xmrig | 82c8a0a9e5ec83173ad54a78cfeccd4b4bd75f81f1b6f3f19829e808475f4356

Analysis

max time kernel
27s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
30-04-2024 22:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
Size

1.8MB
MD5

0a951e54e12b1ef0849949cab693b8d0
SHA1

e26183a919f263d2ca70e5572c021bef99d0913e
SHA256

82c8a0a9e5ec83173ad54a78cfeccd4b4bd75f81f1b6f3f19829e808475f4356
SHA512

c28171a15e64da1cd036b91729b93082d6d27f054dff9f6f8a1df2972bc2c03beccc5e59fb927c11d28a87848cb02dbad523a398f0e9d69dcfb49b5bb30ab11f
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlZ:NABw

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 39 IoCs

miner

resource	yara_rule
behavioral2/memory/4072-49-0x00007FF723DE0000-0x00007FF7241D2000-memory.dmp	xmrig
behavioral2/memory/2124-55-0x00007FF7BF510000-0x00007FF7BF902000-memory.dmp	xmrig
behavioral2/memory/968-58-0x00007FF6569B0000-0x00007FF656DA2000-memory.dmp	xmrig
behavioral2/memory/4896-60-0x00007FF7BD9D0000-0x00007FF7BDDC2000-memory.dmp	xmrig
behavioral2/memory/3796-90-0x00007FF682D10000-0x00007FF683102000-memory.dmp	xmrig
behavioral2/memory/3032-278-0x00007FF609BA0000-0x00007FF609F92000-memory.dmp	xmrig
behavioral2/memory/1620-279-0x00007FF6C6C50000-0x00007FF6C7042000-memory.dmp	xmrig
behavioral2/memory/5088-106-0x00007FF6CC440000-0x00007FF6CC832000-memory.dmp	xmrig
behavioral2/memory/4776-82-0x00007FF692EA0000-0x00007FF693292000-memory.dmp	xmrig
behavioral2/memory/5100-76-0x00007FF662E00000-0x00007FF6631F2000-memory.dmp	xmrig
behavioral2/memory/1568-71-0x00007FF7BC4D0000-0x00007FF7BC8C2000-memory.dmp	xmrig
behavioral2/memory/1132-48-0x00007FF73C240000-0x00007FF73C632000-memory.dmp	xmrig
behavioral2/memory/3384-320-0x00007FF6B07C0000-0x00007FF6B0BB2000-memory.dmp	xmrig
behavioral2/memory/724-323-0x00007FF61BA30000-0x00007FF61BE22000-memory.dmp	xmrig
behavioral2/memory/2796-325-0x00007FF7C9D20000-0x00007FF7CA112000-memory.dmp	xmrig
behavioral2/memory/2772-329-0x00007FF62DA60000-0x00007FF62DE52000-memory.dmp	xmrig
behavioral2/memory/3484-332-0x00007FF754230000-0x00007FF754622000-memory.dmp	xmrig
behavioral2/memory/1276-335-0x00007FF7840C0000-0x00007FF7844B2000-memory.dmp	xmrig
behavioral2/memory/3272-336-0x00007FF6964C0000-0x00007FF6968B2000-memory.dmp	xmrig
behavioral2/memory/3920-337-0x00007FF7BC590000-0x00007FF7BC982000-memory.dmp	xmrig
behavioral2/memory/1132-1709-0x00007FF73C240000-0x00007FF73C632000-memory.dmp	xmrig
behavioral2/memory/968-1761-0x00007FF6569B0000-0x00007FF656DA2000-memory.dmp	xmrig
behavioral2/memory/5100-1804-0x00007FF662E00000-0x00007FF6631F2000-memory.dmp	xmrig
behavioral2/memory/3920-1889-0x00007FF7BC590000-0x00007FF7BC982000-memory.dmp	xmrig
behavioral2/memory/724-1876-0x00007FF61BA30000-0x00007FF61BE22000-memory.dmp	xmrig
behavioral2/memory/1708-1867-0x00007FF7B6960000-0x00007FF7B6D52000-memory.dmp	xmrig
behavioral2/memory/5088-1866-0x00007FF6CC440000-0x00007FF6CC832000-memory.dmp	xmrig
behavioral2/memory/3796-1838-0x00007FF682D10000-0x00007FF683102000-memory.dmp	xmrig
behavioral2/memory/4088-1821-0x00007FF700470000-0x00007FF700862000-memory.dmp	xmrig
behavioral2/memory/4776-1830-0x00007FF692EA0000-0x00007FF693292000-memory.dmp	xmrig
behavioral2/memory/4896-1787-0x00007FF7BD9D0000-0x00007FF7BDDC2000-memory.dmp	xmrig
behavioral2/memory/3032-2023-0x00007FF609BA0000-0x00007FF609F92000-memory.dmp	xmrig
behavioral2/memory/3272-2026-0x00007FF6964C0000-0x00007FF6968B2000-memory.dmp	xmrig
behavioral2/memory/1276-2104-0x00007FF7840C0000-0x00007FF7844B2000-memory.dmp	xmrig
behavioral2/memory/2772-2183-0x00007FF62DA60000-0x00007FF62DE52000-memory.dmp	xmrig
behavioral2/memory/3384-2012-0x00007FF6B07C0000-0x00007FF6B0BB2000-memory.dmp	xmrig
behavioral2/memory/2124-1770-0x00007FF7BF510000-0x00007FF7BF902000-memory.dmp	xmrig
behavioral2/memory/4072-1739-0x00007FF723DE0000-0x00007FF7241D2000-memory.dmp	xmrig
behavioral2/memory/1568-1723-0x00007FF7BC4D0000-0x00007FF7BC8C2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
7	1964	powershell.exe
9	1964	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1568	RQAEWyp.exe
1132	NBFhKdc.exe
4072	qelSPOZ.exe
2124	karLDVc.exe
968	SRYvncw.exe
4896	yZBtfHe.exe
4088	ZDFDKxE.exe
5100	UFKEJTv.exe
4776	rjvYutc.exe
1708	pxuFYOv.exe
3796	OroZRip.exe
5088	kJjUVQV.exe
3032	pccJtZw.exe
3384	mmTpfCd.exe
724	vNUoQoD.exe
3272	jXGERPJ.exe
3920	cTdpOcU.exe
2796	ImJtWYG.exe
2772	raesjuv.exe
3484	eMlUUPi.exe
1276	kpNHSJc.exe
440	eEAfOeg.exe
228	nNzeFtw.exe
880	mCahaOG.exe
4648	WVOsDmi.exe
4488	aNcTEpj.exe
4476	tkkxKob.exe
4572	DSsivJy.exe
2788	fynUvgO.exe
3628	ykgiqCW.exe
1780	lhVWhYE.exe
3108	VeJLQTz.exe
4336	mWRcVBa.exe
2200	efToqju.exe
4580	LAKdbaT.exe
2844	KsUXPcZ.exe
3652	oVWhNoT.exe
2616	lSsPGrf.exe
3288	fqDCZkg.exe
3904	GoAQlLa.exe
4856	xBxUgGh.exe
4928	iTEGwhq.exe
2032	LGSNwsB.exe
4768	qsaHpqh.exe
756	UJhPblz.exe
2344	gORDogQ.exe
4620	EBxxmyx.exe
2528	plDSZuU.exe
3792	pdILWWt.exe
3236	iTucavm.exe
4952	OPIoQZU.exe
3612	ZzxDVzc.exe
5124	ILdBpbT.exe
5152	RJezRlJ.exe
5180	LfdUnze.exe
5208	wTEJHZv.exe
5232	NAftDAE.exe
5260	sNHPNEM.exe
5284	zFzEmCO.exe
5332	fXaiEbK.exe
5356	yOEaVSX.exe
5376	WgCrxiY.exe
5400	GRgdPpu.exe
5480	dNsJqge.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1620-0-0x00007FF6C6C50000-0x00007FF6C7042000-memory.dmp	upx
behavioral2/files/0x000800000002322b-6.dat	upx
behavioral2/files/0x000800000002322e-10.dat	upx
behavioral2/files/0x0008000000023232-9.dat	upx
behavioral2/files/0x0007000000023234-24.dat	upx
behavioral2/files/0x0008000000023230-39.dat	upx
behavioral2/files/0x0007000000023235-50.dat	upx
behavioral2/memory/4072-49-0x00007FF723DE0000-0x00007FF7241D2000-memory.dmp	upx
behavioral2/memory/2124-55-0x00007FF7BF510000-0x00007FF7BF902000-memory.dmp	upx
behavioral2/memory/968-58-0x00007FF6569B0000-0x00007FF656DA2000-memory.dmp	upx
behavioral2/memory/4896-60-0x00007FF7BD9D0000-0x00007FF7BDDC2000-memory.dmp	upx
behavioral2/files/0x0007000000023239-70.dat	upx
behavioral2/files/0x0008000000023238-75.dat	upx
behavioral2/files/0x000700000002323c-87.dat	upx
behavioral2/memory/3796-90-0x00007FF682D10000-0x00007FF683102000-memory.dmp	upx
behavioral2/files/0x000700000002323f-113.dat	upx
behavioral2/files/0x0007000000023241-125.dat	upx
behavioral2/files/0x0007000000023243-132.dat	upx
behavioral2/files/0x0007000000023245-137.dat	upx
behavioral2/files/0x0007000000023246-148.dat	upx
behavioral2/files/0x0007000000023247-150.dat	upx
behavioral2/files/0x000700000002324c-173.dat	upx
behavioral2/files/0x000700000002324e-185.dat	upx
behavioral2/files/0x000700000002324d-180.dat	upx
behavioral2/memory/3032-278-0x00007FF609BA0000-0x00007FF609F92000-memory.dmp	upx
behavioral2/memory/1620-279-0x00007FF6C6C50000-0x00007FF6C7042000-memory.dmp	upx
behavioral2/files/0x000700000002324b-172.dat	upx
behavioral2/files/0x000700000002324a-168.dat	upx
behavioral2/files/0x0007000000023249-160.dat	upx
behavioral2/files/0x0007000000023248-157.dat	upx
behavioral2/files/0x0007000000023244-140.dat	upx
behavioral2/files/0x0007000000023242-128.dat	upx
behavioral2/files/0x0007000000023240-120.dat	upx
behavioral2/files/0x000700000002323e-110.dat	upx
behavioral2/memory/5088-106-0x00007FF6CC440000-0x00007FF6CC832000-memory.dmp	upx
behavioral2/files/0x000700000002323d-100.dat	upx
behavioral2/files/0x000700000002323b-97.dat	upx
behavioral2/files/0x000700000002323a-91.dat	upx
behavioral2/memory/1708-86-0x00007FF7B6960000-0x00007FF7B6D52000-memory.dmp	upx
behavioral2/memory/4776-82-0x00007FF692EA0000-0x00007FF693292000-memory.dmp	upx
behavioral2/memory/5100-76-0x00007FF662E00000-0x00007FF6631F2000-memory.dmp	upx
behavioral2/memory/1568-71-0x00007FF7BC4D0000-0x00007FF7BC8C2000-memory.dmp	upx
behavioral2/memory/4088-69-0x00007FF700470000-0x00007FF700862000-memory.dmp	upx
behavioral2/files/0x0008000000023237-64.dat	upx
behavioral2/files/0x0007000000023236-56.dat	upx
behavioral2/memory/1132-48-0x00007FF73C240000-0x00007FF73C632000-memory.dmp	upx
behavioral2/files/0x0008000000023233-27.dat	upx
behavioral2/memory/3384-320-0x00007FF6B07C0000-0x00007FF6B0BB2000-memory.dmp	upx
behavioral2/memory/724-323-0x00007FF61BA30000-0x00007FF61BE22000-memory.dmp	upx
behavioral2/memory/2796-325-0x00007FF7C9D20000-0x00007FF7CA112000-memory.dmp	upx
behavioral2/memory/2772-329-0x00007FF62DA60000-0x00007FF62DE52000-memory.dmp	upx
behavioral2/memory/3484-332-0x00007FF754230000-0x00007FF754622000-memory.dmp	upx
behavioral2/memory/1276-335-0x00007FF7840C0000-0x00007FF7844B2000-memory.dmp	upx
behavioral2/memory/3272-336-0x00007FF6964C0000-0x00007FF6968B2000-memory.dmp	upx
behavioral2/memory/3920-337-0x00007FF7BC590000-0x00007FF7BC982000-memory.dmp	upx
behavioral2/memory/1132-1709-0x00007FF73C240000-0x00007FF73C632000-memory.dmp	upx
behavioral2/memory/968-1761-0x00007FF6569B0000-0x00007FF656DA2000-memory.dmp	upx
behavioral2/memory/5100-1804-0x00007FF662E00000-0x00007FF6631F2000-memory.dmp	upx
behavioral2/memory/3920-1889-0x00007FF7BC590000-0x00007FF7BC982000-memory.dmp	upx
behavioral2/memory/724-1876-0x00007FF61BA30000-0x00007FF61BE22000-memory.dmp	upx
behavioral2/memory/1708-1867-0x00007FF7B6960000-0x00007FF7B6D52000-memory.dmp	upx
behavioral2/memory/5088-1866-0x00007FF6CC440000-0x00007FF6CC832000-memory.dmp	upx
behavioral2/memory/3796-1838-0x00007FF682D10000-0x00007FF683102000-memory.dmp	upx
behavioral2/memory/4088-1821-0x00007FF700470000-0x00007FF700862000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	raw.githubusercontent.com
7	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\sUsZPae.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\vNNlvYr.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\uVbsOlu.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\VbWNlPL.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\vffCDmd.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\eEAfOeg.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\ITFSIDs.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\neUjgwP.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\MOHGiQA.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\gYbKtwK.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\fbcgNwa.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\QcaRzVa.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\FydBOyq.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\qsaHpqh.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\UnFKObu.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\qjLBjdX.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\UFozQTJ.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\MpExrce.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\ZzxDVzc.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\imKWVxx.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\MWBjXud.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\jNlnbvm.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\sCqQTNz.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\UrNkRtF.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\DljGlja.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\BeKVSkk.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\tkkxKob.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\nqKAvjo.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\MIOdaTw.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\dpBueDM.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\lRqDMLI.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\lYzFFPg.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\jpciDuy.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\pccJtZw.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\plDSZuU.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\ObXkNnS.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\zICkLBd.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\EWrmdph.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\WVOsDmi.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\UMDWjKk.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\EBxxmyx.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\KJsGDaq.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\kbpgByd.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\jXGERPJ.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\mWRcVBa.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\jKlNdDn.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\vJHzRbj.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\HhkFWik.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\UFJtKNV.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\LAKdbaT.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\KsUXPcZ.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\NqziWoU.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\SnZeYiM.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\iTucavm.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\ZNHdIyE.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\UigcsjD.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\mmTpfCd.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\cTdpOcU.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\iNXcYjb.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\fnhKusY.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\mqbGyAB.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\qatveFI.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\mXNkpFa.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\RQAEWyp.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1964	powershell.exe
1964	powershell.exe
1964	powershell.exe
1964	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
Token: SeDebugPrivilege	1964	powershell.exe
Token: SeLockMemoryPrivilege	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 1964	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	93
PID 1620 wrote to memory of 1964	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	93
PID 1620 wrote to memory of 1568	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	94
PID 1620 wrote to memory of 1568	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	94
PID 1620 wrote to memory of 1132	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	95
PID 1620 wrote to memory of 1132	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	95
PID 1620 wrote to memory of 4072	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	96
PID 1620 wrote to memory of 4072	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	96
PID 1620 wrote to memory of 2124	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	97
PID 1620 wrote to memory of 2124	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	97
PID 1620 wrote to memory of 968	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	98
PID 1620 wrote to memory of 968	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	98
PID 1620 wrote to memory of 4896	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	99
PID 1620 wrote to memory of 4896	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	99
PID 1620 wrote to memory of 4088	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	100
PID 1620 wrote to memory of 4088	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	100
PID 1620 wrote to memory of 5100	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	101
PID 1620 wrote to memory of 5100	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	101
PID 1620 wrote to memory of 4776	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	102
PID 1620 wrote to memory of 4776	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	102
PID 1620 wrote to memory of 1708	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	103
PID 1620 wrote to memory of 1708	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	103
PID 1620 wrote to memory of 3796	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	104
PID 1620 wrote to memory of 3796	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	104
PID 1620 wrote to memory of 5088	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	105
PID 1620 wrote to memory of 5088	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	105
PID 1620 wrote to memory of 3032	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	106
PID 1620 wrote to memory of 3032	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	106
PID 1620 wrote to memory of 3384	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	107
PID 1620 wrote to memory of 3384	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	107
PID 1620 wrote to memory of 724	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	108
PID 1620 wrote to memory of 724	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	108
PID 1620 wrote to memory of 3272	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	109
PID 1620 wrote to memory of 3272	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	109
PID 1620 wrote to memory of 3920	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	110
PID 1620 wrote to memory of 3920	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	110
PID 1620 wrote to memory of 2796	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	111
PID 1620 wrote to memory of 2796	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	111
PID 1620 wrote to memory of 2772	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	112
PID 1620 wrote to memory of 2772	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	112
PID 1620 wrote to memory of 3484	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	113
PID 1620 wrote to memory of 3484	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	113
PID 1620 wrote to memory of 1276	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	114
PID 1620 wrote to memory of 1276	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	114
PID 1620 wrote to memory of 440	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	115
PID 1620 wrote to memory of 440	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	115
PID 1620 wrote to memory of 228	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	116
PID 1620 wrote to memory of 228	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	116
PID 1620 wrote to memory of 880	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	117
PID 1620 wrote to memory of 880	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	117
PID 1620 wrote to memory of 4648	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	118
PID 1620 wrote to memory of 4648	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	118
PID 1620 wrote to memory of 4488	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	119
PID 1620 wrote to memory of 4488	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	119
PID 1620 wrote to memory of 4476	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	120
PID 1620 wrote to memory of 4476	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	120
PID 1620 wrote to memory of 4572	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	121
PID 1620 wrote to memory of 4572	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	121
PID 1620 wrote to memory of 2788	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	122
PID 1620 wrote to memory of 2788	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	122
PID 1620 wrote to memory of 3628	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	123
PID 1620 wrote to memory of 3628	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	123
PID 1620 wrote to memory of 1780	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	124
PID 1620 wrote to memory of 1780	1620	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	124

