xmrig | 9d4af826b38b0dbf3d2500c7a3f4ed497ea191fef0ed04043423758ba7dad668

Analysis

max time kernel
150s
max time network
144s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 20:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
Size

1.4MB
MD5

3c87cabaeec0caab05649d3217b23ba0
SHA1

ef1a3e4958e96ca52a110f2010f8dd6f57981331
SHA256

9d4af826b38b0dbf3d2500c7a3f4ed497ea191fef0ed04043423758ba7dad668
SHA512

7332539692f907550d15b99b98fb7249188252f1c4394efa9834d1ef62f046afb6b6857dc8d4384a3cf29161fa2530470505f92e5995967adaa0b101fbb9616d
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYKpGncHBN/VPwK:Lz071uv4BPMkibTIA5CJr

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 18 IoCs

miner

resource	yara_rule
behavioral1/memory/2760-29-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	xmrig
behavioral1/memory/2224-16-0x000000013FAA0000-0x000000013FE92000-memory.dmp	xmrig
behavioral1/memory/2296-15-0x000000013F1F0000-0x000000013F5E2000-memory.dmp	xmrig
behavioral1/memory/2852-78-0x000000013F660000-0x000000013FA52000-memory.dmp	xmrig
behavioral1/memory/2508-87-0x000000013FE80000-0x0000000140272000-memory.dmp	xmrig
behavioral1/memory/1780-95-0x000000013F6B0000-0x000000013FAA2000-memory.dmp	xmrig
behavioral1/memory/2392-92-0x000000013F260000-0x000000013F652000-memory.dmp	xmrig
behavioral1/memory/1624-89-0x000000013F360000-0x000000013F752000-memory.dmp	xmrig
behavioral1/memory/2632-86-0x000000013F9D0000-0x000000013FDC2000-memory.dmp	xmrig
behavioral1/memory/2552-85-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	xmrig
behavioral1/memory/2604-98-0x000000013F240000-0x000000013F632000-memory.dmp	xmrig
behavioral1/memory/2604-4017-0x000000013F240000-0x000000013F632000-memory.dmp	xmrig
behavioral1/memory/2552-4335-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	xmrig
behavioral1/memory/1624-4337-0x000000013F360000-0x000000013F752000-memory.dmp	xmrig
behavioral1/memory/2632-4345-0x000000013F9D0000-0x000000013FDC2000-memory.dmp	xmrig
behavioral1/memory/2760-4373-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	xmrig
behavioral1/memory/2392-4431-0x000000013F260000-0x000000013F652000-memory.dmp	xmrig
behavioral1/memory/616-12032-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2024	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2224	JhnmRZT.exe
2296	FaDAhvF.exe
2760	JDMYZBv.exe
2604	bhDtEMc.exe
2852	gEzRhzC.exe
2552	iIekGgh.exe
2632	wQObCKW.exe
2508	pSdGBWW.exe
1624	XqvOFCL.exe
2392	czzIViz.exe
1780	goERqLJ.exe
976	pkXzDYS.exe
756	bclMpIP.exe
2728	kTERTYD.exe
2856	ZeYbbnS.exe
1812	FYLKBkm.exe
1616	qJZJQWY.exe
1552	pYIwsEs.exe
2424	kgmkNpO.exe
2844	jOaeHGr.exe
768	WTeANsu.exe
576	XLbOMtY.exe
824	JCFhddi.exe
2464	ObImdWE.exe
1704	qSvPIzh.exe
2324	aLcpMHq.exe
2132	vBGVlbe.exe
944	FwPNXuO.exe
1848	XLDqkTe.exe
1904	mjJYuxe.exe
604	cXuINoD.exe
3020	OekRLPN.exe
3060	GruHBWV.exe
2396	pDbVwRL.exe
1372	HMRPSph.exe
860	jqRHCqi.exe
2928	zHZaker.exe
1216	cmEwBHV.exe
2336	rkjcqcG.exe
2896	DbINVFD.exe
2676	dyfJUci.exe
2948	iMFQEJN.exe
2304	GxhPhEz.exe
2756	tndEUDp.exe
1672	itPokNZ.exe
2116	dEAwwsr.exe
2100	oMGBKQx.exe
1532	NbKYFBT.exe
552	DtCukUG.exe
1640	Rtlafzr.exe
2652	zIuyHZh.exe
1148	QYvvsps.exe
1760	RMCrfmZ.exe
1420	UDCZcAy.exe
3100	tcWNMWw.exe
3132	TMyOMFX.exe
3164	zAvuQQl.exe
3196	UCTWItG.exe
3228	QDaZnJg.exe
3260	bzjMvNw.exe
3292	czHIxAH.exe
3324	BIEhGTD.exe
3356	QUJPSro.exe
3388	yCvuILg.exe

