2928 wrote to memory of 4560	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	107
PID 2928 wrote to memory of 4560	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	107
PID 2928 wrote to memory of 1584	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	108
PID 2928 wrote to memory of 1584	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	108
PID 2928 wrote to memory of 460	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	109
PID 2928 wrote to memory of 460	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	109
PID 2928 wrote to memory of 4960	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	110
PID 2928 wrote to memory of 4960	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	110
PID 2928 wrote to memory of 760	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	111
PID 2928 wrote to memory of 760	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	111
PID 2928 wrote to memory of 1240	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	112
PID 2928 wrote to memory of 1240	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	112
PID 2928 wrote to memory of 4100	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	113
PID 2928 wrote to memory of 4100	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	113
PID 2928 wrote to memory of 3788	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	114
PID 2928 wrote to memory of 3788	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	114
PID 2928 wrote to memory of 3100	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	115
PID 2928 wrote to memory of 3100	2928	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\13525010260f506b65997c2676fb19d3_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4000
- C:\Windows\System\MkCSkkh.exe
  C:\Windows\System\MkCSkkh.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\DthxCMd.exe
  C:\Windows\System\DthxCMd.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\RPYZOBL.exe
  C:\Windows\System\RPYZOBL.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\xSYkeEp.exe
  C:\Windows\System\xSYkeEp.exe
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Windows\System\OiQnYHf.exe
  C:\Windows\System\OiQnYHf.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\EQZxnjm.exe
  C:\Windows\System\EQZxnjm.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\kwvOwBC.exe
  C:\Windows\System\kwvOwBC.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\SFZFviC.exe
  C:\Windows\System\SFZFviC.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\qqSkFop.exe
  C:\Windows\System\qqSkFop.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\GGzMEgy.exe
  C:\Windows\System\GGzMEgy.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\vELiQIU.exe
  C:\Windows\System\vELiQIU.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\LnYRyrq.exe
  C:\Windows\System\LnYRyrq.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\NMSMjWH.exe
  C:\Windows\System\NMSMjWH.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\vSniujc.exe
  C:\Windows\System\vSniujc.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\VblaGcF.exe
  C:\Windows\System\VblaGcF.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\xaNyiUb.exe
  C:\Windows\System\xaNyiUb.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\UppxEFd.exe
  C:\Windows\System\UppxEFd.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\qZJDJjJ.exe
  C:\Windows\System\qZJDJjJ.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\OAZQmvl.exe
  C:\Windows\System\OAZQmvl.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\kGYVifv.exe
  C:\Windows\System\kGYVifv.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\gtieoPe.exe
  C:\Windows\System\gtieoPe.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\GxPKoml.exe
  C:\Windows\System\GxPKoml.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\PMhhZHo.exe
  C:\Windows\System\PMhhZHo.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\LDhtEVf.exe
  C:\Windows\System\LDhtEVf.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\RdXlSOw.exe
  C:\Windows\System\RdXlSOw.exe
  2⤵
  - Executes dropped EXE
  PID:460
- C:\Windows\System\qiOjavD.exe
  C:\Windows\System\qiOjavD.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\GfONrjz.exe
  C:\Windows\System\GfONrjz.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\ztbWEgF.exe
  C:\Windows\System\ztbWEgF.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\lEiJOAT.exe
  C:\Windows\System\lEiJOAT.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\OJUmWSm.exe
  C:\Windows\System\OJUmWSm.exe
  2⤵
  - Executes dropped EXE
  PID:3788
- C:\Windows\System\MHBviIe.exe
  C:\Windows\System\MHBviIe.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\DnhHabj.exe
  C:\Windows\System\DnhHabj.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\IWweZit.exe
  C:\Windows\System\IWweZit.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\DIQqVrJ.exe
  C:\Windows\System\DIQqVrJ.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\DTRAfNi.exe
  C:\Windows\System\DTRAfNi.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\tJswDwS.exe
  C:\Windows\System\tJswDwS.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\PeHaFAB.exe
  C:\Windows\System\PeHaFAB.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\PZdHxTC.exe
  C:\Windows\System\PZdHxTC.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\aNVdkxE.exe
  C:\Windows\System\aNVdkxE.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\LcKroHg.exe
  C:\Windows\System\LcKroHg.exe
  2⤵
  - Executes dropped EXE
  PID:3736
- C:\Windows\System\AKntztc.exe
  C:\Windows\System\AKntztc.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\gfxMels.exe
  C:\Windows\System\gfxMels.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\cIEXGIB.exe
  C:\Windows\System\cIEXGIB.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\VdnFOQG.exe
  C:\Windows\System\VdnFOQG.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\fcixPnB.exe
  C:\Windows\System\fcixPnB.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\wizlmDU.exe
  C:\Windows\System\wizlmDU.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\enKffYq.exe
  C:\Windows\System\enKffYq.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\tTZEsSb.exe
  C:\Windows\System\tTZEsSb.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\AuIQooI.exe
  C:\Windows\System\AuIQooI.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\OFmffMB.exe
  C:\Windows\System\OFmffMB.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\cZTHATt.exe
  C:\Windows\System\cZTHATt.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\AorYERP.exe
  C:\Windows\System\AorYERP.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\oXTNjgk.exe
  C:\Windows\System\oXTNjgk.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\CVRlOKw.exe
  C:\Windows\System\CVRlOKw.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\GhmOSJu.exe
  C:\Windows\System\GhmOSJu.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\wnIOkBF.exe
  C:\Windows\System\wnIOkBF.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\PwthCjG.exe
  C:\Windows\System\PwthCjG.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\PoqGGDU.exe
  C:\Windows\System\PoqGGDU.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\pQQSjam.exe
  C:\Windows\System\pQQSjam.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\sGqhqaa.exe
  C:\Windows\System\sGqhqaa.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\HBFKUkp.exe
  C:\Windows\System\HBFKUkp.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\gypTqZV.exe
  C:\Windows\System\gypTqZV.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\ORonuIq.exe
  C:\Windows\System\ORonuIq.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\HdodDJg.exe
  C:\Windows\System\HdodDJg.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\mSaMyGf.exe
  C:\Windows\System\mSaMyGf.exe
  2⤵
  PID:3324
- C:\Windows\System\wBZezfu.exe
  C:\Windows\System\wBZezfu.exe
  2⤵
  PID:2668
- C:\Windows\System\CkqqYoG.exe
  C:\Windows\System\CkqqYoG.exe
  2⤵
  PID:536
- C:\Windows\System\WFktFCS.exe
  C:\Windows\System\WFktFCS.exe
  2⤵
  PID:2736
- C:\Windows\System\MeniYnn.exe
  C:\Windows\System\MeniYnn.exe
  2⤵
  PID:4268
- C:\Windows\System\BEhqgQd.exe
  C:\Windows\System\BEhqgQd.exe
  2⤵
  PID:4176
- C:\Windows\System\stvuxJE.exe
  C:\Windows\System\stvuxJE.exe
  2⤵
  PID:912
- C:\Windows\System\iLjSahh.exe
  C:\Windows\System\iLjSahh.exe
  2⤵
  PID:1656
- C:\Windows\System\qlutXkM.exe
  C:\Windows\System\qlutXkM.exe
  2⤵
  PID:3576
- C:\Windows\System\nEwkMAh.exe
  C:\Windows\System\nEwkMAh.exe
  2⤵
  PID:4356
- C:\Windows\System\gxGTupa.exe
  C:\Windows\System\gxGTupa.exe
  2⤵
  PID:1856
- C:\Windows\System\coMGKVc.exe
  C:\Windows\System\coMGKVc.exe
  2⤵
  PID:4576
- C:\Windows\System\qjtChrQ.exe
  C:\Windows\System\qjtChrQ.exe
  2⤵
  PID:2640
- C:\Windows\System\EkTETOw.exe
  C:\Windows\System\EkTETOw.exe
  2⤵
  PID:692
- C:\Windows\System\UulmegL.exe
  C:\Windows\System\UulmegL.exe
  2⤵
  PID:5148
- C:\Windows\System\DuReXvG.exe
  C:\Windows\System\DuReXvG.exe