C:\Users\Admin\AppData\Local\Temp\0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1964
- C:\Windows\System\RQAEWyp.exe
  C:\Windows\System\RQAEWyp.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\NBFhKdc.exe
  C:\Windows\System\NBFhKdc.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\qelSPOZ.exe
  C:\Windows\System\qelSPOZ.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\karLDVc.exe
  C:\Windows\System\karLDVc.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\SRYvncw.exe
  C:\Windows\System\SRYvncw.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\yZBtfHe.exe
  C:\Windows\System\yZBtfHe.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\ZDFDKxE.exe
  C:\Windows\System\ZDFDKxE.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\UFKEJTv.exe
  C:\Windows\System\UFKEJTv.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\rjvYutc.exe
  C:\Windows\System\rjvYutc.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\pxuFYOv.exe
  C:\Windows\System\pxuFYOv.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\OroZRip.exe
  C:\Windows\System\OroZRip.exe
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Windows\System\kJjUVQV.exe
  C:\Windows\System\kJjUVQV.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\pccJtZw.exe
  C:\Windows\System\pccJtZw.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\mmTpfCd.exe
  C:\Windows\System\mmTpfCd.exe
  2⤵
  - Executes dropped EXE
  PID:3384
- C:\Windows\System\vNUoQoD.exe
  C:\Windows\System\vNUoQoD.exe
  2⤵
  - Executes dropped EXE
  PID:724
- C:\Windows\System\jXGERPJ.exe
  C:\Windows\System\jXGERPJ.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\cTdpOcU.exe
  C:\Windows\System\cTdpOcU.exe
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Windows\System\ImJtWYG.exe
  C:\Windows\System\ImJtWYG.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\raesjuv.exe
  C:\Windows\System\raesjuv.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\eMlUUPi.exe
  C:\Windows\System\eMlUUPi.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\kpNHSJc.exe
  C:\Windows\System\kpNHSJc.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\eEAfOeg.exe
  C:\Windows\System\eEAfOeg.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\nNzeFtw.exe
  C:\Windows\System\nNzeFtw.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\mCahaOG.exe
  C:\Windows\System\mCahaOG.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\WVOsDmi.exe
  C:\Windows\System\WVOsDmi.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\aNcTEpj.exe
  C:\Windows\System\aNcTEpj.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\tkkxKob.exe
  C:\Windows\System\tkkxKob.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\DSsivJy.exe
  C:\Windows\System\DSsivJy.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\fynUvgO.exe
  C:\Windows\System\fynUvgO.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\ykgiqCW.exe
  C:\Windows\System\ykgiqCW.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\lhVWhYE.exe
  C:\Windows\System\lhVWhYE.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\VeJLQTz.exe
  C:\Windows\System\VeJLQTz.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\mWRcVBa.exe
  C:\Windows\System\mWRcVBa.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\efToqju.exe
  C:\Windows\System\efToqju.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\LAKdbaT.exe
  C:\Windows\System\LAKdbaT.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\KsUXPcZ.exe
  C:\Windows\System\KsUXPcZ.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\oVWhNoT.exe
  C:\Windows\System\oVWhNoT.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\lSsPGrf.exe
  C:\Windows\System\lSsPGrf.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\fqDCZkg.exe
  C:\Windows\System\fqDCZkg.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\GoAQlLa.exe
  C:\Windows\System\GoAQlLa.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\xBxUgGh.exe
  C:\Windows\System\xBxUgGh.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\iTEGwhq.exe
  C:\Windows\System\iTEGwhq.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\LGSNwsB.exe
  C:\Windows\System\LGSNwsB.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\qsaHpqh.exe
  C:\Windows\System\qsaHpqh.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\UJhPblz.exe
  C:\Windows\System\UJhPblz.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\gORDogQ.exe
  C:\Windows\System\gORDogQ.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\EBxxmyx.exe
  C:\Windows\System\EBxxmyx.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\plDSZuU.exe
  C:\Windows\System\plDSZuU.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\pdILWWt.exe
  C:\Windows\System\pdILWWt.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System\iTucavm.exe
  C:\Windows\System\iTucavm.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\OPIoQZU.exe
  C:\Windows\System\OPIoQZU.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\ZzxDVzc.exe
  C:\Windows\System\ZzxDVzc.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\ILdBpbT.exe
  C:\Windows\System\ILdBpbT.exe
  2⤵
  - Executes dropped EXE
  PID:5124
- C:\Windows\System\RJezRlJ.exe
  C:\Windows\System\RJezRlJ.exe
  2⤵
  - Executes dropped EXE
  PID:5152
- C:\Windows\System\LfdUnze.exe
  C:\Windows\System\LfdUnze.exe
  2⤵
  - Executes dropped EXE
  PID:5180
- C:\Windows\System\wTEJHZv.exe
  C:\Windows\System\wTEJHZv.exe
  2⤵
  - Executes dropped EXE
  PID:5208
- C:\Windows\System\NAftDAE.exe
  C:\Windows\System\NAftDAE.exe
  2⤵
  - Executes dropped EXE
  PID:5232
- C:\Windows\System\sNHPNEM.exe
  C:\Windows\System\sNHPNEM.exe
  2⤵
  - Executes dropped EXE
  PID:5260
- C:\Windows\System\zFzEmCO.exe
  C:\Windows\System\zFzEmCO.exe
  2⤵
  - Executes dropped EXE
  PID:5284
- C:\Windows\System\fXaiEbK.exe
  C:\Windows\System\fXaiEbK.exe
  2⤵
  - Executes dropped EXE
  PID:5332
- C:\Windows\System\yOEaVSX.exe
  C:\Windows\System\yOEaVSX.exe
  2⤵
  - Executes dropped EXE
  PID:5356
- C:\Windows\System\WgCrxiY.exe
  C:\Windows\System\WgCrxiY.exe
  2⤵
  - Executes dropped EXE
  PID:5376
- C:\Windows\System\GRgdPpu.exe
  C:\Windows\System\GRgdPpu.exe
  2⤵
  - Executes dropped EXE
  PID:5400
- C:\Windows\System\dNsJqge.exe
  C:\Windows\System\dNsJqge.exe
  2⤵
  - Executes dropped EXE
  PID:5480
- C:\Windows\System\MIOdaTw.exe
  C:\Windows\System\MIOdaTw.exe
  2⤵
  PID:5508
- C:\Windows\System\VbCgtBF.exe
  C:\Windows\System\VbCgtBF.exe
  2⤵
  PID:5540
- C:\Windows\System\rsXYxPy.exe
  C:\Windows\System\rsXYxPy.exe
  2⤵
  PID:5580
- C:\Windows\System\FDRcdiU.exe
  C:\Windows\System\FDRcdiU.exe
  2⤵
  PID:5712
- C:\Windows\System\MbJvUoE.exe
  C:\Windows\System\MbJvUoE.exe
  2⤵
  PID:5760
- C:\Windows\System\pbILnid.exe
  C:\Windows\System\pbILnid.exe
  2⤵
  PID:5792
- C:\Windows\System\sPQhOkw.exe
  C:\Windows\System\sPQhOkw.exe
  2⤵
  PID:5820
- C:\Windows\System\oiJmBTM.exe
  C:\Windows\System\oiJmBTM.exe
  2⤵
  PID:5868
- C:\Windows\System\iTpHySo.exe
  C:\Windows\System\iTpHySo.exe
  2⤵
  PID:5892
- C:\Windows\System\auMizdI.exe
  C:\Windows\System\auMizdI.exe
  2⤵
  PID:5912
- C:\Windows\System\hbVFBln.exe
  C:\Windows\System\hbVFBln.exe
  2⤵
  PID:5932
- C:\Windows\System\imKWVxx.exe
  C:\Windows\System\imKWVxx.exe
  2⤵
  PID:5964
- C:\Windows\System\UMDWjKk.exe
  C:\Windows\System\UMDWjKk.exe
  2⤵
  PID:5992
- C:\Windows\System\MHUrLAa.exe
  C:\Windows\System\MHUrLAa.exe
  2⤵
  PID:6024
- C:\Windows\System\YvVOfNW.exe
  C:\Windows\System\YvVOfNW.exe
  2⤵
  PID:6068
- C:\Windows\System\qZzqxXV.exe
  C:\Windows\System\qZzqxXV.exe
  2⤵
  PID:6100
- C:\Windows\System\VkGtRkN.exe
  C:\Windows\System\VkGtRkN.exe
  2⤵
  PID:6120
- C:\Windows\System\MDvVfGx.exe
  C:\Windows\System\MDvVfGx.exe
  2⤵
  PID:4000
- C:\Windows\System\dpBueDM.exe
  C:\Windows\System\dpBueDM.exe
  2⤵
  PID:4484
- C:\Windows\System\jsLaSLW.exe
  C:\Windows\System\jsLaSLW.exe
  2⤵
  PID:3256
- C:\Windows\System\ElfUAKJ.exe
  C:\Windows\System\ElfUAKJ.exe
  2⤵
  PID:5136
- C:\Windows\System\UrNkRtF.exe
  C:\Windows\System\UrNkRtF.exe
  2⤵
  PID:556
- C:\Windows\System\mCdAtdX.exe
  C:\Windows\System\mCdAtdX.exe
  2⤵
  PID:5240
- C:\Windows\System\oqPNuMd.exe
  C:\Windows\System\oqPNuMd.exe
  2⤵
  PID:5252
- C:\Windows\System\hTPunnF.exe
  C:\Windows\System\hTPunnF.exe
  2⤵
  PID:5280
- C:\Windows\System\DWhjTfr.exe
  C:\Windows\System\DWhjTfr.exe
  2⤵
  PID:5308
- C:\Windows\System\fBBAxKU.exe
  C:\Windows\System\fBBAxKU.exe
  2⤵
  PID:4032
- C:\Windows\System\VwaQPWB.exe
  C:\Windows\System\VwaQPWB.exe
  2⤵
  PID:1528
- C:\Windows\System\UFozQTJ.exe
  C:\Windows\System\UFozQTJ.exe
  2⤵
  PID:1128
- C:\Windows\System\fbcgNwa.exe
  C:\Windows\System\fbcgNwa.exe
  2⤵
  PID:5464
- C:\Windows\System\sAAaCcZ.exe
  C:\Windows\System\sAAaCcZ.exe
  2⤵
  PID:408
- C:\Windows\System\mqbGyAB.exe
  C:\Windows\System\mqbGyAB.exe
  2⤵
  PID:3352
- C:\Windows\System\jKlNdDn.exe
  C:\Windows\System\jKlNdDn.exe
  2⤵
  PID:5524
- C:\Windows\System\PdGkhdJ.exe
  C:\Windows\System\PdGkhdJ.exe
  2⤵
  PID:5532
- C:\Windows\System\wyeYBUC.exe
  C:\Windows\System\wyeYBUC.exe
  2⤵
  PID:5612
- C:\Windows\System\iNXcYjb.exe
  C:\Windows\System\iNXcYjb.exe
  2⤵
  PID:4016
- C:\Windows\System\YBUtIHc.exe
  C:\Windows\System\YBUtIHc.exe
  2⤵
  PID:5600
- C:\Windows\System\XwtBCTl.exe
  C:\Windows\System\XwtBCTl.exe
  2⤵
  PID:5636
- C:\Windows\System\SnZeYiM.exe
  C:\Windows\System\SnZeYiM.exe
  2⤵
  PID:5700
- C:\Windows\System\VNhztFm.exe
  C:\Windows\System\VNhztFm.exe
  2⤵
  PID:5728
- C:\Windows\System\FfnAORm.exe
  C:\Windows\System\FfnAORm.exe
  2⤵
  PID:5744
- C:\Windows\System\VHiqaTg.exe
  C:\Windows\System\VHiqaTg.exe
  2⤵
  PID:5852
- C:\Windows\System\YxooqmV.exe
  C:\Windows\System\YxooqmV.exe
  2⤵
  PID:5924
- C:\Windows\System\qatveFI.exe
  C:\Windows\System\qatveFI.exe
  2⤵
  PID:5948
- C:\Windows\System\DljGlja.exe
  C:\Windows\System\DljGlja.exe
  2⤵
  PID:5984
- C:\Windows\System\TxGLxod.exe
  C:\Windows\System\TxGLxod.exe
  2⤵
  PID:5756
- C:\Windows\System\neUjgwP.exe
  C:\Windows\System\neUjgwP.exe
  2⤵
  PID:5848
- C:\Windows\System\OZEnEWG.exe
  C:\Windows\System\OZEnEWG.exe
  2⤵
  PID:6052
- C:\Windows\System\lRqDMLI.exe
  C:\Windows\System\lRqDMLI.exe
  2⤵
  PID:6108
- C:\Windows\System\lYzFFPg.exe
  C:\Windows\System\lYzFFPg.exe
  2⤵
  PID:5196
- C:\Windows\System\ITFSIDs.exe
  C:\Windows\System\ITFSIDs.exe
  2⤵
  PID:4364
- C:\Windows\System\hmAVQje.exe
  C:\Windows\System\hmAVQje.exe
  2⤵
  PID:3012
- C:\Windows\System\maTBzDC.exe
  C:\Windows\System\maTBzDC.exe
  2⤵
  PID:3100
- C:\Windows\System\KfIEcQk.exe
  C:\Windows\System\KfIEcQk.exe
  2⤵
  PID:5572
- C:\Windows\System\amqgRJp.exe
  C:\Windows\System\amqgRJp.exe
  2⤵
  PID:5616
- C:\Windows\System\agrdrcC.exe
  C:\Windows\System\agrdrcC.exe
  2⤵
  PID:996
- C:\Windows\System\gojVVAM.exe
  C:\Windows\System\gojVVAM.exe
  2⤵
  PID:3516
- C:\Windows\System\KJsGDaq.exe
  C:\Windows\System\KJsGDaq.exe
  2⤵
  PID:3956
- C:\Windows\System\jgclorx.exe
  C:\Windows\System\jgclorx.exe
  2⤵
  PID:6116
- C:\Windows\System\tTEiRTZ.exe
  C:\Windows\System\tTEiRTZ.exe