Loads dropped DLL 64 IoCs

pid	Process
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe

UPX packed file 59 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/616-0-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	upx
behavioral1/files/0x000b000000012286-3.dat	upx
behavioral1/files/0x0038000000015686-10.dat	upx
behavioral1/files/0x0008000000015cb8-20.dat	upx
behavioral1/files/0x0007000000015cc7-33.dat	upx
behavioral1/files/0x000d00000000549e-37.dat	upx
behavioral1/files/0x0008000000015ce8-39.dat	upx
behavioral1/memory/2760-29-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	upx
behavioral1/memory/2224-16-0x000000013FAA0000-0x000000013FE92000-memory.dmp	upx
behavioral1/memory/2296-15-0x000000013F1F0000-0x000000013F5E2000-memory.dmp	upx
behavioral1/files/0x0007000000015cf0-45.dat	upx
behavioral1/files/0x00060000000165e1-67.dat	upx
behavioral1/files/0x0006000000016a8a-72.dat	upx
behavioral1/memory/2852-78-0x000000013F660000-0x000000013FA52000-memory.dmp	upx
behavioral1/memory/2508-87-0x000000013FE80000-0x0000000140272000-memory.dmp	upx
behavioral1/memory/1780-95-0x000000013F6B0000-0x000000013FAA2000-memory.dmp	upx
behavioral1/memory/2392-92-0x000000013F260000-0x000000013F652000-memory.dmp	upx
behavioral1/memory/1624-89-0x000000013F360000-0x000000013F752000-memory.dmp	upx
behavioral1/memory/2632-86-0x000000013F9D0000-0x000000013FDC2000-memory.dmp	upx
behavioral1/memory/2552-85-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	upx
behavioral1/files/0x0006000000016d4b-138.dat	upx
behavioral1/files/0x0006000000016ddc-173.dat	upx
behavioral1/files/0x00060000000173ca-187.dat	upx
behavioral1/files/0x0008000000015d12-55.dat	upx
behavioral1/files/0x0006000000016581-61.dat	upx
behavioral1/files/0x00060000000171d7-180.dat	upx
behavioral1/files/0x0006000000016dc8-166.dat	upx
behavioral1/files/0x0006000000016d9f-159.dat	upx
behavioral1/files/0x0006000000016d6f-152.dat	upx
behavioral1/files/0x0006000000016d64-145.dat	upx
behavioral1/files/0x0006000000016d3b-131.dat	upx
behavioral1/files/0x0006000000016d2a-124.dat	upx
behavioral1/files/0x0006000000016ceb-117.dat	upx
behavioral1/files/0x0006000000016c78-110.dat	upx
behavioral1/files/0x0037000000015693-103.dat	upx
behavioral1/files/0x0008000000016455-59.dat	upx
behavioral1/files/0x00060000000173f6-189.dat	upx
behavioral1/files/0x0006000000017223-182.dat	upx
behavioral1/files/0x0006000000016de3-175.dat	upx
behavioral1/files/0x0006000000016dd1-168.dat	upx
behavioral1/files/0x0006000000016dba-161.dat	upx
behavioral1/files/0x0006000000016d8b-154.dat	upx
behavioral1/files/0x0006000000016d68-147.dat	upx
behavioral1/files/0x0006000000016d5f-140.dat	upx
behavioral1/files/0x0006000000016d43-133.dat	upx
behavioral1/files/0x0006000000016d32-126.dat	upx
behavioral1/files/0x0006000000016d17-119.dat	upx
behavioral1/files/0x0006000000016cc1-112.dat	upx
behavioral1/files/0x0006000000016c6f-105.dat	upx
behavioral1/memory/2604-98-0x000000013F240000-0x000000013F632000-memory.dmp	upx
behavioral1/files/0x0006000000016c52-96.dat	upx
behavioral1/files/0x0006000000016835-69.dat	upx
behavioral1/memory/2604-4017-0x000000013F240000-0x000000013F632000-memory.dmp	upx
behavioral1/memory/2552-4335-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	upx
behavioral1/memory/1624-4337-0x000000013F360000-0x000000013F752000-memory.dmp	upx
behavioral1/memory/2632-4345-0x000000013F9D0000-0x000000013FDC2000-memory.dmp	upx
behavioral1/memory/2760-4373-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	upx
behavioral1/memory/2392-4431-0x000000013F260000-0x000000013F652000-memory.dmp	upx
behavioral1/memory/616-12032-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ezCqPLk.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\xJbxbOJ.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\eQlseXZ.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\gJUQZnE.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\cYnXUvh.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\LYORKmY.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\CpruRNC.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\dUbhowp.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\baeZIkg.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\RswMbJo.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\nCLpmXl.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\EiOmsZa.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\tPVoeLJ.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\gdegqmO.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\zAvuQQl.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\KtQemVs.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\JJFOTCv.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\MrvYcSU.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\srvFtTj.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\vNySSpH.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\noLNvrn.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\LniKnNR.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\DjFnPWu.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\sZTTYff.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\GkLfXdp.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\UDckaJS.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\WYJMysQ.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\BdWGftU.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\PoJFNRx.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\KakvNAd.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\QlXMUQq.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\UytIedy.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\IGCLejE.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\tPdAAtD.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\mQpNoxV.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\WETSkIY.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\HVmNsUI.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\NvcaEcL.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\ksgGYAu.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\GRNvHWY.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\jWAIybz.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\sfLfWez.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\qZOtbif.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\zKHQxxj.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\BhoXpTO.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\iIUQFXV.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\YAVAujq.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\NeXVboP.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\UqIMoQQ.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\toqGSZt.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\HrFzOYJ.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\mkjWtnf.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\ehMrFeZ.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\RBTYPJq.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\ZTTmHEs.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\qYNFbCZ.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\TYewdDZ.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\fvmsdxH.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\uYeVVTI.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\czmohIT.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\gUvrnxA.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\NLsNaYY.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\uwUfIfu.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
File created	C:\Windows\System\ygpfZDo.exe	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2024	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
Token: SeDebugPrivilege	2024	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 616 wrote to memory of 2024	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	29
PID 616 wrote to memory of 2024	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	29
PID 616 wrote to memory of 2024	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	29
PID 616 wrote to memory of 2224	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	30
PID 616 wrote to memory of 2224	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	30
PID 616 wrote to memory of 2224	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	30
PID 616 wrote to memory of 2296	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	31
PID 616 wrote to memory of 2296	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	31
PID 616 wrote to memory of 2296	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	31
PID 616 wrote to memory of 2760	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	32
PID 616 wrote to memory of 2760	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	32
PID 616 wrote to memory of 2760	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	32
PID 616 wrote to memory of 2604	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	33
PID 616 wrote to memory of 2604	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	33
PID 616 wrote to memory of 2604	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	33
PID 616 wrote to memory of 2852	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	34
PID 616 wrote to memory of 2852	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	34
PID 616 wrote to memory of 2852	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	34
PID 616 wrote to memory of 2632	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	35
PID 616 wrote to memory of 2632	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	35
PID 616 wrote to memory of 2632	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	35
PID 616 wrote to memory of 2552	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	36
PID 616 wrote to memory of 2552	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	36
PID 616 wrote to memory of 2552	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	36
PID 616 wrote to memory of 2508	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	37
PID 616 wrote to memory of 2508	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	37
PID 616 wrote to memory of 2508	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	37
PID 616 wrote to memory of 1624	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	38
PID 616 wrote to memory of 1624	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	38
PID 616 wrote to memory of 1624	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	38
PID 616 wrote to memory of 2328	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	39
PID 616 wrote to memory of 2328	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	39
PID 616 wrote to memory of 2328	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	39
PID 616 wrote to memory of 2392	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	40
PID 616 wrote to memory of 2392	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	40
PID 616 wrote to memory of 2392	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	40
PID 616 wrote to memory of 2988	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	41
PID 616 wrote to memory of 2988	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	41
PID 616 wrote to memory of 2988	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	41
PID 616 wrote to memory of 1780	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	42
PID 616 wrote to memory of 1780	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	42
PID 616 wrote to memory of 1780	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	42
PID 616 wrote to memory of 2732	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	43
PID 616 wrote to memory of 2732	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	43
PID 616 wrote to memory of 2732	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	43
PID 616 wrote to memory of 976	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	44
PID 616 wrote to memory of 976	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	44
PID 616 wrote to memory of 976	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	44
PID 616 wrote to memory of 1928	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	45
PID 616 wrote to memory of 1928	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	45
PID 616 wrote to memory of 1928	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	45
PID 616 wrote to memory of 756	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	46
PID 616 wrote to memory of 756	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	46
PID 616 wrote to memory of 756	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	46
PID 616 wrote to memory of 2564	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	47
PID 616 wrote to memory of 2564	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	47
PID 616 wrote to memory of 2564	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	47
PID 616 wrote to memory of 2728	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	48
PID 616 wrote to memory of 2728	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	48
PID 616 wrote to memory of 2728	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	48
PID 616 wrote to memory of 2872	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	49
PID 616 wrote to memory of 2872	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	49
PID 616 wrote to memory of 2872	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	49
PID 616 wrote to memory of 2856	616	3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3c87cabaeec0caab05649d3217b23ba0_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:616
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2024
- C:\Windows\System\JhnmRZT.exe
  C:\Windows\System\JhnmRZT.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\FaDAhvF.exe
  C:\Windows\System\FaDAhvF.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\JDMYZBv.exe
  C:\Windows\System\JDMYZBv.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\bhDtEMc.exe
  C:\Windows\System\bhDtEMc.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\gEzRhzC.exe
  C:\Windows\System\gEzRhzC.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\wQObCKW.exe
  C:\Windows\System\wQObCKW.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\iIekGgh.exe
  C:\Windows\System\iIekGgh.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\pSdGBWW.exe
  C:\Windows\System\pSdGBWW.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\XqvOFCL.exe
  C:\Windows\System\XqvOFCL.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\GZHrPWV.exe
  C:\Windows\System\GZHrPWV.exe
  2⤵
  PID:2328
- C:\Windows\System\czzIViz.exe
  C:\Windows\System\czzIViz.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\aLviwAS.exe
  C:\Windows\System\aLviwAS.exe
  2⤵
  PID:2988
- C:\Windows\System\goERqLJ.exe
  C:\Windows\System\goERqLJ.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\CcfzGtY.exe
  C:\Windows\System\CcfzGtY.exe
  2⤵
  PID:2732
- C:\Windows\System\pkXzDYS.exe
  C:\Windows\System\pkXzDYS.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\osJacBv.exe
  C:\Windows\System\osJacBv.exe
  2⤵
  PID:1928
- C:\Windows\System\bclMpIP.exe
  C:\Windows\System\bclMpIP.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\ijdIYtu.exe
  C:\Windows\System\ijdIYtu.exe
  2⤵
  PID:2564
- C:\Windows\System\kTERTYD.exe
  C:\Windows\System\kTERTYD.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\Zeazkvm.exe
  C:\Windows\System\Zeazkvm.exe
  2⤵
  PID:2872
- C:\Windows\System\ZeYbbnS.exe
  C:\Windows\System\ZeYbbnS.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\LJKlyJH.exe
  C:\Windows\System\LJKlyJH.exe
  2⤵
  PID:832
- C:\Windows\System\FYLKBkm.exe
  C:\Windows\System\FYLKBkm.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\gTMsZLb.exe
  C:\Windows\System\gTMsZLb.exe
  2⤵
  PID:356
- C:\Windows\System\qJZJQWY.exe
  C:\Windows\System\qJZJQWY.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\budyNwF.exe
  C:\Windows\System\budyNwF.exe
  2⤵
  PID:2124
- C:\Windows\System\pYIwsEs.exe
  C:\Windows\System\pYIwsEs.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\iWzQWiA.exe
  C:\Windows\System\iWzQWiA.exe
  2⤵
  PID:1072
- C:\Windows\System\kgmkNpO.exe
  C:\Windows\System\kgmkNpO.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\bRGZHoF.exe
  C:\Windows\System\bRGZHoF.exe
  2⤵
  PID:2916
- C:\Windows\System\jOaeHGr.exe
  C:\Windows\System\jOaeHGr.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\porLYBl.exe
  C:\Windows\System\porLYBl.exe
  2⤵
  PID:2816
- C:\Windows\System\WTeANsu.exe
  C:\Windows\System\WTeANsu.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\wJjyljd.exe
  C:\Windows\System\wJjyljd.exe
  2⤵
  PID:1028
- C:\Windows\System\XLbOMtY.exe
  C:\Windows\System\XLbOMtY.exe
  2⤵
  - Executes dropped EXE
  PID:576
- C:\Windows\System\cRoKhIo.exe
  C:\Windows\System\cRoKhIo.exe
  2⤵
  PID:1092
- C:\Windows\System\JCFhddi.exe
  C:\Windows\System\JCFhddi.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\GgNJDre.exe
  C:\Windows\System\GgNJDre.exe
  2⤵
  PID:1840
- C:\Windows\System\ObImdWE.exe
  C:\Windows\System\ObImdWE.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\CsDnxcc.exe
  C:\Windows\System\CsDnxcc.exe
  2⤵
  PID:748
- C:\Windows\System\qSvPIzh.exe
  C:\Windows\System\qSvPIzh.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\smhACtx.exe
  C:\Windows\System\smhACtx.exe
  2⤵
  PID:2320
- C:\Windows\System\aLcpMHq.exe
  C:\Windows\System\aLcpMHq.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\iXPNsXv.exe
  C:\Windows\System\iXPNsXv.exe
  2⤵
  PID:492
- C:\Windows\System\vBGVlbe.exe
  C:\Windows\System\vBGVlbe.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\akSVttj.exe
  C:\Windows\System\akSVttj.exe
  2⤵
  PID:1544
- C:\Windows\System\FwPNXuO.exe
  C:\Windows\System\FwPNXuO.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\iKFPMZh.exe
  C:\Windows\System\iKFPMZh.exe
  2⤵
  PID:2044
- C:\Windows\System\XLDqkTe.exe
  C:\Windows\System\XLDqkTe.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\IYdqaWE.exe
  C:\Windows\System\IYdqaWE.exe
  2⤵
  PID:1884
- C:\Windows\System\mjJYuxe.exe
  C:\Windows\System\mjJYuxe.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\YPHANmf.exe
  C:\Windows\System\YPHANmf.exe
  2⤵
  PID:1892
- C:\Windows\System\cXuINoD.exe
  C:\Windows\System\cXuINoD.exe
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\System\RadSSlX.exe
  C:\Windows\System\RadSSlX.exe
  2⤵
  PID:2356
- C:\Windows\System\OekRLPN.exe
  C:\Windows\System\OekRLPN.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\FzqBrDr.exe
  C:\Windows\System\FzqBrDr.exe
  2⤵
  PID:2956
- C:\Windows\System\GruHBWV.exe
  C:\Windows\System\GruHBWV.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\imDGVQV.exe
  C:\Windows\System\imDGVQV.exe
  2⤵
  PID:2944
- C:\Windows\System\pDbVwRL.exe
  C:\Windows\System\pDbVwRL.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\dkIPFoM.exe
  C:\Windows\System\dkIPFoM.exe
  2⤵
  PID:540
- C:\Windows\System\HMRPSph.exe
  C:\Windows\System\HMRPSph.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\zsdMmJQ.exe
  C:\Windows\System\zsdMmJQ.exe
  2⤵
  PID:1488
- C:\Windows\System\jqRHCqi.exe
  C:\Windows\System\jqRHCqi.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\yOIxuHM.exe
  C:\Windows\System\yOIxuHM.exe
  2⤵
  PID:2940
- C:\Windows\System\zHZaker.exe
