xmrig | 2406f606500bb728a02d22858a8793cf8320622f006b0d972ae5f17990bf9169

Analysis

max time kernel
150s
max time network
143s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 06:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
Size

2.1MB
MD5

1fb23cb1cd6a177df26d7cd7a9cf1860
SHA1

9d868d872b56073c59be2ad458b0f0779cf60954
SHA256

2406f606500bb728a02d22858a8793cf8320622f006b0d972ae5f17990bf9169
SHA512

df5cd088a25a01e33ed43a22874142f40fc67eb10e4f10b8448bfff54ef01d8f865609cc1006b7975b2dc5c85d5b5ff76b6b108b03cb36da7e5b28b50b4d8b00
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafM4U7:NABR

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 19 IoCs

miner

resource	yara_rule
behavioral1/memory/2992-23-0x000000013F600000-0x000000013F9F2000-memory.dmp	xmrig
behavioral1/memory/2548-29-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	xmrig
behavioral1/memory/2284-42-0x000000013FDF0000-0x00000001401E2000-memory.dmp	xmrig
behavioral1/memory/2216-78-0x000000013F340000-0x000000013F732000-memory.dmp	xmrig
behavioral1/memory/2692-83-0x000000013F3B0000-0x000000013F7A2000-memory.dmp	xmrig
behavioral1/memory/2216-82-0x00000000035E0000-0x00000000039D2000-memory.dmp	xmrig
behavioral1/memory/2392-282-0x000000013FD20000-0x0000000140112000-memory.dmp	xmrig
behavioral1/memory/2600-54-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	xmrig
behavioral1/memory/2720-50-0x000000013F650000-0x000000013FA42000-memory.dmp	xmrig
behavioral1/memory/2272-28-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	xmrig
behavioral1/memory/2720-647-0x000000013F650000-0x000000013FA42000-memory.dmp	xmrig
behavioral1/memory/2616-1897-0x000000013FBE0000-0x000000013FFD2000-memory.dmp	xmrig
behavioral1/memory/2548-5946-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	xmrig
behavioral1/memory/2692-5947-0x000000013F3B0000-0x000000013F7A2000-memory.dmp	xmrig
behavioral1/memory/2628-5954-0x000000013FC40000-0x0000000140032000-memory.dmp	xmrig
behavioral1/memory/2064-5963-0x000000013F1F0000-0x000000013F5E2000-memory.dmp	xmrig
behavioral1/memory/2272-6028-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	xmrig
behavioral1/memory/2720-6006-0x000000013F650000-0x000000013FA42000-memory.dmp	xmrig
behavioral1/memory/2600-5964-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1136	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2992	IuwFJXo.exe
2548	hHPHgSk.exe
2392	DUWamjU.exe
2272	DNSSRvM.exe
2284	JiiVfhi.exe
2720	NVqhTlx.exe
2600	wHcZrRj.exe
2616	ZupktkM.exe
3008	bnuVGcQ.exe
2064	AtiIbtN.exe
2692	SZnJHIY.exe
2628	SRmcgHF.exe
2836	PPTpyPk.exe
636	jWPGIUA.exe
1756	etbqOGJ.exe
1944	BhMNwTf.exe
1708	AkXBCZC.exe
1948	QzcbACR.exe
772	zsHXWGO.exe
1984	jSwCpcT.exe
1160	maJeKnx.exe
1192	vTDtlZf.exe
2892	asyrHyG.exe
2024	dgKUWrw.exe
2120	KyzsGZR.exe
1804	QRZJCQL.exe
616	zkpVNrj.exe
1140	VNYKHIy.exe
2152	XYdQmwW.exe
1340	TKjavth.exe
884	JfxPvCn.exe
1316	qamaqaK.exe
1692	HIexeOu.exe
944	fyhLAGu.exe
2140	lMErvKG.exe
1628	WoRXMGC.exe
2380	bAOQsCd.exe
1508	sdPeoUh.exe
1512	FLWwoHF.exe
2240	gMBDxIS.exe
2160	TzSULHL.exe
2396	ekCtWDV.exe
1576	eWxBdzb.exe
2172	clKZNzy.exe
2040	GFZgUmD.exe
796	tYYPbdO.exe
960	omUTWKL.exe
1796	jCHRfZr.exe
696	TOQhmjo.exe
1996	KgELKCF.exe
2044	PSBGgGG.exe
2376	ausUzDD.exe
1772	NouUktL.exe
1620	ErHRghz.exe
2912	yRZjHCK.exe
916	qlLHFYU.exe
1800	OALSShG.exe
2920	qwQIKyu.exe
980	RfYnITn.exe
1980	OxhzgyD.exe
2124	EjocRZt.exe
2620	GKyUcbr.exe
1004	eAqLEXQ.exe
2956	jSNoFfV.exe