  2⤵
  PID:5164
- C:\Windows\System\NimPrCn.exe
  C:\Windows\System\NimPrCn.exe
  2⤵
  PID:5180
- C:\Windows\System\ssFjuGg.exe
  C:\Windows\System\ssFjuGg.exe
  2⤵
  PID:5196
- C:\Windows\System\OFpvDAV.exe
  C:\Windows\System\OFpvDAV.exe
  2⤵
  PID:5212
- C:\Windows\System\JGQEuax.exe
  C:\Windows\System\JGQEuax.exe
  2⤵
  PID:5228
- C:\Windows\System\mUIgaBY.exe
  C:\Windows\System\mUIgaBY.exe
  2⤵
  PID:5244
- C:\Windows\System\erlmPGX.exe
  C:\Windows\System\erlmPGX.exe
  2⤵
  PID:5260
- C:\Windows\System\oBsuZWb.exe
  C:\Windows\System\oBsuZWb.exe
  2⤵
  PID:5276
- C:\Windows\System\BUPGIPw.exe
  C:\Windows\System\BUPGIPw.exe
  2⤵
  PID:5292
- C:\Windows\System\CPmOLKV.exe
  C:\Windows\System\CPmOLKV.exe
  2⤵
  PID:5312
- C:\Windows\System\SAFHUTO.exe
  C:\Windows\System\SAFHUTO.exe
  2⤵
  PID:5528
- C:\Windows\System\FTKrSkQ.exe
  C:\Windows\System\FTKrSkQ.exe
  2⤵
  PID:5548
- C:\Windows\System\ANiLnyD.exe
  C:\Windows\System\ANiLnyD.exe
  2⤵
  PID:5572
- C:\Windows\System\kOljgoH.exe
  C:\Windows\System\kOljgoH.exe
  2⤵
  PID:5596
- C:\Windows\System\PPWddVi.exe
  C:\Windows\System\PPWddVi.exe
  2⤵
  PID:5624
- C:\Windows\System\bwaCzCU.exe
  C:\Windows\System\bwaCzCU.exe
  2⤵
  PID:1380
- C:\Windows\System\yQRliEo.exe
  C:\Windows\System\yQRliEo.exe
  2⤵
  PID:3188
- C:\Windows\System\nMpZQkZ.exe
  C:\Windows\System\nMpZQkZ.exe
  2⤵
  PID:5880
- C:\Windows\System\dbiREqx.exe
  C:\Windows\System\dbiREqx.exe
  2⤵
  PID:5900
- C:\Windows\System\hbxfoQo.exe
  C:\Windows\System\hbxfoQo.exe
  2⤵
  PID:5924
- C:\Windows\System\iXRWwes.exe
  C:\Windows\System\iXRWwes.exe
  2⤵
  PID:5952
- C:\Windows\System\BEdJpji.exe
  C:\Windows\System\BEdJpji.exe
  2⤵
  PID:5976
- C:\Windows\System\MnewcoS.exe
  C:\Windows\System\MnewcoS.exe
  2⤵
  PID:6016
- C:\Windows\System\xiBclRO.exe
  C:\Windows\System\xiBclRO.exe
  2⤵
  PID:6048
- C:\Windows\System\MBlaquq.exe
  C:\Windows\System\MBlaquq.exe
  2⤵
  PID:6072
- C:\Windows\System\jBnstKE.exe
  C:\Windows\System\jBnstKE.exe
  2⤵
  PID:2064
- C:\Windows\System\xTrozvJ.exe
  C:\Windows\System\xTrozvJ.exe
  2⤵
  PID:6128
- C:\Windows\System\cWnwcbk.exe
  C:\Windows\System\cWnwcbk.exe
  2⤵
  PID:4884
- C:\Windows\System\xzuBpns.exe
  C:\Windows\System\xzuBpns.exe
  2⤵
  PID:2388
- C:\Windows\System\GLDtTIl.exe
  C:\Windows\System\GLDtTIl.exe
  2⤵
  PID:5068
- C:\Windows\System\wxBSuXj.exe
  C:\Windows\System\wxBSuXj.exe
  2⤵
  PID:1064
- C:\Windows\System\Tletkny.exe
  C:\Windows\System\Tletkny.exe
  2⤵
  PID:5072
- C:\Windows\System\PAODeLs.exe
  C:\Windows\System\PAODeLs.exe
  2⤵
  PID:1396
- C:\Windows\System\bdHGxMg.exe
  C:\Windows\System\bdHGxMg.exe
  2⤵
  PID:4832
- C:\Windows\System\KupRmQL.exe
  C:\Windows\System\KupRmQL.exe
  2⤵
  PID:5188
- C:\Windows\System\SGVjAMM.exe
  C:\Windows\System\SGVjAMM.exe
  2⤵
  PID:964
- C:\Windows\System\bfHUtPH.exe
  C:\Windows\System\bfHUtPH.exe
  2⤵
  PID:4304
- C:\Windows\System\ubZeOpL.exe
  C:\Windows\System\ubZeOpL.exe
  2⤵
  PID:5300
- C:\Windows\System\qtzWrao.exe
  C:\Windows\System\qtzWrao.exe
  2⤵
  PID:5368
- C:\Windows\System\lykpKqx.exe
  C:\Windows\System\lykpKqx.exe
  2⤵
  PID:5396
- C:\Windows\System\bXUdPzl.exe
  C:\Windows\System\bXUdPzl.exe
  2⤵
  PID:5444
- C:\Windows\System\qeDVrBy.exe
  C:\Windows\System\qeDVrBy.exe
  2⤵
  PID:5512
- C:\Windows\System\aTZfoZI.exe
  C:\Windows\System\aTZfoZI.exe
  2⤵
  PID:5544
- C:\Windows\System\gVkAelV.exe
  C:\Windows\System\gVkAelV.exe
  2⤵
  PID:5604
- C:\Windows\System\YyElRBE.exe
  C:\Windows\System\YyElRBE.exe
  2⤵
  PID:5688
- C:\Windows\System\ICGlZQF.exe
  C:\Windows\System\ICGlZQF.exe
  2⤵
  PID:5804
- C:\Windows\System\UgrUNJZ.exe
  C:\Windows\System\UgrUNJZ.exe
  2⤵
  PID:5808
- C:\Windows\System\icKYNWy.exe
  C:\Windows\System\icKYNWy.exe
  2⤵
  PID:2976
- C:\Windows\System\BYIjQIe.exe
  C:\Windows\System\BYIjQIe.exe
  2⤵
  PID:4244
- C:\Windows\System\aGwweHN.exe
  C:\Windows\System\aGwweHN.exe
  2⤵
  PID:3856
- C:\Windows\System\LvOLFkF.exe
  C:\Windows\System\LvOLFkF.exe
  2⤵
  PID:5800
- C:\Windows\System\NvkOMvQ.exe
  C:\Windows\System\NvkOMvQ.exe
  2⤵
  PID:4984
- C:\Windows\System\keuIUfW.exe
  C:\Windows\System\keuIUfW.exe
  2⤵
  PID:4652
- C:\Windows\System\xiBpAkN.exe
  C:\Windows\System\xiBpAkN.exe
  2⤵
  PID:5864
- C:\Windows\System\uwrBFpz.exe
  C:\Windows\System\uwrBFpz.exe
  2⤵
  PID:5888
- C:\Windows\System\SjWPVDa.exe
  C:\Windows\System\SjWPVDa.exe
  2⤵
  PID:5936
- C:\Windows\System\pbobLwP.exe
  C:\Windows\System\pbobLwP.exe
  2⤵
  PID:5984
- C:\Windows\System\vsdntzM.exe
  C:\Windows\System\vsdntzM.exe
  2⤵
  PID:6036
- C:\Windows\System\QUrvmJL.exe
  C:\Windows\System\QUrvmJL.exe
  2⤵
  PID:6068
- C:\Windows\System\cUCHhfO.exe
  C:\Windows\System\cUCHhfO.exe
  2⤵
  PID:6108
- C:\Windows\System\jWnJZaF.exe
  C:\Windows\System\jWnJZaF.exe
  2⤵
  PID:2160
- C:\Windows\System\XFMUUIg.exe
  C:\Windows\System\XFMUUIg.exe
  2⤵
  PID:2260
- C:\Windows\System\akpIDfP.exe
  C:\Windows\System\akpIDfP.exe
  2⤵
  PID:5220
- C:\Windows\System\ByqQpaN.exe
  C:\Windows\System\ByqQpaN.exe
  2⤵
  PID:5256
- C:\Windows\System\MwyNRmE.exe
  C:\Windows\System\MwyNRmE.exe
  2⤵
  PID:3028
- C:\Windows\System\wcOORGN.exe
  C:\Windows\System\wcOORGN.exe
  2⤵
  PID:1736
- C:\Windows\System\WVFEcpS.exe
  C:\Windows\System\WVFEcpS.exe
  2⤵
  PID:5372
- C:\Windows\System\BOltRoP.exe
  C:\Windows\System\BOltRoP.exe
  2⤵
  PID:5160
- C:\Windows\System\MeJwEgz.exe
  C:\Windows\System\MeJwEgz.exe
  2⤵
  PID:5536
- C:\Windows\System\whCRGcc.exe
  C:\Windows\System\whCRGcc.exe
  2⤵
  PID:5704
- C:\Windows\System\rqtLlhO.exe
  C:\Windows\System\rqtLlhO.exe
  2⤵
  PID:2016
- C:\Windows\System\hCmHsgX.exe
  C:\Windows\System\hCmHsgX.exe
  2⤵
  PID:2880
- C:\Windows\System\lnYDlJE.exe
  C:\Windows\System\lnYDlJE.exe
  2⤵
  PID:5948
- C:\Windows\System\nVkFvgq.exe
  C:\Windows\System\nVkFvgq.exe
  2⤵
  PID:4864
- C:\Windows\System\KwQQjgz.exe
  C:\Windows\System\KwQQjgz.exe
  2⤵
  PID:6004
- C:\Windows\System\AejkrtI.exe
  C:\Windows\System\AejkrtI.exe
  2⤵
  PID:1144
- C:\Windows\System\biPrAiS.exe
  C:\Windows\System\biPrAiS.exe
  2⤵
  PID:2724
- C:\Windows\System\CCXJfRy.exe
  C:\Windows\System\CCXJfRy.exe
  2⤵
  PID:5872
- C:\Windows\System\mFLVICy.exe
  C:\Windows\System\mFLVICy.exe
  2⤵
  PID:5916
- C:\Windows\System\rKJAQDi.exe
  C:\Windows\System\rKJAQDi.exe
  2⤵
  PID:5480
- C:\Windows\System\wwJbHxc.exe
  C:\Windows\System\wwJbHxc.exe
  2⤵
  PID:6152
- C:\Windows\System\rlAGykx.exe
  C:\Windows\System\rlAGykx.exe
  2⤵
  PID:6176
- C:\Windows\System\mtQvQzz.exe
  C:\Windows\System\mtQvQzz.exe
  2⤵
  PID:6200
- C:\Windows\System\iilNrwR.exe
  C:\Windows\System\iilNrwR.exe
  2⤵
  PID:6220
- C:\Windows\System\kOsVRyn.exe
  C:\Windows\System\kOsVRyn.exe
  2⤵
  PID:6244
- C:\Windows\System\WQwDWmN.exe
  C:\Windows\System\WQwDWmN.exe
  2⤵
  PID:6268
- C:\Windows\System\rytPKDr.exe
  C:\Windows\System\rytPKDr.exe
  2⤵
  PID:6296
- C:\Windows\System\xEvYpRA.exe
  C:\Windows\System\xEvYpRA.exe
  2⤵
  PID:6316
- C:\Windows\System\JpJppan.exe
  C:\Windows\System\JpJppan.exe
  2⤵
  PID:6340
- C:\Windows\System\ahQOGWo.exe
  C:\Windows\System\ahQOGWo.exe
  2⤵
  PID:6364
- C:\Windows\System\wMuLpCU.exe
  C:\Windows\System\wMuLpCU.exe
  2⤵
  PID:6388
- C:\Windows\System\PSeooPZ.exe
  C:\Windows\System\PSeooPZ.exe
  2⤵
  PID:6412
- C:\Windows\System\OZzrYVp.exe
  C:\Windows\System\OZzrYVp.exe
  2⤵
  PID:6440
- C:\Windows\System\wUoZRqI.exe
  C:\Windows\System\wUoZRqI.exe
  2⤵
  PID:6456
- C:\Windows\System\EsWtCCb.exe
  C:\Windows\System\EsWtCCb.exe
  2⤵
  PID:6472
- C:\Windows\System\cfRrYBS.exe
  C:\Windows\System\cfRrYBS.exe
  2⤵
  PID:6488
- C:\Windows\System\HDKeYhn.exe
  C:\Windows\System\HDKeYhn.exe
  2⤵
  PID:6504
- C:\Windows\System\ChoChzA.exe
  C:\Windows\System\ChoChzA.exe
  2⤵
  PID:6524
- C:\Windows\System\dvDIfnc.exe
  C:\Windows\System\dvDIfnc.exe
  2⤵
  PID:6548
- C:\Windows\System\zJTnENZ.exe
  C:\Windows\System\zJTnENZ.exe
  2⤵
  PID:6572
- C:\Windows\System\GBqhWoc.exe
  C:\Windows\System\GBqhWoc.exe
  2⤵
  PID:6596
- C:\Windows\System\EdCgjWP.exe
  C:\Windows\System\EdCgjWP.exe
  2⤵
  PID:6616
- C:\Windows\System\IWQtywR.exe
  C:\Windows\System\IWQtywR.exe
  2⤵
  PID:6636
- C:\Windows\System\NrZtAFg.exe
  C:\Windows\System\NrZtAFg.exe
  2⤵
  PID:6664
- C:\Windows\System\dlnMGGU.exe
  C:\Windows\System\dlnMGGU.exe
  2⤵
  PID:6684
- C:\Windows\System\KZkvWUX.exe
  C:\Windows\System\KZkvWUX.exe
  2⤵
  PID:6708
- C:\Windows\System\BVgjcIf.exe
  C:\Windows\System\BVgjcIf.exe
  2⤵
  PID:6728
- C:\Windows\System\aGNJjZJ.exe
  C:\Windows\System\aGNJjZJ.exe
  2⤵
  PID:6748
- C:\Windows\System\KojXmLn.exe
  C:\Windows\System\KojXmLn.exe
  2⤵
  PID:6776
- C:\Windows\System\niuxvle.exe
  C:\Windows\System\niuxvle.exe
  2⤵
  PID:6796
- C:\Windows\System\FGeDLHy.exe
  C:\Windows\System\FGeDLHy.exe
  2⤵
  PID:6816
- C:\Windows\System\vouyXCG.exe
  C:\Windows\System\vouyXCG.exe
  2⤵
  PID:6844
- C:\Windows\System\XpYpGAu.exe
  C:\Windows\System\XpYpGAu.exe
  2⤵
  PID:6864
- C:\Windows\System\LOtGGGD.exe