  C:\Windows\System\zHZaker.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\OpgLzNy.exe
  C:\Windows\System\OpgLzNy.exe
  2⤵
  PID:1592
- C:\Windows\System\cmEwBHV.exe
  C:\Windows\System\cmEwBHV.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\CjPmQBB.exe
  C:\Windows\System\CjPmQBB.exe
  2⤵
  PID:2680
- C:\Windows\System\rkjcqcG.exe
  C:\Windows\System\rkjcqcG.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\destPbY.exe
  C:\Windows\System\destPbY.exe
  2⤵
  PID:2600
- C:\Windows\System\DbINVFD.exe
  C:\Windows\System\DbINVFD.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\ZdMikPN.exe
  C:\Windows\System\ZdMikPN.exe
  2⤵
  PID:3024
- C:\Windows\System\dyfJUci.exe
  C:\Windows\System\dyfJUci.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\GJSeHjS.exe
  C:\Windows\System\GJSeHjS.exe
  2⤵
  PID:2492
- C:\Windows\System\iMFQEJN.exe
  C:\Windows\System\iMFQEJN.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\OpULPLN.exe
  C:\Windows\System\OpULPLN.exe
  2⤵
  PID:2528
- C:\Windows\System\GxhPhEz.exe
  C:\Windows\System\GxhPhEz.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\PGWjpxk.exe
  C:\Windows\System\PGWjpxk.exe
  2⤵
  PID:2032
- C:\Windows\System\tndEUDp.exe
  C:\Windows\System\tndEUDp.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\JOgEPog.exe
  C:\Windows\System\JOgEPog.exe
  2⤵
  PID:1612
- C:\Windows\System\itPokNZ.exe
  C:\Windows\System\itPokNZ.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\zKUccXY.exe
  C:\Windows\System\zKUccXY.exe
  2⤵
  PID:2284
- C:\Windows\System\dEAwwsr.exe
  C:\Windows\System\dEAwwsr.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\dBsebVP.exe
  C:\Windows\System\dBsebVP.exe
  2⤵
  PID:268
- C:\Windows\System\oMGBKQx.exe
  C:\Windows\System\oMGBKQx.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\KihknRf.exe
  C:\Windows\System\KihknRf.exe
  2⤵
  PID:1944
- C:\Windows\System\NbKYFBT.exe
  C:\Windows\System\NbKYFBT.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\AJpJOlj.exe
  C:\Windows\System\AJpJOlj.exe
  2⤵
  PID:284
- C:\Windows\System\DtCukUG.exe
  C:\Windows\System\DtCukUG.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\keVyJOg.exe
  C:\Windows\System\keVyJOg.exe
  2⤵
  PID:2292
- C:\Windows\System\Rtlafzr.exe
  C:\Windows\System\Rtlafzr.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\hIGmDJv.exe
  C:\Windows\System\hIGmDJv.exe
  2⤵
  PID:1584
- C:\Windows\System\zIuyHZh.exe
  C:\Windows\System\zIuyHZh.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\bnCuvIY.exe
  C:\Windows\System\bnCuvIY.exe
  2⤵
  PID:3056
- C:\Windows\System\QYvvsps.exe
  C:\Windows\System\QYvvsps.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\mJsVZTi.exe
  C:\Windows\System\mJsVZTi.exe
  2⤵
  PID:2860
- C:\Windows\System\RMCrfmZ.exe
  C:\Windows\System\RMCrfmZ.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\XEzQmSW.exe
  C:\Windows\System\XEzQmSW.exe
  2⤵
  PID:3008
- C:\Windows\System\UDCZcAy.exe
  C:\Windows\System\UDCZcAy.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\xrClzpL.exe
  C:\Windows\System\xrClzpL.exe
  2⤵
  PID:3084
- C:\Windows\System\tcWNMWw.exe
  C:\Windows\System\tcWNMWw.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\BdeRmYH.exe
  C:\Windows\System\BdeRmYH.exe
  2⤵
  PID:3116
- C:\Windows\System\TMyOMFX.exe
  C:\Windows\System\TMyOMFX.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\pjZarfc.exe
  C:\Windows\System\pjZarfc.exe
  2⤵
  PID:3148
- C:\Windows\System\zAvuQQl.exe
  C:\Windows\System\zAvuQQl.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\BMqMLdM.exe
  C:\Windows\System\BMqMLdM.exe
  2⤵
  PID:3180
- C:\Windows\System\UCTWItG.exe
  C:\Windows\System\UCTWItG.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\VrAagwz.exe
  C:\Windows\System\VrAagwz.exe
  2⤵
  PID:3212
- C:\Windows\System\QDaZnJg.exe
  C:\Windows\System\QDaZnJg.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\GISpxfI.exe
  C:\Windows\System\GISpxfI.exe
  2⤵
  PID:3244
- C:\Windows\System\bzjMvNw.exe
  C:\Windows\System\bzjMvNw.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\XqeytjQ.exe
  C:\Windows\System\XqeytjQ.exe
  2⤵
  PID:3276
- C:\Windows\System\czHIxAH.exe
  C:\Windows\System\czHIxAH.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\bYHoNRu.exe
  C:\Windows\System\bYHoNRu.exe
  2⤵
  PID:3308
- C:\Windows\System\BIEhGTD.exe
  C:\Windows\System\BIEhGTD.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\hebxyYf.exe
  C:\Windows\System\hebxyYf.exe
  2⤵
  PID:3340
- C:\Windows\System\QUJPSro.exe
  C:\Windows\System\QUJPSro.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\KptmJdK.exe
  C:\Windows\System\KptmJdK.exe
  2⤵
  PID:3372
- C:\Windows\System\yCvuILg.exe
  C:\Windows\System\yCvuILg.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\vBiYkNb.exe
  C:\Windows\System\vBiYkNb.exe
  2⤵
  PID:3404
- C:\Windows\System\PsvaGDs.exe
  C:\Windows\System\PsvaGDs.exe
  2⤵
  PID:3420
- C:\Windows\System\VUnHWJm.exe
  C:\Windows\System\VUnHWJm.exe
  2⤵
  PID:3436
- C:\Windows\System\ZiWTocA.exe
  C:\Windows\System\ZiWTocA.exe
  2⤵
  PID:3452
- C:\Windows\System\LjPRCmg.exe
  C:\Windows\System\LjPRCmg.exe
  2⤵
  PID:3468
- C:\Windows\System\oZQUIfc.exe
  C:\Windows\System\oZQUIfc.exe
  2⤵
  PID:3484
- C:\Windows\System\rAupfAp.exe
  C:\Windows\System\rAupfAp.exe
  2⤵
  PID:3500
- C:\Windows\System\CQRuSBH.exe
  C:\Windows\System\CQRuSBH.exe
  2⤵
  PID:3516
- C:\Windows\System\vxKUtln.exe
  C:\Windows\System\vxKUtln.exe
  2⤵
  PID:3532
- C:\Windows\System\boLCwAR.exe
  C:\Windows\System\boLCwAR.exe
  2⤵
  PID:3548
- C:\Windows\System\sqTkjmS.exe
  C:\Windows\System\sqTkjmS.exe
  2⤵
  PID:3564
- C:\Windows\System\rZxWsAO.exe
  C:\Windows\System\rZxWsAO.exe
  2⤵
  PID:3580
- C:\Windows\System\VATbOXn.exe
  C:\Windows\System\VATbOXn.exe
  2⤵
  PID:3596
- C:\Windows\System\AZBwrBJ.exe
  C:\Windows\System\AZBwrBJ.exe
  2⤵
  PID:3612
- C:\Windows\System\CaiUIcQ.exe
  C:\Windows\System\CaiUIcQ.exe
  2⤵
  PID:3628
- C:\Windows\System\XpWJGKX.exe
  C:\Windows\System\XpWJGKX.exe
  2⤵
  PID:3644
- C:\Windows\System\ipOUCXE.exe
  C:\Windows\System\ipOUCXE.exe
  2⤵
  PID:3660
- C:\Windows\System\zhHIMzb.exe
  C:\Windows\System\zhHIMzb.exe
  2⤵
  PID:3676
- C:\Windows\System\Iioqzej.exe
  C:\Windows\System\Iioqzej.exe
  2⤵
  PID:3692
- C:\Windows\System\ZSJPiiG.exe
  C:\Windows\System\ZSJPiiG.exe
  2⤵
  PID:3708
- C:\Windows\System\ZlCUcDa.exe
  C:\Windows\System\ZlCUcDa.exe
  2⤵
  PID:3724
- C:\Windows\System\xvhPrYx.exe
  C:\Windows\System\xvhPrYx.exe
  2⤵
  PID:3740
- C:\Windows\System\PQdXJVO.exe
  C:\Windows\System\PQdXJVO.exe
  2⤵
  PID:3756
- C:\Windows\System\vSCJmju.exe
  C:\Windows\System\vSCJmju.exe
  2⤵
  PID:3772
- C:\Windows\System\vmutmqx.exe
  C:\Windows\System\vmutmqx.exe
  2⤵
  PID:3788
- C:\Windows\System\oJZYsnJ.exe
  C:\Windows\System\oJZYsnJ.exe
  2⤵
  PID:3804
- C:\Windows\System\ZpiWnUN.exe
  C:\Windows\System\ZpiWnUN.exe
  2⤵
  PID:3820
- C:\Windows\System\uYfMACw.exe
  C:\Windows\System\uYfMACw.exe
  2⤵
  PID:3836
- C:\Windows\System\jTbYmjH.exe
  C:\Windows\System\jTbYmjH.exe
  2⤵
  PID:3852
- C:\Windows\System\QbOUBbh.exe
  C:\Windows\System\QbOUBbh.exe
  2⤵
  PID:3868
- C:\Windows\System\YFHmpVt.exe
  C:\Windows\System\YFHmpVt.exe
  2⤵
  PID:3884
- C:\Windows\System\QRZBPDv.exe
  C:\Windows\System\QRZBPDv.exe
  2⤵
  PID:3900
- C:\Windows\System\dIZTjEM.exe
  C:\Windows\System\dIZTjEM.exe
  2⤵
  PID:3916
- C:\Windows\System\rEaZWPe.exe
  C:\Windows\System\rEaZWPe.exe
  2⤵
  PID:3932
- C:\Windows\System\rLCbUiD.exe
  C:\Windows\System\rLCbUiD.exe
  2⤵
  PID:3948
- C:\Windows\System\BWxhkoy.exe
  C:\Windows\System\BWxhkoy.exe
  2⤵
  PID:3964
- C:\Windows\System\mEIoVFY.exe
  C:\Windows\System\mEIoVFY.exe
  2⤵
  PID:3980
- C:\Windows\System\OJlmsNo.exe
  C:\Windows\System\OJlmsNo.exe
  2⤵
  PID:3996
- C:\Windows\System\CpruRNC.exe
  C:\Windows\System\CpruRNC.exe
  2⤵
  PID:4012
- C:\Windows\System\ZhNUPsH.exe
  C:\Windows\System\ZhNUPsH.exe
  2⤵
  PID:4028
- C:\Windows\System\bnAZdgP.exe
  C:\Windows\System\bnAZdgP.exe
  2⤵
  PID:4044
- C:\Windows\System\fwqtFNy.exe
  C:\Windows\System\fwqtFNy.exe
  2⤵
  PID:4060
- C:\Windows\System\wJkkWcz.exe
  C:\Windows\System\wJkkWcz.exe
  2⤵
  PID:4076
- C:\Windows\System\uGXiuiX.exe
  C:\Windows\System\uGXiuiX.exe
  2⤵
  PID:4092
- C:\Windows\System\ODIbrXh.exe
  C:\Windows\System\ODIbrXh.exe
  2⤵
  PID:1604
- C:\Windows\System\eXJZGFR.exe
  C:\Windows\System\eXJZGFR.exe
  2⤵
  PID:3112
- C:\Windows\System\TFaNGCC.exe
  C:\Windows\System\TFaNGCC.exe
  2⤵
  PID:3176
- C:\Windows\System\uLoGZBQ.exe
  C:\Windows\System\uLoGZBQ.exe
  2⤵
  PID:3240
- C:\Windows\System\ATGrAgj.exe
  C:\Windows\System\ATGrAgj.exe
  2⤵
  PID:3272
- C:\Windows\System\EUbJwZn.exe
  C:\Windows\System\EUbJwZn.exe
  2⤵
  PID:3336
- C:\Windows\System\zbBtUof.exe
  C:\Windows\System\zbBtUof.exe
  2⤵
  PID:788
- C:\Windows\System\QOgdgBB.exe
  C:\Windows\System\QOgdgBB.exe
  2⤵
  PID:3432
- C:\Windows\System\cNGrSeB.exe
  C:\Windows\System\cNGrSeB.exe
  2⤵
  PID:3496
- C:\Windows\System\pJhHZBX.exe
  C:\Windows\System\pJhHZBX.exe
  2⤵
  PID:3560
- C:\Windows\System\GaBQKWL.exe
  C:\Windows\System\GaBQKWL.exe
  2⤵
  PID:3624
- C:\Windows\System\zsfjvNY.exe
  C:\Windows\System\zsfjvNY.exe
  2⤵
  PID:3688
- C:\Windows\System\yspLNxX.exe
  C:\Windows\System\yspLNxX.exe
  2⤵
  PID:1284
- C:\Windows\System\kuQuAqH.exe
  C:\Windows\System\kuQuAqH.exe
  2⤵
  PID:3032
- C:\Windows\System\ArQlsfr.exe
  C:\Windows\System\ArQlsfr.exe
  2⤵
  PID:2260
- C:\Windows\System\hpJYaek.exe
  C:\Windows\System\hpJYaek.exe
  2⤵
  PID:3816
- C:\Windows\System\xTnJQvK.exe
  C:\Windows\System\xTnJQvK.exe
  2⤵
  PID:3848
- C:\Windows\System\MphfWqW.exe
  C:\Windows\System\MphfWqW.exe
  2⤵
  PID:2088
- C:\Windows\System\BwaiVOU.exe
  C:\Windows\System\BwaiVOU.exe
  2⤵
  PID:3912
- C:\Windows\System\ItLjKXc.exe
  C:\Windows\System\ItLjKXc.exe
  2⤵
  PID:3976
- C:\Windows\System\LwJCsmo.exe
  C:\Windows\System\LwJCsmo.exe
  2⤵
  PID:4040
- C:\Windows\System\awsKAch.exe
  C:\Windows\System\awsKAch.exe
  2⤵
  PID:1344
- C:\Windows\System\gHVpndj.exe
  C:\Windows\System\gHVpndj.exe
  2⤵
  PID:1988
- C:\Windows\System\lqmQTtq.exe
  C:\Windows\System\lqmQTtq.exe
  2⤵
  PID:3492
- C:\Windows\System\AAqbFfG.exe
  C:\Windows\System\AAqbFfG.exe
  2⤵
  PID:3748
- C:\Windows\System\NSpupzb.exe
  C:\Windows\System\NSpupzb.exe
  2⤵
  PID:2740
- C:\Windows\System\dOulVTH.exe
  C:\Windows\System\dOulVTH.exe
  2⤵
  PID:4108
- C:\Windows\System\oAhFjgR.exe
  C:\Windows\System\oAhFjgR.exe
  2⤵
  PID:4124
- C:\Windows\System\hhKgnNS.exe
  C:\Windows\System\hhKgnNS.exe
  2⤵
  PID:4140
- C:\Windows\System\LbVKajU.exe
  C:\Windows\System\LbVKajU.exe
  2⤵
  PID:4156
- C:\Windows\System\PfEbeqP.exe
  C:\Windows\System\PfEbeqP.exe
  2⤵
  PID:4172
- C:\Windows\System\EylJekI.exe
  C:\Windows\System\EylJekI.exe
  2⤵
  PID:4188
- C:\Windows\System\LsQLYpc.exe
  C:\Windows\System\LsQLYpc.exe
  2⤵
  PID:4204
- C:\Windows\System\iKhZDEJ.exe
  C:\Windows\System\iKhZDEJ.exe
  2⤵
  PID:4220
- C:\Windows\System\RVlNHOq.exe
  C:\Windows\System\RVlNHOq.exe
  2⤵
  PID:4236
- C:\Windows\System\emZkDEl.exe
  C:\Windows\System\emZkDEl.exe
  2⤵
  PID:4252
- C:\Windows\System\bZdvTmA.exe
  C:\Windows\System\bZdvTmA.exe
  2⤵
  PID:4268
- C:\Windows\System\fOfilCW.exe
  C:\Windows\System\fOfilCW.exe
  2⤵
  PID:4284
- C:\Windows\System\fjIstco.exe
  C:\Windows\System\fjIstco.exe
  2⤵
  PID:4300
- C:\Windows\System\lgjTHyc.exe
  C:\Windows\System\lgjTHyc.exe
  2⤵
  PID:4316
- C:\Windows\System\LhUEevp.exe
  C:\Windows\System\LhUEevp.exe
  2⤵
  PID:4336
- C:\Windows\System\VxfARiA.exe
  C:\Windows\System\VxfARiA.exe
  2⤵
  PID:4352
- C:\Windows\System\aYpmbyK.exe
  C:\Windows\System\aYpmbyK.exe
  2⤵
  PID:4368
- C:\Windows\System\hPdFGAV.exe
  C:\Windows\System\hPdFGAV.exe
  2⤵
  PID:4384
- C:\Windows\System\eKGXHvO.exe
  C:\Windows\System\eKGXHvO.exe
  2⤵
  PID:4400
- C:\Windows\System\OHnoeNk.exe
  C:\Windows\System\OHnoeNk.exe
  2⤵
  PID:4416
- C:\Windows\System\QBthJHX.exe
  C:\Windows\System\QBthJHX.exe
  2⤵
  PID:4432
- C:\Windows\System\JejmTDp.exe
  C:\Windows\System\JejmTDp.exe
  2⤵
  PID:4448
- C:\Windows\System\VLxzvrQ.exe
  C:\Windows\System\VLxzvrQ.exe
  2⤵
  PID:4464
- C:\Windows\System\NLsNaYY.exe
  C:\Windows\System\NLsNaYY.exe
  2⤵
  PID:4480
- C:\Windows\System\xuKbPuu.exe
  C:\Windows\System\xuKbPuu.exe
  2⤵
  PID:4496
- C:\Windows\System\mBQJito.exe
  C:\Windows\System\mBQJito.exe
  2⤵
  PID:4512
- C:\Windows\System\bjTTTjg.exe
  C:\Windows\System\bjTTTjg.exe
  2⤵
  PID:4528
- C:\Windows\System\WFbZAmd.exe
  C:\Windows\System\WFbZAmd.exe
  2⤵
  PID:4544
- C:\Windows\System\vhZmTpu.exe
  C:\Windows\System\vhZmTpu.exe
  2⤵
  PID:4560
- C:\Windows\System\SVyPBpO.exe
  C:\Windows\System\SVyPBpO.exe
  2⤵
  PID:4576
- C:\Windows\System\HjvFYBr.exe
  C:\Windows\System\HjvFYBr.exe
  2⤵
  PID:4592
- C:\Windows\System\aCNcRWc.exe
  C:\Windows\System\aCNcRWc.exe
  2⤵
  PID:4608
- C:\Windows\System\kILmkyh.exe
  C:\Windows\System\kILmkyh.exe
  2⤵
  PID:4628
- C:\Windows\System\gMrguHl.exe
  C:\Windows\System\gMrguHl.exe
  2⤵
  PID:4652
- C:\Windows\System\eJtitfl.exe
  C:\Windows\System\eJtitfl.exe
  2⤵
  PID:4684
- C:\Windows\System\MbzOFgN.exe
  C:\Windows\System\MbzOFgN.exe
  2⤵
  PID:4760
- C:\Windows\System\ViwtYxg.exe
  C:\Windows\System\ViwtYxg.exe
  2⤵
  PID:4776
- C:\Windows\System\xLBUgrF.exe
  C:\Windows\System\xLBUgrF.exe
  2⤵
  PID:4792
- C:\Windows\System\dSXVMGR.exe
  C:\Windows\System\dSXVMGR.exe
  2⤵
  PID:4808
- C:\Windows\System\YXykIAD.exe
  C:\Windows\System\YXykIAD.exe
  2⤵
  PID:4824
- C:\Windows\System\UfHIHEr.exe
  C:\Windows\System\UfHIHEr.exe
  2⤵
  PID:4840
- C:\Windows\System\xNvdTZD.exe
  C:\Windows\System\xNvdTZD.exe
  2⤵
  PID:4856
- C:\Windows\System\AvoVxEC.exe
  C:\Windows\System\AvoVxEC.exe
  2⤵
  PID:4872
- C:\Windows\System\sfLfWez.exe
  C:\Windows\System\sfLfWez.exe
  2⤵
  PID:4888
- C:\Windows\System\zmOrolm.exe
  C:\Windows\System\zmOrolm.exe
  2⤵
  PID:4904
- C:\Windows\System\xGHiiIp.exe
  C:\Windows\System\xGHiiIp.exe
  2⤵
  PID:4920
- C:\Windows\System\VpzHIAS.exe
  C:\Windows\System\VpzHIAS.exe
  2⤵
  PID:4936
- C:\Windows\System\UTOPelh.exe
  C:\Windows\System\UTOPelh.exe
  2⤵
  PID:4952
- C:\Windows\System\cAsvoqY.exe
  C:\Windows\System\cAsvoqY.exe
  2⤵
  PID:4968
- C:\Windows\System\ysfVZya.exe
  C:\Windows\System\ysfVZya.exe
  2⤵
  PID:4984
- C:\Windows\System\GmZqcJa.exe
  C:\Windows\System\GmZqcJa.exe
  2⤵
  PID:5000
- C:\Windows\System\LroTkMU.exe
  C:\Windows\System\LroTkMU.exe
  2⤵
  PID:5016
- C:\Windows\System\SsmzBoR.exe
  C:\Windows\System\SsmzBoR.exe
  2⤵
  PID:5032
- C:\Windows\System\PfQxJNA.exe
  C:\Windows\System\PfQxJNA.exe
  2⤵
  PID:5048
- C:\Windows\System\cTEhzPG.exe
  C:\Windows\System\cTEhzPG.exe
  2⤵
  PID:5064
- C:\Windows\System\ODwAlHr.exe
  C:\Windows\System\ODwAlHr.exe
  2⤵
  PID:5080
- C:\Windows\System\kBLZXbo.exe
  C:\Windows\System\kBLZXbo.exe
  2⤵
  PID:5100
- C:\Windows\System\iDaEpLP.exe
  C:\Windows\System\iDaEpLP.exe
  2⤵
  PID:3720
- C:\Windows\System\vECcXeQ.exe
  C:\Windows\System\vECcXeQ.exe
  2⤵
  PID:2252
- C:\Windows\System\VrVZXBx.exe
  C:\Windows\System\VrVZXBx.exe
  2⤵
  PID:4228
- C:\Windows\System\BDqRnPc.exe
  C:\Windows\System\BDqRnPc.exe
  2⤵
  PID:2836
- C:\Windows\System\TjdOKQn.exe
  C:\Windows\System\TjdOKQn.exe
  2⤵
  PID:4292
- C:\Windows\System\cJAosGa.exe
  C:\Windows\System\cJAosGa.exe
  2⤵
  PID:2080
- C:\Windows\System\YDMmQqu.exe
  C:\Windows\System\YDMmQqu.exe
  2⤵
  PID:4360
- C:\Windows\System\bzaZtas.exe
  C:\Windows\System\bzaZtas.exe
  2⤵
  PID:4396
- C:\Windows\System\lihDpIO.exe
  C:\Windows\System\lihDpIO.exe
  2⤵
  PID:4460
- C:\Windows\System\QSxSUfK.exe
  C:\Windows\System\QSxSUfK.exe
  2⤵
  PID:4524
- C:\Windows\System\WdDJkrK.exe
  C:\Windows\System\WdDJkrK.exe
  2⤵
  PID:4556
- C:\Windows\System\PEzHwEE.exe
  C:\Windows\System\PEzHwEE.exe
  2⤵
  PID:2744
- C:\Windows\System\SfHKoyu.exe
  C:\Windows\System\SfHKoyu.exe
  2⤵
  PID:4616
- C:\Windows\System\IKsjssr.exe
  C:\Windows\System\IKsjssr.exe
  2⤵
  PID:4664
- C:\Windows\System\Fgskyhg.exe
  C:\Windows\System\Fgskyhg.exe
  2⤵
  PID:4800
- C:\Windows\System\gzAeOwa.exe
  C:\Windows\System\gzAeOwa.exe
  2⤵
  PID:4864
- C:\Windows\System\QSXUWHR.exe
  C:\Windows\System\QSXUWHR.exe
  2⤵
  PID:4928
- C:\Windows\System\WRSIfnT.exe
  C:\Windows\System\WRSIfnT.exe
  2⤵
  PID:4992
- C:\Windows\System\aeHcHuu.exe
  C:\Windows\System\aeHcHuu.exe
  2⤵
  PID:5056
- C:\Windows\System\TZGDrxp.exe
  C:\Windows\System\TZGDrxp.exe
  2⤵
  PID:2352
- C:\Windows\System\eaAQvYR.exe
  C:\Windows\System\eaAQvYR.exe
  2⤵
  PID:1600
- C:\Windows\System\cvBhJnf.exe
  C:\Windows\System\cvBhJnf.exe
  2⤵
  PID:4136
- C:\Windows\System\CgneWTe.exe
  C:\Windows\System\CgneWTe.exe
  2⤵
  PID:1688
- C:\Windows\System\JiwNZsc.exe
  C:\Windows\System\JiwNZsc.exe
  2⤵
  PID:1428
- C:\Windows\System\WSLtyxK.exe
  C:\Windows\System\WSLtyxK.exe
  2⤵
  PID:2724
- C:\Windows\System\umwugSs.exe
  C:\Windows\System\umwugSs.exe
  2⤵
  PID:4836
- C:\Windows\System\SDSHETs.exe
  C:\Windows\System\SDSHETs.exe
  2⤵
  PID:5092
- C:\Windows\System\JOniORh.exe
  C:\Windows\System\JOniORh.exe
  2⤵
  PID:2616
- C:\Windows\System\eUlxCnm.exe
  C:\Windows\System\eUlxCnm.exe
  2⤵
  PID:4392
- C:\Windows\System\iSkglvY.exe
  C:\Windows\System\iSkglvY.exe
  2⤵
  PID:5136
- C:\Windows\System\zfwkPZU.exe
  C:\Windows\System\zfwkPZU.exe
  2⤵
  PID:5152
- C:\Windows\System\uDRgzkV.exe
  C:\Windows\System\uDRgzkV.exe
  2⤵
  PID:5168
- C:\Windows\System\XAQGVQg.exe
  C:\Windows\System\XAQGVQg.exe
  2⤵
  PID:5192
- C:\Windows\System\bzTNFQp.exe
  C:\Windows\System\bzTNFQp.exe
  2⤵
  PID:5284
- C:\Windows\System\QtJQHGB.exe
  C:\Windows\System\QtJQHGB.exe
  2⤵
  PID:5300
- C:\Windows\System\BznnUiN.exe
  C:\Windows\System\BznnUiN.exe
  2⤵
  PID:5316
- C:\Windows\System\tAiqxkm.exe
  C:\Windows\System\tAiqxkm.exe
  2⤵
  PID:5332
- C:\Windows\System\ndKLouc.exe
  C:\Windows\System\ndKLouc.exe
  2⤵
  PID:5348
- C:\Windows\System\UkLbUjL.exe
  C:\Windows\System\UkLbUjL.exe
  2⤵
  PID:5364
- C:\Windows\System\NvcaEcL.exe
  C:\Windows\System\NvcaEcL.exe
  2⤵
  PID:5380
- C:\Windows\System\bqiovnp.exe
  C:\Windows\System\bqiovnp.exe
  2⤵
  PID:5396
- C:\Windows\System\JTVZTRO.exe
  C:\Windows\System\JTVZTRO.exe
  2⤵
  PID:5828
- C:\Windows\System\lNTTmMC.exe
  C:\Windows\System\lNTTmMC.exe
  2⤵
  PID:5860
- C:\Windows\System\UAKcqxt.exe
  C:\Windows\System\UAKcqxt.exe
  2⤵
  PID:5888
- C:\Windows\System\mouwpLb.exe
  C:\Windows\System\mouwpLb.exe
  2⤵
  PID:5904
- C:\Windows\System\EwxrWtH.exe
  C:\Windows\System\EwxrWtH.exe
  2⤵
  PID:6440
- C:\Windows\System\PvyYAdV.exe
  C:\Windows\System\PvyYAdV.exe
  2⤵
  PID:6456
- C:\Windows\System\QggjBvf.exe
  C:\Windows\System\QggjBvf.exe
  2⤵
  PID:6472
- C:\Windows\System\LeRwGao.exe
  C:\Windows\System\LeRwGao.exe
  2⤵
  PID:6488
- C:\Windows\System\icgtJLu.exe
  C:\Windows\System\icgtJLu.exe
  2⤵
  PID:6504
- C:\Windows\System\LAbVgAV.exe
  C:\Windows\System\LAbVgAV.exe
  2⤵
  PID:6520
- C:\Windows\System\XCdrYpp.exe
  C:\Windows\System\XCdrYpp.exe
  2⤵
  PID:6536
- C:\Windows\System\uzNgQZV.exe
  C:\Windows\System\uzNgQZV.exe
  2⤵
  PID:6560
- C:\Windows\System\ashPXPs.exe
  C:\Windows\System\ashPXPs.exe
  2⤵
  PID:6584
- C:\Windows\System\AedBjHj.exe
  C:\Windows\System\AedBjHj.exe
