xmrig | c9feb36ae2c14b6a4d5c06b3f9556698218392726850bf1898931b5b4a3661d0

Analysis

max time kernel
70s
max time network
41s
platform
windows10-2004_x64
resource
win10v2004-20240729-en
resource tags

arch:x64arch:x86image:win10v2004-20240729-enlocale:en-usos:windows10-2004-x64system
submitted
28/07/2024, 00:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
Size

1.7MB
MD5

03b1c24229d33c26654e1313bb1e7bba
SHA1

a5801316fb1fcad04a5a8a8401bf7a9f69bb0d8c
SHA256

c9feb36ae2c14b6a4d5c06b3f9556698218392726850bf1898931b5b4a3661d0
SHA512

a43a5cd5bfaf5d044ea975b56115b856fdee9c37a459c5b34e9090983535fe43a03c677626e14f201e7cb1a7be96e985d9ab6313491a84ee8b1cab7d7ac4ca11
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXeug:NABY

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/4348-383-0x00007FF770940000-0x00007FF770D32000-memory.dmp	xmrig
behavioral2/memory/3916-478-0x00007FF77E920000-0x00007FF77ED12000-memory.dmp	xmrig
behavioral2/memory/1504-532-0x00007FF7C0670000-0x00007FF7C0A62000-memory.dmp	xmrig
behavioral2/memory/4536-579-0x00007FF681C60000-0x00007FF682052000-memory.dmp	xmrig
behavioral2/memory/4004-592-0x00007FF6DBB20000-0x00007FF6DBF12000-memory.dmp	xmrig
behavioral2/memory/3644-722-0x00007FF6F3F10000-0x00007FF6F4302000-memory.dmp	xmrig
behavioral2/memory/4180-799-0x00007FF719800000-0x00007FF719BF2000-memory.dmp	xmrig
behavioral2/memory/1080-1007-0x00007FF68E890000-0x00007FF68EC82000-memory.dmp	xmrig
behavioral2/memory/4772-1709-0x00007FF6CD720000-0x00007FF6CDB12000-memory.dmp	xmrig
behavioral2/memory/4296-1700-0x00007FF759B20000-0x00007FF759F12000-memory.dmp	xmrig
behavioral2/memory/4192-1575-0x00007FF645190000-0x00007FF645582000-memory.dmp	xmrig
behavioral2/memory/1488-1550-0x00007FF67A070000-0x00007FF67A462000-memory.dmp	xmrig
behavioral2/memory/4648-1352-0x00007FF622CD0000-0x00007FF6230C2000-memory.dmp	xmrig
behavioral2/memory/2032-1349-0x00007FF618D40000-0x00007FF619132000-memory.dmp	xmrig
behavioral2/memory/5084-1288-0x00007FF620D90000-0x00007FF621182000-memory.dmp	xmrig
behavioral2/memory/1220-924-0x00007FF7DA250000-0x00007FF7DA642000-memory.dmp	xmrig
behavioral2/memory/4016-914-0x00007FF651370000-0x00007FF651762000-memory.dmp	xmrig
behavioral2/memory/3868-870-0x00007FF6688D0000-0x00007FF668CC2000-memory.dmp	xmrig
behavioral2/memory/4060-723-0x00007FF6BB630000-0x00007FF6BBA22000-memory.dmp	xmrig
behavioral2/memory/3052-706-0x00007FF7498A0000-0x00007FF749C92000-memory.dmp	xmrig
behavioral2/memory/3508-681-0x00007FF7AC290000-0x00007FF7AC682000-memory.dmp	xmrig
behavioral2/memory/4256-634-0x00007FF75CC40000-0x00007FF75D032000-memory.dmp	xmrig
behavioral2/memory/684-631-0x00007FF6B6CC0000-0x00007FF6B70B2000-memory.dmp	xmrig
behavioral2/memory/3216-619-0x00007FF6F86A0000-0x00007FF6F8A92000-memory.dmp	xmrig
behavioral2/memory/4348-3699-0x00007FF770940000-0x00007FF770D32000-memory.dmp	xmrig
behavioral2/memory/3916-3701-0x00007FF77E920000-0x00007FF77ED12000-memory.dmp	xmrig
behavioral2/memory/4772-3703-0x00007FF6CD720000-0x00007FF6CDB12000-memory.dmp	xmrig
behavioral2/memory/4004-3705-0x00007FF6DBB20000-0x00007FF6DBF12000-memory.dmp	xmrig
behavioral2/memory/4256-3707-0x00007FF75CC40000-0x00007FF75D032000-memory.dmp	xmrig
behavioral2/memory/1504-3709-0x00007FF7C0670000-0x00007FF7C0A62000-memory.dmp	xmrig
behavioral2/memory/4536-3711-0x00007FF681C60000-0x00007FF682052000-memory.dmp	xmrig
behavioral2/memory/3508-3713-0x00007FF7AC290000-0x00007FF7AC682000-memory.dmp	xmrig
behavioral2/memory/1080-3715-0x00007FF68E890000-0x00007FF68EC82000-memory.dmp	xmrig
behavioral2/memory/3216-3719-0x00007FF6F86A0000-0x00007FF6F8A92000-memory.dmp	xmrig
behavioral2/memory/4648-3721-0x00007FF622CD0000-0x00007FF6230C2000-memory.dmp	xmrig
behavioral2/memory/3052-3717-0x00007FF7498A0000-0x00007FF749C92000-memory.dmp	xmrig
behavioral2/memory/4060-3727-0x00007FF6BB630000-0x00007FF6BBA22000-memory.dmp	xmrig
behavioral2/memory/4016-3726-0x00007FF651370000-0x00007FF651762000-memory.dmp	xmrig
behavioral2/memory/684-3724-0x00007FF6B6CC0000-0x00007FF6B70B2000-memory.dmp	xmrig
behavioral2/memory/1220-3729-0x00007FF7DA250000-0x00007FF7DA642000-memory.dmp	xmrig
behavioral2/memory/4192-3739-0x00007FF645190000-0x00007FF645582000-memory.dmp	xmrig
behavioral2/memory/1488-3737-0x00007FF67A070000-0x00007FF67A462000-memory.dmp	xmrig
behavioral2/memory/2032-3735-0x00007FF618D40000-0x00007FF619132000-memory.dmp	xmrig
behavioral2/memory/5084-3734-0x00007FF620D90000-0x00007FF621182000-memory.dmp	xmrig
behavioral2/memory/3644-3746-0x00007FF6F3F10000-0x00007FF6F4302000-memory.dmp	xmrig
behavioral2/memory/4296-3757-0x00007FF759B20000-0x00007FF759F12000-memory.dmp	xmrig
behavioral2/memory/4180-3754-0x00007FF719800000-0x00007FF719BF2000-memory.dmp	xmrig
behavioral2/memory/3868-3756-0x00007FF6688D0000-0x00007FF668CC2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1952	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4772	aoKpRYj.exe
4348	kwbONYA.exe
3916	mqxUwAs.exe
1504	ztsSWcf.exe
4536	IHkHnHc.exe
4004	TbSuraP.exe
3216	yZQVQVi.exe
684	orczgjm.exe
4256	wZExCGm.exe
3508	blOwOxr.exe
3052	zfBoJrC.exe
3644	yKTjGVg.exe
4060	qfbtPFe.exe
4180	jxZEffC.exe
3868	IMGMlGf.exe
4016	TkqmMzm.exe
1220	BduYWRm.exe
1080	KPnanEs.exe
5084	YaaghDg.exe
2032	QcEVrHt.exe
4648	sQKZhkA.exe
1488	KVxYadR.exe
4192	gDVWEtj.exe
4296	wioHabr.exe
2952	SGCkDzX.exe
5000	AHipKHd.exe
2664	YPClzYD.exe
676	yQnLzJZ.exe
804	ZWDmqWW.exe
1596	VaQrReq.exe
3232	dLZIFNU.exe
1468	RUGeDcN.exe
3484	vvXFmMx.exe
4288	ODsweyr.exe
3972	YyDbKHM.exe
3236	MJcTyyp.exe
2800	UwHmWtz.exe
2784	nSLxrtp.exe
3576	nGwLxDa.exe
1424	TKzmaXY.exe
3572	YaGEzWt.exe
4420	WpDaLgb.exe
1632	EbeIiFq.exe
1740	ipqzMhP.exe
1828	hnQACYd.exe
4708	HgtIrmp.exe
3588	LkFhKgf.exe
2708	GcVoPKL.exe
5036	VoOTTtc.exe
2072	wuaSoau.exe
1300	qhhBcEi.exe
3044	BNIakMn.exe
1968	voSOsKC.exe
3240	pKlITOe.exe
2956	BFdQScN.exe
2420	tJWZHUL.exe
4120	rxIdKSw.exe
1760	NvFiBEe.exe
2524	PBwcafp.exe
460	tffJYXO.exe
4312	MtkPQIb.exe
1472	GEgJIZb.exe
4168	MLfQqPk.exe
760	GSDtpmX.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/860-0-0x00007FF7D7960000-0x00007FF7D7D52000-memory.dmp	upx
behavioral2/files/0x00070000000235e6-19.dat	upx
behavioral2/files/0x00080000000235e1-12.dat	upx
behavioral2/files/0x00080000000235e4-14.dat	upx
behavioral2/files/0x0009000000023581-10.dat	upx
behavioral2/memory/4348-383-0x00007FF770940000-0x00007FF770D32000-memory.dmp	upx
behavioral2/memory/3916-478-0x00007FF77E920000-0x00007FF77ED12000-memory.dmp	upx
behavioral2/memory/1504-532-0x00007FF7C0670000-0x00007FF7C0A62000-memory.dmp	upx
behavioral2/memory/4536-579-0x00007FF681C60000-0x00007FF682052000-memory.dmp	upx
behavioral2/memory/4004-592-0x00007FF6DBB20000-0x00007FF6DBF12000-memory.dmp	upx
behavioral2/memory/3644-722-0x00007FF6F3F10000-0x00007FF6F4302000-memory.dmp	upx
behavioral2/memory/4180-799-0x00007FF719800000-0x00007FF719BF2000-memory.dmp	upx
behavioral2/memory/1080-1007-0x00007FF68E890000-0x00007FF68EC82000-memory.dmp	upx
behavioral2/memory/4772-1709-0x00007FF6CD720000-0x00007FF6CDB12000-memory.dmp	upx
behavioral2/memory/4296-1700-0x00007FF759B20000-0x00007FF759F12000-memory.dmp	upx
behavioral2/memory/4192-1575-0x00007FF645190000-0x00007FF645582000-memory.dmp	upx
behavioral2/memory/1488-1550-0x00007FF67A070000-0x00007FF67A462000-memory.dmp	upx
behavioral2/memory/4648-1352-0x00007FF622CD0000-0x00007FF6230C2000-memory.dmp	upx
behavioral2/memory/2032-1349-0x00007FF618D40000-0x00007FF619132000-memory.dmp	upx
behavioral2/memory/5084-1288-0x00007FF620D90000-0x00007FF621182000-memory.dmp	upx
behavioral2/memory/1220-924-0x00007FF7DA250000-0x00007FF7DA642000-memory.dmp	upx
behavioral2/memory/4016-914-0x00007FF651370000-0x00007FF651762000-memory.dmp	upx
behavioral2/memory/3868-870-0x00007FF6688D0000-0x00007FF668CC2000-memory.dmp	upx
behavioral2/memory/4060-723-0x00007FF6BB630000-0x00007FF6BBA22000-memory.dmp	upx
behavioral2/memory/3052-706-0x00007FF7498A0000-0x00007FF749C92000-memory.dmp	upx
behavioral2/memory/3508-681-0x00007FF7AC290000-0x00007FF7AC682000-memory.dmp	upx
behavioral2/memory/4256-634-0x00007FF75CC40000-0x00007FF75D032000-memory.dmp	upx
behavioral2/memory/684-631-0x00007FF6B6CC0000-0x00007FF6B70B2000-memory.dmp	upx
behavioral2/memory/3216-619-0x00007FF6F86A0000-0x00007FF6F8A92000-memory.dmp	upx
behavioral2/files/0x0007000000023608-191.dat	upx
behavioral2/files/0x0007000000023607-189.dat	upx
behavioral2/files/0x00080000000235e2-186.dat	upx
behavioral2/files/0x00070000000235f6-176.dat	upx
behavioral2/files/0x0007000000023605-173.dat	upx
behavioral2/files/0x0007000000023605-171.dat	upx
behavioral2/files/0x0007000000023604-169.dat	upx
behavioral2/files/0x00070000000235fc-161.dat	upx
behavioral2/files/0x00070000000235f4-154.dat	upx
behavioral2/files/0x00070000000235e9-146.dat	upx
behavioral2/files/0x00070000000235ee-198.dat	upx
behavioral2/files/0x0007000000023609-195.dat	upx
behavioral2/files/0x00070000000235fa-192.dat	upx
behavioral2/files/0x0007000000023602-140.dat	upx
behavioral2/files/0x00070000000235f9-136.dat	upx
behavioral2/files/0x00070000000235f8-183.dat	upx
behavioral2/files/0x00070000000235ed-130.dat	upx
behavioral2/files/0x00070000000235f7-128.dat	upx
behavioral2/files/0x0007000000023606-172.dat	upx
behavioral2/files/0x0007000000023601-127.dat	upx
behavioral2/files/0x00070000000235f5-120.dat	upx
behavioral2/files/0x00070000000235fe-119.dat	upx
behavioral2/files/0x00070000000235fd-118.dat	upx
behavioral2/files/0x00070000000235ff-164.dat	upx
behavioral2/files/0x0007000000023603-152.dat	upx
behavioral2/files/0x00070000000235ef-112.dat	upx
behavioral2/files/0x00070000000235fb-111.dat	upx
behavioral2/files/0x00070000000235e8-133.dat	upx
behavioral2/files/0x00070000000235ec-104.dat	upx
behavioral2/files/0x0007000000023600-123.dat	upx
behavioral2/files/0x00070000000235eb-91.dat	upx
behavioral2/files/0x00070000000235f3-114.dat	upx
behavioral2/files/0x00070000000235f2-113.dat	upx
behavioral2/files/0x00070000000235f1-84.dat	upx
behavioral2/files/0x00070000000235f0-82.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\lAeFtQZ.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\RjCJRTE.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\xVfRLhX.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\YAunEPh.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\IwyVMcJ.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\BOrhABq.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\xjRTYjl.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\PcksNMX.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\CgeIwCa.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\vEDbkIW.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\LpGLgJQ.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\sIpAbKe.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\kybkSXz.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\mSmjprp.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\IGePBHe.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\MtqmxxX.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\fwnBWeL.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\DJnyMoy.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\NwCzYVW.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\qcMCaZJ.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\dbvItxN.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\MpZrnZj.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\JdxMNgZ.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\UGYCiLW.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\RSXISwN.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\jNgPmmd.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\qnAcPaq.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\TQdsvzy.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\XawdzDz.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\bhKHefd.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\AEMoabi.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\dawgZAF.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\pfpIrRY.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\YPClzYD.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\iNqAgNH.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\gwuKyEC.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\cftFioI.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\vKClsdI.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\YBbIbPu.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\HzosXrA.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\gctCXXn.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\cgObDea.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\xIWmMLS.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\wMrvflh.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\dMdGhHw.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\cRXrVRo.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\WlteZCL.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\grSioyL.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\IGLwBEB.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\cBksHYm.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\RgGHxQh.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\CpYVCBD.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\IyUHmwn.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\zKljCYa.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\MpvUfeU.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\hsBfdLL.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\deEDURp.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\QOcMYOh.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\EbelWpM.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\mUMFqku.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\CYXYEfQ.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\STRtHHj.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\kqBroYO.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
File created	C:\Windows\System\dPmmzeC.exe	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1952	powershell.exe
1952	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1952	powershell.exe
Token: SeLockMemoryPrivilege	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 860 wrote to memory of 1952	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	81
PID 860 wrote to memory of 1952	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	81
PID 860 wrote to memory of 4772	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	82
PID 860 wrote to memory of 4772	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	82
PID 860 wrote to memory of 4348	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	83
PID 860 wrote to memory of 4348	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	83
PID 860 wrote to memory of 3916	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	84
PID 860 wrote to memory of 3916	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	84
PID 860 wrote to memory of 4536	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	85
PID 860 wrote to memory of 4536	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	85
PID 860 wrote to memory of 1504	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	86
PID 860 wrote to memory of 1504	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	86
PID 860 wrote to memory of 4004	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	87
PID 860 wrote to memory of 4004	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	87
PID 860 wrote to memory of 3216	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	88
PID 860 wrote to memory of 3216	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	88
PID 860 wrote to memory of 684	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	89
PID 860 wrote to memory of 684	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	89
PID 860 wrote to memory of 4256	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	90
PID 860 wrote to memory of 4256	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	90
PID 860 wrote to memory of 3508	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	91
PID 860 wrote to memory of 3508	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	91
PID 860 wrote to memory of 3052	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	92
PID 860 wrote to memory of 3052	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	92
PID 860 wrote to memory of 3644	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	93
PID 860 wrote to memory of 3644	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	93
PID 860 wrote to memory of 4192	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	94
PID 860 wrote to memory of 4192	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	94
PID 860 wrote to memory of 4060	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	95
PID 860 wrote to memory of 4060	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	95
PID 860 wrote to memory of 4180	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	96
PID 860 wrote to memory of 4180	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	96
PID 860 wrote to memory of 3868	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	97
PID 860 wrote to memory of 3868	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	97
PID 860 wrote to memory of 2952	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	98
PID 860 wrote to memory of 2952	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	98
PID 860 wrote to memory of 4016	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	99
PID 860 wrote to memory of 4016	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	99
PID 860 wrote to memory of 1220	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	100
PID 860 wrote to memory of 1220	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	100
PID 860 wrote to memory of 1080	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	101
PID 860 wrote to memory of 1080	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	101
PID 860 wrote to memory of 5084	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	102
PID 860 wrote to memory of 5084	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	102
PID 860 wrote to memory of 3232	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	103
PID 860 wrote to memory of 3232	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	103
PID 860 wrote to memory of 2032	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	104
PID 860 wrote to memory of 2032	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	104
PID 860 wrote to memory of 4648	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	105
PID 860 wrote to memory of 4648	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	105
PID 860 wrote to memory of 1488	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	106
PID 860 wrote to memory of 1488	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	106
PID 860 wrote to memory of 4296	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	107
PID 860 wrote to memory of 4296	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	107
PID 860 wrote to memory of 5000	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	108
PID 860 wrote to memory of 5000	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	108
PID 860 wrote to memory of 2664	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	109
PID 860 wrote to memory of 2664	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	109
PID 860 wrote to memory of 676	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	110
PID 860 wrote to memory of 676	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	110
PID 860 wrote to memory of 4288	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	111
PID 860 wrote to memory of 4288	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	111
PID 860 wrote to memory of 804	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	112
PID 860 wrote to memory of 804	860	03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe	112