  C:\Windows\System\LOtGGGD.exe
  2⤵
  PID:6888
- C:\Windows\System\eQuPbcq.exe
  C:\Windows\System\eQuPbcq.exe
  2⤵
  PID:6912
- C:\Windows\System\sdqCVwD.exe
  C:\Windows\System\sdqCVwD.exe
  2⤵
  PID:6932
- C:\Windows\System\fzHJWrC.exe
  C:\Windows\System\fzHJWrC.exe
  2⤵
  PID:6960
- C:\Windows\System\qrsjqlV.exe
  C:\Windows\System\qrsjqlV.exe
  2⤵
  PID:6980
- C:\Windows\System\tRchAca.exe
  C:\Windows\System\tRchAca.exe
  2⤵
  PID:7004
- C:\Windows\System\paczcwM.exe
  C:\Windows\System\paczcwM.exe
  2⤵
  PID:7032
- C:\Windows\System\LXaHNsm.exe
  C:\Windows\System\LXaHNsm.exe
  2⤵
  PID:7056
- C:\Windows\System\domHxcc.exe
  C:\Windows\System\domHxcc.exe
  2⤵
  PID:7080
- C:\Windows\System\fbBqUKP.exe
  C:\Windows\System\fbBqUKP.exe
  2⤵
  PID:7104
- C:\Windows\System\rVVzVdI.exe
  C:\Windows\System\rVVzVdI.exe
  2⤵
  PID:7124
- C:\Windows\System\OYrKDtD.exe
  C:\Windows\System\OYrKDtD.exe
  2⤵
  PID:7152
- C:\Windows\System\ilPRcmW.exe
  C:\Windows\System\ilPRcmW.exe
  2⤵
  PID:6064
- C:\Windows\System\tjFVmDO.exe
  C:\Windows\System\tjFVmDO.exe
  2⤵
  PID:1436
- C:\Windows\System\smGLGDz.exe
  C:\Windows\System\smGLGDz.exe
  2⤵
  PID:5360
- C:\Windows\System\Qtzkoek.exe
  C:\Windows\System\Qtzkoek.exe
  2⤵
  PID:5380
- C:\Windows\System\UaoPjsc.exe
  C:\Windows\System\UaoPjsc.exe
  2⤵
  PID:5496
- C:\Windows\System\WtSoPFV.exe
  C:\Windows\System\WtSoPFV.exe
  2⤵
  PID:6196
- C:\Windows\System\gwOvQWb.exe
  C:\Windows\System\gwOvQWb.exe
  2⤵
  PID:6240
- C:\Windows\System\wsVuSMZ.exe
  C:\Windows\System\wsVuSMZ.exe
  2⤵
  PID:5112
- C:\Windows\System\pwDavXm.exe
  C:\Windows\System\pwDavXm.exe
  2⤵
  PID:6372
- C:\Windows\System\ldDXyjB.exe
  C:\Windows\System\ldDXyjB.exe
  2⤵
  PID:6400
- C:\Windows\System\cHdHKsW.exe
  C:\Windows\System\cHdHKsW.exe
  2⤵
  PID:6184
- C:\Windows\System\RlKHfxy.exe
  C:\Windows\System\RlKHfxy.exe
  2⤵
  PID:6452
- C:\Windows\System\WgDeSBH.exe
  C:\Windows\System\WgDeSBH.exe
  2⤵
  PID:6308
- C:\Windows\System\MGbHbFD.exe
  C:\Windows\System\MGbHbFD.exe
  2⤵
  PID:6676
- C:\Windows\System\mQHNUYS.exe
  C:\Windows\System\mQHNUYS.exe
  2⤵
  PID:6720
- C:\Windows\System\TjOzZBI.exe
  C:\Windows\System\TjOzZBI.exe
  2⤵
  PID:6852
- C:\Windows\System\DiDSImS.exe
  C:\Windows\System\DiDSImS.exe
  2⤵
  PID:6216
- C:\Windows\System\FcNTSKX.exe
  C:\Windows\System\FcNTSKX.exe
  2⤵
  PID:6948
- C:\Windows\System\woDbLjs.exe
  C:\Windows\System\woDbLjs.exe
  2⤵
  PID:6276
- C:\Windows\System\VHFharl.exe
  C:\Windows\System\VHFharl.exe
  2⤵
  PID:7076
- C:\Windows\System\UMakfeR.exe
  C:\Windows\System\UMakfeR.exe
  2⤵
  PID:6696
- C:\Windows\System\vBPpSkD.exe
  C:\Windows\System\vBPpSkD.exe
  2⤵
  PID:6740
- C:\Windows\System\rPueKdw.exe
  C:\Windows\System\rPueKdw.exe
  2⤵
  PID:6792
- C:\Windows\System\bJCDYlZ.exe
  C:\Windows\System\bJCDYlZ.exe
  2⤵
  PID:6812
- C:\Windows\System\FHbpcJW.exe
  C:\Windows\System\FHbpcJW.exe
  2⤵
  PID:5124
- C:\Windows\System\SVXkHKc.exe
  C:\Windows\System\SVXkHKc.exe
  2⤵
  PID:6480
- C:\Windows\System\urDiHTm.exe
  C:\Windows\System\urDiHTm.exe
  2⤵
  PID:7180
- C:\Windows\System\MsobSHV.exe
  C:\Windows\System\MsobSHV.exe
  2⤵
  PID:7200
- C:\Windows\System\LpQAqZM.exe
  C:\Windows\System\LpQAqZM.exe
  2⤵
  PID:7220
- C:\Windows\System\DdQtMNJ.exe
  C:\Windows\System\DdQtMNJ.exe
  2⤵
  PID:7244
- C:\Windows\System\OhiMQzE.exe
  C:\Windows\System\OhiMQzE.exe
  2⤵
  PID:7268
- C:\Windows\System\IDiGJRD.exe
  C:\Windows\System\IDiGJRD.exe
  2⤵
  PID:7292
- C:\Windows\System\BERArdR.exe
  C:\Windows\System\BERArdR.exe
  2⤵
  PID:7312
- C:\Windows\System\KxVxNvu.exe
  C:\Windows\System\KxVxNvu.exe
  2⤵
  PID:7332
- C:\Windows\System\jFKYcdK.exe
  C:\Windows\System\jFKYcdK.exe
  2⤵
  PID:7360
- C:\Windows\System\babdgvb.exe
  C:\Windows\System\babdgvb.exe
  2⤵
  PID:7384
- C:\Windows\System\fSrMQoE.exe
  C:\Windows\System\fSrMQoE.exe
  2⤵
  PID:7404
- C:\Windows\System\rCGdMIi.exe
  C:\Windows\System\rCGdMIi.exe
  2⤵
  PID:7424
- C:\Windows\System\LLZbinQ.exe
  C:\Windows\System\LLZbinQ.exe
  2⤵
  PID:7452
- C:\Windows\System\Ddjktgk.exe
  C:\Windows\System\Ddjktgk.exe
  2⤵
  PID:7476
- C:\Windows\System\IugJoEC.exe
  C:\Windows\System\IugJoEC.exe
  2⤵
  PID:7492
- C:\Windows\System\bXPFtJZ.exe
  C:\Windows\System\bXPFtJZ.exe
  2⤵
  PID:7516
- C:\Windows\System\fdbMCns.exe
  C:\Windows\System\fdbMCns.exe
  2⤵
  PID:7540
- C:\Windows\System\uezeraF.exe
  C:\Windows\System\uezeraF.exe
  2⤵
  PID:7560
- C:\Windows\System\zkyGRnN.exe
  C:\Windows\System\zkyGRnN.exe
  2⤵
  PID:7580
- C:\Windows\System\vdYKFIf.exe
  C:\Windows\System\vdYKFIf.exe
  2⤵
  PID:7604
- C:\Windows\System\XQdqxNA.exe
  C:\Windows\System\XQdqxNA.exe
  2⤵
  PID:7628
- C:\Windows\System\gRpvaTq.exe
  C:\Windows\System\gRpvaTq.exe
  2⤵
  PID:7648
- C:\Windows\System\WlYsqHd.exe
  C:\Windows\System\WlYsqHd.exe
  2⤵
  PID:7668
- C:\Windows\System\juUYJkW.exe
  C:\Windows\System\juUYJkW.exe
  2⤵
  PID:7692
- C:\Windows\System\xpMeYpa.exe
  C:\Windows\System\xpMeYpa.exe
  2⤵
  PID:7716
- C:\Windows\System\TxkvZQo.exe
  C:\Windows\System\TxkvZQo.exe
  2⤵
  PID:7740
- C:\Windows\System\sPfVZcm.exe
  C:\Windows\System\sPfVZcm.exe
  2⤵
  PID:7760
- C:\Windows\System\kQLbPOV.exe
  C:\Windows\System\kQLbPOV.exe
  2⤵
  PID:7780
- C:\Windows\System\uOwuTFR.exe
  C:\Windows\System\uOwuTFR.exe
  2⤵
  PID:7804
- C:\Windows\System\iVVnbdr.exe
  C:\Windows\System\iVVnbdr.exe
  2⤵
  PID:7824
- C:\Windows\System\FsHRBXA.exe
  C:\Windows\System\FsHRBXA.exe
  2⤵
  PID:7844
- C:\Windows\System\JzPubph.exe
  C:\Windows\System\JzPubph.exe
  2⤵
  PID:7868
- C:\Windows\System\EVjDnff.exe
  C:\Windows\System\EVjDnff.exe
  2⤵
  PID:7892
- C:\Windows\System\otEMwxT.exe
  C:\Windows\System\otEMwxT.exe
  2⤵
  PID:7916
- C:\Windows\System\toVNEpg.exe
  C:\Windows\System\toVNEpg.exe
  2⤵
  PID:7940
- C:\Windows\System\uhvFAAh.exe
  C:\Windows\System\uhvFAAh.exe
  2⤵
  PID:7968
- C:\Windows\System\BeZzeXV.exe
  C:\Windows\System\BeZzeXV.exe
  2⤵
  PID:7988
- C:\Windows\System\vzdMcXt.exe
  C:\Windows\System\vzdMcXt.exe
  2⤵
  PID:8008
- C:\Windows\System\wgeOaFy.exe
  C:\Windows\System\wgeOaFy.exe
  2⤵
  PID:8032
- C:\Windows\System\CUPUReu.exe
  C:\Windows\System\CUPUReu.exe
  2⤵
  PID:8060
- C:\Windows\System\TnMgQeV.exe
  C:\Windows\System\TnMgQeV.exe
  2⤵
  PID:8084
- C:\Windows\System\XhcCZjW.exe
  C:\Windows\System\XhcCZjW.exe
  2⤵
  PID:8108
- C:\Windows\System\WZIKTti.exe
  C:\Windows\System\WZIKTti.exe
  2⤵
  PID:8128
- C:\Windows\System\mLWwTez.exe
  C:\Windows\System\mLWwTez.exe
  2⤵
  PID:8144
- C:\Windows\System\SeCYsoF.exe
  C:\Windows\System\SeCYsoF.exe
  2⤵
  PID:8172
- C:\Windows\System\aqLOnXs.exe
  C:\Windows\System\aqLOnXs.exe
  2⤵
  PID:8188
- C:\Windows\System\lWVnxUG.exe
  C:\Windows\System\lWVnxUG.exe
  2⤵
  PID:6380
- C:\Windows\System\kBfMPLT.exe
  C:\Windows\System\kBfMPLT.exe
  2⤵
  PID:3496
- C:\Windows\System\cFnsfLN.exe
  C:\Windows\System\cFnsfLN.exe
  2⤵
  PID:7016
- C:\Windows\System\smIrqRq.exe
  C:\Windows\System\smIrqRq.exe
  2⤵
  PID:6644
- C:\Windows\System\hwlAcRo.exe
  C:\Windows\System\hwlAcRo.exe
  2⤵
  PID:6612
- C:\Windows\System\ZYqXQbg.exe
  C:\Windows\System\ZYqXQbg.exe
  2⤵
  PID:6860
- C:\Windows\System\ffEinGt.exe
  C:\Windows\System\ffEinGt.exe
  2⤵
  PID:6260
- C:\Windows\System\wOLeZzD.exe
  C:\Windows\System\wOLeZzD.exe
  2⤵
  PID:6896
- C:\Windows\System\zrSTFEk.exe
  C:\Windows\System\zrSTFEk.exe
  2⤵
  PID:5240
- C:\Windows\System\uAaiDkj.exe
  C:\Windows\System\uAaiDkj.exe
  2⤵
  PID:6520
- C:\Windows\System\DjmziNq.exe
  C:\Windows\System\DjmziNq.exe
  2⤵
  PID:7236
- C:\Windows\System\NsROCiF.exe
  C:\Windows\System\NsROCiF.exe
  2⤵
  PID:6628
- C:\Windows\System\PjFkroq.exe
  C:\Windows\System\PjFkroq.exe
  2⤵
  PID:6228
- C:\Windows\System\WcZjQWt.exe
  C:\Windows\System\WcZjQWt.exe
  2⤵
  PID:7396
- C:\Windows\System\erqsuiI.exe
  C:\Windows\System\erqsuiI.exe
  2⤵
  PID:7464
- C:\Windows\System\sdNKHnI.exe
  C:\Windows\System\sdNKHnI.exe
  2⤵
  PID:7548
- C:\Windows\System\opqXcya.exe
  C:\Windows\System\opqXcya.exe
  2⤵
  PID:7600
- C:\Windows\System\LljHfHo.exe
  C:\Windows\System\LljHfHo.exe
  2⤵
  PID:8196
- C:\Windows\System\EfeOJkR.exe
  C:\Windows\System\EfeOJkR.exe
  2⤵
  PID:8216
- C:\Windows\System\ntwlzIp.exe
  C:\Windows\System\ntwlzIp.exe
  2⤵
  PID:8236
- C:\Windows\System\RuKdlDs.exe
  C:\Windows\System\RuKdlDs.exe
  2⤵
  PID:8260
- C:\Windows\System\aQqcxlk.exe
  C:\Windows\System\aQqcxlk.exe
  2⤵
  PID:8284
- C:\Windows\System\wrmwykq.exe
  C:\Windows\System\wrmwykq.exe
  2⤵
  PID:8304
- C:\Windows\System\LvIPCxh.exe
  C:\Windows\System\LvIPCxh.exe
  2⤵
  PID:8328
- C:\Windows\System\JyWzzgA.exe
  C:\Windows\System\JyWzzgA.exe
  2⤵
  PID:8360
- C:\Windows\System\hhvHfLi.exe
  C:\Windows\System\hhvHfLi.exe
  2⤵
  PID:8376
- C:\Windows\System\PkYyqYO.exe
  C:\Windows\System\PkYyqYO.exe
  2⤵
  PID:8396
- C:\Windows\System\WmAbJKi.exe
  C:\Windows\System\WmAbJKi.exe
  2⤵
  PID:8424
- C:\Windows\System\hnYAyQl.exe
  C:\Windows\System\hnYAyQl.exe
  2⤵
  PID:8456
- C:\Windows\System\kLoTbkn.exe