  2⤵
  PID:1584
- C:\Windows\System\jpciDuy.exe
  C:\Windows\System\jpciDuy.exe
  2⤵
  PID:416
- C:\Windows\System\sROTeTY.exe
  C:\Windows\System\sROTeTY.exe
  2⤵
  PID:5452
- C:\Windows\System\wvchIaG.exe
  C:\Windows\System\wvchIaG.exe
  2⤵
  PID:5904
- C:\Windows\System\wkierRB.exe
  C:\Windows\System\wkierRB.exe
  2⤵
  PID:5108
- C:\Windows\System\UfAiBZz.exe
  C:\Windows\System\UfAiBZz.exe
  2⤵
  PID:6060
- C:\Windows\System\WqfAJNU.exe
  C:\Windows\System\WqfAJNU.exe
  2⤵
  PID:6056
- C:\Windows\System\nqKAvjo.exe
  C:\Windows\System\nqKAvjo.exe
  2⤵
  PID:5552
- C:\Windows\System\jzqyOlg.exe
  C:\Windows\System\jzqyOlg.exe
  2⤵
  PID:5828
- C:\Windows\System\iZXiCGW.exe
  C:\Windows\System\iZXiCGW.exe
  2⤵
  PID:6148
- C:\Windows\System\WISRjXJ.exe
  C:\Windows\System\WISRjXJ.exe
  2⤵
  PID:6180
- C:\Windows\System\xiCbmRU.exe
  C:\Windows\System\xiCbmRU.exe
  2⤵
  PID:6216
- C:\Windows\System\nsNOiSI.exe
  C:\Windows\System\nsNOiSI.exe
  2⤵
  PID:6236
- C:\Windows\System\eXCRZEt.exe
  C:\Windows\System\eXCRZEt.exe
  2⤵
  PID:6264
- C:\Windows\System\WArVEvj.exe
  C:\Windows\System\WArVEvj.exe
  2⤵
  PID:6284
- C:\Windows\System\vJHzRbj.exe
  C:\Windows\System\vJHzRbj.exe
  2⤵
  PID:6300
- C:\Windows\System\apUkkjE.exe
  C:\Windows\System\apUkkjE.exe
  2⤵
  PID:6340
- C:\Windows\System\jEomKaP.exe
  C:\Windows\System\jEomKaP.exe
  2⤵
  PID:6416
- C:\Windows\System\UnFKObu.exe
  C:\Windows\System\UnFKObu.exe
  2⤵
  PID:6432
- C:\Windows\System\uUpvxTm.exe
  C:\Windows\System\uUpvxTm.exe
  2⤵
  PID:6472
- C:\Windows\System\FoISSWV.exe
  C:\Windows\System\FoISSWV.exe
  2⤵
  PID:6496
- C:\Windows\System\sUsZPae.exe
  C:\Windows\System\sUsZPae.exe
  2⤵
  PID:6516
- C:\Windows\System\blKzjbb.exe
  C:\Windows\System\blKzjbb.exe
  2⤵
  PID:6536
- C:\Windows\System\HhkFWik.exe
  C:\Windows\System\HhkFWik.exe
  2⤵
  PID:6556
- C:\Windows\System\ObXkNnS.exe
  C:\Windows\System\ObXkNnS.exe
  2⤵
  PID:6576
- C:\Windows\System\MWWXRll.exe
  C:\Windows\System\MWWXRll.exe
  2⤵
  PID:6608
- C:\Windows\System\vNNlvYr.exe
  C:\Windows\System\vNNlvYr.exe
  2⤵
  PID:6656
- C:\Windows\System\ZrdGZSm.exe
  C:\Windows\System\ZrdGZSm.exe
  2⤵
  PID:6672
- C:\Windows\System\WUhyyRE.exe
  C:\Windows\System\WUhyyRE.exe
  2⤵
  PID:6696
- C:\Windows\System\QcaRzVa.exe
  C:\Windows\System\QcaRzVa.exe
  2⤵
  PID:6740
- C:\Windows\System\vJDEIMa.exe
  C:\Windows\System\vJDEIMa.exe
  2⤵
  PID:6764
- C:\Windows\System\aCewnio.exe
  C:\Windows\System\aCewnio.exe
  2⤵
  PID:6784
- C:\Windows\System\MOHGiQA.exe
  C:\Windows\System\MOHGiQA.exe
  2⤵
  PID:6804
- C:\Windows\System\uVbsOlu.exe
  C:\Windows\System\uVbsOlu.exe
  2⤵
  PID:6828
- C:\Windows\System\KRzygLK.exe
  C:\Windows\System\KRzygLK.exe
  2⤵
  PID:6844
- C:\Windows\System\FOhePOA.exe
  C:\Windows\System\FOhePOA.exe
  2⤵
  PID:6864
- C:\Windows\System\bPJayNy.exe
  C:\Windows\System\bPJayNy.exe
  2⤵
  PID:6888
- C:\Windows\System\KUnKYic.exe
  C:\Windows\System\KUnKYic.exe
  2⤵
  PID:6916
- C:\Windows\System\HoRNeSg.exe
  C:\Windows\System\HoRNeSg.exe
  2⤵
  PID:6936
- C:\Windows\System\ZNHdIyE.exe
  C:\Windows\System\ZNHdIyE.exe
  2⤵
  PID:6956
- C:\Windows\System\TZRlSWi.exe
  C:\Windows\System\TZRlSWi.exe
  2⤵
  PID:6976
- C:\Windows\System\YjOvhaQ.exe
  C:\Windows\System\YjOvhaQ.exe
  2⤵
  PID:7008
- C:\Windows\System\KYwHSwv.exe
  C:\Windows\System\KYwHSwv.exe
  2⤵
  PID:7024
- C:\Windows\System\kTPapFE.exe
  C:\Windows\System\kTPapFE.exe
  2⤵
  PID:7044
- C:\Windows\System\cgTIHKp.exe
  C:\Windows\System\cgTIHKp.exe
  2⤵
  PID:7064
- C:\Windows\System\qjLBjdX.exe
  C:\Windows\System\qjLBjdX.exe
  2⤵
  PID:7088
- C:\Windows\System\nsZEdRU.exe
  C:\Windows\System\nsZEdRU.exe
  2⤵
  PID:7108
- C:\Windows\System\EdrZWEe.exe
  C:\Windows\System\EdrZWEe.exe
  2⤵
  PID:7132
- C:\Windows\System\ugSDPGt.exe
  C:\Windows\System\ugSDPGt.exe
  2⤵
  PID:7148
- C:\Windows\System\VaFDZpF.exe
  C:\Windows\System\VaFDZpF.exe
  2⤵
  PID:5592
- C:\Windows\System\HvWjxuy.exe
  C:\Windows\System\HvWjxuy.exe
  2⤵
  PID:3260
- C:\Windows\System\VLFAeLB.exe
  C:\Windows\System\VLFAeLB.exe
  2⤵
  PID:6312
- C:\Windows\System\PWueQFe.exe
  C:\Windows\System\PWueQFe.exe
  2⤵
  PID:6244
- C:\Windows\System\KNyzqZg.exe
  C:\Windows\System\KNyzqZg.exe
  2⤵
  PID:6336
- C:\Windows\System\kbpgByd.exe
  C:\Windows\System\kbpgByd.exe
  2⤵
  PID:6376
- C:\Windows\System\ivCnlkj.exe
  C:\Windows\System\ivCnlkj.exe
  2⤵
  PID:6428
- C:\Windows\System\PhxgSvh.exe
  C:\Windows\System\PhxgSvh.exe
  2⤵
  PID:6528
- C:\Windows\System\IOrziCX.exe
  C:\Windows\System\IOrziCX.exe
  2⤵
  PID:6548
- C:\Windows\System\UFJtKNV.exe
  C:\Windows\System\UFJtKNV.exe
  2⤵
  PID:6572
- C:\Windows\System\zICkLBd.exe
  C:\Windows\System\zICkLBd.exe
  2⤵
  PID:6664
- C:\Windows\System\UigcsjD.exe
  C:\Windows\System\UigcsjD.exe
  2⤵
  PID:6668
- C:\Windows\System\BeKVSkk.exe
  C:\Windows\System\BeKVSkk.exe
  2⤵
  PID:6824
- C:\Windows\System\xyLCmyq.exe
  C:\Windows\System\xyLCmyq.exe
  2⤵
  PID:6796
- C:\Windows\System\ToCREHC.exe
  C:\Windows\System\ToCREHC.exe
  2⤵
  PID:6948
- C:\Windows\System\NqziWoU.exe
  C:\Windows\System\NqziWoU.exe
  2⤵
  PID:6840
- C:\Windows\System\FydBOyq.exe
  C:\Windows\System\FydBOyq.exe
  2⤵
  PID:6928
- C:\Windows\System\ABMLHJE.exe
  C:\Windows\System\ABMLHJE.exe
  2⤵
  PID:7072
- C:\Windows\System\gYbKtwK.exe
  C:\Windows\System\gYbKtwK.exe
  2⤵
  PID:6984
- C:\Windows\System\fnhKusY.exe
  C:\Windows\System\fnhKusY.exe
  2⤵
  PID:6172
- C:\Windows\System\SlzQwFX.exe
  C:\Windows\System\SlzQwFX.exe
  2⤵
  PID:6280
- C:\Windows\System\qGUrqEp.exe
  C:\Windows\System\qGUrqEp.exe
  2⤵
  PID:7120
- C:\Windows\System\cmCuome.exe
  C:\Windows\System\cmCuome.exe
  2⤵
  PID:6512
- C:\Windows\System\MWBjXud.exe
  C:\Windows\System\MWBjXud.exe
  2⤵
  PID:6616
- C:\Windows\System\flVPFAb.exe
  C:\Windows\System\flVPFAb.exe
  2⤵
  PID:6752
- C:\Windows\System\kJHvqUG.exe
  C:\Windows\System\kJHvqUG.exe
  2⤵
  PID:6276
- C:\Windows\System\LfnWKrl.exe
  C:\Windows\System\LfnWKrl.exe
  2⤵
  PID:7184
- C:\Windows\System\mXNkpFa.exe
  C:\Windows\System\mXNkpFa.exe
  2⤵
  PID:7208
- C:\Windows\System\kFhLxvb.exe
  C:\Windows\System\kFhLxvb.exe
  2⤵
  PID:7228
- C:\Windows\System\mvCyiUN.exe
  C:\Windows\System\mvCyiUN.exe
  2⤵
  PID:7248
- C:\Windows\System\hHSXgcG.exe
  C:\Windows\System\hHSXgcG.exe
  2⤵
  PID:7264
- C:\Windows\System\bEsDnyZ.exe
  C:\Windows\System\bEsDnyZ.exe
  2⤵
  PID:7280
- C:\Windows\System\pGIgidg.exe
  C:\Windows\System\pGIgidg.exe
  2⤵
  PID:7304
- C:\Windows\System\ZvsgEXE.exe
  C:\Windows\System\ZvsgEXE.exe
  2⤵
  PID:7328
- C:\Windows\System\HMjlDKn.exe
  C:\Windows\System\HMjlDKn.exe
  2⤵
  PID:7344
- C:\Windows\System\HMScBhy.exe
  C:\Windows\System\HMScBhy.exe
  2⤵
  PID:7368
- C:\Windows\System\cnuJFxh.exe
  C:\Windows\System\cnuJFxh.exe
  2⤵
  PID:7392
- C:\Windows\System\NtKXMcH.exe
  C:\Windows\System\NtKXMcH.exe
  2⤵
  PID:7408
- C:\Windows\System\UqAvgtW.exe
  C:\Windows\System\UqAvgtW.exe
  2⤵
  PID:7432
- C:\Windows\System\LlabDwg.exe
  C:\Windows\System\LlabDwg.exe
  2⤵
  PID:7452
- C:\Windows\System\zkidbck.exe
  C:\Windows\System\zkidbck.exe
  2⤵
  PID:7472
- C:\Windows\System\ceLOBdK.exe
  C:\Windows\System\ceLOBdK.exe
  2⤵
  PID:7492
- C:\Windows\System\jixBMsW.exe
  C:\Windows\System\jixBMsW.exe
  2⤵
  PID:7512
- C:\Windows\System\EWrmdph.exe
  C:\Windows\System\EWrmdph.exe
  2⤵
  PID:7532
- C:\Windows\System\GosHqlr.exe
  C:\Windows\System\GosHqlr.exe
  2⤵
  PID:7556
- C:\Windows\System\jgeMCcj.exe
  C:\Windows\System\jgeMCcj.exe
  2⤵
  PID:7572
- C:\Windows\System\UtYnWen.exe
  C:\Windows\System\UtYnWen.exe
  2⤵
  PID:7596
- C:\Windows\System\VbWNlPL.exe
  C:\Windows\System\VbWNlPL.exe
  2⤵
  PID:7612
- C:\Windows\System\XOaYWNC.exe
  C:\Windows\System\XOaYWNC.exe
  2⤵
  PID:7632
- C:\Windows\System\jnBdSwi.exe
  C:\Windows\System\jnBdSwi.exe
  2⤵
  PID:7648
- C:\Windows\System\UqBXgcm.exe
  C:\Windows\System\UqBXgcm.exe
  2⤵
  PID:7668
- C:\Windows\System\MpExrce.exe
  C:\Windows\System\MpExrce.exe
  2⤵
  PID:7692
- C:\Windows\System\jusDbur.exe
  C:\Windows\System\jusDbur.exe
  2⤵
  PID:7708
- C:\Windows\System\GFhNdGZ.exe
  C:\Windows\System\GFhNdGZ.exe
  2⤵
  PID:7732
- C:\Windows\System\FNhMmat.exe
  C:\Windows\System\FNhMmat.exe
  2⤵
  PID:7752
- C:\Windows\System\agmzfHi.exe
  C:\Windows\System\agmzfHi.exe
  2⤵
  PID:7776
- C:\Windows\System\jNlnbvm.exe
  C:\Windows\System\jNlnbvm.exe
  2⤵
  PID:7796
- C:\Windows\System\fQKNZfe.exe
  C:\Windows\System\fQKNZfe.exe
  2⤵
  PID:7820
- C:\Windows\System\vffCDmd.exe
  C:\Windows\System\vffCDmd.exe
  2⤵
  PID:7840
- C:\Windows\System\TbmDvuf.exe
  C:\Windows\System\TbmDvuf.exe
  2⤵
  PID:7860
- C:\Windows\System\Zbppcnd.exe
  C:\Windows\System\Zbppcnd.exe
  2⤵
  PID:7880
- C:\Windows\System\FWdpaan.exe
  C:\Windows\System\FWdpaan.exe
  2⤵
  PID:7900
- C:\Windows\System\sCqQTNz.exe
  C:\Windows\System\sCqQTNz.exe
  2⤵
  PID:7924
- C:\Windows\System\RkejMDF.exe
  C:\Windows\System\RkejMDF.exe
  2⤵
  PID:7312
- C:\Windows\System\fVReeCV.exe
  C:\Windows\System\fVReeCV.exe
  2⤵
  PID:7384
- C:\Windows\System\OgsomkA.exe
  C:\Windows\System\OgsomkA.exe
  2⤵
  PID:7104
- C:\Windows\System\IqkeAng.exe
  C:\Windows\System\IqkeAng.exe
  2⤵
  PID:6648
- C:\Windows\System\rZcbSjZ.exe
  C:\Windows\System\rZcbSjZ.exe
  2⤵
  PID:7236
- C:\Windows\System\qbNXkFQ.exe
  C:\Windows\System\qbNXkFQ.exe
  2⤵
  PID:7568
- C:\Windows\System\HzPxXQx.exe
  C:\Windows\System\HzPxXQx.exe
  2⤵
  PID:7644
- C:\Windows\System\nJchnxN.exe
  C:\Windows\System\nJchnxN.exe
  2⤵
  PID:7276
- C:\Windows\System\GvyKQdZ.exe
  C:\Windows\System\GvyKQdZ.exe
  2⤵
  PID:7744
- C:\Windows\System\hPXYToz.exe
  C:\Windows\System\hPXYToz.exe
  2⤵
  PID:8112
- C:\Windows\System\TpAfYyW.exe
  C:\Windows\System\TpAfYyW.exe
  2⤵
  PID:8028
- C:\Windows\System\eVlMouy.exe
  C:\Windows\System\eVlMouy.exe
  2⤵
  PID:8044
- C:\Windows\System\yskdEso.exe
  C:\Windows\System\yskdEso.exe
  2⤵
  PID:8084
- C:\Windows\System\zIDezKO.exe
  C:\Windows\System\zIDezKO.exe
  2⤵
  PID:7524
- C:\Windows\System\CQKpEOM.exe
  C:\Windows\System\CQKpEOM.exe
  2⤵
  PID:7624
- C:\Windows\System\fSwGOPj.exe
  C:\Windows\System\fSwGOPj.exe
  2⤵
  PID:7288
- C:\Windows\System\boquCyo.exe
  C:\Windows\System\boquCyo.exe
  2⤵
  PID:7964
- C:\Windows\System\JTiFmwe.exe
  C:\Windows\System\JTiFmwe.exe
  2⤵
  PID:4528
- C:\Windows\System\GQlLbAx.exe
  C:\Windows\System\GQlLbAx.exe
  2⤵
  PID:7564
- C:\Windows\System\tRAWpbk.exe
  C:\Windows\System\tRAWpbk.exe
  2⤵
  PID:8052
- C:\Windows\System\VEQUyTt.exe
  C:\Windows\System\VEQUyTt.exe
  2⤵
  PID:7552
- C:\Windows\System\CfSRLdM.exe
  C:\Windows\System\CfSRLdM.exe
  2⤵
  PID:8092
- C:\Windows\System\JDvsqFW.exe
  C:\Windows\System\JDvsqFW.exe
  2⤵
  PID:8212
- C:\Windows\System\AvmSKoa.exe
  C:\Windows\System\AvmSKoa.exe
  2⤵
  PID:8236
- C:\Windows\System\VtbZknf.exe
  C:\Windows\System\VtbZknf.exe
  2⤵
  PID:8252
- C:\Windows\System\EvIiWBO.exe
  C:\Windows\System\EvIiWBO.exe
  2⤵
  PID:8268
- C:\Windows\System\AoiRRPH.exe
  C:\Windows\System\AoiRRPH.exe
  2⤵
  PID:8288
- C:\Windows\System\PFGcxGe.exe