C:\Users\Admin\AppData\Local\Temp\03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03b1c24229d33c26654e1313bb1e7bba_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1952
- C:\Windows\System\aoKpRYj.exe
  C:\Windows\System\aoKpRYj.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\kwbONYA.exe
  C:\Windows\System\kwbONYA.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\mqxUwAs.exe
  C:\Windows\System\mqxUwAs.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\IHkHnHc.exe
  C:\Windows\System\IHkHnHc.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\ztsSWcf.exe
  C:\Windows\System\ztsSWcf.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\TbSuraP.exe
  C:\Windows\System\TbSuraP.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\yZQVQVi.exe
  C:\Windows\System\yZQVQVi.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\orczgjm.exe
  C:\Windows\System\orczgjm.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\wZExCGm.exe
  C:\Windows\System\wZExCGm.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\blOwOxr.exe
  C:\Windows\System\blOwOxr.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\zfBoJrC.exe
  C:\Windows\System\zfBoJrC.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\yKTjGVg.exe
  C:\Windows\System\yKTjGVg.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\gDVWEtj.exe
  C:\Windows\System\gDVWEtj.exe
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Windows\System\qfbtPFe.exe
  C:\Windows\System\qfbtPFe.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\jxZEffC.exe
  C:\Windows\System\jxZEffC.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\IMGMlGf.exe
  C:\Windows\System\IMGMlGf.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\SGCkDzX.exe
  C:\Windows\System\SGCkDzX.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\TkqmMzm.exe
  C:\Windows\System\TkqmMzm.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\BduYWRm.exe
  C:\Windows\System\BduYWRm.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\KPnanEs.exe
  C:\Windows\System\KPnanEs.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\YaaghDg.exe
  C:\Windows\System\YaaghDg.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\dLZIFNU.exe
  C:\Windows\System\dLZIFNU.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\QcEVrHt.exe
  C:\Windows\System\QcEVrHt.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\sQKZhkA.exe
  C:\Windows\System\sQKZhkA.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\KVxYadR.exe
  C:\Windows\System\KVxYadR.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\wioHabr.exe
  C:\Windows\System\wioHabr.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\AHipKHd.exe
  C:\Windows\System\AHipKHd.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\YPClzYD.exe
  C:\Windows\System\YPClzYD.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\yQnLzJZ.exe
  C:\Windows\System\yQnLzJZ.exe
  2⤵
  - Executes dropped EXE
  PID:676
- C:\Windows\System\ODsweyr.exe
  C:\Windows\System\ODsweyr.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\ZWDmqWW.exe
  C:\Windows\System\ZWDmqWW.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\VaQrReq.exe
  C:\Windows\System\VaQrReq.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\RUGeDcN.exe
  C:\Windows\System\RUGeDcN.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\vvXFmMx.exe
  C:\Windows\System\vvXFmMx.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\YyDbKHM.exe
  C:\Windows\System\YyDbKHM.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\MJcTyyp.exe
  C:\Windows\System\MJcTyyp.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\UwHmWtz.exe
  C:\Windows\System\UwHmWtz.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\nSLxrtp.exe
  C:\Windows\System\nSLxrtp.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\nGwLxDa.exe
  C:\Windows\System\nGwLxDa.exe
  2⤵
  - Executes dropped EXE
  PID:3576
- C:\Windows\System\TKzmaXY.exe
  C:\Windows\System\TKzmaXY.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\YaGEzWt.exe
  C:\Windows\System\YaGEzWt.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\WpDaLgb.exe
  C:\Windows\System\WpDaLgb.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\EbeIiFq.exe
  C:\Windows\System\EbeIiFq.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\ipqzMhP.exe
  C:\Windows\System\ipqzMhP.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\hnQACYd.exe
  C:\Windows\System\hnQACYd.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\HgtIrmp.exe
  C:\Windows\System\HgtIrmp.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\LkFhKgf.exe
  C:\Windows\System\LkFhKgf.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\GcVoPKL.exe
  C:\Windows\System\GcVoPKL.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\VoOTTtc.exe
  C:\Windows\System\VoOTTtc.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\wuaSoau.exe
  C:\Windows\System\wuaSoau.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\qhhBcEi.exe
  C:\Windows\System\qhhBcEi.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\EhFuNDh.exe
  C:\Windows\System\EhFuNDh.exe
  2⤵
  PID:2108
- C:\Windows\System\BNIakMn.exe
  C:\Windows\System\BNIakMn.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\voSOsKC.exe
  C:\Windows\System\voSOsKC.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\pKlITOe.exe
  C:\Windows\System\pKlITOe.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\BFdQScN.exe
  C:\Windows\System\BFdQScN.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\tJWZHUL.exe
  C:\Windows\System\tJWZHUL.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\rxIdKSw.exe
  C:\Windows\System\rxIdKSw.exe
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\System\NvFiBEe.exe
  C:\Windows\System\NvFiBEe.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\PBwcafp.exe
  C:\Windows\System\PBwcafp.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\tffJYXO.exe
  C:\Windows\System\tffJYXO.exe
  2⤵
  - Executes dropped EXE
  PID:460
- C:\Windows\System\MtkPQIb.exe
  C:\Windows\System\MtkPQIb.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\GEgJIZb.exe
  C:\Windows\System\GEgJIZb.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\MLfQqPk.exe
  C:\Windows\System\MLfQqPk.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\GSDtpmX.exe
  C:\Windows\System\GSDtpmX.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\HhYPTjd.exe
  C:\Windows\System\HhYPTjd.exe
  2⤵
  PID:1588
- C:\Windows\System\PcywIWv.exe
  C:\Windows\System\PcywIWv.exe
  2⤵
  PID:2304
- C:\Windows\System\uavpWBy.exe
  C:\Windows\System\uavpWBy.exe
  2⤵
  PID:4576
- C:\Windows\System\INFgZzd.exe
  C:\Windows\System\INFgZzd.exe
  2⤵
  PID:3988
- C:\Windows\System\SnGCNaU.exe
  C:\Windows\System\SnGCNaU.exe
  2⤵
  PID:4492
- C:\Windows\System\JodBTaH.exe
  C:\Windows\System\JodBTaH.exe
  2⤵
  PID:4116
- C:\Windows\System\QBFcJNI.exe
  C:\Windows\System\QBFcJNI.exe
  2⤵
  PID:512
- C:\Windows\System\jeKpaqS.exe
  C:\Windows\System\jeKpaqS.exe
  2⤵
  PID:1560
- C:\Windows\System\zlTrRUr.exe
  C:\Windows\System\zlTrRUr.exe
  2⤵
  PID:4840
- C:\Windows\System\FNKkuNs.exe
  C:\Windows\System\FNKkuNs.exe
  2⤵
  PID:2632
- C:\Windows\System\bhKHefd.exe
  C:\Windows\System\bhKHefd.exe
  2⤵
  PID:2028
- C:\Windows\System\zmUPDWP.exe
  C:\Windows\System\zmUPDWP.exe
  2⤵
  PID:4556
- C:\Windows\System\zYfpxCr.exe
  C:\Windows\System\zYfpxCr.exe
  2⤵
  PID:2944
- C:\Windows\System\LsZuYRG.exe
  C:\Windows\System\LsZuYRG.exe
  2⤵
  PID:4912
- C:\Windows\System\lMCjGHu.exe
  C:\Windows\System\lMCjGHu.exe
  2⤵
  PID:2252
- C:\Windows\System\RDiCBYs.exe
  C:\Windows\System\RDiCBYs.exe
  2⤵
  PID:4368
- C:\Windows\System\fpZxCGT.exe
  C:\Windows\System\fpZxCGT.exe
  2⤵
  PID:5044
- C:\Windows\System\alrdgNv.exe
  C:\Windows\System\alrdgNv.exe
  2⤵
  PID:3248
- C:\Windows\System\BHLESXt.exe
  C:\Windows\System\BHLESXt.exe
  2⤵
  PID:1940
- C:\Windows\System\hgDDHNV.exe
  C:\Windows\System\hgDDHNV.exe
  2⤵
  PID:4684
- C:\Windows\System\ASwDlcn.exe
  C:\Windows\System\ASwDlcn.exe
  2⤵
  PID:3296
- C:\Windows\System\CXVxxZd.exe
  C:\Windows\System\CXVxxZd.exe
  2⤵
  PID:1460
- C:\Windows\System\OxRRCCe.exe
  C:\Windows\System\OxRRCCe.exe
  2⤵
  PID:620
- C:\Windows\System\hqULBVM.exe
  C:\Windows\System\hqULBVM.exe
  2⤵
  PID:2276
- C:\Windows\System\GOoZXrk.exe
  C:\Windows\System\GOoZXrk.exe
  2⤵
  PID:1416
- C:\Windows\System\kOalFKk.exe
  C:\Windows\System\kOalFKk.exe
  2⤵
  PID:1796
- C:\Windows\System\RmdYGCw.exe
  C:\Windows\System\RmdYGCw.exe
  2⤵
  PID:2052
- C:\Windows\System\jOgiCCN.exe
  C:\Windows\System\jOgiCCN.exe
  2⤵
  PID:2992
- C:\Windows\System\DUZOygv.exe
  C:\Windows\System\DUZOygv.exe
  2⤵
  PID:4816
- C:\Windows\System\sobmmDA.exe
  C:\Windows\System\sobmmDA.exe
  2⤵
  PID:1328
- C:\Windows\System\HsBTgdc.exe
  C:\Windows\System\HsBTgdc.exe
  2⤵
  PID:4724
- C:\Windows\System\BeDhsuS.exe
  C:\Windows\System\BeDhsuS.exe
  2⤵
  PID:2292
- C:\Windows\System\XFlFeaE.exe
  C:\Windows\System\XFlFeaE.exe
  2⤵
  PID:1324
- C:\Windows\System\XNWekjl.exe
  C:\Windows\System\XNWekjl.exe
  2⤵
  PID:4996
- C:\Windows\System\iMzwfpw.exe
  C:\Windows\System\iMzwfpw.exe
  2⤵
  PID:1800
- C:\Windows\System\zPqyBzN.exe
  C:\Windows\System\zPqyBzN.exe
  2⤵
  PID:3012
- C:\Windows\System\PxUYOJQ.exe
  C:\Windows\System\PxUYOJQ.exe
  2⤵
  PID:1408
- C:\Windows\System\ELHbcPb.exe
  C:\Windows\System\ELHbcPb.exe
  2⤵
  PID:4268
- C:\Windows\System\nVCCxzU.exe
  C:\Windows\System\nVCCxzU.exe
  2⤵
  PID:4276
- C:\Windows\System\WYKEjFl.exe
  C:\Windows\System\WYKEjFl.exe
  2⤵
  PID:892
- C:\Windows\System\lgkaXLA.exe
  C:\Windows\System\lgkaXLA.exe
  2⤵
  PID:1656
- C:\Windows\System\BQuNAvV.exe
  C:\Windows\System\BQuNAvV.exe
  2⤵
  PID:5136
- C:\Windows\System\xtsLXSU.exe
  C:\Windows\System\xtsLXSU.exe
  2⤵
  PID:5152
- C:\Windows\System\yTxoHDs.exe
  C:\Windows\System\yTxoHDs.exe
  2⤵
  PID:5176
- C:\Windows\System\LfxMsme.exe
  C:\Windows\System\LfxMsme.exe
  2⤵
  PID:5192
- C:\Windows\System\PPmqBWo.exe
  C:\Windows\System\PPmqBWo.exe
  2⤵
  PID:5216
- C:\Windows\System\nzRwQba.exe
  C:\Windows\System\nzRwQba.exe
  2⤵
  PID:5240
- C:\Windows\System\kybkSXz.exe
  C:\Windows\System\kybkSXz.exe
  2⤵
  PID:5260
- C:\Windows\System\lAeFtQZ.exe
  C:\Windows\System\lAeFtQZ.exe
  2⤵
  PID:5276
- C:\Windows\System\kWrpdOF.exe
  C:\Windows\System\kWrpdOF.exe
  2⤵
  PID:5300
- C:\Windows\System\HEZTNEg.exe
  C:\Windows\System\HEZTNEg.exe
  2⤵
  PID:5316
- C:\Windows\System\quonilM.exe
  C:\Windows\System\quonilM.exe
  2⤵
  PID:5336
- C:\Windows\System\VznfQyy.exe
  C:\Windows\System\VznfQyy.exe
  2⤵
  PID:5356
- C:\Windows\System\CmVUEzu.exe