  C:\Windows\System\kLoTbkn.exe
  2⤵
  PID:8484
- C:\Windows\System\TwQCYNa.exe
  C:\Windows\System\TwQCYNa.exe
  2⤵
  PID:8500
- C:\Windows\System\FdKcLiR.exe
  C:\Windows\System\FdKcLiR.exe
  2⤵
  PID:8528
- C:\Windows\System\EBeNHyT.exe
  C:\Windows\System\EBeNHyT.exe
  2⤵
  PID:8564
- C:\Windows\System\KppTzBe.exe
  C:\Windows\System\KppTzBe.exe
  2⤵
  PID:8588
- C:\Windows\System\tcIMvTv.exe
  C:\Windows\System\tcIMvTv.exe
  2⤵
  PID:8604
- C:\Windows\System\PevcNus.exe
  C:\Windows\System\PevcNus.exe
  2⤵
  PID:8632
- C:\Windows\System\BYbHrIG.exe
  C:\Windows\System\BYbHrIG.exe
  2⤵
  PID:8656
- C:\Windows\System\DbvJSMO.exe
  C:\Windows\System\DbvJSMO.exe
  2⤵
  PID:8680
- C:\Windows\System\ENOOQLF.exe
  C:\Windows\System\ENOOQLF.exe
  2⤵
  PID:8704
- C:\Windows\System\cIhcGWR.exe
  C:\Windows\System\cIhcGWR.exe
  2⤵
  PID:8724
- C:\Windows\System\kmpnWRL.exe
  C:\Windows\System\kmpnWRL.exe
  2⤵
  PID:8752
- C:\Windows\System\SuwaBMD.exe
  C:\Windows\System\SuwaBMD.exe
  2⤵
  PID:8772
- C:\Windows\System\QmkPRam.exe
  C:\Windows\System\QmkPRam.exe
  2⤵
  PID:8796
- C:\Windows\System\DTkglht.exe
  C:\Windows\System\DTkglht.exe
  2⤵
  PID:8820
- C:\Windows\System\IEUWDts.exe
  C:\Windows\System\IEUWDts.exe
  2⤵
  PID:8844
- C:\Windows\System\ZSnCJYe.exe
  C:\Windows\System\ZSnCJYe.exe
  2⤵
  PID:8868
- C:\Windows\System\rSbxWCt.exe
  C:\Windows\System\rSbxWCt.exe
  2⤵
  PID:8908
- C:\Windows\System\QraXbyf.exe
  C:\Windows\System\QraXbyf.exe
  2⤵
  PID:8940
- C:\Windows\System\XXenRmA.exe
  C:\Windows\System\XXenRmA.exe
  2⤵
  PID:8960
- C:\Windows\System\eJrJFKf.exe
  C:\Windows\System\eJrJFKf.exe
  2⤵
  PID:8984
- C:\Windows\System\hcIeUBF.exe
  C:\Windows\System\hcIeUBF.exe
  2⤵
  PID:9016
- C:\Windows\System\FxmDAGr.exe
  C:\Windows\System\FxmDAGr.exe
  2⤵
  PID:9036
- C:\Windows\System\FtaYnTV.exe
  C:\Windows\System\FtaYnTV.exe
  2⤵
  PID:9056
- C:\Windows\System\vtRLBah.exe
  C:\Windows\System\vtRLBah.exe
  2⤵
  PID:9080
- C:\Windows\System\mVYqYHL.exe
  C:\Windows\System\mVYqYHL.exe
  2⤵
  PID:9100
- C:\Windows\System\NDynADD.exe
  C:\Windows\System\NDynADD.exe
  2⤵
  PID:9120
- C:\Windows\System\iGRTkJo.exe
  C:\Windows\System\iGRTkJo.exe
  2⤵
  PID:9140
- C:\Windows\System\PloxibR.exe
  C:\Windows\System\PloxibR.exe
  2⤵
  PID:9164
- C:\Windows\System\XlYbgwE.exe
  C:\Windows\System\XlYbgwE.exe
  2⤵
  PID:9184
- C:\Windows\System\CDRouge.exe
  C:\Windows\System\CDRouge.exe
  2⤵
  PID:9200
- C:\Windows\System\sAiqTYF.exe
  C:\Windows\System\sAiqTYF.exe
  2⤵
  PID:7732
- C:\Windows\System\tAXfJXC.exe
  C:\Windows\System\tAXfJXC.exe
  2⤵
  PID:5856
- C:\Windows\System\TqiViri.exe
  C:\Windows\System\TqiViri.exe
  2⤵
  PID:7772
- C:\Windows\System\csnfLJj.exe
  C:\Windows\System\csnfLJj.exe
  2⤵
  PID:7816
- C:\Windows\System\tDLXVsY.exe
  C:\Windows\System\tDLXVsY.exe
  2⤵
  PID:7912
- C:\Windows\System\ldVvSSO.exe
  C:\Windows\System\ldVvSSO.exe
  2⤵
  PID:7956
- C:\Windows\System\KwDbQBp.exe
  C:\Windows\System\KwDbQBp.exe
  2⤵
  PID:8048
- C:\Windows\System\ixKvuFM.exe
  C:\Windows\System\ixKvuFM.exe
  2⤵
  PID:8080
- C:\Windows\System\uwUbFnB.exe
  C:\Windows\System\uwUbFnB.exe
  2⤵
  PID:8180
- C:\Windows\System\SImKbuk.exe
  C:\Windows\System\SImKbuk.exe
  2⤵
  PID:5712
- C:\Windows\System\OekiiiL.exe
  C:\Windows\System\OekiiiL.exe
  2⤵
  PID:7448
- C:\Windows\System\vMiiQXa.exe
  C:\Windows\System\vMiiQXa.exe
  2⤵
  PID:7468
- C:\Windows\System\jYJkojF.exe
  C:\Windows\System\jYJkojF.exe
  2⤵
  PID:7276
- C:\Windows\System\LEVDDhM.exe
  C:\Windows\System\LEVDDhM.exe
  2⤵
  PID:7280
- C:\Windows\System\nXrBkyx.exe
  C:\Windows\System\nXrBkyx.exe
  2⤵
  PID:7700
- C:\Windows\System\EkRryBe.exe
  C:\Windows\System\EkRryBe.exe
  2⤵
  PID:8324
- C:\Windows\System\DyPGTEy.exe
  C:\Windows\System\DyPGTEy.exe
  2⤵
  PID:7852
- C:\Windows\System\pWsYEEx.exe
  C:\Windows\System\pWsYEEx.exe
  2⤵
  PID:7380
- C:\Windows\System\dqaRIcf.exe
  C:\Windows\System\dqaRIcf.exe
  2⤵
  PID:8524
- C:\Windows\System\uGzmdXu.exe
  C:\Windows\System\uGzmdXu.exe
  2⤵
  PID:8136
- C:\Windows\System\mmxcwrD.exe
  C:\Windows\System\mmxcwrD.exe
  2⤵
  PID:8576
- C:\Windows\System\gmAnPiV.exe
  C:\Windows\System\gmAnPiV.exe
  2⤵
  PID:8688
- C:\Windows\System\IzSXufH.exe
  C:\Windows\System\IzSXufH.exe
  2⤵
  PID:6560
- C:\Windows\System\ZhkzKJo.exe
  C:\Windows\System\ZhkzKJo.exe
  2⤵
  PID:6304
- C:\Windows\System\cHSnXrN.exe
  C:\Windows\System\cHSnXrN.exe
  2⤵
  PID:7160
- C:\Windows\System\XZViCyN.exe
  C:\Windows\System\XZViCyN.exe
  2⤵
  PID:6448
- C:\Windows\System\oXpvtiV.exe
  C:\Windows\System\oXpvtiV.exe
  2⤵
  PID:4260
- C:\Windows\System\wfElanP.exe
  C:\Windows\System\wfElanP.exe
  2⤵
  PID:7708
- C:\Windows\System\EzzWgYt.exe
  C:\Windows\System\EzzWgYt.exe
  2⤵
  PID:8280
- C:\Windows\System\pLuyvut.exe
  C:\Windows\System\pLuyvut.exe
  2⤵
  PID:8404
- C:\Windows\System\kwBxcdu.exe
  C:\Windows\System\kwBxcdu.exe
  2⤵
  PID:9240
- C:\Windows\System\gaWJDdI.exe
  C:\Windows\System\gaWJDdI.exe
  2⤵
  PID:9264
- C:\Windows\System\IlfVvHR.exe
  C:\Windows\System\IlfVvHR.exe
  2⤵
  PID:9288
- C:\Windows\System\doLwPqG.exe
  C:\Windows\System\doLwPqG.exe
  2⤵
  PID:9312
- C:\Windows\System\pTqhcoZ.exe
  C:\Windows\System\pTqhcoZ.exe
  2⤵
  PID:9332
- C:\Windows\System\QWLeRTS.exe
  C:\Windows\System\QWLeRTS.exe
  2⤵
  PID:9352
- C:\Windows\System\bvsaTNC.exe
  C:\Windows\System\bvsaTNC.exe
  2⤵
  PID:9380
- C:\Windows\System\fscmwjz.exe
  C:\Windows\System\fscmwjz.exe
  2⤵
  PID:9400
- C:\Windows\System\tvvleSb.exe
  C:\Windows\System\tvvleSb.exe
  2⤵
  PID:9424
- C:\Windows\System\XRLBHWZ.exe
  C:\Windows\System\XRLBHWZ.exe
  2⤵
  PID:9696
- C:\Windows\System\UZxdEsf.exe
  C:\Windows\System\UZxdEsf.exe
  2⤵
  PID:9724
- C:\Windows\System\klrspZP.exe
  C:\Windows\System\klrspZP.exe
  2⤵
  PID:9740
- C:\Windows\System\rtfKkYQ.exe
  C:\Windows\System\rtfKkYQ.exe
  2⤵
  PID:9764
- C:\Windows\System\FrTbdvg.exe
  C:\Windows\System\FrTbdvg.exe
  2⤵
  PID:9784
- C:\Windows\System\JRWVvAr.exe
  C:\Windows\System\JRWVvAr.exe
  2⤵
  PID:9800
- C:\Windows\System\qSOOBCv.exe
  C:\Windows\System\qSOOBCv.exe
  2⤵
  PID:9816
- C:\Windows\System\cEfqYyi.exe
  C:\Windows\System\cEfqYyi.exe
  2⤵
  PID:9832
- C:\Windows\System\aNIUyLg.exe
  C:\Windows\System\aNIUyLg.exe
  2⤵
  PID:9852
- C:\Windows\System\YuScwkb.exe
  C:\Windows\System\YuScwkb.exe
  2⤵
  PID:9868
- C:\Windows\System\VDIFvDB.exe
  C:\Windows\System\VDIFvDB.exe
  2⤵
  PID:9888
- C:\Windows\System\jMhcmgD.exe
  C:\Windows\System\jMhcmgD.exe
  2⤵
  PID:9908
- C:\Windows\System\mGMkPSk.exe
  C:\Windows\System\mGMkPSk.exe
  2⤵
  PID:9932
- C:\Windows\System\JFNkmxD.exe
  C:\Windows\System\JFNkmxD.exe
  2⤵
  PID:9956
- C:\Windows\System\FAiWqwm.exe
  C:\Windows\System\FAiWqwm.exe
  2⤵
  PID:9976
- C:\Windows\System\HlEaxes.exe
  C:\Windows\System\HlEaxes.exe
  2⤵
  PID:9996
- C:\Windows\System\cUkPZIB.exe
  C:\Windows\System\cUkPZIB.exe
  2⤵
  PID:10020
- C:\Windows\System\vzBFlRV.exe
  C:\Windows\System\vzBFlRV.exe
  2⤵
  PID:10044
- C:\Windows\System\kwQdQhs.exe
  C:\Windows\System\kwQdQhs.exe
  2⤵
  PID:10068
- C:\Windows\System\WOMNMnY.exe
  C:\Windows\System\WOMNMnY.exe
  2⤵
  PID:10100
- C:\Windows\System\kjZZEep.exe
  C:\Windows\System\kjZZEep.exe
  2⤵
  PID:10128
- C:\Windows\System\rWwnLNg.exe
  C:\Windows\System\rWwnLNg.exe
  2⤵
  PID:10152
- C:\Windows\System\eLeHPbd.exe
  C:\Windows\System\eLeHPbd.exe
  2⤵
  PID:10176
- C:\Windows\System\cTugbVe.exe
  C:\Windows\System\cTugbVe.exe
  2⤵
  PID:10200
- C:\Windows\System\MkKqNWI.exe
  C:\Windows\System\MkKqNWI.exe
  2⤵
  PID:10224
- C:\Windows\System\jwmwuun.exe
  C:\Windows\System\jwmwuun.exe
  2⤵
  PID:7980
- C:\Windows\System\fvgSbpM.exe
  C:\Windows\System\fvgSbpM.exe
  2⤵
  PID:8476
- C:\Windows\System\mgbuIyM.exe
  C:\Windows\System\mgbuIyM.exe
  2⤵
  PID:9212
- C:\Windows\System\HryOiNB.exe
  C:\Windows\System\HryOiNB.exe
  2⤵
  PID:6356
- C:\Windows\System\XvxYZOU.exe
  C:\Windows\System\XvxYZOU.exe
  2⤵
  PID:6604
- C:\Windows\System\yiVfRvt.exe
  C:\Windows\System\yiVfRvt.exe
  2⤵
  PID:1084
- C:\Windows\System\AwZrztV.exe
  C:\Windows\System\AwZrztV.exe
  2⤵
  PID:6192
- C:\Windows\System\MDsukiI.exe
  C:\Windows\System\MDsukiI.exe
  2⤵
  PID:7536
- C:\Windows\System\gFiNmIj.exe
  C:\Windows\System\gFiNmIj.exe
  2⤵
  PID:7684
- C:\Windows\System\tuptOtK.exe
  C:\Windows\System\tuptOtK.exe
  2⤵
  PID:8232
- C:\Windows\System\uHFWfOg.exe
  C:\Windows\System\uHFWfOg.exe
  2⤵
  PID:8972
- C:\Windows\System\iATAHyR.exe
  C:\Windows\System\iATAHyR.exe
  2⤵
  PID:8392
- C:\Windows\System\tLUMsKg.exe
  C:\Windows\System\tLUMsKg.exe
  2⤵
  PID:9372
- C:\Windows\System\CZiaLUB.exe
  C:\Windows\System\CZiaLUB.exe
  2⤵
  PID:7800
- C:\Windows\System\zvvlJJr.exe
  C:\Windows\System\zvvlJJr.exe
  2⤵
  PID:6164
- C:\Windows\System\HaBYQhq.exe
  C:\Windows\System\HaBYQhq.exe
  2⤵
  PID:8116
- C:\Windows\System\LbuZaSz.exe
  C:\Windows\System\LbuZaSz.exe
  2⤵
  PID:9416
- C:\Windows\System\fuDdtPn.exe
  C:\Windows\System\fuDdtPn.exe
  2⤵
  PID:7788
- C:\Windows\System\yPPNfSZ.exe