Loads dropped DLL 64 IoCs

pid	Process
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe

UPX packed file 59 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2216-0-0x000000013F340000-0x000000013F732000-memory.dmp	upx
behavioral1/files/0x0007000000015d20-13.dat	upx
behavioral1/memory/2992-23-0x000000013F600000-0x000000013F9F2000-memory.dmp	upx
behavioral1/memory/2548-29-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	upx
behavioral1/files/0x0007000000015d4e-34.dat	upx
behavioral1/memory/2284-42-0x000000013FDF0000-0x00000001401E2000-memory.dmp	upx
behavioral1/files/0x0009000000015d56-38.dat	upx
behavioral1/files/0x0006000000016616-61.dat	upx
behavioral1/memory/2616-59-0x000000013FBE0000-0x000000013FFD2000-memory.dmp	upx
behavioral1/files/0x0007000000016adc-76.dat	upx
behavioral1/memory/2216-78-0x000000013F340000-0x000000013F732000-memory.dmp	upx
behavioral1/memory/2064-73-0x000000013F1F0000-0x000000013F5E2000-memory.dmp	upx
behavioral1/memory/2692-83-0x000000013F3B0000-0x000000013F7A2000-memory.dmp	upx
behavioral1/files/0x0006000000016c44-86.dat	upx
behavioral1/memory/2628-89-0x000000013FC40000-0x0000000140032000-memory.dmp	upx
behavioral1/files/0x0006000000016cdc-107.dat	upx
behavioral1/files/0x0006000000016d18-118.dat	upx
behavioral1/files/0x0006000000016d3e-141.dat	upx
behavioral1/files/0x0006000000016d5f-149.dat	upx
behavioral1/files/0x0006000000016d20-128.dat	upx
behavioral1/files/0x0006000000016d34-133.dat	upx
behavioral1/files/0x0006000000016db9-172.dat	upx
behavioral1/files/0x000600000001704a-179.dat	upx
behavioral1/files/0x0006000000016d43-146.dat	upx
behavioral1/files/0x0006000000016d3a-140.dat	upx
behavioral1/memory/2392-282-0x000000013FD20000-0x0000000140112000-memory.dmp	upx
behavioral1/files/0x00060000000171df-186.dat	upx
behavioral1/files/0x000600000001708b-181.dat	upx
behavioral1/files/0x0006000000016dbe-174.dat	upx
behavioral1/files/0x0006000000016db1-167.dat	upx
behavioral1/files/0x0006000000016d9d-160.dat	upx
behavioral1/files/0x0006000000016d74-153.dat	upx
behavioral1/files/0x0006000000016da5-165.dat	upx
behavioral1/files/0x0006000000016d8e-158.dat	upx
behavioral1/files/0x0034000000015ccd-122.dat	upx
behavioral1/files/0x0006000000016d07-112.dat	upx
behavioral1/files/0x0006000000016c64-96.dat	upx
behavioral1/files/0x0006000000016cb0-101.dat	upx
behavioral1/files/0x0006000000016c5e-92.dat	upx
behavioral1/files/0x000e0000000054ab-72.dat	upx
behavioral1/memory/3008-70-0x000000013FEF0000-0x00000001402E2000-memory.dmp	upx
behavioral1/files/0x000800000001658a-55.dat	upx
behavioral1/memory/2600-54-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	upx
behavioral1/memory/2720-50-0x000000013F650000-0x000000013FA42000-memory.dmp	upx
behavioral1/files/0x0007000000015d42-33.dat	upx
behavioral1/memory/2272-28-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	upx
behavioral1/memory/2392-26-0x000000013FD20000-0x0000000140112000-memory.dmp	upx
behavioral1/files/0x0007000000015cff-22.dat	upx
behavioral1/files/0x000b00000001565d-21.dat	upx
behavioral1/files/0x0034000000015cb6-5.dat	upx
behavioral1/memory/2720-647-0x000000013F650000-0x000000013FA42000-memory.dmp	upx
behavioral1/memory/2616-1897-0x000000013FBE0000-0x000000013FFD2000-memory.dmp	upx
behavioral1/memory/2548-5946-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	upx
behavioral1/memory/2692-5947-0x000000013F3B0000-0x000000013F7A2000-memory.dmp	upx
behavioral1/memory/2628-5954-0x000000013FC40000-0x0000000140032000-memory.dmp	upx
behavioral1/memory/2064-5963-0x000000013F1F0000-0x000000013F5E2000-memory.dmp	upx
behavioral1/memory/2272-6028-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	upx
behavioral1/memory/2720-6006-0x000000013F650000-0x000000013FA42000-memory.dmp	upx
behavioral1/memory/2600-5964-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\IpCuDhL.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\YwisUCF.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\wbeAQrr.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\uqueocY.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\JKNaflk.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\GsIPUsH.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\OAUjWCt.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\OZGsiRZ.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\zWwTFPw.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\JsCcjSO.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\vxZEmUW.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\xhmgoVN.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\LjnIjZK.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\IdDMZwe.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\NMwPyDk.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\FGFBYPq.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\JfxPvCn.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\uGhzoOw.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\qUJNZOR.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\sCjBgbA.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\KjyTPWQ.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\gMBDxIS.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\qJAEbfo.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\zmJzCmg.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\sWkaIYH.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\JibVbvv.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\McUgFeV.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\MMxMkrq.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\rVwbGDg.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\AtuvfrB.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\IYqwTeP.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\WlcNPIe.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\WsYEofx.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\HqYkJmg.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\pqrtMBY.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\WlmEmbQ.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\URWndxh.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\pRcJSyc.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\FrnyMqk.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\mbiDQQs.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\sYqxYDg.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\ttxBsHx.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\RvssUsB.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\katJdjU.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\UmwmlPa.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\byttLlR.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\RejAnOq.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\wxpjKFW.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\CcZiSQz.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\kZdbZWO.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\zcEmmCR.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\oBOIEBA.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\Welwqrr.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\mjSWuTY.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\GnYLbyk.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\uBcCTxx.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\nKwfPtl.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\qYGICKR.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\HKWAcGl.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\bHuqZnH.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\MeHRZOE.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\RkJnmQO.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\UGDFVtS.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\waZdwzU.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1136	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
Token: SeDebugPrivilege	1136	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 1136	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	29
PID 2216 wrote to memory of 1136	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	29
PID 2216 wrote to memory of 1136	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	29
PID 2216 wrote to memory of 2392	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	30
PID 2216 wrote to memory of 2392	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	30
PID 2216 wrote to memory of 2392	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	30
PID 2216 wrote to memory of 2992	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	31
PID 2216 wrote to memory of 2992	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	31
PID 2216 wrote to memory of 2992	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	31
PID 2216 wrote to memory of 2272	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	32
PID 2216 wrote to memory of 2272	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	32
PID 2216 wrote to memory of 2272	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	32
PID 2216 wrote to memory of 2548	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	33
PID 2216 wrote to memory of 2548	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	33
PID 2216 wrote to memory of 2548	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	33
PID 2216 wrote to memory of 2284	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	34
PID 2216 wrote to memory of 2284	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	34
PID 2216 wrote to memory of 2284	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	34
PID 2216 wrote to memory of 2600	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	35
PID 2216 wrote to memory of 2600	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	35
PID 2216 wrote to memory of 2600	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	35
PID 2216 wrote to memory of 2720	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	36
PID 2216 wrote to memory of 2720	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	36
PID 2216 wrote to memory of 2720	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	36
PID 2216 wrote to memory of 2616	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	37
PID 2216 wrote to memory of 2616	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	37
PID 2216 wrote to memory of 2616	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	37
PID 2216 wrote to memory of 3008	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	38
PID 2216 wrote to memory of 3008	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	38
PID 2216 wrote to memory of 3008	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	38
PID 2216 wrote to memory of 2064	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	39
PID 2216 wrote to memory of 2064	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	39
PID 2216 wrote to memory of 2064	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	39
PID 2216 wrote to memory of 2692	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	40
PID 2216 wrote to memory of 2692	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	40
PID 2216 wrote to memory of 2692	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	40
PID 2216 wrote to memory of 2628	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	41
PID 2216 wrote to memory of 2628	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	41
PID 2216 wrote to memory of 2628	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	41
PID 2216 wrote to memory of 2836	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	42
PID 2216 wrote to memory of 2836	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	42
PID 2216 wrote to memory of 2836	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	42
PID 2216 wrote to memory of 636	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	43
PID 2216 wrote to memory of 636	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	43
PID 2216 wrote to memory of 636	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	43
PID 2216 wrote to memory of 1756	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	44
PID 2216 wrote to memory of 1756	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	44
PID 2216 wrote to memory of 1756	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	44
PID 2216 wrote to memory of 1944	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	45
PID 2216 wrote to memory of 1944	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	45
PID 2216 wrote to memory of 1944	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	45
PID 2216 wrote to memory of 1708	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	46
PID 2216 wrote to memory of 1708	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	46
PID 2216 wrote to memory of 1708	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	46
PID 2216 wrote to memory of 1948	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	47
PID 2216 wrote to memory of 1948	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	47
PID 2216 wrote to memory of 1948	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	47
PID 2216 wrote to memory of 772	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	48
PID 2216 wrote to memory of 772	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	48
PID 2216 wrote to memory of 772	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	48
PID 2216 wrote to memory of 1984	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	49
PID 2216 wrote to memory of 1984	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	49
PID 2216 wrote to memory of 1984	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	49
PID 2216 wrote to memory of 1160	2216	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1136
- C:\Windows\System\DUWamjU.exe
  C:\Windows\System\DUWamjU.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\IuwFJXo.exe
  C:\Windows\System\IuwFJXo.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\DNSSRvM.exe
  C:\Windows\System\DNSSRvM.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\hHPHgSk.exe
  C:\Windows\System\hHPHgSk.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\JiiVfhi.exe
  C:\Windows\System\JiiVfhi.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\wHcZrRj.exe
  C:\Windows\System\wHcZrRj.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\NVqhTlx.exe
  C:\Windows\System\NVqhTlx.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\ZupktkM.exe
  C:\Windows\System\ZupktkM.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\bnuVGcQ.exe
  C:\Windows\System\bnuVGcQ.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\AtiIbtN.exe
  C:\Windows\System\AtiIbtN.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\SZnJHIY.exe
  C:\Windows\System\SZnJHIY.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\SRmcgHF.exe
  C:\Windows\System\SRmcgHF.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\PPTpyPk.exe
  C:\Windows\System\PPTpyPk.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\jWPGIUA.exe
  C:\Windows\System\jWPGIUA.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\etbqOGJ.exe
  C:\Windows\System\etbqOGJ.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\BhMNwTf.exe
  C:\Windows\System\BhMNwTf.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\AkXBCZC.exe
  C:\Windows\System\AkXBCZC.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\QzcbACR.exe
  C:\Windows\System\QzcbACR.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\zsHXWGO.exe
  C:\Windows\System\zsHXWGO.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\jSwCpcT.exe
  C:\Windows\System\jSwCpcT.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\maJeKnx.exe
  C:\Windows\System\maJeKnx.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\vTDtlZf.exe
  C:\Windows\System\vTDtlZf.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\asyrHyG.exe
  C:\Windows\System\asyrHyG.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\GFZgUmD.exe
  C:\Windows\System\GFZgUmD.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\dgKUWrw.exe
  C:\Windows\System\dgKUWrw.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\tYYPbdO.exe
  C:\Windows\System\tYYPbdO.exe
  2⤵
  - Executes dropped EXE
  PID:796
- C:\Windows\System\KyzsGZR.exe
  C:\Windows\System\KyzsGZR.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\omUTWKL.exe
  C:\Windows\System\omUTWKL.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\QRZJCQL.exe
  C:\Windows\System\QRZJCQL.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\jCHRfZr.exe
  C:\Windows\System\jCHRfZr.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\zkpVNrj.exe
  C:\Windows\System\zkpVNrj.exe
  2⤵
  - Executes dropped EXE
  PID:616
- C:\Windows\System\TOQhmjo.exe
  C:\Windows\System\TOQhmjo.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\VNYKHIy.exe
  C:\Windows\System\VNYKHIy.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\PSBGgGG.exe
  C:\Windows\System\PSBGgGG.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\XYdQmwW.exe
  C:\Windows\System\XYdQmwW.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\ausUzDD.exe
  C:\Windows\System\ausUzDD.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\TKjavth.exe
  C:\Windows\System\TKjavth.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\NouUktL.exe
  C:\Windows\System\NouUktL.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\JfxPvCn.exe
  C:\Windows\System\JfxPvCn.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\ErHRghz.exe
  C:\Windows\System\ErHRghz.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\qamaqaK.exe
  C:\Windows\System\qamaqaK.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\yRZjHCK.exe
  C:\Windows\System\yRZjHCK.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\HIexeOu.exe
  C:\Windows\System\HIexeOu.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\qlLHFYU.exe
  C:\Windows\System\qlLHFYU.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\fyhLAGu.exe
  C:\Windows\System\fyhLAGu.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\OALSShG.exe
  C:\Windows\System\OALSShG.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\lMErvKG.exe
  C:\Windows\System\lMErvKG.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\qwQIKyu.exe
  C:\Windows\System\qwQIKyu.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\WoRXMGC.exe
  C:\Windows\System\WoRXMGC.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\RfYnITn.exe
  C:\Windows\System\RfYnITn.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\bAOQsCd.exe
  C:\Windows\System\bAOQsCd.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\OxhzgyD.exe
  C:\Windows\System\OxhzgyD.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\sdPeoUh.exe
  C:\Windows\System\sdPeoUh.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\EjocRZt.exe
  C:\Windows\System\EjocRZt.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\FLWwoHF.exe
  C:\Windows\System\FLWwoHF.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\LjTDQYd.exe
  C:\Windows\System\LjTDQYd.exe
  2⤵
  PID:3004
- C:\Windows\System\gMBDxIS.exe
  C:\Windows\System\gMBDxIS.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\mLSvYaU.exe
  C:\Windows\System\mLSvYaU.exe
  2⤵
  PID:2028
- C:\Windows\System\TzSULHL.exe
  C:\Windows\System\TzSULHL.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\UsVDtWj.exe
  C:\Windows\System\UsVDtWj.exe
  2⤵
  PID:2580