  C:\Windows\System\CmVUEzu.exe
  2⤵
  PID:5380
- C:\Windows\System\jgOHZvN.exe
  C:\Windows\System\jgOHZvN.exe
  2⤵
  PID:5400
- C:\Windows\System\KsvZCoF.exe
  C:\Windows\System\KsvZCoF.exe
  2⤵
  PID:5420
- C:\Windows\System\IwotmtW.exe
  C:\Windows\System\IwotmtW.exe
  2⤵
  PID:5440
- C:\Windows\System\MJcGMLO.exe
  C:\Windows\System\MJcGMLO.exe
  2⤵
  PID:5460
- C:\Windows\System\CdOnflN.exe
  C:\Windows\System\CdOnflN.exe
  2⤵
  PID:5480
- C:\Windows\System\vSRDxyp.exe
  C:\Windows\System\vSRDxyp.exe
  2⤵
  PID:5500
- C:\Windows\System\cAsCjsC.exe
  C:\Windows\System\cAsCjsC.exe
  2⤵
  PID:5524
- C:\Windows\System\BhQcMrC.exe
  C:\Windows\System\BhQcMrC.exe
  2⤵
  PID:5560
- C:\Windows\System\ywnqNqK.exe
  C:\Windows\System\ywnqNqK.exe
  2⤵
  PID:5580
- C:\Windows\System\GsJSvlq.exe
  C:\Windows\System\GsJSvlq.exe
  2⤵
  PID:5600
- C:\Windows\System\gnDSlri.exe
  C:\Windows\System\gnDSlri.exe
  2⤵
  PID:5620
- C:\Windows\System\jsmDEDn.exe
  C:\Windows\System\jsmDEDn.exe
  2⤵
  PID:5644
- C:\Windows\System\gtuZooC.exe
  C:\Windows\System\gtuZooC.exe
  2⤵
  PID:5660
- C:\Windows\System\HLEgMgw.exe
  C:\Windows\System\HLEgMgw.exe
  2⤵
  PID:5680
- C:\Windows\System\JGEjFHl.exe
  C:\Windows\System\JGEjFHl.exe
  2⤵
  PID:5700
- C:\Windows\System\vinqAdL.exe
  C:\Windows\System\vinqAdL.exe
  2⤵
  PID:5724
- C:\Windows\System\SxOTzGu.exe
  C:\Windows\System\SxOTzGu.exe
  2⤵
  PID:5744
- C:\Windows\System\nSeyRQW.exe
  C:\Windows\System\nSeyRQW.exe
  2⤵
  PID:5764
- C:\Windows\System\UavYRaI.exe
  C:\Windows\System\UavYRaI.exe
  2⤵
  PID:5780
- C:\Windows\System\kxWyYvs.exe
  C:\Windows\System\kxWyYvs.exe
  2⤵
  PID:5804
- C:\Windows\System\gjPbALW.exe
  C:\Windows\System\gjPbALW.exe
  2⤵
  PID:5832
- C:\Windows\System\RXHKync.exe
  C:\Windows\System\RXHKync.exe
  2⤵
  PID:5856
- C:\Windows\System\BURZcRm.exe
  C:\Windows\System\BURZcRm.exe
  2⤵
  PID:5872
- C:\Windows\System\bKvxosx.exe
  C:\Windows\System\bKvxosx.exe
  2⤵
  PID:5892
- C:\Windows\System\tuFkySa.exe
  C:\Windows\System\tuFkySa.exe
  2⤵
  PID:5924
- C:\Windows\System\wInZxfp.exe
  C:\Windows\System\wInZxfp.exe
  2⤵
  PID:5956
- C:\Windows\System\SDmfEut.exe
  C:\Windows\System\SDmfEut.exe
  2⤵
  PID:5972
- C:\Windows\System\xHeVuUd.exe
  C:\Windows\System\xHeVuUd.exe
  2⤵
  PID:5988
- C:\Windows\System\xGLUrAO.exe
  C:\Windows\System\xGLUrAO.exe
  2⤵
  PID:6016
- C:\Windows\System\kgXVhpr.exe
  C:\Windows\System\kgXVhpr.exe
  2⤵
  PID:6032
- C:\Windows\System\uoJOmEl.exe
  C:\Windows\System\uoJOmEl.exe
  2⤵
  PID:6060
- C:\Windows\System\tRrJhIc.exe
  C:\Windows\System\tRrJhIc.exe
  2⤵
  PID:6088
- C:\Windows\System\lIsnLMM.exe
  C:\Windows\System\lIsnLMM.exe
  2⤵
  PID:6112
- C:\Windows\System\oarKqDa.exe
  C:\Windows\System\oarKqDa.exe
  2⤵
  PID:6132
- C:\Windows\System\GkPeIKb.exe
  C:\Windows\System\GkPeIKb.exe
  2⤵
  PID:2768
- C:\Windows\System\WnMnjox.exe
  C:\Windows\System\WnMnjox.exe
  2⤵
  PID:1020
- C:\Windows\System\qIagWGT.exe
  C:\Windows\System\qIagWGT.exe
  2⤵
  PID:3660
- C:\Windows\System\GCRgZzX.exe
  C:\Windows\System\GCRgZzX.exe
  2⤵
  PID:3468
- C:\Windows\System\RZkBAjZ.exe
  C:\Windows\System\RZkBAjZ.exe
  2⤵
  PID:4920
- C:\Windows\System\TxjjjNx.exe
  C:\Windows\System\TxjjjNx.exe
  2⤵
  PID:2192
- C:\Windows\System\scwJcUL.exe
  C:\Windows\System\scwJcUL.exe
  2⤵
  PID:2628
- C:\Windows\System\lQKEDWu.exe
  C:\Windows\System\lQKEDWu.exe
  2⤵
  PID:1912
- C:\Windows\System\lYOEeHk.exe
  C:\Windows\System\lYOEeHk.exe
  2⤵
  PID:3780
- C:\Windows\System\HGvcHiE.exe
  C:\Windows\System\HGvcHiE.exe
  2⤵
  PID:4948
- C:\Windows\System\cXzqWiO.exe
  C:\Windows\System\cXzqWiO.exe
  2⤵
  PID:3860
- C:\Windows\System\toVLEAl.exe
  C:\Windows\System\toVLEAl.exe
  2⤵
  PID:4028
- C:\Windows\System\yRqHwvS.exe
  C:\Windows\System\yRqHwvS.exe
  2⤵
  PID:2968
- C:\Windows\System\czsRMMn.exe
  C:\Windows\System\czsRMMn.exe
  2⤵
  PID:4456
- C:\Windows\System\zlUQxPh.exe
  C:\Windows\System\zlUQxPh.exe
  2⤵
  PID:5368
- C:\Windows\System\PbIRdRI.exe
  C:\Windows\System\PbIRdRI.exe
  2⤵
  PID:3028
- C:\Windows\System\xcEdDAy.exe
  C:\Windows\System\xcEdDAy.exe
  2⤵
  PID:1528
- C:\Windows\System\PzGNyVN.exe
  C:\Windows\System\PzGNyVN.exe
  2⤵
  PID:5476
- C:\Windows\System\kyvQYlo.exe
  C:\Windows\System\kyvQYlo.exe
  2⤵
  PID:3716
- C:\Windows\System\ZhpasyM.exe
  C:\Windows\System\ZhpasyM.exe
  2⤵
  PID:1716
- C:\Windows\System\OxFQWzR.exe
  C:\Windows\System\OxFQWzR.exe
  2⤵
  PID:768
- C:\Windows\System\vZADGKx.exe
  C:\Windows\System\vZADGKx.exe
  2⤵
  PID:980
- C:\Windows\System\mgbmQGa.exe
  C:\Windows\System\mgbmQGa.exe
  2⤵
  PID:2624
- C:\Windows\System\PfAtfLO.exe
  C:\Windows\System\PfAtfLO.exe
  2⤵
  PID:6152
- C:\Windows\System\pCdGtNd.exe
  C:\Windows\System\pCdGtNd.exe
  2⤵
  PID:6168
- C:\Windows\System\QEsQdXq.exe
  C:\Windows\System\QEsQdXq.exe
  2⤵
  PID:6192
- C:\Windows\System\CgeIwCa.exe
  C:\Windows\System\CgeIwCa.exe
  2⤵
  PID:6216
- C:\Windows\System\AFYrcGz.exe
  C:\Windows\System\AFYrcGz.exe
  2⤵
  PID:6236
- C:\Windows\System\TVUorzW.exe
  C:\Windows\System\TVUorzW.exe
  2⤵
  PID:6252
- C:\Windows\System\TyRxbJt.exe
  C:\Windows\System\TyRxbJt.exe
  2⤵
  PID:6272
- C:\Windows\System\kbucYrz.exe
  C:\Windows\System\kbucYrz.exe
  2⤵
  PID:6296
- C:\Windows\System\bepFaEX.exe
  C:\Windows\System\bepFaEX.exe
  2⤵
  PID:6312
- C:\Windows\System\DYGHzEG.exe
  C:\Windows\System\DYGHzEG.exe
  2⤵
  PID:6352
- C:\Windows\System\dorabdn.exe
  C:\Windows\System\dorabdn.exe
  2⤵
  PID:6148
- C:\Windows\System\BuFvDHM.exe
  C:\Windows\System\BuFvDHM.exe
  2⤵
  PID:5612
- C:\Windows\System\EbbkOxp.exe
  C:\Windows\System\EbbkOxp.exe
  2⤵
  PID:5572
- C:\Windows\System\jiRBFGs.exe
  C:\Windows\System\jiRBFGs.exe
  2⤵
  PID:5752
- C:\Windows\System\QaRjuiU.exe
  C:\Windows\System\QaRjuiU.exe
  2⤵
  PID:5820
- C:\Windows\System\xqKOlcK.exe
  C:\Windows\System\xqKOlcK.exe
  2⤵
  PID:5904
- C:\Windows\System\OiQPIuE.exe
  C:\Windows\System\OiQPIuE.exe
  2⤵
  PID:5968
- C:\Windows\System\PgmnXed.exe
  C:\Windows\System\PgmnXed.exe
  2⤵
  PID:6104
- C:\Windows\System\oStApkg.exe
  C:\Windows\System\oStApkg.exe
  2⤵
  PID:2004
- C:\Windows\System\bzXAoNS.exe
  C:\Windows\System\bzXAoNS.exe
  2⤵
  PID:1276
- C:\Windows\System\AiyXXyQ.exe
  C:\Windows\System\AiyXXyQ.exe
  2⤵
  PID:6836
- C:\Windows\System\hpupXlA.exe
  C:\Windows\System\hpupXlA.exe
  2⤵
  PID:2268
- C:\Windows\System\GEWsjpX.exe
  C:\Windows\System\GEWsjpX.exe
  2⤵
  PID:5364
- C:\Windows\System\GWmxYMy.exe
  C:\Windows\System\GWmxYMy.exe
  2⤵
  PID:6332
- C:\Windows\System\qeCvirE.exe
  C:\Windows\System\qeCvirE.exe
  2⤵
  PID:4320
- C:\Windows\System\ohiUVzH.exe
  C:\Windows\System\ohiUVzH.exe
  2⤵
  PID:4740
- C:\Windows\System\OLqTekw.exe
  C:\Windows\System\OLqTekw.exe
  2⤵
  PID:812
- C:\Windows\System\NBccQsK.exe
  C:\Windows\System\NBccQsK.exe
  2⤵
  PID:6140
- C:\Windows\System\pNMYVIy.exe
  C:\Windows\System\pNMYVIy.exe
  2⤵
  PID:5980
- C:\Windows\System\PdIxGdJ.exe
  C:\Windows\System\PdIxGdJ.exe
  2⤵
  PID:6424
- C:\Windows\System\rAJwiVj.exe
  C:\Windows\System\rAJwiVj.exe
  2⤵
  PID:6476
- C:\Windows\System\UZvnrmz.exe
  C:\Windows\System\UZvnrmz.exe
  2⤵
  PID:6664
- C:\Windows\System\rFecPDl.exe
  C:\Windows\System\rFecPDl.exe
  2⤵
  PID:6708
- C:\Windows\System\qDGgeVf.exe
  C:\Windows\System\qDGgeVf.exe
  2⤵
  PID:6176
- C:\Windows\System\CmpbZrc.exe
  C:\Windows\System\CmpbZrc.exe
  2⤵
  PID:6764
- C:\Windows\System\YZVwnvB.exe
  C:\Windows\System\YZVwnvB.exe
  2⤵
  PID:6984
- C:\Windows\System\yyvSHWz.exe
  C:\Windows\System\yyvSHWz.exe
  2⤵
  PID:7048
- C:\Windows\System\hSPuCWi.exe
  C:\Windows\System\hSPuCWi.exe
  2⤵
  PID:6260
- C:\Windows\System\UzLubFj.exe
  C:\Windows\System\UzLubFj.exe
  2⤵
  PID:5676
- C:\Windows\System\bBJDdJY.exe
  C:\Windows\System\bBJDdJY.exe
  2⤵
  PID:4956
- C:\Windows\System\wyYnuzk.exe
  C:\Windows\System\wyYnuzk.exe
  2⤵
  PID:7156
- C:\Windows\System\wPRJZkT.exe
  C:\Windows\System\wPRJZkT.exe
  2⤵
  PID:3348
- C:\Windows\System\ahuTaLa.exe
  C:\Windows\System\ahuTaLa.exe
  2⤵
  PID:396
- C:\Windows\System\EiYkdwy.exe
  C:\Windows\System\EiYkdwy.exe
  2⤵
  PID:232
- C:\Windows\System\kwEEMwt.exe
  C:\Windows\System\kwEEMwt.exe
  2⤵
  PID:1896
- C:\Windows\System\rBvtBXH.exe
  C:\Windows\System\rBvtBXH.exe
  2⤵
  PID:6404
- C:\Windows\System\bSltOKh.exe
  C:\Windows\System\bSltOKh.exe
  2⤵
  PID:6776
- C:\Windows\System\yevnEvH.exe
  C:\Windows\System\yevnEvH.exe
  2⤵
  PID:5636
- C:\Windows\System\yuNztQG.exe
  C:\Windows\System\yuNztQG.exe
  2⤵
  PID:6024
- C:\Windows\System\VlaxzYp.exe
  C:\Windows\System\VlaxzYp.exe
  2⤵
  PID:7176
- C:\Windows\System\qVAJxpj.exe
  C:\Windows\System\qVAJxpj.exe
  2⤵
  PID:7204
- C:\Windows\System\TJYQHor.exe
  C:\Windows\System\TJYQHor.exe
  2⤵
  PID:7220
- C:\Windows\System\xmfIrSV.exe
  C:\Windows\System\xmfIrSV.exe
  2⤵
  PID:7240
- C:\Windows\System\uXZvbef.exe
  C:\Windows\System\uXZvbef.exe
  2⤵
  PID:7256
- C:\Windows\System\xOpPqza.exe
  C:\Windows\System\xOpPqza.exe
  2⤵
  PID:7280
- C:\Windows\System\grSioyL.exe
  C:\Windows\System\grSioyL.exe
  2⤵
  PID:7296
- C:\Windows\System\JFvjNYC.exe
  C:\Windows\System\JFvjNYC.exe
  2⤵
  PID:7320
- C:\Windows\System\sVmuLGl.exe
  C:\Windows\System\sVmuLGl.exe
  2⤵
  PID:7344
- C:\Windows\System\QUxfbKi.exe
  C:\Windows\System\QUxfbKi.exe
  2⤵
  PID:7360
- C:\Windows\System\wVjRsxf.exe
  C:\Windows\System\wVjRsxf.exe
  2⤵
  PID:7384
- C:\Windows\System\eIMXppg.exe
  C:\Windows\System\eIMXppg.exe
  2⤵
  PID:7400
- C:\Windows\System\WPDBTGL.exe
  C:\Windows\System\WPDBTGL.exe
  2⤵
  PID:7424
- C:\Windows\System\LzKRJop.exe
  C:\Windows\System\LzKRJop.exe
  2⤵
  PID:7448
- C:\Windows\System\PCcbRKk.exe
  C:\Windows\System\PCcbRKk.exe
  2⤵
  PID:7472
- C:\Windows\System\LrjnOkD.exe
  C:\Windows\System\LrjnOkD.exe
  2⤵
  PID:7488
- C:\Windows\System\TPyxNFr.exe
  C:\Windows\System\TPyxNFr.exe
  2⤵
  PID:7512
- C:\Windows\System\qgNJuIE.exe
  C:\Windows\System\qgNJuIE.exe
  2⤵
  PID:7540
- C:\Windows\System\iLsGJZD.exe
  C:\Windows\System\iLsGJZD.exe
  2⤵
  PID:7560
- C:\Windows\System\ViHNiKb.exe
  C:\Windows\System\ViHNiKb.exe
  2⤵
  PID:7584
- C:\Windows\System\qfiWYeR.exe
  C:\Windows\System\qfiWYeR.exe
  2⤵
  PID:7608
- C:\Windows\System\oePicQS.exe
  C:\Windows\System\oePicQS.exe
  2⤵
  PID:7632
- C:\Windows\System\eBRgMGl.exe
  C:\Windows\System\eBRgMGl.exe
  2⤵
  PID:7652
- C:\Windows\System\NMkRJHw.exe
  C:\Windows\System\NMkRJHw.exe
  2⤵
  PID:7668
- C:\Windows\System\oGkQgmW.exe
  C:\Windows\System\oGkQgmW.exe
  2⤵
  PID:7688
- C:\Windows\System\odcDFIx.exe
  C:\Windows\System\odcDFIx.exe
  2⤵
  PID:7732
- C:\Windows\System\FVxwEMy.exe