  C:\Windows\System\yPPNfSZ.exe
  2⤵
  PID:8620
- C:\Windows\System\sPPAaKh.exe
  C:\Windows\System\sPPAaKh.exe
  2⤵
  PID:6428
- C:\Windows\System\bNwpaor.exe
  C:\Windows\System\bNwpaor.exe
  2⤵
  PID:8792
- C:\Windows\System\XLgcZIK.exe
  C:\Windows\System\XLgcZIK.exe
  2⤵
  PID:8884
- C:\Windows\System\kLVufRG.exe
  C:\Windows\System\kLVufRG.exe
  2⤵
  PID:8920
- C:\Windows\System\WnIMSTB.exe
  C:\Windows\System\WnIMSTB.exe
  2⤵
  PID:7524
- C:\Windows\System\EdFjwNZ.exe
  C:\Windows\System\EdFjwNZ.exe
  2⤵
  PID:9620
- C:\Windows\System\jGTjxsx.exe
  C:\Windows\System\jGTjxsx.exe
  2⤵
  PID:10260
- C:\Windows\System\YmdSBor.exe
  C:\Windows\System\YmdSBor.exe
  2⤵
  PID:10284
- C:\Windows\System\mvZmZDl.exe
  C:\Windows\System\mvZmZDl.exe
  2⤵
  PID:10308
- C:\Windows\System\SPdEaUM.exe
  C:\Windows\System\SPdEaUM.exe
  2⤵
  PID:10324
- C:\Windows\System\qpLjMnl.exe
  C:\Windows\System\qpLjMnl.exe
  2⤵
  PID:10348
- C:\Windows\System\axoSVxP.exe
  C:\Windows\System\axoSVxP.exe
  2⤵
  PID:10368
- C:\Windows\System\ZALKypH.exe
  C:\Windows\System\ZALKypH.exe
  2⤵
  PID:10388
- C:\Windows\System\QDETAci.exe
  C:\Windows\System\QDETAci.exe
  2⤵
  PID:10412
- C:\Windows\System\cXudgcj.exe
  C:\Windows\System\cXudgcj.exe
  2⤵
  PID:10436
- C:\Windows\System\XxhoVsj.exe
  C:\Windows\System\XxhoVsj.exe
  2⤵
  PID:10460
- C:\Windows\System\IzveBTO.exe
  C:\Windows\System\IzveBTO.exe
  2⤵
  PID:10484
- C:\Windows\System\FkjZkxk.exe
  C:\Windows\System\FkjZkxk.exe
  2⤵
  PID:10508
- C:\Windows\System\hPBIFow.exe
  C:\Windows\System\hPBIFow.exe
  2⤵
  PID:10536
- C:\Windows\System\anUwhrm.exe
  C:\Windows\System\anUwhrm.exe
  2⤵
  PID:10560
- C:\Windows\System\NGPeocc.exe
  C:\Windows\System\NGPeocc.exe
  2⤵
  PID:10576
- C:\Windows\System\pemewyR.exe
  C:\Windows\System\pemewyR.exe
  2⤵
  PID:10592
- C:\Windows\System\PZCbFbZ.exe
  C:\Windows\System\PZCbFbZ.exe
  2⤵
  PID:10608
- C:\Windows\System\ewMqyvh.exe
  C:\Windows\System\ewMqyvh.exe
  2⤵
  PID:10624
- C:\Windows\System\vPgEyTX.exe
  C:\Windows\System\vPgEyTX.exe
  2⤵
  PID:10640
- C:\Windows\System\xcUotkM.exe
  C:\Windows\System\xcUotkM.exe
  2⤵
  PID:10656
- C:\Windows\System\MruUsLE.exe
  C:\Windows\System\MruUsLE.exe
  2⤵
  PID:10680
- C:\Windows\System\FLIzbdj.exe
  C:\Windows\System\FLIzbdj.exe
  2⤵
  PID:10708
- C:\Windows\System\YMxhVZx.exe
  C:\Windows\System\YMxhVZx.exe
  2⤵
  PID:10732
- C:\Windows\System\ZcXtsmC.exe
  C:\Windows\System\ZcXtsmC.exe
  2⤵
  PID:10748
- C:\Windows\System\ZvlsCSb.exe
  C:\Windows\System\ZvlsCSb.exe
  2⤵
  PID:10772
- C:\Windows\System\qwASTPv.exe
  C:\Windows\System\qwASTPv.exe
  2⤵
  PID:10796
- C:\Windows\System\JlVjhox.exe
  C:\Windows\System\JlVjhox.exe
  2⤵
  PID:10816
- C:\Windows\System\CZwxglA.exe
  C:\Windows\System\CZwxglA.exe
  2⤵
  PID:10840
- C:\Windows\System\cnXVumu.exe
  C:\Windows\System\cnXVumu.exe
  2⤵
  PID:10860
- C:\Windows\System\XeJrsBH.exe
  C:\Windows\System\XeJrsBH.exe
  2⤵
  PID:10884
- C:\Windows\System\fOuGHfV.exe
  C:\Windows\System\fOuGHfV.exe
  2⤵
  PID:10916
- C:\Windows\System\NKeIOFd.exe
  C:\Windows\System\NKeIOFd.exe
  2⤵
  PID:10944
- C:\Windows\System\gqnenBc.exe
  C:\Windows\System\gqnenBc.exe
  2⤵
  PID:10964
- C:\Windows\System\aeokNXf.exe
  C:\Windows\System\aeokNXf.exe
  2⤵
  PID:10992
- C:\Windows\System\gsqQSIP.exe
  C:\Windows\System\gsqQSIP.exe
  2⤵
  PID:11016
- C:\Windows\System\TpQDUCm.exe
  C:\Windows\System\TpQDUCm.exe
  2⤵
  PID:11036
- C:\Windows\System\GpmLaqV.exe
  C:\Windows\System\GpmLaqV.exe
  2⤵
  PID:11060
- C:\Windows\System\fuWepUV.exe
  C:\Windows\System\fuWepUV.exe
  2⤵
  PID:11088
- C:\Windows\System\MXcTAQQ.exe
  C:\Windows\System\MXcTAQQ.exe
  2⤵
  PID:11112
- C:\Windows\System\ElYPkKi.exe
  C:\Windows\System\ElYPkKi.exe
  2⤵
  PID:11132
- C:\Windows\System\EBxVXkg.exe
  C:\Windows\System\EBxVXkg.exe
  2⤵
  PID:11156
- C:\Windows\System\GSAOkuF.exe
  C:\Windows\System\GSAOkuF.exe
  2⤵
  PID:11176
- C:\Windows\System\wXiWkUE.exe
  C:\Windows\System\wXiWkUE.exe
  2⤵
  PID:11200
- C:\Windows\System\YZQneoi.exe
  C:\Windows\System\YZQneoi.exe
  2⤵
  PID:11228
- C:\Windows\System\lsgtTzs.exe
  C:\Windows\System\lsgtTzs.exe
  2⤵
  PID:11252
- C:\Windows\System\XgBBpos.exe
  C:\Windows\System\XgBBpos.exe
  2⤵
  PID:9064
- C:\Windows\System\QjaZOMC.exe
  C:\Windows\System\QjaZOMC.exe
  2⤵
  PID:9180
- C:\Windows\System\zzqEmUs.exe
  C:\Windows\System\zzqEmUs.exe
  2⤵
  PID:8928
- C:\Windows\System\MoZzPRS.exe
  C:\Windows\System\MoZzPRS.exe
  2⤵
  PID:8492
- C:\Windows\System\sDGeNvq.exe
  C:\Windows\System\sDGeNvq.exe
  2⤵
  PID:8300
- C:\Windows\System\WIWfEjs.exe
  C:\Windows\System\WIWfEjs.exe
  2⤵
  PID:4404
- C:\Windows\System\fkcEYWJ.exe
  C:\Windows\System\fkcEYWJ.exe
  2⤵
  PID:9564
- C:\Windows\System\uKJutfi.exe
  C:\Windows\System\uKJutfi.exe
  2⤵
  PID:7432
- C:\Windows\System\NIRbFnS.exe
  C:\Windows\System\NIRbFnS.exe
  2⤵
  PID:8692
- C:\Windows\System\kDuYzmw.exe
  C:\Windows\System\kDuYzmw.exe
  2⤵
  PID:8860
- C:\Windows\System\BXMOnEI.exe
  C:\Windows\System\BXMOnEI.exe
  2⤵
  PID:8352
- C:\Windows\System\DZimzbg.exe
  C:\Windows\System\DZimzbg.exe
  2⤵
  PID:8952
- C:\Windows\System\DboaCyo.exe
  C:\Windows\System\DboaCyo.exe
  2⤵
  PID:9272
- C:\Windows\System\AtQAOQU.exe
  C:\Windows\System\AtQAOQU.exe
  2⤵
  PID:9328
- C:\Windows\System\YXvKpDN.exe
  C:\Windows\System\YXvKpDN.exe
  2⤵
  PID:9396
- C:\Windows\System\jdmMbVE.exe
  C:\Windows\System\jdmMbVE.exe
  2⤵
  PID:2876
- C:\Windows\System\OQxeCdx.exe
  C:\Windows\System\OQxeCdx.exe
  2⤵
  PID:10688
- C:\Windows\System\agUleGE.exe
  C:\Windows\System\agUleGE.exe
  2⤵
  PID:9752
- C:\Windows\System\KYZoJrm.exe
  C:\Windows\System\KYZoJrm.exe
  2⤵
  PID:9780
- C:\Windows\System\LBaZVCq.exe
  C:\Windows\System\LBaZVCq.exe
  2⤵
  PID:9840
- C:\Windows\System\PDZISHP.exe
  C:\Windows\System\PDZISHP.exe
  2⤵
  PID:10792
- C:\Windows\System\oUNzXSb.exe
  C:\Windows\System\oUNzXSb.exe
  2⤵
  PID:10040
- C:\Windows\System\cduetZG.exe
  C:\Windows\System\cduetZG.exe
  2⤵
  PID:10960
- C:\Windows\System\sPbSrfJ.exe
  C:\Windows\System\sPbSrfJ.exe
  2⤵
  PID:10988
- C:\Windows\System\hGShlIT.exe
  C:\Windows\System\hGShlIT.exe
  2⤵
  PID:7196
- C:\Windows\System\pdRbbuY.exe
  C:\Windows\System\pdRbbuY.exe
  2⤵
  PID:9048
- C:\Windows\System\hebgvAz.exe
  C:\Windows\System\hebgvAz.exe
  2⤵
  PID:8416
- C:\Windows\System\rUthbjS.exe
  C:\Windows\System\rUthbjS.exe
  2⤵
  PID:10316
- C:\Windows\System\neMOrsf.exe
  C:\Windows\System\neMOrsf.exe
  2⤵
  PID:10632
- C:\Windows\System\VdgblBD.exe
  C:\Windows\System\VdgblBD.exe
  2⤵
  PID:10496
- C:\Windows\System\CMppmGv.exe
  C:\Windows\System\CMppmGv.exe
  2⤵
  PID:10448
- C:\Windows\System\ZvxaATe.exe
  C:\Windows\System\ZvxaATe.exe
  2⤵
  PID:10808
- C:\Windows\System\IvMFTUm.exe
  C:\Windows\System\IvMFTUm.exe
  2⤵
  PID:11124
- C:\Windows\System\rSbLtGe.exe
  C:\Windows\System\rSbLtGe.exe
  2⤵
  PID:10292
- C:\Windows\System\GMZLjja.exe
  C:\Windows\System\GMZLjja.exe
  2⤵
  PID:11276
- C:\Windows\System\xDuxipK.exe
  C:\Windows\System\xDuxipK.exe
  2⤵
  PID:11300
- C:\Windows\System\UBBNgad.exe
  C:\Windows\System\UBBNgad.exe
  2⤵
  PID:11324
- C:\Windows\System\GDSibya.exe
  C:\Windows\System\GDSibya.exe
  2⤵
  PID:11348
- C:\Windows\System\QBtRRAQ.exe
  C:\Windows\System\QBtRRAQ.exe
  2⤵
  PID:11376
- C:\Windows\System\uNQnSfV.exe
  C:\Windows\System\uNQnSfV.exe
  2⤵
  PID:11400
- C:\Windows\System\XmGRtCb.exe
  C:\Windows\System\XmGRtCb.exe
  2⤵
  PID:11424
- C:\Windows\System\hzNtUQr.exe
  C:\Windows\System\hzNtUQr.exe
  2⤵
  PID:11452
- C:\Windows\System\PwaynLZ.exe
  C:\Windows\System\PwaynLZ.exe
  2⤵
  PID:11484
- C:\Windows\System\vRqCrqS.exe
  C:\Windows\System\vRqCrqS.exe
  2⤵
  PID:11508
- C:\Windows\System\lfPANeO.exe
  C:\Windows\System\lfPANeO.exe
  2⤵
  PID:11532
- C:\Windows\System\ueUErZK.exe
  C:\Windows\System\ueUErZK.exe
  2⤵
  PID:11552
- C:\Windows\System\VUktktz.exe
  C:\Windows\System\VUktktz.exe
  2⤵
  PID:11576
- C:\Windows\System\EMOBtyF.exe
  C:\Windows\System\EMOBtyF.exe
  2⤵
  PID:11600
- C:\Windows\System\PDhynnq.exe
  C:\Windows\System\PDhynnq.exe
  2⤵
  PID:11632
- C:\Windows\System\JmwxTie.exe
  C:\Windows\System\JmwxTie.exe
  2⤵
  PID:11652
- C:\Windows\System\htmcJXO.exe
  C:\Windows\System\htmcJXO.exe
  2⤵
  PID:11676
- C:\Windows\System\XCOLHFn.exe
  C:\Windows\System\XCOLHFn.exe
  2⤵
  PID:11696
- C:\Windows\System\AVAmGon.exe
  C:\Windows\System\AVAmGon.exe
  2⤵
  PID:11716
- C:\Windows\System\GJlIQVd.exe
  C:\Windows\System\GJlIQVd.exe
  2⤵
  PID:11736
- C:\Windows\System\WbkLyXv.exe
  C:\Windows\System\WbkLyXv.exe
  2⤵
  PID:11772
- C:\Windows\System\GcFdxbd.exe
  C:\Windows\System\GcFdxbd.exe
  2⤵
  PID:11796
- C:\Windows\System\bVENzmn.exe
  C:\Windows\System\bVENzmn.exe
  2⤵
  PID:11820
- C:\Windows\System\wJBQNDf.exe
  C:\Windows\System\wJBQNDf.exe
  2⤵
  PID:11848
- C:\Windows\System\mqBQVWV.exe
  C:\Windows\System\mqBQVWV.exe
  2⤵
  PID:11872
- C:\Windows\System\ICOHkDO.exe
  C:\Windows\System\ICOHkDO.exe
  2⤵
  PID:11904
- C:\Windows\System\YFNmoGE.exe