- C:\Windows\System\ekCtWDV.exe
  C:\Windows\System\ekCtWDV.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\xsNxinD.exe
  C:\Windows\System\xsNxinD.exe
  2⤵
  PID:1608
- C:\Windows\System\eWxBdzb.exe
  C:\Windows\System\eWxBdzb.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\gUBvvTI.exe
  C:\Windows\System\gUBvvTI.exe
  2⤵
  PID:2760
- C:\Windows\System\clKZNzy.exe
  C:\Windows\System\clKZNzy.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\HLmdVqs.exe
  C:\Windows\System\HLmdVqs.exe
  2⤵
  PID:2864
- C:\Windows\System\KgELKCF.exe
  C:\Windows\System\KgELKCF.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\cwMkoKy.exe
  C:\Windows\System\cwMkoKy.exe
  2⤵
  PID:2256
- C:\Windows\System\GKyUcbr.exe
  C:\Windows\System\GKyUcbr.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\ssfHDXq.exe
  C:\Windows\System\ssfHDXq.exe
  2⤵
  PID:1516
- C:\Windows\System\eAqLEXQ.exe
  C:\Windows\System\eAqLEXQ.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\LALCnFs.exe
  C:\Windows\System\LALCnFs.exe
  2⤵
  PID:1556
- C:\Windows\System\jSNoFfV.exe
  C:\Windows\System\jSNoFfV.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\fVrAKll.exe
  C:\Windows\System\fVrAKll.exe
  2⤵
  PID:280
- C:\Windows\System\jHYVXLi.exe
  C:\Windows\System\jHYVXLi.exe
  2⤵
  PID:620
- C:\Windows\System\ZPbYepH.exe
  C:\Windows\System\ZPbYepH.exe
  2⤵
  PID:1928
- C:\Windows\System\hebWOAE.exe
  C:\Windows\System\hebWOAE.exe
  2⤵
  PID:2532
- C:\Windows\System\cTYvYks.exe
  C:\Windows\System\cTYvYks.exe
  2⤵
  PID:776
- C:\Windows\System\YkvthhE.exe
  C:\Windows\System\YkvthhE.exe
  2⤵
  PID:908
- C:\Windows\System\PwhGEKm.exe
  C:\Windows\System\PwhGEKm.exe
  2⤵
  PID:2076
- C:\Windows\System\XVDHTHI.exe
  C:\Windows\System\XVDHTHI.exe
  2⤵
  PID:2724
- C:\Windows\System\nruiUmz.exe
  C:\Windows\System\nruiUmz.exe
  2⤵
  PID:2560
- C:\Windows\System\HQLBMcS.exe
  C:\Windows\System\HQLBMcS.exe
  2⤵
  PID:2540
- C:\Windows\System\vKaRmgj.exe
  C:\Windows\System\vKaRmgj.exe
  2⤵
  PID:1952
- C:\Windows\System\twFLBFJ.exe
  C:\Windows\System\twFLBFJ.exe
  2⤵
  PID:2856
- C:\Windows\System\VIyXtZm.exe
  C:\Windows\System\VIyXtZm.exe
  2⤵
  PID:1568
- C:\Windows\System\fBDGBnd.exe
  C:\Windows\System\fBDGBnd.exe
  2⤵
  PID:1640
- C:\Windows\System\rGUDmnY.exe
  C:\Windows\System\rGUDmnY.exe
  2⤵
  PID:2508
- C:\Windows\System\UryIdma.exe
  C:\Windows\System\UryIdma.exe
  2⤵
  PID:2988
- C:\Windows\System\ZrXzjSE.exe
  C:\Windows\System\ZrXzjSE.exe
  2⤵
  PID:2132
- C:\Windows\System\TLCLril.exe
  C:\Windows\System\TLCLril.exe
  2⤵
  PID:2356
- C:\Windows\System\rOiowcv.exe
  C:\Windows\System\rOiowcv.exe
  2⤵
  PID:2472
- C:\Windows\System\tSBZWNo.exe
  C:\Windows\System\tSBZWNo.exe
  2⤵
  PID:2780
- C:\Windows\System\LUZvDBe.exe
  C:\Windows\System\LUZvDBe.exe
  2⤵
  PID:2732
- C:\Windows\System\TbJprQj.exe
  C:\Windows\System\TbJprQj.exe
  2⤵
  PID:2188
- C:\Windows\System\eSIhRdf.exe
  C:\Windows\System\eSIhRdf.exe
  2⤵
  PID:2108
- C:\Windows\System\BUnzyLm.exe
  C:\Windows\System\BUnzyLm.exe
  2⤵
  PID:1916
- C:\Windows\System\mSzCqBi.exe
  C:\Windows\System\mSzCqBi.exe
  2⤵
  PID:2808
- C:\Windows\System\HGpYYXf.exe
  C:\Windows\System\HGpYYXf.exe
  2⤵
  PID:2556
- C:\Windows\System\shDjvCA.exe
  C:\Windows\System\shDjvCA.exe
  2⤵
  PID:1156
- C:\Windows\System\ykcXPts.exe
  C:\Windows\System\ykcXPts.exe
  2⤵
  PID:2424
- C:\Windows\System\ILjIZLh.exe
  C:\Windows\System\ILjIZLh.exe
  2⤵
  PID:588
- C:\Windows\System\MLICeYm.exe
  C:\Windows\System\MLICeYm.exe
  2⤵
  PID:2972
- C:\Windows\System\yBoaomv.exe
  C:\Windows\System\yBoaomv.exe
  2⤵
  PID:2696
- C:\Windows\System\GxxJoqY.exe
  C:\Windows\System\GxxJoqY.exe
  2⤵
  PID:2308
- C:\Windows\System\QTzERwE.exe
  C:\Windows\System\QTzERwE.exe
  2⤵
  PID:1652
- C:\Windows\System\zSRKOHx.exe
  C:\Windows\System\zSRKOHx.exe
  2⤵
  PID:1060
- C:\Windows\System\SkQLhLz.exe
  C:\Windows\System\SkQLhLz.exe
  2⤵
  PID:1624
- C:\Windows\System\lTwHiqq.exe
  C:\Windows\System\lTwHiqq.exe
  2⤵
  PID:2008
- C:\Windows\System\omQoMeb.exe
  C:\Windows\System\omQoMeb.exe
  2⤵
  PID:2412
- C:\Windows\System\GpulXro.exe
  C:\Windows\System\GpulXro.exe
  2⤵
  PID:2636
- C:\Windows\System\OkuLyKy.exe
  C:\Windows\System\OkuLyKy.exe
  2⤵
  PID:2116
- C:\Windows\System\tzbVbor.exe
  C:\Windows\System\tzbVbor.exe
  2⤵
  PID:1644
- C:\Windows\System\EWyKVDp.exe
  C:\Windows\System\EWyKVDp.exe
  2⤵
  PID:2420
- C:\Windows\System\nzFpsMd.exe
  C:\Windows\System\nzFpsMd.exe
  2⤵
  PID:684
- C:\Windows\System\ZPxNhmV.exe
  C:\Windows\System\ZPxNhmV.exe
  2⤵
  PID:1344
- C:\Windows\System\yxQQqsv.exe
  C:\Windows\System\yxQQqsv.exe
  2⤵
  PID:2476
- C:\Windows\System\SaRcFVw.exe
  C:\Windows\System\SaRcFVw.exe
  2⤵
  PID:2248
- C:\Windows\System\sjjoExm.exe
  C:\Windows\System\sjjoExm.exe
  2⤵
  PID:1028
- C:\Windows\System\UvsGDGy.exe
  C:\Windows\System\UvsGDGy.exe
  2⤵
  PID:1720
- C:\Windows\System\wUhrHQR.exe
  C:\Windows\System\wUhrHQR.exe
  2⤵
  PID:1040
- C:\Windows\System\wsOzjVj.exe
  C:\Windows\System\wsOzjVj.exe
  2⤵
  PID:1560
- C:\Windows\System\PtGkDGM.exe
  C:\Windows\System\PtGkDGM.exe
  2⤵
  PID:2896
- C:\Windows\System\AULlWRf.exe
  C:\Windows\System\AULlWRf.exe
  2⤵
  PID:3044
- C:\Windows\System\oUxUaZG.exe
  C:\Windows\System\oUxUaZG.exe
  2⤵
  PID:336
- C:\Windows\System\yfrnAcq.exe
  C:\Windows\System\yfrnAcq.exe
  2⤵
  PID:2460
- C:\Windows\System\CQHgELC.exe
  C:\Windows\System\CQHgELC.exe
  2⤵
  PID:2812
- C:\Windows\System\iFuoJbk.exe
  C:\Windows\System\iFuoJbk.exe
  2⤵
  PID:2492
- C:\Windows\System\YOaZNpC.exe
  C:\Windows\System\YOaZNpC.exe
  2⤵
  PID:2388
- C:\Windows\System\Xyadolx.exe
  C:\Windows\System\Xyadolx.exe
  2⤵
  PID:2320
- C:\Windows\System\OCCPlhZ.exe
  C:\Windows\System\OCCPlhZ.exe
  2⤵
  PID:2088
- C:\Windows\System\yuYBhUV.exe
  C:\Windows\System\yuYBhUV.exe
  2⤵
  PID:1656
- C:\Windows\System\MpAisZU.exe
  C:\Windows\System\MpAisZU.exe
  2⤵
  PID:1000
- C:\Windows\System\SdKFoTj.exe
  C:\Windows\System\SdKFoTj.exe
  2⤵
  PID:2488
- C:\Windows\System\LkZiVaQ.exe
  C:\Windows\System\LkZiVaQ.exe
  2⤵
  PID:1068
- C:\Windows\System\xNjaslQ.exe
  C:\Windows\System\xNjaslQ.exe
  2⤵
  PID:2772
- C:\Windows\System\dIErJoT.exe
  C:\Windows\System\dIErJoT.exe
  2⤵
  PID:2936
- C:\Windows\System\szOycQc.exe
  C:\Windows\System\szOycQc.exe
  2⤵
  PID:708
- C:\Windows\System\sGAzKyj.exe
  C:\Windows\System\sGAzKyj.exe
  2⤵
  PID:1304
- C:\Windows\System\biMlYKr.exe
  C:\Windows\System\biMlYKr.exe
  2⤵
  PID:1724
- C:\Windows\System\smBaMFU.exe
  C:\Windows\System\smBaMFU.exe
  2⤵
  PID:1108
- C:\Windows\System\vlYhUfL.exe
  C:\Windows\System\vlYhUfL.exe
  2⤵
  PID:1924
- C:\Windows\System\gEHiRBF.exe
  C:\Windows\System\gEHiRBF.exe
  2⤵
  PID:3016
- C:\Windows\System\VRrPToQ.exe
  C:\Windows\System\VRrPToQ.exe
  2⤵
  PID:1688
- C:\Windows\System\uOMDqoI.exe
  C:\Windows\System\uOMDqoI.exe
  2⤵
  PID:3088
- C:\Windows\System\uwjRyOU.exe
  C:\Windows\System\uwjRyOU.exe
  2⤵
  PID:3104
- C:\Windows\System\sOQpECq.exe
  C:\Windows\System\sOQpECq.exe
  2⤵
  PID:3124
- C:\Windows\System\WBRlcvt.exe
  C:\Windows\System\WBRlcvt.exe
  2⤵
  PID:3140
- C:\Windows\System\BMDUTPu.exe
  C:\Windows\System\BMDUTPu.exe
  2⤵
  PID:3160
- C:\Windows\System\KxpuFID.exe
  C:\Windows\System\KxpuFID.exe
  2⤵
  PID:3176
- C:\Windows\System\jibOemX.exe
  C:\Windows\System\jibOemX.exe
  2⤵
  PID:3192
- C:\Windows\System\wxoePZg.exe
  C:\Windows\System\wxoePZg.exe
  2⤵
  PID:3208
- C:\Windows\System\uDmNVrm.exe
  C:\Windows\System\uDmNVrm.exe
  2⤵
  PID:3224
- C:\Windows\System\xNfNpIm.exe
  C:\Windows\System\xNfNpIm.exe
  2⤵
  PID:3240
- C:\Windows\System\FObFHrA.exe
  C:\Windows\System\FObFHrA.exe
  2⤵
  PID:3308
- C:\Windows\System\AeISKcM.exe
  C:\Windows\System\AeISKcM.exe
  2⤵
  PID:3340
- C:\Windows\System\PVXsYrG.exe
  C:\Windows\System\PVXsYrG.exe
  2⤵
  PID:3372
- C:\Windows\System\WXeSLvB.exe
  C:\Windows\System\WXeSLvB.exe
  2⤵
  PID:3404
- C:\Windows\System\yPNyXfE.exe
  C:\Windows\System\yPNyXfE.exe
  2⤵
  PID:3420
- C:\Windows\System\XBKTPYF.exe
  C:\Windows\System\XBKTPYF.exe
  2⤵
  PID:3448
- C:\Windows\System\ZbdlNFF.exe
  C:\Windows\System\ZbdlNFF.exe
  2⤵
  PID:3468
- C:\Windows\System\zohlKML.exe
  C:\Windows\System\zohlKML.exe
  2⤵
  PID:3488
- C:\Windows\System\TKDHwHb.exe
  C:\Windows\System\TKDHwHb.exe
  2⤵
  PID:3508
- C:\Windows\System\iZVvwfG.exe
  C:\Windows\System\iZVvwfG.exe
  2⤵
  PID:3528
- C:\Windows\System\vjbnWNC.exe
  C:\Windows\System\vjbnWNC.exe
  2⤵
  PID:3548
- C:\Windows\System\aucaeek.exe
  C:\Windows\System\aucaeek.exe
  2⤵
  PID:3572
- C:\Windows\System\iDjFepb.exe
  C:\Windows\System\iDjFepb.exe
  2⤵
  PID:3592
- C:\Windows\System\pRDdCbK.exe
  C:\Windows\System\pRDdCbK.exe
  2⤵
  PID:3612
- C:\Windows\System\WIEFWlP.exe
  C:\Windows\System\WIEFWlP.exe
  2⤵
  PID:3628
- C:\Windows\System\XCSMuBB.exe
  C:\Windows\System\XCSMuBB.exe
  2⤵
  PID:3652
- C:\Windows\System\jfdyAow.exe
  C:\Windows\System\jfdyAow.exe
  2⤵
  PID:3672
- C:\Windows\System\xjNVZdI.exe
  C:\Windows\System\xjNVZdI.exe
  2⤵
  PID:3692
- C:\Windows\System\wysrGLO.exe
  C:\Windows\System\wysrGLO.exe
  2⤵
  PID:3712
- C:\Windows\System\AwxObSy.exe
  C:\Windows\System\AwxObSy.exe
  2⤵
  PID:3732
- C:\Windows\System\SLUQzDj.exe
  C:\Windows\System\SLUQzDj.exe
  2⤵
  PID:3748
- C:\Windows\System\LOdysby.exe
  C:\Windows\System\LOdysby.exe
  2⤵
  PID:3772
- C:\Windows\System\PmRXaMK.exe
  C:\Windows\System\PmRXaMK.exe
  2⤵
  PID:3792
- C:\Windows\System\sOBYlzC.exe
  C:\Windows\System\sOBYlzC.exe
  2⤵
  PID:3816
- C:\Windows\System\QUBJueg.exe
  C:\Windows\System\QUBJueg.exe
  2⤵
  PID:3832
- C:\Windows\System\vdiDvLi.exe
  C:\Windows\System\vdiDvLi.exe
  2⤵
  PID:3856
- C:\Windows\System\cWOWMsp.exe
  C:\Windows\System\cWOWMsp.exe
  2⤵
  PID:3872
- C:\Windows\System\ixCWRPb.exe
  C:\Windows\System\ixCWRPb.exe
  2⤵
  PID:3896
- C:\Windows\System\lsXpYpk.exe
  C:\Windows\System\lsXpYpk.exe
  2⤵
  PID:3916
- C:\Windows\System\KhHNxES.exe
  C:\Windows\System\KhHNxES.exe
  2⤵
  PID:3940
- C:\Windows\System\XzRhFqq.exe
  C:\Windows\System\XzRhFqq.exe
  2⤵
  PID:3956
- C:\Windows\System\rPzgIhH.exe
  C:\Windows\System\rPzgIhH.exe
  2⤵
  PID:3976
- C:\Windows\System\PdAAfRt.exe
  C:\Windows\System\PdAAfRt.exe
  2⤵
  PID:3992
- C:\Windows\System\DcpsemV.exe
  C:\Windows\System\DcpsemV.exe
  2⤵
  PID:4012
- C:\Windows\System\CheTeHX.exe
  C:\Windows\System\CheTeHX.exe
  2⤵
  PID:4028
- C:\Windows\System\PlkfTDn.exe
  C:\Windows\System\PlkfTDn.exe
  2⤵
  PID:4044
- C:\Windows\System\QxlXPtu.exe
  C:\Windows\System\QxlXPtu.exe
  2⤵
  PID:4060
- C:\Windows\System\MlEUGLM.exe
  C:\Windows\System\MlEUGLM.exe
  2⤵
  PID:4076
- C:\Windows\System\TDeKlmr.exe
  C:\Windows\System\TDeKlmr.exe
  2⤵
  PID:2880
- C:\Windows\System\AgQQOsx.exe
  C:\Windows\System\AgQQOsx.exe
  2⤵
  PID:3132
- C:\Windows\System\aVjqWxx.exe
  C:\Windows\System\aVjqWxx.exe
  2⤵
  PID:2872
- C:\Windows\System\vIEIigG.exe
  C:\Windows\System\vIEIigG.exe
  2⤵
  PID:3136
- C:\Windows\System\GWgYePQ.exe
  C:\Windows\System\GWgYePQ.exe
  2⤵
  PID:3204
- C:\Windows\System\fyFVSqx.exe
  C:\Windows\System\fyFVSqx.exe
  2⤵
  PID:1932
- C:\Windows\System\hkAWQQh.exe
  C:\Windows\System\hkAWQQh.exe
  2⤵
  PID:596
- C:\Windows\System\IAMlIWD.exe
  C:\Windows\System\IAMlIWD.exe
  2⤵
  PID:3332
- C:\Windows\System\hzLwVMo.exe
  C:\Windows\System\hzLwVMo.exe
  2⤵
  PID:1592
- C:\Windows\System\ZfbEovI.exe
  C:\Windows\System\ZfbEovI.exe
  2⤵
  PID:3392
- C:\Windows\System\GkpVcFQ.exe
  C:\Windows\System\GkpVcFQ.exe
  2⤵
  PID:3384
- C:\Windows\System\rVUzHYU.exe
  C:\Windows\System\rVUzHYU.exe
  2⤵
  PID:1312
- C:\Windows\System\vAEpmCc.exe
  C:\Windows\System\vAEpmCc.exe
  2⤵
  PID:2060
- C:\Windows\System\tfRLhXf.exe
  C:\Windows\System\tfRLhXf.exe
  2⤵
  PID:3444
- C:\Windows\System\TvqwaUz.exe
  C:\Windows\System\TvqwaUz.exe
  2⤵
  PID:2848
- C:\Windows\System\kpfjJHq.exe
  C:\Windows\System\kpfjJHq.exe
  2⤵
  PID:2908
- C:\Windows\System\jGLRZjW.exe
  C:\Windows\System\jGLRZjW.exe
  2⤵
  PID:3084
- C:\Windows\System\GEFywKR.exe
  C:\Windows\System\GEFywKR.exe
  2⤵
  PID:3152
- C:\Windows\System\lRTJQdh.exe
  C:\Windows\System\lRTJQdh.exe
  2⤵
  PID:3248
- C:\Windows\System\XxzKmME.exe
  C:\Windows\System\XxzKmME.exe
  2⤵
  PID:3272
- C:\Windows\System\inKPcFC.exe
  C:\Windows\System\inKPcFC.exe
  2⤵
  PID:3288
- C:\Windows\System\RWoHGNF.exe
  C:\Windows\System\RWoHGNF.exe
  2⤵
  PID:3304
- C:\Windows\System\avOrNPu.exe
  C:\Windows\System\avOrNPu.exe
  2⤵
  PID:3360
- C:\Windows\System\eWuQyPA.exe
  C:\Windows\System\eWuQyPA.exe
  2⤵
  PID:2700
- C:\Windows\System\KGhTeuk.exe
  C:\Windows\System\KGhTeuk.exe
  2⤵
  PID:3476
- C:\Windows\System\qFVzGZP.exe
  C:\Windows\System\qFVzGZP.exe
  2⤵
  PID:3480
- C:\Windows\System\vfxqSQf.exe
  C:\Windows\System\vfxqSQf.exe
  2⤵
  PID:3500
- C:\Windows\System\wuBGZzP.exe
  C:\Windows\System\wuBGZzP.exe
  2⤵
  PID:3556
- C:\Windows\System\hOGWFBq.exe
  C:\Windows\System\hOGWFBq.exe
  2⤵
  PID:1728
- C:\Windows\System\EaTiUTL.exe
  C:\Windows\System\EaTiUTL.exe
  2⤵
  PID:2664
- C:\Windows\System\sDMAqBr.exe
  C:\Windows\System\sDMAqBr.exe
  2⤵
  PID:3608
- C:\Windows\System\MipxLCD.exe
  C:\Windows\System\MipxLCD.exe
  2⤵
  PID:3636
- C:\Windows\System\TOnNaUx.exe
  C:\Windows\System\TOnNaUx.exe
  2⤵
  PID:3660
- C:\Windows\System\gUKoArz.exe
  C:\Windows\System\gUKoArz.exe
  2⤵
  PID:3788
- C:\Windows\System\Epeifun.exe
  C:\Windows\System\Epeifun.exe
  2⤵
  PID:3808
- C:\Windows\System\iZPZpaC.exe
  C:\Windows\System\iZPZpaC.exe
  2⤵
  PID:3824
- C:\Windows\System\bJXCTNY.exe
  C:\Windows\System\bJXCTNY.exe
  2⤵
  PID:3848
- C:\Windows\System\CNwUETR.exe
  C:\Windows\System\CNwUETR.exe
  2⤵
  PID:3868
- C:\Windows\System\KLqKfQp.exe
  C:\Windows\System\KLqKfQp.exe
  2⤵
  PID:2536
- C:\Windows\System\ASXYLry.exe
  C:\Windows\System\ASXYLry.exe
  2⤵
  PID:1784
- C:\Windows\System\QWqDUpk.exe
  C:\Windows\System\QWqDUpk.exe
  2⤵
  PID:3908
- C:\Windows\System\uvEnlfi.exe
  C:\Windows\System\uvEnlfi.exe
  2⤵
  PID:3948
- C:\Windows\System\vSDZZar.exe
  C:\Windows\System\vSDZZar.exe
  2⤵
  PID:3984
- C:\Windows\System\yKNsKNC.exe
  C:\Windows\System\yKNsKNC.exe
  2⤵
  PID:4004
- C:\Windows\System\QoeSQgS.exe
  C:\Windows\System\QoeSQgS.exe
  2⤵
  PID:848
- C:\Windows\System\geBJCvX.exe
  C:\Windows\System\geBJCvX.exe
  2⤵
  PID:4068
- C:\Windows\System\IRJNMhV.exe
  C:\Windows\System\IRJNMhV.exe
  2⤵
  PID:764
- C:\Windows\System\kWmzVjW.exe
  C:\Windows\System\kWmzVjW.exe
  2⤵
  PID:1484
- C:\Windows\System\HQjrJKT.exe
  C:\Windows\System\HQjrJKT.exe
  2⤵
  PID:3096
- C:\Windows\System\UNeBrEf.exe
  C:\Windows\System\UNeBrEf.exe
  2⤵
  PID:3328
- C:\Windows\System\ybLMKFj.exe
  C:\Windows\System\ybLMKFj.exe
  2⤵
  PID:3324
- C:\Windows\System\bPyfZjo.exe
  C:\Windows\System\bPyfZjo.exe
  2⤵
  PID:3200
- C:\Windows\System\zayTAwT.exe
  C:\Windows\System\zayTAwT.exe
  2⤵
  PID:3148
- C:\Windows\System\cYixWnw.exe
  C:\Windows\System\cYixWnw.exe
  2⤵
  PID:452
- C:\Windows\System\dxevNzI.exe
  C:\Windows\System\dxevNzI.exe
  2⤵
  PID:3380
- C:\Windows\System\IZkKSmK.exe
  C:\Windows\System\IZkKSmK.exe
  2⤵
  PID:3428
- C:\Windows\System\RXEXMCg.exe
  C:\Windows\System\RXEXMCg.exe
  2⤵
  PID:3116
- C:\Windows\System\LHmTIsK.exe
  C:\Windows\System\LHmTIsK.exe
  2⤵
  PID:3296
- C:\Windows\System\PQjbMFt.exe
  C:\Windows\System\PQjbMFt.exe
  2⤵
  PID:3416
- C:\Windows\System\YwisUCF.exe
  C:\Windows\System\YwisUCF.exe
  2⤵
  PID:3520
- C:\Windows\System\tacsAdz.exe
  C:\Windows\System\tacsAdz.exe
  2⤵
  PID:3680
- C:\Windows\System\lcljjQB.exe
  C:\Windows\System\lcljjQB.exe
  2⤵
  PID:3688
- C:\Windows\System\hDWovFQ.exe
  C:\Windows\System\hDWovFQ.exe
  2⤵
  PID:3704
- C:\Windows\System\IXYbKUA.exe
  C:\Windows\System\IXYbKUA.exe
  2⤵
  PID:3724
- C:\Windows\System\oAKgdwi.exe
  C:\Windows\System\oAKgdwi.exe
  2⤵
  PID:3756
- C:\Windows\System\GnrNuvA.exe
  C:\Windows\System\GnrNuvA.exe
  2⤵
  PID:1032
- C:\Windows\System\rilonEZ.exe
  C:\Windows\System\rilonEZ.exe
  2⤵
  PID:3664
- C:\Windows\System\aNwYTaF.exe
  C:\Windows\System\aNwYTaF.exe
  2⤵
  PID:3780
- C:\Windows\System\qFpQDOv.exe
  C:\Windows\System\qFpQDOv.exe
  2⤵
  PID:4112
- C:\Windows\System\aXnqUTQ.exe
  C:\Windows\System\aXnqUTQ.exe
  2⤵
  PID:4320
- C:\Windows\System\bwuXXwM.exe
  C:\Windows\System\bwuXXwM.exe
  2⤵
  PID:4336
- C:\Windows\System\YxXLSvS.exe
  C:\Windows\System\YxXLSvS.exe
  2⤵
  PID:4352
- C:\Windows\System\kaBCiBR.exe
  C:\Windows\System\kaBCiBR.exe
  2⤵
  PID:4368
- C:\Windows\System\rehZinu.exe
  C:\Windows\System\rehZinu.exe
  2⤵
  PID:4384
- C:\Windows\System\NELxQhM.exe
  C:\Windows\System\NELxQhM.exe
  2⤵
  PID:4408
- C:\Windows\System\ygESvln.exe
  C:\Windows\System\ygESvln.exe
  2⤵
  PID:4424
- C:\Windows\System\nBEsNzM.exe
  C:\Windows\System\nBEsNzM.exe
  2⤵
  PID:4440
- C:\Windows\System\dVNDbKk.exe
  C:\Windows\System\dVNDbKk.exe
  2⤵
  PID:4456
- C:\Windows\System\prNfTRU.exe
  C:\Windows\System\prNfTRU.exe
  2⤵
  PID:4472
- C:\Windows\System\zapqFFr.exe
  C:\Windows\System\zapqFFr.exe
  2⤵
  PID:4488
- C:\Windows\System\jvfzdwt.exe
  C:\Windows\System\jvfzdwt.exe
  2⤵
  PID:4504
- C:\Windows\System\vaIvvby.exe
  C:\Windows\System\vaIvvby.exe
  2⤵
  PID:4520
- C:\Windows\System\THvQKjn.exe
  C:\Windows\System\THvQKjn.exe
  2⤵
  PID:4540
- C:\Windows\System\LpRElKt.exe
  C:\Windows\System\LpRElKt.exe
  2⤵
  PID:4556
- C:\Windows\System\nDGpcIh.exe
  C:\Windows\System\nDGpcIh.exe
  2⤵
  PID:4572
- C:\Windows\System\LjiETot.exe
  C:\Windows\System\LjiETot.exe
  2⤵
  PID:4588
- C:\Windows\System\fUySYKe.exe
  C:\Windows\System\fUySYKe.exe
  2⤵
  PID:4604
- C:\Windows\System\JyViMVE.exe
  C:\Windows\System\JyViMVE.exe
  2⤵
  PID:4620
- C:\Windows\System\hycObfH.exe
  C:\Windows\System\hycObfH.exe
  2⤵
  PID:4636
- C:\Windows\System\YndHRTv.exe
  C:\Windows\System\YndHRTv.exe
  2⤵
  PID:4652
- C:\Windows\System\qbJbvmJ.exe
  C:\Windows\System\qbJbvmJ.exe
  2⤵
  PID:4668
- C:\Windows\System\qaKitjr.exe
  C:\Windows\System\qaKitjr.exe
  2⤵
  PID:4684
- C:\Windows\System\UtonYLz.exe
  C:\Windows\System\UtonYLz.exe
  2⤵
  PID:4700
- C:\Windows\System\MdIPiBW.exe
  C:\Windows\System\MdIPiBW.exe
  2⤵
  PID:4720
- C:\Windows\System\AynXLMM.exe
  C:\Windows\System\AynXLMM.exe
  2⤵
  PID:4740
- C:\Windows\System\JZGKOBE.exe
  C:\Windows\System\JZGKOBE.exe
  2⤵
  PID:4756
- C:\Windows\System\XRANfKe.exe
  C:\Windows\System\XRANfKe.exe
  2⤵
  PID:4772
- C:\Windows\System\yzIpKnu.exe
  C:\Windows\System\yzIpKnu.exe
  2⤵
  PID:4788
- C:\Windows\System\RFLIpiL.exe
  C:\Windows\System\RFLIpiL.exe
  2⤵
  PID:4804
- C:\Windows\System\MBhLnEn.exe
  C:\Windows\System\MBhLnEn.exe
  2⤵
  PID:4820
- C:\Windows\System\RShcHli.exe
  C:\Windows\System\RShcHli.exe
  2⤵
  PID:4836
- C:\Windows\System\AAIgjvH.exe
  C:\Windows\System\AAIgjvH.exe
  2⤵
  PID:4852
- C:\Windows\System\tHgAQVZ.exe
  C:\Windows\System\tHgAQVZ.exe
  2⤵
  PID:4868
- C:\Windows\System\QOdSOUU.exe
  C:\Windows\System\QOdSOUU.exe
  2⤵
  PID:4884
- C:\Windows\System\cVEdYgT.exe
  C:\Windows\System\cVEdYgT.exe
  2⤵
  PID:4900
- C:\Windows\System\CLLOfQL.exe
  C:\Windows\System\CLLOfQL.exe
  2⤵
  PID:4916
- C:\Windows\System\kTibBHJ.exe
  C:\Windows\System\kTibBHJ.exe
  2⤵
  PID:4932
- C:\Windows\System\WlxjIqK.exe
  C:\Windows\System\WlxjIqK.exe
  2⤵
  PID:4948