  C:\Windows\System\FVxwEMy.exe
  2⤵
  PID:7752
- C:\Windows\System\bxkIbHS.exe
  C:\Windows\System\bxkIbHS.exe
  2⤵
  PID:7772
- C:\Windows\System\PQWNwOZ.exe
  C:\Windows\System\PQWNwOZ.exe
  2⤵
  PID:7796
- C:\Windows\System\ffjXPvK.exe
  C:\Windows\System\ffjXPvK.exe
  2⤵
  PID:7812
- C:\Windows\System\jTAANPn.exe
  C:\Windows\System\jTAANPn.exe
  2⤵
  PID:7832
- C:\Windows\System\HIMFvcd.exe
  C:\Windows\System\HIMFvcd.exe
  2⤵
  PID:7848
- C:\Windows\System\IGLwBEB.exe
  C:\Windows\System\IGLwBEB.exe
  2⤵
  PID:7872
- C:\Windows\System\QWjYpZS.exe
  C:\Windows\System\QWjYpZS.exe
  2⤵
  PID:7896
- C:\Windows\System\JdItTMh.exe
  C:\Windows\System\JdItTMh.exe
  2⤵
  PID:7920
- C:\Windows\System\LfslODV.exe
  C:\Windows\System\LfslODV.exe
  2⤵
  PID:7940
- C:\Windows\System\cgObDea.exe
  C:\Windows\System\cgObDea.exe
  2⤵
  PID:7960
- C:\Windows\System\VZeGpfd.exe
  C:\Windows\System\VZeGpfd.exe
  2⤵
  PID:7984
- C:\Windows\System\IFVWpRm.exe
  C:\Windows\System\IFVWpRm.exe
  2⤵
  PID:8008
- C:\Windows\System\iOYteAu.exe
  C:\Windows\System\iOYteAu.exe
  2⤵
  PID:8028
- C:\Windows\System\ltFilgD.exe
  C:\Windows\System\ltFilgD.exe
  2⤵
  PID:8052
- C:\Windows\System\xiwjLhF.exe
  C:\Windows\System\xiwjLhF.exe
  2⤵
  PID:8068
- C:\Windows\System\jfXCibt.exe
  C:\Windows\System\jfXCibt.exe
  2⤵
  PID:8088
- C:\Windows\System\clFwsEC.exe
  C:\Windows\System\clFwsEC.exe
  2⤵
  PID:8112
- C:\Windows\System\VQAGebP.exe
  C:\Windows\System\VQAGebP.exe
  2⤵
  PID:8140
- C:\Windows\System\oqokyLN.exe
  C:\Windows\System\oqokyLN.exe
  2⤵
  PID:8156
- C:\Windows\System\YqsVQJp.exe
  C:\Windows\System\YqsVQJp.exe
  2⤵
  PID:8184
- C:\Windows\System\KhRkvVo.exe
  C:\Windows\System\KhRkvVo.exe
  2⤵
  PID:6592
- C:\Windows\System\tEmfxDv.exe
  C:\Windows\System\tEmfxDv.exe
  2⤵
  PID:5812
- C:\Windows\System\xnbXvGx.exe
  C:\Windows\System\xnbXvGx.exe
  2⤵
  PID:5952
- C:\Windows\System\MsQcFbQ.exe
  C:\Windows\System\MsQcFbQ.exe
  2⤵
  PID:5112
- C:\Windows\System\CBBqlyP.exe
  C:\Windows\System\CBBqlyP.exe
  2⤵
  PID:1920
- C:\Windows\System\rPqWciK.exe
  C:\Windows\System\rPqWciK.exe
  2⤵
  PID:3668
- C:\Windows\System\PITETno.exe
  C:\Windows\System\PITETno.exe
  2⤵
  PID:3472
- C:\Windows\System\qDePSmZ.exe
  C:\Windows\System\qDePSmZ.exe
  2⤵
  PID:7020
- C:\Windows\System\jWqUIUA.exe
  C:\Windows\System\jWqUIUA.exe
  2⤵
  PID:6468
- C:\Windows\System\QcqvWTT.exe
  C:\Windows\System\QcqvWTT.exe
  2⤵
  PID:6700
- C:\Windows\System\cdkWFkJ.exe
  C:\Windows\System\cdkWFkJ.exe
  2⤵
  PID:7332
- C:\Windows\System\RjCJRTE.exe
  C:\Windows\System\RjCJRTE.exe
  2⤵
  PID:7392
- C:\Windows\System\YbLvToB.exe
  C:\Windows\System\YbLvToB.exe
  2⤵
  PID:7484
- C:\Windows\System\lkblzFc.exe
  C:\Windows\System\lkblzFc.exe
  2⤵
  PID:7548
- C:\Windows\System\qTobcrw.exe
  C:\Windows\System\qTobcrw.exe
  2⤵
  PID:7576
- C:\Windows\System\HdVCLVk.exe
  C:\Windows\System\HdVCLVk.exe
  2⤵
  PID:7640
- C:\Windows\System\WHCTtDc.exe
  C:\Windows\System\WHCTtDc.exe
  2⤵
  PID:6924
- C:\Windows\System\XIdRPUo.exe
  C:\Windows\System\XIdRPUo.exe
  2⤵
  PID:6304
- C:\Windows\System\WlcoQMQ.exe
  C:\Windows\System\WlcoQMQ.exe
  2⤵
  PID:7120
- C:\Windows\System\BnnvDfw.exe
  C:\Windows\System\BnnvDfw.exe
  2⤵
  PID:4372
- C:\Windows\System\suAviPL.exe
  C:\Windows\System\suAviPL.exe
  2⤵
  PID:7416
- C:\Windows\System\pSVoUQb.exe
  C:\Windows\System\pSVoUQb.exe
  2⤵
  PID:8020
- C:\Windows\System\OiwBvoM.exe
  C:\Windows\System\OiwBvoM.exe
  2⤵
  PID:8060
- C:\Windows\System\THGqgUX.exe
  C:\Windows\System\THGqgUX.exe
  2⤵
  PID:8172
- C:\Windows\System\CuDNYjL.exe
  C:\Windows\System\CuDNYjL.exe
  2⤵
  PID:5932
- C:\Windows\System\oYYdrjF.exe
  C:\Windows\System\oYYdrjF.exe
  2⤵
  PID:8204
- C:\Windows\System\fenEljo.exe
  C:\Windows\System\fenEljo.exe
  2⤵
  PID:8224
- C:\Windows\System\fBcLBim.exe
  C:\Windows\System\fBcLBim.exe
  2⤵
  PID:8252
- C:\Windows\System\SUrDXrC.exe
  C:\Windows\System\SUrDXrC.exe
  2⤵
  PID:8268
- C:\Windows\System\WdFmKnN.exe
  C:\Windows\System\WdFmKnN.exe
  2⤵
  PID:8308
- C:\Windows\System\ghOHmPI.exe
  C:\Windows\System\ghOHmPI.exe
  2⤵
  PID:8324
- C:\Windows\System\SRpbSty.exe
  C:\Windows\System\SRpbSty.exe
  2⤵
  PID:8340
- C:\Windows\System\KDDpfqP.exe
  C:\Windows\System\KDDpfqP.exe
  2⤵
  PID:8360
- C:\Windows\System\uNQgxOR.exe
  C:\Windows\System\uNQgxOR.exe
  2⤵
  PID:8376
- C:\Windows\System\LGMtGVn.exe
  C:\Windows\System\LGMtGVn.exe
  2⤵
  PID:8400
- C:\Windows\System\CGANjaT.exe
  C:\Windows\System\CGANjaT.exe
  2⤵
  PID:8424
- C:\Windows\System\sMhJIKg.exe
  C:\Windows\System\sMhJIKg.exe
  2⤵
  PID:8444
- C:\Windows\System\FEGJrDa.exe
  C:\Windows\System\FEGJrDa.exe
  2⤵
  PID:8464
- C:\Windows\System\hFiUDBT.exe
  C:\Windows\System\hFiUDBT.exe
  2⤵
  PID:8488
- C:\Windows\System\HsnrkIx.exe
  C:\Windows\System\HsnrkIx.exe
  2⤵
  PID:8508
- C:\Windows\System\rtVSGDo.exe
  C:\Windows\System\rtVSGDo.exe
  2⤵
  PID:8524
- C:\Windows\System\HqYzFob.exe
  C:\Windows\System\HqYzFob.exe
  2⤵
  PID:8544
- C:\Windows\System\dAVcsVB.exe
  C:\Windows\System\dAVcsVB.exe
  2⤵
  PID:8572
- C:\Windows\System\shjBsaH.exe
  C:\Windows\System\shjBsaH.exe
  2⤵
  PID:8588
- C:\Windows\System\bRYmhFp.exe
  C:\Windows\System\bRYmhFp.exe
  2⤵
  PID:8612
- C:\Windows\System\vmJOqHq.exe
  C:\Windows\System\vmJOqHq.exe
  2⤵
  PID:8636
- C:\Windows\System\LQiYxiS.exe
  C:\Windows\System\LQiYxiS.exe
  2⤵
  PID:8656
- C:\Windows\System\nJSBQUN.exe
  C:\Windows\System\nJSBQUN.exe
  2⤵
  PID:8740
- C:\Windows\System\PhmvPZV.exe
  C:\Windows\System\PhmvPZV.exe
  2⤵
  PID:8756
- C:\Windows\System\HFkzUnu.exe
  C:\Windows\System\HFkzUnu.exe
  2⤵
  PID:8772
- C:\Windows\System\OvdziKp.exe
  C:\Windows\System\OvdziKp.exe
  2⤵
  PID:8788
- C:\Windows\System\QqTijRz.exe
  C:\Windows\System\QqTijRz.exe
  2⤵
  PID:8804
- C:\Windows\System\kutOJAT.exe
  C:\Windows\System\kutOJAT.exe
  2⤵
  PID:8820
- C:\Windows\System\QmTOqkw.exe
  C:\Windows\System\QmTOqkw.exe
  2⤵
  PID:8836
- C:\Windows\System\ZbbBNvD.exe
  C:\Windows\System\ZbbBNvD.exe
  2⤵
  PID:8852
- C:\Windows\System\EmbBfhM.exe
  C:\Windows\System\EmbBfhM.exe
  2⤵
  PID:8868
- C:\Windows\System\ipKvDGz.exe
  C:\Windows\System\ipKvDGz.exe
  2⤵
  PID:8892
- C:\Windows\System\tXmTZpz.exe
  C:\Windows\System\tXmTZpz.exe
  2⤵
  PID:8924
- C:\Windows\System\rjRJBSE.exe
  C:\Windows\System\rjRJBSE.exe
  2⤵
  PID:8940
- C:\Windows\System\UAeYrnH.exe
  C:\Windows\System\UAeYrnH.exe
  2⤵
  PID:8960
- C:\Windows\System\kqBroYO.exe
  C:\Windows\System\kqBroYO.exe
  2⤵
  PID:8984
- C:\Windows\System\jMesUiN.exe
  C:\Windows\System\jMesUiN.exe
  2⤵
  PID:9012
- C:\Windows\System\gnpRoLl.exe
  C:\Windows\System\gnpRoLl.exe
  2⤵
  PID:9048
- C:\Windows\System\uEUeQUg.exe
  C:\Windows\System\uEUeQUg.exe
  2⤵
  PID:9092
- C:\Windows\System\WFWNGEO.exe
  C:\Windows\System\WFWNGEO.exe
  2⤵
  PID:9112
- C:\Windows\System\GTIYXtp.exe
  C:\Windows\System\GTIYXtp.exe
  2⤵
  PID:9128
- C:\Windows\System\Xxsmmkm.exe
  C:\Windows\System\Xxsmmkm.exe
  2⤵
  PID:9152
- C:\Windows\System\PTMmFRO.exe
  C:\Windows\System\PTMmFRO.exe
  2⤵
  PID:9176
- C:\Windows\System\nSuEXus.exe
  C:\Windows\System\nSuEXus.exe
  2⤵
  PID:9200
- C:\Windows\System\yQeTMAx.exe
  C:\Windows\System\yQeTMAx.exe
  2⤵
  PID:32
- C:\Windows\System\iJFaBDJ.exe
  C:\Windows\System\iJFaBDJ.exe
  2⤵
  PID:6748
- C:\Windows\System\gHiJkef.exe
  C:\Windows\System\gHiJkef.exe
  2⤵
  PID:4236
- C:\Windows\System\vhFJPTs.exe
  C:\Windows\System\vhFJPTs.exe
  2⤵
  PID:7312
- C:\Windows\System\CSSUPoe.exe
  C:\Windows\System\CSSUPoe.exe
  2⤵
  PID:7420
- C:\Windows\System\QOcMYOh.exe
  C:\Windows\System\QOcMYOh.exe
  2⤵
  PID:7440
- C:\Windows\System\mFuLMoE.exe
  C:\Windows\System\mFuLMoE.exe
  2⤵
  PID:7468
- C:\Windows\System\SwQBrEe.exe
  C:\Windows\System\SwQBrEe.exe
  2⤵
  PID:6320
- C:\Windows\System\LExyYZc.exe
  C:\Windows\System\LExyYZc.exe
  2⤵
  PID:2044
- C:\Windows\System\JvPGsDy.exe
  C:\Windows\System\JvPGsDy.exe
  2⤵
  PID:7952
- C:\Windows\System\qGGhrSL.exe
  C:\Windows\System\qGGhrSL.exe
  2⤵
  PID:2380
- C:\Windows\System\TAIUvoy.exe
  C:\Windows\System\TAIUvoy.exe
  2⤵
  PID:7780
- C:\Windows\System\QRYzsQT.exe
  C:\Windows\System\QRYzsQT.exe
  2⤵
  PID:7808
- C:\Windows\System\BvnqXKO.exe
  C:\Windows\System\BvnqXKO.exe
  2⤵
  PID:7844
- C:\Windows\System\sAOScRL.exe
  C:\Windows\System\sAOScRL.exe
  2⤵
  PID:7888
- C:\Windows\System\QbJZqzu.exe
  C:\Windows\System\QbJZqzu.exe
  2⤵
  PID:8392
- C:\Windows\System\tsmREGC.exe
  C:\Windows\System\tsmREGC.exe
  2⤵
  PID:8460
- C:\Windows\System\MoEFuiC.exe
  C:\Windows\System\MoEFuiC.exe
  2⤵
  PID:8556
- C:\Windows\System\cYegvHz.exe
  C:\Windows\System\cYegvHz.exe
  2⤵
  PID:9224
- C:\Windows\System\APxbgpM.exe
  C:\Windows\System\APxbgpM.exe
  2⤵
  PID:9244
- C:\Windows\System\ndBsjoC.exe
  C:\Windows\System\ndBsjoC.exe
  2⤵
  PID:9264
- C:\Windows\System\gOsHPrr.exe
  C:\Windows\System\gOsHPrr.exe
  2⤵
  PID:9288
- C:\Windows\System\OwSqUKA.exe
  C:\Windows\System\OwSqUKA.exe
  2⤵
  PID:9304
- C:\Windows\System\jnYRMZO.exe
  C:\Windows\System\jnYRMZO.exe
  2⤵
  PID:9332
- C:\Windows\System\iutwPRS.exe
  C:\Windows\System\iutwPRS.exe
  2⤵
  PID:9360
- C:\Windows\System\sqQqVga.exe
  C:\Windows\System\sqQqVga.exe
  2⤵
  PID:9380
- C:\Windows\System\suhZvnK.exe
  C:\Windows\System\suhZvnK.exe
  2⤵
  PID:9400
- C:\Windows\System\yTMoPnD.exe
  C:\Windows\System\yTMoPnD.exe
  2⤵
  PID:9424
- C:\Windows\System\kdsZCaB.exe
  C:\Windows\System\kdsZCaB.exe
  2⤵
  PID:9448
- C:\Windows\System\dNfkDxf.exe
  C:\Windows\System\dNfkDxf.exe
  2⤵
  PID:9464
- C:\Windows\System\lMtJwVT.exe
  C:\Windows\System\lMtJwVT.exe
  2⤵
  PID:9488
- C:\Windows\System\ZcmpSRi.exe
  C:\Windows\System\ZcmpSRi.exe
  2⤵
  PID:9508
- C:\Windows\System\YFvZENT.exe
  C:\Windows\System\YFvZENT.exe
  2⤵
  PID:9528
- C:\Windows\System\CEGacEc.exe
  C:\Windows\System\CEGacEc.exe
  2⤵
  PID:9556
- C:\Windows\System\WNZsPHR.exe
  C:\Windows\System\WNZsPHR.exe
  2⤵
  PID:9580
- C:\Windows\System\BGCghVD.exe
  C:\Windows\System\BGCghVD.exe
  2⤵
  PID:9632
- C:\Windows\System\RLUZvii.exe
  C:\Windows\System\RLUZvii.exe
  2⤵
  PID:9648
- C:\Windows\System\xoNLLnx.exe
  C:\Windows\System\xoNLLnx.exe
  2⤵
  PID:9664
- C:\Windows\System\soZvemk.exe
  C:\Windows\System\soZvemk.exe
  2⤵
  PID:9680
- C:\Windows\System\qrLPKTA.exe
  C:\Windows\System\qrLPKTA.exe
  2⤵
  PID:9700
- C:\Windows\System\vLRfltx.exe
  C:\Windows\System\vLRfltx.exe
  2⤵
  PID:9720
- C:\Windows\System\GkTdOiO.exe
  C:\Windows\System\GkTdOiO.exe
  2⤵
  PID:9744
- C:\Windows\System\RBOFImY.exe
  C:\Windows\System\RBOFImY.exe
  2⤵
  PID:9764