  C:\Windows\System\PFGcxGe.exe
  2⤵
  PID:8308
- C:\Windows\System\QrmAmOz.exe
  C:\Windows\System\QrmAmOz.exe
  2⤵
  PID:8324
- C:\Windows\System\AmveLrK.exe
  C:\Windows\System\AmveLrK.exe
  2⤵
  PID:8340
- C:\Windows\System\qEqpdRt.exe
  C:\Windows\System\qEqpdRt.exe
  2⤵
  PID:8368
- C:\Windows\System\PbGRwFY.exe
  C:\Windows\System\PbGRwFY.exe
  2⤵
  PID:8384
- C:\Windows\System\yHzVOOW.exe
  C:\Windows\System\yHzVOOW.exe
  2⤵
  PID:8416
- C:\Windows\System\DduYMjs.exe
  C:\Windows\System\DduYMjs.exe
  2⤵
  PID:8468
- C:\Windows\System\QJaySMO.exe
  C:\Windows\System\QJaySMO.exe
  2⤵
  PID:8488
- C:\Windows\System\wzsTYHg.exe
  C:\Windows\System\wzsTYHg.exe
  2⤵
  PID:8528
- C:\Windows\System\mNEUWLr.exe
  C:\Windows\System\mNEUWLr.exe
  2⤵
  PID:8548
- C:\Windows\System\uhSdvVf.exe
  C:\Windows\System\uhSdvVf.exe
  2⤵
  PID:8568
- C:\Windows\System\otvFzbq.exe
  C:\Windows\System\otvFzbq.exe
  2⤵
  PID:8592
- C:\Windows\System\hogOPvv.exe
  C:\Windows\System\hogOPvv.exe
  2⤵
  PID:8620
- C:\Windows\System\teQxBPy.exe
  C:\Windows\System\teQxBPy.exe
  2⤵
  PID:8636
- C:\Windows\System\aQOUyKR.exe
  C:\Windows\System\aQOUyKR.exe
  2⤵
  PID:8656
- C:\Windows\System\OuIbTvl.exe
  C:\Windows\System\OuIbTvl.exe
  2⤵
  PID:8676
- C:\Windows\System\apbHfbL.exe
  C:\Windows\System\apbHfbL.exe
  2⤵
  PID:8696
- C:\Windows\System\VtXYtwo.exe
  C:\Windows\System\VtXYtwo.exe
  2⤵
  PID:8720
- C:\Windows\System\JfFWBhU.exe
  C:\Windows\System\JfFWBhU.exe
  2⤵
  PID:8744
- C:\Windows\System\vZlmmDL.exe
  C:\Windows\System\vZlmmDL.exe
  2⤵
  PID:8764
- C:\Windows\System\dRDnKJx.exe
  C:\Windows\System\dRDnKJx.exe
  2⤵
  PID:8924
- C:\Windows\System\Arvfjcg.exe
  C:\Windows\System\Arvfjcg.exe
  2⤵
  PID:8944
- C:\Windows\System\MBFFbNh.exe
  C:\Windows\System\MBFFbNh.exe
  2⤵
  PID:8968
- C:\Windows\System\pHxvsRr.exe
  C:\Windows\System\pHxvsRr.exe
  2⤵
  PID:8988
- C:\Windows\System\IagkwIq.exe
  C:\Windows\System\IagkwIq.exe
  2⤵
  PID:9012
- C:\Windows\System\wMUiCGU.exe
  C:\Windows\System\wMUiCGU.exe
  2⤵
  PID:9032
- C:\Windows\System\eHsJpzK.exe
  C:\Windows\System\eHsJpzK.exe
  2⤵
  PID:9056
- C:\Windows\System\CvSHNZo.exe
  C:\Windows\System\CvSHNZo.exe
  2⤵
  PID:9072
- C:\Windows\System\UDAtFWp.exe
  C:\Windows\System\UDAtFWp.exe
  2⤵
  PID:9100
- C:\Windows\System\WuFMnpu.exe
  C:\Windows\System\WuFMnpu.exe
  2⤵
  PID:9120
- C:\Windows\System\SxsVrEX.exe
  C:\Windows\System\SxsVrEX.exe
  2⤵
  PID:9140
- C:\Windows\System\GvyTnel.exe
  C:\Windows\System\GvyTnel.exe
  2⤵
  PID:9168
- C:\Windows\System\XRaHgLr.exe
  C:\Windows\System\XRaHgLr.exe
  2⤵
  PID:9188
- C:\Windows\System\RMFYNlX.exe
  C:\Windows\System\RMFYNlX.exe
  2⤵
  PID:9204
- C:\Windows\System\JSraxpg.exe
  C:\Windows\System\JSraxpg.exe
  2⤵
  PID:7404
- C:\Windows\System\aVBXQGJ.exe
  C:\Windows\System\aVBXQGJ.exe
  2⤵
  PID:8208
- C:\Windows\System\fJehaAy.exe
  C:\Windows\System\fJehaAy.exe
  2⤵
  PID:8300
- C:\Windows\System\wQEMEaD.exe
  C:\Windows\System\wQEMEaD.exe
  2⤵
  PID:8380
- C:\Windows\System\NkgrphF.exe
  C:\Windows\System\NkgrphF.exe
  2⤵
  PID:8496
- C:\Windows\System\BApICoi.exe
  C:\Windows\System\BApICoi.exe
  2⤵
  PID:7204
- C:\Windows\System\UBGbVTY.exe
  C:\Windows\System\UBGbVTY.exe
  2⤵
  PID:8480
- C:\Windows\System\fouXFkD.exe
  C:\Windows\System\fouXFkD.exe
  2⤵
  PID:8608
- C:\Windows\System\XNeDhVp.exe
  C:\Windows\System\XNeDhVp.exe
  2⤵
  PID:8544
- C:\Windows\System\hsScXlj.exe
  C:\Windows\System\hsScXlj.exe
  2⤵
  PID:8772
- C:\Windows\System\jTjKIAx.exe
  C:\Windows\System\jTjKIAx.exe
  2⤵
  PID:8664
- C:\Windows\System\vnRFJQB.exe
  C:\Windows\System\vnRFJQB.exe
  2⤵
  PID:8716
- C:\Windows\System\WUPrpBd.exe
  C:\Windows\System\WUPrpBd.exe
  2⤵
  PID:8760
- C:\Windows\System\ptyAmVg.exe
  C:\Windows\System\ptyAmVg.exe
  2⤵
  PID:8828
- C:\Windows\System\CuCtNEH.exe
  C:\Windows\System\CuCtNEH.exe
  2⤵
  PID:9044
- C:\Windows\System\LMazFVP.exe
  C:\Windows\System\LMazFVP.exe
  2⤵
  PID:9132
- C:\Windows\System\PRjSndf.exe
  C:\Windows\System\PRjSndf.exe
  2⤵
  PID:9004
- C:\Windows\System\QnpKKNG.exe
  C:\Windows\System\QnpKKNG.exe
  2⤵
  PID:9028
- C:\Windows\System\CATatGd.exe
  C:\Windows\System\CATatGd.exe
  2⤵
  PID:8936
- C:\Windows\System\iOLzyhh.exe
  C:\Windows\System\iOLzyhh.exe
  2⤵
  PID:4948
- C:\Windows\System\quoIZRk.exe
  C:\Windows\System\quoIZRk.exe
  2⤵
  PID:9080
- C:\Windows\System\xCFQbkO.exe
  C:\Windows\System\xCFQbkO.exe
  2⤵
  PID:9176
- C:\Windows\System\MkwndjB.exe
  C:\Windows\System\MkwndjB.exe
  2⤵
  PID:9196
- C:\Windows\System\TaYcchg.exe
  C:\Windows\System\TaYcchg.exe
  2⤵
  PID:8868
- C:\Windows\System\vPratjV.exe
  C:\Windows\System\vPratjV.exe
  2⤵
  PID:8960
- C:\Windows\System\wZmjaGA.exe
  C:\Windows\System\wZmjaGA.exe
  2⤵
  PID:9232
- C:\Windows\System\DBDMOdt.exe
  C:\Windows\System\DBDMOdt.exe
  2⤵
  PID:9256
- C:\Windows\System\oHUWkJG.exe
  C:\Windows\System\oHUWkJG.exe
  2⤵
  PID:9276
- C:\Windows\System\lZonZOk.exe
  C:\Windows\System\lZonZOk.exe
  2⤵
  PID:9312
- C:\Windows\System\CbzDczx.exe
  C:\Windows\System\CbzDczx.exe
  2⤵
  PID:9340
- C:\Windows\System\IBobQGo.exe
  C:\Windows\System\IBobQGo.exe
  2⤵
  PID:9360
- C:\Windows\System\iZIvonr.exe
  C:\Windows\System\iZIvonr.exe
  2⤵
  PID:9376
- C:\Windows\System\RPwNWkR.exe
  C:\Windows\System\RPwNWkR.exe
  2⤵
  PID:9400
- C:\Windows\System\ZJLGfsQ.exe
  C:\Windows\System\ZJLGfsQ.exe
  2⤵
  PID:9420
- C:\Windows\System\ogqdmsE.exe
  C:\Windows\System\ogqdmsE.exe
  2⤵
  PID:9440
- C:\Windows\System\nYBzovY.exe
  C:\Windows\System\nYBzovY.exe
  2⤵
  PID:9476
- C:\Windows\System\wNUbocL.exe
  C:\Windows\System\wNUbocL.exe
  2⤵
  PID:9492
- C:\Windows\System\BjypwTg.exe
  C:\Windows\System\BjypwTg.exe
  2⤵
  PID:9520
- C:\Windows\System\ohIQdAq.exe
  C:\Windows\System\ohIQdAq.exe
  2⤵
  PID:9540
- C:\Windows\System\DPHfgDe.exe
  C:\Windows\System\DPHfgDe.exe
  2⤵
  PID:9560
- C:\Windows\System\iKFSMGb.exe
  C:\Windows\System\iKFSMGb.exe
  2⤵
  PID:9584
- C:\Windows\System\GTIGTGT.exe
  C:\Windows\System\GTIGTGT.exe
  2⤵
  PID:9600
- C:\Windows\System\VvZckMO.exe
  C:\Windows\System\VvZckMO.exe
  2⤵
  PID:9624
- C:\Windows\System\kPsMuiY.exe
  C:\Windows\System\kPsMuiY.exe
  2⤵
  PID:9640
- C:\Windows\System\lszSbzE.exe
  C:\Windows\System\lszSbzE.exe
  2⤵
  PID:9668
- C:\Windows\System\KCzAhfh.exe
  C:\Windows\System\KCzAhfh.exe
  2⤵
  PID:9688
- C:\Windows\System\XLviuvk.exe
  C:\Windows\System\XLviuvk.exe
  2⤵
  PID:9712
- C:\Windows\System\WWjEfjX.exe
  C:\Windows\System\WWjEfjX.exe
  2⤵
  PID:9732
- C:\Windows\System\udYQnmr.exe
  C:\Windows\System\udYQnmr.exe
  2⤵
  PID:9752
- C:\Windows\System\uzFpUOx.exe
  C:\Windows\System\uzFpUOx.exe
  2⤵
  PID:9768
- C:\Windows\System\mWWWwnV.exe
  C:\Windows\System\mWWWwnV.exe
  2⤵
  PID:9792
- C:\Windows\System\wSgtRZM.exe
  C:\Windows\System\wSgtRZM.exe
  2⤵
  PID:9812
- C:\Windows\System\MkxxrAC.exe
  C:\Windows\System\MkxxrAC.exe
  2⤵
  PID:9828
- C:\Windows\System\hTkiOEd.exe
  C:\Windows\System\hTkiOEd.exe
  2⤵
  PID:9848
- C:\Windows\System\SaxBIhK.exe
  C:\Windows\System\SaxBIhK.exe
  2⤵
  PID:9868
- C:\Windows\System\jxwlDgh.exe
  C:\Windows\System\jxwlDgh.exe
  2⤵
  PID:9888
- C:\Windows\System\CrKenlR.exe
  C:\Windows\System\CrKenlR.exe
  2⤵
  PID:9908
- C:\Windows\System\sZvHOgK.exe
  C:\Windows\System\sZvHOgK.exe
  2⤵
  PID:9932
- C:\Windows\System\YVrQdpn.exe
  C:\Windows\System\YVrQdpn.exe
  2⤵
  PID:9952
- C:\Windows\System\UbTKXsu.exe
  C:\Windows\System\UbTKXsu.exe
  2⤵
  PID:9972
- C:\Windows\System\ZawlBnO.exe
  C:\Windows\System\ZawlBnO.exe
  2⤵
  PID:10000
- C:\Windows\System\DuNmCWd.exe
  C:\Windows\System\DuNmCWd.exe
  2⤵
  PID:10016
- C:\Windows\System\ajrEcuO.exe
  C:\Windows\System\ajrEcuO.exe
  2⤵
  PID:10032
- C:\Windows\System\LehAIfC.exe
  C:\Windows\System\LehAIfC.exe
  2⤵
  PID:10048
- C:\Windows\System\LFbaJJQ.exe
  C:\Windows\System\LFbaJJQ.exe
  2⤵
  PID:10072
- C:\Windows\System\Lhmbdhp.exe
  C:\Windows\System\Lhmbdhp.exe
  2⤵
  PID:10092
- C:\Windows\System\OoegPjn.exe
  C:\Windows\System\OoegPjn.exe
  2⤵
  PID:10116
- C:\Windows\System\OzVYYal.exe
  C:\Windows\System\OzVYYal.exe
  2⤵
  PID:10132
- C:\Windows\System\yhBHZgH.exe
  C:\Windows\System\yhBHZgH.exe
  2⤵
  PID:10156
- C:\Windows\System\vHVxxxN.exe
  C:\Windows\System\vHVxxxN.exe
  2⤵
  PID:10180
- C:\Windows\System\zLzVKqk.exe
  C:\Windows\System\zLzVKqk.exe
  2⤵
  PID:10200
- C:\Windows\System\DFasigw.exe
  C:\Windows\System\DFasigw.exe
  2⤵
  PID:10220
- C:\Windows\System\dSKQqrD.exe
  C:\Windows\System\dSKQqrD.exe
  2⤵
  PID:2024
- C:\Windows\System\DipCsRU.exe
  C:\Windows\System\DipCsRU.exe
  2⤵
  PID:8604
- C:\Windows\System\PTqBSvk.exe
  C:\Windows\System\PTqBSvk.exe
  2⤵
  PID:8984
- C:\Windows\System\FHGcatK.exe
  C:\Windows\System\FHGcatK.exe
  2⤵
  PID:8736
- C:\Windows\System\SMNXpGS.exe
  C:\Windows\System\SMNXpGS.exe
  2⤵
  PID:9052
- C:\Windows\System\nkfNbpq.exe
  C:\Windows\System\nkfNbpq.exe
  2⤵
  PID:2228
- C:\Windows\System\zVKqKns.exe
  C:\Windows\System\zVKqKns.exe
  2⤵
  PID:9384
- C:\Windows\System\gCYArBQ.exe
  C:\Windows\System\gCYArBQ.exe
  2⤵
  PID:9416
- C:\Windows\System\xZFPEFe.exe
  C:\Windows\System\xZFPEFe.exe
  2⤵
  PID:9484
- C:\Windows\System\dEBlDWq.exe
  C:\Windows\System\dEBlDWq.exe
  2⤵
  PID:9224
- C:\Windows\System\hYLgCbb.exe
  C:\Windows\System\hYLgCbb.exe
  2⤵
  PID:9572
- C:\Windows\System\nOazSlO.exe
  C:\Windows\System\nOazSlO.exe
  2⤵
  PID:9612
- C:\Windows\System\eqCVxyI.exe
  C:\Windows\System\eqCVxyI.exe
  2⤵
  PID:9684
- C:\Windows\System\GnHFuFM.exe
  C:\Windows\System\GnHFuFM.exe
  2⤵
  PID:10040
- C:\Windows\System\VryYNww.exe
  C:\Windows\System\VryYNww.exe
  2⤵
  PID:9788
- C:\Windows\System\FhkeTSq.exe
  C:\Windows\System\FhkeTSq.exe
  2⤵
  PID:9896
- C:\Windows\System\ifOcrab.exe
  C:\Windows\System\ifOcrab.exe
  2⤵
  PID:9356
- C:\Windows\System\LgtAxaa.exe
  C:\Windows\System\LgtAxaa.exe
  2⤵
  PID:10276
- C:\Windows\System\OIodjJi.exe
  C:\Windows\System\OIodjJi.exe
  2⤵
  PID:10292
- C:\Windows\System\hbvAAZx.exe
  C:\Windows\System\hbvAAZx.exe
  2⤵
  PID:10320
- C:\Windows\System\WsxfmBR.exe
  C:\Windows\System\WsxfmBR.exe
  2⤵
  PID:10344
- C:\Windows\System\BkQWWAz.exe
  C:\Windows\System\BkQWWAz.exe
  2⤵
  PID:10364
- C:\Windows\System\HEpJebH.exe
  C:\Windows\System\HEpJebH.exe
  2⤵
  PID:10384
- C:\Windows\System\svyLIKJ.exe
  C:\Windows\System\svyLIKJ.exe
  2⤵
  PID:10404
- C:\Windows\System\orXrcKB.exe
  C:\Windows\System\orXrcKB.exe
  2⤵
  PID:10424
- C:\Windows\System\AQAaOLV.exe
  C:\Windows\System\AQAaOLV.exe
  2⤵
  PID:10444
- C:\Windows\System\dxSvpnD.exe
  C:\Windows\System\dxSvpnD.exe
  2⤵
  PID:10460
- C:\Windows\System\JYpeduq.exe
  C:\Windows\System\JYpeduq.exe
  2⤵
  PID:10480
- C:\Windows\System\hzTrtZg.exe
  C:\Windows\System\hzTrtZg.exe
  2⤵
  PID:10504
- C:\Windows\System\noxARuE.exe
  C:\Windows\System\noxARuE.exe
  2⤵
  PID:10524
- C:\Windows\System\dzuKerB.exe
  C:\Windows\System\dzuKerB.exe
  2⤵
  PID:10552
- C:\Windows\System\lejTsTc.exe
  C:\Windows\System\lejTsTc.exe
  2⤵
  PID:10580
- C:\Windows\System\szuqBoD.exe