- C:\Windows\System\wYujxtl.exe
  C:\Windows\System\wYujxtl.exe
  2⤵
  PID:4964
- C:\Windows\System\GgkaujK.exe
  C:\Windows\System\GgkaujK.exe
  2⤵
  PID:4980
- C:\Windows\System\FSOfyco.exe
  C:\Windows\System\FSOfyco.exe
  2⤵
  PID:4996
- C:\Windows\System\twwMpQK.exe
  C:\Windows\System\twwMpQK.exe
  2⤵
  PID:5012
- C:\Windows\System\aAkoJqx.exe
  C:\Windows\System\aAkoJqx.exe
  2⤵
  PID:5028
- C:\Windows\System\ZCkVsUL.exe
  C:\Windows\System\ZCkVsUL.exe
  2⤵
  PID:5044
- C:\Windows\System\tYKPKgp.exe
  C:\Windows\System\tYKPKgp.exe
  2⤵
  PID:5060
- C:\Windows\System\zxhrlVI.exe
  C:\Windows\System\zxhrlVI.exe
  2⤵
  PID:5076
- C:\Windows\System\nPrbjgJ.exe
  C:\Windows\System\nPrbjgJ.exe
  2⤵
  PID:5092
- C:\Windows\System\CnOZMZP.exe
  C:\Windows\System\CnOZMZP.exe
  2⤵
  PID:5108
- C:\Windows\System\nuhuuwh.exe
  C:\Windows\System\nuhuuwh.exe
  2⤵
  PID:3880
- C:\Windows\System\zoWjRIG.exe
  C:\Windows\System\zoWjRIG.exe
  2⤵
  PID:3864
- C:\Windows\System\JDXPbIg.exe
  C:\Windows\System\JDXPbIg.exe
  2⤵
  PID:4020
- C:\Windows\System\LuClDMU.exe
  C:\Windows\System\LuClDMU.exe
  2⤵
  PID:4088
- C:\Windows\System\pEYthQZ.exe
  C:\Windows\System\pEYthQZ.exe
  2⤵
  PID:1912
- C:\Windows\System\nMDheLK.exe
  C:\Windows\System\nMDheLK.exe
  2⤵
  PID:3264
- C:\Windows\System\koYVlPQ.exe
  C:\Windows\System\koYVlPQ.exe
  2⤵
  PID:3256
- C:\Windows\System\LXNdXjh.exe
  C:\Windows\System\LXNdXjh.exe
  2⤵
  PID:3620
- C:\Windows\System\QlLWAQH.exe
  C:\Windows\System\QlLWAQH.exe
  2⤵
  PID:3768
- C:\Windows\System\sjCWUhP.exe
  C:\Windows\System\sjCWUhP.exe
  2⤵
  PID:4128
- C:\Windows\System\cVZXCti.exe
  C:\Windows\System\cVZXCti.exe
  2⤵
  PID:2828
- C:\Windows\System\EZkegTU.exe
  C:\Windows\System\EZkegTU.exe
  2⤵
  PID:4052
- C:\Windows\System\BidtCEY.exe
  C:\Windows\System\BidtCEY.exe
  2⤵
  PID:2072
- C:\Windows\System\cLcZCmJ.exe
  C:\Windows\System\cLcZCmJ.exe
  2⤵
  PID:2788
- C:\Windows\System\hqAIGIr.exe
  C:\Windows\System\hqAIGIr.exe
  2⤵
  PID:4148
- C:\Windows\System\oQYxzBa.exe
  C:\Windows\System\oQYxzBa.exe
  2⤵
  PID:4168
- C:\Windows\System\vMAaWiZ.exe
  C:\Windows\System\vMAaWiZ.exe
  2⤵
  PID:4184
- C:\Windows\System\wXAZDsU.exe
  C:\Windows\System\wXAZDsU.exe
  2⤵
  PID:4200
- C:\Windows\System\ysHJgBd.exe
  C:\Windows\System\ysHJgBd.exe
  2⤵
  PID:3368
- C:\Windows\System\ZyJpzbt.exe
  C:\Windows\System\ZyJpzbt.exe
  2⤵
  PID:3356
- C:\Windows\System\leYlLsE.exe
  C:\Windows\System\leYlLsE.exe
  2⤵
  PID:3888
- C:\Windows\System\vIYvbwM.exe
  C:\Windows\System\vIYvbwM.exe
  2⤵
  PID:2632
- C:\Windows\System\scnFIwz.exe
  C:\Windows\System\scnFIwz.exe
  2⤵
  PID:3588
- C:\Windows\System\ULEUdHo.exe
  C:\Windows\System\ULEUdHo.exe
  2⤵
  PID:3464
- C:\Windows\System\Bjwnxct.exe
  C:\Windows\System\Bjwnxct.exe
  2⤵
  PID:4344
- C:\Windows\System\TpoggEh.exe
  C:\Windows\System\TpoggEh.exe
  2⤵
  PID:4416
- C:\Windows\System\uRWGpLq.exe
  C:\Windows\System\uRWGpLq.exe
  2⤵
  PID:4784
- C:\Windows\System\QSqTyju.exe
  C:\Windows\System\QSqTyju.exe
  2⤵
  PID:4404
- C:\Windows\System\yoCaKGJ.exe
  C:\Windows\System\yoCaKGJ.exe
  2⤵
  PID:4432
- C:\Windows\System\WpCEwjQ.exe
  C:\Windows\System\WpCEwjQ.exe
  2⤵
  PID:4628
- C:\Windows\System\VSxHWep.exe
  C:\Windows\System\VSxHWep.exe
  2⤵
  PID:2884
- C:\Windows\System\gsLPlGv.exe
  C:\Windows\System\gsLPlGv.exe
  2⤵
  PID:2452
- C:\Windows\System\fBJWYgE.exe
  C:\Windows\System\fBJWYgE.exe
  2⤵
  PID:4864
- C:\Windows\System\onKeYfD.exe
  C:\Windows\System\onKeYfD.exe
  2⤵
  PID:4928
- C:\Windows\System\yyLuZmU.exe
  C:\Windows\System\yyLuZmU.exe
  2⤵
  PID:4860
- C:\Windows\System\PLKTbEc.exe
  C:\Windows\System\PLKTbEc.exe
  2⤵
  PID:4908
- C:\Windows\System\aUHOOPj.exe
  C:\Windows\System\aUHOOPj.exe
  2⤵
  PID:4944
- C:\Windows\System\baXsRWt.exe
  C:\Windows\System\baXsRWt.exe
  2⤵
  PID:4976
- C:\Windows\System\MyCzqNz.exe
  C:\Windows\System\MyCzqNz.exe
  2⤵
  PID:4036
- C:\Windows\System\bkletBK.exe
  C:\Windows\System\bkletBK.exe
  2⤵
  PID:4040
- C:\Windows\System\vKmIEZC.exe
  C:\Windows\System\vKmIEZC.exe
  2⤵
  PID:3460
- C:\Windows\System\bCYKsMV.exe
  C:\Windows\System\bCYKsMV.exe
  2⤵
  PID:5116
- C:\Windows\System\yAxPoqe.exe
  C:\Windows\System\yAxPoqe.exe
  2⤵
  PID:2372
- C:\Windows\System\QEUiaiR.exe
  C:\Windows\System\QEUiaiR.exe
  2⤵
  PID:3640
- C:\Windows\System\vsKshyO.exe
  C:\Windows\System\vsKshyO.exe
  2⤵
  PID:3284
- C:\Windows\System\VBeLqDq.exe
  C:\Windows\System\VBeLqDq.exe
  2⤵
  PID:4140
- C:\Windows\System\fklNOmH.exe
  C:\Windows\System\fklNOmH.exe
  2⤵
  PID:4164
- C:\Windows\System\ejsNGBf.exe
  C:\Windows\System\ejsNGBf.exe
  2⤵
  PID:4180
- C:\Windows\System\ObeGyQr.exe
  C:\Windows\System\ObeGyQr.exe
  2⤵
  PID:4220
- C:\Windows\System\EkgzwNv.exe
  C:\Windows\System\EkgzwNv.exe
  2⤵
  PID:3968
- C:\Windows\System\rUSFsRL.exe
  C:\Windows\System\rUSFsRL.exe
  2⤵
  PID:4236
- C:\Windows\System\XEvYQCj.exe
  C:\Windows\System\XEvYQCj.exe
  2⤵
  PID:1864
- C:\Windows\System\WeHEPgj.exe
  C:\Windows\System\WeHEPgj.exe
  2⤵
  PID:3840
- C:\Windows\System\RoREDec.exe
  C:\Windows\System\RoREDec.exe
  2⤵
  PID:4276
- C:\Windows\System\htrwVOU.exe
  C:\Windows\System\htrwVOU.exe
  2⤵
  PID:3536
- C:\Windows\System\OqgPnle.exe
  C:\Windows\System\OqgPnle.exe
  2⤵
  PID:3504
- C:\Windows\System\hozBkaA.exe
  C:\Windows\System\hozBkaA.exe
  2⤵
  PID:4484
- C:\Windows\System\oVAAzRV.exe
  C:\Windows\System\oVAAzRV.exe
  2⤵
  PID:4516
- C:\Windows\System\YDNKOoE.exe
  C:\Windows\System\YDNKOoE.exe
  2⤵
  PID:4616
- C:\Windows\System\uZAskoj.exe
  C:\Windows\System\uZAskoj.exe
  2⤵
  PID:4708
- C:\Windows\System\QXHIwDX.exe
  C:\Windows\System\QXHIwDX.exe
  2⤵
  PID:4716
- C:\Windows\System\IvkpkZd.exe
  C:\Windows\System\IvkpkZd.exe
  2⤵
  PID:4812
- C:\Windows\System\rfOaIJK.exe
  C:\Windows\System\rfOaIJK.exe
  2⤵
  PID:4364
- C:\Windows\System\unaeqeU.exe
  C:\Windows\System\unaeqeU.exe
  2⤵
  PID:2484
- C:\Windows\System\JkQOcSs.exe
  C:\Windows\System\JkQOcSs.exe
  2⤵
  PID:2456
- C:\Windows\System\joOHTOZ.exe
  C:\Windows\System\joOHTOZ.exe
  2⤵
  PID:4956
- C:\Windows\System\EDtQPVO.exe
  C:\Windows\System\EDtQPVO.exe
  2⤵
  PID:4880
- C:\Windows\System\ggAKEMC.exe
  C:\Windows\System\ggAKEMC.exe
  2⤵
  PID:4876
- C:\Windows\System\jLuuwUB.exe
  C:\Windows\System\jLuuwUB.exe
  2⤵
  PID:5036
- C:\Windows\System\iNHPETR.exe
  C:\Windows\System\iNHPETR.exe
  2⤵
  PID:1752
- C:\Windows\System\gAWostn.exe
  C:\Windows\System\gAWostn.exe
  2⤵
  PID:3728
- C:\Windows\System\PKuwIwW.exe
  C:\Windows\System\PKuwIwW.exe
  2⤵
  PID:2004
- C:\Windows\System\nTjdFco.exe
  C:\Windows\System\nTjdFco.exe
  2⤵
  PID:1584
- C:\Windows\System\kZdbZWO.exe
  C:\Windows\System\kZdbZWO.exe
  2⤵
  PID:4176
- C:\Windows\System\OCsvUEE.exe
  C:\Windows\System\OCsvUEE.exe
  2⤵
  PID:1920
- C:\Windows\System\uYniKym.exe
  C:\Windows\System\uYniKym.exe
  2⤵
  PID:3744
- C:\Windows\System\jwiBLsf.exe
  C:\Windows\System\jwiBLsf.exe
  2⤵
  PID:4248
- C:\Windows\System\gOzfZJX.exe
  C:\Windows\System\gOzfZJX.exe
  2⤵
  PID:3740
- C:\Windows\System\WytTIGy.exe
  C:\Windows\System\WytTIGy.exe
  2⤵
  PID:4108
- C:\Windows\System\JdmQXil.exe
  C:\Windows\System\JdmQXil.exe
  2⤵
  PID:4284
- C:\Windows\System\GYediCP.exe
  C:\Windows\System\GYediCP.exe
  2⤵
  PID:4552
- C:\Windows\System\xhSefZL.exe
  C:\Windows\System\xhSefZL.exe
  2⤵
  PID:4564
- C:\Windows\System\zgcJuHq.exe
  C:\Windows\System\zgcJuHq.exe
  2⤵
  PID:4400
- C:\Windows\System\glexTSX.exe
  C:\Windows\System\glexTSX.exe
  2⤵
  PID:4396
- C:\Windows\System\VSloVAM.exe
  C:\Windows\System\VSloVAM.exe
  2⤵
  PID:2212
- C:\Windows\System\PvTkElC.exe
  C:\Windows\System\PvTkElC.exe
  2⤵
  PID:4600
- C:\Windows\System\tRbxdtN.exe
  C:\Windows\System\tRbxdtN.exe
  2⤵
  PID:4728
- C:\Windows\System\uBDbYaI.exe
  C:\Windows\System\uBDbYaI.exe
  2⤵
  PID:4764
- C:\Windows\System\AzbVXNh.exe
  C:\Windows\System\AzbVXNh.exe
  2⤵
  PID:4448
- C:\Windows\System\QXsSxnV.exe
  C:\Windows\System\QXsSxnV.exe
  2⤵
  PID:4972
- C:\Windows\System\nqBjWZE.exe
  C:\Windows\System\nqBjWZE.exe
  2⤵
  PID:4216
- C:\Windows\System\pIlFvYi.exe
  C:\Windows\System\pIlFvYi.exe
  2⤵
  PID:3220
- C:\Windows\System\amFrKdj.exe
  C:\Windows\System\amFrKdj.exe
  2⤵
  PID:312
- C:\Windows\System\DZfIdGk.exe
  C:\Windows\System\DZfIdGk.exe
  2⤵
  PID:3928
- C:\Windows\System\UDJrqBb.exe
  C:\Windows\System\UDJrqBb.exe
  2⤵
  PID:4264
- C:\Windows\System\nGdeQRW.exe
  C:\Windows\System\nGdeQRW.exe
  2⤵
  PID:2504
- C:\Windows\System\tKTacvw.exe
  C:\Windows\System\tKTacvw.exe
  2⤵
  PID:4328
- C:\Windows\System\cLlRwxC.exe
  C:\Windows\System\cLlRwxC.exe
  2⤵
  PID:3600
- C:\Windows\System\OuOQzkq.exe
  C:\Windows\System\OuOQzkq.exe
  2⤵
  PID:4548
- C:\Windows\System\qZlyvWs.exe
  C:\Windows\System\qZlyvWs.exe
  2⤵
  PID:856
- C:\Windows\System\SYqdhVp.exe
  C:\Windows\System\SYqdhVp.exe
  2⤵
  PID:4612
- C:\Windows\System\DvvjuWx.exe
  C:\Windows\System\DvvjuWx.exe
  2⤵
  PID:4580
- C:\Windows\System\MtXCLMi.exe
  C:\Windows\System\MtXCLMi.exe
  2⤵
  PID:4596
- C:\Windows\System\AbBlwwl.exe
  C:\Windows\System\AbBlwwl.exe
  2⤵
  PID:4480
- C:\Windows\System\UaYeRVe.exe
  C:\Windows\System\UaYeRVe.exe
  2⤵
  PID:4748
- C:\Windows\System\WFhZsDW.exe
  C:\Windows\System\WFhZsDW.exe
  2⤵
  PID:4268
- C:\Windows\System\QjmuvAy.exe
  C:\Windows\System\QjmuvAy.exe
  2⤵
  PID:5020
- C:\Windows\System\bKpFseY.exe
  C:\Windows\System\bKpFseY.exe
  2⤵
  PID:4732
- C:\Windows\System\NJuUIad.exe
  C:\Windows\System\NJuUIad.exe
  2⤵
  PID:5088
- C:\Windows\System\JlrHhJb.exe
  C:\Windows\System\JlrHhJb.exe
  2⤵
  PID:3544
- C:\Windows\System\mwfVjqb.exe
  C:\Windows\System\mwfVjqb.exe
  2⤵
  PID:2672
- C:\Windows\System\ynrzyxJ.exe
  C:\Windows\System\ynrzyxJ.exe
  2⤵
  PID:5056
- C:\Windows\System\OvACcRe.exe
  C:\Windows\System\OvACcRe.exe
  2⤵
  PID:3580
- C:\Windows\System\xglExHg.exe
  C:\Windows\System\xglExHg.exe
  2⤵
  PID:2304
- C:\Windows\System\trHlEQd.exe
  C:\Windows\System\trHlEQd.exe
  2⤵
  PID:4452
- C:\Windows\System\IsGcPwP.exe
  C:\Windows\System\IsGcPwP.exe
  2⤵
  PID:4156
- C:\Windows\System\pjulsuc.exe
  C:\Windows\System\pjulsuc.exe
  2⤵
  PID:4940
- C:\Windows\System\WUonSpL.exe
  C:\Windows\System\WUonSpL.exe
  2⤵
  PID:2756
- C:\Windows\System\zVqgXci.exe
  C:\Windows\System\zVqgXci.exe
  2⤵
  PID:4816
- C:\Windows\System\JADawBH.exe
  C:\Windows\System\JADawBH.exe
  2⤵
  PID:2644
- C:\Windows\System\HnPFXWi.exe
  C:\Windows\System\HnPFXWi.exe
  2⤵
  PID:5124
- C:\Windows\System\XgVDwur.exe
  C:\Windows\System\XgVDwur.exe
  2⤵
  PID:5140
- C:\Windows\System\tGFBrxu.exe
  C:\Windows\System\tGFBrxu.exe
  2⤵
  PID:5160
- C:\Windows\System\VnWiqFz.exe
  C:\Windows\System\VnWiqFz.exe
  2⤵
  PID:5176
- C:\Windows\System\YApZQJl.exe
  C:\Windows\System\YApZQJl.exe
  2⤵
  PID:5192
- C:\Windows\System\RJbQFvs.exe
  C:\Windows\System\RJbQFvs.exe
  2⤵
  PID:5208
- C:\Windows\System\QFrUgGm.exe
  C:\Windows\System\QFrUgGm.exe
  2⤵
  PID:5224
- C:\Windows\System\NCFcBgS.exe
  C:\Windows\System\NCFcBgS.exe
  2⤵
  PID:5240
- C:\Windows\System\kByvbXB.exe
  C:\Windows\System\kByvbXB.exe
  2⤵
  PID:5256
- C:\Windows\System\jjnOHks.exe
  C:\Windows\System\jjnOHks.exe
  2⤵
  PID:5272
- C:\Windows\System\FHkCIXt.exe
  C:\Windows\System\FHkCIXt.exe
  2⤵
  PID:5288
- C:\Windows\System\FzQnIwc.exe
  C:\Windows\System\FzQnIwc.exe
  2⤵
  PID:5304
- C:\Windows\System\FAyrFjd.exe
  C:\Windows\System\FAyrFjd.exe
  2⤵
  PID:5320
- C:\Windows\System\XBfvIgh.exe
  C:\Windows\System\XBfvIgh.exe
  2⤵
  PID:5336
- C:\Windows\System\deFLqsT.exe
  C:\Windows\System\deFLqsT.exe
  2⤵
  PID:5352
- C:\Windows\System\mOhEtMN.exe
  C:\Windows\System\mOhEtMN.exe
  2⤵
  PID:5368
- C:\Windows\System\nlIZrrX.exe
  C:\Windows\System\nlIZrrX.exe
  2⤵
  PID:5384
- C:\Windows\System\ppGwELl.exe
  C:\Windows\System\ppGwELl.exe
  2⤵
  PID:5400
- C:\Windows\System\fXKcXBs.exe
  C:\Windows\System\fXKcXBs.exe
  2⤵
  PID:5416
- C:\Windows\System\tezWGql.exe
  C:\Windows\System\tezWGql.exe
  2⤵
  PID:5432
- C:\Windows\System\mvFdTQy.exe
  C:\Windows\System\mvFdTQy.exe
  2⤵
  PID:5448
- C:\Windows\System\XEOLQSK.exe
  C:\Windows\System\XEOLQSK.exe
  2⤵
  PID:5580
- C:\Windows\System\PbnlpRk.exe
  C:\Windows\System\PbnlpRk.exe
  2⤵
  PID:5596
- C:\Windows\System\MfTYjlZ.exe
  C:\Windows\System\MfTYjlZ.exe
  2⤵
  PID:5612
- C:\Windows\System\LNHCPQn.exe
  C:\Windows\System\LNHCPQn.exe
  2⤵
  PID:5628
- C:\Windows\System\SkGpRKg.exe
  C:\Windows\System\SkGpRKg.exe
  2⤵
  PID:5644
- C:\Windows\System\mvquVvQ.exe
  C:\Windows\System\mvquVvQ.exe
  2⤵
  PID:5664
- C:\Windows\System\TaNXOuN.exe
  C:\Windows\System\TaNXOuN.exe
  2⤵
  PID:5680
- C:\Windows\System\ZtlyFAP.exe
  C:\Windows\System\ZtlyFAP.exe
  2⤵
  PID:5696
- C:\Windows\System\mXmjFEe.exe
  C:\Windows\System\mXmjFEe.exe
  2⤵
  PID:5712
- C:\Windows\System\DjAVBic.exe
  C:\Windows\System\DjAVBic.exe
  2⤵
  PID:5728
- C:\Windows\System\zbOefbP.exe
  C:\Windows\System\zbOefbP.exe
  2⤵
  PID:5744
- C:\Windows\System\NLRbPMG.exe
  C:\Windows\System\NLRbPMG.exe
  2⤵
  PID:5764
- C:\Windows\System\ZDjWCiC.exe
  C:\Windows\System\ZDjWCiC.exe
  2⤵
  PID:5780
- C:\Windows\System\SvDkkMg.exe
  C:\Windows\System\SvDkkMg.exe
  2⤵
  PID:5796
- C:\Windows\System\AtZPGEl.exe
  C:\Windows\System\AtZPGEl.exe
  2⤵
  PID:5812
- C:\Windows\System\WufDHAh.exe
  C:\Windows\System\WufDHAh.exe
  2⤵
  PID:5828
- C:\Windows\System\uaIChwu.exe
  C:\Windows\System\uaIChwu.exe
  2⤵
  PID:5844
- C:\Windows\System\bKajdPO.exe
  C:\Windows\System\bKajdPO.exe
  2⤵
  PID:5860
- C:\Windows\System\FLqXbfr.exe
  C:\Windows\System\FLqXbfr.exe
  2⤵
  PID:5880
- C:\Windows\System\egucZBS.exe
  C:\Windows\System\egucZBS.exe
  2⤵
  PID:5896
- C:\Windows\System\JVVYBDt.exe
  C:\Windows\System\JVVYBDt.exe
  2⤵
  PID:5916
- C:\Windows\System\NGMGunK.exe
  C:\Windows\System\NGMGunK.exe
  2⤵
  PID:6024
- C:\Windows\System\qZxoHYn.exe
  C:\Windows\System\qZxoHYn.exe
  2⤵
  PID:6040
- C:\Windows\System\vebbyny.exe
  C:\Windows\System\vebbyny.exe
  2⤵
  PID:6056
- C:\Windows\System\dfrrIJi.exe
  C:\Windows\System\dfrrIJi.exe
  2⤵
  PID:6072
- C:\Windows\System\BLdwqaB.exe
  C:\Windows\System\BLdwqaB.exe
  2⤵
  PID:6088
- C:\Windows\System\cuMOjIZ.exe
  C:\Windows\System\cuMOjIZ.exe
  2⤵
  PID:6104
- C:\Windows\System\wbeAQrr.exe
  C:\Windows\System\wbeAQrr.exe
  2⤵
  PID:6120
- C:\Windows\System\luybXuO.exe
  C:\Windows\System\luybXuO.exe
  2⤵
  PID:6136
- C:\Windows\System\gLCGxoN.exe
  C:\Windows\System\gLCGxoN.exe
  2⤵
  PID:2192
- C:\Windows\System\ubUoeai.exe
  C:\Windows\System\ubUoeai.exe
  2⤵
  PID:2324
- C:\Windows\System\BMUfSuP.exe
  C:\Windows\System\BMUfSuP.exe
  2⤵
  PID:5216
- C:\Windows\System\HezxJIR.exe
  C:\Windows\System\HezxJIR.exe
  2⤵
  PID:4240
- C:\Windows\System\ZnitbvI.exe
  C:\Windows\System\ZnitbvI.exe
  2⤵
  PID:5312
- C:\Windows\System\BKOSqHQ.exe
  C:\Windows\System\BKOSqHQ.exe
  2⤵
  PID:5380
- C:\Windows\System\BYJAbAr.exe
  C:\Windows\System\BYJAbAr.exe
  2⤵
  PID:5132
- C:\Windows\System\nTADZEm.exe
  C:\Windows\System\nTADZEm.exe
  2⤵
  PID:5200
- C:\Windows\System\iWkLJlw.exe
  C:\Windows\System\iWkLJlw.exe
  2⤵
  PID:5232
- C:\Windows\System\OOiABCv.exe
  C:\Windows\System\OOiABCv.exe
  2⤵
  PID:5300
- C:\Windows\System\AbKJMQR.exe
  C:\Windows\System\AbKJMQR.exe
  2⤵
  PID:5364
- C:\Windows\System\ifviidn.exe
  C:\Windows\System\ifviidn.exe
  2⤵
  PID:5428
- C:\Windows\System\tXicERR.exe
  C:\Windows\System\tXicERR.exe
  2⤵
  PID:5468
- C:\Windows\System\HOJqOXj.exe
  C:\Windows\System\HOJqOXj.exe
  2⤵
  PID:5484
- C:\Windows\System\ohLWuZq.exe
  C:\Windows\System\ohLWuZq.exe
  2⤵
  PID:5524
- C:\Windows\System\SsENTXd.exe
  C:\Windows\System\SsENTXd.exe
  2⤵
  PID:5540
- C:\Windows\System\katJdjU.exe
  C:\Windows\System\katJdjU.exe
  2⤵
  PID:5556
- C:\Windows\System\HeFkzqS.exe
  C:\Windows\System\HeFkzqS.exe
  2⤵
  PID:5588
- C:\Windows\System\QYKtXUn.exe
  C:\Windows\System\QYKtXUn.exe
  2⤵
  PID:5652
- C:\Windows\System\AHuoyYV.exe
  C:\Windows\System\AHuoyYV.exe
  2⤵
  PID:5720
- C:\Windows\System\FxiRvKX.exe
  C:\Windows\System\FxiRvKX.exe
  2⤵
  PID:5760
- C:\Windows\System\eabjZhi.exe
  C:\Windows\System\eabjZhi.exe
  2⤵
  PID:5708
- C:\Windows\System\njkySub.exe
  C:\Windows\System\njkySub.exe
  2⤵
  PID:5804
- C:\Windows\System\wguEmSC.exe
  C:\Windows\System\wguEmSC.exe
  2⤵
  PID:5736
- C:\Windows\System\OLFJRMq.exe
  C:\Windows\System\OLFJRMq.exe
  2⤵
  PID:5872
- C:\Windows\System\HcNjDUu.exe
  C:\Windows\System\HcNjDUu.exe
  2⤵
  PID:5928
- C:\Windows\System\kbEWRTM.exe
  C:\Windows\System\kbEWRTM.exe
  2⤵
  PID:5944
- C:\Windows\System\eSTvggj.exe
  C:\Windows\System\eSTvggj.exe
  2⤵
  PID:5964
- C:\Windows\System\qDSZjGe.exe
  C:\Windows\System\qDSZjGe.exe
  2⤵
  PID:5960
- C:\Windows\System\vBphDpa.exe
  C:\Windows\System\vBphDpa.exe
  2⤵
  PID:5996
- C:\Windows\System\XHLHusL.exe
  C:\Windows\System\XHLHusL.exe
  2⤵
  PID:6008
- C:\Windows\System\frhYSYj.exe
  C:\Windows\System\frhYSYj.exe
  2⤵
  PID:6036
- C:\Windows\System\nNAfiwp.exe
  C:\Windows\System\nNAfiwp.exe
  2⤵
  PID:6068
- C:\Windows\System\tqosEOH.exe
  C:\Windows\System\tqosEOH.exe
  2⤵
  PID:6112
- C:\Windows\System\JNCHOsU.exe
  C:\Windows\System\JNCHOsU.exe
  2⤵
  PID:6096
- C:\Windows\System\leMLtVH.exe
  C:\Windows\System\leMLtVH.exe
  2⤵
  PID:5252
- C:\Windows\System\gnLOkwC.exe
  C:\Windows\System\gnLOkwC.exe
  2⤵
  PID:5348
- C:\Windows\System\WATekqD.exe
  C:\Windows\System\WATekqD.exe
  2⤵
  PID:5280
- C:\Windows\System\vtoctYR.exe
  C:\Windows\System\vtoctYR.exe
  2⤵
  PID:4360
- C:\Windows\System\IdDMZwe.exe
  C:\Windows\System\IdDMZwe.exe
  2⤵
  PID:5332
- C:\Windows\System\UqisFpV.exe
  C:\Windows\System\UqisFpV.exe
  2⤵
  PID:5396
- C:\Windows\System\wJacHCa.exe
  C:\Windows\System\wJacHCa.exe
  2⤵
  PID:5460
- C:\Windows\System\PhazsbS.exe
  C:\Windows\System\PhazsbS.exe
  2⤵
  PID:5504
- C:\Windows\System\PKBPHSz.exe
  C:\Windows\System\PKBPHSz.exe
  2⤵
  PID:5496
- C:\Windows\System\BxAsHsl.exe
  C:\Windows\System\BxAsHsl.exe
  2⤵
  PID:5892
- C:\Windows\System\ahESrSv.exe
  C:\Windows\System\ahESrSv.exe
  2⤵
  PID:5692
- C:\Windows\System\lbCPaBQ.exe
  C:\Windows\System\lbCPaBQ.exe
  2⤵
  PID:5820
- C:\Windows\System\PpzGAli.exe
  C:\Windows\System\PpzGAli.exe
  2⤵
  PID:5564
- C:\Windows\System\hpprWGu.exe
  C:\Windows\System\hpprWGu.exe
  2⤵
  PID:5704
- C:\Windows\System\LvjQQFY.exe
  C:\Windows\System\LvjQQFY.exe
  2⤵
  PID:5772
- C:\Windows\System\OVuKwDa.exe
  C:\Windows\System\OVuKwDa.exe
  2⤵
  PID:5940
- C:\Windows\System\NSEMXbx.exe
  C:\Windows\System\NSEMXbx.exe
  2⤵
  PID:5952
- C:\Windows\System\DfxSDmA.exe
  C:\Windows\System\DfxSDmA.exe
  2⤵
  PID:6084
- C:\Windows\System\epmJTWS.exe
  C:\Windows\System\epmJTWS.exe
  2⤵
  PID:6052
- C:\Windows\System\yVzveNt.exe
  C:\Windows\System\yVzveNt.exe
  2⤵
  PID:5236
- C:\Windows\System\eMruSer.exe
  C:\Windows\System\eMruSer.exe
  2⤵
  PID:5620
- C:\Windows\System\nqZqaZs.exe
  C:\Windows\System\nqZqaZs.exe
  2⤵
  PID:6116
- C:\Windows\System\SAPmMej.exe
  C:\Windows\System\SAPmMej.exe
  2⤵
  PID:5520
- C:\Windows\System\NmOcNYv.exe
  C:\Windows\System\NmOcNYv.exe
  2⤵
  PID:5444
- C:\Windows\System\qYGICKR.exe
  C:\Windows\System\qYGICKR.exe
  2⤵
  PID:5532
- C:\Windows\System\XXgWQRs.exe
  C:\Windows\System\XXgWQRs.exe
  2⤵
  PID:5592