  C:\Windows\System\YFNmoGE.exe
  2⤵
  PID:11924
- C:\Windows\System\KPpwpJD.exe
  C:\Windows\System\KPpwpJD.exe
  2⤵
  PID:11948
- C:\Windows\System\lZOapTX.exe
  C:\Windows\System\lZOapTX.exe
  2⤵
  PID:11972
- C:\Windows\System\NyVkcyQ.exe
  C:\Windows\System\NyVkcyQ.exe
  2⤵
  PID:11988
- C:\Windows\System\shQJDKQ.exe
  C:\Windows\System\shQJDKQ.exe
  2⤵
  PID:12004
- C:\Windows\System\vGUUSWT.exe
  C:\Windows\System\vGUUSWT.exe
  2⤵
  PID:12024
- C:\Windows\System\XxUkomS.exe
  C:\Windows\System\XxUkomS.exe
  2⤵
  PID:12044
- C:\Windows\System\yAFBASc.exe
  C:\Windows\System\yAFBASc.exe
  2⤵
  PID:12060
- C:\Windows\System\lyvpkIy.exe
  C:\Windows\System\lyvpkIy.exe
  2⤵
  PID:12076
- C:\Windows\System\IJIksXA.exe
  C:\Windows\System\IJIksXA.exe
  2⤵
  PID:12092
- C:\Windows\System\INAvCyc.exe
  C:\Windows\System\INAvCyc.exe
  2⤵
  PID:12108
- C:\Windows\System\zYecjfr.exe
  C:\Windows\System\zYecjfr.exe
  2⤵
  PID:12124
- C:\Windows\System\ICMuhXI.exe
  C:\Windows\System\ICMuhXI.exe
  2⤵
  PID:12140
- C:\Windows\System\BPSgrvU.exe
  C:\Windows\System\BPSgrvU.exe
  2⤵
  PID:12156
- C:\Windows\System\ApcpIHJ.exe
  C:\Windows\System\ApcpIHJ.exe
  2⤵
  PID:12176
- C:\Windows\System\PXFKODm.exe
  C:\Windows\System\PXFKODm.exe
  2⤵
  PID:12196
- C:\Windows\System\zVJGDRx.exe
  C:\Windows\System\zVJGDRx.exe
  2⤵
  PID:12220
- C:\Windows\System\FfAihMn.exe
  C:\Windows\System\FfAihMn.exe
  2⤵
  PID:12244
- C:\Windows\System\PDXSNNt.exe
  C:\Windows\System\PDXSNNt.exe
  2⤵
  PID:12268
- C:\Windows\System\ETHhYgd.exe
  C:\Windows\System\ETHhYgd.exe
  2⤵
  PID:10812
- C:\Windows\System\ViwEAVY.exe
  C:\Windows\System\ViwEAVY.exe
  2⤵
  PID:10220
- C:\Windows\System\GgtFsSR.exe
  C:\Windows\System\GgtFsSR.exe
  2⤵
  PID:8696
- C:\Windows\System\Efsvwfu.exe
  C:\Windows\System\Efsvwfu.exe
  2⤵
  PID:9248
- C:\Windows\System\dWBpmwe.exe
  C:\Windows\System\dWBpmwe.exe
  2⤵
  PID:12312
- C:\Windows\System\FcJaJLp.exe
  C:\Windows\System\FcJaJLp.exe
  2⤵
  PID:12336
- C:\Windows\System\EefvcMF.exe
  C:\Windows\System\EefvcMF.exe
  2⤵
  PID:12356
- C:\Windows\System\omEzZjt.exe
  C:\Windows\System\omEzZjt.exe
  2⤵
  PID:12380
- C:\Windows\System\kvVLhNR.exe
  C:\Windows\System\kvVLhNR.exe
  2⤵
  PID:12396
- C:\Windows\System\ZYVewpY.exe
  C:\Windows\System\ZYVewpY.exe
  2⤵
  PID:12420
- C:\Windows\System\hQmgUDA.exe
  C:\Windows\System\hQmgUDA.exe
  2⤵
  PID:12440
- C:\Windows\System\zuJyafc.exe
  C:\Windows\System\zuJyafc.exe
  2⤵
  PID:12464
- C:\Windows\System\ZwcByHr.exe
  C:\Windows\System\ZwcByHr.exe
  2⤵
  PID:12484
- C:\Windows\System\PZroGJx.exe
  C:\Windows\System\PZroGJx.exe
  2⤵
  PID:12516
- C:\Windows\System\bgcOEmw.exe
  C:\Windows\System\bgcOEmw.exe
  2⤵
  PID:12544
- C:\Windows\System\qeHoNLt.exe
  C:\Windows\System\qeHoNLt.exe
  2⤵
  PID:12560
- C:\Windows\System\xMbXqZX.exe
  C:\Windows\System\xMbXqZX.exe
  2⤵
  PID:12576
- C:\Windows\System\TIpQdja.exe
  C:\Windows\System\TIpQdja.exe
  2⤵
  PID:12596
- C:\Windows\System\wEQETJx.exe
  C:\Windows\System\wEQETJx.exe
  2⤵
  PID:12628
- C:\Windows\System\hKKftXY.exe
  C:\Windows\System\hKKftXY.exe
  2⤵
  PID:12652
- C:\Windows\System\qUOHgoK.exe
  C:\Windows\System\qUOHgoK.exe
  2⤵
  PID:12684
- C:\Windows\System\dxGgIyG.exe
  C:\Windows\System\dxGgIyG.exe
  2⤵
  PID:12704
- C:\Windows\System\msDevzl.exe
  C:\Windows\System\msDevzl.exe
  2⤵
  PID:12724
- C:\Windows\System\GaXCdTN.exe
  C:\Windows\System\GaXCdTN.exe
  2⤵
  PID:9128
- C:\Windows\System\RhdoiKh.exe
  C:\Windows\System\RhdoiKh.exe
  2⤵
  PID:10356
- C:\Windows\System\HYuvZCu.exe
  C:\Windows\System\HYuvZCu.exe
  2⤵
  PID:12392
- C:\Windows\System\rwCQYMA.exe
  C:\Windows\System\rwCQYMA.exe
  2⤵
  PID:12480
- C:\Windows\System\SoMwQgD.exe
  C:\Windows\System\SoMwQgD.exe
  2⤵
  PID:10716
- C:\Windows\System\osEJvPS.exe
  C:\Windows\System\osEJvPS.exe
  2⤵
  PID:12640
- C:\Windows\System\uRJQYdu.exe
  C:\Windows\System\uRJQYdu.exe
  2⤵
  PID:12696
- C:\Windows\System\xXizkCR.exe
  C:\Windows\System\xXizkCR.exe
  2⤵
  PID:12748
- C:\Windows\System\HXLqNjd.exe
  C:\Windows\System\HXLqNjd.exe
  2⤵
  PID:12764
- C:\Windows\System\GkqNpGK.exe
  C:\Windows\System\GkqNpGK.exe
  2⤵
  PID:12856
- C:\Windows\System\TxLNtiO.exe
  C:\Windows\System\TxLNtiO.exe
  2⤵
  PID:8312
- C:\Windows\System\tjUsbCi.exe
  C:\Windows\System\tjUsbCi.exe
  2⤵
  PID:8864
- C:\Windows\System\eDnWPKc.exe
  C:\Windows\System\eDnWPKc.exe
  2⤵
  PID:12388
- C:\Windows\System\UXrwuGR.exe
  C:\Windows\System\UXrwuGR.exe
  2⤵
  PID:9624
- C:\Windows\System\hUWtUhQ.exe
  C:\Windows\System\hUWtUhQ.exe
  2⤵
  PID:9348
- C:\Windows\System\PrFAkba.exe
  C:\Windows\System\PrFAkba.exe
  2⤵
  PID:10744
- C:\Windows\System\iiBwoea.exe
  C:\Windows\System\iiBwoea.exe
  2⤵
  PID:12568
- C:\Windows\System\EOPuAkN.exe
  C:\Windows\System\EOPuAkN.exe
  2⤵
  PID:12620
- C:\Windows\System\jgQiUIL.exe
  C:\Windows\System\jgQiUIL.exe
  2⤵
  PID:7040
- C:\Windows\System\MsmvAgG.exe
  C:\Windows\System\MsmvAgG.exe
  2⤵
  PID:10320
- C:\Windows\System\UwnSMcJ.exe
  C:\Windows\System\UwnSMcJ.exe
  2⤵
  PID:11396
- C:\Windows\System\uMyVOIw.exe
  C:\Windows\System\uMyVOIw.exe
  2⤵
  PID:11460
- C:\Windows\System\UCRAmgK.exe
  C:\Windows\System\UCRAmgK.exe
  2⤵
  PID:13032
- C:\Windows\System\JPYBufE.exe
  C:\Windows\System\JPYBufE.exe
  2⤵
  PID:12916
- C:\Windows\System\tdZtLGH.exe
  C:\Windows\System\tdZtLGH.exe
  2⤵
  PID:13204
- C:\Windows\System\XzKWJXs.exe
  C:\Windows\System\XzKWJXs.exe
  2⤵
  PID:9344
- C:\Windows\System\TPozHkX.exe
  C:\Windows\System\TPozHkX.exe
  2⤵
  PID:8640
- C:\Windows\System\dCZMWWE.exe
  C:\Windows\System\dCZMWWE.exe
  2⤵
  PID:9880
- C:\Windows\System\KQMwUho.exe
  C:\Windows\System\KQMwUho.exe
  2⤵
  PID:13220
- C:\Windows\System\POYmPNV.exe
  C:\Windows\System\POYmPNV.exe
  2⤵
  PID:9176
- C:\Windows\System\HkkYTvM.exe
  C:\Windows\System\HkkYTvM.exe
  2⤵
  PID:11084
- C:\Windows\System\NKFxqnj.exe
  C:\Windows\System\NKFxqnj.exe
  2⤵
  PID:6656
- C:\Windows\System\tkeOYcx.exe
  C:\Windows\System\tkeOYcx.exe
  2⤵
  PID:10740
- C:\Windows\System\SeHIsZP.exe
  C:\Windows\System\SeHIsZP.exe
  2⤵
  PID:12324
- C:\Windows\System\nDUssuI.exe
  C:\Windows\System\nDUssuI.exe
  2⤵
  PID:6996
- C:\Windows\System\QAqTqBK.exe
  C:\Windows\System\QAqTqBK.exe
  2⤵
  PID:11284
- C:\Windows\System\PjMFBnx.exe
  C:\Windows\System\PjMFBnx.exe
  2⤵
  PID:12404
- C:\Windows\System\vMKBVyz.exe
  C:\Windows\System\vMKBVyz.exe
  2⤵
  PID:7908
- C:\Windows\System\GNaMFrc.exe
  C:\Windows\System\GNaMFrc.exe
  2⤵
  PID:11560
- C:\Windows\System\kyDxfkf.exe
  C:\Windows\System\kyDxfkf.exe
  2⤵
  PID:11648
- C:\Windows\System\TrkApvK.exe
  C:\Windows\System\TrkApvK.exe
  2⤵
  PID:9148
- C:\Windows\System\RZjAyeQ.exe
  C:\Windows\System\RZjAyeQ.exe
  2⤵
  PID:11244
- C:\Windows\System\jKrnzqB.exe
  C:\Windows\System\jKrnzqB.exe
  2⤵
  PID:12528
- C:\Windows\System\liuZZyH.exe
  C:\Windows\System\liuZZyH.exe
  2⤵
  PID:9676
- C:\Windows\System\gPrqqBF.exe
  C:\Windows\System\gPrqqBF.exe
  2⤵
  PID:9024
- C:\Windows\System\tjFesIb.exe
  C:\Windows\System\tjFesIb.exe
  2⤵
  PID:12504
- C:\Windows\System\KMdEFqh.exe
  C:\Windows\System\KMdEFqh.exe
  2⤵
  PID:12284
- C:\Windows\System\IpnkoLw.exe
  C:\Windows\System\IpnkoLw.exe
  2⤵
  PID:12304
- C:\Windows\System\GsyidXR.exe
  C:\Windows\System\GsyidXR.exe
  2⤵
  PID:10004
- C:\Windows\System\mKWUvHD.exe
  C:\Windows\System\mKWUvHD.exe
  2⤵
  PID:10428
- C:\Windows\System\UroTsOF.exe
  C:\Windows\System\UroTsOF.exe
  2⤵
  PID:12796
- C:\Windows\System\sJxmsow.exe
  C:\Windows\System\sJxmsow.exe
  2⤵
  PID:9924
- C:\Windows\System\xbjALzS.exe
  C:\Windows\System\xbjALzS.exe
  2⤵
  PID:1956
- C:\Windows\System\InObCMN.exe
  C:\Windows\System\InObCMN.exe
  2⤵
  PID:12072
- C:\Windows\System\JcnjtvS.exe
  C:\Windows\System\JcnjtvS.exe
  2⤵
  PID:12492
- C:\Windows\System\MKOqOTP.exe
  C:\Windows\System\MKOqOTP.exe
  2⤵
  PID:11624
- C:\Windows\System\JkEdgUN.exe
  C:\Windows\System\JkEdgUN.exe
  2⤵
  PID:9928
- C:\Windows\System\EUIYpwy.exe
  C:\Windows\System\EUIYpwy.exe
  2⤵
  PID:8212
- C:\Windows\System\WfpsaMQ.exe
  C:\Windows\System\WfpsaMQ.exe
  2⤵
  PID:10420
- C:\Windows\System\MaQfKGA.exe
  C:\Windows\System\MaQfKGA.exe
  2⤵
  PID:11356
- C:\Windows\System\SEBHNNF.exe
  C:\Windows\System\SEBHNNF.exe
  2⤵
  PID:11524
- C:\Windows\System\ICpWBAc.exe
  C:\Windows\System\ICpWBAc.exe
  2⤵
  PID:12192
- C:\Windows\System\AZLjwTa.exe
  C:\Windows\System\AZLjwTa.exe
  2⤵
  PID:12068
- C:\Windows\System\sNxATry.exe
  C:\Windows\System\sNxATry.exe
  2⤵
  PID:13092
- C:\Windows\System\NTetbna.exe
  C:\Windows\System\NTetbna.exe
  2⤵
  PID:11024
- C:\Windows\System\cygzkEb.exe
  C:\Windows\System\cygzkEb.exe
  2⤵
  PID:12900
- C:\Windows\System\VOLrnlS.exe
  C:\Windows\System\VOLrnlS.exe
  2⤵
  PID:11792
- C:\Windows\System\qkUogaG.exe
  C:\Windows\System\qkUogaG.exe
  2⤵
  PID:10028
- C:\Windows\System\wXYHJRg.exe
  C:\Windows\System\wXYHJRg.exe
  2⤵
  PID:12984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\B91VJWSD\site-d059d883a114[1].css