  2⤵
  PID:6600
- C:\Windows\System\iwcqnGD.exe
  C:\Windows\System\iwcqnGD.exe
  2⤵
  PID:6616
- C:\Windows\System\dLzPUce.exe
  C:\Windows\System\dLzPUce.exe
  2⤵
  PID:6632
- C:\Windows\System\DZlbLEi.exe
  C:\Windows\System\DZlbLEi.exe
  2⤵
  PID:6688
- C:\Windows\System\FLEMubI.exe
  C:\Windows\System\FLEMubI.exe
  2⤵
  PID:6704
- C:\Windows\System\BJXWyLn.exe
  C:\Windows\System\BJXWyLn.exe
  2⤵
  PID:6720
- C:\Windows\System\edyjyGe.exe
  C:\Windows\System\edyjyGe.exe
  2⤵
  PID:6736
- C:\Windows\System\WVIRcjx.exe
  C:\Windows\System\WVIRcjx.exe
  2⤵
  PID:6752
- C:\Windows\System\wWNoEyJ.exe
  C:\Windows\System\wWNoEyJ.exe
  2⤵
  PID:6768
- C:\Windows\System\GMIoxhi.exe
  C:\Windows\System\GMIoxhi.exe
  2⤵
  PID:6784
- C:\Windows\System\iEFAWBL.exe
  C:\Windows\System\iEFAWBL.exe
  2⤵
  PID:6800
- C:\Windows\System\dMNRuMx.exe
  C:\Windows\System\dMNRuMx.exe
  2⤵
  PID:6816
- C:\Windows\System\HgaMvIC.exe
  C:\Windows\System\HgaMvIC.exe
  2⤵
  PID:6832
- C:\Windows\System\bDZbKwx.exe
  C:\Windows\System\bDZbKwx.exe
  2⤵
  PID:6848
- C:\Windows\System\jkGOLfR.exe
  C:\Windows\System\jkGOLfR.exe
  2⤵
  PID:6864
- C:\Windows\System\QTHdFVg.exe
  C:\Windows\System\QTHdFVg.exe
  2⤵
  PID:6880
- C:\Windows\System\wWiQDgi.exe
  C:\Windows\System\wWiQDgi.exe
  2⤵
  PID:6896
- C:\Windows\System\vjPpxPv.exe
  C:\Windows\System\vjPpxPv.exe
  2⤵
  PID:6912
- C:\Windows\System\mQpNoxV.exe
  C:\Windows\System\mQpNoxV.exe
  2⤵
  PID:6928
- C:\Windows\System\UCRGsJd.exe
  C:\Windows\System\UCRGsJd.exe
  2⤵
  PID:6944
- C:\Windows\System\wKSobHq.exe
  C:\Windows\System\wKSobHq.exe
  2⤵
  PID:6960
- C:\Windows\System\ouopCtx.exe
  C:\Windows\System\ouopCtx.exe
  2⤵
  PID:6976
- C:\Windows\System\NkXlgfA.exe
  C:\Windows\System\NkXlgfA.exe
  2⤵
  PID:6992
- C:\Windows\System\cDtqQbU.exe
  C:\Windows\System\cDtqQbU.exe
  2⤵
  PID:7008
- C:\Windows\System\JXEhoCA.exe
  C:\Windows\System\JXEhoCA.exe
  2⤵
  PID:7024
- C:\Windows\System\STXzzvk.exe
  C:\Windows\System\STXzzvk.exe
  2⤵
  PID:7040
- C:\Windows\System\ucCHxDP.exe
  C:\Windows\System\ucCHxDP.exe
  2⤵
  PID:7056
- C:\Windows\System\GPWbeHH.exe
  C:\Windows\System\GPWbeHH.exe
  2⤵
  PID:7072
- C:\Windows\System\RFbmGyO.exe
  C:\Windows\System\RFbmGyO.exe
  2⤵
  PID:7088
- C:\Windows\System\ErCQbRe.exe
  C:\Windows\System\ErCQbRe.exe
  2⤵
  PID:7104
- C:\Windows\System\lSSjCVb.exe
  C:\Windows\System\lSSjCVb.exe
  2⤵
  PID:7124
- C:\Windows\System\wDTAxxW.exe
  C:\Windows\System\wDTAxxW.exe
  2⤵
  PID:7140
- C:\Windows\System\QrRCtyZ.exe
  C:\Windows\System\QrRCtyZ.exe
  2⤵
  PID:7156
- C:\Windows\System\iIUQFXV.exe
  C:\Windows\System\iIUQFXV.exe
  2⤵
  PID:5344
- C:\Windows\System\mEVJwna.exe
  C:\Windows\System\mEVJwna.exe
  2⤵
  PID:5640
- C:\Windows\System\YHYHYkt.exe
  C:\Windows\System\YHYHYkt.exe
  2⤵
  PID:5700
- C:\Windows\System\OnkqUTr.exe
  C:\Windows\System\OnkqUTr.exe
  2⤵
  PID:5728
- C:\Windows\System\qfmsKFn.exe
  C:\Windows\System\qfmsKFn.exe
  2⤵
  PID:5748
- C:\Windows\System\PfCubqj.exe
  C:\Windows\System\PfCubqj.exe
  2⤵
  PID:5788
- C:\Windows\System\SIKCcXZ.exe
  C:\Windows\System\SIKCcXZ.exe
  2⤵
  PID:5308
- C:\Windows\System\acWUnLQ.exe
  C:\Windows\System\acWUnLQ.exe
  2⤵
  PID:5376
- C:\Windows\System\xhIFlyW.exe
  C:\Windows\System\xhIFlyW.exe
  2⤵
  PID:5416
- C:\Windows\System\rGXFOYq.exe
  C:\Windows\System\rGXFOYq.exe
  2⤵
  PID:5432
- C:\Windows\System\XLdUfvB.exe
  C:\Windows\System\XLdUfvB.exe
  2⤵
  PID:5448
- C:\Windows\System\qnmKMPE.exe
  C:\Windows\System\qnmKMPE.exe
  2⤵
  PID:5476
- C:\Windows\System\LFzJcrE.exe
  C:\Windows\System\LFzJcrE.exe
  2⤵
  PID:5500
- C:\Windows\System\RfgiUZG.exe
  C:\Windows\System\RfgiUZG.exe
  2⤵
  PID:5516
- C:\Windows\System\WxhLKvX.exe
  C:\Windows\System\WxhLKvX.exe
  2⤵
  PID:5532
- C:\Windows\System\iXcHbqz.exe
  C:\Windows\System\iXcHbqz.exe
  2⤵
  PID:5548
- C:\Windows\System\ZngyNuj.exe
  C:\Windows\System\ZngyNuj.exe
  2⤵
  PID:5564
- C:\Windows\System\dToIlMy.exe
  C:\Windows\System\dToIlMy.exe
  2⤵
  PID:5588
- C:\Windows\System\WHSyxeD.exe
  C:\Windows\System\WHSyxeD.exe
  2⤵
  PID:5608
- C:\Windows\System\IpEMIwx.exe
  C:\Windows\System\IpEMIwx.exe
  2⤵
  PID:5636
- C:\Windows\System\bOLRXve.exe
  C:\Windows\System\bOLRXve.exe
  2⤵
  PID:5660
- C:\Windows\System\XqFtZZh.exe
  C:\Windows\System\XqFtZZh.exe
  2⤵
  PID:5676
- C:\Windows\System\eAAZSEL.exe
  C:\Windows\System\eAAZSEL.exe
  2⤵
  PID:5708
- C:\Windows\System\EIgJYEC.exe
  C:\Windows\System\EIgJYEC.exe
  2⤵
  PID:5752
- C:\Windows\System\swhCQeg.exe
  C:\Windows\System\swhCQeg.exe
  2⤵
  PID:5784
- C:\Windows\System\cRYLvcL.exe
  C:\Windows\System\cRYLvcL.exe
  2⤵
  PID:5868
- C:\Windows\System\MCTTzUy.exe
  C:\Windows\System\MCTTzUy.exe
  2⤵
  PID:6428
- C:\Windows\System\xpnboXx.exe
  C:\Windows\System\xpnboXx.exe
  2⤵
  PID:2784
- C:\Windows\System\tHSZmMw.exe
  C:\Windows\System\tHSZmMw.exe
  2⤵
  PID:1888
- C:\Windows\System\ppUoNet.exe
  C:\Windows\System\ppUoNet.exe
  2⤵
  PID:6436
- C:\Windows\System\mGbzwbV.exe
  C:\Windows\System\mGbzwbV.exe
  2⤵
  PID:6496
- C:\Windows\System\RmikqrK.exe
  C:\Windows\System\RmikqrK.exe
  2⤵
  PID:1800
- C:\Windows\System\zukpTaN.exe
  C:\Windows\System\zukpTaN.exe
  2⤵
  PID:5144
- C:\Windows\System\zhUAdCp.exe
  C:\Windows\System\zhUAdCp.exe
  2⤵
  PID:6532
- C:\Windows\System\dJmJoBB.exe
  C:\Windows\System\dJmJoBB.exe
  2⤵
  PID:5324
- C:\Windows\System\aulhwDF.exe
  C:\Windows\System\aulhwDF.exe
  2⤵
  PID:5388
- C:\Windows\System\dmtjSQl.exe
  C:\Windows\System\dmtjSQl.exe
  2⤵
  PID:5896
- C:\Windows\System\RMtTzqb.exe
  C:\Windows\System\RMtTzqb.exe
  2⤵
  PID:4832
- C:\Windows\System\QyFwRMV.exe
  C:\Windows\System\QyFwRMV.exe
  2⤵
  PID:4492
- C:\Windows\System\sJVlVkP.exe
  C:\Windows\System\sJVlVkP.exe
  2⤵
  PID:2568
- C:\Windows\System\nWlnNPu.exe
  C:\Windows\System\nWlnNPu.exe
  2⤵
  PID:4896
- C:\Windows\System\mGVjruK.exe
  C:\Windows\System\mGVjruK.exe
  2⤵
  PID:2096
- C:\Windows\System\EVqzHlq.exe
  C:\Windows\System\EVqzHlq.exe
  2⤵
  PID:4428
- C:\Windows\System\IrcisTy.exe
  C:\Windows\System\IrcisTy.exe
  2⤵
  PID:1536
- C:\Windows\System\VEhWEXr.exe
  C:\Windows\System\VEhWEXr.exe
  2⤵
  PID:5112
- C:\Windows\System\LmFDIbz.exe
  C:\Windows\System\LmFDIbz.exe
  2⤵
  PID:5012
- C:\Windows\System\PdSdHpE.exe
  C:\Windows\System\PdSdHpE.exe
  2⤵
  PID:4948
- C:\Windows\System\aVaAOsx.exe
  C:\Windows\System\aVaAOsx.exe
  2⤵
  PID:4884
- C:\Windows\System\jREYzfU.exe
  C:\Windows\System\jREYzfU.exe
  2⤵
  PID:4820
- C:\Windows\System\VUGaZKa.exe
  C:\Windows\System\VUGaZKa.exe
  2⤵
  PID:4720
- C:\Windows\System\eAswrVQ.exe
  C:\Windows\System\eAswrVQ.exe
  2⤵
  PID:4604
- C:\Windows\System\NZhrQYd.exe
  C:\Windows\System\NZhrQYd.exe
  2⤵
  PID:4540
- C:\Windows\System\axXJvgi.exe
  C:\Windows\System\axXJvgi.exe
  2⤵
  PID:4476
- C:\Windows\System\hWlVYKr.exe
  C:\Windows\System\hWlVYKr.exe
  2⤵
  PID:4412
- C:\Windows\System\EvayyMD.exe
  C:\Windows\System\EvayyMD.exe
  2⤵
  PID:4348
- C:\Windows\System\eubcZEc.exe
  C:\Windows\System\eubcZEc.exe
  2⤵
  PID:4280
- C:\Windows\System\eyScFHl.exe
  C:\Windows\System\eyScFHl.exe
  2⤵
  PID:4184
- C:\Windows\System\msIBeLU.exe
  C:\Windows\System\msIBeLU.exe
  2⤵
  PID:4116
- C:\Windows\System\gpckMOL.exe
  C:\Windows\System\gpckMOL.exe
  2⤵
  PID:3396
- C:\Windows\System\rroHHTv.exe
  C:\Windows\System\rroHHTv.exe
  2⤵
  PID:3944
- C:\Windows\System\OihyvXM.exe
  C:\Windows\System\OihyvXM.exe
  2⤵
  PID:3780
- C:\Windows\System\EyXMsIN.exe
  C:\Windows\System\EyXMsIN.exe
  2⤵
  PID:3528
- C:\Windows\System\YqlYKfg.exe
  C:\Windows\System\YqlYKfg.exe
  2⤵
  PID:3304
- C:\Windows\System\YvdQkoz.exe
  C:\Windows\System\YvdQkoz.exe
  2⤵
  PID:3864
- C:\Windows\System\ycvmyaX.exe
  C:\Windows\System\ycvmyaX.exe
  2⤵
  PID:3800
- C:\Windows\System\KpvUTBL.exe
  C:\Windows\System\KpvUTBL.exe
  2⤵
  PID:3704
- C:\Windows\System\SFuKfJP.exe
  C:\Windows\System\SFuKfJP.exe
  2⤵
  PID:3640
- C:\Windows\System\FpftlvH.exe
  C:\Windows\System\FpftlvH.exe
  2⤵
  PID:3576
- C:\Windows\System\cdAUuwJ.exe
  C:\Windows\System\cdAUuwJ.exe
  2⤵
  PID:3448
- C:\Windows\System\Vukpfns.exe
  C:\Windows\System\Vukpfns.exe
  2⤵
  PID:3284
- C:\Windows\System\VAljohl.exe
  C:\Windows\System\VAljohl.exe
  2⤵
  PID:3220
- C:\Windows\System\vNySSpH.exe
  C:\Windows\System\vNySSpH.exe
  2⤵
  PID:3128
- C:\Windows\System\QjHavZJ.exe
  C:\Windows\System\QjHavZJ.exe
  2⤵
  PID:2936
- C:\Windows\System\nGHBdkW.exe
  C:\Windows\System\nGHBdkW.exe
  2⤵
  PID:864
- C:\Windows\System\gMdhINq.exe
  C:\Windows\System\gMdhINq.exe
  2⤵
  PID:5072
- C:\Windows\System\CQPFioA.exe
  C:\Windows\System\CQPFioA.exe
  2⤵
  PID:760
- C:\Windows\System\SsxlwNg.exe
  C:\Windows\System\SsxlwNg.exe
  2⤵
  PID:4696
- C:\Windows\System\JHoMKtK.exe
  C:\Windows\System\JHoMKtK.exe
  2⤵
  PID:6608
- C:\Windows\System\ZUYswqw.exe
  C:\Windows\System\ZUYswqw.exe
  2⤵
  PID:6480
- C:\Windows\System\WyXScba.exe
  C:\Windows\System\WyXScba.exe
  2⤵
  PID:6640
- C:\Windows\System\EXVRDOd.exe
  C:\Windows\System\EXVRDOd.exe
  2⤵
  PID:2692
- C:\Windows\System\OGOfIae.exe
  C:\Windows\System\OGOfIae.exe
  2⤵
  PID:6552
- C:\Windows\System\YzSEGhB.exe
  C:\Windows\System\YzSEGhB.exe
  2⤵
  PID:2476
- C:\Windows\System\PPohTlS.exe
  C:\Windows\System\PPohTlS.exe
  2⤵
  PID:6716
- C:\Windows\System\wxNYEEb.exe
  C:\Windows\System\wxNYEEb.exe
  2⤵
  PID:6776
- C:\Windows\System\ehKglSs.exe
  C:\Windows\System\ehKglSs.exe
  2⤵
  PID:6808
- C:\Windows\System\rHbWmBx.exe
  C:\Windows\System\rHbWmBx.exe
  2⤵
  PID:2560
- C:\Windows\System\WSDEvqk.exe
  C:\Windows\System\WSDEvqk.exe
  2⤵
  PID:6792
- C:\Windows\System\OSecBWg.exe
  C:\Windows\System\OSecBWg.exe
  2⤵
  PID:6872
- C:\Windows\System\MfvFkyx.exe
  C:\Windows\System\MfvFkyx.exe
  2⤵
  PID:2280
- C:\Windows\System\IksyhoR.exe
  C:\Windows\System\IksyhoR.exe
  2⤵
  PID:2672
- C:\Windows\System\ivQMVvz.exe
  C:\Windows\System\ivQMVvz.exe
  2⤵
  PID:6908
- C:\Windows\System\PleIzFU.exe
  C:\Windows\System\PleIzFU.exe
  2⤵
  PID:1496
- C:\Windows\System\JnqKUYh.exe
  C:\Windows\System\JnqKUYh.exe
  2⤵
  PID:6920
- C:\Windows\System\tnhyyjg.exe
  C:\Windows\System\tnhyyjg.exe
  2⤵
  PID:6972
- C:\Windows\System\PaVggDh.exe
  C:\Windows\System\PaVggDh.exe
  2⤵
  PID:6984
- C:\Windows\System\bMLfREo.exe
  C:\Windows\System\bMLfREo.exe
  2⤵
  PID:7016
- C:\Windows\System\EBsFaIN.exe
  C:\Windows\System\EBsFaIN.exe
  2⤵
  PID:7036
- C:\Windows\System\gdlQlhZ.exe
  C:\Windows\System\gdlQlhZ.exe
  2⤵
  PID:2000
- C:\Windows\System\fzaVDTB.exe
  C:\Windows\System\fzaVDTB.exe
  2⤵
  PID:5724
- C:\Windows\System\moiexBM.exe
  C:\Windows\System\moiexBM.exe
  2⤵
  PID:5744
- C:\Windows\System\OQXgrEI.exe
  C:\Windows\System\OQXgrEI.exe
  2⤵
  PID:7136
- C:\Windows\System\JpWLgqE.exe
  C:\Windows\System\JpWLgqE.exe
  2⤵
  PID:2064
- C:\Windows\System\VBqsexl.exe
  C:\Windows\System\VBqsexl.exe
  2⤵
  PID:5592
- C:\Windows\System\zvOZyrM.exe
  C:\Windows\System\zvOZyrM.exe
  2⤵
  PID:7052
- C:\Windows\System\dspueRL.exe
  C:\Windows\System\dspueRL.exe
  2⤵
  PID:2704
- C:\Windows\System\sqGmINK.exe
  C:\Windows\System\sqGmINK.exe
  2⤵
  PID:5408
- C:\Windows\System\ICNdOKk.exe
  C:\Windows\System\ICNdOKk.exe
  2⤵
  PID:5424
- C:\Windows\System\lmYLFNs.exe
  C:\Windows\System\lmYLFNs.exe
  2⤵
  PID:5444
- C:\Windows\System\AEaaXrF.exe
  C:\Windows\System\AEaaXrF.exe
  2⤵
  PID:5460
- C:\Windows\System\otVKeRO.exe
  C:\Windows\System\otVKeRO.exe
  2⤵
  PID:5528
- C:\Windows\System\wwXxvrh.exe
  C:\Windows\System\wwXxvrh.exe
  2⤵
  PID:5584
- C:\Windows\System\qSJjlhv.exe
  C:\Windows\System\qSJjlhv.exe
  2⤵
  PID:5656
- C:\Windows\System\cfqzuwN.exe
  C:\Windows\System\cfqzuwN.exe
  2⤵
  PID:5580
- C:\Windows\System\YSFTxYY.exe
  C:\Windows\System\YSFTxYY.exe
  2⤵
  PID:5620
- C:\Windows\System\BbDteNB.exe
  C:\Windows\System\BbDteNB.exe
  2⤵
  PID:5768
- C:\Windows\System\BcRanSE.exe
  C:\Windows\System\BcRanSE.exe
  2⤵
  PID:2240
- C:\Windows\System\uFpvPMh.exe
  C:\Windows\System\uFpvPMh.exe
  2⤵
  PID:2996
- C:\Windows\System\WZfxVgh.exe
  C:\Windows\System\WZfxVgh.exe
  2⤵
  PID:6468
- C:\Windows\System\suQEBuk.exe
  C:\Windows\System\suQEBuk.exe
  2⤵
  PID:5176
- C:\Windows\System\efdcozo.exe
  C:\Windows\System\efdcozo.exe
  2⤵
  PID:5840
- C:\Windows\System\KnHzsHS.exe
  C:\Windows\System\KnHzsHS.exe
  2⤵
  PID:5024
- C:\Windows\System\ijYqGbS.exe
  C:\Windows\System\ijYqGbS.exe
  2⤵
  PID:1684
- C:\Windows\System\YLYQIJy.exe
  C:\Windows\System\YLYQIJy.exe
  2⤵
  PID:4196
- C:\Windows\System\BmBfObZ.exe
  C:\Windows\System\BmBfObZ.exe
  2⤵
  PID:4768
- C:\Windows\System\xKlSmiH.exe
  C:\Windows\System\xKlSmiH.exe
  2⤵
  PID:4264
- C:\Windows\System\WYHPcxM.exe
  C:\Windows\System\WYHPcxM.exe
  2⤵
  PID:4916
- C:\Windows\System\QkLYawe.exe
  C:\Windows\System\QkLYawe.exe
  2⤵
  PID:4508
- C:\Windows\System\WCbwklU.exe
  C:\Windows\System\WCbwklU.exe
  2⤵
  PID:4376
- C:\Windows\System\MkuTqIT.exe
  C:\Windows\System\MkuTqIT.exe
  2⤵
  PID:4148
- C:\Windows\System\uHCDtoI.exe
  C:\Windows\System\uHCDtoI.exe
  2⤵
  PID:1992
- C:\Windows\System\XtCHXzi.exe
  C:\Windows\System\XtCHXzi.exe
  2⤵
  PID:3972
- C:\Windows\System\EowaMiY.exe
  C:\Windows\System\EowaMiY.exe
  2⤵
  PID:856
- C:\Windows\System\pqNRPGG.exe
  C:\Windows\System\pqNRPGG.exe
  2⤵
  PID:880
- C:\Windows\System\PnMEpnn.exe
  C:\Windows\System\PnMEpnn.exe
  2⤵
  PID:4084
- C:\Windows\System\svIdAhT.exe
  C:\Windows\System\svIdAhT.exe
  2⤵
  PID:3988
- C:\Windows\System\Gvyeawe.exe
  C:\Windows\System\Gvyeawe.exe
  2⤵
  PID:3108
- C:\Windows\System\tBrccZw.exe
  C:\Windows\System\tBrccZw.exe
  2⤵
  PID:3924
- C:\Windows\System\rOrPJKX.exe
  C:\Windows\System\rOrPJKX.exe
  2⤵
  PID:3832
- C:\Windows\System\mklWhSP.exe
  C:\Windows\System\mklWhSP.exe
  2⤵
  PID:3672
- C:\Windows\System\rosPbCj.exe
  C:\Windows\System\rosPbCj.exe
  2⤵
  PID:3540
- C:\Windows\System\HUbcvMa.exe
  C:\Windows\System\HUbcvMa.exe
  2⤵
  PID:3768
- C:\Windows\System\CdXAccj.exe
  C:\Windows\System\CdXAccj.exe
  2⤵
  PID:3348
- C:\Windows\System\PKkChPq.exe
  C:\Windows\System\PKkChPq.exe
  2⤵
  PID:3412
- C:\Windows\System\nNKwKhV.exe
  C:\Windows\System\nNKwKhV.exe
  2⤵
  PID:704
- C:\Windows\System\qMlOEos.exe
  C:\Windows\System\qMlOEos.exe
  2⤵
  PID:6580
- C:\Windows\System\LHkgtLK.exe
  C:\Windows\System\LHkgtLK.exe
  2⤵
  PID:6596
- C:\Windows\System\EMFdvTt.exe
  C:\Windows\System\EMFdvTt.exe
  2⤵
  PID:6780
- C:\Windows\System\CZqknbQ.exe
  C:\Windows\System\CZqknbQ.exe
  2⤵
  PID:6824
- C:\Windows\System\OMKJHBy.exe
  C:\Windows\System\OMKJHBy.exe
  2⤵
  PID:6940
- C:\Windows\System\XQSGLqS.exe
  C:\Windows\System\XQSGLqS.exe
  2⤵
  PID:7032
- C:\Windows\System\skZBpbK.exe
  C:\Windows\System\skZBpbK.exe
  2⤵
  PID:5276
- C:\Windows\System\wTnyeTh.exe
  C:\Windows\System\wTnyeTh.exe
  2⤵
  PID:3192
- C:\Windows\System\wUpnHpY.exe
  C:\Windows\System\wUpnHpY.exe
  2⤵
  PID:2204
- C:\Windows\System\VvPDGCh.exe
  C:\Windows\System\VvPDGCh.exe
  2⤵
  PID:6452
- C:\Windows\System\jBQFQrY.exe
  C:\Windows\System\jBQFQrY.exe
  2⤵
  PID:6684
- C:\Windows\System\rXXRgRv.exe
  C:\Windows\System\rXXRgRv.exe
  2⤵
  PID:2248
- C:\Windows\System\HqmtDGx.exe
  C:\Windows\System\HqmtDGx.exe
  2⤵
  PID:6856
- C:\Windows\System\LCfdpwQ.exe
  C:\Windows\System\LCfdpwQ.exe
  2⤵
  PID:6988
- C:\Windows\System\OgzjCdI.exe
  C:\Windows\System\OgzjCdI.exe
  2⤵
  PID:7100
- C:\Windows\System\DTbAfqy.exe
  C:\Windows\System\DTbAfqy.exe
  2⤵
  PID:5280
- C:\Windows\System\zLZqoAA.exe
  C:\Windows\System\zLZqoAA.exe
  2⤵
  PID:5488
- C:\Windows\System\khSeUEB.exe
  C:\Windows\System\khSeUEB.exe
  2⤵
  PID:5244
- C:\Windows\System\mHfBAoP.exe
  C:\Windows\System\mHfBAoP.exe
  2⤵
  PID:2020
- C:\Windows\System\ILJfDka.exe
  C:\Windows\System\ILJfDka.exe
  2⤵
  PID:5508
- C:\Windows\System\RIDbKFd.exe
  C:\Windows\System\RIDbKFd.exe
  2⤵
  PID:5824
- C:\Windows\System\cAnagQN.exe
  C:\Windows\System\cAnagQN.exe
  2⤵
  PID:3016
- C:\Windows\System\nRxYJBP.exe
  C:\Windows\System\nRxYJBP.exe
  2⤵
  PID:5764
- C:\Windows\System\TfjDsWQ.exe
  C:\Windows\System\TfjDsWQ.exe
  2⤵
  PID:2544
- C:\Windows\System\fQVdSwS.exe
  C:\Windows\System\fQVdSwS.exe
  2⤵
  PID:5292
- C:\Windows\System\RkjsnHf.exe
  C:\Windows\System\RkjsnHf.exe
  2⤵
  PID:4900
- C:\Windows\System\PjnWiCv.exe
  C:\Windows\System\PjnWiCv.exe
  2⤵
  PID:4328
- C:\Windows\System\bYNxBmW.exe
  C:\Windows\System\bYNxBmW.exe
  2⤵
  PID:4312
- C:\Windows\System\fPyKeBE.exe
  C:\Windows\System\fPyKeBE.exe
  2⤵
  PID:4024
- C:\Windows\System\ZsRBmGb.exe
  C:\Windows\System\ZsRBmGb.exe
  2⤵
  PID:4572
- C:\Windows\System\LETgfpN.exe
  C:\Windows\System\LETgfpN.exe
  2⤵
  PID:3508
- C:\Windows\System\sVCiNjQ.exe
  C:\Windows\System\sVCiNjQ.exe
  2⤵
  PID:3288
- C:\Windows\System\JcjkBKe.exe
  C:\Windows\System\JcjkBKe.exe
  2⤵
  PID:4852
- C:\Windows\System\QFUDvlA.exe
  C:\Windows\System\QFUDvlA.exe
  2⤵
  PID:4120
- C:\Windows\System\AHCTJHT.exe
  C:\Windows\System\AHCTJHT.exe
  2⤵
  PID:324
- C:\Windows\System\eQAZZvJ.exe
  C:\Windows\System\eQAZZvJ.exe
  2⤵
  PID:6712
- C:\Windows\System\hUAuJJj.exe
  C:\Windows\System\hUAuJJj.exe
  2⤵
  PID:3352
- C:\Windows\System\ISArVCY.exe
  C:\Windows\System\ISArVCY.exe
  2⤵
  PID:6592
- C:\Windows\System\rHXVVuE.exe
  C:\Windows\System\rHXVVuE.exe
  2⤵
  PID:968
- C:\Windows\System\uTQgYEg.exe
  C:\Windows\System\uTQgYEg.exe
  2⤵
  PID:4052
- C:\Windows\System\JxyZXhD.exe
  C:\Windows\System\JxyZXhD.exe
  2⤵
  PID:6764
- C:\Windows\System\hCSZiLK.exe
  C:\Windows\System\hCSZiLK.exe
  2⤵
  PID:7068
- C:\Windows\System\kJJpbLU.exe
  C:\Windows\System\kJJpbLU.exe
  2⤵
  PID:2532
- C:\Windows\System\yKcMQTf.exe
  C:\Windows\System\yKcMQTf.exe
  2⤵
  PID:5264
- C:\Windows\System\LMaSmzd.exe
  C:\Windows\System\LMaSmzd.exe
  2⤵
  PID:5260
- C:\Windows\System\YwiiAUW.exe
  C:\Windows\System\YwiiAUW.exe
  2⤵
  PID:5672
- C:\Windows\System\OxMBrUN.exe
  C:\Windows\System\OxMBrUN.exe
  2⤵
  PID:4584
- C:\Windows\System\RzftjVq.exe
  C:\Windows\System\RzftjVq.exe
  2⤵
  PID:4648
- C:\Windows\System\eGtKPIQ.exe
  C:\Windows\System\eGtKPIQ.exe
  2⤵
  PID:3892
- C:\Windows\System\HuxtKay.exe
  C:\Windows\System\HuxtKay.exe
  2⤵
  PID:3316
- C:\Windows\System\McpZygn.exe
  C:\Windows\System\McpZygn.exe
  2⤵
  PID:4088
- C:\Windows\System\ZPeJyem.exe
  C:\Windows\System\ZPeJyem.exe
  2⤵
  PID:5248
- C:\Windows\System\FuEfWBH.exe
  C:\Windows\System\FuEfWBH.exe
  2⤵
  PID:5544
- C:\Windows\System\gAzATVX.exe
  C:\Windows\System\gAzATVX.exe
  2⤵
  PID:5040
- C:\Windows\System\PiRrBgo.exe
  C:\Windows\System\PiRrBgo.exe
  2⤵
  PID:5688
- C:\Windows\System\PCVdXMh.exe
  C:\Windows\System\PCVdXMh.exe
  2⤵
  PID:2812
- C:\Windows\System\HOzjIis.exe
  C:\Windows\System\HOzjIis.exe
  2⤵
  PID:3736
- C:\Windows\System\DgszEyw.exe
  C:\Windows\System\DgszEyw.exe
  2⤵
  PID:3464
- C:\Windows\System\ACfgNgE.exe
  C:\Windows\System\ACfgNgE.exe
  2⤵
  PID:2656
- C:\Windows\System\lNPGJmr.exe
  C:\Windows\System\lNPGJmr.exe
  2⤵
  PID:6760
- C:\Windows\System\GNLhYGO.exe
  C:\Windows\System\GNLhYGO.exe
  2⤵
  PID:5464
- C:\Windows\System\qxijpgZ.exe
  C:\Windows\System\qxijpgZ.exe
  2⤵
  PID:3092
- C:\Windows\System\ZfLDJOW.exe
  C:\Windows\System\ZfLDJOW.exe
  2⤵
  PID:4568
- C:\Windows\System\ouHSGWk.exe
  C:\Windows\System\ouHSGWk.exe
  2⤵