  C:\Windows\System\szuqBoD.exe
  2⤵
  PID:10608
- C:\Windows\System\HZRkhQj.exe
  C:\Windows\System\HZRkhQj.exe
  2⤵
  PID:10636
- C:\Windows\System\JHyIjsU.exe
  C:\Windows\System\JHyIjsU.exe
  2⤵
  PID:10660
- C:\Windows\System\myzLzXb.exe
  C:\Windows\System\myzLzXb.exe
  2⤵
  PID:10680
- C:\Windows\System\TGcqafz.exe
  C:\Windows\System\TGcqafz.exe
  2⤵
  PID:10704
- C:\Windows\System\ksNSSrS.exe
  C:\Windows\System\ksNSSrS.exe
  2⤵
  PID:10724
- C:\Windows\System\OwjgMVG.exe
  C:\Windows\System\OwjgMVG.exe
  2⤵
  PID:10740
- C:\Windows\System\vTrumAg.exe
  C:\Windows\System\vTrumAg.exe
  2⤵
  PID:10756
- C:\Windows\System\ITqnVlK.exe
  C:\Windows\System\ITqnVlK.exe
  2⤵
  PID:10776
- C:\Windows\System\tOiITXX.exe
  C:\Windows\System\tOiITXX.exe
  2⤵
  PID:10800
- C:\Windows\System\DFiHMBn.exe
  C:\Windows\System\DFiHMBn.exe
  2⤵
  PID:10816
- C:\Windows\System\RgzATIq.exe
  C:\Windows\System\RgzATIq.exe
  2⤵
  PID:10832
- C:\Windows\System\MJuXzem.exe
  C:\Windows\System\MJuXzem.exe
  2⤵
  PID:10848
- C:\Windows\System\bFexHLg.exe
  C:\Windows\System\bFexHLg.exe
  2⤵
  PID:10872
- C:\Windows\System\NUJKMTr.exe
  C:\Windows\System\NUJKMTr.exe
  2⤵
  PID:10888
- C:\Windows\System\TyZCpxw.exe
  C:\Windows\System\TyZCpxw.exe
  2⤵
  PID:10912
- C:\Windows\System\QiLgFlh.exe
  C:\Windows\System\QiLgFlh.exe
  2⤵
  PID:10936
- C:\Windows\System\LBZpKtf.exe
  C:\Windows\System\LBZpKtf.exe
  2⤵
  PID:10956
- C:\Windows\System\HlmubvA.exe
  C:\Windows\System\HlmubvA.exe
  2⤵
  PID:10976
- C:\Windows\System\kXYoTAk.exe
  C:\Windows\System\kXYoTAk.exe
  2⤵
  PID:11000
- C:\Windows\System\notcsaQ.exe
  C:\Windows\System\notcsaQ.exe
  2⤵
  PID:11020
- C:\Windows\System\BXDwgYq.exe
  C:\Windows\System\BXDwgYq.exe
  2⤵
  PID:11040
- C:\Windows\System\KobkNal.exe
  C:\Windows\System\KobkNal.exe
  2⤵
  PID:11068
- C:\Windows\System\pJKdgNg.exe
  C:\Windows\System\pJKdgNg.exe
  2⤵
  PID:11084
- C:\Windows\System\PiFrFqw.exe
  C:\Windows\System\PiFrFqw.exe
  2⤵
  PID:11104
- C:\Windows\System\kWciuLo.exe
  C:\Windows\System\kWciuLo.exe
  2⤵
  PID:11128
- C:\Windows\System\FUjyVxY.exe
  C:\Windows\System\FUjyVxY.exe
  2⤵
  PID:11144
- C:\Windows\System\NxdVAPz.exe
  C:\Windows\System\NxdVAPz.exe
  2⤵
  PID:11168
- C:\Windows\System\PrugUmL.exe
  C:\Windows\System\PrugUmL.exe
  2⤵
  PID:11192
- C:\Windows\System\utDegTJ.exe
  C:\Windows\System\utDegTJ.exe
  2⤵
  PID:11212
- C:\Windows\System\GwvPeZV.exe
  C:\Windows\System\GwvPeZV.exe
  2⤵
  PID:10712
- C:\Windows\System\GHGQlAf.exe
  C:\Windows\System\GHGQlAf.exe
  2⤵
  PID:10944
- C:\Windows\System\tOFZvdd.exe
  C:\Windows\System\tOFZvdd.exe
  2⤵
  PID:11096
- C:\Windows\System\UJJhOtH.exe
  C:\Windows\System\UJJhOtH.exe
  2⤵
  PID:7700
- C:\Windows\System\TQCmlRV.exe
  C:\Windows\System\TQCmlRV.exe
  2⤵
  PID:10840
- C:\Windows\System\OHWzDek.exe
  C:\Windows\System\OHWzDek.exe
  2⤵
  PID:10452
- C:\Windows\System\mQOezhu.exe
  C:\Windows\System\mQOezhu.exe
  2⤵
  PID:11052
- C:\Windows\System\oKCDkiV.exe
  C:\Windows\System\oKCDkiV.exe
  2⤵
  PID:11152
- C:\Windows\System\CgFGKrG.exe
  C:\Windows\System\CgFGKrG.exe
  2⤵
  PID:10676
- C:\Windows\System\gMDsLAh.exe
  C:\Windows\System\gMDsLAh.exe
  2⤵
  PID:10764
- C:\Windows\System\gsjkXmZ.exe
  C:\Windows\System\gsjkXmZ.exe
  2⤵
  PID:10812
- C:\Windows\System\VFWyJnQ.exe
  C:\Windows\System\VFWyJnQ.exe
  2⤵
  PID:10908
- C:\Windows\System\UBfgBQz.exe
  C:\Windows\System\UBfgBQz.exe
  2⤵
  PID:10984
- C:\Windows\System\maZMCOg.exe
  C:\Windows\System\maZMCOg.exe
  2⤵
  PID:10088
- C:\Windows\System\WzRoCSM.exe
  C:\Windows\System\WzRoCSM.exe
  2⤵
  PID:11224
- C:\Windows\System\UvEFNTL.exe
  C:\Windows\System\UvEFNTL.exe
  2⤵
  PID:10468
- C:\Windows\System\nVENQHT.exe
  C:\Windows\System\nVENQHT.exe
  2⤵
  PID:11268
- C:\Windows\System\alVWczX.exe
  C:\Windows\System\alVWczX.exe
  2⤵
  PID:11356
- C:\Windows\System\LOFtdSd.exe
  C:\Windows\System\LOFtdSd.exe
  2⤵
  PID:11396
- C:\Windows\System\NFZLJZa.exe
  C:\Windows\System\NFZLJZa.exe
  2⤵
  PID:11480
- C:\Windows\System\FoSnSZm.exe
  C:\Windows\System\FoSnSZm.exe
  2⤵
  PID:11504
- C:\Windows\System\YvNOURM.exe
  C:\Windows\System\YvNOURM.exe
  2⤵
  PID:11524
- C:\Windows\System\WBKkMLE.exe
  C:\Windows\System\WBKkMLE.exe
  2⤵
  PID:11540
- C:\Windows\System\CRTQsia.exe
  C:\Windows\System\CRTQsia.exe
  2⤵
  PID:11564
- C:\Windows\System\MOgwgtz.exe
  C:\Windows\System\MOgwgtz.exe
  2⤵
  PID:11592
- C:\Windows\System\FyNSxRC.exe
  C:\Windows\System\FyNSxRC.exe
  2⤵
  PID:11612
- C:\Windows\System\YyBmqtR.exe
  C:\Windows\System\YyBmqtR.exe
  2⤵
  PID:11628
- C:\Windows\System\LoqYutZ.exe
  C:\Windows\System\LoqYutZ.exe
  2⤵
  PID:11652
- C:\Windows\System\VhcoywZ.exe
  C:\Windows\System\VhcoywZ.exe
  2⤵
  PID:11684
- C:\Windows\System\pcoVrRh.exe
  C:\Windows\System\pcoVrRh.exe
  2⤵
  PID:11716
- C:\Windows\System\eVeiYsU.exe
  C:\Windows\System\eVeiYsU.exe
  2⤵
  PID:11740
- C:\Windows\System\jQCPOLY.exe
  C:\Windows\System\jQCPOLY.exe
  2⤵
  PID:11772
- C:\Windows\System\PfmUuLs.exe
  C:\Windows\System\PfmUuLs.exe
  2⤵
  PID:11808
- C:\Windows\System\iPLexmM.exe
  C:\Windows\System\iPLexmM.exe
  2⤵
  PID:11828
- C:\Windows\System\ryaDdHH.exe
  C:\Windows\System\ryaDdHH.exe
  2⤵
  PID:11852
- C:\Windows\System\xhYxwoe.exe
  C:\Windows\System\xhYxwoe.exe
  2⤵
  PID:11876
- C:\Windows\System\BxkaQQV.exe
  C:\Windows\System\BxkaQQV.exe
  2⤵
  PID:11900
- C:\Windows\System\ZJAqrRz.exe
  C:\Windows\System\ZJAqrRz.exe
  2⤵
  PID:11920
- C:\Windows\System\tFXkLKE.exe
  C:\Windows\System\tFXkLKE.exe
  2⤵
  PID:11940
- C:\Windows\System\rOmsugf.exe
  C:\Windows\System\rOmsugf.exe
  2⤵
  PID:11972
- C:\Windows\System\WdVjish.exe
  C:\Windows\System\WdVjish.exe
  2⤵
  PID:11992
- C:\Windows\System\fGoqnlP.exe
  C:\Windows\System\fGoqnlP.exe
  2⤵
  PID:12008
- C:\Windows\System\QwPGvNB.exe
  C:\Windows\System\QwPGvNB.exe
  2⤵
  PID:12032
- C:\Windows\System\rKHgIAS.exe
  C:\Windows\System\rKHgIAS.exe
  2⤵
  PID:12096
- C:\Windows\System\vYSOhRI.exe
  C:\Windows\System\vYSOhRI.exe
  2⤵
  PID:12120
- C:\Windows\System\RZwLIkQ.exe
  C:\Windows\System\RZwLIkQ.exe
  2⤵
  PID:12144
- C:\Windows\System\YiQPuAl.exe
  C:\Windows\System\YiQPuAl.exe
  2⤵
  PID:12164
- C:\Windows\System\SrCPsgL.exe
  C:\Windows\System\SrCPsgL.exe
  2⤵
  PID:12188
- C:\Windows\System\KFjzXqE.exe
  C:\Windows\System\KFjzXqE.exe
  2⤵
  PID:12212
- C:\Windows\System\qBStZMG.exe
  C:\Windows\System\qBStZMG.exe
  2⤵
  PID:12232
- C:\Windows\System\XhHBute.exe
  C:\Windows\System\XhHBute.exe
  2⤵
  PID:12252
- C:\Windows\System\hmvxXCi.exe
  C:\Windows\System\hmvxXCi.exe
  2⤵
  PID:12280
- C:\Windows\System\haLJrYH.exe
  C:\Windows\System\haLJrYH.exe
  2⤵
  PID:9980
- C:\Windows\System\tXvSLNm.exe
  C:\Windows\System\tXvSLNm.exe
  2⤵
  PID:10796
- C:\Windows\System\xTicVwJ.exe
  C:\Windows\System\xTicVwJ.exe
  2⤵
  PID:10792
- C:\Windows\System\tHDzJjT.exe
  C:\Windows\System\tHDzJjT.exe
  2⤵
  PID:10228
- C:\Windows\System\TQFhYHU.exe
  C:\Windows\System\TQFhYHU.exe
  2⤵
  PID:10652
- C:\Windows\System\mlrZzxQ.exe
  C:\Windows\System\mlrZzxQ.exe
  2⤵
  PID:11384
- C:\Windows\System\QyGMxIw.exe
  C:\Windows\System\QyGMxIw.exe
  2⤵
  PID:11464
- C:\Windows\System\ZFyDWwx.exe
  C:\Windows\System\ZFyDWwx.exe
  2⤵
  PID:11512
- C:\Windows\System\jidetvz.exe
  C:\Windows\System\jidetvz.exe
  2⤵
  PID:11572
- C:\Windows\System\SezqDpz.exe
  C:\Windows\System\SezqDpz.exe
  2⤵
  PID:11420
- C:\Windows\System\fCrInjP.exe
  C:\Windows\System\fCrInjP.exe
  2⤵
  PID:11800
- C:\Windows\System\yDovzit.exe
  C:\Windows\System\yDovzit.exe
  2⤵
  PID:11604
- C:\Windows\System\MYBaqtW.exe
  C:\Windows\System\MYBaqtW.exe
  2⤵
  PID:11916
- C:\Windows\System\taCJFGh.exe
  C:\Windows\System\taCJFGh.exe
  2⤵
  PID:11964
- C:\Windows\System\XpGdzdo.exe
  C:\Windows\System\XpGdzdo.exe
  2⤵
  PID:12224
- C:\Windows\System\JdCnXjN.exe
  C:\Windows\System\JdCnXjN.exe
  2⤵
  PID:6620
- C:\Windows\System\XqylehJ.exe
  C:\Windows\System\XqylehJ.exe
  2⤵
  PID:180
- C:\Windows\System\XZpqHBq.exe
  C:\Windows\System\XZpqHBq.exe
  2⤵
  PID:12132
- C:\Windows\System\uhJPqQE.exe
  C:\Windows\System\uhJPqQE.exe
  2⤵
  PID:12208
- C:\Windows\System\qLEAJIU.exe
  C:\Windows\System\qLEAJIU.exe
  2⤵
  PID:10752
- C:\Windows\System\jyePiEV.exe
  C:\Windows\System\jyePiEV.exe
  2⤵
  PID:12156
- C:\Windows\System\YfaJNfb.exe
  C:\Windows\System\YfaJNfb.exe
  2⤵
  PID:11120
- C:\Windows\System\MqaZTox.exe
  C:\Windows\System\MqaZTox.exe
  2⤵
  PID:12276
- C:\Windows\System\eUkRRMl.exe
  C:\Windows\System\eUkRRMl.exe
  2⤵
  PID:9836
- C:\Windows\System\eGEGpAV.exe
  C:\Windows\System\eGEGpAV.exe
  2⤵
  PID:11204
- C:\Windows\System\mhuZxUe.exe
  C:\Windows\System\mhuZxUe.exe
  2⤵
  PID:11112
- C:\Windows\System\VWVRmpy.exe
  C:\Windows\System\VWVRmpy.exe
  2⤵
  PID:11536
- C:\Windows\System\EqUmEOC.exe
  C:\Windows\System\EqUmEOC.exe
  2⤵
  PID:12372
- C:\Windows\System\jlnKjff.exe
  C:\Windows\System\jlnKjff.exe
  2⤵
  PID:12628
- C:\Windows\System\bKrAfSK.exe
  C:\Windows\System\bKrAfSK.exe
  2⤵
  PID:12644
- C:\Windows\System\JvmDuzk.exe
  C:\Windows\System\JvmDuzk.exe
  2⤵
  PID:12668
- C:\Windows\System\DueYDkp.exe
  C:\Windows\System\DueYDkp.exe
  2⤵
  PID:12696
- C:\Windows\System\vtFoTsx.exe
  C:\Windows\System\vtFoTsx.exe
  2⤵
  PID:12740
- C:\Windows\System\QytwjnY.exe
  C:\Windows\System\QytwjnY.exe
  2⤵
  PID:12760
- C:\Windows\System\NCXYLtW.exe
  C:\Windows\System\NCXYLtW.exe
  2⤵
  PID:12792
- C:\Windows\System\YZAjpdq.exe
  C:\Windows\System\YZAjpdq.exe
  2⤵
  PID:12816
- C:\Windows\System\OoSbehj.exe
  C:\Windows\System\OoSbehj.exe
  2⤵
  PID:12832
- C:\Windows\System\yvNrBTR.exe
  C:\Windows\System\yvNrBTR.exe
  2⤵
  PID:12848
- C:\Windows\System\PohdXyO.exe
  C:\Windows\System\PohdXyO.exe
  2⤵
  PID:12864
- C:\Windows\System\lVVftGM.exe
  C:\Windows\System\lVVftGM.exe
  2⤵
  PID:12880
- C:\Windows\System\JNOHRNN.exe
  C:\Windows\System\JNOHRNN.exe
  2⤵
  PID:12896
- C:\Windows\System\TeOgwOo.exe
  C:\Windows\System\TeOgwOo.exe
  2⤵
  PID:12912
- C:\Windows\System\mJamprv.exe
  C:\Windows\System\mJamprv.exe
  2⤵
  PID:12932
- C:\Windows\System\oXriHAU.exe
  C:\Windows\System\oXriHAU.exe
  2⤵
  PID:12952
- C:\Windows\System\QvCzOwc.exe
  C:\Windows\System\QvCzOwc.exe
  2⤵
  PID:12980
- C:\Windows\System\LYkHxsX.exe
  C:\Windows\System\LYkHxsX.exe
  2⤵
  PID:13004
- C:\Windows\System\bdYMVYd.exe
  C:\Windows\System\bdYMVYd.exe
  2⤵
  PID:13020
- C:\Windows\System\CmfcZQQ.exe
  C:\Windows\System\CmfcZQQ.exe
  2⤵
  PID:13040
- C:\Windows\System\MzvqOKk.exe
  C:\Windows\System\MzvqOKk.exe
  2⤵
  PID:13060
- C:\Windows\System\dDtdLMr.exe
  C:\Windows\System\dDtdLMr.exe
  2⤵
  PID:13136
- C:\Windows\System\udBEtsH.exe
  C:\Windows\System\udBEtsH.exe
  2⤵
  PID:13156
- C:\Windows\System\snhJbHh.exe
  C:\Windows\System\snhJbHh.exe
  2⤵
  PID:13248
- C:\Windows\System\TsRyAjQ.exe
  C:\Windows\System\TsRyAjQ.exe
  2⤵
  PID:13296
- C:\Windows\System\nGmIVZF.exe
  C:\Windows\System\nGmIVZF.exe
  2⤵
  PID:11712
- C:\Windows\System\tnSJMlB.exe
  C:\Windows\System\tnSJMlB.exe
  2⤵
  PID:10356
- C:\Windows\System\trAaTzF.exe