- C:\Windows\System\DKrnoDu.exe
  C:\Windows\System\DKrnoDu.exe
  2⤵
  PID:4680
- C:\Windows\System\vTUsfyO.exe
  C:\Windows\System\vTUsfyO.exe
  2⤵
  PID:5824
- C:\Windows\System\JBeJQpy.exe
  C:\Windows\System\JBeJQpy.exe
  2⤵
  PID:5868
- C:\Windows\System\LqqbFuF.exe
  C:\Windows\System\LqqbFuF.exe
  2⤵
  PID:5492
- C:\Windows\System\GSoaOJo.exe
  C:\Windows\System\GSoaOJo.exe
  2⤵
  PID:5476
- C:\Windows\System\gNvJCWh.exe
  C:\Windows\System\gNvJCWh.exe
  2⤵
  PID:6020
- C:\Windows\System\Uykkmeh.exe
  C:\Windows\System\Uykkmeh.exe
  2⤵
  PID:5360
- C:\Windows\System\BbeUqMw.exe
  C:\Windows\System\BbeUqMw.exe
  2⤵
  PID:5480
- C:\Windows\System\yOIqvnt.exe
  C:\Windows\System\yOIqvnt.exe
  2⤵
  PID:6004
- C:\Windows\System\KRVandS.exe
  C:\Windows\System\KRVandS.exe
  2⤵
  PID:5756
- C:\Windows\System\tXQabRH.exe
  C:\Windows\System\tXQabRH.exe
  2⤵
  PID:5856
- C:\Windows\System\hqhmXQl.exe
  C:\Windows\System\hqhmXQl.exe
  2⤵
  PID:5604
- C:\Windows\System\kWHrpIO.exe
  C:\Windows\System\kWHrpIO.exe
  2⤵
  PID:5188
- C:\Windows\System\PEYnymq.exe
  C:\Windows\System\PEYnymq.exe
  2⤵
  PID:5912
- C:\Windows\System\VXtaure.exe
  C:\Windows\System\VXtaure.exe
  2⤵
  PID:5148
- C:\Windows\System\gLcKsbe.exe
  C:\Windows\System\gLcKsbe.exe
  2⤵
  PID:5908
- C:\Windows\System\bdzvovc.exe
  C:\Windows\System\bdzvovc.exe
  2⤵
  PID:5512
- C:\Windows\System\fDWQuRU.exe
  C:\Windows\System\fDWQuRU.exe
  2⤵
  PID:5972
- C:\Windows\System\aXpSJIj.exe
  C:\Windows\System\aXpSJIj.exe
  2⤵
  PID:6080
- C:\Windows\System\NZNGQkh.exe
  C:\Windows\System\NZNGQkh.exe
  2⤵
  PID:1664
- C:\Windows\System\fEGJSTR.exe
  C:\Windows\System\fEGJSTR.exe
  2⤵
  PID:6164
- C:\Windows\System\dFwsxUQ.exe
  C:\Windows\System\dFwsxUQ.exe
  2⤵
  PID:6180
- C:\Windows\System\RSwusyP.exe
  C:\Windows\System\RSwusyP.exe
  2⤵
  PID:6196
- C:\Windows\System\DHmVojT.exe
  C:\Windows\System\DHmVojT.exe
  2⤵
  PID:6212
- C:\Windows\System\eBOglrX.exe
  C:\Windows\System\eBOglrX.exe
  2⤵
  PID:6228
- C:\Windows\System\MEuBSfX.exe
  C:\Windows\System\MEuBSfX.exe
  2⤵
  PID:6244
- C:\Windows\System\SXzpYlc.exe
  C:\Windows\System\SXzpYlc.exe
  2⤵
  PID:6260
- C:\Windows\System\cIDVLeI.exe
  C:\Windows\System\cIDVLeI.exe
  2⤵
  PID:6276
- C:\Windows\System\OgcxsYP.exe
  C:\Windows\System\OgcxsYP.exe
  2⤵
  PID:6292
- C:\Windows\System\gQDlQfq.exe
  C:\Windows\System\gQDlQfq.exe
  2⤵
  PID:6308
- C:\Windows\System\JzSNYKD.exe
  C:\Windows\System\JzSNYKD.exe
  2⤵
  PID:6324
- C:\Windows\System\EaQSmxA.exe
  C:\Windows\System\EaQSmxA.exe
  2⤵
  PID:6340
- C:\Windows\System\HkUchdk.exe
  C:\Windows\System\HkUchdk.exe
  2⤵
  PID:6356
- C:\Windows\System\ROvlNjR.exe
  C:\Windows\System\ROvlNjR.exe
  2⤵
  PID:6372
- C:\Windows\System\pwNTLJl.exe
  C:\Windows\System\pwNTLJl.exe
  2⤵
  PID:6388
- C:\Windows\System\NyaGaNY.exe
  C:\Windows\System\NyaGaNY.exe
  2⤵
  PID:6404
- C:\Windows\System\eEYZSJZ.exe
  C:\Windows\System\eEYZSJZ.exe
  2⤵
  PID:6420
- C:\Windows\System\iBcBsQS.exe
  C:\Windows\System\iBcBsQS.exe
  2⤵
  PID:6436
- C:\Windows\System\VZqtJxi.exe
  C:\Windows\System\VZqtJxi.exe
  2⤵
  PID:6452
- C:\Windows\System\bAESenA.exe
  C:\Windows\System\bAESenA.exe
  2⤵
  PID:6468
- C:\Windows\System\HqopNZT.exe
  C:\Windows\System\HqopNZT.exe
  2⤵
  PID:6484
- C:\Windows\System\GCtiLjw.exe
  C:\Windows\System\GCtiLjw.exe
  2⤵
  PID:6500
- C:\Windows\System\PJveNBb.exe
  C:\Windows\System\PJveNBb.exe
  2⤵
  PID:6516
- C:\Windows\System\kJPgZRn.exe
  C:\Windows\System\kJPgZRn.exe
  2⤵
  PID:6532
- C:\Windows\System\wucBPuj.exe
  C:\Windows\System\wucBPuj.exe
  2⤵
  PID:6548
- C:\Windows\System\NghgCfd.exe
  C:\Windows\System\NghgCfd.exe
  2⤵
  PID:6564
- C:\Windows\System\jmvQatq.exe
  C:\Windows\System\jmvQatq.exe
  2⤵
  PID:6580
- C:\Windows\System\gcByEGL.exe
  C:\Windows\System\gcByEGL.exe
  2⤵
  PID:6596
- C:\Windows\System\vkGoojN.exe
  C:\Windows\System\vkGoojN.exe
  2⤵
  PID:6612
- C:\Windows\System\oQcvTRU.exe
  C:\Windows\System\oQcvTRU.exe
  2⤵
  PID:6628
- C:\Windows\System\RFIdmQK.exe
  C:\Windows\System\RFIdmQK.exe
  2⤵
  PID:6644
- C:\Windows\System\WiSbxSl.exe
  C:\Windows\System\WiSbxSl.exe
  2⤵
  PID:6660
- C:\Windows\System\msfNlaL.exe
  C:\Windows\System\msfNlaL.exe
  2⤵
  PID:6676
- C:\Windows\System\EBzpLir.exe
  C:\Windows\System\EBzpLir.exe
  2⤵
  PID:6692
- C:\Windows\System\qaQQhsb.exe
  C:\Windows\System\qaQQhsb.exe
  2⤵
  PID:6708
- C:\Windows\System\vOGAEJm.exe
  C:\Windows\System\vOGAEJm.exe
  2⤵
  PID:6724
- C:\Windows\System\ZraIwwu.exe
  C:\Windows\System\ZraIwwu.exe
  2⤵
  PID:6740
- C:\Windows\System\IvlXRPW.exe
  C:\Windows\System\IvlXRPW.exe
  2⤵
  PID:6756
- C:\Windows\System\UivPVEF.exe
  C:\Windows\System\UivPVEF.exe
  2⤵
  PID:6776
- C:\Windows\System\DTSzOkP.exe
  C:\Windows\System\DTSzOkP.exe
  2⤵
  PID:6792
- C:\Windows\System\bcPOBoJ.exe
  C:\Windows\System\bcPOBoJ.exe
  2⤵
  PID:6808
- C:\Windows\System\vkCMLTv.exe
  C:\Windows\System\vkCMLTv.exe
  2⤵
  PID:6824
- C:\Windows\System\KppKpZR.exe
  C:\Windows\System\KppKpZR.exe
  2⤵
  PID:6840
- C:\Windows\System\tUuKhfD.exe
  C:\Windows\System\tUuKhfD.exe
  2⤵
  PID:6856
- C:\Windows\System\cBSicIZ.exe
  C:\Windows\System\cBSicIZ.exe
  2⤵
  PID:6872
- C:\Windows\System\YztRKoX.exe
  C:\Windows\System\YztRKoX.exe
  2⤵
  PID:6888
- C:\Windows\System\eHnVMAe.exe
  C:\Windows\System\eHnVMAe.exe
  2⤵
  PID:6904
- C:\Windows\System\taRtdmn.exe
  C:\Windows\System\taRtdmn.exe
  2⤵
  PID:6920
- C:\Windows\System\vXqbMlu.exe
  C:\Windows\System\vXqbMlu.exe
  2⤵
  PID:6936
- C:\Windows\System\VIwnoKj.exe
  C:\Windows\System\VIwnoKj.exe
  2⤵
  PID:6952
- C:\Windows\System\AnPQzeL.exe
  C:\Windows\System\AnPQzeL.exe
  2⤵
  PID:6968
- C:\Windows\System\CakhPdU.exe
  C:\Windows\System\CakhPdU.exe
  2⤵
  PID:6984
- C:\Windows\System\SuSrdts.exe
  C:\Windows\System\SuSrdts.exe
  2⤵
  PID:7004
- C:\Windows\System\itmFjZW.exe
  C:\Windows\System\itmFjZW.exe
  2⤵
  PID:7020
- C:\Windows\System\MCerjjw.exe
  C:\Windows\System\MCerjjw.exe
  2⤵
  PID:7036
- C:\Windows\System\mJZKpFM.exe
  C:\Windows\System\mJZKpFM.exe
  2⤵
  PID:7052
- C:\Windows\System\csWFwyF.exe
  C:\Windows\System\csWFwyF.exe
  2⤵
  PID:7068
- C:\Windows\System\EQAtPQj.exe
  C:\Windows\System\EQAtPQj.exe
  2⤵
  PID:7084
- C:\Windows\System\SzTkPgi.exe
  C:\Windows\System\SzTkPgi.exe
  2⤵
  PID:7100
- C:\Windows\System\nGoniYs.exe
  C:\Windows\System\nGoniYs.exe
  2⤵
  PID:7116
- C:\Windows\System\CjZNrlK.exe
  C:\Windows\System\CjZNrlK.exe
  2⤵
  PID:7136
- C:\Windows\System\hCiIbEf.exe
  C:\Windows\System\hCiIbEf.exe
  2⤵
  PID:7152
- C:\Windows\System\zcEmmCR.exe
  C:\Windows\System\zcEmmCR.exe
  2⤵
  PID:5296
- C:\Windows\System\axQZbLH.exe
  C:\Windows\System\axQZbLH.exe
  2⤵
  PID:6156
- C:\Windows\System\DXJkVQj.exe
  C:\Windows\System\DXJkVQj.exe
  2⤵
  PID:6188
- C:\Windows\System\DlrqlHM.exe
  C:\Windows\System\DlrqlHM.exe
  2⤵
  PID:6236
- C:\Windows\System\iAJAWCj.exe
  C:\Windows\System\iAJAWCj.exe
  2⤵
  PID:6268
- C:\Windows\System\eLzZcIu.exe
  C:\Windows\System\eLzZcIu.exe
  2⤵
  PID:6300
- C:\Windows\System\kdYtKAW.exe
  C:\Windows\System\kdYtKAW.exe
  2⤵
  PID:6368
- C:\Windows\System\bqXmuuI.exe
  C:\Windows\System\bqXmuuI.exe
  2⤵
  PID:6428
- C:\Windows\System\wkZeYLq.exe
  C:\Windows\System\wkZeYLq.exe
  2⤵
  PID:6320
- C:\Windows\System\OUcqarM.exe
  C:\Windows\System\OUcqarM.exe
  2⤵
  PID:6348
- C:\Windows\System\ppQbAIX.exe
  C:\Windows\System\ppQbAIX.exe
  2⤵
  PID:6384
- C:\Windows\System\tnsCCXJ.exe
  C:\Windows\System\tnsCCXJ.exe
  2⤵
  PID:6448
- C:\Windows\System\WDxMRGM.exe
  C:\Windows\System\WDxMRGM.exe
  2⤵
  PID:6556
- C:\Windows\System\HOgOkMv.exe
  C:\Windows\System\HOgOkMv.exe
  2⤵
  PID:6540
- C:\Windows\System\iYLHZzU.exe
  C:\Windows\System\iYLHZzU.exe
  2⤵
  PID:6572
- C:\Windows\System\ZwixZgc.exe
  C:\Windows\System\ZwixZgc.exe
  2⤵
  PID:6620
- C:\Windows\System\YGjJfSi.exe
  C:\Windows\System\YGjJfSi.exe
  2⤵
  PID:6652
- C:\Windows\System\ywDLuox.exe
  C:\Windows\System\ywDLuox.exe
  2⤵
  PID:6684
- C:\Windows\System\jIxONtG.exe
  C:\Windows\System\jIxONtG.exe
  2⤵
  PID:6720
- C:\Windows\System\OQQicAM.exe
  C:\Windows\System\OQQicAM.exe
  2⤵
  PID:6704
- C:\Windows\System\ALIfrBC.exe
  C:\Windows\System\ALIfrBC.exe
  2⤵
  PID:6764
- C:\Windows\System\GkjBCqC.exe
  C:\Windows\System\GkjBCqC.exe
  2⤵
  PID:6788
- C:\Windows\System\aUUBvjY.exe
  C:\Windows\System\aUUBvjY.exe
  2⤵
  PID:6820
- C:\Windows\System\brJKNzt.exe
  C:\Windows\System\brJKNzt.exe
  2⤵
  PID:6832
- C:\Windows\System\CWzoPHz.exe
  C:\Windows\System\CWzoPHz.exe
  2⤵
  PID:6864
- C:\Windows\System\nxDUdre.exe
  C:\Windows\System\nxDUdre.exe
  2⤵
  PID:6944
- C:\Windows\System\OdMddHj.exe
  C:\Windows\System\OdMddHj.exe
  2⤵
  PID:6976
- C:\Windows\System\LFlHubz.exe
  C:\Windows\System\LFlHubz.exe
  2⤵
  PID:7016
- C:\Windows\System\uKhKxHX.exe
  C:\Windows\System\uKhKxHX.exe
  2⤵
  PID:6996
- C:\Windows\System\MJfjLjc.exe
  C:\Windows\System\MJfjLjc.exe
  2⤵
  PID:7076
- C:\Windows\System\YagTFew.exe
  C:\Windows\System\YagTFew.exe
  2⤵
  PID:7092
- C:\Windows\System\lQIRYmC.exe
  C:\Windows\System\lQIRYmC.exe
  2⤵
  PID:7148
- C:\Windows\System\YrvqyUF.exe
  C:\Windows\System\YrvqyUF.exe
  2⤵
  PID:7096
- C:\Windows\System\lkvctbK.exe
  C:\Windows\System\lkvctbK.exe
  2⤵
  PID:6176
- C:\Windows\System\nCgElXt.exe
  C:\Windows\System\nCgElXt.exe
  2⤵
  PID:6160
- C:\Windows\System\akxedCn.exe
  C:\Windows\System\akxedCn.exe
  2⤵
  PID:6396
- C:\Windows\System\xLIhvEN.exe
  C:\Windows\System\xLIhvEN.exe
  2⤵
  PID:6416
- C:\Windows\System\MfxJfQL.exe
  C:\Windows\System\MfxJfQL.exe
  2⤵
  PID:6336
- C:\Windows\System\fdWQBUc.exe
  C:\Windows\System\fdWQBUc.exe
  2⤵
  PID:6524
- C:\Windows\System\pRCITvE.exe
  C:\Windows\System\pRCITvE.exe
  2⤵
  PID:6576
- C:\Windows\System\yOwzSvv.exe
  C:\Windows\System\yOwzSvv.exe
  2⤵
  PID:6752
- C:\Windows\System\pXroPig.exe
  C:\Windows\System\pXroPig.exe
  2⤵
  PID:6668
- C:\Windows\System\orsNELU.exe
  C:\Windows\System\orsNELU.exe
  2⤵
  PID:5976
- C:\Windows\System\aETnsJD.exe
  C:\Windows\System\aETnsJD.exe
  2⤵
  PID:6816
- C:\Windows\System\EOUaFyw.exe
  C:\Windows\System\EOUaFyw.exe
  2⤵
  PID:6900
- C:\Windows\System\oMRmEWl.exe
  C:\Windows\System\oMRmEWl.exe
  2⤵
  PID:7032
- C:\Windows\System\YdpOSLi.exe
  C:\Windows\System\YdpOSLi.exe
  2⤵
  PID:6332
- C:\Windows\System\kIZPmwh.exe
  C:\Windows\System\kIZPmwh.exe
  2⤵
  PID:6480
- C:\Windows\System\XHZprgl.exe
  C:\Windows\System\XHZprgl.exe
  2⤵
  PID:6544
- C:\Windows\System\ZuIMGEa.exe
  C:\Windows\System\ZuIMGEa.exe
  2⤵
  PID:7012
- C:\Windows\System\FDafhSr.exe
  C:\Windows\System\FDafhSr.exe
  2⤵
  PID:6476
- C:\Windows\System\KprXGXU.exe
  C:\Windows\System\KprXGXU.exe
  2⤵
  PID:7000
- C:\Windows\System\izLuJcS.exe
  C:\Windows\System\izLuJcS.exe
  2⤵
  PID:6152
- C:\Windows\System\XnQGPaD.exe
  C:\Windows\System\XnQGPaD.exe
  2⤵
  PID:6316
- C:\Windows\System\oCUZsWc.exe
  C:\Windows\System\oCUZsWc.exe
  2⤵
  PID:7164
- C:\Windows\System\xeGOkej.exe
  C:\Windows\System\xeGOkej.exe
  2⤵
  PID:6656
- C:\Windows\System\kqeAfJQ.exe
  C:\Windows\System\kqeAfJQ.exe
  2⤵
  PID:6224
- C:\Windows\System\TtoXBsQ.exe
  C:\Windows\System\TtoXBsQ.exe
  2⤵
  PID:7160
- C:\Windows\System\LMjfOAz.exe
  C:\Windows\System\LMjfOAz.exe
  2⤵
  PID:7028
- C:\Windows\System\EGVWOSL.exe
  C:\Windows\System\EGVWOSL.exe
  2⤵
  PID:7176
- C:\Windows\System\afBeBaz.exe
  C:\Windows\System\afBeBaz.exe
  2⤵
  PID:7196
- C:\Windows\System\TCeobWF.exe
  C:\Windows\System\TCeobWF.exe
  2⤵
  PID:7212
- C:\Windows\System\gCKYXmm.exe
  C:\Windows\System\gCKYXmm.exe
  2⤵
  PID:7228
- C:\Windows\System\qUcsgsD.exe
  C:\Windows\System\qUcsgsD.exe
  2⤵
  PID:7244
- C:\Windows\System\lQEBhLS.exe
  C:\Windows\System\lQEBhLS.exe
  2⤵
  PID:7264
- C:\Windows\System\YZrszYb.exe
  C:\Windows\System\YZrszYb.exe
  2⤵
  PID:7280
- C:\Windows\System\TltPFlx.exe
  C:\Windows\System\TltPFlx.exe
  2⤵
  PID:7304
- C:\Windows\System\RTULxOI.exe
  C:\Windows\System\RTULxOI.exe
  2⤵
  PID:7320
- C:\Windows\System\tbnUtFx.exe
  C:\Windows\System\tbnUtFx.exe
  2⤵
  PID:7336
- C:\Windows\System\eCbISlt.exe
  C:\Windows\System\eCbISlt.exe
  2⤵
  PID:7352
- C:\Windows\System\SpNsQzf.exe
  C:\Windows\System\SpNsQzf.exe
  2⤵
  PID:7368
- C:\Windows\System\poIoAPI.exe
  C:\Windows\System\poIoAPI.exe
  2⤵
  PID:7388
- C:\Windows\System\LbhJrKv.exe
  C:\Windows\System\LbhJrKv.exe
  2⤵
  PID:7404
- C:\Windows\System\SZdxZam.exe
  C:\Windows\System\SZdxZam.exe
  2⤵
  PID:7420
- C:\Windows\System\xtrsGoI.exe
  C:\Windows\System\xtrsGoI.exe
  2⤵
  PID:7436
- C:\Windows\System\WIzLurv.exe
  C:\Windows\System\WIzLurv.exe
  2⤵
  PID:7452
- C:\Windows\System\BkbQrYv.exe
  C:\Windows\System\BkbQrYv.exe
  2⤵
  PID:7468
- C:\Windows\System\OJSCZvZ.exe
  C:\Windows\System\OJSCZvZ.exe
  2⤵
  PID:7484
- C:\Windows\System\fQtQZPa.exe
  C:\Windows\System\fQtQZPa.exe
  2⤵
  PID:7504
- C:\Windows\System\JTQZNTp.exe
  C:\Windows\System\JTQZNTp.exe
  2⤵
  PID:7520
- C:\Windows\System\MfaiZIj.exe
  C:\Windows\System\MfaiZIj.exe
  2⤵
  PID:7536
- C:\Windows\System\CKspTaD.exe
  C:\Windows\System\CKspTaD.exe
  2⤵
  PID:7552
- C:\Windows\System\tWLiwqL.exe
  C:\Windows\System\tWLiwqL.exe
  2⤵
  PID:7568
- C:\Windows\System\MMGeqFh.exe
  C:\Windows\System\MMGeqFh.exe
  2⤵
  PID:7584
- C:\Windows\System\eKVjRKY.exe
  C:\Windows\System\eKVjRKY.exe
  2⤵
  PID:7600
- C:\Windows\System\xmoYFpD.exe
  C:\Windows\System\xmoYFpD.exe
  2⤵
  PID:7616
- C:\Windows\System\gqXZWqI.exe
  C:\Windows\System\gqXZWqI.exe
  2⤵
  PID:7632
- C:\Windows\System\nUprBuo.exe
  C:\Windows\System\nUprBuo.exe
  2⤵
  PID:7648
- C:\Windows\System\OiqYjRb.exe
  C:\Windows\System\OiqYjRb.exe
  2⤵
  PID:7664
- C:\Windows\System\FoKebUb.exe
  C:\Windows\System\FoKebUb.exe
  2⤵
  PID:7680
- C:\Windows\System\oGajOnc.exe
  C:\Windows\System\oGajOnc.exe
  2⤵
  PID:7696
- C:\Windows\System\LnPOgwJ.exe
  C:\Windows\System\LnPOgwJ.exe
  2⤵
  PID:7712
- C:\Windows\System\vqyVFTC.exe
  C:\Windows\System\vqyVFTC.exe
  2⤵
  PID:7728
- C:\Windows\System\ZJvjqNt.exe
  C:\Windows\System\ZJvjqNt.exe
  2⤵
  PID:7744
- C:\Windows\System\nBBHfkl.exe
  C:\Windows\System\nBBHfkl.exe
  2⤵
  PID:7760
- C:\Windows\System\FthMBOO.exe
  C:\Windows\System\FthMBOO.exe
  2⤵
  PID:7776
- C:\Windows\System\EHMnQrE.exe
  C:\Windows\System\EHMnQrE.exe
  2⤵
  PID:7792
- C:\Windows\System\jiUuxXx.exe
  C:\Windows\System\jiUuxXx.exe
  2⤵
  PID:7808
- C:\Windows\System\MbnqLkX.exe
  C:\Windows\System\MbnqLkX.exe
  2⤵
  PID:7824
- C:\Windows\System\wZFfZlT.exe
  C:\Windows\System\wZFfZlT.exe
  2⤵
  PID:7840
- C:\Windows\System\cgHPvOe.exe
  C:\Windows\System\cgHPvOe.exe
  2⤵
  PID:7856
- C:\Windows\System\OXpBBzc.exe
  C:\Windows\System\OXpBBzc.exe
  2⤵
  PID:7872
- C:\Windows\System\gfipXaD.exe
  C:\Windows\System\gfipXaD.exe
  2⤵
  PID:7888
- C:\Windows\System\kPrbblg.exe
  C:\Windows\System\kPrbblg.exe
  2⤵
  PID:7904
- C:\Windows\System\llvSSSI.exe
  C:\Windows\System\llvSSSI.exe
  2⤵
  PID:7920
- C:\Windows\System\vQQjECG.exe
  C:\Windows\System\vQQjECG.exe
  2⤵
  PID:7936
- C:\Windows\System\DAbomZu.exe
  C:\Windows\System\DAbomZu.exe
  2⤵
  PID:7952
- C:\Windows\System\FXXaLPT.exe
  C:\Windows\System\FXXaLPT.exe
  2⤵
  PID:7968
- C:\Windows\System\JLqGFZD.exe
  C:\Windows\System\JLqGFZD.exe
  2⤵
  PID:7984
- C:\Windows\System\YGxdiVa.exe
  C:\Windows\System\YGxdiVa.exe
  2⤵
  PID:8000
- C:\Windows\System\TJrjksQ.exe
  C:\Windows\System\TJrjksQ.exe
  2⤵
  PID:8016
- C:\Windows\System\ntqvfPN.exe
  C:\Windows\System\ntqvfPN.exe
  2⤵
  PID:8032
- C:\Windows\System\JIWIYLE.exe
  C:\Windows\System\JIWIYLE.exe
  2⤵
  PID:8048
- C:\Windows\System\YabUfJj.exe
  C:\Windows\System\YabUfJj.exe
  2⤵
  PID:8064
- C:\Windows\System\nkcWhCE.exe
  C:\Windows\System\nkcWhCE.exe
  2⤵
  PID:8080
- C:\Windows\System\QkfqmHl.exe
  C:\Windows\System\QkfqmHl.exe
  2⤵
  PID:8096
- C:\Windows\System\bcmkXpW.exe
  C:\Windows\System\bcmkXpW.exe
  2⤵
  PID:8112
- C:\Windows\System\VaSKxzy.exe
  C:\Windows\System\VaSKxzy.exe
  2⤵
  PID:8128
- C:\Windows\System\pOptnUK.exe
  C:\Windows\System\pOptnUK.exe
  2⤵
  PID:8148
- C:\Windows\System\enNfGyX.exe
  C:\Windows\System\enNfGyX.exe
  2⤵
  PID:6836
- C:\Windows\System\wBTQwOQ.exe
  C:\Windows\System\wBTQwOQ.exe
  2⤵
  PID:7240
- C:\Windows\System\CEAFoGK.exe
  C:\Windows\System\CEAFoGK.exe
  2⤵
  PID:5984
- C:\Windows\System\cvNPyfJ.exe
  C:\Windows\System\cvNPyfJ.exe
  2⤵
  PID:7344
- C:\Windows\System\GmACAEi.exe
  C:\Windows\System\GmACAEi.exe
  2⤵
  PID:7192
- C:\Windows\System\YvGmvLi.exe
  C:\Windows\System\YvGmvLi.exe
  2⤵
  PID:7416
- C:\Windows\System\gpALzwZ.exe
  C:\Windows\System\gpALzwZ.exe
  2⤵
  PID:7476
- C:\Windows\System\wlHZjAg.exe
  C:\Windows\System\wlHZjAg.exe
  2⤵
  PID:6608
- C:\Windows\System\hfTeyre.exe
  C:\Windows\System\hfTeyre.exe
  2⤵
  PID:7188
- C:\Windows\System\jVhYvVT.exe
  C:\Windows\System\jVhYvVT.exe
  2⤵
  PID:7256
- C:\Windows\System\mJSNnTU.exe
  C:\Windows\System\mJSNnTU.exe
  2⤵
  PID:7300
- C:\Windows\System\klvBpmX.exe
  C:\Windows\System\klvBpmX.exe
  2⤵
  PID:7396
- C:\Windows\System\EnrnCOg.exe
  C:\Windows\System\EnrnCOg.exe
  2⤵
  PID:7432
- C:\Windows\System\uigMoWI.exe
  C:\Windows\System\uigMoWI.exe
  2⤵
  PID:7500
- C:\Windows\System\KGjGziY.exe
  C:\Windows\System\KGjGziY.exe
  2⤵
  PID:7532
- C:\Windows\System\pNzcKQp.exe
  C:\Windows\System\pNzcKQp.exe
  2⤵
  PID:7612
- C:\Windows\System\OeFalCg.exe
  C:\Windows\System\OeFalCg.exe
  2⤵
  PID:7676
- C:\Windows\System\yAjgBpc.exe
  C:\Windows\System\yAjgBpc.exe
  2⤵
  PID:7708
- C:\Windows\System\ItlshDd.exe
  C:\Windows\System\ItlshDd.exe
  2⤵
  PID:7772
- C:\Windows\System\WTuxjNL.exe
  C:\Windows\System\WTuxjNL.exe
  2⤵
  PID:7832
- C:\Windows\System\HATbdQU.exe
  C:\Windows\System\HATbdQU.exe
  2⤵
  PID:7752
- C:\Windows\System\zmehZss.exe
  C:\Windows\System\zmehZss.exe
  2⤵
  PID:7896
- C:\Windows\System\SGugkmu.exe
  C:\Windows\System\SGugkmu.exe
  2⤵
  PID:7628
- C:\Windows\System\vIXtRdN.exe
  C:\Windows\System\vIXtRdN.exe
  2⤵
  PID:7788
- C:\Windows\System\zZmzzAc.exe
  C:\Windows\System\zZmzzAc.exe
  2⤵
  PID:7932
- C:\Windows\System\oGjSFNc.exe
  C:\Windows\System\oGjSFNc.exe
  2⤵
  PID:7816
- C:\Windows\System\MMlgZJj.exe
  C:\Windows\System\MMlgZJj.exe
  2⤵
  PID:7964
- C:\Windows\System\TnwAVCA.exe
  C:\Windows\System\TnwAVCA.exe
  2⤵
  PID:7916
- C:\Windows\System\SiZRAxq.exe
  C:\Windows\System\SiZRAxq.exe
  2⤵
  PID:8056
- C:\Windows\System\KtaMIRA.exe
  C:\Windows\System\KtaMIRA.exe
  2⤵
  PID:8012
- C:\Windows\System\NKOFPEY.exe
  C:\Windows\System\NKOFPEY.exe
  2⤵
  PID:8120
- C:\Windows\System\YoqgJgI.exe
  C:\Windows\System\YoqgJgI.exe
  2⤵
  PID:8072
- C:\Windows\System\BdIOETo.exe
  C:\Windows\System\BdIOETo.exe
  2⤵
  PID:8144
- C:\Windows\System\TgazCuP.exe
  C:\Windows\System\TgazCuP.exe
  2⤵
  PID:8160
- C:\Windows\System\NIlNNGG.exe
  C:\Windows\System\NIlNNGG.exe
  2⤵
  PID:8176
- C:\Windows\System\jqRBGMA.exe
  C:\Windows\System\jqRBGMA.exe
  2⤵
  PID:7172
- C:\Windows\System\ucjEusK.exe
  C:\Windows\System\ucjEusK.exe
  2⤵
  PID:7132
- C:\Windows\System\jefxaUm.exe
  C:\Windows\System\jefxaUm.exe
  2⤵
  PID:7312
- C:\Windows\System\ZKleyfp.exe
  C:\Windows\System\ZKleyfp.exe
  2⤵
  PID:7512
- C:\Windows\System\ksyvKbE.exe
  C:\Windows\System\ksyvKbE.exe
  2⤵
  PID:7492