Filesize
66KB

MD5
06ad9bc6321c6fed15c64dd375c36d90

SHA1
2abef97ab0621a1d832c6ca784721adad5bc8315

SHA256
74439e916848a6d30f2933b4e7c5a88b41d8ca3a1593f68a82596379806d4ae6

SHA512
d059d883a114193dd05c54c9d3db4f1552bba29320d529b3abed354152a17bcd773dfdec46afc8c2f2d7fd7f13ff85042fa697d761cb7a3447a8488349c81e2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pawjwmta.r1n.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\DIQqVrJ.exe

Filesize
2.4MB

MD5
f2409c0cf66a926fd0167bac366938f3

SHA1
d560dbc7ffb0e6c19f435acb66843dcb333dd7d6

SHA256
f21f5c5c65fa75557dcba4df35ed1a85cb49b844a4dd830995fe80422dad585f

SHA512
0f1afc2b7cf893723eeac686b2e2e1021fa466faa381a9537308e5b8a22d66f7ba9d4c462b7ad728578177a4cec85ad355835d80daab3c2bb92ca91c5b998966

Download Submit
C:\Windows\System\DTRAfNi.exe

Filesize
2.4MB

MD5
de3a98f37d3da932dd41da6b215db569

SHA1
4507a044248b9f8ac362aaa008095150acd3647f

SHA256
019018b728e439446e981878e881ae13d453a98c5de4773475834ae1ffd10c56

SHA512
d39840b0aa6c7a2a3c8cfb17ad345474db2c9a8a8dce12d617bab881976efcdd0d65245f4d300be03b9d8ba4b4ff4b868e5d9754b2b285e157694d3482b200e5

Download Submit
C:\Windows\System\DnhHabj.exe

Filesize
2.4MB

MD5
278f1fb2a9c4c049ca128cf5803660e0

SHA1
c4e131b6a3db58dcf080dde083e8690b9ccf0f4d

SHA256
9e6fd76df4a4fd755360bc78f2fed86cae50e9119e9bafc586355185eaac4821

SHA512
6391b0833e59aee207df84293d8e5bbb23d992768e5cc732b3aad317b28e7d1ad08a3652279d2ace9d21fac6e70a924962f1c32b5d16b92ddbc6229e4c31d3de

Download Submit
C:\Windows\System\DthxCMd.exe

Filesize
2.4MB

MD5
3ac15ea0b645a617568fc26367478791

SHA1
ce991376848c1a0cd938102baf8d58fdefa443bb

SHA256
87ef15c2d9b5a90deba17e60b7f0f55c47deca2b05b6b7460d6afaa6f5d99e4f

SHA512
3cd0b718da00108f8e60aba74d717ea0506c0fc14bd841fa7f1d8d3e6af2ae45a500072dd4aa9e0f63f9f9e7f560d5016034f764d6d3f6856a2f4b97a101a257

Download Submit
C:\Windows\System\EQZxnjm.exe

Filesize
2.4MB

MD5
18dd91bbbb3a08ef584a9ec0419b0143

SHA1
7372b6addd5a692f1c1c4e8d56999507a9205a83

SHA256
bf16c949e26c4a0643131025c35fa6770c7d05d6f0d51e4064ca1d6fcd8f4c05

SHA512
464f0a5cb765bd4411dbe10a2cced0e608241851deb62dde0782d8f3adb3e888bbf005628af27d6f70be58b4663d36a8dc71a5fa8f36bfad673e92a866ff866a

Download Submit
C:\Windows\System\GGzMEgy.exe

Filesize
2.4MB

MD5
e7e5587fb320be614177bea0436734cb

SHA1
206a0cfde8c0126a90be6946d704390076e1bcc3

SHA256
5c5cde67f230927d1e36ba229d37a04aa74cc31ae09b02aaf5c7de27783e5541

SHA512
47dbb30154aa002f7b3ed9fa005f87554bdaa7a6b7b6535b622aa15f34f94720a5cecf3f08df86d5d907865110820d43e23dacf365ffbb0729c4b02b3899d3bd

Download Submit
C:\Windows\System\GfONrjz.exe

Filesize
2.4MB

MD5
4385d183195fdee57db9be69729727f5

SHA1
3ef5fa40efb8ed1dc211addebe9fb85ac33d7380

SHA256
4bec5a6b8364954dc85c7559d240b77dca778a103431a70ffde940359676f6c1

SHA512
81e8bd6114a352d6d722b568c594773a9d7712f9bd338fd9b28b117d8abcd91db8efbc138ca9211d527269a6d7999323c988dad86ec81db4fff9c59e3995d2b5

Download Submit
C:\Windows\System\GxPKoml.exe

Filesize
2.4MB

MD5
06bbe09acfc2109e7a8ac9603be6ac19

SHA1
42d37fa02a0564b60f027c20a98416034ffc51f9

SHA256
e904fe6108d0983c7118c93a136e121ebb5dd5892e40634315753b5932e4c56b

SHA512
9dad3ef28a963ccaf224465e64137e5cd73d6a3e1686ae4bff7856d2bee7c6fd1174991d1e5cf39ffff339d9897b62a029ae36969bcbbbead5f52ab984bc4f57

Download Submit
C:\Windows\System\IWweZit.exe

Filesize
2.4MB

MD5
c6d280b7840fc14ace39f4815c56255c

SHA1
aab4541cb93095c1652c351d958525ff4e454704

SHA256
3885f7764e684dd1fd2ef666f76ebfe95e5f461032c8e966ca6ec7aa2445331e

SHA512
19d821b6bad00e817e461758cb263e58ecd693914ae39e6ce5bc3ced6eb0a4dd560737949621f99c331199382075d73e11ea102a423484709b707b3633830e19

Download Submit
C:\Windows\System\LDhtEVf.exe

Filesize
2.4MB

MD5
02d8fba2282581256bce4636f419ced3

SHA1
9594701f746670ec8cd28e611f3f1f9c6642582d

SHA256
a6f0d00cb8cd0d29d67dba7567de295d014384d4455a76f9db02fe3c419e4b3f

SHA512
a30d44921dfca76d8ee159fb9b6fbaa60634c5822543d0c2d182b2bc050ba1ab3245140859e4646ce084eccf6d9053de50848531879a94a6c6fadc86fbacb59b

Download Submit
C:\Windows\System\LnYRyrq.exe

Filesize
2.4MB

MD5
bf627a0941b2952802784dd95a741d5a

SHA1
f8598a9cd09d52e4fdc54cfb7dd2d60a60e91bef

SHA256
79689752ffffeb47ff08a1b953d0ac4803afd8e65b29db57729c4517b85a9b46

SHA512
fe0d509da211369ba55760c4292d20ca4aa5cc5b6f98a3157aab6df2a43c717304a0cc513d414784b6cc524c075e1d60c883e08af6b6db87378e2816a8cd7645

Download Submit
C:\Windows\System\MHBviIe.exe

Filesize
2.4MB

MD5
dbfc80db613ec04fa7e2481f15ff2c8a

SHA1
ce36676403b076ac0bd008685c55dbf12a03bdf4

SHA256
c0e706880b3bdc9448abc380c8905a9fad8e9d914c2248b4e9f0f1e3a507d3b8

SHA512
02050c24679ef3545ba7725d033edcfaa7403933f5caf1a206bda93ec7d116173917b65f6327df1a905b11d045ba77c035573bcb9de16ddbcde6fe8a5aa17b2f

Download Submit
C:\Windows\System\MkCSkkh.exe

Filesize
2.4MB

MD5
f0bab486cd59a3b5bbc45fce39b95c65

SHA1
a3748c7215f53ecfa5c26bdf4e0b9e538942c7de

SHA256
1059a4a0011fe1f3faa6325fd6d1191e14e470d608de08f5fb0142b2bdfca807

SHA512
26a93a25c4d33ea7843352fe47245c1c30a8bb951e484cdbaea8ebd9b9813099ddc0efc071c5e1d3fd23728f9bbe0c52a4b3b824377a4e87698cf59bead33d93

Download Submit
C:\Windows\System\NMSMjWH.exe

Filesize
2.4MB

MD5
92b177024a43c645e3a4070989bca479

SHA1
818e15b035f36f94892905af1c6c2534c2e54901

SHA256
e200c1d86660ef9841356ab1833049709cf9748a755215c0561be684f1be7a6c

SHA512
c1c09dbef57fa1ff39406112938cd2e21e7d99ad3393242d020ac55bf65b0abd44f9817a1fe35f7fa254053cc75bb4ac30d1a219367ed42545270965e2a702d5

Download Submit
C:\Windows\System\OAZQmvl.exe

Filesize
2.4MB

MD5
5f52f187e40c03ccf5d44d3272d288af

SHA1
9baceac987e3a42a1bf7bba3360a5909a6a7c1dc

SHA256
8577ac5f8367675dc84abd8d66f30693338f1da0bf97593b7e3ab84ef0d68c9b

SHA512
4b85bf136e8b673537573e0d712ae9c49059e0f61354bd3c6e5a83bf2cbed179d8812483ae33bbd587123d6b10ff8fbaf7c4ba169616229fbf03fac798d03518

Download Submit
C:\Windows\System\OJUmWSm.exe

Filesize
2.4MB

MD5
3391f464a74370187921783113b1d678

SHA1
3cbfdfbba9db355d06f7b61eee44e9f0434ea86c

SHA256
ee9dbd96e7584b1ea2e939bd273aca7a67777c86b526cb1ae8779cd515067792

SHA512
701651e3e5eee6aa22509de63e32c880fb597a6eab7958cbbd4632605aa65f3188cc46a7c06bb63afc3901e924f3ab7ad15591c81de7b448cbb461b3e336b375

Download Submit
C:\Windows\System\OiQnYHf.exe

Filesize
2.4MB

MD5
e52f391de20e1498e9de0749c594336e

SHA1
4a7c2060712544600a6c2d1f93319d9b6642a0c8

SHA256
5bbea68b895279fe12abf59490fc274a0b4a723d2ca61a34f9d08e6f544f7fab

SHA512
71eeb08da2b9b9a200d353a4e8e73165d0f507b10f3327e911cf615e567e57dec7444542428dbdcab2f91621e35363fc9b0e998cb8b4be9044dfe3c0b50acc66

Download Submit
C:\Windows\System\PMhhZHo.exe

Filesize
2.4MB

MD5
6f8f174ca5f39221efb2dba1c34d1503

SHA1
44f10e23de47b99022beb54a91d290ff5266fca0

SHA256
885d7c4e60d5bf126186c9e6e62210e214482555af2de575a96ed701c1c71656

SHA512
b6f0e9530259e865e01bbf872eec6c477692fe519cf296e3b226da3c0000ac489540d2d543372d642deccb6996186a9b6104c45fe08302d5756f0656c4de610d

Download Submit
C:\Windows\System\PeHaFAB.exe

Filesize
2.4MB

MD5
60c352cc17ceace7a3b9c6977198b875

SHA1
4c747d7586f04cc1893fc286c147e6532feef047

SHA256
af2629bf018cdc2985b6462467a7583394c61669f9d97ce0cc90c878a748dcd3

SHA512
27423c172b955b880bc1f91cec0e32db52ffc13be6c26204d1bc564284501c760708712bd93894e03f91324fad5dc01932a11c52bd950ee881b855c2644b24a2

Download Submit
C:\Windows\System\RPYZOBL.exe

Filesize
2.4MB

MD5
c705e21c732bc3dc606f23d4ce2b0705

SHA1
31f3c14b73f5520f5bdfd9bd2c9a5aa4bf4e3f45

SHA256
00d167f502cd621dfa73eadca12e49d4e2b80b635f193d42372129e80272b002

SHA512
8faed9b4a694ebc0f50a91cea8f9d2fb9027733057ef7344231041d46d3a2c1a146a26c53ca9de0ca7f79525701485d34af2dfc60d3bb47153cec5ceb327d52d

Download Submit
C:\Windows\System\RdXlSOw.exe

Filesize
2.4MB

MD5
300aac2b7fdd14f37463f0140d1c3a69

SHA1
1fe633f9a3f6c71494fe1611c86e8da266d9377c

SHA256
5b560ceeaeb18ade29dcdaa4f19ab4942fd5843a8bac2b428c075ce8e8b39d8b

SHA512
963fd22f2e2ce3306d446eb3bb09044bbadd55ce1112281d8796b04b71ad537e64c3e8fa07c5f153be9046d1fb76ab263f2047d484e62beb8ab4a9d7ab24c9a5

Download Submit
C:\Windows\System\SFZFviC.exe

Filesize
2.4MB

MD5
74e71a122847cfc092c6f905c8262878

SHA1
bcda7864d3a8766bbad15a1fc67b3da50571b1a3

SHA256
843d3e994d5f404a28eae9f172a09b3510be6c7aff4858f9193acf012f2ce0ee

SHA512
6baa5c42fd443be0c6953f8cff22c1a1d21fbb6bee55dd13700952348c0f7e44d5a401b0c8e3c5b3211e7cec320a8c67f203741445ea228162ef5fb768fcb4a6

Download Submit
C:\Windows\System\UppxEFd.exe

Filesize
2.4MB

MD5
55442bd81d5e10b8d3843fddfd2538cb

SHA1
69f795634609abb57646f4bd173d353b8ec0cf65

SHA256
1a2bd83b69d4bc0410db6268aa7d16252d1be06c448940ceaade8433366e9ac3

SHA512
474d8f2e51e11839f25a861270fb1263fd7cbc233a94e80548bf31fb57e414851a3ad89d66e3a32634408500fa5e07c2a544702ff994686102a7acfff7c934c3

Download Submit
C:\Windows\System\VblaGcF.exe

Filesize
2.4MB

MD5
4d4686946cb7de33a9703eeb132ccaa5

SHA1
f8e8040b3b8c6ae3571b089414d717526c6dbfd6

SHA256
976264e1253a23b0f4e6d5a75c78e2f6ac4a6f4859a60ff3b7ea82706ad6bda5

SHA512
83827034760dada7ac3a8be37ea40ee720c8057bf3416aa3472918a09a5614edfce709d40a7a94c7373f854ac8c150dbf561f2467d9387ea0f20666338f5e5b2

Download Submit
C:\Windows\System\gtieoPe.exe

Filesize
2.4MB

MD5
054abf8efcf64f39878f03c1821b121e

SHA1
4dda9091350a063a1f2f6ee512cfdd6b4e05579c

SHA256
9e3eb60cc709e592526e0644b52d5c6b87465d600ce98c299866b277e45a6546

SHA512
67c9825d17e01b284404c77fa8eb582d55ed74f18b22d42741563a135f914ffa80fda4ee9bc0e16e10dbfe69d9854c195e1bb178f493e9467374beeb28d85ead

Download Submit
C:\Windows\System\kGYVifv.exe

Filesize
2.4MB

MD5
301b8030fc37a136294f12192e3e41bb

SHA1
8a324ec1d4c745d0c9d9788acaaee83382fd228b

SHA256
0da173893a05b828497a93f0e8f8bc0018ea9529fde4f4101ad957f6c9981260

SHA512
5f2b9ef8d1f6d0d614348cc03cf9185714b2e6ddbacb2463a2067196b7b6f50291e9581cfde06ac03d731b1d15c281fe968bd6e41ab653b65d55c69192453541