  C:\Windows\System\trAaTzF.exe
  2⤵
  PID:11912
- C:\Windows\System\PkYjoJU.exe
  C:\Windows\System\PkYjoJU.exe
  2⤵
  PID:11736
- C:\Windows\System\qidOZoD.exe
  C:\Windows\System\qidOZoD.exe
  2⤵
  PID:11984
- C:\Windows\System\zdGZGIi.exe
  C:\Windows\System\zdGZGIi.exe
  2⤵
  PID:12244
- C:\Windows\System\PYxixiG.exe
  C:\Windows\System\PYxixiG.exe
  2⤵
  PID:12172
- C:\Windows\System\ZCYEeOC.exe
  C:\Windows\System\ZCYEeOC.exe
  2⤵
  PID:10868
- C:\Windows\System\gBkiGPP.exe
  C:\Windows\System\gBkiGPP.exe
  2⤵
  PID:10540
- C:\Windows\System\YyZjfbY.exe
  C:\Windows\System\YyZjfbY.exe
  2⤵
  PID:12316
- C:\Windows\System\nUSnNOw.exe
  C:\Windows\System\nUSnNOw.exe
  2⤵
  PID:12388
- C:\Windows\System\jDkPdcF.exe
  C:\Windows\System\jDkPdcF.exe
  2⤵
  PID:8232
- C:\Windows\System\QNUUeXo.exe
  C:\Windows\System\QNUUeXo.exe
  2⤵
  PID:12536
- C:\Windows\System\qjkrbFA.exe
  C:\Windows\System\qjkrbFA.exe
  2⤵
  PID:12572
- C:\Windows\System\mHGefOF.exe
  C:\Windows\System\mHGefOF.exe
  2⤵
  PID:11896
- C:\Windows\System\CDCaQtB.exe
  C:\Windows\System\CDCaQtB.exe
  2⤵
  PID:12636
- C:\Windows\System\vqRLXVz.exe
  C:\Windows\System\vqRLXVz.exe
  2⤵
  PID:1808
- C:\Windows\System\vamtITG.exe
  C:\Windows\System\vamtITG.exe
  2⤵
  PID:12776
- C:\Windows\System\VIdqrla.exe
  C:\Windows\System\VIdqrla.exe
  2⤵
  PID:12704
- C:\Windows\System\FdvTCjM.exe
  C:\Windows\System\FdvTCjM.exe
  2⤵
  PID:12752
- C:\Windows\System\wigTBoC.exe
  C:\Windows\System\wigTBoC.exe
  2⤵
  PID:12788
- C:\Windows\System\DWulxDY.exe
  C:\Windows\System\DWulxDY.exe
  2⤵
  PID:12988
- C:\Windows\System\BAXICuO.exe
  C:\Windows\System\BAXICuO.exe
  2⤵
  PID:12976
- C:\Windows\System\bHyUaSd.exe
  C:\Windows\System\bHyUaSd.exe
  2⤵
  PID:13012
- C:\Windows\System\jesdHwZ.exe
  C:\Windows\System\jesdHwZ.exe
  2⤵
  PID:12872
- C:\Windows\System\vjCCDCo.exe
  C:\Windows\System\vjCCDCo.exe
  2⤵
  PID:13240
- C:\Windows\System\WLnDxFS.exe
  C:\Windows\System\WLnDxFS.exe
  2⤵
  PID:13100
- C:\Windows\System\GRjSRtY.exe
  C:\Windows\System\GRjSRtY.exe
  2⤵
  PID:13304
- C:\Windows\System\PqLtHEc.exe
  C:\Windows\System\PqLtHEc.exe
  2⤵
  PID:1968
- C:\Windows\System\CoMbjmN.exe
  C:\Windows\System\CoMbjmN.exe
  2⤵
  PID:1764
- C:\Windows\System\uoteZfc.exe
  C:\Windows\System\uoteZfc.exe
  2⤵
  PID:12676
- C:\Windows\System\CresJSV.exe
  C:\Windows\System\CresJSV.exe
  2⤵
  PID:12708
- C:\Windows\System\VApNvBk.exe
  C:\Windows\System\VApNvBk.exe
  2⤵
  PID:1748
- C:\Windows\System\qxBuPgS.exe
  C:\Windows\System\qxBuPgS.exe
  2⤵
  PID:13436
- C:\Windows\System\pECKZxf.exe
  C:\Windows\System\pECKZxf.exe
  2⤵
  PID:13452
- C:\Windows\System\NlQlobp.exe
  C:\Windows\System\NlQlobp.exe
  2⤵
  PID:13476
- C:\Windows\System\eaHKVxb.exe
  C:\Windows\System\eaHKVxb.exe
  2⤵
  PID:13500
- C:\Windows\System\vDiZUGC.exe
  C:\Windows\System\vDiZUGC.exe
  2⤵
  PID:13520
- C:\Windows\System\wtVLnvr.exe
  C:\Windows\System\wtVLnvr.exe
  2⤵
  PID:13572
- C:\Windows\System\MeVStJf.exe
  C:\Windows\System\MeVStJf.exe
  2⤵
  PID:13624
- C:\Windows\System\KSUPuZQ.exe
  C:\Windows\System\KSUPuZQ.exe
  2⤵
  PID:13768
- C:\Windows\System\VpWEyET.exe
  C:\Windows\System\VpWEyET.exe
  2⤵
  PID:13812
- C:\Windows\System\AXghmSG.exe
  C:\Windows\System\AXghmSG.exe
  2⤵
  PID:13872
- C:\Windows\System\JsDoioM.exe
  C:\Windows\System\JsDoioM.exe
  2⤵
  PID:14024
- C:\Windows\System\nqeVEAd.exe
  C:\Windows\System\nqeVEAd.exe
  2⤵
  PID:14128
- C:\Windows\System\pEUZNvl.exe
  C:\Windows\System\pEUZNvl.exe
  2⤵
  PID:14312
- C:\Windows\System\BmdZVLa.exe
  C:\Windows\System\BmdZVLa.exe
  2⤵
  PID:8644
- C:\Windows\System\PUbUKPt.exe
  C:\Windows\System\PUbUKPt.exe
  2⤵
  PID:12892
- C:\Windows\System\nbDEZdz.exe
  C:\Windows\System\nbDEZdz.exe
  2⤵
  PID:12568
- C:\Windows\System\KcpcOPP.exe
  C:\Windows\System\KcpcOPP.exe
  2⤵
  PID:12296
- C:\Windows\System\COiedbL.exe
  C:\Windows\System\COiedbL.exe
  2⤵
  PID:11848
- C:\Windows\System\UnKUISZ.exe
  C:\Windows\System\UnKUISZ.exe
  2⤵
  PID:13820
- C:\Windows\System\lueRdKF.exe
  C:\Windows\System\lueRdKF.exe
  2⤵
  PID:13552
- C:\Windows\System\JVSXqEO.exe
  C:\Windows\System\JVSXqEO.exe
  2⤵
  PID:13580
- C:\Windows\System\pvXIGwH.exe
  C:\Windows\System\pvXIGwH.exe
  2⤵
  PID:13608
- C:\Windows\System\KkoiuSr.exe
  C:\Windows\System\KkoiuSr.exe
  2⤵
  PID:13660
- C:\Windows\System\uplzTIA.exe
  C:\Windows\System\uplzTIA.exe
  2⤵
  PID:3028
- C:\Windows\System\uMLIdmm.exe
  C:\Windows\System\uMLIdmm.exe
  2⤵
  PID:13840
- C:\Windows\System\iZgyiTF.exe
  C:\Windows\System\iZgyiTF.exe
  2⤵
  PID:14100
- C:\Windows\System\EcNblyo.exe
  C:\Windows\System\EcNblyo.exe
  2⤵
  PID:13932
- C:\Windows\System\LZoyRyv.exe
  C:\Windows\System\LZoyRyv.exe
  2⤵
  PID:13724
- C:\Windows\System\gkAByqz.exe
  C:\Windows\System\gkAByqz.exe
  2⤵
  PID:4728
- C:\Windows\System\dBVzmcK.exe
  C:\Windows\System\dBVzmcK.exe
  2⤵
  PID:6088
- C:\Windows\System\xUZMHXi.exe
  C:\Windows\System\xUZMHXi.exe
  2⤵
  PID:14056
- C:\Windows\System\jNGpmDu.exe
  C:\Windows\System\jNGpmDu.exe
  2⤵
  PID:3324
- C:\Windows\System\qEiuHZj.exe
  C:\Windows\System\qEiuHZj.exe
  2⤵
  PID:13388
- C:\Windows\System\fDmmdXQ.exe
  C:\Windows\System\fDmmdXQ.exe
  2⤵
  PID:2836
- C:\Windows\System\zaPbiMj.exe
  C:\Windows\System\zaPbiMj.exe
  2⤵
  PID:13168
- C:\Windows\System\FYJydHl.exe
  C:\Windows\System\FYJydHl.exe
  2⤵
  PID:4716
- C:\Windows\System\odfyBYb.exe
  C:\Windows\System\odfyBYb.exe
  2⤵
  PID:13104
- C:\Windows\System\GKYLqnC.exe
  C:\Windows\System\GKYLqnC.exe
  2⤵
  PID:888
- C:\Windows\System\VuWWQRO.exe
  C:\Windows\System\VuWWQRO.exe
  2⤵
  PID:3616
- C:\Windows\System\YkWEJLF.exe
  C:\Windows\System\YkWEJLF.exe
  2⤵
  PID:3572
- C:\Windows\System\wJIWvul.exe
  C:\Windows\System\wJIWvul.exe
  2⤵
  PID:732
- C:\Windows\System\ybBlLCk.exe
  C:\Windows\System\ybBlLCk.exe
  2⤵
  PID:884
- C:\Windows\System\KSxpmqU.exe
  C:\Windows\System\KSxpmqU.exe
  2⤵
  PID:12844
- C:\Windows\System\DRtoEiF.exe
  C:\Windows\System\DRtoEiF.exe
  2⤵
  PID:4540
- C:\Windows\System\wikryYJ.exe
  C:\Windows\System\wikryYJ.exe
  2⤵
  PID:3848
- C:\Windows\System\raqsgNR.exe
  C:\Windows\System\raqsgNR.exe
  2⤵
  PID:13680
- C:\Windows\System\tEDpnup.exe
  C:\Windows\System\tEDpnup.exe
  2⤵
  PID:13516
- C:\Windows\System\jjftqBN.exe
  C:\Windows\System\jjftqBN.exe
  2⤵
  PID:11500
- C:\Windows\System\YtNsjre.exe
  C:\Windows\System\YtNsjre.exe
  2⤵
  PID:3308
- C:\Windows\System\uiVgbVP.exe
  C:\Windows\System\uiVgbVP.exe
  2⤵
  PID:224
- C:\Windows\System\hhPUKgj.exe
  C:\Windows\System\hhPUKgj.exe
  2⤵
  PID:13972
- C:\Windows\System\jyVRejE.exe
  C:\Windows\System\jyVRejE.exe
  2⤵
  PID:13992
- C:\Windows\System\dBnnGlT.exe
  C:\Windows\System\dBnnGlT.exe
  2⤵
  PID:14228
- C:\Windows\System\WUHYdQs.exe
  C:\Windows\System\WUHYdQs.exe
  2⤵
  PID:10336
- C:\Windows\System\nChpOrF.exe
  C:\Windows\System\nChpOrF.exe
  2⤵
  PID:13080
- C:\Windows\System\vUIBlxX.exe
  C:\Windows\System\vUIBlxX.exe
  2⤵
  PID:13276
- C:\Windows\System\IHYovhs.exe
  C:\Windows\System\IHYovhs.exe
  2⤵
  PID:13192
- C:\Windows\System\UbLCysl.exe
  C:\Windows\System\UbLCysl.exe
  2⤵
  PID:12444
- C:\Windows\System\MFgEHCF.exe
  C:\Windows\System\MFgEHCF.exe
  2⤵
  PID:12220
- C:\Windows\System\HXmTtFQ.exe
  C:\Windows\System\HXmTtFQ.exe
  2⤵
  PID:14264
- C:\Windows\System\ENmgpHE.exe
  C:\Windows\System\ENmgpHE.exe
  2⤵
  PID:6968
- C:\Windows\System\crcyeTw.exe
  C:\Windows\System\crcyeTw.exe
  2⤵
  PID:7480
- C:\Windows\System\wykjTXL.exe
  C:\Windows\System\wykjTXL.exe
  2⤵
  PID:7316
- C:\Windows\System\YUvWnTY.exe
  C:\Windows\System\YUvWnTY.exe
  2⤵
  PID:7956
- C:\Windows\System\zOaAsbz.exe
  C:\Windows\System\zOaAsbz.exe
  2⤵
  PID:7656
- C:\Windows\System\VHwAAza.exe
  C:\Windows\System\VHwAAza.exe
  2⤵
  PID:7720
- C:\Windows\System\JFwhgvV.exe
  C:\Windows\System\JFwhgvV.exe
  2⤵
  PID:7888
- C:\Windows\System\LwzTxvE.exe
  C:\Windows\System\LwzTxvE.exe
  2⤵
  PID:7988
- C:\Windows\System\tfezrdH.exe
  C:\Windows\System\tfezrdH.exe
  2⤵
  PID:8012
- C:\Windows\System\nWreyav.exe
  C:\Windows\System\nWreyav.exe
  2⤵
  PID:8176
- C:\Windows\System\RCByBQq.exe
  C:\Windows\System\RCByBQq.exe
  2⤵
  PID:8184
- C:\Windows\System\vFEopiU.exe
  C:\Windows\System\vFEopiU.exe
  2⤵
  PID:8056
- C:\Windows\System\FklJPfF.exe
  C:\Windows\System\FklJPfF.exe
  2⤵
  PID:8072
- C:\Windows\System\XyPTFsw.exe
  C:\Windows\System\XyPTFsw.exe
  2⤵
  PID:8096
- C:\Windows\System\ycCBuMA.exe
  C:\Windows\System\ycCBuMA.exe
  2⤵
  PID:8132
- C:\Windows\System\OxYISds.exe
  C:\Windows\System\OxYISds.exe
  2⤵
  PID:7172
- C:\Windows\System\fRXQyFO.exe
  C:\Windows\System\fRXQyFO.exe
  2⤵
  PID:2056
- C:\Windows\System\oYdKOgW.exe
  C:\Windows\System\oYdKOgW.exe
  2⤵
  PID:1464
- C:\Windows\System\aUOhzLI.exe
  C:\Windows\System\aUOhzLI.exe
  2⤵
  PID:5096
- C:\Windows\System\IxFWrNl.exe
  C:\Windows\System\IxFWrNl.exe
  2⤵
  PID:13128
- C:\Windows\System\MKifvzJ.exe
  C:\Windows\System\MKifvzJ.exe
  2⤵
  PID:5144
- C:\Windows\System\jAGIGaD.exe
  C:\Windows\System\jAGIGaD.exe
  2⤵
  PID:5648
- C:\Windows\System\CEynjwt.exe
  C:\Windows\System\CEynjwt.exe
  2⤵
  PID:5408
- C:\Windows\System\cDHCkol.exe
  C:\Windows\System\cDHCkol.exe
  2⤵
  PID:5644
- C:\Windows\System\sFXChyy.exe
  C:\Windows\System\sFXChyy.exe
  2⤵
  PID:2500
- C:\Windows\System\yCrNEtY.exe
  C:\Windows\System\yCrNEtY.exe
  2⤵
  PID:5740
- C:\Windows\System\kyVhzmZ.exe
  C:\Windows\System\kyVhzmZ.exe
  2⤵
  PID:5216
- C:\Windows\System\sJjTvPF.exe
  C:\Windows\System\sJjTvPF.exe
  2⤵
  PID:5228
- C:\Windows\System\VvinTDj.exe
  C:\Windows\System\VvinTDj.exe
  2⤵
  PID:2136
- C:\Windows\System\NjVNFZu.exe
  C:\Windows\System\NjVNFZu.exe
  2⤵
  PID:5776
- C:\Windows\System\OBYXNmk.exe
  C:\Windows\System\OBYXNmk.exe
  2⤵
  PID:14092
- C:\Windows\System\DqlKwHB.exe
  C:\Windows\System\DqlKwHB.exe
  2⤵
  PID:2504
- C:\Windows\System\iRUAoUj.exe
  C:\Windows\System\iRUAoUj.exe
  2⤵
  PID:3536
- C:\Windows\System\zhvOWoS.exe
  C:\Windows\System\zhvOWoS.exe
  2⤵
  PID:14292
- C:\Windows\System\yyhDYTw.exe
  C:\Windows\System\yyhDYTw.exe
  2⤵
  PID:14036
- C:\Windows\System\PNDcAKd.exe
  C:\Windows\System\PNDcAKd.exe
  2⤵
  PID:12116
- C:\Windows\System\Lilxsiu.exe
  C:\Windows\System\Lilxsiu.exe
  2⤵
  PID:3036
- C:\Windows\System\PgBpICV.exe
  C:\Windows\System\PgBpICV.exe
  2⤵
  PID:1840
- C:\Windows\System\McwZWuS.exe
  C:\Windows\System\McwZWuS.exe
  2⤵
  PID:13696
- C:\Windows\System\dtnFgIu.exe
  C:\Windows\System\dtnFgIu.exe
  2⤵
  PID:5884
- C:\Windows\System\DjQlpVQ.exe
  C:\Windows\System\DjQlpVQ.exe
  2⤵
  PID:4888
- C:\Windows\System\VsyCHqR.exe
  C:\Windows\System\VsyCHqR.exe
  2⤵
  PID:13512
- C:\Windows\System\qAtHCoj.exe
  C:\Windows\System\qAtHCoj.exe
  2⤵
  PID:13784
- C:\Windows\System\RdmJdjl.exe
  C:\Windows\System\RdmJdjl.exe
  2⤵
  PID:1672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5472 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:14044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3ycotzma.kdn.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\DSsivJy.exe