- C:\Windows\System\wKRQTYX.exe
  C:\Windows\System\wKRQTYX.exe
  2⤵
  PID:7428
- C:\Windows\System\ptfzKXi.exe
  C:\Windows\System\ptfzKXi.exe
  2⤵
  PID:7672
- C:\Windows\System\EUlBmOx.exe
  C:\Windows\System\EUlBmOx.exe
  2⤵
  PID:7360
- C:\Windows\System\BeEEQSt.exe
  C:\Windows\System\BeEEQSt.exe
  2⤵
  PID:7332
- C:\Windows\System\vcmjMtb.exe
  C:\Windows\System\vcmjMtb.exe
  2⤵
  PID:7884
- C:\Windows\System\JZKTKyw.exe
  C:\Windows\System\JZKTKyw.exe
  2⤵
  PID:7704
- C:\Windows\System\EQChNfx.exe
  C:\Windows\System\EQChNfx.exe
  2⤵
  PID:6916
- C:\Windows\System\PptXlaE.exe
  C:\Windows\System\PptXlaE.exe
  2⤵
  PID:8088
- C:\Windows\System\jFfWzNx.exe
  C:\Windows\System\jFfWzNx.exe
  2⤵
  PID:7412
- C:\Windows\System\FVPkhcl.exe
  C:\Windows\System\FVPkhcl.exe
  2⤵
  PID:7868
- C:\Windows\System\ChEcKoj.exe
  C:\Windows\System\ChEcKoj.exe
  2⤵
  PID:7724
- C:\Windows\System\abgWOkQ.exe
  C:\Windows\System\abgWOkQ.exe
  2⤵
  PID:7804
- C:\Windows\System\hHIbJVC.exe
  C:\Windows\System\hHIbJVC.exe
  2⤵
  PID:7660
- C:\Windows\System\wAUgxGh.exe
  C:\Windows\System\wAUgxGh.exe
  2⤵
  PID:7992
- C:\Windows\System\AebrHQg.exe
  C:\Windows\System\AebrHQg.exe
  2⤵
  PID:8140
- C:\Windows\System\khByXPk.exe
  C:\Windows\System\khByXPk.exe
  2⤵
  PID:7448
- C:\Windows\System\UhynMPG.exe
  C:\Windows\System\UhynMPG.exe
  2⤵
  PID:7296
- C:\Windows\System\MknVcnS.exe
  C:\Windows\System\MknVcnS.exe
  2⤵
  PID:7292
- C:\Windows\System\pGtGlQK.exe
  C:\Windows\System\pGtGlQK.exe
  2⤵
  PID:7528
- C:\Windows\System\dbDVDqY.exe
  C:\Windows\System\dbDVDqY.exe
  2⤵
  PID:7644
- C:\Windows\System\eaZpcIC.exe
  C:\Windows\System\eaZpcIC.exe
  2⤵
  PID:8104
- C:\Windows\System\DJlbGDl.exe
  C:\Windows\System\DJlbGDl.exe
  2⤵
  PID:6460
- C:\Windows\System\njBJKQs.exe
  C:\Windows\System\njBJKQs.exe
  2⤵
  PID:8124
- C:\Windows\System\lSGxCJy.exe
  C:\Windows\System\lSGxCJy.exe
  2⤵
  PID:7376
- C:\Windows\System\qgtuscs.exe
  C:\Windows\System\qgtuscs.exe
  2⤵
  PID:8168
- C:\Windows\System\daGjpoE.exe
  C:\Windows\System\daGjpoE.exe
  2⤵
  PID:7852
- C:\Windows\System\fsHtoKS.exe
  C:\Windows\System\fsHtoKS.exe
  2⤵
  PID:6592
- C:\Windows\System\pXZelSP.exe
  C:\Windows\System\pXZelSP.exe
  2⤵
  PID:7580
- C:\Windows\System\MAMGVXR.exe
  C:\Windows\System\MAMGVXR.exe
  2⤵
  PID:8172
- C:\Windows\System\ufLDWKP.exe
  C:\Windows\System\ufLDWKP.exe
  2⤵
  PID:8008
- C:\Windows\System\RNpKNup.exe
  C:\Windows\System\RNpKNup.exe
  2⤵
  PID:8028
- C:\Windows\System\nUciMBY.exe
  C:\Windows\System\nUciMBY.exe
  2⤵
  PID:7624
- C:\Windows\System\vORINoe.exe
  C:\Windows\System\vORINoe.exe
  2⤵
  PID:8204
- C:\Windows\System\xslSEOP.exe
  C:\Windows\System\xslSEOP.exe
  2⤵
  PID:8220
- C:\Windows\System\WZcrdIH.exe
  C:\Windows\System\WZcrdIH.exe
  2⤵
  PID:8236
- C:\Windows\System\mLmiPcU.exe
  C:\Windows\System\mLmiPcU.exe
  2⤵
  PID:8252
- C:\Windows\System\bdXjiqE.exe
  C:\Windows\System\bdXjiqE.exe
  2⤵
  PID:8268
- C:\Windows\System\OpgixVh.exe
  C:\Windows\System\OpgixVh.exe
  2⤵
  PID:8284
- C:\Windows\System\ylSyDYX.exe
  C:\Windows\System\ylSyDYX.exe
  2⤵
  PID:8300
- C:\Windows\System\AeIExnd.exe
  C:\Windows\System\AeIExnd.exe
  2⤵
  PID:8316
- C:\Windows\System\GwdGofD.exe
  C:\Windows\System\GwdGofD.exe
  2⤵
  PID:8332
- C:\Windows\System\KkeaRIN.exe
  C:\Windows\System\KkeaRIN.exe
  2⤵
  PID:8348
- C:\Windows\System\FaZZBeK.exe
  C:\Windows\System\FaZZBeK.exe
  2⤵
  PID:8364
- C:\Windows\System\vzoAiiz.exe
  C:\Windows\System\vzoAiiz.exe
  2⤵
  PID:8380
- C:\Windows\System\mBVaWkN.exe
  C:\Windows\System\mBVaWkN.exe
  2⤵
  PID:8396
- C:\Windows\System\wXLbkTa.exe
  C:\Windows\System\wXLbkTa.exe
  2⤵
  PID:8412
- C:\Windows\System\OuvqCBH.exe
  C:\Windows\System\OuvqCBH.exe
  2⤵
  PID:8428
- C:\Windows\System\NgwgaVm.exe
  C:\Windows\System\NgwgaVm.exe
  2⤵
  PID:8444
- C:\Windows\System\HQgCIHc.exe
  C:\Windows\System\HQgCIHc.exe
  2⤵
  PID:8460
- C:\Windows\System\ZbOdULA.exe
  C:\Windows\System\ZbOdULA.exe
  2⤵
  PID:8480
- C:\Windows\System\ZadIbjc.exe
  C:\Windows\System\ZadIbjc.exe
  2⤵
  PID:8496
- C:\Windows\System\WNlmZiQ.exe
  C:\Windows\System\WNlmZiQ.exe
  2⤵
  PID:8512
- C:\Windows\System\QLBTcam.exe
  C:\Windows\System\QLBTcam.exe
  2⤵
  PID:8528
- C:\Windows\System\VIuKfeN.exe
  C:\Windows\System\VIuKfeN.exe
  2⤵
  PID:8544
- C:\Windows\System\KBmyTTo.exe
  C:\Windows\System\KBmyTTo.exe
  2⤵
  PID:8560
- C:\Windows\System\kOlbJYG.exe
  C:\Windows\System\kOlbJYG.exe
  2⤵
  PID:8580
- C:\Windows\System\ieLZthC.exe
  C:\Windows\System\ieLZthC.exe
  2⤵
  PID:8600
- C:\Windows\System\ggPuwgf.exe
  C:\Windows\System\ggPuwgf.exe
  2⤵
  PID:8616
- C:\Windows\System\kgYRbru.exe
  C:\Windows\System\kgYRbru.exe
  2⤵
  PID:8636
- C:\Windows\System\ifCmoID.exe
  C:\Windows\System\ifCmoID.exe
  2⤵
  PID:8652
- C:\Windows\System\PMEcuBf.exe
  C:\Windows\System\PMEcuBf.exe
  2⤵
  PID:8668
- C:\Windows\System\FWoHjQX.exe
  C:\Windows\System\FWoHjQX.exe
  2⤵
  PID:8684
- C:\Windows\System\bGQoGFp.exe
  C:\Windows\System\bGQoGFp.exe
  2⤵
  PID:8700
- C:\Windows\System\YjCihRg.exe
  C:\Windows\System\YjCihRg.exe
  2⤵
  PID:8716
- C:\Windows\System\FjRSOLO.exe
  C:\Windows\System\FjRSOLO.exe
  2⤵
  PID:8736
- C:\Windows\System\mmnTGrB.exe
  C:\Windows\System\mmnTGrB.exe
  2⤵
  PID:8752
- C:\Windows\System\IidGfCf.exe
  C:\Windows\System\IidGfCf.exe
  2⤵
  PID:8768
- C:\Windows\System\zzOZnfi.exe
  C:\Windows\System\zzOZnfi.exe
  2⤵
  PID:8784
- C:\Windows\System\rlueKpO.exe
  C:\Windows\System\rlueKpO.exe
  2⤵
  PID:8800
- C:\Windows\System\QGgvvwf.exe
  C:\Windows\System\QGgvvwf.exe
  2⤵
  PID:8816
- C:\Windows\System\jIurYiN.exe
  C:\Windows\System\jIurYiN.exe
  2⤵
  PID:8836
- C:\Windows\System\RrDvgkL.exe
  C:\Windows\System\RrDvgkL.exe
  2⤵
  PID:8852
- C:\Windows\System\vzLHEwV.exe
  C:\Windows\System\vzLHEwV.exe
  2⤵
  PID:8868
- C:\Windows\System\FsRFrTV.exe
  C:\Windows\System\FsRFrTV.exe
  2⤵
  PID:8884
- C:\Windows\System\hKQZpNI.exe
  C:\Windows\System\hKQZpNI.exe
  2⤵
  PID:8900
- C:\Windows\System\tIqLBvx.exe
  C:\Windows\System\tIqLBvx.exe
  2⤵
  PID:8916
- C:\Windows\System\eSisyUh.exe
  C:\Windows\System\eSisyUh.exe
  2⤵
  PID:8932
- C:\Windows\System\yZimfWc.exe
  C:\Windows\System\yZimfWc.exe
  2⤵
  PID:8948
- C:\Windows\System\RYroOXR.exe
  C:\Windows\System\RYroOXR.exe
  2⤵
  PID:8964
- C:\Windows\System\cFuFiwm.exe
  C:\Windows\System\cFuFiwm.exe
  2⤵
  PID:8988
- C:\Windows\System\YGaYuNi.exe
  C:\Windows\System\YGaYuNi.exe
  2⤵
  PID:9008
- C:\Windows\System\XufmTrk.exe
  C:\Windows\System\XufmTrk.exe
  2⤵
  PID:9024
- C:\Windows\System\hyntwcy.exe
  C:\Windows\System\hyntwcy.exe
  2⤵
  PID:9044
- C:\Windows\System\pVHWoHQ.exe
  C:\Windows\System\pVHWoHQ.exe
  2⤵
  PID:9060
- C:\Windows\System\lqRjywG.exe
  C:\Windows\System\lqRjywG.exe
  2⤵
  PID:9076
- C:\Windows\System\tWTsqLZ.exe
  C:\Windows\System\tWTsqLZ.exe
  2⤵
  PID:9096
- C:\Windows\System\WCuQaya.exe
  C:\Windows\System\WCuQaya.exe
  2⤵
  PID:9112
- C:\Windows\System\wennWkv.exe
  C:\Windows\System\wennWkv.exe
  2⤵
  PID:9128
- C:\Windows\System\IFgSLsK.exe
  C:\Windows\System\IFgSLsK.exe
  2⤵
  PID:9148
- C:\Windows\System\DRaxoGT.exe
  C:\Windows\System\DRaxoGT.exe
  2⤵
  PID:9164
- C:\Windows\System\joelRfn.exe
  C:\Windows\System\joelRfn.exe
  2⤵
  PID:9180
- C:\Windows\System\WqPNDAM.exe
  C:\Windows\System\WqPNDAM.exe
  2⤵
  PID:9196
- C:\Windows\System\vEqAUVQ.exe
  C:\Windows\System\vEqAUVQ.exe
  2⤵
  PID:9212
- C:\Windows\System\NsTpZre.exe
  C:\Windows\System\NsTpZre.exe
  2⤵
  PID:7608
- C:\Windows\System\nEDcaNp.exe
  C:\Windows\System\nEDcaNp.exe
  2⤵
  PID:8216
- C:\Windows\System\YDEtugl.exe
  C:\Windows\System\YDEtugl.exe
  2⤵
  PID:8248
- C:\Windows\System\rhqMoPj.exe
  C:\Windows\System\rhqMoPj.exe
  2⤵
  PID:8280
- C:\Windows\System\pSuWvcT.exe
  C:\Windows\System\pSuWvcT.exe
  2⤵
  PID:8328
- C:\Windows\System\dRmuCXs.exe
  C:\Windows\System\dRmuCXs.exe
  2⤵
  PID:8340
- C:\Windows\System\RzXTQlF.exe
  C:\Windows\System\RzXTQlF.exe
  2⤵
  PID:8392
- C:\Windows\System\nVZlZFn.exe
  C:\Windows\System\nVZlZFn.exe
  2⤵
  PID:8404
- C:\Windows\System\JMkVtCv.exe
  C:\Windows\System\JMkVtCv.exe
  2⤵
  PID:8436
- C:\Windows\System\jKqzVlV.exe
  C:\Windows\System\jKqzVlV.exe
  2⤵
  PID:8476
- C:\Windows\System\xmgOcZW.exe
  C:\Windows\System\xmgOcZW.exe
  2⤵
  PID:8508
- C:\Windows\System\MuZEvbD.exe
  C:\Windows\System\MuZEvbD.exe
  2⤵
  PID:8556
- C:\Windows\System\nFTLsPR.exe
  C:\Windows\System\nFTLsPR.exe
  2⤵
  PID:8588
- C:\Windows\System\RrUnuEZ.exe
  C:\Windows\System\RrUnuEZ.exe
  2⤵
  PID:8572
- C:\Windows\System\Qdzadaq.exe
  C:\Windows\System\Qdzadaq.exe
  2⤵
  PID:8612
- C:\Windows\System\BRMweRm.exe
  C:\Windows\System\BRMweRm.exe
  2⤵
  PID:8664
- C:\Windows\System\fslyYHe.exe
  C:\Windows\System\fslyYHe.exe
  2⤵
  PID:8724
- C:\Windows\System\jDdyecs.exe
  C:\Windows\System\jDdyecs.exe
  2⤵
  PID:8796
- C:\Windows\System\XUGQUDl.exe
  C:\Windows\System\XUGQUDl.exe
  2⤵
  PID:8644
- C:\Windows\System\yLqenZG.exe
  C:\Windows\System\yLqenZG.exe
  2⤵
  PID:8832
- C:\Windows\System\qOikSlg.exe
  C:\Windows\System\qOikSlg.exe
  2⤵
  PID:8676
- C:\Windows\System\QQIBqXP.exe
  C:\Windows\System\QQIBqXP.exe
  2⤵
  PID:8748
- C:\Windows\System\eONrDjE.exe
  C:\Windows\System\eONrDjE.exe
  2⤵
  PID:8876
- C:\Windows\System\IqAkWfa.exe
  C:\Windows\System\IqAkWfa.exe
  2⤵
  PID:8908
- C:\Windows\System\SLWdXSc.exe
  C:\Windows\System\SLWdXSc.exe
  2⤵
  PID:8940
- C:\Windows\System\fpAiqnI.exe
  C:\Windows\System\fpAiqnI.exe
  2⤵
  PID:8960
- C:\Windows\System\FxbDyaS.exe
  C:\Windows\System\FxbDyaS.exe
  2⤵
  PID:8996
- C:\Windows\System\CnGFGTd.exe
  C:\Windows\System\CnGFGTd.exe
  2⤵
  PID:9036
- C:\Windows\System\uqHQlrK.exe
  C:\Windows\System\uqHQlrK.exe
  2⤵
  PID:9104
- C:\Windows\System\tQbmvSg.exe
  C:\Windows\System\tQbmvSg.exe
  2⤵
  PID:9140
- C:\Windows\System\qjILFpK.exe
  C:\Windows\System\qjILFpK.exe
  2⤵
  PID:9204
- C:\Windows\System\gBbsExk.exe
  C:\Windows\System\gBbsExk.exe
  2⤵
  PID:8228
- C:\Windows\System\eLUppyz.exe
  C:\Windows\System\eLUppyz.exe
  2⤵
  PID:8356
- C:\Windows\System\hQVmgcV.exe
  C:\Windows\System\hQVmgcV.exe
  2⤵
  PID:9020
- C:\Windows\System\zuWFlti.exe
  C:\Windows\System\zuWFlti.exe
  2⤵
  PID:9188
- C:\Windows\System\pIkYCWy.exe
  C:\Windows\System\pIkYCWy.exe
  2⤵
  PID:8372
- C:\Windows\System\XUpJMXW.exe
  C:\Windows\System\XUpJMXW.exe
  2⤵
  PID:6512
- C:\Windows\System\OBYrBQS.exe
  C:\Windows\System\OBYrBQS.exe
  2⤵
  PID:8324
- C:\Windows\System\qiWlZhn.exe
  C:\Windows\System\qiWlZhn.exe
  2⤵
  PID:8472
- C:\Windows\System\ggGYOMR.exe
  C:\Windows\System\ggGYOMR.exe
  2⤵
  PID:8568
- C:\Windows\System\CzOkkkk.exe
  C:\Windows\System\CzOkkkk.exe
  2⤵
  PID:8408
- C:\Windows\System\vindKOZ.exe
  C:\Windows\System\vindKOZ.exe
  2⤵
  PID:8608
- C:\Windows\System\tSGvMFv.exe
  C:\Windows\System\tSGvMFv.exe
  2⤵
  PID:8792
- C:\Windows\System\DBDRtsl.exe
  C:\Windows\System\DBDRtsl.exe
  2⤵
  PID:8712
- C:\Windows\System\iAFeDrl.exe
  C:\Windows\System\iAFeDrl.exe
  2⤵
  PID:8956
- C:\Windows\System\GLbLZLM.exe
  C:\Windows\System\GLbLZLM.exe
  2⤵
  PID:9136
- C:\Windows\System\BXGLOFW.exe
  C:\Windows\System\BXGLOFW.exe
  2⤵
  PID:8844
- C:\Windows\System\jjXIZyE.exe
  C:\Windows\System\jjXIZyE.exe
  2⤵
  PID:8828
- C:\Windows\System\LDjeNjN.exe
  C:\Windows\System\LDjeNjN.exe
  2⤵
  PID:8924
- C:\Windows\System\eRVcnXd.exe
  C:\Windows\System\eRVcnXd.exe
  2⤵
  PID:9072
- C:\Windows\System\SVjqCvB.exe
  C:\Windows\System\SVjqCvB.exe
  2⤵
  PID:8244
- C:\Windows\System\WXxfteC.exe
  C:\Windows\System\WXxfteC.exe
  2⤵
  PID:8260
- C:\Windows\System\Luweoum.exe
  C:\Windows\System\Luweoum.exe
  2⤵
  PID:9220
- C:\Windows\System\galMrns.exe
  C:\Windows\System\galMrns.exe
  2⤵
  PID:9236
- C:\Windows\System\JVqbYDs.exe
  C:\Windows\System\JVqbYDs.exe
  2⤵
  PID:9252
- C:\Windows\System\VrmABdS.exe
  C:\Windows\System\VrmABdS.exe
  2⤵
  PID:9268
- C:\Windows\System\SvBqeSO.exe
  C:\Windows\System\SvBqeSO.exe
  2⤵
  PID:9284
- C:\Windows\System\KEEdALs.exe
  C:\Windows\System\KEEdALs.exe
  2⤵
  PID:9300
- C:\Windows\System\VbfmjFl.exe
  C:\Windows\System\VbfmjFl.exe
  2⤵
  PID:9316
- C:\Windows\System\FTmHymL.exe
  C:\Windows\System\FTmHymL.exe
  2⤵
  PID:9332
- C:\Windows\System\xmBmmZq.exe
  C:\Windows\System\xmBmmZq.exe
  2⤵
  PID:9348
- C:\Windows\System\uAwjDji.exe
  C:\Windows\System\uAwjDji.exe
  2⤵
  PID:9364
- C:\Windows\System\hbqfrPB.exe
  C:\Windows\System\hbqfrPB.exe
  2⤵
  PID:9380
- C:\Windows\System\eWauOsP.exe
  C:\Windows\System\eWauOsP.exe
  2⤵
  PID:9396
- C:\Windows\System\AsDcZOu.exe
  C:\Windows\System\AsDcZOu.exe
  2⤵
  PID:9412
- C:\Windows\System\KtHBdDB.exe
  C:\Windows\System\KtHBdDB.exe
  2⤵
  PID:9428
- C:\Windows\System\cKsFQJT.exe
  C:\Windows\System\cKsFQJT.exe
  2⤵
  PID:9444
- C:\Windows\System\CEflEcK.exe
  C:\Windows\System\CEflEcK.exe
  2⤵
  PID:9460
- C:\Windows\System\BNsCdeH.exe
  C:\Windows\System\BNsCdeH.exe
  2⤵
  PID:9476
- C:\Windows\System\utMGdJy.exe
  C:\Windows\System\utMGdJy.exe
  2⤵
  PID:9492
- C:\Windows\System\sVaibLa.exe
  C:\Windows\System\sVaibLa.exe
  2⤵
  PID:9508
- C:\Windows\System\InxvrJp.exe
  C:\Windows\System\InxvrJp.exe
  2⤵
  PID:9524
- C:\Windows\System\fLQNHNL.exe
  C:\Windows\System\fLQNHNL.exe
  2⤵
  PID:9540
- C:\Windows\System\pZceWfm.exe
  C:\Windows\System\pZceWfm.exe
  2⤵
  PID:9556
- C:\Windows\System\dOMSgAi.exe
  C:\Windows\System\dOMSgAi.exe
  2⤵
  PID:9572
- C:\Windows\System\YEsGqQE.exe
  C:\Windows\System\YEsGqQE.exe
  2⤵
  PID:9588
- C:\Windows\System\cBaTRmN.exe
  C:\Windows\System\cBaTRmN.exe
  2⤵
  PID:9604
- C:\Windows\System\AgkeofZ.exe
  C:\Windows\System\AgkeofZ.exe
  2⤵
  PID:9620
- C:\Windows\System\DmPgKjJ.exe
  C:\Windows\System\DmPgKjJ.exe
  2⤵
  PID:9636
- C:\Windows\System\EvNGNhr.exe
  C:\Windows\System\EvNGNhr.exe
  2⤵
  PID:9656
- C:\Windows\System\FGijEGI.exe
  C:\Windows\System\FGijEGI.exe
  2⤵
  PID:9672
- C:\Windows\System\VGZmFXE.exe
  C:\Windows\System\VGZmFXE.exe
  2⤵
  PID:9688
- C:\Windows\System\OAyJWEx.exe
  C:\Windows\System\OAyJWEx.exe
  2⤵
  PID:9704
- C:\Windows\System\MHjXGdW.exe
  C:\Windows\System\MHjXGdW.exe
  2⤵
  PID:9720
- C:\Windows\System\wLIujHD.exe
  C:\Windows\System\wLIujHD.exe
  2⤵
  PID:9740
- C:\Windows\System\WzMjOlY.exe
  C:\Windows\System\WzMjOlY.exe
  2⤵
  PID:9756
- C:\Windows\System\eluYgEH.exe
  C:\Windows\System\eluYgEH.exe
  2⤵
  PID:9772
- C:\Windows\System\UjkljMG.exe
  C:\Windows\System\UjkljMG.exe
  2⤵
  PID:9788
- C:\Windows\System\TGaqMoE.exe
  C:\Windows\System\TGaqMoE.exe
  2⤵
  PID:9804
- C:\Windows\System\lHvVsfo.exe
  C:\Windows\System\lHvVsfo.exe
  2⤵
  PID:9820
- C:\Windows\System\KLCQTuQ.exe
  C:\Windows\System\KLCQTuQ.exe
  2⤵
  PID:9836
- C:\Windows\System\BMgDwiS.exe
  C:\Windows\System\BMgDwiS.exe
  2⤵
  PID:9852
- C:\Windows\System\kSsYsxR.exe
  C:\Windows\System\kSsYsxR.exe
  2⤵
  PID:9920
- C:\Windows\System\doJUCPs.exe
  C:\Windows\System\doJUCPs.exe
  2⤵
  PID:9936
- C:\Windows\System\ShQSZip.exe
  C:\Windows\System\ShQSZip.exe
  2⤵
  PID:9956
- C:\Windows\System\WovDOGA.exe
  C:\Windows\System\WovDOGA.exe
  2⤵
  PID:9972
- C:\Windows\System\qTQpPzz.exe
  C:\Windows\System\qTQpPzz.exe
  2⤵
  PID:9992
- C:\Windows\System\kQUShiA.exe
  C:\Windows\System\kQUShiA.exe
  2⤵
  PID:10008
- C:\Windows\System\EGehmrR.exe
  C:\Windows\System\EGehmrR.exe
  2⤵
  PID:10024
- C:\Windows\System\XhbLGCE.exe
  C:\Windows\System\XhbLGCE.exe
  2⤵
  PID:10044
- C:\Windows\System\tNUydvs.exe
  C:\Windows\System\tNUydvs.exe
  2⤵
  PID:10060
- C:\Windows\System\WnwSItT.exe
  C:\Windows\System\WnwSItT.exe
  2⤵
  PID:10076
- C:\Windows\System\lQospPT.exe
  C:\Windows\System\lQospPT.exe
  2⤵
  PID:10092
- C:\Windows\System\htlRdQA.exe
  C:\Windows\System\htlRdQA.exe
  2⤵
  PID:10108
- C:\Windows\System\voEbOmz.exe
  C:\Windows\System\voEbOmz.exe
  2⤵
  PID:10128
- C:\Windows\System\bWVRSxE.exe
  C:\Windows\System\bWVRSxE.exe
  2⤵
  PID:10148
- C:\Windows\System\QQUtAvR.exe
  C:\Windows\System\QQUtAvR.exe
  2⤵
  PID:10164
- C:\Windows\System\RMarjTM.exe
  C:\Windows\System\RMarjTM.exe
  2⤵
  PID:10180
- C:\Windows\System\sLetmeN.exe
  C:\Windows\System\sLetmeN.exe
  2⤵
  PID:10196
- C:\Windows\System\yQSXBEd.exe
  C:\Windows\System\yQSXBEd.exe
  2⤵
  PID:10216
- C:\Windows\System\WxnSfQf.exe
  C:\Windows\System\WxnSfQf.exe
  2⤵
  PID:10232
- C:\Windows\System\xdZSPhu.exe
  C:\Windows\System\xdZSPhu.exe
  2⤵
  PID:8388
- C:\Windows\System\CMwvXfn.exe
  C:\Windows\System\CMwvXfn.exe
  2⤵
  PID:9160
- C:\Windows\System\IbgwAeV.exe
  C:\Windows\System\IbgwAeV.exe
  2⤵
  PID:8540
- C:\Windows\System\vJYrjFa.exe
  C:\Windows\System\vJYrjFa.exe
  2⤵
  PID:8860
- C:\Windows\System\sJsrEZl.exe
  C:\Windows\System\sJsrEZl.exe
  2⤵
  PID:8732
- C:\Windows\System\PdvaAPM.exe
  C:\Windows\System\PdvaAPM.exe
  2⤵
  PID:9228
- C:\Windows\System\ijCVTIL.exe
  C:\Windows\System\ijCVTIL.exe
  2⤵
  PID:8764
- C:\Windows\System\FXqCqkT.exe
  C:\Windows\System\FXqCqkT.exe
  2⤵
  PID:9324
- C:\Windows\System\BjdAkGB.exe
  C:\Windows\System\BjdAkGB.exe
  2⤵
  PID:9176
- C:\Windows\System\ltqdzrS.exe
  C:\Windows\System\ltqdzrS.exe
  2⤵
  PID:9248
- C:\Windows\System\WbwmpNm.exe
  C:\Windows\System\WbwmpNm.exe
  2⤵
  PID:9340
- C:\Windows\System\ULviJEi.exe
  C:\Windows\System\ULviJEi.exe
  2⤵
  PID:9536
- C:\Windows\System\ZwopjaA.exe
  C:\Windows\System\ZwopjaA.exe
  2⤵
  PID:9596
- C:\Windows\System\HpcfuXF.exe
  C:\Windows\System\HpcfuXF.exe
  2⤵
  PID:9472
- C:\Windows\System\YsaGBRy.exe
  C:\Windows\System\YsaGBRy.exe
  2⤵
  PID:9564
- C:\Windows\System\byjsWWl.exe
  C:\Windows\System\byjsWWl.exe
  2⤵
  PID:9648
- C:\Windows\System\mzTezLJ.exe
  C:\Windows\System\mzTezLJ.exe
  2⤵
  PID:9668
- C:\Windows\System\NxrcynA.exe
  C:\Windows\System\NxrcynA.exe
  2⤵
  PID:9748
- C:\Windows\System\hooJTFQ.exe
  C:\Windows\System\hooJTFQ.exe
  2⤵
  PID:9784
- C:\Windows\System\LVEGjQg.exe
  C:\Windows\System\LVEGjQg.exe
  2⤵
  PID:9848
- C:\Windows\System\YfwjQXP.exe
  C:\Windows\System\YfwjQXP.exe
  2⤵
  PID:9768
- C:\Windows\System\JHQpdom.exe
  C:\Windows\System\JHQpdom.exe
  2⤵
  PID:9832
- C:\Windows\System\auFbsgC.exe
  C:\Windows\System\auFbsgC.exe
  2⤵
  PID:9932
- C:\Windows\System\rCiJZce.exe
  C:\Windows\System\rCiJZce.exe
  2⤵
  PID:10032
- C:\Windows\System\hjeYTRQ.exe
  C:\Windows\System\hjeYTRQ.exe
  2⤵
  PID:9732
- C:\Windows\System\HnQqtCB.exe
  C:\Windows\System\HnQqtCB.exe
  2⤵
  PID:9908
- C:\Windows\System\sqXcmxI.exe
  C:\Windows\System\sqXcmxI.exe
  2⤵
  PID:9944
- C:\Windows\System\jzMaBWe.exe
  C:\Windows\System\jzMaBWe.exe
  2⤵
  PID:9880
- C:\Windows\System\gbHZzYY.exe
  C:\Windows\System\gbHZzYY.exe
  2⤵
  PID:9896
- C:\Windows\System\mjuKxaE.exe
  C:\Windows\System\mjuKxaE.exe
  2⤵
  PID:10136
- C:\Windows\System\tmqeytr.exe
  C:\Windows\System\tmqeytr.exe
  2⤵
  PID:9952
- C:\Windows\System\KMWcdgz.exe
  C:\Windows\System\KMWcdgz.exe
  2⤵
  PID:10016
- C:\Windows\System\gPgmSuf.exe
  C:\Windows\System\gPgmSuf.exe
  2⤵
  PID:10084
- C:\Windows\System\yfSgRHr.exe
  C:\Windows\System\yfSgRHr.exe
  2⤵
  PID:10204
- C:\Windows\System\bcXZXvE.exe
  C:\Windows\System\bcXZXvE.exe
  2⤵
  PID:10192
- C:\Windows\System\xorflmu.exe
  C:\Windows\System\xorflmu.exe
  2⤵
  PID:8424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AkXBCZC.exe