- C:\Windows\System\IxUnmmY.exe
  C:\Windows\System\IxUnmmY.exe
  2⤵
  PID:9784
- C:\Windows\System\JqcJuAA.exe
  C:\Windows\System\JqcJuAA.exe
  2⤵
  PID:9804
- C:\Windows\System\yBdobSe.exe
  C:\Windows\System\yBdobSe.exe
  2⤵
  PID:9824
- C:\Windows\System\KUTQRvQ.exe
  C:\Windows\System\KUTQRvQ.exe
  2⤵
  PID:9840
- C:\Windows\System\wywhIYX.exe
  C:\Windows\System\wywhIYX.exe
  2⤵
  PID:9860
- C:\Windows\System\kAxauLw.exe
  C:\Windows\System\kAxauLw.exe
  2⤵
  PID:9884
- C:\Windows\System\cftFioI.exe
  C:\Windows\System\cftFioI.exe
  2⤵
  PID:9904
- C:\Windows\System\HUkDdRD.exe
  C:\Windows\System\HUkDdRD.exe
  2⤵
  PID:9920
- C:\Windows\System\NMiCmXn.exe
  C:\Windows\System\NMiCmXn.exe
  2⤵
  PID:9944
- C:\Windows\System\fzjfayl.exe
  C:\Windows\System\fzjfayl.exe
  2⤵
  PID:9968
- C:\Windows\System\HeWiXqw.exe
  C:\Windows\System\HeWiXqw.exe
  2⤵
  PID:9992
- C:\Windows\System\SFXnZJs.exe
  C:\Windows\System\SFXnZJs.exe
  2⤵
  PID:10016
- C:\Windows\System\GCwxIcc.exe
  C:\Windows\System\GCwxIcc.exe
  2⤵
  PID:10036
- C:\Windows\System\hzcvcPN.exe
  C:\Windows\System\hzcvcPN.exe
  2⤵
  PID:10064
- C:\Windows\System\gwfjEJp.exe
  C:\Windows\System\gwfjEJp.exe
  2⤵
  PID:10084
- C:\Windows\System\nIXChKp.exe
  C:\Windows\System\nIXChKp.exe
  2⤵
  PID:10100
- C:\Windows\System\aJfGOGv.exe
  C:\Windows\System\aJfGOGv.exe
  2⤵
  PID:10116
- C:\Windows\System\tvGdOXX.exe
  C:\Windows\System\tvGdOXX.exe
  2⤵
  PID:10132
- C:\Windows\System\OFwYdyN.exe
  C:\Windows\System\OFwYdyN.exe
  2⤵
  PID:10148
- C:\Windows\System\zFtnnZO.exe
  C:\Windows\System\zFtnnZO.exe
  2⤵
  PID:10164
- C:\Windows\System\HxjkupT.exe
  C:\Windows\System\HxjkupT.exe
  2⤵
  PID:10180
- C:\Windows\System\VZfVGTA.exe
  C:\Windows\System\VZfVGTA.exe
  2⤵
  PID:10196
- C:\Windows\System\NizkVJg.exe
  C:\Windows\System\NizkVJg.exe
  2⤵
  PID:10212
- C:\Windows\System\wlZRCKm.exe
  C:\Windows\System\wlZRCKm.exe
  2⤵
  PID:10228
- C:\Windows\System\DEBzhUH.exe
  C:\Windows\System\DEBzhUH.exe
  2⤵
  PID:8652
- C:\Windows\System\bCinAil.exe
  C:\Windows\System\bCinAil.exe
  2⤵
  PID:7684
- C:\Windows\System\TxHRDjO.exe
  C:\Windows\System\TxHRDjO.exe
  2⤵
  PID:7292
- C:\Windows\System\ExQlpjM.exe
  C:\Windows\System\ExQlpjM.exe
  2⤵
  PID:4012
- C:\Windows\System\OTdBDbI.exe
  C:\Windows\System\OTdBDbI.exe
  2⤵
  PID:384
- C:\Windows\System\dbzECfn.exe
  C:\Windows\System\dbzECfn.exe
  2⤵
  PID:6348
- C:\Windows\System\xDUepsj.exe
  C:\Windows\System\xDUepsj.exe
  2⤵
  PID:8876
- C:\Windows\System\HYSGgAX.exe
  C:\Windows\System\HYSGgAX.exe
  2⤵
  PID:8280
- C:\Windows\System\XMDKPnf.exe
  C:\Windows\System\XMDKPnf.exe
  2⤵
  PID:7252
- C:\Windows\System\abFUwIo.exe
  C:\Windows\System\abFUwIo.exe
  2⤵
  PID:9004
- C:\Windows\System\KOMXWAN.exe
  C:\Windows\System\KOMXWAN.exe
  2⤵
  PID:9124
- C:\Windows\System\fRDCvQW.exe
  C:\Windows\System\fRDCvQW.exe
  2⤵
  PID:9212
- C:\Windows\System\rOMZZLO.exe
  C:\Windows\System\rOMZZLO.exe
  2⤵
  PID:3696
- C:\Windows\System\ZqVfiHw.exe
  C:\Windows\System\ZqVfiHw.exe
  2⤵
  PID:7556
- C:\Windows\System\VnphqWy.exe
  C:\Windows\System\VnphqWy.exe
  2⤵
  PID:10260
- C:\Windows\System\AfhSTtt.exe
  C:\Windows\System\AfhSTtt.exe
  2⤵
  PID:10284
- C:\Windows\System\ugHfqov.exe
  C:\Windows\System\ugHfqov.exe
  2⤵
  PID:10308
- C:\Windows\System\UQiRIMB.exe
  C:\Windows\System\UQiRIMB.exe
  2⤵
  PID:10328
- C:\Windows\System\TTMFJLP.exe
  C:\Windows\System\TTMFJLP.exe
  2⤵
  PID:10352
- C:\Windows\System\yrKhyvo.exe
  C:\Windows\System\yrKhyvo.exe
  2⤵
  PID:10792
- C:\Windows\System\SXVSKyq.exe
  C:\Windows\System\SXVSKyq.exe
  2⤵
  PID:11076
- C:\Windows\System\ivGbGBO.exe
  C:\Windows\System\ivGbGBO.exe
  2⤵
  PID:11096
- C:\Windows\System\NKymSeX.exe
  C:\Windows\System\NKymSeX.exe
  2⤵
  PID:11116
- C:\Windows\System\blsekFP.exe
  C:\Windows\System\blsekFP.exe
  2⤵
  PID:11136
- C:\Windows\System\xLHgMRN.exe
  C:\Windows\System\xLHgMRN.exe
  2⤵
  PID:11156
- C:\Windows\System\cmHMDtm.exe
  C:\Windows\System\cmHMDtm.exe
  2⤵
  PID:11176
- C:\Windows\System\qqJxUxU.exe
  C:\Windows\System\qqJxUxU.exe
  2⤵
  PID:11196
- C:\Windows\System\ZOGhPtp.exe
  C:\Windows\System\ZOGhPtp.exe
  2⤵
  PID:11216
- C:\Windows\System\YlqPNoN.exe
  C:\Windows\System\YlqPNoN.exe
  2⤵
  PID:11240
- C:\Windows\System\DtIFXJT.exe
  C:\Windows\System\DtIFXJT.exe
  2⤵
  PID:11256
- C:\Windows\System\smTBIZn.exe
  C:\Windows\System\smTBIZn.exe
  2⤵
  PID:8048
- C:\Windows\System\TXZojpb.exe
  C:\Windows\System\TXZojpb.exe
  2⤵
  PID:7860
- C:\Windows\System\PiNTiUu.exe
  C:\Windows\System\PiNTiUu.exe
  2⤵
  PID:8604
- C:\Windows\System\oiLOEXm.exe
  C:\Windows\System\oiLOEXm.exe
  2⤵
  PID:9408
- C:\Windows\System\iKLhTYT.exe
  C:\Windows\System\iKLhTYT.exe
  2⤵
  PID:9484
- C:\Windows\System\LuplyLr.exe
  C:\Windows\System\LuplyLr.exe
  2⤵
  PID:7528
- C:\Windows\System\LvVvIEB.exe
  C:\Windows\System\LvVvIEB.exe
  2⤵
  PID:8780
- C:\Windows\System\oDzZLCk.exe
  C:\Windows\System\oDzZLCk.exe
  2⤵
  PID:9952
- C:\Windows\System\yjcLNsF.exe
  C:\Windows\System\yjcLNsF.exe
  2⤵
  PID:10004
- C:\Windows\System\leSsxfE.exe
  C:\Windows\System\leSsxfE.exe
  2⤵
  PID:8860
- C:\Windows\System\BKcinKv.exe
  C:\Windows\System\BKcinKv.exe
  2⤵
  PID:8316
- C:\Windows\System\ghbBxir.exe
  C:\Windows\System\ghbBxir.exe
  2⤵
  PID:10192
- C:\Windows\System\AitEslH.exe
  C:\Windows\System\AitEslH.exe
  2⤵
  PID:772
- C:\Windows\System\VwYiCLM.exe
  C:\Windows\System\VwYiCLM.exe
  2⤵
  PID:8764
- C:\Windows\System\RQnOUIv.exe
  C:\Windows\System\RQnOUIv.exe
  2⤵
  PID:9144
- C:\Windows\System\spoGNBA.exe
  C:\Windows\System\spoGNBA.exe
  2⤵
  PID:5588
- C:\Windows\System\DMtNerM.exe
  C:\Windows\System\DMtNerM.exe
  2⤵
  PID:7444
- C:\Windows\System\DnQsrxD.exe
  C:\Windows\System\DnQsrxD.exe
  2⤵
  PID:8644
- C:\Windows\System\lmLGoAu.exe
  C:\Windows\System\lmLGoAu.exe
  2⤵
  PID:8724
- C:\Windows\System\fUKpeac.exe
  C:\Windows\System\fUKpeac.exe
  2⤵
  PID:8816
- C:\Windows\System\NWixuKx.exe
  C:\Windows\System\NWixuKx.exe
  2⤵
  PID:8736
- C:\Windows\System\vFJjWxc.exe
  C:\Windows\System\vFJjWxc.exe
  2⤵
  PID:8948
- C:\Windows\System\jiyxXrT.exe
  C:\Windows\System\jiyxXrT.exe
  2⤵
  PID:9020
- C:\Windows\System\DZnqOuc.exe
  C:\Windows\System\DZnqOuc.exe
  2⤵
  PID:9036
- C:\Windows\System\tBtZDkP.exe
  C:\Windows\System\tBtZDkP.exe
  2⤵
  PID:9068
- C:\Windows\System\ZuSQnoa.exe
  C:\Windows\System\ZuSQnoa.exe
  2⤵
  PID:8700
- C:\Windows\System\Zoyclkj.exe
  C:\Windows\System\Zoyclkj.exe
  2⤵
  PID:6772
- C:\Windows\System\SijYIwi.exe
  C:\Windows\System\SijYIwi.exe
  2⤵
  PID:10124
- C:\Windows\System\cjYtcUF.exe
  C:\Windows\System\cjYtcUF.exe
  2⤵
  PID:9960
- C:\Windows\System\bPgKraS.exe
  C:\Windows\System\bPgKraS.exe
  2⤵
  PID:9672
- C:\Windows\System\JxPgggv.exe
  C:\Windows\System\JxPgggv.exe
  2⤵
  PID:9480
- C:\Windows\System\MCikyjV.exe
  C:\Windows\System\MCikyjV.exe
  2⤵
  PID:10276
- C:\Windows\System\hmHAIUL.exe
  C:\Windows\System\hmHAIUL.exe
  2⤵
  PID:8152
- C:\Windows\System\eUvgkKD.exe
  C:\Windows\System\eUvgkKD.exe
  2⤵
  PID:5212
- C:\Windows\System\jGqOuiE.exe
  C:\Windows\System\jGqOuiE.exe
  2⤵
  PID:5288
- C:\Windows\System\VUEhqfV.exe
  C:\Windows\System\VUEhqfV.exe
  2⤵
  PID:8196
- C:\Windows\System\LSCsSws.exe
  C:\Windows\System\LSCsSws.exe
  2⤵
  PID:7824
- C:\Windows\System\SCWEQHQ.exe
  C:\Windows\System\SCWEQHQ.exe
  2⤵
  PID:8456
- C:\Windows\System\AjdYyez.exe
  C:\Windows\System\AjdYyez.exe
  2⤵
  PID:9240
- C:\Windows\System\nNrOnyF.exe
  C:\Windows\System\nNrOnyF.exe
  2⤵
  PID:10444
- C:\Windows\System\puXulnr.exe
  C:\Windows\System\puXulnr.exe
  2⤵
  PID:10732
- C:\Windows\System\ORRqEUb.exe
  C:\Windows\System\ORRqEUb.exe
  2⤵
  PID:9660
- C:\Windows\System\YVTAljD.exe
  C:\Windows\System\YVTAljD.exe
  2⤵
  PID:9732
- C:\Windows\System\fyOrRPR.exe
  C:\Windows\System\fyOrRPR.exe
  2⤵
  PID:9880
- C:\Windows\System\lECqxeJ.exe
  C:\Windows\System\lECqxeJ.exe
  2⤵
  PID:10096
- C:\Windows\System\yScbNYT.exe
  C:\Windows\System\yScbNYT.exe
  2⤵
  PID:10160
- C:\Windows\System\bveUZTr.exe
  C:\Windows\System\bveUZTr.exe
  2⤵
  PID:3020
- C:\Windows\System\NnhuVxB.exe
  C:\Windows\System\NnhuVxB.exe
  2⤵
  PID:11284
- C:\Windows\System\GFjBJsC.exe
  C:\Windows\System\GFjBJsC.exe
  2⤵
  PID:11316
- C:\Windows\System\OsPlHuP.exe
  C:\Windows\System\OsPlHuP.exe
  2⤵
  PID:11336
- C:\Windows\System\QsjbTYi.exe
  C:\Windows\System\QsjbTYi.exe
  2⤵
  PID:11368
- C:\Windows\System\YklpEks.exe
  C:\Windows\System\YklpEks.exe
  2⤵
  PID:11416
- C:\Windows\System\oPHOoTZ.exe
  C:\Windows\System\oPHOoTZ.exe
  2⤵
  PID:11444
- C:\Windows\System\uRORpdw.exe
  C:\Windows\System\uRORpdw.exe
  2⤵
  PID:11468
- C:\Windows\System\QgcuYPX.exe
  C:\Windows\System\QgcuYPX.exe
  2⤵
  PID:11508
- C:\Windows\System\DfUjcGl.exe
  C:\Windows\System\DfUjcGl.exe
  2⤵
  PID:11532
- C:\Windows\System\JvNKqnD.exe
  C:\Windows\System\JvNKqnD.exe
  2⤵
  PID:11576
- C:\Windows\System\tiyJVPp.exe
  C:\Windows\System\tiyJVPp.exe
  2⤵
  PID:11592
- C:\Windows\System\lGasAgz.exe
  C:\Windows\System\lGasAgz.exe
  2⤵
  PID:11620
- C:\Windows\System\qNFzrks.exe
  C:\Windows\System\qNFzrks.exe
  2⤵
  PID:11644
- C:\Windows\System\gZKZpsy.exe
  C:\Windows\System\gZKZpsy.exe
  2⤵
  PID:11668
- C:\Windows\System\lLhuNPP.exe
  C:\Windows\System\lLhuNPP.exe
  2⤵
  PID:11700
- C:\Windows\System\RMRXsjZ.exe
  C:\Windows\System\RMRXsjZ.exe
  2⤵
  PID:11716
- C:\Windows\System\WiresqG.exe
  C:\Windows\System\WiresqG.exe
  2⤵
  PID:11748
- C:\Windows\System\BZCtxrN.exe
  C:\Windows\System\BZCtxrN.exe
  2⤵
  PID:11772
- C:\Windows\System\mXxazeu.exe
  C:\Windows\System\mXxazeu.exe
  2⤵
  PID:11792
- C:\Windows\System\NDJytRH.exe
  C:\Windows\System\NDJytRH.exe
  2⤵
  PID:11808
- C:\Windows\System\WbpZuIv.exe
  C:\Windows\System\WbpZuIv.exe
  2⤵
  PID:11828
- C:\Windows\System\ahxpawu.exe
  C:\Windows\System\ahxpawu.exe
  2⤵
  PID:11848
- C:\Windows\System\bAqgoya.exe
  C:\Windows\System\bAqgoya.exe
  2⤵
  PID:11864
- C:\Windows\System\forBqVO.exe
  C:\Windows\System\forBqVO.exe
  2⤵
  PID:11884
- C:\Windows\System\YghXvQG.exe
  C:\Windows\System\YghXvQG.exe
  2⤵
  PID:11908
- C:\Windows\System\JLDiKkj.exe
  C:\Windows\System\JLDiKkj.exe
  2⤵
  PID:11928
- C:\Windows\System\vdhFdQF.exe
  C:\Windows\System\vdhFdQF.exe
  2⤵
  PID:11944
- C:\Windows\System\yygPnLc.exe
  C:\Windows\System\yygPnLc.exe
  2⤵
  PID:11964
- C:\Windows\System\aKxwsjj.exe
  C:\Windows\System\aKxwsjj.exe
  2⤵
  PID:11980
- C:\Windows\System\YczidlS.exe
  C:\Windows\System\YczidlS.exe
  2⤵
  PID:11996
- C:\Windows\System\wBaFFsT.exe
  C:\Windows\System\wBaFFsT.exe
  2⤵
  PID:12012