  PID:1772
- C:\Windows\System\SZoAVjd.exe
  C:\Windows\System\SZoAVjd.exe
  2⤵
  PID:5776
- C:\Windows\System\bMshQcE.exe
  C:\Windows\System\bMshQcE.exe
  2⤵
  PID:7172
- C:\Windows\System\NMmdpZX.exe
  C:\Windows\System\NMmdpZX.exe
  2⤵
  PID:7188
- C:\Windows\System\tJoxiJC.exe
  C:\Windows\System\tJoxiJC.exe
  2⤵
  PID:7204
- C:\Windows\System\vfTfUvt.exe
  C:\Windows\System\vfTfUvt.exe
  2⤵
  PID:7220
- C:\Windows\System\uJNHWgY.exe
  C:\Windows\System\uJNHWgY.exe
  2⤵
  PID:7252
- C:\Windows\System\szdYaTx.exe
  C:\Windows\System\szdYaTx.exe
  2⤵
  PID:7268
- C:\Windows\System\sKAYZEJ.exe
  C:\Windows\System\sKAYZEJ.exe
  2⤵
  PID:7284
- C:\Windows\System\ifclGdy.exe
  C:\Windows\System\ifclGdy.exe
  2⤵
  PID:7300
- C:\Windows\System\DOcJSoZ.exe
  C:\Windows\System\DOcJSoZ.exe
  2⤵
  PID:7316
- C:\Windows\System\OQdJzHm.exe
  C:\Windows\System\OQdJzHm.exe
  2⤵
  PID:7332
- C:\Windows\System\YlbEnkb.exe
  C:\Windows\System\YlbEnkb.exe
  2⤵
  PID:7348
- C:\Windows\System\xWzOyel.exe
  C:\Windows\System\xWzOyel.exe
  2⤵
  PID:7364
- C:\Windows\System\MwqQhez.exe
  C:\Windows\System\MwqQhez.exe
  2⤵
  PID:7380
- C:\Windows\System\mZCvKBu.exe
  C:\Windows\System\mZCvKBu.exe
  2⤵
  PID:7396
- C:\Windows\System\BuzibYC.exe
  C:\Windows\System\BuzibYC.exe
  2⤵
  PID:7412
- C:\Windows\System\vkVqcoE.exe
  C:\Windows\System\vkVqcoE.exe
  2⤵
  PID:7492
- C:\Windows\System\aziFrlI.exe
  C:\Windows\System\aziFrlI.exe
  2⤵
  PID:7516
- C:\Windows\System\xFMFZtj.exe
  C:\Windows\System\xFMFZtj.exe
  2⤵
  PID:7540
- C:\Windows\System\TrjNlyg.exe
  C:\Windows\System\TrjNlyg.exe
  2⤵
  PID:7560
- C:\Windows\System\YRdkZJr.exe
  C:\Windows\System\YRdkZJr.exe
  2⤵
  PID:7580
- C:\Windows\System\rMgYMTI.exe
  C:\Windows\System\rMgYMTI.exe
  2⤵
  PID:7596
- C:\Windows\System\OWXqgPV.exe
  C:\Windows\System\OWXqgPV.exe
  2⤵
  PID:7612
- C:\Windows\System\txEMXzy.exe
  C:\Windows\System\txEMXzy.exe
  2⤵
  PID:7632
- C:\Windows\System\QbFIzkw.exe
  C:\Windows\System\QbFIzkw.exe
  2⤵
  PID:7648
- C:\Windows\System\oDDyWks.exe
  C:\Windows\System\oDDyWks.exe
  2⤵
  PID:7664
- C:\Windows\System\VSQAyni.exe
  C:\Windows\System\VSQAyni.exe
  2⤵
  PID:7724
- C:\Windows\System\NvgpJFI.exe
  C:\Windows\System\NvgpJFI.exe
  2⤵
  PID:7748
- C:\Windows\System\WLTdoKm.exe
  C:\Windows\System\WLTdoKm.exe
  2⤵
  PID:7764
- C:\Windows\System\lVcxXsB.exe
  C:\Windows\System\lVcxXsB.exe
  2⤵
  PID:7788
- C:\Windows\System\stVoSZZ.exe
  C:\Windows\System\stVoSZZ.exe
  2⤵
  PID:7848
- C:\Windows\System\lXDwyWH.exe
  C:\Windows\System\lXDwyWH.exe
  2⤵
  PID:7872
- C:\Windows\System\KIsIxtx.exe
  C:\Windows\System\KIsIxtx.exe
  2⤵
  PID:7896
- C:\Windows\System\chJWzxQ.exe
  C:\Windows\System\chJWzxQ.exe
  2⤵
  PID:7912
- C:\Windows\System\HLFhoKE.exe
  C:\Windows\System\HLFhoKE.exe
  2⤵
  PID:7932
- C:\Windows\System\oVutsWH.exe
  C:\Windows\System\oVutsWH.exe
  2⤵
  PID:7972
- C:\Windows\System\sQgAmIC.exe
  C:\Windows\System\sQgAmIC.exe
  2⤵
  PID:7988
- C:\Windows\System\olNNOwK.exe
  C:\Windows\System\olNNOwK.exe
  2⤵
  PID:8076
- C:\Windows\System\QIotDpI.exe
  C:\Windows\System\QIotDpI.exe
  2⤵
  PID:8092
- C:\Windows\System\oGLDGaX.exe
  C:\Windows\System\oGLDGaX.exe
  2⤵
  PID:8108
- C:\Windows\System\nWdXTKu.exe
  C:\Windows\System\nWdXTKu.exe
  2⤵
  PID:8128
- C:\Windows\System\SSqSWJb.exe
  C:\Windows\System\SSqSWJb.exe
  2⤵
  PID:8144
- C:\Windows\System\jiRJLaH.exe
  C:\Windows\System\jiRJLaH.exe
  2⤵
  PID:8160
- C:\Windows\System\vroQNkl.exe
  C:\Windows\System\vroQNkl.exe
  2⤵
  PID:8176
- C:\Windows\System\udtQaCw.exe
  C:\Windows\System\udtQaCw.exe
  2⤵
  PID:7148
- C:\Windows\System\tzIokQG.exe
  C:\Windows\System\tzIokQG.exe
  2⤵
  PID:532
- C:\Windows\System\tPakHBQ.exe
  C:\Windows\System\tPakHBQ.exe
  2⤵
  PID:7020
- C:\Windows\System\vHLyXqv.exe
  C:\Windows\System\vHLyXqv.exe
  2⤵
  PID:4456
- C:\Windows\System\mrvMxEs.exe
  C:\Windows\System\mrvMxEs.exe
  2⤵
  PID:3380
- C:\Windows\System\NiNlGfg.exe
  C:\Windows\System\NiNlGfg.exe
  2⤵
  PID:1052
- C:\Windows\System\EycyKuy.exe
  C:\Windows\System\EycyKuy.exe
  2⤵
  PID:5600
- C:\Windows\System\LniKnNR.exe
  C:\Windows\System\LniKnNR.exe
  2⤵
  PID:7228
- C:\Windows\System\HMZHoyd.exe
  C:\Windows\System\HMZHoyd.exe
  2⤵
  PID:6516
- C:\Windows\System\BUqwfsl.exe
  C:\Windows\System\BUqwfsl.exe
  2⤵
  PID:7216
- C:\Windows\System\edvJKpo.exe
  C:\Windows\System\edvJKpo.exe
  2⤵
  PID:7424
- C:\Windows\System\DTEFEhv.exe
  C:\Windows\System\DTEFEhv.exe
  2⤵
  PID:7404
- C:\Windows\System\AXrhiEe.exe
  C:\Windows\System\AXrhiEe.exe
  2⤵
  PID:7388
- C:\Windows\System\wXLZqQN.exe
  C:\Windows\System\wXLZqQN.exe
  2⤵
  PID:7408
- C:\Windows\System\WXwtWjr.exe
  C:\Windows\System\WXwtWjr.exe
  2⤵
  PID:7440
- C:\Windows\System\HqDjSVr.exe
  C:\Windows\System\HqDjSVr.exe
  2⤵
  PID:7488
- C:\Windows\System\uTKczuz.exe
  C:\Windows\System\uTKczuz.exe
  2⤵
  PID:7484
- C:\Windows\System\qAGmKoA.exe
  C:\Windows\System\qAGmKoA.exe
  2⤵
  PID:7532
- C:\Windows\System\ksgGYAu.exe
  C:\Windows\System\ksgGYAu.exe
  2⤵
  PID:7568
- C:\Windows\System\hZIMYXU.exe
  C:\Windows\System\hZIMYXU.exe
  2⤵
  PID:7576
- C:\Windows\System\oUCavWz.exe
  C:\Windows\System\oUCavWz.exe
  2⤵
  PID:7608
- C:\Windows\System\IGydHvW.exe
  C:\Windows\System\IGydHvW.exe
  2⤵
  PID:7672
- C:\Windows\System\ZrrMToT.exe
  C:\Windows\System\ZrrMToT.exe
  2⤵
  PID:7688
- C:\Windows\System\pSdVfqL.exe
  C:\Windows\System\pSdVfqL.exe
  2⤵
  PID:7704
- C:\Windows\System\xITvxMP.exe
  C:\Windows\System\xITvxMP.exe
  2⤵
  PID:7736
- C:\Windows\System\oXgzqSR.exe
  C:\Windows\System\oXgzqSR.exe
  2⤵
  PID:7744
- C:\Windows\System\hKPsCBP.exe
  C:\Windows\System\hKPsCBP.exe
  2⤵
  PID:7856
- C:\Windows\System\AIepxav.exe
  C:\Windows\System\AIepxav.exe
  2⤵
  PID:7880
- C:\Windows\System\AxvaDxu.exe
  C:\Windows\System\AxvaDxu.exe
  2⤵
  PID:7908
- C:\Windows\System\OOjZRva.exe
  C:\Windows\System\OOjZRva.exe
  2⤵
  PID:7944
- C:\Windows\System\xvKhvNH.exe
  C:\Windows\System\xvKhvNH.exe
  2⤵
  PID:7980
- C:\Windows\System\uogUGxn.exe
  C:\Windows\System\uogUGxn.exe
  2⤵
  PID:8020
- C:\Windows\System\YagMzZi.exe
  C:\Windows\System\YagMzZi.exe
  2⤵
  PID:8044
- C:\Windows\System\FoUGekt.exe
  C:\Windows\System\FoUGekt.exe
  2⤵
  PID:8064
- C:\Windows\System\vXIwuAm.exe
  C:\Windows\System\vXIwuAm.exe
  2⤵
  PID:8100
- C:\Windows\System\ibEjrnw.exe
  C:\Windows\System\ibEjrnw.exe
  2⤵
  PID:8124
- C:\Windows\System\BASucMz.exe
  C:\Windows\System\BASucMz.exe
  2⤵
  PID:8168
- C:\Windows\System\QBINVRg.exe
  C:\Windows\System\QBINVRg.exe
  2⤵
  PID:7184
- C:\Windows\System\vXdIwPN.exe
  C:\Windows\System\vXdIwPN.exe
  2⤵
  PID:8188
- C:\Windows\System\gLOshuH.exe
  C:\Windows\System\gLOshuH.exe
  2⤵
  PID:7280
- C:\Windows\System\MCNvOXR.exe
  C:\Windows\System\MCNvOXR.exe
  2⤵
  PID:8104
- C:\Windows\System\dMRKeSp.exe
  C:\Windows\System\dMRKeSp.exe
  2⤵
  PID:5440
- C:\Windows\System\rYWpSrY.exe
  C:\Windows\System\rYWpSrY.exe
  2⤵
  PID:4216
- C:\Windows\System\zdOGHcP.exe
  C:\Windows\System\zdOGHcP.exe
  2⤵
  PID:7460
- C:\Windows\System\xdFOxUf.exe
  C:\Windows\System\xdFOxUf.exe
  2⤵
  PID:7500
- C:\Windows\System\HOgXsHG.exe
  C:\Windows\System\HOgXsHG.exe
  2⤵
  PID:7536
- C:\Windows\System\vBCkwpG.exe
  C:\Windows\System\vBCkwpG.exe
  2⤵
  PID:7624
- C:\Windows\System\wKiLDfJ.exe
  C:\Windows\System\wKiLDfJ.exe
  2⤵
  PID:7772
- C:\Windows\System\zbjANBM.exe
  C:\Windows\System\zbjANBM.exe
  2⤵
  PID:7732
- C:\Windows\System\kJnIuSy.exe
  C:\Windows\System\kJnIuSy.exe
  2⤵
  PID:7776
- C:\Windows\System\arqKhLl.exe
  C:\Windows\System\arqKhLl.exe
  2⤵
  PID:7780
- C:\Windows\System\lIIKAJB.exe
  C:\Windows\System\lIIKAJB.exe
  2⤵
  PID:7808
- C:\Windows\System\GukEWda.exe
  C:\Windows\System\GukEWda.exe
  2⤵
  PID:7824
- C:\Windows\System\GdYyXPE.exe
  C:\Windows\System\GdYyXPE.exe
  2⤵
  PID:5356
- C:\Windows\System\cQQKyFr.exe
  C:\Windows\System\cQQKyFr.exe
  2⤵
  PID:7844
- C:\Windows\System\eGKvZgs.exe
  C:\Windows\System\eGKvZgs.exe
  2⤵
  PID:7940
- C:\Windows\System\NVfOySV.exe
  C:\Windows\System\NVfOySV.exe
  2⤵
  PID:8040
- C:\Windows\System\kvSvYCB.exe
  C:\Windows\System\kvSvYCB.exe
  2⤵
  PID:8156
- C:\Windows\System\NmzKtGN.exe
  C:\Windows\System\NmzKtGN.exe
  2⤵
  PID:7244
- C:\Windows\System\dYzSwco.exe
  C:\Windows\System\dYzSwco.exe
  2⤵
  PID:7292
- C:\Windows\System\wdUIVZP.exe
  C:\Windows\System\wdUIVZP.exe
  2⤵
  PID:7464
- C:\Windows\System\snIxdaP.exe
  C:\Windows\System\snIxdaP.exe
  2⤵
  PID:7696
- C:\Windows\System\liSZESJ.exe
  C:\Windows\System\liSZESJ.exe
  2⤵
  PID:7700
- C:\Windows\System\GhPVOBb.exe
  C:\Windows\System\GhPVOBb.exe
  2⤵
  PID:8036
- C:\Windows\System\SgKjVQu.exe
  C:\Windows\System\SgKjVQu.exe
  2⤵
  PID:8012
- C:\Windows\System\hBbOqBA.exe
  C:\Windows\System\hBbOqBA.exe
  2⤵
  PID:6844
- C:\Windows\System\tWTwruP.exe
  C:\Windows\System\tWTwruP.exe
  2⤵
  PID:7276
- C:\Windows\System\UqUPsEa.exe
  C:\Windows\System\UqUPsEa.exe
  2⤵
  PID:7472
- C:\Windows\System\myKWdFW.exe
  C:\Windows\System\myKWdFW.exe
  2⤵
  PID:7708
- C:\Windows\System\saciyKW.exe
  C:\Windows\System\saciyKW.exe
  2⤵
  PID:7760
- C:\Windows\System\YfvfElM.exe
  C:\Windows\System\YfvfElM.exe
  2⤵
  PID:7420
- C:\Windows\System\qDZMLjH.exe
  C:\Windows\System\qDZMLjH.exe
  2⤵
  PID:1984
- C:\Windows\System\SJEUgtz.exe
  C:\Windows\System\SJEUgtz.exe
  2⤵
  PID:8060
- C:\Windows\System\gzRkTgp.exe
  C:\Windows\System\gzRkTgp.exe
  2⤵
  PID:7804
- C:\Windows\System\LNwuZpU.exe
  C:\Windows\System\LNwuZpU.exe
  2⤵
  PID:7864
- C:\Windows\System\qnkvffG.exe
  C:\Windows\System\qnkvffG.exe
  2⤵
  PID:7312
- C:\Windows\System\sxXPcHX.exe
  C:\Windows\System\sxXPcHX.exe
  2⤵
  PID:7956
- C:\Windows\System\yrvQUVO.exe
  C:\Windows\System\yrvQUVO.exe
  2⤵
  PID:7504
- C:\Windows\System\rzuawLF.exe
  C:\Windows\System\rzuawLF.exe
  2⤵
  PID:8116
- C:\Windows\System\bjZJqOz.exe
  C:\Windows\System\bjZJqOz.exe
  2⤵
  PID:7832
- C:\Windows\System\sSeJKov.exe
  C:\Windows\System\sSeJKov.exe
  2⤵
  PID:8208
- C:\Windows\System\dxtNdEm.exe
  C:\Windows\System\dxtNdEm.exe
  2⤵
  PID:8224
- C:\Windows\System\QKjrWUe.exe
  C:\Windows\System\QKjrWUe.exe
  2⤵
  PID:8240
- C:\Windows\System\VQCmPoK.exe
  C:\Windows\System\VQCmPoK.exe
  2⤵
  PID:8256
- C:\Windows\System\JutIjKb.exe
  C:\Windows\System\JutIjKb.exe
  2⤵
  PID:8280
- C:\Windows\System\aBKtERk.exe
  C:\Windows\System\aBKtERk.exe
  2⤵
  PID:8296
- C:\Windows\System\IMoDLgk.exe
  C:\Windows\System\IMoDLgk.exe
  2⤵
  PID:8312
- C:\Windows\System\HIsysBl.exe
  C:\Windows\System\HIsysBl.exe
  2⤵
  PID:8328
- C:\Windows\System\sBUdZvu.exe
  C:\Windows\System\sBUdZvu.exe
  2⤵
  PID:8344
- C:\Windows\System\NNLGbFb.exe
  C:\Windows\System\NNLGbFb.exe
  2⤵
  PID:8360
- C:\Windows\System\buMGZNZ.exe
  C:\Windows\System\buMGZNZ.exe
  2⤵
  PID:8376
- C:\Windows\System\TZLiSIL.exe
  C:\Windows\System\TZLiSIL.exe
  2⤵
  PID:8392
- C:\Windows\System\gJDbhCI.exe
  C:\Windows\System\gJDbhCI.exe
  2⤵
  PID:8408
- C:\Windows\System\afwPkqi.exe
  C:\Windows\System\afwPkqi.exe
  2⤵
  PID:8424
- C:\Windows\System\borRRSt.exe
  C:\Windows\System\borRRSt.exe
  2⤵
  PID:8440
- C:\Windows\System\lIUSEVL.exe
  C:\Windows\System\lIUSEVL.exe
  2⤵
  PID:8456
- C:\Windows\System\xTKMvmu.exe
  C:\Windows\System\xTKMvmu.exe
  2⤵
  PID:8472
- C:\Windows\System\MrvYcSU.exe
  C:\Windows\System\MrvYcSU.exe
  2⤵
  PID:8488
- C:\Windows\System\GuAfpGp.exe
  C:\Windows\System\GuAfpGp.exe
  2⤵
  PID:8504
- C:\Windows\System\jbgbpXE.exe
  C:\Windows\System\jbgbpXE.exe
  2⤵
  PID:8520
- C:\Windows\System\OXLOOhk.exe
  C:\Windows\System\OXLOOhk.exe
  2⤵
  PID:8536
- C:\Windows\System\ULbHqLo.exe
  C:\Windows\System\ULbHqLo.exe
  2⤵
  PID:8556
- C:\Windows\System\jaiHwWR.exe
  C:\Windows\System\jaiHwWR.exe
  2⤵
  PID:8576
- C:\Windows\System\RHHaRpK.exe
  C:\Windows\System\RHHaRpK.exe
  2⤵
  PID:8592
- C:\Windows\System\uMvXfEK.exe
  C:\Windows\System\uMvXfEK.exe
  2⤵
  PID:8608
- C:\Windows\System\qWzzOyM.exe
  C:\Windows\System\qWzzOyM.exe
  2⤵
  PID:8624
- C:\Windows\System\QaEyfja.exe
  C:\Windows\System\QaEyfja.exe
  2⤵
  PID:8640
- C:\Windows\System\IpryEpl.exe
  C:\Windows\System\IpryEpl.exe
  2⤵
  PID:8656
- C:\Windows\System\kNtUIVx.exe
  C:\Windows\System\kNtUIVx.exe
  2⤵
  PID:8676
- C:\Windows\System\jeQtaNv.exe
  C:\Windows\System\jeQtaNv.exe
  2⤵
  PID:8692
- C:\Windows\System\ntEtbnA.exe
  C:\Windows\System\ntEtbnA.exe
  2⤵
  PID:8708
- C:\Windows\System\haluhPf.exe
  C:\Windows\System\haluhPf.exe
  2⤵
  PID:8724
- C:\Windows\System\hYkqJPb.exe
  C:\Windows\System\hYkqJPb.exe
  2⤵
  PID:8744
- C:\Windows\System\XMXeBFN.exe
  C:\Windows\System\XMXeBFN.exe
  2⤵
  PID:8760
- C:\Windows\System\QdEuzVR.exe
  C:\Windows\System\QdEuzVR.exe
  2⤵
  PID:8776
- C:\Windows\System\NIRTLZF.exe
  C:\Windows\System\NIRTLZF.exe
  2⤵
  PID:8792
- C:\Windows\System\dkBHQpK.exe
  C:\Windows\System\dkBHQpK.exe
  2⤵
  PID:8812
- C:\Windows\System\JdNbWQk.exe
  C:\Windows\System\JdNbWQk.exe
  2⤵
  PID:8828
- C:\Windows\System\BxUzEdv.exe
  C:\Windows\System\BxUzEdv.exe
  2⤵
  PID:8844
- C:\Windows\System\GQDLBBG.exe
  C:\Windows\System\GQDLBBG.exe
  2⤵
  PID:8860
- C:\Windows\System\OaPLFfv.exe
  C:\Windows\System\OaPLFfv.exe
  2⤵
  PID:8876
- C:\Windows\System\HEDIIxP.exe
  C:\Windows\System\HEDIIxP.exe
  2⤵
  PID:8892
- C:\Windows\System\IsogOKh.exe
  C:\Windows\System\IsogOKh.exe
  2⤵
  PID:8908
- C:\Windows\System\CvzRoHT.exe
  C:\Windows\System\CvzRoHT.exe
  2⤵
  PID:8924
- C:\Windows\System\NTfMPce.exe
  C:\Windows\System\NTfMPce.exe
  2⤵
  PID:8940
- C:\Windows\System\eQUiHqH.exe
  C:\Windows\System\eQUiHqH.exe
  2⤵
  PID:8956
- C:\Windows\System\ilTNqiB.exe
  C:\Windows\System\ilTNqiB.exe
  2⤵
  PID:8976
- C:\Windows\System\JvIwZMx.exe
  C:\Windows\System\JvIwZMx.exe
  2⤵
  PID:8992
- C:\Windows\System\jDuwzdp.exe
  C:\Windows\System\jDuwzdp.exe
  2⤵
  PID:9008
- C:\Windows\System\MBZHByA.exe
  C:\Windows\System\MBZHByA.exe
  2⤵
  PID:9024
- C:\Windows\System\GdOCBJS.exe
  C:\Windows\System\GdOCBJS.exe
  2⤵
  PID:9040
- C:\Windows\System\YXwTTGT.exe
  C:\Windows\System\YXwTTGT.exe
  2⤵
  PID:9056
- C:\Windows\System\BQVzJqO.exe
  C:\Windows\System\BQVzJqO.exe
  2⤵
  PID:9072
- C:\Windows\System\obZNUYs.exe
  C:\Windows\System\obZNUYs.exe
  2⤵
  PID:9088
- C:\Windows\System\qSOUiYL.exe
  C:\Windows\System\qSOUiYL.exe
  2⤵
  PID:9104
- C:\Windows\System\icRMSTO.exe
  C:\Windows\System\icRMSTO.exe
  2⤵
  PID:9120
- C:\Windows\System\OsZDtso.exe
  C:\Windows\System\OsZDtso.exe
  2⤵
  PID:9140
- C:\Windows\System\fIVTRUH.exe
  C:\Windows\System\fIVTRUH.exe
  2⤵
  PID:9156
- C:\Windows\System\lerwUgF.exe
  C:\Windows\System\lerwUgF.exe
  2⤵
  PID:9172
- C:\Windows\System\UCQqHQg.exe
  C:\Windows\System\UCQqHQg.exe
  2⤵
  PID:9188
- C:\Windows\System\LDjlAiV.exe
  C:\Windows\System\LDjlAiV.exe
  2⤵
  PID:9204
- C:\Windows\System\hTGJdQA.exe
  C:\Windows\System\hTGJdQA.exe
  2⤵
  PID:7740
- C:\Windows\System\fBQKbnI.exe
  C:\Windows\System\fBQKbnI.exe
  2⤵
  PID:8232
- C:\Windows\System\wqChxGr.exe
  C:\Windows\System\wqChxGr.exe
  2⤵
  PID:7296
- C:\Windows\System\aZRvres.exe
  C:\Windows\System\aZRvres.exe
  2⤵
  PID:7840
- C:\Windows\System\ntxUhFK.exe
  C:\Windows\System\ntxUhFK.exe
  2⤵
  PID:8252
- C:\Windows\System\CMcZvfn.exe
  C:\Windows\System\CMcZvfn.exe
  2⤵
  PID:8276
- C:\Windows\System\QIXHyrf.exe
  C:\Windows\System\QIXHyrf.exe
  2⤵
  PID:8340
- C:\Windows\System\GLghkvO.exe
  C:\Windows\System\GLghkvO.exe
  2⤵
  PID:8416
- C:\Windows\System\KsNEktS.exe
  C:\Windows\System\KsNEktS.exe
  2⤵
  PID:8448
- C:\Windows\System\jguVcAI.exe
  C:\Windows\System\jguVcAI.exe
  2⤵
  PID:8452
- C:\Windows\System\BeZYcnz.exe
  C:\Windows\System\BeZYcnz.exe
  2⤵
  PID:8684
- C:\Windows\System\AOskoBB.exe
  C:\Windows\System\AOskoBB.exe
  2⤵
  PID:8768
- C:\Windows\System\aNPNBEo.exe
  C:\Windows\System\aNPNBEo.exe
  2⤵
  PID:8756
- C:\Windows\System\XjCxjVo.exe
  C:\Windows\System\XjCxjVo.exe
  2⤵
  PID:8824
- C:\Windows\System\hAhSkTd.exe
  C:\Windows\System\hAhSkTd.exe
  2⤵
  PID:8852
- C:\Windows\System\kUiQsbs.exe
  C:\Windows\System\kUiQsbs.exe
  2⤵
  PID:8468
- C:\Windows\System\oAMipbW.exe
  C:\Windows\System\oAMipbW.exe
  2⤵
  PID:8500
- C:\Windows\System\zoIYbhy.exe
  C:\Windows\System\zoIYbhy.exe
  2⤵
  PID:8552
- C:\Windows\System\mhWqFrb.exe
  C:\Windows\System\mhWqFrb.exe
  2⤵
  PID:8584
- C:\Windows\System\rYSiXav.exe
  C:\Windows\System\rYSiXav.exe
  2⤵
  PID:8588
- C:\Windows\System\TdKBHOZ.exe
  C:\Windows\System\TdKBHOZ.exe
  2⤵
  PID:8620
- C:\Windows\System\GeyQrag.exe
  C:\Windows\System\GeyQrag.exe
  2⤵
  PID:8804
- C:\Windows\System\nBsToou.exe
  C:\Windows\System\nBsToou.exe
  2⤵
  PID:8784
- C:\Windows\System\bMQtVHX.exe
  C:\Windows\System\bMQtVHX.exe
  2⤵
  PID:8916
- C:\Windows\System\AyBfyot.exe
  C:\Windows\System\AyBfyot.exe
  2⤵
  PID:8900
- C:\Windows\System\sZLiVFA.exe
  C:\Windows\System\sZLiVFA.exe
  2⤵
  PID:8972
- C:\Windows\System\MxvRfeN.exe
  C:\Windows\System\MxvRfeN.exe
  2⤵
  PID:7356
- C:\Windows\System\cHfEigo.exe
  C:\Windows\System\cHfEigo.exe
  2⤵
  PID:8248
- C:\Windows\System\rPkkCTK.exe
  C:\Windows\System\rPkkCTK.exe
  2⤵
  PID:7528
- C:\Windows\System\XRMZTZx.exe
  C:\Windows\System\XRMZTZx.exe
  2⤵
  PID:3608
- C:\Windows\System\fvRfvkW.exe
  C:\Windows\System\fvRfvkW.exe
  2⤵
  PID:7920
- C:\Windows\System\XDVpkbE.exe
  C:\Windows\System\XDVpkbE.exe
  2⤵
  PID:7960
- C:\Windows\System\NPKteCF.exe
  C:\Windows\System\NPKteCF.exe
  2⤵
  PID:8404
- C:\Windows\System\vpClHlM.exe
  C:\Windows\System\vpClHlM.exe
  2⤵
  PID:8420
- C:\Windows\System\OHrfSyq.exe
  C:\Windows\System\OHrfSyq.exe
  2⤵
  PID:9220
- C:\Windows\System\QeQxEMK.exe
  C:\Windows\System\QeQxEMK.exe
  2⤵
  PID:9236
- C:\Windows\System\INjNWlm.exe
  C:\Windows\System\INjNWlm.exe
  2⤵
  PID:9256
- C:\Windows\System\kTwTcNm.exe
  C:\Windows\System\kTwTcNm.exe
  2⤵
  PID:9584
- C:\Windows\System\jqflcSm.exe
  C:\Windows\System\jqflcSm.exe
  2⤵
  PID:9600
- C:\Windows\System\IbHeHKo.exe
  C:\Windows\System\IbHeHKo.exe
  2⤵
  PID:9648
- C:\Windows\System\ZTVfHoc.exe
  C:\Windows\System\ZTVfHoc.exe
  2⤵
  PID:9664
- C:\Windows\System\lYvzLue.exe
  C:\Windows\System\lYvzLue.exe
  2⤵
  PID:9680
- C:\Windows\System\XycBgQg.exe
  C:\Windows\System\XycBgQg.exe
  2⤵
  PID:9700
- C:\Windows\System\VkOlEuu.exe
  C:\Windows\System\VkOlEuu.exe
  2⤵
  PID:9716
- C:\Windows\System\BzNZYtv.exe
  C:\Windows\System\BzNZYtv.exe
  2⤵
  PID:9736
- C:\Windows\System\UDckaJS.exe
  C:\Windows\System\UDckaJS.exe
  2⤵
  PID:9752
- C:\Windows\System\dyyzYOl.exe
  C:\Windows\System\dyyzYOl.exe
  2⤵
  PID:9768
- C:\Windows\System\YfHdPkr.exe
  C:\Windows\System\YfHdPkr.exe
  2⤵
  PID:9788
- C:\Windows\System\ixbgQMM.exe
  C:\Windows\System\ixbgQMM.exe
  2⤵
  PID:9804
- C:\Windows\System\bOQEFTH.exe
  C:\Windows\System\bOQEFTH.exe
  2⤵
  PID:9820
- C:\Windows\System\GijIAKf.exe
  C:\Windows\System\GijIAKf.exe
  2⤵
  PID:9840
- C:\Windows\System\tHLSUUM.exe
  C:\Windows\System\tHLSUUM.exe
  2⤵
  PID:9860
- C:\Windows\System\KAQxBnb.exe
  C:\Windows\System\KAQxBnb.exe
  2⤵
  PID:9880
- C:\Windows\System\oRrOzjK.exe
  C:\Windows\System\oRrOzjK.exe
  2⤵
  PID:9896
- C:\Windows\System\XuhPmFj.exe
  C:\Windows\System\XuhPmFj.exe
  2⤵
  PID:9912
- C:\Windows\System\TMocSog.exe
  C:\Windows\System\TMocSog.exe
  2⤵
  PID:9928