Filesize
2.1MB

MD5
06bdbc98858d78a62e408dc727fc01bc

SHA1
75179b3bd12c99b95bc19538baacc5b3e909739c

SHA256
ad927436d795675f6789f28f34f21784c66d4ab876e37c4dceb4c47953ea1ef1

SHA512
6e6d61814b6bb342ea1ff013a55764d81f830fd373590a0c2cf8e076d6c3e1dac03993caa47f4bc5f787fb2b4d6a32c7da3dcdf3ae3682a9a779959d1eb88917

Download Submit
C:\Windows\system\AtiIbtN.exe

Filesize
2.1MB

MD5
316f3b7725d816c68c7a5642aa92c21c

SHA1
c4d483c3d9431081a22b8dc9e8c2ebed05e011f2

SHA256
0b20ea94f65926baee6b4fe505335432a3651caf97cbf46847aff564f192c35e

SHA512
f097b2abafc14696a28c6f53a58564ca0f008769e8cf8e69d3ae5a0e5786408baebad9e8e3c7f3945fc30974a06447126c9f1495954ab1a34c8fd0a1ed12e1d5

Download Submit
C:\Windows\system\BhMNwTf.exe

Filesize
2.1MB

MD5
9535d44b60daa79c0212541383f98e47

SHA1
56fd207433e3355040d185fba13599cda7b5b30e

SHA256
39f1ee8350146340591a30601d9605452d1432d67322368085db2055bbbefe55

SHA512
2c9e15f7ed914497e36934f21e3b234d7fe2fe4c5d0c267e04937dc9e667f40d77c649924b3aff28e5013bbabab6bcacddb74b9023d2632e124eb60b3d14c4a2

Download Submit
C:\Windows\system\DNSSRvM.exe

Filesize
2.1MB

MD5
ffeeac99dad08be792923d7f483c3e9b

SHA1
e13c9e29c4692e54bfa369f4b842b3aef908479f

SHA256
fca1788153010c41c2f30a9b664756287b70a80bc23c3fa68a2e4b86ecd4e424

SHA512
e4a87f22746036c5b72a018265428b5e2f1319f1507c2d166133e6bd29f0af1770dd0a86ad0b4cea6acf39c836706347656aa520c4d88092f3dfe9e16e780918

Download Submit
C:\Windows\system\DUWamjU.exe

Filesize
2.1MB

MD5
4f61d05f908b51f7ee4dcbbc2b1ee50a

SHA1
0568c8fb188939ca1e75ee2e3f55262d45b60847

SHA256
56b25d4d1e8f95bd9db3da76ffd5a0096f8aa4d5e91f79cdde39603bfabda9dd

SHA512
d84c0d4869d53f3ad584873e61f7b5e1da05253ba6b152a00ed4332dde8c552c781909bb539bd538663254c78a23318f940667fa327075ed0cbe8f0ef855f17e