- C:\Windows\System\NXxLjkl.exe
  C:\Windows\System\NXxLjkl.exe
  2⤵
  PID:12028
- C:\Windows\System\IyUHmwn.exe
  C:\Windows\System\IyUHmwn.exe
  2⤵
  PID:12044
- C:\Windows\System\LUtCEHP.exe
  C:\Windows\System\LUtCEHP.exe
  2⤵
  PID:12060
- C:\Windows\System\alknNVs.exe
  C:\Windows\System\alknNVs.exe
  2⤵
  PID:12076
- C:\Windows\System\KtFeQkg.exe
  C:\Windows\System\KtFeQkg.exe
  2⤵
  PID:12092
- C:\Windows\System\lrJunes.exe
  C:\Windows\System\lrJunes.exe
  2⤵
  PID:12108
- C:\Windows\System\aMAjcKr.exe
  C:\Windows\System\aMAjcKr.exe
  2⤵
  PID:12128
- C:\Windows\System\liMDBmg.exe
  C:\Windows\System\liMDBmg.exe
  2⤵
  PID:12152
- C:\Windows\System\mxDUTSf.exe
  C:\Windows\System\mxDUTSf.exe
  2⤵
  PID:12172
- C:\Windows\System\VIIBDOT.exe
  C:\Windows\System\VIIBDOT.exe
  2⤵
  PID:12192
- C:\Windows\System\aFxXndV.exe
  C:\Windows\System\aFxXndV.exe
  2⤵
  PID:12220
- C:\Windows\System\uVzhEuh.exe
  C:\Windows\System\uVzhEuh.exe
  2⤵
  PID:12240
- C:\Windows\System\VbOLJxe.exe
  C:\Windows\System\VbOLJxe.exe
  2⤵
  PID:12260
- C:\Windows\System\xVfRLhX.exe
  C:\Windows\System\xVfRLhX.exe
  2⤵
  PID:12276
- C:\Windows\System\TeSAvBK.exe
  C:\Windows\System\TeSAvBK.exe
  2⤵
  PID:10876
- C:\Windows\System\foPFBBB.exe
  C:\Windows\System\foPFBBB.exe
  2⤵
  PID:10900
- C:\Windows\System\mXuOnuQ.exe
  C:\Windows\System\mXuOnuQ.exe
  2⤵
  PID:1084
- C:\Windows\System\fuZXVmS.exe
  C:\Windows\System\fuZXVmS.exe
  2⤵
  PID:7788
- C:\Windows\System\YeEEUtR.exe
  C:\Windows\System\YeEEUtR.exe
  2⤵
  PID:8212
- C:\Windows\System\zFAOGhI.exe
  C:\Windows\System\zFAOGhI.exe
  2⤵
  PID:6616
- C:\Windows\System\LkdSImR.exe
  C:\Windows\System\LkdSImR.exe
  2⤵
  PID:11152
- C:\Windows\System\mLOCwsi.exe
  C:\Windows\System\mLOCwsi.exe
  2⤵
  PID:9040
- C:\Windows\System\KIzCmQT.exe
  C:\Windows\System\KIzCmQT.exe
  2⤵
  PID:10280
- C:\Windows\System\zKljCYa.exe
  C:\Windows\System\zKljCYa.exe
  2⤵
  PID:10360
- C:\Windows\System\ABsumlL.exe
  C:\Windows\System\ABsumlL.exe
  2⤵
  PID:12328
- C:\Windows\System\aTMtGPa.exe
  C:\Windows\System\aTMtGPa.exe
  2⤵
  PID:12344
- C:\Windows\System\otGrzPr.exe
  C:\Windows\System\otGrzPr.exe
  2⤵
  PID:12360
- C:\Windows\System\TaUMYVN.exe
  C:\Windows\System\TaUMYVN.exe
  2⤵
  PID:12380
- C:\Windows\System\xAwnJhO.exe
  C:\Windows\System\xAwnJhO.exe
  2⤵
  PID:12400
- C:\Windows\System\VTqqeKI.exe
  C:\Windows\System\VTqqeKI.exe
  2⤵
  PID:12420
- C:\Windows\System\rmSoQva.exe
  C:\Windows\System\rmSoQva.exe
  2⤵
  PID:12436
- C:\Windows\System\tCfwVjg.exe
  C:\Windows\System\tCfwVjg.exe
  2⤵
  PID:12456
- C:\Windows\System\uxUucjx.exe
  C:\Windows\System\uxUucjx.exe
  2⤵
  PID:12476
- C:\Windows\System\ZExlLZC.exe
  C:\Windows\System\ZExlLZC.exe
  2⤵
  PID:12496
- C:\Windows\System\MnKGrrw.exe
  C:\Windows\System\MnKGrrw.exe
  2⤵
  PID:12520
- C:\Windows\System\JmkwDAf.exe
  C:\Windows\System\JmkwDAf.exe
  2⤵
  PID:12548
- C:\Windows\System\qUrHKbk.exe
  C:\Windows\System\qUrHKbk.exe
  2⤵
  PID:12568
- C:\Windows\System\ttjzZsh.exe
  C:\Windows\System\ttjzZsh.exe
  2⤵
  PID:12588
- C:\Windows\System\DXJhean.exe
  C:\Windows\System\DXJhean.exe
  2⤵
  PID:12604
- C:\Windows\System\eDsivRb.exe
  C:\Windows\System\eDsivRb.exe
  2⤵
  PID:12624
- C:\Windows\System\sIrECge.exe
  C:\Windows\System\sIrECge.exe
  2⤵
  PID:12644
- C:\Windows\System\bHLPDhT.exe
  C:\Windows\System\bHLPDhT.exe
  2⤵
  PID:12660
- C:\Windows\System\mXKzzYC.exe
  C:\Windows\System\mXKzzYC.exe
  2⤵
  PID:12676
- C:\Windows\System\RQPLXRI.exe
  C:\Windows\System\RQPLXRI.exe
  2⤵
  PID:12692
- C:\Windows\System\dIHJKFc.exe
  C:\Windows\System\dIHJKFc.exe
  2⤵
  PID:12708
- C:\Windows\System\vKnLsDr.exe
  C:\Windows\System\vKnLsDr.exe
  2⤵
  PID:12728
- C:\Windows\System\dVWfOTO.exe
  C:\Windows\System\dVWfOTO.exe
  2⤵
  PID:12752
- C:\Windows\System\BUhfszP.exe
  C:\Windows\System\BUhfszP.exe
  2⤵
  PID:12772
- C:\Windows\System\EBkXyhi.exe
  C:\Windows\System\EBkXyhi.exe
  2⤵
  PID:12796
- C:\Windows\System\ZJrrAdc.exe
  C:\Windows\System\ZJrrAdc.exe
  2⤵
  PID:12812
- C:\Windows\System\TSltlyn.exe
  C:\Windows\System\TSltlyn.exe
  2⤵
  PID:12832
- C:\Windows\System\sVcgjLe.exe
  C:\Windows\System\sVcgjLe.exe
  2⤵
  PID:12852
- C:\Windows\System\nnqGSoo.exe
  C:\Windows\System\nnqGSoo.exe
  2⤵
  PID:12868
- C:\Windows\System\aFKPHVd.exe
  C:\Windows\System\aFKPHVd.exe
  2⤵
  PID:12884
- C:\Windows\System\sXjwlIB.exe
  C:\Windows\System\sXjwlIB.exe
  2⤵
  PID:12900
- C:\Windows\System\nGYkleY.exe
  C:\Windows\System\nGYkleY.exe
  2⤵
  PID:12920
- C:\Windows\System\QSvagOp.exe
  C:\Windows\System\QSvagOp.exe
  2⤵
  PID:12940
- C:\Windows\System\UssHxTP.exe
  C:\Windows\System\UssHxTP.exe
  2⤵
  PID:12964
- C:\Windows\System\pmfRlZo.exe
  C:\Windows\System\pmfRlZo.exe
  2⤵
  PID:12984
- C:\Windows\System\DpbEBEL.exe
  C:\Windows\System\DpbEBEL.exe
  2⤵
  PID:13004
- C:\Windows\System\yFiQwdp.exe
  C:\Windows\System\yFiQwdp.exe
  2⤵
  PID:13028
- C:\Windows\System\qIbFvsE.exe
  C:\Windows\System\qIbFvsE.exe
  2⤵
  PID:13048
- C:\Windows\System\uTRvmgx.exe
  C:\Windows\System\uTRvmgx.exe
  2⤵
  PID:13072
- C:\Windows\System\oWOqdSN.exe
  C:\Windows\System\oWOqdSN.exe
  2⤵
  PID:9640
- C:\Windows\System\TScRslm.exe
  C:\Windows\System\TScRslm.exe
  2⤵
  PID:7288
- C:\Windows\System\NnQemKm.exe
  C:\Windows\System\NnQemKm.exe
  2⤵
  PID:10404
- C:\Windows\System\ZERhAyG.exe
  C:\Windows\System\ZERhAyG.exe
  2⤵
  PID:11292
- C:\Windows\System\OaLerqO.exe
  C:\Windows\System\OaLerqO.exe
  2⤵
  PID:11356
- C:\Windows\System\xGyCfAT.exe
  C:\Windows\System\xGyCfAT.exe
  2⤵
  PID:13248
- C:\Windows\System\bnGYYVV.exe
  C:\Windows\System\bnGYYVV.exe
  2⤵
  PID:12468
- C:\Windows\System\QKlefvK.exe
  C:\Windows\System\QKlefvK.exe
  2⤵
  PID:11724
- C:\Windows\System\rzpNBXH.exe
  C:\Windows\System\rzpNBXH.exe
  2⤵
  PID:12632
- C:\Windows\System\LQVeOVu.exe
  C:\Windows\System\LQVeOVu.exe
  2⤵
  PID:12720
- C:\Windows\System\BmdSCGD.exe
  C:\Windows\System\BmdSCGD.exe
  2⤵
  PID:13308
- C:\Windows\System\RnLgucA.exe
  C:\Windows\System\RnLgucA.exe
  2⤵
  PID:13288
- C:\Windows\System\QTavnvm.exe
  C:\Windows\System\QTavnvm.exe
  2⤵
  PID:11504
- C:\Windows\System\tWUCkXG.exe
  C:\Windows\System\tWUCkXG.exe
  2⤵
  PID:12956
- C:\Windows\System\jctbZCH.exe
  C:\Windows\System\jctbZCH.exe
  2⤵
  PID:11916
- C:\Windows\System\fhKjdsh.exe
  C:\Windows\System\fhKjdsh.exe
  2⤵
  PID:10056
- C:\Windows\System\PAUDDBd.exe
  C:\Windows\System\PAUDDBd.exe
  2⤵
  PID:11788
- C:\Windows\System\pgSviQa.exe
  C:\Windows\System\pgSviQa.exe
  2⤵
  PID:11836
- C:\Windows\System\cuahtzU.exe
  C:\Windows\System\cuahtzU.exe
  2⤵
  PID:1204
- C:\Windows\System\ZMcfIAM.exe
  C:\Windows\System\ZMcfIAM.exe
  2⤵
  PID:10684
- C:\Windows\System\txsrEyf.exe
  C:\Windows\System\txsrEyf.exe
  2⤵
  PID:11956
- C:\Windows\System\vWsFgqq.exe
  C:\Windows\System\vWsFgqq.exe
  2⤵
  PID:12148
- C:\Windows\System\RGGEKES.exe
  C:\Windows\System\RGGEKES.exe
  2⤵
  PID:12336
- C:\Windows\System\VGMbRWK.exe
  C:\Windows\System\VGMbRWK.exe
  2⤵
  PID:11920
- C:\Windows\System\sDcdvNj.exe
  C:\Windows\System\sDcdvNj.exe
  2⤵
  PID:8672
- C:\Windows\System\tAzxffS.exe
  C:\Windows\System\tAzxffS.exe
  2⤵
  PID:12256
- C:\Windows\System\srGZRXj.exe
  C:\Windows\System\srGZRXj.exe
  2⤵
  PID:9608
- C:\Windows\System\QEZSSCu.exe
  C:\Windows\System\QEZSSCu.exe
  2⤵
  PID:4172
- C:\Windows\System\OnXHOeC.exe
  C:\Windows\System\OnXHOeC.exe
  2⤵
  PID:11428
- C:\Windows\System\jdYcLZJ.exe
  C:\Windows\System\jdYcLZJ.exe
  2⤵
  PID:13180
- C:\Windows\System\JdxMNgZ.exe
  C:\Windows\System\JdxMNgZ.exe
  2⤵
  PID:11632
- C:\Windows\System\SwrcPnP.exe
  C:\Windows\System\SwrcPnP.exe
  2⤵
  PID:4896
- C:\Windows\System\YtIGocT.exe
  C:\Windows\System\YtIGocT.exe
  2⤵
  PID:7380
- C:\Windows\System\tUCirXy.exe
  C:\Windows\System\tUCirXy.exe
  2⤵
  PID:3596
- C:\Windows\System\yKrOCcg.exe
  C:\Windows\System\yKrOCcg.exe
  2⤵
  PID:8600
- C:\Windows\System\UyETGRv.exe
  C:\Windows\System\UyETGRv.exe
  2⤵
  PID:9868
- C:\Windows\System\wikIcmv.exe
  C:\Windows\System\wikIcmv.exe
  2⤵
  PID:11460
- C:\Windows\System\aRJeHPd.exe
  C:\Windows\System\aRJeHPd.exe
  2⤵
  PID:13012
- C:\Windows\System\sCGVjIl.exe
  C:\Windows\System\sCGVjIl.exe
  2⤵
  PID:12936
- C:\Windows\System\huKfScr.exe
  C:\Windows\System\huKfScr.exe
  2⤵
  PID:9736
- C:\Windows\System\AxQsLvC.exe
  C:\Windows\System\AxQsLvC.exe
  2⤵
  PID:11800
- C:\Windows\System\iiPBwzh.exe
  C:\Windows\System\iiPBwzh.exe
  2⤵
  PID:12536
- C:\Windows\System\iwLQXld.exe
  C:\Windows\System\iwLQXld.exe
  2⤵
  PID:9436
- C:\Windows\System\JwCVKJt.exe
  C:\Windows\System\JwCVKJt.exe
  2⤵
  PID:11520
- C:\Windows\System\RgSKEXZ.exe
  C:\Windows\System\RgSKEXZ.exe
  2⤵
  PID:12700
- C:\Windows\System\OqQagTY.exe
  C:\Windows\System\OqQagTY.exe
  2⤵
  PID:9896
- C:\Windows\System\gWZQLYR.exe
  C:\Windows\System\gWZQLYR.exe
  2⤵
  PID:1652
- C:\Windows\System\ojhfXdm.exe
  C:\Windows\System\ojhfXdm.exe
  2⤵
  PID:12668
- C:\Windows\System\LoHbpWT.exe
  C:\Windows\System\LoHbpWT.exe
  2⤵
  PID:3908
- C:\Windows\System\sDXRvDy.exe
  C:\Windows\System\sDXRvDy.exe
  2⤵
  PID:9236
- C:\Windows\System\dRHHTuR.exe
  C:\Windows\System\dRHHTuR.exe
  2⤵
  PID:12804
- C:\Windows\System\qTytjmC.exe
  C:\Windows\System\qTytjmC.exe
  2⤵
  PID:11108
- C:\Windows\System\oSWezac.exe
  C:\Windows\System\oSWezac.exe
  2⤵
  PID:3120
- C:\Windows\System\aVBanoG.exe
  C:\Windows\System\aVBanoG.exe
  2⤵
  PID:8748
- C:\Windows\System\HEzwXJX.exe
  C:\Windows\System\HEzwXJX.exe
  2⤵
  PID:12928
- C:\Windows\System\TTgWVgG.exe
  C:\Windows\System\TTgWVgG.exe
  2⤵
  PID:11616
- C:\Windows\System\oPnCmCx.exe
  C:\Windows\System\oPnCmCx.exe
  2⤵
  PID:1696
- C:\Windows\System\ToEsPfn.exe
  C:\Windows\System\ToEsPfn.exe
  2⤵
  PID:9064
- C:\Windows\System\LSGsqWh.exe
  C:\Windows\System\LSGsqWh.exe
  2⤵
  PID:11840
- C:\Windows\System\AIluIbz.exe
  C:\Windows\System\AIluIbz.exe
  2⤵
  PID:3824
- C:\Windows\System\ynYTqMX.exe
  C:\Windows\System\ynYTqMX.exe
  2⤵
  PID:6528
- C:\Windows\System\YXzXsia.exe
  C:\Windows\System\YXzXsia.exe
  2⤵
  PID:13040
- C:\Windows\System\xnNuKwm.exe
  C:\Windows\System\xnNuKwm.exe
  2⤵
  PID:1784
- C:\Windows\System\mikFjsD.exe
  C:\Windows\System\mikFjsD.exe
  2⤵
  PID:10960
- C:\Windows\System\OeBWFdS.exe
  C:\Windows\System\OeBWFdS.exe
  2⤵
  PID:13020
- C:\Windows\System\YDOGtWB.exe
  C:\Windows\System\YDOGtWB.exe
  2⤵
  PID:8980
- C:\Windows\System\BOrhABq.exe
  C:\Windows\System\BOrhABq.exe
  2⤵
  PID:9816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ni0tro3t.zrj.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AHipKHd.exe