- C:\Windows\System\hBQaWYS.exe
  C:\Windows\System\hBQaWYS.exe
  2⤵
  PID:9948
- C:\Windows\System\QXFMWzU.exe
  C:\Windows\System\QXFMWzU.exe
  2⤵
  PID:9964
- C:\Windows\System\LaIWAeV.exe
  C:\Windows\System\LaIWAeV.exe
  2⤵
  PID:9988
- C:\Windows\System\rrxPMYC.exe
  C:\Windows\System\rrxPMYC.exe
  2⤵
  PID:10028
- C:\Windows\System\FoIOMhQ.exe
  C:\Windows\System\FoIOMhQ.exe
  2⤵
  PID:10052
- C:\Windows\System\EDQPeZm.exe
  C:\Windows\System\EDQPeZm.exe
  2⤵
  PID:10076
- C:\Windows\System\WfbwIzw.exe
  C:\Windows\System\WfbwIzw.exe
  2⤵
  PID:10092
- C:\Windows\System\FvcOJum.exe
  C:\Windows\System\FvcOJum.exe
  2⤵
  PID:10108
- C:\Windows\System\ZMrwRGp.exe
  C:\Windows\System\ZMrwRGp.exe
  2⤵
  PID:10128
- C:\Windows\System\zeCCsoV.exe
  C:\Windows\System\zeCCsoV.exe
  2⤵
  PID:10144
- C:\Windows\System\qdwHzAX.exe
  C:\Windows\System\qdwHzAX.exe
  2⤵
  PID:10160
- C:\Windows\System\SFibkZA.exe
  C:\Windows\System\SFibkZA.exe
  2⤵
  PID:10180
- C:\Windows\System\goxGDrk.exe
  C:\Windows\System\goxGDrk.exe
  2⤵
  PID:10196
- C:\Windows\System\YbkisIf.exe
  C:\Windows\System\YbkisIf.exe
  2⤵
  PID:10212
- C:\Windows\System\CApgLau.exe
  C:\Windows\System\CApgLau.exe
  2⤵
  PID:10236
- C:\Windows\System\WyMCpcb.exe
  C:\Windows\System\WyMCpcb.exe
  2⤵
  PID:8564
- C:\Windows\System\PfNQgIV.exe
  C:\Windows\System\PfNQgIV.exe
  2⤵
  PID:8632
- C:\Windows\System\MOvMedS.exe
  C:\Windows\System\MOvMedS.exe
  2⤵
  PID:8700
- C:\Windows\System\tREsjHZ.exe
  C:\Windows\System\tREsjHZ.exe
  2⤵
  PID:8888
- C:\Windows\System\KgeZeRM.exe
  C:\Windows\System\KgeZeRM.exe
  2⤵
  PID:8968
- C:\Windows\System\hPyEIZj.exe
  C:\Windows\System\hPyEIZj.exe
  2⤵
  PID:8140
- C:\Windows\System\bsymdPD.exe
  C:\Windows\System\bsymdPD.exe
  2⤵
  PID:8720
- C:\Windows\System\WiTvIrx.exe
  C:\Windows\System\WiTvIrx.exe
  2⤵
  PID:8604
- C:\Windows\System\rShoQuq.exe
  C:\Windows\System\rShoQuq.exe
  2⤵
  PID:8868
- C:\Windows\System\Sqpbeir.exe
  C:\Windows\System\Sqpbeir.exe
  2⤵
  PID:3604
- C:\Windows\System\UqhTPUh.exe
  C:\Windows\System\UqhTPUh.exe
  2⤵
  PID:7480
- C:\Windows\System\HWiTBUf.exe
  C:\Windows\System\HWiTBUf.exe
  2⤵
  PID:9232
- C:\Windows\System\GygphcQ.exe
  C:\Windows\System\GygphcQ.exe
  2⤵
  PID:9280
- C:\Windows\System\ZpYCIeJ.exe
  C:\Windows\System\ZpYCIeJ.exe
  2⤵
  PID:9300
- C:\Windows\System\CyObMlo.exe
  C:\Windows\System\CyObMlo.exe
  2⤵
  PID:9324
- C:\Windows\System\SOlLpJW.exe
  C:\Windows\System\SOlLpJW.exe
  2⤵
  PID:9340
- C:\Windows\System\WUaYJGt.exe
  C:\Windows\System\WUaYJGt.exe
  2⤵
  PID:9376
- C:\Windows\System\GKJoVEN.exe
  C:\Windows\System\GKJoVEN.exe
  2⤵
  PID:9360
- C:\Windows\System\XqBUzBM.exe
  C:\Windows\System\XqBUzBM.exe
  2⤵
  PID:9400
- C:\Windows\System\kDgNteo.exe
  C:\Windows\System\kDgNteo.exe
  2⤵
  PID:9416
- C:\Windows\System\ETebNKq.exe
  C:\Windows\System\ETebNKq.exe
  2⤵
  PID:9036
- C:\Windows\System\auOdLkl.exe
  C:\Windows\System\auOdLkl.exe
  2⤵
  PID:9432
- C:\Windows\System\GwCinRb.exe
  C:\Windows\System\GwCinRb.exe
  2⤵
  PID:9448
- C:\Windows\System\ufXHSnZ.exe
  C:\Windows\System\ufXHSnZ.exe
  2⤵
  PID:9464
- C:\Windows\System\JtySGFS.exe
  C:\Windows\System\JtySGFS.exe
  2⤵
  PID:9116
- C:\Windows\System\YwSqVJC.exe
  C:\Windows\System\YwSqVJC.exe
  2⤵
  PID:1560
- C:\Windows\System\CvpJYNj.exe
  C:\Windows\System\CvpJYNj.exe
  2⤵
  PID:7892
- C:\Windows\System\doylucQ.exe
  C:\Windows\System\doylucQ.exe
  2⤵
  PID:8356
- C:\Windows\System\IEqiTfw.exe
  C:\Windows\System\IEqiTfw.exe
  2⤵
  PID:8988
- C:\Windows\System\NFvbwVB.exe
  C:\Windows\System\NFvbwVB.exe
  2⤵
  PID:9084
- C:\Windows\System\pzHyroi.exe
  C:\Windows\System\pzHyroi.exe
  2⤵
  PID:9196
- C:\Windows\System\BecVlzu.exe
  C:\Windows\System\BecVlzu.exe
  2⤵
  PID:7868
- C:\Windows\System\xKchLAL.exe
  C:\Windows\System\xKchLAL.exe
  2⤵
  PID:8324
- C:\Windows\System\mdunQGk.exe
  C:\Windows\System\mdunQGk.exe
  2⤵
  PID:9472
- C:\Windows\System\gGOvgjH.exe
  C:\Windows\System\gGOvgjH.exe
  2⤵
  PID:9496
- C:\Windows\System\VGKXzmK.exe
  C:\Windows\System\VGKXzmK.exe
  2⤵
  PID:9520
- C:\Windows\System\BjbwlwF.exe
  C:\Windows\System\BjbwlwF.exe
  2⤵
  PID:9532
- C:\Windows\System\WtaKeOB.exe
  C:\Windows\System\WtaKeOB.exe
  2⤵
  PID:8704
- C:\Windows\System\dXpWlOT.exe
  C:\Windows\System\dXpWlOT.exe
  2⤵
  PID:9560
- C:\Windows\System\czyRamQ.exe
  C:\Windows\System\czyRamQ.exe
  2⤵
  PID:9608
- C:\Windows\System\CGudDIy.exe
  C:\Windows\System\CGudDIy.exe
  2⤵
  PID:9676
- C:\Windows\System\vUTAAtU.exe
  C:\Windows\System\vUTAAtU.exe
  2⤵
  PID:9732
- C:\Windows\System\yySOKIv.exe
  C:\Windows\System\yySOKIv.exe
  2⤵
  PID:9872
- C:\Windows\System\ItASVal.exe
  C:\Windows\System\ItASVal.exe
  2⤵
  PID:9936
- C:\Windows\System\gDiOoqG.exe
  C:\Windows\System\gDiOoqG.exe
  2⤵
  PID:9688
- C:\Windows\System\beXVaqr.exe
  C:\Windows\System\beXVaqr.exe
  2⤵
  PID:9764
- C:\Windows\System\UdurUrB.exe
  C:\Windows\System\UdurUrB.exe
  2⤵
  PID:9940
- C:\Windows\System\ihprngU.exe
  C:\Windows\System\ihprngU.exe
  2⤵
  PID:10048
- C:\Windows\System\sbYBhvp.exe
  C:\Windows\System\sbYBhvp.exe
  2⤵
  PID:9748
- C:\Windows\System\kTFUPrp.exe
  C:\Windows\System\kTFUPrp.exe
  2⤵
  PID:9812
- C:\Windows\System\EYRoOgI.exe
  C:\Windows\System\EYRoOgI.exe
  2⤵
  PID:10116
- C:\Windows\System\aUAOiAU.exe
  C:\Windows\System\aUAOiAU.exe
  2⤵
  PID:10044
- C:\Windows\System\iKGZSkF.exe
  C:\Windows\System\iKGZSkF.exe
  2⤵
  PID:8236
- C:\Windows\System\yzYNMrO.exe
  C:\Windows\System\yzYNMrO.exe
  2⤵
  PID:8984
- C:\Windows\System\lZDYaJO.exe
  C:\Windows\System\lZDYaJO.exe
  2⤵
  PID:10204
- C:\Windows\System\KXDuuiF.exe
  C:\Windows\System\KXDuuiF.exe
  2⤵
  PID:9312
- C:\Windows\System\iVgvzTB.exe
  C:\Windows\System\iVgvzTB.exe
  2⤵
  PID:8484
- C:\Windows\System\SqmQIrL.exe
  C:\Windows\System\SqmQIrL.exe
  2⤵
  PID:9296
- C:\Windows\System\RxhqSul.exe
  C:\Windows\System\RxhqSul.exe
  2⤵
  PID:10232
- C:\Windows\System\mUVaFdA.exe
  C:\Windows\System\mUVaFdA.exe
  2⤵
  PID:8436
- C:\Windows\System\SapVAQx.exe
  C:\Windows\System\SapVAQx.exe
  2⤵
  PID:9368
- C:\Windows\System\cZVbleI.exe
  C:\Windows\System\cZVbleI.exe
  2⤵
  PID:8952
- C:\Windows\System\InNTnQM.exe
  C:\Windows\System\InNTnQM.exe
  2⤵
  PID:9384
- C:\Windows\System\niqsZJf.exe
  C:\Windows\System\niqsZJf.exe
  2⤵
  PID:9004
- C:\Windows\System\NLrnQuq.exe
  C:\Windows\System\NLrnQuq.exe
  2⤵
  PID:9444
- C:\Windows\System\McopCKH.exe
  C:\Windows\System\McopCKH.exe
  2⤵
  PID:7828
- C:\Windows\System\xztxVDO.exe
  C:\Windows\System\xztxVDO.exe
  2⤵
  PID:9048
- C:\Windows\System\VUVahjP.exe
  C:\Windows\System\VUVahjP.exe
  2⤵
  PID:8200
- C:\Windows\System\sPmPXQb.exe
  C:\Windows\System\sPmPXQb.exe
  2⤵
  PID:9512
- C:\Windows\System\UdaDwFQ.exe
  C:\Windows\System\UdaDwFQ.exe
  2⤵
  PID:8400
- C:\Windows\System\VGVhqjV.exe
  C:\Windows\System\VGVhqjV.exe
  2⤵
  PID:9488
- C:\Windows\System\TWJqIbo.exe
  C:\Windows\System\TWJqIbo.exe
  2⤵
  PID:9564
- C:\Windows\System\pyRAhwf.exe
  C:\Windows\System\pyRAhwf.exe
  2⤵
  PID:9628
- C:\Windows\System\qBVWqNA.exe
  C:\Windows\System\qBVWqNA.exe
  2⤵
  PID:9596
- C:\Windows\System\LTiCEUf.exe
  C:\Windows\System\LTiCEUf.exe
  2⤵
  PID:9724
- C:\Windows\System\SIxlMUA.exe
  C:\Windows\System\SIxlMUA.exe
  2⤵
  PID:9780
- C:\Windows\System\tJdmHuQ.exe
  C:\Windows\System\tJdmHuQ.exe
  2⤵
  PID:9868
- C:\Windows\System\OgPrKWS.exe
  C:\Windows\System\OgPrKWS.exe
  2⤵
  PID:9980
- C:\Windows\System\kfIjhLD.exe
  C:\Windows\System\kfIjhLD.exe
  2⤵
  PID:9784
- C:\Windows\System\EGCuGuJ.exe
  C:\Windows\System\EGCuGuJ.exe
  2⤵
  PID:9744
- C:\Windows\System\hyriudo.exe
  C:\Windows\System\hyriudo.exe
  2⤵
  PID:8664
- C:\Windows\System\lLvAwWB.exe
  C:\Windows\System\lLvAwWB.exe
  2⤵
  PID:8820
- C:\Windows\System\lNuVPir.exe
  C:\Windows\System\lNuVPir.exe
  2⤵
  PID:9920
- C:\Windows\System\RhkHWxz.exe
  C:\Windows\System\RhkHWxz.exe
  2⤵
  PID:10064
- C:\Windows\System\VrqcjTF.exe
  C:\Windows\System\VrqcjTF.exe
  2⤵
  PID:10136
- C:\Windows\System\porteCD.exe
  C:\Windows\System\porteCD.exe
  2⤵
  PID:8668
- C:\Windows\System\nsKwllK.exe
  C:\Windows\System\nsKwllK.exe
  2⤵
  PID:8964
- C:\Windows\System\laRKbOa.exe
  C:\Windows\System\laRKbOa.exe
  2⤵
  PID:8740
- C:\Windows\System\hxGbMAq.exe
  C:\Windows\System\hxGbMAq.exe
  2⤵
  PID:9308
- C:\Windows\System\IeUdoPg.exe
  C:\Windows\System\IeUdoPg.exe
  2⤵
  PID:8652
- C:\Windows\System\McvUCBg.exe
  C:\Windows\System\McvUCBg.exe
  2⤵
  PID:10060
- C:\Windows\System\JOwWZYG.exe
  C:\Windows\System\JOwWZYG.exe
  2⤵
  PID:10012
- C:\Windows\System\lvyYAJP.exe
  C:\Windows\System\lvyYAJP.exe
  2⤵
  PID:9392
- C:\Windows\System\ELDQveq.exe
  C:\Windows\System\ELDQveq.exe
  2⤵
  PID:9288
- C:\Windows\System\cHMWvpT.exe
  C:\Windows\System\cHMWvpT.exe
  2⤵
  PID:10220
- C:\Windows\System\ddqyIFk.exe
  C:\Windows\System\ddqyIFk.exe
  2⤵
  PID:9460
- C:\Windows\System\STJTJax.exe
  C:\Windows\System\STJTJax.exe
  2⤵
  PID:8204
- C:\Windows\System\lPGytvN.exe
  C:\Windows\System\lPGytvN.exe
  2⤵
  PID:9428
- C:\Windows\System\CKqzZsj.exe
  C:\Windows\System\CKqzZsj.exe
  2⤵
  PID:9504
- C:\Windows\System\VFGgtaA.exe
  C:\Windows\System\VFGgtaA.exe
  2⤵
  PID:9484
- C:\Windows\System\KaSamUp.exe
  C:\Windows\System\KaSamUp.exe
  2⤵
  PID:9640
- C:\Windows\System\PyUSJPN.exe
  C:\Windows\System\PyUSJPN.exe
  2⤵
  PID:9624
- C:\Windows\System\vzZGHOT.exe
  C:\Windows\System\vzZGHOT.exe
  2⤵
  PID:9712
- C:\Windows\System\qPSKZDF.exe
  C:\Windows\System\qPSKZDF.exe
  2⤵
  PID:8948
- C:\Windows\System\EkmEphQ.exe
  C:\Windows\System\EkmEphQ.exe
  2⤵
  PID:10040
- C:\Windows\System\WPqlvZh.exe
  C:\Windows\System\WPqlvZh.exe
  2⤵
  PID:9660
- C:\Windows\System\lALVnvx.exe
  C:\Windows\System\lALVnvx.exe
  2⤵
  PID:9856
- C:\Windows\System\UFoJmRH.exe
  C:\Windows\System\UFoJmRH.exe
  2⤵
  PID:8516
- C:\Windows\System\BoscLXt.exe
  C:\Windows\System\BoscLXt.exe
  2⤵
  PID:9960
- C:\Windows\System\EiOmsZa.exe
  C:\Windows\System\EiOmsZa.exe
  2⤵
  PID:10036
- C:\Windows\System\MavWHml.exe
  C:\Windows\System\MavWHml.exe
  2⤵
  PID:10156
- C:\Windows\System\zJGuFMQ.exe
  C:\Windows\System\zJGuFMQ.exe
  2⤵
  PID:10016
- C:\Windows\System\IdPtZWX.exe
  C:\Windows\System\IdPtZWX.exe
  2⤵
  PID:9408
- C:\Windows\System\jaMszlP.exe
  C:\Windows\System\jaMszlP.exe
  2⤵
  PID:9276
- C:\Windows\System\QTFkUxq.exe
  C:\Windows\System\QTFkUxq.exe
  2⤵
  PID:9292
- C:\Windows\System\lTXzukb.exe
  C:\Windows\System\lTXzukb.exe
  2⤵
  PID:10176
- C:\Windows\System\VfCREqD.exe
  C:\Windows\System\VfCREqD.exe
  2⤵
  PID:8268
- C:\Windows\System\CcIjxtz.exe
  C:\Windows\System\CcIjxtz.exe
  2⤵
  PID:9248
- C:\Windows\System\GjEbWsX.exe
  C:\Windows\System\GjEbWsX.exe
  2⤵
  PID:9096
- C:\Windows\System\qZXjdCZ.exe
  C:\Windows\System\qZXjdCZ.exe
  2⤵
  PID:9556
- C:\Windows\System\rfdbasG.exe
  C:\Windows\System\rfdbasG.exe
  2⤵
  PID:9892
- C:\Windows\System\hcryWGp.exe
  C:\Windows\System\hcryWGp.exe
  2⤵
  PID:8636
- C:\Windows\System\mnvRQAX.exe
  C:\Windows\System\mnvRQAX.exe
  2⤵
  PID:10168
- C:\Windows\System\uVIbVVY.exe
  C:\Windows\System\uVIbVVY.exe
  2⤵
  PID:9508
- C:\Windows\System\oTCkPhi.exe
  C:\Windows\System\oTCkPhi.exe
  2⤵
  PID:9972
- C:\Windows\System\npxxhpe.exe
  C:\Windows\System\npxxhpe.exe
  2⤵
  PID:9184
- C:\Windows\System\lTNaWLc.exe
  C:\Windows\System\lTNaWLc.exe
  2⤵
  PID:9468
- C:\Windows\System\vuclwJi.exe
  C:\Windows\System\vuclwJi.exe
  2⤵
  PID:10068
- C:\Windows\System\TIOjIhK.exe
  C:\Windows\System\TIOjIhK.exe
  2⤵
  PID:9020
- C:\Windows\System\rkYhQSe.exe
  C:\Windows\System\rkYhQSe.exe
  2⤵
  PID:9984
- C:\Windows\System\kiaHFdF.exe
  C:\Windows\System\kiaHFdF.exe
  2⤵
  PID:9576
- C:\Windows\System\rAkumQx.exe
  C:\Windows\System\rAkumQx.exe
  2⤵
  PID:9136
- C:\Windows\System\ULonXmS.exe
  C:\Windows\System\ULonXmS.exe
  2⤵
  PID:10244
- C:\Windows\System\exmZBnQ.exe
  C:\Windows\System\exmZBnQ.exe
  2⤵
  PID:10260
- C:\Windows\System\nNeVlCY.exe
  C:\Windows\System\nNeVlCY.exe
  2⤵
  PID:10276
- C:\Windows\System\aiDGpcg.exe
  C:\Windows\System\aiDGpcg.exe
  2⤵
  PID:10292
- C:\Windows\System\GdVDUsx.exe
  C:\Windows\System\GdVDUsx.exe
  2⤵
  PID:10308
- C:\Windows\System\XcbaNig.exe
  C:\Windows\System\XcbaNig.exe
  2⤵
  PID:10324
- C:\Windows\System\JrccCse.exe
  C:\Windows\System\JrccCse.exe
  2⤵
  PID:10344
- C:\Windows\System\iepKLic.exe
  C:\Windows\System\iepKLic.exe
  2⤵
  PID:10364
- C:\Windows\System\DwAhEpZ.exe
  C:\Windows\System\DwAhEpZ.exe
  2⤵
  PID:10380
- C:\Windows\System\WxWTcou.exe
  C:\Windows\System\WxWTcou.exe
  2⤵
  PID:10396
- C:\Windows\System\nUccEff.exe
  C:\Windows\System\nUccEff.exe
  2⤵
  PID:10412
- C:\Windows\System\JgCNMxp.exe
  C:\Windows\System\JgCNMxp.exe
  2⤵
  PID:10428
- C:\Windows\System\nrwEkwB.exe
  C:\Windows\System\nrwEkwB.exe
  2⤵
  PID:10444
- C:\Windows\System\ecQQtTG.exe
  C:\Windows\System\ecQQtTG.exe
  2⤵
  PID:10460
- C:\Windows\System\eEITnvg.exe
  C:\Windows\System\eEITnvg.exe
  2⤵
  PID:10480
- C:\Windows\System\zkyfOzO.exe
  C:\Windows\System\zkyfOzO.exe
  2⤵
  PID:10500
- C:\Windows\System\zzRTIaX.exe
  C:\Windows\System\zzRTIaX.exe
  2⤵
  PID:10520
- C:\Windows\System\WYtpxZz.exe
  C:\Windows\System\WYtpxZz.exe
  2⤵
  PID:10536
- C:\Windows\System\hlNjvGl.exe
  C:\Windows\System\hlNjvGl.exe
  2⤵
  PID:10552
- C:\Windows\System\SAHixip.exe
  C:\Windows\System\SAHixip.exe
  2⤵
  PID:10568
- C:\Windows\System\ZbvrkfU.exe
  C:\Windows\System\ZbvrkfU.exe
  2⤵
  PID:10584
- C:\Windows\System\psEqpjm.exe
  C:\Windows\System\psEqpjm.exe
  2⤵
  PID:10600
- C:\Windows\System\VXpEpJm.exe
  C:\Windows\System\VXpEpJm.exe
  2⤵
  PID:10616
- C:\Windows\System\eYYvXbl.exe
  C:\Windows\System\eYYvXbl.exe
  2⤵
  PID:10632
- C:\Windows\System\TOsQBde.exe
  C:\Windows\System\TOsQBde.exe
  2⤵
  PID:10648
- C:\Windows\System\fNHpnDd.exe
  C:\Windows\System\fNHpnDd.exe
  2⤵
  PID:10664
- C:\Windows\System\DPykhNg.exe
  C:\Windows\System\DPykhNg.exe
  2⤵
  PID:10680
- C:\Windows\System\pvMVjfk.exe
  C:\Windows\System\pvMVjfk.exe
  2⤵
  PID:10696
- C:\Windows\System\JaTBDpd.exe
  C:\Windows\System\JaTBDpd.exe
  2⤵
  PID:10712
- C:\Windows\System\wzoCQLG.exe
  C:\Windows\System\wzoCQLG.exe
  2⤵
  PID:10728
- C:\Windows\System\jdmSQrA.exe
  C:\Windows\System\jdmSQrA.exe
  2⤵
  PID:10744
- C:\Windows\System\RisSeta.exe
  C:\Windows\System\RisSeta.exe
  2⤵
  PID:10760
- C:\Windows\System\FGjNujY.exe
  C:\Windows\System\FGjNujY.exe
  2⤵
  PID:10776
- C:\Windows\System\CdauFlQ.exe
  C:\Windows\System\CdauFlQ.exe
  2⤵
  PID:10792
- C:\Windows\System\OczTgQM.exe
  C:\Windows\System\OczTgQM.exe
  2⤵
  PID:10808
- C:\Windows\System\ziusxAl.exe
  C:\Windows\System\ziusxAl.exe
  2⤵
  PID:10824
- C:\Windows\System\NsuHYDL.exe
  C:\Windows\System\NsuHYDL.exe
  2⤵
  PID:10848
- C:\Windows\System\lObsiLi.exe
  C:\Windows\System\lObsiLi.exe
  2⤵
  PID:10864
- C:\Windows\System\PhhTutB.exe
  C:\Windows\System\PhhTutB.exe
  2⤵
  PID:10880
- C:\Windows\System\YKBvCTm.exe
  C:\Windows\System\YKBvCTm.exe
  2⤵
  PID:10896
- C:\Windows\System\SSAXayJ.exe
  C:\Windows\System\SSAXayJ.exe
  2⤵
  PID:10912
- C:\Windows\System\DZxeXoj.exe
  C:\Windows\System\DZxeXoj.exe
  2⤵
  PID:10928
- C:\Windows\System\WEfKGfR.exe
  C:\Windows\System\WEfKGfR.exe
  2⤵
  PID:10944
- C:\Windows\System\klzNglB.exe
  C:\Windows\System\klzNglB.exe
  2⤵
  PID:10964
- C:\Windows\System\AhblKib.exe
  C:\Windows\System\AhblKib.exe
  2⤵
  PID:10980
- C:\Windows\System\UBixWRm.exe
  C:\Windows\System\UBixWRm.exe
  2⤵
  PID:10996
- C:\Windows\System\jgQTTmW.exe
  C:\Windows\System\jgQTTmW.exe
  2⤵
  PID:11012
- C:\Windows\System\SOolGmX.exe
  C:\Windows\System\SOolGmX.exe
  2⤵
  PID:11028
- C:\Windows\System\KgzCYfV.exe
  C:\Windows\System\KgzCYfV.exe
  2⤵
  PID:11044
- C:\Windows\System\JMoIbIe.exe
  C:\Windows\System\JMoIbIe.exe
  2⤵
  PID:11060
- C:\Windows\System\cSwcalM.exe
  C:\Windows\System\cSwcalM.exe
  2⤵
  PID:11076
- C:\Windows\System\pePYtLo.exe
  C:\Windows\System\pePYtLo.exe
  2⤵
  PID:11092
- C:\Windows\System\iDuLOul.exe
  C:\Windows\System\iDuLOul.exe
  2⤵
  PID:11108
- C:\Windows\System\IuTNnof.exe
  C:\Windows\System\IuTNnof.exe
  2⤵
  PID:11124
- C:\Windows\System\PwqkEbP.exe
  C:\Windows\System\PwqkEbP.exe
  2⤵
  PID:11140
- C:\Windows\System\gtZmtzh.exe
  C:\Windows\System\gtZmtzh.exe
  2⤵
  PID:11156
- C:\Windows\System\TANpmxP.exe
  C:\Windows\System\TANpmxP.exe
  2⤵
  PID:11172
- C:\Windows\System\JfxidsL.exe
  C:\Windows\System\JfxidsL.exe
  2⤵
  PID:11188
- C:\Windows\System\aUjTwkJ.exe
  C:\Windows\System\aUjTwkJ.exe
  2⤵
  PID:11204
- C:\Windows\System\PxaIouT.exe
  C:\Windows\System\PxaIouT.exe
  2⤵
  PID:11220
- C:\Windows\System\kravdES.exe
  C:\Windows\System\kravdES.exe
  2⤵
  PID:11236
- C:\Windows\System\TynRRNU.exe
  C:\Windows\System\TynRRNU.exe
  2⤵
  PID:11252
- C:\Windows\System\XlcsOnR.exe
  C:\Windows\System\XlcsOnR.exe
  2⤵
  PID:10268
- C:\Windows\System\iBSTPVA.exe
  C:\Windows\System\iBSTPVA.exe
  2⤵
  PID:10072
- C:\Windows\System\tfopSDK.exe
  C:\Windows\System\tfopSDK.exe
  2⤵
  PID:10124
- C:\Windows\System\vLeWQZd.exe
  C:\Windows\System\vLeWQZd.exe
  2⤵
  PID:9412
- C:\Windows\System\LkVjsMj.exe
  C:\Windows\System\LkVjsMj.exe
  2⤵
  PID:9516
- C:\Windows\System\VrdBgub.exe
  C:\Windows\System\VrdBgub.exe
  2⤵
  PID:10284
- C:\Windows\System\TDpenAS.exe
  C:\Windows\System\TDpenAS.exe
  2⤵
  PID:10372
- C:\Windows\System\QsuwbpN.exe
  C:\Windows\System\QsuwbpN.exe
  2⤵
  PID:10404
- C:\Windows\System\atRiRtH.exe
  C:\Windows\System\atRiRtH.exe
  2⤵
  PID:10392
- C:\Windows\System\mZcIwLd.exe
  C:\Windows\System\mZcIwLd.exe
  2⤵
  PID:10456
- C:\Windows\System\hMcNcQb.exe
  C:\Windows\System\hMcNcQb.exe
  2⤵
  PID:10516
- C:\Windows\System\ZRencaM.exe
  C:\Windows\System\ZRencaM.exe
  2⤵
  PID:10580
- C:\Windows\System\jqScvOn.exe
  C:\Windows\System\jqScvOn.exe
  2⤵
  PID:10644
- C:\Windows\System\lZrIMMU.exe
  C:\Windows\System\lZrIMMU.exe
  2⤵
  PID:10676
- C:\Windows\System\kXSCcVx.exe
  C:\Windows\System\kXSCcVx.exe
  2⤵
  PID:10804
- C:\Windows\System\DNeieHP.exe
  C:\Windows\System\DNeieHP.exe
  2⤵
  PID:10492
- C:\Windows\System\jhCEVtv.exe
  C:\Windows\System\jhCEVtv.exe
  2⤵
  PID:10560
- C:\Windows\System\CEWJxjq.exe
  C:\Windows\System\CEWJxjq.exe
  2⤵
  PID:10596
- C:\Windows\System\qYefoIV.exe
  C:\Windows\System\qYefoIV.exe
  2⤵
  PID:10688
- C:\Windows\System\DPDVqcd.exe
  C:\Windows\System\DPDVqcd.exe
  2⤵
  PID:10936
- C:\Windows\System\QilRzzk.exe
  C:\Windows\System\QilRzzk.exe
  2⤵
  PID:10860
- C:\Windows\System\OFFYfDe.exe
  C:\Windows\System\OFFYfDe.exe
  2⤵
  PID:10892
- C:\Windows\System\NEsPpwo.exe
  C:\Windows\System\NEsPpwo.exe
  2⤵
  PID:11068
- C:\Windows\System\nXnIWvg.exe
  C:\Windows\System\nXnIWvg.exe
  2⤵
  PID:11132
- C:\Windows\System\hJoyGSL.exe
  C:\Windows\System\hJoyGSL.exe
  2⤵
  PID:11260
- C:\Windows\System\MwqLotz.exe
  C:\Windows\System\MwqLotz.exe
  2⤵
  PID:11024
- C:\Windows\System\HqBmhUG.exe
  C:\Windows\System\HqBmhUG.exe
  2⤵
  PID:11180
- C:\Windows\System\tMvisBj.exe
  C:\Windows\System\tMvisBj.exe
  2⤵
  PID:11148
- C:\Windows\System\jIPICnA.exe
  C:\Windows\System\jIPICnA.exe
  2⤵
  PID:11244
- C:\Windows\System\okeNYKy.exe
  C:\Windows\System\okeNYKy.exe
  2⤵
  PID:10300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\FYLKBkm.exe