Filesize
1.8MB

MD5
9cfc3cc89563b20d92c5dbe2974602c9

SHA1
131ffecda7ca3400f49f2b06a06a4d759ec50ef5

SHA256
2bedc43509253fd06632bc4c31364d68cb07f0d5b34097c5c82d44dc9621459b

SHA512
60d148ef48009c674558ac4aaaf24a372a583a3fcc0978a2a9c048cd0fbacbff7f65d2f563689ca7168afa7a3f48532048791afa055b02110e97d993d8ef15f8

Download Submit
C:\Windows\System\ImJtWYG.exe

Filesize
1.8MB

MD5
9ed32c5a8c61485e22263297c419313f

SHA1
dc3e297529c65ad967218d79b3c6bfc822d76953

SHA256
9ae4a82d1971fefa8d9d4903e54f439c3d68940dd8a5f0388ee8652a2f0613b6

SHA512
104a4951e95f93191f38f59d00576e13e8269744fca72ccc2dd8965b417e8aaf47949ef82a5e404444fd749fc004f2fba72b184c0f5b69169eafef358efe6847

Download Submit
C:\Windows\System\NBFhKdc.exe

Filesize
1.8MB

MD5
a98b67e979b41b3e8a330f303a25b3f3

SHA1
326b46e88fc846f73ea7c1e512de873957aa6538

SHA256
48aca97b9728cc929bd3e2b1c87545330131c3fe48987aae5ca9d3be877530bc

SHA512
5351f7f0d5af538bd9d010e69819265ece01969a679dac498f962ef5f67f2357bcc15309a5e1bed649fce060d083e3158868e04d821db9d3776a4b3665641393

Download Submit
C:\Windows\System\OroZRip.exe

Filesize
1.8MB

MD5
ed41e08c021b619384abfe024105de46

SHA1
4bdeaf82543c7639941e899c4c95194a5c85ee4d

SHA256
468f471abd43913dcf91f5f942e15a38cbcc5bf99c5468bcb5941a57a1e66873

SHA512
085be37d9cde3a2d499e28e0e6564a390495b851404b8b05a280017c351a2730b399c61667aac2cb6742ed26ce0d7e15028e2c4cf03787fa143e3a053cc66958

Download Submit
C:\Windows\System\RQAEWyp.exe

Filesize
1.8MB

MD5
69c60bf78ff345c7cd25de0b57ac5eee

SHA1
b687b0a51fdc5ec8e88ecc9a2d200ab1e31d81e2

SHA256
eebbdf145a07ebab1c091b6cefb49645860d07ca06c17b35672a69dd48cbbd78

SHA512
52023b24a4456784426b95b98e48dd4c9928da7d0422f875c478d4e9c6f94230ab6d762bb69d17117d8a8a2d1bc08354871f7d0b938f779c13360c731348baca

Download Submit
C:\Windows\System\SRYvncw.exe

Filesize
1.8MB

MD5
f46a984f762725bc57327e4648c2c39c

SHA1
c6900587c2de9594fe2cb6cf6dd097f4e0c32201

SHA256
eb0a322c73f88739f6e8424cabadb28fc477a4bd31d0b1d455744681d41b2248

SHA512
5fa74bb4fe2a03f5e674447c8cec62067ca86a8e6ca6c6fbd9fabf6ea72f8040ed2d00e5c0f3f0e28df16211fef809a8c5b84702489fd77bf29b8d8aab679c73

Download Submit
C:\Windows\System\UFKEJTv.exe

Filesize
1.8MB

MD5
f999c7ff7280281aba0e8cf05ff6b120

SHA1
1e6a773f952631b94d48aefc5ce80c2dbeb2328d

SHA256
e11e271b7a7de4a5adeb44ddba901decd7750f93286bbea58db33e8f18398fee

SHA512
0f78426a5f030953f10d107477812e92b991f92eab6612ba767887393b7e389a2d00ebc58c13c5ad40ae473a5edf7bdef585e2d42b0dc82866100c1dfc6366be

Download Submit
C:\Windows\System\VeJLQTz.exe

Filesize
1.8MB

MD5
663de32071c53a834904b56968cd546e

SHA1
b3ec47490cb185989cac675731ef0f330c671902

SHA256
7fb9420213c56a15c967b69ea9bea15ced132bd22db8d06323caa6b7a4865233

SHA512
931b09e2971d8ce598c340e2063b3e6753423e02b5f1d7a73d9dc6c3788df88004934b3e710d4de12d207bcad78d91a1990c0d3640d3fa709e9d11dac3caee81

Download Submit
C:\Windows\System\WVOsDmi.exe

Filesize
1.8MB

MD5
a84e74c3b6aba9a4bdbd2ce84c591922

SHA1
293f397cc62a46a9104116d3081c595ccdb38f32

SHA256
7b87aeeffc08f3eaeaff051615e9784953de28131ba3589589026388a91a1cfa

SHA512
e73807d561a7c52e9eaaefc733cbb6852d28d9934f527734667053d8f19bc2e450e0414eafb1d8e7df0c3f9db7846aa15e9f8fc66facaa1bbad7df1188f79c57

Download Submit
C:\Windows\System\ZDFDKxE.exe

Filesize
1.8MB

MD5
d30193c7a4e2c8a942466ecd71f18521

SHA1
753bb49c7d276977a3b8c6549290e86577da537e

SHA256
b5cc5a87323546e14de42158b735ecad7f0a1567718479eb4f159d2aa2cc7f4d

SHA512
4614e418c8722a5fcdba618e716b446ea5aa77c12a949e0990cb41d29d79ab776b66767c52ab8bf13e7e9e81e12632c6e623ac9c6a67ba043f51a0e20c7ab540

Download Submit
C:\Windows\System\aNcTEpj.exe

Filesize
1.8MB

MD5
85ba9d0fb13044310d1c287fa2c52e40

SHA1
4091fb7d2143b333e296e02a5ef6b494225c103b

SHA256
d1aa7f2a85496b7f30383a7baf6809e9db98cbf3b7dc8ecc3d86537d4ae0f516

SHA512
ed9abdad50461a2597ae945920fe2b9029d29bd090ce08f553e12efced8a4a053b9d0d55c9e07f38e18f6153236713f2cdf0a3e104d5e5fa87b93ae85597f321

Download Submit
C:\Windows\System\cTdpOcU.exe

Filesize
1.8MB

MD5
6c4aeeb2080d7c0e5526996362522c90

SHA1
b71e35138e2c9746d96783da8bffb78536ae2025

SHA256
332f557bf21918efd2ee439850783491bddfdddf6ab37c39191015e6324d4e70

SHA512
a8835efbd24fbe81861b7f65c02267b4ebcb66347fb37ca0138dadc2a42c1923941c21a32db6be07a2bf4d6bf41badeeb6e43c911c2f76e8105b56b9f5599f30

Download Submit
C:\Windows\System\eEAfOeg.exe

Filesize
1.8MB

MD5
c3b0a73388ad9f57eb1e389a68f7ec9e

SHA1
9a2fa4d253cc88097bc09913670a9e691d2d6ebe

SHA256
edeabfe35cd20d911c854b48c9dc5c822edf0c1d2b9c856d4279a44d297d4f79

SHA512
67bb7bcda8e23de1756982996e2eae49b8f44b0953617314ee21e719a8e95196286c17f0ad1cd9c3f0a1ed47b97c7cbfc0369231a779b20e4b4525ede599e437

Download Submit
C:\Windows\System\eMlUUPi.exe

Filesize
1.8MB

MD5
6645ef327cec5b5ee25156b7f43fff77

SHA1
6d65a8deabd1f5dd7d8ec6333a77db1f13ffb403

SHA256
de3c196b59bd88bb3e58a04b122f0217e916058a2752de73d993a9de8e786184

SHA512
947c9f3fe8daec925e9ad15a14f316b5fac487476b2bd81149f3aed146f69cb9de5de00a8bb909b1a5592e726ab3f8b982c9ce0b22e7fd403860226f40199ad1