Download Submit
C:\Windows\System\kwvOwBC.exe

Filesize
2.4MB

MD5
5542a122bc1494878e3f85ea3b473f0d

SHA1
9317b0100c132b8dbd4a2d71474f78cf4a241667

SHA256
d7f1f7ca40a8b5ecefcd796bae1acfac4c98ed40205f4fe7fb1f251dabf29095

SHA512
eadc28c773436b6e19292fb93ecdc062410d15b167d829711917c1decc7c5a7c57ef6cb536f9ac5abf3818dd297b952e4360e22a90ea50a5c6b9a9e10d140b71

Download Submit
C:\Windows\System\lEiJOAT.exe

Filesize
2.4MB

MD5
f01321289cfedb828fc8bdc92851af59

SHA1
ca6007a181b133ebee4efc2121cc3cdc26e28218

SHA256
e81373c568b7b25bff483633203a58eedc5f7f4dbf65c04bcc0d14e80cf5c44a

SHA512
47095fa334bddc30304a0379d78f6c95c16dacd11c5750a662969d1578d01e2984bd0736625ca823725f52635425859bd6e6abf6df90e120b26ed8c646f96c05

Download Submit
C:\Windows\System\qPVCrVC.exe

Filesize
8B

MD5
2adac273ce248e8d242a4b12f749bb46

SHA1
300bd2c60c669d978305195f11eaf26c73d9e457

SHA256
5a695799bf8f73300a4f9c4a59fd25b209a2457abf1051a262d540e520557456

SHA512
011941b215532355e8e4d21af78180da68d2fe04927118ebe818ec14ec4bfb6a7a2d9aaa01fdfd0cd2c6dc84968b5f642ccf10cc92c29aa0e1d06bcf6f120232

Download Submit
C:\Windows\System\qZJDJjJ.exe

Filesize
2.4MB

MD5
e8ee39edc635b3005d28a846791de7e1

SHA1
145af77cf9897c45c22fab506fab52b76078d59c

SHA256
cf3ad4cdc9519986a72f31745a193d38efb960b6dd4837e9a8524c024e8f9958

SHA512
e3f66e4786fe509900ecca4ad7798bc5f3fd2da65fc2d181a0964951a9e09c865e8f16e58c99f4967d6ded8070a55532fd8e1a4836b948eddf507da659d0cb4f

Download Submit
C:\Windows\System\qiOjavD.exe

Filesize
2.4MB

MD5
e4a8429c7c7b41f9e00ad1a39a6c2a36

SHA1
92d913da10333ee9e1517d4e5f20f7d55cb2c529

SHA256
5f8cb1b07a994962092055cd61ced754d143d1b5ab06556f4be4f1ba094bf093

SHA512
2546ecb6fc623cd04f4e45120760ea2a7bcfa54358188aeadfed2bb09b9ab9378b7b9e0ba9a8152b9e9faa787f2694569a6b44c8efff574b0e49c76a1f038f99

Download Submit
C:\Windows\System\qqSkFop.exe

Filesize
2.4MB

MD5
4ff299b459f985e2951488c833e36404

SHA1
519bedd8200a3e3aee40421d0c9343fa389ca418

SHA256
3112ae6b7edf490a906cf91fabb7fa647570f0b033dd8b84bbaad696ed650aa0

SHA512
2fec99444a19ae36b1580a1946d271f9ef7b432188419f494c63683e3a798c7d22a706a0c53b74ec09b0adaef36b4aa58bf72c31be1a25875aa224eec08a5b67

Download Submit
C:\Windows\System\tJswDwS.exe

Filesize
2.4MB

MD5
74f634c99d6b554332063cf77fe5ba49

SHA1
8cd2ac67dad89a0f38b389f3c3e05fff7c23e685

SHA256
e57d90def9b5452b5867a269f620997ce449f73ffa38d3dded1f42a523a14bf2

SHA512
3e173f4c505f7fd0b030766b360d1f0651d4229e44617d64bdb2260c8c96f2e9e954e1a06c3b8e2d455faa43a25f8ef09c68c52716557432fe7467046df640a7

Download Submit
C:\Windows\System\vELiQIU.exe

Filesize
2.4MB

MD5
d527b80ec0ef5cbcc982646021752c06

SHA1
ffe7677074c97262d1a319a20a797ada04168ac3

SHA256
ba8760eda48faa8143607c8d39ebff17d6daaf35fbe8275f7efd0355cdfe3f33

SHA512
a0dcb478ad2a70eb0bbe64aba5a15264d66829a7357bcc3139040d5abb82c2c73b21743394b1cad80e7328fee4b2af33fa1b8eacbbbd2198029a4e0c2308ebe4

Download Submit
C:\Windows\System\vSniujc.exe

Filesize
2.4MB

MD5
089eb39194df65907c456bb2512b1b63

SHA1
2554c4043ff05cde52894e8ff96714f08d20fade

SHA256
5d7c7c4c40d11812c7f231240dee78882493a21e008e12a2a56de9f93e73bf57

SHA512
cdb8b17fa37c4871612998f6eb95c70b2c968e68412f8ce57b22787e3fdd1ed7deb54e2247a07165d6e76abd2a892326395fdcb62878664dd2f4c3aebbf27b19

Download Submit
C:\Windows\System\xSYkeEp.exe

Filesize
2.4MB

MD5
600df99fa590f213b8c435776a6ebbdf

SHA1
da6e19e737cb23617e2d51cb802447c82874ec0e

SHA256
b8f1702fa1b2c8dd39b7110023e9ff91673c19451847c5c827f9079d8b7e5e21

SHA512
3311ca070eed408fe09532fc24f3a895640b9baf642053ebf7bf1d345721524af82ed350b418efa076502fcdeae504096e9e896ee6b6877f8cb33f2b6201a0c5

Download Submit
C:\Windows\System\xaNyiUb.exe

Filesize
2.4MB

MD5
367fcf80bf731d4067c3b4953fbd394a

SHA1
cb56c6a64088312f85a4006ed13fe74181524180

SHA256
cc6ef41d7bf879c3252cceb981faba381ece244c57b5bd5311cc13a751d73a2d

SHA512
02ff3662618bfcf665d0271fcab39c179f7840b22ad9534e76c4817735e8acd89e97dc4030a688f0d6deaf2c06fab9a51e84b7d368fe29ec19e5127bd02c1542

Download Submit
C:\Windows\System\ztbWEgF.exe

Filesize
2.4MB

MD5
07a22c0454bb9868479184ebcd91d1bb

SHA1
595e85fb9c6bf6eaf185e202f4ac124201f3e540

SHA256
8e61e969c379d1fbebbb4a3802857224801dc0298bad7198547827e143e142af

SHA512
672e73d536b8b15de592747c397544499d17f1c70552fac4a086ca7d57e0c00b262ab16886094dc857eed64751c6251dc04f07aee44bb0be56d477225e24c7bf

Download Submit
memory/8-282-0x00007FF64D340000-0x00007FF64D732000-memory.dmp

Filesize
3.9MB

Download
memory/8-4135-0x00007FF64D340000-0x00007FF64D732000-memory.dmp

Filesize
3.9MB

Download
memory/400-4146-0x00007FF788500000-0x00007FF7888F2000-memory.dmp

Filesize
3.9MB

Download
memory/400-285-0x00007FF788500000-0x00007FF7888F2000-memory.dmp

Filesize
3.9MB

Download
memory/744-218-0x00007FF6AEA40000-0x00007FF6AEE32000-memory.dmp

Filesize
3.9MB

Download
memory/744-4137-0x00007FF6AEA40000-0x00007FF6AEE32000-memory.dmp

Filesize
3.9MB

Download
memory/924-208-0x00007FF7F8FE0000-0x00007FF7F93D2000-memory.dmp

Filesize
3.9MB

Download
memory/924-4131-0x00007FF7F8FE0000-0x00007FF7F93D2000-memory.dmp

Filesize
3.9MB

Download
memory/1044-4149-0x00007FF7B5590000-0x00007FF7B5982000-memory.dmp

Filesize
3.9MB

Download
memory/1044-311-0x00007FF7B5590000-0x00007FF7B5982000-memory.dmp

Filesize
3.9MB

Download
memory/1384-240-0x00007FF758C80000-0x00007FF759072000-memory.dmp

Filesize
3.9MB

Download
memory/1384-4144-0x00007FF758C80000-0x00007FF759072000-memory.dmp

Filesize
3.9MB

Download
memory/1584-4169-0x00007FF6EB820000-0x00007FF6EBC12000-memory.dmp

Filesize
3.9MB

Download
memory/1584-349-0x00007FF6EB820000-0x00007FF6EBC12000-memory.dmp

Filesize
3.9MB

Download
memory/1624-4143-0x00007FF64D850000-0x00007FF64DC42000-memory.dmp

Filesize
3.9MB

Download
memory/1624-347-0x00007FF64D850000-0x00007FF64DC42000-memory.dmp

Filesize
3.9MB

Download
memory/1788-4139-0x00007FF78E400000-0x00007FF78E7F2000-memory.dmp

Filesize
3.9MB

Download
memory/1788-215-0x00007FF78E400000-0x00007FF78E7F2000-memory.dmp

Filesize
3.9MB

Download
memory/1868-4148-0x00007FF7171A0000-0x00007FF717592000-memory.dmp

Filesize
3.9MB

Download
memory/1868-316-0x00007FF7171A0000-0x00007FF717592000-memory.dmp

Filesize
3.9MB

Download
memory/2000-342-0x00007FF707900000-0x00007FF707CF2000-memory.dmp

Filesize
3.9MB

Download
memory/2000-4174-0x00007FF707900000-0x00007FF707CF2000-memory.dmp

Filesize
3.9MB

Download
memory/2008-338-0x00007FF627B20000-0x00007FF627F12000-memory.dmp

Filesize
3.9MB

Download
memory/2008-4167-0x00007FF627B20000-0x00007FF627F12000-memory.dmp

Filesize
3.9MB

Download
memory/2340-4153-0x00007FF65D620000-0x00007FF65DA12000-memory.dmp

Filesize
3.9MB

Download
memory/2340-294-0x00007FF65D620000-0x00007FF65DA12000-memory.dmp

Filesize
3.9MB

Download
memory/2560-343-0x00007FF6E1820000-0x00007FF6E1C12000-memory.dmp

Filesize
3.9MB

Download
memory/2560-4163-0x00007FF6E1820000-0x00007FF6E1C12000-memory.dmp

Filesize
3.9MB

Download
memory/2680-4126-0x00007FF73BD10000-0x00007FF73C102000-memory.dmp

Filesize
3.9MB

Download
memory/2680-346-0x00007FF73BD10000-0x00007FF73C102000-memory.dmp

Filesize
3.9MB

Download
memory/2928-1-0x0000015973B30000-0x0000015973B40000-memory.dmp

Filesize
64KB

Download
memory/2928-0-0x00007FF701C50000-0x00007FF702042000-memory.dmp

Filesize
3.9MB

Download
memory/3248-4129-0x00007FF7154F0000-0x00007FF7158E2000-memory.dmp

Filesize
3.9MB

Download
memory/3248-106-0x00007FF7154F0000-0x00007FF7158E2000-memory.dmp

Filesize
3.9MB

Download
memory/3988-266-0x00007FF64B4A0000-0x00007FF64B892000-memory.dmp

Filesize
3.9MB

Download
memory/3988-4141-0x00007FF64B4A0000-0x00007FF64B892000-memory.dmp

Filesize
3.9MB

Download
memory/4000-189-0x000001AE47710000-0x000001AE47732000-memory.dmp

Filesize
136KB

Download
memory/4000-49-0x00007FFF36220000-0x00007FFF36CE1000-memory.dmp

Filesize
10.8MB

Download
memory/4000-381-0x000001AE482B0000-0x000001AE48A56000-memory.dmp

Filesize
7.6MB

Download
memory/4000-13-0x00007FFF36223000-0x00007FFF36225000-memory.dmp

Filesize
8KB

Download
memory/4188-4127-0x00007FF68EA70000-0x00007FF68EE62000-memory.dmp

Filesize
3.9MB

Download
memory/4188-159-0x00007FF68EA70000-0x00007FF68EE62000-memory.dmp

Filesize
3.9MB

Download
memory/4264-4123-0x00007FF62D780000-0x00007FF62DB72000-memory.dmp

Filesize
3.9MB

Download
memory/4264-12-0x00007FF62D780000-0x00007FF62DB72000-memory.dmp

Filesize
3.9MB

Download
memory/4332-340-0x00007FF69A1F0000-0x00007FF69A5E2000-memory.dmp

Filesize
3.9MB

Download
memory/4332-4165-0x00007FF69A1F0000-0x00007FF69A5E2000-memory.dmp

Filesize
3.9MB

Download
memory/4376-4176-0x00007FF670BC0000-0x00007FF670FB2000-memory.dmp

Filesize
3.9MB

Download
memory/4376-344-0x00007FF670BC0000-0x00007FF670FB2000-memory.dmp

Filesize
3.9MB

Download
memory/4432-281-0x00007FF6A47C0000-0x00007FF6A4BB2000-memory.dmp

Filesize
3.9MB

Download
memory/4432-4151-0x00007FF6A47C0000-0x00007FF6A4BB2000-memory.dmp

Filesize
3.9MB

Download
memory/4560-4170-0x00007FF6FAD10000-0x00007FF6FB102000-memory.dmp

Filesize
3.9MB

Download
memory/4560-345-0x00007FF6FAD10000-0x00007FF6FB102000-memory.dmp

Filesize
3.9MB

Download
memory/4820-348-0x00007FF749DC0000-0x00007FF74A1B2000-memory.dmp

Filesize
3.9MB

Download
memory/4820-4155-0x00007FF749DC0000-0x00007FF74A1B2000-memory.dmp

Filesize
3.9MB

Download