Filesize
1.4MB

MD5
d4797d92e26c2d8ab1508ba1dc6bf39c

SHA1
d02f44b6276002b2712a685f38f423a3c1f9b77f

SHA256
6b0e4e6d942c86716a426ad2b83c875dd2d032cb29cb6ac443d032156ac8058d

SHA512
031f49d728ff2940e2956fc67c776724ffd7d92a034e235a214d847f80ba9646d72b6de9c6d5d94fdf1447d18da6ff85febf09ba7bb330be1c95b6cd2056952b

Download Submit
C:\Windows\system\FaDAhvF.exe

Filesize
1.4MB

MD5
3c4636693843ce48c5f25bcc304e30f2

SHA1
b57c31571754f9dfb29e874674264d3824acaa08

SHA256
75f61855ac3cae71aa7a741c077f9d228f1ae0f2fd2e70ad95f820223668656d

SHA512
3bead9a21014079dbf8ccd3da268a68c6cb7039546b05103969b5eedacd8309385e0d731e1d0873aee69a34d446967834817b938980c09b944f8472a1e26e7e8

Download Submit
C:\Windows\system\JCFhddi.exe

Filesize
1.4MB

MD5
793838874cacdf50f3e3935ca7e69f31

SHA1
28cd210db79e9f57f0b88e50cd3858542a49a627

SHA256
f74d02cea9ca5c4e3b92bdbadf7833cc4023e830d4c1c114b715f94cfddb5612

SHA512
0e6191ddbee8d174c8be36407322a82b6404829e5206c662a5210ce65068a4bb56f6218cb8ab3625cf604ac490804a8058dc07a060d709cd985dc6234495ddb6

Download Submit
C:\Windows\system\JDMYZBv.exe

Filesize
1.4MB

MD5
9ee707b2bd9942dcab52036cf530de37

SHA1
4a7ca41efd05e1fd5f0c144cc1a9f9f1b586ba87

SHA256
9c59e716fa1145ac6287c2fe246aec6f74f41ff51d5e73978337aff8098f905f

SHA512
98dd17feaf2b282c5ad28bbab57b480d540afb7cf70330f75793a7c0499f9d32f96ca7b9f4afdfef5aa18210ae348bdba247746c6b5b57bc4b536f0e587f5ec6

Download Submit
C:\Windows\system\ObImdWE.exe

Filesize
1.4MB

MD5
7dee6a0de6c7c0858a5b117f2c6eb01b

SHA1
4392124762e772f7b478abe4b3b3408f863f4196

SHA256
82900950f3afdf4141468bafa21e59159f758394b9025108495d95996226dec0

SHA512
469c294402241c52f49cec34fbd8b8ae5976a0cab9342c660148c18f52a5635bc448152d4d2d51e037bb39df9bfd9d90f0d58c13548a882490901723e0e5f7be

Download Submit
C:\Windows\system\WTeANsu.exe

Filesize
1.4MB

MD5
36b8c2a4b60e40ad3dd8a455bb6f5439

SHA1
0691a1698884bf452fd31341d52ee7a53d71a83b

SHA256
0df0f761361bd392e8e4c236f8acd42939fa41b84a7e59e82fde9a24ef06513d

SHA512
80d2f791c433b3be77c203eb2f9e3aa3ccb1bd57340e240b53132a1bfdb6ad9370f8b8ec4e3845cc631a87b1b108cdc4f19c913038c18f54b0aab0096a81b05f

Download Submit
C:\Windows\system\XLbOMtY.exe

Filesize
1.4MB

MD5
501d260b5e4ba50476c33929972fc823

SHA1
b3fc4cb614cda000702a467ec669b49c25dfd47d

SHA256
182234b6cbcf662ded27146008d93ec963b9bea1da12ce84134e72fc0dd81d6a

SHA512
8f642dc10f415192b657f2f5d55f6402d154814bfacbea04c407686c600b279e9f302ed0f34d8fb569f8892ea2f7f5fbae89475fee0f6325015c6c00905bf2c6

Download Submit
C:\Windows\system\XqvOFCL.exe

Filesize
1.4MB

MD5
e4623b9d5c8d1fae43bb441ba82d993f

SHA1
a659bf71e9efec14f29c4c38634f109abe19f12e

SHA256
22774a4ae757d53a032047d88bb6c42a4a10399962d5c12351570b7d6d7df1a3

SHA512
c37b491d39baa3e791821f76b253178e425a63c6ba94c19c2ffc3f19384b094832087854d39709f835dbe22e994c805b3ca23a55b30f60707406c7266326101e

Download Submit
C:\Windows\system\ZeYbbnS.exe

Filesize
1.4MB

MD5
9812cb2eb90bb45a8e4b864acbed8cc6

SHA1
ac05d40bcf7adbcb9e932b4f4d2d1ba588ce673d

SHA256
a77305fa439d8ae8018da897bbd5235726b512ef0047c92af20c9227a2c0381a

SHA512
b536a1ff9fab97b0f55e51aac7fe690ccbaf853d82fc9deec962b7942b548ac347455498601654b8959b18473d0702a1c0f32241271ff8d118c8eab004ba0adc