Download Submit
C:\Windows\system\IuwFJXo.exe

Filesize
2.1MB

MD5
daff6b119dc457f73a29c403dd9e6eba

SHA1
54d5a78cf28f5a12711aae2d8f09aa3758a87f89

SHA256
8f91aca8458beab6c7e3895ed81ed8c3d70641ea9385be11df16926fa7dd0f25

SHA512
473fed74ccf44f04d892b52ce5d032cdaceb6af91a335559d424aaff733ab98f4fb8822145eed345ca6d1803c59c580c797c137cb1bc1457b55e9354db9719e7

Download Submit
C:\Windows\system\JiiVfhi.exe

Filesize
2.1MB

MD5
edaf2150f85bbda8dc0ac0d3c42ea200

SHA1
44452d3dbb47de246abc23d484827facb7f89250

SHA256
3c73d3f1bdcbfc5bfd0155c1cf7c5b5448ec9b69678ecae25678d596992dc47c

SHA512
19dacb490b2ab1a9869ca2bdc07deef6bfdc5ac8b38b92a154c25096238a30ede9709c5403825e880a33ef79ea563d5a268f8c263b53d9b5f8f271d41713d863

Download Submit
C:\Windows\system\KyzsGZR.exe

Filesize
2.1MB

MD5
2f510f05d97ec7de7e6a9d94e433468d

SHA1
8c7ac1e8e8b85e3f61ce47f8b820a7038bebd642

SHA256
0d9d8504334d6ff4732dba4390430e65fad90842341f7becff2b4dcd9890a462

SHA512
0b9acb8d18e1bd2ec0bf4e535168421bd9c5d79639b83d8d2270a59fea5bb9a781b4b366ecb0bd548c329430a55d08ea6cbb3a72b9d1e36352ae254b223c4f94

Download Submit
C:\Windows\system\PPTpyPk.exe

Filesize
2.1MB

MD5
6db791c6d9af84ede992b5363f694c96

SHA1
3bca42c0d1b6151e6ade980feaaf2bbc893bcc41

SHA256
99a732a2ba56ecb7d67f2dbc80b90a6d31563ac99479c851c30d2c89fe14cb1e

SHA512
04d977fbba5fb2440f0294c64c733b95defe018dd3f6314324eaf211313152d56bc7dca1276c40806227261fc2c66a5d2e96d01b2e26b5b280ee63c7bb64d716

Download Submit
C:\Windows\system\QRZJCQL.exe

Filesize
2.1MB

MD5
11386178f892c6b8e586d00db8660ce1

SHA1
88ea64a619ef4905f3fc83fe0bcee89aa712ba2f

SHA256
c50ae8fb17d96c25357199aaa4e820b457cfa5109405348f493bfeb45992777a

SHA512
49725a94cd31cbeba7df352d6424bf1adb9dafb1ec2b10894312d6d37ade332bdb4b3e92429d4df34fd6ec61a6f9953279cc837b85ac6247421b62c586a40d94

Download Submit
C:\Windows\system\QzcbACR.exe

Filesize
2.1MB

MD5
767a15ccccc12b5ee2c0a5fdbece2ec8

SHA1
0394f92f24f6786714d02a1a073feb7208eb71fa

SHA256
f04978cd8099189b1297d953b690cc6f36f4e16164a3f9a4f2195d5ca4e08a91

SHA512
1b7c08aacea829bc5a1483235ff1ad51bc97de89a333b20333bf75ba5a599d57dccfb30c7b6cb0a55031376a8ed10e478076b5ab1ed349f86e49976a7a6d989b

Download Submit
C:\Windows\system\SRmcgHF.exe

Filesize
2.1MB

MD5
82f80cc35f9f118cac95376bbdfcd728

SHA1
9df68bf5b172caf0cdb95600941bfce28c51b9f0

SHA256
01f413acc38eb413789295d2a97fefae84b19d5b25135a7bbcd391433a937bb3

SHA512
eac125bdc32dd01db508e6acd311d924faaa3cfed9bbac45341c4b444f4f52d2bea31b1d054962a9bea83c32316956b6e394401a4c620e8a3db664ecf1f8b41e

Download Submit
C:\Windows\system\SZnJHIY.exe

Filesize
2.1MB

MD5
a8920c987036377cb2fc89078532f36e

SHA1
6b107b396115547599a9f117175c68af1cf46759

SHA256
9427b58c6d7a39f9179bbee61fd856c8e56a2ba2455a3d0a56f4407df6d51403

SHA512
06d064bb7682953ba660aeb1889f2edfb2a446af5d3774189c6d52cf148cea16750671cf035877422966e9eb853719242b0a165fb1048667e6bb9ddab843db20

Download Submit
C:\Windows\system\VNYKHIy.exe

Filesize
2.1MB

MD5
e43bf6b872b70cd9cd560ecdcb858674

SHA1
ef5dc22d2f8a2dc97e81f3433db761e56fe00716

SHA256
eeb433a48038e53487e34bc12cc8bf224373e11ec6283b2eff6996873d9e1d10

SHA512
5b07b144685b8c6a79276b6bbe12d1bbb31e0b19df49da0ffc37ea00d4e605b78c56187c5e51d3f090d0a56cba657bcd323196c698783ca9968da4617c2d8de6

Download Submit
C:\Windows\system\XYdQmwW.exe

Filesize
2.1MB

MD5
5851ffad18257aea99aaf25153f61d0e

SHA1
ac919e811ee46ebb399e07312430283ad3e369c4

SHA256
80ea043181025643f15c68fc98de2c58159cbfcc2ef22bb0b492e4d382f0aeca

SHA512
5789bd39dc7f10eb0ff5bbf93f29f084a6c2d87a318de3e4ab2797a340c7bd3bd1264ef57fed5354efc3703fd5ddd063ec4db90d43554e0853e1774db6a26dbd

Download Submit
C:\Windows\system\ZupktkM.exe

Filesize
2.1MB

MD5
484e046d8c41d837f9e48fbc2ca62688

SHA1
1fe7e5c3745d7a947bc8e200a0e49efde9a88b32

SHA256
2047b3edd66eef0650f164ddec231b1368217918125779a29ab82aa2def0b67a

SHA512
8a0477aee9aa760cece091637d3bc0cf43d3756cb2d375955d10cd60b9da9eeb1f21565ef8701c950d731986ce6ec31e6f7e7317a8f1fa0026f8cf0dd6ed71ff

Download Submit
C:\Windows\system\etbqOGJ.exe

Filesize
2.1MB

MD5
ee8ba2037ed4e4261fc3225bf35521a6

SHA1
99a5321095de9aff6c83763cf1cde8224075dcb2

SHA256
da58e1ee74459cf439aec4747c345c72a954b62ada43a15d3564a30820177818

SHA512
f3a5eab0017af0b5434976c8e7ab566444c9f7a26d503ee077502850c73fea1aaf11b6118cf58da1b72dce067845a06f14784b296aac3b6cec4134fec647117a

Download Submit
C:\Windows\system\jSwCpcT.exe

Filesize
2.1MB

MD5
a56cfc5ee136272c0df746b54114db92

SHA1
9e9d4bd1d8868e2e205dc404ac7a6ba5975c0763

SHA256
c0e9c8c90e976f03899e05843c5f157e59b170c29f79695c0a4c2db3f8cac929

SHA512
d4dfb731325c68680d1bd948efc80448d21c12ddda5914a604fda673db56b3c95e4c4ba9b244cdc22b798636cb7bfa230689dc3dd9543115350f3bd9ed7998be

Download Submit
C:\Windows\system\jWPGIUA.exe

Filesize
2.1MB

MD5
1834615be73f046a5144d776f3858924

SHA1
d480e748b86ca0f89d6cbba65d148015fb18f2a0

SHA256
0acef045aeee2aa4926586b4b86d6719273c4ad8aed58a4701c7c1158830dd8c

SHA512
bd27620878d8f6780cdb29cdc025cbeabd5ce15e1f42f276588a8248275ff7f32d9c281615a3eae8c2019b11e24c15d05cc869aa25a16dc9f95e39e5e749e0b3

Download Submit
C:\Windows\system\maJeKnx.exe

Filesize
2.1MB

MD5
e7897dba893b269ec3b201c948f3c86e

SHA1
a50e7824fcf7d6ce7c711f3281f1a5cbc0d93d63

SHA256
035dc21c561e3c5307a61286ad444000c661bd9b73fb861ae777645f6b1837e9

SHA512
52f46cb1344d94e1d266b045c0ae7b562f3c020dfe950e13aba03f70c7d8180488e0180e124ba4b78eebbf535ed8a445203d740f0d3a3c1faed3c7dab5fb7a71

Download Submit
C:\Windows\system\vTDtlZf.exe

Filesize
2.1MB

MD5
4216d0d67254ff0b93525d200d0d22ee

SHA1
b862d3eac0ef28f72dbc19a747cd539eac6982ac

SHA256
129ae43b1b72e94d781a4eabdf54f58908b35162b9e22bcbe163293263febdc9

SHA512
bcc1b3eee846d596a9758b484c469a79f9269bd14edad28ded207714263002f5e9eee5ed63e4eae9da4394ee91a5c47836292ad7e328262f0253aa2bdc0e7cad

Download Submit
C:\Windows\system\zkpVNrj.exe

Filesize
2.1MB

MD5
f50bdf2f73f1a8d41a07ab87d02afc39

SHA1
b6ae2f4fd8cd43d3059ac77056d572b21b27ccd9

SHA256
41e2b6904b92ac404572d0846bf35dc24cf0b820a0cb55ae2f22453ce6a95182

SHA512
13e6290e07027f09e680a4d9f341d1f5d9cc0382bf38d82365216d57b1d352f29fe84ae8665641d487e9cf83ee08566304f203e83bf7ed0da646917f4d16713c

Download Submit
C:\Windows\system\zsHXWGO.exe

Filesize
2.1MB

MD5
668628c3d268bd47e3b8c3cf0ba557a3

SHA1
1836cab54d8d99c1197e30d1ebdf4b9a84ee5389

SHA256
6d0160f1b1c80718febf65309b7014682755772d64f66d8cfc493cf15f9ba7d2

SHA512
186912ac6db80a07f01b4b037091593d2a9ed11640ff816bb7c3001bbd0632f798678df65d9acd71f15d51c10b9d2ba19b80bd8efb47d0bdf4dc1ceb87bdb5a9

Download Submit
\Windows\system\GFZgUmD.exe

Filesize
2.1MB

MD5
6e80d31105217c74b920324520ccb610

SHA1
6c622155cb6c1593440e6d03e90afc48b0497750

SHA256
b71ab6c1564dd91a6417c2434030359ff5e41906ee84f5c43112a6755e969a18

SHA512
724d3ca05aceddc04a711963c12d584d4d0198430bfa12f8a3c766e721bdec07d58e5caab0d6b63d8dc6155c5e4b0e8ec056c65d394937699586f6d01fb0c004

Download Submit
\Windows\system\NVqhTlx.exe

Filesize
2.1MB

MD5
863f899475772140bacae8fa9bddf24b

SHA1
edbfd2a57ea871b88b062e95bb1274e3dd3dcfd9

SHA256
52c85afde8756de5340cbbfcade83f431afe5ce601406aaf972bb7613e9a4f20

SHA512
8f69803e7d3f641385469da57006854e07595c2650ea2c3afb76c18d42803958d627ab468d218e2e07eb355b4d97a87b0d46da926b3eb70b7bb9a65767c3813a

Download Submit
\Windows\system\PSBGgGG.exe

Filesize
2.1MB

MD5
93d99b13bcb87fb30e9b1581a9534d5c

SHA1
80ef3a7db980265d3fab3341ca3850b44f0f39b3

SHA256
4e19a0cdf668d3031eef9e564f4761491bc17c5fda42ac4f361976d2eb40ddbf

SHA512
928021676bf36051df40de5a9b551690e98b2b6d0e33148eea8f497ae19942f9a4a441d1ec8f6b377c836111bc96a19a496b8d21917ba4482fcb7f211f8036a9

Download Submit
\Windows\system\TOQhmjo.exe

Filesize
2.1MB

MD5
aeb18a5a58c3bda543ff164491cad97b

SHA1
fadc15a3dcf1ff5476498aeaf4c7f0d836e02ea4

SHA256
b94b45391a65820d8faff32991207719a39b24d88e19b635d5a2ffc2c04604ff

SHA512
27c5dbcb0208e443ebc12f139fa237ccefeb029827cc7dd8f5a1cae21c344539d2704afe9b14a03a7b23e2c2ba1b68ba8edaeae02e524eb7c0eb8f950ab14e74

Download Submit
\Windows\system\asyrHyG.exe

Filesize
2.1MB

MD5
429d1563e65fa1756ac7891d73325021

SHA1
26e10b6a3a97fe0f8409d6bf8623512e346b4cc1

SHA256
4be4c3089aa9ec20562ab4c5d1b754e66593d453487ea3e24a7ec6a8bdb80802

SHA512
a8bb6d87f183aabb559391766c869bc0e742f7ed4a073f01760c2460b10664f05ec36252c759bebcfebf1eae2f60b6c760564977178fced42dc73773e47fab07

Download Submit
\Windows\system\bnuVGcQ.exe

Filesize
2.1MB

MD5
da555e064008d4ee129ca6d52e05e559

SHA1
0100cb21e01424d959da826574c3991057ae5130

SHA256
2df5cfdfffb6cd2ce1555f346b723f48c06752baedf44369a274d70edee5fb30

SHA512
13c04b79391a183d3dd3c52ce60a4ccf28be06802befc88dd36293a659b58da31a76765bef9756c28e96fb07fcc0cbb5477c57f46022d3d6a9e0f0ba6d26483d

Download Submit
\Windows\system\dgKUWrw.exe

Filesize
2.1MB

MD5
a4d31072afdea37d94b39d33738bed36

SHA1
beca9585e6f5f58cc5bee4896843317c760f3df1

SHA256
0e76118926dbd85383067846e23e583d8e9ee7458cc1a72a4df0bb003b3ae269

SHA512
f54fac321904a588bfbaaf832c0c764df8aa95f36f17d2f97f649a9b49a5271041b49778711817a662649e048caca99d64e29a9ad26bc0a98293845709dd7af3

Download Submit
\Windows\system\hHPHgSk.exe

Filesize
2.1MB

MD5
47c0badb586804deb0d67483fa6fc3f0

SHA1
74db5ae3414969dbc7085f303b179112ee2ee2e6

SHA256
481357fe5be391d6b2fdd31da37add7e9356956203113d8899563789a936271d

SHA512
2fc64332ea39afdc4cb466ec1140b29918de7ef8b482e25b8e44bd40015e48c0c3f9a93fdf490533ffe6d8e442a303d73e47eec038897a6c88f5d6f71dd4c8f3

Download Submit
\Windows\system\jCHRfZr.exe

Filesize
2.1MB

MD5
49f9448d7dac05630702bae37c640074

SHA1
3a1d8bd7c350b483c402f033abe96360059053ff

SHA256
e7d983a8dd29a5bcb4f41d8173c4cf107355752f45298b1210b72cf242bf6f7a

SHA512
c353b92278c18835fc6ad232577a2172154e824532b9a465de34ad5dfa7a59ad3deb6d66380177aac43cce15f0afdd76615b7a00394f979d398ff91e64a59c6b

Download Submit
\Windows\system\omUTWKL.exe

Filesize
2.1MB

MD5
bfbb79b705fad558c6ea82c38ec03dd8

SHA1
775a7ee72ed8af30cd4c0a6e3a6876dc206e2400

SHA256
41795a6575b93d7fa4130af374c73a8dc5228498d2c8b4f7d87a239854ddd9aa

SHA512
b6e938bdd4531339cf5111e5ce3a42d02816b614114ada1cc4762907f6fc5c83989f616fe6cb42ea88401c9ec4e33da5827c5cfc6b5ab41a195951b40dc4b109

Download Submit
\Windows\system\tYYPbdO.exe

Filesize
2.1MB

MD5
7b11747f2bfbee0ebe2864e599c8d4e9

SHA1
71f5fd439b251818bac75698f9b5d3220c16b73a

SHA256
c8098a1efe65a7098b82c0e1c9b92f66fef8778329d8adf00195a567fc6f82ce

SHA512
9230f3611b6bb3a09893e58a155338f81be00d426c7c1cfbccefc6302e2eae101292eacb16daea512a981ba318616968193a763075b94f2c7b2d40d578182bf1

Download Submit
\Windows\system\wHcZrRj.exe

Filesize
2.1MB

MD5
6501d2419e18f74408c53d9a795f608a

SHA1
da7c10ffcc7efbeed303ddf8e5acb02543d79656

SHA256
fcbcb6f85d2d2d41f15b2a77e6d9aa944a315c907878f4f3e703496b69ead4a1

SHA512
795113fb84ba98ef6d827e890f259f30eb89626c27ad9c0cd8994b383868c18fb9b4bbdb2f116c94415387059742f7b719e2880c80fe16451552e2274d15c197

Download Submit
memory/1136-130-0x000000001B650000-0x000000001B932000-memory.dmp

Filesize
2.9MB

Download
memory/1136-136-0x0000000002720000-0x0000000002728000-memory.dmp

Filesize
32KB

Download
memory/2064-5963-0x000000013F1F0000-0x000000013F5E2000-memory.dmp

Filesize
3.9MB

Download
memory/2064-73-0x000000013F1F0000-0x000000013F5E2000-memory.dmp

Filesize
3.9MB

Download
memory/2216-82-0x00000000035E0000-0x00000000039D2000-memory.dmp

Filesize
3.9MB

Download
memory/2216-53-0x000000013FBE0000-0x000000013FFD2000-memory.dmp

Filesize
3.9MB

Download
memory/2216-17-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

Filesize
3.9MB

Download
memory/2216-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2216-11760-0x000000013FC40000-0x0000000140032000-memory.dmp

Filesize
3.9MB

Download
memory/2216-78-0x000000013F340000-0x000000013F732000-memory.dmp

Filesize
3.9MB

Download
memory/2216-88-0x000000013FC40000-0x0000000140032000-memory.dmp

Filesize
3.9MB

Download
memory/2216-19-0x0000000003120000-0x0000000003512000-memory.dmp

Filesize
3.9MB

Download
memory/2216-41-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Filesize
3.9MB

Download
memory/2216-12-0x000000013FD20000-0x0000000140112000-memory.dmp

Filesize
3.9MB

Download
memory/2216-71-0x00000000035E0000-0x00000000039D2000-memory.dmp

Filesize
3.9MB

Download
memory/2216-10126-0x00000000035E0000-0x00000000039D2000-memory.dmp

Filesize
3.9MB

Download
memory/2216-69-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/2216-47-0x0000000003120000-0x0000000003512000-memory.dmp

Filesize
3.9MB

Download
memory/2216-8164-0x00000000035E0000-0x00000000039D2000-memory.dmp

Filesize
3.9MB

Download
memory/2216-0-0x000000013F340000-0x000000013F732000-memory.dmp

Filesize
3.9MB

Download
memory/2216-51-0x0000000003120000-0x0000000003512000-memory.dmp

Filesize
3.9MB

Download
memory/2272-28-0x000000013F6E0000-0x000000013FAD2000-memory.dmp

Filesize
3.9MB

Download
memory/2272-6028-0x000000013F6E0000-0x000000013FAD2000-memory.dmp

Filesize
3.9MB

Download
memory/2284-42-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Filesize
3.9MB

Download
memory/2392-26-0x000000013FD20000-0x0000000140112000-memory.dmp

Filesize
3.9MB

Download
memory/2392-282-0x000000013FD20000-0x0000000140112000-memory.dmp

Filesize
3.9MB

Download
memory/2548-5946-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

Filesize
3.9MB

Download
memory/2548-29-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

Filesize
3.9MB

Download
memory/2600-5964-0x000000013F4F0000-0x000000013F8E2000-memory.dmp

Filesize
3.9MB

Download
memory/2600-54-0x000000013F4F0000-0x000000013F8E2000-memory.dmp

Filesize
3.9MB

Download
memory/2616-59-0x000000013FBE0000-0x000000013FFD2000-memory.dmp

Filesize
3.9MB

Download
memory/2616-1897-0x000000013FBE0000-0x000000013FFD2000-memory.dmp

Filesize
3.9MB

Download
memory/2628-89-0x000000013FC40000-0x0000000140032000-memory.dmp

Filesize
3.9MB

Download
memory/2628-5954-0x000000013FC40000-0x0000000140032000-memory.dmp

Filesize
3.9MB

Download
memory/2692-5947-0x000000013F3B0000-0x000000013F7A2000-memory.dmp

Filesize
3.9MB

Download
memory/2692-83-0x000000013F3B0000-0x000000013F7A2000-memory.dmp

Filesize
3.9MB

Download
memory/2720-647-0x000000013F650000-0x000000013FA42000-memory.dmp

Filesize
3.9MB

Download
memory/2720-6006-0x000000013F650000-0x000000013FA42000-memory.dmp

Filesize
3.9MB

Download
memory/2720-50-0x000000013F650000-0x000000013FA42000-memory.dmp

Filesize
3.9MB

Download
memory/2992-23-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download
memory/3008-70-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download