Download Submit
C:\Windows\System\fynUvgO.exe

Filesize
1.8MB

MD5
12924ba8082f2f5de13930dd79baab77

SHA1
b67650e96356952352b522ae28c618e714af7155

SHA256
21e5e079e0e1fcc54aa215628637aa34d54ca007cc7d3791ab077a02a4262fb4

SHA512
f00b6d6236ff6887148275dcb573897e2deb30bff74b310baa50729746c49e23af15ed21d05b3c06fc3046ebba189b5c3faa97b8822f2b88ea0a02cf248bb75e

Download Submit
C:\Windows\System\jXGERPJ.exe

Filesize
1.8MB

MD5
e740ce4e180b95da905c21d840d5fdf1

SHA1
6373611c22437fe955d0c1ab31dd9de04104386f

SHA256
e3666a79a92762fc2a8372aac2724777165b1a0d2d012629dde330c44c3441a8

SHA512
c9048d5a5889d053cd5a68d1c7c1f3c5342b38ad96d086b259461b4d9f883ff55933662350de4b7c9a3df43be4a1a99451e727f118d6455cb988f553bbd077f5

Download Submit
C:\Windows\System\kJjUVQV.exe

Filesize
1.8MB

MD5
f14305436d8731b8f5edbc46ad2d3b47

SHA1
5d3fffd375dba50f87ef8167b36a5461fe1874a9

SHA256
2043f5ca19b67900f60ab42949aa01cab5e9f927391722db583724aa93112d6c

SHA512
f6e5677e024b9fdb9e362e2d5221cfae71b96fdda8227e69d66ef72d24a25874ce0428360f7c2361ed3ee208d5cc490abb62d099f47ee789f96f40fc6f00b22a

Download Submit
C:\Windows\System\karLDVc.exe

Filesize
1.8MB

MD5
f9890c8bfe1dd114516eefacca9f6827

SHA1
9e7c51d630cd2255e31b4f978d55fb141106e765

SHA256
651c5cd01abf9539aa45e3d4188c0a49fe80202a3ed68902686ffd6b40655369

SHA512
04736ee0481620403d7167efa68e3461b5e7acf2bafc1b3abe2acdd2369e64d772d83f7c44a7ad32432c7b89b11597ff8099f87cceccc9cb0979d6a0954693f1

Download Submit
C:\Windows\System\kpNHSJc.exe

Filesize
1.8MB

MD5
5daabe5a7c27cf554db942037878fead

SHA1
153390cf8800ca2e2f3b1fa59154d1cf6dc44d5f

SHA256
6751f0c4811a2c7418a26f3204cb0581595bea17d8bdde08b5b38cc294f8e7f6

SHA512
5f5d4f856d55cbee9351b74ff4273ea0ebf577764311a41bf7205d74a8f81e60dfea410e5b519f1407a60854937db19c5ad8af9003d9f9f9a223e92fdeecc5fd

Download Submit
C:\Windows\System\lhVWhYE.exe

Filesize
1.8MB

MD5
d539c0917ea6d309438f5f5a75b654da

SHA1
e11c9b38b089003e3f67650f81ccb189d28ae137

SHA256
6af1fd4ed6d2d7a7f8f61282e7e3befef3abf5921b3e8801d0b3602921bd45f9

SHA512
1c4d40ff8b81b9513f9a61237cfc8345dc8873dec731cdc506d3e3bb29a2b279bdf8dff6c9678b578a9ae8dd39ebc697fcab3ee0895e5057e46404814081a80b

Download Submit
C:\Windows\System\mCahaOG.exe

Filesize
1.8MB

MD5
307fbedfdf0a17078348026f9743c1a3

SHA1
f8c42b96a1df0be061b08a778adf0b1ed0b22c4d

SHA256
ff97a33294b5fcfbe9ca0deb0dbc30d7384a88649634de9c48133d484096cbbe

SHA512
26d4ea914be7a9be9e6d6a54d8e7860d8766b7b060a62bb1fb920532f2ea71c7f83f6a93db7b801ff4134201054800abfe4d483fea2ca6e1e9e26abf9a56526d

Download Submit
C:\Windows\System\mmTpfCd.exe

Filesize
1.8MB

MD5
252772133e45e615d6e447dfe2c9f497

SHA1
53c096c780dbaf744a3a58a03768053543c8c47a

SHA256
fc9b18dfe47d9ac0bd909590c9360a23c17b44ca592fae2417945ecc5d054040

SHA512
f74c919c1632a277708774581c54b11357a66cc22a9be6d184e17a88a672d94473884fec062cd68f88da83c681353c2a7d398e2ff71fc06f16719da02f8ffcad

Download Submit
C:\Windows\System\nNzeFtw.exe

Filesize
1.8MB

MD5
e1803e1d2578951199012cdc7f4c6525

SHA1
f22071e32e3e2ba92edfc6854a82b10dd2e122a7

SHA256
9fcf3ccd71acb8773f24125a5bcd3e259148880445a6e4c7a300e422f8dae39b

SHA512
a23350b487c94f471999bc022233c65d7c926a22f609bf034455545069c71467e185fdbb5a2c2753663096e7f2d56fcc6fcd51e5c9825bd4e1dc8adbc4b905c9

Download Submit
C:\Windows\System\pccJtZw.exe

Filesize
1.8MB

MD5
6ef459963ae7a0f662e25485d54befd4

SHA1
3eb3c41fbd4568d692b38215da539d58d1b4f95e

SHA256
f0c52ab62b85337008d78379cde9e2d477d0904c350d58c4db6d8d86f55c002c

SHA512
c0203c29ff010e8999481a0621af986a6889e38b9d39e5b94b7cf13b573f0eb1cf5415810cb4d9608aadad2f2a5d3ef291564c85074aee2ac33b1afccd96b01f

Download Submit
C:\Windows\System\pxuFYOv.exe

Filesize
1.8MB

MD5
925863aa9c403ff9068b1d91521e8425

SHA1
85b38102d2e611ec88ef90929ad5e976b824aa66

SHA256
2b12aa2ab1226a2ea1ce2ded06e99e0193e7c19dd9b6d82f7393016132d34492

SHA512
a7f20d851b6165fb211b775646e781fb1efab3543e71e0cb584ca7c8d0251a00ae763f52cca848df1bebf14158f438c6f6b9b7f90993f7a1def713c4812cf9c5

Download Submit
C:\Windows\System\qelSPOZ.exe

Filesize
1.8MB

MD5
6cecc077233ba8d38b41f7120943a8ff

SHA1
843387fe0611121ffeba9c993636e7a042be93d6

SHA256
180e942346ab378635766ab49a9e336cc2529a5b9ba8b06955231698ed8d3607

SHA512
f0136d4c2d2600ee9b7f1666e25780ffdc875569f63a6fd38110cb532150c9d58f45309ede860ff6798dafe301a0821fee742679bd23023c8bfd5af92a745217

Download Submit
C:\Windows\System\raesjuv.exe

Filesize
1.8MB

MD5
ff9c56a4bd1faaec5739cbdb71e5dd7a

SHA1
b1a654f3523b52a7cbbd860fff8c1f6b2aa07a92

SHA256
d7dfeb5e25b3035276e59a7fab3ad0732bd2b96930ec4eae0f92644157687f8f

SHA512
1fab0d54e7f7f144ce4ef6e11a7d3c5be000cedfd114578088d29e2a404609f1abf4e5625a7213e9e9704a16820b5d5a709a11775015f904f48e631af9fd7048

Download Submit
C:\Windows\System\rjvYutc.exe

Filesize
1.8MB

MD5
b14a7aeb3cf85692598c83387e59dfe1

SHA1
66b890ff4d931a1074f95cd4b01fe88ceeac091a

SHA256
eba332322548c6e58687091959b5ca64cc018eec252c370622d860fd2278c824

SHA512
45f36435eeb3448718d467d743d65b249b13d2171d936a2dd1b07a40cd93fd448e7ad5291b0e180b5631c5fe83c081465097b8845cf8f3b0794075a440ec775e

Download Submit
C:\Windows\System\tkkxKob.exe

Filesize
1.8MB

MD5
a903b5aae1cfb6f57657321f07a7bb66

SHA1
69556024101c8068aa1405fdb2979a210d9e8ec1

SHA256
4441e3f5ef6c96a6198893df5960c6cbb9651f96e9ffdd4308d86c2814e06cf1

SHA512
a5014ba5fcf60af982f33e7d91888e1e65e1215ac630894fb00e8e626409610d163f6204aabb419f662dc9977306c37ee7060344f03b0109f1bf03014ed7244a

Download Submit
C:\Windows\System\vNUoQoD.exe

Filesize
1.8MB

MD5
ca70e25ea99804e97bae6d6a47ecb750

SHA1
f32a1735389ea1afe2b6a9e1a2690e3fda334342

SHA256
543683098881a1a7fa52e8e0d4f01013a2e2a83f72b14bfe3de3b03547bcfe14

SHA512
5c89e3b6a04f0f12ddb1b812edb6e112ec39c58af2e73a1adb7cf96d0d5b568da7d83f6fd9d852d9330606e9d3008c1df43fb89fe0325b47ee4b6c82db1f841f

Download Submit
C:\Windows\System\yZBtfHe.exe

Filesize
1.8MB

MD5
8dbb48f11b13ac8e30bfca7f1bf67761

SHA1
163777b63b551f1031a5c1b30afc87f7d3f6224c

SHA256
fbd04643dc105465bfa2f017bb5d8c10860dd46ec59a7f14f20b95bd5c2d1dea

SHA512
e140b211de21f321e56504b2a0fc85a1f67e717293b79be2efc168baa4219a39e6c2e1924dbf3301bcf4c60ffa5ecbda0d7a288e6be9c5c323af74736a8a6219

Download Submit
C:\Windows\System\ykgiqCW.exe

Filesize
1.8MB

MD5
a1d4bdb3756162bc280a5bbc2d2041fb

SHA1
8b6e9c6674cd1b2207be1b0467a2f2e488bba404

SHA256
2d508e033138993384f95bafcdfa5fdcc4671df1fe1fd6fa40c4431a92322c14

SHA512
edadccfc5cdb43b54eedab5b0f382e5838fba7daef39136b37d127b65126902a7da6a3ca28cd3d740063759598331238f93b4e8e9bbb803ea3936432033e2ff2

Download Submit
memory/724-323-0x00007FF61BA30000-0x00007FF61BE22000-memory.dmp

Filesize
3.9MB

Download
memory/724-1876-0x00007FF61BA30000-0x00007FF61BE22000-memory.dmp

Filesize
3.9MB

Download
memory/968-58-0x00007FF6569B0000-0x00007FF656DA2000-memory.dmp

Filesize
3.9MB

Download
memory/968-1761-0x00007FF6569B0000-0x00007FF656DA2000-memory.dmp

Filesize
3.9MB

Download
memory/1132-1709-0x00007FF73C240000-0x00007FF73C632000-memory.dmp

Filesize
3.9MB

Download
memory/1132-48-0x00007FF73C240000-0x00007FF73C632000-memory.dmp

Filesize
3.9MB

Download
memory/1276-335-0x00007FF7840C0000-0x00007FF7844B2000-memory.dmp

Filesize
3.9MB

Download
memory/1276-2104-0x00007FF7840C0000-0x00007FF7844B2000-memory.dmp

Filesize
3.9MB

Download
memory/1568-1723-0x00007FF7BC4D0000-0x00007FF7BC8C2000-memory.dmp

Filesize
3.9MB

Download
memory/1568-71-0x00007FF7BC4D0000-0x00007FF7BC8C2000-memory.dmp

Filesize
3.9MB

Download
memory/1620-279-0x00007FF6C6C50000-0x00007FF6C7042000-memory.dmp

Filesize
3.9MB

Download
memory/1620-0-0x00007FF6C6C50000-0x00007FF6C7042000-memory.dmp

Filesize
3.9MB

Download
memory/1620-1-0x000001DEB9EA0000-0x000001DEB9EB0000-memory.dmp

Filesize
64KB

Download
memory/1708-86-0x00007FF7B6960000-0x00007FF7B6D52000-memory.dmp

Filesize
3.9MB

Download
memory/1708-1867-0x00007FF7B6960000-0x00007FF7B6D52000-memory.dmp

Filesize
3.9MB

Download
memory/1964-72-0x000002569E7B0000-0x000002569E7C0000-memory.dmp

Filesize
64KB

Download
memory/1964-45-0x00000256A0AD0000-0x00000256A0AF2000-memory.dmp

Filesize
136KB

Download
memory/1964-32-0x00007FF984460000-0x00007FF984F21000-memory.dmp

Filesize
10.8MB

Download
memory/1964-281-0x00000256A17D0000-0x00000256A1F76000-memory.dmp

Filesize
7.6MB

Download
memory/2124-55-0x00007FF7BF510000-0x00007FF7BF902000-memory.dmp

Filesize
3.9MB

Download
memory/2124-1770-0x00007FF7BF510000-0x00007FF7BF902000-memory.dmp

Filesize
3.9MB

Download
memory/2772-2183-0x00007FF62DA60000-0x00007FF62DE52000-memory.dmp

Filesize
3.9MB

Download
memory/2772-329-0x00007FF62DA60000-0x00007FF62DE52000-memory.dmp

Filesize
3.9MB

Download
memory/2796-325-0x00007FF7C9D20000-0x00007FF7CA112000-memory.dmp

Filesize
3.9MB

Download
memory/3032-278-0x00007FF609BA0000-0x00007FF609F92000-memory.dmp

Filesize
3.9MB

Download
memory/3032-2023-0x00007FF609BA0000-0x00007FF609F92000-memory.dmp

Filesize
3.9MB

Download
memory/3272-2026-0x00007FF6964C0000-0x00007FF6968B2000-memory.dmp

Filesize
3.9MB

Download
memory/3272-336-0x00007FF6964C0000-0x00007FF6968B2000-memory.dmp

Filesize
3.9MB

Download
memory/3384-320-0x00007FF6B07C0000-0x00007FF6B0BB2000-memory.dmp

Filesize
3.9MB

Download
memory/3384-2012-0x00007FF6B07C0000-0x00007FF6B0BB2000-memory.dmp

Filesize
3.9MB

Download
memory/3484-332-0x00007FF754230000-0x00007FF754622000-memory.dmp

Filesize
3.9MB

Download
memory/3796-90-0x00007FF682D10000-0x00007FF683102000-memory.dmp

Filesize
3.9MB

Download
memory/3796-1838-0x00007FF682D10000-0x00007FF683102000-memory.dmp

Filesize
3.9MB

Download
memory/3920-337-0x00007FF7BC590000-0x00007FF7BC982000-memory.dmp

Filesize
3.9MB

Download
memory/3920-1889-0x00007FF7BC590000-0x00007FF7BC982000-memory.dmp

Filesize
3.9MB

Download
memory/4072-1739-0x00007FF723DE0000-0x00007FF7241D2000-memory.dmp

Filesize
3.9MB

Download
memory/4072-49-0x00007FF723DE0000-0x00007FF7241D2000-memory.dmp

Filesize
3.9MB

Download
memory/4088-1821-0x00007FF700470000-0x00007FF700862000-memory.dmp

Filesize
3.9MB

Download
memory/4088-69-0x00007FF700470000-0x00007FF700862000-memory.dmp

Filesize
3.9MB

Download
memory/4776-1830-0x00007FF692EA0000-0x00007FF693292000-memory.dmp

Filesize
3.9MB

Download
memory/4776-82-0x00007FF692EA0000-0x00007FF693292000-memory.dmp

Filesize
3.9MB

Download
memory/4896-1787-0x00007FF7BD9D0000-0x00007FF7BDDC2000-memory.dmp

Filesize
3.9MB

Download
memory/4896-60-0x00007FF7BD9D0000-0x00007FF7BDDC2000-memory.dmp

Filesize
3.9MB

Download
memory/5088-1866-0x00007FF6CC440000-0x00007FF6CC832000-memory.dmp

Filesize
3.9MB

Download
memory/5088-106-0x00007FF6CC440000-0x00007FF6CC832000-memory.dmp

Filesize
3.9MB

Download
memory/5100-1804-0x00007FF662E00000-0x00007FF6631F2000-memory.dmp

Filesize
3.9MB

Download
memory/5100-76-0x00007FF662E00000-0x00007FF6631F2000-memory.dmp

Filesize
3.9MB

Download