Download Submit
C:\Windows\system\bclMpIP.exe

Filesize
1.4MB

MD5
a14ef956ddea0e940f627f15146bed95

SHA1
27132a163703859b415afc6cea800f04f5c498f5

SHA256
f0840c126b6fbb0a5f1247a4c8c95e25b4bd8708a434ba7a74e80c12dd51c714

SHA512
9fcdf3ca606cee4d2179e877f2fb39d9a20c00f1fa627462a52f87c9bba683790a07e961f967aae08215fc9917dbde28bbd945ae55a7ebe8c75ff5eb9dd52548

Download Submit
C:\Windows\system\bhDtEMc.exe

Filesize
1.4MB

MD5
7800d990837e16b598da36fb2ee5afa5

SHA1
7d363df9c20aa54a6def8912973be1afa288f6e0

SHA256
e3ee2204397382429fd9638969e63b174715c5b9ce9459f8a39f8c15a1729361

SHA512
970ac1fbc7ed22f7ba33faeba3d7385457b65cbb86f0ddb7090e96abe40a61276b68fe5f2f35aceeb5094629c8929b0f1916c357ad843ba0977c325dfa702d75

Download Submit
C:\Windows\system\czzIViz.exe

Filesize
1.4MB

MD5
b6cfc37a3f76e9af7350a1fd396b4737

SHA1
fb6f195e5e97704784466fb289c3510fdb3c0e6e

SHA256
bb1db33ecdc4bae387b761ae8e4431bb0e9b2ae84e58d2589301026dc5410597

SHA512
8f59babfb37d049418a83cd6951d56fbc360304b86e99fec42e2bc77502db5db2e2bda8a68659496230e3419908e8a102aadec7275b4ce7bcaa4ad4f24f128df

Download Submit
C:\Windows\system\gEzRhzC.exe

Filesize
1.4MB

MD5
6efaac3336ebc0864688daac0c60ebab

SHA1
fd769af18463548ac45aa661337062670f2c5129

SHA256
fba9a0e4fa1ac44e855ca302d1366954271ac06a26b3cb5c8b305c4da2350bd2

SHA512
ed43283329ef5494c3ed2990aba96fe80bbb55b7afb86f77e44b35835968123fe58dd1869e6f06c35cbb66b5008a032dfae66263df0d886d3da079df8cd468c0

Download Submit
C:\Windows\system\jOaeHGr.exe

Filesize
1.4MB

MD5
ccf7fe61f46081750ed74c189b589cf1

SHA1
e9a2b2e88a96431c9ae5fff81c7e998673005469

SHA256
8a784fdc573877a02db17f5f89825b8fb2dccff4967ce4854f2b8ddb4bb01c76

SHA512
1a56e0aad0b5ecb5c5dbdf063a6179603370fb9216539afa53cc6e9587f0d2a1cba23398b1c231e40a1590e2944774d7217fb3ffe4ec12a9550e0d553946f702

Download Submit
C:\Windows\system\kTERTYD.exe

Filesize
1.4MB

MD5
feba57159a2380669b4b4bfed280ca28

SHA1
8a13f51f2ef71ff4946bc0d17cd825198aad2e57

SHA256
933e119bd397e70bda4c9ecf88ade4c4567657a55b5eab68723c2efd2c67df31

SHA512
1611d0c3d61086d26e1bfbb3c66bf7acc07397966a135caa541722ad79ed362d1b7f3626bfc398483f1ce504aa8e943694954b29dbfc84cd248c7ac93ebd888b

Download Submit
C:\Windows\system\kgmkNpO.exe

Filesize
1.4MB

MD5
77295fb4a856e5be4b940b853c7fd0f6

SHA1
f43fd85a23172ca46cde6acb3b42537cfc4d0489

SHA256
270f33f1e4caa9860b839ffd07f8623bce0155b06e0945352328b416d3ab4b8f

SHA512
9e3076552f65c7c3573b999b819a9c95a3cd5b2d4e90a35682daf970baffaef0875385b2be9cffe7ec5d1f30a2ebcc70d2bc3a70c8642a7ef87232ebd2dbe069

Download Submit
C:\Windows\system\pSdGBWW.exe

Filesize
1.4MB

MD5
2e85609b5c6acc27c50dcdf0b149cf6e

SHA1
41c656220a5c93985ecbf60b6b11c010c44f2841

SHA256
e752eb285494f3361549ce83f7cef44a691db9db46be90866ecea83b748d2612

SHA512
11a7cba6da837b88269e1bc335df0dba013d3a8077b96eae272bf09885dd070535c8a270ca19994ce81eabb285cdce024860e6bb497094517086f17267361e26

Download Submit
C:\Windows\system\pYIwsEs.exe

Filesize
1.4MB

MD5
e749f15a385ee049028d643acaf28774

SHA1
aa40974664d13b3bd408c801ca515cbaf266b6e2

SHA256
eb031cd5590c1eb0b55aaf8d3f159c9a4fa5bf3b6cb05a28f4dbd76943ef969f

SHA512
741365133455589af8f6f5ab3c7df192ff74a113cf562bb63cc658297f539d9ab3db34b1b0c800171a62f8f559a4039e4af0367072ec6ffd38bfc19acd68a71a

Download Submit
C:\Windows\system\pkXzDYS.exe

Filesize
1.4MB

MD5
4791d44c63b4af39ebe1504c0d599f9d

SHA1
9e746fb49e96b2defd4d902eabd32a46a4ef32e0

SHA256
72d73add7c17d4debd28813ee1a09518f97912935c208a3a43b694d7626fdc5f

SHA512
452102ff64c25211aaef499251fcf5468e412b12a7a45cd14f88dc8b2c57d92c7427312cf0b84ceb05b4d656e40b6398406d8ecc24e1419cefbe3ea805f4ad88

Download Submit
C:\Windows\system\qJZJQWY.exe

Filesize
1.4MB

MD5
c41aecd1ba24ca6a73a2a2d80281401d

SHA1
b26ffb7ad94e65618dbec697a4ac3128c3e319de

SHA256
7ad3c215edd11b97710b9e59b86c7c0b0750c643dc945e76e8e9f8ca08039bb2

SHA512
ca74554287da67dca1e7fd9eb5084da2b386a5d3d62dfe2136a6cd91b752ce945581429880e09a7c36d718a6468b5f001a1870557860b5eb241704e6adde6060

Download Submit
\Windows\system\CcfzGtY.exe

Filesize
1.4MB

MD5
ebe3cdfac3c6dd8a814c084f7351ec00

SHA1
f0b57e9dffdddd03d55ee0357283b502df729f91

SHA256
2cfc66715b3fdb30dbdc58582025aebd57aa7558c66b50281892de86cd9aa7b2

SHA512
6bd177d66b1cdd8e0d3bf14033e30a833e730bd8d9a3f3f74a235241ca0ccd4d02ca38314b4250a0e2b40df26462e6b26ea294267bfe364c52130beffced75b4

Download Submit
\Windows\system\CsDnxcc.exe

Filesize
1.4MB

MD5
9686826f79679b98a7023006d7c8c438

SHA1
34773979d50a35f42b41dffa4fa55954eb0f5dd5

SHA256
5882c5d6d9e25b3ddfa15961f4d034232248deb65e9b0fb4a3e6c27c1ab092da

SHA512
81c9407b4130335245113d7634d563329b1a0dd2bb3e6099fab39f454accb6fbfbe2650d60e58c40619cfb1fb7b49bd673ba0fc0268e1801b1e591f08ecd9620

Download Submit
\Windows\system\GZHrPWV.exe

Filesize
1.4MB

MD5
6f36c5ef4ef1f26dfdeb16dccab3bb3f

SHA1
1e6abef1ce321fad6eb94e028cb8b01ab841001b

SHA256
99eee18c15c5f18175b389e3479df2930a9199f4800cc7d67d05090a087fb160

SHA512
15ee2f3800d16012f46adfa3ab290c5231c98333a9e6801b56b28699ed53a36acd653fe0b76a01ae3747a8b3ee748a70486400c7d88bce511bcf66e248946f18

Download Submit
\Windows\system\GgNJDre.exe

Filesize
1.4MB

MD5
1a0302eff6781454cc01810ef7f74ed1

SHA1
f6fa794321898edf665f2565cdd4ac97fa23e070

SHA256
76c11ed64f5f9e7002ed93e742c52d3a0aff6a2f0834a33a4e77003770498cd3

SHA512
277b5ff02f578e9da20a8fcd1e9fa89ab20cb4ab96f4c32d4c558cf59c1e1bd6ef206526f08b0d69445f9e9abb75d099bb078aec75cd45a1b92f2f12f5ed21d4

Download Submit
\Windows\system\JhnmRZT.exe

Filesize
1.4MB

MD5
5cc5d3afca5c4567e2d5ec171edb7f5f

SHA1
8413a1b90889b8501528228a44a89c9d62c03133

SHA256
d6525a8c9f470c26f6e15784af0f84934d44ec05f496f94728ac09621ffeb11d

SHA512
db904a684c6a8a9a1ddc73ce4a858bee6c579684604ef89be4ed9e14c19fb997aa40dcc6307d2d9250edc9480fcb9dc604a6a5ee3cab53422f0bbefbe00da46d

Download Submit
\Windows\system\LJKlyJH.exe

Filesize
1.4MB

MD5
7390554e8b860d42ca24a35caa6d5fde

SHA1
b8a5103d680c21dc0a7139679d1a1f295ab13878

SHA256
e8ac55f68ed26a0e83b5f24c13d415920d7e69d6aec2e630f182346db8e1e3b4

SHA512
a800fe8fa9f384d76bbe2ad23f43a4530043f0cb70396ac6f09979850aff34900b5e1bd600f0391f35a7c922f4e741e2f1832d5ac3cf585e743e6233a42647aa

Download Submit
\Windows\system\Zeazkvm.exe

Filesize
1.4MB

MD5
4660bfff56fbf013a76b599dc8549070

SHA1
d30dba135d1be377de60d94a14a752bfb1e6e690

SHA256
6cd99ff67c564ee789e80c6bf045b67b7d8afef89ae16c231db9692e3f2c5d81

SHA512
c89f2660111190b5dc11e887c5e60477e7c5b3e3f415f164336285884eeef9897303a73d507b7720176dbcf3698773f0c7bf3bf8f1366035e8b0e700dfc1e782

Download Submit
\Windows\system\aLviwAS.exe

Filesize
1.4MB

MD5
07be69af3f00a650cf72965aff28518c

SHA1
55208e17a883eee86fd4b52e99e39118581bb987

SHA256
e7a0b128c35b8351a6076cd703e33f468a505d30af680cd3482ea3fbc7c3a340

SHA512
bd2baf24d64860dc3587c2a4d2c65bfb78107538099a4c5d0aec8997902da8c0eb91d00919343f9f08429122dca41efc1a06ba8ae6090819f0090971b8beb169

Download Submit
\Windows\system\bRGZHoF.exe

Filesize
1.4MB

MD5
c6260aa5b898efb8e947d3390f90560c

SHA1
a4aa8165135665792524bcd9dfd4eb61f86f0744

SHA256
8f0c0a1b4d100edf0348c741b0af9b85b0863aa9136957e764d341ff7e2a5c98

SHA512
0ad5496607276fce785d70f6a09e7d491960a9009bd0e1b8000a40630bf5ab4481fcaad7776bf417c2bfa9c31cb260d46aec37193ee7f7cbefaffce3c2432295

Download Submit
\Windows\system\budyNwF.exe

Filesize
1.4MB

MD5
f3a8bd47886f4deb1bfbf1fa2330ee36

SHA1
8924315bddd740db380803822fd12dca29b174b1

SHA256
cd07cbb79f7a0bf00a5adb042328f732fb70e6a133ba08fa3e2c61725c05ca53

SHA512
b648f9b6f4fe9073ea19dacff67512a9128ec9b831c291987fc9408225c8c957a3a70da1ae7579dd1d052275e45f1fec287c66d8caa1813569d67aecb2ac496a

Download Submit
\Windows\system\cRoKhIo.exe

Filesize
1.4MB

MD5
41d9c3f41847e116d6feb71e3dc3c7f9

SHA1
e2af8967e68a7cd6fd83bc3e989d7fa3f563a9a0

SHA256
36780cf0880996324ba27bec4816693740e4099f782ec44e19c77c6f90397158

SHA512
f9169b7f8eb3d46cf558103407b7a7011c35fc3f82f8e2f6612706a666f43192c78f970a671001d909fc46470065b8044570e1015741f59c60254a0339cbd1c9

Download Submit
\Windows\system\gTMsZLb.exe

Filesize
1.4MB

MD5
67174e76f6ebc5d60e03456818b789f2

SHA1
df42834fdb1398d04c55b775c7d8dc787ee0fbad

SHA256
12b3984a2e90e5579db56abb26aa4cf8e8b63251f73d61d7f14defdf8801b873

SHA512
1b67b5b563a908b9da24cd69566b3cf38d6e22ec4677e4932e1a9a33b4fa15a3378b966540239a536265ddf2061032a90d1389bf35861de7831dc0860cba6e0b

Download Submit
\Windows\system\goERqLJ.exe

Filesize
1.4MB

MD5
8ef34faf6a0d0766b45f502f1fe71ab3

SHA1
3ae33340e51092065de84bf54567996a1d8fbb77

SHA256
2ba9ed988e35bb77e908d7e6a71338aab4c58912005c7bc32dc374951f152c39

SHA512
075e15c0bba035432962566b60a92d327424105fdc703f1544e2e8771829c0d1cb1f902225d43debd0b9c7fe1fdfe4ed541b039c2d03343e0cd61a87af2d4fd7

Download Submit
\Windows\system\iIekGgh.exe

Filesize
1.4MB

MD5
ea2c18acf505951721f92ae756b174ec

SHA1
0d3091f4bec7c7eb3fe2a6cc4940c7881707d527

SHA256
a0d94500ad796ec6347309083eb776c8aa30bf1ebcfa33c2fe70240c396e4ff4

SHA512
46127afb2e69afe145464778735ad4db49b60907b01e883a01be2540f3642b78f0c6fe2c2cd91b11da74fcdf24d4e2675ef379b369a67e2778510d834135c914

Download Submit
\Windows\system\iWzQWiA.exe

Filesize
1.4MB

MD5
1cdcb6ba7c73b8df29f850f5ec7481a9

SHA1
f672eb4766f50df60458d1dec2ba333412866853

SHA256
842bf3ee366eb633df17972a98d2768b5d35ed596e4dbff38489816e3255e3ef

SHA512
f513371a4255a5b79a6ccb28df0a8d6aa76ad981cce0651a3ae84f78c49072455b9f4db187a6d4c0de293d7bee45c5c5f1e84be01d88ebc6ee256cabfd6fa3eb

Download Submit
\Windows\system\ijdIYtu.exe

Filesize
1.4MB

MD5
554c39b9ac7ce982ad45072a38b558be

SHA1
8d26c17979590d0ab3d8e4bd1cf02facd1d601e6

SHA256
75b65629435aaf666c80b1cc5041d7ca93817a8401f3f36abc20393b055b0e2d

SHA512
6d00575d77c8f7b72bf48359297ff106b822676d3e4f7c4a8d5992bc8ef88e4c74e354757140e1593bc0185879ef56ae4bd6534bd65fa158f01d6246858324b3

Download Submit
\Windows\system\osJacBv.exe

Filesize
1.4MB

MD5
1372d02268c4605e21190e9ce76d1b1c

SHA1
22663e0cd30b6086027c0778a0e20f6ffa06752f

SHA256
ef0f8d3be59c5255b0831874b717cb1dff4ea7cc785d518f4f77402d26792469

SHA512
9f5a7a0da7c01c0906126ff102de502e5c9bb2cdce6e2ca00d3d5c04fb60c8472589f29cd0b1f242aad8c978c2486360c52653813055f70e1a1b51f7c8f45110

Download Submit
\Windows\system\porLYBl.exe

Filesize
1.4MB

MD5
4b3ee868208f424afdf9b6510ad4fdb5

SHA1
119f7db6a8b3aac0a8b9cc93ee73384bf433675a

SHA256
a0e77afd12cd9c179b90c0e51f764135304d2b7338467c2fa0aeb8b3df8257f4

SHA512
df110ac9872820677cba5da470427ffaa551357fd42567f4b879ebade9f5e0bdfc34031c0540fd34c97b9a12793a1e68c12cec40f39ca6056aeb24288b09bf5b

Download Submit
\Windows\system\wJjyljd.exe

Filesize
1.4MB

MD5
ff81e322211399d08aed6ddcc6b5995b

SHA1
47ac0eb452820da181f5f00591a9d06daeb4813b

SHA256
de58f171ca7dfc2eee9a1df05fd152aad2690e0e47a0106e522ce0d632d2612f

SHA512
0ea2acc2fe09362c8d5308c5e0075950472fce3e7bb036c1ad0ef2cecc3873474ba92c3e4cf090ffb7764705726f254ce3fba852eeead59556ce05c6c9bab90b

Download Submit
\Windows\system\wQObCKW.exe

Filesize
1.4MB

MD5
5bc260b338f63dd9c7249db4e84754e6

SHA1
8baf725dc08c8db4a3fd70dbfe6320ed9946b44a

SHA256
500b95da5f7e626002e7245ebdc204df48316a3384f29d532fc6a04b2b7d4192

SHA512
a2ad4192fe0fead9b73cf51add8d2657e41132e36cc0eab6995f58c78061daa29f95be948a9d1213427ea3c11e586b8a8ceb8f3bc6e58846cd51917c3338c634

Download Submit
memory/616-80-0x000000013F9D0000-0x000000013FDC2000-memory.dmp

Filesize
3.9MB

Download
memory/616-83-0x0000000003610000-0x0000000003A02000-memory.dmp

Filesize
3.9MB

Download
memory/616-94-0x000000013F6B0000-0x000000013FAA2000-memory.dmp

Filesize
3.9MB

Download
memory/616-12032-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/616-93-0x000000013FEB0000-0x00000001402A2000-memory.dmp

Filesize
3.9MB

Download
memory/616-30-0x0000000003140000-0x0000000003532000-memory.dmp

Filesize
3.9MB

Download
memory/616-84-0x000000013FE80000-0x0000000140272000-memory.dmp

Filesize
3.9MB

Download
memory/616-12-0x000000013FAA0000-0x000000013FE92000-memory.dmp

Filesize
3.9MB

Download
memory/616-0-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/616-91-0x0000000003610000-0x0000000003A02000-memory.dmp

Filesize
3.9MB

Download
memory/616-77-0x0000000003610000-0x0000000003A02000-memory.dmp

Filesize
3.9MB

Download
memory/616-88-0x0000000003610000-0x0000000003A02000-memory.dmp

Filesize
3.9MB

Download
memory/616-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/616-90-0x0000000003610000-0x0000000003A02000-memory.dmp

Filesize
3.9MB

Download
memory/616-14-0x0000000003140000-0x0000000003532000-memory.dmp

Filesize
3.9MB

Download
memory/1624-89-0x000000013F360000-0x000000013F752000-memory.dmp

Filesize
3.9MB

Download
memory/1624-4337-0x000000013F360000-0x000000013F752000-memory.dmp

Filesize
3.9MB

Download
memory/1780-95-0x000000013F6B0000-0x000000013FAA2000-memory.dmp

Filesize
3.9MB

Download
memory/2024-41-0x000000001B650000-0x000000001B932000-memory.dmp

Filesize
2.9MB

Download
memory/2024-97-0x000007FEF5130000-0x000007FEF5ACD000-memory.dmp

Filesize
9.6MB

Download
memory/2024-42-0x00000000027E0000-0x00000000027E8000-memory.dmp

Filesize
32KB

Download
memory/2024-75-0x000007FEF5130000-0x000007FEF5ACD000-memory.dmp

Filesize
9.6MB

Download
memory/2024-82-0x000007FEF5130000-0x000007FEF5ACD000-memory.dmp

Filesize
9.6MB

Download
memory/2024-868-0x000007FEF5130000-0x000007FEF5ACD000-memory.dmp

Filesize
9.6MB

Download
memory/2024-31-0x0000000002950000-0x00000000029D0000-memory.dmp

Filesize
512KB

Download
memory/2024-32-0x000007FEF53EE000-0x000007FEF53EF000-memory.dmp

Filesize
4KB

Download
memory/2224-16-0x000000013FAA0000-0x000000013FE92000-memory.dmp

Filesize
3.9MB

Download
memory/2296-15-0x000000013F1F0000-0x000000013F5E2000-memory.dmp

Filesize
3.9MB

Download
memory/2392-4431-0x000000013F260000-0x000000013F652000-memory.dmp

Filesize
3.9MB

Download
memory/2392-92-0x000000013F260000-0x000000013F652000-memory.dmp

Filesize
3.9MB

Download
memory/2508-87-0x000000013FE80000-0x0000000140272000-memory.dmp

Filesize
3.9MB

Download
memory/2552-4335-0x000000013F5F0000-0x000000013F9E2000-memory.dmp

Filesize
3.9MB

Download
memory/2552-85-0x000000013F5F0000-0x000000013F9E2000-memory.dmp

Filesize
3.9MB

Download
memory/2604-4017-0x000000013F240000-0x000000013F632000-memory.dmp

Filesize
3.9MB

Download
memory/2604-98-0x000000013F240000-0x000000013F632000-memory.dmp

Filesize
3.9MB

Download
memory/2632-4345-0x000000013F9D0000-0x000000013FDC2000-memory.dmp

Filesize
3.9MB

Download
memory/2632-86-0x000000013F9D0000-0x000000013FDC2000-memory.dmp

Filesize
3.9MB

Download
memory/2760-29-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/2760-4373-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/2852-78-0x000000013F660000-0x000000013FA52000-memory.dmp

Filesize
3.9MB

Download