Filesize
1.7MB

MD5
f25633e3eb182e51e36dbbe83612a770

SHA1
7dc1904a04726c6bb1009b17e0bc05d7915bfd13

SHA256
140d2c862ae7ef809e7f863c5bea70f2070d01531d9a0898eaf400fa731dc59c

SHA512
5671b569e48026e6182d58b2eadc5897803431048cc06c4b4055052e6eea2063fbda75ae31ffadb2c7d1d8008f6fa06ac872302df0307eea7653edb9527b6252

Download Submit
C:\Windows\System\BduYWRm.exe

Filesize
1.7MB

MD5
4b63fb6f095d231902411ea6c96db3c1

SHA1
4e199a749ba07f2606054187589a0a22e1d3e535

SHA256
56e6600d6b4574a85e7c3cd6c0bde7efc47ea6ef010f048cbea0fd47d5d735c0

SHA512
38502bd70500d8fc38807d50fc5a307d817018d20282ca7d770b098eb4c3d606cf24650b9bb1efffcb8b92c35f0ec81ebac6873d35340591dbbfaf24d9c4f874

Download Submit
C:\Windows\System\IHkHnHc.exe

Filesize
1.7MB

MD5
d7d2cda7b4599660e618e6d885b44c17

SHA1
dcbf16c4ad2530ac9ac00ea37f0e2c62801b282e

SHA256
c21e78c75ef33cbf4083fb2b3392428412fbbd90734d89748114c930d9cb69da

SHA512
d9acf07acc7cb6aa74135c6a0c2bbc15acaddbf26150629844b9e86c3f05d52e3848accf430cf98848d46c06b52e6086319de84b40df3a5ce06f8bb2cb21dd07

Download Submit
C:\Windows\System\IMGMlGf.exe

Filesize
1.7MB

MD5
a0787018ee5fe93648ae21cf01cade0b

SHA1
49005193681c4d8ddbea0181c227e5ba18096715

SHA256
1abf049353a4af8a9b71c40fdbbd6ae36732294bfe361c33b21ec27dc5952b50

SHA512
f397a1921571abf4fc86565653a1c69bd19d803cd5c71c7a2cde798da77784f7a0816a854576b8cd8ee689800fb7194042ed46251fb8f516b2c6362dc6d8f28b

Download Submit
C:\Windows\System\KPnanEs.exe

Filesize
1.7MB

MD5
3b845604cca175bb66eed84dc2f00958

SHA1
59f0c685e59be8cb5c1cf986f693858f3caf6fd7

SHA256
d098fb21c7a1204875ee668a0756867e16b0e96b2c4e50cbbe01a5e26c6e4e86

SHA512
cdec0e5ba4342ac5d73c6e14ec440f9b0be32a4bab609d6490f428cacb92bec56c615cd2a89521cbb1ab8f8d044d06b6e1ff3ba434335d3f1ae6bb96e876d4ec

Download Submit
C:\Windows\System\KVxYadR.exe

Filesize
1.7MB

MD5
7ee953ea0fdcff59c73792881b3e0d0d

SHA1
8540badcfda2589840db011231bcf0bd071baef1

SHA256
5ef92c4d0702ca0d54809310ebc201024500e6c5c2937ec151b68c531558c47d

SHA512
e86df87bd0d10e4b6171cda9c5e86505a45dba164d054793cb0a87a1c39e0d706b22a107a9521e9533f24843f09df5fa01de0eeac02a884bebe17018f134132a

Download Submit
C:\Windows\System\MJcTyyp.exe

Filesize
1.6MB

MD5
b5043795fedd72bed1de582101aa37b0

SHA1
449db6b5bb4ea26bf9fe741bccce76b8061d4773

SHA256
d4e3d0bd662ce5df577613559090884fbd9e5635bb4b8c661291885e9ad59140

SHA512
d68df7a0f5aa880c56014a0afe81cbf0fea3eb8b6f95760de2fbed564c1841fc3a103cde8ab060e67275267765d6b89d3b6713aa0ac34b76b113311f80a0c2bc

Download Submit
C:\Windows\System\MJcTyyp.exe

Filesize
1.7MB

MD5
a0c96f30059519215c2516742a25ec8b

SHA1
5bb0a6346ff062648b8062a8ec0b159baa6b50fe

SHA256
8099023cfcc3bdbe499904aa50f197b54b8235235fbe2a98efc90ad34ee7a026

SHA512
045bd506d1ab67d061a1e9fb21514d74f98357ffb128bb900db7f7b4b450fc06dc92a763b74d1fbe658df50797e484952f12ff3a3891bf9ed1fe00a51697d1c6

Download Submit
C:\Windows\System\ODsweyr.exe

Filesize
1.7MB

MD5
194b493efaf24755285b43396d1e9c81

SHA1
288e360cbfb50db46a6d03c94965df8a13ccb8ce

SHA256
9799d2df06bb06e6d98e86b5843c42122e93fd3776e54a3b74f14bf6b5d895c6

SHA512
7d885ecf828ce2c3b3724aac067a1018424fc6586d71a9297b8931d7b88495cdb2e69c21f95652952c3aec1be10e157a71e7a2b98aeffaa58147af41b29997a2

Download Submit
C:\Windows\System\QcEVrHt.exe

Filesize
1.7MB

MD5
718b38014cd730c824fddfcb2aeda44e

SHA1
57190f90d6cc2237ef7247f5f901a9a0ad76a86e

SHA256
89f5155a665d10e6172f5d8845955b9819e9aeb3606accd34cd299057d0eae63

SHA512
f5965426f1491bd2e96de6bffe0a4731d3b213eac629943d0c01e9703aa149b23afd456879144649b2447e5caebda280e557dfbc70a92d45551663d22f3eca19

Download Submit
C:\Windows\System\RUGeDcN.exe

Filesize
1.7MB

MD5
ffa2e75abea918ded5d628c08dace83d

SHA1
d5fec2197a61f40d8a846f48d0ee96f7421bdc6e

SHA256
e945ab7fa8135e5fd87c89fc869f46c7417aa28f5f77f3b1639023fcbd128c5f

SHA512
5727dbfd4594f9cb14649bf8ef77dcefbd1c24e793b5ee68722eb96f625bf827cf5d9419c08668a78a701dc7d1ce761908679e9ba039d0f9030c7f4bd450f573

Download Submit
C:\Windows\System\SGCkDzX.exe

Filesize
1.7MB

MD5
2c92f6466117fb1cef71d64364fb4339

SHA1
cf2a99827b48b19df1b4ebfb82010778b3c18e51

SHA256
82abcc1f8654908be97f78972482778c50cf5663736e8743ce4619ca7727a496

SHA512
80dbffbee10a96fc638471492359386067c8fc0b548019f1bc606c651b3f699f53598f48281a1a4d946838f6e551c314aff07c915a47009f192047e0b038a85e

Download Submit
C:\Windows\System\ShbQVMc.exe

Filesize
8B

MD5
8a9416a5ba3f4513ce86ee25fcd9ed2c

SHA1
a36f3dd1333c8cfee404b646d4c6809d7e653313

SHA256
fb7dd3a16f87fe8b7e98987069f2b605508df1550402bd2a9bfdec4856b1a59a

SHA512
c747d417c3e282ae9ec82b691c8fea9cb7d0729d1dda54d2144fa9c71dd39f2ab11cee5a6768a89cb91fd4a7ae6e579302cb4e4de8d6384014994320074580a4

Download Submit
C:\Windows\System\TKzmaXY.exe

Filesize
1.7MB

MD5
33ee3412aaf92a36024a44ca4d70947d

SHA1
310ec045fc85470947194149504ac504b5254b10

SHA256
81ddaad3dcfc072e99556a2bc37b6b21926635f4abeec30717e1ccb9d5bb6fb6

SHA512
e8cd801259bfc7aa0a305f8618655d8182e98a22b33cd4abac38098fb3a45d29f769665cb98b9c23cde3b6c3e71cdcfc6fe0ac2797b8af2f9b8f8b16c62ec62d

Download Submit
C:\Windows\System\TbSuraP.exe

Filesize
1.7MB

MD5
ff930812f45fecd1b8fbc9087c091619

SHA1
05c0f0359046dabc8914b5ac3dc0c015d889df3f

SHA256
284f00e7d76306b7f16c536766e11ef6cf220e64e475b501e0e4c667b5f83f6e

SHA512
f25c40b59c83809ec2beef960f86d9aea7ecefbc97996b39da146267fe07b94f2720111879e3fcb8413594b77667923fd380b5066415b6c92167dbfd435f3463

Download Submit
C:\Windows\System\TkqmMzm.exe

Filesize
1.7MB

MD5
6353cd2300a6ff53a4a0f9b8a2439eff

SHA1
597ea049f0580b277fc94e793e73ebbc29bc8e5e

SHA256
c21fee1628fdbecea25980b16247158c25c4747866716c5ff5e32a72391a1fd7

SHA512
29183c7e623cbdd8444cfec1cea68dc3731f0166272ad8febe22ffc5c8a2addc1c7b285428d9c5a3c580f49931371e03ef4b4b4fdcad82d53b2fdfbda088422a

Download Submit
C:\Windows\System\UwHmWtz.exe

Filesize
1.7MB

MD5
eae01e58d848389477ecfc46f35c15c0

SHA1
dcb4eca3abf9619fe248d3adbfe539a98ae10efd

SHA256
84f5416bf7c21e2c71b64b09f69608c3f83820e86707b389541485b125e87c13

SHA512
f201ceb39bf60e195f90112e55c09ffa352672e91fe9d9a70c5faa4c68a0c4c0821387290e1d2a25de13d807ecbda6486a6f27d915548c4c654c06e2ef811621

Download Submit
C:\Windows\System\VaQrReq.exe

Filesize
1.7MB

MD5
00ef0069432404cd2d25d6a6f06083b0

SHA1
3b07db83d377e289ce952fe79fd93bd8114ec78c

SHA256
dec3ce31d714403c74e3929614e1d07b5044c1cee41349766345fd2ec3ccf5f6

SHA512
d945c11f5fe500b6c5ac6dd2297e9b8f5f0b2ea5549317f3b9491e8544d8f8bfd54fa3339ba0f39b9a3a29cfa2d91cb4a503ea250e80d9ce041e0a7e14feea5b

Download Submit
C:\Windows\System\YPClzYD.exe

Filesize
1.7MB

MD5
21610bb44ceef67ac685a6229f27b430

SHA1
be3ea843517e662ce3c78491889d4132cfaa06de

SHA256
e7bed073da001010a2a337ad2175f9836cbe1167171f3b848201c44651f02763

SHA512
5c508836366709c530df2f8bd3e5e42855202d72560c9d2537264f5cc9d04caeb6a4f2bbfef974bb1b89a29fdfb7026bb7a348fc2ff0d85daa047ed34670532e

Download Submit
C:\Windows\System\YaGEzWt.exe

Filesize
1.7MB

MD5
49438ffe0edb6008b6823a7193d4364b

SHA1
f6d32e65da273d2609eb644065c094b7484219a7

SHA256
303aacbe0e4f7781e336fcec2dae70c44082bcbfae73ba7e19138cd0534b93d0

SHA512
04e117f96f88882535e3a47d828b8bbc33d2c308cf8eada612e63904417e3521367547102589325c19d321a70ee0b698e4620d14f3729439432ea179499d926b

Download Submit
C:\Windows\System\YaaghDg.exe

Filesize
1.7MB

MD5
fde7ef8245bbf98878caa5470a220c14

SHA1
0d0173493fae05998c81304c857645a91949946a

SHA256
3a7809e75a1fd37429aad0b682bf3c98eef641ab18eb49d5774bd0bb99321607

SHA512
6573222195a83cbc26ee6ec2ee133a889770a0b9ae8721e4523e072be804069e544744e64f84dcfc9dcc4408c87865ffa13b44445a97655d8bb8c10f496dbe9d

Download Submit
C:\Windows\System\YyDbKHM.exe

Filesize
1.7MB

MD5
055e0ab74123b4ef75064a6af1b8b02a

SHA1
9c8a8f4d2c9dc94b9c0d38b5bcae37e0f4f02098

SHA256
a385f645165e1b8c7e93d68f63f896914ce876997852a1f01c297801df5d794e

SHA512
445553335ad5d036e97f07cf98e2ca825509efa599daed0db09d181ff1f32e716a9a6595cf2bed1d681861fa233a6710852348ce99547be8291076cea763783a

Download Submit
C:\Windows\System\ZWDmqWW.exe

Filesize
1.7MB

MD5
25d3e081e73dd4ce84053b3e4c0ffe72

SHA1
c5de475086da5f8a06a49b40f9e6c8ac4b13d366

SHA256
fa8d396f4b2d8832f602ddcfa68e1ec23a8d74300d18a8335f70135442fed879

SHA512
72c5088f6843274e51b9983c7ffb193550514459eeb55883e050c90e66cc001fc3bf5d2fec073b1f8f267a0d412bdbcee58a84a414329c0a151206ea32cdfc51

Download Submit
C:\Windows\System\aoKpRYj.exe

Filesize
1.7MB

MD5
42c6cd6fb3bca3435815fdd40ab0d3dd

SHA1
546774f2a3f8368aeeb2006f98c0081e13237cb5

SHA256
f0b1d06dbde1538e490143b56a3a0ee6259567c7b34d2890db8992378abc38ff

SHA512
6b3e33bf7b6b4cfaa866daf92c9af66cc4d0a495c028f35fefa7da51a424ad3025b3b3cac514e85a09f23147ef011a5dae93cb9da6d15ba222816bbe5c56195c

Download Submit
C:\Windows\System\blOwOxr.exe

Filesize
1.7MB

MD5
7060805fdd8788234d7c6e1938c4825a

SHA1
5055694f50b8164fe7214d87870eba639200e8a7

SHA256
c902a25146b1be6c0b425d6c0e1cb8773a23e6635b70965e8e6665d7f01eadc8

SHA512
e9946cf33856426e9aa20c72956ea02ea35d430f69aa511652ffbc83445e1dc6abc85f3fd9d8bc5230010be3fe553b5670f0112227abcc9aedcead9533acb130

Download Submit
C:\Windows\System\dLZIFNU.exe

Filesize
1.7MB

MD5
9df66167096409ae3916c5227c52b7c0

SHA1
923e0286e725b3c9204c0748f2fef0816398b2e4

SHA256
67fbaf50d89c978c7c3630315558f4aad0de1b0dee16a0d8c51af289b6dfb3e6

SHA512
d0123f4a2b715d4717628e2f5a383cfc40b1e1253c6200a3e54af3d162c8db4b81041e727d8b7e83827ade27d9d3b0b9c6ca852ea4c3394f708e73bb58d91d81

Download Submit
C:\Windows\System\gDVWEtj.exe

Filesize
1.7MB

MD5
ef330ea9f805d3d9506ef70554402e87

SHA1
2db4c0fa3ea55c8330ccefe7719413041597adfa

SHA256
80415262fd3e6a8786d40ce95724afccc1762d0b97476c6cb796b56253c82c4a

SHA512
f8c0282bcccf5b873ca14df2c11125baa9b655e6d7231d3970a092af1c06aff879cd2ade227db535929a26ea63d53397fedfeaaa130147e48f31fd73bb8f126c

Download Submit
C:\Windows\System\jxZEffC.exe

Filesize
1.7MB

MD5
a8071f0a6e4139ba98dc140105ea1abc

SHA1
ad0a8917aad684f0771e1d9955fc9f69714656be

SHA256
0fd2d4083d6e3db2fe7a80455f2037493d451408c30a36da1f122afb1518fb96

SHA512
da58f217a3437d3e00221f8cd239cedbc9345afce2cb8e512d8fe0423404b7cb6dc31d0fca8ab7b75b6db94d6acbbf35aa61142ab5610f9484e7d156063d7f08

Download Submit
C:\Windows\System\kwbONYA.exe

Filesize
1.7MB

MD5
623c04d68eff815b10cd2a6fedff2981

SHA1
ac49b3b1051cf11e1d0a11c104a0af7a5bd97a9e

SHA256
41f7fae34bd2c948cac69dd7e326014241aede7a1e88463fc447253edce1aef3

SHA512
373997040b5f39cf31febb54682b897066b28d33135313968db44ed74af0d4e5ffceb85f917f479261da74543f4c8be657f4462342362029b2687491bfd50a85

Download Submit
C:\Windows\System\mqxUwAs.exe

Filesize
1.7MB

MD5
643e42cc68bb33b7a4d96915338ea000

SHA1
b36fa0ae252e45ed5423d084b20857059dbf8eb1

SHA256
66c5b1da129c36812ba82a0e40cae0dab69b85c3c63ba832dfb748a49494bbd7

SHA512
f956a6e6e949d387074ec63b740a25c277a671b9fa400b793383f0878e8712c388f60e7693915fcad714b2d8dd9549a65936d3b7d24fc8bf0eb467600d9b77fe

Download Submit
C:\Windows\System\nGwLxDa.exe

Filesize
1.7MB

MD5
11f2ed573d381d3b942e2991d997521c

SHA1
a96b60ab409334475ef61456e956b073957d7ec5

SHA256
dd6d9609aa1bd4ec853855f391f45bf26af7a7873cc1e503980cff643f826db3

SHA512
7667f54eedf701838b07c5bf2bc84cced2dc6e1aee3924054bafc35d1bbae9a265542d3c1f47eecce45251b1e90fd229ff6cbbf6af90d944dc4155cf147e4e49

Download Submit
C:\Windows\System\nSLxrtp.exe

Filesize
1.7MB

MD5
cabd6fdcd46ae4009a27343329f5ef9a

SHA1
89dc11eadf65bad0104c8ba5c94375a077e12588

SHA256
d03ae2e79def0f50ebf7a65ba8d77b5bc7507e1392d414bb616dc232d56b161e

SHA512
9a8b877e96c3dc0f7f88de0665190b495f6e5792cf285bf75518220e83e9432b7509344c9b1fbf5c85a9009d0fd40fc61cc1344d6ed73e240fed5673f85490e7

Download Submit
C:\Windows\System\orczgjm.exe

Filesize
1.7MB

MD5
58342bad80ff004cd5476128660f7088

SHA1
d61c590697abe4ac3d995d007e3dbd22056982e9

SHA256
56eff40c6634c37a703df38fea206ad361a0a7c8843ffa687e3810c718c1aafa

SHA512
1cf2382af78e354a072c3a537e31b48fd14fc3a746780ce215e5b31583cdc95012beb86610350d149bd691cd53da4fb034eb635af902bc635d3ba6f7754eeff9

Download Submit
C:\Windows\System\qfbtPFe.exe

Filesize
1.7MB

MD5
f4391d97139b8976b58e3f9259fad310

SHA1
469a2547fa05a94a9d718eba0ef7f6f0f6741ce9

SHA256
3fce6a4cdd406a86f41e9264109abd36090381f189ec4373633b512fce23effe

SHA512
7408fb7f9371da9e487816877d92fbbe27a1505f25e3ec0488aece4fc91e62d80e9edd0b5725c6c6f2fa3f6d271a2e9f7127903424db0c19cbecc6c5f1bb8b19

Download Submit
C:\Windows\System\sQKZhkA.exe

Filesize
1.7MB

MD5
4e77011f8f9ae91ea635b7b25db621c8

SHA1
ab091e9f283a526fdce3429d5bfe40cfa211a6e8

SHA256
00281cbdb79215c36f2875fb35ba936abac10d6d0bbe87c1f76d95cd14324bd0

SHA512
d19f8896e308bc41f5adeb29d65e7f9d9356c82736e38e3585482ed0e7a0681ea15a47285855087a11677766bcffa02d0505b85c7ae52450af3f3a4a7e1eb8cb

Download Submit
C:\Windows\System\vvXFmMx.exe

Filesize
1.7MB

MD5
5194f10a8153e13b2d9b890b7bc313ad

SHA1
e3d4770ac78c99c5a09dfe5d5f04bec00637b43c

SHA256
14625d88949ec91232fa420425d686689fcddb93c8163ba7271bece088ff1043

SHA512
80c9251d053833295061923e8d58f93cf569170ea94849a0aa4171df23fcb9c36a651eba35607ab04a47a6e56048c264091e86f42cb342900c77568081a98e2e

Download Submit
C:\Windows\System\wZExCGm.exe

Filesize
1.7MB

MD5
25cd464b0d0479c5ae0bb9392696e894

SHA1
3a6122e529c5d85152a78e9af82499a7af9f6b2d

SHA256
e162adc28dfe182dced2c48507f1dab238a494b46fb1ffc7c3567495fe6dfed4

SHA512
e86462bfb8d405cdd139615082146c349ea6a84595560ffd5d95a8381dbf2e0f5be29a65b9e76b3859bae958a6a29f877378fc087f9c3196f89d83627dd5ba07

Download Submit
C:\Windows\System\wZExCGm.exe

Filesize
1.6MB

MD5
b2a935be4bba28335c5d1ec58985caf8

SHA1
c5eb987a8a58a80479e57e197e18f8f71de788bc

SHA256
815eb510d75599ca86ce8eb8a2eb3f400808833b4be8dc8d4384627f4223e46b

SHA512
eeb1be61e9caa21efbfec267b3236bc63a891a9a17ade8170ed9a5018d8e839cce458cb9c9ca876bbfeab68b39b4edb684cefd8e116524c523b584e0e32b8d0a

Download Submit
C:\Windows\System\wioHabr.exe

Filesize
1.7MB

MD5
90819abf814e6a5b73ba53c0842348b1

SHA1
3da538f626908a2df0aaf62f882bd0409356627f

SHA256
df0cf9666deb55236f4378c30923f495769be0012721a3a69b5e2c73f4a41bd6

SHA512
fb599b5c67a2f0206e1861326ccb048156236e16a71e1ffa8a5789b0e79de24d0459ce9bec3a466c9eab839a22b5cc144b69c62f595f986400c538f3c10dcdcb

Download Submit
C:\Windows\System\yKTjGVg.exe

Filesize
1.7MB

MD5
182b0e8035192e67b522b19cadf5b184

SHA1
11dec21851db716e6e543cbdf2658a82e58f4db5

SHA256
af805bd6d9cbeeba2c8fba3e216e8e376669bac930ae614367424c757a62005a

SHA512
31d8b26ecb111f6e6588022a8f5a2f4f438d1cf1ba8c40539acf10b9b7f0d35d4e4d98862e1fa5b40402eb978a9e1516f464c5e57a6a50d1efb06730c45346c0

Download Submit
C:\Windows\System\yQnLzJZ.exe

Filesize
1.7MB

MD5
6e1f828ef998e7d301f73389ed951135

SHA1
8764dd8eeb8b8ae1225c982f921ffcb3744f6bbe

SHA256
d5904e0a0d00f4d02970a6f2ed8c7787c0844830f5a1272bc18ccf0d7305cc56

SHA512
ea27bd0c43e18d5c10de8757ae0fc3b7aa82bc1123025a7e1f631c040be0b6efc8a8a0263c6b829e6a84ad28077dae4a348ce9d3ccf668c33890800b92d7672e

Download Submit
C:\Windows\System\yZQVQVi.exe

Filesize
1.7MB

MD5
2ce0893dc756a9928bc0a1c8bde6c80c

SHA1
858002ba034a862adaf477c2fed1cc738235cea6

SHA256
abb217d07c7e61d221bdb543f9a72a74e015a271b6ff263e2926abd4acb6ab73

SHA512
d29dc025393dfb4a6e8e1095f79be9a843d5eb6e107399447f1bea095bc89c9e87137332befff30800a40b29238a7fe2da5b24ecf8861d5e1344c52a1065831d

Download Submit
C:\Windows\System\zfBoJrC.exe

Filesize
1.7MB

MD5
6dbc5978d32c1ac37e20c9d1c1d50fd4

SHA1
36b246a0871efb3f2237119cb06f5bbbeb72a401

SHA256
05870326b302c4e5a39a02a7ecad6fee8de41fbb97bf49795eb2da23dd99f609

SHA512
8db88391871ad1076f5f6cc387beae598be5a1bf5601edaa3e5be554866332fe36184d53e79908f8117dc3f807ea4c736f07711790550e351a94d8ed23c180b3

Download Submit
C:\Windows\System\ztsSWcf.exe

Filesize
1.7MB

MD5
6a81d26e9dd32c0dc9ebb2b1651d1a13

SHA1
fc9094267f8d3c3298c382aa9212416b4eeb8ecd

SHA256
41083cf35efa24020723afb2a3bd9297f5dcba115196f5aceca330264e73b6ec

SHA512
aec3bc14b384936160638abbbd8e78bf5ebbfbece7eb9bd2ffec99c0e0a38456dd15b8b694557b0dbab5077693e4fa8dc71def708b2ff3bb33cf2b25ca164c19

Download Submit
memory/684-631-0x00007FF6B6CC0000-0x00007FF6B70B2000-memory.dmp

Filesize
3.9MB

Download
memory/684-3724-0x00007FF6B6CC0000-0x00007FF6B70B2000-memory.dmp

Filesize
3.9MB

Download
memory/860-1-0x000001ED13730000-0x000001ED13740000-memory.dmp

Filesize
64KB

Download
memory/860-0-0x00007FF7D7960000-0x00007FF7D7D52000-memory.dmp

Filesize
3.9MB

Download
memory/1080-3715-0x00007FF68E890000-0x00007FF68EC82000-memory.dmp

Filesize
3.9MB

Download
memory/1080-1007-0x00007FF68E890000-0x00007FF68EC82000-memory.dmp

Filesize
3.9MB

Download
memory/1220-3729-0x00007FF7DA250000-0x00007FF7DA642000-memory.dmp

Filesize
3.9MB

Download
memory/1220-924-0x00007FF7DA250000-0x00007FF7DA642000-memory.dmp

Filesize
3.9MB

Download
memory/1488-1550-0x00007FF67A070000-0x00007FF67A462000-memory.dmp

Filesize
3.9MB

Download
memory/1488-3737-0x00007FF67A070000-0x00007FF67A462000-memory.dmp

Filesize
3.9MB

Download
memory/1504-3709-0x00007FF7C0670000-0x00007FF7C0A62000-memory.dmp

Filesize
3.9MB

Download
memory/1504-532-0x00007FF7C0670000-0x00007FF7C0A62000-memory.dmp

Filesize
3.9MB

Download
memory/1952-228-0x00007FF8E1C10000-0x00007FF8E26D1000-memory.dmp

Filesize
10.8MB

Download
memory/1952-92-0x00007FF8E1C10000-0x00007FF8E26D1000-memory.dmp

Filesize
10.8MB

Download
memory/1952-9-0x00007FF8E1C13000-0x00007FF8E1C15000-memory.dmp

Filesize
8KB

Download
memory/1952-209-0x000001C7612A0000-0x000001C7612C2000-memory.dmp

Filesize
136KB

Download
memory/2032-1349-0x00007FF618D40000-0x00007FF619132000-memory.dmp

Filesize
3.9MB

Download
memory/2032-3735-0x00007FF618D40000-0x00007FF619132000-memory.dmp

Filesize
3.9MB

Download
memory/3052-706-0x00007FF7498A0000-0x00007FF749C92000-memory.dmp

Filesize
3.9MB

Download
memory/3052-3717-0x00007FF7498A0000-0x00007FF749C92000-memory.dmp

Filesize
3.9MB

Download
memory/3216-619-0x00007FF6F86A0000-0x00007FF6F8A92000-memory.dmp

Filesize
3.9MB

Download
memory/3216-3719-0x00007FF6F86A0000-0x00007FF6F8A92000-memory.dmp

Filesize
3.9MB

Download
memory/3508-3713-0x00007FF7AC290000-0x00007FF7AC682000-memory.dmp

Filesize
3.9MB

Download
memory/3508-681-0x00007FF7AC290000-0x00007FF7AC682000-memory.dmp

Filesize
3.9MB

Download
memory/3644-3746-0x00007FF6F3F10000-0x00007FF6F4302000-memory.dmp

Filesize
3.9MB

Download
memory/3644-722-0x00007FF6F3F10000-0x00007FF6F4302000-memory.dmp

Filesize
3.9MB

Download
memory/3868-3756-0x00007FF6688D0000-0x00007FF668CC2000-memory.dmp

Filesize
3.9MB

Download
memory/3868-870-0x00007FF6688D0000-0x00007FF668CC2000-memory.dmp

Filesize
3.9MB

Download
memory/3916-478-0x00007FF77E920000-0x00007FF77ED12000-memory.dmp

Filesize
3.9MB

Download
memory/3916-3701-0x00007FF77E920000-0x00007FF77ED12000-memory.dmp

Filesize
3.9MB

Download
memory/4004-3705-0x00007FF6DBB20000-0x00007FF6DBF12000-memory.dmp

Filesize
3.9MB

Download
memory/4004-592-0x00007FF6DBB20000-0x00007FF6DBF12000-memory.dmp

Filesize
3.9MB

Download
memory/4016-914-0x00007FF651370000-0x00007FF651762000-memory.dmp

Filesize
3.9MB

Download
memory/4016-3726-0x00007FF651370000-0x00007FF651762000-memory.dmp

Filesize
3.9MB

Download
memory/4060-3727-0x00007FF6BB630000-0x00007FF6BBA22000-memory.dmp

Filesize
3.9MB

Download
memory/4060-723-0x00007FF6BB630000-0x00007FF6BBA22000-memory.dmp

Filesize
3.9MB

Download
memory/4180-799-0x00007FF719800000-0x00007FF719BF2000-memory.dmp

Filesize
3.9MB

Download
memory/4180-3754-0x00007FF719800000-0x00007FF719BF2000-memory.dmp

Filesize
3.9MB

Download
memory/4192-1575-0x00007FF645190000-0x00007FF645582000-memory.dmp

Filesize
3.9MB

Download
memory/4192-3739-0x00007FF645190000-0x00007FF645582000-memory.dmp

Filesize
3.9MB

Download
memory/4256-634-0x00007FF75CC40000-0x00007FF75D032000-memory.dmp

Filesize
3.9MB

Download
memory/4256-3707-0x00007FF75CC40000-0x00007FF75D032000-memory.dmp

Filesize
3.9MB

Download
memory/4296-1700-0x00007FF759B20000-0x00007FF759F12000-memory.dmp

Filesize
3.9MB

Download
memory/4296-3757-0x00007FF759B20000-0x00007FF759F12000-memory.dmp

Filesize
3.9MB

Download
memory/4348-383-0x00007FF770940000-0x00007FF770D32000-memory.dmp

Filesize
3.9MB

Download
memory/4348-3699-0x00007FF770940000-0x00007FF770D32000-memory.dmp

Filesize
3.9MB

Download
memory/4536-3711-0x00007FF681C60000-0x00007FF682052000-memory.dmp

Filesize
3.9MB

Download
memory/4536-579-0x00007FF681C60000-0x00007FF682052000-memory.dmp

Filesize
3.9MB

Download
memory/4648-1352-0x00007FF622CD0000-0x00007FF6230C2000-memory.dmp

Filesize
3.9MB

Download
memory/4648-3721-0x00007FF622CD0000-0x00007FF6230C2000-memory.dmp

Filesize
3.9MB

Download
memory/4772-1709-0x00007FF6CD720000-0x00007FF6CDB12000-memory.dmp

Filesize
3.9MB

Download
memory/4772-3703-0x00007FF6CD720000-0x00007FF6CDB12000-memory.dmp

Filesize
3.9MB

Download
memory/5084-3734-0x00007FF620D90000-0x00007FF621182000-memory.dmp

Filesize
3.9MB

Download
memory/5084-1288-0x00007FF620D90000-0x00007FF621182000-memory.dmp

Filesize
3.9MB

Download